Re: [pcp] PCP mapping for 5350 and 5351 ports

["Zhangzongjian (Thomas)" <[e-mail]>]

Sorry. 
Disagreed.  Explanation refers to my last mail.

The text to be replaced:

>    o  The Suggested External Address, Protocol, and Port is already used
>       by the NAT gateway for one of its own services.  For example, TCP
>       port 80 for the NAT gateway's own configuration web pages, or UDP
>       ports 5350 and 5351, used by PCP itself.  A PCP server MUST NOT 
> ................................................^^^^^^^^^^^^^^^^^^^^^
>       create client mappings for External UDP ports 5350 or 5351.
> ......^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>

The suggested text is :

The Suggested External Address, Protocol, and Port is already used by the NAT gateway for one of its own services.  For example, TCP port 80 for the NAT gateway's own configuration web pages, or UDP ports 5350 and 5351, used by PCP itself.  A PCP server MUST NOT create client mappings for External UDP ports 5350 or 5351. If PCP server knows it's internal (from which interface the PCP request is received and private network is behind this interface) and external interfaces, and there only PCP server lies in NAT gateway, PCP server can create mappings for External UDP ports 5350 or 5351
The UDP ports 5350 or 5351 may be used by PCP client, PCP proxy, UPnP-PCP interworking, it is suggested that the UPD ports 5350 or 5351 MUST NOT be used for creating mapping as the internal UDP port.  

