[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: v6ops-nat64-pb-statement-req: DNSSEC requirement

Thomas Narten escribió:

marcelo bagnulo braun <marcelo@it.uc3m.es> writes:
if the verification is performed before the synthesis of the RR and there is a trsut relationship betwen the receiver and the node that has performed the verification and synthesis, this should do it. 

Well, yes, but there are an awful lot of ifs in the above. Certainly
more than are appropriate for the original MUST requirement.
but what i was describing here is a solution the describe that this is possible and so it makes sense to keep the requirement 
there may be other solutions that also satisfy the requirement,

In particular, if everything happens at the end node, we are in
business, right?  (i.e. the v6 end node asks for the A RR, perfomrs
the dnssec validation and then internally generates the v6 address)


Ahem. If the end node is doing this, why isn't it just doing dual
stack? After all, it (or rather the embedded translator) is sending
out IPv4...
cause the main scenario that we are targeting here is the case where the source node has no v4 address configured in its stack, so it cannot send v4 packets.
it is not so trivial for the v4 case though (actually i think it is not possible for the v4 case, hence the question mark) 

In other words, the MUST needs some serious scoping. If it makes
sense at all.

I'm still not sure this requirement is acheivable in practice.
my take is that this is possible to achieve for v6 initiated communications (i.e. when AAAA RR are synthesized) I don't think that it is achievable for v4 initiated communications (i.e. when A RR are synthesized)
I am lately thinking that we need two different lists of requirements one for v4 initiated communications and another one for v6 initiated communications especially for dealing with dns requirements. In v4 initiated communications the state in the nat box has close relationship with the RR synthesis, while in v6 initiated communication they are completely decoupled, which makes possible to satisfy most of the dns requirements. 

so, what do you think?

regards, marcelo




 So I'm
not at all sure it is appropriate to make it a MUST, at least not
without a lot more text explaining what is meant.

Thomas