Re: [pcp] Problem with nonce checking

[Simon Perreault <[e-mail]>]

Le 2013-06-05 04:29, Dan Wing a écrit :
>> 1) make it easier for the client to retrieve the existing mapping (but
>> not learn the nonce).
>> We'd need to do security analysis of that but I think it's OK.
>
> I like that approach to retrieve the existing mapping.  Seems that solves Stuart's case without adding new burden for storing state on the client.

What if, when the server receives a MAP request matching an 
already-mapped internal port but with the wrong nonce, instead of 
returning NOT_AUTHORIZED, it would send a success response containing 
the external address+port, remaining lifetime, and a dummy nonce? I 
can't see anything that would break.

Seems like we don't need a different opcode at all to make this use case 
work. And one round-trip saved.

(But seriously the client should just remember nonces across reboots.)

Simon