[PATCH 6/6] net: Warn when processes listen on AF_INET sockets

David Woodhouse
2026-04-01T07:45:42Z

From: David Woodhouse <dwmw@amazon.co.uk>

There is no need to listen on AF_INET sockets; a modern application can
listen on IPv6 (without IPV6_V6ONLY) and will accept connections from
the 20th century via IPv4-mapped addresses (::ffff:x.x.x.x) on the IPv6
socket.

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
---
net/ipv4/af_inet.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index dc358faa1647..3838782a8437 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -240,6 +240,9 @@ int inet_listen(struct socket *sock, int backlog)
struct sock *sk = sock->sk;
int err = -EINVAL;

+ pr_warn_once("process '%s' (pid %d) is listening on an AF_INET socket. Consider using AF_INET6 with IPV6_V6ONLY=0 instead.\n",
+ current->comm, task_pid_nr(current));
+
lock_sock(sk);

if (sock->state != SS_UNCONNECTED || sock->type != SOCK_STREAM)
--
2.51.0