RFC 2893

Transition Mechanisms for IPv6 Hosts and Routers

📅 published August 2000, from ietf

RFC 2893: Transition Mechanisms for IPv6 Hosts and Routers 🦋

okay so bestie, this is RFC 2893, and it's all about how IPv6 hosts and routers can keep talking to IPv4 🌸 It came out in August 2000 as a Standards Track document. The authors are R. Gilligan (FreeGate Corp.) and E. Nordmark (Sun Microsystems, Inc.). It obsoletes RFC 1933, which means this one replaces that older doc. It doesn't list any RFCs it updates. 💅

Status of This Memo

okay so this document is an Internet standards track protocol for the Internet community, and the authors are asking for discussion and suggestions for improvements 💬 If you want to know where this protocol stands in standardization, check the current edition of the "Internet Official Protocol Standards" (STD 1) 📋 Distribution of this memo is unlimited, so share it with everyone 🌈

Copyright (C) The Internet Society (2000). All Rights Reserved. ©️✨

Abstract

so the big idea here is IPv4 compatibility 🎀 This document specifies mechanisms that IPv6 hosts and routers can implement. They include complete implementations of both IPv4 and IPv6, plus tunneling IPv6 packets over IPv4 routing infrastructures 🚇 The whole point is letting IPv6 nodes stay fully compatible with IPv4, which should make IPv6 way easier to deploy and help the entire Internet transition to IPv6 someday 🌟 This document obsoletes RFC 1933. 🫶

Table of Contents

1.  Introduction.............................................    2
   1.1.  Terminology.........................................    3
   1.2.  Structure of this Document..........................    5
2.  Dual IP Layer Operation..................................    6
   2.1.  Address Configuration...............................    7
   2.2.  DNS.................................................    7
   2.3.  Advertising Addresses in the DNS....................    8
3.  Common Tunneling Mechanisms..............................    9
   3.1.  Encapsulation.......................................   11
   3.2.  Tunnel MTU and Fragmentation........................   11
   3.3.  Hop Limit...........................................   13
   3.4.  Handling IPv4 ICMP errors...........................   13
   3.5.  IPv4 Header Construction............................   15
   3.6.  Decapsulation.......................................   16
   3.7.  Link-Local Addresses................................   17
   3.8.  Neighbor Discovery over Tunnels.....................   18
4.  Configured Tunneling.....................................   18
   4.1.  Default Configured Tunnel...........................   19
   4.2.  Default Configured Tunnel using IPv4 "Anycast Address" 19
   4.3.  Ingress Filtering...................................   20
5.  Automatic Tunneling......................................   20
   5.1.  IPv4-Compatible Address Format......................   20
   5.2.  IPv4-Compatible Address Configuration...............   21
   5.3.  Automatic Tunneling Operation.......................   22
   5.4.  Use With Default Configured Tunnels.................   22
   5.5.  Source Address Selection............................   23
   5.6.  Ingress Filtering...................................   23
6.  Acknowledgments..........................................   24
7.  Security Considerations..................................   24
8.  Authors' Addresses.......................................   24
9.  References...............................................   25
10.  Changes from RFC 1933...................................   26
11.  Full Copyright Statement................................   29

1. Introduction ✨

the key to a successful IPv6 transition is compatibility with the huge installed base of IPv4 hosts and routers 🧚 Staying compatible with IPv4 while rolling out IPv6 makes the whole transition way smoother 💖 This spec defines a set of mechanisms that IPv6 hosts and routers may implement so they can be compatible with IPv4 hosts and routers.

These mechanisms are built for IPv6 hosts and routers that need to interoperate with IPv4 hosts and use IPv4 routing infrastructures 🛣️ We expect most nodes on the Internet to need this kind of compatibility for a long, long time, maybe even indefinitely 😭

IPv6 can also be used in some environments where IPv4 interoperability isn't needed. IPv6 nodes designed for those environments don't need to use or even implement these mechanisms 🌸

The mechanisms specified here include:

  • Dual IP layer (also known as Dual Stack): A technique for providing complete support for both Internet protocols, IPv4 and IPv6, in hosts and routers. 💜
  • Configured tunneling of IPv6 over IPv4: Point-to-point tunnels made by encapsulating IPv6 packets within IPv4 headers, so they can ride over IPv4 routing infrastructures. 🚇
  • IPv4-compatible IPv6 addresses: An IPv6 address format that uses embedded IPv4 addresses. 🎀
  • Automatic tunneling of IPv6 over IPv4: A mechanism that uses IPv4-compatible addresses to automatically tunnel IPv6 packets over IPv4 networks. ✨

These mechanisms are meant to be part of a "transition toolbox," which is a growing collection of techniques that implementations and users can use to ease the transition 🧰 The tools get used as needed, and implementations and sites decide which techniques fit their specific needs. This document defines the initial core set of transition mechanisms, but they're not expected to be the only tools out there. More transition and compatibility mechanisms are expected later, with new documents written to specify them 🔮

1.1. Terminology 📖

the following terms are used in this document:

Types of Nodes

  • IPv4-only node: A host or router that implements only IPv4. An IPv4-only node doesn't understand IPv6. The installed base of IPv4 hosts and routers that exist before the transition begins are IPv4-only nodes. 💀
  • IPv6/IPv4 node: A host or router that implements both IPv4 and IPv6. 🫶
  • IPv6-only node: A host or router that implements IPv6 and doesn't implement IPv4. How IPv6-only nodes operate isn't addressed here. 🙈
  • IPv6 node: Any host or router that implements IPv6. IPv6/IPv4 nodes and IPv6-only nodes are both IPv6 nodes. 👑
  • IPv4 node: Any host or router that implements IPv4. IPv6/IPv4 nodes and IPv4-only nodes are both IPv4 nodes. 🌈

Types of IPv6 Addresses

  • IPv4-compatible IPv6 address: An IPv6 address with the high-order 96-bit prefix 0:0:0:0:0:0 and an IPv4 address in the low-order 32 bits. IPv4-compatible addresses are used by IPv6/IPv4 nodes which perform automatic tunneling, 🍓
  • IPv6-native address: The remainder of the IPv6 address space. An IPv6 address that has a prefix other than 0:0:0:0:0:0. 🌸

