Subject: Re: US DoD and IPv6

From: [email-masked] (Noel Chiappa)
Date: Wed, 6 Oct 2010 11:00:59 -0400 (EDT)

> From: Keith Moore <[email-masked]>

    > Do you actually have a point to make

That depends. Are you still of the opinion that IPv6 will, in our lifetimes,
become ubiquitously deployed, thereby restoring us to a world of transparent
end-end, or do you think we should acknowledge that that's not going to
happen, and start to think about how to design for a permanently mixed
Internet - and actually have that model in mind when doing protocol work?

Because there are clearly a lot of people who don't buy into that (viz. this
recent comment "Now is not the point to invest time fixing the ipv4
internet.").

    >> Look what you have done: not only we have more NATv4 than ever, but
    >> now we also have NAT46, NAT64, NAT464

    > I think you give me far more "credit" than I'm due.

I have to agree. In some sense, NAT became inevitable way back in 1976 (or
so, don't recall the exact date of this), when variable length addresses were
removed from IPv3 (I think it was) in favour of the 32-bit fixed-length
addresses. (The failue to differentiate between interface names and endpoint
names also was a factor, but somewhat tangential.)

The reason is simple: i) 32 bits would eventually be too few for naming
endpoints, and ii) when that happened, since no evolutionary path to a larger
namespace had been defined, naming domains separated by translators were
driven by economics as the cheapest way forward.

	Noel

---

From: Keith Moore <[email-masked]>
Date: Wed, 6 Oct 2010 12:43:13 -0400

> Internet - and actually have that model in mind when doing protocol work?

Honestly, I don't think we can tell.  In the short term, it certainly doesn't look good for end-to-end transparency.    But unlike 10 years ago, today there's a widespread understanding of the problems caused by lack of transparency, and much less denial about it.

The central problem with the Internet seems to be that nearly everybody who routes traffic thinks it's okay to violate the architecture and alter the traffic to optimize for his/her specific circumstances - and the end users and their wide variety of applications just have to cope with the resulting brain damage.   (Admittedly there's a wide variation in _how much_ these people think it's okay to mess with transparency.)  

But I am not sure that that's the fault of the current Internet architecture, or that a different architecture would fare better.  I think it's fairly inherent in that people can always understand their specific circumstances better than they can see the big picture, and that most of the world's economies are biased toward short-term thinking (and thus, hill climbing / dead ends).

Keith

---

From: Fernando Gont <[email-masked]>
Date: Wed, 06 Oct 2010 14:22:56 -0300

On 06/10/2010 01:43 p.m., Keith Moore wrote:

> Honestly, I don't think we can tell.  In the short term, it certainly
> doesn't look good for end-to-end transparency.    But unlike 10 years
> ago, today there's a widespread understanding of the problems caused
> by lack of transparency, and much less denial about it.

It's not clear to me what you mean by "end to end transparency". If you
mean "end to end connectivity", then I'd say that quite a few people are
actually *concerned* about going back to end-to-end connectivity.

I think that even without NATs (which is *not* going to be the case, as
it has already been pointed out), we can expect that at the edge,
firewalls that "only allow return traffic" will be the common case, even
for v6.

> The central problem with the Internet seems to be that nearly
> everybody who routes traffic thinks it's okay to violate the
> architecture and alter the traffic to optimize for his/her specific
> circumstances - and the end users and their wide variety of
> applications just have to cope with the resulting brain damage.

When applications that e.g. include point of attachment addresses in the
app protocol break in the presence of NATs, one should probably ask
whether the NAT is breaking the app, or whether the NAT is making it
clear that the app was actually already broken.

Thanks,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Keith Moore <[email-masked]>
Date: Wed, 6 Oct 2010 13:43:39 -0400

> actually *concerned* about going back to end-to-end connectivity.

I mean having the sender's packets delivered to the receiver, completely intact except for ordinary TTL and IP option processing, with "best effort" or better reliability, delay, and jitter, except when prohibited by explicit end-user-specified policy.

> clear that the app was actually already broken.

It's perfectly reasonable for applications to include IP addresses and port numbers in their payloads, as this is the only way that the Internet Architecture defines to allow applications to make contact with particular processes at particular hosts.  Some might see this as a deficiency in the Internet Architecture, but that's the best that we have to work with for now.

DNS has never been, and never will be, suitable as a general endpoint naming mechanism.   And so far nobody has managed to implement and deploy a better system for endpoint naming.  If and when someone manages to do this, there will still be a need for old applications to use IP addresses.

Meanwhile, those who insist on corrupting other parties' traffic and harming their applications are very good examples of the kind of short-term, self-serving harm to which I was referring.  

Keith

---

From: David Conrad <[email-masked]>
Date: Wed, 6 Oct 2010 07:46:02 -1000

On Oct 6, 2010, at 7:43 AM, Keith Moore wrote:
> DNS has never been, and never will be, suitable as a general endpoint naming mechanism.  

What do you mean by "a general endpoint naming mechanism"?

Regards,
-drc

---

From: Keith Moore <[email-masked]>
Date: Wed, 6 Oct 2010 13:53:45 -0400

On Oct 6, 2010, at 1:45 PM, Phillip Hallam-Baker wrote:

> On Wed, Oct 6, 2010 at 12:43 PM, Keith Moore <[email-masked]> wrote:
> The central problem with the Internet seems to be that nearly everybody who routes traffic thinks it's okay to violate the architecture and alter the traffic to optimize for his/her specific circumstances - and the end users and their wide variety of applications just have to cope with the resulting brain damage.  
>  
> Objective observation suggests that the Internet architecture *is* that anyone who wants to can molest traffic in any way they feel fit. 

If a bomb hits a famous building, we don't generally call the resulting rubble part of the building's architecture.  

(unless, maybe, it's the Hiroshima Peace Dome, which was repurposed to commemorate perhaps the worst man-made disaster in history.)

> But really, I do not understand why people have to fetishize the constancy of IP addresses end to end. IP addresses are not particularly interesting to look at. 

It's one of the two fundamental principles on which the Internet is based.  Universal packet format, universal address space.  That's IP in a nutshell.  

Keith

---

From: Fernando Gont <[email-masked]>
Date: Wed, 6 Oct 2010 16:38:04 -0300

On Wed, Oct 6, 2010 at 2:43 PM, Keith Moore <[email-masked]> wrote:

> It's perfectly reasonable for applications to include IP addresses and port numbers in their payloads,
> as this is the only way that the Internet Architecture defines to allow applications to make contact
> with particular processes at particular hosts.  Some might see this as a deficiency in the Internet
> Architecture, but that's the best that we have to work with for now.

If anything, the fact that "this is is the only way that the Internet
Architecture defines..." doesn't make it reasonable.

Thanks,

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 6 Oct 2010 13:45:39 -0400

On Wed, Oct 6, 2010 at 12:43 PM, Keith Moore <[email-masked]>wrote:

> The central problem with the Internet seems to be that nearly everybody who
> routes traffic thinks it's okay to violate the architecture and alter the
> traffic to optimize for his/her specific circumstances - and the end users
> and their wide variety of applications just have to cope with the resulting
> brain damage.

Objective observation suggests that the Internet architecture *is* that
anyone who wants to can molest traffic in any way they feel fit.

Thats the 'Twits on the Wire' model in a nutshell.

But really, I do not understand why people have to fetishize the constancy
of IP addresses end to end. IP addresses are not particularly interesting to
look at.

-- 
Website: http://hallambaker.com/

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 6 Oct 2010 13:59:47 -0400

And what would we say of architects who continued to build to their original
plan after the bombs had been flying for twenty years and showed no sign of
stopping?

I would prefer the architects with the plans for a bomb shelter.

On Wed, Oct 6, 2010 at 1:53 PM, Keith Moore <[email-masked]>wrote:

>> The central problem with the Internet seems to be that nearly everybody
>> who routes traffic thinks it's okay to violate the architecture and alter
>> the traffic to optimize for his/her specific circumstances - and the end
>> users and their wide variety of applications just have to cope with the
>> resulting brain damage.
>
>
> If a bomb hits a famous building, we don't generally call the resulting
> rubble part of the building's architecture.
>
> (unless, maybe, it's the Hiroshima Peace Dome, which was repurposed to
> commemorate perhaps the worst man-made disaster in history.)
>
> It's one of the two fundamental principles on which the Internet is based.
>  Universal packet format, universal address space.  That's IP in a nutshell.
>
>
> Keith
>
>
>
>

---

From: Keith Moore <[email-masked]>
Date: Wed, 6 Oct 2010 16:34:23 -0400

On Oct 6, 2010, at 1:59 PM, Phillip Hallam-Baker wrote:

> And what would we say of architects who continued to build to their original plan after the bombs had been flying for twenty years and showed no sign of stopping?

which architects would those be?  I see little sign of architectural development in the Internet anymore.   and some of the damage isn't from bombs, it's from lack of maintenance.

