Web session IP protection conflicts with too smart browsers [$10] #356

New Issue

2026-10-05T04:15:07+02:00

adam commented

2026-10-05 04:15:07 +02:00

Some browsers try both IPv4, and IPv6 for every request, and show result of whatever responded faster. http://tools.ietf.org/html/rfc6555

Probably we need to store 2 addresses per session (one IPv4, one IPv6), and if someone connects with existing session from unknown IP, but the corresponding IPvX slot of the session is still empty, fill that slot, and allow the connection.

Issue found with help of sterkh.

--- There is a **[$10 open bounty](https://www.bountysource.com/issues/3099474-web-session-ip-protection-conflicts-with-too-smart-browsers?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** on this issue. Add to the bounty at [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github).

Some browsers try both IPv4, and IPv6 for every request, and show result of whatever responded faster. http://tools.ietf.org/html/rfc6555 Probably we need to store 2 addresses per session (one IPv4, one IPv6), and if someone connects with existing session from unknown IP, but the corresponding IPvX slot of the session is still empty, fill that slot, and allow the connection. Issue found with help of sterkh. ## <bountysource-plugin> --- There is a **[$10 open bounty](https://www.bountysource.com/issues/3099474-web-session-ip-protection-conflicts-with-too-smart-browsers?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** on this issue. Add to the bounty at [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin>

adam commented

2026-10-05 04:15:08 +02:00

According to Wikipedia "Happy Eyeballs" have been supported by major browsers since

Google Chrome
- I cannot find since when.
Opera 12.10
- I cannot find current version.
Firefox 13
- Ubuntu 14.04 has Firefox 20
(OS X Lion)

According to [Wikipedia "Happy Eyeballs"](https://en.wikipedia.org/wiki/Happy_Eyeballs) have been supported by major browsers since - Google Chrome - I cannot find since when. - Opera 12.10 - I cannot find current version. - Firefox 13 - Ubuntu 14.04 has Firefox 20 - (OS X Lion)

adam commented

2026-10-05 04:15:09 +02:00

You should only allow filling the slot if the connection is done within a timeframe of X, otherwise it would be an open door for session hijacking.

You should only allow filling the slot if the connection is done within a timeframe of X, otherwise it would be an open door for session hijacking.

adam commented

2026-10-05 04:15:09 +02:00

I'd like to work on the issue. Can you help me with how to get started with the znc code and how to reproduce the issue?

I'd like to work on the issue. Can you help me with how to get started with the znc code and how to reproduce the issue?

adam commented

2026-10-05 04:15:10 +02:00

Well, start with compiling it. The relevant code is in HTTPSock.cpp and WebModules.cpp
To reproduce, you either need dual stack setup, with DNS pointing at both addresses, or craft HTTP requests manually.

Well, start with compiling it. The relevant code is in HTTPSock.cpp and WebModules.cpp To reproduce, you either need dual stack setup, with DNS pointing at both addresses, or craft HTTP requests manually.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#356