Subject: Re: (ngtrans) draft-hallin-natpt-dns-alg-solutions-01.txt

From: Pekka Savola <[email-masked]>
Date: Sat, 7 Sep 2002 22:41:49 +0300 (EEST)

On Tue, 30 Jul 2002 [email-masked] wrote:
> Hello,
> 
> a new version of draft-hallin-natpt-dns-alg-solutions-01 is now available in the I-D directories.

A few comments.

2.1 AAAA answers for A queries

   This problem arises due to stateless nature of DNS ALG.  If DNS-ALG
   had kept information about the (A) query, then incoming (A) reply  
   could be mapped to that query using previously stored information.  A
   DNS query contains {queryid, type}, which could be matched against   
   {replyid, type} in the DNS response.  Additionally, the tuple
   {srcaddr, dstaddr, sport, dport, proto} will be used for integrity
   check.

==> the tuple should not be used as this will break e.g. v6-anycast DNS.  
I'm not 100% sure of the formal standardization status though.

   Figure 4: Case two, the destination host is IPv4-only

   ---------------------------------------------------------------------
   => This solution ensures that communication between nodes within the
   NAT-PT domain always use native IPv6 communication when possible.
   The price is added DNS latency.

==> in addition to DNS latency, there is some short-lived state for the
DNS request.  But the lifetime is so short this may not be all that 
relevant.

2.3 NAT-PT & IPv6 default router
[...]
   An alternate approach is that IPv6-only nodes will define a DNS
   search list, where the IPv6 DNS server, reachable locally, is defined
   first, and NAT-PT_PREFIX:ipv4_dns appears next in that order.  IPv6- 
   only nodes that want to resolve AAAA (IPv6) names do not have to send
   DNS queries through NAT-PT.

   ---------------------------------------------------------------------
   => It is not necessary for the NAT-PT to be the only default router 
   in the IPv6 domain.  The only traffic that has to go through the NAT-
   PT is the one that needs to be translated.

==> there seems to be some horrible misunderstanding about how DNS queries
work, or I missed something crucial in the text above.  I believe (at
least in the case that the DNS servers are accept recursion which is by
far the most common setup), no DNS traffic would ever go to
NAT-PT_PREFIX::ipv4_dns except when the IPv6 DNS server is down.

3.1 Reverse queries from IPv6 to IPv4

   support.  For example, some applications uses reverse queries to

==> s/uses/use/

3.3 DSTM cannot work with NAT-PT DNS-ALG

   [INTERACTION] points out that DSTM mechanism will never be triggered 
   and used, because a host within the IPv6 domain will never receive a
   DNS response that contains an "A" record.

   Section 2.1 presents the same problem.  Clearly, the proposed
   solution will enable DSTM to work with NAT-PT DNS-ALG.

==> there's something horribly, horribly wrong in the network setup if you 
want to mix NAT-PT and DSTM, I think.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Suresh K Satapati <[email-masked]>
Date: Mon, 9 Sep 2002 14:22:45 -0700 (PDT)

Pekka,

Thanks for the comments..

> I'm not 100% sure of the formal standardization status though.

"IPv6 Stateless DNS Discovery" <draft-ietf-ipv6-dns-discovery-04.txt>
does reference to "anycast" mechanism and says this needs further study.
So i have my own doubts about this.

>    Figure 4: Case two, the destination host is IPv4-only

Agreed.

>    DNS queries through NAT-PT.

you did not missing anything. thanks for pointing it out.

> want to mix NAT-PT and DSTM, I think.

intention is not to mix NAT-PT and DSTM. It is merely saying that the problem
(pointed out by INTERACTION) will not arise using this variant of DNS-ALG. Maybe
some re-wording is needed.

-Suresh