Re: [v6ops] I-D Action: draft-ietf-v6ops-6to4-to-historic-07.txt - software bugs

[Alexandru Petrescu <[e-mail]>]

Le 13/11/2014 23:46, Jeroen Massar a écrit :
> [Replies to multiple mails in this thread compressed into one]
>
> On 2014-11-13 23:17, Alexandru Petrescu wrote: [..]
>>>> Do not deprecate until you offer a solution satisfying a
>>>> number of requirements (currently unsatisfied by eg tunnel
>>>> brokers).
>>>
>>> Which requirements are these?
>>
>> Ones one would have to lay down and agree on before engaging in
>> new work.
>>
>> For example -1- must allow for reverse DNS ok,
>
> That is a business decision. Most (all?) TBs provide this.
>
> Note that a normal ISP does not do this, hence bit silly to require
> it for a free tunnel...

Home ISP may not do it, but business ISP does.

>> -2- must be secureable by existing e2e IPsec,
>
> The tunnel or the packets that flow within it? What is the problem
> you are trying to solve?

I need to trust enough the other endpoint, not send something in the wild.

> The packets in the tunnel are 1280+ hence, go IPSec away as much as
> you want.
>
> For securing the tunnel it would require distributing keying
> material.
>
> As IPsec is horrible to configure and does not work through NATs
> happily (yes, you can patch crap) nobody ever bothered with this.
>
> For AYIYA packets are signed btw, hence, no spoofing of those. There
> is no crypto though there either.

The questions I have about these are numerous but mostly administrative
as such are hard to formulate here in a public forum.  It has to do with
what kind of business is it, etc.

>
>> -3- to the extent of possible be easy to set up for Clients
>
> TSP (gogoclient) and TIC (AICCU) solve that problem. CPEs incorporate
> these tools or have their own implementations (eg Fritz!Box).
>
> How much 'easier' do you want it?

Easy in the sense of as easy as opening a Google account.

>> and not involve intervention of another party (like when
>> requesting an IPv6 address from an administrator, delayed paper
>> forms, etc).
>
> Gogo's "anonymous" TSP tunnels do this. They get a lot of abuse.

For example, do they spy on you?

> Other Tunnel Brokers and Gogo TSP in "authenticated" mode require
> that one signs up, just as you would with a IPv4 ISP.

For example, what kind of private data should I share with them?

> This is a "business" decision though. Nothing a technical thing can
> solve.

There is no such aspect in 6to4...

>> From another mail:
>
>> For example, the current tunnel brokers are very good but (1) are
>> not trustful,
>
> What do you mean with "trustful"?

HArd to say, who do _you_ trust?

Trustful in the sense of accountable.  I dont want them to spy my
traffic, at least.  I want them to anwser questions when asked.

>> (2) force into later efforts to renumber when going native,
>
> Changing ISPs typically require that.

Whereas we can require the destinationISP to set up routing such that I
keep the same prefix I got from the first.  Or update other databases.

> Only way to avoid that is to get your own PI space.

Another administrative effort?

> At that point you will be able to arrange your own connectivity too
> though.

Only to those ISPs who accept it?

>> (3) require filling in forms.  6to4 has the advantage of not
>> requiring 3.
>
> And 6to4 is unreliable as no ISP can 100% support it.

Its mostly a matter of 6to4 Relays uptime and IP routing finding right 
paths.  Up to now I didnt experience 6to4 Relay not responding.

> With Tunnel Brokers you are signing up for a service. Signing up
> requires forms.

Are the Tunnel Brokers ready to fill in forms that I request conceive?

> Though those forms are there primarily to limit abuse too and to
> enable contacting people when they problems with their tunnel so
> that it can be resolved.

What about the potential abuse from the Tunnel Brokers?

> And another mail:
>> 6to4 is not alowing for reverse DNS either, if I am not terribly
>> wrong.
>
> https://6to4.nro.net

Thanks, I didnt know that.

Does it require filling in forms for each IP address?  I am easier at 
vi-ing a config file in my local DNS and then DNS takes care of rest.

> But even then you still do not want 6to4 as it is unreliable ;)

:-)


Alex

>
> Doug Barton wrote:
>> ... and yet I would assert that unless we're talking about
>> something that is provider managed (such as 6rd) then automatically
>> enabling it for the user is a bad idea. It will create more
>> problems than it solves, and cause a lot of support calls, which
>> ISPs are not
> going to like.
>
> Exactly.
>
> Greets, Jeroen
>
>
>