xref: /freebsd/share/man/man4/gif.4 (revision d0f16f93dbfe142f4a32668a79a5e81ac13c5e67)
1f6038661SJun-ichiro itojun Hagino.\"	$FreeBSD$
233841545SHajimu UMEMOTO.\"	$KAME: gif.4,v 1.28 2001/05/18 13:15:56 itojun Exp $
3f6038661SJun-ichiro itojun Hagino.\"
49a4365d0SYoshinobu Inoue.\" Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
59a4365d0SYoshinobu Inoue.\" All rights reserved.
69a4365d0SYoshinobu Inoue.\"
79a4365d0SYoshinobu Inoue.\" Redistribution and use in source and binary forms, with or without
89a4365d0SYoshinobu Inoue.\" modification, are permitted provided that the following conditions
99a4365d0SYoshinobu Inoue.\" are met:
109a4365d0SYoshinobu Inoue.\" 1. Redistributions of source code must retain the above copyright
119a4365d0SYoshinobu Inoue.\"    notice, this list of conditions and the following disclaimer.
129a4365d0SYoshinobu Inoue.\" 2. Redistributions in binary form must reproduce the above copyright
139a4365d0SYoshinobu Inoue.\"    notice, this list of conditions and the following disclaimer in the
149a4365d0SYoshinobu Inoue.\"    documentation and/or other materials provided with the distribution.
159a4365d0SYoshinobu Inoue.\" 3. Neither the name of the project nor the names of its contributors
169a4365d0SYoshinobu Inoue.\"    may be used to endorse or promote products derived from this software
179a4365d0SYoshinobu Inoue.\"    without specific prior written permission.
189a4365d0SYoshinobu Inoue.\"
199a4365d0SYoshinobu Inoue.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
209a4365d0SYoshinobu Inoue.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
219a4365d0SYoshinobu Inoue.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
229a4365d0SYoshinobu Inoue.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
239a4365d0SYoshinobu Inoue.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
249a4365d0SYoshinobu Inoue.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
259a4365d0SYoshinobu Inoue.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
269a4365d0SYoshinobu Inoue.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
279a4365d0SYoshinobu Inoue.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
289a4365d0SYoshinobu Inoue.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
299a4365d0SYoshinobu Inoue.\" SUCH DAMAGE.
309a4365d0SYoshinobu Inoue.\"
319a4365d0SYoshinobu Inoue.Dd April 10, 1999
329a4365d0SYoshinobu Inoue.Dt GIF 4
3312900fe3SJeroen Ruigrok van der Werven.Os
349a4365d0SYoshinobu Inoue.Sh NAME
359a4365d0SYoshinobu Inoue.Nm gif
36eb083802SRuslan Ermilov.Nd generic tunnel interface
379a4365d0SYoshinobu Inoue.Sh SYNOPSIS
38fe403d8dSBrooks Davis.Cd "device gif"
399a4365d0SYoshinobu Inoue.Sh DESCRIPTION
409a4365d0SYoshinobu InoueThe
419a4365d0SYoshinobu Inoue.Nm
429a4365d0SYoshinobu Inoueinterface is a generic tunnelling pseudo device for IPv4 and IPv6.
439a4365d0SYoshinobu InoueIt can tunnel IPv[46] traffic over IPv[46].
449a4365d0SYoshinobu InoueTherefore, there can be four possible configurations.
459a4365d0SYoshinobu InoueThe behavior of
469a4365d0SYoshinobu Inoue.Nm
4733841545SHajimu UMEMOTOis mainly based on RFC2893 IPv6-over-IPv4 configured tunnel.
4833841545SHajimu UMEMOTOOn
4933841545SHajimu UMEMOTO.Nx ,
5033841545SHajimu UMEMOTO.Nm
5133841545SHajimu UMEMOTOcan also tunnel ISO traffic over IPv[46] using EON encapsulation.
529a4365d0SYoshinobu Inoue.Pp
53601404ecSBrooks DavisEach
54f823d4a6SBrooks Davis.Nm
55601404ecSBrooks Davisinterface is created at runtime using interface cloning.
