[32220] in bugtraq
Re: possible issue with IPv4 mapped address and $REMOTE_ADDR in CGI
daemon@ATHENA.MIT.EDU (der Mouse)
Wed Oct 29 13:55:58 2003
From: der Mouse <mouse@Rodents.Montreal.QC.CA>
Message-Id: <200310291814.NAA18908@Sparkle.Rodents.Montreal.QC.CA>
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Date: Wed, 29 Oct 2003 13:06:55 -0500 (EST)
To: bugtraq@securityfocus.com
In-Reply-To: <20031029170147.GA8692@carbon.redbrick.dcu.ie>
> Now consider the logic required if you allow the use of mapped
> addresses; [...]
> It must be noted that this approach is generally simpler (and to my
> mind, less error-prone), portable (certainly within *nix, though not
> win32) and AF forwards-compatible.
It's AF forwards-compatible only if every new AF includes a
mapped-addresses version of all previous ones.
I don't expect this to be true. Indeed, it isn't now, as far as I can
tell, unless you restrict yourself to INET and INET6.
Also, note that the application can get whichever set of semantics it
prefers by explicitly setting the V6ONLY option on the socket; the
tempest in a teapot is strictly about which way the default should be -
and since there are OSes that disagree on the default, well-written
application code won't depend on the default, instead explicitly
setting the option whenever doing things the option affects.
/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML mouse@rodents.montreal.qc.ca
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B
