One document matched: draft-ietf-behave-lsn-requirements-02.xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
<?xml-stylesheet type='text/xsl' href='rfc2629.xslt' ?>
<?rfc strict="yes" ?>
<?rfc toc="yes"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="no" ?>
<?rfc compact="yes" ?>
<?rfc subcompact="no" ?>
<rfc category="bcp" docName="draft-ietf-behave-lsn-requirements-02" ipr="trust200902">
<!-- ***** FRONT MATTER ***** -->
<front>
<title abbrev="CGN Requirements">Common requirements for Carrier Grade NAT
(CGN)</title>
<author fullname="Simon Perreault" initials="S." surname="Perreault"
role="editor">
<organization>Viagénie</organization>
<address>
<postal>
<street>2875 boul. Laurier, suite D2-630</street>
<city>Québec</city>
<region>QC</region>
<code>G1V 2M2</code>
<country>Canada</country>
</postal>
<phone>+1 418 656 9254</phone>
<email>simon.perreault@viagenie.ca</email>
<uri>http://www.viagenie.ca</uri>
</address>
</author>
<author fullname="Ikuhei Yamagata" initials="I." surname="Yamagata">
<organization abbrev="NTT Communications">
NTT Communications Corporation</organization>
<address>
<postal>
<street>Gran Park Tower 17F, 3-4-1 Shibaura, Minato-ku</street>
<city>Tokyo</city>
<code>108-8118</code>
<country>Japan</country>
</postal>
<phone>+81 50 3812 4704</phone>
<email>ikuhei@nttv6.jp</email>
</address>
</author>
<author fullname="Shin Miyakawa" initials="S." surname="Miyakawa">
<organization abbrev="NTT Communications">
NTT Communications Corporation</organization>
<address>
<postal>
<street>Gran Park Tower 17F, 3-4-1 Shibaura, Minato-ku</street>
<city>Tokyo</city>
<code>108-8118</code>
<country>Japan</country>
</postal>
<phone>+81 50 3812 4695</phone>
<email>miyakawa@nttv6.jp</email>
</address>
</author>
<author fullname="Akira Nakagawa" initials="A." surname="Nakagawa">
<organization abbrev="Japan Internet Exchange (JPIX)">
Japan Internet Exchange Co., Ltd. (JPIX)</organization>
<address>
<postal>
<street>Otemachi Building 21F, 1-8-1 Otemachi, Chiyoda-ku</street>
<city>Tokyo</city>
<code>100-0004</code>
<country>Japan</country>
</postal>
<phone>+81 90 9242 2717</phone>
<email>a-nakagawa@jpix.ad.jp</email>
</address>
</author>
<author fullname="Hiroyuki Ashida" initials="H." surname="Ashida">
<organization abbrev="iTSCOM">
its communications Inc.</organization>
<address>
<postal>
<street>541-1 Ichigao-cho Aoba-ku</street>
<city>Yokohama</city>
<code>225-0024</code>
<country>Japan</country>
</postal>
<email>ashida@itscom.ad.jp</email>
</address>
</author>
<date year="2011" />
<!-- Meta-data Declarations -->
<area>Transport</area>
<workgroup>Internet Engineering Task Force</workgroup>
<keyword>CGN, NAT</keyword>
<abstract>
<t>This document defines common requirements for Carrier-Grade NAT
(CGN).</t>
</abstract>
</front>
<middle>
<section title="Introduction">
<t>With the shortage of IPv4 addresses, it is expected that more ISPs may
want to provide a service where a public IPv4 address would be shared by
many subscribers. Each subscriber is
assigned a private address, and a NAT situated in the ISP's network
translates between private and public addresses. This is known as NAT444
<xref target="I-D.shirasaki-nat444-isp-shared-addr"/> when the CPE
includes a NAT function.</t>
<t>This is not to be considered a solution to the shortage of IPv4
addresses. It is a service that can conceivably be offered alongside
others, such as IPv6 services or regular, un-NATed IPv4 service. Some
ISPs started offering such a service long before there was a shortage of
IPv4 addresses, showing that there are driving forces other than the
shortage of IPv4 addresses.</t>
<t>This document describes behavioral requirements that are to be expected
of those ISP-controlled NAT. Meeting this set of requirements
will greatly increase the likelihood that subscribers' applications will
function properly.</t>
<t>Readers should be aware of potential issues that may arise when sharing
a public address between many subscribers. See <xref
target="I-D.ford-shared-addressing-issues"/> for details.</t>
<t>This document builds upon previous works describing requirements for
generic NATs <xref target="RFC4787"/><xref target="RFC5382"/><xref
target="RFC5508"/>. These documents still apply in this context. What
follows are additional requirements, to be satisfied on top of previous
ones.</t>
</section>
<section title="Terminology">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <xref target="RFC2119" />.
