Subject: [Geopriv] Do we need to talk about the lis-discovery draft in Dublin

From: Robert Sparks <[email-masked]>
Date: Mon, 14 Jul 2008 15:54:24 -0500

Martin thinks the lis-discovery draft is essentially ready to LC.

I'm going to not give it agenda time unless I start seeing  
disagreements with that statement that need face time to resolve.

Send in comments if you think it needs to be talked about.

RjS
_______________________________________________
Geopriv mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/geopriv

---

From: Richard Barnes <[email-masked]>
Date: Tue, 15 Jul 2008 18:46:26 -0400

I'm still a little uncomfortable with this draft, in particular with its 
usage of UPnP and STUN.  The two questions I have are:

1. Can a service provider predict the addresses that these mechanisms 
will return, so that it knows which reverse-DNS records it needs to 
maintain to support this service?

2. Conversely, under what circumstances will these mechanisms lead the 
endpoint to discover the incorrect LIS?

It would be great if we could have some feedback on the list from access 
network operators as to whether they feel the current document is 
deployable.

Thanks,
--Richard

Robert Sparks wrote:
> I'm going to not give it agenda time unless I start seeing disagreements 
> with that statement that need face time to resolve.
>

---

From: "Stark, Barbara" <[email-masked]>
Date: Wed, 16 Jul 2008 15:39:01 -0400

Oh, fine. I'll be the token service provider. 

First, I'll answer Richard's questions, and then I'll provide a few
other comments.
1. Yes, the returned addresses are predictable. All addresses that the
service provider makes available on its DHCP server (and, for those who
NAT, the ones used by the NAT to the Internet) need to have reverse DNS
entries. I know that when I'm not on my VPN, that I can do a reverse
DNS. Here's what I'm getting today:
"adsl-160-71-10.asm.bellsouth.net"
When I'm on my work VPN, reverse DNS fails (on the IP address that's
used by my company's server connecting to the Internet). But that's my
company's choice, and they can control all the DHCP servers in the
corporate net, so it shouldn't get to that point.
Note that for a service provider with a NAT, the reverse DNS will still
provide the  domain of that service provider; but the LIS will need to
be inside the NAT. I don't see where this should be a problem.

2. Where the home network is double-NATted, and the inner router doesn't
have a public IP address on its WAN interface, the UPnP method will
fail. This is happening rather frequently.

Now for my comments:
UPnP doesn't have a lot of deployments, and has some security holes
which cause many to turn it off when it is in a router. I'm thinking
maybe we simplify and get rid of this option. Plus, it has the
double-NAT issue. There are enough public STUN servers out there (e.g.,
stunserver.org), that I think it's reasonable to just stick with that.

I've never heard of a STUN server being deployed behind a NAT. Are you
sure that occurs? I'm having real trouble figuring out why anyone would
do that.

It might be good to have a special section (in IP address discovery
section) for IPv6. That would be pretty simple -- the device is expected
to have a global IP address. If it has a global IP address, it uses
that. Figuring out which one to use, if it has multiple, could be
tricky. I guess it should try all, and see if they're on different
domains. If they're all in the same domain, then that's fine. Perhaps
the one that's used for default routing would be the most reliable.

Relating to the use of DHCP to get the domain, I'm a bit unsure about
that. My home router advertises my home domain to devices inside my
home. So this wouldn't work in my home. I think that's fairly common.
I'm wondering if this method may not work well enough to be useful?
Barbara

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Richard Barnes
Sent: Tuesday, July 15, 2008 6:46 PM
To: Robert Sparks
Cc: GEOPRIV
Subject: Re: [Geopriv] Do we need to talk about the lis-discovery draft
in Dublin

Thanks,
--Richard

> I'm going to not give it agenda time unless I start seeing
disagreements 

*****

The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers. GA622