Subject: [P2Prg] draft-irtf-p2prg-p2pv6-problem-statement-00

From: Tim Chown <[email-masked]>
Date: Fri, 24 Mar 2006 15:45:24 +0000

On Thu, Mar 23, 2006 at 06:50:01PM -0500, [email-masked] wrote:
> 
> 	Title		: P2Pv6 (Peer-to-Peer over IPv6) Problem Statement 
> 	Author(s)	: L. Caviglione, W. Yeager
> 	Filename	: draft-irtf-p2prg-p2pv6-problem-statement-00.txt
> 	Pages		: 15
> 	Date		: 2006-3-23
> 
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-irtf-p2prg-p2pv6-problem-statement-00.txt

Hi,

I read this draft, which I think has laudible goals.

I have a few comments.   Perhaps most importantly I notice that the draft
says that IPv6 NATs will be used; to me if this is the case, then there
is no advantage to moving to IPv6 at all (on the assumption the NAT is
public to ULA mapping).   Do the authors really mean this?

Regarding transition, current practice for applications is to prefer
use of ALGs over network layer translation (NAT-PT).   But ALGs fly somewhat
in the face of direct p2p communication.  I asked this question in the
P2P SIP meeting, which I feel should have IPv4-IPv6 interworking explicitly
in its charter.

I agree that a review of IP version independence in existing models is
useful.  There are certainly some specifications and some implementations
that do not support IP version independence.   The issue of whether the
spec or the implementation breaks the independence is important.  Though
if one endpoint has an IPv4 locator and another an IPv6 locator we're
back at the translation issue.  The short-term solution may be use of
dual-stack, but integration of 'legacy' IPv4-only systems needs consideration.

The draft should add discussion of how novel IPv6 features can be used,
e.g. CGAs (RFC3972) and privacy addresses (RFC3041).  Short-lived ad-hoc
pp2p networks using privacy addresses could be an interesting topic.

But overall, I like the thrust of the work and I think it's important.

Tim

_______________________________________________
P2prg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/p2prg

---

From: Bill Yeager <[email-masked]>
Date: Fri, 24 Mar 2006 08:41:21 -0800

Hi Tim,

Thanks for you comments. You NAT question is a good one, and  
something I've thought about. I've a good friend who is a high level  
executive at NetGear and we've had discussions here.

You are right that using NAT's flies in the face of IPv6 giving to  
each of us a unique IP address and reintroducing the possibility of  
bi-directional, end-to-end connectivity without address space  
limitation considerations.

My feeling is that the NAT box producers will want to stay in  
business and offer the possibility of hiding one's IPv6 LAN address  
from the outside Internet. So, apart from having a universal IP  
address space, as you say, there is not advantage of moving to IPv6  
with NAT in place.

Perhaps NAT boxes will migrate towards firewalls? The problem here is  
that the average user will have no idea of what they really must to  
to adequately protect themselves from intrusion. This discussion can  
get very deep very quickly. And, I imagine there are solutions in the  
pipeline. My real concern is "average user friendliness." Most humans  
don't and should not even know what a network is. And, address  
considerations are way beyond their grasp. These are again long  
discussions to which I have given considerable thought.

*Not* having NAT and using IPv6 really simplifies the task of writing  
P2P systems as you well realize. Application Layer Gateways leave me  
somewhat nauseous as a P2P guy.

You've mentioned a couple of things I've not read about and Luca and  
I will check them out: CGA's and privacy addresses.

Thanks again. We will address your issues and resubmit the draft.

Bill

---

From: Luca Caviglione <[email-masked]>
Date: Fri, 24 Mar 2006 19:10:54 +0100

Dear Tim,
thank you very much for the comments.

Basically, I share the same view of Bill. However your comments about NAT are
very interesting and relevant.

I can imagine NAT to stay in the future Internet as a shortcut to hide a
network. Also, I can think about ISPs to build network by using NAT, for
instance as a way to impede users to exploit their bandwidth for commercial
purposes (think about when in the future we will have 1 Gbit Internet in our
flats).

Then, putting the NAT is a conservative perspective. And, of course, as Bill
said, manufacturers will try to stay in the market. Concerning the benefits of
having IPv6 and NAT, I can agree with you here. In an IPv6 world, NAT will be
the wrong answers to right questions (e.g., protecting users).

ALG is something I don’t like, too. But, they exist. I will investigate this
issue.

I will try also to investigate, CGAs and privacy.

Thank you for the suggestions and for the thoughts that will improve our work.

Best Regards,
Luca

> > But overall, I like the thrust of the work and I think it's important.

