5 ms·

I wonder if ping could be abused to send short messages for p2p networking over UDP without a central server to handle NAT busting. Looks like someone figured t

I wonder if ping could be abused to send short messages for p2p networking over UDP without a central server to handle NAT busting. Looks like someone figured the message part out: https://stackoverflow.com/questions/31857419/how-to-send-a-message-with-ping https://stackoverflow.com/questions/31857419/how-to-send-a-m... Unfortunately ping is handled by the OS so apps on the peer IPs wouldn't be able to read the messages. I wonder if it's time to provide hooks to some of these services in user space to make true p2p under double-ended NAT possible. At least a readonly event stream or something. It just feels like the barriers preventing that are entirely artificial now.

Bluecobra 3y ago
As IPv6 gains more and more adoption this should become less as an issue if everyone has a publicly routable IP and can avoid NAT altogether.
riffic 3y ago
ping is icmp not udp
- throwawaymaths 3y ago
  It's super confusing because you can use udp to read icmp packets (but not send, iirc), and i might be wrong, but i remember seeing tuts that did this!!
  - throwawaymaths 3y ago
    Getting downvoted, so: https://stackoverflow.com/questions/13087097/how-to-get-icmp-on-udp-socket-on-unix https://stackoverflow.com/questions/13087097/how-to-get-icmp... Using a udp socket is the "classic" way of implementing ping on low privilege syystems
    - yencabulator 3y ago
      You can kindly ask the kernel networking stack to inform you of errors, but that is not the same as "using udp to read icmp packets".
    - dgl 3y ago
      “udp” in this context means unprivileged data gram, not UDP the protocol. For some reason go uses the confusing “udp” name in parts of its API. The docs for this kind of socket seem to only exist on the kernel commit: https://lwn.net/Articles/420800/ https://lwn.net/Articles/420800/
freedomben 3y ago
Minor technical correction, but ping is ICMP rather than UDP. But I have seen data exfiltration strategies and other communication that uses ping! Nowadays I think it would be nearly impossible for p2p because most firewall default configs will silently drop all ICMP, including pings.
- lazide 3y ago
  Nod, I remember it not being as effective/easy to hide as exfiltration over UDP/DNS too, as there was always less background noise to hide in. That said, I found this with a quick search - https://github.com/utoni/ptunnel-ng https://github.com/utoni/ptunnel-ng for those who still want to do it. A number of hotels and captive portals still let pings through relatively unmolested even if they play tricks with UDP/TCP. Any significant data over ICMP will always stick out though if anyone is doing analysis. Which isn’t often, frankly, in situations like I described, but…
- jandrese 3y ago
  Note that blanket dropping of ICMP will break Path MTU Discovery (PMTUD) so you had better not be tunneling or encapsulating TCP traffic.
  - zinekeller 3y ago
    Actually, ICMP-based PMTUD is almost dead in IPv4 due to this exact problem (since ICMP isn't a "protected" protocol which is required for IPv4 connectivity), most actual services tend to do the MTU discovery purely using UDP or even using TCP (https://datatracker.ietf.org/doc/html/rfc4821 https://datatracker.ietf.org/doc/html/rfc4821)
    - dfox 3y ago
      That is essentially an reaction to random middleboxes just plainly droping ICMP traffic. If you want to stuff to work you do not want to just drop ICMP. The sane policy is to just pass it through or maybe rate limit it.
mindslight 3y ago
Interesting idea. It would seem that 'id' is effectively equivalent of (sport, dport), but 16 bits is a much smaller space than 32. But isn't the main problem with NAT punching that it requires activity on both ends to create a connection? Thus it always requires a coordination server to let node T (target) that node S (source) is trying to talk to it. You've got me thinking though. I wonder if there is a way to do this with ICMP routing messages - unreachable, TTL expired, etc. You can traceroute to some IP address, and get back packets from other arbitrary IP addresses, and this generally works through NAT. I'm envisioning a host T that wanted incoming connections to pick a random "dummy" IP address , publish (router IP, dummy IP) as its identity, and periodically send packets to the dummy IP address. Now a host S that wants to talk to T might be able to send an ICMP TTL-expired to T's router, pertaining to the dummy address. The router should see this and forward the packet to T. Of course this is contingent upon if IP addresses in ICMP fields are ingress policed the way the addresses in the IP header have become. (edit: hah. There is now a top-level comment pointing to an implementation of this idea)
oasisaimlessly 3y ago
It exists: https://samy.pl/pwnat/ https://samy.pl/pwnat/ (from top comment)
- zackmorris 3y ago
  Thanks, ya amazingly it got posted an hour after I asked! I wasted two years of my life back around 2005 trying to implement P2P networking over UDP through double NAT with TCP fallback through a central server tunnel. It was before promises, coroutines, green threads, software transactional memories (STMs), conflict-free replicated data types (CRDTs), Firebase, CouchDB, Redux, declarative programming, etc etc etc had really gone mainstream. So I lost all of that time reinventing the wheel, only to come up with something that wasn't deterministic, because I couldn't figure out how to fork/join conditional logic around multiple conditions and data sources. My cooperative threads would just stall waiting for some network event after a user had already shut down the game lobby, and I'd find myself trying to use signals/exceptions and polling throughout my business logic. That experience taught me that async programming isn't the way to go for mission critical code. The way to do it today looks like Raft, where event streams are centrally handled in synchronous blocking code in either an event handler or a separate thread to create a single source of truth like an STM. So last-known global state is available to all peers, the only differences coming from latency, permissions and distance cutoff. Player input as either events or composed states is sent over the network to update each peer's view of the STM to derive the final global state. Then each physics frame, peers simulate playing forward from that state for dead reckoning and update the scene view. The next frame may have a new STM state, so inconsistencies get resolved through animation metaphors like in CSS and Apple's Core Animation. But there should never be any logic that interacts with the network directly or hand waves its way through paradoxes. Loosely that means that when you hit another player, you may see it lose a life, but then pop back in if the STM decides that the shot was a miss. The game itself is written the standard way, as if all players are on a single server, using (at most) cooperative threads like in Unity to handle game business logic in a coroutine style, rather than using switch commands to implement a state machine around player modes like IS_SPAWNING, IS_SHOT, IS_DYING, etc like most games do. Since everything is sync blocking within each cooperative thread, determinism is guaranteed by eliminating whole classes of bugs. It would be nice if someone would put together everything I just said in a single package that's infinitely scalable to any number of peers like BitTorrent and runs on Mac/Windows/Linux without requiring a separate process or superuser privileges. The Raft/STM interface should look like a browser's local storage and provide fully indexed distributed associative key-value pairs as a JSON interface with the same transaction limitations as Firebase to allow updating trees with something close to ACID compliance from databases. <rant> If I ever get free of the rat race, I'd like to implement that P2P STM, but without world peace or UBI, I'll probably spend the next 20 years making rent like everyone else. I imagine the lifetimes of knowledge and experience siloed in all of our brains that could get out if we just had an extra 40 hours per week to work on the side projects of our dreams to get real work done and it haunts me. Nearly everything I do now in middle age is a waste of time because it would be straightforward to write better tools to make my job easier, but I'll never have the time to do that. So I toil in obscurity implementing other people's dreams in the hopes that someday one of their successes might help me win the internet lottery. But hey it's a living, and after going through a healing and growth process, just this year coming out of the dark night of the soul, I'm grateful for all of the lost decades and what they taught me about the nature of suffering and why we incarnated in this reality. Maybe the next generation will achieve the revolution that eluded mine.
AndroidKitKat 3y ago
Not exactly what you're looking for, but your comment about abusing pings made me remember pingfs [1]. It brings an entirely new definition of cloud computing! [1] - https://github.com/yarrick/pingfs https://github.com/yarrick/pingfs

