#
# USAGI Linux/IPsec for IPv6
#
# $USAGI: README.USAGI-IPSEC,v 1.7 2001/08/26 17:16:09 mk Exp $
#

Now we are developing IPsec for IPv6 based on FreeS/WAN-1.9 and IABG.


Current status:

	We support Transport mode AH/ESP manually keyed.
	(And we strongly recomend linking the ipv6 subsystem statically.)

How to use:

	install usagi/pfkey_util

	% cd ANYWHERE/usagi/usagi/pfkey_util
	% ./configure --with-linux-kernel=ANYWHERE/usagi/kernel/linux24  (default /usr/src/linux)
	(or if you use USAGI kit, pfkey command will be installed automatically.)
	% make
	% su
	# make install

	[manual configuration example]

	(Host A) ----------------- (Host B)
	3ffe:a:b:c:d::1            3ffe:a:b:c:d::2

	mode		: transport AH/ESP
	AH  algo	: hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
	ESP auth algo	: hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
	ESP enc algo	: 3des-cbc (key 0x0123456789abcdef0123456789abcdef0123456789abcdef)
	SPI 		: A -> B AH:0x1234 ESP:0x5678, B -> A AH:0x9abc ESP:0xdef0
	Protocol	: UDP

	(SET Host A -> Host B flow at Host A)
	(SA for AH)  
	# pfkey -A sa -T ah -S 0x1234 -p udp \
		-s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	(SA for ESP) 
	# pfkey -A sa -T esp -S 0x5678 -p udp \
		-s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef \
		--esp 3des-cbc --espkey 0x0123456789abcdef0123456789abcdef0123456789abcdef

        (SP for AH) 
	# pfkey -A sp -T ah -S 0x1234 -p udp  -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 
	(SP for AH) 
	# pfkey -A sp -T esp -S 0x5678 -p udp -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2

	(SET Host B -> Host A flow at Host A)
	(SA for AH) 
	# pfkey -A sa -T ah -S 0x9abc -p udp \
		-d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	(SA for ESP)
	# pfkey -A sa -T esp -S 0xdef0 -p udp \
		-d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef \
		--esp 3des-cbc --espkey 0x0123456789abcdef0123456789abcdef0123456789abcdef

	# pfkey -A sp -T ah -S 0x9abc -p udp  -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2
	# pfkey -A sp -T esp -S 0xdef0 -p udp -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2

	(SET Host A -> Host B flow at Host B)
	(SET Host B -> Host A flow at Host B)
		same as above

	- If you want to display current SA/SP status, use "pfkey -L".
	- If you want to flush SA all, use "pfkey -F any".
	- If you want to delete SA or SP entry, user "pfkey -D ...".
	("pfkey --help" displays more information.)

FAQ:
	(Under construction)

TODOs:
	- NS-NA handling
	- SADB_REGISTER for IKE Daemon (We will use Pluto.)
	- Tunnel mode (We have a plan to realize this using generic over IP{v4|v6} tunnel, which we are writing.)
	- Define the granularity of policies (port, flow,..)
	- And remove many bugs :-)

References:
	FreeS/WAN	http://www.freeswan.org/
	IABG		http://www.ipv6.iabg.de/
	USAGI		http://www.linux-ipv6.org/
   
