Subject: [pcp] base 16 review (1)

From: Francis Dupont <[email-masked]>
Date: Mon, 24 Oct 2011 17:22:08 +0200

I began the base 16 review, here are my comments up to 7.3 page 21.

 - ToC page 3:
   12.4. Source Address and Port in PCP Header ->
   12.4. Source Address in PCP Header 
 (the source port is no longer in the header, BTW I'd like
  to understand why. IMHO it is just a simplication as the
  address is enough to detect unexpected on-path NATs)

 - 1 page 5 (not a comment about the document itself):
  an interception PCP proxy (cf draft-penno-pcp-nested-nat-01.txt)
  is an ALG (as it is commented) so is *bad*!

 - 2.1 page 3: [I-D.miles-behave-l2nat] points to an expired draft?
  Is it just because someone forgot to refresh it or for a more
  annoying reason?

 - 3 page 7 (Remote Host): Remote Host -> Remote Peer Host
  (remote host is used once, remote peer 52 times :-)

 - 3 page 8 (Mapping Types): web page -> web portal
  (just a suggestion, the term "web page" is very poor IMHO)

 - 3 page 9 (Mapping Types, at the end of the item, suggestion):
      ... they behave exactly the same as an
      explicit dynamic mapping.
   ->
      ... they behave exactly the same as
      explicit dynamic mappings.

 - 5 page 11: from a legal IPv6 address, -> from a native IPv6 address,
  (IPv4 mapped IPv6 addresses are legal, BTW native is better but not
   so good as it suggests it couldn't be a 6to4 address, seeking for
   a better term...)

 - 6.1 page 13 (end of 6.1): please remove the second / extra

   Reserved:  16 reserved bits, MUST be sent as 0 and MUST be ignored
      when received.

 - 6.3 page 15: 1024-4*number_of_options -> 1020-4*number_of_options
  (i.e., please add the UNPROCESSED option header too)

 - 6.4 page 18 (NO_RESOURCES): I have a concern with:
      ... This can be used as a catch-all
      error, should no other error message be suitable.

   by itself it is not a bad idea to provide a catch-all but
   NO_RESOURCES has a special processing, cf. 7.3 page 19:

   If the result code is NO_RESOURCES, PCP client SHOULD NOT send *any*
   further requests to that PCP server for the indicated error lifetime.

   So we really need the PROCESSING_ERROR...

 - 6.4 page 18 (CANNOT_PROVIDE_EXTERNAL_PORT): please remember we
  still have an open issue about this

 - 6.4 page 18 (CANNOT_PROVIDE_EXTERNAL_PORT): protcool -> protocol

 - 6.4 page 18 (ADDRESS_MISMATCH): *3* fixes

   12 ADDRESS_MISMATCH: the source IP address or port of the request
      packet does not match the contents of the PCP Client's IP Address
      or UDP port.

  ->

   12 ADDRESS_MISMATCH: the source IP address of the request packet
      does not match the content of the PCP Client's IP Address.

 - 7.1 page 19: it is not a concern for me but BTW there is nothing
  about other (i.e., not first) members of the list of PCP Server(s)...

 - 7.2 page 20: between

     If the length of the message exceeds 1024 octets or is not a multiple

   and

    The PCP server compares the IP address (from the IP header) with the

   a sentence is needed for requests longer than 4 octets but shorter
   than the 6.1/Figure 2 request header, with of course a
   MALFORMED_REQUEST error. Note the response has the 24 octet check.

  - 7.3 page 21: remove from the processing a response:

   If the PCP Client's IP Address and PCP Client's Port fields of the
   PCP response header do not match the source address and port of the
   request, it indicates the presence of a NAT between the PCP client
   and PCP server.  If they don't match, then the PCP client (or the
   user on the client host) MUST ensure that an appropriate NAT mapping
   is created on the intervening NAT(s) (e.g., using UPnP IGD, NAT-PMP,
   or manual configuration), otherwise, the PCP-installed mapping will
   be ineffective.

Thanks

[email-masked]

---

From: "Dan Wing" <[email-masked]>
Date: Thu, 27 Oct 2011 16:23:31 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Francis Dupont
> Sent: Monday, October 24, 2011 8:22 AM
> To: [email-masked]
> Subject: [pcp] base 16 review (1)
> 

Adjusted.

>   address is enough to detect unexpected on-path NATs)

Correct.

>   Is it just because someone forgot to refresh it or for a more

It was never progressed.  Citing an expired draft is perfectly
fine.

>   (remote host is used once, remote peer 52 times :-)

Fixed.

>   (just a suggestion, the term "web page" is very poor IMHO)

Adjusted.

>       explicit dynamic mappings.

