RFC 7488
Port Control Protocol (PCP) Server Selection
Abstract ✨
Okay bestie, RFC 7488 is all about Port Control Protocol (PCP) Server Selection 🎀 It's a Standards Track doc from the Internet Engineering Task Force (IETF), written by M. Boucadair (France Telecom), R. Penno, D. Wing, P. Patil, and T. Reddy (Cisco). It came out in March 2015, its ISSN is 2070-1721, and it updates RFC 6887 🦋 So it's building on that one, not replacing it.
This doc spells out how a PCP client figures out which PCP server(s) to contact when it's been given one or several PCP server IP addresses 💖
This document updates RFC 6887.
Status of This Memo 📜
Okay so this is an Internet Standards Track document 🌈 It's a product of the IETF, which means it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG).
If you want more on Internet Standards, check out Section 2 of RFC 5741 ✨ Info about the current status, any errata, and how to give feedback lives at http://www.rfc-editor.org/info/rfc7488.
Copyright Notice ⚖️
Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication. Please read these carefully, because they describe your rights and restrictions for this document 🙈 Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License.
Table of Contents 🗂️
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology and Conventions . . . . . . . . . . . . . . . . . 3
2.1. Requirements Language . . . . . . . . . . . . . . . . . . 3
2.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3
3. IP Address Selection: PCP Server with Multiple IP Addresses . 3
4. IP Address Selection: Multiple PCP Servers . . . . . . . . . 4
5. Example: Multiple PCP Servers on a Single Interface . . . . . 5
6. Security Considerations . . . . . . . . . . . . . . . . . . . 7
7. References . . . . . . . . . . . . . . . . . . . . . . . . . 7
7.1. Normative References . . . . . . . . . . . . . . . . . . 7
7.2. Informative References . . . . . . . . . . . . . . . . . 8
Appendix A. Multihoming . . . . . . . . . . . . . . . . . . . . 9
A.1. IPv6 Multihoming . . . . . . . . . . . . . . . . . . . . 9
A.2. IPv4 Multihoming . . . . . . . . . . . . . . . . . . . . 10
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 11
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 121. Introduction 🌸
Okay so a host can have multiple network interfaces (like 3G, IEEE 802.11, etc.), and each one can be set up with different PCP servers. Every PCP server you learn must be associated with the interface it was learned on 💅 The generic multi-interface considerations are covered in Section 8.4 of [RFC6887]. Multiple PCP server IP addresses may be configured on a PCP client in some deployment contexts, like multihoming (see Appendix A). A PCP server can also have multiple IP addresses associated with it. It's out of scope for this document to list every deployment scenario that needs multiple PCP server IP addresses to be configured ✨
If a PCP client discovers multiple PCP server IP addresses, it needs to work out what to do next. For example, it has to decide whether PCP entries get installed on all or just a subset of the discovered IP addresses, and whether some PCP entries need to be removed. This document makes the following assumptions:
- There is no requirement that multiple PCP servers configured on the same interface have the same capabilities.
- PCP requests to different PCP servers are independent, the result of a PCP request to one PCP server does not influence another.
- The configuration mechanism must distinguish IP addresses that belong to the same PCP server.
This document specifies the behavior a PCP client [RFC6887] follows to contact its PCP server(s) [RFC6887] when it's configured with one or several PCP server IP addresses (e.g., using DHCP [RFC7291]). It doesn't make any assumption about the type of these IP addresses (i.e., unicast/anycast) 🦋
2. Terminology and Conventions 📖
2.1. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].
2.2. Terminology 💜
- PCP client: a PCP software instance responsible for issuing PCP requests to a PCP server. Refer to [RFC6887].
- PCP server: a software instance that receives and processes PCP requests from a PCP client. A PCP server can be co-located with or be separated from the function it controls (e.g., Network Address Translation (NAT) or firewall). Refer to [RFC6887].
3. IP Address Selection: PCP Server with Multiple IP Addresses 🦋
This section is the behavior a PCP client follows to contact its PCP server when the PCP client has multiple IP addresses for a single PCP server. Here's the play-by-play 👑
- A PCP client should construct a set of candidate source addresses (see Section 4 of [RFC6724]) based on application input and PCP [RFC6887] constraints. For example, when sending a PEER or a MAP with a FILTER request for an existing TCP connection, the only candidate source address is the source address used for the existing TCP connection. But when sending a MAP request for a service that will accept incoming connections, the candidate source addresses may be all of the node's IP addresses or some subset of IP addresses on which the service is configured to listen.
- The PCP client then sorts the PCP server IP addresses as per Section 6 of [RFC6724], using the candidate source addresses selected in the previous step as input to the destination address selection algorithm.
- The PCP client initializes its Maximum Retransmission Count (MRC) to 4.
- The PCP client sends its PCP messages following the retransmission procedure specified in Section 8.1.1 of [RFC6887]. If no response is received after MRC attempts, the PCP client retries the procedure with the next IP address in the sorted list.