</t>
<t>
Readers are expected to be familiar with <xref target="RFC4787" /> and the
terms defined there. The following additional term is used in this document:
<list style='hanging'>
<t hangText="Carrier-Grade NAT (CGN):">A NAT-based <xref
target="RFC2663"/> functional element operated by an administrative
entity (e.g. operator) to share the same address among several
subscribers. A CGN is managed by the administrative entity, not the
subscribers.
<list style="empty">
<t>Note that the term "carrier-grade" has nothing to do with the
quality of the NAT; that is left to discretion of implementers.
Rather, it is to be understood as a topological qualifier: the NAT
is placed in an ISP's network and translates the traffic of
potentially many subscribers. Subscribers have limited or no control
over the CGN, whereas they typically have full control over a NAT
placed on their premises.</t>
</list>
</t>
</list>
</t>
<t><xref target="topology"/> summarizes a common network topology in which a
CGN operates.</t>
<figure anchor="topology" title="CGN network topology" align="center">
<artwork><![CDATA[
.
:
| Internet
............... | ...................
| ISP network
|
|
++------++ External realm
........... | CGN |...............
++------++ Internal realm
| |
| |
| | ISP network
............. | .. | ................
| | Customer premises
++------++ ++------++
| CPE1 | | CPE2 | etc.
++------++ ++------++
]]></artwork>
</figure>
<t>Another possible topology is one for hotspots, where there is no customer
premise or CPE, but where a CGN serves a bunch of customers who don't trust
each other and hence fairness is an issue. One important difference with the
previous topology is the absence of NAT444. This, however, has no impact on
CGN requirements since they are driven by fairness and robustness in the
service provided to customers, which applies in both cases.</t>
</section>
<section title="Requirements for CGNs">
<t>What follows is a list of requirements for CGNs. They are in
addition to those found in other documents such as <xref target="RFC4787"/>,
<xref target="RFC5382"/>, and <xref target="RFC5508"/>.</t>
<t>
<list style="format REQ-%d:" counter="Requirements">
<t>A CGN MUST support at least the following transport protocols: TCP
(MUST support <xref target="RFC5382"/>), UDP (MUST support <xref
target="RFC4787"/>), and ICMP (MUST support <xref target="RFC5508"/>).
Support for additional transport protocols is OPTIONAL.</t>
</list>
<list style="hanging">
<t hangText="Justification:">These protocols are the ones that NATs
traditionally support. The IETF has documented the best current
practices for them.</t>
</list>
</t>
<t>
<list style="format REQ-%d:" counter="Requirements">
<t>A CGN MUST have a default "IP address pooling" behavior of "Paired".
The CGN administrator MAY change this behavior on an application
protocol basis.
<list style="symbols">
<t>When multiple overlapping internal address ranges share the same
external address pool (e.g. DS-Lite <xref
target="I-D.ietf-softwire-dual-stack-lite"/>), external addresses
are paired with subscribers rather than internal addresses.</t>
</list>
</t>
</list>
<list style="hanging">
<t hangText="Justification:">This stronger form of REQ-2 from <xref
target="RFC4787"/> is justified by the stronger need for not breaking
applications that depend on the external address remaining constant.</t>
<t>Note that this requirement applies regardless of the transport
protocol. In other words, a CGN must use the same external IP address
mapping for all sessions associated with the same internal IP address,
be they TCP, UDP, ICMP, something else, or a mix of different
protocols.</t>
<t>The justification for allowing other behaviors is to allow the
administrator to save external addresses and ports for application
protocols that are known to work fine with other behaviors in practice.
However, the default behavior MUST be "Paired".</t>
</list>
</t>
<t>
<list style="format REQ-%d:" counter="Requirements">
<t>A CGN SHOULD limit the number of external ports (or, equivalently,
"identifiers" for ICMP) that are assigned per subscriber.
<list style="letters">
<t>Limits SHOULD be configurable by the CGN administrator.</t>
<t>Limits MAY be configured and applied independently per transport
protocol.</t>
<t>Additionally, it is RECOMMENDED that the CGN include
administrator-adjustable thresholds to prevent a single subscriber
from consuming excessive CPU resources from the CGN (e.g. rate limit
the subscriber's creation of new mappings).</t>
</list>
</t>
</list>
<list style="hanging">
<t hangText="Justification:">A CGN can be considered a network resource
that is shared by competing subscribers. Limiting the number of external
ports assigned to each subscriber mitigates the DoS attack that a
subscriber could launch against other subscribers through the CGN in
order to get a larger share of the resource. It ensures fairness among
subscribers. Limiting the rate of allocation mitigates a similar attack
where the CPU is the resource being targeted instead of port
numbers.</t>
</list>
</t>
<t>
<list style="format REQ-%d:" counter="Requirements">
<t>A CGN SHOULD limit the amount of state memory allocated per mapping and
per subscriber. This may include limiting the number of TCP sessions,
the number of filters, etc., depending on the NAT implementation.
<list style="letters">
<t>Limits SHOULD be configurable by the CGN administrator.</t>
<t>Additionally, it SHOULD be possible to limit the rate at which
memory-consuming state elements are allocated.</t>
</list>
</t>
</list>
<list style="hanging">
<t hangText="Justification:">A NAT needs to keep track of TCP sessions
associated to each mapping. This state consumes resources for which, in
the case of a CGN, subscribers may compete. It is necessary to ensure
that each subscriber has access to a fair share of the CGN's resources.
Limiting TCP sessions per subscriber and per time unit is an effective
mitigation against inter-subscriber DoS attacks. Limiting the rate of
allocation is intended to prevent against CPU resource exhaustion.</t>
</list>
</t>
<t>
<list style="format REQ-%d:" counter="Requirements">
<t>It SHOULD be possible to administratively turn off translation for
specific destination addresses and/or ports.</t>
</list>
<list style="hanging">
<t hangText="Justification:">It is common for a CGN administrator to
provide access for subscribers to servers installed in the ISP's
network, in the external realm. When such a server is able to reach the
internal realm via normal routing (which is entirely controlled by the
ISP), translation is unneeded. In that case, the CGN may forward packets
without modification, thus acting like a plain router. This may
represent an important efficiency gain.</t>
<t><xref target="passthrough"/> illustrates this use-case.</t>
</list>
</t>
<figure anchor="passthrough" title="CGN pass-through" align="center">
<artwork><![CDATA[
X1:x1 X1':x1' X2:x2
+---+from X1:x1 +---+from X1:x1 +---+
| | to X2:x2 | | to X2:x2 | S |
| C |>>>>>>>>>>>>| C |>>>>>>>>>>>>>>| e |
| P | | G | | r |
| E |<<<<<<<<<<<<| N |<<<<<<<<<<<<<<| v |
| |from X2:x2 | |from X2:x2 | e |
| | to X1:x1 | | to X1:x1 | r |
+---+ +---+ +---+
]]></artwork>
</figure>
<t>
<list style="format REQ-%d:" counter="Requirements">
<t>It is RECOMMENDED that a CGN have an "Endpoint-Independent Filtering"
behavior.</t>
</list>
<list style="hanging">
<t hangText="Justification:">This is a stronger form of REQ-8 from <xref
target="RFC4787"/>. An "Address-Dependent Filtering" behavior is NOT
RECOMMENDED. This is based on the observation that some games and
peer-to-peer applications require EIF for the NAT traversal to work. In
the context of a CGN it is important to minimise application
breakage.</t>
</list>
</t>
<t>
<list style="format REQ-%d:" counter="Requirements">
<t>When a CGN loses state (due to a crash, reboot, failover to a cold
standby, etc.), it MUST NOT reuse the same external IP addresses for new
dynamic mappings for at least 120 seconds.</t>
</list>
<list style="hanging">
<t hangText="Justification:">This is necessary in order to prevent
collisions between old and new mappings and sessions. It ensures that
all established sessions are broken instead of redirected to a different
peer. The previous address pool MAY of course be reused after a second
loss of state.</t>
<t>The 120 seconds value corresponds to the Maximum Segment Lifetime (MSL)
from <xref target="RFC0793"/>.</t>
