Manual Pages for UNIX Darwin command on man stf

STF(4) BSD Kernel Interfaces Manual STF(4)

NAME

ssttff - 6to4 tunnel interface

SYNOPSIS

ppsseeuuddoo-ddeevviiccee ssttff

DESCRIPTION

The ssttff interface supports ``6to4'' IPv6 in IPv4 encapsulation. It can tunnel IPv6 traffic over IPv4, as specified in RFC3056. For ordinary nodes in 6to4 site, you do not need ssttff interface. The ssttff interface is necessary for site border router (called ``6to4 router'' in the specification). Due to the way 6to4 protocol is specified, ssttff interface requires certain configuration to work properly. Single (no more than 1) valid 6to4 address needs to be configured to the interface. ``A valid 6to4 address'' is an address which has the following properties. If any of the following properties are not satisfied, ssttff raises runtime error on packet transmission. Read the specification for more details. ++oo matches 2002:xxyy:zzuu::/48 where xxyy:zzuu is a hexadecimal notation of an IPv4 address for the node. IPv4 address can be taken from any of interfaces your node has. Since the specification forbids the use of IPv4 private address, the address needs to be a global IPv4 address. ++oo Subnet identifier portion (48th to 63rd bit) and interface identifier

portion (lower 64 bits) are properly filled to avoid address colli-

sions. If you would like the node to behave as a relay router, the prefix length

for the IPv6 interface address needs to be 16 so that the node would con-

sider any 6to4 destination as ``on-link''. If you would like to restrict

6to4 peers to be inside certain IPv4 prefix, you may want to configure IPv6 prefix length as ``16 + IPv4 prefix length''. ssttff interface will check the IPv4 source address on packets, if the IPv6 prefix length is larger than 16. ssttff can be configured to be ECN friendly. This can be configured by IFFLINK1. See gif(4) for details. Please note that 6to4 specification is written as ``accept tunnelled packet from everyone'' tunnelling device. By enabling ssttff device, you are making it much easier for malicious parties to inject fabricated IPv6 packet to your node. Also, malicious party can inject an IPv6 packet

with fabricated source address to make your node generate improper tun-

nelled packet. Administrators must take caution when enabling the inter-

face. To prevent possible attacks, ssttff interface filters out the follow-

ing packets. Note that the checks are no way complete: ++oo Packets with IPv4 unspecified addrss as outer IPv4 source/destination (0.0.0.0/8) ++oo Packets with loopback address as outer IPv4 source/destination (127.0.0.0/8) ++oo Packets with IPv4 multicast address as outer IPv4 source/destination (224.0.0.0/4)

++oo Packets with limited broadcast address as outer IPv4 source/destina-

tion (255.0.0.0/8)

++oo Packets with subnet broadcast address as outer IPv4 source/destina-

tion. The check is made against subnet broadcast addresses for all of the directly connected subnets. ++oo Packets that does not pass ingress filtering. Outer IPv4 source address must meet the IPv4 topology on the routing table. Ingress filter can be turned off by IFFLINK2 bit. ++oo The same set of rules are appplied against the IPv4 address embedded into inner IPv6 address, if the IPv6 address matches 6to4 prefix. It is recommended to filter/audit incoming IPv4 packet with IP protocol

number 41, as necessary. It is also recommended to filter/audit encapsu-

lated IPv6 packets as well. You may also want to run normal ingress fil-

ter against inner IPv6 address to avoid spoofing. By setting the IFFLINK0 flag on the ssttff interface, it is possible to

disable the input path, making the direct attacks from the outside impos-

sible. Note, however, there are other security risks exist. If you wish to use the configuration, you must not advertise your 6to4 address to others. EEXXAAMMPPLLEESS Note that 8504:0506 is equal to 133.4.5.6, written in hexadecimals.

# ifconfig ne0 inet 133.4.5.6 netmask 0xffffff00

# ifconfig stf0 inet6 2002:8504:0506:0000:a00:5aff:fe38:6f86 \

prefixlen 16 alias The following configuration accepts packets from IPv4 source 9.1.0.0/16 only. It emits 6to4 packet only for IPv6 destination 2002:0901::/32 (IPv4 destination will match 9.1.0.0/16).

# ifconfig ne0 inet 9.1.2.3 netmask 0xffff0000

# ifconfig stf0 inet6 2002:0901:0203:0000:a00:5aff:fe38:6f86 \

prefixlen 32 alias

The following configuration uses the ssttff interface as an output-only

device. You need to have alternative IPv6 connectivity (other than 6to4) to use this configuration. For outbound traffic, you can reach other 6to4 networks efficiently via ssttff. For inbound traffic, you will not

receive any 6to4-tunneled packets (less security drawbacks). Be careful

not to advertise your 6to4 prefix to others (2002:8504:0506::/48), and not to use your 6to4 prefix as a source.

# ifconfig ne0 inet 133.4.5.6 netmask 0xffffff00

# ifconfig stf0 inet6 2002:8504:0506:0000:a00:5aff:fe38:6f86 \

prefixlen 16 alias deprecated link0

# route add -inet6 2002:: -prefixlen 16 ::1

# route change -inet6 2002:: -prefixlen 16 ::1 -ifp stf0

BUGS

No more than one ssttff interface is allowed for a node, and no more than one IPv6 interface address is allowed for an ssttff interface. It is to avoid source address selection conflicts between IPv6 layer and IPv4 layer, and to cope with ingress filtering rule on the other side. This is a feature to make ssttff work right for all occasions. BSD April 27, 2001 BSD