Subject: Re: [BEHAVE] RFC 6535 on Dual-Stack Hosts Using "Bump-in-the-Host" (BIH)

From: Etienne Dublé <[email-masked]>
Date: Fri, 02 Mar 2012 18:10:23 +0100

Le 29/02/2012 19:58, [email-masked] a écrit :
> A new Request for Comments is now available in online RFC libraries.
>
>
>          RFC 6535
>
>          Title:      Dual-Stack Hosts Using "Bump-in-the-Host" (BIH)
>

Hello,
And thanks for this very interesting document.
I just noticed the following: it seems the RFC numbers are swapped in 
the following sentence (part 7.)

"
This document recommends the socket API-layer implementation
option over network layer translation, i.e., it recommends the
approach introduced in RFC 2767 over the approach of RFC 3338.
"

I would also like to point you to the following tool: 
http://sourceforge.net/projects/ipv6-care/. It uses an approach very 
similar to the RFC, with some additional features (and also things that 
should be improved with respect to the RFC). For example it can also 
handle servers.
At https://twiki.cern.ch/twiki/bin/view/EGEE/IPv6CARE you can view a 
video where mysql client and server are talking over IPv6, although none 
of them are IPv6-compliant.
I am the main developper of this tool. IPv6 CARE stands for IPv6 
Compliant Automatic Runtime Environment, it's free and open source 
(Apache license). It uses the API translation mechanism (LD_PRELOAD on 
UNIX).

FYI, I listed below the differences I noticed between the behavior of 
IPv6 CARE and the behavior described in the RFC.
If you have comments about it I would be happy to read them.
Regards
Etienne Duble

--------------

Differences IPv6 CARE / RFC:
- IPv6 CARE also addresses the case of servers (TCP, for now) i.e. when 
patching a server it ensures (at accept() time) that both IPv4 and IPv6 
clients can connect: when needed it opens an additional IPv6 socket and 
performs a select().
- For clients, the mechanism in IPv6 CARE is sometimes triggered at 
connection time, not only at name resolution time. For example if the 
client tries to connect to a dual-stack server (A and AAAA records 
available), the A record will be tried first, and if the connect() call 
fails, then the tool will also try to connect using the IPv6 address of 
the server. Since this is triggered by the connection failure, all this 
is implemented during the connect() phase.
- IPv6 CARE is more complicated. For example in the previous case the 
connect() call is replaced by a specialized algorithm, and therefore the 
trivial 'function mapper' described in the RFC cannot be applied.
- IPv6 CARE also addresses the conversion of addresses (i.e. when a 
synthetic IPv4 address is involved), from binary to text and from text 
to binary (modification of inet_ntoa, inet_aton, inet_ntop, ...)
- The 'Special Exclusion Sets' are not implemented (yet). For now the 
pool is configured at installation time with a subnet of RFC1918 addresses.
- IPv6 CARE does not handle ICMP (i.e. it keep it untouched).
- Security aspects in IPv6 CARE should be improved.

-- 
Etienne Dublé
CNRS / LIG - Drakkar and Hadas teams
+33 (0)476827276