Bluecobra 3y ago

As IPv6 gains more and more adoption this should become less as an issue if everyone has a publicly routable IP and can avoid NAT altogether.

riffic 3y ago

ping is icmp not udp

throwawaymaths 3y ago
It's super confusing because you can use udp to read icmp packets (but not send, iirc), and i might be wrong, but i remember seeing tuts that did this!!
- throwawaymaths 3y ago
  Getting downvoted, so: https://stackoverflow.com/questions/13087097/how-to-get-icmp-on-udp-socket-on-unix https://stackoverflow.com/questions/13087097/how-to-get-icmp... Using a udp socket is the "classic" way of implementing ping on low privilege syystems
  - yencabulator 3y ago
    You can kindly ask the kernel networking stack to inform you of errors, but that is not the same as "using udp to read icmp packets".
  - dgl 3y ago
    “udp” in this context means unprivileged data gram, not UDP the protocol. For some reason go uses the confusing “udp” name in parts of its API. The docs for this kind of socket seem to only exist on the kernel commit: https://lwn.net/Articles/420800/ https://lwn.net/Articles/420800/

freedomben 3y ago

Minor technical correction, but ping is ICMP rather than UDP. But I have seen data exfiltration strategies and other communication that uses ping! Nowadays I think it would be nearly impossible for p2p because most firewall default configs will silently drop all ICMP, including pings.

lazide 3y ago
Nod, I remember it not being as effective/easy to hide as exfiltration over UDP/DNS too, as there was always less background noise to hide in. That said, I found this with a quick search - https://github.com/utoni/ptunnel-ng https://github.com/utoni/ptunnel-ng for those who still want to do it. A number of hotels and captive portals still let pings through relatively unmolested even if they play tricks with UDP/TCP. Any significant data over ICMP will always stick out though if anyone is doing analysis. Which isn’t often, frankly, in situations like I described, but…
jandrese 3y ago
Note that blanket dropping of ICMP will break Path MTU Discovery (PMTUD) so you had better not be tunneling or encapsulating TCP traffic.
- zinekeller 3y ago
  Actually, ICMP-based PMTUD is almost dead in IPv4 due to this exact problem (since ICMP isn't a "protected" protocol which is required for IPv4 connectivity), most actual services tend to do the MTU discovery purely using UDP or even using TCP (https://datatracker.ietf.org/doc/html/rfc4821 https://datatracker.ietf.org/doc/html/rfc4821)
  - dfox 3y ago
    That is essentially an reaction to random middleboxes just plainly droping ICMP traffic. If you want to stuff to work you do not want to just drop ICMP. The sane policy is to just pass it through or maybe rate limit it.

