IMPLEMENTATION OF A NETWORK ADDRESS TRANSLATION

270 Pages·2004·1.31 MB·English

NAVAL
POSTGRADUATE
SCHOOL

MONTEREY, CALIFORNIA

THESIS
IMPLEMENTATION OF A NETWORK ADDRESS TRANSLATION
MECHANISM OVER IPV6

by

Trevor J. Baumgartner
Matthew D.W. Phillips

June 2004

Thesis Advisor: Cynthia E. Irvine
Co-Advisor: Thuy D. Nguyen

Approved for public release; distribution is unlimited
THIS PAGE INTENTIONALLY LEFT BLANK
REPORT DOCUMENTATION PAGE
Form Approved OMB No. 0704-
0188
Public reporting burden for this collection of information is estimated to average 1 hour per
response, including the time for reviewing instruction, searching existing data sources, gathering
and maintaining the data needed, and completing and reviewing the collection of information. Send
comments regarding this burden estimate or any other aspect of this collection of information,
including suggestions for reducing this burden, to Washington headquarters Services, Directorate
for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA
22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188)
Washington DC 20503.
1. AGENCY USE ONLY (Leave blank) 2. REPORT DATE 3. REPORT TYPE AND DATES COVERED
June 2004 Master’s Thesis
4. TITLE AND SUBTITLE: Implementation of a Network 5. FUNDING NUMBERS
Address Translation Mechanism Over IPv6
6. AUTHOR(S)Trevor J. Baumgartner & Matthew D.W. Phillips
7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING ORGANIZATION
Naval Postgraduate School REPORT NUMBER
Monterey, CA 93943-5000
9. SPONSORING /MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSORING/MONITORING
N/A AGENCY REPORT NUMBER
11. SUPPLEMENTARY NOTES The views expressed in this thesis are those of the author and do not
reflect the official policy or position of the Department of Defense or the U.S. Government.
12a. DISTRIBUTION / AVAILABILITY STATEMENT 12b. DISTRIBUTION CODE
Approved for public release; distribution is unlimited.
13. ABSTRACT (maximum 200 words)
Network Address Translation (NAT) for IPv4 was developed primarily to curb
overcrowding of the Internet due to dwindling global IP addresses; however, NAT
provides several other benefits. NAT can be used to mask the internal IP addresses of
an Intranet. IPv6, the emerging standard for Internet addressing, provides three times
the number of bits for IP addressing. While IPv6 does not need NAT for connectivity,
other NAT features such as address hiding are valuable. There is currently no NAT
implementation for IPv6.
The focus of this research was the design and development of a NAT implementation
for IPv6. This implementation will be used within a multilevel testbed. In addition,
the NAT implementation developed here can facilitate the Department of Defense (DoD)
transition to IPv6 planned for 2008 by providing services currently not available for
IPv6.
A working implementation of NAT for IPv6 within the Linux kernel has been produced.
The NAT development created here has been tested for support of the protocols of TCP,
UDP and ICMP for IPv6.

14. SUBJECT TERMS Network Address Translation, NAT, IPv6, IPv4, 15. NUMBER OF
MYSEA, MLS, Common Criteria, Linux Source Code, Netfilter, Iptables, PAGES
Ip6tables 270
16. PRICE CODE
17. SECURITY 18. SECURITY 19. SECURITY 20. LIMITATION
CLASSIFICATION OF CLASSIFICATION OF THIS CLASSIFICATION OF OF ABSTRACT
REPORT PAGE ABSTRACT
Unclassified Unclassified Unclassified UL
NSN 7540-01-280-5500 Standard Form 298 (Rev. 2-89)

Prescribed by ANSI Std. 239-18
i
THIS PAGE INTENTIONALLY LEFT BLANK
ii
Approved for public release; distribution is unlimited

IMPLEMENTATION OF NETWORK ADDRESS TRANSLATION MECHANISM
OVER IPV6

Trevor J. Baumgartner
Ensign, United States Navy
B.S., United States Naval Academy, 2003

Matthew D.W. Phillips
Ensign, United States Navy
B.S., United States Naval Academy, 2003

Submitted in partial fulfillment of the
requirements for the degree of

MASTER OF SCIENCE IN COMPUTER SCIENCE

from the

NAVAL POSTGRADUATE SCHOOL
June 2004

Authors: Trevor J. Baumgartner

Matthew D.W. Phillips

Approved by: Dr. Cynthia E. Irvine
Thesis Advisor

Thuy D. Nguyen
Co-Advisor

Dr. Peter J. Denning
Chairman, Department of Computer
Science

i ii
THIS PAGE INTENTIONALLY LEFT BLANK
iv
ABSTRACT

Network Address Translation (NAT) for IPv4 was
developed primarily to curb overcrowding of the Internet
due to dwindling global IP addresses; however, NAT provides
several other benefits. NAT can be used to mask the
internal IP addresses of an Intranet. IPv6, the emerging
standard for Internet addressing, provides three times the
number of bits for IP addressing. While IPv6 does not need
NAT for connectivity, other NAT features such as address
hiding are valuable. There is currently no NAT
implementation for IPv6.
The focus of this research was the design and
development of a NAT implementation for IPv6. This
implementation will be used within a multilevel testbed. In
addition, the NAT implementation developed here can
facilitate the Department of Defense (DoD) transition to
IPv6 planned for 2008 by providing services currently not
available for IPv6.
A working implementation of NAT for IPv6 within the
Linux kernel has been produced. The NAT development created
here has been tested for support of the protocols of TCP,
UDP and ICMP for IPv6.

