Re: [v6ops] draft-vf-v6ops-ipv6-deployment

[hsyu <[e-mail]>]

Hi, Alexandre and all,

Because the program for detecting whether a website supports IPv6 and the web corresponding to the program are deployed on the same server, in order to ensure the accuracy of the detection, the reachability of the network is the first consideration.  This is why IPv4 addresses are used in the website.

About adding the IPv6 forum and IPv6-test logos to the web, it's because I get some help from these two sites. However, in order to eliminate the misunderstanding, I will delete these two logos from the website. 

Regarding the use of IPv6 addresses and DNS domain names to display this website, I need to apply for relevant resources to support it. 

Since there are many disputes on the website and the website is currently only a test version, the website will be closed for a while to modify the content.

Best regards.

https://maas.mail.163.com/dashi-web-extend/html/proSignature.html?ftlId=1&name=Haisheng+Yu%28Johnson%29&uid=hsyu%40cfiec.net&iconUrl=https%3A%2F%2Fmail-online.nosdn.127.net%2Fsm50a1433bca9fb284d4265d35e9ed54d3.jpg&items=%5B%22%22%2C%22hsyu%40cfiec.net%22%2C%22%22%2C%22%22%2C%22%22%5D" rel="nofollow">

https://mail-online.nosdn.127.net/sm50a1433bca9fb284d4265d35e9ed54d3.jpg">	Haisheng Yu(Johnson)
[e-mail]

ndre Petrescu<[e-mail]> wrote：

To be more concrete.

There are two IPv6 logos at the bottom of that page: "IPv6 Forum" and
"IPv6 validated by ipv6-test.com".

However, my IPv6 experiments from an IPv6--only computer does not see
the page:

http://218.2.231.237:5001/cgi-bin/generate
https://[64:ff9b::da02:e7ed]:5001/cgi-bin/generate

So maybe there is a need need to update the criteria of the IPv6 Forum
and of the ipv6-test.com.  Or update that web page simply to remove the
two logos.

Furthermore, browsing the ipv6-test.com website from an IPv6-only
computer is strange too.  If one tries to browse it from an IPv6-only
computer, then one can see what I mean.  It says I have a score of 10
out of 20, and recommends to install IPv4 to reach a higher score of 20.

That is a very strange recommendation in my oppinion.

On the contrary, if one would like IPv6 to succeed more quiuckly, then
one would construct a website ipv6-test.com which recommends to turn off
IPv4.

But I would not qualify these days an IPv6-only computer to be a score
10/20.  It's really not possible.

Alex




Le 24/03/2021 à 17:03, Alexandre Petrescu a écrit :

Le 24/03/2021 à 16:14, JORDI PALET MARTINEZ a écrit :

If you want to be able to connect to IPv4-only services in Internet,
 you really need 464XLAT. NAT64+DNS64 will break for you with any app
 using literals, etc.

I can agree.

Basically the experiment is: whenever someone invites me to click on
some link, and if I have enough time, I first turn off IPv4 and then I
click.

In the future Internet there would be no IPv4 to try, no DNSv4, no
NAT64, etc.  The future Internet of a sort.

Since I started these experiments a few years ago, as time goes by, more
and more URLs work ok on IPv6 and browsed from IPv6-only computers.

There are still some important issues with security and IPv6 at sites
that are known to be good for IPv6 (e.g. Google is known to be good with
IPv6, but some security checking comes to mind; and it is not the only
one, Cloud logins also comes to mind as not working ok on IPv6 even
though their dataspace is ok on IPv6).

There are other issues as well.  I am not trying only the HTTPS URLs but
also other new services that appear very often, or the old mail servers
like smtp.gmail.com STARTTLS.

There are many things to be learned about IPv6 deployment during all
these experiments of turning off IPv4.

