IST(4)

NAME
ist - ISATAP tunnel interface

SYNOPSIS
pseudo-device ist [count]

DESCRIPTION
The ist interface supports “ISATAP” IPv6 in IPv4 encapsulation. It can tunnel IPv6 traffic over IPv4, as specified in draft-ietf-ngtrans-isatap-08.txt (ISATAP).

  ISATAP
ist interface requires certain configurations to work properly. according to the ISATAP protocol.

•   A statically configured valid ISATAP linklocal address: “A valid ISATAP address” is an address which has the following properties. If any of the following properties are not satisfied, ist raises runtime error on packet transmission. Read the specification for more details.

    •   matches fe80::0000:5efe:xxyy:zzuu/64 where xxyy:zzuu is a hexadecimal notation of an IPv4 address for the node.

        IPv4 address can be taken from any of interfaces your node has.

    •   Global IPv6 prefix is automatically configured by Router-Advertisement from an ISATAP router.

•   At least one IPv4 address of ISATAP routers: It is available in many ways, such as a sepecial domain name ("isatap.domainname"), DHCP option, manual configuration etc.

If you would like the node to behave as an ISATAP router, you have to assign non-linklocal IPv6 addresses to the ISATAP interface in addition to the above two, and distribute the prefixes by Router-Advertisement as is done with normal physical interfaces.

ist can also be configured to be ECN friendly by IFF_LINK1. See gif(4) for details.

Please note that ISATAP specification is written as “accept tunnelled packet from everyone within a site” tunnelling device. By enabling ist device, you are making it much easier for malicious parties to inject fabricated IPv6 packet to your node. Also, malicious party can inject an IPv6 packet with fabricated source address to make your node generate improper tunnelled packet. Administrators must take caution when enabling the interface. To prevent possible attacks, ist interface filters out the following packets. Note that the checks are no way complete:

•   Packets with IPv4 unspecified address as outer IPv4 source/destination (0.0.0.0/8)

•   Packets with loopback address as outer IPv4 source/destination (127.0.0.0/8)

•   Packets with IPv4 multicast address as outer IPv4 source/destination (224.0.0.0/4)

•   Packets with limited broadcast address as outer IPv4 source/destination (255.0.0.0/8)

•   Packets with subnet broadcast address as outer IPv4 source/destination. The check is made against subnet broadcast addresses for all of the directly connected subnets.

•   Packets that does not pass ingress filtering. Outer IPv4 source address must meet the IPv4 topology on the routing table. Ingress filter can be turned off by IFF_LINK2 bit.

•   The same set of rules are applied against the IPv4 address embedded into inner IPv6 address, if the IPv6 address matches on-line prefixes on ist interface.

•   Packets not from any of the ISATAP routers in terms of IPv4, if the inner IPv6 source does not match with on-line prefixes on ist interface.

•   Packets with multicast address as inner IPv6 source/destination

It is recommended to filter/audit incoming IPv4 packet with IP protocol number 41, as necessary. It is also recommended to filter/audit encapsulated IPv6 packets as well. You may also want to run normal ingress filter against inner IPv6 address to avoid spoofing.

By setting the IFF_LINK0 flag on the ist interface, it is possible to disable the input path, making the direct attacks from the outside impossible. Note, however, there are other security risks exist.

EXAMPLES

  ISATAP
In this example, the ISATAP router's IPv4 address is 133.4.1.1 and 133.4.1.2.

Here's the host side configuration. Please take care that you have to send Router Solicitation periodically by “rtsold” , since ISATAP routers cannot advertise unsolicited Router Advertisements.

    # ifconfig ne0 inet 133.4.5.6 netmask 0xffffff00
    # ifconfig ist0 isataprtr 133.4.1.1
    # ifconfig ist0 isataprtr 133.4.1.2
    # ifconfig ist0 inet6 fe80::5efe:133.4.5.6 prefixlen 64
    # rtsold ist0

Here's the router side configuration.

    # ifconfig ne0 inet 133.4.1.1 netmask 0xffffff00
    # ifconfig ist0 isataprtr 133.4.1.1
    # ifconfig ist0 isataprtr 133.4.1.2
    # ifconfig ist0 inet6 fe80::5efe:133.4.1.1 prefixlen 64
    # ifconfig ist0 inet6 3ffe:ffff:ffff:1::5efe:133.4.1.1 prefixlen 64 alias
    # rtadvd ist0

SEE ALSO
gif(4), inet(4), inet6(4) Fred Templin, Tim Gleeson, Mohit Talwar, Dave Thaler, Intra-Site Automatic Tunneling Addressing Protocol (ISATAP), Dec 2002, draft-ietf-ngtrans-isatap-08.txt.

HISTORY
The ist device first appeared in WIDE/KAME IPv6 stack.