Re: [pcp] PCP mapping for 5350 and 5351 ports

["Zhangzongjian (Thomas)" <[e-mail]>]

>    o  The Suggested External Address, Protocol, and Port is already used
>       by the NAT gateway for one of its own services.  For example, TCP
>       port 80 for the NAT gateway's own configuration web pages, or UDP
>       ports 5350 and 5351, used by PCP itself.  A PCP server MUST NOT
> ................................................^^^^^^^^^^^^^^^^^^^^^
>       create client mappings for External UDP ports 5350 or 5351.
> ......^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>

1. Internal UPD ports  5350 or 5351 can't be used.
   (1) PCP client and NAT-PMP client use 5350 and 5351 for PCP or NAT-PMP protocol. They will not send a PCP/NAT-PMP mapping request use UDP 5350 or 5351 as internal port. Of cause PCP server can ignore this since no such a request. For security we must not permit use the UDP 5350 and 5351 as internal port in Mapping entry. The attacker behind CGN may send a PCP or NAT-PMP map request with 5350 or 5351 as internal port. If PCP server or NAT-PMP server create a mapping use the 5350 or 5351 as internal UDP port, mass Data packets from public network will be send PCP client or NAT-PMP client.
   (2) As for UPnP, UDP ports 5350 or 5351 may be used as the internal port in UPnP MAP request.  UPnP-PCP interworking send the PCP request with internal UDP port 5350 or 5351 to PCP server and a mapping entry is created by PCP server. Data packet sent to UPnP client from remote will be forward to UPnP-PCP interworking function. The data packets will be discarded by UPnP-PCP interworking device.

2. we can specify the case that Port is already used by the NAT gateway for one of its own services.
  PCP server usually know which interface is internal (from which interface the PCP request is received and private network is behind this interface) or external, such as PCP server in CGN.  That is to say
(1) When only PCP server in NAT gateway, PCP server only listen on UDP port 5351 at internal interfaces. UDP 5350 or 5351 can be used as the external port.
(2)When both PCP server and PCP client in NAT gateway, PCP server will listen on UDP port 5351 at internal interfaces and PCP client will listen on UDP port 5351 and 5350 at external interfaces. UDP 5350 or 5351 can't be used as the external port.
(3)When PCP proxy or UPnP-PCP interworking in NAT gate way, UDP 5350 or 5351 can't be used as the external port. (This out scope of draft-PCP-base)







> -----Original Message-----
> From: Dan Wing [mailto:[e-mail]]
> Sent: Saturday, September 15, 2012 1:41 AM
> To: Zhangzongjian (Thomas); [e-mail]
> Subject: RE: [pcp] PCP mapping for 5350 and 5351 ports
> 
> > -----Original Message-----
> > From: [e-mail] [mailto:[e-mail]] On Behalf Of
> > Zhangzongjian (Thomas)
> > Sent: Friday, September 14, 2012 1:17 AM
> > To: [e-mail]
> > Subject: [pcp] PCP mapping for 5350 and 5351 ports
> >
> > Dear all
> >
> > In charter 11.3 of draft draft-ietf-pcp-base-26, it said:
> >
> > The PCP server MUST NOT create mappings for the PCP ports themselves
> >    (5350 and 5351), and SHOULD have a policy control to deny mappings
> >    for other ports.  In these cases, the error NOT_AUTHORIZED SHOULD
> be
> >    returned.
> >
> > We need to clarify:
> > 1.
> > What kinds port that 5350 and 5351 ports must not be used for mapping?
> > Internal ports ,  external ports or both?
> >
> > 2.
> > What kinds protocol that the ports must not be used for mapping?  UDP
> > and others?
> >
> > 3.
> > It also seems that different scenarios have different result. Such as,
> > PCP server knows public interfaces and private interfaces in box,  Only
> > PCP server in a box or both PCP server and PCP client.
> 
> During review, this confusion was pointed out.  In -27, the above
> is rewritten into a much more general and clear format, and reads
> as follows.  I highlighted the specific text regarding the PCP
> ports numbers (5350, 5351), and the rest of the new text should
> clarify your questions (2) and (3).  If the new text is still
> inadequate, please let me know.
> 
> 
>    If no mapping exists for the Internal Address, Protocol, and Port,
>    and the PCP server is able to create a mapping using the Suggested
>    External Address and Port, it SHOULD do so.  This is beneficial for
>    re-establishing state lost in the PCP server (e.g., due to a reboot).
>    There are, however, cases where the PCP server is not able to create
>    a new mapping using the Suggested External Address and Port:
> 
>    o  The Suggested External Address, Protocol, and Port is already
>       assigned to another existing explicit or implicit mapping (i.e.,
>       is already forwarding traffic to some other internal address and
>       port).
> 
>    o  The Suggested External Address, Protocol, and Port is already used
>       by the NAT gateway for one of its own services.  For example, TCP
>       port 80 for the NAT gateway's own configuration web pages, or UDP
>       ports 5350 and 5351, used by PCP itself.  A PCP server MUST NOT
> ................................................^^^^^^^^^^^^^^^^^^^^^
>       create client mappings for External UDP ports 5350 or 5351.
> ......^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
>    o  The Suggested External Address, Protocol, and Port is otherwise
>       prohibited by the PCP server's policy.
> 
>    o  The Suggested External Address, Protocol, or Port is invalid
>       (e.g., External Address 127.0.0.1, ::1, a multicast address, or
>       the port is not valid for the indicated protocol).
> 
>    o  The Suggested External Address does not belong to the NAT gateway.
> 
>    o  The Suggested External Address is not configured to be used as an
>       external address of the firewall or NAT gateway.
> 
>    If the PCP server cannot assign the Suggested External Address,
>    Protocol, and Port, then:
> 
>    o  If the request contained the PREFER_FAILURE Option, then the PCP
>       server MUST return CANNOT_PROVIDE_EXTERNAL.
> 
>    o  If the request did not contain the PREFER_FAILURE Option, and the
>       PCP server can assign some other External Address and Port for
>       that protocol, then the PCP server MUST do so and return the newly
>       assigned External Address and Port in the response.  In no case is
>       the client penalized for a 'poor' choice of Suggested External
>       Address and Port.  The Suggested External Address and Port may be
>       used by the server to guide its choice of what External Address
>       and Port to assign, but in no case do they cause the server to
>       fail to allocate an External Address and Port where otherwise it
>       would have succeeded.  The presence of a non-zero Suggested
>       External Address or Port is merely a hint; it never does any harm.
> 
> 
> -d
> 
> 
> >
> >
> > Regards
> > Thomas
> >
> >
> > _______________________________________________
> > pcp mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/pcp