netdev - Re: Disable IPv4-mapped - enforce IPV6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 23 Feb 2013 21:44:27 +0100
From:	Alexander Holler <holler@...oftware.de>
To:	netdev@...r.kernel.org
CC:	linux-kernel@...r.kernel.org
Subject: Re: Disable IPv4-mapped - enforce IPV6_V6ONLY

Am 22.02.2013 16:21, schrieb Alexander Holler:
> Hello,
>
> I'm searching for a way to either enforce IPV6_V6ONLY or to block
> IPv4-mapped addresses on ipv6-sockets (e.g. by using iptables) system-wide.
>
> E.g. net.ipv6.bindv6only doesn't help if something calls
>
> int v6on = 0;
> setsockopt(sd, IPPROTO_IPV6, IPV6_V6ONLY, (char *)&v6on, sizeof(v6on))
>
> In such a case I still want to disable or block IPv4-mapped addresses on
> that socket, even if the program thinks it nows it better.
>
> Until now I haven't found a solution.

I've now done it by the following hack:

-----------
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index d1e2e8e..9eefd3e 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -235,7 +235,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int 
level, int optname,
                 if (optlen < sizeof(int) ||
                     inet_sk(sk)->inet_num)
                         goto e_inval;
-               np->ipv6only = valbool;
+               np->ipv6only = valbool || net->ipv6.sysctl.bindv6only;
                 retv = 0;
                 break;
-----------

A proper solution would be to either return false if net.ipv6.bindv6only 
is true and optval is false (which would break downward compatibility 
because it wouldn't just be a default and setsockopt might return an 
error) or to introduce a new sysctl variable like 
net.ipv6.bindv6only_enforced_silently. ("silently" because setsockopt() 
wouldn't return an error if net.ipv6.bindv6only is true and optval 
(v6only in the example above) is false.)

I would volunteer to write a patch which introduces something like 
net.ipv6.bindv6only_enforced_silently if some maintainer would give me 
his ok.

If so, the question remains if

systemctl net.ipv6.bindv6only_enforced_silently = 1

should set systemctl.net.ipv6.bindv6only too or if an error should be 
returned if net.ipv6.bindv6only is false.

Regards,

Alexander
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html