Re: ident auth postgres 7.4 fedora core 3

Tom Lane wrote:
> Ian Pilcher <i(dot)pilcher(at)comcast(dot)net> writes:
>
>>Since 1.4.2 (I believe), Java uses IPv6 by default. When a connection
>>is made to an IPv4 address, it actually makes an IPv6 connection to an
>>"IPv4-mapped address". So when you request a connection to 127.0.0.1,
>>you actually get a connection to ::ffff:127.0.0.1. PostgreSQL doesn't
>>know this, however; it asks the ident daemon, "who's connecting from
>>127.0.0.1?" The daemon answers "nobody".
>
>
> Hmm. I think you have mischaracterized the situation, because the
> IDENT protocol doesn't actually mention IP addresses at all --- just
> port numbers. It's up to Postgres to connect back to the same IP
> address that the connection came from, and AFAIK we do that correctly
> for IPv6 addresses.

You're right. I believe that what happens is that PostgreSQL, seeing a
client connection from 127.0.0.1, uses an IPv4 socket to connect to the
ident daemon. The daemon sees a request from 127.0.0.1, so it goes
looking for an IPv4 connection (in /proc/net/tcp); it doesn't find it,
because the socket is actually listed in /proc/net/tcp6 (with a local
address of ::ffff:127.0.0.1).

> This report could indicate a bug in our handling of the case, or it
> could indicate a configuration error on the part of the OP, or it could
> be that his ident daemon isn't handling the case correctly. There's
> not enough info to tell. It would be useful to see the postmaster log
> output when the connection is rejected.

Perhaps there's a bug in PostgreSQL's handling of IPv4-mapped sockets,
or perhaps Linux reports it to PostgreSQL as an IPv4 socket ... or
perhaps Red Hat is disabling PostgreSQL's IPv6 support in their RPMs.

--
========================================================================
Ian Pilcher i(dot)pilcher(at)comcast(dot)net
========================================================================