ipv4-dns-over-ipv6

Author: lws-team

include/libwebsockets/lws-network-helper.h

@@ -231,6 +231,19 @@ lws_parse_numeric_address(const char *ads, uint8_t *result, size_t max_len);
 LWS_VISIBLE LWS_EXTERN int
 lws_sa46_parse_numeric_address(const char *ads, lws_sockaddr46 *sa46);
 
+/**
+ * lws_sa46_is_ipv4_mapped() - is an AF_INET6 sa46 an IPv4-mapped address?
+ *
+ * \param sa46: the sa46 to test
+ *
+ * Returns 1 if \p sa46 is AF_INET6 and holds an IPv4-mapped IPv6 address
+ * (::ffff:a.b.c.d), else 0.  Useful for deciding that an AF_INET6 socket
+ * targeting this address must be dual-stack (IPV6_V6ONLY = 0) to actually
+ * reach the IPv4 peer through the mapping.
+ */
+LWS_VISIBLE LWS_EXTERN int
+lws_sa46_is_ipv4_mapped(const lws_sockaddr46 *sa46);
+
 /**
  * lws_write_numeric_address() - convert network byte order ads to text
  *

lib/core-net/adopt.c

@@ -826,6 +826,7 @@ lws_create_adopt_udp2(struct lws *wsi, const char *ads,
 
 #if defined(LWS_WITH_IPV6) && defined(IPV6_V6ONLY)
 		if (s->dest.sa4.sin_family == AF_INET6 &&
+		    !lws_sa46_is_ipv4_mapped(&s->dest) &&
 		    (!(wsi->a.vhost->options & LWS_SERVER_OPTION_IPV6_V6ONLY_MODIFY) ||
 		     (wsi->a.vhost->options & LWS_SERVER_OPTION_IPV6_V6ONLY_VALUE))) {
 			int opt = 1;
@@ -1016,6 +1017,7 @@ lws_create_adopt_udp2(struct lws *wsi, const char *ads,
 
 #if defined(LWS_WITH_IPV6) && defined(IPV6_V6ONLY)
 	if (dest.sa4.sin_family == AF_INET6 &&
+	    !lws_sa46_is_ipv4_mapped(&dest) &&
 	    (!(wsi->a.vhost->options & LWS_SERVER_OPTION_IPV6_V6ONLY_MODIFY) ||
 	     (wsi->a.vhost->options & LWS_SERVER_OPTION_IPV6_V6ONLY_VALUE))) {
 		int opt = 1;

lib/core-net/network.c

@@ -967,11 +967,57 @@ lws_sa46_parse_numeric_address(const char *ads, lws_sockaddr46 *sa46)
 	       sizeof(sa46->sa4.sin_addr.s_addr));
 
 	return 0;
+#elif defined(LWS_WITH_IPV6)
+	/*
+	 * IPv4 literal in a build with IPv4 compiled out: represent it as an
+	 * IPv4-mapped IPv6 address (::ffff:a.b.c.d) so it can be stored in an
+	 * AF_INET6 sockaddr and, on a dual-stack host (or behind NAT64),
+	 * actually reached.  On a host with no IPv4 route this connect will
+	 * simply fail cleanly at the socket layer; the alternative ("refuse
+	 * the literal") makes DNS-server discovery and similar config unusable
+	 * on otherwise-capable dual-stack hosts for no benefit.
+	 */
+	{
+		static uint8_t did_notice;
+
+		sa46->sa6.sin6_family = AF_INET6;
+		memset(sa46->sa6.sin6_addr.s6_addr, 0, 10);
+		sa46->sa6.sin6_addr.s6_addr[10] = 0xff;
+		sa46->sa6.sin6_addr.s6_addr[11] = 0xff;
+		memcpy(&sa46->sa6.sin6_addr.s6_addr[12], a, 4);
+
+		if (!did_notice) {
+			did_notice = 1;
+			lwsl_notice("IPv4 literal '%s' mapped to ::ffff: in this "
+				    "IPv6-only build; reachable only on dual-stack "
+				    "or via NAT64\n", ads);
+		}
+
+		return 0;
+	}
 #else
 	return -1;
 #endif
 }
 
+int
+lws_sa46_is_ipv4_mapped(const lws_sockaddr46 *sa46)
+{
+#if defined(LWS_WITH_IPV6)
+	if (sa46 && sa46->sa4.sin_family == AF_INET6) {
+		const uint8_t *a = sa46->sa6.sin6_addr.s6_addr;
+
+		return !a[0] && !a[1] && !a[2] && !a[3] && !a[4] && !a[5] &&
+		       !a[6] && !a[7] && !a[8] && !a[9] &&
+			a[10] == 0xff && a[11] == 0xff;
+	}
+#else
+	(void)sa46;
+#endif
+
+	return 0;
+}
+
 int
 lws_write_numeric_address(const uint8_t *ads, int size, char *buf, size_t len)
 {
@@ -1313,6 +1359,27 @@ lws_is_lan_address(const char *ads)
 #if defined(LWS_WITH_IPV6)
 		uint8_t *p = (uint8_t *)&sa46.sa6.sin6_addr.s6_addr;
 
+		/*
+		 * An IPv4-mapped address (::ffff:a.b.c.d) is evaluated by its
+		 * embedded IPv4 address, so "is this LAN" agrees whether the
+		 * address is stored as AF_INET or as a mapped AF_INET6 (as
+		 * happens in an IPv6-only build).
+		 */
+		if (lws_sa46_is_ipv4_mapped(&sa46)) {
+			uint8_t *q = &p[12];
+
+			if (q[0] == 10)
+				return 1;
+			if (q[0] == 172 && q[1] >= 16 && q[1] <= 31)
+				return 1;
+			if (q[0] == 192 && q[1] == 168)
+				return 1;
+			if (q[0] == 127)
+				return 1;
+
+			return 0;
+		}
+
 		/* fc00::/7 */
 		if ((p[0] & 0xfe) == 0xfc)
 			return 1;

minimal-examples-lowlevel/api-tests/api-test-network/main.c

@@ -3,6 +3,7 @@
 
 int main(void)
 {
+	lws_sockaddr46 sa46;
 	int e = 0;
 
 	lws_set_log_level(LLL_USER | LLL_ERR | LLL_WARN | LLL_NOTICE, NULL);
@@ -19,6 +20,40 @@ int main(void)
 		e++;
 	}
 
+	/*
+	 * An IPv4 literal must parse in every build.  In a dual-stack build it
+	 * stays AF_INET; in an IPv6-only build (LWS_WITH_IPV4 off) it is mapped
+	 * to ::ffff:a.b.c.d as AF_INET6 so DNS-server discovery and similar
+	 * config still works on dual-stack hosts.
+	 */
+	memset(&sa46, 0, sizeof(sa46));
+	if (lws_sa46_parse_numeric_address("192.168.1.1", &sa46) < 0) {
+		lwsl_err("sa46 parse '192.168.1.1' failed\n");
+		e++;
+	} else {
+#if defined(LWS_WITH_IPV4)
+		if (sa46.sa4.sin_family != AF_INET) {
+			lwsl_err("sa46 family %d != AF_INET\n",
+				 sa46.sa4.sin_family);
+			e++;
+		}
+#elif defined(LWS_WITH_IPV6)
+		if (sa46.sa4.sin_family != AF_INET6 ||
+		    !lws_sa46_is_ipv4_mapped(&sa46)) {
+			lwsl_err("sa46 IPv6-only mapping failed (family %d)\n",
+				 sa46.sa4.sin_family);
+			e++;
+		}
+		/* a native IPv6 literal is not mapped */
+		memset(&sa46, 0, sizeof(sa46));
+		if (lws_sa46_parse_numeric_address("2001:db8::1", &sa46) < 0 ||
+		    lws_sa46_is_ipv4_mapped(&sa46)) {
+			lwsl_err("sa46 native IPv6 mapped wrongly\n");
+			e++;
+		}
+#endif
+	}
+
 	lwsl_user("Completed: %d fails\n", e);
 
 	return e;