Nicolas314

All my geeky stuff ends up here. Mostly Unix-related

Home Automation

leave a comment »

plug

I was a bit late to the party, but I finally got into home automation and bought a couple of connected power plugs. Price and curiosity decided for me: they can often be found online for really cheap and they are a great excuse to spend a week-end doing nothing else but play with new gadgets.

The plugs I got are from a noname Chinese company. The packaging is raw cardboard with no indications, and the manual is limited to a thin and small sheet of paper with a QR code that sends you to the app store to download an app called SmartLife. So be it.

Start the app and get faced with a login screen that forces you to create an account and register your product. Pain in the butt. Once logged in, you need to identify the kind of device you want to register. That’s a bit surprising. You would expect connected devices to be able to exchange their pedigrees over the net instead of me having to shuffle through thousands of possible products and probably getting it wrong. Alright, moving on.

Next step is device registration: put the app in pairing mode, press the only button on the plug long enough, and magic: your connected power plug now appears inside the app. Great!

Let’s spice it up a bit: the plugs are advertised as being Google-compatible, so start the Google home assistant and try the additional linking process. The Google menu is scary: there are literally hundreds of IoT device vendors out there, and I have no idea which one I should be looking for. No brand name on the box or on the plugs, and the product name displayed on Amazon does not appear anywhere in the endless list proposed by the Google app. Hmm… Let’s try with SmartLife? Yes: Google knows about SmartLife and asks for full control over the account I just created above in the app. Why not, who cares? Be my guest.

Once this was done, the two plugs appeared magically under Google Home and I could finally say “Hey Google, turn the lamps on!” and get enlightened. Phew!

That’s fun but I have no intention of leaving a device that permanently records every sound in my house, so voice command is pretty much out of the picture. So without voice command, let me summarize how to switch the lights on in my living room in 8 easy steps:

  • Since the app is registered with a SmartLife and Google account, I only installed it on one device. Which means I am the only one who has the power to switch lights on and off. Which also means that I am the only one who has to rummage through the house to find where I left my bloody smartphone again.
  • Unlock phone with fingerprint. Try again. Nope, try again. Give up and type the password. Avoid the temptation to read the bazillion notifications.
  • Find the app. How’s it called again? Go through the endless list of apps, cursing yourself for not putting in on the home screen with the other 255 must-have apps.
  • Open the app, but since you haven’t used it for a while you need to login again. Of course you forgot the password, so click “Forgot password” and get a link by email to reset it within 5 minutes. Hopefully. Now is the right time to sort out those bazillion notifications.
  • Now you got in, making a mental note to write that password down somewhere on a piece of paper and also remember where you left that piece of paper. Select the Devices tab, go to the lamp you want to switch on, and click.
  • Nothing happens, so click again. And again, several times. Press even harder on the phone screen, you never know.
  • Now all your clicking finally gets through and the lamp starts switching on and off like a Christmas tree, ending up switched off, of course.
  • Click again, then wait. Tadaaa, the light is on!

Easy, right?

The next day I looked into advanced options and found a solution: use a timer. Instead of doing it myself, automate it, of course! Program the lamp to switch on when it’s getting dark, and switch off at midnight. Problem solved.

Or maybe not.

Let’s assume I am sitting in my living room, the lamp is 3 feet away, but just like a real lazy bastard I reach for my phone, open the app, and press the button. What happens next?

My phone connects to the SmartLife server. Could be in China, maybe in the USA, who knows?

I get authenticated. My order gets through, and a flag is raised somewhere on somebody else’s servers, probably in the US on Amazon.

The plug in my living-room sends beacon packets to its home server every second, asking if it needs to do something. The raised flag finally gets to the plug, which acts and switches the light on.

How many things could go wrong?

My phone could stop working. Empty battery, bug in the app, bug in the OS, or it could just be the perfect moment to run a firware update that freezes the device for 20 minutes.

My phone may not be able to connect to the cloud. This requires an overseas link, which is of course not guaranteed to work. Same problem with the plug requesting commands every few seconds. Servers crash, databases get erased, latency can increase without warning. Seems stupid that a server crash in China would prevent me from turning the lamps on in my living-room. I do not want to subscribe to Amazon’s server health status to figure out whether I will be in the dark tonight at home.

My home network is nowhere near industrial availability. Between the internet modem and the plugs are several switches, a router, and a WiFi access point that sometimes decides to take a few hours off for relaxation.

Depending on a bunch of companies to keep my service alive does not sound very future-proof. What happens when some of those companies go out of business? What is the plan then? Will we throw away all the devices that depend on it for a living? I was looking for a network-controlled device, not for a life-time service contract with a third-party company whose name didn’t even appear on the box.

In terms of energy consumption this is not environmentally sound. The plugs keep sending small data packets back home, which is not much in terms of bandwidth but forces every device on the way to grind packets for no reason. An overseas link necessarily involves 15-30 hops one way, that’s a lot of machines working to not light up my living-room.

I also don’t feel too good about needing to create an account to protect the plugs from outside attacks. This is just opening a welcome gate for hackers to get into my network, and the price for closing that gate is to forego any usage of the plugs. Not good.

 

Fortunately there are solutions. Most connected plugs today are based on the ESP8266, a very popular chip in the maker crowd. Just google a bit and you find methods to erase and replace the firmware for those plugs with something that does not need to call home every second.

The project I used is tuya convert:

https://github.com/ct-Open-Source/tuya-convert

The procedure is rather simple. I used an Ubuntu-based laptop and got everything sorted in just 15 minutes. No need to open the box or solder anything, it all happens over the air. I re-flashed the firmware with Tasmota, an alternative ESP8266 piece of firmware, done. The two plugs in my house are now mini web servers that can be automated using MQTT or simply controlled from a web browser. Most importantly: they do not require an Internet connection to work and they do not flood the local network with broadcast messages every second.

https://github.com/arendst/Tasmota

I lost only one thing: the ability to switch the lights from outside my house. Can’t say I will miss much.

This got me thinking: seems most IoT connected devices today are designed to be connected to the cloud. It is extremely hard to find something that could just be controlled from your local network without need to ping back to China or the US or who-knows-where. Why? I understand these companies are hungry for user data, but what’s in it for me? Requiring an active Internet connection should not be a pre-requisite for switching lamps on!

One small note about security: those devices are advertised as being top-notch secure and based on military-grade security. And yet you can simply erase and re-flash their firmware over the air without much effort. Simple but deadly mistake: devices do not validate server-side certificates. It is rather trivial to start your own web server with a self-signed certificate and point the device to it using a well-configured local DNS server. This is great because it means I could get rid of the initial firmware, but it also means anyone in the same room could do the same and poison the firmware. Who knows how many other security issues these devices suffer from?

I can easily imagine that instead of relying on distant machines located in data centers, we could host the main control point ourselves in our houses. Modern houses already have Ethernet cabling running through all rooms, with some space in a closet to connect a router and a switch. It would not be hard to install an additional server there, something Raspberry-pi-sized, and use it to control every piece of connected hardware in the house.

You guessed it: there are already several projects on that topic. The most promising I found seems to be Home Assistant:

https://www.home-assistant.io/

I have not looked too much into it yet but will do soon, and maybe write it up here. Next evolution would be to be able to run voice recognition on that same local machine so we don’t have to be spied upon by Google and Amazon. I am really looking forward to the next company offering a Home OS. Right now these home automation gadgets are just a jungle of services quickly strung together with no future.

Today’s lesson: don’t buy connected devices if you cannot flash them with alternative firmware.

Written by nicolas314

Wednesday 8 January 2020 at 9:46 pm

Japan Kaleidoscope

with 2 comments

cover

Akihabara, Tokyo

I have just spent three weeks in Japan. What can you decently bring back from such a short trip? I have the feeling I have only touched this extremely rich and multi-millenial culture. A kaleidoscope of colours, smells, sounds, and faces come to mind when I try to look back on this small adventure. As usual, when I come back from Asia I discover that I have taken home a little more than I bargained for. Some things are changed, some things are broken inside me, only to be re-built from their ashes.

During my first visit to Asia twenty five years ago, I got hit in the face with fairly obvious cultural shocks. Things like counting on your fingers: I wanted to tell the hotel staff we were three guests and raised my thumb, index, and middle finger to indicate: THREE. The guy repeated with his hand, looking surprised. He said something in Chinese (this was Taipei), I said something in English, and we both understood we would be left with gestures for the rest of the conversation. I waved again with my fingers: THREE, so he repeated it, looking surprised. We were three guys standing in the lobby so I didn’t get it. I showed the two others: ONE, TWO, and myself: THREE. The guy opened his whole hand, showing all fingers, asking something. No we are not five, we are three. It took us a little while to proceed, because what I had just gestured means EIGHT. The hotel clerk was asking me where the other five were. In order to show three, you raise the three middle fingers. Ah, right. I later learned how to count in Chinese, an easy task: with just thirteen words you can count up to 999,999.

There were more embarrassing moments, like the first time I sat on a Korean toilet and could not figure out how it worked since I am quite illiterate in Korean. You may not want to hit random buttons and wait to see what happens, unless you want to come out of the loo covered in smelly water just before an important customer meeting.

Japan has those same magic seats that clean your ass like you are a baby. Once you figured out the controls, you wonder why those are not generalized in the Western world already. There is no better feeling than walking around with a clean butt, especially in those hot summers with 40 degrees and 100% humidity.

My major cultural shock during that last trip was food. If you have never tasted food in Japan, you have never eaten decent food in your life. Ever. The closest you can get to that in terms of taste, freshness, and diversity could be Italy, on a very different spectrum. Japanese food does not just build on fish and seafood, this is just one tiny part of it. The default 5-euro bento they bring to you in very standard Tokyo restaurants could contain fish and meat of all kinds, but also sauces, spices, vegetables, rice, soy, salad. Some parts are raw, some are deep-fried, some barely cooked. I never knew tofu could be prepared to be so delicious. Rice is always perfect. If you never tried, you owe it to yourself to try okonomiyaki and takoyaki. We found a restaurant in Osaka that serves takoyaki for a bit less than 2 euros for 6 pieces, when 12 pieces will fill you up. A ramen bowl served with half-boiled egg and vegetables can serve as a single meal for a day. Soups are largely different from one place to another, always delicious.

food1

Soup, rice, vegetables, tofu, and fried pork

Finding a place to eat in Japan is usually not an issue. Everywhere you look there are between three and thirty restaurants facing you. We tended to stick to the ones offering menus with pictures, where we had a chance to show what we wanted and have an idea of how much we were going to pay. Some restaurants have an vending machine where you insert a note and press one of the many buttons to choose your dish. A ticket gets printed, which you hand over to the cook who will prepare it for you. Only trouble is: all buttons are Japanese-only, so we usually went back and forth between the window outside where plastic replicas displayed the available food, noting the price down. If the dish of your choice was the only one costing 530 yens, you knew what you were having.

Even if Tokyo is a gigantic city, it does not have that oppressing feeling you can have inside Paris, for example. Residential areas are packed with small houses that have at most two floors, letting you see the sky all around you. In business districts, skyscrapers are sufficiently far from each other that you always see the sky, giving you the impression you can breathe. Of course there are exceptions. Train stations and the quarters around them tend to be real mazes of streets and hidden passages you can wander aimlessly for hours on end without ever seeing the light of day.

shibuya1

Shibuya crossing

We visited Shinjuku, a busy business district with office skyscrapers all around, filled with salarymen. Around 8pm, we saw millions of them walking towards the subway. Salarymen and women are equally dressed with deep blue pants or a skirt, and a white shirt, wearing tired black shoes. When we reached Shinjuku station we found a store selling salarymen uniforms: endless lanes of deep blue pants and white shirts, with thousands of people all dressed the same, looking carefully around to find their next deep blue pants and white shirt. It looked so much like a cartoon. When in the subway, they patiently queue where indicated, politely waiting for passengers to come out of the cars before they rush in. Some of those cars were so packed it was suffocating, and the subway usually runs every minute or so. Who would drive a car in such a big city anyway when there are trains to take you anywhere for pennies?

shinjuku1

Shinjuku station

You might have heard of the cat cafés in Tokyo: yes they exist, together with rabbit cafés and owl cafés, where you can have your tea and pet a furry for an hourly fee. In Akihabara we saw those 8-floor buildings filled with arcade games producing deafening noises, endless streams of fighting heroes, car races, and cute little animals singing annoying songs at full volume. We also visited manga cafés, manga buildings, figurine shops, and duty-free electronic stores. We also got into sex-shops, more by accident than anything. From the outside all you see are bright colors and posters of female anime characters. Once inside all doubt is gone: the mangas are not the kind you expected, and the large collection of DVDs is probably not something you want to see because you won’t be able to unsee it ever again.

shop1

May not look like one, but this is a sex-shop

The streets of the electric city are filled with gigantic screens displaying ads, shouting slogans to the crowd as they pass by. There is no escaping those jingles and loud voices trying to sell you stuff, making Blade Runner feel like a documentary. At night, the lights are just magnificent, the information flood fills you with a sense of panic which makes me happy I cannot read. I wondered how we got through Shibuya without inducing an epileptic seizure.

akihabara2

Akihabara, Tokyo

In Takeshita Dori, we were surrounded by school girls looking for kawaii (cute) things to buy. Shops are filled with pretty much every conceivable product covered with images of little large-eyed furry animals staring at you like Bambi. The street is drowned in a thousand child songs playing too fast, laughing girls, brightly-coloured clothes and people yelling about their stores. I wish I could see that on a quiet winter evening.

 

osaka

Department store in Kyoto

You always hear about the Japanese culture and how it wonderfully mixes tradition and modernity, but you really understand what it means when you find kimono-wearing twenty-something girls looking for the latest cameras at Yodobashi, or when you see a tiny shrine on a street filled with bright neon lights displaying manga characters. The working men and women of Japan, all wearing uniforms, are facing a wave of creativity that has little equivalent anywhere else in the world. You see a subway car packed with tired salarymen who only want to get home, surrounded by cheeky colourful adverts inviting them to take better care of their skin or why not travel to a distant country. Cartoon characters showing their butts, movie stars dressed as animals, and dancing pokemon figures are just expressions of pure creativity. Stark contrast.

shop2

Pocket monsters

Three weeks and a million anecdotes later, I realize some things have changed in me and I don’t quite know what yet. Taking away some of the conventions I have unknowlingly applied all of my life and adding some more, gets me a little closer to understand what being human and living in society really means. Three weeks of being illiterate is a humbling experience.

Written by nicolas314

Saturday 1 September 2018 at 11:31 pm

Posted in japan

Tagged with , ,

Put on your shoes

leave a comment »

shoes


– Mister engineer, we are about to leave the house. Could you please lace your shoes?

– I’m afraid I can’t do that before at least next year.

– What? No! We are leaving the house right now. Tie your shoes and let’s go!

– Well, it is obvious you have not been in the shoe-lacing business for quite a while mate. See: in order to tie my shoes I’d have to get my hands closer to my feet. I see three main possibilities:

1. I lower myself down to the level of my feet (and shoes), which is dangerously close to the ground. I could trip and fall, bringing me to ground level with sufficient speed to hurt my nose, probably causing bleeding in the process. Who would want to leave blood on the floor? You don’t want me to hurt myself, do you? This would take us to a large amount of blood cleaning and nose healing, which could take a lot of time and make us both look bad in case someone on the street asks why I have a bloody nose.

2. I could bring the shoes up to my level. Considering my feet would stop touching the ground, I would have very little time to complete the movement needed to effectively tie a knot to what could be considered decent shoe-lacing. Bad knots would make us look bad, and we do not want someone to notice that we are not even able to come out on the street with properly tied shoes.

3. The third and last possibility is to wait for my feet to grow up enough so that my shoes do not fit any more. This would probably trigger some shoe-buying and shoe-replacing, which could then be put to practical use to purchase a new pair of lace-free shoes, which would then solve all the above issues once and for all.

My conclusion is that we should wait until my feet have grown enough. See you in a couple of months.

– Man, you have reached the end of my patience. Let me tie those shoes for you.

– I’m afraid I can’t let you do that, Dave. Your role as a caretaker is not to take responsibilities and do things in my stead, but to teach me to be autonomous and let me do that myself. In addition, may I let you know that I have had these shoes for a few months now and you have never laced them before in your entire life, therefore I am the only suitable person to achieve that.

– C’mere, let me do it.

– Are you questioning my authority with respect to my own shoes? When you bought them you said they were mine!

– They are still yours, let me just lace them.

– You did not understand the above mentioned points. Apologies for my poor choice of words, I always forget that English is not your native language and you may not get the full power of the most subtle nuances.

– Don’t patronize me. Just don’t.

– Oh that was never my intention. In order to patronize someone…

– WILL YOU FUCKING TIE YOUR SHOES?

– Why the harsh language? Is that really needed? I have only given you the current status and all you can do is react strongly against me. I have not invented laces, nor did I decide to place my own hands at a different altitude than my own feet. I suggest you review our options and come to your senses before we do something we might regret.

– Do you see my hand? I swear it can fly and land on your face in no time.

– Let’s not be too hasty now. I would have to inform legal of your perceived intentions and will have to quote your language. Research indicates that people in your situation have very little chances of winning a legal fight that involves strong wording and physical violence.

– … You know what? You… You just stay here, Ok?

– That’s what I have been telling you all the time. Glad you finally came to your senses mate.

Written by nicolas314

Monday 9 July 2018 at 11:08 pm

What time is it?

leave a comment »

clock


– Hello Mr. Engineer, can you tell me what time it is?

– No I can’t.

– Why?

– Well then. You see, my watch is an electronic and mechanic device based on the oscillation of a quartz that imprints a periodic movement to a set of cogs, which are then de-multiplied to lower the base quartz frequency from 32,758 Hz to exactly 1 Hz, i.e. one beat per second.

– That’s very nice. And what time does your watch show now?

– I could tell you but it would not be useful. See, the quartz frequency is not exactly that power of two, it is itself oscillating with a larger period around that value, meaning that my watch can be ahead or behind by some amounts that are hard to measure, let alone predict.

– So it is inaccurate?

– Yes! You can never tell exactly the time with that kind of device.

– Ok… Seriously, what time is it?

– Not only are the watch mechanics imprecise, but they do not take relativistic effects into account.

– That so?

– Yep. Since Einstein we know time is nowhere absolute. When I put my arm up like this, time flows a little slower because of the Earth rotation, and if I put it down like this is goes a bit faster. Or is it the other way around? Anyway, my time reference is unlikely to be the same as yours since we are not moving around in sync.

– Listen, this is all very nice but that was not my question. Will you tell me the time it shows now and I will deal with the imprecision myself?

– No can’t do.

– Why is that?

– Even if you discard all relativistic effects and frequency drifts, the notion of time is not something universal on Earth.

– Care to explain?

– Time is only valid in a given time zone. Since the end of the 19th century we have split world regions according to time zones which keep changing at regular intervals based on political choices. In order to be able to tell you the time of day, I need to know a reference time in a given place and convert that depending on your position on the planet. We could use GMT, which stands for Greenwich Mean Time, but it is not even indicating the current time in Greenwich UK. I could then program a microservice that could give you the current date/time based on an estimated position from your IPv4 address, provided you are not too close to a time border. But then that assumes you have Internet access. Oh wait, do you have an iPhone or an Android?

– Er… Thanks mate. So let’s say we use the current time zone, Ok?

– Do you know if we apply Daylight Saving Time where you stand?

– How would I know? Yes, probably!

– Probably with what probability? Because we could weigh the answer depending on… Hey, where are you going?

– To lunch. I just remembered I wanted to ask you if it was time for lunch.

 

Written by nicolas314

Monday 9 July 2018 at 10:39 pm

Camels

leave a comment »

camels

I read somewhere in a math history book that numbers were actually invented to count camels. Someone wanted to send over a herd of camels to be sold on a market on the other side of the desert and they did not trust the camel escort. How would the receiving party know if some camels had not been stolen on the way? So they used a fairly simple principle: line up your camels, put one pebble in front of each. Gather the pebbles, put them in a small jar, burn the cork, hand it over to the escort.

On the receiving end, break the jar, put one pebble in front of each camel. You will know immediately if camels are missing.

This apparenly went on for a while, until someone figured out that instead of lining up pebbles and camels you could shorten the process by writing signs on the jar to indicate how many pebbles were inside. On the receiving end you just had to look at the signs and compare to what you saw. In case of doubt, break the jar and line up pebbles and camels. And then it was just a matter of time until somebody noticed you don’t need the pebbles and the jar. Just cook a clay tablet in an oven with a text indicating how many camels you are sending.

