Apache and v4-mapped addresses

v4-mapped addresses are handled by Apache when Apache uses an IPv6 listening socket and a client connects to that socket over IPv4. On most systems with IPv6 support, Apache will handle IPv4 and IPv6 connections using a single listening socket bound to IN6ADDR_ANY.

benefits of handling IPv4 connections with an IPv6 socket

SINGLE_LISTEN_UNSERIALIZED_ACCEPT optimization works (unless config has more than one listening socket for other reasons)
simpler Apache config (one generic Listen directive)
save a file descriptor (okay, not such a big deal)

problems with handling IPv4 connections with an IPv6 socket

security concerns and other implementation problems (see http://ietfreport.isoc.org/ids/draft-itojun-v6ops-v4mapped-harmful-01.txt and http://ietfreport.isoc.org/ids/draft-cmetz-v6ops-v4mapped-api-harmful-00.txt )
In fact, some OSs (NetBSD, OpenBSD, FreeBSD >=5) are configured by default to disallow v4-mapped addresses.
Apache's current behavior (including the default config file) is oriented towards using v4-mapped addresses, and we get problem reports from time to time from users on such platforms because the default configuration is not appropriate for systems that have v4-mapped addresses disabled.

what should Apache do differently?

have --enable-v4-mapped/--disable-v4-mapped config option (and hopefully default to --disable-v4-mapped on systems that themselves disable v4-mapped addresses)
with --enable-v4-mapped:
- one Listen statement in default conf file:
```
Listen portnumber
```
- if IPV6_V6ONLY option available, turn off the option for IPv6 listening sockets prior to bind() so that the socket can handle IPv4 connections
with --disable-v4-mapped:
- two Listen statements in default conf file:
```
Listen [::]:portnumber
Listen 0.0.0.0:portnumber
```
- if IPV6_V6ONLY option available, turn on the option for IPv6 listening sockets prior to bind() so that the socket will not receive IPv4 connections (and so there isn't a bind() conflict on systems that default to off for this setting)
- are there systems where the order is critical?

concerns with proposed solution

Users who choose --disable-v4-mapped on systems without IPV6_V6ONLY option may get bit by issues related to the order that the sockets are bound. We should only default to --disable-v4-mapped on systems where that is known to work.

implementation notes

while FreeBSD-release has IPv4-mapped address on by default, it can be turned off via sysctl; FreeBSD-current has IPv4-mapped address off by default, so FreeBSD 5.x will have it off by default
Linux will get IPV6_V6ONLY support soon (2.6-ish)
WinXP, like OpenBSD, does not have IPv4-mapped address support

Many thanks are due to itojun for reviewing this design and providing details on the capabilities and default behavior of various systems.

Last modified: Wed Nov 6 04:57:19 PST 2002