Techniques Used in the Transition

  • IPv6-over-IPv4 tunneling: The technique of encapsulating IPv6 packets within IPv4 so they can be carried across IPv4 routing infrastructures. 🦋
  • Configured tunneling: IPv6-over-IPv4 tunneling where the IPv4 tunnel endpoint address is decided by configuration information on the encapsulating node. These tunnels can be unidirectional or bidirectional. Bidirectional configured tunnels act like virtual point-to-point links. 🔗
  • Automatic tunneling: IPv6-over-IPv4 tunneling where the IPv4 tunnel endpoint address comes from the IPv4 address embedded in the IPv4-compatible destination address of the IPv6 packet being tunneled. ✨
  • IPv4 multicast tunneling: IPv6-over-IPv4 tunneling where the IPv4 tunnel endpoint address is found using Neighbor Discovery [7]. Unlike configured tunneling, this doesn't need any address configuration, and unlike automatic tunneling, it doesn't need IPv4-compatible addresses. However, the mechanism assumes the IPv4 infrastructure supports IPv4 multicast. Specified in [3] and not discussed further in this document. 📡

Other transition mechanisms, including other tunneling mechanisms, are outside the scope of this document 🙅‍♀️

Modes of operation of IPv6/IPv4 nodes

  • IPv6-only operation: An IPv6/IPv4 node with its IPv6 stack enabled and its IPv4 stack disabled. 💜
  • IPv4-only operation: An IPv6/IPv4 node with its IPv4 stack enabled and its IPv6 stack disabled. 🩵
  • IPv6/IPv4 operation: An IPv6/IPv4 node with both stacks enabled. 💞

The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this document, are to be interpreted as described in [16]. 📏

1.2. Structure of this Document 🗺️

the rest of the doc is laid out like this:

  • Section 2 talks about how nodes with a dual IP layer work, the IPv6/IPv4 nodes. 🧩
  • Section 3 covers the common mechanisms used in both of the IPv6-over-IPv4 tunneling techniques. 🛠️
  • Section 4 is about configured tunneling. 🎀
  • Section 5 is about automatic tunneling and the IPv4-compatible IPv6 address format. 🌟

2. Dual IP Layer Operation 💖

the most straightforward way for IPv6 nodes to stay compatible with IPv4-only nodes is by providing a complete IPv4 implementation 🙌 IPv6 nodes that provide complete IPv4 and IPv6 implementations are called "IPv6/IPv4 nodes." 👑 IPv6/IPv4 nodes can send and receive both IPv4 and IPv6 packets 📬 They can directly interoperate with IPv4 nodes using IPv4 packets, and they can also directly interoperate with IPv6 nodes using IPv6 packets. slay 💅

Even though a node can be set up to support both protocols, one or the other stack might get disabled for operational reasons 🙈 So IPv6/IPv4 nodes can operate in one of three modes:

  • With their IPv4 stack enabled and their IPv6 stack disabled. 🩵
  • With their IPv6 stack enabled and their IPv4 stack disabled. 💜
  • With both stacks enabled. 🌈

IPv6/IPv4 nodes with their IPv6 stack disabled will operate like IPv4-only nodes. Similarly, IPv6/IPv4 nodes with their IPv4 stacks disabled will operate like IPv6-only nodes. IPv6/IPv4 nodes MAY provide a configuration switch to disable either their IPv4 or IPv6 stack. 🎛️

The dual IP layer technique may or may not be used together with the IPv6-over-IPv4 tunneling techniques, which are described in sections 3, 4 and 5. An IPv6/IPv4 node that supports tunneling MAY support only configured tunneling, or both configured and automatic tunneling. So three modes of tunneling support are possible: 🚇

  • IPv6/IPv4 node that does not perform tunneling. 🌸
  • IPv6/IPv4 node that performs configured tunneling only. 🦋
  • IPv6/IPv4 node that performs configured tunneling and automatic tunneling. 🌟

2.1. Address Configuration 🎀

okay so bestie, IPv6/IPv4 nodes speak both protocols, which means they can have an IPv4 address and an IPv6 address at the same time 💖 they grab their IPv4 addresses the usual IPv4 way (think DHCP 🧚), and their IPv6-native addresses through IPv6 stuff (like stateless address autoconfiguration ✨). Also, Section 5.2 explains how nodes that support automatic tunneling MAY use IPv4 protocol mechanisms to get their IPv4-compatible IPv6 address 🦋

2.2. DNS 💅

the Domain Naming System (DNS) is used in both IPv4 and IPv6 to map hostnames to IP addresses 🌈 there's a newer record type called A6 for IPv6 addresses [6], which supports the older one called AAAA. since IPv6/IPv4 nodes need to talk directly to both IPv4 and IPv6 nodes, they must have resolver libraries that can handle IPv4 "A" records and IPv6 A6 and AAAA records 🫶

DNS resolver libraries on IPv6/IPv4 nodes MUST be capable of handling both A6/AAAA and A records 🔥 but when a query finds an A6/AAAA record with an IPv6 address and an A record with an IPv4 address, the resolver library MAY filter or order the results it hands to the application, so it can influence which IP version the packets use to reach that node 👑 when it comes to filtering, the resolver has three options:

  • Return only the IPv6 address to the application.
  • Return only the IPv4 address to the application.
  • Return both addresses to the application.

if it returns only the IPv6 address, the app talks to the node over IPv6. if it returns only the IPv4 address, the app uses IPv4. if it returns both, the app gets to pick which address to use, and therefore which IP protocol 💜

if it returns both, the resolver MAY choose to order them, IPv6 first or IPv4 first 🍓 and since most apps try addresses in the order the resolver returns them, this can change which IP version an app "prefers" ✨

whether to filter or order DNS results is implementation specific 🦋 IPv6/IPv4 nodes MAY provide policy configuration to control how addresses from the resolver get filtered or ordered, or they can leave the whole decision up to the application 🧚

an implementation MUST allow the application to control whether or not that filtering takes place. no skipping this one, bestie 🚨

2.3. Advertising Addresses in the DNS 🌸

okay, there are some constraints on using the DNS during the transition. most of them are pretty obvious, but they're written here so nothing gets missed 📝

the recommendation is that A6/AAAA records for a node should not be added to the DNS until all of these are true:

  1. The address is assigned to the interface on the node.
  2. The address is configured on the interface.
  3. The interface is on a link which is connected to the IPv6 infrastructure.

