4 ms·

IPv6 has a political issue. Support for IPv4 addresses (::0.0.0.0) was removed, because IPv6 users were able to connect to IPv4 hosts directly, bypassing IPv4 N

by drran 5y ago

IPv6 has a political issue. Support for IPv4 addresses (::0.0.0.0) was removed, because IPv6 users were able to connect to IPv4 hosts directly, bypassing IPv4 NAT's and firewalls.

drran 5y ago
yjftsjthsd-h 5y ago
> Support for IPv4 addresses (::0.0.0.0) was removed, because IPv6 users were able to connect to IPv4 hosts directly, bypassing IPv4 NAT's and firewalls. How's that work? It can't be sending actual v4 traffic or it'd work like normal v4.
- wyufro 5y ago
  It was using IPv6 in IP, just like 6to4, protocol 41. I haven't heard it called a political issue before though. It just had problems, like being blocked in firewalls and security problems where the encapsulated packet wasn't checked properly, etc.
  - drran 5y ago
    I'm not a native speaker, so I apologize. > The "IPv4-Compatible IPv6 address" is now deprecated because the current IPv6 transition mechanisms no longer use these addresses. «We forbid you to go right because we are going left.» It doesn't look like a technical issue. How I should call it?
    - wyufro 5y ago
      Right. Neither am I, so take this with a grain of salt. But I'd use "committee decision" in this case.
- drran 5y ago
  IPv6 is large enough to represent the whole IPv4 range. Multiple times. Initially (at the very beginning) it was possible to connect to IPv4 address using IPv6 socket. They were called «IPv4-Compatible IPv6 Address»[0]. For example, I can ping both ipv4 and ipv6 addresses using ping: $ ping 127.0.0.1 PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.048 ms $ ping ::1 PING ::1(::1) 56 data bytes 64 bytes from ::1: icmp_seq=1 ttl=64 time=0.044 ms However, this feature allowed to bypass NAT and connect to IPv4 hosts directly via IPv6, so it deprecated. (I skipped names to avoid scapegoating). $ ping6 ::1 PING ::1(::1) 56 data bytes 64 bytes from ::1: icmp_seq=1 ttl=64 time=0.043 ms $ ping6 127.0.0.1 ping6: 127.0.0.1: Address family for hostname not supported It's not a technical issue, see above: it's possible to serve both protocols at the same time. It worked for a brief period. It's purely political decision: backward support for IPv4 in IPv6 was disabled because some people are thinking that such behavior is dangerous. [0]: https://datatracker.ietf.org/doc/html/rfc4291#section-2.5.5.1 https://datatracker.ietf.org/doc/html/rfc4291#section-2.5.5....
  - chungy 5y ago
    That's... really not how any of it works, and the ping examples are a red herring. IPv4-compatible IPv6 addresses basically allows applications to connect to IPv4 hosts using just a single IPv6-compatible network stack. The operating system kernel handles the translation to and from IPv4 native. There's no way it can "bypass NAT" -- that doesn't even make sense, NAT causes the hosts behind a network to all have the same external network, the exact same incoming rules would apply as they always have. As for ping: back in the 1990s and 2000s, ping only understood IPv4 addresses and an independent command "ping6" was made to work on IPv6. In the mean time, regular ping understand both protocols just fine and you don't need a separate one. Modern Linux distros don't even have a "ping6" anymore.
    - drran 5y ago
      Ping is just example to illustrate that the problem is not technical in a way which makes it easy to understand. I'm talking about this issue for more than decade (at national level), so I nailed some patterns. Yes, IPv4 packets and address range are too small to support IPv6, but IPv6 can encapsulate them with room to spare, so IPv6 network can address and handle IPv4 networks and hosts directly. However, this may enable two disconnected IPv4 networks to communicate via IPv6, if they are both announced at ipv6 network. For example, my notebook is behind IPv4 NAT, but bots were able to scan and try to log into my SSH via IPv6 (miredo). Theoretically, when IPv6 will support both IPv6 and IPv4, I can expose my internal IPv4 network via IPv6, which may create security risk, same as for IPv6 native network without NAT. This is the key problem: people don't want to expose internal networks to the public, so the feature was cut with hope that everyone will switch to IPv6 and this will no longer be a problem. In 2004, I was lead of OPS team, so I spent some time trying to invent a way to switch our internal network to IPv6, when it will hit mainstream, and found that seamless transition is not possible at all: IPv6 requires switch, because backward compatibility is disabled, just because a corporation asked for that.

