Re: IPv6 only host NAT64 requirements?

JORDI PALET MARTINEZ <> Mon, 13 November 2017 03:58 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 8F74A129445 for <>; Sun, 12 Nov 2017 19:58:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key); domainkeys=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id s9h5nFxn00vO for <>; Sun, 12 Nov 2017 19:58:51 -0800 (PST)
Received: from ( []) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 0F712126DCA for <>; Sun, 12 Nov 2017 19:58:50 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=simple;; s=MDaemon; t=1510545528; x=1511150328; q=dns/txt; h=DomainKey-Signature: Received:User-Agent:Date:Subject:From:To:Message-ID:Thread-Topic: References:In-Reply-To:Mime-version:Content-type: Content-transfer-encoding:Reply-To; bh=7i3v3uB9yT2pZ8zK08NhYs3u3 BURbU9ntfYl5W4E9wo=; b=orLxcXxFM9XBqZG5+Q+AQhywcYyDtrkbCBm+tnqsf WCcgWuYfkG6lhPwB8roT8uKeFNWH9n3Fr9QzNrmXMZgDTdjK6By40BKAVLhRUeln SR4i0kcOScFubpxYRn7ELwTqsdeKezey9LUBSYcWJPETsoFW/xYXYeHK/+v3koV4 Bg=
DomainKey-Signature: a=rsa-sha1; s=MDaemon;; c=simple; q=dns; h=from:message-id; b=C64aFtQJvx7IMU9LWRKx745LLQO8qXeu/uoTiRztrhtdyzP2Aw7lxdF6UXuD YVPof/b9/P5wXY8gNNg/jIQiNsoDxlHXJhUP1wEobA+nJpGEuezRuPxvu jgQmA4Uh6L5OCj3BQy7mLxcuWa4z9i1rYqX+7GwYi578iyz0eVVw0I=;
X-MDAV-Processed:, Mon, 13 Nov 2017 04:58:48 +0100
X-Spam-Processed:, Mon, 13 Nov 2017 04:58:47 +0100
Received: from [] by (MDaemon PRO v11.0.3) with ESMTP id md50005622213.msg for <>; Mon, 13 Nov 2017 04:58:47 +0100
X-MDOP-RefID: re=0.000,fgs=0 (_st=1 _vt=0 _iwf=0)
X-HashCash: 1:20:171113:md50005622213::V9+qtilAkUZXl/fZ:00000VzP
User-Agent: Microsoft-MacOutlook/f.27.0.171010
Date: Mon, 13 Nov 2017 11:58:22 +0800
Subject: Re: IPv6 only host NAT64 requirements?
To: 6man WG <>
Message-ID: <>
Thread-Topic: IPv6 only host NAT64 requirements?
References: <>
In-Reply-To: <>
Mime-version: 1.0
Content-type: text/plain; charset="UTF-8"
Content-transfer-encoding: quoted-printable
Archived-At: <>
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 13 Nov 2017 03:58:53 -0000

Hi Ole,

I was also thinking on this yesterday after the hackathon and I thing from that talk it is obvious that I will support that.

Also thought about this:

Could the “IPv6 node requirements document” include also a consideration for the same you mention here, in case there is IPv4-only in a dual-stack LAN with IPv6-only access?

I’m almost sure that this is out of the scope of the 6man charter, but I also feel that this is somehow our job … alternatively what is the correct place to do that? May be a new sunset4 document? Or int-area? The point here is an IPv4-only host being used in a network using IPv6-only for the access ...


-----Mensaje original-----
De: ipv6 <> en nombre de Ole Troan <>
Responder a: <>
Fecha: lunes, 13 de noviembre de 2017, 11:46
Para: 6man WG <>
Asunto: IPv6 only host NAT64 requirements?

    At the hackathon there was quite a bit of testing of IPv6 only hosts with access to the IPv4 network via a NAT64.
    While many applications work well on a classic IPv6 only host, there are a few things required to make all applications work.
    - Must be able to do NAT64 prefix discovery (RFC6052)
    - Synthesise IPv6 address from an IPv4 literal (RFC7050)
    This is to be able to deal with IPv4 address literals. Which are common in protocols like SIP/ICE/STUN.
    These can be implemented directly in applications, or it can be implemented in the host stack (although application might still have to change).
    - Should do local DNS64 to support DNSSEC (RFC6147)
(if you do validation).
    A DNS64 service in the network looks like a man in the middle attack, so to support DNSSEC, validation should happen before synthesizing, and must be done on the host itself.
    If this is the direction we want to go. Encourage IPv6 only host deployments (as opposed to dual stack hosts), are these requirements we'd like to add to the IPv6 node requirements document? Somewhere else?
    Best regards,
    IETF IPv6 working group mailing list
    Administrative Requests:

IPv4 is over
Are you ready for the new Internet ?
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.