Alex

Regards, Jordi @jordipalet



El 24/3/21 16:13, "v6ops en nombre de Alexandre Petrescu"
<[e-mail] en nombre de [e-mail]>
escribió:



Le 24/03/2021 à 15:48, JORDI PALET MARTINEZ a écrit :

I think you need to read the NAT64 and related RFCs ...

If your ISP doesn't offer the NAT64, then it is really bad to use
IPv6-only in your network.

?

No no, I live well in the IPv6 world without NAT64... I dont
understand why NAT64 is so required?

I may understand that you do that as an experiment, but then you can
setup your own NAT64, it is really simple in any Linux or even
 an OpenWRT CPE.

I dont want to set up new boxes at home.  It is indeed possible, but
 at this time I do not want.

You may also setup a DNS64 and I will suggest also to setup a
CLAT, all that can be done via VMs, even a single VM in your own
network.

YEs, that is possible too.

But can I do without it please?

Does IPv6 mandate the use of DNS64 and NAT64?

Alex

Regards, Jordi @jordipalet



El 24/3/21 15:33, "v6ops en nombre de Alexandre Petrescu"
<[e-mail] en nombre de [e-mail]>
escribió:

Hi, Gabor,

Thanks for the reply.  Allow me to continue this discussion.

Le 24/03/2021 à 13:11, Gabor LENCSE a écrit :

Dear Alex,

I meant that you need to do the address synthesis manually. I
intended the 64:ff9b::/96 WKP only as an example.

As a side note,  I think that 64:ff9b::/96 prefix might need a 32bit
IID, which is probably forbidden by the IPv6 Addressing Architecture
RFC 4291 ("For all unicast addresses, except those that start with
the binary value 000, Interface IDs are required to
be 64 bits long").

This is not to say that I disagree with the 64:: prefix, but maybe
point to what appears to me to be a slight incoherency.

First, you need to find out the NAT64 prefix used by your ISP. (RFC
7050 describes the process.)

I wanted to ask: do you mean the NAT64 prefix that my ISP uses, or
the ISP that the data provider (the URL in question) uses?

I am saying this because I think my ISP does not provide NAT64
service to home.  It is probably an optional feature.

Then, you can synthesize and use the proper IPv4-Embedded IPv6
Address. (I hope that the IPv6 routing will find the NAT64 gateway
based on the NAT64 prefix.)

Of course, it is just a hack, DNS64 makes our life easier, if
the IPv4 only server is registered in the DNS system. And,
naturally, the real solution is that the server should have an
IPv6 address. :-)

Yes, I agree with it too.

Alex

Best regards,

Gábor

On 3/24/2021 10:59 AM, Alexandre Petrescu wrote:

:-)


Le 24/03/2021 à 09:39, Gabor LENCSE a écrit :

Of course, it is better to use DNS,

I agree.

but if you have only an IPv4 literal AND you know the NAT64 prefix
used in your network, then you can synthesize the
(RFC 6052) IPv4-embedded IPv6 address manually. :-)

For that to work there is a need to implement some conversion in a
network box (NAT64?  464XLAT?) _and_ in the client.

The URL would look like:

https://[64:ff9b::218.2.231.237]:5001/cgi-bin/generate

thanks for the converted URL.

I clicked on it in my Mail User Agent (MUA) client Thunderbird
 on an IPv6-only PC and it quickly complains about something that
might relate to security.  It complains about it very quickly,
there is no circling pointing to wait for response of discoverying
some server in the infra, or waiting reply from a site.

It says: "The link text indicates 'A' but it leads to 'A'" where A
is the hex text with ":" everywhere converted from the
 hex you provided above containing 4 dots.  Remark A is the
same as A, and the error reporting is wrong.  That is a client
 problem that deserves correction (a bug).

But it is a larger client problem too in that clients on PCs dont
have that support for '64::' addresses.  Smartphones might
have that support.  I am not sure it is good to consider that
lack of implementation of "64::" addresses in clients to be a
bug.


