RFC 3338
Dual Stack Hosts Using "Bump-in-the-API" (BIA)
Dual Stack Hosts Using "Bump-in-the-API" (BIA) π
Okay bestie, here's the header info β¨
- Authors: S. Lee, M-K. Shin, and Y-J. Kim from ETRI, plus E. Nordmark and A. Durand from Sun Microsystems π
- Category: Experimental π§ͺ
- Date: October 2002 π
- Obsoletes/Updates: the header doesn't list anything here, so nothing to obsolete or update π¦
- Series: Network Working Group, which is the RFC crew πΈ
Status of this Memo π
So this memo is an Experimental Protocol for the Internet community. It is NOT an Internet standard of any kind, just so we're clear π They're asking for discussion and suggestions for improvement, and distribution of this memo is unlimited π
Copyright Notice π₯
Copyright (C) The Internet Society (2002). All Rights Reserved.
Abstract π¦
Okay so this doc specifies a dual stack host mechanism called "Bump-in-the-API" (BIA) β¨ It lets hosts talk to other IPv6 hosts using the IPv4 apps they already have π The goal is the same as the Bump-in-the-stack mechanism's goal, but BIA does the translation between the IPv4 APIs and the IPv6 APIs instead π₯ So the goal gets achieved without any IP header translation, which is honestly iconic π
Table of Contents π
1. Introduction ................................................ 2
2. Applicability and Disclaimer ................................ 3
2.1 Applicability ............................................... 3
2.2 Disclaimer .................................................. 4
3. Dual Stack Host Architecture Using BIA ...................... 4
3.1 Function Mapper ............................................. 4
3.2 Name Resolver ............................................... 5
3.3 Address Mapper .............................................. 5
4. Behavior Example ............................................ 6
4.1 Originator Behavior ......................................... 6
4.2 Recipient Behavior .......................................... 8
5. Considerations ............................................. 10
5.1 Socket API Conversion ....................................... 10
5.2 ICMP Messages Handling ...................................... 10
5.3 IPv4 Address Pool and Mapping Table ......................... 10
5.4 Internally Assigned IPv4 Addresses .......................... 10
5.5 Mismatch Between DNS Result and Peer Application Version .... 11
5.6 Implementation Issues ....................................... 11
6. Limitations ................................................. 12
7. Security Considerations ..................................... 12
8. Acknowledgments ............................................. 12
9. References .................................................. 12
Appendix: API list intercepted by BIA .......................... 14
Authors Addresses ............................................... 16
Full Copyright Statement ........................................ 17
1. Introduction π
Okay so RFC2767 [BIS] is the one that does host translation with a technique called "Bump-in-the-Stack" π§ It translates IPv4 into IPv6 and vice versa, using the IP conversion mechanism from [SIIT] π₯ BIS lets hosts talk to other IPv6 hosts using existing IPv4 apps, but the vibe is that it uses an API translator stuck between the TCP/IP module and the network card driver π So it has the same limitations as the [SIIT] based IP header translation methods, and its implementation depends on the network interface driver, which is a lot ngl π
So this document is the new mechanism for dual stack hosts, called Bump-in-the-API (BIA) π¦ The BIA technique slides an API translator between the socket API module and the TCP/IP module on the dual stack host π It translates IPv4 socket API functions into IPv6 socket API functions and the other way around πΈ With this, the translation is simpler because there's no IP header translation at all β¨
With BIA, the dual stack host assumes it has both TCP(UDP)/IPv4 and TCP(UDP)/IPv6 stacks on the local node π
When IPv4 apps on the dual stack talk to IPv6 hosts, the API translator spots the socket API functions coming from the IPv4 apps and invokes the IPv6 socket API functions to reach those IPv6 hosts, and vice versa π₯ To make IPv4 apps and the target IPv6 hosts able to communicate, pooled IPv4 addresses get assigned through the name resolver in the API translator π
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC 2119] π
This document uses terms defined in [IPv6], [TRANS-MECH] and [BIS] π«Ά
2. Applicability and Disclaimer π§
2.1 Applicability πΈ
So BIA's main purposes are the same as BIS [BIS] β¨ It makes IPv4 apps talk to IPv6 hosts without changing those IPv4 apps at all π The difference is that BIS is for systems with no IPv6 stack, while BIA is for systems that DO have an IPv6 stack, but where some apps aren't on IPv6 yet and the source code isn't available so nobody can port them π It's giving early adopters who don't have all their apps handy, but it's NOT for mainstream production usage π
There's an issue where a client node running BIA tries to contact a dual stack node on a port number that's only associated with an IPv4 application (see section 5.5) π There are 2 approaches:
- The client application SHOULD cycle through all the addresses and end up trying the IPv4 one.
