sync with kame. more security warnings

1 files changed, 57 insertions, 26 deletions

diff --git a/share/man/man4/gif.4 b/share/man/man4/gif.4
index 7034358..e10dc90 100644
--- a/share/man/man4/gif.4
+++ b/share/man/man4/gif.4
@@ -1,6 +1,9 @@
+.\"	$FreeBSD$
+.\"	$KAME: gif.4,v 1.17 2000/06/30 18:31:27 itojun Exp $
+.\"
 .\" Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 .\" All rights reserved.
-.\" 
+.\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
@@ -12,7 +15,7 @@
 .\" 3. Neither the name of the project nor the names of its contributors
 .\"    may be used to endorse or promote products derived from this software
 .\"    without specific prior written permission.
-.\" 
+.\"
 .\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -25,9 +28,6 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"     $Id: gif.4,v 1.2 1999/09/29 15:36:17 itojun Exp $
-.\"     $FreeBSD$
-.\"
 .Dd April 10, 1999
 .Dt GIF 4
 .Os
@@ -36,7 +36,7 @@
 .Nd
 .Tn Generic tunnel interface
 .Sh SYNOPSIS
-.Cd "pseudo-device gif 4"
+.Cd "pseudo-device gif" Op Ar count
 .Sh DESCRIPTION
 The
 .Nm
@@ -49,7 +49,7 @@ is mainly based on RFC1933 IPv6-over-IPv4 configured tunnel.
 .Pp
 To use
 .Nm gif ,
-administrator needs to configure protocol and addresses used for the outer 
+administrator needs to configure protocol and addresses used for the outer
 header.
 This can be done by using
 .Xr gifconfig 8 ,
@@ -148,7 +148,7 @@ and can be attacked from a malicious node.
 .Ss ECN friendly behavior
 .Nm
 can be configured to be ECN friendly, as described in
-.Dv draft-ipsec-ecn-00.txt .
+.Dv draft-ietf-ipsec-ecn-02.txt .
 This is turned off by default, and can be turned on by
 .Dv IFF_LINK1
 interface flag.
@@ -196,37 +196,68 @@ enable ECN CE bit on the inner.
 .El
 .Pp
 Note that the ECN friendly behavior violates RFC1933.
-This should be used in mutual agreement with the tunnel endpoint.
+This should be used in mutual agreement with the peer.
 .Pp
-.Ss Backward compatibility
-.Nm
-interface will capture packets toward IPv4-in-IPv4 tunnel,
-which has been used by
-.Xr vif 4 
-multicast tunnel device
-.Pq used in MBone community .
-For compatibility, IPv4-in-IPv4 traffic will be matched to
-.Nm
-interfaces first, and then sent to
-.Xr vif 4
-if no match is found.
+.Ss Security
+Malicious party may try to circumvent security filters by using
+tunnelled packets.
+For better protection,
+.Nm
+performs martian filter and ingress filter against outer source address,
+on egress.
+Note that martian/ingress filters are no way complete.
+You may want to secure your node by using packet filters.
+.Pp
+As mentioned above, multi-destination mode
+.Pq Dv IFF_LINK0
+is far less secure than bidirectional mode.
 .\"
 .Sh SEE ALSO
 .Xr inet 4 ,
 .Xr inet6 4 ,
-.Xr vif 4 ,
-.Xr gifconfig 8 ,
-RFC1933
+.Xr gifconfig 8
+.Rs
+.%A	R. Gilligan
+.%A	E. Nordmark
+.%B	RFC1933
+.%T	Transition Mechanisms for IPv6 Hosts and Routers
+.%D	April 1996
+.%O	ftp://ftp.isi.edu/in-notes/rfc1933.txt
+.Re
 .Rs
 .%A	Sally Floyd
 .%A	David L. Black
 .%A	K. K. Ramakrishnan
 .%T	"IPsec Interactions with ECN"
-.%D	February 1999
-.%O	http://www.aciri.org/floyd/papers/draft-ipsec-ecn-00.txt
+.%D	December 1999
+.%O	draft-ietf-ipsec-ecn-02.txt
 .Re
 .\"
 .Sh HISTORY
 The
 .Nm
 device first appeared in WIDE hydrangea IPv6 kit.
+.\"
+.Sh BUGS
+There are many tunnelling protocol specifications,
+defined differently from each other.
+.Nm
+may not interoperate with peers which are based on different specifications,
+and are picky about outer header fields.
+For example, you cannot usually use
+.Nm
+to talk with IPsec devices that use IPsec tunnel mode.
+.Pp
+The current code does not check if the ingress address
+.Pq outer source address
+configured to
+.Nm
+makes sense.
+Make sure to configure an address which belongs to your node.
+Otherwise, your node will not be able to receive packets from the peer,
+and your node will generate packets with a spoofed source address.
+.Pp
+.Xr gif 4
+is an
+.Dv IFF_POINTOPOINT
+device, however, it supports NBMA behavior in multi-destination mode.