Subject: RE: (ngtrans) Re: comments on draft-itojun-v6ops-v4mapped-harmful -00.txt

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Sat, 21 Sep 2002 23:40:50 +0200

=> One question below 

	if you have a node with:
	- dual stack support (kernel code supports IPv4 and IPv6)
	- RFC2553 with section 3.7 support (IPv4 mapped address)
	the node won't be able to interoperate with SIIT translator box.

	Let's say:
	- the node described above is A
	- SIIT translator is S
	- (IPv4) peer is X

	when incoming traffic from X via S reaches A, it will have IPv4
mapped
	address on source address field of IPv6 header.

=> Why are you using SIIT for this noe ??? 
I thought SIIT would be used if A was an IPv6-only
node.

Hesham

  it will get
delivered
	to userland application on A (*), and getpeername(2) will return
IPv4
	mapped address.  if the userland application try to respond to
this
	(A -> S -> X), it will try sendto(2) against IPv4 mapped
address,
	or TCP layer takes care of it.  since the destination address is
IPv4
	mapped address, RFC2553 section 3.7 kicks in, and the traffic
will
	go out of A as an IPv4 packet.

	(*) at this point, since IPv4 mapped address has dual use, I
would
	recommend rejecting the traffic to avoid abuses documented in
	draft-itojun-v6ops-v4mapped-harmful-00.txt.  if you follow this
	recommendation, A won't interoperate with S anyways.

itojun

---

From: [email-masked]
Date: Sun, 22 Sep 2002 10:51:03 +0900

>I thought SIIT would be used if A was an IPv6-only

	that's different from Erik says.

	"kernel supports both IPv4 and v6" and "the system is configured for
	dual stack operation" is different.  vendors may want to ship dual
	stack all the time (to simplify support load), and the machine could
	be put into SIIT environment (with no IPv4 address configured).

	strange thing is that, to me, SIIT requires
	- the kernel to be IPv6-only
	  (due to the conflict i outlined in the previous message)
	- the userland application to be dual stack capable
	  (to avoid protocol content translation in SIIT box)
	which looks way too weird to me.  this is why i say SIIT is similar to
	RSIP.

itojun