Subject: [BEHAVE] Stateless translation definition

From: Zhen Cao <[email-masked]>
Date: Tue, 8 Sep 2009 21:45:37 +0800

Hi Dave and all,

I have a concern with respect to the definition of stateful/stateless
translation. Could you help me? Thanks in advance.

The framework draft defines stateful translation as:

*A translation algorithm may be said to
"require state in a network element" or be "stateful" if the
transmission or reception of a packet creates or modifies a data
structure in the relevant network element.*

According to this definition, say, if hosts are configured with a public
IPv4 address in the host-based translation
(draft-huang-pnat-host-ipv6-02), and the used local prefix is unique, then
the translation on prefix-nat will NOT create or modify any data structure.
Can we call it stateless translation?
Thanks for your help.

Best regards,
Zhen

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 8 Sep 2009 09:18:31 -0700

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Zhen Cao
> Sent: Tuesday, September 08, 2009 6:46 AM
> To: Dave Thaler; Behave WG
> Subject: [BEHAVE] Stateless translation definition
> 
> Hi Dave and all, 
> 
> I have a concern with respect to the definition of 
> stateful/stateless translation. Could you help me? Thanks in advance. 
> 
> 	A translation algorithm may be said to
> 	structure in the relevant network element.
> 
> 
> According to this definition, say, if hosts are configured 
> with a public IPv4 address in the host-based translation 
> (draft-huang-pnat-host-ipv6-02), and the used local prefix is 
> unique, then the translation on prefix-nat will NOT create or 
> modify any data structure. Can we call it stateless translation? 

Yes, that would be stateless translation on the network-based 
NAT device.

However, there is stateful translation in the host device:  
specifically, a DNS query creates state inside of the host's
stack (that state maps IPv4 to IPv6).

So the system, as a whole, is not stateless or stateful.  It
is both.

-d

---

From: Zhen Cao <[email-masked]>
Date: Thu, 10 Sep 2009 09:04:08 +0800

> stack (that state maps IPv4 to IPv6).

Since the WKP is unique, this actually does not create a 'state', it
just append the ipv4 address to the well known prefix.

---

From: "Dan Wing" <[email-masked]>
Date: Wed, 9 Sep 2009 18:31:09 -0700

> From: Zhen Cao [mailto:[email-masked]] 
> Sent: Wednesday, September 09, 2009 6:04 PM
> To: Dan Wing
> Cc: Behave WG
> Subject: Re: [BEHAVE] Stateless translation definition
> 

There isn't enough IPv4 address space to map the entire IPv6
address space, so there is state and old mappings need to be
destroyed.

For example, if an IPv4 application looks up host1.example.net,
the underlying Bump-in-the-Stack/-API of draft-huang-pnat-host-ipv6
will take that IPv4 application's API calls and do an AAAA
query over the air, which returns in AAAA response.  The 
Bump-in-the-Stack/-API will create a mapping from that AAAA
address to an IPv4 address, and provide that IPv4 address 
to the application.  When the IPv4 application looks up
host2.example.net, the same thing occurs, consuming another
IPv4 address in that mapping table inside the host.  This
continues until the IPv4 application has exhausted all of
the IPv4 mapping entries in the host, or until old entries
start being destroyed.

That is, at least, my understanding of the mapping and
NATting that is occuring in the host's stack.  If it works 
some other way, please explain it.  

-d

---

From: Zhen Cao <[email-masked]>
Date: Thu, 10 Sep 2009 18:04:58 +0800

> the IPv4 mapping entries in the host, or until old entries

Thanks for the detailed explanation of the above pnat 46 communication
scenario. For pnat 44 communication, DNS responds with A records, we
believe it is stateless.

---

From: "Dan Wing" <[email-masked]>
Date: Thu, 10 Sep 2009 11:39:18 -0700

> Sent: Thursday, September 10, 2009 3:05 AM
> To: Dan Wing
> Cc: Behave WG

Sorry I misunderstood; I thought you were discussing PNAT46.

Looking at the diagram in
http://tools.ietf.org/html/draft-huang-pnat-host-ipv6-01#section-2 and reading
the PNAT44COM definition in that section, the conclusion I reach is that it
can be done statelessly if both of these are true:

 1. each IPv6 host consumes one IPv4 address in the PNAT64 device; 
    this allows a stateless, algorithmic mapping on the PNAT64 device
    similar to what is described in the IVI drafts and in
    http://tools.ietf.org/html/draft-ietf-behave-address-format-00#section-2.3

and
 2. there are only routable, non-overlapping IPv4 addresses on 
    the IPv4 site.

But if either of those are false, there needs to be per-flow state somewhere.

-d

---

From: Christian Huitema <[email-masked]>
Date: Wed, 16 Sep 2009 05:08:18 +0000

> But if either of those are false, there needs to be per-flow state

I think the "stateless translation" can have two definitions. The least restrictive one is what Dan just described: when it is possible to allocate an IPv4 address to the IPv6 host. The domain of application is very limited, because there are not enough 32 bits IPv4 addresses to map every 128 bit IPv6 address. I can see one application: when we want an IPv6 host to be visible, for example as a web server, by IPv4 hosts.

The more restrictive is an operational definition. A translation is stateless if two different translators, presented with the same packets, would perform exactly the same translation. This is even more restrictive, because it requires that every NAT can interpret the IPv6 source and destination address and translate them to the same pair of IPv4 addresses.

By the way, even the least restrictive definition implies that stateless translation is very much a specialty product, and cannot be used as a general solution for providing IPv6 networks with connectivity to the IPv4 Internet.

-- Christian Huitema

---

From: Rémi Després <[email-masked]>
Date: Thu, 24 Sep 2009 15:45:04 +0200

Zhen,

It may be late to offer one more view on the subject, but I hope it  
clarifies it.

In the context of address translations, my understanding of stateless  
vs stateful is:
- Address Translation is STATELESS if it is 1 to 1.
- Address Translation is STATEFUL if it is NOT 1 to 1:
   . It may differ from one transport connection to another.
   . Port states have to be maintained in addition to address states  
(and in combinations with them).

Whether translation is in a router or in a host doesn't influence  
this definition.

Regards,
RD

Le 8 sept. 09 à 15:45, Zhen Cao a écrit :

> I have a concern with respect to the definition of stateful/ 
> stateless translation. Could you help me? Thanks in advance.
>
> According to this definition, say, if hosts are configured with a  
> public IPv4 address in the host-based translation (draft-huang-pnat- 
> host-ipv6-02), and the used local prefix is unique, then the  
> translation on prefix-nat will NOT create or modify any data  
> structure. Can we call it stateless translation?
>
> Thanks for your help.
>
> Best regards,
> Zhen
> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/behave

---

From: Zhen Cao <[email-masked]>
Date: Sat, 26 Sep 2009 13:53:41 +0800

> It may be late to offer one more view on the subject, but I hope it

Thanks for sharing your opinion.
>
> In the context of address translations, my understanding of stateless vs
> stateful is:
>  . Port states have to be maintained in addition to address states (and in
> combinations with them).

It seems a straightforward understanding. I am afraid of some stateful
translation also has an 1:1 mapping table. From example, each
LIR:PrivateV4Addr maps to a different public IPv6 address.

>
> Whether translation is in a router or in a host doesn't influence this
> definition.
>
> Regards,
> RD
>
>
>
>
>
>
>
>> IPv4 address in the host-based translation (draft-huang-pnat-host-ipv6-02),
>> and the used local prefix is unique, then the translation on prefix-nat will
>> NOT create or modify any data structure. Can we call it stateless
>> translation?
>>
>> Thanks for your help.
>>
>> Best regards,
>> Zhen

---

From: Zhen Cao <[email-masked]>
Date: Sat, 26 Sep 2009 13:55:33 +0800

On Sat, Sep 26, 2009 at 1:53 PM, Zhen Cao <[email-masked]> wrote:
> LIR:PrivateV4Addr maps to a different public IPv4 address.

sorry for the typo above, i meant "each LIR:PrivateV4Addr maps to a
different public IPv4 address"

---

From: Zhen Cao <[email-masked]>
Date: Sat, 26 Sep 2009 14:00:47 +0800

> The more restrictive is an operational definition. A translation is stateless if two different translators, presented with the same packets, would perform exactly the same translation. This is even…

Sounds interesting. Do you see any solution achieving this kind of
stateless translation?

> By the way, even the least restrictive definition implies that stateless translation is very much a specialty product, and cannot be used as a general solution for providing IPv6 networks with conn…

I agree.