mindslight 3y ago

Interesting idea. It would seem that 'id' is effectively equivalent of (sport, dport), but 16 bits is a much smaller space than 32. But isn't the main problem with NAT punching that it requires activity on both ends to create a connection? Thus it always requires a coordination server to let node T (target) that node S (source) is trying to talk to it. You've got me thinking though. I wonder if there is a way to do this with ICMP routing messages - unreachable, TTL expired, etc. You can traceroute to some IP address, and get back packets from other arbitrary IP addresses, and this generally works through NAT. I'm envisioning a host T that wanted incoming connections to pick a random "dummy" IP address , publish (router IP, dummy IP) as its identity, and periodically send packets to the dummy IP address. Now a host S that wants to talk to T might be able to send an ICMP TTL-expired to T's router, pertaining to the dummy address. The router should see this and forward the packet to T. Of course this is contingent upon if IP addresses in ICMP fields are ingress policed the way the addresses in the IP header have become. (edit: hah. There is now a top-level comment pointing to an implementation of this idea)

oasisaimlessly 3y ago

It exists: https://samy.pl/pwnat/ https://samy.pl/pwnat/ (from top comment)

zackmorris 3y ago
Thanks, ya amazingly it got posted an hour after I asked! I wasted two years of my life back around 2005 trying to implement P2P networking over UDP through double NAT with TCP fallback through a central server tunnel. It was before promises, coroutines, green threads, software transactional memories (STMs), conflict-free replicated data types (CRDTs), Firebase, CouchDB, Redux, declarative programming, etc etc etc had really gone mainstream. So I lost all of that time reinventing the wheel, only to come up with something that wasn't deterministic, because I couldn't figure out how to fork/join conditional logic around multiple conditions and data sources. My cooperative threads would just stall waiting for some network event after a user had already shut down the game lobby, and I'd find myself trying to use signals/exceptions and polling throughout my business logic. That experience taught me that async programming isn't the way to go for mission critical code. The way to do it today looks like Raft, where event streams are centrally handled in synchronous blocking code in either an event handler or a separate thread to create a single source of truth like an STM. So last-known global state is available to all peers, the only differences coming from latency, permissions and distance cutoff. Player input as either events or composed states is sent over the network to update each peer's view of the STM to derive the final global state. Then each physics frame, peers simulate playing forward from that state for dead reckoning and update the scene view. The next frame may have a new STM state, so inconsistencies get resolved through animation metaphors like in CSS and Apple's Core Animation. But there should never be any logic that interacts with the network directly or hand waves its way through paradoxes. Loosely that means that when you hit another player, you may see it lose a life, but then pop back in if the STM decides that the shot was a miss. The game itself is written the standard way, as if all players are on a single server, using (at most) cooperative threads like in Unity to handle game business logic in a coroutine style, rather than using switch commands to implement a state machine around player modes like IS_SPAWNING, IS_SHOT, IS_DYING, etc like most games do. Since everything is sync blocking within each cooperative thread, determinism is guaranteed by eliminating whole classes of bugs. It would be nice if someone would put together everything I just said in a single package that's infinitely scalable to any number of peers like BitTorrent and runs on Mac/Windows/Linux without requiring a separate process or superuser privileges. The Raft/STM interface should look like a browser's local storage and provide fully indexed distributed associative key-value pairs as a JSON interface with the same transaction limitations as Firebase to allow updating trees with something close to ACID compliance from databases. <rant> If I ever get free of the rat race, I'd like to implement that P2P STM, but without world peace or UBI, I'll probably spend the next 20 years making rent like everyone else. I imagine the lifetimes of knowledge and experience siloed in all of our brains that could get out if we just had an extra 40 hours per week to work on the side projects of our dreams to get real work done and it haunts me. Nearly everything I do now in middle age is a waste of time because it would be straightforward to write better tools to make my job easier, but I'll never have the time to do that. So I toil in obscurity implementing other people's dreams in the hopes that someday one of their successes might help me win the internet lottery. But hey it's a living, and after going through a healing and growth process, just this year coming out of the dark night of the soul, I'm grateful for all of the lost decades and what they taught me about the nature of suffering and why we incarnated in this reality. Maybe the next generation will achieve the revolution that eluded mine.

AndroidKitKat 3y ago

Not exactly what you're looking for, but your comment about abusing pings made me remember pingfs [1]. It brings an entirely new definition of cloud computing! [1] - https://github.com/yarrick/pingfs https://github.com/yarrick/pingfs