3 ms·

In my opinion the redesign of IPv6 was perfectly fine. The IPv6 headers are significantly simpler that those of IPv4 and much easier to process at great speed.

In my opinion the redesign of IPv6 was perfectly fine. The IPv6 headers are significantly simpler that those of IPv4 and much easier to process at great speed. There was only 1 mistake, but it was huge and all backwards compatibility problems come from it. The IPv4 32-bit address space should have been included in the IPv6 address space, instead of having 2 separate address spaces. IPv6 added very few features, but it mostly removed or simplified the IPv4 features that were useless.

xorcist 8mo ago
> The IPv4 32-bit address space should have been included in the IPv6 address space, That's ... exactly how IPv6 works? Look at the default prefix table at https://en.wikipedia.org/wiki/IPv6_address#Default_address_selection https://en.wikipedia.org/wiki/IPv6_address#Default_address_s... . Or did you mean something else? You still need a dual stack configuration though, there's nothing getting around that when you change the address space. Hence "happy eyeballs" and all that.
- iso1631 8mo ago
  > You still need a dual stack configuration though, there's nothing getting around that when you change the address space Yes there is, at least outside of the machine. All you need to do is have an internal network (100.64/16, 169.254/16, wherever) local to the machine. If you machine is on say 2001::1, then when an application attempts to listen on an ipv4 address it opens a socket listening on 2001::1 instead, and when an application writes a packet to 1.0.0.1, your OS translates it to ::ffff:100:1. This can be even more hidden than things like internal docker networks. Your network then has a route to ::ffff:0:0/96 via a gateway (typically just the default router), with a source of 2001::1 When the packet arrives at a router with v6 and v4 on (assume your v4 address is 2.2.2.2), that does a 6:4 translation, just like a router does v4:v4 nat The packet then runs over the v4 network until it reaches 1.0.0.1 with a source of 2.2.2.2, and a response is sent back to 2.2.2.2 where it is de-natted to a destination of 2001:1 and source of ::ffff:100.1 That way you don't need to change any application unless you want to reach ipv6 only devices, you don't need to run separate ipv4 and ipv6 stacks on your routers, and you can migrate easilly, with no more overhead than a typical 44 nat for rfc1918 devices. Likewise you can serve on your ipv6 only devices by listening on 2001::1 port 80, and having a nat which port forwards traffic coming to 2.2.2.2:80 to 2001::1 port 80 with a source of ::ffff:(whatever) (using colons as a deliminator wasn't great either, you end up with http://[2001::1]:80/ which is horrible)
  - simoncion 8mo ago
    > ...you end up with http://[2001::1]:80/ which is horrible That is horrible, but you do no longer have any possibility of confusion between an IP address and a hostname/domain-name/whatever-it's-called. So, yeah, benefits and detriments. > Your network then has a route to ::ffff:0:0/96 via a gateway... I keep forgetting about IPv4-mapped addresses. Thanks for reminding me of them with this writeup. I should really get around to playing with them some day soon.
    - simoncion 8mo ago
      So, I bothered to play around with these addresses. I find myself a little confused by what you wrote. > If you machine is on say 2001::1, then when an application attempts to listen on an ipv4 address it opens a socket listening on 2001::1 instead, and when an application writes a packet to 1.0.0.1, your OS translates it to ::ffff:100:1. ... > Your network then has a route to ::ffff:0:0/96 via a gateway (typically just the default router), with a source of 2001::1 What's the name of this translation mechanism that you're talking about? It seems to be the important part of the system. I ask because when I visit [0] in Firefox on a Linux system with both globally-routable IPv6 and locally-routable IPv4 addresses configured, I see a TCP conversation with the remote IPv4 address 192.168.2.2. When I remove the IPv4 address (and the IPv4 default route) from the local host, I get immediate failures... neither v4 nor v6 traffic is made. When I add the route it looks like you suggested I add ip route add ::ffff:0:0/96 dev eth0 via <$DEFAULT_IPV6_GATEWAY_IP> I see the route in my routing table, but I get exactly the same results... no IPv4 or IPv6 traffic. Based on my testing, it looks like this is only a way to represent IPv4 addresses as IPv6 addresses, as ::ffff:192.168.2.2 gets translated into ::ffff:c0a8:202, but the OS uses that to create IPv4 traffic. If your system doesn't have an IPv4 address configured on it, then this doesn't seem to help you at all. What am I missing? [0] <http://[::ffff:192.168.2.2]/ http://[::ffff:192.168.2.2]/>