- BIA SHOULD do the work.
It's not clear right now which behavior is desirable (it may very well be application dependent), so we need feedback from experimentation π¬π
2.2 Disclaimer π¨
BIA SHOULD NOT be used for an IPv4 application whose source code is available. We strongly recommend that application programmers SHOULD NOT use this mechanism when application source code is available. As well, it SHOULD NOT be used as an excuse not to port software or delay porting ππ«Ά Be better, port your code, periodt π
3. Dual Stack Host Architecture Using BIA ποΈ
Figure 1 shows the architecture of the host where BIA is installed π¦
+----------------------------------------------+
| +------------------------------------------+ |
| | | |
| | IPv4 applications | |
| | | |
| +------------------------------------------+ |
| +------------------------------------------+ |
| | Socket API (IPv4, IPv6) | |
| +------------------------------------------+ |
| +-[ API translator]------------------------+ |
| | +-----------+ +---------+ +------------+ | |
| | | Name | | Address | | Function | | |
| | | Resolver | | Mapper | | Mapper | | |
| | +-----------+ +---------+ +------------+ | |
| +------------------------------------------+ |
| +--------------------+ +-------------------+ |
| | | | | |
| | TCP(UDP)/IPv4 | | TCP(UDP)/IPv6 | |
| | | | | |
| +--------------------+ +-------------------+ |
+----------------------------------------------+
Figure 1 Architecture of the dual stack host using BIA π
Okay so dual stack hosts defined in RFC2893 [TRANS-MECH] need apps, TCP/IP modules and addresses for BOTH IPv4 and IPv6 π The hosts proposed in this doc have an API translator so they can talk to IPv6 hosts using existing IPv4 apps π That API translator is made of 3 modules: a name resolver, an address mapper, and a function mapper β¨
3.1 Function Mapper π§
This one translates an IPv4 socket API function into an IPv6 socket API function, and vice versa π₯
When it detects IPv4 socket API functions coming from IPv4 apps, it intercepts the function call and invokes new IPv6 socket API functions that correspond to those IPv4 ones π Those IPv6 API functions are used to talk to the target IPv6 hosts π¦ When it detects IPv6 socket API functions in data received from IPv6 hosts, it works symmetrically to the previous case π«Ά
3.2 Name Resolver πΈ
It returns a proper answer in response to the IPv4 application's request π
When an IPv4 app tries to resolve names via the resolver library (e.g. gethostbyname()), BIA intercepts the function call and calls the IPv6 equivalent functions instead (e.g. getnameinfo()) that will resolve both A and AAAA records π
If the AAAA record is available, it asks the address mapper to assign an IPv4 address corresponding to the IPv6 address β¨ Then it creates the A record for the assigned IPv4 address and returns that A record to the app π
3.3 Address Mapper π₯
It internally maintains a table of pairs of an IPv4 address and an IPv6 address π The IPv4 addresses come from an IPv4 address pool, and it uses the unassigned IPv4 addresses (e.g., 0.0.0.1 ~ 0.0.0.255) π§
When the name resolver or the function mapper asks it to assign an IPv4 address for an IPv6 address, it selects and returns an IPv4 address out of the pool and dynamically registers a new entry into the table π The registration happens in the following 2 cases:
(1) When the name resolver gets only an 'AAAA' record for the target host name and there is not a mapping entry for the IPv6 address.
(2) When the function mapper gets a socket API function call from the data received and there is not a mapping entry for the IPv6 source address.
NOTE: This is the same as that of the Address Mapper in [BIS]. π«Ά
4. Behavior Examples π¬
This section describes the behaviors of the proposed dual stack host called "dual stack", which talks to an IPv6 host called "host6" using an IPv4 application π
In this section, the arrows mean the following:
---> A DNS message for name resolving created by the applications
and the name resolver in the API translator.
+++> An IPv4 address request to and reply from the address mapper
for the name resolver and the function mapper.
===> Data flow by socket API functions created by the
applications and the function mapper in the API translator.
4.1 Originator Behavior
okay so this sub-section is all about what happens when the "dual stack" π sends data to "host6" β¨
when an IPv4 application sends a DNS query to its name server, the name resolver jumps in and intercepts it π¦ then makes a brand new query to resolve both A and AAAA records. if only the AAAA record comes back, the name resolver asks the address mapper to assign an IPv4 address that matches the IPv6 address.
the name resolver creates an A record for that assigned IPv4 address and hands it back to the IPv4 applications π
so for the IPv4 application to actually send IPv4 packets to host6, it calls the IPv4 socket API function π
the function mapper spots that socket API call coming from the application. if the call comes from IPv6 applications, it skips the translation π but for IPv4 applications it needs an IPv6 address to invoke the IPv6 socket API function, so the function mapper asks the address mapper for one. the address mapper picks an IPv4 address out of the table and returns the destination IPv6 address. using that IPv6 address, the function mapper invokes the IPv6 socket API function that matches the original IPv4 one π§
when the function mapper gets an IPv6 function call, it asks the address mapper for the IPv4 address so it can translate the IPv6 socket API function into an IPv4 socket API function. then it invokes the socket API function for the IPv4 applications π
Figure 2 illustrates the behavior described above:
"dual stack" "host6"
IPv4 Socket | [ API Translator ] | TCP(UDP)/IP Name
appli- API |Name Address Function| (v6/v4) Server
cation |Resolver Mapper Mapper |
| | | | | | | |
<<Resolve an IPv4 address for "host6".>> | | |
| | | | | | | |
|--------|------->| Query of 'A' records for host6. | |
| | | | | | | |
| | |--------|--------|---------|--------------|------>|
| | | Query of 'A' records and 'AAAA' for host6 |
| | | | | | | |
| | |<-------|--------|---------|--------------|-------|
| | | Reply with the 'AAAA' record. | |
| | | | | | |
| | |<<The 'AAAA' record is resolved.>> |
| | | | | | |
| | |+++++++>| Request one IPv4 address |
| | | | corresponding to the IPv6 address.
| | | | | | |
| | | |<<Assign one IPv4 address.>> |
| | | | | | |
| | |<+++++++| Reply with the IPv4 address. |
| | | | | | |
| | |<<Create 'A' record for the IPv4 address.>>
| | | | | | |
|<-------|--------| Reply with the 'A' record.| |
| | | | | | |
Figure 2 Behavior of the originator (1/2)
"dual stack" "host6"
IPv4 Socket | [ API Translator ] | TCP(UDP)/IP
appli- API |Name Address Function| (v6/v4)
cation |Resolver Mapper Mapper |
| | | | | | |
<<Call IPv4 Socket API function >> | | |
| | | | | | |
|========|========|========|=======>|An IPv4 Socket API function Call
| | | | | | |
| | | |<+++++++| Request IPv6 addresses|
| | | | | corresponding to the |
| | | | | IPv4 addresses. |
| | | | | | |
| | | |+++++++>| Reply with the IPv6 addresses.