Alex

PS: for firefox: when I copy paste that URL
https://[64:ff9b::218.2.231.237]:5001/cgi-bin/generate on my
address bar of web browser firefox on my IPv6-only PC it tries
 to connect to something, waitslike 10 seconds, and then
firefox reports 'The wait delay has been reached' (translated)
and stops waiting.  Firefox is also affected by this problem
in protocols.

Hopefully, your ISP uses a Network-Specific Prefix, and not the
NAT64 Well-Known Prefix.

Gábor

On 3/24/2021 9:02 AM, JORDI PALET MARTINEZ wrote:

It will be much better to use DNS, not literals!

You probably don't see that from an IPv6-only network because it
is a literal (if you have NAT64+DNS64 it will work with DNS, if
you have 464XLAT it will also work with a
literal IPv4).

El 24/3/21 8:53, "v6ops en nombre de Alexandre Petrescu"
<[e-mail] en nombre de
[e-mail]> escribió:



Le 24/03/2021 à 04:14, hsyu a écrit :

Dear Paolo and  Alexandre，

Thank you very much for your interest in this website. This is a
test website, and the current data still

needs

further confirmation. Therefore, I will post it after the

data is corrected.

Hi,

Thank you for the reply.

The data on the website might be correct already.  I can see it
on an IPv4 connection.

But the access to that data should be on IPv6 too, not
only on IPv4.

Ideally, one should add an IPv6 address to the computer's
interface. Then the URL would be something like
https://[2001:db8:1::1]:5001/cgi-bin/generate (attention that is
an IPv6 address for documentation, do not put that particular
address on the interface)

Alex

Haisheng Yu(Johnson) [e-mail]

<https://maas.mail.163.com/dashi-web-extend/html/proSignature.html?ftlId=1&name=Haisheng+Yu%28Johnson%29&uid=hsyu%40cfiec.net&iconUrl=https%3A%2F%2Fmail-online.nosdn.127.net%2Fsm50a1433bca9fb284d4265d35e9ed54d3.jpg&items=%5B%22%22%2C%22hsyu%40cfiec.net%22%2C%22%22%2C%22%22%2C%22%22%5D>

签名由 网易邮箱大师

<https://mail.163.com/dashi/dlpro.html?from=mail81>

定制 On 3/24/2021 02:14，Alexandre

Petrescu<[e-mail]>

<mailto:[e-mail]> wrote：

Hi,

Thank you for the link in China about IPv6 deployment.

But I can not see it :-(

When I copy paste that link

(http://218.2.231.237:5001/cgi-bin/generate)

in my web browser  it responds that the connection has

failed.  I use an

IPv6-only computer (Windows with IPv4 unchecked in the

interface

Properties).

Ideally, one would put data about IPv6 on a server that

is also capable

of doing IPv6.

Maybe one can put an IPv6 address on the server

218.2.231.237?

Alex


Le 23/03/2021 à 07:21, hsyu a écrit :

Hi Paolo, I can also provide some data on the

deployment of IPv6 in

China. http://218.2.231.237:5001/cgi-bin/generate

Best regards.

Haisheng Yu(Johnson) [e-mail]

<https://maas.mail.163.com/dashi-web-extend/html/proSignature.html?ftlId=1&name=Haisheng+Yu%28Johnson%29&uid=hsyu%40cfiec.net&iconUrl=https%3A%2F%2Fmail-online.nosdn.127.net%2Fsm50a1433bca9fb284d4265d35e9ed54d3.jpg&items=%5B%22%22%2C%22hsyu%40cfiec.net%22%2C%22%22%2C%22%22%2C%22%22%5D>

签名由 网易邮箱大师 <https://mail.163.com/dashi
/dlpro.html?from=mail81> 定制 On 3/23/2021 12:40，Dhruv
Dhody<[e-mail]>
<mailto:[e-mail]> wrote：

Hi Paolo,

I think we should highlight that we do not have

visibility

inside the enterprises beyond the external-facing
website or

email and thus it

is also difficult to gauge the IPv6 deployments

inside enterprises.

