#
# USAGI Linux/IPsec for IPv6
#
# $USAGI: IPsec,v 1.15.2.1 2002/09/06 10:57:36 mk Exp $
#

USAGI's IPsec for IPv6 is based on FreeS/WAN-1.9 and IABG.

NOTE: We use cryptoapi (patch-int-2.4.17.0.bz2) as implementation
of cipher/digest algorithms.  However, several algorithms are not
included due to the patent/license issue.  If you want to use them,
you can copy it from patch-int-2.4.17.0.bz2 to linux24/crypto/cipher/, 
and comment out related part of cipher/{Config.in, Makefile}.

The removed files :
	cipher-blowfish.c cipher-dfc.c cipher-idea.c 
	cipher-mars.c cipher-serpent.c cipher-twofish.c

Table of Contents

	1. Current Status
	2. Building/Installing USAGI IPsec
	2.1 Building Kernel 
	2.2 Install the pfkey command
	3. Using USAGI IPsec
	3.1 Transport Mode
	3.1.1 Manually keyed
	3.1.1.1 Save, Restore and Show IPsec Configurations
	3.1.2 Using IKEd
	3.1.2.1 Using IKEd with manual configuration
	3.1.2.2 Using IKEd with configuration file and auto scripts
	3.2 Tunnel Mode
	3.2.1. Connection between two sites
        3.2.1.1. Sample Network Topology
        3.2.1.2. Setup Instruction (manually keyed)
	3.2.2. Connection from a host to Security Gateway
        3.2.1.1. Sample Network Topology
        3.2.1.2. Setup Instruction (manually keyed)
	4. Notice
	5. Debug
	6. FAQ
	7. TODOs
	8. References


1. Current status:

	We support Transport mode AH/ESP manually keyed and using IKEd.
	We support Tunnel mode AH/ESP manually keyed.

2. Building/Installing USAGI IPsec

2.1 Building Kernel 

	The recommended kernel configuration for IPsec is as follows:
	("<o>": indicates an optional setting)

	
	Cryptographic options  --->
		<*> Cryptographic API support
		<o> generic loop cryptographic filter (EXPERIMENTAL)
		<*> Cryptographic ciphers
		--- AES Cipher (128 bit blocksize)
		<*>  AES (aka Rijndael) cipher (EXPERIMENTAL)
		--- AES Finalist Ciphers (128 bit blocksize)
		--- Other Ciphers submitted as AES Candidates:
		--- Other ciphers (64 bit blocksize)
		<*>  DES EDE3 cipher (3DES, EXPERIMENTAL)
		<*>  DES cipher (DEPRECATED)
		--- Debugging   
		<o>  DUMMY cipher (DEPRECATED)
		<*> Digest algorithms
		<*>  MD5 digest (EXPERIMENTAL)
		<*>  SHA1 digest (EXPERIMENTAL)
	Networking options  --->
		[*]    The IPsec protocol (EXPERIMENTAL)
		[*]     IPsec: IPsec Debug messages
		[*]     IPsec: IPsec Debug disable Default
		<*/M>   The IPv6 protocol (EXPERIMENTAL)
		...
		[*]     IPv6: IP Security Support (EXPERIMENTAL)
		<M>	IPv6: IPv6 over IPv6 Tunneling (EXPERIMENTAL)


2.2 Install the pfkey command

	% cd ANYWHERE/usagi/usagi/pfkey
	% ./configure --with-linux-kernel=ANYWHERE/usagi/kernel/linux24
	  (default /usr/src/linux)
	(or if you use USAGI kit, pfkey command will be installed automatically.)
	% make
	% su
	# make install

2.3 Install pluto (IKEd)

	% cd ANYWHERE/usagi/usagi/pluto
	% ./configure
	% make
	% su
	# make install

	By default, then you can see commands in /usr/local/v6/sbin 
	and configuration file and key material file in /usr/local/v6/etc.
	We install _confread, _include, auto, ipsec, pluto, ranbits, 
	rsasigkey and whack in /usr/local/v6/sbin.
	We also install conf.eg and secrets.eg in /usr/local/v6/etc.

3. Using USAGI IPsec

	IPsec can be configured manually using the pfkey command or
	it can be configured dynamically through the IKE daemon, pluto.

	(Attention: YOU MUST AVOID TO USE WEAK KEY.)

3.1 Transport Mode

	Example Network Scenario:

	(Host A) ----------------- (Host B)
	3ffe:a:b:c:d::1            3ffe:a:b:c:d::2

	mode		: transport AH/ESP
	AH  algo	: hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
	ESP auth algo	: hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
	ESP enc algo	: 3des-cbc (key 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7)
	SPI 		: A -> B AH:0x1234 ESP:0x5678, B -> A AH:0x9abc ESP:0xdef0
	Protocol	: UDP

3.1.1 Manually keyed

	(SET Host A -> Host B flow at Host A)
	(SA for AH)  
	# pfkey -A sa -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 -T ah -S 0x1234 -p udp \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	(SA for ESP) 
	# pfkey -A sa -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 -T esp -S 0x5678 -p udp \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef \
		--esp 3des-cbc --espkey 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7

        (SP for AH) 
	# pfkey -A sp -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 -T ah -S 0x1234 -p udp 
	(SP for ESP) 
	# pfkey -A sp -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 -T esp -S 0x5678 -p udp 

	(SET Host B -> Host A flow at Host A)
	(SA for AH) 
	# pfkey -A sa -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 -T ah -S 0x9abc -p udp \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	(SA for ESP)
	# pfkey -A sa -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 -T esp -S 0xdef0 -p udp \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef \
		--esp 3des-cbc --espkey 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7

	# pfkey -A sp -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 -T ah -S 0x9abc -p udp 
	# pfkey -A sp -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 -T esp -S 0xdef0 -p udp 

	Now on Host B do the same as above:
	(SET Host A -> Host B flow at Host B)
	(SET Host B -> Host A flow at Host B)

	You can also use the following options with the pfkey command:

	- "pfkey -L" to display current SA/SP status.
	- "pfkey -F any" to flush all the SAs and SPs.
	- "pfkey -D ..." to delete an SA or SP entry.
	- "pfkey --help" to display more help information.

	(For easy manual testing, we provide a script "ipsec-set" in pfkey directory.)
	We recommend disabling Replay_Window_Check for manual keying.
	e.g. # sysctl -w net.ipsec.replay_window_check=0
	or
	     # echo 0 > /proc/sys/net/ipsec/replay_window_chek

3.1.1.1 Save, Restore and Show IPsec Configurations

	You can use "ipsec-conf" with 'save', 'restore', 
	'reset' and 'show' (some commands need a file name).

	When you have some IPsec configurations in your kernel, 
	you can see these configurations as follows.
	# ipsec-conf show
	and you can save the configurations to file as follows.
	# ipsec-conf save FILENAME

	When you have a IPsec configuration file which was saved by using "ipsec-conf save", 
	you can restore the configuration as follows.
	# ipsec-conf restore FILENAME

3.1.2 Using IKEd

	IKE(preshared key) CONFIGURATION EXAMPLE:

	Difference between FreeS/WAN's pluto and USAGI's pluto
	- Default path for ipsec.conf is changed to /usr/local/v6/etc/ipsec.conf
	- Default path for ipsec.secrets which is authentication key file is changed to
		/usr/local/v6/etc/ipsec.secrets.
	- Our pluto never calls updown script.

3.1.2.1 Using IKEd with manual configuration

	The two commands to use ike are, "pluto" and "whack".
	pluto is a daemon that runs the IKE protocol.
	whack is a command used to communicate with a running pluto.

	1). See manual for pluto and ipsec.secrets, which is in /usr/local/v6/man/{man5,man8}
	1). To se the man pages for pluto and ipsec.secrets, located
	in /usr/local/v6/man/{man,man8}:
	% man ipsec_pluto
	% man ipsec.secrets

	Start sequence:
	
	2). Define a preshared key of both hosts in /usr/local/v6/etc/ipsec.secrets (default).
	3ffe:a:b:c:d::1 3ffe:a:b:c:d::2 : PSK "hoge"
		...... (in ipsec.secrets)

	3). Run pluto with any option
	# pluto
	for debug, we use --nofork --stderrlog --debug-all
	# pluto --nofork --stderrlog --deubg-all

	4). Check pluto is running or not with ps command or ls /var/run.
	# ls /var/run
	If there is a pluto.pid file, pluto is running.

	5). Configure IKE with whack command. The parameter after --name is the
	name of a configuration. This parameteris used for initiation,
	termination, and delete. The configuration name "test" is used in the 
	following examples.

	-- You use authentication
	# whack --name test --ipv6 --host 3ffe:a:b:c:d::1 --to --host 3ffe:a:b:c:d::2 --authnticate
	-- You use encryption
	# whack --name test --ipv6 --host 3ffe:a:b:c:d::1 --to --host 3ffe:a:b:c:d::2 --encrypt
	-- You use authentication and encryption
	# whack --name test --ipv6 --host 3ffe:a:b:c:d::1 --to --host 3ffe:a:b:c:d::2 --authnticate --encrypt

	*You can use other options but tunnel options. Please see a manual of pluto.
	*You can use other options but tunnel options. Please see man pages for pluto.

	6). Make pluto listen
	# whack --listen
	then pluto checks the interface and reads authentication keys from the file.

	7). Initiate key exchange with configuration name
	# whack --initiate --name test
	pluto begins key exchages and if you get an answer establish, pluto successes key exchange.
	You can see the IPsec information with
	% pfkey -L

	Shutdown sequence from here.

	8). Terminate IPsec between the hosts.
	# whack --terminate --name test

	9). Delete configuration
	# whack --delete --name test

	10). Shutdown pluto
	# whack --shutdown
	
3.1.2.2 Using IKEd with configuration file and auto scripts

	We ported some scripts of FreeS/WAN to USAGI.
	Then you can use "ipsec auto" command with "ipsec.conf" and "ipsec.secrets".
	But we can use it only in IPsec transport mode and our implementation never call
	up/down script so that these fields (leftsubnet, leftnexthop, leftupdown, leftfirewall)
	do nothing.

	There is not set up scripts for booting up the hosts either so that "auto" field in
	ipsec.conf does nothing.

	We introduced "af" fields into "ipsec.conf", af which indicates Address
	Family. You can set "inet" or "inet6" in that fields. It is "inet" by default. 

	"/usr/local/v6/etc" is the default path to "ipsec.conf" and "ipsec.secrets".

	Example Network Scenario:

	(Host A) ----------------- (Host B)
	3ffe:a:b:c:d::1            3ffe:a:b:c:d::2

	mode		: transport AH/ESP
	AH  algo	: hmac-md5
	ESP auth algo	: hmac-md5
	ESP enc algo	: 3des-cbc

	IKEd authenticates another with pre-shared secret.

	The name of this SAs is "test"

	1). Write the pre-shared secret in ipsec.secret like this

		3ffe:a:b:c:d::1 3ffe:a:b:c:d::2 : PSK "test SAs secrets"

	2). Write the configuration of "test" in ipsec.conf
	
		config setup
			.....
	
		conn test
			af=inet6
			type=transport
			authby=secret
			left=3ffe:a:b:c:d::1
			right=3ffe:a:b:c:d::2
			esp=3des-md5-96
			auth=hmac-md5-96

	3). Run the pluto with any option (Do this on both hosts)
		#pluto --nofork --stderrlog --debug-all (for debugging)

	4). Add the configuration of "test" to pluto (Do this on both hosts)
		#ipsec auto --add test

	5). Make pluto read secrets (Do this on both hosts)
		#ipsec auto --ready

	6). Make pluto establish IPsec SAs which are configured in "test"
		#ipsec auto --up test

	To delete configuration of "test"
		# ipsec auto --delete test

	To change pre-shared secrets or add pre-shared secrets
		# ipsec auto --rereadsecret

	You want more specifications, please see manual pages.


3.2 Tunnel Mode

3.2.1. Connection between two sites

3.2.1.1. Sample Network Topology

	In this section, Security Gateway 1(SG1) and Security Gateway 2(SG2)
	connect between two networks over IPv6 external network, by using IPsec
	Tunneling. Here is network topology.
	And SA between SG1 and SG2 is shown below.

            (NET1 : fec0:0:0:1000::/64)   (NETX : 3ffe:a:b:c:d::/64)   (NET2 : fec0:0:0:2000::/64)

    	HOST1-eth0-----------------eth0-SG1-eth1================eth1-SG2-eth0----------------eth0-HOST2

    	eth0:fec0:0:0:1000::101    eth0:fec0:0:0:1000::10       eth0:fec0:0:0:2000::20       eth0:fec0:0:0:2000::202
                                   eth1:3ffe:a:b:c:d::10        eth1:3ffe:a:b:c:d::20
                                   tnl0:fe80::10                tnl0:fe80::20

        mode            : tunnel AH/ESP
        AH  algo        : hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
        ESP auth algo   : hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
        ESP enc algo    : 3des-cbc (key 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7)
        SPI             : SG1 -> SG2 AH:0x1234 ESP:0x5678, SG2 -> SG1 AH:0x9abc ESP:0xdef0

3.2.1.2. Setup Instruction (manually keyed)

	First of all, you have to set up interfaces of each nodes and configure 
	SG1 and SG2 as routers.
    
	on HOST1
    	# ifconfig eth0 add fec0:0:0:1000::101/64
    
	on HOST2
	# ifconfig eth0 add fec0:0:0:2000::202/64
    
	If you want to configure HOST1 and HOST2 by Router Advertisements from 
	SG1 and SG2, you don't need to configure these addresses manually
	on HOST1 and HOST2.
    
	on SG1
	# ifconfig eth0 add fec0:0:0:1000::10/64
	# ifconfig eth1 add 3ffe:a:b:c:d::10/64
	# sysctl -w net/ipv6/conf/all/forwarding=1
	# sysctl -w net/ipv6/conf/all/accept_ra=0
    
	on SG2
	# ifconfig eth0 add fec0:0:0:2000::20/64
	# ifconfig eth1 add 3ffe:a:b:c:d::20/64
	# sysctl -w net/ipv6/conf/all/forwarding=1
	# sysctl -w net/ipv6/conf/all/accept_ra=0
    
    
	Then, you have to set up tunnel device between SG1(NETX) and SG2(NETX), and configure
	routing.
	If you want to check tunnel configuration, type "ipv6tunnel show tnl0" after completing
	these configurations.

    	on SG1
    	# modprobe ipv6_tunnel
    	# ipv6tunnel add tnl0 --tunnel-local-packets encaplimit 0 \
      	  remote 3ffe:a:b:c:d::20 local 3ffe:a:b:c:d::10
    	# ipconfig tnl0 up
    	# ipconfig tnl0 add fe80::10
    	# route add --inet6 fec0:0:0:2000::/64 dev tnl0
    
    	on SG2
    	# modprobe ipv6_tunnel
    	# ipv6tunnel add tnl0 --tunnel-local-packets encaplimit 0 \
          remote 3ffe:a:b:c:d::10 local 3ffe:a:b:c:d::20
    	# ipconfig tnl0 up
    	# ipconfig tnl0 add fe80::20
    	# route add --inet6 fec0:0:0:1000::/64 dev tnl0
    
	Now you should ping from HOST1 to HOST2. If it doesn't work well, check your configuration.
	Then, you have to set SAs and SPD.

    	on both SG1 and SG2
    
    	SG1 to SG2
    	# pfkey -A sa -s 3ffe:a:b:c:d::10 -d 3ffe:a:b:c:d::20 -T ah -S 0x1234 \
      	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
    	# pfkey -A sa -s 3ffe:a:b:c:d::10 -d 3ffe:a:b:c:d::20 -T esp -S 0x5678 \
      	  --esp 3des-cbc --espkey 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7 \
      	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
    	# pfkey -A sp -s fec0:0:0:1000::/64 -d fec0:0:0:2000::/64 -T ah -S 0x1234 \
      	  --tunnel --sad 3ffe:a:b:c:d::20
    	# pfkey -A sp -s fec0:0:0:1000::/64 -d fec0:0:0:2000::/64 -T esp -S 0x5678 \
      	  --tunnel --sad 3ffe:a:b:c:d::20
    
    	SG2 to SG1
    	# pfkey -A sa -s 3ffe:a:b:c:d::20 -d 3ffe:a:b:c:d::10 -T ah -S 0x9abc \
      	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
    	# pfkey -A sa -s 3ffe:a:b:c:d::20 -d 3ffe:a:b:c:d::10 -T esp -S 0xdef0 \
      	  --esp 3des-cbc --espkey 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7 \
      	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
   	# pfkey -A sp -s fec0:0:0:2000::/64 -d fec0:0:0:1000::/64 -T ah -S 0x9abc \
      	  --tunnel -sad 3ffe:a:b:c:d::10
    	# pfkey -A sp -s fec0:0:0:2000::/64 -d fec0:0:0:1000::/64 -T esp -S 0xdef0 \
      	  --tunnel -sad 3ffe:a:b:c:d::10

	Finally you configured IPsec tunnel from SG1 to SG2.
	Try to ping from HOST1 to HOST2, and check if the packets are encrypted.

3.2.2. Connection from a host to Security Gateway

3.2.2.1. Sample Network Topology

	In this section, Security Gateway 1(SG1) and Security Gateway 2(SG2)
	communicate over IPv6 external network, by using IPsec Tunneling.
	SG1 has only one phisical interface. Here is network topology.
	And SA between SG1 and SG2 is shown below.

           (NETX : 3ffe:a:b:c:d::/64)   (NET2 : fec0:0:0:2000::/64)

	SG1-eth0================eth1-SG2-eth0----------------eth0-HOST2

    	eth0:3ffe:a:b:c:d::10        eth0:fec0:0:0:2000::20       eth0:fec0:0:0:2000::202
    	tnl0:fec0:0:0:1000::10       eth1:3ffe:a:b:c:d::20
    	tnl0:fe80::10                tnl0:fe80::20

        mode            : tunnel AH/ESP
        AH  algo        : hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
        ESP auth algo   : hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
        ESP enc algo    : 3des-cbc (key 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7)
        SPI             : SG1 -> SG2 AH:0x1234 ESP:0x5678, SG2 -> SG1 AH:0x9abc ESP:0xdef0

3.2.2.2. Setup Instruction (manually keyed)

	First of all, you have to set up interfaces of each nodes and configure 
	SG2 as a router.
    
	on HOST2
	# ifconfig eth0 add fec0:0:0:2000::202/64

	If you want to configure HOST2 by Router Advertisements from SG2, 
	you don't need to configure these addresses manually on HOST2.

	on SG1
	# ifconfig eth0 add 3ffe:a:b:c:d::10/64

	on SG2
	# ifconfig eth0 add fec0:0:0:2000::20/64
	# ifconfig eth1 add 3ffe:a:b:c:d::20/64
	# sysctl -w net/ipv6/conf/all/forwarding=1
	# sysctl -w net/ipv6/conf/all/accept_ra=0

	Then, you have to set up tunnel device between SG1(NETX) and SG2(NETX), and configure
	routing.
	If you want to check tunnel configuration, type "ipv6tunnel show tnl0" after completing
	these configurations.

	on SG1
	# modprobe ipv6_tunnel
	# ipv6tunnel add tnl0 --tunnel-local-packets encaplimit 0 \
	  remote 3ffe:a:b:c:d::20 local 3ffe:a:b:c:d::10
	# ipconfig tnl0 up
	# ipconfig tnl0 add fe80::10
	# ipconfig tnl0 add fec0:0:0:1000::10/64
	# route add --inet6 fec0:0:0:2000::/64 dev tnl0

	on SG2
	# modprobe ipv6_tunnel
	# ipv6tunnel add tnl0 --tunnel-local-packets encaplimit 0 \
  	  remote 3ffe:a:b:c:d::10 local 3ffe:a:b:c:d::20
	# ipconfig tnl0 up
	# ipconfig tnl0 add fe80::20
	# route add --inet6 fec0:0:0:1000::/64 dev tnl0

	Now you should ping from SG1 to HOST2. If it doesn't work well, check your configuration.
	Then, you have to set SAs and SPD.

	on both SG1 and SG2

	SG1 to SG2
	# pfkey -A sa -s 3ffe:a:b:c:d::10 -d 3ffe:a:b:c:d::20 -T ah -S 0x1234 \
	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	# pfkey -A sa -s 3ffe:a:b:c:d::10 -d 3ffe:a:b:c:d::20 -T esp -S 0x5678 \
	  --esp 3des-cbc --espkey 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7 \
	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	# pfkey -A sp -s fec0:0:0:1000::10 -d fec0:0:0:2000::/64 -T ah -S 0x1234 \
	  --tunnel -sad 3ffe:a:b:c:d::20
	# pfkey -A sp -s fec0:0:0:1000::100 -d fec0:0:0:2000::/64 -T esp -S 0x5678 \
	  --tunnel -sad 3ffe:a:b:c:d::20

	SG2 to SG1
	# pfkey -A sa -s 3ffe:a:b:c:d::20 -d 3ffe:a:b:c:d::10 -T ah -S 0x9abc \
	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	# pfkey -A sa -s 3ffe:a:b:c:d::20 -d 3ffe:a:b:c:d::10 -T esp -S 0xdef0 \
	  --esp 3des-cbc --espkey 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7 \
	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	# pfkey -A sp -s fec0:0:0:2000::/64 -d fec0:0:0:1000::10 -T ah -S 0x9abc \
	  --tunnel --sad 3ffe:a:b:c:d::10
	# pfkey -A sp -s fec0:0:0:2000::/64 -d fec0:0:0:1000::10 -T esp -S 0xdef0 \
	  --tunnel --sad 3ffe:a:b:c:d::10

	Finally you configured IPsec tunnel from SG1 to SG2.
	Try to ping from SG1 to HOST2, and check if the packets are encrypted.

4. Notice

	If you use 3DES or DES for ESP encryption algorithm, please avoid using the weak key.

5. Debug

	If you want to try to figure out ipsec related strange behavior,
	you can check a message via syslog to set /proc/net/ipsec/debug_*=1.
	(or sysctl -w net.ipsec.debug_{ipv6,pfkey,sadb,spd}=1)

6. FAQ

	(Under construction)

7. TODOs

	- And remove many bugs :-)
	- fix PMTU handling with Tunnel mode.
	- Support IPv4

8. References

	FreeS/WAN	http://www.freeswan.org/
	IABG		http://www.ipv6.iabg.de/
	USAGI		http://www.linux-ipv6.org/
	cryptoapi	ftp://ftp.kernel.org/, http://sourceforge.net/projects/cryptoapi/
   