      - iso1631 8mo ago
        You make Nat46 part of the OS network stack. You make nat64 part of the typical router. > I ask because when I visit [0] in Firefox on a Linux system with both globally-routable IPv6 and locally-routable IPv4 addresses configured, I see a TCP conversation with the remote IPv4 address 192.168.2.2. When I remove the IPv4 address (and the IPv4 default route) from the local host, I get immediate failures... neither v4 nor v6 traffic is made. Yes, that's the failure of ipv6 deployment. Imagine you have two vlans, one ipv4 only, one ipv6 only. There's a router sitting across both vlans. VLAN1 - ipv6 only Router 2001::1 Device A 2001::1234 VLAN2 - ipv4 only Router 192.168.1.1 Device B 192.168.1.2 Device A pings 192.168.1.2, the OS converts that transparently to ::ffff:192.168.1.2, it sends it to its default router 2001::1 That router does a 6>4 translation, converting the destination to 192.168.1.2 and the source to 192.168.1.1 (or however it's configured) It maintains the protocol/port/address in its state as any ipv4 natting router would do, and the response is "unnatted" as an "established connection" (with connection also applying for icmp/udp as v4 nat does today) An application on Device A has no need to be ipv6 aware. The A record in DNS which resolves to 192.168.1.2 is reachable from device A despite it not having a V4 address. The hard coded IP database in it works fine. Now if Device B wants to reach Device A, it uses traditional port forwarding on the router, where 192.168.1.1:80 is forwarded to [2001::1234]:80, with source of ::ffff:192.168.1.2 With this in place, there is no need to update any applications, and certainly no need for dual stack. The missing bits are the lack of common 64/46 natting -- I don't believe it's built into the normal linux network chain like v4 nat is, and the lack of transparent upgrading of v4 handling on an OS level.
throw0101d 8mo ago
> The IPv4 32-bit address space should have been included in the IPv6 address space, instead of having 2 separate address spaces. Like > Addresses in this group consist of an 80-bit prefix of zeros, the next 16 bits are ones, and the remaining, least-significant 32 bits contain the IPv4 address. For example, ::ffff:192.0.2.128 represents the IPv4 address 192.0.2.128. A previous format, called "IPv4-compatible IPv6 address", was ::192.0.2.128; however, this method is deprecated.[5] * https://en.wikipedia.org/wiki/IPv6#IPv4-mapped_IPv6_addresses https://en.wikipedia.org/wiki/IPv6#IPv4-mapped_IPv6_addresse... ?
- throw0101d 8mo ago
  Also: > For any 32-bit global IPv4 address that is assigned to a host, a 48-bit 6to4 IPv6 prefix can be constructed for use by that host (and if applicable the network behind it) by appending the IPv4 address to 2002::/16. > For example, the global IPv4 address 192.0.2.4 has the corresponding 6to4 prefix 2002:c000:0204::/48. This gives a prefix length of 48 bits, which leaves room for a 16-bit subnet field and 64 bit host addresses within the subnets. * https://en.wikipedia.org/wiki/6to4 https://en.wikipedia.org/wiki/6to4
fanf2 8mo ago
There are several ways to map the IPv4 address space into the IPv6 address space, going right back to the first IPv6 addressing architecture RFC. Every compatibility protocol added a new one. IPv6 added IPSEC which was backported to IPv4. IPv6 tried to add easy renumbering, which did’t work and had to be discarded. IPv6 added scoped addresses which are halfbaked and limited. Site-scoped addresses never worked and were discarded; link-scoped addresses are mostly used for autoconfiguration. IPv6 added new autoconfiguration protocols instead of reusing bootp/DHCP.
jcranmer 8mo ago
> The IPv4 32-bit address space should have been included in the IPv6 address space, instead of having 2 separate address spaces. The entire IPv4 address space is included in the IPv6 address space, in fact it's included multiple times depending on what you want to do with it. There's one copy for representing IPv4 addresses in a dual-stack implementation, another copy for NAT64, a different copy for a different tunneling mechanism, etc.

