Explicit Address Mappings for Stateless IP/ICMP Translation

Explicit Address Mappings for Stateless IP/ICMP Translation Redpill Linpro

Vitaminveien 1A 0485 Oslo Norway +47 959 31 212 tore@redpill-linpro.com http://www.redpill-linpro.com

NIC México

Av. Eugenio Garza Sada 427 L4-6 Nuevo León Monterrey México 64840 ydahhrk@gmail.com http://www.nicmexico.mx/

General IPv6 Operations This document extends the Stateless IP/ICMP Translation Algorithm (SIIT) with an Explicit Address Mapping (EAM) algorithm, and formally updates RFC 6145. The EAM algorithm facilitates stateless IP/ICMP translation between arbitrary (non-IPv4-translatable) IPv6 endpoints and IPv4.

The Stateless IP/ICMP Translation Algorithm (SIIT) specifies that when translating IPv4 addresses to IPv6 and vice versa, all addresses must be translated using the algorithm specified in . This document specifies an alternative to the algorithm, where IP addresses are translated according to a table of Explicit Address Mappings configured on the stateless translator. This removes the previous constraint that IPv6 nodes that communicate with IPv4 nodes through SIIT must be configured with IPv4-translatable IPv6 addresses. Translation using the Explicit Address Mapping Table does not replace . For most use cases, it is expected that both algorithms are used in concert. The Explicit Address Mapping algorithm is used only when a mapping matching the address to be translated exists. If no matching mapping exists, the algorithm will be used instead. Thus, when translating an individual IP packet, an SIIT implementation might translate one of the two IP address fields according to an EAM, while the other IP address field is translated according to .

This document makes use of the following terms: An Explicit Address Mapping, as specified in . The Explicit Address Mapping Table, as specified in . Refers to an IP header located inside the payload of an ICMP error packet, or to an IP address within that header. Compare "Outer". Refers to the first IP header in a packet, or to an IP address within that header. In other words, an IP header or address that is NOT "Inner". If a reference is made to an IP header or address without the "Inner" or "Outer" qualifier, it should be considered as "Outer". The Stateless IP/ICMP Translation algorithm, as specified in . Short for "translation". As defined in Section 1.3 of . As defined in Section 1.3 of . The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .

Section 3.2.1 of notes that "stateless translation mechanisms typically put constraints on what IPv6 addresses can be assigned to IPv6 nodes that want to communicate with IPv4 destinations using an algorithmic mapping". In practice, this means that the IPv6 nodes must be configured with IPv4-translatable IPv6 addresses. For the reasons discussed below, some environments may find that the use of IPv4-translatable IPv6 addresses is not desired or even possible. The number of IPv4-translatable IPv6 addresses available to an operator is equal to the number of IPv4 addresses that is assigned to the SIIT function. IPv4 addresses are scarce, and as a result an operator might not have enough IPv4-translatable IPv6 addresses to number the entire IPv6 infrastructure. IPv4-translatable IPv6 addresses must conform to the format specified in Section 2.2 of . This format is not compatible with other common IPv6 address formats, such as the EUI-64 based IPv6 address format used by IPv6 Stateless Address Autoconfiguration. An operator could overcome the above two problems by building an IPv6 network using regular (non-IPv4-translatable) IPv6 addresses, and assign IPv4-translatable IPv6 addresses as secondary addresses on the nodes that want to communicate with IPv4 nodes through SIIT only. However, doing so may result in a new set of undesired consequences: The IPv4-translatable IPv6 addresses must be routed throughout the IPv6 network separately from the primary (non-IPv4-translatable) IPv6 addresses used by the nodes. It might be impossible to aggregate these routes, as two adjacent IPv4-translatable IPv6 addresses might not be assigned to two adjacent IPv6 nodes. As a result, in order to support SIIT, the IPv6 network might need to carry a large number of extraneous routes. These routes must be separately injected into the IPv6 routing topology somehow. Any intermediate devices in the IPv6 network such as a firewall might require special configuration in order to treat the IPv4-translatable IPv6 address the same as the primary IPv6 address, for example by requiring that any ACL entries involving the primary IPv6 address of a node must be duplicated. The IPv4-translatable IPv6 addresses not only have to be assigned to the IPv6 nodes participating in SIIT; all applications and services on those nodes must also be configured to use them. For example, if the IPv6 node is a load balancer, it might require a separate Virtual Server definition using the IPv4-translatable IPv6 address in addition to one using the service's primary IPv6 address. A web server might require specific configuration to listen for connections on both the IPv4-translatable and the primary IPv6 address. A High-Availability cluster service must be set up to fail over both addresses between cluster nodes, and depending on how the IPv6 network learns the location of the IPv4-translatable IPv6 address, the fail-over mechanism used for the two addresses might be completely different. Service monitoring must be done for both the IPv4-translatable and the primary IPv6 address, and any trouble-shooting procedures must be extended to involve both addresses. Finally, the Default Address Selection Policy Table on the IPv6 nodes might need to be altered in order to ensure that outbound sessions towards the IPv4 Internet are sourced from an IPv4-translatable IPv6 address. In short, the use of IPv4-translatable IPv6 addresses in parallel with regular IPv6 addresses is in many ways analogous to the use of Dual Stack. While no actual IPv4 packets are used, the IPv4-translatable IPv6 addresses creates a secondary "stack" in the infrastructure that must be treated and operated separately from the primary one. This increases the complexity of the overall infrastructure, in turn increasing operational overhead, and reducing reliability. An operator who for such reasons finds the use Dual Stack unappealing, might feel the same way about using SIIT with IPv4-translatable IPv6 addresses.

This normative section defines the EAM algorithm, and formally updates Section 4.1 and Section 5.1 of . Specifically, when the EAM algorithm is applied, it supplants 's requirement that a translator operating in the stateless mode must translate the Source Address and Destination Address IP header fields according to Section 2.3 of .

An SIIT implementation includes an EAMT, a conceptual table in which each row represents an EAM. Each EAM describes a mapping between IPv4 and IPv6 prefixes/addresses. An operator populates the EAMT to provide the mappings between the two address families. The EAMT consists of the following columns: IPv4 Prefix IPv6 Prefix SIIT implementations MAY include other columns in order to support proprietary extensions to the EAM algorithm. Throughout this document, figures representing the EAMT contain an Index column using the pound sign as the header. This column is not a required part of this specification; it is included only as a convenience to the reader.

An EAM consists of an IPv4 Prefix and an IPv6 Prefix. The prefix length MAY be omitted, in which case the implementation MUST assume it to be 32 for IPv4 and 128 for IPv6. illustrates an EAMT containing examples of valid EAMs.

Example EAMT An EAM's IPv4 Prefix value MUST have an identical or smaller number of suffix bits than its corresponding IPv6 Prefix value. Unless otherwise specified in , an SIIT implementation MUST individually translate each IP address it encounters in the packet's IP headers (including any IP headers contained within ICMP errors) according to .

This section describes step-by-step how an SIIT implementation translates addresses between IPv4 and IPv6. Only the outcome of the algorithm described should be considered normative, that is, an SIIT implementation may implement the exact procedure differently than what is described here, but the outcome of the algorithm MUST be the same. For concrete examples of IP addresses translations, refer to .

The IPv4 Prefix column of the EAMT is searched for the EAM entry that shares the longest common prefix with the IPv4 address being translated. The IPv4 Prefix and IPv6 Prefix values of the EAM entry found is from now on referred to as EAM4 and EAM6, respectively. If no matching EAM entry is found, the EAM algorithm is aborted. The SIIT implementation MUST proceed to translate the address in accordance with (and its updates). The prefix bits of EAM4 are removed from IPv4 address being translated. The remaining suffix bits from the IPv4 address being translated are stored in a temporary buffer. The prefix bits of EAM6 are prepended to the temporary buffer. If the temporary buffer at this point does not contain a 128-bit value, it is padded with trailing zeroes so that it reaches a length of 128 bits. The contents of the temporary buffer is the translated IPv6 address.

The IPv6 Prefix column of the EAMT is searched for the EAM entry that shares the longest common prefix with the IPv6 address being translated. The IPv4 Prefix and IPv6 Prefix values of the EAM entry found is from now on referred to as EAM4 and EAM6, respectively. If no matching EAM entry is found, the EAM algorithm is aborted. The SIIT implementation MUST proceed to translate the address in accordance with (and its updates). The prefix bits of EAM6 are removed from IPv6 address being translated. The remaining suffix bits from the IPv6 address being translated are stored in a temporary buffer. The prefix bits of EAM4 are prepended to the temporary buffer. If the temporary buffer at this point does not contain a 32-bit value, any trailing bits are discarded so that the buffer is reduced to a length of 32 bits. The contents of the temporary buffer is the translated IPv4 address.

