Subject: Re: [BEHAVE] DNSsec in IPv6-only-hosts & discarding mapped AAAAs in DNS64

From: Rémi Després <[email-masked]>
Date: Mon, 04 May 2009 19:15:45 +0200

marcelo bagnulo braun  -  le (m/j/a) 5/4/09 6:55 PM:
> Rémi Després escribió:
>> marcelo bagnulo braun  -  le (m/j/a) 5/4/09 5:23 PM:
>>> Hi Remi,
>>>
>>> I must confess, i haven't been able to read the last emails about 
>>> this tread in the ml, but, it seems you are assuming that IPv6 only 
>>> hosts will publish AAAA RR with IPv4 mapped addresses in them?
>> NO.
>> It is IPv4-only host that, in a second phase, will publish their IPv4 
>> addresses both in As and AAAAs.
> right, this is what i meant, sorry
>
>>> could you sumarize what is the exact scenario you have in mind by 
>>> doing so? (if this was already very clear in the mails in the ml, 
>>> just tell me so and i will reply once i have managed to catch up)
>> The target scenario is one where an IPv6-only client reaches an 
>> IPv4-only server (necessarily via NAT64s), and where it can validate 
>> that the AAAA it receives has been signed under the responsibility of 
>> the IPv4-only server (in its DNS server).
>>
> right, but the traget scenario assumes that the IPv4 only host has not 
> provisiones the NAT64 box.
Right. It is a legacy IPv4 server in a legacy environment.

> It just limits itself to publish the AAAA RR with the IPv4 mapped 
> addresses in it and it hopes the nat64 is available somehere else, is 
> this correct?
Yes.
The NAT64 has to be somewhere between the IPv6-only host and the IPv4 
Internet.
(Otherwise the client host should better be dual stack if it needs to 
reach IPv4-only servers.)

RD

---

From: "Dan Wing" <[email-masked]>
Date: Wed, 6 May 2009 18:26:53 -0700

> -----Original Message-----
> From: Rémi Després [mailto:[email-masked]] 
> Sent: Monday, May 04, 2009 10:16 AM
> To: marcelo bagnulo braun
> Cc: Fred Baker; Iljitsch van Beijnum; Dan Wing; Keith Moore; Behave WG
> Subject: Re: DNSsec in IPv6-only-hosts & discarding mapped 
> AAAAs in DNS64
> 

So, this means 

 1. all networks deploying a translator for IPv6-initiated scenarios 
    (Scenario 1 and Scenario 5) would have to use the well-known prefix
 2. all existing dual-stack hosts would see these published AAAA record, 
    which would require those hosts to use a translator if the
    host OS or its application prefer IPv6 over IPv4.  What happens if
    there isn't a translator available to that user or its performance 
    is poor?

Are there other impacts, too?

-d