Subject: Re: [pcp] #5: Channel security mechanism

From: "pcp issue tracker" <[email-masked]>
Date: Tue, 22 Feb 2011 15:53:15 -0000

#5: Channel security mechanism

Comment(by dthaler@…):

 Things you can do with a SYN: nothing needed
 Things you cannot do with a SYN:
 * Things that affect yourself: mitigate with normal source spoofing
 mitigations
 * Things that affect others: webcam case, ISP managing own device case

-- 
--------------------------------+-------------------------------------------
 Reporter:  multiple            |       Owner:     
     Type:  enhancement         |      Status:  new
 Priority:  critical            |   Milestone:     
Component:  base                |     Version:     
 Severity:  Active WG Document  |    Keywords:     
--------------------------------+-------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/pcp/trac/ticket/5#comment:2>
pcp <http://tools.ietf.org/pcp/>

---

From: "pcp issue tracker" <[email-masked]>
Date: Tue, 22 Feb 2011 16:41:03 -0000

Changes (by dthaler@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 Strawman is:
 PCP not capable of opening ports for another subscriber.
 Section 8.8 covers opening ports for another IP within same subscriber IP
 address range, and no additional security is present for that case.
 Need to update "administrative interface" text to be clear that's non-PCP
 (e.g., web interface).

-- 
--------------------------------+-------------------------------------------
 Reporter:  multiple            |        Owner:        
     Type:  enhancement         |       Status:  closed
 Priority:  critical            |    Milestone:        
Component:  base                |      Version:        
 Severity:  Active WG Document  |   Resolution:  fixed 
 Keywords:                      |  
--------------------------------+-------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/pcp/trac/ticket/5#comment:3>
pcp <http://tools.ietf.org/pcp/>

---

From: "pcp issue tracker" <[email-masked]>
Date: Tue, 22 Feb 2011 17:13:19 -0000

Comment(by dthaler@…):

 Another strawman idea to consider is: if an admin wants to restrict the
 ability to do certain PCP operations (e.g., open ports for another IP),
 then those operations should be defined as options.  An implementation can
 then support the ability to have an ACL of some (implementation-specific)
 sort, covering a list of such options.

Ticket URL: <http://trac.tools.ietf.org/wg/pcp/trac/ticket/5#comment:4>
pcp <http://tools.ietf.org/pcp/>