v
THIS PAGE INTENTIONALLY LEFT BLANK

vi
TABLE OF CONTENTS

I. INTRODUCTION ............................................1
A. PURPOSE OF STUDY ...................................2
B. OVERVIEW OF CHAPTERS ...............................3
1. Chapter II, "Network Address Translation
Protocol in IPv4" .............................3
2. Chapter III, "Internet Protocol, Version 6" ...4
3. Chapter IV, "Monterey Security Architecture" ..4
4. Chapter V, "Common Criteria Assurance Level
Exploration" ..................................4
5. Chapter VI, "Development of NAT in IPv6" ......4
6. Chapter VII, "Conclusion" .....................5
II. NETWORK ADDRESS TRANSLATION PROTOCOL IN IPV4 ............7
A. BACKGROUND AND ANALYSIS ............................7
1. Internet Protocol, Version 4 ..................7
a. Background Information .....................7
b. IP Header Structure ........................9
c. Security ..................................11
d. Addressing ................................12
2. Network Address Translation ..................13
a. Basic NAT .................................14
(1) Address assignment .......... 15
(2) Address translation and lookup16
(3) Address unbinding ........... 16
b. Network Address Port Translation (NAPT) ...17
c. Bi-directional NAT ........................18
d. Twice NAT .................................19
e. Multihomed NAT ............................20
B. NAT IN THE LINUX OS ...............................20
1. Netfilter ....................................20
2. Kernel-Space Iptables ........................25
3. User-Space Iptables ..........................26
C. MODULE SEQUENCE MAPPING ...........................27
1. Kernel-Space Trace ...........................27
2. User-Space Trace .............................29
III. INTERNET PROTOCOL, VERSION 6 ...........................31
A. BACKGROUND AND ANALYSIS ...........................31
1. Introduction .................................31
2. Packet Header Format .........................34
3. Addressing Scheme ............................35
4. Address Allocation ...........................37
B. SECURITY ..........................................38
v ii
1. Existing Security Mechanisms .................38
2. Emerging Technologies ........................39
C. FEATURES PROVIDED BY NAT FOR IPV6 .................39
1. Address Hiding ...............................39
2. Dynamic Address Assignment ...................40
3. Transitioning Mechanism ......................41
4. Tunneling ....................................41
5. Connection Limiting ..........................42
D. DESIRED NAT FEATURES NOT PROVIDED BY IPV6 .........43
E. IPV6 SUPPORT WITHIN THE LINUX KERNEL ..............44
1. Initialization ...............................44
2. User-Space Functionality .....................45
3. Kernel-Space Functionality ...................46
IV. MONTEREY SECURITY ARCHITECTURE ..........................47
A. INTRODUCTION ......................................47
B. ARCHITECTURE ......................................48
C. IPV6 NAT TESTBED COMPONENTS .......................49
1. MYSEA Server .................................51
2. MYSEA Trusted Path Extension .................51
3. MYSEA Client .................................53
V. COMMON CRITERIA ASSURANCE LEVEL EXPLORATION ..............55
A. COMMON CRITERIA BACKGROUND ........................55
B. EVALUATION PROCESS ................................56
C. EAL5 REQUIREMENTS .................................58
1. Installation, Generation and Start-Up ........59
2. Administrator Guidance .......................59
3. Development Security .........................59
4. Functional Tests .............................60
VI. DEVELOPMENT OF NAT IN IPV6 ..............................61
A. CONNECTION TRACKING ...............................61
B. PORTING METHODOLOGY ...............................62
1. User-Space Iptables ..........................63
2. Connection Tracking and Netfilter ............64
3. NAT Code .....................................64
C. PORTING DIFFICULTIES ..............................66
1. IPv6 Address Structure .......................66
2. Checksum Calculation Ordering ................67
3. Checksum Calculations Algorithm ..............70
D. DEBUGGING .........................................71
E. TESTING ...........................................73
VII. CONCLUSION & FUTURE WORK ...............................77
A. ANALYSIS OF THE INTEGRATED NAT ....................77
B. FUTURE ALTERNATE IMPLEMENTATION DESIGN ............77
C. OTHER FUTURE WORK .................................79
v iii