summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBjoern A. Zeeb <bz@FreeBSD.org>2019-12-06 16:42:58 +0000
committerBjoern A. Zeeb <bz@FreeBSD.org>2019-12-06 16:42:58 +0000
commitb745e7623c887543bf2eabe8a69dbd7c5c9e67d2 (patch)
treeb982dd2a7fa3b9ec935e814cc29a89b4a75dd936
parentdad68fc301320e163995beb3cf929c846d7fa442 (diff)
Notes
-rw-r--r--sys/netinet6/ip6_input.c18
1 files changed, 0 insertions, 18 deletions
diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c
index 22797ff5d3ba..431941dcad10 100644
--- a/sys/netinet6/ip6_input.c
+++ b/sys/netinet6/ip6_input.c
@@ -897,24 +897,6 @@ passin:
return;
}
- ip6 = mtod(m, struct ip6_hdr *);
-
- /*
- * Malicious party may be able to use IPv4 mapped addr to confuse
- * tcp/udp stack and bypass security checks (act as if it was from
- * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1). Be cautious.
- *
- * For SIIT end node behavior, you may want to disable the check.
- * However, you will become vulnerable to attacks using IPv4 mapped
- * source.
- */
- if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
- IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
- IP6STAT_INC(ip6s_badscope);
- in6_ifstat_inc(rcvif, ifs6_in_addrerr);
- goto bad;
- }
-
/*
* Tell launch routine the next header
*/