Adjusted.

>    so good as it suggests it couldn't be a 6to4 address, seeking for

Adjusted.

>    Reserved:  16 reserved bits, MUST be sent as 0 and MUST be ignored

Removed.

>   (i.e., please add the UNPROCESSED option header too)

Fixed.

>    So we really need the PROCESSING_ERROR...

Let's talk about PROCESSING_ERROR in a separate thread.  As you stated,
the difficulty is writing text to distinguish between a catch-all
PROCESSING_ERROR error and other errors.

>   still have an open issue about this

Renamed to CANNOT_PROVIDE_EXTERNAL, and now says:

  the requested
  external port and/or external address cannot be provided.

Suitable?

>  - 6.4 page 18 (CANNOT_PROVIDE_EXTERNAL_PORT): protcool -> protocol

fixed.

>       does not match the content of the PCP Client's IP Address.

fixed.

>   about other (i.e., not first) members of the list of PCP Server(s)...

On purpose; that may be something another document discusses.

>    MALFORMED_REQUEST error. Note the response has the 24 octet check.

Now says:

        <t>If the length of the message exceeds 1024 octets, is not a
        multiple of 4 octets, or its header is too short, it is
        invalid.

>    or manual configuration), otherwise, the PCP-installed mapping will

Changed to:

        <t>If the error ADDRESS_MISMATCH is received, it indicates the
        presence of a NAT between the PCP client and PCP server.
        Procedures to resolve this problem are beyond the scope of
        this document.</t>

-d

> _______________________________________________
> pcp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pcp

---

From: Stuart Cheshire <[email-masked]>
Date: Thu, 27 Oct 2011 22:38:17 -0700

>   (just a suggestion, the term "web page" is very poor IMHO)

Why "portal"?

What kind of home gateway has a web portal on it?

<http://en.wikipedia.org/wiki/Web_portal>

A web portal or links page is a web site that functions as a point of  
access to information in the World Wide Web. A portal presents  
information from diverse sources in a unified way.

Apart from the standard search engine feature, web portals offer  
other services such as e-mail, news, stock prices, information,  
databases and entertainment. Portals provide a way for enterprises to  
provide a consistent look and feel with access control and procedures  
for multiple applications and databases, which otherwise would have  
been different entities altogether.

Examples of public web portals are AOL, Excite, iGoogle, MSN,  
Netvibes, and Yahoo!.

Stuart Cheshire <[email-masked]>
* Wizard Without Portfolio, Apple Inc.
* www.stuartcheshire.org

---

From: Stuart Cheshire <[email-masked]>
Date: Thu, 27 Oct 2011 23:29:52 -0700

>   (i.e., please add the UNPROCESSED option header too)

Where does this number come from? Why "4*number_of_options"?

---

From: Francis Dupont <[email-masked]>
Date: Fri, 28 Oct 2011 16:08:05 +0200

=> I limit this message to this item: PROCESSING_ERROR is for
problems *after parsing* (so the syntax is good, the request is valid
but for some reasons failed to be correctly processed) and not
bound to a lack of resources, including quotas, i.e., not
NO_RESOURCES or USER_EX_QUOTA. IMHO it is better than other result
code for not syntax errors as it doesn't carry another background,
for instance it is better than NOT_AUTHORIZED.

And as I explained the real choice is between a standardized name
and value, or to use 192 & co privately and everywhere.
   
Regards

---

From: Francis Dupont <[email-masked]>
Date: Fri, 28 Oct 2011 16:15:35 +0200

the requested
   
   Suitable?
   
=> perfect, I'll update my code (wireshark, tcpdump, client, server,
test suite, etc) as soon as I finish these messages.

   
=> I don't care but you could get the same question during the IETF LC

   Now says:

=> note I rewrote the whole list of checks to do at the beginning
of the request processing according to the code I ported to base 16+,
so there is another message more accurate and surely more useful
for you.
   
Thanks

PS: I expect to not find new problems as I nearly finished to update
the corresponding code (i.e., I read and implemented base 16+).

---

From: Francis Dupont <[email-masked]>
Date: Fri, 28 Oct 2011 17:27:26 +0200

Why "portal"?
   
=> just because I'd like to get something else than page,
but if you have a better idea you are very wellcome!
(being more serious some ISPs named this a portal which
makes sense for an ISP in its pure ISP job)

Thanks

---

From: Francis Dupont <[email-masked]>
Date: Fri, 28 Oct 2011 17:31:06 +0200

=> you can get one octet (filled with the option code) per option
in the request, you have 4 octets for the UNPROCESSED option header,
so it gives 1024 - 4 - number_of_options and I agree the
correct number is "1020 - number_of_options".

Thanks