Subject: RFC1933 IPv4 mapped address
To: None <tech-net@netbsd.org>
From: None <itojun@iijlab.net>
List: tech-net
Date: 12/19/1999 14:01:36
	RFC1933 defines IPv4 mapped address in IPv6 address space.
	This address is formed like "::ffff:10.1.1.1".
	The address is to be able to manipulate IPv4 traffic via AF_INET6
	socket.  For example, if IPv4 traffic comes in and there's only
	AF_INET6 socket, the traffic will come into AF_INET6 socket.
		IPv4(s->d) TCP payload
		  v tcp_input
		accepted by to AF_INET6 socket, as if peername=::ffff:s,
			myname=::ffff:d

	This was defined in RFC1933 to help some of porting effort.
	if you change bind(AF_INET) into bind(AF_INET6), you are *almost* done.
	(the reason for "almost" is buffer size of get{peer,sock}name,
	differences in setsockopt allowed on the socket, name resolution,
	whatever).  actually I know almost no appliation ported to be IPv6
	ready this way.

	For security perspective this is very wrong thing to support.  For
	example, even if you think you have disabled IPv4 traffic by
	/etc/inetd.conf (running service on "tcp6" only) and /etc/hosts.deny
	(denying any IPv4 traffic), you are not covered (IPv4 traffic will
	be accepted by a daemon on "tcp6", as if it was from ::ffff:10.1.1.1).

	I'm favor of disabling it (allow enabling it by sysctl, or completely
	disable it).  Opinions/suggestions?

itojun