Skip to main content
Information Security

Return to Question

replaced http://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
Source Link
Community Bot
Community Bot
  • 1

The FreeBSD man page for inet6 has the following:

By default, FreeBSD does not route IPv4 traffic to AF_INET6 sockets. The default behavior intentionally violates RFC2553 for security reasons. Listen to two sockets if you want to accept both IPv4 and IPv6 traffic. IPv4 traffic may be routed with certain per-socket/per-node configuration, however, it is not recommended to do so. Consult ip6(4) for details.

OpenBSD also has a similar wording in its man page

For security reasons, OpenBSD does not route IPv4 traffic to an AF_INET6 socket, and does not support IPv4 mapped addresses, where IPv4 traffic is seen as if it comes from an IPv6 address like ::ffff:10.1.1.1. Where both IPv4 and IPv6 traffic need to be accepted, listen on two sockets.

This is referencing section 3.7 of RFC2553section 3.7 of RFC2553 (obsoleted by RFC3493RFC3493) regarding IPv4 addresses being translated into ::FFFF:<IPv4-address>.

What I don't understand is what kind of security issues would be exposed by accepting IPv4 connections? What makes a translated IPv4 address less secure than any other IPv6 address? And why does Linux allow such "insecure" behavior?

The FreeBSD man page for inet6 has the following:

By default, FreeBSD does not route IPv4 traffic to AF_INET6 sockets. The default behavior intentionally violates RFC2553 for security reasons. Listen to two sockets if you want to accept both IPv4 and IPv6 traffic. IPv4 traffic may be routed with certain per-socket/per-node configuration, however, it is not recommended to do so. Consult ip6(4) for details.

OpenBSD also has a similar wording in its man page

For security reasons, OpenBSD does not route IPv4 traffic to an AF_INET6 socket, and does not support IPv4 mapped addresses, where IPv4 traffic is seen as if it comes from an IPv6 address like ::ffff:10.1.1.1. Where both IPv4 and IPv6 traffic need to be accepted, listen on two sockets.

This is referencing section 3.7 of RFC2553 (obsoleted by RFC3493) regarding IPv4 addresses being translated into ::FFFF:<IPv4-address>.

What I don't understand is what kind of security issues would be exposed by accepting IPv4 connections? What makes a translated IPv4 address less secure than any other IPv6 address? And why does Linux allow such "insecure" behavior?

The FreeBSD man page for inet6 has the following:

By default, FreeBSD does not route IPv4 traffic to AF_INET6 sockets. The default behavior intentionally violates RFC2553 for security reasons. Listen to two sockets if you want to accept both IPv4 and IPv6 traffic. IPv4 traffic may be routed with certain per-socket/per-node configuration, however, it is not recommended to do so. Consult ip6(4) for details.

OpenBSD also has a similar wording in its man page

For security reasons, OpenBSD does not route IPv4 traffic to an AF_INET6 socket, and does not support IPv4 mapped addresses, where IPv4 traffic is seen as if it comes from an IPv6 address like ::ffff:10.1.1.1. Where both IPv4 and IPv6 traffic need to be accepted, listen on two sockets.

This is referencing section 3.7 of RFC2553 (obsoleted by RFC3493) regarding IPv4 addresses being translated into ::FFFF:<IPv4-address>.

What I don't understand is what kind of security issues would be exposed by accepting IPv4 connections? What makes a translated IPv4 address less secure than any other IPv6 address? And why does Linux allow such "insecure" behavior?

Tweeted twitter.com/#!/StackSecurity/status/612326750283038721
Source Link
imgx64
imgx64
  • 1.4k
  • 2
  • 13
  • 10

Is receiving IPv4 connections on AF_INET6 sockets insecure?

The FreeBSD man page for inet6 has the following:

By default, FreeBSD does not route IPv4 traffic to AF_INET6 sockets. The default behavior intentionally violates RFC2553 for security reasons. Listen to two sockets if you want to accept both IPv4 and IPv6 traffic. IPv4 traffic may be routed with certain per-socket/per-node configuration, however, it is not recommended to do so. Consult ip6(4) for details.

OpenBSD also has a similar wording in its man page

For security reasons, OpenBSD does not route IPv4 traffic to an AF_INET6 socket, and does not support IPv4 mapped addresses, where IPv4 traffic is seen as if it comes from an IPv6 address like ::ffff:10.1.1.1. Where both IPv4 and IPv6 traffic need to be accepted, listen on two sockets.

This is referencing section 3.7 of RFC2553 (obsoleted by RFC3493) regarding IPv4 addresses being translated into ::FFFF:<IPv4-address>.

What I don't understand is what kind of security issues would be exposed by accepting IPv4 connections? What makes a translated IPv4 address less secure than any other IPv6 address? And why does Linux allow such "insecure" behavior?