Subject: RE: (ngtrans) The fundamental AutoIPv6 question

From: "Christian Huitema" <[email-masked]>
Date: Thu, 21 Mar 2002 12:31:49 -0800

> Christian Huitema writes:
> > the host can make up an address using 6to4 and advertise it as a
AAAA
> > record.
> 
> Wrong. The host doesn't control its own DNS entries. The administrator
> might, but the administrator isn't going to spend time at your whim.
> 
> Welcome to the real world.

Which real world are you speaking about? Windows 2000 and Windows XP
hosts automatically export their addresses to the DNS; my computer does
indeed export its IPv6 addresses that are published as AAAA records. The
servers and the administrative set-up that you use may not be able to do
that right now, but they certainly will become able to publish AAAA
records at some point in the future.

Are you saying that you would like to enable IPv6 use despite your
incapacity to update the local DNS? There are in fact many ways to do
that without actually using the DNS -- inviting a peer to a session
using SIP comes to mind. Indeed, the main impediment will not be the
impossibility to use update the DNS -- most likely, it will be the
impossibility to carry IPv6 traffic in the first place, for example
because it would be blocked at a firewall.

From an engineering point of view, it is much simpler to only attempt
IPv6 transmission if a AAAA record is present, and to stick to IPv4
transmission if only an A record is present. If you actually lived in
the real world, you would know that the last thing you want is to create
more failure modes, and more support calls.

-- Christian Huitema

---

From: Randy Bush <[email-masked]>
Date: Thu, 21 Mar 2002 14:43:25 -0600

> hosts automatically export their addresses to the DNS

the way in which win 2000 does it is the bane of many servers and is
a major source of bad dns traffic, possibly the largest single source.

randu

---

From: "D. J. Bernstein" <[email-masked]>
Date: 21 Mar 2002 22:59:09 -0000

Christian Huitema writes:
> Which real world are you speaking about? 

The one where UNIX handles a solid majority of public SMTP servers, a
solid majority of public web sites, practically the entire Domain Name
System, and, of course, Google. The one where qmail's percentage of
public SMTP servers leaped past Microsoft Exchange's percentage last
year. You know, the real world.

> Windows 2000 and Windows XP hosts automatically export their addresses
> to the DNS

Have they figured out how to actually find the _right_ DNS server,
instead of bombarding high-level servers?

Anyway, I've seen some sites setting up an _msdcs subdomain as a Windows
playground, but administrators who care about security and reliability
simply refuse these DNS updates. This is not going to change.

> my computer does
> indeed export its IPv6 addresses that are published as AAAA records.

Who cares? Who, on the global Internet, wants to contact your computer?
The big problem is making today's public servers talk to IPv6 clients;
most people running servers do not like your administrative model.

> There are in fact many ways to do that without actually using the DNS
> -- inviting a peer to a session using SIP comes to mind.

That might work, in a nightmare universe where SMTP, HTTP, DNS, etc. all
ran over SIP. In the real world, they don't.

> more failure modes

What are you talking about? An AutoIPv6 client attempts a connection to
the AutoIPv6 address after the IPv4 connection attempt says ``network
unreachable.'' If both sides support AutoIPv6 then the connection will
succeed, as if IPv4 had been available; otherwise the connection will
fail, which is what would have happened without AutoIPv6.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

---

From: JJ Behrens <[email-masked]>
Date: Thu, 21 Mar 2002 15:21:29 -0800

> most people running servers do not like your administrative model.

Dear Sir,

I humbly submit that *I* would like to contact his computer.  I.e., if all I
wanted to do was contact Google, I would just use NAT.  I wouldn't bother
setting up IPv6.  However, end-to-end connectivity is *the* reason I opt for
IPv6 rather than NAT.  

-jj

---

From: Tim Chown <[email-masked]>
Date: Fri, 22 Mar 2002 02:46:00 +0000 (GMT)

> most people running servers do not like your administrative model.

With v6, the model allows client to client where v4 often fails to work
(due to nats).  As Francis says, reachability counts. If I want to reach
v4 sites I can run dual stack (and maybe v4 nat) or use dstm/nat-pt.
I don't need google to initiate v4 communications to me.

> fail, which is what would have happened without AutoIPv6.

I'm not clear how your AutoIPv6 hosts communicate using IPv6, in the
absence of IPv4 to establish the "single host 6to4" tunnel between the
two nodes... can you explain how this would work?  Even if the v4 host
were there, i'd be worriedabout issues like having firewalls permitting
ip-in-ip tunnels and the general issue that Pekka raised of the lack of
an exit strategy (i.e. you'd have a similar problem to tunnel brokers,
where in not pestering the admin, the site will never deploy v6 "properly").

tim

---

From: "D. J. Bernstein" <[email-masked]>
Date: 22 Mar 2002 14:43:12 -0000

JJ Behrens writes:
> I humbly submit that *I* would like to contact his computer.

Really? What service is running on his computer? Isn't he deliberately
behind a firewall?

