Re: [pcp] PCP proxying / relaying

[Alain Durand <[e-mail]>]

Dan:

It seems to me that our 'old' idea of using the AFTR IANA assigned address (192.0.0.1)
as the default address of the PCP server (instead of sending to the default router) would
actually solve this problem more elegantly...

What do you think?

   - Alain.

On Mar 11, 2011, at 3:18 PM, Dan Wing wrote:

> A subscriber might have multiple IP addresses, from the same ISP.  There are
> 
> several ways this could occur:
> 
>  * IPv6 subscriber with a /64 (e.g., native IPv6, with a CPE implementing 
>    Simple CPE Security [RFC6092]).  This is unrelated to IPv4, and might
>    be an IPv6-only subscriber, a Dual-Stack Lite subscriber, 6rd
> subscriber,
>    dual-stack subscriber, and so on.
> 
>  * Dual-Stack Lite subscriber, with an IPv6 /64 and multiple IPv4 addresses
> 
>  * IPv4-only subscriber with multiple IPv4 addresses (e.g., "business
> service"),
>    behind a CGN.
> 
> (There are probably others, which don't yet exist on anyone's radar, such as
> an ISP offering filtering (firewalling) for an IPv4 subscriber, in order to
> block incoming IPv4 address sweeps, pings, etc., prior to consuming access
> link bandwidth.)
> 
> 
> For all of these cases, consensus seems to be that we do not want any
> arbitrary host to create, modify, or delete mappings for any other arbitrary
> host.  Rather, we want only the subscriber's CPE to do that.  The subscriber
> would need to log into the CPE to do that, using the CPE's administrative
> interface (e.g., HTTP with the administrative username/password).
> 
> 
> If PCP is implemented in end hosts (e.g., PCs), this is complicated by PCP
> clients which send PCP requests to their default gateway.  Several network
> topologies could exist.  For example, with DS-Lite or other dual-stack
> technologies with an ISP-operated PCP-aware CGN, two scenarios would be in
> operation at the same time, one scenario for each address family.
> 
> Whenever there are multiple IPv4 addresses at the subscriber's premise,
> either because of DS-Lite or because of a "business class" service, the
> scneario looks like this:
>   [IPv4 host]--[PCP-aware CPE router]--------[PCP server and CGN at
> ISP]--<Internet>
> 
> For IPv6, the PCP-aware router in the CPE implements Simple CPE Security
> [RFC6092] and the scenario looks like this:
>   [IPv6 host]--[PCP-aware CPE router]--<Internet>
> 
> 
> There are two ways that PCP can be handled in the CPE router:
> 
>  1.  CPE router passes packet using internal node's IPv4 address.  This
>      is simple routing.
>  2.  CPE router passes packet using the CPE router's own IPv4 
>      external address (e.g., for DS-Lite would be 192.0.0.2).  This
>      requires doing "PCP proxying" or "PCP Relaying" (see below).
>  3.  CPE router passes packet using the CPE router's external 
>      IPv6 address.  This requires doing "PCP proxying" or "PCP 
>      Relaying".
> 
> PCP proxying:  described in draft-bpw-pcp-proxy-00.txt.  Implements
> a PCP server in the CPE router which understands most of the protocol.
> 
> PCP relaying:  this is more akin to how DHCP Relay works today.  In
> DHCP relay, a DHCP-aware router on the local LAN picks up the 
> broadcasted message, populates the GIADDR field (so that the router
> does not need to maintain state) and forwards the DHCP message to
> the DHCP server's IP address.  The packet's source address is
> re-written to the router's IP address, so the DHCP server's response
> goes back to the router, which uses the GIADDR to send the message
> back to its original interface.  
> 
> Critical distinction between PCP Proxy and PCP relay is this:  the
> relay understands very, very little of the protocol.
> 
> 
> A concern I have, which others have raised usually in conjunction
> with the term "ALG", is that PCP proxying might prevent the PCP
> protocol from being extended.  For example, introducing a new 
> OpCode requires updating the PCP Client and PCP server (which is 
> normal, necessary, and expected) but if it requires also updating
> the PCP Proxy, we will have harmed ourselves.  As we all know,
> software in CPE routers is seldom, if ever, upgraded by users.
> Most don't know their CPE routers even run software that can be
> upgraded, don't know how to do it, or are afraid of bricking it.
> 
> 
> My question to the group, and to Francis:  how close to a "relay"
> can we get, so that the PCP-aware software in the CPE router 
> does the least amount of work?
> 
> -d
> 
> 
> 
> _______________________________________________
> pcp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pcp