xorcist 8mo ago

> The IPv4 32-bit address space should have been included in the IPv6 address space, That's ... exactly how IPv6 works? Look at the default prefix table at https://en.wikipedia.org/wiki/IPv6_address#Default_address_selection https://en.wikipedia.org/wiki/IPv6_address#Default_address_s... . Or did you mean something else? You still need a dual stack configuration though, there's nothing getting around that when you change the address space. Hence "happy eyeballs" and all that.

iso1631 8mo ago
> You still need a dual stack configuration though, there's nothing getting around that when you change the address space Yes there is, at least outside of the machine. All you need to do is have an internal network (100.64/16, 169.254/16, wherever) local to the machine. If you machine is on say 2001::1, then when an application attempts to listen on an ipv4 address it opens a socket listening on 2001::1 instead, and when an application writes a packet to 1.0.0.1, your OS translates it to ::ffff:100:1. This can be even more hidden than things like internal docker networks. Your network then has a route to ::ffff:0:0/96 via a gateway (typically just the default router), with a source of 2001::1 When the packet arrives at a router with v6 and v4 on (assume your v4 address is 2.2.2.2), that does a 6:4 translation, just like a router does v4:v4 nat The packet then runs over the v4 network until it reaches 1.0.0.1 with a source of 2.2.2.2, and a response is sent back to 2.2.2.2 where it is de-natted to a destination of 2001:1 and source of ::ffff:100.1 That way you don't need to change any application unless you want to reach ipv6 only devices, you don't need to run separate ipv4 and ipv6 stacks on your routers, and you can migrate easilly, with no more overhead than a typical 44 nat for rfc1918 devices. Likewise you can serve on your ipv6 only devices by listening on 2001::1 port 80, and having a nat which port forwards traffic coming to 2.2.2.2:80 to 2001::1 port 80 with a source of ::ffff:(whatever) (using colons as a deliminator wasn't great either, you end up with http://[2001::1]:80/ which is horrible)
- simoncion 8mo ago
  > ...you end up with http://[2001::1]:80/ which is horrible That is horrible, but you do no longer have any possibility of confusion between an IP address and a hostname/domain-name/whatever-it's-called. So, yeah, benefits and detriments. > Your network then has a route to ::ffff:0:0/96 via a gateway... I keep forgetting about IPv4-mapped addresses. Thanks for reminding me of them with this writeup. I should really get around to playing with them some day soon.
  - simoncion 8mo ago
    So, I bothered to play around with these addresses. I find myself a little confused by what you wrote. > If you machine is on say 2001::1, then when an application attempts to listen on an ipv4 address it opens a socket listening on 2001::1 instead, and when an application writes a packet to 1.0.0.1, your OS translates it to ::ffff:100:1. ... > Your network then has a route to ::ffff:0:0/96 via a gateway (typically just the default router), with a source of 2001::1 What's the name of this translation mechanism that you're talking about? It seems to be the important part of the system. I ask because when I visit [0] in Firefox on a Linux system with both globally-routable IPv6 and locally-routable IPv4 addresses configured, I see a TCP conversation with the remote IPv4 address 192.168.2.2. When I remove the IPv4 address (and the IPv4 default route) from the local host, I get immediate failures... neither v4 nor v6 traffic is made. When I add the route it looks like you suggested I add ip route add ::ffff:0:0/96 dev eth0 via <$DEFAULT_IPV6_GATEWAY_IP> I see the route in my routing table, but I get exactly the same results... no IPv4 or IPv6 traffic. Based on my testing, it looks like this is only a way to represent IPv4 addresses as IPv6 addresses, as ::ffff:192.168.2.2 gets translated into ::ffff:c0a8:202, but the OS uses that to create IPv4 traffic. If your system doesn't have an IPv4 address configured on it, then this doesn't seem to help you at all. What am I missing? [0] <http://[::ffff:192.168.2.2]/ http://[::ffff:192.168.2.2]/>
    - iso1631 8mo ago
      You make Nat46 part of the OS network stack. You make nat64 part of the typical router. > I ask because when I visit [0] in Firefox on a Linux system with both globally-routable IPv6 and locally-routable IPv4 addresses configured, I see a TCP conversation with the remote IPv4 address 192.168.2.2. When I remove the IPv4 address (and the IPv4 default route) from the local host, I get immediate failures... neither v4 nor v6 traffic is made. Yes, that's the failure of ipv6 deployment. Imagine you have two vlans, one ipv4 only, one ipv6 only. There's a router sitting across both vlans. VLAN1 - ipv6 only Router 2001::1 Device A 2001::1234 VLAN2 - ipv4 only Router 192.168.1.1 Device B 192.168.1.2 Device A pings 192.168.1.2, the OS converts that transparently to ::ffff:192.168.1.2, it sends it to its default router 2001::1 That router does a 6>4 translation, converting the destination to 192.168.1.2 and the source to 192.168.1.1 (or however it's configured) It maintains the protocol/port/address in its state as any ipv4 natting router would do, and the response is "unnatted" as an "established connection" (with connection also applying for icmp/udp as v4 nat does today) An application on Device A has no need to be ipv6 aware. The A record in DNS which resolves to 192.168.1.2 is reachable from device A despite it not having a V4 address. The hard coded IP database in it works fine. Now if Device B wants to reach Device A, it uses traditional port forwarding on the router, where 192.168.1.1:80 is forwarded to [2001::1234]:80, with source of ::ffff:192.168.1.2 With this in place, there is no need to update any applications, and certainly no need for dual stack. The missing bits are the lack of common 64/46 natting -- I don't believe it's built into the normal linux network chain like v4 nat is, and the lack of transparent upgrading of v4 handling on an OS level.

