Subject: RE: (ngtrans) SIIT and Shipworm

From: "Christian Huitema" <[email-masked]>
Date: Tue, 24 Sep 2002 11:29:45 -0700

I am a bit puzzled by this discussion. SIIT and Teredo cover two
different needs: SIIT aims at providing IPv4 connectivity in a pure IPv6
infrastructure, and do that using a form of header translation; Teredo
aims at providing IPv6 connectivity in an IPv4 "privately addressed"
infrastructure, and does so using tunneling. The chances of convergence
appear limited.

> Providing an IPv6 address to an IPv4-only node without sys
> admin support would require a tunneling client that sent
> IPv6 packets over a IPv4 tunnel from user mode software.

I think there is confusion here between "sys admin" and "network admin".
Installing a tunneling client requires the moral equivalent of a driver
in the IPv4 only node; this "driver" may be pre-installed in the system,
or may have to be installed by the node's user or owner. This owner may
or may not be the same person as the owner of the network.

> That works, but the sys admin is quite likely to view it as
> an unauthorized tunnel. They would be justified in shutting
> it down. Of course they would be shutting down *all*
> tunneled IPv6 traffic.

This point is actually discussed in the security considerations in the
last Teredo draft. The main domain of application of Teredo is really
the "home network", in which there is generally no "sysadmin"; in a
managed network, the use of Teredo would indeed have to be explicitly
approved by the network administrators.

-- Christian Huitema

---

From: Caitlin Bestler <[email-masked]>
Date: Tue, 24 Sep 2002 14:40:24 -0500

On 9/24/02, Christian Huitema wrote:

>I am a bit puzzled by this discussion. SIIT and Teredo
>cover two different needs: SIIT aims at providing IPv4
>connectivity in a pure IPv6 infrastructure, and do that
>using a form of header translation; Teredo aims at
>providing IPv6 connectivity in an IPv4 "privately
>addressed" infrastructure, and does so using tunneling.
>The chances of convergence appear limited.
>

I was responding to the specific point Michael Cole's post
that argued providing an IPv6 address to an IPv4 host was
better than providing an IPv4 address to an IPv6 host.

For the reasons cited, I do not agree with that assertion.

I believe the current shipworm draft is fully compatible
with that position, as that it does not advocate use of
teredo servers over other available solutions.

Even with those limitations I agree that it is a valuable
tools for some situations, particularly as a method of
installing an "IPv6 stack" inside of a private IPv4 network
that is not ready to support IPv6 more generally.

But providing a public IPv4 address to match a public IPv6
server is inherently more friendly to existing IPv4 sites,
especially those exercising monitoring and control over
outbound connections.

>> Providing an IPv6 address to an IPv4-only node without
>> sys admin support would require a tunneling client that
>> sent IPv6 packets over a IPv4 tunnel from user mode
>> software.
>
>I think there is confusion here between "sys admin" and
>"network admin". Installing a tunneling client requires
>the moral equivalent of a driver in the IPv4 only node;
>this "driver" may be pre-installed in the system, or may
>have to be installed by the node's user or owner. This
>owner may or may not be the same person as the owner of
>the network.
>

Good point, my reference would have more properly been to
the network admin.

My assumption, which I goofed in not stating, is that even
if the system admin and network admin were different people
was that it would be rare for a system admin to violate the
network admin's policies. (And if sys admins are doing that,
the site's security is probably already compromised anyway).

It is possible for someone to provide an application
specific client, that acts as a Teredo client and does the
tunneling themselves. In a home environment, where the user,
sys admin and network admin are all the same person, this is
perfectly fine. In a corporate intranet it is likely to
result in the teredo connection being shut down -- which is
why it should not be a preferred solution in those
environments.

>> That works, but the sys admin is quite likely to view it
>> as an unauthorized tunnel. They would be justified in
>> shutting it down. Of course they would be shutting down
>> *all* tunneled IPv6 traffic.
>
>This point is actually discussed in the security
>considerations in the last Teredo draft. The main domain
>of application of Teredo is really the "home network", in
>which there is generally no "sysadmin"; in a managed
>network, the use of Teredo would indeed have to be
>explicitly approved by the network administrators.
>

I agree that the Teredo draft does indeed clarify its
intended usage and limitations well, probably better than
most drafts do. A node within a home network desiring to
access IPv6 services would indeed benefit from this service.

My disagreement was with the argument Michael Cole raised in
the context of comparing SIIT versus Teredo. Favoring the
assignment of IPv6 addresses to IPv4 nodes over assigning
IPv4 addresses to IPv6 nodes would imply that Teredo is a
preferred solution over NAT and/or SIIT solutions.

Caitlin Bestler
http://asomi.com/CaitlinBestler/