1bdea400fSAndrew Thompson.\" $OpenBSD: enc.4,v 1.22 2006/05/26 08:51:29 jmc Exp $ 2bdea400fSAndrew Thompson.\" 3bdea400fSAndrew Thompson.\" Copyright (c) 1999 Angelos D. Keromytis 4bdea400fSAndrew Thompson.\" All rights reserved. 5bdea400fSAndrew Thompson.\" 6bdea400fSAndrew Thompson.\" Redistribution and use in source and binary forms, with or without 7bdea400fSAndrew Thompson.\" modification, are permitted provided that the following conditions 8bdea400fSAndrew Thompson.\" are met: 9bdea400fSAndrew Thompson.\" 10bdea400fSAndrew Thompson.\" 1. Redistributions of source code must retain the above copyright 11bdea400fSAndrew Thompson.\" notice, this list of conditions and the following disclaimer. 12bdea400fSAndrew Thompson.\" 2. Redistributions in binary form must reproduce the above copyright 13bdea400fSAndrew Thompson.\" notice, this list of conditions and the following disclaimer in the 14bdea400fSAndrew Thompson.\" documentation and/or other materials provided with the distribution. 15bdea400fSAndrew Thompson.\" 3. All advertising materials mentioning features or use of this software 16bdea400fSAndrew Thompson.\" must display the following acknowledgement: 17bdea400fSAndrew Thompson.\" This product includes software developed by Angelos D. Keromytis. 18bdea400fSAndrew Thompson.\" 4. The name of the author may not be used to endorse or promote products 19bdea400fSAndrew Thompson.\" derived from this software without specific prior written permission. 20bdea400fSAndrew Thompson.\" 21bdea400fSAndrew Thompson.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22bdea400fSAndrew Thompson.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23bdea400fSAndrew Thompson.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24bdea400fSAndrew Thompson.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25bdea400fSAndrew Thompson.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26bdea400fSAndrew Thompson.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27bdea400fSAndrew Thompson.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28bdea400fSAndrew Thompson.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29bdea400fSAndrew Thompson.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30bdea400fSAndrew Thompson.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31bdea400fSAndrew Thompson.\" 32bdea400fSAndrew Thompson.\" $FreeBSD$ 33bdea400fSAndrew Thompson.\" 3445358a00SBjoern A. Zeeb.Dd November 28, 2007 35bdea400fSAndrew Thompson.Dt ENC 4 36bdea400fSAndrew Thompson.Os 37bdea400fSAndrew Thompson.Sh NAME 38bdea400fSAndrew Thompson.Nm enc 39bdea400fSAndrew Thompson.Nd Encapsulating Interface 40bdea400fSAndrew Thompson.Sh SYNOPSIS 41904887e2SChristian BruefferTo compile this driver into the kernel, 42904887e2SChristian Bruefferplace the following line in your 43904887e2SChristian Bruefferkernel configuration file: 44904887e2SChristian Brueffer.Bd -ragged -offset indent 45bdea400fSAndrew Thompson.Cd "device enc" 46904887e2SChristian Brueffer.Ed 47bdea400fSAndrew Thompson.Sh DESCRIPTION 48bdea400fSAndrew ThompsonThe 49bdea400fSAndrew Thompson.Nm 50bdea400fSAndrew Thompsoninterface is a software loopback mechanism that allows hosts or 51bdea400fSAndrew Thompsonfirewalls to filter 52e0c92631SBjoern A. Zeeb.Xr ipsec 4 53bdea400fSAndrew Thompsontraffic using any firewall package that hooks in via the 54bdea400fSAndrew Thompson.Xr pfil 9 55bdea400fSAndrew Thompsonframework. 