TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

IPv6 Transition Support

14 posts · Sep 2011 – Feb 2024

What this trail covers

Cloudflare's platform has evolved to support IPv6 transition by reducing internal and egress use of IPv4 addresses. This includes investigating and optimizing the performance of TCP connect() syscalls, particularly the port selection algorithm (__inet_hash_connect()), to improve efficiency when establishing a large number of connections. The goal is to minimize the number of source IPv4 addresses required for services like the cache, thereby reducing operational costs and improving performance. The Automatic IPv6 Gateway was launched, enabling users to access IPv6-only content from IPv4 networks and vice-versa, with options for full subdomain enablement or specific IPv6-only subdomains.

All Cloudflare trails
  1. connect() - why are you so slow?This post details an investigation into the performance of the TCP connect() syscall, specifically focusing on the `__inet_hash_connect()` function in Linux. The analysis reveals a bimodal distribution in connection latency, attributed to the port selection algorithm's preference for even ports when the port range starts with an even number. Experiments show that using a single IPv4 address can introduce significant latency compared to using two, and that the disparity between even and odd port allocation is a key bottleneck. The post also introduces the `IP_LOCAL_PORT_RANGE` socket option as a potential avenue for optimization.
  2. Using DNS to estimate the worldwide state of IPv6 adoptionThis post details an experiment using DNS query data from 1.1.1.1 to estimate server-side IPv6 adoption. It compares client-side adoption metrics from HTTP traffic (around 36%) with DNS query volume (around 30.5% AAAA queries) and server response rates for AAAA records (around 25-30%). The analysis highlights a gap between client readiness and server readiness for IPv6 connections, suggesting that while clients are increasingly IPv6-capable, servers are not keeping pace, impacting the overall ability to utilize IPv6 for connections.
  3. Amazon’s $2bn IPv4 tax — and how you can avoid paying itThis post details how Cloudflare can help customers avoid AWS's new IPv4 charges by facilitating a transition to IPv6. It explains the technical reasons for IPv4 exhaustion and the benefits of IPv6, then provides a step-by-step guide for enabling IPv6 compatibility within Cloudflare and configuring AWS for IPv6 origins. It also outlines how to update Cloudflare DNS with AAAA records and offers a $43 credit for eligible customers who transition.
  4. Cloudflare's handling of a bug in interpreting IPv4-mapped IPv6 addressesThis post details a vulnerability where a bug in Cloudflare's internal DNS system and HTTP proxy allowed bypass of network policies and access to loopback/internal IPs via IPv4-mapped IPv6 addresses. The DNS system incorrectly serialized IPv4-mapped IPv6 addresses, and the HTTP proxy incorrectly compared these addresses against the IPv6 deny list instead of the IPv4 deny list. A hotfix was deployed within hours to block the creation of malicious DNS records, followed by a permanent fix in the proxy service to correctly validate IP addresses against the appropriate deny lists. An investigation confirmed no prior exploitation.
  5. The tale of a single register valueThis post details a kernel crash caused by a bug in the IPv4 stack's handling of Generic Segmentation Offload (GSO) packets with encapsulated TCP traffic, specifically within the `skb_gso_transport_seglen()` function. The crash occurred due to an invalid memory access when calculating the inner TCP header length, likely caused by an underflow in the calculation of `skb->inner_transport_header - skb->transport_header`.
  7. Fixing an old hack - why we are bumping the IPv6 MTUThis post details the decision to increase the IPv6 MTU from a hardcoded 1280 bytes to 1400 bytes. This change was driven by the need to support UDP traffic for Cloudflare Spectrum, which requires a larger MTU for encapsulated packets. The post explains the original problem with ECMP routing and ICMP packet drops, the temporary fix of reducing the MTU, and the analysis of eyeball advertised MSS values for both IPv4 and IPv6 to inform the new MTU choice. It also discusses the trade-offs and monitoring of ICMPv6 Packet Too Big counters post-rollout.
  8. IPv6 in ChinaThis post details the significant growth of IPv6 users and traffic originating from Mainland China, specifically highlighting China Mobile's aggressive adoption and announcement of IPv6 address blocks. It discusses the necessity of IPv6 due to IPv4 exhaustion and the role of Carrier Grade NAT (CGN) and NAT64 as transitional solutions. The post observes China Mobile starting to announce IPv6 address blocks and exchanging IPv6 traffic, showing a significant percentage of IPv6 traffic in their Guangdong network.
  9. Less Is More - Why The IPv6 Switch Is MissingThis post details Cloudflare's move to mandatory IPv6 enablement for all domains, starting with free domains. It introduces a new DNS metatype (TYPE65535) being tested with OpenDNS to return both A and AAAA records in a single query, aiming to improve IPv6 adoption and performance by reducing DNS round trips and pre-populating global DNS caches. The post also highlights the success of previous efforts to enable IPv6 for millions of domains, bringing Cloudflare's enablement to 98.1%.
  10. 98.01% of sites on Cloudflare now use IPv6This post details the widespread adoption of IPv6 across Cloudflare's customer base, reporting that 98.01% of sites on Cloudflare now use IPv6. It highlights the performance benefits of IPv6, citing reduced connection times and faster page loads. The post analyzes the drivers of IPv6 adoption, including specific countries (Belgium, Ireland, India), major networks (Telenet, Facebook, Sprint), and devices (mobile vs. desktop, iOS vs. Android, Windows versions). It also notes the impact of operating systems and browsers on IPv6 traffic percentages and discusses the role of IPv6 in DDoS attacks. Cloudflare's proactive enablement of IPv6 for its customers is highlighted as a key factor in this growth, with data showing significant increases in IPv6 usage following their efforts. The post also touches on the IETF's evolving stance on IPv6 backward compatibility and the increasing usage of unique IPv6 addresses.
  11. Supporting the transition to IPv6-only networking services for iOSThis post details the challenges and solutions for iOS developers transitioning to IPv6-only networking services, driven by Apple's requirement for apps submitted after June 1, 2016. It explains the technical limitations of IPv4, the vast address space of IPv6, and the reasons for slow adoption. The post highlights common pitfalls for developers, such as using IP literals and network preflighting, and recommends using high-level networking frameworks. It also introduces Cloudflare's IPv6 features, including IPv6 Compatibility enablement and Pseudo IPv4 (with 'Add Header' and 'Overwrite Headers' options), to assist in this transition. Performance benefits observed by companies like Facebook and LinkedIn are also mentioned.
  12. iOS Developers — Migrate to iOS 9 with CloudFlareThis post announces that Cloudflare's existing IPv6 and HTTPS support is now a critical enabler for iOS 9 and OS X El Capitan developers due to Apple's new App Store submission requirements. It details how Cloudflare's free, automatic IPv6 gateway and Universal SSL (including TLS 1.2 and Forward Secrecy) directly address these new mandates, simplifying the migration process for developers by providing these protocols without requiring backend hosting provider support or complex certificate management. It also mentions the option for flexible SSL encryption between the app and Cloudflare if the backend does not support HTTPS.
  13. Four years later and CloudFlare is still doing IPv6 automaticallyThis post highlights Cloudflare's four years of providing automatic IPv6 support for customers, demonstrating its commitment to IPv6 transition. It showcases new graphs illustrating the growth of IPv6 adoption at the end-user level, mobile device usage of IPv6, and top countries for IPv6 traffic delivery, with a specific mention of Peru's high IPv6 traffic percentage. The post reiterates the importance of IPv6 due to IPv4 address depletion and Cloudflare's role in enabling this transition for all customers.
  14. Eliminating the last reasons to not enable IPv6Introduced Pseudo IPv4, a service that maps IPv6 connections to Class E IPv4 addresses via HTTP headers (`Cf-Pseudo-IPv4` or overwriting `Cf-Connecting-IP` and `X-Forwarded-For`). This addresses compatibility issues with legacy software that assumes IPv4. The implementation uses MD5 hashing on the top 64 bits of the IPv6 address to generate a unique pseudo IPv4 address, ensuring consistent mapping. A new header `Cf-Connecting-IPv6` is added when overwriting headers to preserve the original IPv6 address.
  15. Three years after World IPv6 DayThis post marks three years since World IPv6 Day and highlights Cloudflare's continued commitment to IPv6 adoption. It details the company's decision to make IPv6 the default setting for new and existing accounts, leading to increased IPv6 traffic and minimal support issues. The post also identifies a challenge with legacy systems hardcoding IPv4 addresses and introduces a 'pseudo IPv4' workaround to facilitate the transition. It notes that 20% of the IPv6 web uses Cloudflare's IPv6 services.
  16. I joined CloudFlare on Monday along with 5,000 othersThe author, a new "Network Strategy guy" at Cloudflare, discusses the company's commitment to IPv6. Cloudflare has been running an IPv4/IPv6 gateway for customers since 2012, making web properties available over both protocols. The default setting for new customers will be changed from 'IPv6 off' to 'IPv6 on' in the coming weeks. Existing customers will also be transitioned to IPv6-enabled by default in a staggered release. The author emphasizes the importance of IPv6 for the continued growth of the internet due to IPv4 address exhaustion.
  17. Happy IPv6 Day: Usage On the Rise, Attacks TooThis post details the growth of IPv6 usage on Cloudflare's network, highlighting that it has become one of the largest providers of the IPv6 web due to a free IPv6 gateway. It notes that IPv6 is enabled by default for over 1 million customers. The post also observes a marked increase in IPv6-based web attacks, primarily DDoS, and discusses the challenges IPv6 presents to IP-based blocklist strategies while also offering opportunities for more accurate allowlists.
  18. WSJ: CloudFlare Named Most Innovative Internet & Networking Company, Second Year in a RowThis post announces the launch of Cloudflare's Automatic IPv6 Gateway, a free service that allows customers to maintain their existing IPv4 infrastructure and be available on the IPv6 web. It highlights the challenge of IPv4 address exhaustion and the need for IPv6 interoperability. The service is credited with doubling the number of IPv6 websites available on the day of launch and making Cloudflare the largest provider of IPv6 connectivity to websites. The post also mentions Rocket Loader and Railgun as other innovative technologies launched in the past year.
  19. Why mobile performance is difficultThis post details the challenges of mobile network performance due to TCP's limitations with high latency and packet loss, and how Cloudflare customizes TCP stack parameters and classifies connections to optimize performance for mobile users.
  20. Global IPv6 Challenge: No More Excuses, Enable the FutureThis post announces World IPv6 Day and Cloudflare's challenge to enable IPv6 support. It details Cloudflare's free and easy IPv6 support via an Automatic IPv6 Gateway and encourages users to enable FULL IPv6 mode. It also introduces an IPv6 Network Testing app to gather data on ISP support and identify broken networks.
  21. CloudFlare Helping IPv6 Reach Escape VelocityThis post announces Cloudflare's participation in World IPv6 Launch and its commitment to enabling IPv6 for its products and services by June 2012. It highlights Cloudflare's existing IPv6 support, noting that 10% of IPv6-capable Alexa top 1 million websites use Cloudflare for IPv6 web service. The post aims to increase this percentage and asks for community suggestions on how to break the IPv6 chicken-or-egg problem, motivating ISPs and content providers to adopt IPv6.
  22. CloudFlare Expanding the IPv6 WebThis post highlights that approximately 10% of websites supporting IPv6 connections do so via Cloudflare's free Automatic IPv6 Gateway, indicating early adoption and contribution to IPv6 expansion.
  23. Introducing CloudFlare's Automatic IPv6 GatewayIntroduced the Automatic IPv6 Gateway, a free feature for all Cloudflare users, to bridge the incompatibility between IPv4 and IPv6 networks. This feature allows websites on Cloudflare to be accessible to the growing IPv6-only internet user base. Users can enable it via their Cloudflare Settings page, choosing between a 'FULL' option for all subdomains or a 'SAFE' option for specific IPv6-only subdomains. No DNS changes are required from the user.