Subject: Re: [pcp] UPnP interop #10 (closed): Firewall (address-dependent filter) support

From: "pcp issue tracker" <[email-masked]>
Date: Fri, 11 Feb 2011 01:33:21 -0000

#10: Firewall (address-dependent filter) support

Changes (by dwing@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 Closed, with this text that will appear in -05:

 {{{
 8.5.2.  REMOTE_PEER_FILTER

    This Option indicates packet filtering is desired.  The remote peer
    port and remote peer IP Address indicate the permitted remote peer's
    source IP address and port for packets from the Internet.  The remote
    peer prefix length indicates the length of the remote peer's IP
    address that is significant; this allows a single Option to permit an
    entire subnet.  After processing this MAP request and generating a
    successful response, the PCP-controlled device will simply drop
    packets with a source IP address, transport, or port that do not
    match the fields.
       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |    Reserved   | prefix-length |      Remote Peer Port         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      :                                                               :
      :     Remote Peer IP address (32 bits if MAP4,                  :
      :              1 28 bits if MAP6)                               :
      :                                                               :
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

    These fields are described below:

    Reserved:  8 reserved bits, MUST be sent as 0 and MUST be ignored
       when received.

    prefix-length:  indicates how many bits of the IPv4 or IPv6 address
       are relevant for this filter.  The value 0 indicates "no filter",
       and will remove all previous filters.  See below for detail.

    Remote Peer Port:  the port number of the remote peer.  The value 0
       indicates "all ports"

    Remote Peer IP address:  The IP address of the remote peer.

    This Option:

       name: REMOTE_PEER_FILTER

       number: 128

       is valid for OpCodes: MAP4, MAP6

       is included in responses: MUST, if it appeared in the request.

       length: 2 if used with MAP4, 5 if used with MAP6

       may appear in: requests

       maximum occurrences: as many as fit within maximum PCP message
       size

    Because of interactions with dynamic ports this Option MUST only be
    used by a client that is operating a server (that is, using the MAP
    OpCode), as this ensures that no other application will be assigned
    the same ephemeral port for its outgoing connection.  Other use by a
    PCP client is NOT RECOMMENDED and will cause some UNSAF NAT traversal
    mechanisms [RFC3424] to fail where they would have otherwise
    succeeded, breaking other applications running on this same host.

    The prefix-length indicates how many bits of the IPv6 address or IPv4
    address are used for the filter.  For MAP4, a prefix-length of 32
    indicates the entire IPv4 address is used.  For MAP6, a prefix-length
    of 128 indicates the entire IPv6 address is used.  For MAP4 the
    minimum prefix-length value is 0 and the maximum value is 32.  For
    MAP6 the minimum prefix-length value is 0 and the maximum value is
    128.  Values outside those range cause an MALFORMED_OPTION response
    code.

    If multiple occurrences of REMOTE_PEER_FILTER exist, they are
    processed in the same order received.

    To remove all existing filters, the prefix-length 0 is used.

    To change an existing filter, the PCP client sends a MAP request
    containing two REMOTE_PEER_FILTER options, the first option
    containing a prefix-length of 0 (to delete all existing filters) and
    the second containing the new remote peer's IP address and port.  To
    allow an additional remote peer to an existing filtered mapping, a
    new MAP request is sent with the REMOTE_PEER_FILTER.

    The PCP server or the PCP-controlled device is expected to have a
    limit on the number of remote peers it can support.  This limit might
    be as small as one.  If a MAP request would exceed this limit, the
    entire MAP request is rejected with the result code
    EXCESSIVE_REMOTE_PEERS, and the state on the PCP server is unchanged.
 }}}

-- 
--------------------------------+-------------------------------------------
 Reporter:  dwing@…             |        Owner:        
     Type:  enhancement         |       Status:  closed
 Priority:  major               |    Milestone:        
Component:  UPnP interop        |      Version:        
 Severity:  Active WG Document  |   Resolution:  fixed 
 Keywords:                      |  
--------------------------------+-------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/pcp/trac/ticket/10#comment:3>
pcp <http://tools.ietf.org/pcp/>

---

From: "pcp issue tracker" <[email-masked]>
Date: Tue, 22 Feb 2011 14:51:02 -0000

Changes (by dthaler@…):

  * component:  UPnP interop => Firewall

Component:  Firewall            |      Version:        

Ticket URL: <http://trac.tools.ietf.org/wg/pcp/trac/ticket/10#comment:4>
pcp <http://tools.ietf.org/pcp/>

---

From: "pcp issue tracker" <[email-masked]>
Date: Tue, 22 Feb 2011 22:22:53 -0000

Comment(by tena@…):

 Replying to [comment:4 dthaler@…]:
 Agreed this method, actually it allows PCP server can have black list
 function.
 But is there any security issue of this black list function?
 For some user, REMOTE_PEER_FILTER options can only filter the remote peer
 related to this user's IP. I did not see related description on this
 specification.

Ticket URL: <http://trac.tools.ietf.org/wg/pcp/trac/ticket/10#comment:5>
pcp <http://tools.ietf.org/pcp/>

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 22 Feb 2011 16:09:30 -0800

> -----Original Message-----
> From: pcp issue tracker [mailto:[email-masked]]
> Sent: Tuesday, February 22, 2011 2:23 PM
> To: [email-masked]; [email-masked]; [email-masked]
> Cc: [email-masked]
> Subject: Re: [pcp] #10: Firewall (address-dependent filter) support
> 

Such as?

>  related to this user's IP. I did not see related description on this

If there is a mistake in the document, can you point at the section 
and text that is wrong?

-d