<t>One way that this requirement could be satisfied would be have two
distinct address pools: one dormant and one active. When rebooting, the
CGN would swap the dormant pool with the active pool. Another way would
be simply to wait 120 seconds before resuming NAT activity.</t>
</list>
</t>
<t>
<list style="format REQ-%d:" counter="Requirements">
<t>Once an external port is deallocated, it SHOULD NOT be reallocated to a
new mapping until at least 120 seconds have passed. The length of time
and the maximum number of ports in this state SHOULD be configurable by
the CGN administrator.</t>
</list>
<list style="hanging">
<t hangText="Justification:">This is to prevent users from receiving
unwanted traffic. It also helps prevent against clock skew when mappings
are logged.</t>
<t>The 120 seconds value corresponds to the Maximum Segment Lifetime (MSL)
from <xref target="RFC0793"/>.</t>
</list>
</t>
<t>
<list style="format REQ-%d:" counter="Requirements">
<t>A CGN MUST handle the IPv4 ID field of translated packets as described
in <xref target="I-D.ietf-intarea-ipv4-id-update"/> section 9.</t>
</list>
<list style="hanging">
<t hangText="Justification:">Refer to <xref
target="I-D.ietf-intarea-ipv4-id-update"/>.</t>
</list>
</t>
<t>
<list style="format REQ-%d:" counter="Requirements">
<t>A CGN SHOULD support a port forwarding protocol such as the Port
Control Protocol <xref target="I-D.ietf-pcp-base"/>.</t>
</list>
<list style="hanging">
<t hangText="Justification:">Allowing subscribers to manipulate the NAT
state table with a port forwarding protocol greatly increases the
likelihood that applications will function properly.</t>
</list>
</t>
<t>
<list style="format REQ-%d:" counter="Requirements">
<t>A CGN SHOULD support <xref target="RFC4008"/>.</t>
</list>
<list style="hanging">
<t hangText="Justification:">It is anticipated that CGNs will be primarily
deployed in ISP networks where the need for management is critical.</t>
<t>Note also that there are efforts within the IETF toward creating a MIB
specifically for CGNs <xref target="I-D.jpdionne-behave-cgn-mib"/>.</t>
</list>
</t>
<t>
<list style="format REQ-%d:" counter="Requirements">
<t>When packets pass from one side to the other, the DSCP values MUST be
preserved. If the CGN also includes diffserv classifier and marker
functionality it MAY change the DSCP values.</t>
</list>
<list style="hanging">
<t hangText="Justification:">See <xref target="RFC2983"/>, in particular
section 6.</t>
</list>
</t>
<t>
<list style="format REQ-%d:" counter="Requirements">
<t>When a CGN is unable to create a mapping due to resource contraints
or administrative restrictions (i.e. quotas)...
<list style="letters">
<t>it MUST drop the original packet;</t>
<t>it SHOULD send an ICMP Destination Unreachable message with code 3
(Port Unreachable) to the session initiator;</t>
<t>it SHOULD send a notification (e.g. SNMP trap) towards a
management system (if configured to do so);</t>
<t>and it MUST NOT delete existing mappings in order to "make room"
for the new one.</t>
</list>
</t>
</list>
<list style="hanging">
<t hangText="Justification:">This is a slightly different form of REQ-8
from <xref target="RFC5508"/>. Code 3 is preferred to code 13 because it
is listed as a "soft error" in <xref target="RFC5461"/>, which is
important because we don't want TCP stacks to abort the connection
attempt in this case. Sending an ICMP error may be rate-limited for
security reasons, which is why requirement B is a SHOULD, not a
MUST.</t>
</list>
</t>
</section>
<section title="Logging">
<t>It may be necessary for CGN administrators to be able to identify a
subscriber based on external IPv4 address, port, and timestamp in order to
deal with abuse and lawful intercept requests. When multiple subscribers
share a single external address, the source address and port that are
visible at the destination host have been translated from the ones
originated by the subscriber.</t>
<t>In order to be able to do this, the CGN would need to log the following
information for each mapping created:
<list style="symbols">
<t>internal source address</t>
<t>internal source port</t>
<t>external source address</t>
<t>external source port</t>
<t>destination address (but see below)</t>
<t>destination port (but see below)</t>
<t>timestamp</t>
</list>
</t>
<t>A disadvantage of this is that CGNs under heavy usage may produce large
amounts of logs, which may require large storage volume.</t>
<t>Readers should be aware of logging recommendations for Internet-facing
servers <xref target="I-D.ietf-intarea-server-logging-recommendations"/>.
