Date: 29 Jun 2026 19:29:25 -0400
Message-ID: <97734010-8f35-c22b-745a-593b68decf00@taugh.com>
From: "John R Levine" <johnl@taugh.com>
To: "Brian E Carpenter" <brian.e.carpenter@gmail.com>,
  "jordi.palet@consulintel.es" <jordi.palet@consulintel.es>
In-Reply-To: <6c9cb3b6-d418-4b3f-81d4-fac388f30d2f@gmail.com>
References: 
 <178267270866.1927117.9396396869229471234@dt-datatracker-f9b87776f-xzl65>
 <08A9B518-F5AF-4BCB-8D65-4D1844DBD00A@consulintel.es>
 <6c9cb3b6-d418-4b3f-81d4-fac388f30d2f@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8BIT
Message-ID-Hash: HJ35ALSVBMHWN36IVYOB3TUSDD5573OR
CC: art@ietf.org, draft-ietf-v6ops-rfc6146-bis.all@ietf.org,
 last-call@ietf.org, v6ops@ietf.org
Precedence: list
Subject: =?utf-8?q?=5Bart=5D_Re=3A_=5Bv6ops=5D_Re=3A_draft-ietf-v6ops-rfc6146-bis-07_?=
 =?utf-8?q?ietf_last_call_Artart_review?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/art/8r5Syu20wzJ2vLzVjSrvjZPuERg>

On Tue, 30 Jun 2026, Brian E Carpenter wrote:
>> Regarding the inclusion of DNS64/DNSSEC in the security section, I’m not 
>> convinced this is good, as it is a DNS64 issue and in some situations NAT64 
>> can be used without DNS64 (with a penalty in overall performance, extra 
>> delays, etc.). That said, I’m happy to include a “conditional” paragraph 
>> referring to that if you agree, something in the line of “Note that if 
>> DNS64 is used in some cases DNSSEC validation may fail. This is not a NAT64 
>> issues, but a DNS64 one and it is discussed in RFC6147 section ….”.
>
> Or just say "If DNS64 is used, also see the Security Considerations of 
> [RFC6147]."

That would be OK but I would prefer to at least give a hint that the 
problem is with DNSSEC.

R's,
John

>>> El 28 jun 2026, a las 20:51, John Levine via Datatracker 
>>> <noreply@ietf.org> escribió:
>>> 
>>> Document: draft-ietf-v6ops-rfc6146-bis
>>> Title: Stateful NAT64: Network Address and Protocol Translation from IPv6 
>>> Clients to IPv4 Servers
>>> Reviewer: John Levine
>>> Review result: Ready with Issues
>>> 
>>> ARTART last call review of draft-ietf-v6ops-rfc6146-bis
>>> 
>>> Reviewer: John Levine
>>> 
>>> Overall: Ready with Issues
>>> 
>>> Figure 1 is scrambled. It looks like it was intended to be two large
>>> boxes representing IPv6 and IPv4 networks connected by smaller boxes
>>> for DNS64 and NAT64. But the right edge of the IPv6 box runs through
>>> the middle of the small boxes. There is a vertical line under the k in
>>> "IPv6 network" that might have been intended to be the right edge of
>>> the IPv6 box but isn't. This figure is unchanged from RFC 6146 where
>>> it was equally scrambled, which makes me wonder when was the last time
>>> somone really looked at it.
>>> 
>>> Both this figure and Figure 2, which appears correct but is complex
>>> and confusing, could benefit from being redrawn as real figures using
>>> SVG tools.
>>> 
>>> The security considerations should say something about DNS64 and
>>> DNSSEC, since the synthesized AAAA records are not and cannot be
>>> signed. There are workarounds but none of them are great. RFC 6147
>>> Section 3 discusses this issue so it could refer there.
>>> 
>>> I have looked at Tony Li's review and while I am not as sceptical of
>>> IPv6 as he is, I generally agree with the changes he proposed.
>>> 
>>> 
>>> 
>>> _______________________________________________
>>> art mailing list -- art@ietf.org
>>> To unsubscribe send an email to art-leave@ietf.org
>> 
>> 
>> **********************************************
>> IPv4 is over
>> Are you ready for the new Internet ?
>> http://www.theipv6company.com
>> The IPv6 Company
>> 
>> This electronic message contains information which may be privileged or 
>> confidential. The information is intended to be for the exclusive use of 
>> the individual(s) named above and further non-explicilty authorized 
>> disclosure, copying, distribution or use of the contents of this 
>> information, even if partially, including attached files, is strictly 
>> prohibited and will be considered a criminal offense. If you are not the 
>> intended recipient be aware that any disclosure, copying, distribution or 
>> use of the contents of this information, even if partially, including 
>> attached files, is strictly prohibited, will be considered a criminal 
>> offense, so you must reply to the original sender to inform about this 
>> communication and delete it.
>> 
>> 
>> 
>> _______________________________________________
>> v6ops mailing list -- v6ops@ietf.org
>> To unsubscribe send an email to v6ops-leave@ietf.org
>

Regards,
John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly