Subject: [v6ops] Status of CLAT implementation on iPhone? (IPv4 apps on IPv6-only PDP type)

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 23 Feb 2015 13:38:07 +0100

Hello participants to v6ops WG,

What is the status of a CLAT implementation on iPhone?  Any hint in that
direction?

I am asking because in private conversation I have noticed doubts about
this being done.  Or, since the iPhone relies on a bsd derivative,
it would be technically feasible to implement CLAT on it; it is nothing
more than some iptables address translation plus a bit of python
scripting in case.

(CLAT is needed by some IPv4 apps to continue working on a smartphone
  connected solely with an IPv6-only PDP type).

Alex

---

From: Mikael Abrahamsson <[email-masked]>
Date: Mon, 23 Feb 2015 13:46:40 +0100 (CET)

> What is the status of a CLAT implementation on iPhone?  Any hint in that

There is no official news that iPhone will support this. This is not 
surprising since Apple rarely talks about these things.

So until you hear something officially, people are not going to post on 
this list about it because if it's not official (and I have heard nothing 
official), then people would be violating NDAs if they talked about it if 
something was happening.

Apple has been asked to implement it by several different people and 
entities. So far I have not heard anything official that they will support 
it.

Otoh if it just arrived in the next version of iOS I wouldn't be surprised 
either, sometimes they work on things and you just get them without any 
prior notice at all.

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Tore Anderson <[email-masked]>
Date: Mon, 23 Feb 2015 13:54:21 +0100

* Alexandru Petrescu <[email-masked]>

> What is the status of a CLAT implementation on iPhone?  Any hint in that

No idea. It wouldn't surprise me if they'll just assume operators will
eventually start supporting IPV4V6 though, which doesn't seem too far
fetched now that LTE is rolling out in several economies.

> I am asking because in private conversation I have noticed doubts
> about this being done.  Or, since the iPhone relies on a bsd
> derivative, it would be technically feasible to implement CLAT on it;
> it is nothing more than some iptables address translation plus a bit
> of python scripting in case.

You can'ẗ implement a CLAT using iptables, since the IPv4 and IPv6
versions of iptables don't really mix. So you can't take an IPv4 packet
as input and output and IPv6 packet or vice versa. You can do it with a
user space daemon like TAYGA though. You'll find an CLAT implementation
for Linux using Perl/TAYGA on my Github page, it's probably not too
hard to adapt it to work on *BSD if you want to.

That said, I've always wondered if it couldn't simply be implemented as
an app. In principle a CLAT doesn't operate much differently than a
regular VPN client, and there are plenty of VPN apps AFAIK.

Tore

---

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 23 Feb 2015 13:55:17 +0100

Le 23/02/2015 13:46, Mikael Abrahamsson a écrit :
>> What is the status of a CLAT implementation on iPhone?  Any hint in
>> that direction?
>

Well, I can understand the explanation below with NDAs.

But CLAT would not be a hardware spec like e.g. a 5G feature.

CLAT would be an app that can be written and upload in a *store.

Alex

>
> So until you hear something officially, people are not going to post
> on this list about it because if it's not official (and I have heard
>  nothing official), then people would be violating NDAs if they
> talked about it if something was happening.
>
>  entities. So far I have not heard anything official that they will
> support it.
>
> Otoh if it just arrived in the next version of iOS I wouldn't be
> surprised either, sometimes they work on things and you just get them
>  without any prior notice at all.
>

---

From: Lorenzo Colitti <[email-masked]>
Date: Mon, 23 Feb 2015 23:11:53 +0900

> more than some iptables address translation plus a bit of python

They are also free to reuse existing implementations of clat, such as the
one that Android uses, which is BSD-licensed.

---

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 23 Feb 2015 16:16:11 +0100

Le 23/02/2015 15:11, Lorenzo Colitti a écrit :
> On Mon, Feb 23, 2015 at 9:38 PM, Alexandru Petrescu
> <[email-masked] <mailto:[email-masked]>>
> wrote:
>
> They are also free to reuse existing implementations of clat, such as
>  the one that Android uses, which is BSD-licensed.

Maybe end users will install it and it will work off-the-shelf, just
like every other app.

Alex

---

From: Ca By <[email-masked]>
Date: Mon, 23 Feb 2015 07:40:27 -0800

> Maybe end users will install it and it will work off-the-shelf, just

This is not a path towards success since it requires the user to care about
how their connectivity is achieved.

An ipv(v4|v6) decision is only ever made at scale by default, at scale

That said, Android and Microsoft have already included CLAT as part of the
OS.

It would substantially and immediately improve my IPv6 deployment, and
restoration of a proper e2e IPv6 internet,  if Apple would release CLAT as
part of their OS.

CB

> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops
>

---

From: Lorenzo Colitti <[email-masked]>
Date: Tue, 24 Feb 2015 00:41:38 +0900

> one that Android uses, which is BSD-licensed.

(Sorry - Apache licensed.)

---

From: Kossut Tomasz - Hurt <[email-masked]>
Date: Mon, 23 Feb 2015 15:56:16 +0000

Just like Microsoft did, CLAT is included in Windows Phone 8.1.

From: Lorenzo Colitti [mailto:[email-masked]]
Sent: Monday, February 23, 2015 3:12 PM
To: Alexandru Petrescu
Cc: [email-masked]
Subject: Re: [v6ops] Status of CLAT implementation on iPhone? (IPv4 apps on IPv6-only PDP type)

On Mon, Feb 23, 2015 at 9:38 PM, Alexandru Petrescu <[email-masked]<mailto:[email-masked]>> wrote:

They are also free to reuse existing implementations of clat, such as the one that Android uses, which is BSD-licensed.

---

From: "Heatley, Nick" <[email-masked]>
Date: Mon, 23 Feb 2015 16:04:08 +0000

FWIW +1 to that

From: v6ops [mailto:[email-masked]] On Behalf Of Ca By
Sent: 23 February 2015 15:40
To: Alexandru Petrescu
Cc: [email-masked]
Subject: Re: [v6ops] Status of CLAT implementation on iPhone? (IPv4 apps on IPv6-only PDP type)

On Mon, Feb 23, 2015 at 7:16 AM, Alexandru Petrescu <[email-masked]<mailto:[email-masked]>> wrote:
Le 23/02/2015 15:11, Lorenzo Colitti a écrit :
On Mon, Feb 23, 2015 at 9:38 PM, Alexandru Petrescu
<[email-masked]<mailto:[email-masked]> <mailto:[email-masked]<mailto:[email-masked]>>>

wrote:

Alex

This is not a path towards success since it requires the user to care about how their connectivity is achieved.

That said, Android and Microsoft have already included CLAT as part of the OS.

It would substantially and immediately improve my IPv6 deployment, and restoration of a proper e2e IPv6 internet,  if Apple would release CLAT as part of their OS.

CB

_______________________________________________
v6ops mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/v6ops

NOTICE AND DISCLAIMER
This e-mail (including any attachments) is intended for the above-named person(s).  If you are not the intended recipient, notify the sender immediately, delete this email from your system and do not disclose or use for any purpose.  
 
We may monitor all incoming and outgoing emails in line with current legislation. We have taken steps to ensure that this email and attachments are free from any virus, but it remains your responsibility to ensure that viruses do not adversely affect you. 

EE Limited
Registered in England and Wales
Company Registered Number: 02382161
Registered Office Address: Trident Place, Mosquito Way, Hatfield, Hertfordshire, AL10 9BW.

---

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 23 Feb 2015 17:12:44 +0100

Le 23/02/2015 16:40, Ca By a écrit :
>
>
> On Mon, Feb 23, 2015 at 7:16 AM, Alexandru Petrescu
> <[email-masked] <mailto:[email-masked]>
> <mailto:[email-masked]
> <mailto:[email-masked]>>>
>
> wrote:
>
> derivative, it would be technically feasible to implement CLAT on
> it; it is nothing more than some iptables address translation plus a
> bit of python scripting in case.
>
>
> They are also free to reuse existing implementations of clat, such
> as the one that Android uses, which is BSD-licensed.
>
>
> This is not a path towards success since it requires the user to care
> about how their connectivity is achieved.

Well right, user should be freed from this.  But there is connectivity
and connectivity.

VPN connectivity is an app done by Enterprise, not by the device
manufacturer.

> That said, Android and Microsoft have already included CLAT as part

WEll, I don't know how to read this.

On one hand, yes, most people do it, so this company should too,
to be interoperable.

On another hand, being distinct and still interoperable may tempt even more.

> It would substantially and immediately improve my IPv6 deployment,
> and restoration of a proper e2e IPv6 internet,  if Apple would
> release CLAT as part of their OS.

I wonder whether this is not the main goal of this draft?  If yes, it
would make sense to state so upfront, and involve this particular
company in the discussion.  Do you know somebody from this particular
company here at IETF?

Alex

>
> CB
>
> _________________________________________________ v6ops mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/__listinfo/v6ops
> <https://www.ietf.org/mailman/listinfo/v6ops>
>
>

---

From: <[email-masked]>
Date: Mon, 23 Feb 2015 16:21:46 +0000

Alex,

Please see inline.

Cheers,
Med

> -----Message d'origine-----
> De : v6ops [mailto:[email-masked]] De la part de Alexandru
> Petrescu
> Envoyé : lundi 23 février 2015 17:13
> À : Ca By
> Cc : [email-masked]
> Objet : Re: [v6ops] Status of CLAT implementation on iPhone? (IPv4 apps on
> IPv6-only PDP type)
> 
> 
> I wonder whether this is not the main goal of this draft? 