With compliant servers, the destination address and port do not need to be
logged by the CGN. This can help reduce the amount of logging.</t>
</section>
<section title="Bulk Port Allocation">
<t>So far we have assumed that a CGN allocates one external port for every
outgoing connection. In this section, the impacts of allocating multiple
external ports at a time are discussed.</t>
<t>There is a range of things a CGN can do:
<list style="hanging">
<t hangText="Traditional:">For every outgoing connection, allocate one
external port.</t>
<t hangText="Random port set:">For an outgoing connection, create a set
of several random external ports. Subsequent outgoing connections will
use ports from the set. When the set is exhausted, a new connection
causes a new set to be created. A set is smaller or equal to the user's
maximum port limit.</t>
<t hangText="Consecutive port set:">Same as the random port set, but the
ports allocated to a set are consecutive instead of random.</t>
</list>
</t>
<t>Note that this list is not exhaustive. There is a continuum of behavior
that a CGN may choose to implement. For example, a CGN could use random sets
of consecutive port sets.</t>
<t>The impacts of bulk port allocation are as follows.
<list style="hanging">
<t hangText="Port Utilization:">The mechanisms at the top of the list are
very efficient in their port utilization. In that sense, they have good
scaling properties (nothing is wasted). The mechanisms at the bottom of
the list will waste ports. The number of wasted ports is proportional
to size of the "bin".</t>
<t hangText="Logging:">Traditional allocation creates a lot of log entries.
Allocation by random or consecutive port sets create the same number of
log entries, but the entries in the case of consecutive port sets are
smaller because the sets can be expressed very compactly
by indicating a range (e.g. "12000-12009").</t>
<t>With large set sizes, the logging frequency for random and consecutive
port sets can approach that of DHCP servers.</t>
<t>Traditional allocation can log destinations while random and
consecutive port sets cannot. This means that a CGN implementing one of
the latter two will rely on the remote peer to follow the
recommendations in <xref
target="I-D.ietf-intarea-server-logging-recommendations"/>. If this is
not acceptable, random or consecutive port sets cannot be used.</t>
<t hangText="Security:">Traditional and random port sets provide very good
security in that ports numbers are not easily guessed. Easily guessed
port numbers put subscribers at risk of the attacks described in <xref
target="RFC6056"/>. Consecutive port sets provides poor security to
subscribers, especially if the set size is small.</t>
</list>
</t>
</section>
<section title="Deployment Considerations">
<t>Several issues are encountered when CGNs are used <xref
target="I-D.ietf-intarea-shared-addressing-issues"/>. There is current
work in the IETF toward alleviating some of these issues. For example, see
<xref target="I-D.boucadair-intarea-nat-reveal-analysis"/>.</t>
<t>The address sharing ratio is the ratio between the number of external
addresses and the number of internal addresses that a CGN is configured to
handle. See <xref target="I-D.ietf-intarea-shared-addressing-issues"/>
section 26.2 for guidance on picking an appropriate ratio.</t>
</section>
<section anchor="IANA" title="IANA Considerations">
<t>There are no IANA considerations.</t>
</section>
<section anchor="Security" title="Security Considerations">
<t>If a malicious subscriber can spoof another subscriber's CPE, it may
cause a DoS to that subscriber by creating mappings up to the allowed
limit. Therefore, the CGN administrator SHOULD ensure that spoofing is
impossible. This can be accomplished with ingress filtering, as described
in <xref target="RFC2827"/>.</t>
</section>
<section title="Acknowledgements">
<t>
Thanks for the input and review by
Arifumi Matsumoto,
Benson Schliesser,
Dai Kuwabara,
Dan Wing,
Dave Thaler,
Francis Dupont,
Joe Touch,
Lars Eggert,
Kousuke Shishikura,
Mohamed Boucadair,
Reinaldo Penno,
Senthil Sivakumar,
Takanori Mizuguchi,
Takeshi Tomochika,
Tomohiro Fujisaki,
Tomohiro Nishitani,
Tomoya Yoshida,
and
Yasuhiro Shirasaki.
