[pcp] PCP proxying / relaying

["Dan Wing" <[e-mail]>]

A subscriber might have multiple IP addresses, from the same ISP.  There are

several ways this could occur:

  * IPv6 subscriber with a /64 (e.g., native IPv6, with a CPE implementing 
    Simple CPE Security [RFC6092]).  This is unrelated to IPv4, and might
    be an IPv6-only subscriber, a Dual-Stack Lite subscriber, 6rd
subscriber,
    dual-stack subscriber, and so on.

  * Dual-Stack Lite subscriber, with an IPv6 /64 and multiple IPv4 addresses

  * IPv4-only subscriber with multiple IPv4 addresses (e.g., "business
service"),
    behind a CGN.

(There are probably others, which don't yet exist on anyone's radar, such as
an ISP offering filtering (firewalling) for an IPv4 subscriber, in order to
block incoming IPv4 address sweeps, pings, etc., prior to consuming access
link bandwidth.)


For all of these cases, consensus seems to be that we do not want any
arbitrary host to create, modify, or delete mappings for any other arbitrary
host.  Rather, we want only the subscriber's CPE to do that.  The subscriber
would need to log into the CPE to do that, using the CPE's administrative
interface (e.g., HTTP with the administrative username/password).


If PCP is implemented in end hosts (e.g., PCs), this is complicated by PCP
clients which send PCP requests to their default gateway.  Several network
topologies could exist.  For example, with DS-Lite or other dual-stack
technologies with an ISP-operated PCP-aware CGN, two scenarios would be in
operation at the same time, one scenario for each address family.

Whenever there are multiple IPv4 addresses at the subscriber's premise,
either because of DS-Lite or because of a "business class" service, the
scneario looks like this:
   [IPv4 host]--[PCP-aware CPE router]--------[PCP server and CGN at
ISP]--<Internet>

For IPv6, the PCP-aware router in the CPE implements Simple CPE Security
[RFC6092] and the scenario looks like this:
   [IPv6 host]--[PCP-aware CPE router]--<Internet>


There are two ways that PCP can be handled in the CPE router:

  1.  CPE router passes packet using internal node's IPv4 address.  This
      is simple routing.
  2.  CPE router passes packet using the CPE router's own IPv4 
      external address (e.g., for DS-Lite would be 192.0.0.2).  This
      requires doing "PCP proxying" or "PCP Relaying" (see below).
  3.  CPE router passes packet using the CPE router's external 
      IPv6 address.  This requires doing "PCP proxying" or "PCP 
      Relaying".

PCP proxying:  described in draft-bpw-pcp-proxy-00.txt.  Implements
a PCP server in the CPE router which understands most of the protocol.

PCP relaying:  this is more akin to how DHCP Relay works today.  In
DHCP relay, a DHCP-aware router on the local LAN picks up the 
broadcasted message, populates the GIADDR field (so that the router
does not need to maintain state) and forwards the DHCP message to
the DHCP server's IP address.  The packet's source address is
re-written to the router's IP address, so the DHCP server's response
goes back to the router, which uses the GIADDR to send the message
back to its original interface.  

Critical distinction between PCP Proxy and PCP relay is this:  the
relay understands very, very little of the protocol.


A concern I have, which others have raised usually in conjunction
with the term "ALG", is that PCP proxying might prevent the PCP
protocol from being extended.  For example, introducing a new 
OpCode requires updating the PCP Client and PCP server (which is 
normal, necessary, and expected) but if it requires also updating
the PCP Proxy, we will have harmed ourselves.  As we all know,
software in CPE routers is seldom, if ever, upgraded by users.
Most don't know their CPE routers even run software that can be
upgraded, don't know how to do it, or are afraid of bricking it.


My question to the group, and to Francis:  how close to a "relay"
can we get, so that the PCP-aware software in the CPE router 
does the least amount of work?

-d