IPSec for FreeBSD

This is the release 0.50b of an ipsec implementaion for FreeBSD for ipv4 only. It was ported from OpenBSD which again was ported from BSD/OS.
Bug reports and comments are highly appreciated.

Please refer to http://www.ietf.org/html.charters/ipsec-charter.html for more information about ipsec.

Please note that I'm no longer maintaining this port as the KAME IPSec stack now also works for IPv4. KAME has now become part of the standard FreeBSD distribution. Please see man ipsec on your FreeBSD box and take a look at the kame website

Software

The patches are now available for the following versions:

FreeBSD 2.2.7-RELEASE (v0.1b only)
FreeBSD 3.0-RELEASE (up to v0.04b)

FreeBSD 3.1-RELEASE

Installation

In order to install this you need to have the kernel sources installed. You will also need the des package.
Simply follow those steps:

Unpack the distribution by typing:

tar xzvf ipsec.freebsd.227R-v0.01b.tar.gz
or
tar xzvf ipsec.freebsd.3.1R-v0.05b.tar.gz

change to the directory containing the unpacked dsitribution by typing:

cd ipsec-v0.05b
To apply the kernel patches type:

sh install
Then add the following lines to your kernel configuration file:

options IPSEC
options "MD5"
pseudo-device enc 1

If you'd like to view debug messages also add:

options ENCDEBUG

In case you don't know where to find your kernel config file, please refer to the FreeBSD Handbook entry
Rebuild the kernel and install it.
Reboot into the new kernel
After that you will notice a new interface called enc0.

You should install the userland programs in tools/ and the manpages. To do so, simply type:

sh install-tools

This will makde the userland programs and install them in the proper places. They're:

ipsecadm	use this to manually set up SA's. Refer to its manpage for further information.
rt	this lets you create ipsec routing entries
rtdelete	This will help you delete them again
photurisd	this is the photuris keymanagement daemon
startkey	use this to start keying with photurisd
libhash	this is a simple lib providing sha and ripemd-160. OpenBSD has this in libc, FreeBSD doesn't
netstat	this is a replacement for your current netstat which'll let you view ipsec routes

You can add the following entries to rc.conf to configure ipsec at startup:

	### IPsec options ###
        ipsec_enable="YES"              # enable IPsec
        ipsec_encdebug_enable="YES"     # set debug.encdebug=1
	ipsec_manual_setup="NO"         # manually setup SAs+ routes in rc.ipsec
	ipsec_setup_name ="NONE"        # setup name (see rc.ipsec)

        photuris_enable="YES"           # run photurisd
        photuris_flags=""               # Flags to photurisd

If you do so make sure you also type:

sh install-config

to add rc.ipsec and make some changes to your /etc/rc.

Please refer to the manpages and general ipsec and photuris documentation on how to set it up. If you want to test it right away you can do the following:

on machine1 and on machine2:

ipsecadm -enc 3des -auth md5 -spi 1000 -src ip_of_machine_1 -dst ip_of_machine2 -key 123456789123456789123456789123456789123456789123 -authkey dead

ipsecadm -enc 3des -auth md5 -spi 1001 -src ip_of_machine_2 -dst ip_of_machine1 -key 123456789123456789123456789123456789123456789122 -authkey dead

on machine1:

rt machine1 255.255.255.255 machine2 255.255.255.255 -1 -1 -1 machine2 1000 1

on machine2:

rt machine2 255.255.255.255 machine1 255.255.255.255 -1 -1 -1 machine1 1001 1

To see whats happening now type:

tcpdump host machine1 and host machine2

To see what has been added type:

netstat -rn

To see what SA's you added type:

sysctl net.ipsec.setup

Bugs

Please report bugs to S. Wehner