Партнёры:
Хостинг:
setkey - manually manipulate the IPsec SA/SP database
setkey takes a series of operations from standard input Po if invoked with -c Pc or the file named filename Po if invoked with -f filename Pc .
Meta-arguments are as follows:
key must be a double-quoted character string, or a series of hexadecimal digits preceded by ``0x ''
Possible values for ealgo aalgo and calgo are specified in the Sx Algorithms sections.
address address/prefixlen address[port] address/prefixlen[port]
prefixlen and port must be decimal numbers. The square brackets around port are really necessary, they are not man page meta-characters. For FQDN resolution, the rules applicable to src and dst apply here as well.
spdadd ::/0 ::/0 icmp6 135,0 -P in none
Note upperspec does not work against forwarding case at this moment, as it requires extra reassembly at the forwarding node (not implemented at this moment) There are many protocols in /etc/protocols but all protocols except of TCP, UDP, and ICMP may not be suitable to use with IPsec. You have to consider carefully what to use.
- -P direction [priority specification] discard
- -P direction [priority specification] none
- -P direction [priority specification] ipsec protocol/mode/src-dst/level [...]
priority specification is used to control the placement of the policy within the SPD. Policy position is determined by a signed integer where higher priorities indicate the policy is placed closer to the beginning of the list and lower priorities indicate the policy is placed closer to the end of the list. Policies with equal priorities are added at the end of groups of such policies.
Priority can only be specified when setkey has been compiled against kernel headers that support policy priorities (Linux Gt]= 2.6.6). If the kernel does not support priorities, a warning message will be printed the first time a priority specification is used. Policy priority takes one of the following formats:
offset is an unsigned integer. It can be up to 1073741824 for positive offsets, and up to 1073741823 for negative offsets.
discard means the packet matching indexes will be discarded. none means that IPsec operation will not take place onto the packet. ipsec means that IPsec operation will take place onto the packet.
The protocol/mode/src-dst/level part specifies the rule how to process the packet. Either ah esp or ipcomp must be used as protocol mode is either transport or tunnel If mode is tunnel you must specify the end-point addresses of the SA as src and dst with `-' between these addresses, which is used to specify the SA to use. If mode is transport both src and dst can be omitted. level is to be one of the following: default , use , require or unique If the SA is not available in every level, the kernel will ask the key exchange daemon to establish a suitable SA. default means the kernel consults the system wide default for the protocol you specified, e.g. the esp_trans_deflev sysctl variable, when the kernel processes the packet. use means that the kernel uses an SA if it's available, otherwise the kernel keeps normal operation. require means SA is required whenever the kernel sends a packet matched with the policy. unique is the same as require in addition, it allows the policy to match the unique out-bound SA. You just specify the policy level unique racoon(8) will configure the SA for the policy. If you configure the SA by manual keying for that policy, you can put a decimal number as the policy identifier after unique separated by a colon `:' like: unique:number in order to bind this policy to the SA. number must be between 1 and 32767. It corresponds to extensions -u of the manual SA configuration. When you want to use SA bundle, you can define multiple rules. For example, if an IP header was followed by an AH header followed by an ESP header followed by an upper layer protocol header, the rule would be:
esp/transport//require ah/transport//requireThe rule order is very important.
When NAT-T is enabled in the kernel, policy matching for ESP over UDP packets may be done on endpoint addresses and port (this depends on the system. System that do not perform the port check cannot support multiple endpoints behind the same NAT). When using ESP over UDP, you can specify port numbers in the endpoint addresses to get the correct matching. Here is an example:
spdadd 10.0.11.0/24[any] 10.0.11.33/32[any] any -P out ipsec
esp/tunnel/192.168.0.1[4500]-192.168.1.2[30000]/require ;
These ports must be left unspecified (which defaults to 0) for
anything other than ESP over UDP.
They can be displayed in SPD dump using
setkey
-D
Note that ``discard '' and ``none '' are not in the syntax described in ipsec_set_policy3. There are a few differences in the syntax. See ipsec_set_policy3 for detail.
algorithm keylen (bits)
hmac-md5 128 ah: rfc2403
128 ah-old: rfc2085
hmac-sha1 160 ah: rfc2404
160 ah-old: 128bit ICV (no document)
keyed-md5 128 ah: 96bit ICV (no document)
128 ah-old: rfc1828
keyed-sha1 160 ah: 96bit ICV (no document)
160 ah-old: 128bit ICV (no document)
null 0 to 2048 for debugging
hmac-sha256 256 ah: 96bit ICV
(draft-ietf-ipsec-ciph-sha-256-00)
256 ah-old: 128bit ICV (no document)
hmac-sha384 384 ah: 96bit ICV (no document)
384 ah-old: 128bit ICV (no document)
hmac-sha512 512 ah: 96bit ICV (no document)
512 ah-old: 128bit ICV (no document)
hmac-ripemd160 160 ah: 96bit ICV (RFC2857)
ah-old: 128bit ICV (no document)
aes-xcbc-mac 128 ah: 96bit ICV (RFC3566)
128 ah-old: 128bit ICV (no document)
tcp-md5 8 to 640 tcp: rfc2385
These encryption algorithms can be used as ealgo in -E ealgo of the protocol parameter:
algorithm keylen (bits) des-cbc 64 esp-old: rfc1829, esp: rfc2405 3des-cbc 192 rfc2451 null 0 to 2048 rfc2410 blowfish-cbc 40 to 448 rfc2451 cast128-cbc 40 to 128 rfc2451 des-deriv 64 ipsec-ciph-des-derived-01 3des-deriv 192 no document rijndael-cbc 128/192/256 rfc3602 twofish-cbc 0 to 256 draft-ietf-ipsec-ciph-aes-cbc-01 aes-ctr 160/224/288 draft-ietf-ipsec-ciph-aes-ctr-03
Note that the first 128 bits of a key for aes-ctr will be used as AES key, and the remaining 32 bits will be used as nonce.
These compression algorithms can be used as calgo in -C calgo of the protocol parameter:
algorithm deflate rfc2394
In kernel mode, setkey manages and shows policies and SAs exactly as they are stored in the kernel.
In RFC mode, setkey
add 3ffe:501:4819::1 3ffe:501:481d::1 esp 123457
-E des-cbc 0x3ffe05014819ffff ;
add -6 myhost.example.com yourhost.example.com ah 123456
-A hmac-sha1 "AH SA configuration!" ;
add 10.0.11.41 10.0.11.33 esp 0x10001
-E des-cbc 0x3ffe05014819ffff
-A hmac-md5 "authentication!!" ;
get 3ffe:501:4819::1 3ffe:501:481d::1 ah 123456 ;
flush ;
dump esp ;
spdadd 10.0.11.41/32[21] 10.0.11.33/32[any] any
-P out ipsec esp/tunnel/192.168.0.1-192.168.1.2/require ;
add 10.1.10.34 10.1.10.36 tcp 0x1000 -A tcp-md5 "TCP-MD5 BGP secret" ;
add 10.0.11.41 10.0.11.33 esp 0x10001
-ctx 1 1 "system_u:system_r:unconfined_t:SystemLow-SystemHigh"
-E des-cbc 0x3ffe05014819ffff;
spdadd 10.0.11.41 10.0.11.33 any
-ctx 1 1 "system_u:system_r:unconfined_t:SystemLow-SystemHigh"
-P out ipsec esp/transport//require ;
For IPsec gateway configuration, src_range and dst_range with TCP/UDP port numbers does not work, as the gateway does not reassemble packets (it cannot inspect upper-layer headers)
|
Закладки на сайте Проследить за страницей |
Created 1996-2024 by Maxim Chirkov Добавить, Поддержать, Вебмастеру |