The FreeBSD Diary |
|
(TM) | Providing practical examples since 1998If you buy from Amazon USA, please support us by using this link. |
|
IPsec
27 December 2000
|
|
This article was written by Greg Panula. This is just my notes from setting up ipsec between two test boxes; phoenix and cardinal. See also this ONLamp article. The test uses both AH and ESP; packet and payload encryption. It is a test of transport mode, i.e. direct communications between two hosts. In order to use IPSEC, you must first add it to your kernel. You'll need the following options: options IPSEC #IP security options IPSEC_ESP #IP security (crypto; define w/ IPSEC) options IPSEC_DEBUG #debug for IP security For instructions on how to create a new kernel, refer to the Configuring the FreeBSD Kernel section in the FreeBSD handbook. Pay special attention to the section on Building and Installing a Custom Kernel. |
|
Transport mode
|
Useful references:
The initial test is between phoenix (10.0.1.57) and cardinal (10.1.2.45). This test will use both AH and ESP; packet and payload encryption. The test is using only transport mode (i.e. it is not creating a tunnel). Phoenix and Cardinal reside on different network segments, there is a router between them but no firewall, nat or packet filtering. |
|
Phoenix setup
|
This is the AH protocol setup:setkey -c add 10.0.1.57 10.1.2.45 ah 15700 -A hmac-md5 "1234567890123456"; add 10.1.2.45 10.0.1.57 ah 24500 -A hmac-md5 "1234567890123456"; ^D This sets up the AH protocol using hmac-md5 as the encryption algorithm. hmac-md5 requires a 128bit key, which means it must be 16 characters (bytes) long. Breakdown of the first line:
SPI tells the kernel which encryption rule and algorithm to use on traffic tagged with that SPI This is the ESP protocol setup: setkey -c add 10.0.1.57 10.1.2.45 esp 15701 -E blowfish-cbc "12345"; add 10.1.2.45 10.0.1.57 esp 24501 -E blowfish-cbc "12345"; ^D This sets up the ESP protocol using the blowfish-cbc encryption algortihm. blowfish-cbc allows for key lengths of 40-448 bits (5 to 56 bytes). |
|
Cardinal setup
|
This is the AH protocol setup:setkey -c add 10.0.1.57 10.1.2.45 ah 15700 -A hmac-md5 "1234567890123456"; add 10.1.2.45 10.0.1.57 ah 24500 -A hmac-md5 "1234567890123456"; ^D This is the ESP protocol setup: setkey -c add 10.0.1.57 10.1.2.45 esp 15701 -E blowfish-cbc "12345"; add 10.1.2.45 10.0.1.57 esp 24501 -E blowfish-cbc "12345"; ^D |
|
Using ESP
|
| Now we will configure both machines to use AH and ESP. We will use the level of
default. Which means the kernel consults the sysctl variable esp_trans_deflev
to determine whether to encrypt or not. This allows us to remotely setup one
end (phoenix in this case) without losing connectivity. The default value of esp_trans_deflev
is 1. After looking at /sys/netinet6/ipsec.h and then doing a quick tcpdump
of the traffic between phoenix and cardinal, I have selected a value of 1, means
use encryption if available. This is the relevent section from ipsec.h: /* Security protocol level */ #define IPSEC_LEVEL_DEFAULT 0 /* reference to system default */ #define IPSEC_LEVEL_USE 1 /* use SA if present. */ #define IPSEC_LEVEL_REQUIRE 2 /* require SA. */ #define IPSEC_LEVEL_UNIQUE 3 /* unique SA. */ Cardinal
Phoenix
Note: the above spdadd line is one line and it encrypts all traffic (the `any' before the -P). Check the setkey man page for info on how to encrypt certain packets, e.g. rsh. I'm only encrypting outbound traffic. And the format for the spdadd line is:
|
|
What's it look like?
|
| A tcpdump of the traffic between phoenix and cardinal shows this: 14:15:30.919115
cardinal.foo.bar > phoenix.foo.bar: AH(spi=24500,seq=0x2ac): ESP(spi=24501,seq=0x59e)
(DF) |
|
Setting the keys at boot time
|
One thing learned afterwards was the kernel loses the keys after a reboot.
There is a mechanism built into /etc/rc.conf which set the keys for
you at boot time. Note: do not modify /etc/defaults/rc.conf, make the
changes to /etc/rc.conf instead.
If you put your setkey commands into |