Subject: RE: (ngtrans) W.G. Last Call on "Shipworm: Tunneling IPv6 over UD P through NATs"

From: "Christian Huitema" <[email-masked]>
Date: Thu, 4 Oct 2001 09:09:58 -0700

Keith,

There is an explicit trade-off between ease of deployment and stable
addresses. Shipworm errs on the side of "ease of deployment", based on
four assumptions:

1) That the addresses will be stable enough, i.e. that we can keep them
for several hours by use of the "maintenance" procedure.

2) That the lack of permanent addresses can be alleviated by the use of
appropriate name services; you will note that P2P apps, from Napster to
Fasttrack, actually incorporate such services. Given such services,
having a globally reachable address enables many scenarios that are just
barred by existing NATs.

3) That if permament addresses are actually needed, they can be provided
by the combination of Shipworm and Mobile IPv6.

Providing addresses that can be use as stable identifiers has an
implicit cost: your identifier is only worth anything if it is
authenticated. This implies running a control protocol of some sort,
which in turn requires maintaining a database of users and passwords,
and probably some accounting mechanism. Such procedures do increase the
cost of providing the service; they also force the end user to provide
some parameterization, which goes against our objective of automatic
deployment of IPv6 everywhere.

I did review your 6overNAT proposal, and I actually use the same
encapsulation; indeed, we share the same basic objective, a wide
deployment of IPv6 despite the NATs. There are three differences between
Shipworm and 6overNAT:

1) we enable direct transmission to the host behind the NAT, without
requiring all packets to go through a "border box". This can
significantly lower the cost of providing a Shipworm service.

2) we target a deployment on the global Internet, while 6overNAT targets
deployment in a single domain, marked by a "border box." In that
respect, Shipworm is more like 6to4, while 6overNAT is more like ISATAP.

3) we don't require any configuration of the Shipworm client.

I think that the Shipworm proposal solves a real problem, is complete,
and can be deployed almost immediately. Frankly, the sooner we can
bypass the NAT, the better!

-- Christian Huitema

> -----Original Message-----
> From: Keith Moore [mailto:[email-masked]] 
> Sent: Thursday, October 04, 2001 8:35 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: (ngtrans) W.G. Last Call on "Shipworm: Tunneling 
> IPv6 over UD P through NATs" 
> 
> 
> and then there was 6overNAT: draft-moore-6overnat-00.txt
> 
> I really think it's inappropriate to consider just shipworm when there
> were other proposals in the same space.  OTOH, if shipworm works just
> as well as the others, I don't care too much which one we pick.
> 
> I'm still trying to find time to evaluate shipworm but one thing
> that bugs me is the idea that shipworm doesn't supply you with
> a stable IPv6 prefix.  it seems to me that unless IPv6 prefixes
> are reasonably stable and can be used as reliable endpoint identifers
> by p2p apps, we haven't provided much value added over IPv4 with NAT.
> 
> > Sorry to ask at the last call phase, but have you compared 
> Shipworm with
> > other IPoverUDP proposals? I know of at least two: IPSec
> > (draft-ietf-ipsec-udp-encaps-00.txt) and Mobile IP
> > (draft-levkowetz-mobileip-nat-tunnel-00.txt). 
>

---

From: Keith Moore <[email-masked]>
Date: Thu, 04 Oct 2001 12:31:01 -0400

> for several hours by use of the "maintenance" procedure.

"stable enough" for what?  several hours isn't even close to
stable enough to support distributed applications that run for
weeks or more.  several hours is not even stable enough for
conventional applications like long-running FTP transfers, or 
keeping ssh sessions open.
 
> Fasttrack, actually incorporate such services. 

that's an overgeneralization.  many P2P apps do not incorporate
such services.  what you seem to be saying is that each app needs to
solve the address stability problem for itself.  which sounds rather bizarre.

> by the combination of Shipworm and Mobile IPv6.

yes, they can, if those forwarders actually exist.  but that's like 
saying we're going to reduce this problem to a previously unsolved 
problem and call it done.

> authenticated. 

strongly disagree.

in the v4 world, stable addresses are quite valuable even if there is 
no authentication; the same would presumably be true of v6 addresses.   
true, they're not very valuable as authenticators, but they're valuable 
for providing a reliable contact point for a host or process.

now, there is a potential attack against any tunneling system 
which would allow anyone to impersonate someone else's address 
if the forwarder did not require authentication.  but that's not the
same thing as saying that stable addresses are only valuable if they
are authenticated.

> This implies running a control protocol of some sort,

automatic deployment of a severely downgraded IPv6 may not be terribly 
beneficial.    the danger is that the IPv6 that gets widely deployed
will have little more functionality than NATted IPv4.  if IPv6 doesn't
provide more functionality to apps, what's the point?

as I said, I want to find time to thoroughly review shipworm.  but
from a cursory reading I don't think it's ready to ship as-is.  

Keith

---

From: Pekka Savola <[email-masked]>
Date: Thu, 4 Oct 2001 19:47:17 +0300 (EEST)

> for several hours by use of the "maintenance" procedure.

From what I understand, I don't see why the addresses couldn't be kept for
much, much longer period.

Like a day, or a week or a month.

That is, when the NAT box is rebooted, the address is naturally lost.  I
don't see any other reasons for losing it, if it's being maintained
properly.

And when the address is lost, there is no warning.  It is lost "quick".
If the "state" of the IP address is kept in the DNS, the lifetime would
have to be really small, like 1 minute if you want to recover quickly.

Shipworm is not good enough IMO if we are satisfied with assuming it can
only provide a couple hours' worth of address stability.  A few days would
feel like an absolute minimum for me.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords