xref: /freebsd/share/man/man4/enc.4 (revision e81210c1d0907c74d4719b4583097288382bca3a)
1bdea400fSAndrew Thompson.\"	$OpenBSD: enc.4,v 1.22 2006/05/26 08:51:29 jmc Exp $
2bdea400fSAndrew Thompson.\"
3bdea400fSAndrew Thompson.\" Copyright (c) 1999 Angelos D. Keromytis
4bdea400fSAndrew Thompson.\" All rights reserved.
5bdea400fSAndrew Thompson.\"
6bdea400fSAndrew Thompson.\" Redistribution and use in source and binary forms, with or without
7bdea400fSAndrew Thompson.\" modification, are permitted provided that the following conditions
8bdea400fSAndrew Thompson.\" are met:
9bdea400fSAndrew Thompson.\"
10bdea400fSAndrew Thompson.\" 1. Redistributions of source code must retain the above copyright
11bdea400fSAndrew Thompson.\"    notice, this list of conditions and the following disclaimer.
12bdea400fSAndrew Thompson.\" 2. Redistributions in binary form must reproduce the above copyright
13bdea400fSAndrew Thompson.\"    notice, this list of conditions and the following disclaimer in the
14bdea400fSAndrew Thompson.\"    documentation and/or other materials provided with the distribution.
15bdea400fSAndrew Thompson.\" 3. All advertising materials mentioning features or use of this software
16bdea400fSAndrew Thompson.\"    must display the following acknowledgement:
17bdea400fSAndrew Thompson.\"	This product includes software developed by Angelos D. Keromytis.
18bdea400fSAndrew Thompson.\" 4. The name of the author may not be used to endorse or promote products
19bdea400fSAndrew Thompson.\"    derived from this software without specific prior written permission.
20bdea400fSAndrew Thompson.\"
21bdea400fSAndrew Thompson.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22bdea400fSAndrew Thompson.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23bdea400fSAndrew Thompson.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24bdea400fSAndrew Thompson.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25bdea400fSAndrew Thompson.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26bdea400fSAndrew Thompson.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27bdea400fSAndrew Thompson.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28bdea400fSAndrew Thompson.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29bdea400fSAndrew Thompson.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30bdea400fSAndrew Thompson.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31bdea400fSAndrew Thompson.\"
32bdea400fSAndrew Thompson.\" $FreeBSD$
33bdea400fSAndrew Thompson.\"
3445358a00SBjoern A. Zeeb.Dd November 28, 2007
35bdea400fSAndrew Thompson.Dt ENC 4
36bdea400fSAndrew Thompson.Os
37bdea400fSAndrew Thompson.Sh NAME
38bdea400fSAndrew Thompson.Nm enc
39bdea400fSAndrew Thompson.Nd Encapsulating Interface
40bdea400fSAndrew Thompson.Sh SYNOPSIS
41904887e2SChristian BruefferTo compile this driver into the kernel,
42904887e2SChristian Bruefferplace the following line in your
43904887e2SChristian Bruefferkernel configuration file:
44904887e2SChristian Brueffer.Bd -ragged -offset indent
45bdea400fSAndrew Thompson.Cd "device enc"
46904887e2SChristian Brueffer.Ed
47bdea400fSAndrew Thompson.Sh DESCRIPTION
48bdea400fSAndrew ThompsonThe
49bdea400fSAndrew Thompson.Nm
50bdea400fSAndrew Thompsoninterface is a software loopback mechanism that allows hosts or
51bdea400fSAndrew Thompsonfirewalls to filter
52e0c92631SBjoern A. Zeeb.Xr ipsec 4
53bdea400fSAndrew Thompsontraffic using any firewall package that hooks in via the
54bdea400fSAndrew Thompson.Xr pfil 9
55bdea400fSAndrew Thompsonframework.
56bdea400fSAndrew Thompson.Pp
57bdea400fSAndrew ThompsonThe
58bdea400fSAndrew Thompson.Nm
5945358a00SBjoern A. Zeebinterface allows an administrator to see incoming and outgoing packets
6045358a00SBjoern A. Zeebbefore and after they will be or have been processed by
6145358a00SBjoern A. Zeeb.Xr ipsec 4
6245358a00SBjoern A. Zeebvia
63e0ca5a93SChristian Brueffer.Xr tcpdump 1 .
64bdea400fSAndrew Thompson.Pp
65bdea400fSAndrew ThompsonThe
66ae91966bSRuslan Ermilov.Dq Li enc0
67bdea400fSAndrew Thompsoninterface inherits all IPsec traffic.