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

---

From: Wes Felter <[email-masked]>
Date: Fri, 24 Mar 2006 17:51:55 -0600

Bill Yeager wrote:

> My feeling is that the NAT box producers will want to stay in  business 
> and offer the possibility of hiding one's IPv6 LAN address  from the 
> outside Internet. So, apart from having a universal IP  address space, 
> as you say, there is not advantage of moving to IPv6  with NAT in place.
> 
> that the average user will have no idea of what they really must to  to 
> adequately protect themselves from intrusion. This discussion can  get 
> very deep very quickly. And, I imagine there are solutions in the  

This was discussed recently on interesting-people and maybe p2p-hackers, 
and the consensus seems to be that a connection-tracking firewall that 
only allows outgoing connections (perhaps with UPnP control over 
firewall rules) provides the same security properties under v6 as NAT 
does under v4. (This assumes that "address hiding" is not a security 
property.) So a "broadband router" that provides v4 NAT and v6 firewall 
is strictly superior to just v4 NAT and requires no extra thinking on 
the part of the user. A "broadband router" with 6to4, Teredo, DHCP-PD, 
etc. would be even better, but that stuff is less important IMO.

Given that no v6 "broadband routers" have been shipped yet (to my 
knowledge), I think the most useful P2Pv6 contribution would be a 
standardized set of firewall rules and a standardized protocol to modify 
these rules (i.e. opening holes for incoming connections). This would 
prevent v4's problem of different flavors of NAT from recurring.

Wes Felter - [email-masked]

---

From: Bill Yeager <[email-masked]>
Date: Fri, 24 Mar 2006 17:07:28 -0800

Hi Wes,

Thanks for the information and very useful thoughts:

On Mar 24, 2006, at 3:51 PM, Wes Felter wrote:

>> business and offer the possibility of hiding one's IPv6 LAN  
>> address  from the outside Internet. So, apart from having a  
>> universal IP  address space, as you say, there is not advantage of  
>> moving to IPv6  with NAT in place.
>> Perhaps NAT boxes will migrate towards firewalls? The problem here  
>> is  that the average user will have no idea of what they really  
>> must to  to adequately protect themselves from intrusion. This  
>> discussion can  get very deep very quickly. And, I imagine there  
>> are solutions in the  pipeline. My real concern is "average user  
>> friendliness." Most humans  don't and should not even know what a  
>> network is. And, address  considerations are way beyond their  
>> grasp. These are again long  discussions to which I have given  
>> considerable thought.
>
> This was discussed recently on interesting-people and maybe p2p- 
> hackers, and the consensus seems to be that a connection-tracking  
> firewall that only allows outgoing connections (perhaps with UPnP  
> control over firewall rules) provides the same security properties  
> under v6 as NAT does under v4. (This assumes that "address hiding"  
> is not a security property.) So a "broadband router" that provides  
> v4 NAT and v6 firewall is strictly superior to just v4 NAT and  
> requires no extra thinking on the part of the user.

This had not occurred to either me or Luca, and I like the idea. For  
most users address hiding is not a security issue. I'm thinking that  
there are anonymity people who like to be as stealth as possible and  
they are the exception and for them turning on NAT in such a box is  
their solution. Again, these issues are quite deep and require  
analysis. Another good topic for our P2P IPv6 research proposal.

> A "broadband router" with 6to4, Teredo, DHCP-PD, etc. would be even  
> better, but that stuff is less important IMO.
>
> standardized set of firewall rules and a standardized protocol to  
> modify these rules (i.e. opening holes for incoming connections).  
> This would prevent v4's problem of different flavors of NAT from  
> recurring.

You are correct and we'll add this to our proposals for research for  
p2p IPv6 migration.

Thanks,

Bill

---

From: Tim Chown <[email-masked]>
Date: Sun, 26 Mar 2006 23:04:25 +0100

> analysis. Another good topic for our P2P IPv6 research proposal.

The IPv6 dual-stack with IPv4+NAT path is one that is predicted to be
quite common during the transition phase.   How one 'secures' the IPv6
protocol when one (rightly or wrongly) relies on NAT to 'secure' IPv4
is open for discussion; there are naturally user interaction issues here.

I suggest you read the NAP draft that is just off to the IESG for RFC
approval:

http://www.ietf.org/internet-drafts/draft-ietf-v6ops-nap-02.txt

This includes the concept of topology hiding by use of non-aggregated
/64's in a network, if that issue is of importance to you.  It explains
how 'NAT thinking' can be removed for IPv6.   

Whoever markets the first IPv6 NAT box will be a brave person ;)

> You are correct and we'll add this to our proposals for research for  

Another interesting area lies in MIPv6 'communities of interest'; essentially
use MIPv6 to create a virtual subnet spanning whatever links the mobile
nodes happen to be on at any time.   This breaks certain assumptions about
links/subnets, but has possibilities for p2p models.
 
There's a lot more to IPv6 than just the address space;  exploring this in
the p2p domain is certainly a good idea.

-- 
Tim/::1

---

From: Tim Chown <[email-masked]>
Date: Sun, 26 Mar 2006 23:06:33 +0100

> ALG is something I don’t like, too. But, they exist. I will investigate this

Well, if you want an IPv4-only and IPv6-only node to talk 'directly' you
have to translate at some layer, be it network (NAT-PT), transport (TCP
relay) or application (ALG).   Ideally you avoid the issue by having at
least one peer dual-stack, but there won't be enough IPv4 global addresses
around for ever to deal with that.
 
> Thank you for the suggestions and for the thoughts that will improve our work.

Good luck :)

Tim