1f6038661SJun-ichiro itojun Hagino.\" $FreeBSD$ 233841545SHajimu UMEMOTO.\" $KAME: gif.4,v 1.28 2001/05/18 13:15:56 itojun Exp $ 3f6038661SJun-ichiro itojun Hagino.\" 49a4365d0SYoshinobu Inoue.\" Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 59a4365d0SYoshinobu Inoue.\" All rights reserved. 69a4365d0SYoshinobu Inoue.\" 79a4365d0SYoshinobu Inoue.\" Redistribution and use in source and binary forms, with or without 89a4365d0SYoshinobu Inoue.\" modification, are permitted provided that the following conditions 99a4365d0SYoshinobu Inoue.\" are met: 109a4365d0SYoshinobu Inoue.\" 1. Redistributions of source code must retain the above copyright 119a4365d0SYoshinobu Inoue.\" notice, this list of conditions and the following disclaimer. 129a4365d0SYoshinobu Inoue.\" 2. Redistributions in binary form must reproduce the above copyright 139a4365d0SYoshinobu Inoue.\" notice, this list of conditions and the following disclaimer in the 149a4365d0SYoshinobu Inoue.\" documentation and/or other materials provided with the distribution. 159a4365d0SYoshinobu Inoue.\" 3. Neither the name of the project nor the names of its contributors 169a4365d0SYoshinobu Inoue.\" may be used to endorse or promote products derived from this software 179a4365d0SYoshinobu Inoue.\" without specific prior written permission. 189a4365d0SYoshinobu Inoue.\" 199a4365d0SYoshinobu Inoue.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 209a4365d0SYoshinobu Inoue.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 219a4365d0SYoshinobu Inoue.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 229a4365d0SYoshinobu Inoue.\" ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 239a4365d0SYoshinobu Inoue.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 249a4365d0SYoshinobu Inoue.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 259a4365d0SYoshinobu Inoue.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 269a4365d0SYoshinobu Inoue.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 279a4365d0SYoshinobu Inoue.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 289a4365d0SYoshinobu Inoue.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 299a4365d0SYoshinobu Inoue.\" SUCH DAMAGE. 309a4365d0SYoshinobu Inoue.\" 319a4365d0SYoshinobu Inoue.Dd April 10, 1999 329a4365d0SYoshinobu Inoue.Dt GIF 4 3312900fe3SJeroen Ruigrok van der Werven.Os 349a4365d0SYoshinobu Inoue.Sh NAME 359a4365d0SYoshinobu Inoue.Nm gif 36eb083802SRuslan Ermilov.Nd generic tunnel interface 379a4365d0SYoshinobu Inoue.Sh SYNOPSIS 38fe403d8dSBrooks Davis.Cd "device gif" 399a4365d0SYoshinobu Inoue.Sh DESCRIPTION 409a4365d0SYoshinobu InoueThe 419a4365d0SYoshinobu Inoue.Nm 429a4365d0SYoshinobu Inoueinterface is a generic tunnelling pseudo device for IPv4 and IPv6. 439a4365d0SYoshinobu InoueIt can tunnel IPv[46] traffic over IPv[46]. 449a4365d0SYoshinobu InoueTherefore, there can be four possible configurations. 459a4365d0SYoshinobu InoueThe behavior of 469a4365d0SYoshinobu Inoue.Nm 4733841545SHajimu UMEMOTOis mainly based on RFC2893 IPv6-over-IPv4 configured tunnel. 4833841545SHajimu UMEMOTOOn 4933841545SHajimu UMEMOTO.Nx , 5033841545SHajimu UMEMOTO.Nm 5133841545SHajimu UMEMOTOcan also tunnel ISO traffic over IPv[46] using EON encapsulation. 