Subject: Re: [Last-Call] Iotdir last call review of draft-ietf-dhc-v6only-03

From: Philip Homburg <[email-masked]>
Date: Tue, 23 Jun 2020 19:39:44 +0200

>Huh? NAT64 can involves no host changes at all (other than not having IPv4 to
>succeed in network attachment, and as Lorenzo said, IPv4 literals in some ancien
>t protocols).

I don't know if you consider http://192.0.2.1/ an ancient protocol, but this
is typically something that breaks with NAT64.

However, NAT64 is also a complete violation of core IPv6 standards.
1) RFC 4443 (ICMP6) Section 2.4, (c):
    Every ICMPv6 error message (type < 128) MUST include as much of
    the IPv6 offending (invoking) packet (the packet that caused the
    error) as possible without making the error message packet exceed
    the minimum IPv6 MTU [IPv6].

  There is no way an NAT64 gateway is going to make that work. Worse, RFC 4884
  put funny bits at ofset 128. 

2) IPv4 links can have MTUs lower than 1280. Again this is incompatible with 
   IPv6 specifications.

Then, if you say no host changes required, you imply the use of DNS64, which is
incompatible with a DNSSEC validating resolver on the host (unless that 
resolver is aware of the presence of DNS64).

---

From: Ted Lemon <[email-masked]>
Date: Tue, 23 Jun 2020 14:23:45 -0400

On Jun 23, 2020, at 1:39 PM, Philip Homburg <[email-masked]> wrote:
> I don't know if you consider http://192.0.2.1/ <http://192.0.2.1/> an ancient protocol, but this

I don’t think this is really relevant to the IoT directorate. A constrained device is not going to be doing this in production.  If your goal is to discuss the question of whether IPv6-only can ever be legitimately asserted on a network, that’s not something that you should Cc: the IoT directorate on.

That said, hard-coded RFC1918 IP literals in URLs are useful for testing, but are simply bad practice for web sites. If your web site relies on this, and end users lose as a consequence, it’s due to your incompetence that they are losing, not due to any failing of the network infrastructure.

---

From: Michael Richardson <[email-masked]>
Date: Tue, 23 Jun 2020 14:56:34 -0400

> is typically something that breaks with NAT64.

Yes, I do consider it past it's time, but not as ancient as FTP.
It does have literals in the protocol, in the Host: header.

https://192.0.2.1/ is the modern equivalent, and due to the IPv4 literal,
does not get security, so it doesn't work.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-