Subject: RE: (ngtrans) W.G. Last Call on "Shipworm: Tunneling IPv6 over UDP through NATs"

From: "Christian Huitema" <[email-masked]>
Date: Tue, 2 Oct 2001 13:58:33 -0700

> My concern was that NAT vendors, who make the hardware that most needs
> IPv6 support, will no longer have a reason to support IPv6.  But I bet
> there's enough competition in the NAT market that the IPv6 
> support will be
> available before the users even really care.  

I certainly agree it is a concern. OTOH, there are NAT that are out
there already, and have no chance of being reprogrammed. Let's hope, as
you say, that market pressure will prevail.

> Yes, but how many administrators read all RFCs as soon as 
> they come out,
> just to make sure their firewalls are up-to-date?  I know 
> they *should*,
> but in practice that doesn't happen.  It will take many months after
> Shipworm becomes available for admins to figure out that it 
> even exists.  
> Thus, you can't assume that simply because an administrator 
> hasn't blocked
> the Shipworm UDP port, they don't mind the use of Shipworm on their
> network.  They may have figured that any protocol that uses UDP is
> probably safe, which is true in general.

I see your concern. It has to do with users automatically starting
Shipworm without even knowing. I am not sure it is so much of an issue,
since one would also have to discover their specific IP address in order
to do anything useful. In any case, there is a simple way out: if IPv6
is locally available, then Shipworm will definitely not start.

> My point here is that you are taking UDP, which is generally 
> assumed to be
> fairly benign, and you're tunneling an entire network 
> protocol through it.  

I am not convinced that firewall managers generally assume UDP to be
"fairly benign." Quite the contrary, in fact.

> I wouldn't be too surprised if what really gets everybody 
> IPv6-enabled is
> if a popular P2P app enables the IPv6 stack as part of the install
> procedure.

Fine. How do you reconcile that with "not allowing Shipworm by default"
? It seems that the first thing the application will do is, use a local
command and enable the stack...

> Well, my question was really whether we can expect Shipworm 
> as some sort 
> of free XP add-on in the not-too-distant future, or if we'll 
> have to wait 
> for Windows XXP or XP 2.0 or whatever the next version will 
> be called.  It 
> will be nice if it's integrated into a service pack so users 
> won't have to 
> download it themselves.  -Nathan

An IETF working group is not the proper place to discuss product plans.
Sorry.

-- Christian Huitema

---

From: Nathan Lutchansky <[email-masked]>
Date: Tue, 2 Oct 2001 18:36:01 -0400

On Tue, Oct 02, 2001 at 01:58:33PM -0700, Christian Huitema wrote:
> > Yes, but how many administrators read all RFCs as soon as they come
> > out, just to make sure their firewalls are up-to-date?  I know they
> > *should*, but in practice that doesn't happen.  It will take many 
> > months after Shipworm becomes available for admins to figure out that 
> > it even exists. Thus, you can't assume that simply because an 
> > administrator hasn't blocked the Shipworm UDP port, they don't mind 
> > the use of Shipworm on their network.  They may have figured that any 
> > protocol that uses UDP is probably safe, which is true in general.
> 
> to do anything useful.

True - the IPv6 addresses assigned via Shipworm are not expected to be 
long-lived, nor entered into DNS.  There are other ways of obtaining IP 
addresses though; chat systems like ICQ and IRC will provide the IP 
address of any user.

> In any case, there is a simple way out: if IPv6 is locally available,
> then Shipworm will definitely not start.

Oh, that's an interesting way to push for IPv6 adoption.

> > assumed to be fairly benign, and you're tunneling an entire network 
> > protocol through it.
> 

I hope you're right.  All the firewalls I've used allow pretty much all 
UDP traffic, as long as it is initiated from the node inside the firewall.  
Such liberal UDP policies are my basis for concern.

> > I wouldn't be too surprised if what really gets everybody IPv6-enabled
> > is if a popular P2P app enables the IPv6 stack as part of the install
> > procedure.
> 
> Fine. How do you reconcile that with "not allowing Shipworm by default"?
> It seems that the first thing the application will do is, use a local

I wasn't implying that it would be a responsible thing for P2P developers
to do.  I simply said that I wouldn't be surprised if it happened.  P2P
apps have a lot of irresponsible functionality already, so it wouldn't be
a big step for one of them to reconfigure a user's network stack without
asking.

At any rate, I'm happy with Shipworm now that my concerns have been heard.  
Thank you for your work on this draft, I hope it will provide for the
pervasiveness we all expect.  -Nathan

-- 
+-------------------+---------------------+------------------------+
| Nathan Lutchansky | [email-masked] |  Lithium Technologies  |
+------------------------------------------------------------------+
|  I dread success.  To have succeeded is to have finished one's   |
|  business on earth...  I like a state of continual becoming,     |
|  with a goal in front and not behind. - George Bernard Shaw      |
+------------------------------------------------------------------+