1.\" $KAME: inet6.4,v 1.21 2001/04/05 01:00:18 itojun Exp $ 2.\" 3.\" Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the project nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" $FreeBSD$ 31.\" 32.Dd September 2, 2009 33.Dt INET6 4 34.Os 35.Sh NAME 36.Nm inet6 37.Nd Internet protocol version 6 family 38.Sh SYNOPSIS 39.In sys/types.h 40.In netinet/in.h 41.Sh DESCRIPTION 42The 43.Nm 44family is an updated version of 45.Xr inet 4 46family. 47While 48.Xr inet 4 49implements Internet Protocol version 4, 50.Nm 51implements Internet Protocol version 6. 52.Pp 53.Nm 54is a collection of protocols layered atop the 55.Em Internet Protocol version 6 56.Pq Tn IPv6 57transport layer, and utilizing the IPv6 address format. 58The 59.Nm 60family provides protocol support for the 61.Dv SOCK_STREAM , SOCK_DGRAM , 62and 63.Dv SOCK_RAW 64socket types; the 65.Dv SOCK_RAW 66interface provides access to the 67.Tn IPv6 68protocol. 69.Sh ADDRESSING 70IPv6 addresses are 16 byte quantities, stored in network standard byteorder. 71The include file 72.In netinet/in.h 73defines this address 74as a discriminated union. 75.Pp 76Sockets bound to the 77.Nm 78family utilize the following addressing structure: 79.Bd -literal -offset indent 80struct sockaddr_in6 { 81 uint8_t sin6_len; 82 sa_family_t sin6_family; 83 in_port_t sin6_port; 84 uint32_t sin6_flowinfo; 85 struct in6_addr sin6_addr; 86 uint32_t sin6_scope_id; 87}; 88.Ed 89.Pp 90Sockets may be created with the local address 91.Dq Dv :: 92(which is equal to IPv6 address 93.Dv 0:0:0:0:0:0:0:0 ) 94to affect 95.Dq wildcard 96matching on incoming messages. 97.Pp 98The IPv6 specification defines scoped addresses, 99like link-local or site-local addresses. 100A scoped address is ambiguous to the kernel, 101if it is specified without a scope identifier. 102To manipulate scoped addresses properly from the userland, 103programs must use the advanced API defined in RFC2292. 104A compact description of the advanced API is available in 105.Xr ip6 4 . 106If a scoped address is specified without an explicit scope, 107the kernel may raise an error. 108Note that scoped addresses are not for daily use at this moment, 109both from a specification and an implementation point of view. 110.Pp 111The KAME implementation supports an extended numeric IPv6 address notation 112for link-local addresses, 113like 114.Dq Li fe80::1%de0 115to specify 116.Do 117.Li fe80::1 118on 119.Li de0 120interface 121.Dc . 122This notation is supported by 123.Xr getaddrinfo 3 124and 125.Xr getnameinfo 3 . 126Some of normal userland programs, such as 127.Xr telnet 1 128or 129.Xr ftp 1 , 130are able to use this notation. 131With special programs 132like 133.Xr ping6 8 , 134you can specify the outgoing interface by an extra command line option 135to disambiguate scoped addresses. 136.Pp 137Scoped addresses are handled specially in the kernel. 138In kernel structures like routing tables or interface structures, 139a scoped address will have its interface index embedded into the address. 140Therefore, 141the address in some kernel structures is not the same as that on the wire. 142The embedded index will become visible through a 143.Dv PF_ROUTE 144socket, kernel memory accesses via 145.Xr kvm 3 146and on some other occasions. 147HOWEVER, users should never use the embedded form. 148For details please consult 149.Pa IMPLEMENTATION 150supplied with KAME kit. 151.Sh PROTOCOLS 152The 153.Nm 154family is comprised of the 155.Tn IPv6 156network protocol, Internet Control 157Message Protocol version 6 158.Pq Tn ICMPv6 , 159Transmission Control Protocol 160.Pq Tn TCP , 161and User Datagram Protocol 162.Pq Tn UDP . 163.Tn TCP 164is used to support the 165.Dv SOCK_STREAM 166abstraction while 167.Tn UDP 168is used to support the 169.Dv SOCK_DGRAM 170abstraction. 171Note that 172.Tn TCP 173and 174.Tn UDP 175are common to 176.Xr inet 4 177and 178.Nm . 179A raw interface to 180.Tn IPv6 181is available 182by creating an Internet socket of type 183.Dv SOCK_RAW . 