Re: [pcp] Capability discovery

[Alper Yegin <[e-mail]>]

>>>> -----Original Message-----
>>>> From:[e-mail]  [mailto:[e-mail]] On Behalf Of
>>>> Yoshihiro Ohba
>>>> Sent: Thursday, October 04, 2012 8:04 PM To:[e-mail]
>>>> Subject: [pcp] Capability discovery
>>>> 
>>>> There has been a question on what to do when PCP client supports PCP
>>>> authentication while PCP server does not, and vise versa.
>>> Yes, that problem needs to be solved.
>>> 
>>>> The same issue will exist for future PCP extensions.
>>> I disagree that problem exists for PCP extensions.  The client can
>>> simply try to use the extension, and will either get back an error
>>> (e.g., UNSUPP_OPCODE or UNSUPP_OPTION error), or the option will
>>> not be included in the response (for options outside the mandatory-
>>> to-process range).
>> 
>> In that case, the problem is specific to side-by-side PANA approach
>> which does not use PCP opcode/options.  Is this correct?
> 
> Yes, I believe that's correct.


Let's look at the whole space and see where the issue arises.

1. PANA tunneling
No problem. 

2. PANA port-sharing (side-by-side)

2.1. DHCP-based PCP server discovery
Not a problem, we can easily define auth_requirement as an attribute of the PCP server.

2.2. Implicit (non-DHCP-based) PCP server discovery (PCP server is the default gateway).

2.2.a. Client and server supports auth
No problem

2.2.b. Client does not support, server supports&requires auth
Not a problem. Server sends an error in response to unauthenticated request.

2.2.c. Client and server does not support auth
No problem

2.2.d. Client supports auth, server does not support auth.
Earlier example to cause an issue was when the client starts with auth, and the server does not understand what was going on (server would think the client is talking version PCP 128).

But, we can easily require "clients that do  not know the server's capability and policy" to start with "no auth" and see what happens.
Either the PCP goes thru, which is fine; or the client receives a PCP auth error in which case it learns to go back and try with auth.

So, overall, there does not seem to be an issue. Am I missing something?


Alper