68bdea400fSAndrew ThompsonThus all IPsec traffic can be filtered based on
69ae91966bSRuslan Ermilov.Dq Li enc0 ,
70bdea400fSAndrew Thompsonand all IPsec traffic could be seen by invoking
71e0ca5a93SChristian Brueffer.Xr tcpdump 1
72bdea400fSAndrew Thompsonon the
73ae91966bSRuslan Ermilov.Dq Li enc0
74bdea400fSAndrew Thompsoninterface.
7545358a00SBjoern A. Zeeb.Pp
7645358a00SBjoern A. ZeebWhat can be seen with
7745358a00SBjoern A. Zeeb.Xr tcpdump 1
7845358a00SBjoern A. Zeeband what will be passed on to the firewalls via the
7945358a00SBjoern A. Zeeb.Xr pfil 9
8045358a00SBjoern A. Zeebframework can be independently controlled using the following
8145358a00SBjoern A. Zeeb.Xr sysctl 8
8245358a00SBjoern A. Zeebvariables:
8345358a00SBjoern A. Zeeb.Bl -column net.enc.out.ipsec_filter_mask 0x00000000 0x00000000
8445358a00SBjoern A. Zeeb.It Sy "Name	Defaults	Suggested"
85c913de0eSJoel Dahl.It "net.enc.out.ipsec_bpf_mask	0x00000003	0x00000001"
86c913de0eSJoel Dahl.It "net.enc.out.ipsec_filter_mask	0x00000001	0x00000001"
87c913de0eSJoel Dahl.It "net.enc.in.ipsec_bpf_mask	0x00000001	0x00000002"
88c913de0eSJoel Dahl.It "net.enc.in.ipsec_filter_mask	0x00000001	0x00000002"
8945358a00SBjoern A. Zeeb.El
9045358a00SBjoern A. Zeeb.Pp
9145358a00SBjoern A. ZeebFor the incoming path a value of
9245358a00SBjoern A. Zeeb.Li 0x1
9345358a00SBjoern A. Zeebmeans
9445358a00SBjoern A. Zeeb.Dq Li before stripping off the outer header
9545358a00SBjoern A. Zeeband
9645358a00SBjoern A. Zeeb.Li 0x2
9745358a00SBjoern A. Zeebmeans
9845358a00SBjoern A. Zeeb.Dq Li after stripping off the outer header .
9945358a00SBjoern A. ZeebFor the outgoing path
10045358a00SBjoern A. Zeeb.Li 0x1
10145358a00SBjoern A. Zeebmeans
10245358a00SBjoern A. Zeeb.Dq Li with only the inner header
10345358a00SBjoern A. Zeeband
10445358a00SBjoern A. Zeeb.Li 0x2
10545358a00SBjoern A. Zeebmeans
10645358a00SBjoern A. Zeeb.Dq Li with outer and inner headers .
10745358a00SBjoern A. Zeeb.Bd -literal
10845358a00SBjoern A. Zeebincoming path                                          |------|
10945358a00SBjoern A. Zeeb---- IPsec processing ---- (before) ---- (after) ----> |      |
11045358a00SBjoern A. Zeeb                                                       | Host |
11145358a00SBjoern A. Zeeb<--- IPsec processing ---- (after) ----- (before) ---- |      |
11245358a00SBjoern A. Zeeboutgoing path                                          |------|
11345358a00SBjoern A. Zeeb.Ed
11445358a00SBjoern A. Zeeb.Pp
11545358a00SBjoern A. ZeebMost people will want to run with the suggested defaults for
11645358a00SBjoern A. Zeeb.Cm ipsec_filter_mask
11745358a00SBjoern A. Zeeband rely on the security policy database for the outer headers.
118bdea400fSAndrew Thompson.Sh EXAMPLES
11945358a00SBjoern A. ZeebTo see the packets the processed via
120e0c92631SBjoern A. Zeeb.Xr ipsec 4 ,
12145358a00SBjoern A. Zeebadjust the
12245358a00SBjoern A. Zeeb.Xr sysctl 8
12345358a00SBjoern A. Zeebvariables according to your need and run:
124bdea400fSAndrew Thompson.Pp
125ae91966bSRuslan Ermilov.Dl "tcpdump -i enc0"
126bdea400fSAndrew Thompson.Sh SEE ALSO
127904887e2SChristian Brueffer.Xr tcpdump 1 ,
128bdea400fSAndrew Thompson.Xr bpf 4 ,
129bdea400fSAndrew Thompson.Xr ipf 4 ,
130bdea400fSAndrew Thompson.Xr ipfw 4 ,
131e0c92631SBjoern A. Zeeb.Xr ipsec 4 ,
132*e81210c1SEdward Tomasz Napierala.Xr pf 4
133