#
# USAGI Linux/IPsec for IPv6
#
# $USAGI: IPsec,v 1.2 2001/12/29 20:47:40 kunitake Exp $
#

Now we are developing IPsec for IPv6 based on FreeS/WAN-1.9 and IABG.


Current status:

	We support Transport mode AH/ESP manually keyed.

Build:
	Our recommendation for ipsec related kernel config is as follows:
	
	- algorithm
		<*> Crypto support
		<*> Crypto ciphers
		<*> DES EDE3 cipher (3DES, EXPERIMENTAL)
		<*> DES cipher (DEPRECATED)
		<*> Digest algorithms
		<*> MD5 digest (EXPERIMENTAL)
		<*> SHA1 digest (EXPERIMENTAL)
	- ipsec
		[*]    The IPsec protocol (EXPERIMENTAL)
		[ ]     IPsec: IPsec Debug messages
		[ ]     IPsec: IPsec Debug disable Default
		[*]     IPv6: IP Security Support (EXPERIMENTAL)
		[*]     IPv6: Apply IPsec to ICMPv6 packets

How to use:

	install usagi/pfkey_util

	% cd ANYWHERE/usagi/usagi/pfkey_util
	% ./configure --with-linux-kernel=ANYWHERE/usagi/kernel/linux24  (default /usr/src/linux)
	(or if you use USAGI kit, pfkey command will be installed automatically.)
	% make
	% su
	# make install

	[manual configuration example]

	(Host A) ----------------- (Host B)
	3ffe:a:b:c:d::1            3ffe:a:b:c:d::2

	mode		: transport AH/ESP
	AH  algo	: hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
	ESP auth algo	: hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
	ESP enc algo	: 3des-cbc (key 0x0123456789abcdef0123456789abcdef0123456789abcdef)
	SPI 		: A -> B AH:0x1234 ESP:0x5678, B -> A AH:0x9abc ESP:0xdef0
	Protocol	: UDP

	(SET Host A -> Host B flow at Host A)
	(SA for AH)  
	# pfkey -A sa -T ah -S 0x1234 -p udp \
		-s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	(SA for ESP) 
	# pfkey -A sa -T esp -S 0x5678 -p udp \
		-s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef \
		--esp 3des-cbc --espkey 0x0123456789abcdef0123456789abcdef0123456789abcdef

        (SP for AH) 
	# pfkey -A sp -T ah -S 0x1234 -p udp  -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 
	(SP for AH) 
	# pfkey -A sp -T esp -S 0x5678 -p udp -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2

	(SET Host B -> Host A flow at Host A)
	(SA for AH) 
	# pfkey -A sa -T ah -S 0x9abc -p udp \
		-d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	(SA for ESP)
	# pfkey -A sa -T esp -S 0xdef0 -p udp \
		-d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef \
		--esp 3des-cbc --espkey 0x0123456789abcdef0123456789abcdef0123456789abcdef

	# pfkey -A sp -T ah -S 0x9abc -p udp  -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2
	# pfkey -A sp -T esp -S 0xdef0 -p udp -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2

	(SET Host A -> Host B flow at Host B)
	(SET Host B -> Host A flow at Host B)
		same as above

	- If you want to display current SA/SP status, use "pfkey -L".
	- If you want to flush SA all, use "pfkey -F any".
	- If you want to delete SA or SP entry, user "pfkey -D ...".
	("pfkey --help" displays more information.)
	(For easy manual testing, we provide a tiny script "ipsec-set" in pfkey_util directory.)

NOTICE:
	If you use 3DES or DES for ESP encryption algorithm, please avoid to use the weak key.

Debug:
	If you want to try to figure out ipsec related strange behavior,
	you can check a message via syslog to set /proc/net/ipsec/debug_*=1.
	(or sysctl -w net.ipsec.debug_{ipv6,pfkey,sadb,spd}=1)
FAQ:
	(Under construction)

TODOs:
	- NS-NA handling
	- SADB_REGISTER for IKE Daemon (We will use Pluto.)
	- Tunnel mode (We have a plan to realize this using generic over IP{v4|v6} tunnel, which we are writing.)
	- And remove many bugs :-)

References:
	FreeS/WAN	http://www.freeswan.org/
	IABG		http://www.ipv6.iabg.de/
	USAGI		http://www.linux-ipv6.org/
   
