Subject: Re: [v6ops] Status of CLAT implementation on iPhone? (IPv4 apps on IPv6-only PDP type)

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 10 Jun 2015 15:05:02 +0200

Resurecting an earlier discussion...

I hear Apple just announced about mandating IPv6 in each app submitted 
to store, and about a tech to offer IPv6 hotspots to app developpers on 
IPv4.

Not sure that includes a CLAT implementation on iPhone, nor about what
kind of protocol spec can realize that IPv4-IPv6 behaviour (CLAT,
64share, DS-MIP, NAT/NPT, any new?).

Alex

Le 23/02/2015 21:38, James Woodyatt a écrit :
> p1. I have no inside information from Apple's Core OS Networking
> group newer than seventeen months ago when I separated. I'm not at
> liberty to discuss confidential stuff even today. That said, I can
> dispel some myths.
>
> p2. The security architecture for networking on iOS will effectively
>  prevent any third-party efforts from delivering a CLAT for iOS.
> Andrew Yourtchenko wrote one for OS X, but it will be necessary for
> Apple Core OS engineers to deliver it on iOS. Anyone who wants to
> review the source code for the Darwin kernel in
> publicsource.apple.com <http://publicsource.apple.com> should be able
> to get a sense of the scope of this problem.
>
> p3. The Android implementation may be Apache-licensed, but— like Mr.
>  Yourtchenko's implementation— it's unsuitable for general production
> use with Apple's networking stack, which has diverged substantially
> from FreeBSD in the last several years. The Darwin kernel networking
> stack in iOS and OS X has interface scoped routes, which the Core
> Networking and Core Telephony subsystems use extensively. The IPv4
> addresses assigned to the host via the CLAT must be attached to the
> same interface as the translated IPv6 address or the interface scoped
> routing won't work properly. Again, see the Darwin kernel source code
> for details.
>
> p4. It might be comparatively easy for Apple to deliver a very
> limited CLAT, using one of several Darwin-specific tricks, e.g. a
> socket filter, that only works to enable certain 3rd-party
> applications, e.g. Skype, on IPv6-only LTE networks with a PLAT
> service available, but that will also have some interoperability
> issues that make it unsuitable for general reliability. I hope they
> don't go that way, but I don't work there anymore, and I don't think
> anyone there would listen to me anyway, if that's what they were to
> decide to do. I can kinda see why they might choose to do this.
>
> For these reasons, I would counsel any operators expecting Apple to
> deliver a CLAT in a forthcoming release of iOS to test it extensively
>  before accepting it. Especially: A) test it with Internet Sharing
> enabled, B) test it with VPN connect-on-demand, and C) test it with
> AirDrop and AirPlay in use. Whatever method they choose to implement
> a CLAT, it will be a tricky job, and I would be surprised if it
> doesn't take a lot of Radar problems to be opened and closed before
> it works acceptably.
>
> Shorter james: I don't think IETF should list having a CLAT as
> requirement for 3GPP mobile devices. It could be awkward for us while
>  the leading vendor of IPv6-capable handsets is shipping without
> one.
>
>
> On Mon, Feb 23, 2015 at 4:38 AM, Alexandru Petrescu
> <[email-masked] <mailto:[email-masked]>>
> wrote:
>
> Hello participants to v6ops WG,
>
> What is the status of a CLAT implementation on iPhone?  Any hint in
> that direction?
>
> I am asking because in private conversation I have noticed doubts
> about this being done.  Or, since the iPhone relies on a bsd
> derivative, it would be technically feasible to implement CLAT on it;
> it is nothing more than some iptables address translation plus a bit
> of python scripting in case.
>
> (CLAT is needed by some IPv4 apps to continue working on a
> smartphone connected solely with an IPv6-only PDP type).
>
> Alex
>
> _________________________________________________ v6ops mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/__listinfo/v6ops
> <https://www.ietf.org/mailman/listinfo/v6ops>
>
>
>
>
> -- james woodyatt <[email-masked] <mailto:[email-masked]>> Nest
> Labs, Communications Engineering
>
>
> _______________________________________________ v6ops mailing list
> [email-masked] https://www.ietf.org/mailman/listinfo/v6ops
>

---

From: Mikael Abrahamsson <[email-masked]>
Date: Wed, 10 Jun 2015 15:24:21 +0200 (CEST)

On Wed, 10 Jun 2015, Alexandru Petrescu wrote:

> I hear Apple just announced about mandating IPv6 in each app submitted to 
> store, and about a tech to offer IPv6 hotspots to app developpers on IPv4.
>

http://www.internetsociety.org/deploy360/blog/2015/06/apple-will-require-ipv6-support-for-all-ios-9-apps/

If I were to guess from that article, it sounds like OSX will come with a 
mode where it can create an IPv6 only wifi, and then do DNS64+NAT64 
towards an IPv4 only connection to the outside.

If that is indeed the case, this is great, a lot more people will easily 
be able to test easily if their applications work well in a DNS64+NAT64 
environment.

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 10 Jun 2015 15:49:25 +0200

Le 10/06/2015 15:24, Mikael Abrahamsson a écrit :
>> to store, and about a tech to offer IPv6 hotspots to app developpers
>> on IPv4.
>>
> If I were to guess from that article, it sounds like OSX will come with
> a mode where it can create an IPv6 only wifi, and then do DNS64+NAT64

Would that use ULAs inside the IPv6-only  WiFi?

Would it use IPv6 NAT?

I couldn't see otherwise.

> be able to test easily if their applications work well in a DNS64+NAT64

I agree.

Alex

---

From: Lorenzo Colitti <[email-masked]>
Date: Wed, 10 Jun 2015 22:53:25 +0900

> I couldn't see otherwise.

It doesn't need to do IPv6 NAT (and it can't, unless it has an IPv6
upstream). It only needs to do NAT64.

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 10 Jun 2015 15:59:02 +0200

Le 10/06/2015 15:53, Lorenzo Colitti a écrit :
> On Wed, Jun 10, 2015 at 10:49 PM, Alexandru Petrescu
> <[email-masked] <mailto:[email-masked]>> wrote:
>

Right, sorry.  I dont see otherwise than NAT64, i.e. have an IPv4 
address on one side and a ULA prefix on the other side.

Alex