[JDEV] NAT Issues

[Charles Forsythe]

Michael Brown wrote:
> Has this be covered already?  If so, is there a solution?

I've been looking into this issue and I've found three basic approaches:

  - Put software on your NAT/Firewall to handle the protocol.  BUT:
	Inexperienced users may not know how to do this.
	NAT/Firewall vendors may not support your protocol.
	The NAT/Firewall may not be under your control (ISP or corporate)

  - NATs compliant with RFC 2663 can use a UDP hack (see link below).
BUT:
	UDP-based transports are a headache
	UDP traffic has higher priority and can clog your network
	UDP introduces security issues
	If multiple peers are behind given NAT, they each need a unique
	  UDP port number (someone has to keep track of this)

  - Offer peer-to-peer proxy service to paying customers only.

I'm going with this last option.  People can use the P2P functions of my
client for free if they can, but if they want a Quality Of Service
guarantee (we promise you can do P2P even if you're both behind
firewalls), they can help pay for the server capacity to support them.

Anyway, here's a nice little whitepaper on the subject:
	http://www.alumni.caltech.edu/~dank/peer-nat.html

This may a stupid question (I've got a whole two weeks of experience
with Jabber), but how would you use or extend the Jabber protocol to
provide P2P negotiation?  Basically, one Jabber presence ("client")
would request a P2P connection to another Jabber presence ("server"). 
The Jabber "cloud" would first determine whether the "server" presence
is willing or able to support the connection.  If it will, and then the
Jabber servers will orchestrate the connection mechanism between the
"client" and "server" peers.  The options are:

	- client to server TCP socket (client may use Socks protocol)
	- server to client TCP socket (reverse connection)
	- client to server HTTP on port 80 (hack around firewalls)
	- client to server TLS on port 443 (better hack around firewalls)
	- UDP transport
	- client and server connect through proxy server via TCP sockets
	  (client and/or server may need to use HTTP tunneling to connect
	   to proxy server)

The decision on what method to use depends on:

	- what options the peers support
	- what options the Jabber servers are allowed to negotiate
	  (the proxy server option may not be provided)

Any thoughts?

-- Charles