The PCP client may receive a response from an IP address after exhausting MRC attempts for that particular IP address. The PCP client SHOULD ignore such a response, because receiving a delayed response after exhausting four retransmissions sent with exponentially increasing intervals is an indication that problems are to be encountered in the corresponding forwarding path and/or when processing subsequent requests by that PCP server instance 😬
If, when sending PCP requests, the PCP client receives a hard ICMP error [RFC1122], it MUST immediately try the next IP address from the list of PCP server IP addresses.
- If the PCP client has exhausted all IP addresses configured for a given PCP server, the procedure SHOULD be repeated every 15 minutes until the PCP request is successfully answered.
- Once the PCP client has successfully received a response from a PCP server's IP address, all subsequent PCP requests to that PCP server are sent on the same IP address until that IP address becomes unresponsive. In case the IP address becomes unresponsive, the PCP client clears the cache of sorted destination addresses and follows the steps described above to contact the PCP server again.
For efficiency, the PCP client SHOULD use the same Mapping Nonce for requests sent to all IP addresses belonging to the same PCP server. As a reminder, nonce validation checks are performed when operating in the Simple Threat Model (see Section 18.1 of [RFC6887]) to defend against some off-path attacks 🔐
4. IP Address Selection: Multiple PCP Servers 🌈
This section describes the behavior a PCP client follows to contact multiple PCP servers, with each PCP server reachable on a list of IP addresses. There is no requirement that these multiple PCP servers have the same capabilities ✨
Note that how PCP clients are configured to separate lists of IP addresses of each PCP server is implementation specific and deployment specific. For example, a PCP client can be configured using DHCP with multiple lists of PCP server IP addresses; each list is referring to a distinct PCP server [RFC7291].
If several PCP servers are configured, each with multiple IP addresses, the PCP client contacts all PCP servers using the procedure described in Section 3.
As specified in Sections 11.2 and 12.2 of [RFC6887], the PCP client must use a different Mapping Nonce for each PCP server with which it communicates.
If the PCP client is configured, using some means, with the capabilities of each PCP server, a PCP client may choose to contact all PCP servers simultaneously or iterate through them with a delay.
This procedure may result in a PCP client instantiating multiple mappings maintained by distinct PCP servers. The decision to use all these mappings or delete some of them depends on the purpose of the PCP request. For example, if the PCP servers are configuring firewall (not NAT) functionality, then the client would, by default (i.e., unless it knows that they all replicate state among them), need to use all the PCP servers 🫶
5. Example: Multiple PCP Servers on a Single Interface ✨
okay so Figure 1 is giving us a super clear example of the server selection stuff we just covered in Sections 3 and 4 🎀 here, PCP servers A and B are chilling with edge routers rtr1 and rtr2, and each PCP server is in charge of its own device 💅
ISP Network
| |
.........................................................
| | Subscriber Network
+----------+-----+ +-----+----------+
| PCP-Server-A | | PCP-Server-B |
| (rtr1) | | (rtr2) |
+-------+--------+ +--+-------------+
192.0.2.1 | | 198.51.100.1
2001:db8:1111::1 | | 2001:db8:2222::1
| |
| |
-------+-------+------+-----------
|
| 203.0.113.0
| 2001:db8:3333::1
+---+---+
| Host |
+-------+
Edge Routers (rtr1, rtr2)
Figure 1: Single Uplink, Multiple PCP Serversso this example is about what happens when ONE IP address for one PCP server is not responsive 🙈 the PCP client has two PCP servers configured for the same interface (PCP-Server-A and PCP-Server-B), and each one has two addresses, an IPv4 one and an IPv6 one 🦋 the client wants an IPv4 mapping, so it orders the addresses like this:
- PCP-Server-A:
- 192.0.2.1
- 2001:db8:1111::1
- PCP-Server-B:
- 198.51.100.1
- 2001:db8:2222::1
now let's say that:
- The path to reach 192.0.2.1 is broken 💀
- The path to reach 2001:db8:1111::1 is working ✨
- The path to reach 198.51.100.1 is working ✨
- The path to reach 2001:db8:2222::1 is working ✨
the PCP client sends two PCP requests at the same time, the first one to 192.0.2.1 (that's PCP-Server-A) and the second one to 198.51.100.1 (that's PCP-Server-B) 🫶 the path to 198.51.100.1 is working, so a PCP response comes back, but since the path to 192.0.2.1 is broken, nothing comes back from that one 😭 the PCP client retries four times to get a response from 192.0.2.1, and then it finally gives up on that address and sends a PCP message to 2001::db8:1111:1 💅 that path is working, so a response comes back! after that, the PCP client should keep using that responsive IP address for PCP-Server-A (2001:db8:1111::1) 🌈 and in this particular case, it will have to use the THIRD_PARTY option for IPv4 mappings 🧚
6. Security Considerations 🔥
PCP-related security considerations are discussed in [RFC6887].
okay bestie, this part is serious 😭 this document does not say how PCP server addresses get provisioned on the PCP client, so that's not its job. it's the job of the PCP server provisioning document(s) to explain the security considerations for discovering legitimate PCP servers 🔐
7. References 📚
7.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC6724] Thaler, D., Ed., Draves, R., Matsumoto, A., and T. Chown,
"Default Address Selection for Internet Protocol Version 6
(IPv6)", RFC 6724, September 2012,
<http://www.rfc-editor.org/info/rfc6724>.
