#
# USAGI Linux/IPsec for IPv6
#
# $USAGI: IPsec,v 1.4 2002/01/16 09:10:19 mk Exp $
#

Now we are developing IPsec for IPv6 based on FreeS/WAN-1.9 and IABG.

And we use cryptoapi(patch-int-2.4.17.0.bz2) as cipher/digest algorithm,
but we removed needless crypto algorithm to avoid patent/license issue.
If you want to use removed algorithm, 
you can use it just copy from patch-int-2.4.17.0.bz2 to linux24/crypto/cipher/, 
and comment out related part of cipher/{Config.in, Makefile}.
(removed files:
	cipher-blowfish.c cipher-dfc.c cipher-idea.c 
	cipher-mars.c cipher-serpent.c cipher-twofish.c)

Current status:

	We support Transport mode AH/ESP manually keyed.

Build:
	Our recommendation for ipsec related kernel config is as follows:
	("<o>": as you like)
	
	Cryptographic options  --->
		<*> Cryptographic API support
		<o> generic loop cryptographic filter (EXPERIMENTAL)
		<*> Cryptographic ciphers
		--- AES Cipher (128 bit blocksize)
		<*>  AES (aka Rijndael) cipher (EXPERIMENTAL)
		--- AES Finalist Ciphers (128 bit blocksize)
		--- Other Ciphers submitted as AES Candidates:
		--- Other ciphers (64 bit blocksize)
		<*>  DES EDE3 cipher (3DES, EXPERIMENTAL)
		<*>  DES cipher (DEPRECATED)
		--- Debugging   
		<o>  DUMMY cipher (DEPRECATED)
		<*> Digest algorithms
		<*>  MD5 digest (EXPERIMENTAL)
		<*>  SHA1 digest (EXPERIMENTAL)
	Networking options  --->
		[*]    The IPsec protocol (EXPERIMENTAL)
		[*]     IPsec: IPsec Debug messages
		[*]     IPsec: IPsec Debug disable Default
		<*/M>   The IPv6 protocol (EXPERIMENTAL)
		...
		[*]     IPv6: IP Security Support (EXPERIMENTAL)
		[*]     IPv6: Apply IPsec to ICMPv6 packets

How to use:

	install usagi/pfkey_util

	% cd ANYWHERE/usagi/usagi/pfkey_util
	% ./configure --with-linux-kernel=ANYWHERE/usagi/kernel/linux24  (default /usr/src/linux)
	(or if you use USAGI kit, pfkey command will be installed automatically.)
	% make
	% su
	# make install

	[manual configuration example]

	(Attention: You must avoid to use weakkey.)

	(Host A) ----------------- (Host B)
	3ffe:a:b:c:d::1            3ffe:a:b:c:d::2

	mode		: transport AH/ESP
	AH  algo	: hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
	ESP auth algo	: hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
	ESP enc algo	: 3des-cbc (key 0x0123456789abcdef0123456789abcdef0123456789abcdef)
	SPI 		: A -> B AH:0x1234 ESP:0x5678, B -> A AH:0x9abc ESP:0xdef0
	Protocol	: UDP

	(SET Host A -> Host B flow at Host A)
	(SA for AH)  
	# pfkey -A sa -T ah -S 0x1234 -p udp \
		-s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	(SA for ESP) 
	# pfkey -A sa -T esp -S 0x5678 -p udp \
		-s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef \
		--esp 3des-cbc --espkey 0x0123456789abcdef0123456789abcdef0123456789abcdef

        (SP for AH) 
	# pfkey -A sp -T ah -S 0x1234 -p udp  -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 
	(SP for AH) 
	# pfkey -A sp -T esp -S 0x5678 -p udp -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2

	(SET Host B -> Host A flow at Host A)
	(SA for AH) 
	# pfkey -A sa -T ah -S 0x9abc -p udp \
		-d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	(SA for ESP)
	# pfkey -A sa -T esp -S 0xdef0 -p udp \
		-d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef \
		--esp 3des-cbc --espkey 0x0123456789abcdef0123456789abcdef0123456789abcdef

	# pfkey -A sp -T ah -S 0x9abc -p udp  -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2
	# pfkey -A sp -T esp -S 0xdef0 -p udp -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2

	(SET Host A -> Host B flow at Host B)
	(SET Host B -> Host A flow at Host B)
		same as above

	- If you want to display current SA/SP status, use "pfkey -L".
	- If you want to flush SA all, use "pfkey -F any".
	- If you want to delete SA or SP entry, user "pfkey -D ...".
	("pfkey --help" displays more information.)
	(For easy manual testing, we provide a tiny script "ipsec-set" in pfkey_util directory.)

NOTICE:
	If you use 3DES or DES for ESP encryption algorithm, please avoid to use the weak key.

Debug:
	If you want to try to figure out ipsec related strange behavior,
	you can check a message via syslog to set /proc/net/ipsec/debug_*=1.
	(or sysctl -w net.ipsec.debug_{ipv6,pfkey,sadb,spd}=1)
FAQ:
	(Under construction)

TODOs:
	- NS-NA handling
	- SADB_REGISTER for IKE Daemon (We will use Pluto.)
	- Tunnel mode (We have a plan to realize this using generic over IP{v4|v6} tunnel, which we are writing.)
	- And remove many bugs :-)

References:
	FreeS/WAN	http://www.freeswan.org/
	IABG		http://www.ipv6.iabg.de/
	USAGI		http://www.linux-ipv6.org/
	cryptoapi	ftp://ftp.kernel.org/, http://sourceforge.net/projects/cryptoapi/
   