I have no idea if this story is true or not, but I like the way it stresses the breakthroughs that have happened. Going from a bijection pebbles/camels to a bijection in camels/signs was brilliant. I expect the first attempts were likely to just draw plain strokes on the jar, as many as there were camels in the herd. The next breakthrough was simplifying a whole bunch of strokes into a single sign, e.g. using a hand to signify the number 5. And the last one was to realize that the jar and pebbles were unneeded.

Another shift that amazes me to this day is how money actually works. The first currency tokens had actual value, they were made of metal you could melt and use if you so wanted. When the first bank notes were introduced, they switched from actual value to a potential: the note said that you could obtain real metal if you were to exchange that note in a bank.

We now live in a world where I can pay my lunch by waving a piece of plastic over a radio-equipped terminal connected to a bank. My plastic contains numbers that cannot be found on any other credit card, which are used to authenticate me. Now my bank makes a promise to pay my meal to the restaurant’s bank. No metal or paper changes hands.

Since a few years, things are shifting again. Instead of waving a credit card containing my unique account identification numbers, I can now use a mobile phone that contains a series of numbers that are only valid for myself, my account, for today, and for limited amounts. This is what they call tokenization and the reason it is booming is that it is a lot simpler to store temporary tokens with limited value than long-term banking credentials with unlimited powers. Security needs not be that high, though you still need to be able to authenticate account owners in a very secure way, but there are plenty of ways to achieve that.

Among the strongest methods we know today to authenticate someone, the most popular relies on the fact that you cannot split a big number into a multiplication of primes. If you tried with a gigantic computer, it would require more heat to power than is available in the universe.

We have come a long way since camel-counting.

Written by nicolas314

Wednesday 1 November 2017 at 11:37 pm

Posted in fun

Tagged with , ,

I am not your daughter

leave a comment »

sleepless

You called me quite late. Some time during the middle of the night, and for whatever reason I had left my phone on. I picked it up and was greeted by your anxious voice:
– Isabelle, is that you?
Part of my brain was still actively dreaming, but the part that was emerging found the idea preposterous. Do I sound like an Isabelle? I croaked:
– No Madam, this is not Isabelle.
– Oh come on Isabelle, it’s Mum. Stop playing fool with me, I recognize your voice, please..
Even half awoken, the tension in your voice was definitely noticeable. You wanted to talk to your daughter and nothing would stop you.
– Madam, I can assure you I am not your daughter. In fact I am a man and my name is Nicolas.
– Bullshit! Isabelle, talk to me!
Your old lady’s tone left me no choice but to obey, so I gave up and decided to play along.
– Alright Mum, you got me. What’s up?
You seemed surprised. Apparently Isabelle does not give up so easily when playing this game. But the sudden joy of being able to talk to your daughter was so great that you could not help it. You started talking about your neighbours at the retirement home, how the nurses were treating you, and had many complaints about the food and such. I listened very carefully at first and quickly dozed off, we were half way during the night after all.

You called again a bit later, and again, and again. We spent our night like this: you finally talking to your daughter, and me sleeping through 10-minute intervals. Finally one of your nurses must have found out you were secretly phoning at night and you stopped calling.

You never called again. I hope you found the right number for Isabelle and she takes good care of you.

Written by nicolas314

Monday 2 October 2017 at 9:42 am

Posted in Uncategorized

Long live NAT!

leave a comment »

ipv6-no-thanksHome networking can be a lot of fun: setting up a name service, a guest network, or traffic rules, leads to an endless joy of discovering new RFCs or creativity in the very active field of artistic configuration file syntax.

I thought I had seen everything until I tried to set up IPv6 connectivity for my home network. Little did I know that this would eat up so many of my precious free evenings. The following writeup is here to remind me never to try that kind of shit ever again, and as a warning to future generations who might want to dig into this kind of topic. Life is short, there are many better things to do than attempt to set up a new addressing scheme for your home network. Long live the NAT king!

The Start

It all began when I noticed that my ISP provided me with a unique (native!) IPv6 prefix to use on my home network. Something like:

2001:1234:5678:9abc::/56

Since I was not familiar with IPv6 addresses, it took me a while to find out that the first 64 bits of a 128-bit IPv6 address designate a network, and the last 64 are reserved to differentiate hosts on that network. My provider handing me a /56 means I have 64-56 = 8 bits to play with, i.e. I can instantiate 256 home networks, each having up to 2^64 = 18,446,744,073,709,551,616 hosts. Overshot a bit, maybe.

So where do I start? Do I have to install specific software? Where? Do I need to buy specific hardware? How many services are needed? And thereby started my long painful descent into the horrific world of IPv6. Toss and loose 1d20 sanity points immediately.

My ISP unfortunately did not provide any help as to what I am supposed to do with the IPv6 thingie they gave me. No single help page, very few discussions on their forums, and all exchanges I had with customer service were completely useless. Best I could find were discussions between customers of an ISP in the US that provides a similar setup. That is thin.

Say you received a /56 prefix from your ISP. If that prefix ever changes e.g. because you switched to a new ISP, you want things to work automagically because that is the way things currently work with IPv4: changing my public IPv4 address does not change anything to my home network.

In order to do that, IPv6 suggests that home networks use two sets of addresses: the public ones derived from the ISP-provided /56, and another private address space based on something else called a ULA (Unique Local Addresses). You get to choose your own ULA on your home network(s), preferrably based on a good random number generator, but nothing prevents you from taking something like fc00:caca:caca:caca:caca::/48. If anybody else on the Internet picks the same network prefix you will get into trouble when trying to get intimate with each other, e.g. by establishing a VPN between both worlds. We had exactly the same problem when trying to join two sites using IPv4 NAT’d 10.0.0.0/8 subnets, so this is not really a regression. Fun fact: if you have no ULA in France you can always say “Il manque ULA sur mon réseau”.

How do you get to choose this ULA? If you happen to have a single router on your home network it should just be a matter of digging through the router IPv6 setup until you find it. But most home networks are now running multiple routers that are all unaware of each other, and all convinced they are masters of the universe. You will most certainly end up with several ULAs. Some of your devices will get several addresses and you will have to understand your own network topology to know which address to use to access them. Prepare for glorious hours of debugging, which is particularly great when facing addresses that are mostly made of bloody random bits.

Why several routers on the same home network? Simply because you may be running several DSL connections, or maybe you have a VPN started somewhere away from your edge router, or maybe you connected your smartphone and it offers another potential exit to the Internet. You also get a virtual router when you start virtual machines on a desktop.

To make things simpler, every network interface on your machines will also generate a local address that is only valid for its closest neighbours, called a link-local address. Unfortunately you won’t go far with that one as it is not supposed to cross boundaries. Think of it as a 127.0.0.1 that extends to the other side of the cable but not further.

Ok so we have now several adresses for each machine on the network.  Figuring out which one should be used (incoming or outgoing) is just an unspecified, incredible mess. The link-local address can only be used on very specific physical links, the ULA address cannot be routed to the Internet, and the public addresses you have may change at any moment, e.g.  through your smartphone sharing a 4G access.

At that point we have just determined that your printer currently identified as ‘printer’ also known as 192.168.1.20 in IPv4 will now be accessible as:

– fe80:bffa:3d5f:5f8d:b4cf:1749:b01c:5b2f for machines directly connected to it through an Ethernet cable
– fc00:c465:3b76:b34d:38f7:da19:2586:1cbd for machines living on the same internal network.
– 2001:61af:ff44:b148:4fc3:0097:f35d:c806 for machines on the internet when reached through a first ISP, and another public address for each available ISP connection.

Oh joy.

Of course normal human beings are not meant to remember this kind of random shit. For this kind of thing you have DNS.

DNS you said? What DNS?

There are really two ways machines can obtain an IPv6 address: SLAAC and DHCPv6. SLAAC means Stateless Address Auto Configuration, whereby a machine obtains a prefix and derives its own IP address from it, e.g. based on its own MAC address. Cool, right? You do not have to assign individual addresses in static DHCP leases, every machine does it on its own. But then: how do you know which address was self-assigned by your very smart printer?

There are dedicated neighbour-discovery protocols for that, but they are mainly designed to make sure that addresses are locally unique and routers know where to find them. This is only taking care of establishing a link, there is nothing dedicated to associating a name to a self-assigned IP address. And if there was, how would you know who to believe? If two machines on the local network claimed to be ‘joe’, what should happen?

To be fair, there are solutions like Bonjour, also known as zeroconf, but they are unlikely to work on lightweight or old devices. Shoot again.

