Re: listening to IPv4 & 6 sockets

Date sent:      	Thu, 18 Sep 2003 12:28:18 -0600
> > > Dixitur illum [email protected] scribere...
> > > This is because itojun@ thinks it's a security problem, and

> > OK, but then why is it a security risk?

> It causes what is called "automatic tunnels".  These are incredibly
> dangerous, hence, the decision was made -- and pressure is being
> applied to the IETF, to stop this ridiculous embracing of such crap
> technology ideas which can (and will) result in by-passing of
> firewalls.

How do they cause these automatic tunnels? If somebody could connect to 
me at 64.7.137.104 port 4201 or 2002:4007:8968::4007:8968 port 4201 and 
somehow the IPv6 connection creates one of these anonymous tunnels, 
isn't that more a sign of bad network set up on my part rather than a  
supposed security risk of a signle socket listening on both IPv4 and 
IPv6? Because if the server is listening to 64.7.137.104 port 4201 and 
192.168.0.2 port 4201 isn't it a possiility that such a tunnel could 
happen to allow access to my internal machines in a manner that I did 
not want to happen? And again, would that not be because of bad network 
(and/or firewall) setup on my part?

I still do not understand how listening on an IPv4 address and an IPv6 
address with the same socket  is any more of a security risk than 
listening to multiple IPv4 addresses with the same socket.

I'm hoping that somebody can explain this too me, because I am willing 
to be proven wrong on any assumptions that I have made.
--
Cory C. Albrecht
If you ever need anything please don't hesitate to ask someone else 
first.
 -- Nirvana