Subject: Re: [pcp] pcp-base security considerations

From: "Dan Wing" <[email-masked]>
Date: Thu, 1 Dec 2011 09:18:43 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Alper Yegin
> Sent: Wednesday, November 30, 2011 1:45 AM
> To: [email-masked]
> Subject: [pcp] pcp-base security considerations
> 
> 
> Few questions about the security considerations of pcp-base:
> 
>    A PCP Server is secure under this threat model if the PCP Server is
>    constrained so that it does not configure any explicit mapping that
>    it would not configure implicitly.
> 
> Is there any document that can be referenced for the "security analysis
> of implicit mapping"?

An "implicit mapping" is a mapping created when an initial packet is
sent by a host (e.g., TCP SYN).  Such a mapping is always created in a
NAPT device (e.g., a Linksys/D-Link/etc. NAPT device), and such a
mapping is often created in a firewall.

I know of no such analysis.

>    In most cases, this means that
>    PCP Servers running on NAT boxes or stateful firewalls that support
>    the PEER Opcode can be secure under this threat model if all of
> their
>    hosts are within a single administrative domain
> 
> Can we really say that if, for example, we are talking about a home
> network (domain) or a WiFi hotspot (domain)?

For PEER to be used as an attack vector, the other hosts would
need to:
  * spoof the victim's IP address
or 
  * use their own IP address and the THIRD_PARTY option

The THIRD_PARTY option would not be supported by a PCP server in
a home network or WiFi hotspot -- there is no reason to support
THIRD_PARTY in those environments.

-d