Let me rephrase. There are millions of public DNS servers, web servers, 
message transfer agents, etc. They interact with the Internet in a more
complicated way than a typical workstation. For example, they have to be
reliably _found_ by clients around the Internet.

Making servers automatically talk to IPv6 addresses is a more advanced
problem than making a typical workstation automatically talk to IPv6
addresses. Focusing on the first problem tends to solve the second for
free. Focusing on the second problem tends to skip crucial issues.

Furthermore, remember that the primary objective is to reach the magic
moment where people are just as happy setting up a site on an IPv6
address as on an IPv4 address. What's important is to have the IPv6
address talk to all the machines that the IPv4 address could have talked
to. I realize that IPv6 offers the hope of talking to even _more_
machines, but those aren't relevant to the magic moment.

---

From: "D. J. Bernstein" <[email-masked]>
Date: 22 Mar 2002 14:57:14 -0000

Tim Chown writes:
> two nodes... can you explain how this would work?

In the absence of IPv4 on either end, AutoIPv6 support is the same as
IPv6 support. The client finds an AAAA record and makes an IPv6
connection.

> i'd be worriedabout issues like having firewalls permitting
> ip-in-ip tunnels

``Other network components are upgraded to make AutoIPv6 addresses
functionally identical to the corresponding IPv4 addresses, with the
extra feature of being able to talk to other IPv6 addresses. ... An
AutoIPv6 firewall is slightly more than a firewall that can allow IPv6
packets. When it is told to allow a packet to or from an IPv4 address,
it automatically allows IPv6 packets to or from the corresponding
AutoIPv6 address, if those packets are tunneled through IPv4 to or from
the IPv4 address.''

> the lack of an exit strategy

What's wrong with the 6to4 exit strategy? After the magic moment, the
big disadvantage of IPv6 (being cut off from most of the Internet) will
be gone, while the advantages (slightly easier configuration of new
machines, for example, and slightly better network performance) will
remain. People will naturally migrate to native IPv6 at their own pace.

---

From: Pekka Savola <[email-masked]>
Date: Fri, 22 Mar 2002 18:36:17 +0200 (EET)

> AutoIPv6 address, if those packets are tunneled through IPv4 to or from

This could be called "network connectivity pixie dust" I suppose, and I 
doubt we have all that much of that either..

Anyway, as noted with ECN, e.g.:

http://gtf.org/garzik/ecn/

There are still a number of sites that do this, even though these methods 
that kill ECN have been forbidden for years, and frowned upon for a very 
very long time.

I think you're just shifting the work from DNS admins to firewall admins 
(are you a DNS admin, DJB?  do you have a firewall implementations? :-).

Even if we standardized "AutoIPv6 firewall" today, I think even in 5 years 
a significant portion of the Internet would still be using non-compliant 
devices.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: "Eugene M. Kim" <[email-masked]>
Date: Fri, 22 Mar 2002 10:31:06 -0800

> (are you a DNS admin, DJB?  do you have a firewall implementations? :-).

He wrote and maintains djbdns (http://cr.yp.to/djbdns.html).

Eugene

---

From: "D. J. Bernstein" <[email-masked]>
Date: 23 Mar 2002 07:53:22 -0000

> I think you're just shifting the work from DNS admins to firewall admins 

This is the sixth blatantly incorrect assertion that you have made about
AutoIPv6. You are making a fool of yourself.

---

From: Tim Chown <[email-masked]>
Date: Sun, 24 Mar 2002 12:46:04 +0000 (GMT)

> AutoIPv6. You are making a fool of yourself.

Dan, I think Pekka is referring to the fact that by devising an architecture
for transition whereby IPv6 connectivity is achieved by having an internet
of single host 6to4 boxes you're implicitly having IPv6-in-IPv4 (protocol 41)
tunnels opened up potentially between any hosts on the net.  Thus while
DNS admins are less "inconvenienced", firewall admins certainly are.

Using the more conventiaonal transition methods already proposed by the
group, firewalling can be done at a single point of entry to the site IPv6
network, on a native IPv6 stream rather than one tunnelled in IPv4.  Assuming, 
of course, that the point to point v6 session isn't IPsec.

There are very few (no?) commercial IPv6 firewall implementations.  Here we
use FreeBSD's ip6fw.   Would be nice if CheckPoint et al got into gear on
IPv6...

Tim

---

From: "D. J. Bernstein" <[email-masked]>
Date: 24 Mar 2002 16:13:55 -0000

Tim Chown writes:
> you're implicitly having IPv6-in-IPv4 (protocol 41)

No. An AutoIPv6 firewall works automatically. It makes each AutoIPv6
address functionally identical to the corresponding IPv4 address, plus
the extra feature of being able to talk to IPv6 addresses.

The firewall administrator, like the DNS administrator, doesn't have to
touch his configuration. His existing IPv4 setup is, through AutoIPv6,
automatically extended to a corresponding AutoIPv6 setup.