184The 185.Tn ICMPv6 186message protocol is accessible from a raw socket. 187.\" .Pp 188.\" The 128-bit IPv6 address contains both network and host parts. 189.\" However, direct examination of addresses is discouraged. 190.\" For those programs which absolutely need to break addresses 191.\" into their component parts, the following 192.\" .Xr ioctl 2 193.\" commands are provided for a datagram socket in the 194.\" .Nm 195.\" domain; they have the same form as the 196.\" .Dv SIOCIFADDR 197.\" command (see 198.\" .Xr intro 4 ) . 199.\" .Pp 200.\" .Bl -tag -width SIOCSIFNETMASK 201.\" .It Dv SIOCSIFNETMASK 202.\" Set interface network mask. 203.\" The network mask defines the network part of the address; 204.\" if it contains more of the address than the address type would indicate, 205.\" then subnets are in use. 206.\" .It Dv SIOCGIFNETMASK 207.\" Get interface network mask. 208.\" .El 209.\" .Sh ROUTING 210.\" The current implementation of Internet protocols includes some routing-table 211.\" adaptations to provide enhanced caching of certain end-to-end 212.\" information necessary for Transaction TCP and Path MTU Discovery. The 213.\" following changes are the most significant: 214.\" .Bl -enum 215.\" .It 216.\" All IP routes, except those with the 217.\" .Dv RTF_CLONING 218.\" flag and those to multicast destinations, have the 219.\" .Dv RTF_PRCLONING 220.\" flag forcibly enabled (they are thus said to be 221.\" .Dq "protocol cloning" ). 222.\" .It 223.\" When the last reference to an IP route is dropped, the route is 224.\" examined to determine if it was created by cloning such a route. If 225.\" this is the case, the 226.\" .Dv RTF_PROTO3 227.\" flag is turned on, and the expiration timer is initialized to go off 228.\" in net.inet.ip.rtexpire seconds. If such a route is re-referenced, 229.\" the flag and expiration timer are reset. 230.\" .It 231.\" A kernel timeout runs once every ten minutes, or sooner if there are 232.\" soon-to-expire routes in the kernel routing table, and deletes the 233.\" expired routes. 234.\" .El 235.\" .Pp 236.\" A dynamic process is in place to modify the value of 237.\" net.inet.ip.rtexpire if the number of cached routes grows too large. 238.\" If after an expiration run there are still more than 239.\" net.inet.ip.rtmaxcache unreferenced routes remaining, the rtexpire 240.\" value is multiplied by 3/4, and any routes which have longer 241.\" expiration times have those times adjusted. This process is damped 242.\" somewhat by specification of a minimum rtexpire value 243.\" (net.inet.ip.rtminexpire), and by restricting the reduction to once in 244.\" a ten-minute period. 245.\" .Pp 246.\" If some external process deletes the original route from which a 247.\" protocol-cloned route was generated, the ``child route'' is deleted. 248.\" (This is actually a generic mechanism in the routing code support for 249.\" protocol-requested cloning.) 250.\" .Pp 251.\" No attempt is made to manage routes which were not created by protocol 252.\" cloning; these are assumed to be static, under the management of an 253.\" external routing process, or under the management of a link layer 254.\" (e.g., 255.\" .Tn ARP 256.\" for Ethernets). 257.\" .Pp 258.\" Only certain types of network activity will result in the cloning of a 259.\" route using this mechanism. Specifically, those protocols (such as 260.\" .Tn TCP 261.\" and 262.\" .Tn UDP ) 263.\" which themselves cache a long-lasting reference to route for a destination 264.\" will trigger the mechanism; whereas raw 265.\" .Tn IP 266.\" packets, whether locally-generated or forwarded, will not. 267.Ss MIB Variables 268A number of variables are implemented in the net.inet6 branch of the 269.Xr sysctl 3 270MIB. 271In addition to the variables supported by the transport protocols 272(for which the respective manual pages may be consulted), 273the following general variables are defined: 274.Bl -tag -width IPV6CTL_MAXFRAGPACKETS 275.It Dv IPV6CTL_FORWARDING 276.Pq ip6.forwarding 277Boolean: enable/disable forwarding of 278.Tn IPv6 279packets. 280Also, identify if the node is acting as a router. 281Defaults to off. 282.It Dv IPV6CTL_SENDREDIRECTS 283.Pq ip6.redirect 284Boolean: enable/disable sending of 285.Tn ICMPv6 286redirects in response to unforwardable 287.Tn IPv6 288packets. 289This option is ignored unless the node is routing 290.Tn IPv6 291packets, 292and should normally be enabled on all systems. 293Defaults to on. 294.It Dv IPV6CTL_DEFHLIM 295.Pq ip6.hlim 296Integer: default hop limit value to use for outgoing 297.Tn IPv6 298packets. 299This value applies to all the transport protocols on top of 300.Tn IPv6 . 301There are APIs to override the value. 302.It Dv IPV6CTL_MAXFRAGPACKETS 303.Pq ip6.maxfragpackets 304Integer: default maximum number of fragmented packets the node will accept. 3050 means that the node will not accept any fragmented packets. 306-1 means that the node will accept as many fragmented packets as it receives. 307The flag is provided basically for avoiding possible DoS attacks. 308.It Dv IPV6CTL_ACCEPT_RTADV 309.Pq ip6.accept_rtadv 310Boolean: the default value of a per-interface flag to 311enable/disable receiving of 312.Tn ICMPv6 313router advertisement packets, 314and autoconfiguration of address prefixes and default routers. 315The node must be a host 316(not a router) 317for the option to be meaningful. 318Defaults to off. 319.It Dv IPV6CTL_AUTO_LINKLOCAL 320.Pq ip6.auto_linklocal 321Boolean: the default value of a per-interface flag to 322enable/disable performing automatic link-local address configuration. 323Defaults to on. 324.It Dv IPV6CTL_KEEPFAITH 325.Pq ip6.keepfaith 326Boolean: enable/disable 327.Dq FAITH 328TCP relay IPv6-to-IPv4 translator code in the kernel. 329Refer 330.Xr faith 4 331and 332.Xr faithd 8 333for detail. 334Defaults to off. 335.It Dv IPV6CTL_LOG_INTERVAL 336.Pq ip6.log_interval 337Integer: default interval between 338.Tn IPv6 339packet forwarding engine log output 340(in seconds). 341.It Dv IPV6CTL_HDRNESTLIMIT 342.Pq ip6.hdrnestlimit 343Integer: default number of the maximum 344.Tn IPv6 345extension headers 346permitted on incoming 347.Tn IPv6 348packets. 349If set to 0, the node will accept as many extension headers as possible. 350.It Dv IPV6CTL_DAD_COUNT 351.Pq ip6.dad_count 352Integer: default number of 353.Tn IPv6 354DAD 355.Pq duplicated address detection 356probe packets. 357The packets will be generated when 358.Tn IPv6 359interface addresses are configured. 360.It Dv IPV6CTL_AUTO_FLOWLABEL 361.Pq ip6.auto_flowlabel 362Boolean: enable/disable automatic filling of 363.Tn IPv6 364flowlabel field, for outstanding connected transport protocol packets. 365The field might be used by intermediate routers to identify packet flows. 366Defaults to on. 367.It Dv IPV6CTL_DEFMCASTHLIM 368.Pq ip6.defmcasthlim 369Integer: default hop limit value for an 370.Tn IPv6 371multicast packet sourced by the node. 372This value applies to all the transport protocols on top of 373.Tn IPv6 . 374There are APIs to override the value as documented in 375.Xr ip6 4 . 376.It Dv IPV6CTL_GIF_HLIM 377.Pq ip6.gifhlim 378Integer: default maximum hop limit value for an 379.Tn IPv6 380packet generated by 381.Xr gif 4 382tunnel interface. 383.It Dv IPV6CTL_KAME_VERSION 384.Pq ip6.kame_version 385String: identifies the version of KAME 386.Tn IPv6 387stack implemented in the kernel. 388.It Dv IPV6CTL_USE_DEPRECATED 389.Pq ip6.use_deprecated 390Boolean: enable/disable use of deprecated address, 391specified in RFC2462 5.5.4. 392Defaults to on. 393.It Dv IPV6CTL_RR_PRUNE 394.Pq ip6.rr_prune 395Integer: default interval between 396.Tn IPv6 397router renumbering prefix babysitting, in seconds. 398.It Dv IPV6CTL_V6ONLY 399.Pq ip6.v6only 400Boolean: enable/disable the prohibited use of 401.Tn IPv4 402mapped address on 403.Dv AF_INET6 404sockets. 