Subject: Re: nat breaks dcc (was Re: (NAT) Requested changes to NAT Terminology draft)

From: Pyda Srisuresh <[email-masked]>
Date: Thu, 10 Jun 1999 13:01:16 -0700 (PDT)

Andrew,

Sorry for the delay in responding.

From your description of the problem, dcc seems like yet another
application where an ALG is required. But, the protocol is not 
entirely clear to me. Does IRC have the same issues as DCC?
In any case, If you could send a more detailed description of
the protocol and the issues with both irc and dcc to Matt 
and/or myself, we could include this in the next rev of protocol 
complications draft. Thanks.

cheers,
suresh
> 
> >>                                     and dcc (within irc) is "just
> >> plain broken"(tm) by nat.
> >> 
> >
> >May be so. Do you know why? I would appreciate if you could send an e-mail 
> >on why this happens in a seperate e-mail thread. Thanks.
> 
> dcc is "direct client connection" as used in irc.  it's basically,
> imho, an elegant hack (ie, it's not covered in rfc1459 that describes
> the irc protocol), since the message(s) involved in dcc operate
> entirely within the irc message syntax.  the irc server itself has no
> awareness that such messages are being passed nor does it need to
> provide any facility for the support thereof.
> 
> the problem (as some irc fanatics would put it) is that the local
> client address is not rewritten by the nat.  the reason for this is
> simple and twofold: (1) no one has written an irc-alg, and (2) there's
> no "standard" port for irc (iana has apparently assigned 194, but most
> servers operate on 6665-6669) on which such an alg would operate.  the
> alg itself would be as simple as a slightly modified ftp-alt, eg
> instead of changing the address (and perhaps port) components of
> 
>    PORT 1,2,3,4,5,6
> 
> the alg would have to alter the contents of a
> 
>    PRIVMSG nick :^ADCC verb noun 16909060 1286 72422^A
> 
> message (the 16909060 is the address, and the 1286 is the port; i have
> no idea what the 72422 is or even if it's "correct" for this example).
> inbound nat would also have to content with a "nick!ident@hostname"
> prefix to this one line message.  pretty easy to do, but for the two
> points above.
> 
> i'm not advocating the development of an irc-alg, i'm just providing
> another example of something that's "broken" by nat.
> 
> -- 
> |-----< "CODE WARRIOR" >-----|
> [email-masked]             * "ah!  i see you have the internet
> [email-masked] (Andrew Brown)                that goes *ping*!"
> [email-masked]       * "information is power -- share the wealth."
> 

-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.

---

From: Andrew Brown <[email-masked]>
Date: Thu, 10 Jun 1999 16:25:17 -0400

>Sorry for the delay in responding.

np.

>complications draft. Thanks.

a few points:

* i'm not saying that dcc needs to be fixed.  it would not be
difficult to do so, but it would be quirky since the supposedly
"well-known" port number (like ftp's port 21) is not so fixed in
stone.  i was simply mentioning dcc rather off-handedly as a way of
showing that things you've never heard of can be broken quite easily
by nat.

* the irc protocol itself is detailed in rfc1459.  irc does not have
nat issues.  dcc (or direct client connect) is not covered there, since
dcc consists entirely of simple irc messages that the server relays
from one client to another.  sort of the same as using ftp to transfer
mail messages.  ftp (or ftpd) would "need to know" how to rewrite
email headers so as to provide a proper return path.

* dcc is a means for one client to advertise to another, a local port
over which it wishes to provide a service.  given that the irc
protocol itself was not modified at all in order to provide this
service, and also its wide-spread use as an "active" connection,
trying to force a "passive" dcc mode into the irc community is
unfortunately not an option.  irc-ers are known to just whine and move
on when confronted with dcc broken by a firewall.

* i've told you everything that i know about the dcc protocol.  do you
have any more specific questions i can answer?

---

From: Pyda Srisuresh <[email-masked]>
Date: Fri, 11 Jun 1999 08:22:57 -0700 (PDT)

OK. Thanks.

cheers,
suresh

-