Re: [pcp] How can I make a ~stateless forwarding PCP proxy again?

Hi Markus,

we had this discussion in the past but and I, for one, backed the idea of PCP being able to support stateless proxies.  So, you are not alone there but maybe you want to write a draft about it so the WG can discuss it.

thanks,

Reinaldo

________________________________________
From: pcp [pcp-bounces@ietf.org] on behalf of Markus Stenberg [markus.stenberg@iki.fi]
Sent: Monday, May 05, 2014 10:59 AM
To: pcp@ietf.org
Subject: [pcp] How can I make a ~stateless forwarding PCP proxy again?

Let’s assume I have client, proxy, and server. Proxy isn’t even firewall, nor is it NAT.

[1] Client sends to proxy (first-hop router).  Proxy replaces internal IP with it’s own, adds THIRD_PARTY, and forwards to real server it decides based on magic.

[2] Server sends back response to proxy.

[3] Proxy has no per-client state, and drops packet as it can’t find client’s address from anywhere.

Motivation:

For homenet use cases, for inner routers within home, you _won’t_ want actually firewall or NAT to be involved, but you _do_ need a proxy to make decisions about which CER to talk to with different source addresses as it’s not really addressed by current solutions and routers know more about network topology changes than the client will in any case.

For example, IPv4 uplink may change somewhere ‘in the network’, and current PCP client implementations I play with wouldn’t even know about how to learn of it, not to even mention react to it. This is reality in my NAT-‘enabled’ home, as at a time I have only one upstream NAT active, but it may change, based on active-standby model (and yes, it could be on different routers).

As another example, IPv6 traffic within a home network is routed based on source prefix, but I have yet to see PCP client implementation that does server selection based on this (is it even specified?).  Yet making firewall holes would be still nice.

As I _do_ control both (mostly fictional) proxy implementation as well as the (mostly functional) server implementation, my current plan is to add option which just contains client’s address at proxy, and strip it on way back from proxy to client. Is there a better solution?

Cheers,

-Markus

P.S. I’ll accept that it’s host’s responsibility always if and only if every device (mostly with fruity logo on them) on my home that talks PCP actually deals with this stuff somehow magically. I’m not holding my breath, though.

_______________________________________________
pcp mailing list
pcp@ietf.org
https://www.ietf.org/mailman/listinfo/pcp