Subject: [pcp] base 16 review (3/last)

From: Francis Dupont <[email-masked]>
Date: Wed, 26 Oct 2011 17:55:32 +0200

Here are my editorial comments about base 16 from 12 page 56:

 - 12.2 page 57: I can't find a real case for 'after' in:

   No matter if a NAT is EIM or EDM, it is possible that one (or more)
   implicit dynamic mappings, using the same internal port on the
   Internal Host, might be created before or after a MAP request.

  but is it a problem? IMHO it is not as it is better to document
  impossible cases than to forget possible cases...

 - 12.3 page 57: please at a reference to Stuart's I-D
  [draft-cheshire-pcp-recovery-01.txt]

 - 12.4 page 59: two extra 'and port' in the title and in the text

 - 13.2 page 60 (remark): about quotas they can be per protocol too...

 - 14.1 pages 60 to 62: I have a concern about this because the
  security constraints described here are not compatible with the
  previous (in the specs) operational requirements, i.e., this leads
  to a situation where an implementation can be secure or compliant
  but not both.

 - 14.1.2.2 page 62: I have a problem with the text as it is clearly
  for the DS-Lite encapsulation code when all implementors I know
  the opinion are for the plain mode.
  There are many ways to fix this, IMHO the simplest (so the best?)
  should to move the whole text to the DS-Lite draft and just leave
  a reference.

 - 14.1.2.2 page 62: possible typo in the last sentence:

   DS-Lite's security policies may also permit use of the MAP Opcode.
                                                          ^^^

 - 14.3.3 page 64: (again) I don't like the wording, I propose:

   ... This threat is reduced by using persistent storage of
   explicit dynamic mappings in the PCP server (so it does not lose
   explicit dynamic mapping state), or by ensuring the previous external
   IP address and port cannot be used by another host (e.g., by using a
   different IP address pool).

 ->

   ... This threat is suppressed by using persistent storage of
   explicit dynamic mappings in the PCP server (so it does not lose
   explicit dynamic mapping state), or reduced by ensuring the
   previous external IP address and port cannot be used by another
   host (e.g., by using a different IP address pool).

 (the idea is the second workaround replaced the direct threat by
  a possible denial of service, so they are not equivalent and
  the first should be prefered when applicable)

 - 15.2 page 65: draft-cheshire-pcp-recovery-01.txt uses the
  reserved value 0 but only in response, so I can't see
  whether this is legal or not...

 - 15.3 page 65: the private range was *silently* changed from
  128-254 to 192-254 between drafts 14 and 15 (grrr...!)

 - 17.2 page 68: the IGD reference is obsolete:

   [IGD]      UPnP Gateway Committee, "WANIPConnection:1",
              November 2001, <http://upnp.org/specs/gw/
              UPnP-gw-WANIPConnection-v1-Service.pdf>.

 ->

   [IGD]      UPnP Gateway Committee, "WANIPConnection:2",
              September 2010, <http://upnp.org/specs/gw/
              UPnP-gw-WANIPConnection-v2-Service.pdf>.

Done, regards

[email-masked]

PS; I could get other remarks or comments from implementing
experience but unfortunately perhaps not before the LC deadline.