529a4365d0SYoshinobu Inoue.Pp 53601404ecSBrooks DavisEach 54f823d4a6SBrooks Davis.Nm 55601404ecSBrooks Davisinterface is created at runtime using interface cloning. 560787ca52SRuslan ErmilovThis is 57f823d4a6SBrooks Davismost easily done with the 58f823d4a6SBrooks Davis.Xr ifconfig 8 59f823d4a6SBrooks Davis.Cm create 60601404ecSBrooks Daviscommand or using the 61fb5293cfSRuslan Ermilov.Va gifconfig_ Ns Aq Ar interface 62601404ecSBrooks Davisvariable in 63601404ecSBrooks Davis.Xr rc.conf 5 . 64f823d4a6SBrooks Davis.Pp 659a4365d0SYoshinobu InoueTo use 664b66483fSRuslan Ermilov.Nm , 679a4365d0SYoshinobu Inoueadministrator needs to configure protocol and addresses used for the outer 689a4365d0SYoshinobu Inoueheader. 699a4365d0SYoshinobu InoueThis can be done by using 709a4365d0SYoshinobu Inoue.Xr gifconfig 8 , 719a4365d0SYoshinobu Inoueor 729a4365d0SYoshinobu Inoue.Dv SIOCSIFPHYADDR 739a4365d0SYoshinobu Inoueioctl. 749a4365d0SYoshinobu InoueAlso, administrator needs to configure protocol and addresses used for the 759a4365d0SYoshinobu Inoueinner header, by using 769a4365d0SYoshinobu Inoue.Xr ifconfig 8 . 779a4365d0SYoshinobu InoueNote that IPv6 link-local address 78c4d9468eSRuslan Ermilov(those start with 79c4d9468eSRuslan Ermilov.Li fe80:: ) 809a4365d0SYoshinobu Inouewill be automatically configured whenever possible. 819a4365d0SYoshinobu InoueYou may need to remove IPv6 link-local address manually using 829a4365d0SYoshinobu Inoue.Xr ifconfig 8 , 839a4365d0SYoshinobu Inouewhen you would like to disable the use of IPv6 as inner header 84c4d9468eSRuslan Ermilov(like when you need pure IPv4-over-IPv6 tunnel). 859a4365d0SYoshinobu InoueFinally, use routing table to route the packets toward 869a4365d0SYoshinobu Inoue.Nm 879a4365d0SYoshinobu Inoueinterface. 889a4365d0SYoshinobu Inoue.Pp 899a4365d0SYoshinobu Inoue.Nm 909a4365d0SYoshinobu Inouecan be configured to be ECN friendly. 919a4365d0SYoshinobu InoueThis can be configured by 929a4365d0SYoshinobu Inoue.Dv IFF_LINK1 . 939a4365d0SYoshinobu Inoue.Ss ECN friendly behavior 949a4365d0SYoshinobu Inoue.Nm 959a4365d0SYoshinobu Inouecan be configured to be ECN friendly, as described in 96f6038661SJun-ichiro itojun Hagino.Dv draft-ietf-ipsec-ecn-02.txt . 979a4365d0SYoshinobu InoueThis is turned off by default, and can be turned on by 989a4365d0SYoshinobu Inoue.Dv IFF_LINK1 999a4365d0SYoshinobu Inoueinterface flag. 1009a4365d0SYoshinobu Inoue.Pp 1019a4365d0SYoshinobu InoueWithout 1029a4365d0SYoshinobu Inoue.Dv IFF_LINK1 , 1039a4365d0SYoshinobu Inoue.Nm 10433841545SHajimu UMEMOTOwill show a normal behavior, like described in RFC2893. 1059a4365d0SYoshinobu InoueThis can be summarized as follows: 1069a4365d0SYoshinobu Inoue.Bl -tag -width "Ingress" -offset indent 1079a4365d0SYoshinobu Inoue.It Ingress 1089a4365d0SYoshinobu InoueSet outer TOS bit to 1099a4365d0SYoshinobu Inoue.Dv 0 . 