ipv6 revision 4ac00f66832747f88c552904f7716571d3349d81
21b8c3cb46cea2b31a585a95ce9f93f4f6abc35brbbCopyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
21b8c3cb46cea2b31a585a95ce9f93f4f6abc35brbbCopyright (C) 2000, 2001 Internet Software Consortium.
9a0d076511763b559a755133f6a182e6c24ef643rbbSee COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
9a0d076511763b559a755133f6a182e6c24ef643rbbCurrently, there are multiple interesting problems with ipv6
9a0d076511763b559a755133f6a182e6c24ef643rbbimplementations on various platforms. These problems range from not
9a0d076511763b559a755133f6a182e6c24ef643rbbbeing able to use ipv6 with bind9 (or in particular the ISC socket
b42a7e46e4f80282bd27e96d43c9510b14ccb9aarbblibrary, contained in libisc) to listen-on lists not being respected,
b42a7e46e4f80282bd27e96d43c9510b14ccb9aarbbto strange warnings but seemingly correct behavior of named.
b42a7e46e4f80282bd27e96d43c9510b14ccb9aarbbCOMPILE-TIME ISSUES
b42a7e46e4f80282bd27e96d43c9510b14ccb9aarbb-------------------
6501b757f710f75d47c950300d8110aca67dc0b0rbbThe socket library requires a certain level of support from the
6501b757f710f75d47c950300d8110aca67dc0b0rbboperating system. In particular, it must follow the advanced ipv6
6501b757f710f75d47c950300d8110aca67dc0b0rbbsocket API to be usable. The systems which do not follow this will
dfd4950edac888e671b96f62ff5382b7cb350d48rbbcurrently not get any warnings or errors, but ipv6 will simply not
dfd4950edac888e671b96f62ff5382b7cb350d48rbbfunction on them.
dfd4950edac888e671b96f62ff5382b7cb350d48rbbThese systems currently include, but are not limited to:
a6d4b3f8d54aaf14d8ee5dda3a09bf8b6370dfa4wrowe AIX 3.4 (with ipv6 patches)
c9a95767fbf0f5fb0976a06b97a256033925e433rbbRUN-TIME ISSUES
c9a95767fbf0f5fb0976a06b97a256033925e433rbb---------------
d8d839738b1e80b0f9c54e83677b3f2c46c22705rbbIn the original drafts of the ipv6 RFC documents, binding an ipv6
d8d839738b1e80b0f9c54e83677b3f2c46c22705rbbsocket to the ipv6 wildcard address would also cause the socket to
d8d839738b1e80b0f9c54e83677b3f2c46c22705rbbaccept ipv4 connections and datagrams. When an ipv4 packet is
d8d839738b1e80b0f9c54e83677b3f2c46c22705rbbreceived on these systems, it is mapped into an ipv6 address. For
adaea88da2d103e4302e361c932b98cee86fb1c5rbbexample, 1.2.3.4 would be mapped into ::ffff:1.2.3.4. The intent of
9635d7ffbd8ca441f85051f9a3adba17142d0b20rbbthis mapping was to make transition from an ipv4-only application into
9635d7ffbd8ca441f85051f9a3adba17142d0b20rbbipv6 easier, by only requiring one socket to be open on a given port.
9635d7ffbd8ca441f85051f9a3adba17142d0b20rbbLater, it was discovered that this was generally a bad idea. For one,
d8d839738b1e80b0f9c54e83677b3f2c46c22705rbbmany firewalls will block connection to 1.2.3.4, but will let through
d8d839738b1e80b0f9c54e83677b3f2c46c22705rbb::ffff:1.2.3.4. This, of course, is bad. Also, access control lists
0415e5e1b9b6eba6899a2e5ef18f8facb8db0cfbstoddardwritten to accept only ipv4 addresses were suddenly ignored unless
0415e5e1b9b6eba6899a2e5ef18f8facb8db0cfbstoddardthey were rewritten to handle the ipv6 mapped addresses as well.
0415e5e1b9b6eba6899a2e5ef18f8facb8db0cfbstoddardPartly because of these problems, the latest IPv6 API introduces an
1374444b4fab1475091e12a81663f379b73005efrbbexplicit knob (the "IPV6_V6ONLY" socket option ) to turn off the ipv6
1374444b4fab1475091e12a81663f379b73005efrbbmapped address usage.
3233d057ad276d823bded5c24c3fd6729ed1a736rbbIn bind9, we first check if both the advanced API and the IPV6_V6ONLY
3233d057ad276d823bded5c24c3fd6729ed1a736rbbsocket option are available. If both of them are available, bind9
3233d057ad276d823bded5c24c3fd6729ed1a736rbbnamed will bind to the ipv6 wildcard port for both TCP and UDP.
9927a2a72d50103f32323b53f5fc4577c1801327rbbOtherwise named will make a warning and try to bind to all available
9927a2a72d50103f32323b53f5fc4577c1801327rbbipv6 addresses separately.