if an IPv6 node is isolated from an IPv6 point of view (for example, it isn't connected to the 6bone, to take a concrete example 🌐), constraint #3 means it should not have an address in the DNS 🙈

this works great when other dual stack nodes try to contact the isolated dual stack node 💖 there's no IPv6 address in the DNS, so the peer doesn't even try IPv6 and goes straight to IPv4 (we're assuming both nodes have A records in the DNS).

but this doesn't work well when the isolated node is the one trying to start the conversation 💀 even though it has no IPv6 address in the DNS, it will find A6/AAAA records for the peer. since the isolated node has IPv6 addresses assigned to at least one interface, it'll try IPv6, and if it has no IPv6 route to the 6bone (for example, because the local router was upgraded to advertise IPv6 addresses using Neighbor Discovery but that router doesn't have any IPv6 routes), the communication fails. usually that means a few minutes of delay while TCP times out 😭 the TCP specification says ICMP unreachable messages could be due to routing transients, so they should not immediately end the TCP connection. that means the normal TCP timeout of a few minutes applies. once TCP times out, the app will hopefully try the IPv4 addresses from the A records in the DNS, but it's going to be painfully slow 🐢

a possible side effect of all this is that if someone turns on IPv6 on a node sitting on a link with no IPv6 infrastructure, and chooses to add A6/AAAA records for that node to the DNS, then external IPv6 nodes that see those records might try to reach it over IPv6 and run into delays or communication failures because it's unreachable 🥲 (a delay happens if the app correctly falls back to IPv4 when it can't connect over IPv6. if that fallback doesn't happen, the app simply fails to communicate in this case.) so the suggestion is either to follow the recommendations above, or to take care that you only do this with nodes that won't be hurt by outside access delays and/or communication failures 🫶

in the future, when a site or node drops IPv4 support, the recommendations above apply to when the A records for the node(s) should be removed from the DNS 🦋

3. Common Tunneling Mechanisms ✨

in most deployment scenarios, the IPv6 routing infrastructure gets built up over time 🌱 while it's being deployed, the existing IPv4 routing infrastructure can keep working and can be used to carry IPv6 traffic. tunneling gives you a way to use the existing IPv4 routing infrastructure to carry IPv6 traffic 💜

IPv6/IPv4 hosts and routers can tunnel IPv6 datagrams over regions of the IPv4 routing topology by wrapping them up inside IPv4 packets 🎁 tunneling can be used in a few different ways:

  • Router-to-Router. IPv6/IPv4 routers connected by an IPv4 infrastructure can tunnel IPv6 packets between themselves. here the tunnel covers one segment of the end-to-end path the IPv6 packet takes.
  • Host-to-Router. IPv6/IPv4 hosts can tunnel IPv6 packets to an intermediary IPv6/IPv4 router that's reachable through an IPv4 infrastructure. this kind of tunnel covers the first segment of the packet's end-to-end path.
  • Host-to-Host. IPv6/IPv4 hosts connected by an IPv4 infrastructure can tunnel IPv6 packets between themselves. here the tunnel covers the entire end-to-end path the packet takes.
  • Router-to-Host. IPv6/IPv4 routers can tunnel IPv6 packets all the way to their final destination IPv6/IPv4 host. this tunnel only covers the last segment of the end-to-end path.

tunneling techniques are usually sorted by how the encapsulating node figures out the address of the node at the far end of the tunnel 🔍 in the first two methods above (router-to-router and host-to-router), the IPv6 packet is being tunneled to a router. the tunnel endpoint is an intermediary router, which has to unwrap the IPv6 packet and forward it on to its final destination 🚚 when you tunnel to a router, the endpoint isn't the same as the packet's destination, so the addresses inside the IPv6 packet can't give you the IPv4 address of the tunnel endpoint. instead, that address has to come from configuration info on the node doing the tunneling. we use the term "configured tunneling" for this type, where the endpoint is explicitly configured ⚙️

in the last two methods (host-to-host and router-to-host), the IPv6 packet gets tunneled all the way to its final destination. here the destination address of both the IPv6 packet and the encapsulating IPv4 header identify the same node! 🤯 this can be exploited by encoding information in the IPv6 destination address that lets the encapsulating node work out the tunnel endpoint IPv4 address automatically. automatic tunneling does exactly this, using a special IPv6 address format with an embedded IPv4 address so tunneling nodes can derive the tunnel endpoint IPv4 address on their own 🪄 that means no one has to explicitly configure the tunnel endpoint address, which makes setup way simpler 💅

automatic and configured tunneling mainly differ in how they determine the tunnel endpoint address. most of the underlying mechanisms are the same:

  • The entry node of the tunnel (the encapsulating node) creates an encapsulating IPv4 header and transmits the encapsulated packet.
  • The exit node of the tunnel (the decapsulating node) receives the encapsulated packet, reassembles it if needed, removes the IPv4 header, updates the IPv6 header, and processes the received IPv6 packet.
  • The encapsulating node MAY need to maintain soft state information for each tunnel, recording parameters such as the MTU of the tunnel so it can process IPv6 packets forwarded into the tunnel 📦 since any one host or router might be using a lot of tunnels, this state can be cached and discarded when it isn't in use 🧹

the rest of this section covers the common mechanisms that apply to both types of tunneling 💖 the sections after it explain how the tunnel endpoint address is determined for automatic and configured tunneling 🎀

3.1. Encapsulation 🌸

the encapsulation of an IPv6 datagram in IPv4 looks like this:

                                             +-------------+
                                             |    IPv4     |
                                             |   Header    |
             +-------------+                 +-------------+
             |    IPv6     |                 |    IPv6     |
             |   Header    |                 |   Header    |
             +-------------+                 +-------------+
             |  Transport  |                 |  Transport  |
             |   Layer     |      ===>       |   Layer     |
             |   Header    |                 |   Header    |
             +-------------+                 +-------------+
             |             |                 |             |
             ~    Data     ~                 ~    Data     ~
             |             |                 |             |
             +-------------+                 +-------------+

                      Encapsulating IPv6 in IPv4

besides adding an IPv4 header, the encapsulating node also has to deal with some trickier stuff 🧩

  • Figuring out when to fragment, and when to report an ICMP "packet too big" error back to the source ✂️
  • How to reflect IPv4 ICMP errors from routers along the tunnel path back to the source as IPv6 ICMP errors 🔁

those issues are covered in the following sections 🦋

3.2. Tunnel MTU and Fragmentation 🌊

Okay so the encapsulating node could totally treat encapsulation as IPv6 using IPv4 as a link layer with a huge MTU 😤 (65535-20 bytes, to be exact, because 20 bytes of "extra" are needed for the encapsulating IPv4 header). The encapsulating node would only need to send IPv6 ICMP "packet too big" errors back to the source for packets bigger than that MTU. BUT ngl, this scheme is kinda inefficient for two reasons 💀

  1. It would cause more fragmentation than necessary. IPv4 layer fragmentation SHOULD be avoided because of the performance problems that happen when the loss unit is smaller than the retransmission unit [11]. 😩
  2. Any IPv4 fragmentation happening inside the tunnel would have to be reassembled at the tunnel endpoint. For tunnels that end at a router, that means extra memory is needed to put the IPv4 fragments back together into a complete IPv6 packet before it can be forwarded onward 🧠

The fragmentation inside the tunnel can be kept to a minimum by having the encapsulating node track the IPv4 Path MTU across the tunnel. It uses the IPv4 Path MTU Discovery Protocol [8] and records the resulting path MTU 🔍 Then the IPv6 layer in the encapsulating node can view the tunnel as a link layer with an MTU equal to the IPv4 path MTU, minus the size of the encapsulating IPv4 header. Main character energy ✨

Heads up though: this doesn't completely get rid of IPv4 fragmentation when the IPv4 path MTU would give an IPv6 MTU smaller than 1280 bytes. (Any link layer used by IPv6 has to have an MTU of at least 1280 bytes [4].) In that case the IPv6 layer has to "see" a link layer with an MTU of 1280 bytes, and the encapsulating node has to use IPv4 fragmentation to forward those 1280 byte IPv6 packets 🫠

Here's the algorithm the encapsulating node can use to decide when to forward an IPv6 packet that's bigger than the tunnel's path MTU using IPv4 fragmentation, and when to send back an IPv6 ICMP "packet too big" message 🎀

     if (IPv4 path MTU - 20) is less than or equal to 1280
             if packet is larger than 1280 bytes
                     Send IPv6 ICMP "packet too big" with MTU = 1280.
                     Drop packet.
             else
                     Encapsulate but do not set the Don't Fragment
                     flag in the IPv4 header.  The resulting IPv4
                     packet might be fragmented by the IPv4 layer on
                     the encapsulating node or by some router along
                     the IPv4 path.
             endif
     else
             if packet is larger than (IPv4 path MTU - 20)
                     Send IPv6 ICMP "packet too big" with
                     MTU = (IPv4 path MTU - 20).
                     Drop packet.
             else

                     Encapsulate and set the Don't Fragment flag
                     in the IPv4 header.
             endif
     endif

Encapsulating nodes that have a lot of tunnels might not be able to store the IPv4 Path MTU for every single one 😭 Those nodes can skip the IPv4 Path MTU algorithm across the tunnel and use the MTU of the link layer (under IPv4) in the algorithm above instead of the IPv4 path MTU. The tradeoff is more fragmentation in the network, so it's a choice with a cost 💅

In this case, the Don't Fragment bit MUST NOT be set in the encapsulating IPv4 header 🚫

3.3. Hop Limit 🦋

IPv6-over-IPv4 tunnels are modeled as "single-hop", which is so iconic. The IPv6 hop limit gets decremented by 1 when an IPv6 packet goes through the tunnel 🙈 This single-hop model is what hides the tunnel's existence. The tunnel is opaque to network users and can't be detected by network diagnostic tools like traceroute. Invisible queen 👑

The single-hop model works because the encapsulating and decapsulating nodes process the IPv6 hop limit field the same way they would if they were forwarding a packet on to any other datalink. In other words, they decrement the hop limit by 1 when forwarding an IPv6 packet. (The originating node and the final destination do not decrement the hop limit.) 🌸

The TTL of the encapsulating IPv4 header is selected in an implementation dependent manner. The current suggested value is published in the "Assigned Numbers RFC. Implementations MAY provide a mechanism that lets the administrator configure the IPv4 TTL, such as the one specified in the IP Tunnel MIB [17]. ⚙️

3.4. Handling IPv4 ICMP errors 🚨

So in response to encapsulated packets the encapsulating node has sent into the tunnel, it might get IPv4 ICMP error messages from IPv4 routers inside the tunnel. These packets are addressed to the encapsulating node, because it's the IPv4 source of the encapsulated packet 📬

The ICMP "packet too big" error messages get handled according to IPv4 Path MTU Discovery [8], and the resulting path MTU is recorded in the IPv4 layer. IPv6 then uses that recorded path MTU to figure out whether it has to generate an IPv6 ICMP "packet too big" error, as described in section 3.2 🧮

Other types of ICMP error messages are handled based on how much information is included in the "packet in error" field, which holds the encapsulated packet that caused the error 🔎

Lots of older IPv4 routers only return 8 bytes of data beyond the IPv4 header of the packet in error. That's not enough to include the address fields of the IPv6 header 😬 More modern IPv4 routers are likely to return enough data beyond the IPv4 header to include the entire IPv6 header, and possibly even some of the data after that 💖

If the offending packet includes enough data, the encapsulating node MAY extract the encapsulated IPv6 packet and use it to generate an IPv6 ICMP message directed back to the originating IPv6 node, as shown below 🦋

              +--------------+
              | IPv4 Header  |
              | dst = encaps |
              |       node   |
              +--------------+
              |     ICMP     |
              |    Header    |
       - -    +--------------+
              | IPv4 Header  |
              | src = encaps |
      IPv4    |       node   |
              +--------------+   - -
      Packet  |    IPv6      |
              |    Header    |   Original IPv6
       in     +--------------+   Packet -
              |  Transport   |   Can be used to
      Error   |    Header    |   generate an
              +--------------+   IPv6 ICMP
              |              |   error message
              ~     Data     ~   back to the source.
              |              |
       - -    +--------------+   - -

  IPv4 ICMP Error Message Returned to Encapsulating Node

3.5. IPv4 Header Construction 🧱

When you encapsulate an IPv6 packet in an IPv4 datagram, the IPv4 header fields get set like this:

  • Version: 4
  • IP Header Length in 32-bit words: 5 (There are no IPv4 options in the encapsulating header.) 🎀
  • Type of Service: 0. [Note that work underway in the IETF is redefining the Type of Service byte, so future RFCs might define a different behavior for the ToS byte when tunneling.] 👀
  • Total Length: Payload length from IPv6 header plus length of IPv6 and IPv4 headers (i.e. a constant 60 bytes). 📏
  • Identification: Generated uniquely as for any IPv4 packet transmitted by the system. 🆔
  • Flags: Set the Don't Fragment (DF) flag as specified in section 3.2. Set the More Fragments (MF) bit as necessary if fragmenting. 🚩
  • Fragment offset: Set as necessary if fragmenting. 🧩
  • Time to Live: Set in implementation-specific manner. ⏳
  • Protocol: 41 (Assigned payload type number for IPv6) 🪪
  • Header Checksum: Calculate the checksum of the IPv4 header. ✅
  • Source Address: IPv4 address of outgoing interface of the encapsulating node. 🏠
  • Destination Address: IPv4 address of tunnel endpoint. 🎯

Any IPv6 options are preserved in the packet (after the IPv6 header) 💜

3.6. Decapsulation 🎁

When an IPv6/IPv4 host or a router gets an IPv4 datagram addressed to one of its own IPv4 addresses, and the protocol field is 41, it reassembles the packet if it was fragmented at the IPv4 level. Then it strips off the IPv4 header and hands the IPv6 datagram to its IPv6 layer code 📦

The decapsulating node MUST be capable of reassembling an IPv4 packet that is 1300 bytes (1280 bytes plus IPv4 header) 💪

Here's what decapsulation looks like 👇

        +-------------+
        |    IPv4     |
        |   Header    |
        +-------------+                 +-------------+
        |    IPv6     |                 |    IPv6     |
        |   Header    |                 |   Header    |
        +-------------+                 +-------------+
        |  Transport  |                 |  Transport  |
        |   Layer     |      ===>       |   Layer     |
        |   Header    |                 |   Header    |
        +-------------+                 +-------------+
        |             |                 |             |
        ~    Data     ~                 ~    Data     ~
        |             |                 |             |
        +-------------+                 +-------------+

                    Decapsulating IPv6 from IPv4

When the packet gets decapsulated, the IPv6 header is not modified. [Note that work underway in the IETF is redefining the Type of Service byte, so future RFCs might define a different behavior for the ToS byte when decapsulating a tunneled packet.] If the packet is forwarded afterwards, its hop limit is decremented by one 🌈

As part of decapsulation, the node SHOULD silently discard a packet with an invalid IPv4 source address, such as a multicast address, a broadcast address, 0.0.0.0, and 127.0.0.1. In general it SHOULD apply the rules for martian filtering in [18] and ingress filtering [13] to the IPv4 source address 🛡️

The encapsulating IPv4 header gets thrown away 🗑️

After decapsulation, the node SHOULD silently discard a packet with an invalid IPv6 source address. That includes IPv6 multicast addresses, the unspecified address, and the loopback address, but also IPv4-compatible IPv6 source addresses where the IPv4 part of the address is an (IPv4) multicast address, broadcast address, 0.0.0.0, or 127.0.0.1. In general it SHOULD apply the rules for martian filtering in [18] and ingress filtering [13] to the IPv4-compatible source address 🧐

The decapsulating node performs IPv4 reassembly before decapsulating the IPv6 packet. All IPv6 options are preserved, even if the encapsulating IPv4 packet was fragmented 🫶

After the IPv6 packet is decapsulated, it's processed almost the same as any received IPv6 packet. The only difference is that a decapsulated packet MUST NOT be forwarded unless the node has been explicitly configured to forward such packets for the given IPv4 source address. That configuration can be implicit, for example by having a configured tunnel that matches the IPv4 source address. This restriction is needed to stop tunneling from being used as a tool to get around ingress filtering [13] 🚧

okay bestie, both the configured and automatic tunnels are IPv6 interfaces that sit on top of the IPv4 "link layer" 💅, so they MUST have link-local addresses 💖. Routing protocols running over the tunnels rely on these link-local addresses 🔥.

The Interface Identifier [14] for such an Interface SHOULD be the 32-bit IPv4 address of that interface 🦋. The bytes go in the same order they'd appear in an IPv4 packet header, and then you pad the left side with zeros until you hit 64 bits 🌸. Notice that the "Universal/Local" bit is zero, which tells you the Interface Identifier is not globally unique 🙈. If the host has more than one IPv4 address in use on the physical interface, an administrative choice picks one of them 👑.

The IPv6 Link-local address [14] for an IPv4 virtual interface is formed by appending that Interface Identifier to the prefix FE80::/64 ✨. Here's the layout:

+-------+-------+-------+-------+-------+-------+------+------+
|  FE      80      00      00      00      00      00     00  |
+-------+-------+-------+-------+-------+-------+------+------+
|  00      00   |  00   |  00   |   IPv4 Address              |
+-------+-------+-------+-------+-------+-------+------+------+

3.8. Neighbor Discovery over Tunnels 🌈

Automatic tunnels and unidirectional configured tunnels are both considered unidirectional 🦋. So the only part of Neighbor Discovery [7] and Stateless Address Autoconfiguration [5] that applies to these tunnels is forming the link-local address 💜.

If an implementation provides bidirectional configured tunnels, it MUST at least accept and respond to the probe packets used by Neighbor Unreachability Detection [7] 🫶. Such implementations SHOULD also send NUD probe packets so they can detect when the configured tunnel fails 💀. Once that happens, the implementation can switch to an alternate path to reach the destination 🔥. Also, Neighbor Discovery lets you skip sending NUD probes on router-to-router links, as long as the routing protocol is tracking bidirectional reachability 🧠.

For the purposes of Neighbor Discovery, the automatic and configured tunnels in this document are assumed to NOT have a link-layer address 🙃, even though the link-layer (IPv4) does have one. What that means is that a sender of Neighbor Discovery packets:

  • SHOULD NOT include Source Link Layer Address options or Target Link Layer Address options on the tunnel link 💅.
  • MUST silently ignore any received SLLA or TLLA options on the tunnel link 🙈.

4. Configured Tunneling 🎀

In configured tunneling, the tunnel endpoint address comes from configuration information in the encapsulating node 📝. Each tunnel means the encapsulating node has to store that tunnel endpoint address 💖. When an IPv6 packet goes over a tunnel, the tunnel endpoint address configured for that tunnel becomes the destination address in the encapsulating IPv4 header ✨.

Which packets get tunneled is usually decided by routing information on the encapsulating node 🗺️. This is typically handled by a routing table, which routes packets based on their destination address using the prefix mask and match technique 🧚.

4.1. Default Configured Tunnel 🦋

IPv6/IPv4 hosts that are connected to datalinks with no IPv6 routers MAY use a configured tunnel to reach an IPv6 router 🌸. That tunnel lets the host talk to the rest of the IPv6 Internet, meaning nodes with IPv6-native addresses 🌍. If you know the IPv4 address of an IPv6/IPv4 router bordering the IPv6 backbone, you can use it as the tunnel endpoint address 🔥. You can also configure the tunnel into the routing table as an IPv6 "default route" 👑. That means every IPv6 destination address matches the route and could potentially go through the tunnel 💅. Because the "mask length" of a default route is zero, it only gets used if there's no other route with a longer mask that matches the destination 🙌. The default configured tunnel can work together with automatic tunneling, as described in section 5.4 🫶.

4.2. Default Configured Tunnel using IPv4 "Anycast Address" 🌈

The tunnel endpoint address of a default tunnel like this could be the IPv4 address of one IPv6/IPv4 router at the border of the IPv6 backbone 🏰. Or, the tunnel endpoint could be an IPv4 "anycast address" instead 🧠. With this approach, several IPv6/IPv4 routers at the border advertise IPv4 reachability to the same IPv4 address 📡. All of those routers accept packets sent to this address as their own, and they'll decapsulate IPv6 packets tunneled there 💜. When an IPv6/IPv4 node sends an encapsulated packet to this address, it gets delivered to only one of the border routers, but the sender won't know which one 🤷‍♀️. The IPv4 routing system will generally carry the traffic to the closest router 🦋.

Using a default tunnel to an IPv4 "anycast address" gives you a high degree of robustness ⭐. You can have multiple border routers, and through the normal fallback mechanisms of IPv4 routing, traffic automatically switches to another router when one goes down ✨. Still, you have to be careful with a default tunnel like this so that different IPv4 fragments don't end up arriving at different routers for reassembly 😭. You can prevent that either by avoiding fragmentation of the encapsulated packets (by making sure the IPv4 MTU is at least 1300 bytes) or by preventing frequent changes to IPv4 routing 🎀.

4.3. Ingress Filtering 🛡️

The decapsulating node MUST verify that the tunnel source address is acceptable before it forwards decapsulated packets, so nobody can get around ingress filtering [13] 💅. Packets that get delivered to transport protocols on the decapsulating node SHOULD NOT be subject to these checks 🙈. For bidirectional configured tunnels, you check this by verifying that the source address is the IPv4 address of the other end of the tunnel 🫶. For unidirectional configured tunnels, the decapsulating node MUST be configured with a list of acceptable source IPv4 address prefixes 📋. That list MUST default to having no entries at all 🚫. So the node has to be explicitly configured before it'll forward decapsulated packets that came in over unidirectional configured tunnels 🔒.

5. Automatic Tunneling 🧚‍♀️

In automatic tunneling, the tunnel endpoint address is determined by the IPv4-compatible destination address of the IPv6 packet being tunneled ✨. Automatic tunneling lets IPv6/IPv4 nodes talk to each other over IPv4 routing infrastructure without pre-configuring any tunnels 🦋.

5.1. IPv4-Compatible Address Format 💖

IPv6/IPv4 nodes that do automatic tunneling are assigned an IPv4-compatible address 🌸. An IPv4-compatible address is identified by an all-zeros 96-bit prefix, and it holds an IPv4 address in the low-order 32 bits 🔢. Here's how IPv4-compatible addresses are laid out:

        |              96-bits                 |   32-bits    |
        +--------------------------------------+--------------+
        |            0:0:0:0:0:0               | IPv4 Address |
        +--------------------------------------+--------------+
                     IPv4-Compatible IPv6 Address Format

IPv4-compatible addresses are assigned exclusively to nodes that support automatic tunneling 🔒. A node SHOULD be configured with an IPv4-compatible address only if it's ready to accept IPv6 packets destined for that address, encapsulated in IPv4 packets destined to the embedded IPv4 address 🫶.

An IPv4-compatible address is globally unique as long as the IPv4 address isn't from the private IPv4 address space [15] 🌍. An implementation SHOULD behave as if its IPv4-compatible address(es) are assigned to the node's automatic tunneling interface, even if the implementation doesn't use the concept of interfaces to do automatic tunneling 🧠. So the IPv4-compatible address SHOULD NOT be viewed as attached to something like an Ethernet interface 🙅‍♀️. That means you shouldn't use Neighbor Discovery mechanisms like NUD [7] over Ethernet. Any such interactions should be done using the encapsulated packets, meaning over the automatic tunneling (conceptual) interface 💜.

5.2. IPv4-Compatible Address Configuration 🎀

An IPv6/IPv4 node with an IPv4-compatible address uses that address as one of its IPv6 addresses 💅. The IPv4 address embedded in the low-order 32 bits serves as the IPv4 address for one of its interfaces 🦋.

An IPv6/IPv4 node MAY get its IPv4-compatible IPv6 addresses through IPv4 address configuration protocols 📡. It MAY use any IPv4 address configuration mechanism to acquire its IPv4 address, and then "map" that address into an IPv4-compatible IPv6 address by prepending the 96-bit prefix 0:0:0:0:0:0 🪄. This approach lets IPv6/IPv4 nodes "leverage" the installed base of IPv4 address configuration servers 🙌.

Here's the specific algorithm for getting an IPv4-compatible address using IPv4-based address configuration protocols ✨:

  1. The IPv6/IPv4 node uses standard IPv4 mechanisms or protocols to acquire the IPv4 address for one of its interfaces. These include:
    • The Dynamic Host Configuration Protocol (DHCP) [2] 📦
    • The Bootstrap Protocol (BOOTP) [1] 👢
    • The Reverse Address Resolution Protocol (RARP) [9] 🔄
    • Manual configuration ✍️
    • Any other mechanism which accurately yields the node's own IPv4 address 💯
  2. The node uses this address as the IPv4 address for this interface.
  3. The node prepends the 96-bit prefix 0:0:0:0:0:0 to the 32-bit IPv4 address it acquired in step (1). The result is an IPv4-compatible IPv6 address with one of the node's IPv4 addresses embedded in the low-order 32 bits 🎉. The node uses this address as one of its IPv6 addresses 👑.

5.3. Automatic Tunneling Operation 🌈

In automatic tunneling, the tunnel endpoint address is determined from the packet being tunneled 📦. If the destination IPv6 address is IPv4-compatible, the packet can be sent via automatic tunneling 💖. If the destination is IPv6-native, the packet can not be sent via automatic tunneling 🙅‍♀️.

A routing table entry can be used to direct automatic tunneling 🗺️. An implementation can have a special static routing table entry for the prefix 0:0:0:0:0:0/96 (that's a route to the all-zeros prefix with a 96-bit mask) 🧚. Packets matching this prefix are sent to a pseudo-interface driver that does automatic tunneling 🦋. Since every IPv4-compatible IPv6 address matches this prefix, all packets to those destinations get auto-tunneled 🔥.

Once the IPv6 packet is delivered to the automatic tunneling module, it's encapsulated within an IPv4 header following the rules in section 3 ✨. The source and destination addresses of that encapsulating IPv4 header are assigned like this 📝:

   Destination IPv4 address:

      Low-order 32-bits of IPv6 destination address

   Source IPv4 address:

      IPv4 address of interface the packet is sent via

The automatic tunneling module always sends packets in this encapsulated form, even when the destination is on an attached datalink 🫶.

The automatic tunneling module MUST NOT send to IPv4 broadcast or multicast destinations 🚫. It MUST drop all IPv6 packets destined to IPv4-compatible destinations when the embedded IPv4 address is broadcast, multicast, the unspecified (0.0.0.0) address, or the loopback address (127.0.0.1) 😭. Note that the sender can only tell whether an address is a network or subnet broadcast for broadcast addresses assigned to directly attached links 🧠.

5.4. Use With Default Configured Tunnels ✨

Automatic tunneling is often paired with the default configured tunnel technique, and it's giving teamwork 🫶. "Isolated" IPv6/IPv4 hosts, the ones with no on-link IPv6 routers, are set up to use automatic tunneling and IPv4-compatible IPv6 addresses. They also have at least one default configured tunnel to an IPv6 router, and that router is set up to do automatic tunneling too 🚇. These isolated hosts send packets to IPv4-compatible destinations through automatic tunneling, and packets to IPv6-native destinations go through the default configured tunnel. IPv4-compatible destinations match the 96-bit all-zeros prefix route from the previous section, while IPv6-native destinations match the default route through the configured tunnel 🎯. Replies from IPv6-native destinations get routed back to an IPv6/IPv4 router, which hands them to the original host using automatic tunneling. More examples of mixing these tunneling techniques are discussed in [12] 💜.

5.5. Source Address Selection 💅

When an IPv6/IPv4 node sends out an IPv6 packet, it must pick the source IPv6 address to use 👀. IPv6/IPv4 nodes that do automatic tunneling can have global IPv6-native addresses as well as IPv4-compatible addresses. The source address you pick decides how the return traffic gets sent back to you 🔁. If you use the IPv4-compatible address, the return traffic has to come back through automatic tunneling. If you use the IPv6-native address, the return traffic doesn't get automatic-tunneled. To keep traffic as symmetric as possible, this source address selection preference is RECOMMENDED:

   Destination is IPv4-compatible:

      Use IPv4-compatible source address associated with IPv4 address
      of outgoing interface

   Destination is IPv6-native:

      Use IPv6-native address of outgoing interface

If an IPv6/IPv4 node doesn't have a global IPv6-native address but is sending a packet to an IPv6-native destination, it MAY use its IPv4-compatible address as its source address 🌸.

5.6. Ingress Filtering 🛡️

The decapsulating node MUST check that the encapsulated packets are acceptable before it forwards the decapsulated packets, so nobody sneaks past ingress filtering [13] 🕵️‍♀️. Packets that get delivered to transport protocols on the decapsulating node SHOULD NOT have to go through these checks, just so you know 💖. Automatic tunnels always encapsulate to the destination (the IPv4 destination is the destination), so any packet that comes in over an automatic tunnel SHOULD NOT be forwarded 🚫. Not me being dramatic, but this one is a hard stop 😭.

6. Acknowledgments 🎀

We want to thank the members of the IPng working group and the Next Generation Transition (ngtrans) working group for their many contributions and their super thorough review of this document 🙌. Special thanks go to Jim Bound, Ross Callon, and Bob Hinden for their helpful suggestions, and to John Moy for suggesting the IPv4 "anycast address" default tunnel technique 🧚.

7. Security Considerations 🔐

Tunneling isn't known to introduce any security holes, except for the possibility of getting around ingress filtering [13]. This gets prevented by requiring that decapsulating routers only forward packets if they've been configured to accept encapsulated packets from the IPv4 source address in the received packet 🧱. Also, for automatic tunneling, nodes are required to not forward the decapsulated packets, because automatic tunneling ends the tunnel at the destination 🏁. This part is kinda serious, bestie, so please don't skip it 💀.

8. Authors' Addresses 📬

   Robert E. Gilligan
   FreeGate Corp
   1208 E. Arques Ave
   Sunnyvale, CA 94086
   USA

   Phone:  +1-408-617-1004
   Fax:    +1-408-617-1010
   EMail:  gilligan@freegate.com


   Erik Nordmark
   Sun Microsystems, Inc.
   901 San Antonio Rd.
   Palo Alto, CA 94303
   USA

   Phone:  +1-650-786-5166
   Fax:    +1-650-786-5896
   EMail:  nordmark@eng.sun.com

9. References 📚

   [1]  Croft, W. and J. Gilmore, "Bootstrap Protocol", RFC 951,
        September 1985.

   [2]  Droms, R., "Dynamic Host Configuration Protocol", RFC 1541,
        October 1993.

   [3]  Carpenter, B. and C. Jung, "Transmission of IPv6 over IPv4
        Domains without Explicit Tunnels", RFC 2529, March 1999.

   [4]  Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6)
        Specification", RFC 2460, December 1998.

