Re: listening to IPv4 & 6 sockets

From:           	Thorsten Glaser <[email protected]>
> Dixitur illum [email protected] scribere...
> >of IPv4 only. This is because on OpenBSD you can't just bind to and 
> >listen on a IPv6 socket and get the IPv4 connections on that same 
> >socket like other OSes can do.

> This is because itojun@ thinks it's a security problem, and

OK, but then why is it a security risk? According to netstat, sshd is 
listening on *.22 (single socket fro all IPv4 addresses) compared to named 
which gets listed as 127.0.0.1.53, 192.168.0.2.53 and 192.168.1.1.53 (3 
different opened sockets, 1 per address). Wouldn't the same reasoning used to 
say opening a single socket to listen on both IPv4 & 6 is insecure  also lead 
one to say that a single socket listenig to multiple IPv4 addresses is also 
insecure? Because if a programme with single socket listening on 64.7.112.3 & 
3ffe:b80:ceb::1234:5678 is somehow insecure, then that same programme 
listening with a single socket to 64.7.112.3 & 199.212.134.1 would be just as 
insecure. It would be the coding of the programme opening that socket that 
would make it insecure (i.e. thet prog is attackable via buffer overruns), not 
that listening on both IPv4 and 6 would be inherently so.

If I am missing something, I would love to be shown what.

> thus OpenBSD is "doble stack", not "dual stack".

I have heard "dual stack" versus "dual layer" used for what I think you are 
referring to. Are you differntiating between a single driver handling all tcp 
packets regardless of whether it came in on IPv4 or 6 and separate drivers for 
both?
--
Cory C. Albrecht
Courtesy is the lubricant of social interaction.
 -- Robert A. Heinlein