Dan Wing also contributed much of section 5.
</t>
</section>
</middle>
<back>
<references title="Normative References">
<?rfc include="reference.RFC.2119"?>
<?rfc include="reference.RFC.4008"?>
<?rfc include="reference.RFC.4787"?>
<?rfc include="reference.RFC.5382"?>
<?rfc include="reference.RFC.5508"?>
<?rfc include="reference.I-D.ietf-intarea-ipv4-id-update"?>
</references>
<references title="Informative Reference">
<?rfc include="reference.RFC.0793"?>
<?rfc include="reference.RFC.2663"?>
<?rfc include="reference.RFC.2827"?>
<?rfc include="reference.RFC.2983"?>
<?rfc include="reference.RFC.5461"?>
<?rfc include="reference.RFC.6056"?>
<?rfc include="reference.I-D.ietf-intarea-server-logging-recommendations"?>
<?rfc include="reference.I-D.ietf-intarea-shared-addressing-issues"?>
<?rfc include="reference.I-D.ietf-pcp-base"?>
<?rfc include="reference.I-D.ietf-softwire-dual-stack-lite"?>
<?rfc include="reference.I-D.boucadair-intarea-nat-reveal-analysis"?>
<?rfc include="reference.I-D.ford-shared-addressing-issues"?>
<?rfc include="reference.I-D.jpdionne-behave-cgn-mib"?>
<?rfc include="reference.I-D.shirasaki-nat444-isp-shared-addr"?>
</references>
<section title="Change Log (to be removed by RFC Editor prior to
publication)">
<section title="Changed in -02">
<t>
<list style="symbols">
<t>CGNs MUST support at least TCP, UDP, and ICMP.</t>
<t>Add requirement from <xref target="I-D.ietf-intarea-ipv4-id-update"/>.</t>
<t>Add informative reference to <xref
target="I-D.ietf-intarea-shared-addressing-issues"/>.</t>
<t>Add requirement (SHOULD level) for a port forwarding protocol.</t>
<t>Allow any pooling behavior on a per-application protocol
basis.</t>
<t>Adjust wording for external port allocation rate limiting.</t>
<t>Add requirement for RFC4008 support (SHOULD level).</t>
<t>Adjust wording for swapping address pools when rebooting.</t>
<t>Add DSCP requirement (stolen from draft-jennings-behave-nat6).</t>
<t>Add informative reference to
draft-boucadair-intarea-nat-reveal-analysis.</t>
<t>Add requirement for hold-down pool.</t>
<t>Change definition of CGN.</t>
<t>Avoid usage of "device" loaded word throughout the document.</t>
<t>Add requirement about resource exhaustion.</t>
<t>Change title.</t>
<t>Describe additional CGN topology where there is no NAT444.</t>
<t>Better justification for "Paired" pool behavior.</t>
<t>Make it clear that rate limiting allocation is for preserving CPU
resources</t>
<t>Generalize the requirement for limiting the number of TCP sessions
per mapping so that it applies to all memory-consuming state
elements.</t>
<t>Change CPE to subscriber where it applies throughout the text.</t>
<t>Better terminology for bulk port allocation mechanisms.</t>
<t>Explain how external address pairing works with DS-Lite.</t>
</list>
</t>
</section>
<section title="Changed in -01">
<t>
<list style="symbols">
<t>Terminology: LSN is now CGN.</t>
<t>Imported all requirements from RFCs 4787, 5382, and 5508. This
allowed us to eliminate some duplication.</t>
<t>Added references to
draft-ietf-intarea-server-logging-recommendations
and draft-ford-shared-addressing-issues.</t>
<t>Incorporated a requirement from
draft-xu-behave-stateful-nat-standby-06.</t>
</list>
</t>
</section>
</section>
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-24 05:09:22 |