Subject: [pcp] bad version response

From: Francis Dupont <[email-masked]>
Date: Thu, 27 Oct 2011 16:19:28 +0200

In base 16 7.2 page 20 I can read:

   If the received message is at least two octets long but the first
   octet (version) is a version that is not supported, a response is
   generated with the UNSUPP_VERSION result code, and the other steps
   detailed in Section 7.6 are followed.

the R bit set is after so a response with a bad version is not dropped,
I suggest to add a clause to change this, for instance:

   If the received message is at least two octets long but the first
   octet (version) is a version that is not supported, and R bit is
   not set, a response is generated with the UNSUPP_VERSION result
   code, and the other steps detailed in Section 7.6 are followed.

Regards

[email-masked]

PS: so the checks are in this order:

length < 2 => drop

R bit set => drop

bad version => UNSUPP_VERSION
(BTW the section 7.6 is underspecified, for instance it is not
clear the correct response is 4 octet long even there is no
reason to have more things in common between versions than
the 4 first octets, cf NAT-PMP :-)

length < 4 => drop

server overloaded, rate limit, etc => drop

length > 1024 => MALFORMED_REQUEST

length < 24 => MALFORMED_REQUEST
(this is *not* in base 16 but is required to apply
the address one)

length & 3 != 0 => MALFORMED_REQUEST

IP source address != PCP client address => ADDRESS_MISMATCH

etc

PPS: IMHO it makes sense to merge the length < 4 and
length < 24 checks, i.e., to drop all requests with
a supported version but shorter than the header.