168 lines
5.1 KiB
Groff
168 lines
5.1 KiB
Groff
.\" $KAME: stf.4,v 1.6 2000/03/11 08:01:51 itojun Exp $
|
|
.\"
|
|
.\" Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
|
|
.\" All rights reserved.
|
|
.\"
|
|
.\" Redistribution and use in source and binary forms, with or without
|
|
.\" modification, are permitted provided that the following conditions
|
|
.\" are met:
|
|
.\" 1. Redistributions of source code must retain the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer.
|
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
|
.\" notice, this list of conditions and the following disclaimer in the
|
|
.\" documentation and/or other materials provided with the distribution.
|
|
.\" 3. Neither the name of the project nor the names of its contributors
|
|
.\" may be used to endorse or promote products derived from this software
|
|
.\" without specific prior written permission.
|
|
.\"
|
|
.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
|
|
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
|
|
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
.\" SUCH DAMAGE.
|
|
.\"
|
|
.\" $FreeBSD$
|
|
.\"
|
|
.Dd March 6, 2000
|
|
.Dt STF 4
|
|
.Os KAME
|
|
.Sh NAME
|
|
.Nm stf
|
|
.Nd
|
|
.Tn 6to4 tunnel interface
|
|
.Sh SYNOPSIS
|
|
.Cd "pseudo-device stf"
|
|
.Sh DESCRIPTION
|
|
The
|
|
.Nm
|
|
interface supports
|
|
.Dq 6to4
|
|
IPv6 in IPv4 encapsulation.
|
|
It can tunnel IPv6 traffic over IPv4, as specified in
|
|
.Li draft-ietf-ngtrans-6to4-03.txt .
|
|
.Pp
|
|
Due to the way 6to4 protocol is specified,
|
|
.Nm
|
|
interface requires certain configuration to work properly.
|
|
Single
|
|
.Pq no more than 1
|
|
valid 6to4 address needs to be configured to the interface.
|
|
.Dq A valid 6to4 address
|
|
is an address which has the following properties.
|
|
If any of the following properties are not satisfied,
|
|
.Nm stf
|
|
raises runtime error on packet transmission.
|
|
Read the specification for more details.
|
|
.Bl -bullet
|
|
.It
|
|
matches
|
|
.Li 2002:xxyy:zzuu::/48
|
|
where
|
|
.Li xxyy:zzuu
|
|
is a hexadecimal notation of an IPv4 address for the node.
|
|
.It
|
|
The interface identifier portion
|
|
.Pq lower 64 bits
|
|
is properly filled to avoid address collisions.
|
|
.El
|
|
.Pp
|
|
If you would like the node to behave as a relay router,
|
|
the prefix length for the IPv6 interface address needs to be 16 so that
|
|
the node would consider any 6to4 destination as
|
|
.Dq on-link .
|
|
If you would like to restrict 6to4 peers to be inside certain IPv4 prefix,
|
|
you may want to configure IPv6 prefix length as
|
|
.Dq 16 + IPv4 prefix length .
|
|
.\"(Not yet implemented on 4.0)
|
|
.\".Nm
|
|
.\"interface will check the IPv4 source address on packets,
|
|
.\"if the IPv6 prefix length is larger than 16.
|
|
.Pp
|
|
.Nm
|
|
can be configured to be ECN friendly.
|
|
This can be configured by
|
|
.Dv IFF_LINK1 .
|
|
See
|
|
.Xr gif 4
|
|
for details.
|
|
.Pp
|
|
Please note that 6to4 specification is written as
|
|
.Dq accept tunnelled packet from everyone
|
|
tunnelling device.
|
|
By enabling
|
|
.Nm
|
|
device, you are making it much easier for malicious parties to inject
|
|
fabricated IPv6 packet to your node.
|
|
Also, malicious party can inject an IPv6 packet with fabricated source address
|
|
to make your node generate improper tunnelled packet.
|
|
Administrators must take caution when enabling the interface.
|
|
It is recommended to filter/audit
|
|
incoming IPv4 packet with IP protocol number 41, as necessary.
|
|
.\"To prevent possible DoS attacks,
|
|
.\"(No check yet on 4.0, but such packets won't go through IPv4 cloud.)
|
|
.\".Nm
|
|
.\"interface filters out packets with the following property:
|
|
.\".Bl -bullet
|
|
.\".It
|
|
.\"Packets with 6to4 address based on 0.0.0.0, as inner destination/source
|
|
.\".It
|
|
.\"Packets with 6to4 address based on 255.255.255.255,
|
|
.\" as inner destination/source
|
|
.\".El
|
|
.\".Pp
|
|
You may also want to reject encapsulated IPv6 packets with
|
|
suspicious 6to4 addresses, like
|
|
.Li 2002:7f00::/24.
|
|
.\"
|
|
.Sh EXAMPLES
|
|
Note that
|
|
.Li 8504:0506
|
|
is equal to
|
|
.Li 133.4.5.6 ,
|
|
written in hexadecimals.
|
|
.Bd -literal
|
|
# ifconfig ne0 inet 133.4.5.6 netmask 0xffffff00
|
|
# ifconfig stf0 inet6 2002:8504:0506:0000:a00:5aff:fe38:6f86 \\
|
|
prefixlen 16 alias
|
|
.Ed
|
|
.Pp
|
|
The following configuration sends packets to IPv4 destination 10.1.0.0/16
|
|
only
|
|
.Pq IPv6 prefix length = 32 .
|
|
.Bd -literal
|
|
# ifconfig ne0 inet 10.1.2.3 netmask 0xffff0000
|
|
# ifconfig stf0 inet6 2002:0a01:0203:0000:a00:5aff:fe38:6f86 \\
|
|
prefixlen 32 alias
|
|
.Ed
|
|
.\"
|
|
.Sh SEE ALSO
|
|
.Xr gif 4 ,
|
|
.Xr inet 4 ,
|
|
.Xr inet6 4
|
|
.Rs
|
|
.%A Brian Carpenter
|
|
.%A Keith Moore
|
|
.%T "Connection of IPv6 Domains via IPv4 Clouds without Explicit Tunnels"
|
|
.%D October 1999
|
|
.%N draft-ietf-ngtrans-6to4-03.txt
|
|
.%O work in progress
|
|
.Re
|
|
.Rs
|
|
.%A Jun-ichiro itojun Hagino
|
|
.%T "Possible abuse against IPv6 transition technologies"
|
|
.%D March 2000
|
|
.%N draft-itojun-ipv6-transition-abuse-00.txt
|
|
.%O work in progress
|
|
.Re
|
|
.\"
|
|
.Sh HISTORY
|
|
The
|
|
.Nm
|
|
device first appeared in WIDE/KAME IPv6 stack.
|