560787ca52SRuslan ErmilovThis is
57f823d4a6SBrooks Davismost easily done with the
58f823d4a6SBrooks Davis.Xr ifconfig 8
59f823d4a6SBrooks Davis.Cm create
60601404ecSBrooks Daviscommand or using the
61fb5293cfSRuslan Ermilov.Va gifconfig_ Ns Aq Ar interface
62601404ecSBrooks Davisvariable in
63601404ecSBrooks Davis.Xr rc.conf 5 .
64f823d4a6SBrooks Davis.Pp
659a4365d0SYoshinobu InoueTo use
664b66483fSRuslan Ermilov.Nm ,
679a4365d0SYoshinobu Inoueadministrator needs to configure protocol and addresses used for the outer
689a4365d0SYoshinobu Inoueheader.
699a4365d0SYoshinobu InoueThis can be done by using
709a4365d0SYoshinobu Inoue.Xr gifconfig 8 ,
719a4365d0SYoshinobu Inoueor
729a4365d0SYoshinobu Inoue.Dv SIOCSIFPHYADDR
739a4365d0SYoshinobu Inoueioctl.
749a4365d0SYoshinobu InoueAlso, administrator needs to configure protocol and addresses used for the
759a4365d0SYoshinobu Inoueinner header, by using
769a4365d0SYoshinobu Inoue.Xr ifconfig 8 .
779a4365d0SYoshinobu InoueNote that IPv6 link-local address
78c4d9468eSRuslan Ermilov(those start with
79c4d9468eSRuslan Ermilov.Li fe80:: )
809a4365d0SYoshinobu Inouewill be automatically configured whenever possible.
819a4365d0SYoshinobu InoueYou may need to remove IPv6 link-local address manually using
829a4365d0SYoshinobu Inoue.Xr ifconfig 8 ,
839a4365d0SYoshinobu Inouewhen you would like to disable the use of IPv6 as inner header
84c4d9468eSRuslan Ermilov(like when you need pure IPv4-over-IPv6 tunnel).
859a4365d0SYoshinobu InoueFinally, use routing table to route the packets toward
869a4365d0SYoshinobu Inoue.Nm
879a4365d0SYoshinobu Inoueinterface.
889a4365d0SYoshinobu Inoue.Pp
899a4365d0SYoshinobu Inoue.Nm
909a4365d0SYoshinobu Inouecan be configured to be ECN friendly.
919a4365d0SYoshinobu InoueThis can be configured by
929a4365d0SYoshinobu Inoue.Dv IFF_LINK1 .
939a4365d0SYoshinobu Inoue.Ss ECN friendly behavior
949a4365d0SYoshinobu Inoue.Nm
959a4365d0SYoshinobu Inouecan be configured to be ECN friendly, as described in
96f6038661SJun-ichiro itojun Hagino.Dv draft-ietf-ipsec-ecn-02.txt .
979a4365d0SYoshinobu InoueThis is turned off by default, and can be turned on by
989a4365d0SYoshinobu Inoue.Dv IFF_LINK1
999a4365d0SYoshinobu Inoueinterface flag.
1009a4365d0SYoshinobu Inoue.Pp
1019a4365d0SYoshinobu InoueWithout
1029a4365d0SYoshinobu Inoue.Dv IFF_LINK1 ,
1039a4365d0SYoshinobu Inoue.Nm
10433841545SHajimu UMEMOTOwill show a normal behavior, like described in RFC2893.
1059a4365d0SYoshinobu InoueThis can be summarized as follows:
1069a4365d0SYoshinobu Inoue.Bl -tag -width "Ingress" -offset indent
1079a4365d0SYoshinobu Inoue.It Ingress
1089a4365d0SYoshinobu InoueSet outer TOS bit to
1099a4365d0SYoshinobu Inoue.Dv 0 .
1109a4365d0SYoshinobu Inoue.It Egress
1119a4365d0SYoshinobu InoueDrop outer TOS bit.
1129a4365d0SYoshinobu Inoue.El
1139a4365d0SYoshinobu Inoue.Pp
1149a4365d0SYoshinobu InoueWith
1159a4365d0SYoshinobu Inoue.Dv IFF_LINK1 ,
1169a4365d0SYoshinobu Inoue.Nm
1179a4365d0SYoshinobu Inouewill copy ECN bits
118c4d9468eSRuslan Ermilov.Dv ( 0x02
1199a4365d0SYoshinobu Inoueand
1209a4365d0SYoshinobu Inoue.Dv 0x01
121c4d9468eSRuslan Ermilovon IPv4 TOS byte or IPv6 traffic class byte)
1229a4365d0SYoshinobu Inoueon egress and ingress, as follows:
1239a4365d0SYoshinobu Inoue.Bl -tag -width "Ingress" -offset indent
1249a4365d0SYoshinobu Inoue.It Ingress
1259a4365d0SYoshinobu InoueCopy TOS bits except for ECN CE
126c4d9468eSRuslan Ermilov(masked with
127c4d9468eSRuslan Ermilov.Dv 0xfe )
1289a4365d0SYoshinobu Inouefrom
1299a4365d0SYoshinobu Inoueinner to outer.
130c75526d5SRuslan ErmilovSet ECN CE bit to
1319a4365d0SYoshinobu Inoue.Dv 0 .
1329a4365d0SYoshinobu Inoue.It Egress
1339a4365d0SYoshinobu InoueUse inner TOS bits with some change.
1349a4365d0SYoshinobu InoueIf outer ECN CE bit is
1359a4365d0SYoshinobu Inoue.Dv 1 ,
1369a4365d0SYoshinobu Inoueenable ECN CE bit on the inner.
1379a4365d0SYoshinobu Inoue.El
1389a4365d0SYoshinobu Inoue.Pp
13933841545SHajimu UMEMOTONote that the ECN friendly behavior violates RFC2893.
140f6038661SJun-ichiro itojun HaginoThis should be used in mutual agreement with the peer.
141f6038661SJun-ichiro itojun Hagino.Ss Security
142f6038661SJun-ichiro itojun HaginoMalicious party may try to circumvent security filters by using
143f6038661SJun-ichiro itojun Haginotunnelled packets.
144f6038661SJun-ichiro itojun HaginoFor better protection,
1459a4365d0SYoshinobu Inoue.Nm
146f6038661SJun-ichiro itojun Haginoperforms martian filter and ingress filter against outer source address,
147f6038661SJun-ichiro itojun Haginoon egress.
148f6038661SJun-ichiro itojun HaginoNote that martian/ingress filters are no way complete.
149f6038661SJun-ichiro itojun HaginoYou may want to secure your node by using packet filters.
15033841545SHajimu UMEMOTOIngress filter can be turned off by
15133841545SHajimu UMEMOTO.Dv IFF_LINK2
15233841545SHajimu UMEMOTObit.
1539a4365d0SYoshinobu Inoue.\"
154872f786aSBrooks Davis.Ss Miscellaneous
155d0f16f93SRuslan ErmilovBy default,
156872f786aSBrooks Davis.Nm
157872f786aSBrooks Davistunnels may not be nested.
158872f786aSBrooks DavisThis behavior may be modified at runtime by setting the
159872f786aSBrooks Davis.Xr sysctl 8
160872f786aSBrooks Davisvariable
161872f786aSBrooks Davis.Va net.link.gif.max_nesting
162872f786aSBrooks Davisto the desired level of nesting.
163872f786aSBrooks DavisAdditionally,
164872f786aSBrooks Davis.Nm
165872f786aSBrooks Davistunnels are restricted to one per pair of end points.
166872f786aSBrooks DavisParallel tunnels may be enabled by setting the
167872f786aSBrooks Davis.Xr sysctl 8
168872f786aSBrooks Davisvariable
169872f786aSBrooks Davis.Va net.link.gif.parallel_tunnels
170872f786aSBrooks Davisto 1.
