Changeset View
Changeset View
Standalone View
Standalone View
sbin/setkey/sample.cf
Show All 28 Lines | |||||
# There are sample scripts for IPsec configuration by manual keying. | # There are sample scripts for IPsec configuration by manual keying. | ||||
# A security association is uniquely identified by a triple consisting | # A security association is uniquely identified by a triple consisting | ||||
# of a Security Parameter Index (SPI), an IP Destination Address, and a | # of a Security Parameter Index (SPI), an IP Destination Address, and a | ||||
# security protocol (AH or ESP) identifier. You must take care of these | # security protocol (AH or ESP) identifier. You must take care of these | ||||
# parameters when you configure by manual keying. | # parameters when you configure by manual keying. | ||||
# ESP transport mode is recommended for TCP port number 110 between | # ESP transport mode is recommended for TCP port number 110 between | ||||
# Host-A and Host-B. Encryption algorithm is blowfish-cbc whose key | # Host-A and Host-B. Encryption algorithm is aes-cbc whose key | ||||
# is "kamekame", and authentication algorithm is hmac-sha1 whose key | # is "kamekamekamekamekamekamekamekame", and authentication algorithm is | ||||
# is "this is the test key". | # hmac-sha2-512 whose key is "this is the test key". | ||||
# | # | ||||
# ============ ESP ============ | # ============ ESP ============ | ||||
# | | | # | | | ||||
# Host-A Host-B | # Host-A Host-B | ||||
# fec0::10 -------------------- fec0::11 | # fec0::10 -------------------- fec0::11 | ||||
# | # | ||||
# At Host-A and Host-B, | # At Host-A and Host-B, | ||||
spdadd fec0::10[any] fec0::11[110] tcp -P out ipsec | spdadd fec0::10[any] fec0::11[110] tcp -P out ipsec | ||||
esp/transport//use ; | esp/transport//use ; | ||||
spdadd fec0::11[110] fec0::10[any] tcp -P in ipsec | spdadd fec0::11[110] fec0::10[any] tcp -P in ipsec | ||||
esp/transport//use ; | esp/transport//use ; | ||||
add fec0::10 fec0::11 esp 0x10001 | add fec0::10 fec0::11 esp 0x10001 | ||||
-m transport | -m transport | ||||
-E blowfish-cbc "kamekame" | -E aes-cbc "kamekamekamekamekamekamekamekame" | ||||
-A hmac-sha1 "this is the test key" ; | -A hmac-sha2-512 "this is the test key" ; | ||||
add fec0::11 fec0::10 esp 0x10002 | add fec0::11 fec0::10 esp 0x10002 | ||||
-m transport | -m transport | ||||
-E blowfish-cbc "kamekame" | -E aes-cbc "kamekamekamekamekamekamekamekame" | ||||
-A hmac-sha1 "this is the test key" ; | -A hmac-sha2-512 "this is the test key" ; | ||||
# "[any]" is wildcard of port number. Note that "[0]" is the number of | # "[any]" is wildcard of port number. Note that "[0]" is the number of | ||||
# zero in port number. | # zero in port number. | ||||
# Security protocol is old AH tunnel mode, i.e. RFC1826, with keyed-md5 | # Security protocol is old AH tunnel mode, i.e. RFC1826, with hmac-sha2-256 | ||||
# whose key is "this is the test" as authentication algorithm. | # whose key is "this is the test" as authentication algorithm. | ||||
# That protocol takes place between Gateway-A and Gateway-B. | # That protocol takes place between Gateway-A and Gateway-B. | ||||
# | # | ||||
# ======= AH ======= | # ======= AH ======= | ||||
# | | | # | | | ||||
# Network-A Gateway-A Gateway-B Network-B | # Network-A Gateway-A Gateway-B Network-B | ||||
# 10.0.1.0/24 ---- 172.16.0.1 ----- 172.16.0.2 ---- 10.0.2.0/24 | # 10.0.1.0/24 ---- 172.16.0.1 ----- 172.16.0.2 ---- 10.0.2.0/24 | ||||
# | # | ||||
# At Gateway-A: | # At Gateway-A: | ||||
spdadd 10.0.1.0/24 10.0.2.0/24 any -P out ipsec | spdadd 10.0.1.0/24 10.0.2.0/24 any -P out ipsec | ||||
ah/tunnel/172.16.0.1-172.16.0.2/require ; | ah/tunnel/172.16.0.1-172.16.0.2/require ; | ||||
spdadd 10.0.2.0/24 10.0.1.0/24 any -P in ipsec | spdadd 10.0.2.0/24 10.0.1.0/24 any -P in ipsec | ||||
ah/tunnel/172.16.0.2-172.16.0.1/require ; | ah/tunnel/172.16.0.2-172.16.0.1/require ; | ||||
add 172.16.0.1 172.16.0.2 ah-old 0x10003 | add 172.16.0.1 172.16.0.2 ah-old 0x10003 | ||||
-m any | -m any | ||||
-A keyed-md5 "this is the test" ; | -A hmac-sha2-256 "this is the test" ; | ||||
add 172.16.0.2 172.16.0.1 ah-old 0x10004 | add 172.16.0.2 172.16.0.1 ah-old 0x10004 | ||||
-m any | -m any | ||||
-A keyed-md5 "this is the test" ; | -A hmac-sha2-256 "this is the test" ; | ||||
# If port number field is omitted such above then "[any]" is employed. | # If port number field is omitted such above then "[any]" is employed. | ||||
# -m specifies the mode of SA to be used. "-m any" means wildcard of | # -m specifies the mode of SA to be used. "-m any" means wildcard of | ||||
# mode of security protocol. You can use this SAs for both tunnel and | # mode of security protocol. You can use this SAs for both tunnel and | ||||
# transport mode. | # transport mode. | ||||
# At Gateway-B. Attention to the selector and peer's IP address for tunnel. | # At Gateway-B. Attention to the selector and peer's IP address for tunnel. | ||||
spdadd 10.0.2.0/24 10.0.1.0/24 any -P out ipsec | spdadd 10.0.2.0/24 10.0.1.0/24 any -P out ipsec | ||||
ah/tunnel/172.16.0.2-172.16.0.1/require ; | ah/tunnel/172.16.0.2-172.16.0.1/require ; | ||||
spdadd 10.0.1.0/24 10.0.2.0/24 any -P in ipsec | spdadd 10.0.1.0/24 10.0.2.0/24 any -P in ipsec | ||||
ah/tunnel/172.16.0.1-172.16.0.2/require ; | ah/tunnel/172.16.0.1-172.16.0.2/require ; | ||||
add 172.16.0.1 172.16.0.2 ah-old 0x10003 | add 172.16.0.1 172.16.0.2 ah-old 0x10003 | ||||
-m tunnel | -m tunnel | ||||
-A keyed-md5 "this is the test" ; | -A hmac-sha2-256 "this is the test" ; | ||||
add 172.16.0.2 172.16.0.1 ah-old 0x10004 | add 172.16.0.2 172.16.0.1 ah-old 0x10004 | ||||
-m tunnel | -m tunnel | ||||
-A keyed-md5 "this is the test" ; | -A hmac-sha2-256 "this is the test" ; | ||||
# AH transport mode followed by ESP tunnel mode is required between | # AH transport mode followed by ESP tunnel mode is required between | ||||
# Gateway-A and Gateway-B. | # Gateway-A and Gateway-B. | ||||
# Encryption algorithm is 3des-cbc, and authentication algorithm for ESP | # Encryption algorithm is aes-cbc, and authentication algorithm for ESP | ||||
# is hmac-sha1. Authentication algorithm for AH is hmac-md5. | # is hmac-sha2-512. Authentication algorithm for AH is hmac-sha2-256. | ||||
# | # | ||||
# ========== AH ========= | # ========== AH ========= | ||||
# | ======= ESP ===== | | # | ======= ESP ===== | | ||||
# | | | | | # | | | | | ||||
# Network-A Gateway-A Gateway-B Network-B | # Network-A Gateway-A Gateway-B Network-B | ||||
# fec0:0:0:1::/64 --- fec0:0:0:1::1 ---- fec0:0:0:2::1 --- fec0:0:0:2::/64 | # fec0:0:0:1::/64 --- fec0:0:0:1::1 ---- fec0:0:0:2::1 --- fec0:0:0:2::/64 | ||||
# | # | ||||
# At Gateway-A: | # At Gateway-A: | ||||
spdadd fec0:0:0:1::/64 fec0:0:0:2::/64 any -P out ipsec | spdadd fec0:0:0:1::/64 fec0:0:0:2::/64 any -P out ipsec | ||||
esp/tunnel/fec0:0:0:1::1-fec0:0:0:2::1/require | esp/tunnel/fec0:0:0:1::1-fec0:0:0:2::1/require | ||||
ah/transport//require ; | ah/transport//require ; | ||||
spdadd fec0:0:0:2::/64 fec0:0:0:1::/64 any -P in ipsec | spdadd fec0:0:0:2::/64 fec0:0:0:1::/64 any -P in ipsec | ||||
esp/tunnel/fec0:0:0:2::1-fec0:0:0:1::1/require | esp/tunnel/fec0:0:0:2::1-fec0:0:0:1::1/require | ||||
ah/transport//require ; | ah/transport//require ; | ||||
add fec0:0:0:1::1 fec0:0:0:2::1 esp 0x10001 | add fec0:0:0:1::1 fec0:0:0:2::1 esp 0x10001 | ||||
-m tunnel | -m tunnel | ||||
-E 3des-cbc "kamekame12341234kame1234" | -E aes-cbc "kamekame12341234kamekame12341234" | ||||
-A hmac-sha1 "this is the test key" ; | -A hmac-sha2-512 "this is the test key" ; | ||||
add fec0:0:0:1::1 fec0:0:0:2::1 ah 0x10001 | add fec0:0:0:1::1 fec0:0:0:2::1 ah 0x10001 | ||||
-m transport | -m transport | ||||
-A hmac-md5 "this is the test" ; | -A hmac-sha2-256 "this is the test" ; | ||||
add fec0:0:0:2::1 fec0:0:0:1::1 esp 0x10001 | add fec0:0:0:2::1 fec0:0:0:1::1 esp 0x10001 | ||||
-m tunnel | -m tunnel | ||||
-E 3des-cbc "kamekame12341234kame1234" | -E aes-cbc "kamekame12341234kamekame12341234" | ||||
-A hmac-sha1 "this is the test key" ; | -A hmac-sha2-512 "this is the test key" ; | ||||
add fec0:0:0:2::1 fec0:0:0:1::1 ah 0x10001 | add fec0:0:0:2::1 fec0:0:0:1::1 ah 0x10001 | ||||
-m transport | -m transport | ||||
-A hmac-md5 "this is the test" ; | -A hmac-sha2-256 "this is the test" ; | ||||
# ESP tunnel mode is required between Host-A and Gateway-A. | # ESP tunnel mode is required between Host-A and Gateway-A. | ||||
# Encryption algorithm is cast128-cbc, and authentication algorithm | # Encryption algorithm is aes-cbc, and authentication algorithm | ||||
# for ESP is hmac-sha1. | # for ESP is hmac-sha2-256. | ||||
# ESP transport mode is recommended between Host-A and Host-B. | # ESP transport mode is recommended between Host-A and Host-B. | ||||
# Encryption algorithm is rc5-cbc, and authentication algorithm | # Encryption algorithm is aes-ctr, and authentication algorithm | ||||
# for ESP is hmac-md5. | # for ESP is hmac-sha2-512. | ||||
# | # | ||||
# ================== ESP ================= | # ================== ESP ================= | ||||
# | ======= ESP ======= | | # | ======= ESP ======= | | ||||
# | | | | | # | | | | | ||||
# Host-A Gateway-A Host-B | # Host-A Gateway-A Host-B | ||||
# fec0:0:0:1::1 ---- fec0:0:0:2::1 ---- fec0:0:0:2::2 | # fec0:0:0:1::1 ---- fec0:0:0:2::1 ---- fec0:0:0:2::2 | ||||
# | # | ||||
# At Host-A: | # At Host-A: | ||||
spdadd fec0:0:0:1::1[any] fec0:0:0:2::2[80] tcp -P out ipsec | spdadd fec0:0:0:1::1[any] fec0:0:0:2::2[80] tcp -P out ipsec | ||||
esp/transport//use | esp/transport//use | ||||
esp/tunnel/fec0:0:0:1::1-fec0:0:0:2::1/require ; | esp/tunnel/fec0:0:0:1::1-fec0:0:0:2::1/require ; | ||||
spdadd fec0:0:0:2::1[80] fec0:0:0:1::1[any] tcp -P in ipsec | spdadd fec0:0:0:2::1[80] fec0:0:0:1::1[any] tcp -P in ipsec | ||||
esp/transport//use | esp/transport//use | ||||
esp/tunnel/fec0:0:0:2::1-fec0:0:0:1::1/require ; | esp/tunnel/fec0:0:0:2::1-fec0:0:0:1::1/require ; | ||||
add fec0:0:0:1::1 fec0:0:0:2::2 esp 0x10001 | add fec0:0:0:1::1 fec0:0:0:2::2 esp 0x10001 | ||||
-m transport | -m transport | ||||
-E cast128-cbc "12341234" | -E aes-cbc "kamekame12341234kamekame12341234" | ||||
-A hmac-sha1 "this is the test key" ; | -A hmac-sha2-256 "this is the test key" ; | ||||
add fec0:0:0:1::1 fec0:0:0:2::1 esp 0x10002 | add fec0:0:0:1::1 fec0:0:0:2::1 esp 0x10002 | ||||
-E rc5-cbc "kamekame" | -E aes-ctr "kamekame12341234kamekame12341234f00f" | ||||
-A hmac-md5 "this is the test" ; | -A hmac-sha2-512 "this is the test" ; | ||||
add fec0:0:0:2::2 fec0:0:0:1::1 esp 0x10003 | add fec0:0:0:2::2 fec0:0:0:1::1 esp 0x10003 | ||||
-m transport | -m transport | ||||
-E cast128-cbc "12341234" | -E aes-cbc "kamekame12341234kamekame12341234" | ||||
-A hmac-sha1 "this is the test key" ; | -A hmac-sha2-256 "this is the test key" ; | ||||
add fec0:0:0:2::1 fec0:0:0:1::1 esp 0x10004 | add fec0:0:0:2::1 fec0:0:0:1::1 esp 0x10004 | ||||
-E rc5-cbc "kamekame" | -E aes-ctr "kamekame12341234kamekame12341234f00f" | ||||
-A hmac-md5 "this is the test" ; | -A hmac-sha2-512 "this is the test" ; | ||||
# By "get" command, you can get a entry of either SP or SA. | # By "get" command, you can get a entry of either SP or SA. | ||||
get fec0:0:0:1::1 fec0:0:0:2::2 ah 0x10004 ; | get fec0:0:0:1::1 fec0:0:0:2::2 ah 0x10004 ; | ||||
# Also delete command, you can delete a entry of either SP or SA. | # Also delete command, you can delete a entry of either SP or SA. | ||||
spddelete fec0:0:0:1::/64 fec0:0:0:2::/64 any -P out; | spddelete fec0:0:0:1::/64 fec0:0:0:2::/64 any -P out; | ||||
delete fec0:0:0:1::1 fec0:0:0:2::2 ah 0x10004 ; | delete fec0:0:0:1::1 fec0:0:0:2::2 ah 0x10004 ; | ||||
# By dump command, you can dump all entry of either SP or SA. | # By dump command, you can dump all entry of either SP or SA. | ||||
dump ; | dump ; | ||||
spddump ; | spddump ; | ||||
dump esp ; | dump esp ; | ||||
flush esp ; | flush esp ; | ||||
# By flush command, you can flush all entry of either SP or SA. | # By flush command, you can flush all entry of either SP or SA. | ||||
flush ; | flush ; | ||||
spdflush ; | spdflush ; | ||||
# "flush" and "dump" commands can specify a security protocol. | # "flush" and "dump" commands can specify a security protocol. | ||||
dump esp ; | dump esp ; | ||||
flush ah ; | flush ah ; | ||||
# XXX | # XXX | ||||
gnn: Elide? | |||||
jhbAuthorUnsubmitted Done Inline ActionsI think the comment means "these are cases we don't have nice examples for above" so is still relevant. jhb: I think the comment means "these are cases we don't have nice examples for above" so is still… | |||||
add ::1 ::1 esp 10001 -m transport -E null ; | add ::1 ::1 esp 10001 -m transport -E null ; | ||||
add ::1 ::1 esp 10002 -m transport -E des-deriv "12341234" ; | |||||
add ::1 ::1 esp-old 10003 -m transport -E des-32iv "12341234" ; | |||||
add ::1 ::1 esp 10004 -m transport -E null -A null ; | add ::1 ::1 esp 10004 -m transport -E null -A null ; | ||||
add ::1 ::1 esp 10005 -m transport -E null -A hmac-md5 "1234123412341234" ; | |||||
add ::1 ::1 esp 10006 -m tunnel -E null -A hmac-sha1 "12341234123412341234" ; | add ::1 ::1 esp 10006 -m tunnel -E null -A hmac-sha1 "12341234123412341234" ; | ||||
add ::1 ::1 esp 10007 -m transport -E null -A keyed-md5 "1234123412341234" ; | |||||
add ::1 ::1 esp 10008 -m any -E null -A keyed-sha1 "12341234123412341234" ; | |||||
add ::1 ::1 esp 10009 -m transport -E des-cbc "testtest" ; | |||||
add ::1 ::1 esp 10010 -m transport -E 3des-cbc "testtest12341234testtest" ; | add ::1 ::1 esp 10010 -m transport -E 3des-cbc "testtest12341234testtest" ; | ||||
add ::1 ::1 esp 10011 -m tunnel -E cast128-cbc "testtest1234" ; | |||||
add ::1 ::1 esp 10012 -m tunnel -E blowfish-cbc "testtest1234" ; | |||||
add ::1 ::1 esp 10013 -m tunnel -E rc5-cbc "testtest1234" ; | |||||
add ::1 ::1 esp 10014 -m any -E rc5-cbc "testtest1234" ; | |||||
add ::1 ::1 esp 10015 -m transport -f zero-pad -E null ; | add ::1 ::1 esp 10015 -m transport -f zero-pad -E null ; | ||||
add ::1 ::1 esp 10016 -m tunnel -f random-pad -r 8 -lh 100 -ls 80 -E null ; | add ::1 ::1 esp 10016 -m tunnel -f random-pad -r 8 -lh 100 -ls 80 -E null ; | ||||
add ::1 ::1 esp 10017 -m transport -f seq-pad -f nocyclic-seq -E null ; | add ::1 ::1 esp 10017 -m transport -f seq-pad -f nocyclic-seq -E null ; | ||||
add ::1 ::1 esp 10018 -m transport -E null ; | add ::1 ::1 esp 10018 -m transport -E null ; | ||||
#add ::1 ::1 ah 20000 -m transport -A null ; | #add ::1 ::1 ah 20000 -m transport -A null ; | ||||
add ::1 ::1 ah 20001 -m any -A hmac-md5 "1234123412341234"; | |||||
add ::1 ::1 ah 20002 -m tunnel -A hmac-sha1 "12341234123412341234"; | add ::1 ::1 ah 20002 -m tunnel -A hmac-sha1 "12341234123412341234"; | ||||
add ::1 ::1 ah 20003 -m transport -A keyed-md5 "1234123412341234"; | |||||
add ::1 ::1 ah-old 20004 -m transport -A keyed-md5 "1234123412341234"; | |||||
add ::1 ::1 ah 20005 -m transport -A keyed-sha1 "12341234123412341234"; | |||||
#add ::1 ::1 ipcomp 30000 -C oui ; | #add ::1 ::1 ipcomp 30000 -C oui ; | ||||
add ::1 ::1 ipcomp 30001 -C deflate ; | add ::1 ::1 ipcomp 30001 -C deflate ; | ||||
#add ::1 ::1 ipcomp 30002 -C lzs ; | #add ::1 ::1 ipcomp 30002 -C lzs ; | ||||
# enjoy. | # enjoy. |
Elide?