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 6 Oct 2010 16:40:04 -0400

> Architecture defines..." doesn't make it reasonable.

So basically you're arguing to impair the ability of applications to function, just so that network operators can futz around with addresses. 

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 6 Oct 2010 16:43:23 -0400

> What do you mean by "a general endpoint naming mechanism"?

It's a good question, but it might take an internet-draft to answer that question in sufficient detail for this environment.   The services required aren't hard to describe, but it's hard to get the definitions of the terms right.

---

From: Fernando Gont <[email-masked]>
Date: Wed, 06 Oct 2010 21:57:30 -0300

On 06/10/2010 05:40 p.m., Keith Moore wrote:

>>> It's perfectly reasonable for applications to include IP
>>> addresses and port numbers in their payloads, as this is the only
>>> way that the Internet Architecture defines to allow applications
>>> to make contact with particular processes at particular hosts.
>>> Some might see this as a deficiency in the Internet Architecture,
>>> but that's the best that we have to work with for now.
>> 
>> If anything, the fact that "this is is the only way that the
>> Internet Architecture defines..." doesn't make it reasonable.
> 
> So basically you're arguing to impair the ability of applications to
> function, just so that network operators can futz around with
> addresses.

No. I'm arguing that you should not blame NATs for broken application
designs, and that you should not assess reasonable-ness based on
existing (and questionable) application designs.

Thanks,

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 07 Oct 2010 14:17:49 +1300

> existing (and questionable) application designs.

The problem is that the creation of disjoint addressing realms
(due to NAT and to IPv4/IPv6 coexistence) has made distributed
application design almost impossible without kludges.

See draft-carpenter-referral-ps-01

      Brian

---

From: Masataka Ohta <[email-masked]>
Date: Thu, 07 Oct 2010 11:41:02 +0900

> application design almost impossible without kludges.

That's why we shouldn't use IPv6.

With port restricted IPv4 (such as A+P, E2ENAT, PE-ARP), the
addressing realm of address+port is identical as the current
IPv4 Internet that there are no kludges necessary.

Application protocols and programs, including but not limited
to FTP, are working as is without ALG kludges.

As PR-IP effectively expands IPv4 address space by a factor
of 100 or 1000, there is no point to migrate to old and poor
IPv6, even if we need a long term solution.

						Masataka Ohta

---

From: Keith Moore <[email-masked]>
Date: Thu, 7 Oct 2010 10:32:35 -0400

> existing (and questionable) application designs.

Reasonableness of an application should have to do with whether it's operating within the expectations established by the standard IP, TCP, etc. protocol specifications, not with whether it happens to conform to the expectations established by any particular religion.  As currently defined, IP assumes a global address space that is used consistently throughout the network, and that the network will make a best effort to deliver each packet to its destination.

The problem is that significant violations of fundamental design points of IP are now so widespread and varied that there's no longer any objective view of reasonableness.   What you cite as "reasonable" is arbitrary.  It isn't a consequence of any explicit design of the protocol or the network, it just reflects your personal prejudices.  Who is to say whose prejudices are right?

What is desperately needed in the Internet today is an architecture.  By "architecture" I mean a set of explicit, conscious, well-considered decisions that dictate the roles of various components of the network and how they interact with one another.   And that architecture has to be maintained to reflect changing circumstances over time.

We don't have an architecture today.  What we have today are the remnants of an architecture that is 30+ years old, and a lot of competing religions.

Keith

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 7 Oct 2010 09:21:21 -0400

Brian is playing unfair here by introducing an actual application layer
consequence into the architecture discussion :-)

The referral problem he refers to is real, but I see it more as a
consequence of the IETF being too rigid in its approach to address
numbering.

The basic question here is that we have two hosts that are to connect for a
peer-peer protocol in which either endpoint can initiate or respond to a
connection request.

Clearly this is rather challenging if the boundaries between addressing
schemes are arbitrary and becomes somewhat simpler in a uniform addressing
model.

But the real Internet is not like that. It is a network of networks and
crossing the boundary between a private network and the interconnect space
between the networks has consequences.

One of those consequences is that addresses can change at the
private/interconnect border. Another consequence is that crossing that
boundary should have security consequences.

Opening up a port to receive connection requests has considerably greater
security consequence than making the request. The requester is opening a
communication channel with a single, specified entity, the responder is
opening access to any host on the Internet.

