Re: [BEHAVE] I-D Action:draft-ietf-behave-v6v4-xlate-06.txt

[Xing Li <[e-mail]>]

Hi, Dan,

Dan Wing 写道:
> (off-list.)
>
> See below. 
>
>   
>
> The new text is this, and is in the "Translating from IPv4 to IPv6" section:
>
>       If the translator gets an illegal source address (e.g. 0.0.0.0,
>       127.0.0.1, etc.), the translator SHOULD silently drop the packet.
>
> I suggest adding "(as discussed in Section 5.3.7 of [RFC1812])" to the end of
> that sentence.
>   

Modified as in version 07.
>
> Can similar text be added to the "Translating from IPv6 to IPv4" section of
> behave-v6v4-xlate?  Currently regarding stateless translation it says only:
>
>    Source Address:  In the stateless mode, which is to say that if the
>       IPv6 source address is within the range of a configured IPv6
>       translation prefix, the IPv4 source address is derived from the
>       IPv6 source address per [I-D.ietf-behave-address-format] section
>       2.1.  Note that the original IPv6 source address is an IPv4-
>       translatable address.
>
> We probably want to also list IPv6 'martian addresses' (::1, for sure; perhaps
> others?) should be simply dropped (no ICMP response), as was added for IPv4.
>
>
>   
Agree. Modified as in version 07.

> A question:  for debugging/troubleshooting, it seems useful to send an ICMP
> when the source IPv6 address is outside the range of configured IPv6
> translation prefix(es).  That is, add a sentence like this to the quoted
> paragraph above:
>
>   If the IPv6 source address is not within the range of configured IPv6
> prefix(es), 
>   the translator SHOULD respond with an ICMPv6 Type=1, Code=5 (Destination 
>   Unreachable, Source address failed ingress/egress policy).
>
> Thoughts on that idea?
>
>   

Agree. Modified as in version 07.

So the new text reads,

    Source Address:  In the stateless mode, which is to say that if the
      IPv6 source address is within the range of a configured IPv6
      translation prefix, the IPv4 source address is derived from the
      IPv6 source address per [I-D.ietf-behave-address-format] section
      2.1.  Note that the original IPv6 source address is an IPv4-
      translatable address.  If the translator only supports stateless
      mode and if the IPv6 source address is not within the range of
      configured IPv6 prefix(es), the translator SHOULD drop the packet
      and respond with an ICMPv6 Type=1, Code=5 (Destination
      Unreachable, Source address failed ingress/egress policy).

      In the stateful mode, which is to say that if the IPv6 source
      address is not within the range of any configured IPv6 stateless
      translation prefix, the IPv4 source address and transport-layer
      source port corresponding to the IPv4-related IPv6 source address
      and source port are derived from the Binding Information Bases
      (BIBs) as described in [I-D.ietf-behave-v6v4-xlate-stateful].

      In stateless and stateful modes, if the translator gets an illegal
      source address (e.g. ::1, etc.), the translator SHOULD silently
      drop the packet.

Regards,

xing, congxiao