Skip site navigation (1)Skip section navigation (2)

FreeBSD Man Pages

Man Page or Keyword Search:
Man Architecture
Apropos Keyword Search (all sections) Output format
home | help
IPSEC(4)               FreeBSD Kernel Interfaces Manual               IPSEC(4)

     ipsec - IP security protocol

     #include <sys/types.h>
     #include <netinet/in.h>
     #include <netinet6/ipsec.h>

     ipsec is a security protocol implemented within the Internet Protocol
     layer of the TCP/IP stack.  ipsec is defined for both IPv4 and IPv6
     (inet(4) and inet6(4)).  ipsec contains two protocols, ESP, the
     encapsulated security payload protocol and AH, the authentication header
     protocol.  ESP prevents unauthorized parties from reading the payload of
     an IP packet by encrypting it using secret key cryptography algorithms.
     AH both authenticates guarantees the integrity of an IP packet by
     attaching a cryptographic checksum computed using one-way hash functions.
     ipsec has operates in one of two modes: transport mode or tunnel mode.
     Transport mode is used to protect peer-to-peer communication between end
     nodes.  Tunnel mode encapsulates IP packets within other IP packets and
     is designed for security gateways such as VPN endpoints.

   Kernel interface
     ipsec is controlled by a key management and policy engine, that reside in
     the operating system kernel.  Key management is the process of
     associating keys with security associations, also know as SAs.  Policy
     management dictates when new security associations created or destroyed.

     The key management engine can be accessed from userland by using PF_KEY
     sockets.  The PF_KEY socket API is defined in RFC2367.

     an extended version of the PF_KEY interface, and allows the programmer to

     The kernel code does not implement a dynamic encryption key exchange
     beyond what is necessary in the kernel and should be implemented as
     daemon processes which call the APIs.

   Policy management
     configuring kernel level packet filter-based policies using the PF_KEY
     interface, via the setkey(8) command.  In either case, IPsec policies
     must be specified using the syntax described in ipsec_set_policy(3).
     Please refer to the setkey(8) man page for instructions on its use.

     When setting policies using the setkey(8) command the ``default'' option
     you can have the system use its default policy, explained below, for
     processing packets.  The following sysctl variables are available for
     configuring the system's IPsec behavior.  The variables can have one of
     processed by IPsec.  The value 2 is synonymous with ``require'', which

     Name                                 Type          Changeable
     net.inet.ipsec.esp_trans_deflev      integer       yes
     net.inet.ipsec.esp_net_deflev        integer       yes
     net.inet.ipsec.ah_trans_deflev       integer       yes
     net.inet.ipsec.ah_net_deflev         integer       yes
     net.inet6.ipsec6.esp_trans_deflev    integer       yes
     net.inet6.ipsec6.esp_net_deflev      integer       yes
     net.inet6.ipsec6.ah_trans_deflev     integer       yes
     net.inet6.ipsec6.ah_net_deflev       integer       yes


     Name                           Type          Changeable
     net.inet.ipsec.def_policy      integer       yes
     net.inet6.ipsec6.def_policy    integer       yes

   Miscellaneous sysctl variables
     The following variables are accessible via sysctl(8), for tweaking the
     kernel's IPsec behavior:

     Name                                 Type          Changeable
     net.inet.ipsec.ah_cleartos           integer       yes
     net.inet.ipsec.ah_offsetmask         integer       yes
     net.inet.ipsec.dfbit                 integer       yes
     net.inet.ipsec.ecn                   integer       yes
     net.inet.ipsec.debug                 integer       yes
     net.inet6.ipsec6.ecn                 integer       yes
     net.inet6.ipsec6.debug               integer       yes

     The variables are interpreted as follows:

     Li ipsec.ah_cleartos
             in the IPv4 header during AH authentication data computation.
             This variable is used to get current systems to inter-operate

             During AH authentication data computation, the kernel will
             include a 16bit fragment offset field (including flag bits) in
             the IPv4 header, after computing logical AND with the variable.
             The variable is used for inter-operating with devices that
             fragment offset field during computation) for RFC2402

             This variable configures the kernel behavior on IPv4 IPsec tunnel
             is supplied to conform to RFC2401 chapter 6.1.

             behavior will be friendly to ECN (explicit congestion
             gif(4) talks more about the behavior.


     Variables under the net.inet6.ipsec6 tree have similar meanings to those
     described above.

     The ipsec protocol acts as a plug-in to the inet(4) and inet6(4)
     protocols and therefore supports most of the protocols defined upon those
     differently with ipsec because ipsec can prevent icmp(4) or icmp6(4)
     routines from looking into the IP payload.

     setkey(8), sysctl(8)



     API, Version 2, RFC, 2367.


     The implementation described herein appeared in WIDE/KAME IPv6/IPsec


     engine API described herein is just for KAME implementation.

     and AH authenticates encapsulating (outer) packet, not the encapsulated
     to keep all the packet decapsulation history.

     When a large database of security associations or policies is present in
     the kernel the SADB_DUMP and SADB_SPDDUMP operations on PF_KEY sockets
     alleviate this problem.

FreeBSD 11.0-PRERELEASE        February 14, 2006       FreeBSD 11.0-PRERELEASE


Want to link to this manual page? Use this URL:

home | help