Search code examples
javascriptbrowseripv6equalityipv4

Dual IP stack address equality comparison


I am trying to prevent redundant WebSocket connections in a browser by only permitting IPv4 and IPv6 addresses received from potentially malicious sources by modifying and using this regex to validate and then testing for equality before connecting.

However, I have no experience with IPv6 and do not know how to test for equality especially for the special case of IPv4 to IPv6 mapped addresses.

How can all types of IP addresses be compared for equality?


Solution

  • IPv4 and IPv6 are separate protocols, so mapping between an IPv4 and IPv6 address is usually not possible. There are however some transitioning mechanisms that put (part of) the IPv4 address inside the IPv6 address. Most IPv6 users won't use these mechanisms though, so usually a mapping will not be possible at all.

    I'll try to list as many of them here as I can. Please leave a comment if I forgot something relevant!

    IPv4-Compatible IPv6 Address

    Defined in RFC 4291. To quote the RFC:

    The "IPv4-Compatible IPv6 address" was defined to assist in the IPv6 transition. [...] The "IPv4-Compatible IPv6 address" is now deprecated because the current IPv6 transition mechanisms no longer use these addresses.

    They look like ::192.0.2.123 (the last 32 bits written as an IPv4 address) or ::c000:027b (the last 32 bits written in hexadecimal as usual).

    IPv4-Mapped IPv6 Address

    Also defined in RFC 4291. These addresses are used in software when the software is using IPv6 internally, but in reality is speaking the IPv4 protocol (also see Socket listener for IPv6 and IPv4). They look like ::ffff:192.0.2.123 (the last 32 bits written as an IPv4 address) or ::ffff:c000:027b (the last 32 bits written in hexadecimal as usual). They are never used in real packets but are a software construct to make it easier for software to support both IPv4 and IPv6 at the same time.

    6to4 Address

    Defined in RFC 3056. 6to4 is a mechanism where every public IPv4 address automatically has an IPv6 /48 network. For example: if your home router has public IPv4 address 192.0.2.123 then you can use IPv6 prefix 2002:c000:027b::/48 (fixed 16-bit prefix 2002: + the 32 bits of your IPv4 address = 48 bits) inside your home. So from a 6to4 you can extract the IPv4 address again. The IPv6 traffic is then tunnelled. When talking to another 6to4 site your router will tunnel traffic directly to the IPv4 address of the other site. When talking to the 'normal' IPv6 internet your router will tunnel to a public 6to4 relay. Because these relays are provided by volunteers the quality is not predictable, so it might or might not work well.

    6rd

    Defined in RFC 5969. 6rd is like the ISP-provided version of 6to4. Because it is managed by an ISP the reliability can be guaranteed. The IPv6 addresses used by a 6rd deployment are determined by the ISP, so they are not distinguishable from normal other IPv6 addresses. Part of the IPv4 address is mapped to part of the IPv6 address by the ISP, but you'd have to know the mapping parameters used (which bits of the IPv4 address are copied to which bits of the IPv6 address, and that are the non-mapped bits of the IPv4 address) to be able to determine the IPv4 address from the IPv6 address.

    A 6rd deployment could for example map IPv4 address 192.0.2.123 to IPv6 prefix 2001:db8:6d02:7b00::/56. In this example I took IPv6 prefix 2001:db8:6d00::/40 and then appended the last 16 bits of the IPv6 address to get a /56 prefix.

    Teredo

    Defined in RFC 4380. Teredo is a protocol for getting public IPv6 addresses to a host behind a NAT. Teredo IPv6 addresses contain an obfuscated version of the IPv4 address. Teredo addresses can be recognised because the first 32 bits of the address are always 2001:0000:. The last 32 bits of a Teredo address contain the IPv4 address but with all bits flipped. So a host behind a NAT device with external IPv4 address 192.0.2.123 would get a Teredo address where the last 32 bits are :3fff:fd84.