IPv4+4 Address extension with NATs Zoltán Turányi András Valkó Andrew Campbell (Rita)

Problem: IPv4 address shortage IPv6 There for 6+ years No deployment Complicated transition Little incentives NAT Deployed Breaks end-to-end Breaks apps Single point of failure Not scalable Even more deployed

Why are NATs so popular? Very easy –No need to replace routers –No need to get more addresses Provide address isolation –Easy address planning independent of outside –Provider change does not result in renumbering –Some even think it is security

IPv4+4 Use existing multiple address realms NAT A B X X A.X B.X level 1 part level 2 part

IPv4+4 Use existing multiple address realms NAT

IPv4+4 packet versionhdrlen DS bytetotal length identificationfragment offsetflags TTLprotocolheader checksum source address destination address source address 2 destination address 2 protocol 2sposdposheader checksum 2 transport header + payload 233 covers addresses, len & protocol end-to-end

IPv4+4 routing RGW A B X Y A.X B.Y X B A Y X B A Y A B X Y A B X Y A Y X B packet routable based on IP header private addresses not visible in public realm private realm’s addresses not visible in another private realm

IPv4+4 routing RGW A B X C A.X C.0 X C A 0 X C A 0 A C X

IPv4+4 routing RGW A B Y C C.0 B.Y C B 0 Y C B 0 Y C Y 0 B

ICMP translation R R A RGW A B X Y R.0 A.X X B A Y A B X Y

ICMP translation R RGW A B X Y X B A Y A B X Y R A A Y X B B.R A.X

ICMP – a problem versionhdrlen DS bytetotal length identificationfragment offsetflags TTLprotocolheader checksum source address destination address source portdestination port sequence number (TCP)/length+checksum (UDP)

ICMP – a problem versionhdrlen DS bytetotal length identificationfragment offsetflags TTLprotocolheader checksum source address destination address source address 2 destination address 2 protocol 2sposdposheader checksum 2 source portdestination port sequence number (TCP)/length+checksum (UDP)

ICMP – a problem versionhdrlen DS bytetotal length identificationfragment offsetflags TTLprotocolheader checksum source address destination address source address 2 destination address 2 protocol 2sposdposheader checksum 2 source portdestination port sequence number (TCP)/length+checksum (UDP)

Summary - RGWs Legacy NAT Packet out: swap source Packet in: swap destination Add 4+4 header to ICMP messages Stateless, cheap processing

Summary – End hosts Generate & understand 4+4 header Decide if peer is in the same realm or not Obtain 4+4 addresses of peers –DNS –Configuration Application support needed

Implementation Linux kernel module Translates IPv4+4 packets and addresses – Mappings are dynamically created –Incoming packet –DNS request Packet headers inside ICMP errors DNS messages also affected

Implementation Linux kernel module – no kernel patch Load/unload any time KERNEL Module Applications userland kernel space

Implementation Linux kernel module – no kernel patch Uses netfilter hooks –Can examine and modify packet –Say a verdict: accept, drop, steal, queue Applications Input deviceOutput device PRE_ROUTINGPOST_ROUTING LOCAL_INPUTLOCAL_OUTPUT FORWARD

Applications Input deviceOutput device PRE_ROUTINGPOST_ROUTING LOCAL_INLOCAL_OUT FORWARD LOCAL_OUT If an ICMP error that carry a peer id inside => translate If destination is a peer id => translate LOCAL_IN If an ICMP error that carry a 4+4 packet => translate If v4+4 and addressed to us => translate If a DNS packet => QUEUE daemon QUEUEACCEPT

Applications Input deviceOutput device PRE_ROUTINGPOST_ROUTING LOCAL_INPUTLOCAL_OUTPUT FORWARD FORWARDING ICMP error carrying 4+4 packet => add IPv4+4 header 4+4 packet => swap source address PRE_ROUTING ICMP error carrying 4+4 packet => add IPv4+4 header 4+4 packet => swap destination address

DNS Each 4+4 address is stored as two “A” RR Name prepending is used as with SRV RRs Hostname: pleione.comet.columbia.edu. Records: l1.pleione.comet.columbia.edu l2.pleione.comet.columbia.edu IPv4+4 address:

DNS Kernel App Module Daemon Who is a.b.com? a.b.com doesn’t exist. Who is l1.a.b.com? Who is l2.a.b.com? l1.a.b.com is l2.a.b.com is Mapping:  a.b.com is

Testbed aphroditetaygeta pleione DNS server WEB server ipv44.comet.columbia.edu WEB server pleione.ipv44.comet.columbia.edu pc Budapest, Hungary Comet Lab New York

aphroditetaygeta pleione

aphroditetaygeta pleione

aphroditetaygeta pleione

aphroditetaygeta pleione

aphroditetaygeta pleione

Experiments Applications/protocols –icmp, ssh, scp, telnet, ping, http –arp, snmp, dhcp, routing protocols –ftp, irc Network management/configuration –dns, firewall, routing

Performance Pentium III, 1 GHz machine Unloaded Measured the forwarding time Applications Input deviceOutput device PRE_ROUTING LOCAL_INPUTLOCAL_OUTPUT FORWARD POST_ROUTING

Performance