Two IPv6 nodes that are both covered by EAMs might in certain circumstances attempt to communicate through a stateless translator, rather than using native IPv6 directly. This happens if one of the nodes initiate traffic towards the IPv4-converted IPv6 address whose embedded IPv4 address matches an EAM that covers the other node. Special consideration is required in order to make this communication pattern work in a bi-directional fashion. This is illustrated by the example below. Assume that a stateless translator is configured with an translation prefix of 64:ff9b::/96 and the EAMT shown in . The IPv6 node 2001:db8:aaaa:: transmits an IPv6 packet towards 64:ff9b::192.0.2.2, which reaches the translator and is being translated into an IPv4 packet with source address 192.0.2.1 and destination address 192.0.2.2. This destination address is found in the EAMT, so the packet loops back into the translation function, and is translated back to an IPv6 packet with source address 2001:db8:aaaa:: and destination address 2001:db8:bbbb::b. While this packet will reach its destination just fine, a problem will occur when 2001:db8:bbbb::b responds to it. The response packet will have a source address of 2001:db8:bbbb::b and a destination address of 2001:db8:aaaa::, and will be routed directly to its destination without being subjected to any form of translation. Because the source address of this response packet (2001:db8:bbbb::b) is not equal to the destination address of the initial outgoing packet (64:ff9b::192.0.2.2), the packet will most likely be discarded by 2001:db8:aaaa:: and bi-directional communication will most likely fail. The above scenario could be made to work by ensuring that the stateless translator is hairpinning the traffic in both directions. describes how this is accomplished. The resulting address translations are demonstrated step-by-step in .

An SIIT implementation SHOULD include a feature that ensures that hairpinned IPv6 traffic is supported. The feature SHOULD be enabled by default. The following two subsections describe two alternate ways to implement this feature. An implementation MAY support both approaches.

When the simple hairpinning feature is enabled, the translator employs the following rules when translating from IPv4 to IPv6: If the packet is not an ICMPv4 error: The EAM algorithm MUST NOT be used in order to translate the source address in the IPv4 header. If the packet is an ICMPv4 error: The EAM algorithm MUST NOT be used when translating the destination address in the inner IPv4 header. If the packet is an ICMPv4 error whose outer IPv4 source address is equal to its inner IPv4 destination address: The EAM algorithm MUST NOT be used in order to translate the source address in the outer IPv4 header. Rule #2 and #3 are cumulative. The addresses in question MUST instead be translated according to , as if they did not match any EAM.

When the intrinsic hairpinning feature is enabled, the translator employs the following rules when receiving an IPv6 packet: If all the conditions in either of the two sets below is true, the packet is to be hairpinned. The implementation MUST immediately (i.e., prior to forwarding it to the IPv4 network) translate the packet back to IPv6. During the second translation pass, the behaviour specified in MUST be applied, and the Hop Limit field SHOULD NOT be decremented. The packet is not an ICMPv4 error The destination address was translated using the algorithm The destination address is found in the EAMT The packet is an ICMPv4 error The inner source address was translated using the algorithm The inner source address is found in the EAMT

The algorithm specified in relies on making a lookup in the EAMT in order to find the EAM entry that shares the longest common prefix with the address being translated. Operators should note that configuring EAMs with overlapping or identical IPv4 or IPv6 Prefixes in the EAMT may create configurations where the IPv4-to-IPv6 and IPv6-to-IPv4 address translations will not be symmetric. This may in some cases make bi-directional communication impossible. The example EAMT in could be thought of as implementing IVI (EAM #1), but additionally with a single exception in the style of SIIT-DC (EAM #2). The IPv4 Prefixes of the two EAMs overlap, while the IPv6 Prefixes do not. This results in a situation where the IPv6 address 2001:db8:ffc6:3364:4000:: will be translated (according to EAM #1) to the IPv4 address 198.51.100.64. However, when this IPv4 address is translated back to IPv6, it will be translated (according to EAM #2) to the IPv6 address 2001:db8::abcd. Because the IPv4-to-IPv6 translation in this example does not mirror the corresponding IPv6-to-IPv4 translation, bi-directional communication involving the IPv6 address 2001:db8:ffc6:3364:4000:: might fail. In order to help avoid such situations, implementations MAY warn the operator when a new EAM that overlaps with a previously existing one is inserted into the EAMT.

EAMT containing overlapping IPv4 Prefixes In , the IPv6 Prefixes of the two EAMs are identical. The behaviour of the stateless translator when translating an IPv6 packet that contains the address 2001:db8::1 to IPv4 is in this case unspecified. In order to prevent this situation from occurring, implementations MAY refuse to insert a new EAM, whose IPv4 or IPv6 Prefix value is identical to that of an already existing EAM, into the EAMT.

EAMT containing identical IPv6 prefixes

When one or both of the address fields in an IP/ICMP packet are translated according to EAM, the translation can not be relied upon to be checksum neutral, even if the well-known prefix 64:ff9b::/96 is used. This consideration is discussed in more detail in Section 4.1 of .

