Subject: Re: [pcp] #10: Firewall (address-dependent filter) support

From: "pcp issue tracker" <[email-masked]>
Date: Tue, 01 Mar 2011 08:13:06 -0000

#10: Firewall (address-dependent filter) support

Comment(by tena@…):

 8.8.2.  REMOTE_PEER_FILTER
 After processing this MAP request and generating a
    successful response, the PCP-controlled device will simply drop
    packets with a source IP address, transport, or port that do not
    match the fields.

 Should be changed to “the PCP-controlled device will simply drop packets
 with a peer IP address, transport, or port and PCP client IP address that
 do not match the fields.”

 A PCP client can’t request a REMOTE_PEER_FILTER for another PCP client.

-- 
--------------------------------+-------------------------------------------
 Reporter:  dwing@…             |        Owner:        
     Type:  enhancement         |       Status:  closed
 Priority:  major               |    Milestone:        
Component:  Firewall            |      Version:        
 Severity:  Active WG Document  |   Resolution:  fixed 
 Keywords:                      |  
--------------------------------+-------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/pcp/trac/ticket/10#comment:6>
pcp <http://tools.ietf.org/pcp/>

---

From: "pcp issue tracker" <[email-masked]>
Date: Tue, 01 Mar 2011 15:53:45 -0000

Comment(by dwing@…):

 > A PCP client can’t request a REMOTE_PEER_FILTER for another PCP client.

 There is currently nothing preventing that.  Do we need to prevent that?
 Why?

 Regarding the text change, I went with this in -07:

 {{{
   After processing this MAP request and generating a
   successful response, the PCP-controlled device will drop
   packets received on its public-facing interface with a
   source IP address (i.e., remote peer address), transport, or
   port that do not match the fields, and if its security
   policy allows MAY generate an ICMP error in response to that
   packet.
 }}}

Ticket URL: <http://trac.tools.ietf.org/wg/pcp/trac/ticket/10#comment:7>
pcp <http://tools.ietf.org/pcp/>