Subject: [Hipsec] NAT traversal interoperability test report

From: Ari Keranen <[email-masked]>
Date: Fri, 15 May 2009 11:30:00 +0300

Hi all,

Here's a status update on the NAT traversal design team efforts.

Now all major features of the NAT traversal base draft are implemented 
in both HIPL and hip4inter.net implementations. We run a set of 
interoperability tests between the two implementations and (after some 
bug squashing) they seem to work together nicely.

We tested registering, Base Exchange via a HIP relay, ICE mode, plain 
UDP mode and keepalives using different topologies (hosts behind NATs 
and hosts in public network) and NAT types. You can find more detailed 
information about different tested scenarios from our test plan below.

We also made some small modifications and clarifications to the draft, 
and the current up-to-date pre-version (containing also the improvements 
Samu suggested earlier) is available here:
http://users.piuha.net/akeranen/drafts/draft-ietf-hip-nat-traversal-07-pre1.txt

Cheers,
Ari

The test plan
=============

1st test case category: registration
------------------------------------
Registering to other implementation's relay and doing a BeX via it.

Successful outcome: registering and BeX works without errors.

2nd test case category: BeX and ICE
-----------------------------------

Legend:
Pub: host with public IP, BeX directly
Pub with relay: host not behind NAT but BeX via relay
Priv: Host behind NAT, BeX via relay

Test case topologies:
Pub  - Pub
Pub  - Pub with relay
Priv - Pub
Priv - Pub with relay
Priv - Priv

Both implementations taking each role in turn and working both as 
Initiator and Responder. All priv cases with both nasty (Linux) NAT and 
with a P2P friendly (endpoint independent mapping) NAT.

Successful outcome: working SA with the best (as measured by ICE 
priority) usable path in use. ICE check pacing is negotiated correctly. 
No errors in the relay or at endpoints. Hosts can ping each other using 
the UDP encapsulated ESP.

3rd test case category: keepalives
----------------------------------

After hosts have setup a connection, they should keep it alive with 
keepalives.

Successful outcome: keepalives are sent and processed correctly.

4th test case category: just UDP
--------------------------------

A host with public IP address does not propose/select the ICE NAT 
traversal mode, but (just) the UDP-ENCAPSULATION mode.

Successful outcome: no ICE is run, but SAs with just UDP encapsulation 
are created and used.