Subject: [pcp] #76 (proxy): Dave Thaler's comments on draft-ietf-pcp-proxy-06

From: "pcp issue tracker" <[email-masked]>
Date: Tue, 28 Apr 2015 21:36:13 -0000

#76: Dave Thaler's comments on draft-ietf-pcp-proxy-06

 Section 1.1:
 > likely to be more than on NAT on the path between client machines and

 s/more than on/more than one/

 Section 1.2:
 Is it worth noting that the pcp-anycast draft is an alternate solution to
 this same use case?

 Section 3.2:
 This section's wording is a bit confusing.   Section 1 explained the
 reference
 model of back-to-back client and server.  So termination would occur when
 either
 a) the request gets to a server that does not have the PCP proxy
 functional element, or
 b) it gets to a PCP proxy whose PCP client has no PCP servers reachable
 (e.g. none configured and no default routers that respond to PCP) and thus
 has nothing to forward to.
 No?

 The two examples currently in 3.2 are merely ways a NAT gateway (but a PCP
 proxy could be a firewall or something other than a NAT...) could choose
 to enable or disable a PCP proxy functional element and hence
 toggle between a and b above.   But the PCP speaker might not be a NAT
 gateway, or it might not implement a PCP proxy at all, or it might
 implement one but not be "configured to know it's the outermost" but
 rather use rule b above.
 So I think section 3.2 needs further elaboration as noted above.

 Section 3.6:
 I think the reference to Zone ID [I-D.penno-pcp-zones] should probably
 reference the Third Party ID Option [I-D.ietf-pcp-third-party-id-option].

 Section 5:
 > Section 3.3 specifies the cases where a THIRD_PARTY option is inserted
 > the PCP Proxy.  In those cases, means to prevent a malicious

 s/inserted/inserted by/

 > THIRD_PARTY option MUST NOT be enabled unless the network on which

 Grammar: s/option/options/

 >   dropped (or in the case of an unknown Option which is not mandatory-
 >   to-process the Option be removed) if it is not compatible with

 s/Option be/Option SHOULD be/

-- 
-------------------------------------+-------------------------------------
 Reporter:  [email-masked]    |      Owner:  draft-ietf-pcp-
     Type:  defect                   |  [email-masked]
 Priority:  minor                    |     Status:  new
Component:  proxy                    |  Milestone:  milestone1
 Severity:  Waiting for Shepherd     |    Version:  1.0
  Writeup                            |   Keywords:
-------------------------------------+-------------------------------------

Ticket URL: <http://tools.ietf.org/wg/pcp/trac/ticket/76>
pcp <http://tools.ietf.org/pcp/>

---

From: <[email-masked]>
Date: Wed, 29 Apr 2015 08:02:06 +0000

Hi Dave,

Thank you for the review. 

I integrated almost all of your comments except the one about Third Party ID Option because IMHO it does not address the same problem as zone_id. Anyway, zone_id is provided as an example, so we don't need to ne exhaustive here. 

FWIW, the diff is available here:           https:https://www.ietf.org/rfcdiff?url2=draft-ietf-pcp-proxy-07  

Cheers,
Med

> -----Message d'origine-----
> De : pcp [mailto:[email-masked]] De la part de pcp issue tracker
> Envoyé : mardi 28 avril 2015 23:36
> À : [email-masked]; [email-masked]
> Cc : [email-masked]
> Objet : [pcp] #76 (proxy): Dave Thaler's comments on draft-ietf-pcp-proxy-
> 06
> 
> _______________________________________________
> pcp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pcp

---

From: Dave Thaler <[email-masked]>
Date: Thu, 30 Apr 2015 21:09:24 +0000

Question about the new section 3.2:

>   o  An ISP's PCP-controlled gateway (that may embed a NAT, firewall or
>      any function that can be controlled with PCP) could be configured
>      to know that it is the outermost PCP-controlled gateway, and
>      consequently does not need to relay PCP requests upstream.
>      Typically, it may be the case that many Carrier Grade NATs and/or
>      firewalls of the kind used by ISPs may simply not implement
>      Recursive PCP, thereby naturally terminating the recursion at that
>      point.

What is "Recursive PCP"  near the end?   Should that say "a PCP proxy"?
If so, how is it different from the newly added last bullet which says

>   o  Recursion may also be terminated if the upstream PCP-controlled  
>          device does not embed a PCP Proxy.

So I understand all the bullets except that first one.

Dave

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]
> Sent: Wednesday, April 29, 2015 1:02 AM
> To: pcp issue tracker; [email-masked]; Dave Thaler
> Cc: [email-masked]
> Subject: RE: [pcp] #76 (proxy): Dave Thaler's comments on draft-ietf-pcp-
> proxy-06
> 
> Hi Dave,
> 
> I integrated almost all of your comments except the one about Third Party ID
> Option because IMHO it does not address the same problem as zone_id.
> Anyway, zone_id is provided as an example, so we don't need to ne
> exhaustive here.
> 
> FWIW, the diff is available here:
> https:https://www.ietf.org/rfcdiff?url2=draft-ietf-pcp-proxy-07
> 
> Cheers,
> Med
> 
> > Envoyé : mardi 28 avril 2015 23:36 À :
> > [email-masked]; [email-masked] Cc :
> > [email-masked] Objet : [pcp] #76 (proxy): Dave Thaler's comments on
> > draft-ietf-pcp-proxy-
> > 06
> >
> >  Is it worth noting that the pcp-anycast draft is an alternate
> > solution to  this same use case?
> >
> >  Section 3.2:
> >  model of back-to-back client and server.  So termination would occur
> > when  either
> >  b) it gets to a PCP proxy whose PCP client has no PCP servers
> > reachable  (e.g. none configured and no default routers that respond
> > to PCP) and thus  has nothing to forward to.
> >  No?
> >
> >  The two examples currently in 3.2 are merely ways a NAT gateway (but
> > a PCP  proxy could be a firewall or something other than a NAT...)
> > could choose  to enable or disable a PCP proxy functional element and
> > hence
> >  I think the reference to Zone ID [I-D.penno-pcp-zones] should
> > probably  reference the Third Party ID Option [I-D.ietf-pcp-third-party-id-
> option].
> >
> >  Section 5:
> >  > Section 3.3 specifies the cases where a THIRD_PARTY option is
> > inserted  > the PCP Proxy.  In those cases, means to prevent a
> > malicious
> >
> >  s/inserted/inserted by/
> >
> > -------------------------------------+--------------------------------
> > -------------------------------------+----
> > -
> > -------------------------------------+--------------------------------
> > -------------------------------------+----
> > -
> >