| | | | | | |
| | | | |<<Translate IPv4 into IPv6.>>
| | | | | | |
| An IPv6 Socket API function call.|=========|=============>|
| | | | | | |
| | | | |<<Reply an IPv6 data |
| | | | | to dual stack.>> |
| | | | | | |
| An IPv6 Socket API function call.|<========|==============|
| | | | | | |
| | | | |<<Translate IPv6 into IPv4.>>
| | | | | | |
| | | |<+++++++| Request IPv4 addresses|
| | | | | corresponding to the |
| | | | | IPv6 addresses. |
| | | | | | |
| | | |+++++++>| Reply with the IPv4 addresses.
| | | | | | |
|<=======|========|========|========| An IPv4 Socket function call.
| | | | | | |
Figure 2 Behavior of the originator (2/2)
4.2 Recipient Behavior
this subsection covers the recipient side of "dual stack" πΈ and this time the communication is kicked off by "host6" π
"host6" resolves the address of "dual stack" with 'AAAA' records through its name server, and then sends an IPv6 packet to the "dual stack" π¦
the IPv6 packet reaches the "dual stack", and the function mapper detects it β¨
the function mapper asks the address mapper for the IPv4 address so it can invoke the IPv4 socket API function and talk to the IPv4 application. then the function mapper invokes the corresponding IPv4 socket API function for the IPv4 applications, matching up with the IPv6 functions π
Figure 3 illustrates the behavior described above:
"dual stack" "host6"
IPv4 Socket | [ API Translator ] | TCP(UDP)/IP
appli- API |Name Address Function| (v6/v4)
cation |Resolver Mapper Mapper |
| | | | | | |
<<Receive data from "host6".>> | | |
| | | | | | |
| An IPv6 Socket function call.|<========|==============|
| | | | | | |
| | | |<+++++++| Request IPv4 addresses|
| | | | | corresponding to the IPv6
| | | | | addresses. |
| | | | | | |
| | | |+++++++>| Reply with the IPv4 addresses.
| | | | | | |
| | | | |<<Translate IPv6 into IPv4.>>
| | | | | | |
|<=======|========|========|========| An IPv4 function call |
| | | | | | |
<<Reply an IPv4 data to "host6".>> | | |
| | | | | | |
|========|========|========|=======>| An IPv4 function call |
| | | | | | |
| | | | |<<Translate IPv4 into IPv6.>>
| | | | | | |
| | | |<+++++++| Request IPv6 addresses|
| | | | | corresponding to the IPv4
| | | | | addresses. |
| | | | | | |
| | | |+++++++>| Reply with the IPv6 addresses.
| | | | | | |
| An IPv6 Socket function call.|=========|=============>|
| | | | | | |
Figure 3 Behavior of Receiving data from IPv6 host
5. Considerations
5.1 Socket API Conversion
IPv4 socket API functions get translated into semantically the same IPv6 socket API functions, and vice versa π the list of APIs that BIA intercepts is in Appendix A. IP addresses embedded in application layer protocols (e.g., FTP) can be translated within API functions. how that works depends on the operating system π₯οΈ
NOTE: Basically, IPv4 socket API functions are not fully compatible with IPv6 since the IPv6 has new advanced features. π
5.2 ICMP Message Handling
when an application needs ICMP message values (e.g., Type, Code, etc.) from a network layer, ICMPv4 message values MAY be translated into ICMPv6 message values based on [SIIT], and vice versa π«Ά this can be implemented using a raw socket π
5.3 IPv4 Address Pool and Mapping Table
the address pool is made up of the unassigned IPv4 addresses πΈ the pool can be set up at different granularity on the node, like one pool per node, or something finer such as per user or per process. but if a bunch of IPv4 applications talk to IPv6 hosts, the available address space will run out π then IPv4 applications won't be able to talk to IPv6 nodes at all. so the pool needs smart management. for example, it's desirable for the mapper to free the oldest entry and reuse that IPv4 address for a new entry π§ this is the same issue as [BIS]. with a per-node address mapping table, there MAY be a larger risk of running out of addresses π
5.4 Internally Assigned IPv4 Addresses
the IPv4 addresses that get assigned internally to IPv6 target hosts come out of the pool, and they're unassigned IPv4 addresses (e.g., 0.0.0.1 ~ 0.0.0.255) β¨ there's no potential collision with another use of the private address space once the IPv4 address flows out from the host π
5.5 Mismatch between DNS result(AAAA) and Peer Application Version(v4) π
