TCP NAT Traversal Testing for Anonymous File Sharing

Firewall hole punching implemented.

Now testing step by step.

So sometimes the test group http://www.itsdargens.com/swarm/show_one/86d1cca8104f981648eb1b1d0f0f3a39
might produce unexpected results.

Please try it we need more testers.

Bootstrapping to Anonymous P2P Networks

Even P2P overlays need some way to bootstrap in disconnected networks.

While DNS typically bootstraps with hardcoded IP addresses of the 13
root servers.

Ants p2p (version 2) kerjodando bootstraps using the itsdargens.com website.

Any user website can be set-up and used for this purpose.

Basically, all code is open source so that users can set-up own bootstrapping website.

The website replaces the current ANts p2p bootstrapping methods:

1. irc (why use this method when a website is much more friendly)
   
2. Gwebcache (this openly displays your ip address to strangers) and
3. Random walk accross the ad-hoc network. This allows users who you are not connected to (and don't know) to find out who else is connected.
   

The itsdargens.com Ruby on Rails bootstrapping website will provides the following functions:

1. Bootstrapping to a friend to friend group
2. TCP NAT traversal

STUNT P2P TCP NAT Traversal on a Ad-hoc Overlay Network

I've been thinking about this TCP NAT Traversal (TCP hole punching a method that allows everyone to connect quickly without port forwarding).

I think the following changes are needed to kerjodando to make it work.

1. Trusted Peers list (and itsDargens User database table) need to include two extra hidden fields, User ID (prob already in itsDargens database) and "use STUNT" flag. For example, if 100 users on a LAN connect to one group they will all have different user IDs although they have the same ip+port. Then when a user wants to connect to another user (after trying direct connection) they connect to STUNT using their user ID and signal (using SIPS) to another users ID. STUNT then tell them what ip+port to use to connect to that user ID. Also STUNT would set the "use STUNT flag" to yes.
2. ItsDargens user database to change to include "use STUNT" flag
3. Trusted peer file needs to download and use the included user IDs and "use STUNT" flag as well as ip+port.
   

The other thing I realised is that for signaling, users will have to maintain a connection to the STUNT server as long as they have a user (user ID) in their trusted peers list that they are not connected to.

However, once they have connected to all their trusted peers they can disconnect form the STUNT server.

Also, probably there will be some users that you can't connect to even with STUNT, maybe these should be marked as such in "use STUNT" flag and counted as connected when deciding if should disconnect form STUNT server.

To me a STUNT server consists of the following processes:

1. Maintaing TCP user connections with many users (User IDs)
   
2. Recording user (user ID) ip+port for at least two test connections from the user
3. Calculating predicted ip+port for a user (User ID)
4. Reply to a request to connect to a User ID with predicted ip+port
   
5. Telling other User to also make a request etc
6. Recording "STUNT flag" in user database table so that it can be included in downloaded trusted peers
7. Recording if STUNT does not work
   

More About STUNT:

Found STUNT ( Simple Traversal of UDP Through NATs and TCP too) library in java:

http://nutss.gforge.cis.cornell.edu//jstunt-faq.php


What does the stunt.jar library provide?

It provides a way to establish unproxied TCP connections between two end-points, both of which can be behind a NAT. It returns a SocketChannel that can be used for blocking or non-blocking IO as the application desires.


How does one write a server-client or peer-to-peer applications with the library?

We have provided a simple server-client application consisting of an EchoServer ( http://nutss.gforge.cis.cornell.edu//EchoServer.java ) that accepts inbound connections from one or more EchoClient ( http://nutss.gforge.cis.cornell.edu//EchoClient.java ) applications.


Does the library require some infrastructure?

Yes. The library requires a rendezvous server (much like a directory server) where applications with one URI can find the application with another URI and coordinate to establish a connection. The library also requires some STUNT servers that help applications find out their external IP address and port for establishing the real connection.


Does the rendezvous server proxy data?

No. The rendezvous server only helps set up the connection. After that, all data is exchanged directly between the end-points and does not go through the rendezvous server.


Who provides the rendezvous and STUNT service? Who can use them?

We at Cornell University are providing a rendezvous and STUNT service for developers and researchers to use. However, if you wish to deploy your own application that uses the library, we ask that you set up rendezvous and STUNT servers only for your own applications such that you do not overburden the Cornell service (which is for research and development purposes) and so that outages and changes in the Cornell service doesn't affect your application. The rendezvous server ( https://gforge.cis.cornell.edu/frs/?group_id=15 )and STUNT server ( https://gforge.cis.cornell.edu/frs/?group_id=15 )code is freely available.


Is this library under active development? Will you implement feature X?

The library is a proof of concept that TCP NAT Traversal is possible and is intended to be a starting-poing for application developers who want to use it in a real-world deployable project. At the same time, it is a library that can be used more-or-less unmodified for research and quicky-development and prototyping of applications. Time permitting, I would like to implement various features that are requested; but I cannot promise that all features will be implemented in a timely fashion. I will do my best to make the library more suited to its primary goal -- show how the NAT TCP problem can be solved easily by applications.


I want to implement TCP NAT traversal in my application but don't want to use your library?

The TCP NAT traversal code is contained in the file STUNTCont.java ( https://gforge.cis.cornell.edu/plugins/scmcvs/cvsweb.php/old/stunt_java/src/net/nutss/stunt/STUNCont.java?cvsroot=cvsroot%2Fnutss ). It includes extensive documentation. Feel free to adapt the code to your application. The rendezvous service and the STUNT service are modular and may be replaced by your own implementations if you wish to use the rest of the library.


