Subject: UPNP was:RE: myth of the great transition (was US Defense Department forma lly adopts IPv6)

From: "Michel Py" <[email-masked]>
Date: Tue, 24 Jun 2003 21:13:23 -0700

Christian,

> Christian Huitema wrote:
> I don't quite get the point on the handling of
> incoming connections

The way I understand UPNP is that it will allow the automation (meaning,
no manual config of the NAPT box) of:

Server1: 192.168.1.10:80 <-> x.y.z.t:81
Server2: 192.168.1.11:80 <-> x.y.z.t:82
Server3: 192.168.1.12:80 <-> x.y.z.t:83

[x.y.z.t is the global public address]

In DNS you publish:
x.y.z.t server1.example.com
x.y.z.t server2.example.com
x.y.z.t server3.example.com

and you access the servers by:
http://server1.example.com:81
http://server2.example.com:82
http://server3.example.com:83

But what would be _really_ cool is if you could do this:

Server1: 192.168.1.10:80 <-> x.y.z.t:80
Server2: 192.168.1.11:80 <-> x.y.z.t:80
Server3: 192.168.1.12:80 <-> x.y.z.t:80
** and ** have the UPNP box select the proper NAT association based on
the requests.

In DNS you would still publish:
x.y.z.t server1.example.com
x.y.z.t server2.example.com
x.y.z.t server3.example.com

_BUT_ you could access the servers by:
http://server1.example.com
http://server2.example.com
http://server3.example.com
That's were the coolness is; no stinkin' port number.

As mentioned earlier there are some dirty ways to do it (hard state
piggied back on DNS requests) and less dirty (!= clean) (decapsulate
http host headers).

Michel.

---

From: John Stracke <[email-masked]>
Date: Wed, 25 Jun 2003 14:23:35 -0400

>x.y.z.t server3.example.com
[...]

>That's were the coolness is; no stinkin' port number.
You could publish URLs without port numbers if you could count on the 
clients recognizing SRV records.

-- 
/=====================================================\
|John Stracke      [email-masked]              |
|Principal Engineer|http://www.centive.com            |
|Centive           |My opinions are my own.           |
|=====================================================|
|"The Reality Check's in the mail." --L. Peter Deutsch|
\=====================================================/

---

From: John Stracke <[email-masked]>
Date: Wed, 25 Jun 2003 15:48:15 -0400

Keith Moore wrote:

>] You could publish URLs without port numbers if you could count on the 
>] cliens recognizing SRV records.
>
>use of SRV records for apps that aren't specified to use them is a
>violation of both those apps' protocols and the SRV specification.
>  
>
Agreed.  But it's an option for people who need to build new apps to 
kludge around NATs.

-- 
/=============================================================\
|John Stracke      [email-masked]                      |
|Principal Engineer|http://www.centive.com                    |
|Centive           |My opinions are my own.                   |
|=============================================================|
|*BOOM* "Thank you, Beaker. Now we know that is definitely too|
|much gunpowder." -- Dr. Bunsen Honeydew                      |
\=============================================================/

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jun 2003 15:41:44 -0400

] >That's were the coolness is; no stinkin' port number.
] >  
] >
] You could publish URLs without port numbers if you could count on the 
] cliens recognizing SRV records.

but you can't, because this would break interoperability with the vast
majority of existing protocols; it also would not work with protocols that
don't use fixed port numbers. 

Keith

p.s. yes, I know there are people who think it's okay to break the entire
installed base of Internet protocols in order to accomodate their pet kludge.

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jun 2003 15:23:29 -0400

] But what would be _really_ cool is if you could do this:
] 
] Server1: 192.168.1.10:80 <-> x.y.z.t:80
] Server2: 192.168.1.11:80 <-> x.y.z.t:80
] Server3: 192.168.1.12:80 <-> x.y.z.t:80
] ** and ** have the UPNP box select the proper NAT association based on
] the requests.

no, that would be *really* ugly.  because then you'd expect the NAT box
to know how to intercept every application you'd want to use, despite the
fact that those applications are evolving and the set of those apps is
changing constantly.  so you'd have to upgrade your NAT every time you upgraded
installed a new app.

stupidity has no bounds.

---

From: Keith Moore <[email-masked]>
Date: Wed, 25 Jun 2003 19:32:27 -0400

> Agreed.  But it's an option for people who need to build new apps to 

presuming, of course, that the app only needs to communicate with peers
in a single addressing realm outside the nat, and the app knows what
its external address/port is, and the app is able to arrange for the SRV
records to reflect that, and the address binding doesn't change during
the TTL of the SRV records. which, taken together, is a big stretch.