{"id":13547121,"url":"https://github.com/massar/sixxsd","last_synced_at":"2025-07-07T06:33:16.254Z","repository":{"id":150237353,"uuid":"129634924","full_name":"massar/sixxsd","owner":"massar","description":"sixxsd - The SixXS Daemon - IPv6 Tunnel \u0026 Routing Engine","archived":false,"fork":false,"pushed_at":"2018-05-03T14:58:27.000Z","size":456,"stargazers_count":22,"open_issues_count":0,"forks_count":11,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-07-05T00:59:08.269Z","etag":null,"topics":["ayiya","ipv6","routing","sixxs","tunnel","tunnel-server","tunnelbroker"],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/massar.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2018-04-15T17:39:40.000Z","updated_at":"2024-01-31T00:45:23.000Z","dependencies_parsed_at":"2023-04-26T03:03:32.923Z","dependency_job_id":null,"html_url":"https://github.com/massar/sixxsd","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/massar/sixxsd","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/massar%2Fsixxsd","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/massar%2Fsixxsd/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/massar%2Fsixxsd/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/massar%2Fsixxsd/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/massar","download_url":"https://codeload.github.com/massar/sixxsd/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/massar%2Fsixxsd/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264027611,"owners_count":23546108,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ayiya","ipv6","routing","sixxs","tunnel","tunnel-server","tunnelbroker"],"created_at":"2024-08-01T12:00:51.245Z","updated_at":"2025-07-07T06:33:16.235Z","avatar_url":"https://github.com/massar.png","language":"C","funding_links":[],"categories":["C","\u003ca id=\"01e6651181d405ecdcd92a452989e7e0\"\u003e\u003c/a\u003e工具","others"],"sub_categories":["\u003ca id=\"ea4dfcd8f33ec1852180c6283b2c8516\"\u003e\u003c/a\u003e未分类"],"readme":"# sixxsd\n\n\"sixxsd\" is the SixXS Daemon, it is the software that used to run on the [SixXS](https://www.sixxs.net/) PoPs \nand that handled the server-side of proto-41, heartbeat and AYIYA tunnels.\n\nsixxsd was designed and implemented by [Jeroen Massar](https://jeroen.massar.ch).\n\n[SixXS was sunset on 2017-06-06](https://www.sixxs.net/sunset/) after 17 years of operation as a free\n[IPv6 Tunnel Broker](https://en.wikipedia.org/wiki/Tunnel_broker) service for users worldwide.\n\nsixxsd ran on the PoPs from 2004 till 2017, serving an active daily 50.000 tunnels spread over 50 PoPs (with some PoPs being small \u003c100 tunnels, others having \u003e3000 tunnels per host).\nBefore sixxsd existed several bash scripts would reconfigure the kernel's gif interfaces.\n\n## Important Historic Notice\n\n*THIS CODE IS HISTORIC AND INTENDED FOR REFERENCE ONLY*\n\nsixxsd is provided for HISTORIC purposes, to show an insight into\nhow SixXS handled provisioning massive amounts of tunnels on\nmany PoPs around the world.\n\nSixXS shut down as IPv6 and deploying it is happening for 20+ years...\nThus, please, finally, get *native* IPv6!!!!!\n\nIf you need a tunneling solution fit for 2017 and beyond: use Wireguard!\nDo not send plaintext traffic over the Internet as is the case with\nproto-41, heartbeat and AYIYA tunnels.\n\nPlease also note that because of the cleartext various attacks are actually\npossible that can affect operation of such tunnels. MD5 used by heartbeat\nis easily fakeable, AYIYA uses good old SHA1 as a hash signature.\n\nAs such, we repeat again: sixxsd is intended for historic insight,\ndo not operate anymore on the public Internet.\n\n## Operation\n\nIn effect sixxsd is SixXS's own routing platform as the complete process of en/decapsulation of tunneled\npackets and passing it to the proper location is handled by it.\n\nsixxsd also takes care of the latency tests and traffic statistic collection.\nVarious statistics can be seen, when logged in, in real-time from the user home under tunnel details,\ne.g. the current location of an endpoint of a tunnel.\n\nsixxsd exists as the Linux kernel has/was not been designed to handle thousands of network interfaces: every packet was walking over a linked list.\nAdding/removing/reconfiguring interfaces was also prone to disconnects between what the system thought happened and what the actual configuration was.\nNext to that a lot of tuning due to routing table size was needed and various other issues we ran into over time.\n\nThe model that sixxsd uses is that of a single tun/tap interface exposed by the kernel where one or more /40's are routed into.\nThis releases the kernel from any of the management of this address space and all the interfaces that are located there.\nsixxsd effectively runs 'statically', nothing changes (no memory allocations etc) after it has been started.\nElements for configuration have all been pre-allocated, thus avoiding out of memory issues or memory fragmentation issues.\nAs we know the address-space layout, sixxsd is optimized for that, which avoids the need for table lookups or linked lists for routing packets.