Subject: RE: IPv6 over UDP/IPv4

From: "Christian Huitema" <[email-masked]>
Date: Fri, 15 Jun 2001 10:47:24 -0700

> From: Robert Elz [mailto:[email-masked]]
>     From:        "Christian Huitema" <[email-masked]>
> 
>   | I think we must meet the following requirements:
> 
> If all that is to be done, then it would probably be easier to
> just use TCP.  That doesn't, of itself, satisfy all the requirements,
> but it makes it a lot easier to handle them (eg: it pretty much
handles
> the two way data problem, and it allows some kind of authentication
that
> doesn't have to be repeated for every packet).

In fact, if you really want to maximize the chances of going through
"hostile territory", you probably want to use IPv6 > HTTP > TLS > TCP.
And yes, I do mean "https"; using a different port would allow the
network police to see you and catch you. This would get you through
firewalls as well as NAT. OTOH, shipping this kind of solution will also
get you "interesting" comments from network managers. Also, you may have
a small problem with the packets' latencies.

Seriously, I believe that most of the requirements can be met pretty
easily. You need to design a protocol that starts with a formal
handshake, probably similar in nature to the PPP control protocol:
provide credentials in a format that is compatible with a Radius
back-end. You want the handshake to be at least a three ways handshake,
so has to ensure that the connection actually works. You may want to
negotiate something like ESP or TLS. As Franci points out, once the
connection is set and the identities have been validated, then we
probably are home free -- use autoconfig if needed, use NUD, etc.

-- Christian Huitema

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Francis Dupont <[email-masked]>
Date: Sun, 17 Jun 2001 14:28:48 +0200

In your previous mail you wrote:

=> are you suggesting to use the UDP optional encapsulation of
the FreeBSD/OpenBSD user-mode PPP tool (aka http://www.Awfulhak.org/ppp.html)?
It has no IPv6 support but this is easy to fix (some patches are already
available for previous versions). This can do the job for BSD boxes
(so we had only to do this for Linux (port) and Windowses (someone
from Microsoft :-)).

   provide credentials in a format that is compatible with a Radius
   back-end. You want the handshake to be at least a three ways handshake,
   so has to ensure that the connection actually works. You may want to
   negotiate something like ESP or TLS.

=> I am strongly in favor of ESP because TLS protected connections are
too easily killed by junk RSTs (not a real problem for the web but
here we'd like to get long term connections).

   As Francis points out, once the
   connection is set and the identities have been validated, then we
   probably are home free -- use autoconfig if needed, use NUD, etc.
   
=> IPv6 has a superior design, just be convinced outselves (:-)!

Thanks

[email-masked]

PS: BSD user PPP uses synchronous serial line encapsulation for UDP
(ie. the IP packet is put directly into an UDP packet) and asynchronous
one for TCP (ie. TCP provides an octet stream). This seems reasonnable
and simple (maximal reuse of the code for serial lines).
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------