Subject: [pcp] pcp-base-29

From: "Dan Wing" <[email-masked]>
Date: Wed, 7 Nov 2012 11:29:05 -0500

Reinaldo pointed out that -28 still had a latent paragraph suggesting a PCP
client could clear out old mappings.  With the Mapping Nonce change made
back in -27, the PCP client can't do that except in the unlikely scenario
where it is the same PCP client restarting (with same Mapping Nonce) and
with the same IP address.  I just submitted -29, which removes that
paragraph.

http://tools.ietf.org/html/draft-ietf-pcp-base-29
http://tools.ietf.org/rfcdiff?url2=draft-ietf-pcp-base-29.txt

There were no other WGLC comments.

-d

---

From: Sam Hartman <[email-masked]>
Date: Wed, 07 Nov 2012 13:21:55 -0500

>>>>> "Dan" == Dan Wing <[email-masked]> writes:

    Dan> Reinaldo pointed out that -28 still had a latent paragraph
    Dan> suggesting a PCP client could clear out old mappings.  With the
    Dan> Mapping Nonce change made back in -27, the PCP client can't do
    Dan> that except in the unlikely scenario where it is the same PCP
    Dan> client restarting (with same Mapping Nonce) and with the same
    Dan> IP address.  I just submitted -29, which removes that
    Dan> paragraph.

I thought we were not going to take this out because in the advanced
authentication case  or even with a server that implements a security
mechanism for unauthenticated use, a server could permit a client to
clear mappings.

--Sam

---

From: "Reinaldo Penno (repenno)" <[email-masked]>
Date: Wed, 7 Nov 2012 19:04:26 +0000

Hello Sam,

The scenario as written in -28 is the following:

- end hosts gets a new address when joins the network and want to clear
old mappings associated with this address.

Is there a way to do that?

Thanks,

Reinaldo

On 11/7/12 1:21 PM, "Sam Hartman" <[email-masked]> wrote:

>_______________________________________________
>pcp mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pcp

---

From: Sam Hartman <[email-masked]>
Date: Wed, 07 Nov 2012 14:20:32 -0500

>>>>> "Reinaldo" == Reinaldo Penno (repenno) <[email-masked]> writes:

    Reinaldo> Hello Sam, The scenario as written in -28 is the
    Reinaldo> following:

    Reinaldo> - end hosts gets a new address when joins the network and
    Reinaldo> want to clear old mappings associated with this address.

Sure. Two ways:

1) it's an authenticated request it uses to do that.

2)  The server implements authentication and thus falls under the
advanced threat model. Its policy permits an unauthenticated flush
request.

--Sam

---

From: "Reinaldo Penno (repenno)" <[email-masked]>
Date: Wed, 7 Nov 2012 19:22:59 +0000

>1) it's an authenticated request it uses to do that.

The nonce and IP addresses would not match, can these checks be relaxed?

>advanced threat model. Its policy permits an unauthenticated flush

See above.

---

From: Sam Hartman <[email-masked]>
Date: Wed, 07 Nov 2012 14:51:00 -0500

Reinaldo> following:
    >> 1) it's an authenticated request it uses to do that.

    Reinaldo> The nonce and IP addresses would not match, can these
    Reinaldo> checks be relaxed?

We could permiwt nonce check to be relaxed in the advanced threat model.

I'm OK with this text being dropped.
Up to the WG though.