[PV] Ok. Probably here you refer to small-medium

enterprises. For

large enterprises public data on the usage of IPv6

can be retrieved

(Nalini, in copy, provided a good input on IPv6 in large
organizations). We will better specify this point in

the next

version of the draft.


I had this NIST data in mind -
https://fedv6-deployment.antd.nist.gov/cgi-bin/generate-com

which

includes large enterprises and relies on DNS, mail,

external

website. Also, see Eric's site -
https://www.vyncke.org/ipv6status/detailed.php?country=in

Thanks! Dhruv

_______________________________________________ v6ops mailing

list

[e-mail] https://www.ietf.org/mailman/listinfo/v6ops


_______________________________________________ v6ops mailing

list

[e-mail] https://www.ietf.org/mailman/listinfo/v6ops

_______________________________________________ v6ops mailing
list [e-mail] https://www.ietf.org/mailman/listinfo/v6ops



********************************************** IPv4 is
over Are you ready for the new Internet ?
http://www.theipv6company.com The IPv6 Company

This electronic message contains information which may be
privileged or confidential. The information is intended to
 be for the exclusive use of the individual(s) named above
 and further non-explicilty authorized disclosure,
copying, distribution or use of the contents of this
information, even if partially, including attached files,
is strictly prohibited and will be considered a criminal
offense. If you are not the intended recipient be aware
that any disclosure, copying, distribution or use of the
contents of this information, even if partially, including
attached files, is strictly prohibited, will be considered
a criminal offense, so you must reply to the original
sender to inform about this communication and delete it.



_______________________________________________ v6ops mailing
list [e-mail] https://www.ietf.org/mailman/listinfo/v6ops

_______________________________________________ v6ops
mailing list [e-mail]
https://www.ietf.org/mailman/listinfo/v6ops

_______________________________________________ v6ops mailing list
[e-mail] https://www.ietf.org/mailman/listinfo/v6ops

_______________________________________________ v6ops mailing list
[e-mail] https://www.ietf.org/mailman/listinfo/v6ops



********************************************** IPv4 is over Are
you ready for the new Internet ? http://www.theipv6company.com The
IPv6 Company

This electronic message contains information which may be privileged
or confidential. The information is intended to be for the exclusive
use of the individual(s) named above and further non-explicilty
authorized disclosure, copying, distribution or use
 of the contents of this information, even if partially, including
 attached files, is strictly prohibited and will be considered a
criminal offense. If you are not the intended recipient be aware that
any disclosure, copying, distribution or use of the contents of this
information, even if partially, including attached files, is strictly
prohibited, will be considered a criminal offense, so you must reply
to the original sender to inform about this communication and delete it.



_______________________________________________ v6ops mailing list
[e-mail] https://www.ietf.org/mailman/listinfo/v6ops

_______________________________________________ v6ops mailing list
[e-mail] https://www.ietf.org/mailman/listinfo/v6ops



********************************************** IPv4 is over Are you
ready for the new Internet ? http://www.theipv6company.com The IPv6
Company

This electronic message contains information which may be privileged
 or confidential. The information is intended to be for the exclusive
 use of the individual(s) named above and further non-explicilty
authorized disclosure, copying, distribution or use of the contents of
this information, even if partially, including attached files, is
 strictly prohibited and will be considered a criminal offense. If
you are not the intended recipient be aware that any disclosure,
copying, distribution or use of the contents of this information,
even if partially, including attached files, is strictly prohibited,
will be considered a criminal offense, so you must reply to the
original sender to inform about this communication and delete it.



_______________________________________________ v6ops mailing list
[e-mail] https://www.ietf.org/mailman/listinfo/v6ops

_______________________________________________
v6ops mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/v6ops

_______________________________________________
v6ops mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/v6ops