Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

eBPF Mystery: When is IPv4 not IPv4? When it's pretending to be IPv6

blog.gripdev.xyz

Post reply on HN
Print view View original

21–30 of 35 posts

Re: eBPF Mystery: When is IPv4 not IPv4? When it's pretending to be IPv6

#21

Post by aaronmdjones »

eqvinox wrote: post #18
zzq1015 wrote: post #12

For Linux, there's a kernel setting for that. Just run sysctl -w net.ipv6.bindv6only=1 so IPv6 will not include IPv4-mapped addresses. https://www.kernel.org/doc/Documentation/networking/ip-sysct...

This affects -to my best knowledge- only bind()ing, not outgoing connect()ing. As the name implies, really. (I should try this, not entirely sure tbh.) It won't help you though if the resolver library gives you a ::ffff:ma.p.p.ed address (yes they can do that), then you just fail to connect…

I did try this. connect(2) with an IPv4-mapped IPv6 address on an AF_INET6 socket with IPV6_V6ONLY set on it fails.

Re: eBPF Mystery: When is IPv4 not IPv4? When it's pretending to be IPv6

#22

Post by mfro »

Almondsetat wrote: post #20

>I thought I must have this wrong, surely you can’t just smash an ipv4 address in ipv6 field and magic happens?! Nope, didn’t have it wrong, that’s what happens. Linux supports this, and will go on to route the request as IPv4. I mean... it's literally one of the officially defined unicast IPv6 address types. If you ever read the Wikipedia page to learn about what link-local, global unicast, etc. addresses are you su…

Not everyone spends their days digging through networking specifications. I for one earned CCENT and CCNA certifications was entirely unaware of this mechanism.

Re: eBPF Mystery: When is IPv4 not IPv4? When it's pretending to be IPv6

#23

Post by Almondsetat »

mfro wrote: post #22
Almondsetat wrote: post #20

>I thought I must have this wrong, surely you can’t just smash an ipv4 address in ipv6 field and magic happens?! Nope, didn’t have it wrong, that’s what happens. Linux supports this, and will go on to route the request as IPv4. I mean... it's literally one of the officially defined unicast IPv6 address types. If you ever read the Wikipedia page to learn about what link-local, global unicast, etc. addresses are you su…

Not everyone spends their days digging through networking specifications. I for one earned CCENT and CCNA certifications was entirely unaware of this mechanism.

What a bad faith response.

If you are searching for information about IPv6 (as the author of the post was doing for their endeavor) the Wikipedia page will be among the first things you will look at. And if the Wikipedia page clearly states this information then not only is it reasonable to expect someone to find it, but it's very far from "digging through specification"

Re: eBPF Mystery: When is IPv4 not IPv4? When it's pretending to be IPv6

#24

Post by mfro »

Almondsetat wrote: post #23
mfro wrote: post #22

Earlier quoted context omitted.

Not everyone spends their days digging through networking specifications. I for one earned CCENT and CCNA certifications was entirely unaware of this mechanism.

What a bad faith response. If you are searching for information about IPv6 (as the author of the post was doing for their endeavor) the Wikipedia page will be among the first things you will look at. And if the Wikipedia page clearly states this information then not only is it reasonable to expect someone to find it, but it's very far from "digging through specification"

...the author of the post linked a wikipedia article about the mechanism in their article. That is how they found out about it. What point are you even trying to make?

Re: eBPF Mystery: When is IPv4 not IPv4? When it's pretending to be IPv6

#25

Post by lotharcable »

mfro wrote: post #22
Almondsetat wrote: post #20

>I thought I must have this wrong, surely you can’t just smash an ipv4 address in ipv6 field and magic happens?! Nope, didn’t have it wrong, that’s what happens. Linux supports this, and will go on to route the request as IPv4. I mean... it's literally one of the officially defined unicast IPv6 address types. If you ever read the Wikipedia page to learn about what link-local, global unicast, etc. addresses are you su…

Not everyone spends their days digging through networking specifications. I for one earned CCENT and CCNA certifications was entirely unaware of this mechanism.

If you are going to do weird shoot-self-foot things with writing custom EBF scripts to do ill advised network traffic manipulations things then it is probably a good idea to pay attention to RFCs.

I mean I have a small book of notes I built up based on various network RFCs and I am don't even have a CCENT and CCNA certifications.

This sort of thing isn't unreasonable.

Of course this isn't a dunk on the author of the article (except the part about doing weird DNS games, which sounds like a nightmare for whoever needs to figure out what he did months or years from now). Everybody has run into situations were they think they know how something works and it turns out they are wrong and get a nasty surprise from it.

Re: eBPF Mystery: When is IPv4 not IPv4? When it's pretending to be IPv6

#26

Post by arccy »

mfro wrote: post #22
Almondsetat wrote: post #20

>I thought I must have this wrong, surely you can’t just smash an ipv4 address in ipv6 field and magic happens?! Nope, didn’t have it wrong, that’s what happens. Linux supports this, and will go on to route the request as IPv4. I mean... it's literally one of the officially defined unicast IPv6 address types. If you ever read the Wikipedia page to learn about what link-local, global unicast, etc. addresses are you su…

Not everyone spends their days digging through networking specifications. I for one earned CCENT and CCNA certifications was entirely unaware of this mechanism.

maybe it just means those a pretty worthless certs focused on training you to shill for cisco instead of teaching you actually important network concepts...

Re: eBPF Mystery: When is IPv4 not IPv4? When it's pretending to be IPv6

#27

Post by brewmarche »

You need to be a bit careful with terminology, IPv4-compatible and IPv4-mapped are different, i.e. ::/96 vs. ::ffff:0:0/96.

The former (compatible) are not in use anymore, they were specified in an old tunnelling RFC. The latter (mapped) are used for sockets that bind to both IPv4 and IPv6.

There are even more ways to include IPv4 addresses in IPv6 ones (NAT64, 6to4, ...)

Re: eBPF Mystery: When is IPv4 not IPv4? When it's pretending to be IPv6

#28

Post by mfro »

arccy wrote: post #26
mfro wrote: post #22

Earlier quoted context omitted.

Not everyone spends their days digging through networking specifications. I for one earned CCENT and CCNA certifications was entirely unaware of this mechanism.

maybe it just means those a pretty worthless certs focused on training you to shill for cisco instead of teaching you actually important network concepts...

No, it means I didn't spend any time on a random specification that will rarely be seen in a production environment. I feel I gained a lot of networking knowledge.

Re: eBPF Mystery: When is IPv4 not IPv4? When it's pretending to be IPv6

#29

Post by eqvinox »

aaronmdjones wrote: post #21
eqvinox wrote: post #18

Earlier quoted context omitted.

This affects -to my best knowledge- only bind()ing, not outgoing connect()ing. As the name implies, really. (I should try this, not entirely sure tbh.) It won't help you though if the resolver library gives you a ::ffff:ma.p.p.ed address (yes they can do that), then you just fail to connect…

I did try this. connect(2) with an IPv4-mapped IPv6 address on an AF_INET6 socket with IPV6_V6ONLY set on it fails.

Very good to know, Thanks for trying!

Re: eBPF Mystery: When is IPv4 not IPv4? When it's pretending to be IPv6

#30

Post by jcalvinowens »

zzq1015 wrote: post #12

For Linux, there's a kernel setting for that. Just run sysctl -w net.ipv6.bindv6only=1 so IPv6 will not include IPv4-mapped addresses. https://www.kernel.org/doc/Documentation/networking/ip-sysct...

It's important to emphasize it only changes the default behavior: unprivileged programs can still use setsockopt(..., IPPROTO_IPV6, IPV6_V6ONLY, ...) to override it. That's not a terribly uncommon thing to do, since different distros have historically used different defaults for the sysctl: you'll have to handle it either way.
Post reply on HN