1.\" $OpenBSD: enc.4,v 1.22 2006/05/26 08:51:29 jmc Exp $ 2.\" 3.\" Copyright (c) 1999 Angelos D. Keromytis 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. All advertising materials mentioning features or use of this software 16.\" must display the following acknowledgement: 17.\" This product includes software developed by Angelos D. Keromytis. 18.\" 4. The name of the author may not be used to endorse or promote products 19.\" derived from this software without specific prior written permission. 20.\" 21.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31.\" 32.\" $FreeBSD$ 33.\" 34.Dd August 9, 2017 35.Dt ENC 4 36.Os 37.Sh NAME 38.Nm enc 39.Nd Encapsulating Interface 40.Sh SYNOPSIS 41To compile this driver into the kernel, 42place the following line in your 43kernel configuration file: 44.Bd -ragged -offset indent 45.Cd "device enc" 46.Ed 47.Pp 48Alternatively, to load the driver as a 49module at boot time, place the following line in 50.Xr loader.conf 5 : 51.Bd -literal -offset indent 52if_enc_load="YES" 53.Ed 54.Sh DESCRIPTION 55The 56.Nm 57interface is a software loopback mechanism that allows hosts or 58firewalls to filter 59.Xr ipsec 4 60traffic using any firewall package that hooks in via the 61.Xr pfil 9 62framework. 63.Pp 64The 65.Nm 66interface allows an administrator to see incoming and outgoing packets 67before and after they will be or have been processed by 68.Xr ipsec 4 69via 70.Xr tcpdump 1 . 71.Pp 72The 73.Dq Li enc0 74interface inherits all IPsec traffic. 75Thus all IPsec traffic can be filtered based on 76.Dq Li enc0 , 77and all IPsec traffic could be seen by invoking 78.Xr tcpdump 1 79on the 80.Dq Li enc0 81interface. 82.Pp 83What can be seen with 84.Xr tcpdump 1 85and what will be passed on to the firewalls via the 86.Xr pfil 9 87framework can be independently controlled using the following 88.Xr sysctl 8 89variables: 90.Bl -column net.enc.out.ipsec_filter_mask 0x00000000 0x00000000 91.It Sy "Name Defaults Suggested" 92.It "net.enc.out.ipsec_bpf_mask 0x00000003 0x00000001" 93.It "net.enc.out.ipsec_filter_mask 0x00000001 0x00000001" 94.It "net.enc.in.ipsec_bpf_mask 0x00000001 0x00000002" 95.It "net.enc.in.ipsec_filter_mask 0x00000001 0x00000002" 96.El 97.Pp 98For the incoming path a value of 99.Li 0x1 100means 101.Dq Li before stripping off the outer header 102and 103.Li 0x2 104means 105.Dq Li after stripping off the outer header . 106For the outgoing path 107.Li 0x1 108means 109.Dq Li with only the inner header 110and 111.Li 0x2 112means 113.Dq Li with outer and inner headers . 114.Bd -literal 115incoming path |------| 116---- IPsec processing ---- (before) ---- (after) ----> | | 117 | Host | 118<--- IPsec processing ---- (after) ----- (before) ---- | | 119outgoing path |------| 120.Ed 121.Pp 122Most people will want to run with the suggested defaults for 123.Cm ipsec_filter_mask 124and rely on the security policy database for the outer headers. 125.Pp 126Note that packets are captured by BPF before firewall processing. 127The special value 0x4 can be configured in the 128.Ar ipsec_bpf_mask 129and packets will be also captured after firewall processing. 130.Sh EXAMPLES 131To see the packets the processed via 132.Xr ipsec 4 , 133adjust the 134.Xr sysctl 8 135variables according to your need and run: 136.Pp 137.Dl "tcpdump -i enc0" 138.Sh SEE ALSO 139.Xr tcpdump 1 , 140.Xr bpf 4 , 141.Xr ipf 4 , 142.Xr ipfw 4 , 143.Xr ipsec 4 , 144.Xr pf 4 145