[RFC6887] Wing, D., Ed., Cheshire, S., Boucadair, M., Penno, R., and
P. Selkirk, "Port Control Protocol (PCP)", RFC 6887, April
2013, <http://www.rfc-editor.org/info/rfc6887>.7.2. Informative References
[RFC1122] Braden, R., Ed., "Requirements for Internet Hosts -
Communication Layers", STD 3, RFC 1122, October 1989,
<http://www.rfc-editor.org/info/rfc1122>.
[RFC4116] Abley, J., Lindqvist, K., Davies, E., Black, B., and V.
Gill, "IPv4 Multihoming Practices and Limitations", RFC
4116, July 2005, <http://www.rfc-editor.org/info/rfc4116>.
[RFC7291] Boucadair, M., Penno, R., and D. Wing, "DHCP Options for
the Port Control Protocol (PCP)", RFC 7291, July 2014,
<http://www.rfc-editor.org/info/rfc7291>.Appendix A. Multihoming 🌸
okay so the big problem with PCP multihoming is basically "one PCP client, multiple PCP servers" 💖 like we said in Section 3, if a PCP client finds multiple PCP servers, it should send requests to all of them, with the assumptions from Section 1 🎀
the next sub-sections walk through some multihoming examples to show how the PCP client behaves 🦋
A.1. IPv6 Multihoming 💜
in this IPv6 multihomed example, two or more routers that have firewalls are sitting on one link shared with the host(s) ✨ each router is hooked up to a different service provider network, and the host gets multiple prefixes and multiple DNS servers 🌈 picture a situation where the firewalls in an IPv6 multihoming setup also run a PCP server 🔥 the PCP client finds the available PCP servers using DHCP [RFC7291] or any other provisioning mechanism 🧚 looking at Figure 2, a typical setup is to embed DHCP servers in rtr1 and rtr2 🫶 a host behind rtr1 and rtr2 can contact these two DHCP servers and grab the IP address(es) of the matching PCP server from each one 💅
the PCP client sends PCP requests in parallel to each of the PCP servers ⭐
==================
| Internet |
==================
| |
| |
+----+-+ +-+----+
| ISP1 | | ISP2 |
+----+-+ +-+----+ ISP Network
| |
.........................................................
| |
| | Subscriber Network
+-------+---+ +----+------+
| rtr1 with | | rtr2 with |
| FW1 | | FW2 |
+-------+---+ +----+------+
| |
| |
-------+----------+------
|
+---+---+
| Host |
+-------+
Figure 2: IPv6 MultihomingA.2. IPv4 Multihoming 🍓
in this IPv4 multihomed example, which is described in "NAT- or RFC2260-based Multihoming" (Section 3.3 of [RFC4116]), the gateway router is connected to different service provider networks 🌷 this method uses Provider-Aggregatable (PA) addresses assigned by each transit provider the site is connected to 💫 the site uses NAT to translate the various provider addresses into a single set of private-use addresses inside the site 🎀 in a case like this, two PCP servers might have to be present to set up NAT toward each of the transit providers 🦋 the PCP client finds the available PCP servers using DHCP [RFC7291] or any other provisioning mechanism 💅 looking at Figure 3, a typical setup is to embed the DHCP server and the PCP servers in rtr1 🫶 a host behind rtr1 can contact the DHCP server to get the IP addresses of the PCP servers ✨ and the PCP client sends PCP requests in parallel to each of the PCP servers 🌈
=====================
| Internet |
=====================
| |
| |
+----+--------+ +-+------------+
| ISP1 | | ISP2 |
| | | |
+----+--------+ +-+------------+ ISP Network
| |
| |
..............................................................
| |
| Port1 | Port2 Subscriber Network
| |
+----+--------------+----+
|rtr1: NAT & PCP servers |
| GW Router |
+----+-------------------+
|
|
|
-----+--------------
|
+-+-----+
| Host | (private address space)
+-------+
Figure 3: IPv4 MultihomingAcknowledgements 🫶
many thanks to Dave Thaler, Simon Perreault, Hassnaa Moustafa, Ted Lemon, Chris Inacio, and Brian Haberman for their reviews and comments 💖
Authors' Addresses 💌
Mohamed Boucadair
France Telecom
Rennes 35000
France
EMail: mohamed.boucadair@orange.com
Reinaldo Penno
Cisco Systems, Inc.
United States
EMail: repenno@cisco.com
Dan Wing
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134
United States
EMail: dwing@cisco.com
Prashanth Patil
Cisco Systems, Inc.
Bangalore
India
EMail: praspati@cisco.com
Tirumaleswar Reddy
Cisco Systems, Inc.
Cessna Business Park, Varthur Hobli
Sarjapur Marathalli Outer Ring Road
Bangalore, Karnataka 560103
India
EMail: tireddy@cisco.com📦 where this page comes from
- ietf: rfc7488 2015-03
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms