[src/trunk]: src/share/man/man4 improve bugs and security section. correct r...

[itojun <itojun%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2288fd94dfde
branches:  trunk
changeset: 485105:2288fd94dfde
user:      itojun <itojun%NetBSD.org@localhost>
date:      Wed Apr 19 06:31:49 2000 +0000

description:
improve bugs and security section.  correct reference.
(sync with kame)

diffstat:

 share/man/man4/gif.4 |  67 ++++++++++++++++++++++++++++++++++++++++++---------
 1 files changed, 55 insertions(+), 12 deletions(-)

diffs (132 lines):

diff -r 03614dcd6867 -r 2288fd94dfde share/man/man4/gif.4
--- a/share/man/man4/gif.4      Wed Apr 19 06:30:51 2000 +0000
+++ b/share/man/man4/gif.4      Wed Apr 19 06:31:49 2000 +0000
@@ -1,6 +1,9 @@
+.\"    $NetBSD: gif.4,v 1.7 2000/04/19 06:31:49 itojun Exp $
+.\"    $KAME: gif.4,v 1.13 2000/04/17 12:09:30 itojun Exp $
+.\"
 .\" Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 .\" All rights reserved.
-.\" 
+.\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
@@ -12,7 +15,7 @@
 .\" 3. Neither the name of the project nor the names of its contributors
 .\"    may be used to endorse or promote products derived from this software
 .\"    without specific prior written permission.
-.\" 
+.\"
 .\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -25,12 +28,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"     $NetBSD: gif.4,v 1.6 2000/01/19 06:59:32 itojun Exp $
-.\"     KAME Id: gif.4,v 1.3 2000/01/19 06:16:52 itojun Exp
-.\"
 .Dd April 10, 1999
 .Dt GIF 4
-.Os KAME
+.Os
 .Sh NAME
 .Nm gif
 .Nd
@@ -49,7 +49,7 @@
 .Pp
 To use
 .Nm gif ,
-administrator needs to configure protocol and addresses used for the outer 
+administrator needs to configure protocol and addresses used for the outer
 header.
 This can be done by using
 .Xr gifconfig 8 ,
@@ -196,13 +196,13 @@
 .El
 .Pp
 Note that the ECN friendly behavior violates RFC1933.
-This should be used in mutual agreement with the tunnel endpoint.
+This should be used in mutual agreement with the peer.
 .Pp
 .Ss Backward compatibility
 .Nm
 interface will capture packets toward IPv4-in-IPv4 tunnel,
 which has been used by
-.Xr vif 4 
+.Xr vif 4
 multicast tunnel device
 .Pq used in MBone community .
 For compatibility, IPv4-in-IPv4 traffic will be matched to
@@ -210,23 +210,66 @@
 interfaces first, and then sent to
 .Xr vif 4
 if no match is found.
+.Pp
+.Ss Security
+Malicious party may try to circumvent security filters by using
+tunnelled packets.
+For better protection,
+.Nm
+performs martian filter and ingress filter against outer source address,
+on egress.
+Note that martian/ingress filters are no way complete.
+You may want to secure your node by using packet filters.
+.Pp
+As mentioned above, multi-destination mode
+.Pq Dv IFF_LINK0
+is far less secure than bidirectional mode.
 .\"
 .Sh SEE ALSO
 .Xr inet 4 ,
 .Xr inet6 4 ,
 .Xr vif 4 ,
 .Xr gifconfig 8
-RFC1933
+.Rs
+.%A    R. Gilligan
+.%A    E. Nordmark
+.%B    RFC1933
+.%T    Transition Mechanisms for IPv6 Hosts and Routers
+.%D    April 1996
+.%O    ftp://ftp.isi.edu/in-notes/rfc1933.txt
+.Re
 .Rs
 .%A    Sally Floyd
 .%A    David L. Black
 .%A    K. K. Ramakrishnan
 .%T    "IPsec Interactions with ECN"
-.%D    February 1999
-.%O    http://www.aciri.org/floyd/papers/draft-ipsec-ecn-00.txt
+.%D    December 1999
+.%O    draft-ietf-ipsec-ecn-02.txt
 .Re
 .\"
 .Sh HISTORY
 The
 .Nm
 device first appeared in WIDE hydrangea IPv6 kit.
+.\"
+.Sh BUGS
+There are many tunnelling protocol specifications,
+defined differently from each other.
+.Nm
+may not interoperate with peers which are based on different specifications,
+and are picky about outer header fields.
+For example, you cannot usually use
+.Nm
+to talk with IPsec devices that use IPsec tunnel mode.
+.Pp
+The current code does not check if the ingress address
+.Pq outer source address
+configured to
+.Nm
+makes sense.
+Make sure to configure an address which belongs to your node.
+Otherwise, your node will not be able to receive packets from the peer,
+and your node will generate packets with a spoofed source address.
+.Pp
+If the outer protocol is IPv6, path MTU discovery for encapsulated packet
+may affect communication over the interface.