Subject: Re: [BEHAVE] DNSsec in IPv6-only-hosts & discarding mapped AAAAs in DNS64

From: Rémi Després <[email-masked]>
Date: Thu, 07 May 2009 12:32:25 +0200

Dan Wing  -  le (m/j/a) 5/7/09 3:26 AM:
> So, this means
> 
> 1. all networks deploying a translator for IPv6-initiated scenarios 
> (Scenario 1 and Scenario 5) would have to use the well-known prefix

A.
The scenario being discussed is "connecting an IPv6 network to the IPv4
Internet", i.e. scenario (2) in Fred's draft on the Translation
Framework. (I must confess I am confused with scenarios identified by
numbers: Fred has only 4 of them.)

B.
A network deploying a translator for IPv6-initiated scenarios should
route to its NAT64s all packets whose destination start with:
- the prefix(es) chosen by the ISP for its NAT64s (an ISP-specific
prefix and/or, if a WKP different from that of mapped addresses is
standardized, this WKP )
- the mapped address prefix (or at least its 64 first bits, i.e. ::/64,
if /96 prefixes are not routed)

> 2. all existing dual-stack hosts would see these published AAAA
> record, which would require those hosts to use a translator if the 
> host OS or its application prefer IPv6 over IPv4.  What happens if 
> there isn't a translator available to that user or its performance is
> poor?

When mapped-address AAAAs start being published, dual-stack hosts are
expected to send datagrams having mapped addresses as destinations:
- in IPv4 if an IPv4 address is available at the interface
- in IPv6 otherwise (and then require a NAT64 to be provided by the ISP)

> Are there other impacts, too?

DNS64s:
-  as long as dual-stack hosts cannot be expected to act as specified
above, MUST discard mapped address records;
- after that, SHOULD forward them, at least if they are DNSsec signed.

IPv6-only applications should not artificially block mapped addresses
destinations.

Does this answer your questions?

Regards,
RD

---

From: "Dan Wing" <[email-masked]>
Date: Thu, 7 May 2009 13:15:51 -0700

> -----Original Message-----
> From: Rémi Després [mailto:[email-masked]] 
> Sent: Thursday, May 07, 2009 3:32 AM
> To: Dan Wing; Behave WG
> Subject: Re: DNSsec in IPv6-only-hosts & discarding mapped 
> AAAAs in DNS64
> 

Yes, sorry about that.

I was going with the 4 we have in the charter,
http://www.ietf.org/html.charters/behave-charter.html, and the
other two defined by Dave Thaler in the Doodle poll,
http://www.doodle.com/participation.html?pollId=9qsdgt8r6kqk6zty

Our soon-to-be-updated charter will have all 6, because at
the San Francisco meeting the clear consensus was to work on
all 6.

> prefix and/or, if a WKP different from that of mapped addresses is

Ok.

> > there isn't a translator available to that user or its 
> > performance is poor?
> 

Ok, thanks.  

So, I believe the timeframes would be aligned:  An ISP that offers
only IPv6 addresses to subscribers will need to operate a translator
to access IPv4 anyway.

> above, MUST discard mapped address records;

We would like dual-stack hosts to prefer native connectivity (rather
than translated connectivity).

> IPv6-only applications should not artificially block mapped addresses

So applications and host OSs should ignore
draft-itojun-v6ops-v4mapped-harmful, correct?

> Does this answer your questions?

Yes, thanks.  Much clearer now.

And I see how this could work now.

-d

---

From: Rémi Després <[email-masked]>
Date: Fri, 08 May 2009 07:57:58 +0200

Dan Wing  -  le (m/j/a) 5/7/09 10:15 PM:

>> DNS64s:
>> -  as long as dual-stack hosts cannot be expected to act as
>> specified above, MUST discard mapped address records;
> 
>> IPv6-only applications should not artificially block mapped
>> addresses destinations.
> 

Yes.
(Concerns of this draft don't apply in this case.)

> And I see how this could work now.

:-).

RD

---

From: "Dan Wing" <[email-masked]>
Date: Mon, 11 May 2009 19:00:47 -0700

Rémi,

I have one more question about using v4-mapped as the well-known prefix for
the 6/4 translator.  It appears, based on Iljitsh's testing last summer [1]
that when Windows Vista or MacOS Leopard are configured as IPv6-only (that is,
no IPv4 address), they won't send a v4-mapped IPv6 packet at all.  This seems
a problem for using v4-mapped as the well-known prefix of the IPv6/IPv4
translator.

[1] http://www.ietf.org/mail-archive/web/int-area/current/msg01476.html

I do wonder, however, if configuring those hosts for IPv4 just to know about
127.0.0.1 would be sufficient for their IP stacks to emit v4-mapped IPv6
addresses.  

Iljitsch, would you have time to test that idea, or would you know off-hand
the answer from previous testing you did?

-d

> From: Dan Wing [mailto:[email-masked]] 
> Sent: Thursday, May 07, 2009 1:16 PM
> To: 'Rémi Després'; 'Behave WG'
> Subject: RE: DNSsec in IPv6-only-hosts & discarding mapped 
> AAAAs in DNS64
> 
>  
> 
> specified
> addresses

---

From: Rémi Després <[email-masked]>
Date: Tue, 12 May 2009 18:06:24 +0200

> [1] http://www.ietf.org/mail-archive/web/int-area/current/msg01476.html

That's why it is proposed to DELAY the use of v4-mapped AAAAs in DNS 
servers.

It has to be delayed until what was expected before Iljitsch made his 
tests becomes a reality, namely:
R1: OSes, if they have IPv6 enabled and IPv4 disabled, send packets that 
have v4-mapped destinations in IPv6.
(This makes sense, doesn't it?).

Provisionally all IPv6-only networks should have DNS64s that, in 
addition to their synthetizing AAAAs, filter all v4-mapped RRs. Thus, 
all existing OSes work in hosts:
- of IPv4-only networks (as usual)
- of dual-stack networks (They receive A RRs  and send IPv4 packets.)
- of IPv6-only networks (Provided they use DNS64s, as they must, they 
never receive mapped addresses).

When OSes have been updated, and ONLY THEN, IPv4-only servers can have 
their addresses protected not only for IPv4-enabled clients but also for 
clients in IPv6-only networks, provided:
- these networks have NAT64s (as normally required)
- these clients use DNSes that don't discard v4-mapped RRs (either those 
of their v6-only provider or some other).

Operators of IPv6-only networks should have their DNSes stop discarding 
v4-mapped RRs ONLY WHEN they know that their hosts that may connect to 
IPv4-only servers have all been updated. Typically, operators of private 
sites would be first to do it.

Hope it clarifies.

Regards,

RD

---

From: Xuewei Wang <[email-masked]>
Date: Wed, 27 May 2009 11:21:47 +0800

hi,Dan,

If v4-mapped as the well-known prefix is not available for IPv6 only host, could we consider other well-known prefix which requires IANA allocates?

For DNSSEC we can cancel the DNS64, and make the DNS server synthesize AAAA RR using a well-known prefix for IPv4 only host, so DNSSEC can be implemented at IPv6 host.
For dual stack host in the IPv6 network, should upgrade them to make them to recognize the well-known prefix, and obtain the original IPv4 address from the synthesized IPv6 address.

Xuewei Wang
----- Original Message ----- 
From: "Dan Wing" <[email-masked]>
To: "'Rémi Després'" <[email-masked]>; "'Behave WG'" <[email-masked]>
Sent: Tuesday, May 12, 2009 10:00 AM
Subject: Re: [BEHAVE] DNSsec in IPv6-only-hosts & discarding mapped AAAAs inDNS64

Rémi,

-d

> And I see how this could work now.

_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave