Subject: RFC1933 IPv4 mapped address
To: None <tech-net@netbsd.org>
From: None <itojun@iijlab.net>
List: tech-net
Date: 12/19/1999 14:01:36
RFC1933 defines IPv4 mapped address in IPv6 address space.
This address is formed like "::ffff:10.1.1.1".
The address is to be able to manipulate IPv4 traffic via AF_INET6
socket. For example, if IPv4 traffic comes in and there's only
AF_INET6 socket, the traffic will come into AF_INET6 socket.
IPv4(s->d) TCP payload
v tcp_input
accepted by to AF_INET6 socket, as if peername=::ffff:s,
myname=::ffff:d
This was defined in RFC1933 to help some of porting effort.
if you change bind(AF_INET) into bind(AF_INET6), you are *almost* done.
(the reason for "almost" is buffer size of get{peer,sock}name,
differences in setsockopt allowed on the socket, name resolution,
whatever). actually I know almost no appliation ported to be IPv6
ready this way.
For security perspective this is very wrong thing to support. For
example, even if you think you have disabled IPv4 traffic by
/etc/inetd.conf (running service on "tcp6" only) and /etc/hosts.deny
(denying any IPv4 traffic), you are not covered (IPv4 traffic will
be accepted by a daemon on "tcp6", as if it was from ::ffff:10.1.1.1).
I'm favor of disabling it (allow enabling it by sysctl, or completely
disable it). Opinions/suggestions?
itojun