[Med] I infirm. The goal of the draft is clearly called out in the Introduction section.

---

From: Tore Anderson <[email-masked]>
Date: Mon, 23 Feb 2015 19:09:28 +0100

* Ca By

> about how their connectivity is achieved.

Assuming it's possible to write such an app for iOs in the first place,
couldn't you pre-load it on the handsets you sell and have it start up
automatically? If so, the user wouldn't be required to care. As I
understand it, it's common carrier practise to pre-load the handsets
with other kinds of "value add" apps anyway, right?

For example: Orange Poland's 464XLAT deployment. As I understand it,
they are *not* using DNS64, so I guess that necessarily means they
pre-configure the handsets' CLAT with their NAT64/PLAT prefix before
shipping them the customers. So if doing such custom modifications is
doable, pre-loading a CLAT app doesn't seem impossible either.

It wouldn't work for for retail handsets of course, but I understand
that in the US the majority of people buy their handsets from their
carriers rather than from retail stores anyway, so perhaps it's okay
that those relatively few customers that bring retail iPhones onto your
network either 1) get IPv4-only for now, or 2) will be asked to install
the (presumably free) CLAT app if they want Skype to work.

> restoration of a proper e2e IPv6 internet,  if Apple would release CLAT as

For the record, I'm not disagreeing that having it in iOS proper would
be the optimal solution. It just seems to me there's another viable way
forward that does not depend on Apple being the ones to implement the
CLAT. But I'm probably missing something?

Tore

---

From: Gert Doering <[email-masked]>
Date: Mon, 23 Feb 2015 19:20:05 +0100

Hi,

On Mon, Feb 23, 2015 at 07:09:28PM +0100, Tore Anderson wrote:
> > [CLAT as an app]

>From what I understand, it would be possible to write such an app,
using the VPN API.  The problem with that API is that you need NDA'ed
documentation from Apple, and the resulting app needs to be specially
signed by Apple to be permitted to access it (which makes sense, given
that such an app is effectively able to steal other app's traffic) - so
you need fairly deep involvement from Apple, and if they are interested
enough to do that, they could write the CLAT themselves right away...

Auto-starting a VPN app is also possible (VPN on demand), but I'm not 
sure this can be tied to "only on 3G, and only if no IPv4 is there", so 
that aspect could be a bit tricky.

[..]
> CLAT. But I'm probably missing something?

Access restrictions to the VPN API...

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (0)89/32356-444           USt-IdNr.: DE813185279

---

From: James Woodyatt <[email-masked]>
Date: Mon, 23 Feb 2015 12:38:58 -0800

p1. I have no inside information from Apple's Core OS Networking group
newer than seventeen months ago when I separated. I'm not at liberty to
discuss confidential stuff even today. That said, I can dispel some myths.

p2. The security architecture for networking on iOS will effectively
prevent any third-party efforts from delivering a CLAT for iOS. Andrew
Yourtchenko wrote one for OS X, but it will be necessary for Apple Core OS
engineers to deliver it on iOS. Anyone who wants to review the source code
for the Darwin kernel in publicsource.apple.com should be able to get a
sense of the scope of this problem.

p3. The Android implementation may be Apache-licensed, but— like Mr.
Yourtchenko's implementation— it's unsuitable for general production use
with Apple's networking stack, which has diverged substantially from
FreeBSD in the last several years. The Darwin kernel networking stack in
iOS and OS X has interface scoped routes, which the Core Networking and
Core Telephony subsystems use extensively. The IPv4 addresses assigned to
the host via the CLAT must be attached to the same interface as the
translated IPv6 address or the interface scoped routing won't work
properly. Again, see the Darwin kernel source code for details.

p4. It might be comparatively easy for Apple to deliver a very limited
CLAT, using one of several Darwin-specific tricks, e.g. a socket filter,
that only works to enable certain 3rd-party applications, e.g. Skype, on
IPv6-only LTE networks with a PLAT service available, but that will also
have some interoperability issues that make it unsuitable for general
reliability. I hope they don't go that way, but I don't work there anymore,
and I don't think anyone there would listen to me anyway, if that's what
they were to decide to do. I can kinda see why they might choose to do this.

For these reasons, I would counsel any operators expecting Apple to deliver
a CLAT in a forthcoming release of iOS to test it extensively before
accepting it. Especially: A) test it with Internet Sharing enabled, B) test
it with VPN connect-on-demand, and C) test it with AirDrop and AirPlay in
use. Whatever method they choose to implement a CLAT, it will be a tricky
job, and I would be surprised if it doesn't take a lot of Radar problems to
be opened and closed before it works acceptably.

Shorter james: I don't think IETF should list having a CLAT as requirement
for 3GPP mobile devices. It could be awkward for us while the leading
vendor of IPv6-capable handsets is shipping without one.

-- 
james woodyatt <[email-masked]>
Nest Labs, Communications Engineering