Subject: RE: Opportunistic Tunneling

From: "Christian Huitema" <[email-masked]>
Date: Wed, 11 Feb 2004 15:27:06 -0800

> > As the Unmanaged Analysis document is currently at WG Last Call, the
> > biggest issue appears to be the so-called "opportunistic tunneling",
> > i.e., automatic tunneling which would be possible without set-up or
> > ISP support.  Examples of these are 6to4 and Teredo. (No other
> > specific proposals have been made.)  We need to figure out how to
move
> > forward.  The critical questions are at least:
> >
> >  1) Do we agree that this is something we need in the first place?
> >      * Considering user-driven deployment, maybe not.
> >         - example: the user says "I want to use application X" or "I
> >           want to use functionality Y", where X or Y would require
> >           IPv6.
> >      * Considering large-scale vendor-centric deployment, probably
> >        yes.

The reality is that 6to4 and Teredo solution are being deployed, so I
wonder whether we really need a long discussion about whether or not
they are needed. It would perhaps be more important to discuss how the
deployment can be tuned...

> >  2) What are the models for deploying relays, considering the
economic
> >     or deployment considerations (in-host, in-site, network)?
> >      * And what are the implications of any approach?
> >      * Can we decide on the recommended model?

The unmaneval draft includes a section that discussed these points.

> >  3) For NAT traversing, opportunistic tunneling, are there any
> >     features in Teredo which are missing or are unnecessary? I.e.,
> >     how good a fit would it be?  Are there alternatives?
>
> 	4) security implication of such technology.  for instance, 6to4
> relay
> 	   router can easily abused.  how about Teredo, and other
> technologies?

The Teredo draft includes a rather extensive security analysis.
Obviously, we may have missed some threats, but we certainly thought
hard about it.

-- Christian Huitema

---

From: "Christian Huitema" <[email-masked]>
Date: Thu, 19 Feb 2004 09:11:57 -0800

> > I think the answer to this can be found by looking at what is
deployed
> > now.  In any case, I didn't think the IETF needs to be discussion
> economic
> > models.
> 
> Economic models, to an extent, make deployments realistic (or not), so
> I personally think this is somewhat of a factor in the discussions
> whether to recommend some model for deployment.  Of course, the IETF
> cannot _force_ anyone to a model.

I appreciate Pekka's concern for deployment, but I think that Bob is
right. The bottom line is that the IETF is an engineering organization,
and its members are not very qualified to assess business models, let
alone mandate them.

It certainly does not make sense to invest in a technology that cannot
be deployed, and anyone designing a new protocol should concern
themselves with deployment scenarios, e.g. what are the dependencies, do
we need to boil the ocean for this thing to fly, and other such
considerations. Indeed, when a technology requires third parties to
deploy servers or other helpers, the technology promoters should have a
plausible response to the question, "why would someone deploy your
stuff".

However, we have many examples of technologies that get deployed for
entirely different reasons than those initially advanced. The Arpanet,
for example, was supposed to provide better access to time-sharing
mainframes, and we know what happened. So, while there is a need for
some conscious reasoning about deployment, Bob's point is very valid. If
a technology is in fact deployed, then the IETF should assume that
someone somewhere saw a business case, and should not engage in a
guessing exercise.

-- Christian Huitema

---

From: <[email-masked]>
Date: Fri, 20 Feb 2004 12:36:46 +0200

Hello,

I think it is evident that the economical considerations are out of IETF's scope. IETF is a global organization and even different countries have different economical systems. In addition, different companies use different models for their businesses.

Of course, in the v6ops WG we have to use also the same principle as in the other WGs: rough consensus, and runnig code. If there is deployment there is definetely already running code. 

Cheers,

Jonne.

> -----Original Message-----
> From: ext Christian Huitema [mailto:[email-masked]]
> Sent: 19 February, 2004 19:12
> To: Pekka Savola; Hinden Bob (Nokia-ES/MtView)
> Cc: Soininen Jonne (Nokia-NET/Helsinki); [email-masked]
> Subject: RE: Opportunistic Tunneling
> 
> 
>

---

From: "Christian Huitema" <[email-masked]>
Date: Tue, 24 Feb 2004 10:26:48 -0800

> On Tue, 24 Feb 2004 [email-masked] wrote:
> > >Both 6to4 and Teredo can work, to an extent, when relay routers
don't
> > >exist.  TSP can't.
> >
> > 	how useful is the IPv6 internet if you can talk with 6to4 users
only?
> > 	i think the argument is bogus.
> 
> Based on the deployments of Microsoft I guess some do view this as a
> sufficient first step.. because you can still use IPv4 to those native
> IPv6 users.

Or you push those native users who want connectivity to deploy their own
"local gateways". After all, any host or any site that has dual
connectivity can be "multi-homed" to 6to4 and native, and can run a
local Teredo relay. 

But this "local relay" solution has an important drawback: if we deploy
millions a relays in millions of sites, then we will have a hard time
rolling back the transition technology when it is not needed any more. 

In contrast, if IPv6 providers do provide relays, then hosts and sites
don't have to "run their own", and the "transition out of the
transition" will be easier.

-- Christian Huitema

---

From: "Christian Huitema" <[email-masked]>
Date: Wed, 25 Feb 2004 18:10:14 -0800

> >  2) 6to4 and Teredo (to a lesser degree AFAIK) are pretty anonymous
> > services.  When someone abuses using those addresses, there is no
ISP
> > "hosting" the service which would get abuse etc. reports, get
> > blacklisted if someone behaves badly, etc. -- on the other hand, if
> > the ISP offers the service to outsiders using its RIR address space,
> > this will certainly lead to all kinds of nasty administrative
> > actions.. sooner or later raising the question, "why are we even
> > providing this kind of service to outsiders for free, if we get
> > nothing but trouble!?!"
> 
> 	as mentioned in (already expired) transition-abuse draft, 6to4
relay
> 	routers (provided by ISPs) will get abused by malicious parties,
and
> 	ISPs get blamed for the traffic being generated by the abuse.  i
> 	strongly disagree with the above statement.

Please note that this is mostly a 6to4 issue. Teredo requires a
three-ways handshake before sending data through a relay, which makes
attacks much harder.

For 6to4, Pekka has proposed a solution: that relay routers source
packets from the reserved address 192.88.99.1. This solution certainly
solves the "ISP get blamed" part, since the 6to4 packets will not
identify a specific relay. 

The solution also has the potential of solving the abuse scenario in
which a 3rd party obtains the IPv4 address of a relay and uses it to
send traffic: since the relays are only listening to the anycast
address, they can only receive traffic from networks to which they
advertise the anycast address.

We would also achieve some protection against spoofing if we requested
that 6to4 routers only accept "native IPv6 packets" from the anycast
relay. Hackers will have to be able to spoof IPv4 in order to spoof
IPv6. (Another way to solve this issue is to require a 3-ways handshake
similar to Teredo; we could require it if the packet comes from another
address.)

In any case, we should all be aware that hackers do not need to be able
to spoof addresses in order to mount a DDOS attack. The recent attacks
mounted by the MYDOOM worm consisted of establishing TCP connections to
a target site, and loading a page from the site. No spoofing, just very
many connections from very many zombies. 

-- Christian Huitema