okay so, picture this π₯Ί a server app that isn't IPv6-ready yet is chilling on a machine that does do other IPv6 services, and that machine has an AAAA record in DNS. now an IPv4 client app using BIA might fail to connect, because the DNS answer says AAAA (IPv6) but the server app is IPv4. total mismatch, bestie π
the fix is to try all the addresses DNS gives back and not just faceplant after the first attempt π«Ά there are two approaches. the client application itself SHOULD cycle through all the addresses and end up trying the IPv4 one. Or it SHOULD be done by some extensions of name resolver and API translator in BIA. For this, BIA SHOULD do iterated jobs for finding the working address used by the other application out of addresses returned by the extended name resolver. it may very well be application dependent πΈ
ngl this is the part that gets interesting. BIA might be able to do the iteraction over all addresses for TCP sockets, since BIA can observe when the connect call fails β¨ but for UDP sockets it is hard if not impossible for BIA to know which address worked. so, hence, the application must do the iteraction over all addresses until it finds a working address π¦
another way to dodge this whole drama is to make BIA only come into effect when no A records exist for the peer. thus traffic from an application using BIA on a dual-stack host to a dual-stack host would use IPv4 π
5.6 Implementation Issues π§
some operating systems support the preload library functions, so it is easy to implement the API translator by using it π for example, the user can replace all existing socket API functions with user-defined socket API functions which translate the socket API function. in this case, every IPv4 application has its own translation library using a preloaded library which will be bound into the application before executing it dynamically.
other operating systems support the user-defined layered protocol, which lets a user develop some additional protocols and put them in the existing protocol stack. in this case, the API translator can be implemented as a layered protocol module π
in the above two approaches, it is assumed that there exists both TCP(UDP)/IPv4 and TCP(UDP)/IPv6 stacks, and there is no need to modify or to add a new TCP-UDP/IPv6 stack π
6. Limitations π
in common with [NAT-PT], BIA needs to translate IP addresses embedded in application layer protocols, e.g., FTP. so it may not work for new applications which embed addresses in payloads π
this mechanism supports unicast communications only. in order to support multicast functions, some other additional functionalities must be considered in the function mapper module π
since the IPv6 API has new advanced features, it is difficult to translate such kinds of IPv6 APIs into IPv4 APIs. thus, IPv6 inbound communication with advanced features may be discarded π
7. Security Considerations π₯
the security story here is serious, bestie. read it twice π
the security consideration of BIA mostly relies on that of [NAT-PT]. the differences are due to the address translation occurring at the API and not in the network layer. that is, since the mechanism uses the API translator at the socket API level, hosts can utilize the security of the network layer (e.g., IPsec) when they communicate with IPv6 hosts using IPv4 applications via the mechanism. as well, there isn't a DNS ALG as in NAT-PT, so there is no interference with DNSSEC β¨
the use of address pooling may open a denial of service attack vulnerability. so BIA should employ the same sort of protection techniques as [NAT-PT] does π¨
8. Acknowledgments π«Ά
we would like to acknowledge the implementation contributions by Wanjik Lee (wjlee@arang.miryang.ac.kr) and i2soft Corporation (www.i2soft.net) π
9. References π
- [TRANS-MECH] Gilligan, R. and E. Nordmark, "Transition Mechanisms for IPv6 Hosts and Routers", RFC 2893, August 2000.
- [SIIT] Nordmark, E., "Stateless IP/ICMP Translator (SIIT)", RFC 2765, February 2000.
- [FTP] Postel, J. and J. Reynolds, "File Transfer Protocol", STD 9, RFC 959, October 1985.
- [NAT] Srisuresh, P. and K. Egevang, "Traditional IP Network Address Translator (Traditional NAT)", RFC 3022, January 2001.