Also see http://en.wikipedia.org/wiki/STUN

Aslo see:

see STUNT

http://nutss.gforge.cis.cornell.edu/stunt.php

and

http://www1.ietf.org/mail-archive/web/p2prg/current/msg00789.html

and

http://en.wikipedia.org/wiki/NAT_traversal

and

http://reports-archive.adm.cs.cmu.edu/anon/isri2005/CMU-ISRI-05-104.pdf

and

http://emu.freenetproject.org/pipermail/tech/2005-September/011611.html

Firewall Tunnelling and Quicker User Connection

Tne next project is ensure that users connect quickly and easily to kerjodando. It has two parts:

1. Ensure that users connect quickly and easily to trusted peers ONLY (except for users using Upnp to connect to other LAN users)

Currently "Ants" has several methods of connecting these need to be removed leaving only trusted peers and Upnp.

There might be more than this but here are the methods I know:

1. irc - REMOVED
   
2. gwebcache - REMOVED
   
3. peers - previous connections - LEAVE
   
4. random walk across the network from peer to peer recording peers with free slots - TO BE REMOVED
   
5. manual connect in advance tab - LEAVE
   
6. trusted peers - IMPROVE SO THAT IT KEEPS TRYING UNTIL CONNECTION MADE WITHOUT ANY BANDWIDTH TESTING
7. Upnp - LEAVE

This is important as with fewer users in each group quick connection is very important.


2. Using the itsDargens website as an intermediary develop a simple process to allow two peers with un-forwarded ports to connect.

I must admit that I don't fully understand the TCP/IP protocol but I would prefer if the solution involved a client connecting to website and then the website updating the trusted peers file to reflect the external port that was used. (This could be total rubbish on my part) The solution must be SIMPLE.

This is important as with fewer users in each group quick connection is very important and there is a high probability that both users may not have kerj ports forwarded.

Both jobs are urgent as the point of the application is to CONNECT and DOWNLOAD and currently about 50% of users can't connect!



The full list of things added and removed are:

Needed:
Own folder, separate from Ants - JAVA - OUTSTANDING
Client minimize to systems tray on opening - JAVA- OUTSTANDING
try to connect to trusted peers - JAVA- OUTSTANDING
itsdargens itermediate connection help where two users behind a firewall - RAILS - OUTSTANDING
ipfilter.dat - RAILS - OUTSTANDING
irc applet to website - RAILS- OUTSTANDING
email invite from google and IM on website - RAILS - OUTSTANDING


Not Needed:
Help page not needed as it is no help! - JAVA - DONE
Browser location setting no longer needed - JAVA - DONE
Monitor clip board for ed2k and ants links - JAVA - DONE
Random walk for new peers with free slots (must use trusted peers) - JAVA - OUTSTANDING
irc - JAVA - DONE
http tunnel - JAVA - DONE
ed2k hashes - JAVA - DONE
Search for peers on Gwebcache - JAVA - DONE
publish ip on gwebcache - JAVA - DONE
any restriction on peers connected to e.g. bandwidth - JAVA - OUTSTANDING

You Can Use Any Port on ANts p2p version 2 (kerjodando)

The development team has just added a new option to use any port to connect to Ants p2p (kerjodando) YUM YUM!

See http://www.itsdargens.com/swarm/show_one/86d1cca8104f981648eb1b1d0f0f3a39

If you don't put a port then 443 is used.

443 is still the recommended port as it allows people behind firewalls to connect easily.

Please try it we need some feedback.

Port 443 in the Trusted Peer File

Currently kerjodando defaults to port 443 in the trusted peer file.

However, I have three computers on a LAN and so only one can use port 443.

So only one can be connected to from outside the LAN by using the trusted peer file.

This is now a very big issue.

I have received a lot of feedback from users (linux and Mac ) who can't use 443 so other users can't directly connect to them - they have to use an intermediary.

THIS HAS TO CHANGE.

So I propose that the developers add an input field on for port number on the swarm page e.g. http://www.itsdargens.com/swarm/show_one/86d1cca8104f981648eb1b1d0f0f3a39

Should put it below description but above start. Put the following highlighted text next to it.
Enter port for p2p client, if using a router this port must be forwarded (leave blank if not sure - default port is 443)

The default port should stay as 443. However if a user inputs a port number then this should be used instead of 443 in the trusted peers file that is downloaded every 5 minutes.

THIS TAKE PRIORITY OVER THE WEB GUI AS IT IS MY MISTAKE IN LOGIC THAT NEEDS TO BE FIXED.

NEED DO IT BEFORE CONTINUING TO WORK ON WEB GUI.

Connecting to a P2P Network - ANts p2p and ANts p2p version 2 (kerjodando)

Port Needed to Connect to Ants p2p and Ants p2p version 2 (kerjodando)
Your Enviroment			Can You Connect?
Your Port	Port on Firewall Open?	Port forwarded?	YOU can connect TO OTHERS	OTHERS can connect TO YOU
443	Yes*	Yes	Yes	Yes
443	Yes*	No	Yes	Once you have connected to first user then others can connect to you.
Other Port	Yes	Yes	Yes	Once you have connected to first user then others can connect to you.
Other Port	Yes	No	Yes	Once you have connected to first user then others can connect to you.
Other Port	No	No	No	No
*This port is always open in firewalls;