Re: [pcp] I-D Action: draft-ietf-pcp-authentication-04.txt

["Tirumaleswar Reddy (tireddy)" <[e-mail]>]

Hi Dacheng,

Responding to the only ones which needs further discussion.

> >
> > [12] I think a section is required to explain how PCP authentication
> > works in the presence of PCP proxies ?
> >         In specific explain what happens when PCP proxy and PCP server
> > are involved in re-authentication while PCP clients are sending PCP
> requests.
> >
> [Dacheng Zhang:]
> How about the following text?
> 
> " During a re-authentication procedure between a PCP server and a PCP
> proxy, the proxy SHOULD discard the mapping creation requests from its PCP

It could be any PCP request (not just specific to mapping creation request)

> clients if the PCP proxy does not already have a valid active mapping for this
> mapping-creation request. Because PCP clients are responsible for reliable
> delivery of PCP request messages, it will resend the requests. Then, after the
> re-authentication finishes, the requests will be processed. "

The other variation is that in case of re-authentication b/w PCP proxy and PCP server, PCP proxy can use current SA to proxy the PCP request from the client and does not have to discard 
PCP messages. 

-Tiru

> 
> > Cheers,
> > -Tiru
> >
> > > -----Original Message-----
> > > From: Dacheng Zhang [mailto:[e-mail]]
> > > Sent: Monday, July 21, 2014 8:35 PM
> > > To: [e-mail]
> > > Subject: [pcp] I-D Action: draft-ietf-pcp-authentication-04.txt
> > >
> > > Hi, in this version of the document, we try to address the comments
> > > got since the last meeting.  Particularly, we:
> > >    o  Refine the retransmission policies.
> > >
> > >    o  Provide the discussion about how to instruct a PCP client to
> > >       choose proper credential during authenticaiton, and an ID
> > >       Indication Option is defined for that purpose.
> > > In addition, it is advised that we should remove the key ID from the
> > > PCP authentication message, and only use one key for a PCP session.
> > > However, this indicates we will use the MSK to generate MACs for PCP
> > message directly.
> > > We would like to check with the group again before including it into
> > > the document.
> > >
> > > Any comments and suggestions are appreciated.
> > >
> > > Cheers
> > >
> > > Dacheng
> > >
> > >
> > > >
> > > > A New Internet-Draft is available from the on-line Internet-Drafts
> > > directories.
> > > > This draft is a work item of the Port Control Protocol Working
> > > > Group of the
> > > IETF.
> > > >
> > > >        Title           : Port Control Protocol (PCP) Authentication
> > Mechanism
> > > >        Authors         : Margaret Wasserman
> > > >                          Sam Hartman
> > > >                          Dacheng Zhang
> > > > 	Filename        : draft-ietf-pcp-authentication-04.txt
> > > > 	Pages           : 24
> > > > 	Date            : 2014-07-21
> > > >
> > > > Abstract:
> > > >   An IPv4 or IPv6 host can use the Port Control Protocol (PCP) to
> > > >   flexibly manage the IP address and port mapping information on
> > > >   Network Address Translators (NATs) or firewalls, to facilitate
> > > >   communications with remote hosts.  However, the un-controlled
> > > >   generation or deletion of IP address mappings on such network
> devices
> > > >   may cause security risks and should be avoided.  In some cases the
> > > >   client may need to prove that it is authorized to modify, create or
> > > >   delete PCP mappings.  This document proposes an in-band
> > > >   authentication mechanism for PCP that can be used in those cases.
> > > >   The Extensible Authentication Protocol (EAP) is used to perform
> > > >   authentication between PCP devices.
> > > >
> > > >
> > > > The IETF datatracker status page for this draft is:
> > > > https://datatracker.ietf.org/doc/draft-ietf-pcp-authentication/
> > > >
> > > > There's also a htmlized version available at:
> > > > http://tools.ietf.org/html/draft-ietf-pcp-authentication-04
> > > >
> > > > A diff from the previous version is available at:
> > > > http://www.ietf.org/rfcdiff?url2=draft-ietf-pcp-authentication-04
> > > >
> > > >
> > > > Please note that it may take a couple of minutes from the time of
> > > > submission until the htmlized version and diff are available at
> tools.ietf.org.
> > > >
> > > > Internet-Drafts are also available by anonymous FTP at:
> > > > ftp://ftp.ietf.org/internet-drafts/
> > > >
> > > > _______________________________________________
> > > > pcp mailing list
> > > > [e-mail]
> > > > https://www.ietf.org/mailman/listinfo/pcp
> > > >
> > >
> >
> > _______________________________________________
> > pcp mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/pcp