"It is much better to give than to receive"

So opening a port is an event that should be mediated by access control at
the host level and private/interconnect border at a minimum. In a default
deny network there will be additional policy enforcement within the private
network.

---

From: David Conrad <[email-masked]>
Date: Thu, 7 Oct 2010 07:32:37 -1000

Keith,

On Oct 7, 2010, at 4:32 AM, Keith Moore wrote:
> As currently defined, IP assumes a global address space that is used consistently throughout the network, 

I actually think it's a bit worse than that.  As currently defined, IP assumes a global address space in which each individual address has the potential for being topologically significant.  Topological aggregation to permit scaling was an afterthought that doesn't fit particularly well into that architecture.

> Who is to say whose prejudices are right?

If it doesn't work (for some value of the variable 'work'), it's fairly clear it's wrong.

> What is desperately needed in the Internet today is an architecture. 
...
> We don't have an architecture today.  What we have today are the remnants of an architecture that is 30+ years old, and a lot of competing religions.

I wonder if the folks in the telephony world would say the same thing (modulo 100+ instead of 30+).  Given people's reliance on the Internet, the idea that we can throw out the existing (non-)architecture and replace it wholesale with something new is mere fantasy. Even back with IPng was being chosen, the assumption that this would be possible was probably a core mistake.

Regards,
-drc

---

From: Keith Moore <[email-masked]>
Date: Thu, 7 Oct 2010 19:22:29 -0400

> I actually think it's a bit worse than that.  As currently defined, IP assumes a global address space in which each individual address has the potential for being topologically significant.  Topolo…

Fair enough.  But very few applications out there make assumptions about topology based on address assignments.  If IP address assignment suddenly became non topologically significant, hardly any applications would break.   Routing would have to change, but assuming you had a way to do it, such a change would be far less disruptive than say IPv4->IPv6 transition.

> If it doesn't work (for some value of the variable 'work'), it's fairly clear it's wrong.

From that point of view, everything in IPv4 is wrong.  Using NATs is wrong because it doesn't work for some apps; not using NATs is wrong because it doesn't provide enough address space.  In other words, the problem of making IPv4 continue to be viable is (probably inherently) overconstrained.

>> Given people's reliance on the Internet, the idea that we can throw out the existing (non-)architecture and replace it wholesale with something new is mere fantasy. Even back with IPng was being chosen, the assumption that this would be possible was probably a core mistake.

No disagreement there.  Clearly you can't replace the internet architecture wholesale, but it might be possible to evolve it.  What doesn't work well is to have everyone decide for himself how to change the architecture.

Keith

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 08 Oct 2010 09:18:53 +0900

David Conrad wrote:

> Topological aggregation to permit scaling was an afterthought
> that doesn't fit particularly well into that architecture.

Topological aggregation to divide an IP address into network
and local address parts with classes A, B and C to permit
scaling has been there from the beginning.

It's inherent to fundamental architecture of the CATENET model.

You can find more than two levels of aggregation in RFC796.

						Masataka Ohta

---

From: Keith Moore <[email-masked]>
Date: Fri, 8 Oct 2010 09:00:39 -0400

> The referral problem he refers to is real, but I see it more as a consequence of the IETF being too rigid in its approach to address numbering.

How would changing IETF's approach to address numbering help the referral problem?

> The basic question here is that we have two hosts that are to connect for a peer-peer protocol in which either endpoint can initiate or respond to a connection request.
> 
> 
> Clearly this is rather challenging if the boundaries between addressing schemes are arbitrary and becomes somewhat simpler in a uniform addressing model.
> 
> But the real Internet is not like that. It is a network of networks and crossing the boundary between a private network and the interconnect space between the networks has consequences.
> 
> One of those consequences is that addresses can change at the private/interconnect border. Another consequence is that crossing that boundary should have security consequences.

In the "real" Internet, the boundary between a private network and "the interconnect space" is fuzzy and arbitrary, especially from a security point-of-view, and becoming moreso all the time. 

> Opening up a port to receive connection requests has considerably greater security consequence than making the request. The requester is opening a communication channel with a single, specified entity, the responder is opening access to any host on the Internet.

And far better mechanisms than "opening up a port" are feasible even within the classic Internet architecture.  If the industry hasn't provided them, that's not the fault of the architecture.

> So opening a port is an event that should be mediated by access control at the host level and private/interconnect border at a minimum. In a default deny network there will be additional policy enforcement within the private network. 

There's a fundamental problem in that people have come to expect that somehow the network is responsible for keeping hosts secure from attack.  Again, that's not the fault of the architecture.

Keith