Subject: Re: [pcp] PCP security model

From: Francis Dupont <[email-masked]>
Date: Mon, 01 Nov 2010 16:22:26 +0100

In your previous mail you wrote:

   > between subscribers:
   >  - a subscribe is not authorized to steal another subscriber PFs.
   >   So the PCP server of a CGN is required to keep its state
   >   (PFs and subscriber identities) in stable storage.
   
   The actual requirement is to not give the mapping to another 
   subscriber until the lifetime expires.

=> in fact it is lifetime + hold down but this doesn't change
the problem (i.e., it is an implementation detail).

   That can be implemented by using stable storage, true.

=> I am afraid stable storage is required for other reasons
(legal constraints for instance) so I don't worry too much
about this. And we can put a MUST for the reason and a SHOULD
for the solution: this will make everybody happy.

   Two *examples* of ways to implement
   that requirement, without stable storage of PCP-mappings:
   
     * algorithmically assigning certain ports to certain 
       subscribers -- like A+P (port range routing) does for 
       its dynamic connections.
     * using a completely different pool of IPv4 addresses upon 
       NAT server restart, as explained for dynamic connections
       with cold standby in Section 6 of 
       draft-xu-behave-stateful-nat-standby.
   
=> interesting (BTW these solves the deep issue, i.e., they work
for the legal stuff too).

   >  - if the subscriber identity is the HG address on the infrastructure,
   >   some measures must be taken to ensure a subscriber can't use
   >   the address of another subscriber, i.e., access control on the
   >   infrastructure including ingress filtering.
   >   (with other words the identification should be able to provide
   >    authentication)
   
   That's needed anyway, without PCP -- to prevent subscribers from 
   clobbering each others sessions.
   
=> yes and IMHO it is a good thing PCP doesn't add new constraints.

   >  - the support of subscriber renumbering requires a subscriber
   >   authentication which is not based on addresses (proposal in PPS).
   
   I don't care about maintaining PCP mappings during a subscriber 
   renumbering event.

=> I agree it is a minor goal but if we can get it for free there
is no reason to not provide it. And I believe we agree it must
not be provided in a not-secure way.

Thanks

[email-masked]

PS: can you provide a better wording for the stable storage for CGN
requirement?

---

From: Paul Selkirk <[email-masked]>
Date: Mon, 8 Nov 2010 16:18:44 +0000 (UTC)

On Fri, 29 Oct 2010 11:45:01 -0700, Dan Wing said:
> subscriber until the lifetime expires.  ...

When I went looking for the actual language, all I found was this (in
draft-wing-pcp-base-01.txt, section 10.2):

   Once a PCP server has responded positively to a pinhole request for a
   certain lifetime, the port forwarding is active for the duration of
   the lifetime unless deleted by the PCP client.  Also see XXX. [sic]

This is watered down from -base-00, which said "MUST keep that pinhole
open for the duration of the lifetime".  But "active for the duration
of the lifetime" implies the same thing, and I can't come up with any
reasonable reading of "the mapping is active" that means "the mapping
won't be reassigned during the lifetime".

In fact, you've removed normative language, and replaced it with
non-normative language.

Unless I'm reading the wrong draft?  There have been so many...

				paul

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 9 Nov 2010 07:44:16 +0800

> -----Original Message-----
> From: Paul Selkirk [mailto:[email-masked]]
> Sent: Tuesday, November 09, 2010 12:19 AM
> To: Dan Wing
> Cc: [email-masked]; [email-masked]
> Subject: Re: [pcp] PCP security model
> 

I was considering what we want as the requirement -- what are we
wanting / needing to do.  draft-wing-pcp-base-01 isn't necessarily
correctly capturing the requirement or how to meet it.

-d