Subject: Re: 6to4 relays [Re: WG Review: IPv6 Operations (v6ops)]

From: "Fred L. Templin" <[email-masked]>
Date: Fri, 13 Sep 2002 14:18:21 -0700

> I use 6to4 on hosts every day, so I don't consider it hammering.
> 
> But 6to4 was primariliy intended for routers.  That it happens
> to work on some hosts is a happy side-benefit, not the design goal.
> 
> Keith

If you want to run 6to4 on a host that happens to have a global IPv4 address
and can accept 'ip-proto-41' w/o creating a security risk, then that is fine.
But (and you seem to recognize this), if one wants to postulate a "generalized
host-based 6to4" mechanism, that is a different matter and one that is not
covered by any existing RFCs.

To realize a "generalized host-based 6to4", one would need to incorporate the
NAT traversal mechanisms first pioneered by TEREDO and the two-stage (end-to-edge;
edge-to-internet) tunneling mechanism first pioneered by ISATAP. But, then this
becomes more than just vanilla 6to4 and represents a unified transition mechanism
that incorporates elements proven by earlier works in various degrees. Finally,
a truly generalized mechanism would work behind a corporate firewall w/o requiring
any per-host firewall filter configurations and w/o exposing the site to outside
attackers. It's not clear to me whether a solution for this exists - but, it
would be pretty interesting if one could be identified!

Fred
[email-masked]

---

From: Keith Moore <[email-masked]>
Date: Fri, 13 Sep 2002 17:54:28 -0400

> edge-to-internet) tunneling mechanism first pioneered by ISATAP. 

No, that's not "generalized host-based 6to4", that's "6to4 trying to accomodate
NAT brain-damage".  A solution which works well (okay, as well as possible) in 
the presence of NATs will be very sub-optimal between hosts whose communications
is not hampered by NAT.  Which is why something like 6to4 and something like 
Teredo are both needed. 

Keith

---

From: David Terrell <[email-masked]>
Date: Fri, 13 Sep 2002 16:24:52 -0700

On Fri, Sep 13, 2002 at 05:54:28PM -0400, Keith Moore wrote:
>>To realize a "generalized host-based 6to4", one would need to
>>incorporate the NAT traversal mechanisms first pioneered by TEREDO
>>and the two-stage (end-to-edge; edge-to-internet) tunneling mechanism
>>first pioneered by ISATAP.
>
>No, that's not "generalized host-based 6to4", that's "6to4 trying
>to accomodate NAT brain-damage".  A solution which works well (okay,
>as well as possible) in the presence of NATs will be very sub-optimal
>between hosts whose communications is not hampered by NAT.  Which
>is why something like 6to4 and something like Teredo are both needed.

to diverge slightly on this topic, it would be kind of nice if 6to4
could turn into a more general transition mechanism for non-NAT
servers; i.e. if many 6to4 aware machines could implicitly bind to
2002:ipv4::something[*], v6only servers could try to connect to
that as an alternative to something like the site-local faith --
that could of course be a fallback for things that don't understand
this mechanism ("implicit host-based 6to4").

I was hoping to zip out a draft on this behavior before the deadline
but obviously I didn't make it.

* - Someone mentioned that Win XP is listening on 2002:ipv4::ipv4?

-- 
David Terrell             | "War is peace, 
Prime Minister, Nebcorp   | freedom is slavery, 
[email-masked]              | ignorance is strength 
http://wwn.nebcorp.com/   | Dishes are clean." - Chris Fester

---

From: Keith Moore <[email-masked]>
Date: Fri, 13 Sep 2002 19:26:31 -0400

> if many 6to4 aware machines could implicitly bind to

unfortunately that constrains how sites organize their networks,
which doesn't seem desirable.

Keith

---

From: David Terrell <[email-masked]>
Date: Fri, 13 Sep 2002 16:30:06 -0700

> which doesn't seem desirable.

This would only be a potential method for IPv6-only sites to connect
to a remote end for which you only have an IPv4 address -- if you
don't want it, include an AAAA record.

-- 
David Terrell            | "Consumerism is neat."
[email-masked]             |         - Brian Swetland
http://wwn.nebcorp.com/  |

---

From: Keith Moore <[email-masked]>
Date: Fri, 13 Sep 2002 19:34:36 -0400

> don't want it, include an AAAA record.

okay, why is it better to impose such assumptions on hosts and nets
(not to mention firewalls) "by default" (i.e. in the absence of an 
AAAA record) than to require them to declare their willingness to 
accept such traffic (by advertising an AAAA record)?

Keith

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 15 Sep 2002 10:02:14 +0200

> would be pretty interesting if one could be identified!

If you are really stuck behind a NAT you have no choice but to try some 
Teredo-like trick, and one Teredo in the world is enough. But trying to 
support enterprise scenarios where neither the ISP, nor the corporate IS 
people, are willing to support IPv6, *and* there is a NAT in the way, is 
just not worth considering IMHO. Too complicated, too many failure modes.

   Brian