1 .\" Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
2 .\" All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
12 .\" 3. Neither the name of the project nor the names of its contributors
13 .\" may be used to endorse or promote products derived from this software
14 .\" without specific prior written permission.
16 .\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
17 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
20 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 .\" $Id: ipsec.4,v 1.2 1999/10/07 03:55:08 itojun Exp $
36 .Nd IP security protocol
38 .Fd #include <sys/types.h>
39 .Fd #include <netinet/in.h>
40 .Fd #include <netinet6/ipsec.h>
43 is a security protocol in Internet Protocol layer.
45 is defined for both IPv4 and IPv6
52 consists of two sub-protocols, namely
54 .Pq encapsulated security payload
56 .Pq authentication header .
57 ESP protects IP payload from wire-tapping by encrypting it by
58 secret key cryptography algorithms.
59 AH guarantees integrity of IP packet
60 and protects it from intermediate alteration or impersonation,
61 by attaching cryptographic checksum computed by one-way hash functions.
63 has two operation modes: transport mode and tunnel mode.
64 Transport mode is for protecting peer-to-peer commuication between end nodes.
65 Tunnel mode includes IP-in-IP encapsulation operation
66 and is designed for security gateways, like VPN configurations.
70 is controlled by key management engine, and policy engine in the
71 operating system kernel.
73 Key management engine can be accessed from the userland by using
78 socket API is defined in RFC2367.
80 Policy engine can be controlled by extended part of
90 interface, and allows you to define IPsec policy like per-packet filters.
92 interface is used to define per-socket behavior, and
94 interface is used to define host-wide default behavior.
96 The kernel code does not implement dynamic encryption key exchange protocol
98 .Pq Internet Key Exchange .
99 That should be implemented as userland programs
100 .Pq usually as daemons ,
101 by using the above described APIs.
103 .Sh POLICY MANAGEMENT
104 The kernel implements experimental policy management code.
105 You can manage the IPsec policy in two ways.
106 One is to configure per-socket policy using
108 The other is to configure kernel packet filter-based policy using
112 In both cases, IPsec policy must be specified with syntax described in
113 .Xr ipsec_set_policy 3 .
117 you can define IPsec policy in per-socket basis.
118 You can enforce particular IPsec policy onto packets that go through
123 you can define IPsec policy against packets,
124 using sort of packet filtering rule.
131 policy is allowed for use with
133 By configuring policy to
135 you can refer system-wide
137 variable for default settings.
138 The following variables are available.
147 .Bl -column net.inet6.ipsec6.esp_trans_deflev integerxxx
148 .It Sy Name Type Changeable
149 .It net.inet.ipsec.esp_trans_deflev integer yes
150 .It net.inet.ipsec.esp_net_deflev integer yes
151 .It net.inet.ipsec.ah_trans_deflev integer yes
152 .It net.inet.ipsec.ah_net_deflev integer yes
153 .It net.inet6.ipsec6.esp_trans_deflev integer yes
154 .It net.inet6.ipsec6.esp_net_deflev integer yes
155 .It net.inet6.ipsec6.ah_trans_deflev integer yes
156 .It net.inet6.ipsec6.ah_net_deflev integer yes
159 If kernel finds no matching policy system wide default value is applied.
160 System wide default is specified by the following
166 which asks the kernel to drop the packet.
170 .Bl -column net.inet6.ipsec6.def_policy integerxxx
171 .It Sy Name Type Changeable
172 .It net.inet.ipsec.def_policy integer yes
173 .It net.inet6.ipsec6.def_policy integer yes
179 protocol works like plug-in to
186 supports most of the protocols defined upon those IP-layer protocols.
187 Some of the protocols, like
191 may behave differently with
199 routines from looking into IP payload.
204 .Xr ipsec_set_policy 3 ,
217 .%T "A Simple IP Security API Extension to BSD Sockets"
218 .%N "draft-mcdonald-simple-ipsec-api-03.txt"
222 The IPsec support is subject to change as the IPsec protocols develop.
224 There is no single standard for policy engine API,
225 so the policy engine API described herein is just for KAME implementation.
228 The implementation described herein appeared in WIDE/KAME IPv6/IPsec stack.