56bdea400fSAndrew Thompson.Pp 57bdea400fSAndrew ThompsonThe 58bdea400fSAndrew Thompson.Nm 5945358a00SBjoern A. Zeebinterface allows an administrator to see incoming and outgoing packets 6045358a00SBjoern A. Zeebbefore and after they will be or have been processed by 6145358a00SBjoern A. Zeeb.Xr ipsec 4 6245358a00SBjoern A. Zeebvia 63e0ca5a93SChristian Brueffer.Xr tcpdump 1 . 64bdea400fSAndrew Thompson.Pp 65bdea400fSAndrew ThompsonThe 66ae91966bSRuslan Ermilov.Dq Li enc0 67bdea400fSAndrew Thompsoninterface inherits all IPsec traffic. 68bdea400fSAndrew ThompsonThus all IPsec traffic can be filtered based on 69ae91966bSRuslan Ermilov.Dq Li enc0 , 70bdea400fSAndrew Thompsonand all IPsec traffic could be seen by invoking 71e0ca5a93SChristian Brueffer.Xr tcpdump 1 72bdea400fSAndrew Thompsonon the 73ae91966bSRuslan Ermilov.Dq Li enc0 74bdea400fSAndrew Thompsoninterface. 7545358a00SBjoern A. Zeeb.Pp 7645358a00SBjoern A. ZeebWhat can be seen with 7745358a00SBjoern A. Zeeb.Xr tcpdump 1 7845358a00SBjoern A. Zeeband what will be passed on to the firewalls via the 7945358a00SBjoern A. Zeeb.Xr pfil 9 8045358a00SBjoern A. Zeebframework can be independently controlled using the following 8145358a00SBjoern A. Zeeb.Xr sysctl 8 8245358a00SBjoern A. Zeebvariables: 8345358a00SBjoern A. Zeeb.Bl -column net.enc.out.ipsec_filter_mask 0x00000000 0x00000000 8445358a00SBjoern A. Zeeb.It Sy "Name Defaults Suggested" 85c913de0eSJoel Dahl.It "net.enc.out.ipsec_bpf_mask 0x00000003 0x00000001" 86c913de0eSJoel Dahl.It "net.enc.out.ipsec_filter_mask 0x00000001 0x00000001" 87c913de0eSJoel Dahl.It "net.enc.in.ipsec_bpf_mask 0x00000001 0x00000002" 88c913de0eSJoel Dahl.It "net.enc.in.ipsec_filter_mask 0x00000001 0x00000002" 8945358a00SBjoern A. Zeeb.El 9045358a00SBjoern A. Zeeb.Pp 9145358a00SBjoern A. ZeebFor the incoming path a value of 9245358a00SBjoern A. Zeeb.Li 0x1 9345358a00SBjoern A. Zeebmeans 9445358a00SBjoern A. Zeeb.Dq Li before stripping off the outer header 9545358a00SBjoern A. Zeeband 9645358a00SBjoern A. Zeeb.Li 0x2 9745358a00SBjoern A. Zeebmeans 9845358a00SBjoern A. Zeeb.Dq Li after stripping off the outer header . 9945358a00SBjoern A. ZeebFor the outgoing path 10045358a00SBjoern A. Zeeb.Li 0x1 10145358a00SBjoern A. Zeebmeans 10245358a00SBjoern A. Zeeb.Dq Li with only the inner header 10345358a00SBjoern A. Zeeband 10445358a00SBjoern A. Zeeb.Li 0x2 10545358a00SBjoern A. Zeebmeans 10645358a00SBjoern A. Zeeb.Dq Li with outer and inner headers . 10745358a00SBjoern A. Zeeb.Bd -literal 10845358a00SBjoern A. Zeebincoming path |------| 10945358a00SBjoern A. Zeeb---- IPsec processing ---- (before) ---- (after) ----> | | 11045358a00SBjoern A. Zeeb | Host | 11145358a00SBjoern A. Zeeb<--- IPsec processing ---- (after) ----- (before) ---- | | 11245358a00SBjoern A. Zeeboutgoing path |------| 11345358a00SBjoern A. Zeeb.Ed 11445358a00SBjoern A. Zeeb.Pp 11545358a00SBjoern A. ZeebMost people will want to run with the suggested defaults for 11645358a00SBjoern A. Zeeb.Cm ipsec_filter_mask 11745358a00SBjoern A. Zeeband rely on the security policy database for the outer headers. 118bdea400fSAndrew Thompson.Sh EXAMPLES 11945358a00SBjoern A. ZeebTo see the packets the processed via 120e0c92631SBjoern A. Zeeb.Xr ipsec 4 , 12145358a00SBjoern A. Zeebadjust the 12245358a00SBjoern A. Zeeb.Xr sysctl 8 12345358a00SBjoern A. Zeebvariables according to your need and run: 124bdea400fSAndrew Thompson.Pp 125ae91966bSRuslan Ermilov.Dl "tcpdump -i enc0" 126bdea400fSAndrew Thompson.Sh SEE ALSO 127904887e2SChristian Brueffer.Xr tcpdump 1 , 128bdea400fSAndrew Thompson.Xr bpf 4 , 129bdea400fSAndrew Thompson.Xr ipf 4 , 130bdea400fSAndrew Thompson.Xr ipfw 4 , 131e0c92631SBjoern A. Zeeb.Xr ipsec 4 , 132*e81210c1SEdward Tomasz Napierala.Xr pf 4 133