\n\nThis model also means that sixxsd sees all the packets and thus is able to provide accurate counters for performance monitoring.\n\n## Features\n\nA short summary of features of sixxsd:\n\n - Handles the full IPv6 Routing process\n - En/Decapsulation of protocol-41 (6in4/[RFC3056](https://tools.ietf.org/html/rfc3056)) and AYIYA (IPv4 in IPv6-UDP and IPv6 in IPv4-UDP)\n - Very high performance (during tests easily forwarded 4 Gbit/s of mixed AYIYA/proto-41 traffic)\n - IPv6 Tunnel Heartbeat support\n - Latency testing of active endpoints\n - Per-tunnel remote debugging option showing per-packet decisions being made\n - Per-tunnel statistics and error information\n - Per-tunnel default routed /64 towards tunnel endpoint\n\n## Configuration\n\nThe sixxsd binary starts by reading a [sixxsd.conf](misc/sixxsd.conf) this instructs it which prefixes it handles and which it routes to the tunnel device.\nIt uses a standard tun/tap device as provided by most Unix-alike kernels. \n\nThe SixXS backend, which can get updated by users using the webinterface, re-pushes the full configuration to the PoP.\nThis directly updates the state for all the interfaces and routes.\n\nThe ```pop saveconfig``` command atomically saves the sixxsd.conf running configuration to disk.\nThus allowing a restart of the PoP to resume with that state of configuration till a configuration push updates the configuration again.\n\n## Stability\n\nAs SixXS only deployed minimal kernels the PoPs where sixxsd ran where extremely stable and ran for multiple years at a time.\n\nSome details from when we shutdown all the PoPs:\n```\nDaemon uptime:\nnlams05.sixxs.net: 901 days 01:41:44\nusanc01.sixxs.net: 826 days 00:32:10\nnlede01.sixxs.net: 826 days 01:02:11\nfihel01.sixxs.net: 826 days 00:27:25\nusbos01.sixxs.net: 821 days 18:36:37\ndeham02.sixxs.net: 821 days 18:39:21\ndeham01.sixxs.net: 821 days 18:39:25\nausyd01.sixxs.net: 821 days 18:40:08\naubne01.sixxs.net: 821 days 18:45:04\ndeleo01.sixxs.net: 802 days 23:07:44\n\nServer uptime:\ndeham02.sixxs.net: 1893 days 00:05:17\nusbos01.sixxs.net: 1876 days 06:59:03\ndeham01.sixxs.net: 1610 days 17:44:19\nfihel01.sixxs.net: 1581 days 15:17:46\nnlede01.sixxs.net: 1260 days 01:49:58\nausyd01.sixxs.net: 1082 days 06:05:18\naubne01.sixxs.net: 1082 days 06:00:58\nnlams05.sixxs.net: 1064 days 10:04:58\nusanc01.sixxs.net: 879 days 23:33:28\ndeleo01.sixxs.net: 802 days 23:09:10\n```\n\nThat demonstrates an uptime of about 2,5 years of active running indicating how stable it ran.\nEspecially considering when one realises how many packets these daemons where forwarding, while\nbeing reconfigured every 10 minutes from the central server and also by heartbeat and AYIYA clients.\n\n## Platforms\n\nsixxsd was primarily run on minimal Debian GNU/Linux systems, but also ran on FreeBSD and OpenBSD based PoPs.\nIn addition, for development, MacOS also functions, but primarily for development, not for actual operation.\n\n## Support / Status\n\nThe code is provided as-as, primarily for historical purposes as various people have requested insight into what actually drove the SixXS PoPs.\n\nDue to the state of IPv6 deployment, we hope that this code is not needed anymore anywhere: please finally get native IPv6, it has been more than 20 years...\n\nIf one wants to create a VPN-alike service, we heavily suggest looking at [Wireguard](https://www.wireguard.com/) and/or OpenVPN instead as these\nprovide secure (read: cryptography involved) tunnels which disallow snooping along. All protocols implemented by sixxsd are insecure: no cryptography involved.\n\nSee also above the historic notice.\n\n## Security\n\nAs one will notice, no TLS or even SSL is included in this code, the SixXS PoPs where reconfigured over SSH tunneled TCP connections.\n\nAny current modern tunneling solution will use proper cryptography, hence, please look at Wireguard.\n\n* proto-41, heartbeat and AYIYA are all cleartext\n* The heartbeat protocol uses good old MD5\n* The AYIYA protocol uses good old SHA-1\n\nAll of these do not make a secure system.\n\n## Monitoring\n\nThe [check_sixxsd.py](misc/check_sixxsd.py) script was used for monitoring sixxsd instances.\n\nThis was quite useful, as we monitored active tunnels, if they dropped below a certain level we would know that something was wrong on our side.\nFiguring out then what, was the fun exercise.\n\n## License\n\nThe license for sixxsd is the [LICENSE](BSD 3-clause license).\n\nIn case one uses/references this, don't hesitate to give a shout out to the author, it is much appreciated.\n\n## Author\n\nThe designer and implementor of sixxsd is [Jeroen Massar](https://jeroen.massar.ch).\n\n## Contact\n\nJeroen can be reached by email: [jeroen@massar.ch](mailto:jeroen@massar.ch).\n\nThe previous email SixXS addresses. (jeroen@sixxs.net and info@sixxs.net) have been deactived when the project sunset.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmassar%2Fsixxsd","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmassar%2Fsixxsd","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmassar%2Fsixxsd/lists"}