1109a4365d0SYoshinobu Inoue.It Egress 1119a4365d0SYoshinobu InoueDrop outer TOS bit. 1129a4365d0SYoshinobu Inoue.El 1139a4365d0SYoshinobu Inoue.Pp 1149a4365d0SYoshinobu InoueWith 1159a4365d0SYoshinobu Inoue.Dv IFF_LINK1 , 1169a4365d0SYoshinobu Inoue.Nm 1179a4365d0SYoshinobu Inouewill copy ECN bits 118c4d9468eSRuslan Ermilov.Dv ( 0x02 1199a4365d0SYoshinobu Inoueand 1209a4365d0SYoshinobu Inoue.Dv 0x01 121c4d9468eSRuslan Ermilovon IPv4 TOS byte or IPv6 traffic class byte) 1229a4365d0SYoshinobu Inoueon egress and ingress, as follows: 1239a4365d0SYoshinobu Inoue.Bl -tag -width "Ingress" -offset indent 1249a4365d0SYoshinobu Inoue.It Ingress 1259a4365d0SYoshinobu InoueCopy TOS bits except for ECN CE 126c4d9468eSRuslan Ermilov(masked with 127c4d9468eSRuslan Ermilov.Dv 0xfe ) 1289a4365d0SYoshinobu Inouefrom 1299a4365d0SYoshinobu Inoueinner to outer. 130c75526d5SRuslan ErmilovSet ECN CE bit to 1319a4365d0SYoshinobu Inoue.Dv 0 . 1329a4365d0SYoshinobu Inoue.It Egress 1339a4365d0SYoshinobu InoueUse inner TOS bits with some change. 1349a4365d0SYoshinobu InoueIf outer ECN CE bit is 1359a4365d0SYoshinobu Inoue.Dv 1 , 1369a4365d0SYoshinobu Inoueenable ECN CE bit on the inner. 1379a4365d0SYoshinobu Inoue.El 1389a4365d0SYoshinobu Inoue.Pp 13933841545SHajimu UMEMOTONote that the ECN friendly behavior violates RFC2893. 140f6038661SJun-ichiro itojun HaginoThis should be used in mutual agreement with the peer. 141f6038661SJun-ichiro itojun Hagino.Ss Security 142f6038661SJun-ichiro itojun HaginoMalicious party may try to circumvent security filters by using 143f6038661SJun-ichiro itojun Haginotunnelled packets. 144f6038661SJun-ichiro itojun HaginoFor better protection, 1459a4365d0SYoshinobu Inoue.Nm 146f6038661SJun-ichiro itojun Haginoperforms martian filter and ingress filter against outer source address, 147f6038661SJun-ichiro itojun Haginoon egress. 148f6038661SJun-ichiro itojun HaginoNote that martian/ingress filters are no way complete. 149f6038661SJun-ichiro itojun HaginoYou may want to secure your node by using packet filters. 15033841545SHajimu UMEMOTOIngress filter can be turned off by 15133841545SHajimu UMEMOTO.Dv IFF_LINK2 15233841545SHajimu UMEMOTObit. 1539a4365d0SYoshinobu Inoue.\" 154872f786aSBrooks Davis.Ss Miscellaneous 155d0f16f93SRuslan ErmilovBy default, 156872f786aSBrooks Davis.Nm 157872f786aSBrooks Davistunnels may not be nested. 158872f786aSBrooks DavisThis behavior may be modified at runtime by setting the 159872f786aSBrooks Davis.Xr sysctl 8 160872f786aSBrooks Davisvariable 161872f786aSBrooks Davis.Va net.link.gif.max_nesting 162872f786aSBrooks Davisto the desired level of nesting. 163872f786aSBrooks DavisAdditionally, 164872f786aSBrooks Davis.Nm 165872f786aSBrooks Davistunnels are restricted to one per pair of end points. 166872f786aSBrooks DavisParallel tunnels may be enabled by setting the 167872f786aSBrooks Davis.Xr sysctl 8 168872f786aSBrooks Davisvariable 169872f786aSBrooks Davis.Va net.link.gif.parallel_tunnels 170872f786aSBrooks Davisto 1. 1719a4365d0SYoshinobu Inoue.Sh SEE ALSO 1729a4365d0SYoshinobu Inoue.Xr inet 4 , 1739a4365d0SYoshinobu Inoue.Xr inet6 4 , 174f6038661SJun-ichiro itojun Hagino.Xr gifconfig 8 175f6038661SJun-ichiro itojun Hagino.Rs 176f6038661SJun-ichiro itojun Hagino.%A R. Gilligan 177f6038661SJun-ichiro itojun Hagino.%A E. Nordmark 17833841545SHajimu UMEMOTO.%B RFC2893 179f6038661SJun-ichiro itojun Hagino.%T Transition Mechanisms for IPv6 Hosts and Routers 18033841545SHajimu UMEMOTO.%D August 2000 18133841545SHajimu UMEMOTO.