Add support for Port Control Protocol

[jech]

My router has support for NAT-PMP and PCP, but not for uPNP.

go-ipfs redirects the IPv4 port, but doesn't seem to open a firewall hole for the IPv6 port.

It looks like the NAT library [1] we use simply has no code whatsoever for IPv6, and no PCP support either :(

[1] https://github.com/fd/go-nat

[jech]

It looks like the NAT library [1] we use simply has no code whatsoever for IPv6, and no PCP support either :(

Lars, may I suggest that this deserves a mention in the README? Like it or not, the IETF are recommending that home routers implement a stateful IPv6 firewall, and people are implementing the IETF recommendation. Thanks for the prompt answer,

…

-- Juliusz

[Kubuxu]

I have to disagree, for Home IPv6 Networks IETF recommends statefull firewall but is not decided in it behaviou. As described in RFC 7348 Section 3.6.1:

The topic of whether future home networks as described in this
document should have a 'default deny' or 'default allow' position has
been discussed at length in various IETF meetings without any
consensus being reached on which approach is more appropriate.

The IETF also recognises that stating 'default deny' policy is less than optimal:

It should be noted that a 'default deny' filtering approach would effectively
replace the need for IPv4 NAT traversal protocols with a need to use
a signalling protocol to request a firewall hole be opened [...]

The IPv6 is supported with IPv6 design in mind.

[jech]

It seems like I'm meeting the whole team :-)

I have to disagree, for Home IPv6 Networks IETF recommends statefull firewall
but is not decided in it behaviou. As described in RFC 7348 Section 3.6.1:

The topic of whether future home networks as described in this
document should have a 'default deny' or 'default allow' position has
been discussed at length in various IETF meetings without any
consensus being reached on which approach is more appropriate.

IETF-watching is my favourite spectator sport too.

You're right, I expressed myself badly. The IETF is recommending that
a stateful filter should be implemented, that it should allow outgoing
flows by default, and refuses to express an opinion on incoming flows. It
seems to me howeverthat they've accepted that the firewalls will be deny
by default. See RFC 6092:

REC-31: All valid sequences of TCP packets (defined in [RFC0793])
MUST be forwarded for outbound flows and explicitly permitted inbound
flows.

This does not say that inbound flows that are not explicitly permitted
should be dropped, but comes pretty close.

Two additional elements:

• the Apple wireless router (whatever its name) had a permissive policy
  in the first version that supported IPv6. After a lot of public outcry,
  this was changed to deny-by-default in subsequent versions.
• OpenWRT has a deny-by-default policy.

I expect that pretty much all IPv6 home routers will ship with
deny-by-default policies. I agree, that sucks.

-- Juliusz

Whatever the details about IPv6 and home routers -- we should implement port mapping for IPv6, either by adding it to the existing NAT-PMP and UPnP code, or by implementing PCP, or both.

[jech]

Whatever the details about IPv6 and home routers -- we should implement port mapping for IPv6, either by adding it to the existing NAT-PMP and UPnP code, or by implementing PCP, or both.

NAT-PMP only does IPv4. PCP is the scheduled replacement for NAT-PMP, and it's sort-of-backwards-compatible. As to UPnP -- the sooner it's forgotten, the better for everyone.

[Kubuxu]

I would love to support it but:

1. I don't see any go libs for PCP
2. I don't have any hardware that supports PCP

Do you know if there are any Linux based, easy to setup PCP servers?

[jech]

Do you know if there are any Linux based, easy to setup PCP servers?

I could be wrong, but I believe that miniupnpd supports PCP.

…

-- Juliusz

[whyrusleeping]

can someone spare me googling "PCP"?

[Kubuxu]

Port Control Protocol

[jech]

PCP: https://tools.ietf.org/html/rfc6887 and https://tools.ietf.org/html/rfc7488 See Appendix A of RFC 6887 for compatibility with NAT-PMP (RFC 6886).