Subject: (ngtrans) NAT-PT -05 INput

From: Jim Bound <[email-masked]>
Date: Wed, 31 Mar 1999 12:27:17 -0500

Bob, Tony, Alain, George, and Suresh,

First I think we need to resolve the issues of SIIT as you reference
that spec but I have some issues I will state below.

1.  You state NAT-PT supports end-to-end.  That is simply not the case
or you need to define end-to-end in terms of NAT.  This I believe could
be misleading to the market to see the word end-to-end.  Also I think
the way to state this is end-2-end in the nomenclature.
See: draft-carpenter-transparency-00.txt as I too define e2e and NAT-PT
is far from transparent.  Also text I sent on deployment list as to what
constitutes e2e IMO.  

2.  The spec needs a lot of editing.  It appears the use of "articles"
is missing in many sentences "a", "an", "the".  But this is editing.

3.  Under: 3.1 NAT-PT Outgoing Sessions (IPv6 to IPv4)

      If the outgoing packet is not a session initialisation packet, the
     NAT-PT  SHOULD  already  have  stored some state about the related
     session, including assigned IPv4 address and cached parameters for
      the  translation.   If this state does not exist the packet SHOULD
     be silently discarded.

What if it is a UDP session?  Something should be stated if its not a
TCP SYN start.

4.  Use of PREFIX::1.2.3.4 on incoming and outgoing sessions.  

You don't ever state how this PREFIX is assigned to an IPv6 node on the
V6 domain behind the NAT-PT.  But more importantly how it may be routed
on the V6 Network?  How the PREFIX plays in the topology.

FRom section 3.2:    

      Say the IPv6 Host A wanted to set up a TCP session with  the  IPv4
     Host  C.

      Host A creates a packet with:

      Source Address, SA=FEDC:BA98::7654:3210 , source TCP port  =  3017
     and Destination Address, DA = PREFIX::132.146.243.30,  destination
     TCP port = 23.

How did Host A "know" the PREFIX for the DA?

5.  Under section 4 IPv4 Address Assignment

4.1 V4 Address assignment for outgoing connections

      Outbound session start is based on identifying the first packet of
     a session. For ex: SYN, !ACK for TCP sessions.

Please reference UDP too or some example?

      V6 hosts learn the address of V4 hosts from the DNS server in  the
     V4  domain or the DNS server internal to the V6 network. We recom-
     mend that DNS servers internal to V6 maintain mapping of names  to
     IP  V6  addresses  for  internal  hosts and possibly some external
     hosts.  External DNS servers in the V4 domain maintain  name  map-
     ping for external hosts (i.e., V4 hosts) alone.

Why is this different than what DNS already does?  I don't see why your
saying this text in the spec and your recommendation is the norm?  It
appears you are stating the obvious?  So I am missing something in the
text above can you tell us why you say this above?

      4.2.1 DNS Application Layer Gateway (ALG) support

         In figure 2 above, when Host C name resolver makes a name  look
        up  request  for  Host A, the lookup query is redirected to the
        DNS server on the V6 network. Considering that NAT-PT is resid-
        ing   on the border router between V4 and V6 networks, this re-
        quest datagram would traverse through the  NAT-PT  router.  The
        DNS  ALG on NAT-PT  would modify  the DNS Queries going into V6
         domain as follows:

Do you want to ref DNS-ALG?  Also in the first sentenced I think you
want to say "directed" not redirected because this is what DNS does as
the norm.  NAT-PT is intercepting all DNS queries, but what else?  This
is why I ask if you want to reference another spec that supports an IPv6
DNS-ALG example?   The one for NAT now only supports IPv4 in the NAT WG
maybe we need one for IPv6 too, so this WG can parse that as DNS for
NAT-PT is a pretty big part and will affect users normal DNS processing
and all the configuration possible with Firewalls etc.

            a) For Host Name to Host Address Query requests:
               Change the Query type from "A" to "AAAA".
            b) For Host address to Host name query requests:
               Replace the V4 address octets (in reverse   order)   pre-
              ceding  the string "IN-ADDR.ARPA"  with the corresponding
              V6 address (if there exists a map) octets in reverse  or-
              der.

IN-ADDR.ARPA should say ip6.int above.

Also I think you need to address A6 and the binary labels for the
reverse records.  This will complicate and increase the DNS packet 
intercepting at the NAT-PT and should be discussed later as a "pain" to 
using this mechanism or appropriate wording.  

         In the opposite direction, when DNS response traverse from  the
        DNS  server  on  V6 network to V4 host, the DNS-ALG once  again
        traps the DNS packet and would:

            a)  Translate  DNS  responses  for  "AAAA"  records into 'A'
           records,
            b) Replace the V6 address sent by the V6 DNS server with the
           V4 address internally assigned by the NAT-PT router.

Here A6 type records may be requested multiple times by a client v6
resolver as it tries to find the top level DNAME zone.  This complicates
the query at the NAT-PT and could imply state for the DNS processing
within the NAT-PT for processing.  Also if IPv4 comes back the V6 node
now must deal with that in the V6 resolver code and this should be
discussed in this spec or in an updated DNS-ALG NAT spec.

         If a V4 address is not previously assigned  to  this  V6  host,
        NAT-PT would assign it this time. The TTL values on all DNS re-
        source records (RRs) passing through NAT-PT would be set to  0.

Is the NAT-PT dynamically updating the DNS or just keeping state in the
NAT-PT.  If using dynamic updates then this is scary because NAT-PT
cannot support DNSSEC and this problem should be stated in the spec if
dynamic updates to DNS MUST be supported without security.  I gave you
folks this input on the existing DNS-ALG for IPv4 privately as input too
last week.  

         This  technique  is  also  useful for outgoing communication as
        well. We saw that a v6host that needs to communicate with  a v4
        hosts needs to use a specific prefix (PREFIX::) in front of the
        IPv4 address of the v4host. The above technique allows the  use
        of this prefix without any configuration in the hosts. E.g.: In
        Figure 2, Host-A makes a name look-up on the  Host-C.  The  DNS
        query  goes  to  the v6 DNS server and from there to the v4 DNS
        server outside the v6 stub domain after it has been  translated
        by  the  NAT-PT.  The  reply follows the same route but now the
        NAT-PT translates the reply adding the appropriate prefix.  So,
        if the reply is:

            HostC    A     132.146.243.30, it is translated to
            HostC   AAAA   PREFIX::132.146.243.30

Again how does a user determine the PREFIX to configure?  Some examples
and discussion is needed IMO.  

And if it is an A6 RECORD what is the affect as they are distributed
unlike AAAA records.  You folks need to address A6 Records.

You should state that the PREFIX will not be an IPv4 Mapped or IPv4
Compatible Address too.

6.  In section 5.4 FTP ALG

You need to address the EPRT and EPASV commands being replaced in IPv6
FTP with prt and passv as they are different.

thanks
/jim