[v6ops] Re: Traffic control protocols (PCP and UPnP IGD)

["Kawashima Masanobu(川島 正伸)" <[e-mail]>]

Hi Ole, 

I agree with you. 

If we consider that the IPv6 CE router acts as a firewall, we should consider 
not only RFC 6887 but also RFC 7652. 
When CE router acts as a firewall, security consideration is also important. 

Just FYI, UPnP IGDv2 also has security mechanism that is called 'DeviceProtection'. 

There is a choice of firewall control protocol, NAT-PMP, UPnP, PCP, etc. 
IMHO, CSA Matter is the appropriate protocol for the future. 
If we use Matter, Node to Node messages are secured, authenticated, 
and provide replay protection, etc. 
However, the problem is that we need to join CSA membership if we want to 
implement Matter spec. 

Regards, 
Masanobu 

======================== 
 NEC Platforms, Ltd.                  
 KAWASHIMA Masanobu              
 [e-mail]          
 https://www.necplatforms.co.jp/en/    
========================



> -----Original Message-----
> From: Ole Troan <otroan=[e-mail]>
> Sent: Friday, July 26, 2024 7:36 PM
> To: "Kawashima Masanobu(川島　正伸)"
> <kawashimam=[e-mail]>
> Cc: [e-mail]
> Subject: [v6ops] Re: Traffic control protocols (PCP and UPnP IGD)
> 
> If there is a desire that the IPv6 CE router acts as a firewall, just requiring PCP
> RFC6887 may not be enough.
> At least RFC6887 opens up quite a few security trust issues. At least if we have to
> deal with the threat that an inside client is not under the control of the party
> interested in security.
> Then something like RFC7652 would be required.
> (Which leads one to wonder if it isn’t simpler to configure this through a UI on the
> IPv6 CE router instead of a through a protocol…)
> 
> Ole
> 
> > On 26 Jul 2024, at 03:34, Kawashima Masanobu(川島　正伸)
> <kawashimam=[e-mail]> wrote:
> >
> >  It’s clear now. Thank you.  Regards, Masanobu   From: Ted Lemon
> <[e-mail]>
> > Sent: Friday, July 26, 2024 10:12 AM
> > To: Kawashima Masanobu(川島　正伸) <[e-mail]>
> > Cc: [e-mail]
> > Subject: Re: [v6ops] Re: Traffic control protocols (PCP and UPnP IGD)
> > I think it should be fine to do that, yes.
> >  Op do 25 jul 2024 om 17:15 schreef Kawashima Masanobu(川島　正伸)
> > <[e-mail]>
> >
> > Ted,
> >
> > Thank you for your reply.  It’s almost clear now. :-)
> >
> > How about RFC 6970((UPnP IGD-PCP IWF)?
> > It is ‘Standard Track’. Should we mention something? Regards, Masanobu
> ========================  NEC Platforms, Ltd.
> KAWASHIMA Masanobu               [e-mail]
> https://www.necplatforms.co.jp/en/    ========================
> >    From: Ted Lemon <[e-mail]>
> > Sent: Friday, July 26, 2024 8:59 AM
> > To: Kawashima Masanobu(川島　正伸) <[e-mail]>
> > Cc: [e-mail]
> > Subject: Re: [v6ops] Re: Traffic control protocols (PCP and UPnP IGD)
> > As a router vendor, you have more than one set of requirements you need to
> satisfy. Nobody's saying "don't do uPNP." We're saying "do PCP." We're saying "the
> IETF is not asking you to do uPNP," not "the IETF is telling you not to do uPNP."
> >  On Thu, Jul 25, 2024 at 4:50 PM Kawashima Masanobu(川島　正伸)
> <kawashimam=[e-mail]> wrote:
> >
> > Hi all,
> >
> > > In today’s v6ops meeting there was mention of UPnP. Having a way for
> > > client devices to signal to network infrastructure what traffic they
> > > want to receive is a good idea. However, doing that using the UPnP
> > > IGD protocol would be a disastrously bad idea.
> >
> > I agree with having a way for client devices to signal to network infrastructure.
> > However, I'm still not sure UPnP IGD is bad idea.
> >
> > As you may know, Broadband Forum has released TR-124 issue 9 on July 2024.
> > https://rg-device-requirements.broadband-forum.org/index.htm
> >
> > Related parts are as follows.
> >
> > [WAN.PCP.1]
> >  The RG MUST support Port Control Protocol (PCP) Client as specified
> > in RFC 6887
> >
> > [WAN.PCP.7]
> >  The RG MUST embed an interworking function to ensure interworking
> > between the UPnP IGD (Internet Gateway Device) used by CPE LAN devices
> > in the LAN and PCP as defined in RFC 6970
> >
> > [MGMT.UPnP.IGD.ACRF.1]
> > The RG MUST support UPnP Internet Gateway Device:2 root device. This
> > specification is available for download at
> > http://upnp.org/specs/gw/UPnP-gw-InternetGatewayDevice-v2-Device.pdf
> >
> > As one of CE router vendor, what should I do?
> > Should I ignore TR-124 because UPnP will be deprecated soon?
> > or should we mention UPnP in some form in RFC 7084bis?
> >
> > As I commented on v6ops WG meeting a while ago, UPnP IGDv2(for IPv6) is
> increasing in Japan.
> > Because our CE router support it, and some gaming title support UPnP controll
> point as well.
> > Syncthing(file sharing app) has also supported UPnP IGDv2.
> > Addition to this, we also recognized UPnP IGDv2 implementation increasing in
> some countries.
> >
> > Please let me know your opinion.
> >
> > Regards,
> > Masanobu
> >
> > ========================
> >  NEC Platforms, Ltd.
> >  KAWASHIMA Masanobu
> >  [e-mail]
> >  https://www.necplatforms.co.jp/en/
> > ========================
> >
> >
> >
> > > -----Original Message-----
> > > From: Stuart Cheshire <cheshire=[e-mail]>
> > > Sent: Friday, July 26, 2024 5:33 AM
> > > To: [e-mail]
> > > Subject: [v6ops] Traffic control protocols (PCP and UPnP IGD)
> > >
> > > In today’s v6ops meeting there was mention of UPnP. Having a way for
> > > client devices to signal to network infrastructure what traffic they
> > > want to receive is a good idea. However, doing that using the UPnP
> > > IGD protocol would be a disastrously bad idea.
> > >
> > > For a list of the many flaws of UPnP IGD see RFC 6886:
> > >
> > > <https://datatracker.ietf.org/doc/html/rfc6886#section-9>
> > >
> > > This is why the IETF needed to create a robust reliable protocol for
> > > doing this, Port Control Protocol:
> > >
> > > <https://datatracker.ietf.org/doc/html/rfc6887>
> > >
> > > If an IETF document is going to recommend or require a way of doing
> > > this, it should be using RFC 6887, both because that is an IETF
> > > Standards Track protocol, and (more importantly) because of the technical
> merits of that protocol.
> > >
> > > If the UPnP organization still existed then maybe they could try to
> > > design a replacement for IGD that works reliably, but what would be
> > > the point when the IETF has already done that?
> > >
> > > Stuart Cheshire
> > >
> > > _______________________________________________
> > > v6ops mailing list -- [e-mail] To unsubscribe send an email to
> > > [e-mail]
> > _______________________________________________
> > v6ops mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > _______________________________________________
> > v6ops mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> 
> 
> 
> _______________________________________________
> v6ops mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]