throw0101d 8mo ago

> The IPv4 32-bit address space should have been included in the IPv6 address space, instead of having 2 separate address spaces. Like > Addresses in this group consist of an 80-bit prefix of zeros, the next 16 bits are ones, and the remaining, least-significant 32 bits contain the IPv4 address. For example, ::ffff:192.0.2.128 represents the IPv4 address 192.0.2.128. A previous format, called "IPv4-compatible IPv6 address", was ::192.0.2.128; however, this method is deprecated.[5] * https://en.wikipedia.org/wiki/IPv6#IPv4-mapped_IPv6_addresses https://en.wikipedia.org/wiki/IPv6#IPv4-mapped_IPv6_addresse... ?

throw0101d 8mo ago
Also: > For any 32-bit global IPv4 address that is assigned to a host, a 48-bit 6to4 IPv6 prefix can be constructed for use by that host (and if applicable the network behind it) by appending the IPv4 address to 2002::/16. > For example, the global IPv4 address 192.0.2.4 has the corresponding 6to4 prefix 2002:c000:0204::/48. This gives a prefix length of 48 bits, which leaves room for a 16-bit subnet field and 64 bit host addresses within the subnets. * https://en.wikipedia.org/wiki/6to4 https://en.wikipedia.org/wiki/6to4

fanf2 8mo ago

There are several ways to map the IPv4 address space into the IPv6 address space, going right back to the first IPv6 addressing architecture RFC. Every compatibility protocol added a new one. IPv6 added IPSEC which was backported to IPv4. IPv6 tried to add easy renumbering, which did’t work and had to be discarded. IPv6 added scoped addresses which are halfbaked and limited. Site-scoped addresses never worked and were discarded; link-scoped addresses are mostly used for autoconfiguration. IPv6 added new autoconfiguration protocols instead of reusing bootp/DHCP.

jcranmer 8mo ago

> The IPv4 32-bit address space should have been included in the IPv6 address space, instead of having 2 separate address spaces. The entire IPv4 address space is included in the IPv6 address space, in fact it's included multiple times depending on what you want to do with it. There's one copy for representing IPv4 addresses in a dual-stack implementation, another copy for NAT64, a different copy for a different tunneling mechanism, etc.