Subject: [pcp] PCP reliability models

From: Francis Dupont <[email-masked]>
Date: Fri, 06 Aug 2010 16:48:04 +0200

PCP needs a reliability model, i.e., to specify how to recover
from a PCP server reboot.

Today we have two incompatible models: the stateful server and
the NAT-PMP one ('seconds since start of epoch').

The stateful server is pretty simple: the server keeps in stable
storage some state with the mappings (both installed and in hold down
mappings). When it reboots the mappings which are not expired are
re-installed (or held down) for the remaining of the lifetime.
There is no security issue and it is transparent (modulo packet
losses during the reboot), of course this requires stable storage
for the PCP server, so perhaps we don't want to require this model.

The NAT-PMP model relies on recovery from clients: the protocol
adds a reboot indication in all responses and in multicast announces,
so clients can ask their mappings to be re-installed. This is
convenient for 'small' NATs without stable storage (this is why
it was proposed for NAT-PMP) but is *not* suitable for a CGN
for (at least) two reasons:
 - reboot announces must be sent to all clients, this works
  well in directly attached LANs using multicast, but this doesn't
  scale for a CGN (both for the diffusion of the information and
  its avalanche effect).
 - this raises a major security issue for a CGN: when a bad guy
  receives the announce the CGN has lost all its mappings, he can
  try to steal some of them. Worst, it makes crashing the CGN very
  attractive for him.

So I propose either to give up for the NAT-PMP model or to keep it
for some cases but with a special value for the SSSOE which means
the server keeps state.

[email-masked]