405Defaults to on. 406.It Dv IPV6CTL_RTEXPIRE 407.Pq ip6.rtexpire 408Integer: lifetime in seconds of protocol-cloned 409.Tn IP 410routes after the last reference drops (default one hour). 411.\"This value varies dynamically as described above. 412.It Dv IPV6CTL_RTMINEXPIRE 413.Pq ip6.rtminexpire 414Integer: minimum value of ip.rtexpire (default ten seconds). 415.\"This value has no effect on user modifications, but restricts the dynamic 416.\"adaptation described above. 417.It Dv IPV6CTL_RTMAXCACHE 418.Pq ip6.rtmaxcache 419Integer: trigger level of cached, unreferenced, protocol-cloned routes 420which initiates dynamic adaptation (default 128). 421.El 422.Ss Interaction between IPv4/v6 sockets 423By default, 424.Fx 425does not route IPv4 traffic to 426.Dv AF_INET6 427sockets. 428The default behavior intentionally violates RFC2553 for security reasons. 429Listen to two sockets if you want to accept both IPv4 and IPv6 traffic. 430IPv4 traffic may be routed with certain 431per-socket/per-node configuration, however, it is not recommended to do so. 432Consult 433.Xr ip6 4 434for details. 435.Pp 436The behavior of 437.Dv AF_INET6 438TCP/UDP socket is documented in RFC2553. 439Basically, it says this: 440.Bl -bullet -compact 441.It 442A specific bind on an 443.Dv AF_INET6 444socket 445.Xr ( bind 2 446with an address specified) 447should accept IPv6 traffic to that address only. 448.It 449If you perform a wildcard bind 450on an 451.Dv AF_INET6 452socket 453.Xr ( bind 2 454to IPv6 address 455.Li :: ) , 456and there is no wildcard bind 457.Dv AF_INET 458socket on that TCP/UDP port, IPv6 traffic as well as IPv4 traffic 459should be routed to that 460.Dv AF_INET6 461socket. 462IPv4 traffic should be seen as if it came from an IPv6 address like 463.Li ::ffff:10.1.1.1 . 464This is called an IPv4 mapped address. 465.It 466If there are both a wildcard bind 467.Dv AF_INET 468socket and a wildcard bind 469.Dv AF_INET6 470socket on one TCP/UDP port, they should behave separately. 471IPv4 traffic should be routed to the 472.Dv AF_INET 473socket and IPv6 should be routed to the 474.Dv AF_INET6 475socket. 476.El 477.Pp 478However, RFC2553 does not define the ordering constraint between calls to 479.Xr bind 2 , 480nor how IPv4 TCP/UDP port numbers and IPv6 TCP/UDP port numbers 481relate to each other 482(should they be integrated or separated). 483Implemented behavior is very different from kernel to kernel. 484Therefore, it is unwise to rely too much upon the behavior of 485.Dv AF_INET6 486wildcard bind sockets. 487It is recommended to listen to two sockets, one for 488.Dv AF_INET 489and another for 490.Dv AF_INET6 , 491when you would like to accept both IPv4 and IPv6 traffic. 492.Pp 493It should also be noted that 494malicious parties can take advantage of the complexity presented above, 495and are able to bypass access control, 496if the target node routes IPv4 traffic to 497.Dv AF_INET6 498socket. 499Users are advised to take care handling connections 500from IPv4 mapped address to 501.Dv AF_INET6 502sockets. 503.Sh SEE ALSO 504.Xr ioctl 2 , 505.Xr socket 2 , 506.Xr sysctl 3 , 507.Xr icmp6 4 , 508.Xr intro 4 , 509.Xr ip6 4 , 510.Xr tcp 4 , 511.Xr udp 4 512.Sh STANDARDS 513.Rs 514.%A Tatsuya Jinmei 515.%A Atsushi Onoe 516.%T "An Extension of Format for IPv6 Scoped Addresses" 517.%R internet draft 518.%D June 2000 519.%N draft-ietf-ipngwg-scopedaddr-format-02.txt 520.%O work in progress material 521.Re 522.Sh HISTORY 523The 524.Nm 525protocol interfaces are defined in RFC2553 and RFC2292. 526The implementation described herein appeared in the WIDE/KAME project. 527.Sh BUGS 528The IPv6 support is subject to change as the Internet protocols develop. 529Users should not depend on details of the current implementation, 530but rather the services exported. 531.Pp 532Users are suggested to implement 533.Dq version independent 534code as much as possible, as you will need to support both 535.Xr inet 4 536and 537.Nm . 538