Re: [v6ops] FYI: Microsoft's latest on CLAT

[Tore Anderson <[e-mail]>]

On 09/03/24 08:58, Ole Trøan wrote:
> Could stateful XLAT be made to work on a host with a single address? Yes. Would using a single address lead to interoperability problems? No.
> I.e. it’s an implementation choice.

Indeed. On Linux this can be easily done today, by assigning a locally 
significant IPv6 address (e.g., ULA) to the CLAT function, and then 
running the packets through Netfilter's stateful IPv6 NAT function prior 
to forwarding to the external network.

This works just fine on any IPv6 network, unlike the dual address 
approach. It also means NDP interaction is not an issue to worry about, 
so it is actually easier to implement than the dual address approach too 
(in my opinion, anyway).

I can also imagine a single-address in-kernel CLAT that achieves the 
same more elegantly by integrating directly with the socket layer, e.g., 
by ensuring that an outbound TCP/UDP connection assigned 192.0.2.1:portX 
claims [2001:db8::1]:portX automatically, and where return traffic 
destined for [2001:db8::1]:portX will be directed to the CLAT function 
for IPv6→IPv4 translation. [2001:db8::1]:portY may be used by a regular 
native IPv6 socket simultaneously.

Tore