   [5]  Thomson, S. and T. Narten, "IPv6 Stateless Address
        Autoconfiguration," RFC 2462, December 1998.

   [6]  Crawford, M., Thomson, S., and C. Huitema. "DNS Extensions to
        Support IPv6 Address Allocation and Renumbering", RFC 2874, July
        2000.

   [7]  Narten, T., Nordmark, E. and W. Simpson, "Neighbor Discovery for
        IP Version 6 (IPv6)", RFC 2461, December 1998.

   [8]  Mogul, J. and S. Deering, "Path MTU Discovery", RFC 1191,
        November 1990.

   [9]  Finlayson, R., Mann, T., Mogul, J. and M. Theimer, "Reverse
        Address Resolution Protocol", STD 38, RFC 903, June 1984.

   [10] Braden, R., "Requirements for Internet Hosts - Communication
        Layers", STD 3, RFC 1122, October 1989.

   [11] Kent, C. and J. Mogul, "Fragmentation Considered Harmful".  In
        Proc.  SIGCOMM '87 Workshop on Frontiers in Computer
        Communications Technology.  August 1987.

   [12] Callon, R. and D. Haskin, "Routing Aspects of IPv6 Transition",
        RFC 2185, September 1997.

   [13] Ferguson, P. and D. Senie, "Network Ingress Filtering: Defeating
        Denial of Service Attacks which employ IP Source Address
        Spoofing", RFC 2267, January 1998.

   [14] Hinden, R. and S. Deering, "IP Version 6 Addressing
        Architecture", RFC 2373, July 1998.

   [15] Rechter, Y., Moskowitz, B., Karrenberg, D., de Groot, G.J. and
        E. Lear, "Address Allocation for Private Internets", BCP 5, RFC
        1918, February 1996.

   [16] Bradner, S., "Key words for use in RFCs to Indicate Requirement
        Levels", BCP 14, RFC 2119, March 1997.

   [17] Thaler, D., "IP Tunnel MIB", RFC 2667, August 1999.

   [18] Baker, F., "Requirements for IP Version 4 Routers", RFC 1812,
        June 1995.

10. Changes from RFC 1933 📝

  • Deleted section 3.1.1 (IPv4 loopback address) so nobody mistakes it for a rule that routers have to filter the address ::127.0.0.1. That would've added another test to the IPv6 router forwarding path, and nobody wants that 🙅‍♀️.
  • Deleted section 4.4 (Default Sending Algorithm). It let nodes send packets in "raw form" to IPv4-compatible destinations on the same datalink. Implementation experience showed that the extra complexity wasn't worth the tiny header savings 🤷‍♀️.
  • Added definitions for operating modes for IPv6/IPv4 nodes 🧩.
  • Revised the DNS section to clarify resolver filtering and ordering options 🔍.
  • Rewrote the discussion of IPv4-compatible addresses to make clear they're used only together with the automatic tunneling mechanism. Also reorganized the document so the IPv4-compatible address format definition sits with the automatic tunneling description 🗂️.
  • Changed the term "IPv6-only address" to "IPv6-native address" to match current usage 🔄.
  • Updated the algorithm for determining tunnel MTU to reflect the change in the IPv6 minimum MTU from 576 to 1280 bytes [4] 📏.
  • Deleted the definition of the term "IPv6-in-IPv4 encapsulation." It hasn't been widely used 👋.
  • Revised the IPv4-compatible address configuration section (5.2) to recognize multiple interfaces 🖥️.
  • Added discussion of source address selection when using IPv4-compatible addresses 🎯.
  • Added a section on combining the default configured tunneling technique with hosts that use automatic tunneling 🤝.
  • Added a prohibition against automatic tunneling to IPv4 broadcast or multicast destinations 🚫.
  • Clarified that configured tunnels can be unidirectional or bidirectional ↔️.
  • Added a description of bidirectional virtual links as another type of tunnel. Nodes MUST respond to NUD probes on such links and SHOULD send NUD probes 📡.
  • Added a reference to the [16] specification as an alternative for tunneling over a multicast capable IPv4 cloud ☁️.
  • Clarified that IPv4-compatible addresses are assigned only to nodes that support automatic tunnels, meaning nodes that can receive such packets 🎟️.
  • Added text about forming link-local addresses and using Neighbor Discovery on tunnels 🔗.
  • Added a restriction that decapsulated packets must not be forwarded unless the source address is acceptable to the decapsulating router 🔒.
  • Clarified that decapsulating nodes MUST be capable of reassembling an IPv4 packet that is 1300 bytes (1280 bytes plus the IPv4 header) 🧩.
  • Clarified that when using a default tunnel to an IPv4 "anycast address," the network must either have an IPv4 MTU of at least 1300 bytes (to avoid fragmenting minimum size IPv6 packets) or be configured to avoid frequent changes to IPv4 routing to the "anycast address" (so different IPv4 fragments don't arrive at different tunnel endpoints) 🛣️.
  • Switched from AAAA to A6/AAAA for referencing IPv6 address records in the DNS 🏷️.
  • Specified when to put IPv6 addresses in the DNS 📇.
  • Added a reference to the tunnel MIB for the TTL specification for the tunnels ⏱️.
  • Added a table of contents 📖.
  • Added recommendations for using source and target link layer address options for the tunnel links 🔗.
  • Added checks in decapsulation that look at both the IPv4-compatible IPv6 source address and the outer IPv4 source addresses for multicast, broadcast, all-zeros, and so on 🔍.

Copyright (C) The Internet Society (2000). All Rights Reserved. 💜

This document, and translations of it, may be copied and given to others. Derivative works that comment on or explain it, or help implement it, may be prepared, copied, published, and distributed, in whole or in part, without any restriction, as long as the copyright notice and this paragraph are included on all such copies and derivative works. The document itself, though, may not be modified in any way, such as by removing the copyright notice or the references to the Internet Society or other Internet organizations. The exceptions are when that's needed to develop Internet standards, in which case the Internet Standards process copyright procedures must be followed, or when it's needed to translate the document into languages other than English 🌍.

The limited permissions above are perpetual and won't be revoked by the Internet Society or its successors or assigns ♾️.

This document and the information in it are provided on an "AS IS" basis, and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 🫶.

Acknowledgement 🌈

Funding for the RFC Editor function is currently provided by the Internet Society 💖.

📦 where this page comes from