Subject: [mobile-ip] NAT traversal for mobile IP using UDP tunneling implementation

From: Guru P <[email-masked]>
Date: Sat, 13 Apr 2002 11:08:04 -0700 (PDT)

To All,
I have a implementation of UDP tunneling for Mobile IP
that does NAT traversal at:
http://people.eecs.ku.edu/~pai/801/index.html
Anybody interested at all? If somebody does have a
look at it I would like to get some useful comments
and suggestions. Thanks
Guru

__________________________________________________
Do You Yahoo!?
Yahoo! Tax Center - online filing with TurboTax
http://taxes.yahoo.com/

---

From: "Henrik Levkowetz" <[email-masked]>
Date: Tue, 16 Apr 2002 00:48:43 +0200

Hello Gurunandan,

	It was interesting to read about your implementation of the
NAT traversal draft (based on the -00 version, I note). 
A few questions and comments: 

	Why do you set the 'U' flag in the request? This is not clear 
from your description. The 'U' flag should generally NOT be set,
as the UDP tunnelling overhead gives no benefit at all if you don't
need to get through a NAT, and by setting the 'U' flag you will
be using UDP tunnelling even if there is no NAT in the path.

	Also note that in the -01 and -02 drafts, the 'U' flag in the
UDP Tunnel Request Extension has been renamed to 'F' (force).

	The link to 'Decapsulation' at the bottom of your page giving
'Changes to Registration Mechanism' is broken. (there's a /801/
missing)

	Your text on the protocol number in the IP header of the
encapsulation sounds as if there's a choice, when there really is
none. If the next header after the IP header is a UDP header, the
only possible value for the protocol number is 17. 

	You set the UDP checksum to zero when encapsulating; this is
permissible but not advisable. You're needlessly stripping yourself
of some protection against corrupted packets here. I suspect this
may be the result of time pressure?

	When talking about the decapsulation, you mention that after
stripping off the outer IP/UDP encapsulation, you call vif_rx() to
handle the inner IP/UDP payload. Please note that the inner payload
may be IP with any type of payload, not only UDP. I suspect that this
is just a textual mistake, and the code handles any payload.

	I believe that the manner in which you do decapsulation (stateful,
and dependent on your MIP_UDP_TUN_ACCEPT flag) is unsafe. Decapsulation
should be done based on the presence of the new MIP message type header, 
not on anything else.

	Finally, I note that you have only implemented UDP tunnelling of
the forward tunnel, not of the reverse tunnel. This is not according
to the draft, but may work if the re-registrations are made often
enough that the mapping of the NAT does not time out, and the MN and
HA is implemented consistently. Although not acceptable in a full 
implementation, it may possibly be acceptable in your project due to 
time limitations. It will probably not be interoperable with other 
implementations.

	I have not read through your code, so have no comments on that.

	If you were to polish this a bit, to adhere more strictly to the
draft, it would be interesting to do an interop test with your 
implementation, seeing that your code is for Linux and available for
download.

	Regards,
		Henrik

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Guru P
> Sent: Saturday, April 13, 2002 8:08 PM
> To: [email-masked]
> Subject: [mobile-ip] NAT traversal for mobile IP using UDP tunneling
> implementation
> 
> 
> To All,