by drran 5y ago

IPv6 has a political issue. Support for IPv4 addresses (::0.0.0.0) was removed, because IPv6 users were able to connect to IPv4 hosts directly, bypassing IPv4 NAT's and firewalls.

drran 5y ago

yjftsjthsd-h 5y ago

> Support for IPv4 addresses (::0.0.0.0) was removed, because IPv6 users were able to connect to IPv4 hosts directly, bypassing IPv4 NAT's and firewalls. How's that work? It can't be sending actual v4 traffic or it'd work like normal v4.

wyufro 5y ago
It was using IPv6 in IP, just like 6to4, protocol 41. I haven't heard it called a political issue before though. It just had problems, like being blocked in firewalls and security problems where the encapsulated packet wasn't checked properly, etc.
- drran 5y ago
  I'm not a native speaker, so I apologize. > The "IPv4-Compatible IPv6 address" is now deprecated because the current IPv6 transition mechanisms no longer use these addresses. «We forbid you to go right because we are going left.» It doesn't look like a technical issue. How I should call it?
  - wyufro 5y ago
    Right. Neither am I, so take this with a grain of salt. But I'd use "committee decision" in this case.
drran 5y ago
IPv6 is large enough to represent the whole IPv4 range. Multiple times. Initially (at the very beginning) it was possible to connect to IPv4 address using IPv6 socket. They were called «IPv4-Compatible IPv6 Address»[0]. For example, I can ping both ipv4 and ipv6 addresses using ping: $ ping 127.0.0.1 PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.048 ms $ ping ::1 PING ::1(::1) 56 data bytes 64 bytes from ::1: icmp_seq=1 ttl=64 time=0.044 ms However, this feature allowed to bypass NAT and connect to IPv4 hosts directly via IPv6, so it deprecated. (I skipped names to avoid scapegoating). $ ping6 ::1 PING ::1(::1) 56 data bytes 64 bytes from ::1: icmp_seq=1 ttl=64 time=0.043 ms $ ping6 127.0.0.1 ping6: 127.0.0.1: Address family for hostname not supported It's not a technical issue, see above: it's possible to serve both protocols at the same time. It worked for a brief period. It's purely political decision: backward support for IPv4 in IPv6 was disabled because some people are thinking that such behavior is dangerous. [0]: https://datatracker.ietf.org/doc/html/rfc4291#section-2.5.5.1 https://datatracker.ietf.org/doc/html/rfc4291#section-2.5.5....
- chungy 5y ago
  That's... really not how any of it works, and the ping examples are a red herring. IPv4-compatible IPv6 addresses basically allows applications to connect to IPv4 hosts using just a single IPv6-compatible network stack. The operating system kernel handles the translation to and from IPv4 native. There's no way it can "bypass NAT" -- that doesn't even make sense, NAT causes the hosts behind a network to all have the same external network, the exact same incoming rules would apply as they always have. As for ping: back in the 1990s and 2000s, ping only understood IPv4 addresses and an independent command "ping6" was made to work on IPv6. In the mean time, regular ping understand both protocols just fine and you don't need a separate one. Modern Linux distros don't even have a "ping6" anymore.
  - drran 5y ago
    Ping is just example to illustrate that the problem is not technical in a way which makes it easy to understand. I'm talking about this issue for more than decade (at national level), so I nailed some patterns. Yes, IPv4 packets and address range are too small to support IPv6, but IPv6 can encapsulate them with room to spare, so IPv6 network can address and handle IPv4 networks and hosts directly. However, this may enable two disconnected IPv4 networks to communicate via IPv6, if they are both announced at ipv6 network. For example, my notebook is behind IPv4 NAT, but bots were able to scan and try to log into my SSH via IPv6 (miredo). Theoretically, when IPv6 will support both IPv6 and IPv4, I can expose my internal IPv4 network via IPv6, which may create security risk, same as for IPv6 native network without NAT. This is the key problem: people don't want to expose internal networks to the public, so the feature was cut with hope that everyone will switch to IPv6 and this will no longer be a problem. In 2004, I was lead of OPS team, so I spent some time trying to invent a way to switch our internal network to IPv6, when it will hit mainstream, and found that seamless transition is not possible at all: IPv6 requires switch, because backward compatibility is disabled, just because a corporation asked for that.