9927a2a72d50103f32323b53f5fc4577c1801327rbbIn any case, bind9 named binds to specific addresses for ipv4 sockets.
82d2eed8f2152aff3f7554951c133a9d404ebbc5rbbThe followings are historical notes when we always bound to the ipv6
82d2eed8f2152aff3f7554951c133a9d404ebbc5rbbwildcard port regardless of the availability of the API support.
82d2eed8f2152aff3f7554951c133a9d404ebbc5rbbThese problems should not happen with the closer checks above.
2e970b7ec485dde18f8fb3f494f98a3f68749859fanfIPV6 Sockets Accept IPV4, Specific IPV4 Addresses Bindings Fail
a5a7ecb732cfe89bb1f8e3c61b316c2075cefe52rbb---------------------------------------------------------------
a5a7ecb732cfe89bb1f8e3c61b316c2075cefe52rbbThe only OS which seems to do this is (some kernel versions of) linux.
364701a102725758f2e3a511924381e2faa93e27rbbIf an ipv6 socket is bound to the ipv6 wildcard socket, and a specific
364701a102725758f2e3a511924381e2faa93e27rbbipv4 socket is later bound (say, to 1.2.3.4 port 53) the ipv4 binding
364701a102725758f2e3a511924381e2faa93e27rbbWhat this means to bind9 is that the application will log warnings
364701a102725758f2e3a511924381e2faa93e27rbbabout being unable to bind to a socket because the address is already
0811e8a41d152f0016a385ce1dfa44f475425b70rbbin use. Since the ipv6 socket will accept ipv4 packets and map them,
0811e8a41d152f0016a385ce1dfa44f475425b70rbbhowever, the ipv4 addresses continue to function.
0811e8a41d152f0016a385ce1dfa44f475425b70rbbThe effect is that the config file listen-on directive will not be
957b9b3f5e47c6cc7c2d8d9e2224c7364e966c70rbbrespected on these systems.
957b9b3f5e47c6cc7c2d8d9e2224c7364e966c70rbbIPV6 Sockets Accept IPV4, Specific IPV4 Address Bindings Succeed
957b9b3f5e47c6cc7c2d8d9e2224c7364e966c70rbb----------------------------------------------------------------
e91c80d53d8ffa738283d923638fa3efd8aa6bf7rbbIn this case, the system allows opening an ipv6 wildcard address
e91c80d53d8ffa738283d923638fa3efd8aa6bf7rbbsocket and then binding to a more specific ipv4 address later. An
e91c80d53d8ffa738283d923638fa3efd8aa6bf7rbbexample of this type of system is Digital Unix with ipv6 patches
9359bd100badb53fd8a465cb3a0a90b218b30c4cbenWhat this means to bind9 is that the application will respect
d0211374a981173d4537e3f919c708b5f64040fcgsteinlisten-on in regards to ipv4 sockets, but it will use mapped ipv6
d0211374a981173d4537e3f919c708b5f64040fcgsteinaddresses for any that do not match the listen-on list. This, in
d0211374a981173d4537e3f919c708b5f64040fcgsteineffect, makes listen-on useless for these machines as well.
37d15e1062df9dcdd39ebee5bd2fdc75d4a6aa4arbbIPV6 Sockets Do Not Accept IPV4
e3ec3193b69b45923c14915fa3ee3bc1f0215bafrbb-------------------------------
e3ec3193b69b45923c14915fa3ee3bc1f0215bafrbbOn these systems, opening an IPV6 socket does not implicitly open any
e3ec3193b69b45923c14915fa3ee3bc1f0215bafrbbipv4 sockets. An example of these systems are NetBSD-current with the
e3ec3193b69b45923c14915fa3ee3bc1f0215bafrbblatest KAME patch, and other systems which use the latest KAME patches
138c8f7cb8254e035c6f45288e3909cd9c21be5cmartinas their ipv6 implementation.
138c8f7cb8254e035c6f45288e3909cd9c21be5cmartinOn these systems, listen-on is fully functional, as the ipv6 socket
138c8f7cb8254e035c6f45288e3909cd9c21be5cmartinonly accepts ipv6 packets, and the ipv4 sockets will handle the ipv4
adaea88da2d103e4302e361c932b98cee86fb1c5rbbRELEVANT RFCs
adaea88da2d103e4302e361c932b98cee86fb1c5rbb-------------
8e7c85d6eb9bf628f081763c5bd778b784d5001crbb3513: Internet Protocol Version 6 (IPv6) Addressing Architecture
8e7c85d6eb9bf628f081763c5bd778b784d5001crbb3493: Basic Socket Interface Extensions for IPv6
8e7c85d6eb9bf628f081763c5bd778b784d5001crbb3542: Advanced Sockets Application Program Interface (API) for IPv6
2d3a1dd65798c72b7e46593614b4e27716cc5cderbb$Id: ipv6,v 1.9 2004/08/10 04:27:51 jinmei Exp $