Re: 6to4 considered a bad thing

[james woodyatt <jhw@apple.com>]

On Feb 1, 2008, at 13:23, Christian Huitema wrote:
> James is observing that some public relays are broken, perhaps  
> deliberately.

I'm also observing that some ISP's are refusing to deploy 6to4 relays  
at *private* anycast addresses inside their own interior routing  
domains, preferring instead to dump the 6to4 "problem" to whatever  
the nearest public 6to4 relay is advertising service (which may or  
may not actually be available).

I think it would be helpful if routes to 192.88.99.1 shouldn't be  
advertised to peers from which protocol 41 packets will not be  
decapsulated and forwarded into an IPv6 domain.

> Teredo went one step further. Public gateways can easily be abused.  
> So Teredo introduced a discovery mechanism to find out the best  
> gateway on a destination by destination basis. That mechanism is  
> little more than a ping, and could easily be ported to 6to4. We  
> could assume that 6to4 routers maintain a "routing cache"  
> associating specific "native IPv6" destinations with the "closest  
> 6to4 gateway". Given a new IPv6 destination, the 6to4 router will  
> send a ping through the public server, note the IPv4 address from  
> which the ping comes back, and send the rest of the traffic through  
> that address.


This assumes the "ping" packets will pass through the same firewalls  
as the packets that trigger them.  If they don't produce a timely  
response, what happens?  Remember, at this point, there is a human  
being sitting at a console watching a stalled progress bar and  
waiting for a connection to go through.  The connection they're  
attempting is IPv6 because their host has a global IPv6 address  
assigned (with a 2002:aabb:ccdd:xxxx:/64 prefix) and they got an  
answer to a request for AAAA records.

Their host can connect to other hosts in 2002::/16 just fine.  It's  
only the non-2002::/16 address that are unreachable.  So, how many  
non-6to4 destinations do we have to "ping" before we decide to stop  
advertising an IPv6 default route for those 2002:aabb:ccdd:xxxx::/64  
addresses altogether?

At this point, if large IPv6-capable ISP's cannot be persuaded to  
deploy 6to4 relays in their interior IPv6/IPv4 routing domains for  
the use of their paying, retail IPv4 customers, then I have to say  
that 6to4 is a failure as a transition strategy, and we should move  
now to deprecate it.


--
james woodyatt <jhw@apple.com>
member of technical staff, communications engineering