%O ftp://ftp.isi.edu/in-notes/rfc2893.txt 182f6038661SJun-ichiro itojun Hagino.Re 1839a4365d0SYoshinobu Inoue.Rs 1849a4365d0SYoshinobu Inoue.%A Sally Floyd 1859a4365d0SYoshinobu Inoue.%A David L. Black 1869a4365d0SYoshinobu Inoue.%A K. K. Ramakrishnan 1879a4365d0SYoshinobu Inoue.%T "IPsec Interactions with ECN" 188f6038661SJun-ichiro itojun Hagino.%D December 1999 189f6038661SJun-ichiro itojun Hagino.%O draft-ietf-ipsec-ecn-02.txt 1909a4365d0SYoshinobu Inoue.Re 1919a4365d0SYoshinobu Inoue.\" 1929a4365d0SYoshinobu Inoue.Sh HISTORY 1939a4365d0SYoshinobu InoueThe 1949a4365d0SYoshinobu Inoue.Nm 1959a4365d0SYoshinobu Inouedevice first appeared in WIDE hydrangea IPv6 kit. 196f6038661SJun-ichiro itojun Hagino.\" 197f6038661SJun-ichiro itojun Hagino.Sh BUGS 198f6038661SJun-ichiro itojun HaginoThere are many tunnelling protocol specifications, 199f6038661SJun-ichiro itojun Haginodefined differently from each other. 200f6038661SJun-ichiro itojun Hagino.Nm 201f6038661SJun-ichiro itojun Haginomay not interoperate with peers which are based on different specifications, 202f6038661SJun-ichiro itojun Haginoand are picky about outer header fields. 203f6038661SJun-ichiro itojun HaginoFor example, you cannot usually use 204f6038661SJun-ichiro itojun Hagino.Nm 205f6038661SJun-ichiro itojun Haginoto talk with IPsec devices that use IPsec tunnel mode. 206f6038661SJun-ichiro itojun Hagino.Pp 207f6038661SJun-ichiro itojun HaginoThe current code does not check if the ingress address 208c4d9468eSRuslan Ermilov(outer source address) 209f6038661SJun-ichiro itojun Haginoconfigured to 210f6038661SJun-ichiro itojun Hagino.Nm 211f6038661SJun-ichiro itojun Haginomakes sense. 212f6038661SJun-ichiro itojun HaginoMake sure to configure an address which belongs to your node. 213f6038661SJun-ichiro itojun HaginoOtherwise, your node will not be able to receive packets from the peer, 214f6038661SJun-ichiro itojun Haginoand your node will generate packets with a spoofed source address. 215f6038661SJun-ichiro itojun Hagino.Pp 21633841545SHajimu UMEMOTOIf the outer protocol is IPv4, 21733841545SHajimu UMEMOTO.Nm 21833841545SHajimu UMEMOTOdoes not try to perform path MTU discovery for the encapsulated packet 219c4d9468eSRuslan Ermilov(DF bit is set to 0). 22033841545SHajimu UMEMOTO.Pp 22133841545SHajimu UMEMOTOIf the outer protocol is IPv6, path MTU discovery for encapsulated packet 22233841545SHajimu UMEMOTOmay affect communication over the interface. 22333841545SHajimu UMEMOTOThe first bigger-than-pmtu packet may be lost. 22433841545SHajimu UMEMOTOTo avoid the problem, you may want to set the interface MTU for 22533841545SHajimu UMEMOTO.Nm 22633841545SHajimu UMEMOTOto 1240 or smaller, when outer header is IPv6 and inner header is IPv4. 22733841545SHajimu UMEMOTO.Pp 22833841545SHajimu UMEMOTO.Nm 22933841545SHajimu UMEMOTOdoes not translate ICMP messages for outer header into inner header. 23033841545SHajimu UMEMOTO.Pp 23133841545SHajimu UMEMOTOIn the past, 23233841545SHajimu UMEMOTO.Nm 23333841545SHajimu UMEMOTOhad a multi-destination behavior, configurable via 23433841545SHajimu UMEMOTO.Dv IFF_LINK0 23533841545SHajimu UMEMOTOflag. 23633841545SHajimu UMEMOTOThe behavior was obsoleted and is no longer supported. 237