Regards
Thomas


> -----Original Message-----
> From: Dan Wing [mailto:[e-mail]]
> Sent: Tuesday, September 18, 2012 5:35 AM
> To: Zhangzongjian (Thomas)
> Subject: RE: [pcp] PCP mapping for 5350 and 5351 ports
> 
> I don't understand if you are agreeing with the text, or disagreeing with
> the text.
> 
> Can you explain what change you want in the text?
> 
> -d
> 
> 
> > -----Original Message-----
> > From: Zhangzongjian (Thomas) [mailto:[e-mail]]
> > Sent: Monday, September 17, 2012 12:46 AM
> > To: Dan Wing; [e-mail]
> > Subject: RE: [pcp] PCP mapping for 5350 and 5351 ports
> >
> > >    o  The Suggested External Address, Protocol, and Port is already
> > used
> > >       by the NAT gateway for one of its own services.  For example,
> > TCP
> > >       port 80 for the NAT gateway's own configuration web pages, or
> > UDP
> > >       ports 5350 and 5351, used by PCP itself.  A PCP server MUST NOT
> > > ................................................^^^^^^^^^^^^^^^^^^^^^
> > >       create client mappings for External UDP ports 5350 or 5351.
> > > ......^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> ^
> > >
> >
> > 1. Internal UPD ports  5350 or 5351 can't be used.
> >    (1) PCP client and NAT-PMP client use 5350 and 5351 for PCP or NAT-
> > PMP protocol. They will not send a PCP/NAT-PMP mapping request use UDP
> > 5350 or 5351 as internal port. Of cause PCP server can ignore this
> > since no such a request. For security we must not permit use the UDP
> > 5350 and 5351 as internal port in Mapping entry. The attacker behind
> > CGN may send a PCP or NAT-PMP map request with 5350 or 5351 as internal
> > port. If PCP server or NAT-PMP server create a mapping use the 5350 or
> > 5351 as internal UDP port, mass Data packets from public network will
> > be send PCP client or NAT-PMP client.
> >    (2) As for UPnP, UDP ports 5350 or 5351 may be used as the internal
> > port in UPnP MAP request.  UPnP-PCP interworking send the PCP request
> > with internal UDP port 5350 or 5351 to PCP server and a mapping entry
> > is created by PCP server. Data packet sent to UPnP client from remote
> > will be forward to UPnP-PCP interworking function. The data packets
> > will be discarded by UPnP-PCP interworking device.
> >
> > 2. we can specify the case that Port is already used by the NAT gateway
> > for one of its own services.
> >   PCP server usually know which interface is internal (from which
> > interface the PCP request is received and private network is behind
> > this interface) or external, such as PCP server in CGN.  That is to say
> > (1) When only PCP server in NAT gateway, PCP server only listen on UDP
> > port 5351 at internal interfaces. UDP 5350 or 5351 can be used as the
> > external port.
> > (2)When both PCP server and PCP client in NAT gateway, PCP server will
> > listen on UDP port 5351 at internal interfaces and PCP client will
> > listen on UDP port 5351 and 5350 at external interfaces. UDP 5350 or
> > 5351 can't be used as the external port.
> > (3)When PCP proxy or UPnP-PCP interworking in NAT gate way, UDP 5350 or
> > 5351 can't be used as the external port. (This out scope of draft-PCP-
> > base)
> >
> >
> >
> >
> >
> >
> >
> > > -----Original Message-----
> > > From: Dan Wing [mailto:[e-mail]]
> > > Sent: Saturday, September 15, 2012 1:41 AM
> > > To: Zhangzongjian (Thomas); [e-mail]
> > > Subject: RE: [pcp] PCP mapping for 5350 and 5351 ports
> > >
> > > > -----Original Message-----
> > > > From: [e-mail] [mailto:[e-mail]] On Behalf
> > Of
> > > > Zhangzongjian (Thomas)
> > > > Sent: Friday, September 14, 2012 1:17 AM
> > > > To: [e-mail]
> > > > Subject: [pcp] PCP mapping for 5350 and 5351 ports
> > > >
> > > > Dear all
> > > >
> > > > In charter 11.3 of draft draft-ietf-pcp-base-26, it said:
> > > >
> > > > The PCP server MUST NOT create mappings for the PCP ports
> > themselves
> > > >    (5350 and 5351), and SHOULD have a policy control to deny
> > mappings
> > > >    for other ports.  In these cases, the error NOT_AUTHORIZED
> > SHOULD
> > > be
> > > >    returned.
> > > >
> > > > We need to clarify:
> > > > 1.
> > > > What kinds port that 5350 and 5351 ports must not be used for
> > mapping?
> > > > Internal ports ,  external ports or both?
> > > >
> > > > 2.
> > > > What kinds protocol that the ports must not be used for mapping?
> > UDP
> > > > and others?
> > > >
> > > > 3.
> > > > It also seems that different scenarios have different result. Such
> > as,
> > > > PCP server knows public interfaces and private interfaces in box,
> > Only
> > > > PCP server in a box or both PCP server and PCP client.
> > >
> > > During review, this confusion was pointed out.  In -27, the above
> > > is rewritten into a much more general and clear format, and reads
> > > as follows.  I highlighted the specific text regarding the PCP
> > > ports numbers (5350, 5351), and the rest of the new text should
> > > clarify your questions (2) and (3).  If the new text is still
> > > inadequate, please let me know.
> > >
> > >
> > >    If no mapping exists for the Internal Address, Protocol, and Port,
> > >    and the PCP server is able to create a mapping using the Suggested
> > >    External Address and Port, it SHOULD do so.  This is beneficial
> > for
> > >    re-establishing state lost in the PCP server (e.g., due to a
> > reboot).
> > >    There are, however, cases where the PCP server is not able to
> > create
> > >    a new mapping using the Suggested External Address and Port:
> > >
> > >    o  The Suggested External Address, Protocol, and Port is already
> > >       assigned to another existing explicit or implicit mapping
> > (i.e.,
> > >       is already forwarding traffic to some other internal address
> > and
> > >       port).
> > >
> > >    o  The Suggested External Address, Protocol, and Port is already
> > used
> > >       by the NAT gateway for one of its own services.  For example,
> > TCP
> > >       port 80 for the NAT gateway's own configuration web pages, or
> > UDP
> > >       ports 5350 and 5351, used by PCP itself.  A PCP server MUST NOT
> > > ................................................^^^^^^^^^^^^^^^^^^^^^
> > >       create client mappings for External UDP ports 5350 or 5351.
> > > ......^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> ^
> > >
> > >    o  The Suggested External Address, Protocol, and Port is otherwise
> > >       prohibited by the PCP server's policy.
> > >
> > >    o  The Suggested External Address, Protocol, or Port is invalid
> > >       (e.g., External Address 127.0.0.1, ::1, a multicast address, or
> > >       the port is not valid for the indicated protocol).
> > >
> > >    o  The Suggested External Address does not belong to the NAT
> > gateway.
> > >
> > >    o  The Suggested External Address is not configured to be used as
> > an
> > >       external address of the firewall or NAT gateway.
> > >
> > >    If the PCP server cannot assign the Suggested External Address,
> > >    Protocol, and Port, then:
> > >
> > >    o  If the request contained the PREFER_FAILURE Option, then the
> > PCP
> > >       server MUST return CANNOT_PROVIDE_EXTERNAL.
> > >
> > >    o  If the request did not contain the PREFER_FAILURE Option, and
> > the
> > >       PCP server can assign some other External Address and Port for
> > >       that protocol, then the PCP server MUST do so and return the
> > newly
> > >       assigned External Address and Port in the response.  In no case
> > is
> > >       the client penalized for a 'poor' choice of Suggested External
> > >       Address and Port.  The Suggested External Address and Port may
> > be
> > >       used by the server to guide its choice of what External Address
> > >       and Port to assign, but in no case do they cause the server to
> > >       fail to allocate an External Address and Port where otherwise
> > it
> > >       would have succeeded.  The presence of a non-zero Suggested
> > >       External Address or Port is merely a hint; it never does any
> > harm.
> > >
> > >
> > > -d
> > >
> > >
> > > >
> > > >
> > > > Regards
> > > > Thomas
> > > >
> > > >
> > > > _______________________________________________
> > > > pcp mailing list
> > > > [e-mail]
> > > > https://www.ietf.org/mailman/listinfo/pcp