The EAM algorithm does not introduce any new security issues beyond those that are already discussed in Section 7 of .

This draft makes no request of the IANA.

This document was conceived due to comments made by Dave Thaler in the v6ops session at IETF 91 as well as e-mail discussions between Fred Baker and the author. Valuable reviews, suggestions, and other feedback was given by Fred Baker, Mohamed Boucadair, Cameron Byrne, Brian E Carpenter, Brian Haberman, Ray Hunter, Alvaro Retana, Michael Richardson, Dan Romascanu, Hemant Singh, and Andrew Yourtchenko.

The following subsections lists some use cases that at the time of writing leverage SIIT with the EAM algorithm.

When the CLAT component in the 464XLAT architecture does not have a dedicated IPv6 prefix assigned, it may instead use "one interface IPv6 address that is claimed by the CLAT". This IPv6 address might not be IPv4-translatable. If this is the case, the CLAT essentially implements the EAM algorithm using an EAMT as follows (assuming the CLAT's IPv4 address is picked from the IPv4 Service Continuity Prefix):

Example EAMT for an 464XLAT CLAT In this particular use case, the EAM algorithm is used to translate IPv6 destination addresses to IPv4, and conversely, IPv4 source addresses to IPv6. Other addresses are translated using .

IVI describes a stateless translation model that embeds IPv4 addresses in a 40-bit translation prefix where bits 33-40 are required to be 1. The embedded IPv4 address is located in bits 41-72 of the IPv6 address. Bits 73-128 are required to be 0. The location of the eight least significant IPv4 address bits makes the IVI address mapping differ from .

Example EAMT for IVI In this particular use case, all addresses are translated according to the EAM algorithm. In other words, mapping is not used at all.

SIIT-DC describes the use of SIIT to facilitate connectivity from the IPv4 Internet to services hosted in an IPv6-only data centre. In order to avoid the constraints relating to the use of IPv4-translatable IPv6 addresses discussed in the stateless IPv4/IPv6 translators are provisioned with an EAMT containing one entry per IPv6-only service that are to be made available from the IPv4 Internet, for example (assuming 2001:db8:aaaa::1 and 2001:db8:bbbb::1 are assigned to load balancers or servers that provides the IPv6-only services in question):

Example EAMT for SIIT-DC In this particular use case, the EAM algorithm is used to translate IPv4 destination addresses to IPv6, and conversely, IPv6 source addresses to IPv4. Other addresses are translated using .

demonstrates how a set of example IP addresses are translated given the example EAMT in . Implementors may use the examples given to develop test cases to validate correct operation. Note that the address translations are bidirectional, so a single row in the table describes two address translations: IPv4 to IPv6, and IPv6 to IPv4. It is also assumed that the translation prefix is configured to be 64:ff9b::/96.

Example IP Address Translations

The following examples show how hairpinned IPv6 packets between the IPv6 nodes 2001:db8:aaaa:: and 2001:db8:bbbb::b are translated according to . As in , the EAMT in is used and the translation prefix is 64:ff9b::/96. In addition, the pool is assumed to contain only the single address 198.51.100.1.

Hairpinning of a normal IPv6 packet illustrates how a normal (i.e., not an ICMP error) IPv6 packet sent from 2001:db8:aaaa:: towards 64:ff9b::192.0.2.2 is is hairpinned. In this example, rule #1 in was applied in order to disable the EAM algorithm when translating the intermediate IPv4 source address to IPv6.

Hairpinning of a router-originated ICMPv6 error illustrates the hairpinning of an ICMPv6 error sent by an arbitrary IPv6 router (2001:db8::1234) in response to the packet . In this example, rule #2 in was applied in order to disable the EAM algorithm when translating the intermediate inner IPv4 destination address to IPv6.

Hairpinning of a host-originated ICMPv6 error illustrates the hairpinning of an ICMPv6 error sent by the original destination host itself in response to the packet . In this example, rules #2 and #3 in were both applied in order to disable the EAM algorithm when translating the intermediate inner IPv4 destination address and the intermediate outer IPv4 destination address to IPv6.

Hairpinning of normal response packet illustrates how 2001:db8:bbbb::b's response to the packet in is hairpinned in the exact same fashion as the initial packet. Again, rule #1 in was applied in order to disable the EAM algorithm when translating the intermediate IPv4 source address to IPv6. The example is included in order to illustrate how the addresses in the packet initially sent by 2001:db8:aaaa:: matches those in the translated response packet sent by 2001:db8:bbbb::b, thus facilitating bi-directional communication.