Subject: (ngtrans) I-D ACTION:draft-huitema-shipworm-00.txt

From: [email-masked]
Date: Wed, 18 Jul 2001 07:00:54 -0400

A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title		: Shipworm: Tunneling IPv6 over UDP through NATs
	Author(s)	: C. Huitema
	Filename	: draft-huitema-shipworm-00.txt
	Pages		: 16
	Date		: 17-Jul-01
	
We propose here a service that would enable nodes located behind one 
or several IPv4 NATs to obtain IPv6 connectivity by tunneling 
packets over UDP; we call this the Shipworm service. The 
establishment of the tunnel is automatic, and does not require any 
configuration parameters on the client. Running the service requires 
the help of 'Shipworm servers' and 'Shipworm relays'; the Shipworm 
servers are stateless, and only have to manage a small fraction of 
the traffic between Shipworm clients; the Shipworm relays act as 
IPv6 routers between the Shipworm service and the 'native' IPv6 
Internet.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-huitema-shipworm-00.txt

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-huitema-shipworm-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-huitema-shipworm-00.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Pekka Savola <[email-masked]>
Date: Wed, 18 Jul 2001 20:12:57 +0300 (EEST)

> 	Title		: Shipworm: Tunneling IPv6 over UDP through NATs

Most importantly:

I have hard time understanding how on earth could this protocol could be
stateless from server's point of view; assuming the ipv6 shipworm address
is like:

2003:aabb:ccdd:1234:<eui64>

Now, aabb:ccdd is a global IPv4 address of the Shipworm server,
and 1234 is the hexadecimal representation of the port.

Now these must form a mapping:

port 0x1234: tunnel the packet to internal NAT ipv4 address xx.yy.zz.ww
             port blarg.

Joe IPv6 User (e.g. with 3ffe::/16) knows where to send a packet with
dst=2003:aabb:ccdd:1234; (tunnel it himself or) via shipworm relay to IPv4
address aabb:ccdd port TBD.  But how does the shipworm server just after
receiving the packet know where to put it?  0x1234 is insufficient space
for enconding NATted IPv4 address unless there's some state in the server,
and if the aabb:ccdd wasn't shipworm server's address, how could it have
ended up there?

Or was it some other form of stateless that was meant here?

Or have I gravely misunderstook something?

I'll keep away from most until this is cleared..

Some other comments...

It says, in Chapter 3:

---
The Shipworm routers must be connected to the IPv6 Internet and must
participate in IPv6 routing; they must be able to announce
reachability over IPv6 of the "Shipworm service IPv6 prefix." They
must then be able to relay packets over IPv4 UDP towards Shipworm
clients. It is very sensible to combine the functions of Shipworm
server and Shipworm relay in a single box.
---

There is no tecnical reason why Shipworm routers would have to be
dual-homed.  "Virtually dual-homed", perhaps.  All you need is add a box
with one interface in private LAN, and configure the NAT box to pass the
traffic through to its global address untouched.

In 4.2.4, Maintenance, there is:
---
The Shipworm client must ensure that the mappings that it uses
remain valid. It does so by checking that packets are regularly
received from the Shipworm server.

At regular intervals, the client must check the "date and time of
the last interaction with the Shipworm server", to ensure that at
least one packet has been received in the last 30 seconds. If this
is not the case, the client shall send a router solicitation to the
Shipworm IPv6 Anycast address. When the router advertisement is
received, the client checks that the advertised prefix corresponds
to the current Shipworm service prefix. If this is not the case, the
mapping has changed; the client must check that the new prefix is
valid, as specified in the qualification procedure. It should then
invalidate the addresses derived from the old prefixes.
---

Why is this?  Even though anycast address is used, I don't see this to be
fundamentally different from e.g. NUD.  The mappings only become important
when you send packets, at which time you could perform this if you have a
reason to believe Shipworm server has failed.

This kind of "keepalive" would be important if there were e.g. stateful
UDP firewalls between clients and server, but that's not often the case I
suspect.  If this is one goal, it should be noted in the draft.

Not that there's that much _harm_ in having this -- it just adds a little
complexity and and (close to) negligible amount "useless" packets.

Addional security considerations:

Being able to specify the dst port for UDP tunneling opens up some
interesting DoS/portscan scenarios; for example, you can make shipworm
relay router probe all the possible IPv4 UDP ports of everybody in the
Internet....

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Michael Richardson <[email-masked]>
Date: Wed, 18 Jul 2001 15:44:36 -0400

>>>>> "Internet-Drafts" == Internet-Drafts  <[email-masked]> writes:
    Internet-Drafts> 	Title		: Shipworm: Tunneling IPv6 over UDP through NATs
    Internet-Drafts> 	Author(s)	: C. Huitema
    Internet-Drafts> 	Filename	: draft-huitema-shipworm-00.txt
    Internet-Drafts> 	Pages		: 16
    Internet-Drafts> 	Date		: 17-Jul-01

  So, this is identical to the proposal that I had started writing up
in February. Christian did a much better job than I, and even gave it
a nice cute name, whose definition I repeat here.

  I have to read a little more carefully, but I think that my code 
may in fact be compatible already with his, but I'm not certain. At least
the data transmission is. (How many ways can you put a IPv6 packet over
UDP?)
  I did not use IPv4 anycast addresses because frankly, I've never seen one
that really worked. 
  The only difference that I had was that my server responded directly to
a request to echo the clients source address and port back. The client then
worried about how to construct its address. Christian uses router
advertisements instead, which makes complete sense.

  I think that I can have some code before London (not that I'll be there).

====

5.6     Why do we use the name Shipworm?

A "Shipworm" is a little saltwater critter that is common in the 
harbors of warm seas and that digs holes in immersed wood pieces, 
such as boat hulls or posts. The animal is not an actual worm - it 
is a mollusk. The Shipworm service also digs holes, albeit in NATs, 
not in wood. 

On one hand, one may think that the shipworm is a pretty nasty 
animal. On the other hand, the animal only survives in relatively 
clean and unpolluted water; its recent comeback in several Northern 
American harbors is a testimony to their newly retrieved 
cleanliness. The Shipworm service should, in turn, contribute to a 
newly retrieved transparency of the Internet.