Dual Stack RadSec

[Adam Bishop]

On 14 Nov 2013, at 13:35, Phil Mayers <p.mayers at IMPERIAL.AC.UK> wrote:
> Same as with OpenSSH; a single TCP socket, listening on IPv6, gets both IPv4 and IPv6 connect attempts, with the v4 source appearing as a mapped address.

Yup, this is what I mean - 1.2.3.4 becomes ::ffff:1:2:3:4, controlled by the sysctl knob 'net.ipv6.bindv6only'.

> Moderately useful approach, IMO, but FR would need code to recognise the mapped addresses, extract the v4 original and use that for client{} lookups and similar.

I wouldn't even go that far - unless you're using DNS names in the client block, I'd just list the client with the full ::ffff: address in my configuration (being as IPv4 is legacy anyway!).

Regards,

Adam Bishop

 gpg: 0x6609D460

Janet, the UK's research and education network.


Janet(UK) is a trading name of Jisc Collections and Janet Limited, a 
not-for-profit company which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238