1719a4365d0SYoshinobu Inoue.Sh SEE ALSO
1729a4365d0SYoshinobu Inoue.Xr inet 4 ,
1739a4365d0SYoshinobu Inoue.Xr inet6 4 ,
174f6038661SJun-ichiro itojun Hagino.Xr gifconfig 8
175f6038661SJun-ichiro itojun Hagino.Rs
176f6038661SJun-ichiro itojun Hagino.%A	R. Gilligan
177f6038661SJun-ichiro itojun Hagino.%A	E. Nordmark
17833841545SHajimu UMEMOTO.%B	RFC2893
179f6038661SJun-ichiro itojun Hagino.%T	Transition Mechanisms for IPv6 Hosts and Routers
18033841545SHajimu UMEMOTO.%D	August 2000
18133841545SHajimu UMEMOTO.%O	ftp://ftp.isi.edu/in-notes/rfc2893.txt
182f6038661SJun-ichiro itojun Hagino.Re
1839a4365d0SYoshinobu Inoue.Rs
1849a4365d0SYoshinobu Inoue.%A	Sally Floyd
1859a4365d0SYoshinobu Inoue.%A	David L. Black
1869a4365d0SYoshinobu Inoue.%A	K. K. Ramakrishnan
1879a4365d0SYoshinobu Inoue.%T	"IPsec Interactions with ECN"
188f6038661SJun-ichiro itojun Hagino.%D	December 1999
189f6038661SJun-ichiro itojun Hagino.%O	draft-ietf-ipsec-ecn-02.txt
1909a4365d0SYoshinobu Inoue.Re
1919a4365d0SYoshinobu Inoue.\"
1929a4365d0SYoshinobu Inoue.Sh HISTORY
1939a4365d0SYoshinobu InoueThe
1949a4365d0SYoshinobu Inoue.Nm
1959a4365d0SYoshinobu Inouedevice first appeared in WIDE hydrangea IPv6 kit.
196f6038661SJun-ichiro itojun Hagino.\"
197f6038661SJun-ichiro itojun Hagino.Sh BUGS
198f6038661SJun-ichiro itojun HaginoThere are many tunnelling protocol specifications,
199f6038661SJun-ichiro itojun Haginodefined differently from each other.
200f6038661SJun-ichiro itojun Hagino.Nm
201f6038661SJun-ichiro itojun Haginomay not interoperate with peers which are based on different specifications,
202f6038661SJun-ichiro itojun Haginoand are picky about outer header fields.
203f6038661SJun-ichiro itojun HaginoFor example, you cannot usually use
204f6038661SJun-ichiro itojun Hagino.Nm
205f6038661SJun-ichiro itojun Haginoto talk with IPsec devices that use IPsec tunnel mode.
206f6038661SJun-ichiro itojun Hagino.Pp
207f6038661SJun-ichiro itojun HaginoThe current code does not check if the ingress address
208c4d9468eSRuslan Ermilov(outer source address)
209f6038661SJun-ichiro itojun Haginoconfigured to
210f6038661SJun-ichiro itojun Hagino.Nm
211f6038661SJun-ichiro itojun Haginomakes sense.
212f6038661SJun-ichiro itojun HaginoMake sure to configure an address which belongs to your node.
213f6038661SJun-ichiro itojun HaginoOtherwise, your node will not be able to receive packets from the peer,
214f6038661SJun-ichiro itojun Haginoand your node will generate packets with a spoofed source address.
215f6038661SJun-ichiro itojun Hagino.Pp
21633841545SHajimu UMEMOTOIf the outer protocol is IPv4,
21733841545SHajimu UMEMOTO.Nm
21833841545SHajimu UMEMOTOdoes not try to perform path MTU discovery for the encapsulated packet
219c4d9468eSRuslan Ermilov(DF bit is set to 0).
22033841545SHajimu UMEMOTO.Pp
22133841545SHajimu UMEMOTOIf the outer protocol is IPv6, path MTU discovery for encapsulated packet
22233841545SHajimu UMEMOTOmay affect communication over the interface.
22333841545SHajimu UMEMOTOThe first bigger-than-pmtu packet may be lost.
22433841545SHajimu UMEMOTOTo avoid the problem, you may want to set the interface MTU for
22533841545SHajimu UMEMOTO.Nm
22633841545SHajimu UMEMOTOto 1240 or smaller, when outer header is IPv6 and inner header is IPv4.
22733841545SHajimu UMEMOTO.Pp
22833841545SHajimu UMEMOTO.Nm
22933841545SHajimu UMEMOTOdoes not translate ICMP messages for outer header into inner header.
23033841545SHajimu UMEMOTO.Pp
23133841545SHajimu UMEMOTOIn the past,
23233841545SHajimu UMEMOTO.Nm
23333841545SHajimu UMEMOTOhad a multi-destination behavior, configurable via
23433841545SHajimu UMEMOTO.Dv IFF_LINK0
23533841545SHajimu UMEMOTOflag.
23633841545SHajimu UMEMOTOThe behavior was obsoleted and is no longer supported.
237