Subject: There are no NAT boxes on the Internet and never have been.

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 27 Jan 2015 12:40:19 -0500

Since my paper was rejected, I did not attend the middlebox workshop.

But I reading the back and forth on Facebook about it, and having spent
much of last week reading original sources on the architecture, I realized
that a lot of the problem seems to be the confusion between the use of
Internet Protocol in a network and an Inter-Network.

Today we typically use the term 'Internet' in a very broad fashion to refer
to all devices that run IP. That is a fine use of the term but it is not
the sense in which it is used in making the end-to-end argument. On the
contrary, in that era there was a sharp distinction between the local
network and the inter-network and very few machines in a university campus
had a direct inter-network connection.

When I read arguments from folk saying middleboxes should be eliminated,
they seem to all be making arguments for the Inter-Network. We certainly
want to keep the Inter-Network free of middleboxen. And with the rare
exception of boxes designed to perform mass surveillance deployed in Iran,
Syria, Russia, Saudi Arabia and other dictatorial regimes, we have pretty
much succeeded.

The question is not whether there should be middleboxen in the
Inter-Network. The question is how to provide control of the local network.
And here my college tutor, Tony Hoare was very insistent on collecting
security related functions into one single control point that can be
properly coded and audited within an operating system. I think the same
principle holds for a network.

It does not hold for an inter-network because the definition of an
Internetwork is that there is no central control point. Which in turn means
that we can't implement certain security functions in the Internet (though
there are some functions such as traffic analysis defense that can only be
implemented there).

---

From: Måns Nilsson <[email-masked]>
Date: Tue, 27 Jan 2015 21:24:38 +0100

> Since my paper was rejected, I did not attend the middlebox workshop.

<snip> 

> there are some functions such as traffic analysis defense that can only be

Your definition of The Inter-Network does not look to me as "no central
control point" but more in the direction of "The network where there
are no middleboxes" which is IMNSHO less satisfactory. Not to mention
an exercise in circulus in probando in the light of the present 
discussion.

I do, however, agree that for the IP-network overseer there exists a
right to manage traffic by regulating it but  that right should be as
delegated as possible and flexible if at all possible.

Is it, then, worthwhile to try expanding the radius of the Inter-Network
as defined by lack of middleboxes?

Is it worthwhile to try expanding the radius of the Inter-Network as
defined by e2e reachability perhaps partially regulated by policy at
AS border? I'm using AS-border because that seems to be  the most neutral
and unambigous point in the network (of networks) if one wants to make
a distinction between IP-Network and Inter-Network.

Does the IETF have a rôle to play in this? 

My personal position from operational experience is that some middleboxes
are more evil than others; that those who make it techically possible to
keep for instance a TCP 5-tuple unmolested through them are easier to
maintain, scale and live with, whereas those who require a new 5-tuple
on the other side of the middlebox are considerably more evil, because
they make themselves an integral part of the connection. (And the
connection fails when the middlebox fails, which means that the
reliability of the Inter-Network will be compromised)

Perhaps the IETF does have a rôle to play, in supplying the networking
world with methods and standards to scale out e2e networks, making the
(IMNSHO) bad, invasive middleboxen less attractive in favour of less
intrusive devices.

-- 
Måns Nilsson     primary/secondary/besserwisser/machina
MN-1334-RIPE                             +46 705 989668
Please come home with me ... I have Tylenol!!

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 28 Jan 2015 10:02:37 -0500

On Tue, Jan 27, 2015 at 3:24 PM, Måns Nilsson <[email-masked]>
wrote:

> Subject: There are no NAT boxes on the Internet and never have been. Date:
> Tue, Jan 27, 2015 at 12:40:19PM -0500 Quoting Phillip Hallam-Baker (
> [email-masked]):

The Inter-network is the network of networks. Einar Stefferud used to give
a very good talk explaining the difference between an Inter-network and a
network.

Running IP end to end does not necessarily mean running Internet end to
end. The point is that the INTERNET Engineering Task Force is recognized as
the authoritative body for setting standards for the inter-network but the
decision maker at the network level is the owner of each network.

A random IETF participant with an opinion and a keyboard does not get to
tell me how to run my damn network. He is not even entitled to an opinion
on the matter.

I am certainly not arguing for reducing the scope of the IETF to the areas
where it is authoritative. But I think people from the routing layer need
to understand that what we do at the applications layer are better
understood as suggestions rather than making laws and our approach as being
persuasion rather than command.

> delegated as possible and flexible if at all possible.

Why is delegation a good thing? Why is flexibility a good thing?

What I want as a network user is for my applications to work with as little
hassle as possible. And for that I find consistency and a single control
point much easier than having to work out which of the multiple veto points
is stopping something from happening.

Yesterday I had to remove and reinstall Apache on the linux box because it
would not start thinking it didn't have the right permissions. The
permissions in question being split between O/S permissions and application
level permissions and the software gives no information saying which is
blocking.

Windows is even worse for this. Trying to get apps to run under IIS
requires three separate sets of permissions to be set and they don't even
tell you about one of them. It is a hidden O/S feature that you have to
discover by poking about on programming forums.

The problem with middleboxes is that they distribute control across a
network and make the transport of packets non-deterministic. Middleboxes
will make arbitrary and often bran dead modifications to packets in an
attempt to achieve control.

There are two aspects of an access control infrastructure, the policy
decision point and the policy enforcement point. In the current middlebox
model every middlebox does both and that makes network management hard. In
a default-deny network, no packet transits without express authority. So
middleboxen need to perform policy enforcement. But the only way to make
such a configuration practical is to coordinate policy distribution.

---

From: Seth Johnson <[email-masked]>
Date: Wed, 28 Jan 2015 13:58:55 -0500

Yes.  One of the key problems with the Information Society project is
that it encourages confusion of the term "Internet" with IP-based
networks in general.

Seth

On Wed, Jan 28, 2015 at 10:02 AM, Phillip Hallam-Baker
<[email-masked]> wrote:
>> Tue, Jan 27, 2015 at 12:40:19PM -0500 Quoting Phillip Hallam-Baker
>> ([email-masked]):
> The Inter-network is the network of networks. Einar Stefferud used to give a
> very good talk explaining the difference between an Inter-network and a
> network.
>
> Running IP end to end does not necessarily mean running Internet end to end.
> The point is that the INTERNET Engineering Task Force is recognized as the
> authoritative body for setting standards for the inter-network but the
> tell me how to run my damn network. He is not even entitled to an opinion on
> the matter.
>
> where it is authoritative. But I think people from the routing layer need to
> understand that what we do at the applications layer are better understood
> as suggestions rather than making laws and our approach as being persuasion
> rather than command.
>
>
> Windows is even worse for this. Trying to get apps to run under IIS requires
> three separate sets of permissions to be set and they don't even tell you
> about one of them. It is a hidden O/S feature that you have to discover by
> poking about on programming forums.
>
>
> model every middlebox does both and that makes network management hard. In a
> default-deny network, no packet transits without express authority. So