Subject: Re: SIIT/NAT64 is similar to RSIP

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Tue, 17 Sep 2002 16:01:37 +0900

>But it has serious advantages over NAT-PT.
>It scales much better and does not break DNSsec.

	i do not really think it a major advantage.
	if you can use "AD is secure" proposal and let NAT-PT box to validate
	DNSsec signature, we can get the same effect with NAT-PT.

	one big disadbantage: abuses IPv4 mapped address.

itojun

---

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Tue, 17 Sep 2002 16:41:24 +0900

>Using "AD is secure" add extra complexity.

	then why is "AD is secure" proposed?  it is to avoid implementing
	complex crypto operations in every resolver implementation.

>Another big issue with NAT-PT: you can not use it
>to enable an Ipv6-only resolver to query data from
>an Ipv4 only DNS server... (in the general issue to make
>DNS interoperate smoothly between IPv4 & IPv6 only worlds)

	as long as DNS-ALG is IPv4/v6 dual stack, it should be okay.

>Also, as i explain earlier, NAT64 scales better.

	with NAT-PT you can do the same, with multiple DNS-ALG returning
	different address prefixes. (it is documented in TRT RFC)

>you still haven't convince me about the severity of those problems.
>I think I made clear today that those issues can be addressed.

	i disagree, this is not just a firewall issue.  it affects end nodes
	and applications.  and it is impractical to ask every applications to
	implement IN6_IS_ADDR_V4MAPPED() goofs.

itojun

---

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Tue, 17 Sep 2002 17:02:20 +0900

NAT64 is still not in v6ops charter, btw.  we should go back to ngtrans.

>	different address prefixes. (it is documented in TRT RFC)

	or single DNS-ALG returning different addreess prefix at random/round
	robin.

itojun

---

From: Alain Durand <[email-masked]>
Date: Tue, 17 Sep 2002 00:30:16 -0700

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

On Tuesday, September 17, 2002, at 12:01 AM, Jun-ichiro itojun Hagino 

	- Alain.