Subject: [pcp] from jabber yesterday

From: Francis Dupont <[email-masked]>
Date: Fri, 12 Nov 2010 06:18:37 +0100

Two comments I made on jabber.

(Using RFC 4787 terminology) "port forwarding" entries (the objects
managed by PCP in the NAT case) are equivalent to "dynamic mappings"
if and only if EIM and EIF (end-point independent mode and filtering)
are used. With APF (address and port filtering) which is the Linux
default a "dynamic mapping", i.e., what a TCP SYN creates, is 'more
secure'.

BTW I have several little NAT boxes at home and I am still looking
for one implementing EIF...

Second point: in many specs (RFC 5280 (aka PKIX) section 4.2,
RFC 5996 (aka IKEv2) section 3.2, etc) the bit which means either
the extension must be recognized or a fatal error must be raised
is named 'critical'.

Regards

[email-masked]