- [IPV4] Postel, J., "Internet Protocol", STD 5, RFC 791, September 1981.
- [IPV6] Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", RFC 2460, December 1998.
- [NAT-PT] Tsirtsis, G. and P. Srisuresh, "Network Address Translation - Protocol Translation (NAT-PT)", RFC 2766, February 2000.
- [BIS] Tsuchiya, K., Higuchi, H. and Y. Atarashi, "Dual Stack Hosts using the "Bump-In-the-Stack" Technique (BIS)", RFC 2767, February 2000.
- [SOCK-EXT] Gilligan, R., Thomson, S., Bound, J. and W. Stevens, "Basic Socket Interface Extensions for IPv6", RFC 2553, March 1999.
- [RFC 2119] Bradner S., "Key words for use in RFCs to indicate Requirement Levels", RFC 2119, March 1997.
Appendix A : API list intercepted by BIA π¦
the following functions are the API list which SHOULD be intercepted by BIA module π
the functions that the application uses to pass addresses into the system are:
bind()
connect()
sendmsg()
sendto()
the functions that return an address from the system to an application are:
accept()
recvfrom()
recvmsg()
getpeername()
getsockname()
the functions that are related to socket options are:
getsocketopt()
setsocketopt()
the functions that are used for conversion of IP addresses embedded in application layer protocol (e.g., FTP, DNS, etc.) are:
recv()
send()
read()
write()
as well, raw sockets for IPv4 and IPv6 MAY be intercepted β¨
most of the socket functions require a pointer to the socket address structure as an argument. each IPv4 argument is mapped into corresponding an IPv6 argument, and vice versa π
according to [SOCK-EXT], the following new IPv6 basic APIs and structures are required:
IPv4 new IPv6
------------------------------------------------
AF_INET AF_INET6
sockaddr_in sockaddr_in6
gethostbyname() getaddrinfo()
gethostbyaddr() getnameinfo()
inet_ntoa()/inet_addr() inet_pton()/inet_ntop()
INADDR_ANY in6addr_any
BIA MAY intercept inet_ntoa() and inet_addr() and use the address mapper for those. doing that enables BIA to support literal IP addresses πΈ
the gethostbyname() call returns a list of addresses. when the name resolver function invokes getaddrinfo() and getaddrinfo() returns multiple IP addresses, whether IPv4 or IPv6, they SHOULD all be represented in the addresses returned by gethostbyname(). thus if getaddrinfo() returns multiple IPv6 addresses, this implies that multiple address mappings will be created; one for each IPv6 address π
Authors' Addresses π·
Seungyun Lee
ETRI PEC
161 Kajong-Dong, Yusong-Gu, Taejon 305-350, Korea
Tel: +82 42 860 5508
Fax: +82 42 861 5404
EMail: syl@pec.etri.re.kr
Myung-Ki Shin
ETRI PEC
161 Kajong-Dong, Yusong-Gu, Taejon 305-350, Korea
Tel: +82 42 860 4847
Fax: +82 42 861 5404
EMail: mkshin@pec.etri.re.kr
Yong-Jin Kim
ETRI
161 Kajong-Dong, Yusong-Gu, Taejon 305-350, Korea
Tel: +82 42 860 6564
Fax: +82 42 861 1033
EMail: yjkim@pec.etri.re.kr
Alain Durand
Sun Microsystems, inc.
25 Network circle
Menlo Park, CA 94025, USA
Fax: +1 650 786 5896
EMail: Alain.Durand@sun.com
Erik Nordmark
Sun Microsystems Laboratories
180, avenue de l'Europe
38334 SAINT ISMIER Cedex, France
Tel: +33 (0)4 76 18 88 03
Fax: +33 (0)4 76 18 88 88
EMail: erik.nordmark@sun.com
Full Copyright Statement βοΈ
Copyright (C) The Internet Society (2002). All Rights Reserved.
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement π
Funding for the RFC Editor function is currently provided by the Internet Society β¨
π¦ where this page comes from
- ietf: rfc3338 2002-10
- π girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms