Disable IPv4-mapped - enforce IPV6_V6ONLY

Hello,

I'm searching for a way to either enforce IPV6_V6ONLY or to block IPv4-mapped addresses on ipv6-sockets (e.g. by using iptables) system-wide.

E.g. net.ipv6.bindv6only doesn't help if something calls

int v6on = 0;
setsockopt(sd, IPPROTO_IPV6, IPV6_V6ONLY, (char *)&v6on, sizeof(v6on))

In such a case I still want to disable or block IPv4-mapped addresses on that socket, even if the program thinks it nows it better.

Until now I haven't found a solution.

Am 22.02.2013 16:21, schrieb Alexander Holler:

Quoted 7 lines

Hello,

I'm searching for a way to either enforce IPV6_V6ONLY or to block IPv4-mapped addresses on ipv6-sockets (e.g. by using iptables) system-wide.

E.g. net.ipv6.bindv6only doesn't help if something calls

Quoted 7 lines

int v6on = 0;
setsockopt(sd, IPPROTO_IPV6, IPV6_V6ONLY, (char *)&v6on, sizeof(v6on))

In such a case I still want to disable or block IPv4-mapped addresses on that socket, even if the program thinks it nows it better.

Until now I haven't found a solution.

I've now done it by the following hack:

-----------

net/ipv6/ipv6_sockglue.c +1 -2

index d1e2e8e..9eefd3e 100644
@@ -235,7 +235,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                if (optlen < sizeof(int) ||
                    inet_sk(sk)->inet_num)
                        goto e_inval;
-               np->ipv6only = valbool;
+               np->ipv6only = valbool || net->ipv6.sysctl.bindv6only;
                retv = 0;
                break;
-----------

A proper solution would be to either return false if net.ipv6.bindv6only is true and optval is false (which would break downward compatibility because it wouldn't just be a default and setsockopt might return an error) or to introduce a new sysctl variable like net.ipv6.bindv6only_enforced_silently. ("silently" because setsockopt() wouldn't return an error if net.ipv6.bindv6only is true and optval (v6only in the example above) is false.)

I would volunteer to write a patch which introduces something like net.ipv6.bindv6only_enforced_silently if some maintainer would give me his ok.

If so, the question remains if

systemctl net.ipv6.bindv6only_enforced_silently = 1

should set systemctl.net.ipv6.bindv6only too or if an error should be returned if net.ipv6.bindv6only is false.

Quoted 1 line

A proper solution would be to either return false if net.ipv6.bindv6only is true and optval is false

(which would break downward compatibility because it wouldn't just be a default and setsockopt might return an error) or to introduce a new sysctl variable like net.ipv6.bindv6only_enforced_silently. ("silently" because setsockopt() wouldn't return an error if net.ipv6.bindv6only is true and optval (v6only in the example above) is false.)

Quoted 2 lines

I would volunteer to write a patch which introduces something like

net.ipv6.bindv6only_enforced_silently if some maintainer would give me his ok.

Quoted 6 lines

If so, the question remains if

systemctl net.ipv6.bindv6only_enforced_silently = 1

should set systemctl.net.ipv6.bindv6only too or if an error should be returned if

net.ipv6.bindv6only is false.

I am not convinced why you need this, and I am not in favor of enfocing IPV6_V6ONLY, but... some points:

- We should allow system-admin to "enforce" IPV6_V6ONLY to 0 as well.
- CAP_NET_ADMIN users should always be able to use both modes (They can do sysctl anyway.)
- setsockopt should fail w/ EPERM if user tries to override.

Quoted 11 lines

Quoted 1 line

A proper solution would be to either return false if net.ipv6.bindv6only is true and optval is false

(which would break downward compatibility because it wouldn't just be a default and setsockopt might return an error) or to introduce a new sysctl variable like net.ipv6.bindv6only_enforced_silently. ("silently" because setsockopt() wouldn't return an error if net.ipv6.bindv6only is true and optval (v6only in the example above) is false.)

Quoted 2 lines

I would volunteer to write a patch which introduces something like

net.ipv6.bindv6only_enforced_silently if some maintainer would give me his ok.

Quoted 3 lines

If so, the question remains if

Quoted 7 lines

Quoted 3 lines

systemctl net.ipv6.bindv6only_enforced_silently = 1

should set systemctl.net.ipv6.bindv6only too or if an error should be returned if

net.ipv6.bindv6only is false.

I am not convinced why you need this, and I am not in favor of enfocing IPV6_V6ONLY, but... some points:

Quoted 5 lines

- We should allow system-admin to "enforce" IPV6_V6ONLY to 0 as well.
- CAP_NET_ADMIN users should always be able to use both modes (They can do sysctl anyway.)
- setsockopt should fail w/ EPERM if user tries to override.

I can imagine that some programs will always try to clear IPV6_V6ONLY (maybe for portability with other OS which default to setting it for security reasons) and will error-exit if it fails.
So non-silent enforcing could be a PITA.

You really don't want to (globally) stop an application setting IPV6_V6ONLY, such a program may well be creating separate IPv4 and IPv6 sockets.

Some of this needs to be part of some application wide 'security' framework - that probably doesn't exist!

Should there also be similar controls for the use of IPv4 mapped addresses in actual on-the-wire IPv6 packets - eg those destined for a remote gateway on an IPv6 only system?