Subject: Re: (ngtrans) I-D ACTION:draft-ietf-ngtrans-6to4-03.txt

From: Pyda Srisuresh <[email-masked]>
Date: Sun, 17 Oct 1999 10:02:34 -0700 (PDT)

--- Keith Moore <[email-masked]> wrote:
> 
> > Just as an aside: I don't know of anybody that thinks NAT-PT will be used
> > when two IPv6 nodes communicate. The intent is to use it only when
> IPv6-only
> > and IPv4-only nodes communicate.
> 
> yes, that's the intent.  my concern is about an unintended consequence.
> 

Keith - What unintended consequences are you concerned about? 
        Are these things beyond the known limitations of a V4 NAT?

> > Thus NAT-PT will only be a dead-end is only subsets of the sites
> > move to IPv6.
> 
> I disagree.  
> 
> It's really difficult to imagine that all ISPs will uniformly move to
> v6 within 2-4 years' time; the bulk of the information that I've received
> says that fast routers either don't support v6 or that their v6 code isn't
> up to production quality, and the router vendors can barely keep their
> v4 codebase up.  So I have to assume that for several years the core
> of the net will be IPv4 only, and that v6 is only supported at the
> periphery and by a few emerging nets that really need v6 capability.
> Lots of folks that are using v6 will thus be using 6to4 and NAT-PT.
> 
> If there is a native or 6to4 path between two hosts, applications
> will work fine, but if two v6 nodes attempt to communicate across 
> NAT-PTs, they end up with a NATted network. applications written
> assuming a non NATted network will fail.  

Keith - This is valid concern. But, not true. 

You raised the same issue during the IESG review of NAT-PT draft as well. 
I just sent you an e-mail why this will not be the case. We can certainly
pursue the discussion some more on the NAT-PT thread. I am  also posting 
this to the mailing list to thwart any concerns others also might have.

In the V6 domain, NAT-PT will translate only the packets with source or
destination address  using the advertised PREFIX. Native-to-Native V6 
packets do not meet this criteria and hence will not be processed by 
the NAT-PT function. The policy on the NAT-PT device may opt using some 
form of tunneling techniwue to route such packets over V4. That is outside 
the scope of NAT-PT document. NAT-PT refers only to the communication 
between V4 and V6 nodes.
  
Applications written assuming non NATted network (i.e., Nativev6-to-nativev6
only communication) will not fail with NAT-PT enroute because NAT-PT will 
not process thise packets. Applications that do not mandate nativeV6 peers 
could work with legacy V4 nodes with NAT-PT enroute.

regards,
suresh  

=====

__________________________________________________
Do You Yahoo!?
Bid and sell for free at http://auctions.yahoo.com

---

From: Keith Moore <[email-masked]>
Date: Sun, 17 Oct 1999 16:47:07 -0400

Suresh,

the case I'm concerned about is where there is no native v6 path between
two v6-capable nodes, but there is a pseudo-v6 path through back-to-back
NAT-PT boxes.  each end node thinks it's talking to a v6 peer.
each NAT-PT box thinks it's talking to a remote v4 host, but in reality 
both hosts are v6.  

e.g.

Host A ==== NAT-PT X --------- NAT-PT Y ==== Host B

==== v6 path
---- v4 path

Host A thinks it has a v6 connection to Host B, but the v6 address
that A uses to refer to B is not one of B's addresses. Similarly, 
Host B thinks it has a v6 connection to Host A, but the v6 addresses
that B uses to refer to A is not one of A's addresses.
NAT-PT X thinks that Host B is a v4 host.
NAT-PT Y thinks that Host A is a v4 host.

the point being, both A and B think they have a *real* v6 connection,
but the connection doesn't have the characteristics that a v6 
conneciton ought to have.

here's a worked out example, assuming that A initiates a connection to B:

1. A queries B's name in DNS, looking for AAAA or A6 records.

2. A's query first gets intercepted by NAT-PT X, which treats this as 
an attempt to set up an "outgoing" connection per 4.2 of natpt-06. 
so it forwards the query via IPv4 to the DNS server for B, and waits 
for the response so it can be modified.
(note: it's not clear from 4.2 what NAT-PT X should do to the
query before forwarding, but presumably it will have to change the 
query type on outgoing requests to "A"; otherwise it will not get
useful responses from older DNS servers.  Either that or it will
have to wait for the initial response to "AAAA" or "A6" queries 
and if the response contains no information, retransmit the request 
with query type set to "A"...which adds delay.  I'm assuming
that the query type gets translated to "A")

3. The forwarded request then gets intercepted by NAT-PT Y, which
treats this as an attempt to set up an "incoming" connection per
4.1 of natpt-06.  So it allocates a v4 address and associates it
with B's v6 address, and returns an answer A=<v4-addr-assigned-to-B> 

4. NAT-PT X gets the response back from NAT-PT Y, and modifies
it so that the response looks like AAAA=PREFIX-X::<v4-addr-assigned-to-B>

meanwhile A's address has been translated to <v4-addr-assigned-to-A>  
between X and Y and to PREFIX-Y:<v4-addr-assigned-to-A> on B's side of Y.

Am I wrong in assuming that X translates the query type to A in 
outgoing queries?
If so, then how does X deal with the case where the remote DNS server
returns AAAA or A6 records (which are not reachable)?  How does X deal 
with the case where the remote DNS server returns "no records matching 
this query" (either because it has only A records, or because it
does not support AAAA or A6 query types)?

Keith