Subject: RE: (ngtrans) Re: comments on draft-itojun-v6ops-v4mapped-harmful-00.txt

From: "Christian Huitema" <[email-masked]>
Date: Sat, 21 Sep 2002 20:35:47 -0700

>>I believe we have a general consensus in v6ops that prefixes are cheap
>>while confusion is costly. It seems that we should simply allocate a
>>different default prefix than ::FFFF:0:0/96 for the SIIT function.
>>Something like 0:0:0:FFFF::/96, for example. This is a very simple
>>update to SIIT, and it rids us of the confusion between the API spec,
>>which is widely implemented, and SIIT, which is not.
>
>        one of the point i was making (while it may not have been delivered
>        well, sorry) is that we cannot make SIIT to use different prefix.
>        SIIT is taking advantage of dual use of IPv4 mapped address.

It is very possible that the current SIIT spec requires that, but it is certainly not necessary. There is a part of the SIIT design that seems predicated on the idea of a perfectly stateless translation device, and I believe that this leads to a few unrealistic assumptions. In practice, nodes with V6 only connectivity will send packets to a "translated address" of the form <translator prefix>:<IPv4 address>. The translator is very likely to behave exactly like current NAT do, including functions such as port mapping that are not present in the specification; it implies that the translator will have to maintain a modicum of "per association" state.
 
What all this means is, we probably need to rewrite some parts of the SIIT specification. In fact, we probably need to write a single document that supercedes both SIIT and NAT-PT.

>        for instance, an SIIT-compatible IPv6 node in SIIT cloud will issue
>        PORT/PASV request by seeing IPv4 mapped address on getpeername(2),
>        and therefore, SIIT box doesn't need to translate the content of the
>        packet.
 
I don't think this kind of behavior is realistic if the translation device has to perform port mapping. It is more likely that we will use some FTP ALG in the translation device.
 
-- Christian Huitema

---

From: Senthil Sivakumar <[email-masked]>
Date: Sat, 21 Sep 2002 23:34:55 -0700 (PDT)

> What all this means is, we probably need to rewrite some parts of the SIIT specification. In fact, we probably need to write a single document that supercedes both SIIT and NAT-PT.

I agree, combining these two documents and removing the confusing parts
would be good.

Senthil

---

From: [email-masked]
Date: Sun, 22 Sep 2002 22:55:10 +0900

>I don't think this kind of behavior is realistic if the translation
>device has to perform port mapping. It is more likely that we will
>use some FTP ALG in the translation device.

	read the SIIT spec again, the whole point of SIIT was that SIIT box
	does not alter the content of the packet.  SIIT device does not
	perform port mapping, nor any kind of packet content rewrites.

itojun