Re: PCP, and 6434bis (was Re: IPv6 only host NAT64 requirements?)

On Thu, Nov 16, 2017 at 1:53 AM Tim Chown <Tim.Chown@jisc.ac.uk> wrote:

> Hi,
>
> > On 15 Nov 2017, at 23:04, james woodyatt <jhw@google.com> wrote:
> >
> > On Nov 15, 2017, at 13:47, Ole Troan <otroan@employees.org> wrote:
> >>
> >>>> IMHO the optimal solution is:
> >>>> - the network SHOULD provide a host with NAT64 prefix information in
> RA;
> >>>
> >>> Disagree. If the network has NAT64, then it should deploy RFC 7225. Ye
> gods, this is the very last thing that should be jammed into RA messages.
> >>
> >> Do we really want PCP in IPv6?
> >
> > If we have any kind of NAT, then we need PCP. Using NAT without PCP
> considered harmful. That goes for NAT64 and NAT66.
>
> And PCP is still needed to negotiate firewall holes in a pure IPv6
> scenario, isn’t it?  Assuming the host with PCP is behind Simple Security.
>
> A question: is this something we should conducer for RFC6434-bis, or
> should we be silent on PCP?
>

No

> >> Is PCP successful in IPv4?
> >
> > Well, there was this: <
> https://www.ietf.org/proceedings/88/slides/slides-88-pcp-5.pdf>
> >
> >> Or does it even work well with A+P based solutions?
> >
> > Designed expressly for it.
>
> I assumed PCP was designed with an eye firmly on future routed home
> networks where firewall holes need to be opened. What is the alternative?
>

The alternative is secure host and no firewall. There is no firewall at the
ietf conference right now, right?  Are you secure ? Is there a malware
outbreak?

The fatal flaw in PCP (aside from the name) is that it assumes the host
needs protection yet it gives the host the power to control the firewall.
Next gen malware will come via email (just like today), it will encrypt
your hard drive, and then setup and c2 network on your pc via pcp
controls.  Sad!

CB

> Tim
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>