Back to square one: if you want to reach your own machines using human-usable names you need to run DHCPv6, a protocol that was designed to compensate for such things. And there you go: back to static leases, addresses assigned by a router, attached to a name, and you end up doing exactly the same kind of shit you used to do with IPv4 local networks, except this time the addresses are much easier to screw up.

Even worse: if the self-assigned IPv6 addresses are not related to MAC addresses, it means every single host on your local network will have generated its own random address, forcing you to manually harvest them from all devices. But you know how to do that on your connected toaster, right?

What’s in it for the average home network user? Pretty much nothing. The fact that every single one of your home devices has a potentially reachable address on the intertubes is downright scary. Internet service is for internet servers, not for sensors and other IoT bullshit. First thing you will want to do is bullet-proof your firewall to make sure nobody but you can access your printer from the Internet, and hope things are Ok with your IoT shit.

The story did not just end up with me reading thousands of pages on the Internet and a couple of paper books. I hacked every single computer in my house to run IPv6, starting with the routers under OpenWRT, LEDE, FreeBSD, OpenBSD, pfSense, OPNSense, and later moving on to all client OS machines: OSX, Linux, Android, *BSD, and even some Windows boxes, blimey.  I instantiated dedicated DHCP and DNS servers, configured static addresses, automatic ones, bridges and NATs and firewall rules and what-have-you, and I ended up with some machines working under IPv6 only, some under IPv4 only, some that could use both stacks, and some (a lot) that were just unreachable no matter what. Yeah, I also crashed my Internet access several times. Omelet and eggs.

Let me try to put it this way: some of my home machines are servers, e.g. a NAS or a printer. I want to be able to print on ‘printer’ or mount a share on ‘NAS’ without having to remember random 128-bit numbers. Silly me. Since I want to use names I have to assign addresses myself from a router running DHCPv6. Neither NAS nor printer need to be available to the public. So what did I gain compared to a local IPv4 network? Hmm… Address management is not fun with 32 bits, imagine with 128.

Or maybe I am just old-fashioned, trying to manually assign names to my home machines. This might be an idea for a new product: a router that would automatically identify hosts on the home network and show them on a single web interface, allowing you to assign names and forget about addressing altogether. Might get in trouble when you have several identical devices but I’m sure there would be a way. If such a product exists I have not seen it yet.

On the other hand, if I want to browse the Interwebs in v6, I found out that mounting a SOCKS proxy on a remote cloud box works perfectly well. No need to configure anything, just ssh -D and the IPv6 world is mine to browse.

Summing it all up

Address assignment is not easier than IPv4. Still requires a dedicated DHCP and DNS server, only more complicated to configure. You are facing the tedious task of gathering self-assigned IPv6 addresses from all hosts and copying them onto your DHCPv6 server, hoping the self-assignment method won’t change soon.

Routing is now different, but not easier. New constraints are imposed on knowing which interface to bind to when reaching out to the Internet.

Firewalling the whole thing with a mix of IPv4 and IPv6 might tear you a new one. I can already lock myself out of a router with human-readable firewall rules, I cannot imagine doing the same thing with batshit-crazy addresses and feel safe.

You know what? I will stick to glorious NAT’ing until this mess is sorted out. Good news is that there are many bright people currently working on the topic. All I hope is they eventually come up with something that you and me can use without having to read through a million pages of RFCs, compile obscure daemons, or purchase new boxes as if I did not have enough of them.

Talking about RFCs, this one is trying to gather very sensible requirements about home networks:

https://tools.ietf.org/html/rfc7368

If you have 20 minutes to spare, you should watch this talk:
https://www.youtube.com/watch?v=wQdfWUsG4uI

If you really insist on switching your home network to IPv6, I would recommend reading this rant first:

IPv6 at home (published 2012, still relevant):
http://www.kloepfer.org/ipv6-homenet.html

And to get an idea about how messy it is to get IPv6 configured on Linux:

IPv6 Set up an IPv6 LAN with Linux
https://www.jumpingbean.co.za/blogs/mark/set-up-ipv6-lan-with-linux

In its current state I can only dismiss the current IPv6 definition for home networks as very incomplete and unworkable for non-professionals.  Let’s hope RFC 7368 will be handled by qualified, creative, and pragmatic people.

Til then, there is no place like 127.0.0.1

Written by nicolas314

Tuesday 28 February 2017 at 11:41 pm