netdev - Re: netstat and dual stack sockets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20150616012538.05160213DD@mail.nwl.cc>
Date:	Tue, 16 Jun 2015 03:25:53 +0200
From:	Phil Sutter <phil@....cc>
To:	Hagen Paul Pfeifer <hagen@...u.net>
Cc:	netdev <netdev@...r.kernel.org>
Subject: Re: netstat and dual stack sockets

HGN!

On Mon, Jun 15, 2015 at 11:36:54PM +0200, Hagen Paul Pfeifer wrote:
> On 15 June 2015 at 22:54, Phil Sutter <phil@....cc> wrote:
> 
> > As I see it, a user has no way of detecting the listening socket in this
> > address family: it does not show in /proc/net/{tcp,udp} nor do
> > 'netstat', 'ss' or 'lsof' print any additional information about those
> > sockets over pure IPv6 ones.
> 
> Probably a combination of IPV6_V6ONLY(1, 0) and IN6_IS_ADDR_V4MAPPED
> fulfills all user requirements, ... so far. Your proposal is to hand
> over sk->sk_ipv6only?

Not sure if I understand you correctly - of course it is possible to
programmatically determine whether a socket one has opened accepts
v4mapped addresses or a given address is v4mapped. My concern is about
the system administrator's point of view, using system tools to find out
on which IP addresses and ports a machine is accessible. Looking at e.g.
/proc/net/tcp6 does not reveal if a listening socket also accepts
v4mapped addresses, factually acting as AF_INET socket upon request.

Cheers, Phil
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html