254 files changed, 0 insertions, 167666 deletions

diff --git a/doc/.cvsignore b/doc/.cvsignore
deleted file mode 100644
index a523b809d..000000000
--- a/doc/.cvsignore
+++ /dev/null
@@ -1,66 +0,0 @@
-HowTo.html
-HowTo.html
-adv_config.html
-adv_config.html
-background.html
-background.html
-biblio.html
-biblio.html
-compat.html
-compat.html
-config.html
-config.html
-draft-richardson-ipsec-opportunistic.nr
-draft-richardson-ipsec-rr.nr
-draft-richardson-ipsec-rr.txt
-faq.html
-faq.html
-firewall.html
-firewall.html
-glossary.html
-glossary.html
-index.html
-index.html
-install.html
-install.html
-interop.html
-interop.html
-intro.html
-intro.html
-ipsec.html
-ipsec.html
-kernel.html
-kernel.html
-mail.html
-mail.html
-makecheck.html
-manpage.d
-manpage.d
-manpages.html
-manpages.html
-multi_netjig.png
-nightly.html
-performance.html
-performance.html
-policygroups.html
-politics.html
-politics.html
-quickstart.html
-rfc.html
-rfc.html
-rfc_pg
-roadmap.html
-roadmap.html
-single_netjig.png
-testing.html
-testing.html
-toc.html
-toc.html
-trouble.html
-trouble.html
-umltesting.html
-upgrading.html
-user_examples.html
-user_examples.html
-web.html
-web.html
diff --git a/doc/2.6.known-issues b/doc/2.6.known-issues
deleted file mode 100644
index 397c4f957..000000000
--- a/doc/2.6.known-issues
+++ /dev/null
@@ -1,112 +0,0 @@
-Known issues with FreeS/WAN on a 2.6 kernel                   Claudia Schmeing
--------------------------------------------
-
-
-This is an overview of known issues with FreeS/WAN on the 2.6 kernel codebase
-(also 2.5.x), which includes native Linux IPsec code.
-
-More information on the native IPsec code is available here:
-
-    http://lartc.org/howto/lartc.ipsec.html 
-
-Tools for use with that code are here:
-
-    http://ipsec-tools.sourceforge.net/
-
-
-* As of FreeS/WAN 2.03, FreeS/WAN ships with some support for the 2.6 kernel
-  IPsec code. In 2.03, this support is preliminary, but we expect to develop
-  it fully. Many thanks to Herbert Xu for the initial code patches.
-
-* Use the most recent Linux FreeS/WAN 2.x release from ftp.xs4all.nl 
-  to try our 2.6 kernel support.
-
-* The installation procedure for use with 2.6 kernel IPsec is a little 
-  different from a traditional FreeS/WAN installation. Please see
-  the latest doc/install.html.
-
-* Please see the design and users' mailing lists 
-  (http://www.freeswan.org/mail.html) for more detail and the latest reports.
-
-
-
-DESIGN-RELATED ISSUES
-
-
-* In 2.6, IPsec policies are detached from routing decisions. Because of this
-  design, Opportunistic Encryption on the local LAN will be possible with 2.6.
-
-  One side effect: When contacting a node on the local LAN which is protected
-  by gateway OE, you will get asymmetrical routing (one way through the gateway,
-  one way direct), and IPsec will drop the return packets.
-
-
-
-CURRENT ISSUES
-
-
-* For the moment, users wishing to test FreeS/WAN with 2.6 will require
-  ipsec-tools' "setkey" program. Though FreeS/WAN's keying daemon, Pluto,
-  directly sets IPsec policy, setkey is currently required to reset kernel SPD 
-  (Security Policy Database) states when Pluto restarts. We will likely add 
-  this basic functionality to an upcoming FreeS/WAN release.
-
-* State information is not available to the user, eg. ipsec 
-  eroute/ipsec spi/ipsec look do not work. The exception: ipsec auto --status 
-  This will be fixed in a future release.
-
-* If you're running Opportunistic Encryption, connectivity to new hosts will
-  immediately fail. You may receive a message similar to this:
-  
-     connect: Resource temporarily unavailable
-
-  The reason for this lies in the kernel code. Fairly complex discussion:
-
-      http://lists.freeswan.org/archives/design/2003-September/msg00073.html
-
-  As of 2.6.0-test6, this has not been fixed.
-
-* This initial connectivity failure has an unintended side effect on DNS queries. 
-  This will result in a rekey failure for OE connections; a %pass will be 
-  installed for your destination IP before a %pass is re-instituted to your 
-  DNS server. As a workaround, please add your DNS servers to 
-  /etc/ipsec.d/policies/clear. 
-
-* Packets on all interfaces are considered for OE, including loopback. If you're 
-  running a local nameserver, you'll still need to exempt localhost DNS traffic
-  as per the previous point. Since this traffic has a source of 127.0.0.1/32,
-  the "clear" policy group will not suffice; you'll need to add the following 
-  %passthrough conn to ipsec.conf:
-
-  conn exclude-lo
-          authby=never
-          left=127.0.0.1
-          leftsubnet=127.0.0.0/8
-          right=127.0.0.2
-          rightsubnet=127.0.0.0/8
-          type=passthrough
-          auto=route
-
-
-
-OLD ISSUES
-
-
-None, yet.
-
-
-
-RELATED DOCUMENTS
-
-
-FreeS/WAN Install web page        doc/install.html
-
-FreeS/WAN Install guide           INSTALL
-
-FreeS/WAN mailing list posts, including:
-
-    http://lists.freeswan.org/archives/design/2003-September/msg00057.html
-
-To sign up for our mailing lists, see http://www.freeswan.org/mail.html
-
-
diff --git a/doc/HowTo.html b/doc/HowTo.html
deleted file mode 100644
index a6f92dda9..000000000
--- a/doc/HowTo.html
+++ /dev/null
@@ -1,18733 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<CENTER><A HREF="#CONTENTS"><H1>Introduction to FreeS/WAN</H1></A><BR>
-</CENTER>
-<HR>
-<H1 ALIGN="CENTER"><A NAME="CONTENTS">Table of Contents</A></H1>
-<BR>
-<BR><B><A HREF="#intro">Introduction</A></B>
-<UL>
-<LI><A HREF="#ipsec.intro">IPsec, Security for the Internet Protocol</A></LI>
-<UL>
-<LI><A HREF="#intro.interop">Interoperating with other IPsec
- implementations</A></LI>
-<LI><A HREF="#advantages">Advantages of IPsec</A></LI>
-<LI><A HREF="#applications">Applications of IPsec</A></LI>
-<UL>
-<LI><A HREF="#makeVPN">Using secure tunnels to create a VPN</A></LI>
-<LI><A HREF="#road.intro">Road Warriors</A></LI>
-<LI><A HREF="#opp.intro">Opportunistic encryption</A></LI>
-</UL>
-<LI><A HREF="#types">The need to authenticate gateways</A></LI>
-</UL>
-<LI><A HREF="#project">The FreeS/WAN project</A></LI>
-<UL>
-<LI><A HREF="#goals">Project goals</A></LI>
-<LI><A HREF="#staff">Project team</A></LI>
-</UL>
-<LI><A HREF="#products">Products containing FreeS/WAN</A></LI>
-<UL>
-<LI><A HREF="#distwith">Full Linux distributions</A></LI>
-<LI><A HREF="#kernel_dist">Linux kernel distributions</A></LI>
-<LI><A HREF="#office_dist">Office server distributions</A></LI>
-<LI><A HREF="#fw_dist">Firewall distributions</A></LI>
-<LI><A HREF="#turnkey">Firewall and VPN products</A></LI>
-</UL>
-<LI><A HREF="#docs">Information sources</A></LI>
-<UL>
-<LI><A HREF="#docformats">This HowTo, in multiple formats</A></LI>
-<LI><A HREF="#rtfm">RTFM (please Read The Fine Manuals)</A></LI>
-<LI><A HREF="#text">Other documents in the distribution</A></LI>
-<LI><A HREF="#assumptions">Background material</A></LI>
-<LI><A HREF="#archives">Archives of the project mailing list</A></LI>
-<LI><A HREF="#howto">User-written HowTo information</A></LI>
-<LI><A HREF="#applied">Papers on FreeS/WAN</A></LI>
-<LI><A HREF="#licensing">License and copyright information</A></LI>
-</UL>
-<LI><A HREF="#sites">Distribution sites</A></LI>
-<UL>
-<LI><A HREF="#1_5_1">Primary site</A></LI>
-<LI><A HREF="#mirrors">Mirrors</A></LI>
-<LI><A HREF="#munitions">The &quot;munitions&quot; archive of Linux crypto
- software</A></LI>
-</UL>
-<LI><A HREF="#1_6">Links to other sections</A></LI>
-</UL>
-<B><A HREF="#2">Upgrading to FreeS/WAN 2.x</A></B>
-<UL>
-<LI><A HREF="#2_1">New! Built in Opportunistic connections</A></LI>
-<UL>
-<LI><A HREF="#2_1_1">Upgrading Opportunistic Encryption to 2.01 (or
- later)</A></LI>
-</UL>
-<LI><A HREF="#2_2">New! Policy Groups</A></LI>
-<LI><A HREF="#2_3">New! Packetdefault Connection</A></LI>
-<LI><A HREF="#2_4">FreeS/WAN now disables Reverse Path Filtering</A></LI>
-<LI><A HREF="#2_5">Revised ipsec.conf</A></LI>
-<UL>
-<LI><A HREF="#2_5_1">No promise of compatibility</A></LI>
-<LI><A HREF="#2_5_2">Most ipsec.conf files will work fine</A></LI>
-<LI><A HREF="#2_5_3">Backward compatibility patch</A></LI>
-<LI><A HREF="#2_5_4">Details</A></LI>
-<LI><A HREF="#2_5_5">Upgrading from 1.x RPMs to 2.x RPMs</A></LI>
-</UL>
-</UL>
-<B><A HREF="#quickstart">Quickstart Guide to Opportunistic Encryption</A>
-</B>
-<UL>
-<LI><A HREF="#opp.setup">Purpose</A></LI>
-<UL>
-<LI><A HREF="#3_1_1">OE &quot;flag day&quot;</A></LI>
-</UL>
-<LI><A HREF="#opp.dns">Requirements</A></LI>
-<LI><A HREF="#easy.install">RPM install</A></LI>
-<UL>
-<LI><A HREF="#3_3_1">Download RPMs</A></LI>
-<LI><A HREF="#3_3_2">Check signatures</A></LI>
-<LI><A HREF="#3_3_3">Install the RPMs</A></LI>
-<LI><A HREF="#testinstall">Test</A></LI>
-</UL>
-<LI><A HREF="#opp.setups.list">Our Opportunistic Setups</A></LI>
-<UL>
-<LI><A HREF="#3_4_1">Full or partial opportunism?</A></LI>
-</UL>
-<LI><A HREF="#opp.client">Initiate-only setup</A></LI>
-<UL>
-<LI><A HREF="#3_5_1">Restrictions</A></LI>
-<LI><A HREF="#forward.dns">Create and publish a forward DNS record</A></LI>
-<UL>
-<LI><A HREF="#3_5_2_1">Find a domain you can use</A></LI>
-<LI><A HREF="#3_5_2_2">Choose your ID</A></LI>
-<LI><A HREF="#3_5_2_3">Create a forward TXT record</A></LI>
-<LI><A HREF="#3_5_2_4">Publish the forward TXT record</A></LI>
-</UL>
-<LI><A HREF="#3_5_3">Test that your key has been published</A></LI>
-<LI><A HREF="#3_5_4">Configure, if necessary</A></LI>
-<LI><A HREF="#3_5_5">Test</A></LI>
-</UL>
-<LI><A HREF="#3_6">Full Opportunism</A></LI>
-<UL>
-<LI><A HREF="#3_6_1">Put a TXT record in a Forward Domain</A></LI>
-<LI><A HREF="#3_6_2">Put a TXT record in Reverse DNS</A></LI>
-<UL>
-<LI><A HREF="#3_6_2_1">Create a Reverse DNS TXT record</A></LI>
-<LI><A HREF="#3_6_2_2">Publish your TXT record</A></LI>
-</UL>
-<LI><A HREF="#3_6_3">Test your DNS record</A></LI>
-<LI><A HREF="#3_6_4">No Configuration Needed</A></LI>
-<LI><A HREF="#3_6_5">Consider Firewalling</A></LI>
-<LI><A HREF="#3_6_6">Test</A></LI>
-<LI><A HREF="#3_6_7">Test</A></LI>
-</UL>
-<LI><A HREF="#opp.test">Testing opportunistic connections</A></LI>
-<LI><A HREF="#3_8">Now what?</A></LI>
-<LI><A HREF="#3_9">Notes</A></LI>
-<LI><A HREF="#3_10">Troubleshooting OE</A></LI>
-<LI><A HREF="#3_11">Known Issues</A></LI>
-</UL>
-<B><A HREF="#4">How to Configure Linux FreeS/WAN with Policy Groups</A></B>
-<UL>
-<LI><A HREF="#4_1">What are Policy Groups?</A></LI>
-<UL>
-<LI><A HREF="#4_1_1">Built-In Security Options</A></LI>
-</UL>
-<LI><A HREF="#4_2">Using Policy Groups</A></LI>
-<UL>
-<LI><A HREF="#4_2_1">Example 1: Using a Base Policy Group</A></LI>
-<LI><A HREF="#4_2_2">Example 2: Defining IPsec Security Policy with
- Groups</A></LI>
-<LI><A HREF="#4_2_3">Example 3: Creating a Simple IPsec VPN with the
- private Group</A></LI>
-<LI><A HREF="#4_2_4">Example 4: New Policy Groups to Protect a Subnet</A>
-</LI>
-<LI><A HREF="#4_2_5">Example 5: Adding a Subnet to the VPN</A></LI>
-</UL>
-<LI><A HREF="#4_3">Appendix</A></LI>
-<UL>
-<LI><A HREF="#4_3_1">Our Hidden Connections</A></LI>
-<LI><A HREF="#4_3_2">Custom Policy Groups</A></LI>
-<LI><A HREF="#4_3_3">Disabling Opportunistic Encryption</A></LI>
-</UL>
-</UL>
-<B><A HREF="#5">FreeS/WAN FAQ</A></B>
-<UL>
-<LI><A HREF="#questions">Index of FAQ questions</A></LI>
-<LI><A HREF="#whatzit">What is FreeS/WAN?</A></LI>
-<LI><A HREF="#problems">How do I report a problem or seek help?</A></LI>
-<LI><A HREF="#generic">Can I get ...</A></LI>
-<UL>
-<LI><A HREF="#lemme_out">Can I get an off-the-shelf system that includes
- FreeS/WAN?</A></LI>
-<LI><A HREF="#consultant">Can I hire consultants or staff who know
- FreeS/WAN?</A></LI>
-<LI><A HREF="#commercial">Can I get commercial support?</A></LI>
-</UL>
-<LI><A HREF="#release">Release questions</A></LI>
-<UL>
-<LI><A HREF="#rel.current">What is the current release?</A></LI>
-<LI><A HREF="#relwhen">When is the next release?</A></LI>
-<LI><A HREF="#rel.bugs">Are there known bugs in the current release?</A></LI>
-</UL>
-<LI><A HREF="#mod_cons">Modifications and contributions</A></LI>
-<UL>
-<LI><A HREF="#modify.faq">Can I modify FreeS/WAN to ...?</A></LI>
-<LI><A HREF="#contrib.faq">Can I contribute to the project?</A></LI>
-<LI><A HREF="#ddoc.faq">Is there detailed design documentation?</A></LI>
-</UL>
-<LI><A HREF="#interact">Will FreeS/WAN work in my environment?</A></LI>
-<UL>
-<LI><A HREF="#interop.faq">Can FreeS/WAN talk to ...?</A></LI>
-<LI><A HREF="#old_to_new">Can different FreeS/WAN versions talk to each
- other?</A></LI>
-<LI><A HREF="#faq.bandwidth">Is there a limit on throughput?</A></LI>
-<LI><A HREF="#faq.number">Is there a limit on number of tunnels?</A></LI>
-<LI><A HREF="#faq.speed">Is a ... fast enough to handle FreeS/WAN with
- my loads?</A></LI>
-</UL>
-<LI><A HREF="#work_on">Will FreeS/WAN work on ... ?</A></LI>
-<UL>
-<LI><A HREF="#versions">Will FreeS/WAN run on my version of Linux?</A></LI>
-<LI><A HREF="#nonIntel.faq">Will FreeS/WAN run on non-Intel CPUs?</A></LI>
-<LI><A HREF="#multi.faq">Will FreeS/WAN run on multiprocessors?</A></LI>
-<LI><A HREF="#k.old">Will FreeS/WAN work on an older kernel?</A></LI>
-<LI><A HREF="#k.versions">Will FreeS/WAN run on the latest kernel
- version?</A></LI>
-<LI><A HREF="#interface.faq">Will FreeS/WAN work on unusual network
- hardware?</A></LI>
-<LI><A HREF="#vlan">Will FreeS/WAN work on a VLAN (802.1q) network?</A></LI>
-</UL>
-<LI><A HREF="#features.faq">Does FreeS/WAN support ...</A></LI>
-<UL>
-<LI><A HREF="#VPN.faq">Does FreeS/WAN support site-to-site VPN (Virtual
- Private Network) applications?</A></LI>
-<LI><A HREF="#warrior.faq">Does FreeS/WAN support remote users
- connecting to a LAN?</A></LI>
-<LI><A HREF="#road.shared.possible">Does FreeS/WAN support remote users
- using shared secret authentication?</A></LI>
-<LI><A HREF="#wireless.faq">Does FreeS/WAN support wireless networks?</A>
-</LI>
-<LI><A HREF="#PKIcert">Does FreeS/WAN support X.509 or other PKI
- certificates?</A></LI>
-<LI><A HREF="#Radius">Does FreeS/WAN support user authentication
- (Radius, SecureID, Smart Card...)?</A></LI>
-<LI><A HREF="#NATtraversal">Does FreeS/WAN support NAT traversal?</A></LI>
-<LI><A HREF="#virtID">Does FreeS/WAN support assigning a &quot;virtual
- identity&quot; to a remote system?</A></LI>
-<LI><A HREF="#noDES.faq">Does FreeS/WAN support single DES encryption?</A>
-</LI>
-<LI><A HREF="#AES.faq">Does FreeS/WAN support AES encryption?</A></LI>
-<LI><A HREF="#other.cipher">Does FreeS/WAN support other encryption
- algorithms?</A></LI>
-</UL>
-<LI><A HREF="#canI">Can I ...</A></LI>
-<UL>
-<LI><A HREF="#policy.preconfig">Can I use policy groups along with
- explicitly configured connections?</A></LI>
-<LI><A HREF="#policy.off">Can I turn off policy groups?</A></LI>
-<LI><A HREF="#reload">Can I reload connection info without restarting?</A>
-</LI>
-<LI><A HREF="#masq.faq">Can I use several masqueraded subnets?</A></LI>
-<LI><A HREF="#dup_route">Can I use subnets masqueraded to the same
- addresses?</A></LI>
-<LI><A HREF="#road.masq">Can I assign a road warrior an address on my
- net (a virtual identity)?</A></LI>
-<LI><A HREF="#road.many">Can I support many road warriors with one
- gateway?</A></LI>
-<LI><A HREF="#road.PSK">Can I have many road warriors using shared
- secret authentication?</A></LI>
-<LI><A HREF="#QoS">Can I use Quality of Service routing with FreeS/WAN?</A>
-</LI>
-<LI><A HREF="#deadtunnel">Can I recognise dead tunnels and shut them
- down?</A></LI>
-<LI><A HREF="#demanddial">Can I build IPsec tunnels over a demand-dialed
- link?</A></LI>
-<LI><A HREF="#GRE">Can I build GRE, L2TP or PPTP tunnels over IPsec?</A></LI>
-<LI><A HREF="#NetBIOS">... use Network Neighborhood (Samba, NetBIOS)
- over IPsec?</A></LI>
-</UL>
-<LI><A HREF="#setup.faq">Life's little mysteries</A></LI>
-<UL>
-<LI><A HREF="#cantping">I cannot ping ....</A></LI>
-<LI><A HREF="#forever">It takes forever to ...</A></LI>
-<LI><A HREF="#route">I send packets to the tunnel with route(8) but they
- vanish</A></LI>
-<LI><A HREF="#down_route">When a tunnel goes down, packets vanish</A></LI>
-<LI><A HREF="#firewall_ate">The firewall ate my packets!</A></LI>
-<LI><A HREF="#dropconn">Dropped connections</A></LI>
-<LI><A HREF="#defaultroutegone">Disappearing %defaultroute</A></LI>
-<LI><A HREF="#tcpdump.faq">TCPdump on the gateway shows strange things</A>
-</LI>
-<LI><A HREF="#no_trace">Traceroute does not show anything between the
- gateways</A></LI>
-</UL>
-<LI><A HREF="#man4debug">Testing in stages</A></LI>
-<UL>
-<LI><A HREF="#nomanual">Manually keyed connections don't work</A></LI>
-<LI><A HREF="#spi_error">One manual connection works, but second one
- fails</A></LI>
-<LI><A HREF="#man_no_auto">Manual connections work, but automatic keying
- doesn't</A></LI>
-<LI><A HREF="#nocomp">IPsec works, but connections using compression
- fail</A></LI>
-<LI><A HREF="#pmtu.broken">Small packets work, but large transfers fail</A>
-</LI>
-<LI><A HREF="#subsub">Subnet-to-subnet works, but tests from the
- gateways don't</A></LI>
-</UL>
-<LI><A HREF="#compile.faq">Compilation problems</A></LI>
-<UL>
-<LI><A HREF="#gmp.h_missing">gmp.h: No such file or directory</A></LI>
-<LI><A HREF="#noVM">... virtual memory exhausted</A></LI>
-</UL>
-<LI><A HREF="#error">Interpreting error messages</A></LI>
-<UL>
-<LI><A HREF="#route-client">route-client (or host) exited with status 7</A>
-</LI>
-<LI><A HREF="#unreachable">SIOCADDRT:Network is unreachable</A></LI>
-<LI><A HREF="#modprobe">ipsec_setup: modprobe: Can't locate module ipsec</A>
-</LI>
-<LI><A HREF="#noKLIPS">ipsec_setup: Fatal error, kernel appears to lack
- KLIPS</A></LI>
-<LI><A HREF="#noDNS">ipsec_setup: ... failure to fetch key for ... from
- DNS</A></LI>
-<LI><A HREF="#dup_address">ipsec_setup: ... interfaces ... and ... share
- address ...</A></LI>
-<LI><A HREF="#kflags">ipsec_setup: Cannot adjust kernel flags</A></LI>
-<LI><A HREF="#message_num">Message numbers (MI3, QR1, et cetera) in
- Pluto messages</A></LI>
-<LI><A HREF="#conn_name">Connection names in Pluto error messages</A></LI>
-<LI><A HREF="#cantorient">Pluto: ... can't orient connection</A></LI>
-<LI><A HREF="#no.interface">... we have no ipsecN interface for either
- end of this connection</A></LI>
-<LI><A HREF="#noconn">Pluto: ... no connection is known</A></LI>
-<LI><A HREF="#nosuit">Pluto: ... no suitable connection ...</A></LI>
-<LI><A HREF="#noconn.auth">Pluto: ... no connection has been authorized</A>
-</LI>
-<LI><A HREF="#noDESsupport">Pluto: ... OAKLEY_DES_CBC is not supported.</A>
-</LI>
-<LI><A HREF="#notransform">Pluto: ... no acceptable transform</A></LI>
-<LI><A HREF="#rsasigkey">rsasigkey dumps core</A></LI>
-<LI><A HREF="#sig4">!Pluto failure!: ... exited with ... signal 4</A></LI>
-<LI><A HREF="#econnrefused">ECONNREFUSED error message</A></LI>
-<LI><A HREF="#no_eroute">klips_debug: ... no eroute!</A></LI>
-<LI><A HREF="#SAused">... trouble writing to /dev/ipsec ... SA already
- in use</A></LI>
-<LI><A HREF="#ignore">... ignoring ... payload</A></LI>
-<LI><A HREF="#unknown_rightcert">unknown parameter name &quot;rightcert&quot;</A></LI>
-</UL>
-<LI><A HREF="#spam">Why don't you restrict the mailing lists to reduce
- spam?</A></LI>
-</UL>
-<B><A HREF="#manpages">FreeS/WAN manual pages</A></B>
-<UL>
-<LI><A HREF="#man.file">Files</A></LI>
-<LI><A HREF="#man.command">Commands</A></LI>
-<LI><A HREF="#man.lib">Library routines</A></LI>
-</UL>
-<B><A HREF="#firewall">FreeS/WAN and firewalls</A></B>
-<UL>
-<LI><A HREF="#filters">Filtering rules for IPsec packets</A></LI>
-<LI><A HREF="#examplefw">Firewall configuration at boot</A></LI>
-<UL>
-<LI><A HREF="#simple.rules">A simple set of rules</A></LI>
-<LI><A HREF="#complex.rules">Other rules</A></LI>
-<UL>
-<LI><A HREF="#7_2_2_1">Adding additional rules</A></LI>
-<LI><A HREF="#7_2_2_2">Modifying existing rules</A></LI>
-</UL>
-<LI><A HREF="#rules.pub">Published rule sets</A></LI>
-<UL>
-<LI><A HREF="#Ranch.trinity">Scripts based on Ranch's work</A></LI>
-<LI><A HREF="#seawall">The Seattle firewall</A></LI>
-<LI><A HREF="#rcf">The RCF scripts</A></LI>
-<LI><A HREF="#asgard">Asgard scripts</A></LI>
-<LI><A HREF="#user.scripts">User scripts from the mailing list</A></LI>
-</UL>
-</UL>
-<LI><A HREF="#updown">Calling firewall scripts, named in ipsec.conf(5)</A>
-</LI>
-<UL>
-<LI><A HREF="#pre_post">Scripts called at IPsec start and stop</A></LI>
-<LI><A HREF="#up_down">Scripts called at connection up and down</A></LI>
-<UL>
-<LI><A HREF="#fw.default">The default script</A></LI>
-<LI><A HREF="#userscript">User-written scripts</A></LI>
-</UL>
-<LI><A HREF="#ipchains.script">Scripts for ipchains or iptables</A></LI>
-</UL>
-<LI><A HREF="#NAT">A complication: IPsec vs. NAT</A></LI>
-<UL>
-<LI><A HREF="#nat_ok">NAT on or behind the IPsec gateway works</A></LI>
-<LI><A HREF="#nat_bad">NAT between gateways is problematic</A></LI>
-<LI><A HREF="#NAT.ref">Other references on NAT and IPsec</A></LI>
-</UL>
-<LI><A HREF="#complications">Other complications</A></LI>
-<UL>
-<LI><A HREF="#through">IPsec through the gateway</A></LI>
-<LI><A HREF="#ipsec_only">Preventing non-IPsec traffic</A></LI>
-<LI><A HREF="#unknowngate">Filtering packets from unknown gateways</A></LI>
-</UL>
-<LI><A HREF="#otherfilter">Other packet filters</A></LI>
-<UL>
-<LI><A HREF="#ICMP">ICMP filtering</A></LI>
-<LI><A HREF="#traceroute">UDP packets for traceroute</A></LI>
-<LI><A HREF="#l2tp">UDP for L2TP</A></LI>
-</UL>
-<LI><A HREF="#packets">How it all works: IPsec packet details</A></LI>
-<UL>
-<LI><A HREF="#noport">ESP and AH do not have ports</A></LI>
-<LI><A HREF="#header">Header layout</A></LI>
-<LI><A HREF="#dhr">DHR on the updown script</A></LI>
-</UL>
-</UL>
-<B><A HREF="#trouble">Linux FreeS/WAN Troubleshooting Guide</A></B>
-<UL>
-<LI><A HREF="#overview">Overview</A></LI>
-<LI><A HREF="#install">1. During Install</A></LI>
-<UL>
-<LI><A HREF="#8_2_1">1.1 RPM install gotchas</A></LI>
-<LI><A HREF="#8_2_2">1.2 Problems installing from source</A></LI>
-<LI><A HREF="#install.check">1.3 Install checks</A></LI>
-<LI><A HREF="#oe.trouble">1.3 Troubleshooting OE</A></LI>
-</UL>
-<LI><A HREF="#negotiation">2. During Negotiation</A></LI>
-<UL>
-<LI><A HREF="#state">2.1 Determine Connection State</A></LI>
-<UL>
-<LI><A HREF="#8_3_1_1">Finding current state</A></LI>
-<LI><A HREF="#8_3_1_2">What's this supposed to look like?</A></LI>
-</UL>
-<LI><A HREF="#find.pluto.error">2.2 Finding error text</A></LI>
-<UL>
-<LI><A HREF="#8_3_2_1">Verbose start for more information</A></LI>
-<LI><A HREF="#8_3_2_2">Debug levels count</A></LI>
-<LI><A HREF="#8_3_2_3">ipsec barf for lots of debugging information</A></LI>
-<LI><A HREF="#8_3_2_4">Find the error</A></LI>
-<LI><A HREF="#8_3_2_5">Play both sides</A></LI>
-</UL>
-<LI><A HREF="#interpret.pluto.error">2.3 Interpreting a Negotiation
- Error</A></LI>
-<UL>
-<LI><A HREF="#ikepath">Connection stuck at STATE_MAIN_I1</A></LI>
-<LI><A HREF="#8_3_3_2">Other errors</A></LI>
-</UL>
-</UL>
-<LI><A HREF="#use">3. Using a Connection</A></LI>
-<UL>
-<LI><A HREF="#8_4_1">3.1 Orienting yourself</A></LI>
-<UL>
-<LI><A HREF="#8_4_1_1">How do I know if it works?</A></LI>
-<LI><A HREF="#8_4_1_2">ipsec barf is useful again</A></LI>
-</UL>
-<LI><A HREF="#8_4_2">3.2 Those pesky configuration errors</A></LI>
-<LI><A HREF="#route.firewall">3.3 Check Routing and Firewalling</A></LI>
-<UL>
-<LI><A HREF="#8_4_3_1">Background:</A></LI>
-<LI><A HREF="#ifconfig">View Interface and Firewall Statistics</A></LI>
-</UL>
-<LI><A HREF="#sniff">3.4 When in doubt, sniff it out</A></LI>
-<UL>
-<LI><A HREF="#8_4_4_1">Anticipate your packets' path</A></LI>
-</UL>
-<LI><A HREF="#find.use.error">3.5 Check your logs</A></LI>
-<UL>
-<LI><A HREF="#interpret.use.error">Interpreting log text</A></LI>
-</UL>
-<LI><A HREF="#bigpacket">3.6 More testing for the truly thorough</A></LI>
-<UL>
-<LI><A HREF="#8_4_6_1">Large Packets</A></LI>
-<LI><A HREF="#8_4_6_2">Stress Tests</A></LI>
-</UL>
-</UL>
-<LI><A HREF="#prob.report">4. Problem Reporting</A></LI>
-<UL>
-<LI><A HREF="#8_5_1">4.1 How to ask for help</A></LI>
-<LI><A HREF="#8_5_2">4.2 Where to ask</A></LI>
-</UL>
-<LI><A HREF="#notes">5. Additional Notes on Troubleshooting</A></LI>
-<UL>
-<LI><A HREF="#system.info">5.1 Information available on your system</A></LI>
-<UL>
-<LI><A HREF="#logusage">Logs used</A></LI>
-<LI><A HREF="#pages">man pages provided</A></LI>
-<LI><A HREF="#statusinfo">Status information</A></LI>
-</UL>
-<LI><A HREF="#testgates"> 5.2 Testing between security gateways</A></LI>
-<LI><A HREF="#ifconfig1">5.3 ifconfig reports for KLIPS debugging</A></LI>
-<LI><A HREF="#gdb"> 5.4 Using GDB on Pluto</A></LI>
-</UL>
-</UL>
-<B><A HREF="#compat">Linux FreeS/WAN Compatibility Guide</A></B>
-<UL>
-<LI><A HREF="#spec">Implemented parts of the IPsec Specification</A></LI>
-<UL>
-<LI><A HREF="#in">In Linux FreeS/WAN</A></LI>
-<LI><A HREF="#dropped">Deliberately omitted</A></LI>
-<LI><A HREF="#not">Not (yet) in Linux FreeS/WAN</A></LI>
-</UL>
-<LI><A HREF="#pfkey">Our PF-Key implementation</A></LI>
-<UL>
-<LI><A HREF="#pfk.port">PF-Key portability</A></LI>
-</UL>
-<LI><A HREF="#otherk">Kernels other than the latest 2.2.x and 2.4.y</A></LI>
-<UL>
-<LI><A HREF="#kernel.2.0">2.0.x kernels</A></LI>
-<LI><A HREF="#kernel.production">2.2 and 2.4 kernels</A></LI>
-</UL>
-<LI><A HREF="#otherdist">Intel Linux distributions other than Redhat</A></LI>
-<UL>
-<LI><A HREF="#rh7">Redhat 7.0</A></LI>
-<LI><A HREF="#suse">SuSE Linux</A></LI>
-<UL>
-<LI><A HREF="#9_4_2_1">SuSE Linux 5.3</A></LI>
-</UL>
-<LI><A HREF="#slack">Slackware</A></LI>
-<LI><A HREF="#deb">Debian</A></LI>
-<LI><A HREF="#caldera">Caldera</A></LI>
-</UL>
-<LI><A HREF="#CPUs">CPUs other than Intel</A></LI>
-<UL>
-<LI><A HREF="# strongarm">Corel Netwinder (StrongARM CPU)</A></LI>
-<LI><A HREF="#yellowdog">Yellow Dog Linux on Power PC</A></LI>
-<LI><A HREF="#mklinux">Mklinux</A></LI>
-<LI><A HREF="#alpha">Alpha 64-bit processors</A></LI>
-<LI><A HREF="#SPARC">Sun SPARC processors</A></LI>
-<LI><A HREF="#mips">MIPS processors</A></LI>
-<LI><A HREF="#crusoe">Transmeta Crusoe</A></LI>
-<LI><A HREF="#coldfire">Motorola Coldfire</A></LI>
-</UL>
-<LI><A HREF="#multiprocessor">Multiprocessor machines</A></LI>
-<LI><A HREF="#hardware">Support for crypto hardware</A></LI>
-<LI><A HREF="#ipv6">IP version 6 (IPng)</A></LI>
-<UL>
-<LI><A HREF="#v6.back">IPv6 background</A></LI>
-</UL>
-</UL>
-<B><A HREF="#10">Interoperating with FreeS/WAN</A></B>
-<UL>
-<LI><A HREF="#10_1">Interop at a Glance</A></LI>
-<UL>
-<LI><A HREF="#10_1_1">Key</A></LI>
-</UL>
-<LI><A HREF="#10_2">Basic Interop Rules</A></LI>
-<LI><A HREF="#10_3">Longer Stories</A></LI>
-<UL>
-<LI><A HREF="#10_3_1">For More Compatible Implementations</A></LI>
-<UL>
-<LI><A HREF="#freeswan">FreeS/WAN</A></LI>
-<LI><A HREF="#isakmpd">isakmpd (OpenBSD)</A></LI>
-<LI><A HREF="#kame">Kame</A></LI>
-<LI><A HREF="#mcafee">PGPNet/McAfee</A></LI>
-<LI><A HREF="#microsoft">Microsoft Windows 2000/XP</A></LI>
-<LI><A HREF="#ssh">SSH Sentinel</A></LI>
-<LI><A HREF="#safenet">Safenet SoftPK/SoftRemote</A></LI>
-</UL>
-<LI><A HREF="#10_3_2">For Other Implementations</A></LI>
-<UL>
-<LI><A HREF="#6wind">6Wind</A></LI>
-<LI><A HREF="#alcatel">Alcatel Timestep</A></LI>
-<LI><A HREF="#apple">Apple Macintosh System 10+</A></LI>
-<LI><A HREF="#ashleylaurent">AshleyLaurent VPCom</A></LI>
-<LI><A HREF="#borderware">Borderware</A></LI>
-<LI><A HREF="#checkpoint">Check Point VPN-1 or FW-1</A></LI>
-<LI><A HREF="#cisco">Cisco</A></LI>
-<LI><A HREF="#equinux">Equinux VPN tracker (for Mac OS X)</A></LI>
-<LI><A HREF="#fsecure">F-Secure</A></LI>
-<LI><A HREF="#gauntlet">Gauntlet GVPN</A></LI>
-<LI><A HREF="#aix">IBM AIX</A></LI>
-<LI><A HREF="#as400">IBM AS/400</A></LI>
-<LI><A HREF="#intel">Intel Shiva LANRover / Net Structure</A></LI>
-<LI><A HREF="#lancom">LanCom (formerly ELSA)</A></LI>
-<LI><A HREF="#linksys">Linksys</A></LI>
-<LI><A HREF="#lucent">Lucent</A></LI>
-<LI><A HREF="#netasq">Netasq</A></LI>
-<LI><A HREF="#netcelo">Netcelo</A></LI>
-<LI><A HREF="#netgear">Netgear fvs318</A></LI>
-<LI><A HREF="#netscreen">Netscreen 100 or 5xp</A></LI>
-<LI><A HREF="#nortel">Nortel Contivity</A></LI>
-<LI><A HREF="#radguard">Radguard</A></LI>
-<LI><A HREF="#raptor">Raptor (NT or Solaris)</A></LI>
-<LI><A HREF="#redcreek">Redcreek Ravlin</A></LI>
-<LI><A HREF="#sonicwall">SonicWall</A></LI>
-<LI><A HREF="#sun">Sun Solaris</A></LI>
-<LI><A HREF="#symantec">Symantec</A></LI>
-<LI><A HREF="#watchguard">Watchguard Firebox</A></LI>
-<LI><A HREF="#xedia">Xedia Access Point/QVPN</A></LI>
-<LI><A HREF="#zyxel">Zyxel</A></LI>
-</UL>
-</UL>
-</UL>
-<B><A HREF="#performance">Performance of FreeS/WAN</A></B>
-<UL>
-<LI><A HREF="#pub.bench">Published material</A></LI>
-<LI><A HREF="#perf.estimate">Estimating CPU overheads</A></LI>
-<UL>
-<LI><A HREF="#perf.more">Higher performance alternatives</A></LI>
-<LI><A HREF="#11_2_2">Other considerations</A></LI>
-</UL>
-<LI><A HREF="#biggate">Many tunnels from a single gateway</A></LI>
-<LI><A HREF="#low-end">Low-end systems</A></LI>
-<LI><A HREF="#klips.bench">Measuring KLIPS</A></LI>
-<LI><A HREF="#speed.compress">Speed with compression</A></LI>
-<LI><A HREF="#methods">Methods of measuring</A></LI>
-</UL>
-<B><A HREF="#test.freeswan">Testing FreeS/WAN</A></B>
-<UL>
-<LI><A HREF="#test.oe">Testing opportunistic connections</A></LI>
-<UL>
-<LI><A HREF="#12_1_1">Basic OE Test</A></LI>
-<LI><A HREF="#12_1_2">OE Gateway Test</A></LI>
-<LI><A HREF="#12_1_3">Additional OE tests</A></LI>
-</UL>
-<LI><A HREF="#test.uml">Testing with User Mode Linux</A></LI>
-<LI><A HREF="#testnet">Configuration for a testbed network</A></LI>
-<UL>
-<LI><A HREF="#testbed">Testbed network</A></LI>
-<LI><A HREF="#tcpdump.test">Using packet sniffers in testing</A></LI>
-</UL>
-<LI><A HREF="#verify.crypt">Verifying encryption</A></LI>
-<LI><A HREF="#mail.test">Mailing list pointers</A></LI>
-</UL>
-<B><A HREF="#kernelconfig">Kernel configuration for FreeS/WAN</A></B>
-<UL>
-<LI><A HREF="#notall">Not everyone needs to worry about kernel
- configuration</A></LI>
-<LI><A HREF="#assume">Assumptions and notation</A></LI>
-<UL>
-<LI><A HREF="#labels">Labels used</A></LI>
-</UL>
-<LI><A HREF="#kernelopt">Kernel options for FreeS/WAN</A></LI>
-</UL>
-<B><A HREF="#adv_config">Other configuration possibilities</A></B>
-<UL>
-<LI><A HREF="#thumb">Some rules of thumb about configuration</A></LI>
-<UL>
-<LI><A HREF="#cheap.tunnel">Tunnels are cheap</A></LI>
-<LI><A HREF="#subnet.size">Subnet sizes</A></LI>
-<LI><A HREF="#example.more">Other network layouts</A></LI>
-<UL>
-<LI><A HREF="#internet.subnet">The Internet as a big subnet</A></LI>
-<LI><A HREF="#wireless.config">Wireless</A></LI>
-</UL>
-</UL>
-<LI><A HREF="#choose">Choosing connection types</A></LI>
-<UL>
-<LI><A HREF="#man-auto">Manual vs. automatic keying</A></LI>
-<LI><A HREF="#auto-auth">Authentication methods for auto-keying</A></LI>
-<LI><A HREF="#adv-pk">Advantages of public key methods</A></LI>
-</UL>
-<LI><A HREF="#prodsecrets">Using shared secrets in production</A></LI>
-<UL>
-<LI><A HREF="#secrets">Putting secrets in ipsec.secrets(5)</A></LI>
-<LI><A HREF="#securing.secrets">File security</A></LI>
-<LI><A HREF="#notroadshared">Shared secrets for road warriors</A></LI>
-</UL>
-<LI><A HREF="#prodman">Using manual keying in production</A></LI>
-<UL>
-<LI><A HREF="#ranbits">Creating keys with ranbits</A></LI>
-</UL>
-<LI><A HREF="#boot">Setting up connections at boot time</A></LI>
-<LI><A HREF="#multitunnel">Multiple tunnels between the same two
- gateways</A></LI>
-<UL>
-<LI><A HREF="#advroute">One tunnel plus advanced routing</A></LI>
-</UL>
-<LI><A HREF="#opp.gate">An Opportunistic Gateway</A></LI>
-<UL>
-<LI><A HREF="#14_7_1">Start from full opportunism</A></LI>
-<LI><A HREF="#14_7_2">Reverse DNS TXT records for each protected machine</A>
-</LI>
-<LI><A HREF="#14_7_3">Publish your records</A></LI>
-<LI><A HREF="#14_7_4">...and test them</A></LI>
-<LI><A HREF="#14_7_5">No Configuration Needed</A></LI>
-</UL>
-<LI><A HREF="#extruded.config">Extruded Subnets</A></LI>
-<LI><A HREF="#roadvirt">Road Warrior with virtual IP address</A></LI>
-<LI><A HREF="#dynamic">Dynamic Network Interfaces</A></LI>
-<UL>
-<LI><A HREF="#basicdyn">Basics</A></LI>
-<LI><A HREF="#bootdyn">Boot Time</A></LI>
-<LI><A HREF="#changedyn">Change Time</A></LI>
-</UL>
-<LI><A HREF="#unencrypted">Unencrypted tunnels</A></LI>
-</UL>
-<B><A HREF="#install">Installing FreeS/WAN</A></B>
-<UL>
-<LI><A HREF="#15_1">Requirements</A></LI>
-<LI><A HREF="#15_2">Choose your install method</A></LI>
-<LI><A HREF="#15_3">FreeS/WAN ships with some Linuxes</A></LI>
-<UL>
-<LI><A HREF="#15_3_1">FreeS/WAN may be altered...</A></LI>
-<LI><A HREF="#15_3_2">You might need to create an authentication keypair</A>
-</LI>
-<LI><A HREF="#15_3_3">Start and test FreeS/WAN</A></LI>
-</UL>
-<LI><A HREF="#15_4">RPM install</A></LI>
-<UL>
-<LI><A HREF="#15_4_1">Download RPMs</A></LI>
-<LI><A HREF="#15_4_2">For freeswan.org RPMs: check signatures</A></LI>
-<LI><A HREF="#15_4_3">Install the RPMs</A></LI>
-<LI><A HREF="#15_4_4">Start and Test FreeS/WAN</A></LI>
-</UL>
-<LI><A HREF="#15_5">Install from Source</A></LI>
-<UL>
-<LI><A HREF="#15_5_1">Decide what functionality you need</A></LI>
-<LI><A HREF="#15_5_2">Download FreeS/WAN</A></LI>
-<LI><A HREF="#15_5_3">For freeswan.org source: check its signature</A></LI>
-<LI><A HREF="#15_5_4">Untar, unzip</A></LI>
-<LI><A HREF="#15_5_5">Patch if desired</A></LI>
-<LI><A HREF="#15_5_6">... and Make</A></LI>
-<UL>
-<LI><A HREF="#15_5_6_1">Userland-only Install for 2.6 kernels</A></LI>
-<LI><A HREF="#15_5_6_2">KLIPS install for 2.2, 2.4, or 2.6 kernels</A></LI>
-</UL>
-</UL>
-<LI><A HREF="#15_6">Start FreeS/WAN and test your install</A></LI>
-<LI><A HREF="#15_7">Test your install</A></LI>
-<LI><A HREF="#15_8">Making FreeS/WAN play well with others</A></LI>
-<LI><A HREF="#15_9">Configure for your needs</A></LI>
-</UL>
-<B><A HREF="#config">How to configure FreeS/WAN</A></B>
-<UL>
-<LI><A HREF="#16_1">Requirements</A></LI>
-<LI><A HREF="#config.netnet">Net-to-Net connection</A></LI>
-<UL>
-<LI><A HREF="#netnet.info.ex">Gather information</A></LI>
-<UL>
-<LI><A HREF="#16_2_1_1">Get your leftrsasigkey</A></LI>
-<LI><A HREF="#16_2_1_2">...and your rightrsasigkey</A></LI>
-</UL>
-<LI><A HREF="#16_2_2">Edit /etc/ipsec.conf</A></LI>
-<LI><A HREF="#16_2_3">Start your connection</A></LI>
-<LI><A HREF="#16_2_4">Do not MASQ or NAT packets to be tunneled</A></LI>
-<LI><A HREF="#16_2_5">Test your connection</A></LI>
-<LI><A HREF="#16_2_6">Finishing touches</A></LI>
-</UL>
-<LI><A HREF="#config.rw">Road Warrior Configuration</A></LI>
-<UL>
-<LI><A HREF="#rw.info.ex">Gather information</A></LI>
-<UL>
-<LI><A HREF="#16_3_1_1">Get your leftrsasigkey...</A></LI>
-<LI><A HREF="#16_3_1_2">...and your rightrsasigkey</A></LI>
-</UL>
-<LI><A HREF="#16_3_2">Customize /etc/ipsec.conf</A></LI>
-<LI><A HREF="#16_3_3">Start your connection</A></LI>
-<LI><A HREF="#16_3_4">Do not MASQ or NAT packets to be tunneled</A></LI>
-<LI><A HREF="#16_3_5">Test your connection</A></LI>
-<LI><A HREF="#16_3_6">Finishing touches</A></LI>
-<LI><A HREF="#16_3_7">Multiple Road Warriors</A></LI>
-</UL>
-<LI><A HREF="#16_4">What next?</A></LI>
-</UL>
-<B><A HREF="#background">Linux FreeS/WAN background</A></B>
-<UL>
-<LI><A HREF="#dns.background">Some DNS background</A></LI>
-<UL>
-<LI><A HREF="#forward.reverse">Forward and reverse maps</A></LI>
-<LI><A HREF="#17_1_2">Hierarchy and delegation</A></LI>
-<LI><A HREF="#17_1_3">Syntax of DNS records</A></LI>
-<LI><A HREF="#17_1_4">Cacheing, TTL and propagation delay</A></LI>
-</UL>
-<LI><A HREF="#MTU.trouble">Problems with packet fragmentation</A></LI>
-<LI><A HREF="#nat.background">Network address translation (NAT)</A></LI>
-<UL>
-<LI><A HREF="#17_3_1">NAT to non-routable addresses</A></LI>
-<LI><A HREF="#17_3_2">NAT to routable addresses</A></LI>
-</UL>
-</UL>
-<B><A HREF="#user.examples">FreeS/WAN script examples</A></B>
-<UL>
-<LI><A HREF="#poltorak">Poltorak's Firewall script</A></LI>
-</UL>
-<B><A HREF="#makecheck">How to configure to use &quot;make check&quot;</A></B>
-<UL>
-<LI><A HREF="#19_1">What is &quot;make check&quot;</A></LI>
-<LI><A HREF="#19_2">Running &quot;make check&quot;</A></LI>
-</UL>
-<B><A HREF="#20">How to write a &quot;make check&quot; test</A></B>
-<UL>
-<LI><A HREF="#20_1">Structure of a test</A></LI>
-<LI><A HREF="#20_2">The TESTLIST</A></LI>
-<LI><A HREF="#20_3">Test kinds</A></LI>
-<LI><A HREF="#20_4">Common parameters</A></LI>
-<LI><A HREF="#20_5">KLIPStest paramaters</A></LI>
-<LI><A HREF="#20_6">mkinsttest paramaters</A></LI>
-<LI><A HREF="#20_7">rpm_build_install_test paramaters</A></LI>
-<LI><A HREF="#20_8">libtest paramaters</A></LI>
-<LI><A HREF="#20_9">umlplutotest paramaters</A></LI>
-<LI><A HREF="#20_10">umlXhost parameters</A></LI>
-<LI><A HREF="#20_11">kernel_patch_test paramaters</A></LI>
-<LI><A HREF="#20_12">module_compile paramaters</A></LI>
-</UL>
-<B><A HREF="#21">Current pitfalls</A></B>
-<BR>
-<BR><B><A HREF="#umltesting">User-Mode-Linux Testing guide</A></B>
-<UL>
-<LI><A HREF="#22_1">Preliminary Notes on BIND</A></LI>
-<LI><A HREF="#22_2">Steps to Install UML for FreeS/WAN</A></LI>
-</UL>
-<B><A HREF="#23">Debugging the kernel with GDB</A></B>
-<UL>
-<LI><A HREF="#23_1">Other notes about debugging</A></LI>
-</UL>
-<B><A HREF="#24">User-Mode-Linux mysteries</A></B>
-<BR>
-<BR><B><A HREF="#25">Getting more info from uml_netjig</A></B>
-<BR>
-<BR><B><A HREF="#politics">History and politics of cryptography</A></B>
-<UL>
-<LI><A HREF="#intro.politics">Introduction</A></LI>
-<UL>
-<LI><A HREF="#26_1_1">History</A></LI>
-<UL>
-<LI><A HREF="#26_1_1_1">World War II</A></LI>
-<LI><A HREF="#postwar">Postwar and Cold War</A></LI>
-<LI><A HREF="#recent">Recent history -- the crypto wars</A></LI>
-</UL>
-<LI><A HREF="#intro.poli">Politics</A></LI>
-<LI><A HREF="#26_1_3">Links</A></LI>
-<LI><A HREF="#26_1_4">Outline of this section</A></LI>
-</UL>
-<LI><A HREF="#leader">From our project leader</A></LI>
-<UL>
-<LI><A HREF="#gilmore">Swan: Securing the Internet against Wiretapping</A>
-</LI>
-<UL>
-<LI><A HREF="#26_2_1_1">Deployment of IPSEC</A></LI>
-<LI><A HREF="#26_2_1_2">Current status</A></LI>
-<LI><A HREF="#26_2_1_3">Why?</A></LI>
-<LI><A HREF="#26_2_1_4">What You Can Do</A></LI>
-<LI><A HREF="#26_2_1_5">Related projects</A></LI>
-</UL>
-<LI><A HREF="#policestate">Stopping wholesale monitoring</A></LI>
-</UL>
-<LI><A HREF="#weak">Government promotion of weak crypto</A></LI>
-<UL>
-<LI><A HREF="#escrow">Escrowed encryption</A></LI>
-<LI><A HREF="#shortkeys">Limited key lengths</A></LI>
-<UL>
-<LI><A HREF="#26_3_2_1">Some real trade-offs</A></LI>
-</UL>
-</UL>
-<LI><A HREF="#exlaw">Cryptography Export Laws</A></LI>
-<UL>
-<LI><A HREF="#USlaw">US Law</A></LI>
-<UL>
-<LI><A HREF="#UScontrib">US contributions to FreeS/WAN</A></LI>
-</UL>
-<LI><A HREF="#wrong">What's wrong with restrictions on cryptography</A></LI>
-<LI><A HREF="#Wassenaar">The Wassenaar Arrangement</A></LI>
-<LI><A HREF="#status">Export status of Linux FreeS/WAN</A></LI>
-<LI><A HREF="#help">Help spread IPsec around</A></LI>
-</UL>
-<LI><A HREF="#desnotsecure">DES is Not Secure</A></LI>
-<UL>
-<LI><A HREF="#deshware">Dedicated hardware breaks DES in a few days</A></LI>
-<LI><A HREF="#spooks">Spooks may break DES faster yet</A></LI>
-<LI><A HREF="#desnet">Networks break DES in a few weeks</A></LI>
-<LI><A HREF="#no_des">We disable DES</A></LI>
-<LI><A HREF="#40joke">40-bits is laughably weak</A></LI>
-<LI><A HREF="#altdes">Triple DES is almost certainly secure</A></LI>
-<LI><A HREF="#aes.ipsec">AES in IPsec</A></LI>
-</UL>
-<LI><A HREF="#press">Press coverage of Linux FreeS/WAN:</A></LI>
-<UL>
-<LI><A HREF="#26_6_1">FreeS/WAN 1.0 press</A></LI>
-<LI><A HREF="#release">Press release for version 1.0</A></LI>
-</UL>
-</UL>
-<B><A HREF="#ipsec.detail">The IPsec protocols</A></B>
-<UL>
-<LI><A HREF="#27_1">Protocols and phases</A></LI>
-<LI><A HREF="#others">Applying IPsec</A></LI>
-<UL>
-<LI><A HREF="#advantages">Advantages of IPsec</A></LI>
-<LI><A HREF="#limitations">Limitations of IPsec</A></LI>
-<LI><A HREF="#uses">IPsec is a general mechanism for securing IP</A></LI>
-<LI><A HREF="#authonly">Using authentication without encryption</A></LI>
-<LI><A HREF="#encnoauth">Encryption without authentication is dangerous</A>
-</LI>
-<LI><A HREF="#multilayer">Multiple layers of IPsec processing are
- possible</A></LI>
-<LI><A HREF="#traffic.resist">Resisting traffic analysis</A></LI>
-<UL>
-<LI><A HREF="#extra">Using &quot;unnecessary&quot; encryption</A></LI>
-<LI><A HREF="#multi-encrypt">Using multiple encryption</A></LI>
-<LI><A HREF="#fewer">Using fewer tunnels</A></LI>
-</UL>
-</UL>
-<LI><A HREF="#primitives">Cryptographic components</A></LI>
-<UL>
-<LI><A HREF="#block.cipher">Block ciphers</A></LI>
-<LI><A HREF="#hash.ipsec">Hash functions</A></LI>
-<UL>
-<LI><A HREF="#hmac.ipsec">The HMAC construct</A></LI>
-<LI><A HREF="#27_3_2_2">Choice of hash algorithm</A></LI>
-</UL>
-<LI><A HREF="#DH.keying">Diffie-Hellman key agreement</A></LI>
-<LI><A HREF="#RSA.auth">RSA authentication</A></LI>
-</UL>
-<LI><A HREF="#structure">Structure of IPsec</A></LI>
-<UL>
-<LI><A HREF="#IKE.ipsec">IKE (Internet Key Exchange)</A></LI>
-<UL>
-<LI><A HREF="#phases">Phases of IKE</A></LI>
-<LI><A HREF="#sequence">Sequence of messages in IKE</A></LI>
-<LI><A HREF="#struct.exchange">Structure of IKE messages</A></LI>
-</UL>
-<LI><A HREF="#services">IPsec Services, AH and ESP</A></LI>
-<LI><A HREF="#AH.ipsec">The Authentication Header (AH)</A></LI>
-<UL>
-<LI><A HREF="#keyed">Keyed MD5 and Keyed SHA</A></LI>
-<LI><A HREF="#sequence">Sequence numbers</A></LI>
-</UL>
-<LI><A HREF="#ESP.ipsec">Encapsulated Security Payload (ESP)</A></LI>
-</UL>
-<LI><A HREF="#modes">IPsec modes</A></LI>
-<UL>
-<LI><A HREF="#tunnel.ipsec">Tunnel mode</A></LI>
-<LI><A HREF="#transport.ipsec">Transport mode</A></LI>
-</UL>
-<LI><A HREF="#parts">FreeS/WAN parts</A></LI>
-<UL>
-<LI><A HREF="#KLIPS.ipsec">KLIPS: Kernel IPsec Support</A></LI>
-<LI><A HREF="#Pluto.ipsec">The Pluto daemon</A></LI>
-<LI><A HREF="#command">The ipsec(8) command</A></LI>
-<LI><A HREF="#ipsec.conf">Linux FreeS/WAN configuration file</A></LI>
-</UL>
-<LI><A HREF="#key">Key management</A></LI>
-<UL>
-<LI><A HREF="#current">Currently Implemented Methods</A></LI>
-<UL>
-<LI><A HREF="#manual">Manual keying</A></LI>
-<LI><A HREF="#auto">Automatic keying</A></LI>
-</UL>
-<LI><A HREF="#notyet">Methods not yet implemented</A></LI>
-<UL>
-<LI><A HREF="#noauth">Unauthenticated key exchange</A></LI>
-<LI><A HREF="#DNS">Key exchange using DNS</A></LI>
-<LI><A HREF="#PKI">Key exchange using a PKI</A></LI>
-<LI><A HREF="#photuris">Photuris</A></LI>
-<LI><A HREF="#skip">SKIP</A></LI>
-</UL>
-</UL>
-</UL>
-<B><A HREF="#lists">Mailing lists and newsgroups</A></B>
-<UL>
-<LI><A HREF="#list.fs">Mailing lists about FreeS/WAN</A></LI>
-<UL>
-<LI><A HREF="#projlist">The project mailing lists</A></LI>
-<UL>
-<LI><A HREF="#which.list">Which list should I use?</A></LI>
-<LI><A HREF="#policy.list">List policies</A></LI>
-</UL>
-<LI><A HREF="#archive">Archives of the lists</A></LI>
-</UL>
-<LI><A HREF="#indexes">Indexes of mailing lists</A></LI>
-<LI><A HREF="#otherlists">Lists for related software and topics</A></LI>
-<UL>
-<LI><A HREF="#28_3_1">Products that include FreeS/WAN</A></LI>
-<LI><A HREF="#linux.lists">Linux mailing lists</A></LI>
-<LI><A HREF="#ietf">Lists for IETF working groups</A></LI>
-<LI><A HREF="#other">Other mailing lists</A></LI>
-</UL>
-<LI><A HREF="#newsgroups">Usenet newsgroups</A></LI>
-</UL>
-<B><A HREF="#weblink">Web links</A></B>
-<UL>
-<LI><A HREF="#freeswan">The Linux FreeS/WAN Project</A></LI>
-<UL>
-<LI><A HREF="#patch">Add-ons and patches for FreeS/WAN</A></LI>
-<UL>
-<LI><A HREF="#29_1_1_1">Current patches</A></LI>
-<LI><A HREF="#29_1_1_2">Older patches</A></LI>
-<LI><A HREF="#VPN.masq">VPN masquerade patches</A></LI>
-</UL>
-<LI><A HREF="#dist">Distributions including FreeS/WAN</A></LI>
-<LI><A HREF="#used">Things FreeS/WAN uses or could use</A></LI>
-<LI><A HREF="#alternatives">Other approaches to VPNs for Linux</A></LI>
-</UL>
-<LI><A HREF="#ipsec.link">The IPsec Protocols</A></LI>
-<UL>
-<LI><A HREF="#general">General IPsec or VPN information</A></LI>
-<LI><A HREF="#overview">IPsec overview documents or slide sets</A></LI>
-<LI><A HREF="#otherlang">IPsec information in languages other than
- English</A></LI>
-<LI><A HREF="#RFCs1">RFCs and other reference documents</A></LI>
-<LI><A HREF="#analysis">Analysis and critiques of IPsec protocols</A></LI>
-<LI><A HREF="#IP.background">Background information on IP</A></LI>
-</UL>
-<LI><A HREF="#implement">IPsec Implementations</A></LI>
-<UL>
-<LI><A HREF="#linuxprod">Linux products</A></LI>
-<LI><A HREF="#router">IPsec in router products</A></LI>
-<LI><A HREF="#fw.web">IPsec in firewall products</A></LI>
-<LI><A HREF="#ipsecos">Operating systems with IPsec support</A></LI>
-<LI><A HREF="#29_3_5">IPsec on network cards</A></LI>
-<LI><A HREF="#opensource">Open source IPsec implementations</A></LI>
-<UL>
-<LI><A HREF="#linuxipsec">Other Linux IPsec implementations</A></LI>
-<LI><A HREF="#BSD">IPsec for BSD Unix</A></LI>
-<LI><A HREF="#misc">IPsec for other systems</A></LI>
-</UL>
-<LI><A HREF="#interop.web">Interoperability</A></LI>
-<UL>
-<LI><A HREF="#result">Interoperability results</A></LI>
-<LI><A HREF="#test1">Interoperability test sites</A></LI>
-</UL>
-</UL>
-<LI><A HREF="#linux.link">Linux links</A></LI>
-<UL>
-<LI><A HREF="#linux.basic">Basic and tutorial Linux information</A></LI>
-<LI><A HREF="#general">General Linux sites</A></LI>
-<LI><A HREF="#docs.ldp">Documentation</A></LI>
-<LI><A HREF="#advroute.web">Advanced routing</A></LI>
-<LI><A HREF="#linsec">Security for Linux</A></LI>
-<LI><A HREF="#firewall.linux">Linux firewalls</A></LI>
-<LI><A HREF="#linux.misc">Miscellaneous Linux information</A></LI>
-</UL>
-<LI><A HREF="#crypto.link">Crypto and security links</A></LI>
-<UL>
-<LI><A HREF="#security">Crypto and security resources</A></LI>
-<UL>
-<LI><A HREF="#std.links">The standard link collections</A></LI>
-<LI><A HREF="#FAQ">Frequently Asked Question (FAQ) documents</A></LI>
-<LI><A HREF="#cryptover">Tutorials</A></LI>
-<LI><A HREF="#standards">Crypto and security standards</A></LI>
-<LI><A HREF="#quotes">Crypto quotes</A></LI>
-</UL>
-<LI><A HREF="#policy">Cryptography law and policy</A></LI>
-<UL>
-<LI><A HREF="#legal">Surveys of crypto law</A></LI>
-<LI><A HREF="#oppose">Organisations opposing crypto restrictions</A></LI>
-<LI><A HREF="#other.policy">Other information on crypto policy</A></LI>
-</UL>
-<LI><A HREF="#crypto.tech">Cryptography technical information</A></LI>
-<UL>
-<LI><A HREF="#cryptolinks">Collections of crypto links</A></LI>
-<LI><A HREF="#papers">Lists of online cryptography papers</A></LI>
-<LI><A HREF="#interesting">Particularly interesting papers</A></LI>
-</UL>
-<LI><A HREF="#compsec">Computer and network security</A></LI>
-<UL>
-<LI><A HREF="#seclink">Security links</A></LI>
-<LI><A HREF="#firewall.web">Firewall links</A></LI>
-<LI><A HREF="#vpn">VPN links</A></LI>
-<LI><A HREF="#tools">Security tools</A></LI>
-</UL>
-<LI><A HREF="#people">Links to home pages</A></LI>
-</UL>
-</UL>
-<B><A HREF="#ourgloss">Glossary for the Linux FreeS/WAN project</A></B>
-<UL>
-<LI><A HREF="#jump">Jump to a letter in the glossary</A></LI>
-<LI><A HREF="#gloss">Other glossaries</A></LI>
-<LI><A HREF="#definitions">Definitions</A></LI>
-</UL>
-<B><A HREF="#biblio">Bibliography for the Linux FreeS/WAN project</A></B>
-<BR>
-<BR><B><A HREF="#RFC">IPsec RFCs and related documents</A></B>
-<UL>
-<LI><A HREF="#RFCfile">The RFCs.tar.gz Distribution File</A></LI>
-<LI><A HREF="#sources">Other sources for RFCs &amp; Internet drafts</A></LI>
-<UL>
-<LI><A HREF="#RFCdown">RFCs</A></LI>
-<LI><A HREF="#drafts">Internet Drafts</A></LI>
-<LI><A HREF="#FIPS1">FIPS standards</A></LI>
-</UL>
-<LI><A HREF="#RFCs.tar.gz">What's in the RFCs.tar.gz bundle?</A></LI>
-<UL>
-<LI><A HREF="#rfc.ov">Overview RFCs</A></LI>
-<LI><A HREF="#basic.prot">Basic protocols</A></LI>
-<LI><A HREF="#key.ike">Key management</A></LI>
-<LI><A HREF="#rfc.detail">Details of various things used</A></LI>
-<LI><A HREF="#rfc.ref">Older RFCs which may be referenced</A></LI>
-<LI><A HREF="#rfc.dns">RFCs for secure DNS service, which IPsec may use</A>
-</LI>
-<LI><A HREF="#rfc.exp">RFCs labelled &quot;experimental&quot;</A></LI>
-<LI><A HREF="#rfc.rel">Related RFCs</A></LI>
-</UL>
-</UL>
-<B><A HREF="#roadmap">Distribution Roadmap: What's Where in Linux
- FreeS/WAN</A></B>
-<UL>
-<LI><A HREF="#top">Top directory</A></LI>
-<LI><A HREF="#doc">Documentation</A></LI>
-<LI><A HREF="#klips.roadmap">KLIPS: kernel IP security</A></LI>
-<LI><A HREF="#pluto.roadmap">Pluto key and connection management daemon</A>
-</LI>
-<LI><A HREF="#utils">Utils</A></LI>
-<LI><A HREF="#lib">Libraries</A></LI>
-<UL>
-<LI><A HREF="#fswanlib">FreeS/WAN Library</A></LI>
-<LI><A HREF="#otherlib">Imported Libraries</A></LI>
-<UL>
-<LI><A HREF="#33_6_2_1">LibDES</A></LI>
-<LI><A HREF="#33_6_2_2">GMP</A></LI>
-</UL>
-</UL>
-</UL>
-<B><A HREF="#umltesting">User-Mode-Linux Testing guide</A></B>
-<UL>
-<LI><A HREF="#34_1">Preliminary Notes on BIND</A></LI>
-<LI><A HREF="#34_2">Steps to Install UML for FreeS/WAN</A></LI>
-</UL>
-<B><A HREF="#35">Debugging the kernel with GDB</A></B>
-<UL>
-<LI><A HREF="#35_1">Other notes about debugging</A></LI>
-</UL>
-<B><A HREF="#36">User-Mode-Linux mysteries</A></B>
-<BR>
-<BR><B><A HREF="#37">Getting more info from uml_netjig</A></B>
-<BR>
-<BR><B><A HREF="#makecheck">How to configure to use &quot;make check&quot;</A></B>
-<UL>
-<LI><A HREF="#38_1">What is &quot;make check&quot;</A></LI>
-<LI><A HREF="#38_2">Running &quot;make check&quot;</A></LI>
-</UL>
-<B><A HREF="#39">How to write a &quot;make check&quot; test</A></B>
-<UL>
-<LI><A HREF="#39_1">Structure of a test</A></LI>
-<LI><A HREF="#39_2">The TESTLIST</A></LI>
-<LI><A HREF="#39_3">Test kinds</A></LI>
-<LI><A HREF="#39_4">Common parameters</A></LI>
-<LI><A HREF="#39_5">KLIPStest paramaters</A></LI>
-<LI><A HREF="#39_6">mkinsttest paramaters</A></LI>
-<LI><A HREF="#39_7">rpm_build_install_test paramaters</A></LI>
-<LI><A HREF="#39_8">libtest paramaters</A></LI>
-<LI><A HREF="#39_9">umlplutotest paramaters</A></LI>
-<LI><A HREF="#39_10">umlXhost parameters</A></LI>
-<LI><A HREF="#39_11">kernel_patch_test paramaters</A></LI>
-<LI><A HREF="#39_12">module_compile paramaters</A></LI>
-</UL>
-<B><A HREF="#40">Current pitfalls</A></B>
-<BR>
-<BR><B><A HREF="#nightly">Nightly regression testing</A></B>
-<BR>
-<BR><B><A HREF="#nightlyhowto">How to setup the nightly build</A></B>
-<UL>
-<LI><A HREF="#42_1"> Files you need to know about</A></LI>
-<LI><A HREF="#42_2">Configuring freeswan-regress-env.sh</A></LI>
-</UL>
-<HR>
-<H1><A name="intro">Introduction</A></H1>
-<P>This section gives an overview of:</P>
-<UL>
-<LI>what IP Security (IPsec) does</LI>
-<LI>how IPsec works</LI>
-<LI>why we are implementing it for Linux</LI>
-<LI>how this implementation works</LI>
-</UL>
-<P>This section is intended to cover only the essentials,<EM> things you
- should know before trying to use FreeS/WAN.</EM></P>
-<P>For more detailed background information, see the<A href="#politics">
- history and politics</A> and<A href="#ipsec.detail"> IPsec protocols</A>
- sections.</P>
-<H2><A name="ipsec.intro">IPsec, Security for the Internet Protocol</A></H2>
-<P>FreeS/WAN is a Linux implementation of the IPsec (IP security)
- protocols. IPsec provides<A href="#encryption"> encryption</A> and<A href="#authentication">
- authentication</A> services at the IP (Internet Protocol) level of the
- network protocol stack.</P>
-<P>Working at this level, IPsec can protect any traffic carried over IP,
- unlike other encryption which generally protects only a particular
- higher-level protocol --<A href="#PGP"> PGP</A> for mail,<A href="#ssh">
- SSH</A> for remote login,<A href="#SSL"> SSL</A> for web work, and so
- on. This approach has both considerable advantages and some
- limitations. For discussion, see our<A href="#others"> IPsec section</A>
-</P>
-<P>IPsec can be used on any machine which does IP networking. Dedicated
- IPsec gateway machines can be installed wherever required to protect
- traffic. IPsec can also run on routers, on firewall machines, on
- various application servers, and on end-user desktop or laptop
- machines.</P>
-<P>Three protocols are used</P>
-<UL>
-<LI><A href="#AH">AH</A> (Authentication Header) provides a packet-level
- authentication service</LI>
-<LI><A href="#ESP">ESP</A> (Encapsulating Security Payload) provides
- encryption plus authentication</LI>
-<LI><A href="#IKE">IKE</A> (Internet Key Exchange) negotiates connection
- parameters, including keys, for the other two</LI>
-</UL>
-<P>Our implementation has three main parts:</P>
-<UL>
-<LI><A href="#KLIPS">KLIPS</A> (kernel IPsec) implements AH, ESP, and
- packet handling within the kernel</LI>
-<LI><A href="#Pluto">Pluto</A> (an IKE daemon) implements IKE,
- negotiating connections with other systems</LI>
-<LI>various scripts provide an adminstrator's interface to the machinery</LI>
-</UL>
-<P>IPsec is optional for the current (version 4) Internet Protocol.
- FreeS/WAN adds IPsec to the Linux IPv4 network stack. Implementations
- of<A href="#ipv6.gloss"> IP version 6</A> are required to include
- IPsec. Work toward integrating FreeS/WAN into the Linux IPv6 stack has<A
-href="#ipv6"> started</A>.</P>
-<P>For more information on IPsec, see our<A href="#ipsec.detail"> IPsec
- protocols</A> section, our collection of<A href="#ipsec.link"> IPsec
- links</A> or the<A href="#RFC"> RFCs</A> which are the official
- definitions of these protocols.</P>
-<H3><A name="intro.interop">Interoperating with other IPsec
- implementations</A></H3>
-<P>IPsec is designed to let different implementations work together. We
- provide:</P>
-<UL>
-<LI>a<A href="#implement"> list</A> of some other implementations</LI>
-<LI>information on<A href="#interop"> using FreeS/WAN with other
- implementations</A></LI>
-</UL>
-<P>The VPN Consortium fosters cooperation among implementers and
- interoperability among implementations. Their<A href="http://www.vpnc.org/">
- web site</A> has much more information.</P>
-<H3><A name="advantages">Advantages of IPsec</A></H3>
-<P>IPsec has a number of security advantages. Here are some
- independently written articles which discuss these:</P>
-<P><A HREF="http://www.sans.org/rr/"> SANS institute papers</A>. See the
- section on Encryption &amp;VPNs.
-<BR><A HREF="http://www.cisco.com/en/US/netsol/ns110/ns170/ns171/ns128/networking_solutions_white_papers_list.html">
- Cisco's white papers on &quot;Networking Solutions&quot;</A>.
-<BR><A HREF="http://iscs.sourceforge.net/HowWhyBrief/HowWhyBrief.html">
- Advantages of ISCS (Linux Integrated Secure Communications System;
- includes FreeS/WAN and other software)</A>.</P>
-<H3><A name="applications">Applications of IPsec</A></H3>
-<P>Because IPsec operates at the network layer, it is remarkably
- flexible and can be used to secure nearly any type of Internet traffic.
- Two applications, however, are extremely widespread:</P>
-<UL>
-<LI>a<A href="#VPN"> Virtual Private Network</A>, or VPN, allows
- multiple sites to communicate securely over an insecure Internet by
- encrypting all communication between the sites.</LI>
-<LI>&quot;Road Warriors&quot; connect to the office from home, or perhaps from a
- hotel somewhere</LI>
-</UL>
-<P>There is enough opportunity in these applications that vendors are
- flocking to them. IPsec is being built into routers, into firewall
- products, and into major operating systems, primarily to support these
- applications. See our<A href="#implement"> list</A> of implementations
- for details.</P>
-<P>We support both of those applications, and various less common IPsec
- applications as well, but we also add one of our own:</P>
-<UL>
-<LI>opportunistic encryption, the ability to set up FreeS/WAN gateways
- so that any two of them can encrypt to each other, and will do so
- whenever packets pass between them.</LI>
-</UL>
-<P>This is an extension we are adding to the protocols. FreeS/WAN is the
- first prototype implementation, though we hope other IPsec
- implementations will adopt the technique once we demonstrate it. See<A href="#goals">
- project goals</A> below for why we think this is important.</P>
-<P>A somewhat more detailed description of each of these applications is
- below. Our<A href="#quick_guide"> quickstart</A> section will show you
- how to build each of them.</P>
-<H4><A name="makeVPN">Using secure tunnels to create a VPN</A></H4>
-<P>A VPN, or<STRONG> V</STRONG>irtual<STRONG> P</STRONG>rivate<STRONG> N</STRONG>
-etwork lets two networks communicate securely when the only connection
- between them is over a third network which they do not trust.</P>
-<P>The method is to put a security gateway machine between each of the
- communicating networks and the untrusted network. The gateway machines
- encrypt packets entering the untrusted net and decrypt packets leaving
- it, creating a secure tunnel through it.</P>
-<P>If the cryptography is strong, the implementation is careful, and the
- administration of the gateways is competent, then one can reasonably
- trust the security of the tunnel. The two networks then behave like a
- single large private network, some of whose links are encrypted tunnels
- through untrusted nets.</P>
-<P>Actual VPNs are often more complex. One organisation may have fifty
- branch offices, plus some suppliers and clients, with whom it needs to
- communicate securely. Another might have 5,000 stores, or 50,000
- point-of-sale devices. The untrusted network need not be the Internet.
- All the same issues arise on a corporate or institutional network
- whenever two departments want to communicate privately with each other.</P>
-<P>Administratively, the nice thing about many VPN setups is that large
- parts of them are static. You know the IP addresses of most of the
- machines involved. More important, you know they will not change on
- you. This simplifies some of the admin work. For cases where the
- addresses do change, see the next section.</P>
-<H4><A name="road.intro">Road Warriors</A></H4>
-<P>The prototypical &quot;Road Warrior&quot; is a traveller connecting to home
- base from a laptop machine. Administratively, most of the same problems
- arise for a telecommuter connecting from home to the office, especially
- if the telecommuter does not have a static IP address.</P>
-<P>For purposes of this document:</P>
-<UL>
-<LI>anyone with a dynamic IP address is a &quot;Road Warrior&quot;.</LI>
-<LI>any machine doing IPsec processing is a &quot;gateway&quot;. Think of the
- single-user road warrior machine as a gateway with a degenerate subnet
- (one machine, itself) behind it.</LI>
-</UL>
-<P>These require somewhat different setup than VPN gateways with static
- addresses and with client systems behind them, but are basically not
- problematic.</P>
-<P>There are some difficulties which appear for some road warrior
- connections:</P>
-<UL>
-<LI>Road Wariors who get their addresses via DHCP may have a problem.
- FreeS/WAN can quite happily build and use a tunnel to such an address,
- but when the DHCP lease expires, FreeS/WAN does not know that. The
- tunnel fails, and the only recovery method is to tear it down and
- re-build it.</LI>
-<LI>If<A href="#NAT.gloss"> Network Address Translation</A> (NAT) is
- applied between the two IPsec Gateways, this breaks IPsec. IPsec
- authenticates packets on an end-to-end basis, to ensure they are not
- altered en route. NAT rewrites packets as they go by. See our<A href="#NAT">
- firewalls</A> document for details.</LI>
-</UL>
-<P>In most situations, however, FreeS/WAN supports road warrior
- connections just fine.</P>
-<H4><A name="opp.intro">Opportunistic encryption</A></H4>
-<P>One of the reasons we are working on FreeS/WAN is that it gives us
- the opportunity to add what we call opportuntistic encryption. This
- means that any two FreeS/WAN gateways will be able to encrypt their
- traffic, even if the two gateway administrators have had no prior
- contact and neither system has any preset information about the other.</P>
-<P>Both systems pick up the authentication information they need from
- the<A href="#DNS"> DNS</A> (domain name service), the service they
- already use to look up IP addresses. Of course the administrators must
- put that information in the DNS, and must set up their gateways with
- opportunistic encryption enabled. Once that is done, everything is
- automatic. The gateways look for opportunities to encrypt, and encrypt
- whatever they can. Whether they also accept unencrypted communication
- is a policy decision the administrator can make.</P>
-<P>This technique can give two large payoffs:</P>
-<UL>
-<LI>It reduces the administrative overhead for IPsec enormously. You
- configure your gateway and thereafter everything is automatic. The need
- to configure the system on a per-tunnel basis disappears. Of course,
- FreeS/WAN allows specifically configured tunnels to co-exist with
- opportunistic encryption, but we hope to make them unnecessary in most
- cases.</LI>
-<LI>It moves us toward a more secure Internet, allowing users to create
- an environment where message privacy is the default. All messages can
- be encrypted, provided the other end is willing to co-operate. See our<A
-href="#politics"> history and politics of cryptography</A> section for
- discussion of why we think this is needed.</LI>
-</UL>
-<P>Opportunistic encryption is not (yet?) a standard part of the IPsec
- protocols, but an extension we are proposing and demonstrating. For
- details of our design, see<A href="#applied"> links</A> below.</P>
-<P>Only one current product we know of implements a form of
- opportunistic encryption.<A href="#ssmail"> Secure sendmail</A> will
- automatically encrypt server-to-server mail transfers whenever
- possible.</P>
-<H3><A name="types">The need to authenticate gateways</A></H3>
-<P>A complication, which applies to any type of connection -- VPN, Road
- Warrior or opportunistic -- is that a secure connection cannot be
- created magically.<EM> There must be some mechanism which enables the
- gateways to reliably identify each other.</EM> Without this, they
- cannot sensibly trust each other and cannot create a genuinely secure
- link.</P>
-<P>Any link they do create without some form of<A href="#authentication">
- authentication</A> will be vulnerable to a<A href="#middle">
- man-in-the-middle attack</A>. If<A href="#alicebob"> Alice and Bob</A>
- are the people creating the connection, a villian who can re-route or
- intercept the packets can pose as Alice while talking to Bob and pose
- as Bob while talking to Alice. Alice and Bob then both talk to the man
- in the middle, thinking they are talking to each other, and the villain
- gets everything sent on the bogus &quot;secure&quot; connection.</P>
-<P>There are two ways to build links securely, both of which exclude the
- man-in-the middle:</P>
-<UL>
-<LI>with<STRONG> manual keying</STRONG>, Alice and Bob share a secret
- key (which must be transmitted securely, perhaps in a note or via PGP
- or SSH) to encrypt their messages. For FreeS/WAN, such keys are stored
- in the<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A> file. Of
- course, if an enemy gets the key, all is lost.</LI>
-<LI>with<STRONG> automatic keying</STRONG>, the two systems authenticate
- each other and negotiate their own secret keys. The keys are
- automatically changed periodically.</LI>
-</UL>
-<P>Automatic keying is much more secure, since if an enemy gets one key
- only messages between the previous re-keying and the next are exposed.
- It is therefore the usual mode of operation for most IPsec deployment,
- and the mode we use in our setup examples. FreeS/WAN does support
- manual keying for special circumstanes. See this<A href="#prodman">
- section</A>.</P>
-<P>For automatic keying, the two systems must authenticate each other
- during the negotiations. There is a choice of methods for this:</P>
-<UL>
-<LI>a<STRONG> shared secret</STRONG> provides authentication. If Alice
- and Bob are the only ones who know a secret and Alice recives a message
- which could not have been created without that secret, then Alice can
- safely believe the message came from Bob.</LI>
-<LI>a<A href="#public"> public key</A> can also provide authentication.
- If Alice receives a message signed with Bob's private key (which of
- course only he should know) and she has a trustworthy copy of his
- public key (so that she can verify the signature), then she can safely
- believe the message came from Bob.</LI>
-</UL>
-<P>Public key techniques are much preferable, for reasons discussed<A href="#choose">
- later</A>, and will be used in all our setup examples. FreeS/WAN does
- also support auto-keying with shared secret authentication. See this<A href="#prodsecrets">
- section</A>.</P>
-<H2><A name="project">The FreeS/WAN project</A></H2>
-<P>For complete information on the project, see our web site,<A href="http://liberty.freeswan.org">
- freeswan.org</A>.</P>
-<P>In summary, we are implementing the<A href="#IPSEC"> IPsec</A>
- protocols for Linux and extending them to do<A href="#carpediem">
- opportunistic encryption</A>.</P>
-<H3><A name="goals">Project goals</A></H3>
-<P>Our overall goal in FreeS/WAN is to make the Internet more secure and
- more private.</P>
-<P>Our IPsec implementation supports VPNs and Road Warriors of course.
- Those are important applications. Many users will want FreeS/WAN to
- build corporate VPNs or to provide secure remote access.</P>
-<P>However, our goals in building it go beyond that. We are trying to
- help<STRONG> build security into the fabric of the Internet</STRONG> so
- that anyone who choses to communicate securely can do so, as easily as
- they can do anything else on the net.</P>
-<P>More detailed objectives are:</P>
-<UL>
-<LI>extend IPsec to do<A href="#carpediem"> opportunistic encryption</A>
- so that
-<UL>
-<LI>any two systems can secure their communications without a
- pre-arranged connection</LI>
-<LI><STRONG>secure connections can be the default</STRONG>, falling back
- to unencrypted connections only if:
-<UL>
-<LI><EM>both</EM> the partner is not set up to co-operate on securing
- the connection</LI>
-<LI><EM>and</EM> your policy allows insecure connections</LI>
-</UL>
-</LI>
-<LI>a significant fraction of all Internet traffic is encrypted</LI>
-<LI>wholesale monitoring of the net (<A href="#intro.poli">examples</A>)
- becomes difficult or impossible</LI>
-</UL>
-</LI>
-<LI>help make IPsec widespread by providing an implementation with no
- restrictions:
-<UL>
-<LI>freely available in source code under the<A href="#GPL"> GNU General
- Public License</A></LI>
-<LI>running on a range of readily available hardware</LI>
-<LI>not subject to US or other nations'<A href="#exlaw"> export
- restrictions</A>.
-<BR> Note that in order to avoid<EM> even the appearance</EM> of being
- subject to those laws, the project cannot accept software contributions
- --<EM> not even one-line bug fixes</EM> -- from US residents or
- citizens.</LI>
-</UL>
-</LI>
-<LI>provide a high-quality IPsec implementation for Linux
-<UL>
-<LI>portable to all CPUs Linux supports:<A href="#CPUs"> (current list)</A>
-</LI>
-<LI>interoperable with other IPsec implementations:<A href="#interop">
- (current list)</A></LI>
-</UL>
-</LI>
-</UL>
-<P>If we can get opportunistic encryption implemented and widely
- deployed, then it becomes impossible for even huge well-funded agencies
- to monitor the net.</P>
-<P>See also our section on<A href="#politics"> history and politics</A>
- of cryptography, which includes our project leader's<A href="#gilmore">
- rationale</A> for starting the project.</P>
-<H3><A name="staff">Project team</A></H3>
-<P>Two of the team are from the US and can therefore contribute no code:</P>
-<UL>
-<LI>John Gilmore: founder and policy-maker (<A href="http://www.toad.com/gnu/">
-home page</A>)</LI>
-<LI>Hugh Daniel: project manager, Most Demented Tester, and occasionally
- Pointy-Haired Boss</LI>
-</UL>
-<P>The rest of the team are Canadians, working in Canada. (<A href="#status">
-Why Canada?</A>)</P>
-<UL>
-<LI>Hugh Redelmeier:<A href="#Pluto"> Pluto daemon</A> programmer</LI>
-<LI>Richard Guy Briggs:<A href="#KLIPS"> KLIPS</A> programmer</LI>
-<LI>Michael Richardson: hacker without portfolio</LI>
-<LI>Claudia Schmeing: documentation</LI>
-<LI>Sam Sgro: technical support via the<A href="#lists"> mailing lists</A>
-</LI>
-</UL>
-<P>The project is funded by civil libertarians who consider our goals
- worthwhile. Most of the team are paid for this work.</P>
-<P>People outside this core team have made substantial contributions.
- See</P>
-<UL>
-<LI>our<A href="../CREDITS"> CREDITS</A> file</LI>
-<LI>the<A href="#patch"> patches and add-ons</A> section of our web
- references file</LI>
-<LI>lists below of user-written<A href="#howto"> HowTos</A> and<A href="#applied">
- other papers</A></LI>
-</UL>
-<P>Additional contributions are welcome. See the<A href="#contrib.faq">
- FAQ</A> for details.</P>
-<H2><A name="products">Products containing FreeS/WAN</A></H2>
-<P>Unfortunately the<A href="#exlaw"> export laws</A> of some countries
- restrict the distribution of strong cryptography. FreeS/WAN is
- therefore not in the standard Linux kernel and not in all CD or web
- distributions.</P>
-<P>FreeS/WAN is, however, quite widely used. Products we know of that
- use it are listed below. We would appreciate hearing, via the<A href="#lists">
- mailing lists</A>, of any we don't know of.</P>
-<H3><A name="distwith">Full Linux distributions</A></H3>
-<P>FreeS/WAN is included in various general-purpose Linux distributions,
- mostly from countries (shown in brackets) with more sensible laws:</P>
-<UL>
-<LI><A href="http://www.suse.com/">SuSE Linux</A> (Germany)</LI>
-<LI><A href="http://www.conectiva.com">Conectiva</A> (Brazil)</LI>
-<LI><A href="http://www.linux-mandrake.com/en/">Mandrake</A> (France)</LI>
-<LI><A href="http://www.debian.org">Debian</A></LI>
-<LI>the<A href="http://www.pld.org.pl/"> Polish(ed) Linux Distribution</A>
- (Poland)</LI>
-<LI><A>Best Linux</A> (Finland)</LI>
-</UL>
-<P>For distributions which do not include FreeS/WAN and are not Redhat
- (which we develop and test on), there is additional information in our<A
-href="#otherdist"> compatibility</A> section.</P>
-<P>The server edition of<A href="http://www.corel.com"> Corel</A> Linux
- (Canada) also had FreeS/WAN, but Corel have dropped that product line.</P>
-<H3><A name="kernel_dist">Linux kernel distributions</A></H3>
-<UL>
-<LI><A href="http://sourceforge.net/projects/wolk/">Working Overloaded
- Linux Kernel (WOLK)</A></LI>
-</UL>
-<H3><A name="office_dist">Office server distributions</A></H3>
-<P>FreeS/WAN is also included in several distributions aimed at the
- market for turnkey business servers:</P>
-<UL>
-<LI><A href="http://www.e-smith.com/">e-Smith</A> (Canada), which has
- recently been acquired and become the Network Server Solutions group of<A
-href="http://www.mitel.com/"> Mitel Networks</A> (Canada)</LI>
-<LI><A href="http://www.clarkconnect.org/">ClarkConnect</A> from Point
- Clark Networks (Canada)</LI>
-<LI><A href="http://www.trustix.net/">Trustix Secure Linux</A> (Norway)</LI>
-</UL>
-<H3><A name="fw_dist">Firewall distributions</A></H3>
-<P>Several distributions intended for firewall and router applications
- include FreeS/WAN:</P>
-<UL>
-<LI>The<A href="http://www.linuxrouter.org/"> Linux Router Project</A>
- produces a Linux distribution that will boot from a single floppy. The<A
-href="http://leaf.sourceforge.net"> LEAF</A> firewall project provides
- several different LRP-based firewall packages. At least one of them,
- Charles Steinkuehler's Dachstein, includes FreeS/WAN with X.509
- patches.</LI>
-<LI>there are several distributions bootable directly from CD-ROM,
- usable on a machine without hard disk.
-<UL>
-<LI>Dachstein (see above) can be used this way</LI>
-<LI><A href="http://www.gibraltar.at/">Gibraltar</A> is based on Debian
- GNU/Linux.</LI>
-<LI>at time of writing,<A href="www.xiloo.com"> Xiloo</A> is available
- only in Chinese. An English version is expected.</LI>
-</UL>
-</LI>
-<LI><A href="http://www.astaro.com/products/index.html">Astaro Security
- Linux</A> includes FreeS/WAN. It has some web-based tools for managing
- the firewall that include FreeS/WAN configuration management.</LI>
-<LI><A href="http://www.linuxwall.de">Linuxwall</A></LI>
-<LI><A href="http://www.smoothwall.org/">Smoothwall</A></LI>
-<LI><A href="http://www.devil-linux.org/">Devil Linux</A></LI>
-<LI>Coyote Linux has a<A href="http://embedded.coyotelinux.com/wolverine/index.php">
- Wolverine</A> firewall/VPN server</LI>
-</UL>
-<P>There are also several sets of scripts available for managing a
- firewall which is also acting as a FreeS/WAN IPsec gateway. See this<A href="#rules.pub">
- list</A>.</P>
-<H3><A name="turnkey">Firewall and VPN products</A></H3>
-<P>Several vendors use FreeS/WAN as the IPsec component of a turnkey
- firewall or VPN product.</P>
-<P>Software-only products:</P>
-<UL>
-<LI><A href="http://www.linuxmagic.com/vpn/index.html">Linux Magic</A>
- offer a VPN/Firewall product using FreeS/WAN</LI>
-<LI>The Software Group's<A href="http://www.wanware.com/sentinet/">
- Sentinet</A> product uses FreeS/WAN</LI>
-<LI><A href="http://www.merilus.com">Merilus</A> use FreeS/WAN in their
- Gateway Guardian firewall product</LI>
-</UL>
-<P>Products that include the hardware:</P>
-<UL>
-<LI>The<A href="http://www.lasat.com"> LASAT SafePipe[tm]</A> series. is
- an IPsec box based on an embedded MIPS running Linux with FreeS/WAN and
- a web-config front end. This company also host our freeswan.org web
- site.</LI>
-<LI>Merilus<A href="http://www.merilus.com/products/fc/index.shtml">
- Firecard</A> is a Linux firewall on a PCI card.</LI>
-<LI><A href="http://www.kyzo.com/">Kyzo</A> have a &quot;pizza box&quot; product
- line with various types of server, all running from flash. One of them
- is an IPsec/PPTP VPN server</LI>
-<LI><A href="http://www.pfn.com">PFN</A> use FreeS/WAN in some of their
- products</LI>
-</UL>
-<P><A href="www.rebel.com">Rebel.com</A>, makers of the Netwinder Linux
- machines (ARM or Crusoe based), had a product that used FreeS/WAN. The
- company is in receivership so the future of the Netwinder is at best
- unclear.<A href="#patch"> PKIX patches</A> for FreeS/WAN developed at
- Rebel are listed in our web links document.</P>
-<H2><A name="docs">Information sources</A></H2>
-<H3><A name="docformats">This HowTo, in multiple formats</A></H3>
-<P>FreeS/WAN documentation up to version 1.5 was available only in HTML.
- Now we ship two formats:</P>
-<UL>
-<LI>as HTML, one file for each doc section plus a global<A href="toc.html">
- Table of Contents</A></LI>
-<LI><A href="HowTo.html">one big HTML file</A> for easy searching</LI>
-</UL>
-<P>and provide a Makefile to generate other formats if required:</P>
-<UL>
-<LI><A href="HowTo.pdf">PDF</A></LI>
-<LI><A href="HowTo.ps">Postscript</A></LI>
-<LI><A href="HowTo.txt">ASCII text</A></LI>
-</UL>
-<P>The Makefile assumes the htmldoc tool is available. You can download
- it from<A href="http://www.easysw.com"> Easy Software</A>.</P>
-<P>All formats should be available at the following websites:</P>
-<UL>
-<LI><A href="http://www.freeswan.org/doc.html">FreeS/WAN project</A></LI>
-<LI><A href="http://www.linuxdoc.org">Linux Documentation Project</A></LI>
-</UL>
-<P>The distribution tarball has only the two HTML formats.</P>
-<P><STRONG>Note:</STRONG> If you need the latest doc version, for
- example to see if anyone has managed to set up interoperation between
- FreeS/WAN and whatever, then you should download the current snapshot.
- What is on the web is documentation as of the last release. Snapshots
- have all changes I've checked in to date.</P>
-<H3><A name="rtfm">RTFM (please Read The Fine Manuals)</A></H3>
-<P>As with most things on any Unix-like system, most parts of Linux
- FreeS/WAN are documented in online manual pages. We provide a list of<A href="/mnt/floppy/manpages.html">
- FreeS/WAN man pages</A>, with links to HTML versions of them.</P>
-<P>The man pages describing configuration files are:</P>
-<UL>
-<LI><A href="/mnt/floppy/manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A></LI>
-<LI><A href="/mnt/floppy/manpage.d/ipsec.secrets.5.html">
-ipsec.secrets(5)</A></LI>
-</UL>
-<P>Man pages for common commands include:</P>
-<UL>
-<LI><A href="/mnt/floppy/manpage.d/ipsec.8.html">ipsec(8)</A></LI>
-<LI><A href="/mnt/floppy/manpage.d/ipsec_pluto.8.html">ipsec_pluto(8)</A>
-</LI>
-<LI><A href="/mnt/floppy/manpage.d/ipsec_newhostkey.8.html">
-ipsec_newhostkey(8)</A></LI>
-<LI><A href="/mnt/floppy/manpage.d/ipsec_auto.8.html">ipsec_auto(8)</A></LI>
-</UL>
-<P>You can read these either in HTML using the links above or with the<VAR>
- man(1)</VAR> command.</P>
-<P>In the event of disagreement between this HTML documentation and the
- man pages, the man pages are more likely correct since they are written
- by the implementers. Please report any such inconsistency on the<A href="#lists">
- mailing list</A>.</P>
-<H3><A name="text">Other documents in the distribution</A></H3>
-<P>Text files in the main distribution directory are README, INSTALL,
- CREDITS, CHANGES, BUGS and COPYING.</P>
-<P>The Libdes encryption library we use has its own documentation. You
- can find it in the library directory..</P>
-<H3><A name="assumptions">Background material</A></H3>
-<P>Throughout this documentation, I write as if the reader had at least
- a general familiarity with Linux, with Internet Protocol networking,
- and with the basic ideas of system and network security. Of course that
- will certainly not be true for all readers, and quite likely not even
- for a majority.</P>
-<P>However, I must limit amount of detail on these topics in the main
- text. For one thing, I don't understand all the details of those topics
- myself. Even if I did, trying to explain everything here would produce
- extremely long and almost completely unreadable documentation.</P>
-<P>If one or more of those areas is unknown territory for you, there are
- plenty of other resources you could look at:</P>
-<DL>
-<DT>Linux</DT>
-<DD>the<A href="http://www.linuxdoc.org"> Linux Documentation Project</A>
- or a local<A href="http://www.linux.org/groups/"> Linux User Group</A>
- and these<A href="#linux.link"> links</A></DD>
-<DT>IP networks</DT>
-<DD>Rusty Russell's<A href="http://netfilter.samba.org/unreliable-guides/networking-concepts-HOWTO/index.html">
- Networking Concepts HowTo</A> and these<A href="#IP.background"> links</A>
-</DD>
-<DT>Security</DT>
-<DD>Schneier's book<A href="#secrets"> Secrets and Lies</A> and these<A href="#crypto.link">
- links</A></DD>
-</DL>
-<P>Also, I do make an effort to provide some background material in
- these documents. All the basic ideas behind IPsec and FreeS/WAN are
- explained here. Explanations that do not fit in the main text, or that
- not everyone will need, are often in the<A href="#ourgloss"> glossary</A>
-, which is the largest single file in this document set. There is also a<A
-href="#background"> background</A> file containing various explanations
- too long to fit in glossary definitions. All files are heavily
- sprinkled with links to each other and to the glossary.<STRONG> If some
- passage makes no sense to you, try the links</STRONG>.</P>
-<P>For other reference material, see the<A href="#biblio"> bibliography</A>
- and our collection of<A href="web.html#weblinks"> web links</A>.</P>
-<P>Of course, no doubt I get this (and other things) wrong sometimes.
- Feedback via the<A href="#lists"> mailing lists</A> is welcome.</P>
-<H3><A name="archives">Archives of the project mailing list</A></H3>
-<P>Until quite recently, there was only one FreeS/WAN mailing list, and
- archives of it were:</P>
-<UL>
-<LI><A href="http://www.sandelman.ottawa.on.ca/linux-ipsec">Canada</A></LI>
-<LI><A href="http://www.nexial.com">Holland</A></LI>
-</UL>
- The two archives use completely different search engines. You might
- want to try both.
-<P>More recently we have expanded to five lists, each with its own
- archive.</P>
-<P><A href="#lists">More information</A> on mailing lists.</P>
-<H3><A name="howto">User-written HowTo information</A></H3>
-<P>Various user-written HowTo documents are available. The ones covering
- FreeS/WAN-to-FreeS/WAN connections are:</P>
-<UL>
-<LI>Jean-Francois Nadeau's<A href="http://jixen.tripod.com/"> practical
- configurations</A> document</LI>
-<LI>Jens Zerbst's HowTo on<A href="http://dynipsec.tripod.com/"> Using
- FreeS/WAN with dynamic IP addresses</A>.</LI>
-<LI>an entry in Kurt Seifried's<A href="http://www.securityportal.com/lskb/kben00000013.html">
- Linux Security Knowledge Base</A>.</LI>
-<LI>a section of David Ranch's<A href="http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html#trinityos">
- Trinity OS Guide</A></LI>
-<LI>a section in David Bander's book<A href="#bander"> Linux Security
- Toolkit</A></LI>
-</UL>
-<P>User-wriiten HowTo material may be<STRONG> especially helpful if you
- need to interoperate with another IPsec implementation</STRONG>. We
- have neither the equipment nor the manpower to test such
- configurations. Users seem to be doing an admirable job of filling the
- gaps.</P>
-<UL>
-<LI>list of user-written<A href="interop.html#otherpub"> interoperation
- HowTos</A> in our interop document</LI>
-</UL>
-<P>Check what version of FreeS/WAN user-written documents cover. The
- software is under active development and the current version may be
- significantly different from what an older document describes.</P>
-<H3><A name="applied">Papers on FreeS/WAN</A></H3>
-<P>Two design documents show team thinking on new developments:</P>
-<UL>
-<LI><A href="opportunism.spec">Opportunistic Encryption</A> by technical
- lead Henry Spencer and Pluto programmer Hugh Redelemeier</LI>
-<LI>discussion of<A href="http://www.sandelman.ottawa.on.ca/SSW/freeswan/klips2req/">
- KLIPS redesign</A></LI>
-</UL>
-<P>Both documents are works in progress and are frequently revised. For
- the latest version, see the<A href="#lists"> design mailing list</A>.
- Comments should go to that list.</P>
-<P>There is now an<A href="http://www.ietf.org/internet-drafts/draft-richardson-ipsec-opportunistic-06.txt">
- Internet Draft on Opportunistic Encryption</A> by Michael Richardson,
- Hugh Redelmeier and Henry Spencer. This is a first step toward getting
- the protocol standardised so there can be multiple implementations of
- it. Discussion of it takes place on the<A href="http://www.ietf.org/html.charters/ipsec-charter.html">
- IETF IPsec Working Group</A> mailing list.</P>
-<P>A number of papers giving further background on FreeS/WAN, or
- exploring its future or its applications, are also available:</P>
-<UL>
-<LI>Both Henry and Richard gave talks on FreeS/WAN at the 2000<A href="http://www.linuxsymposium.org">
- Ottawa Linux Symposium</A>.
-<UL>
-<LI>Richard's<A href="http://www.conscoop.ottawa.on.ca/rgb/freeswan/ols2k/">
- slides</A></LI>
-<LI>Henry's paper</LI>
-<LI>MP3 audio of their talks is available from the<A href="http://www.linuxsymposium.org/">
- conference page</A></LI>
-</UL>
-</LI>
-<LI><CITE>Moat: A Virtual Private Network Appliances and Services
- Platform</CITE> is a paper about large-scale (a few 100 links) use of
- FreeS/WAN in a production application at AT&amp;T Research. It is available
- in Postscript or PDF from co-author Steve Bellovin's<A href="http://www.research.att.com/~smb/papers/index.html">
- papers list page</A>.</LI>
-<LI>One of the Moat co-authors, John Denker, has also written
-<UL>
-<LI>a<A href="http://www.av8n.com/vpn/ipsec+routing.htm"> proposal</A>
- for how future versions of FreeS/WAN might interact with routing
- protocols</LI>
-<LI>a<A href="http://www.av8n.com/vpn/wishlist.htm"> wishlist</A> of
- possible new features</LI>
-</UL>
-</LI>
-<LI>Bart Trojanowski's web page has a draft design for<A href="http://www.jukie.net/~bart/linux-ipsec/">
- hardware acceleration</A> of FreeS/WAN</LI>
-</UL>
-<P>Several of these provoked interesting discussions on the mailing
- lists, worth searching for in the<A href="#archive"> archives</A>.</P>
-<P>There are also several papers in languages other than English, see
- our<A href="#otherlang"> web links</A>.</P>
-<H3><A name="licensing">License and copyright information</A></H3>
-<P>All code and documentation written for this project is distributed
- under either the GNU General Public License (<A href="#GPL">GPL</A>) or
- the GNU Library General Public License. For details see the COPYING
- file in the distribution.</P>
-<P>Not all code in the distribution is ours, however. See the CREDITS
- file for details. In particular, note that the<A href="#LIBDES"> Libdes</A>
- library and the version of<A href="#MD5"> MD5</A> that we use each have
- their own license.</P>
-<H2><A name="sites">Distribution sites</A></H2>
-<P>FreeS/WAN is available from a number of sites.</P>
-<H3><A NAME="1_5_1">Primary site</A></H3>
-<P>Our primary site, is at xs4all (Thanks, folks!) in Holland:</P>
-<UL>
-<LI><A href="http://www.xs4all.nl/~freeswan">HTTP</A></LI>
-<LI><A href="ftp://ftp.xs4all.nl/pub/crypto/freeswan">FTP</A></LI>
-</UL>
-<H3><A name="mirrors">Mirrors</A></H3>
-<P>There are also mirror sites all over the world:</P>
-<UL>
-<LI><A href="http://www.flora.org/freeswan">Eastern Canada</A> (limited
- resouces)</LI>
-<LI><A href="ftp://ludwig.doculink.com/pub/freeswan/">Eastern Canada</A>
- (has older versions too)</LI>
-<LI><A href="ftp://ntsc.notBSD.org/pub/crypto/freeswan/">Eastern Canada</A>
- (has older versions too)</LI>
-<LI><A href="ftp://ftp.kame.net/pub/freeswan/">Japan</A></LI>
-<LI><A href="ftp://ftp.futuredynamics.com/freecrypto/FreeSWAN/">Hong
- Kong</A></LI>
-<LI><A href="ftp://ipsec.dk/pub/freeswan/">Denmark</A></LI>
-<LI><A href="ftp://ftp.net.lut.ac.uk/freeswan">the UK</A></LI>
-<LI><A href="http://storm.alert.sk/comp/mirrors/freeswan/">Slovak
- Republic</A></LI>
-<LI><A href="http://the.wiretapped.net/security/vpn-tunnelling/freeswan/">
-Australia</A></LI>
-<LI><A href="http://freeswan.technolust.cx/">technolust</A></LI>
-<LI><A href="http://freeswan.devguide.de/">Germany</A></LI>
-<LI>Ivan Moore's<A href="http://snowcrash.tdyc.com/freeswan/"> site</A></LI>
-<LI>the<A href="http://www.cryptoarchive.net/"> Crypto Archive</A> on
- the<A href="http://www.securityportal.com/"> Security Portal</A> site</LI>
-<LI><A href="http://www.wiretapped.net/">Wiretapped.net</A> in Australia</LI>
-</UL>
-<P>Thanks to those folks as well.</P>
-<H3><A name="munitions">The &quot;munitions&quot; archive of Linux crypto software</A>
-</H3>
-<P>There is also an archive of Linux crypto software called &quot;munitions&quot;,
- with its own mirrors in a number of countries. It includes FreeS/WAN,
- though not always the latest version. Some of its sites are:</P>
-<UL>
-<LI><A href="http://munitions.vipul.net/">Germany</A></LI>
-<LI><A href="http://munitions.iglu.cjb.net/">Italy</A></LI>
-<LI><A href="http://munitions2.xs4all.nl/">Netherlands</A></LI>
-</UL>
-<P>Any of those will have a list of other &quot;munitions&quot; mirrors. There is
- also a CD available.</P>
-<H2><A NAME="1_6">Links to other sections</A></H2>
-<P>For more detailed background information, see:</P>
-<UL>
-<LI><A href="#politics">history and politics</A> of cryptography</LI>
-<LI><A href="#ipsec.detail">IPsec protocols</A></LI>
-</UL>
-<P>To begin working with FreeS/WAN, go to our<A href="quickstart.html#quick.guide">
- quickstart</A> guide.</P>
-<HR>
-<A NAME="upgrading"></A>
-<H1><A NAME="2">Upgrading to FreeS/WAN 2.x</A></H1>
-<H2><A NAME="2_1">New! Built in Opportunistic connections</A></H2>
-<P>Out of the box, FreeS/WAN 2.x will attempt to encrypt all your IP
- traffic. It will try to establish IPsec connections for:</P>
-<UL>
-<LI> IP traffic from the Linux box on which you have installed
- FreeS/WAN, and</LI>
-<LI> outbound IP traffic routed through that Linux box (eg. from a
- protected subnet).</LI>
-</UL>
-<P>FreeS/WAN 2.x uses<STRONG> hidden, automatically enabled<VAR>
- ipsec.conf</VAR> connections</STRONG> to do this.</P>
-<P>This behaviour is part of our campaign to get Opportunistic
- Encryption (OE) widespread in the Linux world, so that any two Linux
- boxes can encrypt to one another without prearrangement. There's one
- catch, however: you must<A HREF="#quickstart"> set up a few DNS records</A>
- to distribute RSA public keys and (if applicable) IPsec gateway
- information.</P>
-<P>If you start FreeS/WAN before you have set up these DNS records, your
- connectivity will be slow, and messages relating to the built in
- connections will clutter your logs. If you are unable to set up DNS for
- OE, you will wish to<A HREF="#disable_policygroups"> disable the hidden
- connections</A>.</P>
-<A NAME="upgrading.flagday"></A>
-<H3><A NAME="2_1_1">Upgrading Opportunistic Encryption to 2.01 (or
- later)</A></H3>
-<P>As of FreeS/WAN 2.01, Opportunistic Encryption (OE) uses DNS TXT
- resource records (RRs) only (rather than TXT with KEY). This change
- causes a &quot;flag day&quot;. Users of FreeS/WAN 2.00 (or earlier) OE who are
- upgrading may need to post additional resource records.</P>
-<P>If you are running<A HREF="#initiate-only"> initiate-only OE</A>, you<EM>
- must</EM> put up a TXT record in any forward domain as per our<A HREF="#opp.client">
- quickstart instructions</A>. This replaces your old forward KEY.</P>
-<P> If you are running full OE, you require no updates. You already have
- the needed TXT record in the reverse domain. However, to facilitate
- future features, you may also wish to publish that TXT record in a
- forward domain as instructed<A HREF="#opp.incoming"> here</A>.</P>
-<P>If you are running OE on a gateway (and encrypting on behalf of
- subnetted boxes) you require no updates. You already have the required
- TXT record in your gateway's reverse map, and the TXT records for any
- subnetted boxes require no updating. However, to facilitate future
- features, you may wish to publish your gateway's TXT record in a
- forward domain as shown<A HREF="#opp.incoming"> here</A>.</P>
-<P> During the transition, you may wish to leave any old KEY records up
- for some time. They will provide limited backward compatibility.
-<!--
-For more
-detail on that compatibility, see <A HREF="oe.known-issues">Known Issues with
-OE</A>.
--->
-</P>
-<H2><A NAME="2_2">New! Policy Groups</A></H2>
-<P>We want to make it easy for you to declare security policy as it
- applies to IPsec connections.</P>
-<P>Policy Groups make it simple to say:</P>
-<UL>
-<LI>These are the folks I want to talk to in the clear.</LI>
-<LI>These spammers' domains -- I don't want to talk to them at all.</LI>
-<LI>To talk to the finance department, I must use IPsec.</LI>
-<LI>For any other communication, try to encrypt, but it's okay if we
- can't.</LI>
-</UL>
-<P>FreeS/WAN then implements these policies, creating OE connections if
- and when needed. You can use Policy Groups along with connections you
- explicitly define in ipsec.conf.</P>
-<P>For more information, see our<A HREF="policygroups.html"> Policy
- Group HOWTO</A>.</P>
-<H2><A NAME="2_3">New! Packetdefault Connection</A></H2>
-<P>Free/SWAN 2.x ships with the<STRONG> automatically enabled, hidden
- connection</STRONG><VAR> packetdefault</VAR>. This configures a
- FreeS/WAN box as an OE gateway for any hosts located behind it. As
- mentioned above, you must configure some<A HREF="quickstart.html"> DNS
- records</A> for OE to work.</P>
-<P>As the name implies, this connection functions as a default. If you
- have more specific connections, such as policy groups which configure
- your FreeS/WAN box as an OE gateway for a local subnet, these will
- apply before<VAR> packetdefault</VAR>. You can view<VAR> packetdefault</VAR>
-'s specifics in<A HREF="manpage.d/ipsec.conf.5.html"> man ipsec.conf</A>
-.</P>
-<H2><A NAME="2_4">FreeS/WAN now disables Reverse Path Filtering</A></H2>
-<P>FreeS/WAN often doesn't work with reverse path filtering. At start
- time, FreeS/WAN now turns rp_filter off, and logs a warning.</P>
-<P>FreeS/WAN does not turn it back on again. You can do this yourself
- with a command like:</P>
-<PRE>   echo 1 &gt; /proc/sys/net/ipv4/conf/eth0/rp_filter</PRE>
-<P>For eth0, substitute the interface which FreeS/WAN was affecting.</P>
-<A NAME="ipsec.conf_v2"></A>
-<H2><A NAME="2_5">Revised<VAR> ipsec.conf</VAR></A></H2>
-<H3><A NAME="2_5_1">No promise of compatibility</A></H3>
-<P>The FreeS/WAN team promised config-file compatibility throughout the
- 1.x series. That means a 1.5 config file can be directly imported into
- a fresh 1.99 install with no problems.</P>
-<P>With FreeS/WAN 2.x, we've given ourselves permission to make the
- config file easier to use. The cost: some FreeS/WAN 1.x configurations
- will not work properly. Many of the new features are, however, backward
- compatible.</P>
-<H3><A NAME="2_5_2">Most<VAR> ipsec.conf</VAR> files will work fine</A></H3>
-<P>... so long as you paste this line,<STRONG> with no preceding
- whitespace</STRONG>, at the top of your config file:</P>
-<PRE>    version 2</PRE>
-<H3><A NAME="2_5_3">Backward compatibility patch</A></H3>
-<P>If the new defaults bite you, use<A HREF="ipsec.conf.2_to_1"> this<VAR>
- ipsec.conf</VAR> fragment</A> to simulate the old default values.</P>
-<H3><A NAME="2_5_4">Details</A></H3>
-<P> We've obsoleted various directives which almost no one was using:</P>
-<PRE>    dump
-    plutobackgroundload
-    no_eroute_pass
-    lifetime
-    rekeystart
-    rekeytries</PRE>
-<P>For most of these, there is some other way to elicit the desired
- behaviour. See<A HREF="http://lists.freeswan.org/pipermail/design/2002-August/003243.html">
- this post</A>.</P>
-<P> We've made some settings, which almost everyone was using, defaults.
- For example:</P>
-<PRE>    interfaces=%defaultroute
-    plutoload=%search
-    plutostart=%search
-    uniqueids=yes</PRE>
-<P>We've also changed some default values to help with OE and Policy
- Groups:</P>
-<PRE>    authby=rsasig   ## not secret!!!
-    leftrsasigkey=%dnsondemand ## looks up missing keys in DNS when needed.
-    rightrsasigkey=%dnsondemand</PRE>
-<P> Of course, you can still override any defaults by explictly
- declaring something else in your connection.</P>
-<P><A HREF="http://lists.freeswan.org/pipermail/design/2002-August/003243.html">
- A post with a list of many ipsec.conf changes.</A>
-<BR><A HREF="manpage.d/ipsec.conf.5.html"> Current ipsec.conf manual.</A>
-</P>
-<A NAME="upgrading.rpms"></A>
-<H3><A NAME="2_5_5">Upgrading from 1.x RPMs to 2.x RPMs</A></H3>
-<P>Note: When upgrading from 1-series to 2-series RPMs,<VAR> rpm -U</VAR>
- will not work.</P>
-<P>You must instead erase the 1.x RPMs, then install the 2.x set:</P>
-<PRE>    rpm -e freeswan</PRE>
-<PRE>    rpm -e freeswan-module</PRE>
-<P>On erasing, your old<VAR> ipsec.conf</VAR> should be moved to<VAR>
- ipsec.conf.rpmsave</VAR>. Keep this. You will probably want to copy
- your existing connections to the end of your new 2.x file.</P>
-<P>Install the RPMs suitable for your kernel version, such as:</P>
-<PRE>    rpm -ivh freeswan-module-2.04_2.4.20_20.9-0.i386.rpm</PRE>
-<PRE>    rpm -ivh freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm</PRE>
-<P>Or, to splice the files:</P>
-<PRE>    cat /etc/ipsec.conf /etc/ipsec.conf.rpmsave &gt; /etc/ipsec.conf.tmp
-    mv /etc/ipsec.conf.tmp /etc/ipsec.conf</PRE>
-<P>Then, remove the redundant<VAR> conn %default</VAR> and<VAR> config
- setup</VAR> sections. Unless you have done any special configuring
- here, you'll likely want to remove the 1.x versions. Remove<VAR> conn
- OEself</VAR>, if present.</P>
-<HR>
-<H1><A name="quickstart">Quickstart Guide to Opportunistic Encryption</A>
-</H1>
-<A name="quick_guide"></A>
-<H2><A name="opp.setup">Purpose</A></H2>
-<P>This page will get you started using Linux FreeS/WAN with
- opportunistic encryption (OE). OE enables you to set up IPsec tunnels
- without co-ordinating with another site administrator, and without hand
- configuring each tunnel. If enough sites support OE, a &quot;FAX effect&quot;
- occurs, and many of us can communicate without eavesdroppers.</P>
-<H3><A NAME="3_1_1">OE &quot;flag day&quot;</A></H3>
-<P>As of FreeS/WAN 2.01, OE uses DNS TXT resource records (RRs) only
- (rather than TXT with KEY). This change causes a<A href="http://jargon.watson-net.com/jargon.asp?w=flag+day">
- &quot;flag day&quot;</A>. Users of FreeS/WAN 2.00 (or earlier) OE who are
- upgrading may require additional resource records, as detailed in our<A href="#upgrading.flagday">
- upgrading document</A>. OE setup instructions here are for 2.02 or
- later.</P>
-<H2><A name="opp.dns">Requirements</A></H2>
-<P>To set up opportunistic encryption, you will need:</P>
-<UL>
-<LI>a Linux box. For OE to the public Internet, this box must NOT be
- behind<A HREF="#NAT.gloss"> Network Address Translation</A> (NAT).</LI>
-<LI>to install Linux FreeS/WAN 2.02 or later</LI>
-<LI>either control over your reverse DNS (for full opportunism) or the
- ability to write to some forward domain (for initiator-only).<A HREF="http://www.fdns.net">
- This free DNS service</A> explicitly supports forward TXT records for
- FreeS/WAN use.</LI>
-<LI>(for full opportunism) a static IP</LI>
-</UL>
-<P>Note: Currently, only Linux FreeS/WAN supports opportunistic
- encryption.</P>
-<H2><A name="easy.install">RPM install</A></H2>
-<P>Our instructions are for a recent Red Hat with a 2.4-series stock or
- Red Hat updated kernel. For other ways to install, see our<A href="#install">
- install document</A>.</P>
-<H3><A NAME="3_3_1">Download RPMs</A></H3>
-<P>If we have prebuilt RPMs for your Red Hat system, this command will
- get them:</P>
-<PRE>    ncftpget ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs/`uname -r | tr -d 'a-wy-z'`/\*</PRE>
-<P>If that fails, you will need to try<A HREF="install.html"> another
- install method</A>. Our kernel modules<B> will only work on the Red Hat
- kernel they were built for</B>, since they are very sensitive to small
- changes in the kernel.</P>
-<P>If it succeeds, you will have userland tools, a kernel module, and an
- RPM signing key:</P>
-<PRE>    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm
-    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm
-    freeswan-rpmsign.asc</PRE>
-<H3><A NAME="3_3_2">Check signatures</A></H3>
-<P>If you're running RedHat 8.x or later, import the RPM signing key
- into the RPM database:</P>
-<PRE>    rpm --import freeswan-rpmsign.asc</PRE>
-<P>For RedHat 7.x systems, you'll need to add it to your<A HREF="#PGP">
- PGP</A> keyring:</P>
-<PRE>    pgp -ka freeswan-rpmsign.asc</PRE>
-<P>Check the digital signatures on both RPMs using:</P>
-<PRE>    rpm --checksig freeswan*.rpm </PRE>
-<P>You should see that these signatures are good:</P>
-<PRE>    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm: pgp md5 OK
-    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm: pgp md5 OK</PRE>
-<H3><A NAME="3_3_3">Install the RPMs</A></H3>
-<P>Become root:</P>
-<PRE>    su</PRE>
-<P>Install your RPMs with:</P>
-<P></P>
-<PRE>    rpm -ivh freeswan*.rpm</PRE>
-<P>If you're upgrading from FreeS/WAN 1.x RPMs, and have problems with
- that command, see<A HREF="#upgrading.rpms"> this note</A>.</P>
-<P>Then, start FreeS/WAN:</P>
-<PRE>    service ipsec start</PRE>
-<H3><A name="testinstall">Test</A></H3>
-<P>To check that you have a successful install, run:</P>
-<PRE>    ipsec verify</PRE>
-<P>You should see as part of the<VAR> verify</VAR> output:</P>
-<PRE>
-    Checking your system to see if IPsec got installed and started correctly
-    Version check and ipsec on-path                             [OK]
-    Checking for KLIPS support in kernel                        [OK]
-    Checking for RSA private key (/etc/ipsec.secrets)           [OK]
-    Checking that pluto is running                              [OK]
-    ...</PRE>
-<P>If any of these first four checks fails, see our<A href="#install.check">
- troubleshooting guide</A>.</P>
-<H2><A name="opp.setups.list">Our Opportunistic Setups</A></H2>
-<H3><A NAME="3_4_1">Full or partial opportunism?</A></H3>
-<P>Determine the best form of opportunism your system can support.</P>
-<UL>
-<LI>For<A HREF="#opp.incoming"> full opportunism</A>, you'll need a
- static IP and and either control over your reverse DNS or an ISP that
- can add the required TXT record for you.</LI>
-<LI>If you have a dynamic IP, and/or write access to forward DNS only,
- you can do<A HREF="#opp.client"> initiate-only opportunism</A></LI>
-<LI>To protect traffic bound for real IPs behind your gateway, use<A HREF="#opp.gate">
- this form of full opportunism</A>.</LI>
-</UL>
-<H2><A name="opp.client">Initiate-only setup</A></H2>
-<H3><A NAME="3_5_1">Restrictions</A></H3>
-<P>When you set up initiate-only Opportunistic Encryption (iOE):</P>
-<UL>
-<LI>there will be<STRONG> no incoming connection requests</STRONG>; you
- can initiate all the IPsec connections you need.</LI>
-<LI><STRONG>only one machine is visible</STRONG> on your end of the
- connection.</LI>
-<LI>iOE also protects traffic on behalf of<A HREF="#NAT.gloss"> NATted</A>
- hosts behind the iOE box.</LI>
-</UL>
-<P>You cannot network a group of initiator-only machines if none of
- these is capable of responding to OE. If one is capable of responding,
- you may be able to create a hub topology using routing.</P>
-<H3><A name="forward.dns">Create and publish a forward DNS record</A></H3>
-<H4><A NAME="3_5_2_1">Find a domain you can use</A></H4>
-<P>Find a DNS forward domain (e.g. example.com) where you can publish
- your key. You'll need access to the DNS zone files for that domain.
- This is common for a domain you own. Some free DNS providers, such as<A HREF="http://www.fdns.net">
- this one</A>, also provide this service.</P>
-<P>Dynamic IP users take note: the domain where you place your key need
- not be associated with the IP address for your system, or even with
- your system's usual hostname.</P>
-<H4><A NAME="3_5_2_2">Choose your ID</A></H4>
-<P>Choose a name within that domain which you will use to identify your
- machine. It's convenient if this can be the same as your hostname:</P>
-<PRE>    [root@xy root]# hostname --fqdn
-    xy.example.com</PRE>
-<P>This name in FQDN (fully-qualified domain name) format will be your
- ID, for DNS key lookup and IPsec negotiation.</P>
-<H4><A NAME="3_5_2_3">Create a forward TXT record</A></H4>
-<P>Generate a forward TXT record containing your system's public key
- with a command like:</P>
-<PRE>    ipsec showhostkey --txt @xy.example.com</PRE>
-<P>using your chosen ID in place of xy.example.com. This command takes
- the contents of /etc/ipsec.secrets and reformats it into something
- usable by ISC's BIND. The result should look like this (with the key
- data trimmed down for clarity):</P>
-<PRE>
-    ; RSA 2192 bits   xy.example.com   Thu Jan  2 12:41:44 2003
-        IN      TXT     &quot;X-IPsec-Server(10)=@xy.example.com&quot; 
-    &quot;AQOF8tZ2... ...+buFuFn/&quot;
-</PRE>
-<H4><A NAME="3_5_2_4">Publish the forward TXT record</A></H4>
-<P>Insert the record into DNS, or have a system adminstrator do it for
- you. It may take up to 48 hours for the record to propagate, but it's
- usually much quicker.</P>
-<H3><A NAME="3_5_3">Test that your key has been published</A></H3>
-<P>Check your DNS work</P>
-<PRE>    ipsec verify --host xy.example.com</PRE>
-<P>As part of the<VAR> verify</VAR> output, you ought to see something
- like:</P>
-<PRE>    ...
-    Looking for TXT in forward map: xy.example.com          [OK]
-    ...</PRE>
-<P>For this type of opportunism, only the forward test is relevant; you
- can ignore the tests designed to find reverse records.</P>
-<H3><A NAME="3_5_4">Configure, if necessary</A></H3>
-<P> If your ID is the same as your hostname, you're ready to go.
- FreeS/WAN will use its<A HREF="policygroups.html"> built-in connections</A>
- to create your iOE functionality.</P>
-<P>If you have chosen a different ID, you must tell FreeS/WAN about it
- via<A HREF="manpage.d/ipsec.conf.5.html"><VAR> ipsec.conf</VAR></A>:</P>
-<PRE>    config setup
-        myid=@myname.freedns.example.com</PRE>
-<P>and restart FreeS/WAN:</P>
-<PRE>    service ipsec restart</PRE>
-<P>The new ID will be applied to the built-in connections.</P>
-<P>Note: you can create more complex iOE configurations as explained in
- our<A HREF="#policygroups"> policy groups document</A>, or disable OE
- using<A HREF="#disable_policygroups"> these instructions</A>.</P>
-<H3><A NAME="3_5_5">Test</A></H3>
-<P>That's it!<A HREF="#opp.test"> Test your connections</A>.</P>
-<A name="opp.incoming"></A>
-<H2><A NAME="3_6">Full Opportunism</A></H2>
-<P>Full opportunism allows you to initiate and receive opportunistic
- connections on your machine.</P>
-<A name="incoming.opp.dns"></A>
-<H3><A NAME="3_6_1">Put a TXT record in a Forward Domain</A></H3>
-<P>To set up full opportunism, first<A HREF="#forward.dns"> set up a
- forward TXT record</A> as for<A HREF="#opp.client"> initiator-only OE</A>
-, using an ID (for example, your hostname) that resolves to your IP. Do
- not configure<VAR> /etc/ipsec.conf</VAR>, but continue with the
- instructions for full opportunism, below.</P>
-<P>Note that this forward record is not currently necessary for full OE,
- but will facilitate future features.</P>
-<A name="incoming.opp.dns"></A>
-<H3><A NAME="3_6_2">Put a TXT record in Reverse DNS</A></H3>
-<P>You must be able to publish your DNS RR directly in the reverse
- domain. FreeS/WAN will not follow a PTR which appears in the reverse,
- since a second lookup at connection start time is too costly.</P>
-<H4><A NAME="3_6_2_1">Create a Reverse DNS TXT record</A></H4>
-<P>This record serves to publicize your FreeS/WAN public key. In
- addition, it lets others know that this machine can receive
- opportunistic connections, and asserts that the machine is authorized
- to encrypt on its own behalf.</P>
-<P>Use the command:</P>
-<PRE>    ipsec showhostkey --txt 192.0.2.11</PRE>
-<P>where you replace 192.0.2.11 with your public IP.</P>
-<P>The record (with key shortened) looks like:</P>
-<PRE>    ; RSA 2048 bits  xy.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;</PRE>
-<H4><A NAME="3_6_2_2">Publish your TXT record</A></H4>
-<P>Send these records to your ISP, to be published in your IP's reverse
- map. It may take up to 48 hours for these to propagate, but usually
- takes much less time.</P>
-<H3><A NAME="3_6_3">Test your DNS record</A></H3>
-<P>Check your DNS work with</P>
-<PRE>    ipsec verify --host xy.example.com</PRE>
-<P>As part of the<VAR> verify</VAR> output, you ought to see something
- like:</P>
-<PRE>    ...
-    Looking for TXT in reverse map: 11.2.0.192.in-addr.arpa [OK]
-    ...</PRE>
-<P>which indicates that you've passed the reverse-map test.</P>
-<H3><A NAME="3_6_4">No Configuration Needed</A></H3>
-<P>FreeS/WAN 2.x ships with full OE enabled, so you don't need to
- configure anything. To enable OE out of the box, FreeS/WAN 2.x uses the
- policy group<VAR> private-or-clear</VAR>, which creates IPsec
- connections if possible (using OE if needed), and allows traffic in the
- clear otherwise. You can create more complex OE configurations as
- described in our<A HREF="#policygroups"> policy groups document</A>, or
- disable OE using<A HREF="#disable_policygroups"> these instructions</A>
-.</P>
-<P>If you've previously configured for initiator-only opportunism,
- remove<VAR> myid=</VAR> from<VAR> config setup</VAR>, so that peer
- FreeS/WANs will look up your key by IP. Restart FreeS/WAN so that your
- change will take effect, with</P>
-<PRE>    service ipsec restart</PRE>
-<H3><A NAME="3_6_5">Consider Firewalling</A></H3>
-<P>If you are running a default install of RedHat 8.x, take note: you
- will need to alter your iptables rule setup to allow IPSec traffic
- through your firewall. See<A HREF="#simple.rules"> our firewall
- document</A> for sample<VAR> iptables</VAR> rules.</P>
-<H3><A NAME="3_6_6">Test</A></H3>
-<P>That's it. Now,<A HREF="#opp.test"> test your connection</A>.</P>
-<H3><A NAME="3_6_7">Test</A></H3>
-<P>Instructions are in the next section.</P>
-<H2><A NAME="opp.test">Testing opportunistic connections</A></H2>
-<P>Be sure IPsec is running. You can see whether it is with:</P>
-<PRE>    ipsec setup status</PRE>
-<P>If need be, you can restart it with:</P>
-<PRE>    service ipsec restart</PRE>
-<P>Load a FreeS/WAN test website from the host on which you're running
- FreeS/WAN. Note: the feds may be watching these sites. Type one of:</P>
-<P></P>
-<PRE>   links oetest.freeswan.org</PRE>
-<PRE>   links oetest.freeswan.nl</PRE>
-
-<!--<PRE>   links oetest.freeswan.ca</PRE>-->
-<P>A positive result looks like this:</P>
-<PRE>
-   You  seem  to  be  connecting  from:  192.0.2.11 which DNS says is:
-   gateway.example.com
-     _________________________________________________________________
-
-   Status E-route
-   OE    enabled    16    192.139.46.73/32    -&gt;    192.0.2.11/32   =&gt;
-   tun0x2097@192.0.2.11
-   OE    enabled    176    192.139.46.77/32    -&gt;   192.0.2.11/32   =&gt;
-   tun0x208a@192.0.2.11
-</PRE>
-<P>If you see this, congratulations! Your OE host or gateway will now
- encrypt its own traffic whenever it can. For more OE tests, please see
- our<A HREF="#test.oe"> testing document</A>. If you have difficulty,
- see our<A HREF="#oe.trouble"> OE troubleshooting tips</A>.</P>
-<H2><A NAME="3_8">Now what?</A></H2>
-<P>Please see our<A HREF="policygroups.html"> policy groups document</A>
- for more ways to set up Opportunistic Encryption.</P>
-<P>You may also wish to make some<A HREF="config.html"> pre-configured
- connections</A>.</P>
-<H2><A NAME="3_9">Notes</A></H2>
-<UL>
-<LI>We assume some facts about your system in order to make
- Opportunistic Encryption easier to configure. For example, we assume
- that you wish to have FreeS/WAN secure your default interface.</LI>
-<LI>You may change this, and other settings, by altering the<VAR> config
- setup</VAR> section in<VAR> /etc/ipsec.conf</VAR>.</LI>
-<LI>Note that the built-in connections used to build policy groups do
- not inherit from<VAR> conn default</VAR>.</LI>
-
-<!--
-<LI>If you do not define your local identity
-(eg. <VAR>leftid</VAR>), this will be the IP address of your default
-FreeS/WAN interface.  
--->
-<LI> If you fail to define your local identity and do not fill in your
- reverse DNS entry, you will not be able to use OE.</LI>
-</UL>
-<A NAME="oe.trouble"></A>
-<H2><A NAME="3_10">Troubleshooting OE</A></H2>
-<P>See the OE troubleshooting hints in our<A HREF="#oe.trouble">
- troubleshooting guide</A>.</P>
-<A NAME="oe.known-issues"></A>
-<H2><A NAME="3_11">Known Issues</A></H2>
-<P>Please see<A HREF="opportunism.known-issues"> this list</A> of known
- issues with Opportunistic Encryption.</P>
-<HR>
-<H1><A NAME="4">How to Configure Linux FreeS/WAN with Policy Groups</A></H1>
-<A NAME="policygroups"></A>
-<H2><A NAME="4_1">What are Policy Groups?</A></H2>
-<P><STRONG>Policy Groups</STRONG> are an elegant general mechanism to
- configure FreeS/WAN. They are useful for many FreeS/WAN users.</P>
-<P>In previous FreeS/WAN versions, you needed to configure each IPsec
- connection explicitly, on both local and remote hosts. This could
- become complex.</P>
-<P>By contrast, Policy Groups allow you to set local IPsec policy for
- lists of remote hosts and networks, simply by listing the hosts and
- networks which you wish to have special treatment in one of several
- Policy Group files. FreeS/WAN then internally creates the connections
- needed to implement each policy.</P>
-<P>In the next section we describe our five Base Policy Groups, which
- you can use to configure IPsec in many useful ways. Later, we will show
- you how to create an IPsec VPN using one line of configuration for each
- remote host or network.</P>
-<A NAME="builtin_policygroups"></A>
-<H3><A NAME="4_1_1">Built-In Security Options</A></H3>
-<P>FreeS/WAN offers these Base Policy Groups:</P>
-<DL>
-<DT>private</DT>
-<DD> FreeS/WAN only communicates privately with the listed<A HREF="#CIDR">
- CIDR</A> blocks. If needed, FreeS/WAN attempts to create a connection
- opportunistically. If this fails, FreeS/WAN blocks communication.
- Inbound blocking is assumed to be done by the firewall. FreeS/WAN
- offers firewall hooks but no modern firewall rules to help with inbound
- blocking.</DD>
-<DT>private-or-clear</DT>
-<DD> FreeS/WAN prefers private communication with the listed CIDR
- blocks. If needed, FreeS/WAN attempts to create a connection
- opportunistically. If this fails, FreeS/WAN allows traffic in the
- clear.</DD>
-<DT>clear-or-private</DT>
-<DD> FreeS/WAN communicates cleartext with the listed CIDR blocks, but
- also accepts inbound OE connection requests from them. Also known as<A HREF="#passive.OE">
- passive OE (pOE)</A>, this policy may be used to create an<A HREF="#responder">
- opportunistic responder</A>.</DD>
-<DT>clear</DT>
-<DD> FreeS/WAN only communicates cleartext with the listed CIDR blocks.</DD>
-<DT>block</DT>
-<DD>FreeS/WAN blocks traffic to and from and the listed CIDR blocks.
- Inbound blocking is assumed to be done by the firewall. FreeS/WAN
- offers firewall hooks but no modern firewall rules to help with inbound
- blocking.
-<!-- also called "blockdrop".-->
-</DD>
-</DL>
-<A NAME="policy.group.notes"></A>
-<P>Notes:</P>
-<UL>
-<LI>Base Policy Groups apply to communication with this host only.</LI>
-<LI>The most specific rule (whether policy or pre-configured connection)
- applies. This has several practical applications:
-<UL>
-<LI>If CIDR blocks overlap, FreeS/WAN chooses the most specific
- applicable block.</LI>
-<LI>This decision also takes into account any pre-configured connections
- you may have.</LI>
-<LI>If the most specific connection is a pre-configured connection, the
- following procedure applies. If that connection is up, it will be used.
- If it is routed, it will be brought up. If it is added, no action will
- be taken.</LI>
-</UL>
-</LI>
-<LI>Base Policy Groups are created using built-in connections. Details
- in<A HREF="manpage.d/ipsec.conf.5.html"> man ipsec.conf</A>.</LI>
-<LI>All Policy Groups are bidirectional.<A HREF="src/policy-groups-table.html">
- This chart</A> shows some technical details. FreeS/WAN does not support
- one-way encryption, since it can give users a false sense of security.</LI>
-</UL>
-<H2><A NAME="4_2">Using Policy Groups</A></H2>
-<P>The Base Policy Groups which build IPsec connections rely on
- Opportunistic Encryption. To use the following examples, you must first
- become OE-capable, as described in our<A HREF="#quickstart"> quickstart
- guide</A>.<A NAME="example1"></A></P>
-<H3><A NAME="4_2_1">Example 1: Using a Base Policy Group</A></H3>
-<P>Simply place CIDR blocks (<A HREF="#dnswarning">names</A>, IPs or IP
- ranges) in /etc/ipsec.d/policies/<VAR>[groupname]</VAR>, and reread the
- policy group files.</P>
-<P>For example, the<VAR> private-or-clear</VAR> policy tells FreeS/WAN
- to prefer encrypted communication to the listed CIDR blocks. Failing
- that, it allows talk in the clear.</P>
-<P>To make this your default policy, place<A HREF="#fullnet"> fullnet</A>
- in the<VAR> private-or-clear</VAR> policy group file:</P>
-<PRE>    [root@xy root]# cat /etc/ipsec.d/policies/private-or-clear
-    # This file defines the set of CIDRs (network/mask-length) to which
-    # communication should be private, if possible, but in the clear otherwise.
-    ....
-    0.0.0.0/0</PRE>
-<P>and reload your policies with</P>
-<PRE>    ipsec auto --rereadgroups</PRE>
-<P>Use<A HREF="#opp.test"> this test</A> to verify opportunistic
- connections.</P>
-<A NAME="example2"></A>
-<H3><A NAME="4_2_2">Example 2: Defining IPsec Security Policy with
- Groups</A></H3>
-<P>Defining IPsec security policy with Base Policy Groups is like
- creating a shopping list: just put CIDR blocks in the appropriate group
- files. For example:</P>
-<PRE>    [root@xy root]# cd /etc/ipsec.d/policies
-    [root@xy policies]# cat private
-        192.0.2.96/27              # The finance department
-        192.0.2.192/29             # HR
-	192.0.2.12                 # HR gateway
-        irc.private.example.com    # Private IRC server
-  
-    [root@xy policies]# cat private-or-clear
-        0.0.0.0/0                  # My default policy: try to encrypt.
-
-    [root@xy policies]# cat clear
-        192.0.2.18/32              # My POP3 server
-        192.0.2.19/32              # My Web proxy
-
-    [root@xy policies]# cat block
-        spamsource.example.com</PRE>
-<P>To make these settings take effect, type:</P>
-<PRE>    ipsec auto --rereadgroups</PRE>
-<P>Notes:</P>
-<UL>
-<LI>For opportunistic connection attempts to succeed, all participating
- FreeS/WAN hosts and gateways must be configured for OE.</LI>
-<LI>Examples 3 through 5 show how to implement a detailed<VAR> private</VAR>
- policy.</LI>
-<LI><A NAME="dnswarning"></A><FONT COLOR="RED"> Warning:</FONT> Using
- DNS names in policy files and ipsec.conf can be tricky. If the name
- does not resolve, the policy will not be implemented for that name. It
- is therefore safer either to use IPs, or to put any critical names in
- /etc/hosts. We plan to implement periodic DNS retry to help with this.
-<BR> Names are resolved at FreeS/WAN startup, or when the policies are
- reloaded. Unfortunately, name lookup can hold up the startup process.
- If you have fast DNS servers, the problem may be less severe.</LI>
-</UL>
-<A HREF="example3"></A>
-<H3><A NAME="4_2_3">Example 3: Creating a Simple IPsec VPN with the<VAR>
- private</VAR> Group</A></H3>
-<P>You can create an IPsec VPN between several hosts, with only one line
- of configuration per host, using the<VAR> private</VAR> policy group.</P>
-<P>First, use our<A HREF="quickstart.html"> quickstart guide</A> to set
- up each participating host with a FreeS/WAN install and OE.</P>
-<P>In one host's<VAR> /etc/ipsec.d/policies/private</VAR>, list the
- peers to which you wish to protect traffic. For example:</P>
-<PRE>    [root@xy root]# cd /etc/ipsec.d/policies
-    [root@xy policies]# cat private
-        192.0.2.9              # several hosts at example.com
-        192.0.2.11             
-        192.0.2.12                 
-        irc.private.example.com 
-</PRE>
-<P>Copy the<VAR> private</VAR> file to each host. Remove the local host,
- and add the initial host.</P>
-<PRE>    scp2 /etc/ipsec.d/policies/private root@192.0.2.12:/etc/ipsec.d/policies/private</PRE>
-<P>On each host, reread the policy groups with</P>
-<PRE>    ipsec auto --rereadgroups</PRE>
-<P>That's it! You're configured.</P>
-<P>Test by pinging between two hosts. After a second or two, traffic
- should flow, and</P>
-<PRE>    ipsec eroute</PRE>
-<P>should yield something like</P>
-<PRE>    192.0.2.11/32   -&gt; 192.0.2.8/32  =&gt; tun0x149f@192.0.2.8</PRE>
-<P>where your host IPs are substituted for 192.0.2.11 and 192.0.2.8.</P>
-<P>If traffic does not flow, there may be an error in your OE setup.
- Revisit our<A HREF="quickstart.html"> quickstart guide</A>.</P>
-<P>Our next two examples show you how to add subnets to this IPsec VPN.</P>
-<A NAME="example4"></A>
-<H3><A NAME="4_2_4">Example 4: New Policy Groups to Protect a Subnet</A></H3>
-<P>To protect traffic to a subnet behind your FreeS/WAN gateway, you'll
- need additional DNS records, and new policy groups. To set up the DNS,
- see our<A HREF="#opp.gate"> quickstart guide</A>. To create five new
- policy groups for your subnet, copy these connections to<VAR>
- /etc/ipsec.conf</VAR>. Substitute your subnet's IPs for 192.0.2.128/29.</P>
-<PRE>
-conn private-net
-    also=private  # inherits settings (eg. auto=start) from built in conn
-    leftsubnet=192.0.2.128/29  # your subnet's IPs here
-
-conn private-or-clear-net
-    also=private-or-clear
-    leftsubnet=192.0.2.128/29
-
-conn clear-or-private-net
-    also=clear-or-private
-    leftsubnet=192.0.2.128/29
-
-conn clear-net
-    also=clear
-    leftsubnet=192.0.2.128/29
-
-conn block-net
-    also=block
-    leftsubnet=192.0.2.128/29
-</PRE>
-<P>Copy the gateway's files to serve as the initial policy group files
- for the new groups:</P>
-<PRE>
-    cp -p /etc/ipsec.d/policies/private /etc/ipsec.d/policies/private-net
-    cp -p /etc/ipsec.d/policies/private-or-clear /etc/ipsec.d/policies/private-or-clear-net
-    cp -p /etc/ipsec.d/policies/clear-or-private /etc/ipsec.d/policies/clear-or-private-net
-    cp -p /etc/ipsec.d/policies/clear /etc/ipsec.d/policies/clear-net
-    cp -p /etc/ipsec.d/policies/block /etc/ipsec.d/policies/block
-</PRE>
-<P><STRONG>Tip: Since a missing policy group file is equivalent to a
- file with no entries, you need only create files for the connections
- you'll use.</STRONG></P>
-<P>To test one of your new groups, place the fullnet 0.0.0.0/0 in<VAR>
- private-or-clear-net</VAR>. Perform the subnet test in<A HREF="#opp.test">
- our quickstart guide</A>. You should see a connection, and</P>
-<PRE>    ipsec eroute</PRE>
-<P>should include an entry which mentions the subnet node's IP and the
- OE test site IP, like this:</P>
-<PRE>    192.0.2.131/32   -&gt; 192.139.46.77/32  =&gt; tun0x149f@192.0.2.11</PRE>
-<A HREF="example5"></A>
-<H3><A NAME="4_2_5">Example 5: Adding a Subnet to the VPN</A></H3>
-<P>Suppose you wish to secure traffic to a subnet 192.0.2.192/29 behind
- a FreeS/WAN box 192.0.2.12.</P>
-<P>First, add DNS entries to configure 192.0.2.12 as an opportunistic
- gateway for that subnet. Instructions are in our<A HREF="#opp.gate">
- quickstart guide</A>. Next, create a<VAR> private-net</VAR> group on
- 192.0.2.12 as described in<A HREF="#example4"> Example 4</A>.</P>
-<P>On each other host, add the subnet 192.0.2.192/29 to<VAR> private</VAR>
-, yielding for example</P>
-<PRE>    [root@xy root]# cd /etc/ipsec.d/policies
-    [root@xy policies]# cat private
-        192.0.2.9              # several hosts at example.com
-        192.0.2.11
-        192.0.2.12             # HR department gateway
-        192.0.2.192/29         # HR subnet
-        irc.private.example.com
-</PRE>
-<P>and reread policy groups with</P>
-<PRE>    ipsec auto --rereadgroups</PRE>
-<P>That's all the configuration you need.</P>
-<P>Test your VPN by pinging from a machine on 192.0.2.192/29 to any
- other host:</P>
-<PRE>    [root@192.0.2.194]# ping 192.0.2.11</PRE>
-<P>After a second or two, traffic should flow, and</P>
-<PRE>    ipsec eroute</PRE>
-<P>should yield something like</P>
-<PRE>    192.0.2.11/32   -&gt; 192.0.2.194/32  =&gt; tun0x149f@192.0.2.12
-</PRE>
-<P>Key:</P>
-<TABLE>
-<TR><TD>1.</TD><TD>192.0.2.11/32</TD><TD>Local start point of the
- protected traffic.</TD></TR>
-<TR><TD>2.</TD><TD>192.0.2.194/32</TD><TD>Remote end point of the
- protected traffic.</TD></TR>
-<TR><TD>3.</TD><TD>192.0.2.12</TD><TD>Remote FreeS/WAN node (gateway or
- host). May be the same as (2).</TD></TR>
-<TR><TD>4.</TD><TD>[not shown]</TD><TD>Local FreeS/WAN node (gateway or
- host), where you've produced the output. May be the same as (1).</TD></TR>
-</TABLE>
-<P>For additional assurance, you can verify with a packet sniffer that
- the traffic is being encrypted.</P>
-<P>Note</P>
-<UL>
-<LI>Because strangers may also connect via OE, this type of VPN may
- require a stricter firewalling policy than a conventional VPN.</LI>
-</UL>
-<H2><A NAME="4_3">Appendix</A></H2>
-<A NAME="hiddenconn"></A>
-<H3><A NAME="4_3_1">Our Hidden Connections</A></H3>
-<P>Our Base Policy Groups are created using hidden connections. These
- are spelled out in<A HREF="manpage.d/ipsec.conf.5.html"> man ipsec.conf</A>
- and defined in<VAR> /usr/local/lib/ipsec/_confread</VAR>.</P>
-<A NAME="custom_policygroups"></A>
-<H3><A NAME="4_3_2">Custom Policy Groups</A></H3>
-<P>A policy group is built using a special connection description in<VAR>
- ipsec.conf</VAR>, which:</P>
-<UL>
-<LI>is<STRONG> generic</STRONG>. It uses<VAR>
- right=[%group|%opportunisticgroup]</VAR> rather than specific IPs. The
- connection is cloned for every name or IP range listed in its Policy
- Group file.</LI>
-<LI>often has a<STRONG> failure rule</STRONG>. This rule, written<VAR>
- failureshunt=[passthrough|drop|reject|none]</VAR>, tells FreeS/WAN what
- to do with packets for these CIDRs if it fails to establish the
- connection. Default is<VAR> none</VAR>.</LI>
-</UL>
-<P>To create a new group:</P>
-<OL>
-<LI>Create its connection definition in<VAR> ipsec.conf</VAR>.</LI>
-<LI>Create a Policy Group file in<VAR> /etc/ipsec.d/policies</VAR> with
- the same name as your connection.</LI>
-<LI>Put a CIDR block in that file.</LI>
-<LI>Reread groups with<VAR> ipsec auto --rereadgroups</VAR>.</LI>
-<LI>Test:<VAR> ping</VAR> to activate any OE connection, and view
- results with<VAR> ipsec eroute</VAR>.</LI>
-</OL>
-<A NAME="disable_oe"></A><A NAME="disable_policygroups"></A>
-<H3><A NAME="4_3_3">Disabling Opportunistic Encryption</A></H3>
-<P>To disable OE (eg. policy groups and packetdefault), cut and paste
- the following lines to<VAR> /etc/ipsec.conf</VAR>:</P>
-<PRE>conn block
-    auto=ignore
-
-conn private
-    auto=ignore
-
-conn private-or-clear
-    auto=ignore
-
-conn clear-or-private
-    auto=ignore
-
-conn clear
-    auto=ignore
-
-conn packetdefault
-    auto=ignore</PRE>
-<P>Restart FreeS/WAN so that the changes take effect:</P>
-<PRE>    ipsec setup restart</PRE>
-<HR>
-<H1><A NAME="5">FreeS/WAN FAQ</A></H1>
-<P>This is a collection of questions and answers, mostly taken from the
- FreeS/WAN<A href="mail.html"> mailing list</A>. See the project<A href="http://www.freeswan.org/">
- web site</A> for more information. All the FreeS/WAN documentation is
- online there.</P>
-<P>Contributions to the FAQ are welcome. Please send them to the project<A
-href="mail.html"> mailing list</A>.</P>
-<HR>
-<H2><A name="questions">Index of FAQ questions</A></H2>
-<UL>
-<LI><A href="#whatzit">What is FreeS/WAN?</A></LI>
-<LI><A href="#problems">How do I report a problem or seek help?</A></LI>
-<LI><A href="#generic">Can I get ...</A>
-<UL>
-<LI><A href="#lemme_out">... an off-the-shelf system that includes
- FreeS/WAN?</A></LI>
-<LI><A href="#contractor">... contractors or staff who know FreeS/WAN?</A>
-</LI>
-<LI><A href="#commercial">... commercial support?</A></LI>
-</UL>
-</LI>
-<LI><A href="#release">Release questions</A>
-<UL>
-<LI><A href="#rel.current">What is the current release?</A></LI>
-<LI><A href="#relwhen">When is the next release?</A></LI>
-<LI><A href="#rel.bugs">Are there known bugs in the current release?</A></LI>
-</UL>
-</LI>
-<LI><A href="mod_cons">Modifications and contributions</A>
-<UL>
-<LI><A href="#modify.faq">Can I modify FreeS/WAN to ...?</A></LI>
-<LI><A href="#contrib.faq">Can I contribute to the project?</A></LI>
-<LI><A href="#ddoc.faq">Is there detailed design documentation?</A></LI>
-</UL>
-</LI>
-<LI><A href="#interact">Will FreeS/WAN work in my environment?</A>
-<UL>
-<LI><A href="#interop.faq">Can FreeS/WAN talk to ... ?</A></LI>
-<LI><A href="#old_to_new">Can different FreeS/WAN versions talk to each
- other?</A></LI>
-<LI><A href="#faq.bandwidth">Is there a limit on throughput?</A></LI>
-<LI><A href="#faq.number">Is there a limit on number of connections?</A></LI>
-<LI><A href="#faq.speed">Is a ... fast enough to handle FreeS/WAN with
- my loads?</A></LI>
-</UL>
-</LI>
-<LI><A href="#work_on">Will FreeS/WAN work on ...</A>
-<UL>
-<LI><A href="#versions">... my version of Linux?</A></LI>
-<LI><A href="#nonIntel.faq">... non-Intel CPUs?</A></LI>
-<LI><A href="#multi.faq">... multiprocessors?</A></LI>
-<LI><A href="#k.old">... an older kernel?</A></LI>
-<LI><A href="#k.versions">... the latest kernel version?</A></LI>
-<LI><A href="#interface.faq">... unusual network hardware?</A></LI>
-<LI><A href="#vlan">... a VLAN (802.1q) network?</A></LI>
-</UL>
-</LI>
-<LI><A href="#features.faq">Does FreeS/WAN support ...</A>
-<UL>
-<LI><A href="#VPN.faq">... site-to-site VPN applications</A></LI>
-<LI><A href="#warrior.faq">... remote users connecting to a LAN</A></LI>
-<LI><A href="#road.shared.possible">... remote users using shared secret
- authentication?</A></LI>
-<LI><A href="#wireless.faq">... wireless networks</A></LI>
-<LI><A href="#PKIcert">... X.509 or other PKI certificates?</A></LI>
-<LI><A href="#Radius">... user authentication (Radius, SecureID, Smart
- Card ...)?</A></LI>
-<LI><A href="#NATtraversal">... NAT traversal</A></LI>
-<LI><A href="#virtID">... assigning a &quot;virtual identity&quot; to a remote
- system?</A></LI>
-<LI><A href="#noDES.faq">... single DES encryption?</A></LI>
-<LI><A href="#AES.faq">... AES encryption?</A></LI>
-<LI><A href="#other.cipher">... other encryption algorithms?</A></LI>
-</UL>
-</LI>
-<LI><A href="#canI">Can I ...</A>
-<UL>
-<LI><A href="#policy.preconfig">...use policy groups along with
- explicitly configured connections?</A></LI>
-<LI><A href="#policy.off">...turn off policy groups?</A></LI>
-
-<!--
-      <li><a href="#policy.otherinterface">...use policy groups
-      on an interface other than <VAR>%defaultroute</VAR>?</a></li>
--->
-<LI><A href="#reload">... reload connection info without restarting?</A></LI>
-<LI><A href="#masq.faq">... use several masqueraded subnets?</A></LI>
-<LI><A href="#dup_route">... use subnets masqueraded to the same
- addresses?</A></LI>
-<LI><A href="#road.masq">... assign a road warrior an address on my net
- (a virtual identity)?</A></LI>
-<LI><A href="#road.many">... support many road warriors with one
- gateway?</A></LI>
-<LI><A href="#road.PSK">... have many road warriors using shared secret
- authentication?</A></LI>
-<LI><A href="#QoS">... use Quality of Service routing with FreeS/WAN?</A>
-</LI>
-<LI><A href="#deadtunnel">... recognise dead tunnels and shut them down?</A>
-</LI>
-<LI><A href="#demanddial">... build IPsec tunnels over a demand-dialed
- link?</A></LI>
-<LI><A href="#GRE">... build GRE, L2TP or PPTP tunnels over IPsec?</A></LI>
-<LI><A href="#NetBIOS">... use Network Neighborhood (Samba, NetBIOS)
- over IPsec?</A></LI>
-</UL>
-</LI>
-<LI><A href="#setup.faq">Life's little mysteries</A>
-<UL>
-<LI><A href="#cantping">I cannot ping ....</A></LI>
-<LI><A href="#forever">It takes forever to ...</A></LI>
-<LI><A href="#route">I send packets to the tunnel with route(8) but they
- vanish</A></LI>
-<LI><A href="#down_route">When a tunnel goes down, packets vanish</A></LI>
-<LI><A href="#firewall_ate">The firewall ate my packets!</A></LI>
-<LI><A href="#dropconn">Dropped connections</A></LI>
-<LI><A href="#defaultroutegone">Disappearing %defaultroute</A></LI>
-<LI><A href="#tcpdump.faq">TCPdump on the gateway shows strange things</A>
-</LI>
-<LI><A href="#no_trace">Traceroute does not show anything between the
- gateways</A></LI>
-</UL>
-</LI>
-<LI><A href="#man4debug">Testing in stages (or .... works but ...
- doesn't)</A>
-<UL>
-<LI><A href="#nomanual">Manually keyed connections don't work</A></LI>
-<LI><A href="#spi_error">One manual connection works, but second one
- fails</A></LI>
-<LI><A href="#man_no_auto">Manual connections work, but automatic keying
- doesn't</A></LI>
-<LI><A href="#nocomp">IPsec works, but connections using compression
- fail</A></LI>
-<LI><A href="#pmtu.broken">Small packets work, but large transfers fail</A>
-</LI>
-<LI><A href="#subsub">Subnet-to-subnet works, but tests from the
- gateways don't</A></LI>
-</UL>
-</LI>
-<LI><A href="#compile.faq">Compilation problems</A>
-<UL>
-<LI><A href="#gmp.h_missing">gmp.h: No such file or directory</A></LI>
-<LI><A href="#noVM">... virtual memory exhausted</A></LI>
-</UL>
-</LI>
-<LI><A href="#error">Interpreting error messages</A>
-<UL>
-<LI><A href="#route-client">route-client (or host) exited with status 7</A>
-</LI>
-<LI><A href="#unreachable">SIOCADDRT:Network is unreachable</A></LI>
-<LI><A href="#modprobe">ipsec_setup: modprobe: Can't locate moduleipsec</A>
-</LI>
-<LI><A href="#noKLIPS">ipsec_setup: Fatal error, kernel appears to lack
- KLIPS</A></LI>
-<LI><A href="#noDNS">ipsec_setup: ... failure to fetch key for ... from
- DNS</A></LI>
-<LI><A href="#dup_address">ipsec_setup: ... interfaces ... and ... share
- address ...</A></LI>
-<LI><A href="#kflags">ipsec_setup: Cannot adjust kernel flags</A></LI>
-<LI><A href="#message_num">Message numbers (MI3, QR1, et cetera) in
- Pluto messages</A></LI>
-<LI><A href="#conn_name">Connection names in Pluto error messages</A></LI>
-<LI><A href="#cantorient">Pluto: ... can't orient connection</A></LI>
-<LI><A href="#no.interface">... we have no ipsecN interface for either
- end of this connection</A></LI>
-<LI><A href="#noconn">Pluto: ... no connection is known</A></LI>
-<LI><A href="#nosuit">Pluto: ... no suitable connection ...</A></LI>
-<LI><A href="#noconn.auth">Pluto: ... no connection has been authorized</A>
-</LI>
-<LI><A href="#noDESsupport">Pluto: ... OAKLEY_DES_CBC is not supported.</A>
-</LI>
-<LI><A href="#notransform">Pluto: ... no acceptable transform</A></LI>
-<LI><A href="#rsasigkey">rsasigkey dumps core</A></LI>
-<LI><A href="#sig4">!Pluto failure!: ... exited with ... signal 4</A></LI>
-<LI><A href="#econnrefused">ECONNREFUSED error message</A></LI>
-<LI><A href="#no_eroute">klips_debug: ... no eroute!</A></LI>
-<LI><A href="#SAused">... trouble writing to /dev/ipsec ... SA already
- in use</A></LI>
-<LI><A href="#ignore">... ignoring ... payload</A></LI>
-<LI><A href="#unknown_rightcert">unknown parameter name &quot;rightcert&quot;</A></LI>
-</UL>
-</LI>
-<LI><A href="#spam">Why don't you restrict the mailing lists to reduce
- spam?</A></LI>
-</UL>
-<HR>
-<H2><A name="whatzit">What is FreeS/WAN?</A></H2>
-<P>FreeS/WAN is a Linux implementation of the<A href="#IPSEC"> IPsec</A>
- protocols, providing security services at the IP (Internet Protocol)
- level of the network.</P>
-<P>For more detail, see our<A href="intro.html"> introduction</A>
- document or the FreeS/WAN project<A href="http://www.freeswan.org/">
- web site</A>.</P>
-<P>To start setting it up, go to our<A href="quickstart.html">
- quickstart guide</A>.</P>
-<P>Our<A href="web.html"> web links</A> document has information on<A href="#implement">
- IPsec for other systems</A>.</P>
-<H2><A name="problems">How do I report a problem or seek help?</A></H2>
-<DL>
-<DT>Read our<A href="trouble.html"> troubleshooting</A> document.</DT>
-<DD>
-<P>It may guide you to a solution. If not, see its<A href="#prob.report">
- problem reporting</A> section.</P>
-<P>Basically, what it says is<STRONG> give us the output from<VAR> ipsec
- barf</VAR> from both gateways</STRONG>. Without full information, we
- cannot diagnose a problem. However,<VAR> ipsec barf</VAR> produces a
- lot of output. If at all possible,<STRONG> please make barfs accessible
- via the web or FTP</STRONG> rather than sending enormous mail messages.</P>
-</DD>
-<DT><STRONG>Use the<A href="mail.html"> users mailing list</A> for
- problem reports</STRONG>, rather than mailing developers directly.</DT>
-<DD>
-<UL>
-<LI>This gives you access to more expertise, including users who may
- have encountered and solved the same problems.</LI>
-<LI>It is more likely to get a quick response. Developers may get behind
- on email, or even ignore it entirely for a while, but a list message
- (given a reasonable Subject: line) is certain to be read by a fair
- number of people within hours.</LI>
-<LI>It may also be important because of<A href="#exlaw"> cryptography
- export laws</A>. A US citizen who provides technical assistance to
- foreign cryptographic work might be charged under the arms export
- regulations. Such a charge would be easier to defend if the discussion
- took place on a public mailing list than if it were done in private
- mail.</LI>
-</UL>
-</DD>
-<DT>Try irc.freenode.net#freeswan.</DT>
-<DD>
-<P>FreeS/WAN developers, volunteers and users can often be found there.
- Be patient and be prepared to provide lots of information to support
- your question.</P>
-<P>If your question was really interesting, and you found an answer,
- please share that with the class by posting to the<A href="mail.html">
- users mailing list</A>. That way others with the same problem can find
- your answer in the archives.</P>
-</DD>
-<DT>Premium support is also available.</DT>
-<DD>
-<P>See the next several questions.</P>
-</DD>
-</DL>
-<H2><A name="generic">Can I get ...</A></H2>
-<H3><A name="lemme_out">Can I get an off-the-shelf system that includes
- FreeS/WAN?</A></H3>
-<P>There are a number of Linux distributions or firewall products which
- include FreeS/WAN. See this<A href="#products"> list</A>. Using one of
- these, chosen to match your requirements and budget, may save you
- considerable time and effort.</P>
-<P>If you don't know your requirements, start by reading Schneier's<A href="#secrets">
- Secrets and Lies</A>. That gives the best overview of security issues I
- have seen. Then consider hiring a consultant (see next question) to
- help define your requirements.</P>
-<H3><A name="consultant">Can I hire consultants or staff who know
- FreeS/WAN?</A></H3>
-<P>If you want the help of a contractor, or to hire staff with FreeS/WAN
- expertise, you could:</P>
-<UL>
-<LI>check availability in your area through your local Linux User Group
- (<A href="http://lugww.counter.li.org/">LUG Index</A>)</LI>
-<LI>try asking on our<A href="mail.html"> mailing list</A></LI>
-</UL>
-<P>For companies offerring support, see the next question.</P>
-<H3><A name="commercial">Can I get commercial support?</A></H3>
-<P>Many of the distributions or firewall products which include
- FreeS/WAN (see this<A href="#products"> list</A>) come with commercial
- support or have it available as an option.</P>
-<P>Various companies specialize in commercial support of open source
- software. Our project leader was a founder of the first such company,
- Cygnus Support. It has since been bought by<A href="http://www.redhat.com">
- Redhat</A>. Another such firm is<A href="http://www.linuxcare.com">
- Linuxcare</A>.</P>
-<H2><A name="release">Release questions</A></H2>
-<H3><A name="rel.current">What is the current release?</A></H3>
-<P>The current release is the highest-numbered tarball on our<A href="ftp://ftp.xs4all.nl/pub/crypto/freeswan">
- distribution site</A>. Almost always, any of<A href="#mirrors"> the
- mirrors</A> will have the same file, though perhaps not for a day or so
- after a release.</P>
-<P>Unfortunately, the web site is not always updated as quickly as it
- should be.</P>
-<H3><A name="relwhen">When is the next release?</A></H3>
-<P>We try to do a release approximately every six to eight weeks.</P>
-<P>If pre-release tests fail and the fix appears complex, or more
- generally if the code does not appear stable when a release is
- scheduled, we will just skip that release.</P>
-<P>For serious bugs, we may bring out an extra bug-fix release. These
- get numbers in the normal release series. For example, there was a bug
- found in FreeS/WAN 1.6, so we did another release less than two weeks
- later. The bug-fix release was called 1.7.</P>
-<H3><A name="rel.bugs">Are there known bugs in the current release?</A></H3>
-<P>Any problems we are aware of at the time of a release are documented
- in the<A href="../BUGS"> BUGS</A> file for that release. You should
- also look at the<A href="../CHANGES"> CHANGES</A> file.</P>
-<P>Bugs discovered after a release are discussed on the<A href="mail.html">
- mailing lists</A>. The easiest way to check for any problems in the
- current code would be to peruse the<A href="http://lists.freeswan.org/pipermail/briefs">
- List In Brief</A>.</P>
-<H2><A name="mod_cons">Modifications and contributions</A></H2>
-<H3><A name="modify.faq">Can I modify FreeS/WAN to ...?</A></H3>
-<P>You are free to modify FreeS/WAN in any way. See the discussion of<A href="#licensing">
- licensing</A> in our introduction document.</P>
-<P>Before investing much energy in any such project, we suggest that you</P>
-<UL>
-<LI>check the list of<A href="#patch"> existing patches</A></LI>
-<LI>post something about your project to the<A href="mail.html"> design
- mailing list</A></LI>
-</UL>
-<P>This may prevent duplicated effort, or lead to interesting
- collaborations.</P>
-<H3><A name="contrib.faq">Can I contribute to the project?</A></H3>
- In general, we welcome contributions from the community. Various
- contributed patches, either to fix bugs or to add features, have been
- incorporated into our distribution. Other patches, not yet included in
- the distribution, are listed in our<A href="#patch"> web links</A>
- section.
-<P>Users have also contributed heavily to documentation, both by
- creating their own<A href="#howto"> HowTos</A> and by posting things on
- the<A href="mail.html"> mailing lists</A> which I have quoted in these
- HTML docs.</P>
-<P>There are, however, some caveats.</P>
-<P>FreeS/WAN is being implemented in Canada, by Canadians, largely to
- ensure that is it is entirely free of export restrictions. See this<A href="#status">
- discussion</A>. We<STRONG> cannot accept code contributions from US
- residents or citizens</STRONG>, not even one-line bugs fixes. The
- reasons for this were recently discussed extensively on the mailing
- list, in a thread starting<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/01/msg00111.html">
- here</A>.</P>
-<P>Not all contributions are of interest to us. The project has a set of
- fairly ambitious and quite specific goals, described in our<A href="#goals">
- introduction</A>. Contributions that lead toward these goals are likely
- to be welcomed enthusiastically. Other contributions may be seen as
- lower priority, or even as a distraction.</P>
-<P>Discussion of possible contributions takes place on the<A href="mail.html">
- design mailing list</A>.</P>
-<H3><A name="ddoc.faq">Is there detailed design documentation?</A></H3>
- There are:
-<UL>
-<LI><A href="rfc.html">RFCs</A> specifying the protocols we implement</LI>
-<LI><A href="manpages.html">man pages</A> for our utilities, library
- functions and file formats</LI>
-<LI>comments in the source code</LI>
-<LI><A href="index.html">HTML documentation</A> written primarily for
- users</LI>
-<LI>archived discussions from the<A href="mail.html"> mailing lists</A></LI>
-<LI>other papers mentioned in our<A href="#applied"> introduction</A></LI>
-</UL>
-<P>The only formal design documents are a few papers in the last
- category above. All the other categories, however, have things to say
- about design as well.</P>
-<H2><A name="interact">Will FreeS/WAN work in my environment?</A></H2>
-<H3><A name="interop.faq">Can FreeS/WAN talk to ...?</A></H3>
-<P>The IPsec protocols are designed to support interoperation. In
- theory, any two IPsec implementations should be able to talk to each
- other. In practice, it is considerably more complex. We have a whole<A href="interop.html">
- interoperation document</A> devoted to this problem.</P>
-<P>An important part of that document is links to the many<A href="interop.html#otherpub">
- user-written HowTos</A> on interoperation between FreeS/WAN and various
- other implementations. Often the users know more than the developers
- about these issues (and almost always more than me :-), so these
- documents may be your best resource.</P>
-<H3><A name="old_to_new">Can different FreeS/WAN versions talk to each
- other?</A></H3>
-<P>Linux FreeS/WAN can interoperate with many IPsec implementations,
- including earlier versions of Linux FreeS/WAN itself.</P>
-<P>In a few cases, there are some complications. See our<A href="interop.html#oldswan">
- interoperation</A> document for details.</P>
-<H3><A name="faq.bandwidth">Is there a limit on throughput?</A></H3>
-<P>There is no hard limit, but see below.</P>
-<H3><A name="faq.number">Is there a limit on number of tunnels?</A></H3>
-<P>There is no hard limit, but see next question.</P>
-<H3><A name="faq.speed">Is a ... fast enough to handle FreeS/WAN with my
- loads?</A></H3>
-<P>A quick summary:</P>
-<DL>
-<DT>Even a limited machine can be useful</DT>
-<DD>A 486 can handle a T1, ADSL or cable link, though the machine may be
- breathing hard.</DD>
-<DT>A mid-range PC (say 800 MHz with good network cards) can do a lot of
- IPsec</DT>
-<DD>With up to roughly 50 tunnels and aggregate bandwidth of 20 Megabits
- per second, it willl have cycles left over for other tasks.</DD>
-<DT>There are limits</DT>
-<DD>Even a high end CPU will not come close to handling a fully loaded
- 100 Mbit/second Ethernet link.
-<P>Beyond about 50 tunnels it needs careful management.</P>
-</DD>
-</DL>
-<P>See our<A href="performance.html"> FreeS/WAN performance</A> document
- for details.</P>
-<H2><A name="work_on">Will FreeS/WAN work on ... ?</A></H2>
-<H3><A name="versions">Will FreeS/WAN run on my version of Linux?</A></H3>
-<P>We build and test on Redhat distributions, but FreeS/WAN runs just
- fine on several other distributions, sometimes with minor fiddles to
- adapt to the local environment. Details are in our<A href="#otherdist">
- compatibility</A> document. Also, some distributions or products come
- with<A href="#products"> FreeS/WAN included</A>.</P>
-<H3><A name="nonIntel.faq">Will FreeS/WAN run on non-Intel CPUs?</A></H3>
-<P>FreeS/WAN is<STRONG> intended to run on all CPUs Linux supports</STRONG>
-. We know of it being used in production on x86, ARM, Alpha and MIPS. It
- has also had successful tests on PPC and SPARC, though we don't know of
- actual use there. Details are in our<A href="#CPUs"> compatibility</A>
- document.</P>
-<H3><A name="multi.faq">Will FreeS/WAN run on multiprocessors?</A></H3>
-<P>FreeS/WAN is designed to work on any SMP architecture Linux supports,
- and has been tested successfully on at least dual processor Intel
- architecture machines. Details are in our<A href="#multiprocessor">
- compatibility</A> document.</P>
-<H3><A name="k.old">Will FreeS/WAN work on an older kernel?</A></H3>
-<P>It might, but we strongly recommend using a recent 2.2 or 2.4 series
- kernel. Sometimes the newer versions include security fixes which can
- be quite important on a gateway.</P>
-<P>Also, we use recent kernels for development and testing, so those are
- better tested and, if you do encounter a problem, more easily
- supported. If something breaks applying recent FreeS/WAN patches to an
- older kernel, then &quot;update your kernel&quot; is almost certain to be the
- first thing we suggest. It may be the only suggestion we have.</P>
-<P>The precise kernel versions supported by a particular FreeS/WAN
- release are given in the<A href="XX"> README</A> file of that release.</P>
-<P>See the following question for more on kernels.</P>
-<H3><A name="k.versions">Will FreeS/WAN run on the latest kernel
- version?</A></H3>
-<P>Sometimes yes, but quite often, no.</P>
-<P>Kernel versions supported are given in the<A href="../README"> README</A>
- file of each FreeS/WAN release. Typically, they are whatever production
- kernels were current at the time of our release (or shortly before; we
- might release for kernel<VAR> n</VAR> just as Linus releases<VAR> n+1</VAR>
-). Often FreeS/WAN will work on slightly later kernels as well, but of
- course this cannot be guaranteed.</P>
-<P>For example, FreeS/WAN 1.91 was released for kernels 2.2.19 or 2.4.5,
- the current kernels at the time. It also worked on 2.4.6, 2.4.7 and
- 2.4.8, but 2.4.9 had changes that caused compilation errors if it was
- patched with FreeS/WAN 1.91.</P>
-<P>When such changes appear, we put a fix in the FreeS/WAN snapshots,
- and distribute it with our next release. However, this is not a high
- priority for us, and it may take anything from a few days to several
- weeks for such a problem to find its way to the top of our kernel
- programmer's To-Do list. In the meanwhile, you have two choices:</P>
-<UL>
-<LI>either stick with a slightly older kernel, even if it is not the
- latest and greatest. This is recommended for production systems; new
- versions may have new bugs.</LI>
-<LI>or fix the problem yourself and send us a patch, via the<A href="mail.html">
- Users mailing list</A>.</LI>
-</UL>
-<P>We don't even try to keep up with kernel changes outside the main 2.2
- and 2.4 branches, such as the 2.4.x-ac patched versions from Alan Cox
- or the 2.5 series of development kernels. We'd rather work on
- developing the FreeS/WAN code than on chasing these moving targets. We
- are, however, happy to get patches for problems discovered there.</P>
-<P>See also the<A href="install.html#choosek"> Choosing a kernel</A>
- section of our installation document.</P>
-<H3><A name="interface.faq">Will FreeS/WAN work on unusual network
- hardware?</A></H3>
-<P>IPsec is designed to work over any network that IP works over, and
- FreeS/WAN is intended to work over any network interface hardware that
- Linux supports.</P>
-<P>If you have working IP on some unusual interface -- perhaps Arcnet,
- Token Ring, ATM or Gigabit Ethernet -- then IPsec should &quot;just work&quot;.</P>
-<P>That said, practice is sometimes less tractable than theory. Our
- testing is done almost entirely on:</P>
-<UL>
-<LI>10 or 100 Mbit Ethernet</LI>
-<LI>ADSL or cable connections, with and without PPPoE</LI>
-<LI>IEEE 802.11 wireless LANs (see<A href="#wireless.faq"> below</A>)</LI>
-</UL>
-<P>If you have some other interface, especially an uncommon one, it is
- entirely possible you will get bitten either by a FreeS/WAN bug which
- our testing did not turn up, or by a bug in the driver that shows up
- only with our loads.</P>
-<P>If IP works on your interface and FreeS/WAN doesn't, seek help on the<A
-href="mail.html"> mailing lists</A>.</P>
-<P>Another FAQ section describes<A href="#pmtu.broken"> MTU problems</A>
-. These are a possibility for some interfaces.</P>
-<H3><A name="vlan">Will FreeS/WAN work on a VLAN (802.1q) network?</A></H3>
-<P> Yes, FreeSwan works fine, though some network drivers have problems
- with jumbo sized ethernet frames. If you used interfaces=%defaultroute
- you do not need to change anything, but if you specified an interface
- (eg eth0) then remember you must change that to reflect the VLAN
- interface (eg eth0.2 for VLAN ID 2).</P>
-<P> The &quot;eepro100&quot; module is known to be broken, use the e100 driver for
- those cards instead (included in 2.4 as 'alternative driver' for the
- Intel EtherExpressPro/100.</P>
-<P> You do not need to change any MTU setting (those are workarounds
- that are only needed for buggy drivers)</P>
-<P><EM>This FAQ contributed by Paul Wouters.</EM></P>
-<H2><A name="features.faq">Does FreeS/WAN support ...</A></H2>
-<P>For a discussion of which parts of the IPsec specifications FreeS/WAN
- does and does not implement, see our<A href="#spec"> compatibility</A>
- document.</P>
-<P>For information on some often-requested features, see below.</P>
-<H3><A name="VPN.faq"></A>Does FreeS/WAN support site-to-site VPN (<A HREF="#VPN">
-Virtual Private Network</A>) applications?</H3>
-<P>Absolutely. See this FreeS/WAN-FreeS/WAN<A HREF="config.html">
- configuration example</A>. If only one site is using FreeS/WAN, there
- may be a relevant HOWTO on our<A HREF="interop.html"> interop page</A>.</P>
-<H3><A name="warrior.faq">Does FreeS/WAN support remote users connecting
- to a LAN?</A></H3>
-<P>Yes. We call the remote users &quot;Road Warriors&quot;. Check out our
- FreeS/WAN-FreeS/WAN<A HREF="#config.rw"> Road Warrior Configuration
- Example</A>.</P>
-<P>If your Road Warrior is a Windows or Mac PC, you may need to install
- an IPsec implementation on that machine. Our<A HREF="interop.html">
- interop</A> page lists many available brands, and features links to
- several HOWTOs.</P>
-<H3><A name="road.shared.possible">Does FreeS/WAN support remote users
- using shared secret authentication?</A></H3>
-<P><STRONG>Yes, but</STRONG> there are severe restrictions, so<STRONG>
- we strongly recommend using</STRONG><A href="#RSA"><STRONG> RSA</STRONG>
-</A><STRONG> keys for</STRONG><A href="#authentication"><STRONG>
- authentication</STRONG></A><STRONG> instead</STRONG>.</P>
-<P>See this<A href="#road.PSK"> FAQ question</A>.</P>
-<H3><A name="wireless.faq">Does FreeS/WAN support wireless networks?</A></H3>
-<P>Yes, it is a common practice to use IPsec over wireless networks
- because their built-in encryption,<A href="#WEP"> WEP</A>, is insecure.</P>
-<P>There is some<A href="#wireless.config"> discussion</A> in our
- advanced configuration document. See also the<A HREF="http://www.wavesec.org">
- WaveSEC site</A>.</P>
-<H3><A name="PKIcert">Does FreeS/WAN support X.509 or other PKI
- certificates?</A></H3>
-<P>Vanilla FreeS/WAN does not support X.509, but Andreas Steffen and
- others have provided a popular, well-supported X.509 patch.</P>
-<UL>
-<LI><A HREF="http://www.strongsec.com/freeswan">patch</A></LI>
-<LI><A HREF="http://www.freeswan.ca">Super FreeS/WAN</A> incorporates
- this and other user-contributed patches.</LI>
-<LI> Kai Martius'<A HREF="http://www.strongsec.com/freeswan/install.htm">
- X.509 Installation and Configuration Guide</A></LI>
-</UL>
-<P> Linux FreeS/WAN features<A HREF="quickstart.html"> Opportunistic
- Encryption</A>, an alternative Public Key Infrastructure based on
- Secure DNS.</P>
-<H3><A name="Radius">Does FreeS/WAN support user authentication (Radius,
- SecureID, Smart Card...)?</A></H3>
-<P>Andreas Steffen's<A HREF="http://www.strongsec.com/freeswan"> X.509
- patch</A> (v. 1.42+) supports Smart Cards. The patch does not ship with
- vanilla FreeS/WAN, but will be incorporated into<A HREF="http://www.freeswan.ca/">
- Super FreeS/WAN 2.01+</A>. The patch implements the PCKS#15
- Cryptographic Token Information Format Standard, using the OpenSC
- smartcard library functions.</P>
-<P>Older news:</P>
-<P>A user-supported patch to FreeS/WAN 1.3, for smart card style
- authentication, is available on<A HREF="http://alcatraz.webcriminals.com/~bastiaan/ipsec">
- Bastiaan's site</A>. It supports skeyid and ibutton. This patch is not
- part of Super FreeS/WAN.</P>
-<P>For a while progress on this front was impeded by a lack of standard.
- The IETF<A href="http://www.ietf.org/html.charters/ipsra-charter.html">
- working group</A> has now nearly completed its recommended solution to
- the problem; meanwhile several vendors have implemented various things.</P>
-
-<!--
-<p>The <a href="web.html#patch">patches</a> section of our web links document
-has links to some user work on this.</p>
--->
-<P>Of course, there are various ways to avoid any requirement for user
- authentication in IPsec. Consider the situation where road warriors
- build IPsec tunnels to your office net and you are considering
- requiring user authentication during tunnel negotiation. Alternatives
- include:</P>
-<UL>
-<LI>If you can trust the road warrior machines, then set them up so that
- only authorised users can create tunnels. If your road warriors use
- laptops, consider the possibility of theft.</LI>
-<LI>If the tunnel only provides access to particular servers and you can
- trust those servers, then set the servers up to require user
- authentication.</LI>
-</UL>
-<P>If either of those is trustworthy, it is not clear that you need user
- authentication in IPsec.</P>
-<H3><A name="NATtraversal">Does FreeS/WAN support NAT traversal?</A></H3>
-<P>Vanilla FreeS/WAN does not, but thanks to Mathieu Lafon and Arkoon
- Network Security, there's a patch to support this.</P>
-<UL>
-<LI><A HREF="http://open-source.arkoon.net">patch and documentation</A></LI>
-<LI><A HREF="http://www.freeswan.ca">Super FreeS/WAN</A> incorporates
- this and other user-contributed patches.</LI>
-</UL>
-<P>The NAT traversal patch has some issues with PSKs, so you may wish to
- authenticate with RSA keys, or X.509 (requires a patch which is also
- included in Super FreeS/WAN). Doing the latter also has advantages when
- dealing with large numbers of clients who may be behind NAT; instead of
- having to make an individual Roadwarrior connection for each virtual
- IP, you can use the &quot;rightsubnetwithin&quot; parameter to specify a range.
- See<A HREF="http://www.strongsec.com/freeswan/install.htm#section_4.4">
- these<VAR> rightsubnetwithin</VAR> instructions</A>.</P>
-<H3><A name="virtID">Does FreeS/WAN support assigning a &quot;virtual
- identity&quot; to a remote system?</A></H3>
-<P>Some IPsec implementations allow you to make the source address on
- packets sent by a Road Warrior machine be something other than the
- address of its interface to the Internet. This is sometimes described
- as assigning a virtual identity to that machine.</P>
-<P>FreeS/WAN does not directly support this, but it can be done. See
- this<A href="#road.masq"> FAQ question</A>.</P>
-<H3><A name="noDES.faq">Does FreeS/WAN support single DES encryption?</A>
-</H3>
-<P><STRONG>No</STRONG>, single DES is not used either at the<A href="#IKE">
- IKE</A> level for negotiating connections or at the<A href="#IPSEC">
- IPsec</A> level for actually building them.</P>
-<P>Single DES is<A href="#desnotsecure"> insecure</A>. As we see it, it
- is more important to deliver real security than to comply with a
- standard which has been subverted into allowing use of inadequate
- methods. See this<A href="#weak"> discussion</A>.</P>
-<P>If you want to interoperate with an IPsec implementation which offers
- only DES, see our<A href="interop.html#noDES"> interoperation</A>
- document.</P>
-<H3><A name="AES.faq">Does FreeS/WAN support AES encryption?</A></H3>
-<P><A href="#AES">AES</A> is a new US government<A href="#block"> block
- cipher</A> standard to replace the obsolete<A href="#DES"> DES</A>.</P>
-<P>At time of writing (March 2002), the FreeS/WAN distribution does not
- yet support AES but user-written<A href="#patch"> patches</A> are
- available to add it. Our kernel programmer is working on integrating
- those patches into the distribution, and there is active discussion of
- this on the design mailimg list.</P>
-<H3><A name="other.cipher">Does FreeS/WAN support other encryption
- algorithms?</A></H3>
-<P>Currently<A href="#3DES"> triple DES</A> is the only cipher
- supported. AES will almost certainly be added (see previous question),
- and it is likely that in the process we will also add the other two AES
- finalists with open licensing, Twofish and Serpent.</P>
-<P>We are extremely reluctant to add other ciphers. This would make both
- use and maintenance of FreeS/WAN more complex without providing any
- clear benefit. Complexity is emphatically not desirable in a security
- product.</P>
-<P>Various users have written patches to add other ciphers. We provide<A href="#patch">
- links</A> to these.</P>
-<H2><A name="canI">Can I ...</A></H2>
-<H3><A name="policy.preconfig">Can I use policy groups along with
- explicitly configured connections?</A></H3>
-<P>Yes, you can, so long as you pay attention to the selection rule,
- which can be summarized &quot;the most specific connection wins&quot;. We
- describe the rule in our<A HREF="#policy.group.notes"> policy groups</A>
- document, and provide a more technical explanation in<A HREF="manpage.d/ipsec.conf.5.html">
- man ipsec.conf</A>.</P>
-<P>A good guideline: If you have a regular connection defined in<VAR>
- ipsec.conf</VAR>, ensure that a subset of that connection is not listed
- in a less restrictive policy group. Otherwise, FreeS/WAN will use the
- subset, with its more specific source/destination pair.</P>
-<P>Here's an example. Suppose you are the system administrator at
- 192.0.2.2. You have this connection in ipsec.conf:<VAR> ipsec.conf</VAR>
-:</P>
-<PRE>conn net-to-net
-    left=192.0.2.2           # you are here
-    right=192.0.2.8
-    rightsubnet=192.0.2.96/27
-    ....
-</PRE>
-<P>If you then place a host or net within<VAR> rightsubnet</VAR>, (let's
- say 192.0.2.98) in<VAR> private-or-clear</VAR>, you may find that
- 192.0.2.2 at times communicates in the clear with 192.0.2.98. That's
- consistent with the rule, but may be contrary to your expectations.</P>
-<P>On the other hand, it's safe to put a larger subnet in a less
- restrictive policy group file. If<VAR> private-or-clear</VAR> contains
- 192.0.2.0/24, then the more specific<VAR> net-to-net</VAR> connection
- is used for any communication to 192.0.2.96/27. The more general policy
- applies only to communication with hosts or subnets in 192.0.2.0/24
- without a more specific policy or connection.</P>
-<H3><A name="policy.off">Can I turn off policy groups?</A></H3>
-<P>Yes. Use<A HREF="#disable_policygroups"> these instructions</A>.</P>
-
-<!--
-<h3><a name="policy.otherinterface">Can I use policy groups
- on an interface other than <VAR>%defaultroute</VAR>?</a></h3>
-
-<p>??<p>
--->
-<H3><A name="reload">Can I reload connection info without restarting?</A>
-</H3>
-<P>Yes, you can do this. Here are the details, in a mailing list message
- from Pluto programmer Hugh Redelmeier:</P>
-<PRE>| How can I reload config's without restarting all of pluto and klips?  I am using
-| FreeSWAN -&gt; PGPNet in a medium sized production environment, and would like to be
-| able to add new connections ( i am using include config/* ) without dropping current
-| SA's.
-| 
-| Can this be done?
-| 
-| If not, are there plans to add this kind of feature?
-
-        ipsec auto --add whatever
-This will look in the usual place (/etc/ipsec.conf) for a conn named
-whatever and add it.
-
-If you added new secrets, you need to do
-        ipsec auto --rereadsecrets
-before Pluto needs to know those secrets.
-
-| I have looked (perhaps not thoroughly enough tho) to see how to do this:
-
-There may be more bits to look for, depending on what you are trying
-to do.</PRE>
-<P>Another useful command here is<VAR> ipsec auto --replace &lt;conn_name&gt;</VAR>
- which re-reads data for a named connection.</P>
-<H3><A name="masq.faq">Can I use several masqueraded subnets?</A></H3>
-<P>Yes. This is done all the time. See the discussion in our<A href="config.html#route_or_not">
- setup</A> document. The only restriction is that the subnets on the two
- ends must not overlap. See the next question.</P>
-<P>Here is a mailing list message on the topic. The user incorrectly
- thinks you need a 2.4 kernel for this -- actually various people have
- been doing it on 2.0 and 2.2 for quite some time -- but he has it right
- for 2.4.</P>
-<PRE>Subject: Double NAT and freeswan working :)
-   Date: Sun, 11 Mar 2001
-   From: Paul Wouters &lt;paul@xtdnet.nl&gt;
-
-Just to share my pleasure, and make an entry for people who are searching
-the net on how to do this. Here's the very simple solution to have a double
-NAT'ed network working with freeswan. (Not sure if this is old news, but I'm
-not on the list (too much spam) and I didn't read this in any HOWTO/FAQ/doc
-on the freeswan site yet (Sandy, put it in! :)
-
-10.0.0.0/24 --- 10.0.0.1 a.b.c.d  ---- a.b.c.e {internet} ----+
-                                                              |
-10.0.1.0/24 --- 10.0.1.1 f.g.h.i  ---- f.g.h.j {internet} ----+
-
-the goal is to have the first network do a VPN to the second one, yet also
-have NAT in place for connections not destinated for the other side of the
-NAT. Here the two Linux security gateways have one real IP number (cable
-modem, dialup, whatever.
-
-The problem with NAT is you don't want packets from 10.*.*.* to 10.*.*.*
-to be NAT'ed. While with Linux 2.2, you can't, with Linux 2.4 you can.
-
-(This has been tested and works for 2.4.2 with Freeswan snapshot2001mar8b)
-
-relevant parts of /etc/ipsec.conf:
-
-        left=f.g.h.i
-        leftsubnet=10.0.1.0/24
-        leftnexthop=f.g.h.j
-        leftfirewall=yes
-        leftid=@firewall.netone.nl
-        leftrsasigkey=0x0........
-        right=a.b.c.d
-        rightsubnet=10.0.0.0/24
-        rightnexthop=a.b.c.e
-        rightfirewall=yes
-        rightid=@firewall.nettwo.nl
-        rightrsasigkey=0x0......
-        # To authorize this connection, but not actually start it, at startup,
-        # uncomment this.
-        auto=add
-
-and now the real trick. Setup the NAT correctly on both sites:
-
-iptables -t nat -F
-iptables -t nat -A POSTROUTING -o eth0 -d \! 10.0.0.0/8 -j MASQUERADE
-
-This tells the NAT code to only do NAT for packets with destination other then
-10.* networks. note the backslash to mask the exclamation mark to protect it
-against the shell.
-
-Happy painting :)
-
-Paul</PRE>
-<H3><A name="dup_route">Can I use subnets masqueraded to the same
- addresses?</A></H3>
-<P><STRONG>No.</STRONG> The notion that IP addresses are unique is one
- of the fundamental principles of the IP protocol. Messing with it is
- exceedingly perilous.</P>
-<P>Fairly often a situation comes up where a company has several
- branches, all using the same<A href="#non-routable"> non-routable
- addresses</A>, perhaps 192.168.0.0/24. This works fine as long as those
- nets are kept distinct. The<A href="#masq"> IP masquerading</A> on
- their firewalls ensures that packets reaching the Internet carry the
- firewall address, not the private address.</P>
-<P>This can break down when IPsec enters the picture. FreeS/WAN builds a
- tunnel that pokes through both masquerades and delivers packets from<VAR>
- leftsubnet</VAR> to<VAR> rightsubnet</VAR> and vice versa. For this to
- work, the two subnets<EM> must</EM> be distinct.</P>
-<P>There are several solutions to this problem.</P>
-<P>Usually, you<STRONG> re-number the subnets</STRONG>. Perhaps the
- Vancouver office becomes 192.168.101.0/24, Calgary 192.168.102.0/24 and
- so on. FreeS/WAN can happily handle this. With, for example<VAR>
- leftsubnet=192.168.101.0/24</VAR> and<VAR> rightsubnet=192.168.102.0/24</VAR>
- in a connection description, any machine in Calgary can talk to any
- machine in Vancouver. If you want to be more restrictive and use
- something like<VAR> leftsubnet=192.168.101.128/25</VAR> and<VAR>
- rightsubnet=192.168.102.240/28</VAR> so only certain machines on each
- end have access to the tunnel, that's fine too.</P>
-<P>You could also<STRONG> split the subnet</STRONG> into smaller ones,
- for example using<VAR> 192.168.1.0/25</VAR> in Vancouver and<VAR>
- rightsubnet=192.168.0.128/25</VAR> in Calgary.</P>
-<P>Alternately, you can just<STRONG> give up routing</STRONG> directly
- to machines on the subnets. Omit the<VAR> leftsubnet</VAR> and<VAR>
- rightsubnet</VAR> parameters from your connection descriptions. Your
- IPsec tunnels will then run between the public interfaces of the two
- firewalls. Packets will be masqueraded both before they are put into
- tunnels and after they emerge. Your Vancouver client machines will see
- only one Calgary machine, the firewall.</P>
-<H3><A name="road.masq">Can I assign a road warrior an address on my net
- (a virtual identity)?</A></H3>
-<P>Often it would be convenient to be able to give a Road Warrior an IP
- address which appears to be on the local network. Some IPsec
- implementations have support for this, sometimes calling the feature
- &quot;virtual identity&quot;.</P>
-<P>Currently (Sept 2002) FreeS/WAN does not support this, and we have no
- definite plans to add it. The difficulty is that is not yet a standard
- mechanism for it. There is an Internet Draft for a method of doing it
- using<A href="#DHCP"> DHCP</A> which looks promising. FreeS/WAN may
- support that in a future release.</P>
-<P>In the meanwhile, you can do it yourself using the Linux iproute2(8)
- facilities. Details are in<A href="http://www.av8n.com/vpn/iproute2.htm">
- this paper</A>.</P>
-<P>Another method has also been discussed on the mailing list.:</P>
-<UL>
-<LI>You can use a variant of the<A href="#extruded.config"> extruded
- subnet</A> procedure.</LI>
-<LI>You have to avoid having the road warrior's assigned address within
- the range you actually use at home base. See previous question.</LI>
-<LI>On the other hand, you want the roadwarrior's address to be within
- the range that<EM> seems</EM> to be on your network.</LI>
-</UL>
-<P>For example, you might have:</P>
-<DL>
-<DT>leftsubnet=a.b.c.0/25</DT>
-<DD>head office network</DD>
-<DT>rightsubnet=a.b.c.129/32</DT>
-<DD>extruded to a road warrior. Note that this is not in a.b.c.0/25</DD>
-<DT>a.b.c.0/24</DT>
-<DD>whole network, including both the above</DD>
-</DL>
-<P>You then set up routing so that the office machines use the IPsec
- gateway as their route to a.b.c.128/25. The leftsubnet parameter tells
- the road warriors to use tunnels to reach a.b.c.0/25, so you should
- have two-way communication. Depending or your network and applications,
- there may be some additional work to do on DNS or Windows configuration</P>
-<H3><A name="road.many">Can I support many road warriors with one
- gateway?</A></H3>
-<P>Yes. This is easily done, using</P>
-<DL>
-<DT>either RSA authentication</DT>
-<DD>standard in the FreeS/WAN distribution</DD>
-<DT>or X.509 certificates</DT>
-<DD>requires<A href="#PKIcert"> Super FreeS/WAN or a patch</A>.</DD>
-</DL>
-<P>In either case, each Road Warrior must have a different key or
- certificate.</P>
-<P>It is also possible using pre-shared key authentication, though we
- don't recommend this; see the<A href="#road.PSK"> next question</A> for
- details.</P>
-<P>If you expect to have more than a few dozen Road Warriors connecting
- simultaneously, you may need a fairly powerful gateway machine. See our
- document on<A href="performance.html"> FreeS/WAN performance</A>.</P>
-<H3><A name="road.PSK">Can I have many road warriors using shared secret
- authentication?</A></H3>
-<P><STRONG>Yes, but avoid it if possible</STRONG>.</P>
-<P>You can have multiple Road Warriors using shared secret
- authentication<STRONG> only if they all use the same secret</STRONG>.
- You must also set:</P>
-<P></P>
-<PRE>   uniqueids=no   </PRE>
-<P>in the connection definition.</P>
-<P>Why it's less secure:</P>
-<UL>
-<LI>If you have many users, it becomes almost certain the secret will
- leak</LI>
-<LI>The secret becomes quite valuable to an attacker</LI>
-<LI>All users authenticate the same way, so the gateway cannot tell them
- apart for logging or access control purposes</LI>
-<LI>Changing the secret is difficult. You have to securely notify all
- users.</LI>
-<LI>If you find out the secret has been compromised, you can change it,
- but then what? None of your users can connect without the new secret.
- How will you notify them all, quickly and securely, without using the
- VPN?</LI>
-</UL>
-<P>This is a designed-in limitation of the<A href="#IKE"> IKE</A> key
- negotiation protocol, not a problem with our implementation.</P>
-<P><STRONG>We very strongly recommend that you avoid using shared secret
- authentication for multiple Road Warriors.</STRONG> Use RSA
- authentication instead.</P>
-<P>The longer story: When using shared secrets, the protocol requires
- that the responding gateway be able to determine which secret to use at
- a time when all it knows about the initiator is an IP address. This
- works fine if you know the initiator's address in advance and can use
- it to look up the appropiriate secret. However, it fails for Road
- Warriors since the gateway cannot know their IP addresses in advance.</P>
-<P>With RSA signatures (or certificates) the protocol is slightly
- different. The initiator provides an identifier early in the exchange
- and the responder can use that identifier to look up the correct key or
- certificate. See<A href="#road.many"> above</A>.</P>
-<H3><A name="QoS">Can I use Quality of Service routing with FreeS/WAN?</A>
-</H3>
-<P>From project technical lead Henry Spencer:</P>
-<PRE>&gt; Do QoS add to FreeS/WAN?
-&gt; For example integrating DiffServ and FreeS/WAN?
-
-With a current version of FreeS/WAN, you will have to add hidetos=no to
-the config-setup section of your configuration file.  By default, the TOS
-field of tunnel packets is zeroed; with hidetos=no, it is copied from the
-packet inside.  (This is a modest security hole, which is why it is no
-longer the default.)
-
-DiffServ does not interact well with tunneling in general.  Ways of
-improving this are being studied.</PRE>
-<P>Copying the<A href="#TOS"> TOS</A> (type of service) information from
- the encapsulated packet to the outer header reveals the TOS information
- to an eavesdropper. This does not tell him much, but it might be of use
- in<A href="#traffic"> traffic analysis</A>. Since we do not have to
- give it to him, our default is not to.</P>
-<P>Even with the TOS hidden, you can still:</P>
-<UL>
-<LI>apply QOS rules to the tunneled (ESP) packets; for example, by
- giving ESP packets a certain priority.</LI>
-<LI>apply QOS rules to the packets as they enter or exit the tunnel via
- an IPsec virtual interface (eg.<VAR> ipsec0</VAR>).</LI>
-</UL>
-<P>See<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A> for more
- on the<VAR> hidetos=</VAR> parameter.</P>
-<H3><A name="deadtunnel">Can I recognise dead tunnels and shut them
- down?</A></H3>
-<P>There is no general mechanism to do this is in the IPsec protocols.</P>
-<P>From time to time, there is discussion on the IETF Working Group<A href="#ietf">
- mailing list</A> of adding a &quot;keep-alive&quot; mechanism (which some say
- should be called &quot;make-dead&quot;), but it is a fairly complex problem and
- no consensus has been reached on whether or how it should be done.</P>
-<P>The protocol does have optional<A href="#ignore"> delete-SA</A>
- messages which one side can send when it closes a connection in hopes
- this will cause the other side to do the same. FreeS/WAN does not
- currently support these. In any case, they would not solve the problem
- since:</P>
-<UL>
-<LI>a gateway that crashes or hangs would not send the messages</LI>
-<LI>the sender is not required to send them</LI>
-<LI>they are not authenticated, so any receiver that trusts them leaves
- itself open to a<A href="#DOS"> denial of service</A> attack</LI>
-<LI>the receiver is not required to do anything about them</LI>
-<LI>the receiver cannot acknowledge them; the protocol provides no
- mechanism for that</LI>
-<LI>since they are not acknowledged, the sender cannot rely on them</LI>
-</UL>
-<P>However, connections do have limited lifetimes and you can control
- how many attempts your gateway makes to rekey before giving up. For
- example, you can set:</P>
-<PRE>conn default
-        keyingtries=3
-        keylife=30m</PRE>
-<P>With these settings old connections will be cleaned up. Within 30
- minutes of the other end dying, rekeying will be attempted. If it
- succeeds, the new connection replaces the old one. If it fails, no new
- connection is created. Either way, the old connection is taken down
- when its lifetime expires.</P>
-<P>Here is a mailing list message on the topic from FreeS/WAN tech
- support person Claudia Schmeing:</P>
-<PRE>You ask how to determine whether a tunnel is redundant:
-
-&gt; Can anybody explain the best way to determine this. Esp when a RW has
-&gt; disconnected? I thought 'ipsec auto --status' might be one way.
-
-If a tunnel goes down from one end, Linux FreeS/WAN on the
-other end has no way of knowing this until it attempts to rekey.
-Once it tries to rekey and fails, it will 'know' that the tunnel is 
-down.
-
-Because it doesn't have a way of knowing the state until this point, 
-it will also not be able to tell you the state via ipsec auto --status.
-
-&gt; However, comparing output from a working tunnel with that of one that
-&gt; was closed 
-&gt; did not show clearly show tunnel status.
-
-If your tunnel is down but not 'unrouted' (see man ipsec_auto), you
-should not be able to ping the opposite side of the tunnel. You can
-use this as an indicator of tunnel status.
-
-On a related note, you may be interested to know that as of 1.7, 
-redundant tunnels caused by RW disconnections are likely to be 
-less of a pain. From doc/CHANGES:
-
-    There is a new configuration parameter, uniqueids, to control a new Pluto
-    option:  when a new connection is negotiated with the same ID as an old
-    one, the old one is deleted immediately.  This should help eliminate
-    dangling Road Warrior connections when the same Road Warrior reconnects. 
-    It thus requires that IDs not be shared by hosts (a previously legal but
-    probably useless capability).  NOTE WELL:  the sample ipsec.conf now has
-    uniqueids=yes in its config-setup section.
-
-
-Cheers,
-
-Claudia</PRE>
-<H3><A name="demanddial">Can I build IPsec tunnels over a demand-dialed
- link?</A></H3>
-<P>This is possible, but not easy. FreeS/WAN technical lead Henry
- Spencer wrote:</P>
-<PRE>&gt; 5. If the ISDN link goes down in between and is reestablished, the SAs
-&gt; are still up but the eroute are deleted and the IPsec interface shows
-&gt; garbage (with ifconfig)
-&gt; 6. Only restarting IPsec will bring the VPN back online.
-
-This one is awkward to solve.  If the real interface that the IPsec
-interface is mounted on goes down, it takes most of the IPsec machinery
-down with it, and a restart is the only good way to recover. 
-
-The only really clean fix, right now, is to split the machines in two: 
-
-1. A minimal machine serves as the network router, and only it is aware
-that the link goes up and down. 
-
-2. The IPsec is done on a separate gateway machine, which thinks it has
-a permanent network connection, via the router.
-
-This is clumsy but it does work.  Trying to do both functions within a
-single machine is tricky.  There is a software package (diald) which will
-give the illusion of a permanent connection for demand-dialed modem
-connections; I don't know whether it's usable for ISDN, or whether it can
-be made to cooperate properly with FreeS/WAN. 
-
-Doing a restart each time the interface comes up *does* work, although it
-is a bit painful.  I did that with PPP when I was running on a modem link;
-it wasn't hard to arrange the PPP scripts to bring IPsec up and down at
-the right times.  (I'd meant to investigate diald but never found time.)
-
-In principle you don't need to do a complete restart on reconnect, but you
-do have to rebuild some things, and we have no nice clean way of doing
-only the necessary parts.</PRE>
-<P>In the same thread, one user commented:</P>
-<PRE>Subject: Re: linux-ipsec: IPsec and Dial Up Connections
-   Date: Wed, 22 Nov 2000
-   From: Andy Bradford &lt;andyb@calderasystems.com&gt;
-
-On Wed, 22 Nov 2000 19:47:11 +0100, Philip Reetz wrote:
-
-&gt; Are there any ideas what might be the cause of the problem and any way
-&gt; to work around it.
-&gt; Any help is highly appreciated.
-
-On my laptop, when using ppp there is a ip-up script in /etc/ppp that 
-will be executed each time that the ppp interface is brought up.  
-Likewise there is an ip-down script that is called when it is taken 
-down.  You might consider custimzing those to stop and start FreeS/WAN 
-with each connection.  I believe that ISDN uses the same files, though 
-I could be wrong---there should be something similar though.</PRE>
-<H3><A name="GRE">Can I build GRE, L2TP or PPTP tunnels over IPsec?</A></H3>
-<P>Yes. Normally this is not necessary, but it is useful in a few
- special cases. For example, if you must route non-IP packets such as
- IPX, you will need to use a tunneling protocol that can route these
- packets. IPsec can be layered around it for extra security. Another
- example: you can provide failover protection for high availability (HA)
- environments by combining IPsec with other tools. Ken Bantoft describes
- one such setup in<A HREF="http://www.freeswan.ca/docs/HA"> Using
- FreeS/WAN with Linux-HA, GRE, OSPF and BGP for enterprise grade VPN
- solutions</A>.</P>
-<P>GRE over IPsec is covered as part of<A HREF="http://www.freeswan.ca/docs/HA">
- that document</A>.<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/07/msg00209.html">
- Here are links</A> to other GRE resources. Jacco de Leuw has created<A HREF="http://www.jacco2.dds.nl/networking/">
- this page on L2TP over IPsec</A> with instructions for FreeS/WAN and
- several other brands of IPsec software.</P>
-<P>Please let us know of other useful links via the<A HREF="mail.html">
- mailing lists</A>.</P>
-<H3><A name="NetBIOS">... use Network Neighborhood (Samba, NetBIOS) over
- IPsec?</A></H3>
-<P>Your local PC needs to know how to translate NetBIOS names to IP
- addresses. It may do this either via a local LMHOSTS file, or using a
- local or remote WINS server. The WINS server is preferable since it
- provides a centralized source of the information to the entire network.
- To use a WINS server over the<A HREF="#VPN"> VPN</A> (or any IP-based
- network), you must enable &quot;NetBIOS over TCP&quot;.</P>
-<P><A HREF="http://www.samba.org">Samba</A> can emulate a WINS server on
- Linux.</P>
-<P> See also several discussions in our<A HREF="http://lists.freeswan.org/pipermail/users/2002-September/thread.html">
- September 2002 Users archives</A></P>
-<H2><A name="setup.faq">Life's little mysteries</A></H2>
-<P>FreeS/WAN is a fairly complex product. (Neither the networks it runs
- on nor the protocols it uses are simple, so it could hardly be
- otherwise.) It therefore sometimes exhibits behaviour which can be
- somewhat confusing, or has problems which are not easy to diagnose.
- This section tries to explain those problems.</P>
-<P>Setup and configuration of FreeS/WAN are covered in other
- documentation sections:</P>
-<UL>
-<LI><A href="quickstart.html">basic setup and configuration</A></LI>
-<LI><A href="adv_config.html">advanced configuration</A></LI>
-<LI><A href="trouble.html">Troubleshooting</A></LI>
-</UL>
-<P>However, we also list some of the commonest problems here.</P>
-<H3><A name="cantping">I cannot ping ....</A></H3>
-<P>This question is dealt with in the advanced configuration section
- under the heading<A href="#multitunnel"> multiple tunnels</A>.</P>
-<P>The standard subnet-to-subnet tunnel protects traffic<STRONG> only
- between the subnets</STRONG>. To test it, you must use pings that go
- from one subnet to the other.</P>
-<P>For example, suppose you have:</P>
-<PRE>      subnet a.b.c.0/24
-             |
-      eth1 = a.b.c.1
-         gate1
-      eth0 = 192.0.2.8
-             |
-
-       ~ internet ~
-
-             |
-      eth0 = 192.0.2.11
-         gate2
-      eth1 = x.y.z.1
-              |
-       subnet x.y.z.0/24</PRE>
-<P>and the connection description:</P>
-<PRE>conn abc-xyz
-     left=192.0.2.8
-     leftsubnet=a.b.c.0/24
-     right=192.0.2.11
-     rightsubnet=x.y.z.0/24</PRE>
-<P>You can test this connection description only by sending a ping that
- will actually go through the tunnel. Assuming you have machines at
- addresses a.b.c.2 and x.y.z.2, pings you might consider trying are:</P>
-<DL>
-<DT>ping from x.y.z.2 to a.b.c.2 or vice versa</DT>
-<DD>Succeeds if tunnel is working. This is the<STRONG> only valid test
- of the tunnel</STRONG>.</DD>
-<DT>ping from gate2 to a.b.c.2 or vice versa</DT>
-<DD><STRONG>Does not use tunnel</STRONG>. gate2 is not on protected
- subnet.</DD>
-<DT>ping from gate1 to x.y.z.2 or vice versa</DT>
-<DD><STRONG>Does not use tunnel</STRONG>. gate1 is not on protected
- subnet.</DD>
-<DT>ping from gate1 to gate2 or vice versa</DT>
-<DD><STRONG>Does not use tunnel</STRONG>. Neither gate is on a protected
- subnet.</DD>
-</DL>
-<P>Only the first of these is a useful test of this tunnel. The others
- do not use the tunnel. Depending on other details of your setup and
- routing, they:</P>
-<UL>
-<LI>either fail, telling you nothing about the tunnel</LI>
-<LI>or succeed, telling you nothing about the tunnel since these packets
- use some other route</LI>
-</UL>
-<P>In some cases, you may be able to get around this. For the example
- network above, you could use:</P>
-<PRE>        ping -I a.b.c.1 x.y.z.1</PRE>
-<P>Both the adresses given are within protected subnets, so this should
- go through the tunnel.</P>
-<P>If required, you can build additional tunnels so that all the
- machines involved can talk to all the others. See<A href="#multitunnel">
- multiple tunnels</A> in the advanced configuration document for
- details.</P>
-<H3><A name="forever">It takes forever to ...</A></H3>
-<P>Users fairly often report various problems involving long delays,
- sometimes on tunnel setup and sometimes on operations done through the
- tunnel, occasionally on simple things like ping or more often on more
- complex operations like doing NFS or Samba through the tunnel.</P>
-<P>Almost always, these turn out to involve failure of a DNS lookup. The
- timeouts waiting for DNS are typically set long so that you won't time
- out when a query involves multiple lookups or long paths. Genuine
- failures therefore produce long delays before they are detected.</P>
-<P>A mailing list message from project technical lead Henry Spencer:</P>
-<PRE>&gt; ... when i run /etc/rc.d/init.d/ipsec start, i get:
-&gt; ipsec_setup: Starting FreeS/WAN IPsec 1.5...
-&gt; and it just sits there, doesn't give back my bash prompt.
-
-Almost certainly, the problem is that you're using DNS names in your
-ipsec.conf, but DNS lookups are not working for some reason.  You will
-get your prompt back... eventually.  But the DNS timeouts are long.
-Doing something about this is on our list, but it is not easy.</PRE>
-<P>In the meanwhile, we recommend that connection descriptions in<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> use numeric IP addresses rather than names which will
- require a DNS lookup.</P>
-<P>Names that do not require a lookup are fine. For example:</P>
-<UL>
-<LI>a road warrior might use the identity<VAR>
- rightid=@lancelot.example.org</VAR></LI>
-<LI>the gateway might use<VAR> leftid=@camelot.example.org</VAR></LI>
-</UL>
-<P>These are fine. The @ sign prevents any DNS lookup. However, do not
- attempt to give the gateway address as<VAR> left=camelot.example.org</VAR>
-. That requires a lookup.</P>
-<P>A post from one user after solving a problem with long delays:</P>
-<PRE>Subject: Final Answer to Delay!!!
-   Date: Mon, 19 Feb 2001
-   From: &quot;Felippe Solutions&quot; &lt;felippe@solutionstecnologia.com.br&gt;
-
-Sorry people, but seems like the Delay problem had nothing to do with
-freeswan.
-
-The problem was DNS as some people sad from the beginning, but not the way
-they thought it was happening. Samba, ssh, telnet and other apps try to
-reverse lookup addresses when you use IP numbers (Stupid that ahh).
-
-I could ping very fast because I always ping with &quot;-n&quot; option, but I don't
-know the option on the other apps to stop reverse addressing so I don't use
-it.</PRE>
-<P>This post is fairly typical. These problems are often tricky and
- frustrating to diagnose, and most turn out to be DNS-related.</P>
-<P>One suggestion for diagnosis: test with both names and addresses if
- possible. For example, try all of:</P>
-<UL>
-<LI>ping<VAR> address</VAR></LI>
-<LI>ping -n<VAR> address</VAR></LI>
-<LI>ping<VAR> name</VAR></LI>
-</UL>
-<P>If these behave differently, the problem must be DNS-related since
- the three commands do exactly the same thing except for DNS lookups.</P>
-<H3><A name="route">I send packets to the tunnel with route(8) but they
- vanish</A></H3>
-<P>IPsec connections are designed to carry only packets travelling
- between pre-defined connection endpoints. As project technical lead
- Henry Spencer put it:</P>
-<BLOCKQUOTE> IPsec tunnels are not just virtual wires; they are virtual
- wires with built-in access controls. Negotiation of an IPsec tunnel
- includes negotiation of access rights for it, which don't include
- packets to/from other IP addresses. (The protocols themselves are quite
- inflexible about this, so there are limits to what we can do about it.)</BLOCKQUOTE>
-<P>For fairly obvious security reasons, and to comply with the IPsec
- RFCs,<A href="#KLIPS"> KLIPS</A> drops any packets it receives that are
- not allowed on the tunnels currently defined. So if you send it packets
- with<VAR> route(8)</VAR>, and suitable tunnels are not defined, the
- packets vanish. Whether this is reported in the logs depends on the
- setting of<VAR> klipsdebug</VAR> in your<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> file.</P>
-<P>To rescue vanishing packets, you must ensure that suitable tunnels
- for them exist, by editing the connection descriptions in<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A>. For example, supposing you have a simple setup:</P>
-<PRE>         leftsubnet -- leftgateway === internet === roadwarrior</PRE>
-<P>If you want to give the roadwarrior access to some resource that is
- located behind the left gateway but is not in the currently defined
- left subnet, then the usual procedure is to define an additional tunnel
- for those packets by creating a new connection description.</P>
-<P>In some cases, it may be easier to alter an existing connection
- description, enlarging the definition of<VAR> leftsubnet</VAR>. For
- example, instead of two connection descriptions with 192.168.8.0/24 and
- 192.168.9.0/24 as their<VAR> leftsubnet</VAR> parameters, you can use a
- single description with 192.168.8.0/23.</P>
-<P>If you have multiple endpoints on each side, you need to ensure that
- there is a route for each pair of endpoints. See this<A href="#multitunnel">
- example</A>.</P>
-<H3><A name="down_route">When a tunnel goes down, packets vanish</A></H3>
-<P>This is a special case of the vanishing packet problem described in
- the previous question. Whenever KLIPS sees packets for which it does
- not have a tunnel, it drops them.</P>
-<P>When a tunnel goes away, either because negotiations with the other
- gateway failed or because you gave an<VAR> ipsec auto --down</VAR>
- command, the route to its other end is left pointing into KLIPS, and
- KLIPS will drop packets it has no tunnel for.</P>
-<P>This is a documented design decision, not a bug. FreeS/WAN must not
- automatically adjust things to send packets via another route. The
- other route might be insecure.</P>
-<P>Of course, re-routing may be necessary in many cases. In those cases,
- you have to do it manually or via scripts. We provide the<VAR> ipsec
- auto --unroute</VAR> command for these cases.</P>
-<P>From<A href="manpage.d/ipsec_auto.8.html"> ipsec_auto(8)</A>:</P>
-<BLOCKQUOTE> Normally, pluto establishes a route to the destination
- specified for a connection as part of the --up operation. However, the
- route and only the route can be established with the --route operation.
- Until and unless an actual connection is established, this discards any
- packets sent there, which may be preferable to having them sent
- elsewhere based on a more general route (e.g., a default route).</BLOCKQUOTE><BLOCKQUOTE>
- Normally, pluto's route to a destination remains in place when a --down
- operation is used to take the connection down (or if connection setup,
- or later automatic rekeying, fails). This permits establishing a new
- connection (perhaps using a different specification; the route is
- altered as necessary) without having a ``window'' in which packets
- might go elsewhere based on a more general route. Such a route can be
- removed using the --unroute operation (and is implicitly removed by
- --delete).</BLOCKQUOTE>
-<P>See also this mailing list<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00523.html">
- message</A>.</P>
-<H3><A name="firewall_ate">The firewall ate my packets!</A></H3>
-<P>If firewalls filter out:</P>
-<UL>
-<LI>either the UDP port 500 packets used in IKE negotiations</LI>
-<LI>or the ESP and AH (protocols 50 and 51) packets used to implement
- the IPsec tunnel</LI>
-</UL>
-<P>then IPsec cannot work. The first thing to check if packets seem to
- be vanishing is the firewall rules on the two gateway machines and any
- other machines along the path that you have access to.</P>
-<P>For details, see our document on<A href="firewall.html"> firewalls</A>
-.</P>
-<P>Some advice from technical lead Henry Spencer on diagnosing such
- problems:</P>
-<PRE>&gt; &gt; Packets vanishing between the hardware interface and the ipsecN interface
-&gt; &gt; is usually the result of firewalls not being configured to let them in...
-&gt; 
-&gt; Thanks for the suggestion. If only it were that simple! My ipchains startup
-&gt; script does take care of that, but just in case I manually inserted rules 
-&gt; accepting everything from london on dublin. No difference.
-
-The other thing to check is whether the &quot;RX packets dropped&quot; count on the
-ipsecN interface (run &quot;ifconfig ipsecN&quot;, for N=1 or whatever, to see the
-counts) is rising.  If so, then there's some sort of configuration mismatch
-between the two ends, and IPsec itself is rejecting them.  If none of the
-ipsecN counts is rising, then the packets are never reaching the IPsec
-machinery, and the problem is almost certainly in firewalls etc.</PRE>
-<H3><A name="dropconn">Dropped connections</A></H3>
-<P>Networks being what they are, IPsec connections can be broken for any
- number of reasons, ranging from hardware failures to various software
- problems such as the path MTU problems discussed<A href="#pmtu.broken">
- elsewhere in the FAQ</A>. Fortunately, various diagnostic tools exist
- that help you sort out many of the possible problems.</P>
-<P>There is one situation, however, where FreeS/WAN (using default
- settings) may destroy a connection for no readily apparent reason. This
- occurs when things are<STRONG> misconfigured</STRONG> so that<STRONG>
- two tunnels</STRONG> from the same gateway expect<STRONG> the same
- subnet on the far end</STRONG>.</P>
-<P>In this situation, the first tunnel comes up fine and works until the
- second is established. At that point, because of the way we track
- connections internally, the first tunnel ceases to exist as far as this
- gateway is concerned. Of course the far end does not know that, and a
- storm of error messages appears on both systems as it tries to use the
- tunnel.</P>
-<P>If the far end gives up, goes back to square one and negotiates a new
- tunnel, then that wipes out the second tunnel and ...</P>
-<P>The solution is simple.<STRONG> Do not build multiple conn
- descriptions with the same remote subnet</STRONG>.</P>
-<P>This is actually intended to be a feature, rather than a bug.
- Consider the situation where a single remote system goes down, then
- comes back up and reconnects to the gateway. It is useful to have the
- gateway tear down the old tunnel and recover resources when the
- reconnection is made. It recognises that situation by checking the
- remote subnet for each tunnel it builds and discarding duplicates. This
- works fine as long as you don't configure multiple tunnels with the
- same remote subnet.</P>
-<P>If this behaviour is inconvenient for you, you can disable it by
- setting<VAR> uniqueids=no</VAR> in<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A>.</P>
-<H3><A name="defaultroutegone">Disappearing %defaultroute</A></H3>
-<P>When an underlying connection (eg. ppp) goes down, FreeS/WAN will not
- recover properly without a little help. Here are the symptoms that
- FreeS/WAN user Michael Carmody noticed:</P>
-<PRE>
-&gt; After about 24 hours the freeswan connection takes over the default route.
-&gt; 
-&gt; i.e instead of deafult gateway pointing to the router via eth0, it becomes a 
-&gt; pointer to the router via ipsec0.
- 
-&gt; All internet access is then lost as all replies (and not just the link I 
-&gt; wanted) are routed out ipsec0 and the router doesn't respond to the ipsec 
-&gt; traffic.
-</PRE>
-<P>If you're using a FreeS/WAN 2.x/KLIPS system, simply re-attach the
- IPsec virtual interface with<EM> ipsec tnconfig</EM> command such as:</P>
-<PRE>    ipsec tnconfig --attach --virtual ipsec0 --physical ppp0</PRE>
-<P>In your command, name the physical and virtual interfaces as they
- appear paired on your system during regular uptime. For a system with
- several physical/virtual interface pairs on flaky links, you'll need
- more than one such command. If you're using FreeS/WAN 1.x, you must
- restart FreeS/WAN, which is more time consuming.</P>
-<P><A href="http://lists.freeswan.org/pipermail/design/2002-July/003070.html">
- Here</A> is a script which can help to automate the process of
- FreeS/WAN restart at need. It could easily be adapted to use tnconfig
- instead.</P>
-<H3><A name="tcpdump.faq">TCPdump on the gateway shows strange things</A>
-</H3>
- As another user pointed out, keeping the connect
-<P>Attempting to look at IPsec packets by running monitoring tools on
- the IPsec gateway machine can produce silly results. That machine is
- mangling the packets for IPsec, and possibly for firewall or NAT
- purposes as well. If the internals of the machine's IP stack are not
- what the monitoring tool expects, then the tool can misinterpret them
- and produce nonsense output.</P>
-<P>See our<A href="#tcpdump.test"> testing</A> document for more detail.</P>
-<H3><A name="no_trace">Traceroute does not show anything between the
- gateways</A></H3>
-<P>As far as traceroute can see, the two gateways are one hop apart; the
- data packet goes directly from one to the other through the tunnel. Of
- course the outer packets that implement the tunnel pass through
- whatever lies between the gateways, but those packets are built and
- dismantled by the gateways. Traceroute does not see them and cannot
- report anything about their path.</P>
-<P>Here is a mailing list message with more detail.</P>
-<PRE>Date: Mon, 14 May 2001
-To: linux-ipsec@freeswan.org
-From: &quot;John S. Denker&quot; &lt;jsd@research.att.com&lt;
-Subject: Re: traceroute: one virtual hop
-
-At 02:20 PM 5/14/01 -0400, Claudia Schmeing wrote:
-&gt;
-&gt;&gt; &gt; A bonus question: traceroute in subnet to subnet enviroment looks like:
-&gt;&gt; &gt; 
-&gt;&gt; &gt; traceroute to andris.dmz (172.20.24.10), 30 hops max, 38 byte packets
-&gt;&gt; &gt; 1  drama (172.20.1.1)  0.716 ms  0.942 ms  0.434 ms
-&gt;&gt; &gt; 2  * * *
-&gt;&gt; &gt; 3  andris.dmz (172.20.24.10)  73.576 ms  78.858 ms  79.434 ms
-&gt;&gt; &gt; 
-&gt;&gt; &gt; Why aren't there the other hosts which take part in the delivery during 
-&gt;    * * * ?
-&gt;
-&gt;If there is an ipsec tunnel between GateA and Gate B, this tunnel forms a 
-&gt;'virtual wire'.  When it is tunneled, the original packet becomes an inner 
-&gt;packet, and new ESP and/or AH headers are added to create an outer packet 
-&gt;around it. You can see an example of how this is done for AH at 
-&gt;doc/ipsec.html#AH . For ESP it is similar.
-&gt;
-&gt;Think about the packet's path from the inner packet's perspective.
-&gt;It leaves the subnet, goes into the tunnel, and re-emerges in the second
-&gt;subnet. This perspective is also the only one available to the
-&gt;'traceroute' command when the IPSec tunnel is up.
-
-Claudia got this exactly right.  Let me just expand on a couple of points:
-
-*) GateB is exactly one (virtual) hop away from GateA.  This is how it
-would be if there were a physically private wire from A to B.  The
-virtually private connection should work the same, and it does.
-
-*) While the information is in transit from GateA to GateB, the hop count
-of the outer header (the &quot;envelope&quot;) is being decremented.  The hop count
-of the inner header (the &quot;contents&quot; of the envelope) is not decremented and
-should not be decremented.  The hop count of the outer header is not
-derived from and should not be derived from the hop count of the inner header.
-
-Indeed, even if the packets did time out in transit along the tunnel, there
-would be no way for traceroute to find out what happened.  Just as
-information cannot leak _out_ of the tunnel to the outside, information
-cannot leak _into_ the tunnel from outside, and this includes ICMP messages
-from routers along the path.
-
-There are some cases where one might wish for information about what is
-happening at the IP layer (below the tunnel layer) -- but the protocol
-makes no provision for this.  This raises all sorts of conceptual issues.
-AFAIK nobody has ever cared enough to really figure out what _should_
-happen, let alone implement it and standardize it.
-
-*) I consider the &quot;* * *&quot; to be a slight bug.  One might wish for it to be
-replaced by &quot;GateB GateB GateB&quot;.  It has to do with treating host-to-subnet
-traffic different from subnet-to-subnet traffic (and other gory details).
-I fervently hope KLIPS2 will make this problem go away.
-
-*) If you want to ask questions about the link from GateA to GateB at the
-IP level (below the tunnel level), you have to ssh to GateA and launch a
-traceroute from there.</PRE>
-<H2><A name="man4debug">Testing in stages</A></H2>
-<P>It is often useful in debugging to test things one at a time:</P>
-<UL>
-<LI>disable IPsec entirely, for example by turning it off with
- chkconfig(8), and make sure routing works</LI>
-<LI>Once that works, try a manually keyed connection. This does not
- require key negotiation between Pluto and the key daemon on the other
- end.</LI>
-<LI>Once that works, try automatically keyed connections</LI>
-<LI>Once IPsec works, add packet compression</LI>
-<LI>Once everything seems to work, try stress tests with large
- transfers, many connections, frequent re-keying, ...</LI>
-</UL>
-<P>FreeS/WAN releases are tested for all of these, so you can be
- reasonably certain they<EM> can</EM> do them all. Of course, that does
- not mean they<EM> will</EM> on the first try, especially if you have
- some unusual configuration.</P>
-<P>The rest of this section gives information on diagnosing the problem
- when each of the above steps fails.</P>
-<H3><A name="nomanual">Manually keyed connections don't work</A></H3>
-<P>Suspect one of:</P>
-<UL>
-<LI>mis-configuration of IPsec system in the /etc/ipsec.conf file
-<BR> common errors are incorrect interface or next hop information</LI>
-<LI>mis-configuration of manual connection in the /etc/ipsec.conf file</LI>
-<LI>routing problems causing IPsec packets to be lost</LI>
-<LI>bugs in KLIPS</LI>
-<LI>mismatch between the transforms we support and those another IPsec
- implementation offers.</LI>
-</UL>
-<H3><A name="spi_error">One manual connection works, but second one
- fails</A></H3>
-<P>This is a fairly common problem when attempting to configure multiple
- manually keyed connections from a single gateway.</P>
-<P>Each connection must be identified by a unique<A href="#SPI"> SPI</A>
- value. For automatic connections, these values are assigned
- automatically. For manual connections, you must set them with<VAR> spi=</VAR>
- statements in<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A>.</P>
-<P>Each manual connection must have a unique SPI value in the range
- 0x100 to 0x999. Two or more with the same value will fail. For details,
- see our doc section<A href="#prodman"> Using manual keying in
- production</A> and the man page<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A>.</P>
-<H3><A name="man_no_auto">Manual connections work, but automatic keying
- doesn't</A></H3>
-<P>The most common reason for this behaviour is a firewall dropping the
- UDP port 500 packets used in key negotiation.</P>
-<P>Other possibilities:</P>
-<UL>
-<LI>mis-configuration of auto connection in the /etc/ipsec.conf file.
-<P>One common configuration error is forgetting that you need<VAR>
- auto=add</VAR> to load the connection description on the receiving end
- so it recognises the connection when the other end asks for it.</P>
-</LI>
-<LI>error in shared secret in /etc/ipsec.secrets</LI>
-<LI>one gateway lacks a route to the other so Pluto's UDP packets are
- lost</LI>
-<LI>bugs in Pluto</LI>
-<LI>incompatibilities between Pluto's<A href="#IKE"> IKE</A>
- implementation and the IKE at the other end of the tunnel.
-<P>Some possibile problems are discussed in out<A href="interop.html#interop.problem">
- interoperation</A> document.</P>
-</LI>
-</UL>
-<H3><A name="nocomp">IPsec works, but connections using compression fail</A>
-</H3>
-<P>When we first added compression, we saw some problems:</P>
-<UL>
-<LI>compatibility issues with other implementations. We followed the
- RFCs and omitted some extra material that many compression libraries
- add by default. Some other implementations left the extras in</LI>
-<LI>bugs in assembler compression routines on non-Intel CPUs. The
- workaround is to use C code instead of possibly problematic assembler.</LI>
-</UL>
-<P>We have not seen either problem in some time (at least six months as
- I write in March 2002), but if you have some unusual configuration then
- you may see them.</P>
-<H3><A name="pmtu.broken">Small packets work, but large transfers fail</A>
-</H3>
-<P>If tests with ping(1) and a small packet size succeed, but tests or
- transfers with larger packet sizes fail, suspect problems with packet
- fragmentation and perhaps<A href="#pathMTU"> path MTU discovery</A>.</P>
-<P>Our<A href="#bigpacket"> troubleshooting document</A> covers these
- problems. Information on the underlying mechanism is in our<A href="#MTU.trouble">
- background</A> document.</P>
-<H3><A name="subsub">Subnet-to-subnet works, but tests from the gateways
- don't</A></H3>
-<P>This is described under<A href="#cantping"> I cannot ping...</A>
- above.</P>
-<H2><A name="compile.faq">Compilation problems</A></H2>
-<H3><A name="gmp.h_missing">gmp.h: No such file or directory</A></H3>
-<P>Pluto needs the GMP (<STRONG>G</STRONG>NU</P>
-<P><STRONG>M</STRONG>ulti-<STRONG>P</STRONG>recision) library for the
- large integer calculations it uses in<A href="#public"> public key</A>
- cryptography. This error message indicates a failure to find the
- library. You must install it before Pluto will compile.</P>
-<P>The GMP library is included in most Linux distributions. Typically,
- there are two RPMs, libgmp and libgmp-devel, You need to<EM> install
- both</EM>, either from your distribution CDs or from your vendor's web
- site.</P>
-<P>On Debian, a mailing list message reports that the command to give is<VAR>
- apt-get install gmp2</VAR>.</P>
-<P>For more information and the latest version, see the<A href="http://www.swox.com/gmp/">
- GMP home page</A>.</P>
-<H3><A name="noVM">... virtual memory exhausted</A></H3>
-<P>We have had several reports of this message appearing, all on SPARC
- Linux. Here is a mailing message on a solution:</P>
-<PRE>&gt; ipsec_sha1.c: In function `SHA1Transform':
-&gt; ipsec_sha1.c:95: virtual memory exhausted
-
-I'm seeing exactly the same problem on an Ultra with 256MB ram and 500
-MB swap.  Except I am compiling version 1.5 and its Red Hat 6.2.
-
-I can get around this by using -O instead of -O2 for the optimization
-level.  So it is probably a bug in the optimizer on the sparc complier. 
-I'll try and chase this down on the sparc lists.</PRE>
-<H2><A name="error">Interpreting error messages</A></H2>
-<H3><A name="route-client">route-client (or host) exited with status 7</A>
-</H3>
-<P>Here is a discussion of this error from FreeS/WAN &quot;listress&quot; (mailing
- list tech support person) Claudia Schmeing. The &quot;FAQ on the network
- unreachable error&quot; which she refers to is the next question below.</P>
-<PRE>&gt; I reached the point where the two boxes (both on dial-up connections, but
-&gt; treated as static IPs by getting the IP and editing ipsec.conf after the
-&gt; connection is established) to the point where they exchange some info, but I
-&gt; get an error like &quot;route-client command exited with status 7 \n internal
-&gt; error&quot;.
-&gt; Where can I find a description of this error?
-
-In general, if the FAQ doesn't cover it, you can search the mailing list 
-archives - I like to use
-http://www.sandelman.ottawa.on.ca/linux-ipsec/
-but you can see doc/mail.html for different archive formats.
-
-
-Your error comes from the _updown script, which performs some
-routing and firewall functions to help Linux FreeS/WAN. More info
-is available at doc/firewall.html and man ipsec.conf. Its routing
-is integral to the health of Linux FreeS/WAN; it also provides facility
-to insert custom firewall rules to be executed when you create or destroy
-a connection.
-
-Yours is, of course, a routing error. You can be fairly sure the routing 
-machinery is saying &quot;network is unreachable&quot;. There's a FAQ on the 
-&quot;network is unreachable&quot; error, but more information is available now; read on.
-
-If your _updown script is recent (for example if it shipped with 
-Linux FreeS/WAN 1.91), you will see another debugging line in your logs 
-that looks something like this:
-
-&gt; output: /usr/local/lib/ipsec/_updown: `route add -net 128.174.253.83 
-&gt; netmask 255.255.255.255 dev ipsec0 gw 66.92.93.161' failed
-
-This is, of course, the system route command that exited with status 7, 
-(ie. failed). Man route for details. Seeing the command typed out yields 
-more information. If your _updown script is older, you may wish to update 
-it to show the command explicitly.
-
-Three parameters fed to the route command: net, netmask and gw [gateway] 
-are derived from things you've put in ipsec.conf.
-
-Net and netmask are derived from the peer's IP and mask. In more detail:
-
-You may see a routing error when routing to a client (ie. subnet), or 
-to a host (IPSec gateway or freestanding host; a box that does IPSec for
-itself). In _updown, the &quot;route-client&quot; section  is responsible to set up 
-the route for IPSec'd (usually, read 'tunneled') packets headed to a 
-peer subnet. Similarly, route-host routes IPSec'd packets to a peer host
-or IPSec gateway.
-
-When routing to a 'client', net and netmask are ipsec.conf's left- or 
-rightsubnet (whichever is not local). Similarly, when routing to a 
-'host' the net is left or right. Host netmask is always /32, indicating a 
-single machine.
-
-Gw is nexthop's value. Again, the value in question is left- or rightnexthop,
-whichever is local. Where left/right or left-/rightnexthop has the special 
-value %defaultroute (described in man ipsec.conf), gw will automagically get
-the value of the next hop on the default route.
-
-Q: &quot;What's a nexthop and why do I need one?&quot;
-
-A: 'nexthop' is a routing kluge; its value is the next hop away
-   from the machine that's doing IPSec, and toward your IPSec peer. 
-   You need it to get the processed packets out of the local system and 
-   onto the wire. While we often route other packets through the machine 
-   that's now doing IPSec, and are done with it, this does not suffice here. 
-   After packets are processed with IPSec, this machine needs to know where 
-   they go next. Of course using the 'IPSec gateway' as their routing gateway 
-   would cause an infinite loop! [To visualize this, see the packet flow 
-   diagram at doc/firewall.html.] To avoid this, we route packets through 
-   the next hop down their projected path.
-
-Now that you know the background, consider:
-1. Did you test routing between the gateways in the absence of Linux
-   FreeS/WAN, as recommended? You need to ensure the two machines that
-   will be running Linux FreeS/WAN can route to one another before trying to 
-   make a secure connection.
-2. Is there anything obviously wrong with the sense of your route command?
-
-Normally, this problem is caused by an incorrect local nexthop parameter.
-Check out the use of %defaultroute, described in man ipsec.conf. This is
-a simple way to set nexthop for most people. To figure nexthop out by hand,
-traceroute in-the-clear to your IPSec peer. Nexthop is the traceroute's 
-first hop after your IPSec gateway.</PRE>
-<H3><A name="unreachable">SIOCADDRT:Network is unreachable</A></H3>
-<P>This message is not from FreeS/WAN, but from the Linux IP stack
- itself. That stack is seeing packets it has no route for, either
- because your routing was broken before FreeS/WAN started or because
- FreeS/WAN's changes broke it.</P>
-<P>Here is a message from Claudia suggesting ways to diagnose and fix
- such problems:</P>
-<PRE>You write,
-&gt; I have correctly installed freeswan-1.8 on RH7.0 kernel 2.2.17, but when 
-&gt; I setup a VPN connection with the other machine(RH5.2 Kernel 2.0.36 
-&gt; freeswan-1.0, it works well.) it told me that 
-&gt; &quot;SIOCADDRT:Network is unreachable&quot;!  But the network connection is no 
-&gt; problem.
-
-Often this error is the result of a misconfiguration. 
-
-Be sure that you can route successfully in the absence of Linux
-FreeS/WAN. (You say this is no problem, so proceed to the next step.)
-
-Use a custom copy of the default updownscript. Do not change the route 
-commands, but add a diagnostic message revealing the exact text of the 
-route command. Is there a problem with the sense of the route command
-that you can see? If so, then re-examine those ipsec.conf settings
-that are being sent to the route command. 
-
-You may wish to use the ipsec auto --route and --unroute commands to 
-troubleshoot the problem. See man ipsec_auto for details.</PRE>
-<P>Since the above message was written, we have modified the updown
- script to provide a better diagnostic for this problem. Check<VAR>
- /var/log/messages</VAR>.</P>
-<P>See also the FAQ question<A href="#route-client"> route-client (or
- host) exited with status 7</A>.</P>
-<H3><A name="modprobe">ipsec_setup: modprobe: Can't locate module ipsec</A>
-</H3>
-<H3><A name="noKLIPS">ipsec_setup: Fatal error, kernel appears to lack
- KLIPS</A></H3>
-<P>These messages indicate an installation failure. The kernel you are
- running does not contain the<A href="#KLIPS"> KLIPS (kernel IPsec)</A>
- code.</P>
-<P>Note that the &quot;modprobe: Can't locate module ipsec&quot; message appears
- even if you are not using modules. If there is no KLIPS in your kernel,
- FreeS/WAN tries to load it as a module. If that fails, you get this
- message.</P>
-<P>Commands you can quickly try are:</P>
-<DL>
-<DT><VAR>uname -a</VAR></DT>
-<DD>to get details, including compilation date and time, of the
- currently running kernel</DD>
-<DT><VAR>ls /</VAR></DT>
-<DT><VAR>ls /boot</VAR></DT>
-<DD>to ensure a new kernel is where it should be. If kernel compilation
- puts it in<VAR> /</VAR> but<VAR> lilo</VAR> wants it in<VAR> /boot</VAR>
-, then you should uncomment the<VAR> INSTALL_PATH=/boot</VAR> line in
- the kernel<VAR> Makefile</VAR>.</DD>
-<DT><VAR>more /etc/lilo.conf</VAR></DT>
-<DD>to see that<VAR> lilo</VAR> has correct information</DD>
-<DT><VAR>lilo</VAR></DT>
-<DD>to ensure that information in<VAR> /etc/lilo.conf</VAR> has been
- transferred to the boot sector</DD>
-</DL>
-<P>If those don't find the problem, you have to go back and check
- through the<A href="install.html"> install</A> procedure to see what
- was missed.</P>
-<P>Here is one of Claudia's messages on the topic:</P>
-<PRE>&gt; I tried to install freeswan 1.8 on my mandrake 7.2 test box. ...
-
-&gt; It does show version and some output for whack.
-
-Yes, because the Pluto (daemon) part of ipsec is installed correctly, but
-as we see below the kernel portion is not.
-
-&gt; However, I get the following from /var/log/messages:
-&gt; 
-&gt; Mar 11 22:11:55 pavillion ipsec_setup: Starting FreeS/WAN IPsec 1.8...
-&gt; Mar 11 22:12:02 pavillion ipsec_setup: modprobe: Can't locate module ipsec
-&gt; Mar 11 22:12:02 pavillion ipsec_setup: Fatal error, kernel appears to lack
-&gt; KLIPS.
-
-This is your problem. You have not successfully installed a kernel with
-IPSec machinery in it. 
-
-Did you build Linux FreeS/WAN as a module? If so, you need to ensure that 
-your new module has been installed in the directory where your kernel 
-loader normally finds your modules. If not, you need to ensure
-that the new IPSec-enabled kernel is being loaded correctly.
-
-See also doc/install.html, and INSTALL in the distro.</PRE>
-<H3><A name="noDNS">ipsec_setup: ... failure to fetch key for ... from
- DNS</A></H3>
-<P>Quoting Henry:</P>
-<PRE>Note that by default, FreeS/WAN is now set up to
-     (a) authenticate with RSA keys, and
-     (b) fetch the public key of the far end from DNS.
-Explicit attention to  ipsec.conf will be needed if you want
-to do something different.</PRE>
-<P>and Claudia, responding to the same user:</P>
-<PRE>You write,
-
-&gt;       My current setup in ipsec.conf is leftrsasigkey=%dns I have 
-&gt; commented this and authby=rsasig out. I am able to get ipsec running, 
-&gt; but what I find is that the documentation only specifies for %dns are 
-&gt; there any other values that can be placed in this variable other than 
-&gt; %dns and the key? I am also assuming that this is where I would place 
-&gt; my public key for the left and right side as well is this correct?
-
-Valid values for authby= are rsasig and secret, which entail authentication
-by RSA signature or by shared secret, respectively. Because you have 
-commented authby=rsasig out, you are using the default value of authby=secret. 
-
-When using RSA signatures, there are two ways to get the public key for the
-IPSec peer: either copy it directly into *rsasigkey= in ipsec.conf, or
-fetch it from dns. The magic value %dns for *rsasigkey parameters says to 
-try to fetch the peer's key from dns.
-
-For any parameters, you may find their significance and special values in
-man ipsec.conf. If you are setting up keys or secrets, be sure also to
-reference man ipsec.secrets.</PRE>
-<H3><A name="dup_address">ipsec_setup: ... interfaces ... and ... share
- address ...</A></H3>
-<P>This is a fatal error. FreeS/WAN cannot cope with two or more
- interfaces using the same IP address. You must re-configure to avoid
- this.</P>
-<P>A mailing list message on the topic from Pluto developer Hugh
- Redelmeier:</P>
-<PRE>| I'm trying to get freeswan working between two machine where one has a ppp
-| interface.
-| I've already suceeded with  two machines with ethernet ports but  the ppp
-| interface is causing me problems.
-|  basically when I run ipsec start  i get
-| ipsec_setup: Starting FreeS/WAN IPsec 1.7...
-| ipsec_setup: 003 IP interfaces ppp1 and ppp0 share address 192.168.0.10!
-| ipsec_setup: 003 IP interfaces ppp1 and ppp2 share address 192.168.0.10!
-| ipsec_setup: 003 IP interfaces ppp0 and ppp2 share address 192.168.0.10!
-| ipsec_setup: 003 no public interfaces found
-|
-| followed by lots of cannot work out interface for connection messages
-|
-| now I can specify the interface in ipsec.conf to be ppp0 , but this does
-| not affect the above behaviour. A quick look in server.c indicates that the
-| interfaces value  is not used but some sort of raw detect happens.
-|
-| I guess I could prevent the formation of the extra ppp interfaces or
-| allocate them different ip but I'd  rather not. if at all possible. Any
-| suggestions please.
-
-Pluto won't touch an interface that shares an IP address with another.
-This will eventually change, but it probably won't happen soon.
-
-For now, you will have to give the ppp1 and ppp2 different addresses.</PRE>
-<H3><A name="kflags">ipsec_setup: Cannot adjust kernel flags</A></H3>
-<P>A mailing list message form technical lead Henry Spencer:</P>
-<PRE>&gt; When FreeS/WAN IPsec 1.7 is starting on my 2.0.38 Linux kernel the following
-&gt; error message is generated:
-&gt; ipsec_setup: Cannot adjust kernel flags, no /proc/sys/net/ipsec directory!
-&gt; What is supposed to create this directory and how can I fix this problem?
-
-I think that directory is a 2.2ism, although I'm not certain (I don't have
-a 2.0.xx system handy any more for testing).  Without it, some of the
-ipsec.conf config-setup flags won't work, but otherwise things should
-function. </PRE>
-<P>You also need to enable the<VAR> /proc</VAR> filesystem in your
- kernel configuration for these operations to work.</P>
-<H3><A name="message_num">Message numbers (MI3, QR1, et cetera) in Pluto
- messages</A></H3>
-<P>Pluto messages often indicate where Pluto is in the IKE protocols.
- The letters indicate<STRONG> M</STRONG>ain mode or<STRONG> Q</STRONG>
-uick mode and<STRONG> I</STRONG>nitiator or<STRONG> R</STRONG>esponder.
- The numerals are message sequence numbers. For more detail, see our<A href="#sequence">
- IPsec section</A>.</P>
-<H3><A name="conn_name">Connection names in Pluto error messages</A></H3>
-<P>From Pluto programmer Hugh Redelmeier:</P>
-<PRE>| Jan 17 16:21:10 remus Pluto[13631]: &quot;jumble&quot; #1: responding to Main Mode from Road Warrior 130.205.82.46
-| Jan 17 16:21:11 remus Pluto[13631]: &quot;jumble&quot; #1: no suitable connection for peer @banshee.wittsend.com
-| 
-|     The connection &quot;jumble&quot; has nothing to do with the incoming
-| connection requests, which were meant for the connection &quot;banshee&quot;.
-
-You are right.  The message tells you which Connection Pluto is
-currently using, which need not be the right one.  It need not be the
-right one now for the negotiation to eventually succeed!  This is
-described in ipsec_pluto(8) in the section &quot;Road Warrior Support&quot;.
-
-There are two times when Pluto will consider switching Connections for
-a state object.  Both are in response to receiving ID payloads (one in
-Phase 1 / Main Mode and one in Phase 2 / Quick Mode).  The second is
-not unique to Road Warriors.  In fact, neither is the first any more
-(two connections for the same pair of hosts could differ in Phase 1 ID
-payload; probably nobody else has tried this).</PRE>
-<H3><A name="cantorient">Pluto: ... can't orient connection</A></H3>
-<P>Older versions of FreeS/WAN used this message. The same error now
- gives the &quot;we have no ipsecN ...&quot; error described just below.</P>
-<H3><A name="no.interface">... we have no ipsecN interface for either
- end of this connection</A></H3>
-<P>Your tunnel has no IP address which matches the IP address of any of
- the available IPsec interfaces. Either you've misconfigured the
- connection, or you need to define an appropriate IPsec interface
- connection.<VAR> interfaces=%defaultroute</VAR> works in many cases.</P>
-<P>A longer story: Pluto needs to know whether it is running on the
- machine which the connection description calls<VAR> left</VAR> or on<VAR>
- right</VAR>. It figures that out by:</P>
-<UL>
-<LI>looking at the interfaces given in<VAR> interfaces=</VAR> lines in
- the<VAR> config setup</VAR> section</LI>
-<LI>discovering the IP addresses for those interfaces</LI>
-<LI>searching for a match between those addresses and the ones given in<VAR>
- left=</VAR> or<VAR> right=</VAR> lines.</LI>
-</UL>
-<P>Normally a match is found. Then Pluto knows where it is and can set
- up other things (for example, if it is<VAR> left</VAR>) using
- parameters such as<VAR> leftsubnet</VAR> and<VAR> leftnexthop</VAR>,
- and sending its outgoing packets to<VAR> right</VAR>.</P>
-<P>If no match is found, it emits the above error message.</P>
-<H3><A name="noconn">Pluto: ... no connection is known</A></H3>
-<P>This error message occurs when a remote system attempts to negotiate
- a connection and Pluto does not have a connection description that
- matches what the remote system has requested. The most common cause is
- a configuration error on one end or the other.</P>
-<P>Parameters involved in this match are<VAR> left</VAR>,<VAR> right</VAR>
-,<VAR> leftsubnet</VAR> and<VAR> rightsubnet</VAR>.</P>
-<P><STRONG>The match must be exact</STRONG>. For example, if your left
- subnet is a.b.c.0/24 then neither a single machine in that net nor a
- smaller subnet such as a.b.c.64/26 will be considered a match.</P>
-<P>The message can also occur when an appropriate description exists but
- Pluto has not loaded it. Use an<VAR> auto=add</VAR> statement in the
- connection description, or an<VAR> ipsec auto --add &lt;conn_name&gt;</VAR>
- command, to correct this.</P>
-<P>An explanation from the Pluto developer:</P>
-<PRE>| Jul 12 15:00:22 sohar58 Pluto[574]: &quot;corp_road&quot; #2: cannot respond to IPsec
-| SA request because no connection is known for
-| 216.112.83.112/32===216.112.83.112...216.67.25.118
-
-This is the first message from the Pluto log showing a problem.  It
-means that PGPnet is trying to negotiate a set of SAs with this
-topology:
-
-216.112.83.112/32===216.112.83.112...216.67.25.118
-^^^^^^^^^^^^^^^^^   ^^^^^^^^^^^^^^   ^^^^^^^^^^^^^
-client on our side  our host         PGPnet host, no client
-
-None of the conns you showed look like this.
-
-Use
-        ipsec auto --status
-to see a snapshot of what connections are in pluto, what
-negotiations are going on, and what SAs are established.
-
-The leftsubnet= (client) in your conn is 216.112.83.64/26.  It must
-exactly match what pluto is looking for, and it does not.</PRE>
-<H3><A name="nosuit">Pluto: ... no suitable connection ...</A></H3>
-<P>This is similar to the<A href="#noconn"> no connection known</A>
- error, but occurs at a different point in Pluto processing.</P>
-<P>Here is one of Claudia's messages explaining the problem:</P>
-<PRE>You write,
-
-&gt; What could be the reason of the following error? 
-&gt; &quot;no suitable connection for peer '@xforce'&quot;
-
-When a connection is initiated by the peer, Pluto must choose which entry in 
-the conf file best matches the incoming connection. A preliminary choice is 
-made on the basis of source and destination IPs, since that information is 
-available at that time. 
-
-A payload containing an ID arrives later in the negotiation. Based on this
-id and the *id= parameters, Pluto refines its conn selection. ...
-
-The message &quot;no suitable connection&quot; indicates that in this refining step,
-Pluto does not find a connection that matches that ID.
-
-Please see &quot;Selecting a connection when responding&quot; in man ipsec_pluto for
-more details.</PRE>
-<P>See also<A href="#conn_name"> Connection names in Pluto error
- messages</A>.</P>
-<H3><A name="noconn.auth">Pluto: ... no connection has been authorized</A>
-</H3>
-<P>Here is one of Claudia's messages discussing this problem:</P>
-<PRE>You write,
-
-&gt;  May 22 10:46:31 debian Pluto[25834]: packet from x.y.z.p:10014: 
-&gt;  initial Main Mode message from x.y.z.p:10014 
-                            but no connection has been authorized
-
-This error occurs early in the connection negotiation process,
-at the first step of IKE negotiation (Main Mode), which is itself the 
-first of two negotiation phases involved in creating an IPSec connection.
-
-Here, Linux FreeS/WAN receives a packet from a potential peer, which 
-requests that they begin discussing a connection.
-
-The &quot;no connection has been authorized&quot; means that there is no connection 
-description in Linux FreeS/WAN's internal database that can be used to 
-link your ipsec interface with that peer.
-
-&quot;But of course I configured that connection!&quot; 
-
-It may be that the appropriate connection description exists in ipsec.conf 
-but has not been added to the database with ipsec auto --add myconn or the 
-auto=add method. Or, the connection description may be misconfigured.
-
-The only parameters that are relevant in this decision are left= and right= .
-Local and remote ports are also taken into account -- we see that the port 
-is printed in the message above -- but there is no way to control these
-in ipsec.conf.
-
-
-Failure at &quot;no connection has been authorized&quot; is similar to the
-&quot;no connection is known for...&quot; error in the FAQ, and the &quot;no suitable
-connection&quot; error described in the snapshot's FAQ. In all three cases,
-Linux FreeS/WAN is trying to match parameters received in the
-negotiation with the connection description in the local config file.
-
-As it receives more information, its matches take more parameters into 
-account, and become more precise:  first the pair of potential peers,
-then the peer IDs, then the endpoints (including any subnets).
-
-The &quot;no suitable connection for peer *&quot; occurs toward the end of IKE 
-(Main Mode) negotiation, when the IDs are matched.
-
-&quot;no connection is known for a/b===c...d&quot; is seen at the beginning of IPSec 
-(Quick Mode, phase 2) negotiation, when the connections are matched using
-left, right, and any information about the subnets.</PRE>
-<H3><A name="noDESsupport">Pluto: ... OAKLEY_DES_CBC is not supported.</A>
-</H3>
-<P>This message occurs when the other system attempts to negotiate a
- connection using<A href="#DES"> single DES</A>, which we do not support
- because it is<A href="#desnotsecure"> insecure</A>.</P>
-<P>Our interoperation document has suggestions for<A href="interop.html#noDES">
- how to deal with</A> systems that attempt to use single DES.</P>
-<H3><A name="notransform">Pluto: ... no acceptable transform</A></H3>
-<P>This message means that the other gateway has made a proposal for
- connection parameters, but nothing they proposed is acceptable to
- Pluto. Possible causes include:</P>
-<UL>
-<LI>misconfiguration on either end</LI>
-<LI>policy incompatibilities, for example we require encrypted
- connections but they are trying to create one with just authentication</LI>
-<LI>interoperation problems, for example they offer only single DES and
- FreeS/WAN does not support that. See<A href="interop.html#interop.problem">
- discussion</A> in our interoperation document.</LI>
-</UL>
-<P>A more detailed explanation, from Pluto programmer Hugh Redelmeier:</P>
-<PRE>Background:
-
-When one IKE system (for example, Pluto) is negotiating with another
-to create an SA, the Initiator proposes a bunch of choices and the
-Responder replies with one that it has selected.
-
-The structure of the choices is fairly complicated.  An SA payload
-contains a list of lists of &quot;Proposals&quot;.  The outer list is a set of
-choices: the selection must be from one element of this list.
-
-Each of these elements is a list of Proposals.  A selection must be
-made from each of the elements of the inner list.  In other words,
-*all* of them apply (that is how, for example, both AH and ESP can
-apply at once).
-
-Within each of these Proposals is a list of Transforms.  For each
-Proposal selected, one Transform must be selected (in other words,
-each Proposal provides a choice of Transforms).
-
-Each Transform is made up of a list of Attributes describing, well,
-attributes.  Such as lifetime of the SA.  Such as algorithm to be
-used.  All the Attributes apply to a Transform.
-
-You will have noticed a pattern here: layers alternate between being
-disjunctions (&quot;or&quot;) and conjunctions (&quot;and&quot;).
-
-For Phase 1 / Main Mode (negotiating an ISAKMP SA), this structure is
-cut back.  There must be exactly one Proposal.  So this degenerates to
-a list of Transforms, one of which must be chosen.
-
-In your case, no proposal was considered acceptable to Pluto (the
-Responder).  So negotiation ceased.  Pluto logs the reason it rejects
-each Transform.  So look back in the log to see what is going wrong.</PRE>
-<H3><A name="rsasigkey">rsasigkey dumps core</A></H3>
- A comment on this error from Henry:
-<PRE>On Fri, 29 Jun 2001, Rodrigo Gruppelli wrote:
-&gt; ...Well, it seem that there's
-&gt; another problem with it. When I try to generate a pair of RSA keys,
-&gt; rsasigkey cores dump...
-
-*That* is a neon sign flashing &quot;GMP LIBRARY IS BROKEN&quot;.  Rsasigkey calls
-GMP a lot, and our own library a little bit, and that's very nearly all it
-does.  Barring bugs in its code or our library -- which have happened, but
-not very often -- a problem in rsasigkey is a problem in GMP.</PRE>
-<P>See the next question for how to deal with GMP errors.</P>
-<H3><A name="sig4">!Pluto failure!: ... exited with ... signal 4</A></H3>
-<P>Pluto has died. Signal 4 is SIGILL, illegal instruction.</P>
-<P>The most likely cause is that your<A href="#GMP"> GMP</A> (GNU
- multi-precision) library is compiled for a different processor than
- what you are running on. Pluto uses that library for its public key
- calculations.</P>
-<P>Try getting the GMP sources and recompile for your processor type.
- Most Linux distributions will include this source, or you can download
- it from the<A href="http://www.swox.com/gmp/"> GMP home page</A>.</P>
-<H3><A name="econnrefused">ECONNREFUSED error message</A></H3>
-<P>From John Denker, on the mailing list:</P>
-<PRE>1)  The log message
-  some IKE message we sent has been rejected with 
-  ECONNREFUSED (kernel supplied no details)
-is much more suitable than the previous version.  Thanks.
-
-2) Minor suggestion for further improvement: it might be worth mentioning
-that the command
-  tcpdump -i eth1 icmp[0] != 8 and icmp[0] != 0
-is useful for tracking down the details in question.  We shouldn't expect
-all IPsec users to figure that out on their own.  The log message might
-even provide a hint as to where to look in the docs.</PRE>
-<P>Reply From Pluto developer Hugh Redelmeier</P>
-<PRE>Good idea.
-
-I've added a bit pluto(8)'s BUGS section along these lines.
-I didn't have the heart to lengthen this message.</PRE>
-<H3><A name="no_eroute">klips_debug: ... no eroute!</A></H3>
-<P>This message means<A href="#KLIPS"> KLIPS</A> has received a packet
- for which no IPsec tunnel has been defined.</P>
-<P>Here is a more detailed duscussion from the team's tech support
- person Claudia Schmeing, responding to a query on the mailing list:</P>
-<PRE>&gt; Why ipsec reports no eroute! ???? IP Masq... is disabled.
-
-In general, more information is required so that people on the list may
-give you informed input. See doc/prob.report.</PRE>
-<P>The document she refers to has since been replaced by a<A href="#prob.report">
- section</A> of the troubleshooting document.</P>
-<PRE>However, I can make some general comments on this type of error.
-
-This error usually looks something like this (clipped from an archived
-message):
-
-&gt; ttl:64 proto:1 chk:45459 saddr:192.168.1.2 daddr:192.168.100.1
-&gt; ... klips_debug:ipsec_findroute: 192.168.1.2-&gt;192.168.100.1
-&gt; ... klips_debug:rj_match: * See if we match exactly as a host destination
-&gt; ... klips_debug:rj_match: ** try to match a leaf, t=0xc1a260b0
-&gt; ... klips_debug:rj_match: *** start searching up the tree, t=0xc1a260b0
-&gt; ... klips_debug:rj_match: **** t=0xc1a260c8
-&gt; ... klips_debug:rj_match: **** t=0xc1fe5960
-&gt; ... klips_debug:rj_match: ***** not found.
-&gt; ... klips_debug:ipsec_tunnel_start_xmit: Original head/tailroom: 2, 28
-&gt; ... klips_debug:ipsec_tunnel_start_xmit: no eroute!: ts=47.3030, dropping.
-
-
-What does this mean?
-- --------------------
-
-&quot;eroute&quot; stands for &quot;extended route&quot;, and is a special type of route 
-internal to Linux FreeS/WAN. For more information about this type of route, 
-see the section of man ipsec_auto on ipsec auto --route.
-
-&quot;no eroute!&quot; here means, roughly, that Linux FreeS/WAN cannot find an 
-appropriate tunnel that should have delivered this packet. Linux 
-FreeS/WAN therefore drops the packet, with the message &quot;no eroute! ...
-dropping&quot;, on the assumption that this packet is not a legitimate 
-transmission through a properly constructed tunnel.
-
-
-How does this situation come about?
-- -----------------------------------
-
-Linux FreeS/WAN has a number of connection descriptions defined in 
-ipsec.conf. These must be successfully brought &quot;up&quot; to form actual tunnels.
-(see doc/setup.html's step 15, man ipsec.conf and man ipsec_auto 
-for details).
-
-Such connections are often specific to the endpoints' IPs. However, in 
-some cases they may be more general, for example in the case of 
-Road Warriors where left or right is the special value %any.
-
-When Linux FreeS/WAN receives a packet, it verifies that the packet has
-come through a legitimate channel, by checking that there is an
-appropriate tunnel through which this packet might legitimately have
-arrived. This is the process we see above.
-
-First, it checks for an eroute that exactly matches the packet. In the 
-example above, we see it checking for a route that begins at 192.168.1.2
-and ends at 192.168.100.1. This search favours the most specific match that
-would apply to the route between these IPs. So, if there is a connection 
-description exactly matching these IPs, the search will end there. If not, 
-the code will search for a more general description matching the IPs.
-If there is no match, either specific or general, the packet will be
-dropped, as we see, above.
-
-Unless you are working with Road Warriors, only the first, specific part 
-of the matching process is likely to be relevant to you.
-
-
-&quot;But I defined the tunnel, and it came up, why do I have this error?&quot;
-- ---------------------------------------------------------------------
-
-One of the most common causes of this error is failure to specify enough
-connection descriptions to cover all needed tunnels between any two 
-gateways and their respective subnets. As you have noticed, troubleshooting
-this error may be complicated by the use of IP Masq. However, this error is
-not limited to cases where IP Masq is used. 
-
-See doc/configuration.html#multitunnel for a detailed example of the 
-solution to this type of problem.</PRE>
-<P>The documentation section she refers to is now<A href="#multitunnel">
- here</A>.</P>
-<H3><A name="SAused">... trouble writing to /dev/ipsec ... SA already in
- use</A></H3>
-<P>This error message occurs when two manual connections are set up with
- the same SPI value.</P>
-<P>See the FAQ for<A href="#spi_error"> One manual connection works, but
- second one fails</A>.</P>
-<H3><A name="ignore">... ignoring ... payload</A></H3>
-<P>This message is harmless. The IKE protocol provides for a number of
- optional messages types:</P>
-<UL>
-<LI>delete SA</LI>
-<LI>initial contact</LI>
-<LI>vendor ID</LI>
-<LI>...</LI>
-</UL>
-<P>An implementation is never required to send these, but they are
- allowed to. The receiver is not required to do anything with them.
- FreeS/WAN ignores them, but notifies you via the logs.</P>
-<P>For the &quot;ignoring delete SA Payload&quot; message, see also our discussion
- of cleaning up<A href="#deadtunnel"> dead tunnels</A>.</P>
-<H3><A name="unknown_rightcert">unknown parameter name &quot;rightcert&quot;</A></H3>
-<P>This message can appear when you've upgraded an X.509-enabled Linux
- FreeS/WAN with a vanilla Linux FreeS/WAN. To use your X.509 configs you
- will need to overwrite the new install with<A HREF="http://www.freeswan.ca">
- Super FreeS/WAN</A>, or add the<A HREF="http://www.strongsec.ca/freeswan">
- X.509 patch</A> by hand.</P>
-<H2><A name="spam">Why don't you restrict the mailing lists to reduce
- spam?</A></H2>
-<P>As a matter of policy, some of our<A href="mail.html"> mailing lists</A>
- need to be open to non-subscribers. Project management feel strongly
- that maintaining this openness is more important than blocking spam.</P>
-<UL>
-<LI>Users should be able to get help or report bugs without subscribing.</LI>
-<LI>Even a user who is subscribed may not have access to his or her
- subscribed account when he or she needs help, miles from home base in
- the middle of setting up a client's gateway.</LI>
-<LI>There is arguably a legal requirement for this policy. A US resident
- or citizen could be charged under munitions export laws for providing
- technical assistance to a foreign cryptographic project. Such a charge
- would be more easily defended if the discussion takes place in public,
- on an open list.</LI>
-</UL>
-<P>This has been discussed several times at some length on the list. See
- the<A href="#archive"> list archives</A>. Bringing the topic up again
- is unlikely to be useful. Please don't. Or at the very least, please
- don't without reading the archives and being certain that whatever you
- are about to suggest has not yet been discussed.</P>
-<P>Project technical lead Henry Spencer summarised one discussion:</P>
-<BLOCKQUOTE> For the third and last time: this list *will* *not* do
- address-based filtering. This is a policy decision, not an
- implementation problem. The decision is final, and is not open to
- discussion. This needs to be communicated better to people, and steps
- are being taken to do that.</BLOCKQUOTE>
-<P>Adding this FAQ section is one of the steps he refers to.</P>
-<P>You have various options other than just putting up with the spam,
- filtering it yourself, or unsubscribing:</P>
-<UL>
-<LI>subscribe only to one or both of our lists with restricted posting
- rules:
-<UL>
-<LI><A href="mailto:briefs@lists.freeswan.org?body=subscribe">briefs</A>
-, weekly list summaries</LI>
-<LI><A href="mailto:announce@lists.freeswan.org?body=subscribe">announce</A>
-, project-related announcements</LI>
-</UL>
-</LI>
-<LI>read the other lists via the<A href="#archive"> archives</A></LI>
-</UL>
-<P>A number of tools are available to filter mail.</P>
-<UL>
-<LI>Many mail readers include some filtering capability.</LI>
-<LI>Many Linux distributions include<A href="http://www.procmail.org/">
- procmail(8)</A> for server-side filtering.</LI>
-<LI>The<A href="http://www.spambouncer.org/"> Spam Bouncer</A> is a set
- of procmail(8) filters designed to combat spam.</LI>
-<LI>Roaring Penguin have a<A href="http://www.roaringpenguin.com/mimedefang/">
- MIME defanger</A> that removes potentially dangerous attachments.</LI>
-</UL>
-<P>If you use your ISP's mail server rather than running your own,
- consider suggesting to the ISP that they tag suspected spam as<A href="http://www.msen.com/1997/spam.html#SUSPECTED">
- this ISP</A> does. They could just refuse mail from dubious sources,
- but that is tricky and runs some risk of losing valuable mail or
- senselessly annoying senders and their admins. However, they can safely
- tag and deliver dubious mail. The tags can greatly assist your
- filtering.</P>
-<P>For information on tracking down spammers, see these<A href="http://www.rahul.net/falk/#howtos">
- HowTos</A>, or the<A href="http://www.sputum.com/index2.html"> Sputum</A>
- site. Sputum have a Linux anti-spam screensaver available for download.</P>
-<P>Here is a more detailed message from Henry:</P>
-<PRE>On Mon, 15 Jan 2001, Jay Vaughan wrote:
-&gt; I know I'm flogging a dead horse here, but I'm curious as to the reasons for
-&gt; an aversion for a subscriber-only mailing list?
-
-Once again:  for legal reasons, it is important that discussions of these
-things be held in a public place -- the list -- and we do not want to
-force people to subscribe to the list just to ask one question, because
-that may be more than merely inconvenient for them.  There are also real
-difficulties with people who are temporarily forced to use alternate
-addresses; that is precisely the time when they may be most in need of
-help, yet a subscribers-only policy shuts them out.
-
-These issues do not apply to most mailing lists, but for a list that is
-(necessarily) the primary user support route for a crypto package, they
-are very important.  This is *not* an ordinary mailing list; it has to
-function under awkward constraints that make various simplistic solutions
-inapplicable or undesirable. 
-
-&gt; We're *ALL* sick of hearing about list management problems, not just you
-&gt; old-timers, so why don't you DO SOMETHING EFFECTIVE ABOUT IT...
-
-Because it's a lot harder than it looks, and many existing &quot;solutions&quot;
-have problems when examined closely.
-
-&gt; A suggestion for you, based on 10 years of experience with management of my
-&gt; own mailing lists would be to use mailman, which includes pretty much every
-&gt; feature under the sun that you guys need and want, plus some.  The URL for
-&gt; mailman...
-
-I assure you, we're aware of mailman.  Along with a whole bunch of others,
-including some you almost certainly have never heard of (I hadn't!).
-
-&gt; As for the argument that the list shouldn't be configured to enforce
-&gt; subscription - I contend that it *SHOULD* AT LEAST require manual address
-&gt; verification in order for posts to be redirected.
-
-You do realize, I hope, that interposing such a manual step might cause
-your government to decide that this is not truly a public forum, and thus
-you could go to jail if you don't get approval from them before mailing to
-it?  If you think this sounds irrational, your government is noted for
-making irrational decisions in this area; we can't assume that they will
-suddenly start being sensible.  See above about awkward constraints.  You
-may be willing to take the risk, but we can't, in good conscience, insist
-that all users with problems do so. 
-
-                                                          Henry Spencer
-                                                       henry@spsystems.net</PRE>
-<P>and a message on the topic from project leader John Gilmore:</P>
-<PRE>Subject: Re: The linux-ipsec list's topic
-   Date: Sat, 30 Dec 2000
-   From: John Gilmore &lt;gnu@toad.com&gt;
-
-I'll post this single message, once only, in this discussion, and then
-not burden the list with any further off-topic messages.  I encourage
-everyone on the list to restrain themself from posting ANY off-topic
-messages to the linux-ipsec list.
-
-The topic of the linux-ipsec mailing list is the FreeS/WAN software.
-
-I frequently see &quot;discussions about spam on a list&quot; overwhelm the
-volume of &quot;actual spam&quot; on a list. BOTH kinds of messages are
-off-topic messages.  Twenty anti-spam messages take just as long to
-detect and discard as twenty spam messages.
-
-The Linux-ipsec list encourages on-topic messages from people who have
-not joined the list itself.  We will not censor messages to the list
-based on where they originate, or what return address they contain.
-In other words, non-subscribers ARE allowed to post, and this will not
-change.  My own valid contributions have been rejected out-of-hand by
-too many other mailing lists for me to want to impose that censorship
-on anybody else's contributions.  And every day I see the damage that
-anti-spam zeal is causing in many other ways; that zeal is far more
-damaging to the culture of the Internet than the nuisance of spam.
-
-In general, it is the responsibility of recipients to filter,
-prioritize, or otherwise manage the handling of email that comes to
-them.  It is not the responsibility of the rest of the Internet
-community to refrain from sending messages to recipients that they
-might not want to see.  If your software infrastructure for managing
-your incoming email is insufficient, then improve it.  If you think
-the signal-to-noise ratio on linux-ipsec is too poor, then please
-unsubscribe.  But don't further increase the noise by posting to the
-linux-ipsec list about those topics.
-
-        John Gilmore
-        founder &amp; sponsor, FreeS/WAN project</PRE>
-<HR>
-<H1><A name="manpages">FreeS/WAN manual pages</A></H1>
-<P>The various components of Linux FreeS/WAN are of course documented in
- standard Unix manual pages, accessible via the man(1) command.</P>
-<P>Links here take you to an HTML version of the man pages.</P>
-<H2><A name="man.file">Files</A></H2>
-<DL>
-<DT><A href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A></DT>
-<DD>IPsec configuration and connections</DD>
-<DT><A href="manpage.d/ipsec.secrets.5.html">ipsec.secrets(5)</A></DT>
-<DD>secrets for IKE authentication, either pre-shared keys or RSA
- private keys</DD>
-</DL>
-<P>These files are also discussed in the<A href="config.html">
- configuration</A> section.</P>
-<H2><A name="man.command">Commands</A></H2>
-<P>Many users will never give most of the FreeS/WAN commands directly.
- Configure the files listed above correctly and everything should be
- automatic.</P>
-<P>The exceptions are commands for mainpulating the<A href="#RSA"> RSA</A>
- keys used in Pluto authentication:</P>
-<DL>
-<DT><A href="manpage.d/ipsec_rsasigkey.8.html">ipsec_rsasigkey(8)</A></DT>
-<DD>generate keys</DD>
-<DT><A href="manpage.d/ipsec_newhostkey.8.html">ipsec_newhostkey(8)</A></DT>
-<DD>generate keys in a convenient format</DD>
-<DT><A href="manpage.d/ipsec_showhostkey.8.html">ipsec_showhostkey(8)</A>
-</DT>
-<DD>extract<A href="#RSA"> RSA</A> keys from<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets(5)</A> (or optionally, another file) and format them for
- insertion in<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A> or
- in DNS records</DD>
-</DL>
-<P>Note that:</P>
-<UL>
-<LI>These keys are for<STRONG> authentication only</STRONG>. They are<STRONG>
- not secure for encryption</STRONG>.</LI>
-<LI>The utility uses random(4) as a source of<A href="#random"> random
- numbers</A>. This may block for some time if there is not enough
- activity on the machine to provide the required entropy. You may want
- to give it some bogus activity such as random mouse movements or some
- command such as<NOBR> <TT>du /usr &gt; /dev/null &amp;</TT>.</LI>
-</UL>
-<P>The following commands are fairly likely to be used, if only for
- testing and status checks:</P>
-<DL>
-<DT><A href="manpage.d/ipsec.8.html">ipsec(8)</A></DT>
-<DD>invoke IPsec utilities</DD>
-<DT><A href="manpage.d/ipsec_setup.8.html">ipsec_setup(8)</A></DT>
-<DD>control IPsec subsystem</DD>
-<DT><A href="manpage.d/ipsec_auto.8.html">ipsec_auto(8)</A></DT>
-<DD>control automatically-keyed IPsec connections</DD>
-<DT><A href="manpage.d/ipsec_manual.8.html">ipsec_manual(8)</A></DT>
-<DD>take manually-keyed IPsec connections up and down</DD>
-<DT><A href="manpage.d/ipsec_ranbits.8.html">ipsec_ranbits(8)</A></DT>
-<DD>generate random bits in ASCII form</DD>
-<DT><A href="manpage.d/ipsec_look.8.html">ipsec_look(8)</A></DT>
-<DD>show minimal debugging information</DD>
-<DT><A href="manpage.d/ipsec_barf.8.html">ipsec_barf(8)</A></DT>
-<DD>spew out collected IPsec debugging information</DD>
-</DL>
-<P>The lower-level utilities listed below are normally invoked via
- scripts listed above, but they can also be used directly when required.</P>
-<DL>
-<DT><A href="manpage.d/ipsec_eroute.8.html">ipsec_eroute(8)</A></DT>
-<DD>manipulate IPsec extended routing tables</DD>
-<DT><A href="manpage.d/ipsec_klipsdebug.8.html">ipsec_klipsdebug(8)</A></DT>
-<DD>set Klips (kernel IPsec support) debug features and level</DD>
-<DT><A href="manpage.d/ipsec_pluto.8.html">ipsec_pluto(8)</A></DT>
-<DD>IPsec IKE keying daemon</DD>
-<DT><A href="manpage.d/ipsec_spi.8.html">ipsec_spi(8)</A></DT>
-<DD>manage IPsec Security Associations</DD>
-<DT><A href="manpage.d/ipsec_spigrp.8.html">ipsec_spigrp(8)</A></DT>
-<DD>group/ungroup IPsec Security Associations</DD>
-<DT><A href="manpage.d/ipsec_tncfg.8.html">ipsec_tncfg(8)</A></DT>
-<DD>associate IPsec virtual interface with real interface</DD>
-<DT><A href="manpage.d/ipsec_whack.8.html">ipsec_whack(8)</A></DT>
-<DD>control interface for IPsec keying daemon</DD>
-</DL>
-<H2><A name="man.lib">Library routines</A></H2>
-<DL>
-<DT><A href="manpage.d/ipsec_atoaddr.3.html">ipsec_atoaddr(3)</A></DT>
-<DT><A href="manpage.d/ipsec_addrtoa.3.html">ipsec_addrtoa(3)</A></DT>
-<DD>convert Internet addresses to and from ASCII</DD>
-<DT><A href="manpage.d/ipsec_atosubnet.3.html">ipsec_atosubnet(3)</A></DT>
-<DT><A href="manpage.d/ipsec_subnettoa.3.html">ipsec_subnettoa(3)</A></DT>
-<DD>convert subnet/mask ASCII form to and from addresses</DD>
-<DT><A href="manpage.d/ipsec_atoasr.3.html">ipsec_atoasr(3)</A></DT>
-<DD>convert ASCII to Internet address, subnet, or range</DD>
-<DT><A href="manpage.d/ipsec_rangetoa.3.html">ipsec_rangetoa(3)</A></DT>
-<DD>convert Internet address range to ASCII</DD>
-<DT>ipsec_atodata(3)</DT>
-<DT><A href="manpage.d/ipsec_datatoa.3.html">ipsec_datatoa(3)</A></DT>
-<DD>convert binary data from and to ASCII formats</DD>
-<DT><A href="manpage.d/ipsec_atosa.3.html">ipsec_atosa(3)</A></DT>
-<DT><A href="manpage.d/ipsec_satoa.3.html">ipsec_satoa(3)</A></DT>
-<DD>convert IPsec Security Association IDs to and from ASCII</DD>
-<DT><A href="manpage.d/ipsec_atoul.3.html">ipsec_atoul(3)</A></DT>
-<DT><A href="manpage.d/ipsec_ultoa.3.html">ipsec_ultoa(3)</A></DT>
-<DD>convert unsigned-long numbers to and from ASCII</DD>
-<DT><A href="manpage.d/ipsec_goodmask.3.html">ipsec_goodmask(3)</A></DT>
-<DD>is this Internet subnet mask a valid one?</DD>
-<DT><A href="manpage.d/ipsec_masktobits.3.html">ipsec_masktobits(3)</A></DT>
-<DD>convert Internet subnet mask to bit count</DD>
-<DT><A href="manpage.d/ipsec_bitstomask.3.html">ipsec_bitstomask(3)</A></DT>
-<DD>convert bit count to Internet subnet mask</DD>
-<DT><A href="manpage.d/ipsec_optionsfrom.3.html">ipsec_optionsfrom(3)</A>
-</DT>
-<DD>read additional ``command-line'' options from file</DD>
-<DT><A href="manpage.d/ipsec_subnetof.3.html">ipsec_subnetof(3)</A></DT>
-<DD>given Internet address and subnet mask, return subnet number</DD>
-<DT><A href="manpage.d/ipsec_hostof.3.html">ipsec_hostof(3)</A></DT>
-<DD>given Internet address and subnet mask, return host part</DD>
-<DT><A href="manpage.d/ipsec_broadcastof.3.html">ipsec_broadcastof(3)</A>
-</DT>
-<DD>given Internet address and subnet mask, return broadcast address</DD>
-</DL>
-<HR>
-<H1><A name="firewall">FreeS/WAN and firewalls</A></H1>
-<P>FreeS/WAN, or other IPsec implementations, frequently run on gateway
- machines, the same machines running firewall or packet filtering code.
- This document discusses the relation between the two.</P>
-<P>The firewall code in 2.4 and later kernels is called Netfilter. The
- user-space utility to manage a firewall is iptables(8). See the<A href="http://netfilter.samba.org">
- netfilter/iptables web site</A> for details.</P>
-<H2><A name="filters">Filtering rules for IPsec packets</A></H2>
-<P>The basic constraint is that<STRONG> an IPsec gateway must have
- packet filters that allow IPsec packets</STRONG>, at least when talking
- to other IPsec gateways:</P>
-<UL>
-<LI>UDP port 500 for<A href="#IKE"> IKE</A> negotiations</LI>
-<LI>protocol 50 if you use<A href="#ESP"> ESP</A> encryption and/or
- authentication (the typical case)</LI>
-<LI>protocol 51 if you use<A href="#AH"> AH</A> packet-level
- authentication</LI>
-</UL>
-<P>Your gateway and the other IPsec gateways it communicates with must
- be able to exchange these packets for IPsec to work. Firewall rules
- must allow UDP 500 and at least one of<A href="#AH"> AH</A> or<A href="#ESP">
- ESP</A> on the interface that communicates with the other gateway.</P>
-<P>For nearly all FreeS/WAN applications, you must allow UDP port 500
- and the ESP protocol.</P>
-<P>There are two ways to set this up:</P>
-<DL>
-<DT>easier but less flexible</DT>
-<DD>Just set up your firewall scripts at boot time to allow IPsec
- packets to and from your gateway. Let FreeS/WAN reject any bogus
- packets.</DD>
-<DT>more work, giving you more precise control</DT>
-<DD>Have the<A href="manpage.d/ipsec_pluto.8.html"> ipsec_pluto(8)</A>
- daemon call scripts to adjust firewall rules dynamically as required.
- This is done by naming the scripts in the<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> variables<VAR> prepluto=</VAR>,<VAR> postpluto=</VAR>
-,<VAR> leftupdown=</VAR> and<VAR> rightupdown=</VAR>.</DD>
-</DL>
-<P>Both methods are described in more detail below.</P>
-<H2><A name="examplefw">Firewall configuration at boot</A></H2>
-<P>It is possible to set up both firewalling and IPsec with appropriate
- scripts at boot and then not use<VAR> leftupdown=</VAR> and<VAR>
- rightupdown=</VAR>, or use them only for simple up and down operations.</P>
-<P>Basically, the technique is</P>
-<UL>
-<LI>allow IPsec packets (typically, IKE on UDP port 500 plus ESP,
- protocol 50)
-<UL>
-<LI>incoming, if the destination address is your gateway (and
- optionally, only from known senders)</LI>
-<LI>outgoing, with the from address of your gateway (and optionally,
- only to known receivers)</LI>
-</UL>
-</LI>
-<LI>let<A href="#Pluto"> Pluto</A> deal with IKE</LI>
-<LI>let<A href="#KLIPS"> KLIPS</A> deal with ESP</LI>
-</UL>
-<P>Since Pluto authenticates its partners during the negotiation, and
- KLIPS drops packets for which no tunnel has been negotiated, this may
- be all you need.</P>
-<H3><A name="simple.rules">A simple set of rules</A></H3>
-<P>In simple cases, you need only a few rules, as in this example:</P>
-<PRE># allow IPsec
-#
-# IKE negotiations
-iptables -I INPUT  -p udp --sport 500 --dport 500 -j ACCEPT
-iptables -I OUTPUT -p udp --sport 500 --dport 500 -j ACCEPT
-# ESP encryption and authentication
-iptables -I INPUT  -p 50 -j ACCEPT
-iptables -I OUTPUT -p 50 -j ACCEPT
-</PRE>
-<P>This should be all you need to allow IPsec through<VAR> lokkit</VAR>,
- which ships with Red Hat 9, on its medium security setting. Once you've
- tweaked to your satisfaction, save your active rule set with:</P>
-<PRE>service iptables save</PRE>
-<H3><A name="complex.rules">Other rules</A></H3>
- You can add additional rules, or modify existing ones, to work with
- IPsec and with your network and policies. We give a some examples in
- this section.
-<P>However, while it is certainly possible to create an elaborate set of
- rules yourself (please let us know via the<A href="mail.html"> mailing
- list</A> if you do), it may be both easier and more secure to use a set
- which has already been published and tested.</P>
-<P>The published rule sets we know of are described in the<A href="#rules.pub">
- next section</A>.</P>
-<H4><A NAME="7_2_2_1">Adding additional rules</A></H4>
- If necessary, you can add additional rules to:
-<DL>
-<DT>reject IPsec packets that are not to or from known gateways</DT>
-<DD>This possibility is discussed in more detail<A href="#unknowngate">
- later</A></DD>
-<DT>allow systems behind your gateway to build IPsec tunnels that pass
- through the gateway</DT>
-<DD>This possibility is discussed in more detail<A href="#through">
- later</A></DD>
-<DT>filter incoming packets emerging from KLIPS.</DT>
-<DD>Firewall rules can recognise packets emerging from IPsec. They are
- marked as arriving on an interface such as<VAR> ipsec0</VAR>, rather
- than<VAR> eth0</VAR>,<VAR> ppp0</VAR> or whatever.</DD>
-</DL>
-<P>It is therefore reasonably straightforward to filter these packets in
- whatever way suits your situation.</P>
-<H4><A NAME="7_2_2_2">Modifying existing rules</A></H4>
-<P>In some cases rules that work fine before you add IPsec may require
- modification to work with IPsec.</P>
-<P>This is especially likely for rules that deal with interfaces on the
- Internet side of your system. IPsec adds a new interface; often the
- rules must change to take account of that.</P>
-<P>For example, consider the rules given in<A href="http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-5.html">
- this section</A> of the Netfilter documentation:</P>
-<PRE>Most people just have a single PPP connection to the Internet, and don't
-want anyone coming back into their network, or the firewall:
-
-    ## Insert connection-tracking modules (not needed if built into kernel).
-    # insmod ip_conntrack
-    # insmod ip_conntrack_ftp
-
-    ## Create chain which blocks new connections, except if coming from inside.
-    # iptables -N block
-    # iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
-    # iptables -A block -m state --state NEW -i ! ppp0 -j ACCEPT
-    # iptables -A block -j DROP
-
-    ## Jump to that chain from INPUT and FORWARD chains.
-    # iptables -A INPUT -j block
-    # iptables -A FORWARD -j block</PRE>
-<P>On an IPsec gateway, those rules may need to be modified. The above
- allows new connections from<EM> anywhere except ppp0</EM>. That means
- new connections from ipsec0 are allowed.</P>
-<P>Do you want to allow anyone who can establish an IPsec connection to
- your gateway to initiate TCP connections to any service on your
- network? Almost certainly not if you are using opportunistic
- encryption. Quite possibly not even if you have only explicitly
- configured connections.</P>
-<P>To disallow incoming connections from ipsec0, change the middle
- section above to:</P>
-<PRE>    ## Create chain which blocks new connections, except if coming from inside.
-    # iptables -N block
-    # iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
-    # iptables -A block -m state --state NEW -i ppp+ -j DROP
-    # iptables -A block -m state --state NEW -i ipsec+ -j DROP
-    # iptables -A block -m state --state NEW -i -j ACCEPT
-    # iptables -A block -j DROP</PRE>
-<P>The original rules accepted NEW connections from anywhere except
- ppp0. This version drops NEW connections from any PPP interface (ppp+)
- and from any ipsec interface (ipsec+), then accepts the survivors.</P>
-<P>Of course, these are only examples. You will need to adapt them to
- your own situation.</P>
-<H3><A name="rules.pub">Published rule sets</A></H3>
-<P>Several sets of firewall rules that work with FreeS/WAN are
- available.</P>
-<H4><A name="Ranch.trinity">Scripts based on Ranch's work</A></H4>
-<P>One user, Rob Hutton, posted his boot time scripts to the mailing
- list, and we included them in previous versions of this documentation.
- They are still available from our<A href="http://www.freeswan.org/freeswan_trees/freeswan-1.5/doc/firewall.html#examplefw">
- web site</A>. However, they were for an earlier FreeS/WAN version so we
- no longer recommend them. Also, they had some bugs. See this<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/04/msg00316.html">
- message</A>.</P>
-<P>Those scripts were based on David Ranch's scripts for his &quot;Trinity
- OS&quot; for setting up a secure Linux. Check his<A href="http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html">
- home page</A> for the latest version and for information on his<A href="#ranch">
- book</A> on securing Linux. If you are going to base your firewalling
- on Ranch's scripts, we recommend using his latest version, and sending
- him any IPsec modifications you make for incorporation into later
- versions.</P>
-<H4><A name="seawall">The Seattle firewall</A></H4>
-<P>We have had several mailing lists reports of good results using
- FreeS/WAN with Seawall (the Seattle Firewall). See that project's<A href="http://seawall.sourceforge.net/">
- home page</A> on Sourceforge.</P>
-<H4><A name="rcf">The RCF scripts</A></H4>
-<P>Another set of firewall scripts with IPsec support are the RCF or
- rc.firewall scripts. See their<A href="http://jsmoriss.mvlan.net/linux/rcf.html">
- home page</A>.</P>
-<H4><A name="asgard">Asgard scripts</A></H4>
-<P><A href="http://heimdall.asgardsrealm.net/linux/firewall/">Asgard's
- Realm</A> has set of firewall scripts with FreeS/WAN support, for 2.4
- kernels and iptables.</P>
-<H4><A name="user.scripts">User scripts from the mailing list</A></H4>
-<P>One user gave considerable detail on his scripts, including
- supporting<A href="#IPX"> IPX</A> through the tunnel. His message was
- too long to conveniently be quoted here, so I've put it in a<A href="user_examples.html">
- separate file</A>.</P>
-<H2><A name="updown">Calling firewall scripts, named in ipsec.conf(5)</A>
-</H2>
-<P>The<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A>
- configuration file has three pairs of parameters used to specify an
- interface between FreeS/WAN and firewalling code.</P>
-<P>Note that using these is not required if you have a static firewall
- setup. In that case, you just set your firewall up at boot time (in a
- way that permits the IPsec connections you want) and do not change it
- thereafter. Omit all the FreeS/WAN firewall parameters and FreeS/WAN
- will not attempt to adjust firewall rules at all. See<A href="#examplefw">
- above</A> for some information on appropriate scripts.</P>
-<P>However, if you want your firewall rules to change when IPsec
- connections change, then you need to use these parameters.</P>
-<H3><A name="pre_post">Scripts called at IPsec start and stop</A></H3>
-<P>One pair of parmeters are set in the<VAR> config setup</VAR> section
- of the<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A> file and
- affect all connections:</P>
-<DL>
-<DT>prepluto=</DT>
-<DD>script to be called before<A href="manpage.d/ipsec_pluto.8.html">
- pluto(8)</A> IKE daemon is started.</DD>
-<DT>postpluto=</DT>
-<DD>script to be called after<A href="manpage.d/ipsec_pluto.8.html">
- pluto(8)</A> IKE daemon is stopped.</DD>
-</DL>
- These parameters allow you to change firewall parameters whenever IPsec
- is started or stopped.
-<P>They can also be used in other ways. For example, you might have<VAR>
- prepluto</VAR> add a module to your kernel for the secure network
- interface or make a dialup connection, and then have<VAR> postpluto</VAR>
- remove the module or take the connection down.</P>
-<H3><A name="up_down">Scripts called at connection up and down</A></H3>
-<P>The other parameters are set in connection descriptions. They can be
- set in individual connection descriptions, and could even call
- different scripts for each connection for maximum flexibility. In most
- applications, however, it makes sense to use only one script and to
- call it from<VAR> conn %default</VAR> section so that it applies to all
- connections.</P>
-<P>You can:</P>
-<DL>
-<DT><STRONG>either</STRONG></DT>
-<DD>set<VAR> leftfirewall=yes</VAR> or<VAR> rightfirewall=yes</VAR> to
- use our supplied default script</DD>
-<DT><STRONG>or</STRONG></DT>
-<DD>assign a name in a<VAR> leftupdown=</VAR> or<VAR> rightupdown=</VAR>
- line to use your own script</DD>
-</DL>
-<P>Note that<STRONG> only one of these should be used</STRONG>. You
- cannot sensibly use both. Since<STRONG> our default script is obsolete</STRONG>
- (designed for firewalls using<VAR> ipfwadm(8)</VAR> on 2.0 kernels),
- most users who need this service will<STRONG> need to write a custom
- script</STRONG>.</P>
-<H4><A name="fw.default">The default script</A></H4>
-<P>We supply a default script named<VAR> _updown</VAR>.</P>
-<DL>
-<DT>leftfirewall=</DT>
-<DD></DD>
-<DT>rightfirewall=</DT>
-<DD>indicates that the gateway is doing firewalling and that<A href="manpage.d/ipsec_pluto.8.html">
- pluto(8)</A> should poke holes in the firewall as required.</DD>
-</DL>
-<P>Set these to<VAR> yes</VAR> and Pluto will call our default script<VAR>
- _updown</VAR> with appropriate arguments whenever it:</P>
-<UL>
-<LI>starts or stops IPsec services</LI>
-<LI>brings a connection up or down</LI>
-</UL>
-<P>The supplied default<VAR> _updown</VAR> script is appropriate for
- simple cases using the<VAR> ipfwadm(8)</VAR> firewalling package.</P>
-<H4><A name="userscript">User-written scripts</A></H4>
-<P>You can also write your own script and have Pluto call it. Just put
- the script's name in one of these<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> lines:</P>
-<DL>
-<DT>leftupdown=</DT>
-<DD></DD>
-<DT>rightupdown=</DT>
-<DD>specifies a script to call instead of our default script<VAR>
- _updown</VAR>.</DD>
-</DL>
-<P>Your script should take the same arguments and use the same
- environment variables as<VAR> _updown</VAR>. See the &quot;updown command&quot;
- section of the<A href="manpage.d/ipsec_pluto.8.html"> ipsec_pluto(8)</A>
- man page for details.</P>
-<P>Note that<STRONG> you should not modify our _updown script in place</STRONG>
-. If you did that, then upgraded FreeS/WAN, the upgrade would install a
- new default script, overwriting your changes.</P>
-<H3><A name="ipchains.script">Scripts for ipchains or iptables</A></H3>
-<P>Our<VAR> _updown</VAR> is for firewalls using<VAR> ipfwadm(8)</VAR>,
- the firewall code for the 2.0 series of Linux kernels. If you are using
- the more recent packages<VAR> ipchains(8)</VAR> (for 2.2 kernels) or<VAR>
- iptables(8)</VAR> (2.4 kernels), then you must do one of:</P>
-<UL>
-<LI>use static firewall rules which are set up at boot time as described<A
-href="#examplefw"> above</A> and do not need to be changed by Pluto</LI>
-<LI>limit yourself to ipchains(8)'s ipfwadm(8) emulation mode in order
- to use our script</LI>
-<LI>write your own script and call it with<VAR> leftupdown</VAR> and<VAR>
- rightupdown</VAR>.</LI>
-</UL>
-<P>You can write a script to do whatever you need with firewalling.
- Specify its name in a<VAR> [left|right]updown=</VAR> parameter in<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> and Pluto will automatically call it for you.</P>
-<P>The arguments Pluto passes such a script are the same ones it passes
- to our default _updown script, so the best way to build yours is to
- copy ours and modify the copy.</P>
-<P>Note, however, that<STRONG> you should not modify our _updown script
- in place</STRONG>. If you did that, then upgraded FreeS/WAN, the
- upgrade would install a new default script, overwriting your changes.</P>
-<H2><A name="NAT">A complication: IPsec vs. NAT</A></H2>
-<P><A href="#NAT.gloss">Network Address Translation</A>, also known as
- IP masquerading, is a method of allocating IP addresses dynamically,
- typically in circumstances where the total number of machines which
- need to access the Internet exceeds the supply of IP addresses.</P>
-<P>Any attempt to perform NAT operations on IPsec packets<EM> between
- the IPsec gateways</EM> creates a basic conflict:</P>
-<UL>
-<LI>IPsec wants to authenticate packets and ensure they are unaltered on
- a gateway-to-gateway basis</LI>
-<LI>NAT rewrites packet headers as they go by</LI>
-<LI>IPsec authentication fails if packets are rewritten anywhere between
- the IPsec gateways</LI>
-</UL>
-<P>For<A href="#AH"> AH</A>, which authenticates parts of the packet
- header including source and destination IP addresses, this is fatal. If
- NAT changes those fields, AH authentication fails.</P>
-<P>For<A href="#IKE"> IKE</A> and<A href="#ESP"> ESP</A> it is not
- necessarily fatal, but is certainly an unwelcome complication.</P>
-<H3><A name="nat_ok">NAT on or behind the IPsec gateway works</A></H3>
-<P>This problem can be avoided by having the masquerading take place<EM>
- on or behind</EM> the IPsec gateway.</P>
-<P>This can be done physically with two machines, one physically behind
- the other. A picture, using SG to indicate IPsec<STRONG> S</STRONG>
-ecurity<STRONG> G</STRONG>ateways, is:</P>
-<PRE>      clients --- NAT ----- SG ---------- SG
-                  two machines</PRE>
-<P>In this configuration, the actual client addresses need not be given
- in the<VAR> leftsubnet=</VAR> parameter of the FreeS/WAN connection
- description. The security gateway just delivers packets to the NAT box;
- it needs only that machine's address. What that machine does with them
- does not affect FreeS/WAN.</P>
-<P>A more common setup has one machine performing both functions:</P>
-<PRE>      clients ----- NAT/SG ---------------SG
-                  one machine</PRE>
-<P>Here you have a choice of techniques depending on whether you want to
- make your client subnet visible to clients on the other end:</P>
-<UL>
-<LI>If you want the single gateway to behave like the two shown above,
- with your clients hidden behind the NAT, then omit the<VAR> leftsubnet=</VAR>
- parameter. It then defaults to the gateway address. Clients on the
- other end then talk via the tunnel only to your gateway. The gateway
- takes packets emerging from the tunnel, applies normal masquerading,
- and forwards them to clients.</LI>
-<LI>If you want to make your client machines visible, then give the
- client subnet addresses as the<VAR> leftsubnet=</VAR> parameter in the
- connection description and
-<DL>
-<DT>either</DT>
-<DD>set<VAR> leftfirewall=yes</VAR> to use the default<VAR> updown</VAR>
- script</DD>
-<DT>or</DT>
-<DD>use your own script by giving its name in a<VAR> leftupdown=</VAR>
- parameter</DD>
-</DL>
- These scripts are described in their own<A href="#updown"> section</A>.
-<P>In this case, no masquerading is done. Packets to or from the client
- subnet are encrypted or decrypted without any change to their client
- subnet addresses, although of course the encapsulating packets use
- gateway addresses in their headers. Clients behind the right security
- gateway see a route via that gateway to the left subnet.</P>
-</LI>
-</UL>
-<H3><A name="nat_bad">NAT between gateways is problematic</A></H3>
-<P>We recommend not trying to build IPsec connections which pass through
- a NAT machine. This setup poses problems:</P>
-<PRE>      clients --- SG --- NAT ---------- SG</PRE>
-<P>If you must try it, some references are:</P>
-<UL>
-<LI>Jean_Francois Nadeau's document on doing<A href="http://jixen.tripod.com/#NATed gateways">
- IPsec behind NAT</A></LI>
-<LI><A href="#VPN.masq">VPN masquerade patches</A> to make a Linux NAT
- box handle IPsec packets correctly</LI>
-</UL>
-<H3><A name="NAT.ref">Other references on NAT and IPsec</A></H3>
-<P>Other documents which may be relevant include:</P>
-<UL>
-<LI>an Internet Draft on<A href="http://search.ietf.org/internet-drafts/draft-aboba-nat-ipsec-04.txt">
- IPsec and NAT</A> which may eventually evolve into a standard solution
- for this problem.</LI>
-<LI>an informational<A href="http://www.cis.ohio-state.edu/rfc/rfc2709.txt">
- RFC</A>,<CITE> Security Model with Tunnel-mode IPsec for NAT Domains</CITE>
-.</LI>
-<LI>an<A href="http://www.cisco.com/warp/public/759/ipj_3-4/ipj_3-4_nat.html">
- article</A> in Cisco's<CITE> Internet Protocol Journal</CITE></LI>
-</UL>
-<H2><A name="complications">Other complications</A></H2>
-<P>Of course simply allowing UDP 500 and ESP packets is not the whole
- story. Various other issues arise in making IPsec and packet filters
- co-exist and even co-operate. Some of them are summarised below.</P>
-<H3><A name="through">IPsec<EM> through</EM></A> the gateway</H3>
-<P>Basic IPsec packet filtering rules deal only with packets addressed
- to or sent from your IPsec gateway.</P>
-<P>It is a separate policy decision whether to permit such packets to
- pass through the gateway so that client machines can build end-to-end
- IPsec tunnels of their own. This may not be practical if you are using<A
-href="#NAT"> NAT (IP masquerade)</A> on your gateway, and may conflict
- with some corporate security policies.</P>
-<P>Where possible, allowing this is almost certainly a good idea. Using
- IPsec on an end-to-end basis is more secure than gateway-to-gateway.</P>
-<P>Doing it is quite simple. You just need firewall rules that allow UDP
- port 500 and protocols 50 and 51 to pass through your gateway. If you
- wish, you can of course restrict this to certain hosts.</P>
-<H3><A name="ipsec_only">Preventing non-IPsec traffic</A></H3>
- You can also filter<EM> everything but</EM> UDP port 500 and ESP or AH
- to restrict traffic to IPsec only, either for anyone communicating with
- your host or just for specific partners.
-<P>One application of this is for the telecommuter who might have:</P>
-<PRE>     Sunset==========West------------------East ================= firewall --- the Internet
-         home network      untrusted net        corporate network</PRE>
-<P>The subnet on the right is 0.0.0.0/0, the whole Internet. The West
- gateway is set up so that it allows only IPsec packets to East in or
- out.</P>
-<P>This configuration is used in AT&amp;T Research's network. For details,
- see the<A href="#applied"> papers</A> links in our introduction.</P>
-<P>Another application would be to set up firewall rules so that an
- internal machine, such as an employees-only web server, could not talk
- to the outside world except via specific IPsec tunnels.</P>
-<H3><A name="unknowngate">Filtering packets from unknown gateways</A></H3>
-<P>It is possible to use firewall rules to restrict UDP 500, ESP and AH
- packets so that these packets are accepted only from known gateways.
- This is not strictly necessary since FreeS/WAN will discard packets
- from unknown gateways. You might, however, want to do it for any of a
- number of reasons. For example:</P>
-<UL>
-<LI>Arguably, &quot;belt and suspenders&quot; is the sensible approach to
- security. If you can block a potential attack in two ways, use both.
- The only question is whether to look for a third way after implementing
- the first two.</LI>
-<LI>Some admins may prefer to use the firewall code this way because
- they prefer firewall logging to FreeS/WAN's logging.</LI>
-<LI>You may need it to implement your security policy. Consider an
- employee working at home, and a policy that says traffic from the home
- system to the Internet at large must go first via IPsec to the
- corporate LAN and then out to the Internet via the corporate firewall.
- One way to do that is to make<VAR> ipsec0</VAR> the default route on
- the home gateway and provide exceptions only for UDP 500 and ESP to the
- corporate gateway. Everything else is then routed via the tunnel to the
- corporate gateway.</LI>
-</UL>
-<P>It is not possible to use only static firewall rules for this
- filtering if you do not know the other gateways' IP addresses in
- advance, for example if you have &quot;road warriors&quot; who may connect from a
- different address each time or if want to do<A href="#carpediem">
- opportunistic encryption</A> to arbitrary gateways. In these cases, you
- can accept UDP 500 IKE packets from anywhere, then use the<A href="#updown">
- updown</A> script feature of<A href="manpage.d/ipsec_pluto.8.html">
- pluto(8)</A> to dynamically adjust firewalling for each negotiated
- tunnel.</P>
-<P>Firewall packet filtering does not much reduce the risk of a<A href="#DOS">
- denial of service attack</A> on FreeS/WAN. The firewall can drop
- packets from unknown gateways, but KLIPS does that quite efficiently
- anyway, so you gain little. The firewall cannot drop otherwise
- legitmate packets that fail KLIPS authentication, so it cannot protect
- against an attack designed to exhaust resources by making FreeS/WAN
- perform many expensive authentication operations.</P>
-<P>In summary, firewall filtering of IPsec packets from unknown gateways
- is possible but not strictly necessary.</P>
-<H2><A name="otherfilter">Other packet filters</A></H2>
-<P>When the IPsec gateway is also acting as your firewall, other packet
- filtering rules will be in play. In general, those are outside the
- scope of this document. See our<A href="#firewall.linux"> Linux
- firewall links</A> for information. There are a few types of packet,
- however, which can affect the operation of FreeS/WAN or of diagnostic
- tools commonly used with it. These are discussed below.</P>
-<H3><A name="ICMP">ICMP filtering</A></H3>
-<P><A href="#ICMP.gloss">ICMP</A> is the<STRONG> I</STRONG>nternet<STRONG>
- C</STRONG>ontrol<STRONG> M</STRONG>essage<STRONG> P</STRONG>rotocol. It
- is used for messages between IP implementations themselves, whereas IP
- used is used between the clients of those implementations. ICMP is,
- unsurprisingly, used for control messages. For example, it is used to
- notify a sender that a desination is not reachable, or to tell a router
- to reroute certain packets elsewhere.</P>
-<P>ICMP handling is tricky for firewalls.</P>
-<UL>
-<LI>You definitely want some ICMP messages to get through; things won't
- work without them. For example, your clients need to know if some
- destination they ask for is unreachable.</LI>
-<LI>On the other hand, you do equally definitely do not want untrusted
- folk sending arbitrary control messages to your machines. Imagine what
- someone moderately clever and moderately malicious could do to you,
- given control of your network's routing.</LI>
-</UL>
-<P>ICMP does not use ports. Messages are distinguished by a &quot;message
- type&quot; field and, for some types, by an additional &quot;code&quot; field. The
- definitive list of types and codes is on the<A href="http://www.iana.org">
- IANA</A> site.</P>
-<P>One expert uses this definition for ICMP message types to be dropped
- at the firewall.</P>
-<PRE># ICMP types which lack socially redeeming value.
-#  5     Redirect
-#  9     Router Advertisement
-# 10     Router Selection
-# 15     Information Request
-# 16     Information Reply
-# 17     Address Mask Request
-# 18     Address Mask Reply
-
-badicmp='5 9 10 15 16 17 18'</PRE>
-<P>A more conservative approach would be to make a list of allowed types
- and drop everything else.</P>
-<P>Whichever way you do it, your ICMP filtering rules on a FreeS/WAN
- gateway should allow at least the following ICMP packet types:</P>
-<DL>
-<DT>echo (type 8)</DT>
-<DD></DD>
-<DT>echo reply (type 0)</DT>
-<DD>These are used by ping(1). We recommend allowing both types through
- the tunnel and to or from your gateway's external interface, since
- ping(1) is an essential testing tool.
-<P>It is fairly common for firewalls to drop ICMP echo packets addressed
- to machines behind the firewall. If that is your policy, please create
- an exception for such packets arriving via an IPsec tunnel, at least
- during intial testing of those tunnels.</P>
-</DD>
-<DT>destination unreachable (type 3)</DT>
-<DD>This is used, with code 4 (Fragmentation Needed and Don't Fragment
- was Set) in the code field, to control<A href="#pathMTU"> path MTU
- discovery</A>. Since IPsec processing adds headers, enlarges packets
- and may cause fragmentation, an IPsec gateway should be able to send
- and receive these ICMP messages<STRONG> on both inside and outside
- interfaces</STRONG>.</DD>
-</DL>
-<H3><A name="traceroute">UDP packets for traceroute</A></H3>
-<P>The traceroute(1) utility uses UDP port numbers from 33434 to
- approximately 33633. Generally, these should be allowed through for
- troubleshooting.</P>
-<P>Some firewalls drop these packets to prevent outsiders exploring the
- protected network with traceroute(1). If that is your policy, consider
- creating an exception for such packets arriving via an IPsec tunnel, at
- least during intial testing of those tunnels.</P>
-<H3><A name="l2tp">UDP for L2TP</A></H3>
-<P> Windows 2000 does, and products designed for compatibility with it
- may, build<A href="#l2tp"> L2TP</A> tunnels over IPsec connections.</P>
-<P>For this to work, you must allow UDP protocol 1701 packets coming out
- of your tunnels to continue to their destination. You can, and probably
- should, block such packets to or from your external interfaces, but
- allow them from<VAR> ipsec0</VAR>.</P>
-<P>See also our Windows 2000<A href="interop.html#win2k"> interoperation
- discussion</A>.</P>
-<H2><A name="packets">How it all works: IPsec packet details</A></H2>
-<P>IPsec uses three main types of packet:</P>
-<DL>
-<DT><A href="#IKE">IKE</A> uses<STRONG> the UDP protocol and port 500</STRONG>
-.</DT>
-<DD>Unless you are using only (less secure, not recommended) manual
- keying, you need IKE to negotiate connection parameters, acceptable
- algorithms, key sizes and key setup. IKE handles everything required to
- set up, rekey, repair or tear down IPsec connections.</DD>
-<DT><A href="#ESP">ESP</A> is<STRONG> protocol number 50</STRONG></DT>
-<DD>This is required for encrypted connections.</DD>
-<DT><A href="#AH">AH</A> is<STRONG> protocol number 51</STRONG></DT>
-<DD>This can be used where only authentication, not encryption, is
- required.</DD>
-</DL>
-<P>All of those packets should have appropriate IPsec gateway addresses
- in both the to and from IP header fields. Firewall rules can check this
- if you wish, though it is not strictly necessary. This is discussed in
- more detail<A href="#unknowngate"> later</A>.</P>
-<P>IPsec processing of incoming packets authenticates them then removes
- the ESP or AH header and decrypts if necessary. Successful processing
- exposes an inner packet which is then delivered back to the firewall
- machinery, marked as having arrived on an<VAR> ipsec[0-3]</VAR>
- interface. Firewall rules can use that interface label to distinguish
- these packets from unencrypted packets which are labelled with the
- physical interface they arrived on (or perhaps with a non-IPsec virtual
- interface such as<VAR> ppp0</VAR>).</P>
-<P>One of our users sent a mailing list message with a<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/12/msg00006.html">
- diagram</A> of the packet flow.</P>
-<H3><A name="noport">ESP and AH do not have ports</A></H3>
-<P>Some protocols, such as TCP and UDP, have the notion of ports. Others
- protocols, including ESP and AH, do not. Quite a few IPsec newcomers
- have become confused on this point. There are no ports<EM> in</EM> the
- ESP or AH protocols, and no ports used<EM> for</EM> them. For these
- protocols,<EM> the idea of ports is completely irrelevant</EM>.</P>
-<H3><A name="header">Header layout</A></H3>
-<P>The protocol numbers for ESP or AH are used in the 'next header'
- field of the IP header. On most non-IPsec packets, that field would
- have one of:</P>
-<UL>
-<LI>1 for ICMP</LI>
-<LI>4 for IP-in-IP encapsulation</LI>
-<LI>6 for TCP</LI>
-<LI>17 for UDP</LI>
-<LI>... or one of about 100 other possibilities listed by<A href="http://www.iana.org">
- IANA</A></LI>
-</UL>
-<P>Each header in the sequence tells what the next header will be. IPsec
- adds headers for ESP or AH near the beginning of the sequence. The
- original headers are kept and the 'next header' fields adjusted so that
- all headers can be correctly interpreted.</P>
-<P>For example, using<STRONG> [</STRONG><STRONG> ]</STRONG> to indicate
- data protected by ESP and unintelligible to an eavesdropper between the
- gateways:</P>
-<UL>
-<LI>a simple packet might have only IP and TCP headers with:
-<UL>
-<LI>IP header says next header --&gt; TCP</LI>
-<LI>TCP header port number --&gt; which process to send data to</LI>
-<LI>data</LI>
-</UL>
-</LI>
-<LI>with ESP<A href="#transport"> transport mode</A> encapsulation, that
- packet would have:
-<UL>
-<LI>IP header says next header --&gt; ESP</LI>
-<LI>ESP header<STRONG> [</STRONG> says next --&gt; TCP</LI>
-<LI>TCP header port number --&gt; which process to send data to</LI>
-<LI>data<STRONG> ]</STRONG></LI>
-</UL>
- Note that the IP header is outside ESP protection, visible to an
- attacker, and that the final destination must be the gateway.</LI>
-<LI>with ESP in<A href="#tunnel"> tunnel mode</A>, we might have:
-<UL>
-<LI>IP header says next header --&gt; ESP</LI>
-<LI>ESP header<STRONG> [</STRONG> says next --&gt; IP</LI>
-<LI>IP header says next header --&gt; TCP</LI>
-<LI>TCP header port number --&gt; which process to send data to</LI>
-<LI>data<STRONG> ]</STRONG></LI>
-</UL>
- Here the inner IP header is protected by ESP, unreadable by an
- attacker. Also, the inner header can have a different IP address than
- the outer IP header, so the decrypted packet can be routed from the
- IPsec gateway to a final destination which may be another machine.</LI>
-</UL>
-<P>Part of the ESP header itself is encrypted, which is why the<STRONG>
- [</STRONG> indicating protected data appears in the middle of some
- lines above. The next header field of the ESP header is protected. This
- makes<A href="#traffic"> traffic analysis</A> more difficult. The next
- header field would tell an eavesdropper whether your packet was UDP to
- the gateway, TCP to the gateway, or encapsulated IP. It is better not
- to give this information away. A clever attacker may deduce some of it
- from the pattern of packet sizes and timings, but we need not make it
- easy.</P>
-<P>IPsec allows various combinations of these to match local policies,
- including combinations that use both AH and ESP headers or that nest
- multiple copies of these headers.</P>
-<P>For example, suppose my employer has an IPsec VPN running between two
- offices so all packets travelling between the gateways for those
- offices are encrypted. If gateway policies allow it (The admins could
- block UDP 500 and protocols 50 and 51 to disallow it), I can build an
- IPsec tunnel from my desktop to a machine in some remote office. Those
- packets will have one ESP header throughout their life, for my
- end-to-end tunnel. For part of the route, however, they will also have
- another ESP layer for the corporate VPN's encapsulation. The whole
- header scheme for a packet on the Internet might be:</P>
-<UL>
-<LI>IP header (with gateway address) says next header --&gt; ESP</LI>
-<LI>ESP header<STRONG> [</STRONG> says next --&gt; IP</LI>
-<LI>IP header (with receiving machine address) says next header --&gt; ESP</LI>
-<LI>ESP header<STRONG> [</STRONG> says next --&gt; TCP</LI>
-<LI>TCP header port number --&gt; which process to send data to</LI>
-<LI>data<STRONG> ]]</STRONG></LI>
-</UL>
-<P>The first ESP (outermost) header is for the corporate VPN. The inner
- ESP header is for the secure machine-to-machine link.</P>
-<H3><A name="dhr">DHR on the updown script</A></H3>
-<P>Here are some mailing list comments from<A href="manpage.d/ipsec_pluto.8.html">
- pluto(8)</A> developer Hugh Redelmeier on an earlier draft of this
- document:</P>
-<PRE>There are many important things left out
-
-- firewalling is important but must reflect (implement) policy.  Since
-  policy isn't the same for all our customers, and we're not experts,
-  we should concentrate on FW and MASQ interactions with FreeS/WAN.
-
-- we need a diagram to show packet flow WITHIN ONE MACHINE, assuming
-  IKE, IPsec, FW, and MASQ are all done on that machine.  The flow is
-  obvious if the components are run on different machines (trace the
-  cables).
-
-  IKE input:
-        + packet appears on public IF, as UDP port 500
-        + input firewalling rules are applied (may discard)
-        + Pluto sees the packet.
-
-  IKE output:
-        + Pluto generates the packet &amp; writes to public IF, UDP port 500
-        + output firewalling rules are applied (may discard)
-        + packet sent out public IF
-
-  IPsec input, with encapsulated packet, outer destination of this host:
-        + packet appears on public IF, protocol 50 or 51.  If this
-          packet is the result of decapsulation, it will appear
-          instead on the paired ipsec IF.
-        + input firewalling rules are applied (but packet is opaque)
-        + KLIPS decapsulates it, writes result to paired ipsec IF
-        + input firewalling rules are applied to resulting packet
-          as input on ipsec IF
-        + if the destination of the packet is this machine, the
-          packet is passed on to the appropriate protocol handler.
-          If the original packet was encapsulated more than once
-          and the new outer destination is this machine, that
-          handler will be KLIPS.
-        + otherwise:
-          * routing is done for the resulting packet.  This may well
-            direct it into KLIPS for encoding or encrypting.  What
-            happens then is described elsewhere.
-          * forwarding firewalling rules are applied
-          * output firewalling rules are applied
-          * the packet is sent where routing specified
-
- IPsec input, with encapsulated packet, outer destination of another host:
-        + packet appears on some IF, protocol 50 or 51
-        + input firewalling rules are applied (but packet is opaque)
-        + routing selects where to send the packet
-        + forwarding firewalling rules are applied (but packet is opaque)
-        + packet forwarded, still encapsulated
-
-  IPsec output, from this host or from a client:
-        + if from a client, input firewalling rules are applied as the
-          packet arrives on the private IF
-        + routing directs the packet to an ipsec IF (this is how the
-          system decides KLIPS processing is required)
-        + if from a client, forwarding firewalling rules are applied
-        + KLIPS eroute mechanism matches the source and destination
-          to registered eroutes, yielding a SPI group.  This dictates
-          processing, and where the resulting packet is to be sent
-          (the destinations SG and the nexthop).
-        + output firewalling is not applied to the resulting
-          encapsulated packet
-
-- Until quite recently, KLIPS would double encapsulate packets that
-  didn't strictly need to be.  Firewalling should be prepared for
-  those packets showing up as ESP and AH protocol input packets on
-  an ipsec IF.
-
-- MASQ processing seems to be done as if it were part of the
-  forwarding firewall processing (this should be verified).
-
-- If a firewall is being used, it is likely the case that it needs to
-  be adjusted whenever IPsec SAs are added or removed.  Pluto invokes
-  a script to do this (and to adjust routing) at suitable times.  The
-  default script is only suitable for ipfwadm-managed firewalls.  Under
-  LINUX 2.2.x kernels, ipchains can be managed by ipfwadm (emulation),
-  but ipchains more powerful if manipulated using the ipchains command.
-  In this case, a custom updown script must be used.
-
-  We think that the flexibility of ipchains precludes us supplying an
-  updown script that would be widely appropriate.</PRE>
-<HR>
-<H1><A NAME="trouble"></A>Linux FreeS/WAN Troubleshooting Guide</H1>
-<H2><A NAME="overview"></A>Overview</H2>
-<P> This document covers several general places where you might have a
- problem:</P>
-<OL>
-<LI><A HREF="#install">During install</A>.</LI>
-<LI><A HREF="#negotiation">During the negotiation process</A>.</LI>
-<LI><A HREF="#use">Using an established connection</A>.</LI>
-</OL>
-<P>This document also contains<A HREF="#notes"> notes</A> which expand
- on points made in these sections, and tips for<A HREF="#prob.report">
- problem reporting</A>. If the other end of your connection is not
- FreeS/WAN, you'll also want to read our<A HREF="interop.html#interop.problem">
- interoperation</A> document.</P>
-<H2><A NAME="install"></A>1. During Install</H2>
-<H3><A NAME="8_2_1">1.1 RPM install gotchas</A></H3>
-<P>With the RPM method:</P>
-<UL>
-<LI>Be sure you have installed both the userland tools and the kernel
- components. One will not work without the other. For example, when
- using FreeS/WAN-produced RPMs for our 2.04 release, you need both:
-<PRE>    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm
-    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm
-</PRE>
-</LI>
-</UL>
-<H3><A NAME="8_2_2">1.2 Problems installing from source</A></H3>
-<P>When installing from source, you may find these problems:</P>
-<UL>
-<LI>Missing library. See<A HREF="#gmp.h_missing"> this</A> FAQ.</LI>
-<LI>Missing utilities required for compile. See this<A HREF="install.html#tool.lib">
- checklist</A>.</LI>
-<LI>Kernel version incompatibility. See<A HREF="#k.versions"> this</A>
- FAQ.</LI>
-<LI>Another compile problem. Find information in the out.* files, ie.
- out.kpatch, out.kbuild, created at compile time in the top-level Linux
- FreeS/WAN directory. Error messages generated by KLIPS during the boot
- sequence are accessible with the<VAR> dmesg</VAR> command.
-<BR> Check the list archives and the List in Brief to see if this is a
- known issue. If it is not, report it to the bugs list as described in
- our<A HREF="#prob.report"> problem reporting</A> section. In some
- cases, you may be asked to provide debugging information using gdb;
- details<A HREF="#gdb"> below</A>.</LI>
-<LI>If your kernel compiles but you fail to install your new
- FreeS/WAN-enabled kernel, review the sections on<A HREF="install.html#newk">
- installing the patched kernel</A>, and<A HREF="#testinstall"> testing</A>
- to see if install succeeded.</LI>
-</UL>
-<H3><A NAME="install.check"></A>1.3 Install checks</H3>
-<P><VAR>ipsec verify</VAR> checks a number of FreeS/WAN essentials. Here
- are some hints on what do to when your system doesn't check out:</P>
-<P></P>
-<TABLE border="1">
-<TR><TD><STRONG>Problem</STRONG></TD><TD><STRONG>Status</STRONG></TD><TD>
-<STRONG>Action</STRONG></TD></TR>
-<TR><TD><VAR>ipsec</VAR> not on-path</TD><TD>&nbsp;</TD><TD>
-<P>Add<VAR> /usr/local/sbin</VAR> to your PATH.</P>
-</TD></TR>
-<TR><TD>Missing KLIPS support</TD><TD><FONT COLOR="#FF0000">critical</FONT>
-</TD><TD>See<A HREF="#noKLIPS"> this FAQ.</A></TD></TR>
-<TR><TD>No RSA private key</TD><TD>&nbsp;</TD><TD>
-<P>Follow<A HREF="install.html#genrsakey"> these instructions</A> to
- create an RSA key pair for your host. RSA keys are:</P>
-<UL>
-<LI>required for opportunistic encryption, and</LI>
-<LI>our preferred method to authenticate pre-configured connections.</LI>
-</UL>
-</TD></TR>
-<TR><TD><VAR>pluto</VAR> not running</TD><TD><FONT COLOR="#FF0000">
-critical</FONT></TD><TD>
-<PRE>service ipsec start</PRE>
-</TD></TR>
-<TR><TD>No port 500 hole</TD><TD><FONT COLOR="#FF0000">critical</FONT></TD><TD>
-Open port 500 for IKE negotiation.</TD></TR>
-<TR><TD>Port 500 check N/A</TD><TD>&nbsp;</TD><TD>Check that port 500 is open
- for IKE negotiation.</TD></TR>
-<TR><TD>Failed DNS checks</TD><TD>&nbsp;</TD><TD>Opportunistic encryption
- requires information from DNS. To set this up, see<A HREF="#opp.setup">
- our instructions</A>.</TD></TR>
-<TR><TD>No public IP address</TD><TD>&nbsp;</TD><TD>Check that the interface
- which you want to protect with IPSec is up and running.</TD></TR>
-</TABLE>
-<H3><A NAME="oe.trouble"></A>1.3 Troubleshooting OE</H3>
-<P>OE should work with no local configuration, if you have posted DNS
- TXT records according to the instructions in our<A HREF="quickstart.html">
- quickstart guide</A>. If you encounter trouble, try these hints. We
- welcome additional hints via the<A HREF="mail.html"> users' mailing
- list</A>.</P>
-<TABLE border="1">
-<TR><TD><STRONG>Symptom</STRONG></TD><TD><STRONG>Problem</STRONG></TD><TD>
-<STRONG>Action</STRONG></TD></TR>
-<TR><TD> You're running FreeS/WAN 2.01 (or later), and initiating a
- connection to FreeS/WAN 2.00 (or earlier). In your logs, you see a
- message like:
-<PRE>no RSA public key known for '192.0.2.13';
-DNS search for KEY failed (no KEY record
-for 13.2.0.192.in-addr.arpa.)</PRE>
- The older FreeS/WAN logs no error.</TD><TD><A NAME="oe.trouble.flagday">
-</A> A protocol level incompatibility between 2.01 (or later) and 2.00
- (or earlier) causes this error. It occurs when a FreeS/WAN 2.01 (or
- later) box for which no KEY record is posted attempts to initiate an OE
- connection to older FreeS/WAN versions (2.00 and earlier). Note that
- older versions can initiate to newer versions without this error.</TD><TD>
-If you control the peer host, upgrade its FreeS/WAN to 2.01 (or later),
- and post new style TXT records for it. If not, but if you know its
- sysadmin, perhaps a quick note is in order. If neither option is
- possible, you can ease the transition by posting an old style KEY
- record (created with a command like &quot;ipsec&nbsp;showhostkey&nbsp;--key&quot;) to the
- reverse map for the FreeS/WAN 2.01 (or later) box.</TD></TR>
-<TR><TD>OE host is very slow to contact other hosts.</TD><TD>Slow DNS
- service while running OE.</TD><TD>It's a good idea to run a caching DNS
- server on your OE host, as outlined in<A HREF="http://lists.freeswan.org/pipermail/design/2003-January/004205.html">
- this mailing list message</A>. If your DNS servers are elsewhere, put
- their IPs in the<VAR> clear</VAR> policy group, and re-read groups with
-<PRE>ipsec auto --rereadgroups</PRE>
-</TD></TR>
-<TR><TD>
-<PRE>Can't Opportunistically initiate for
-192.0.2.2 to 192.0.2.3: no TXT record
-for 13.2.0.192.in-addr.arpa.</PRE>
-</TD><TD>Peer is not set up for OE.</TD><TD>
-<P>None. Plenty of hosts on the Internet do not run OE. If, however, you
- have set OE up on that peer, this may indicate that you need to wait up
- to 48 hours for its DNS records to propagate.</P>
-</TD></TR>
-<TR><TD><VAR>ipsec verify</VAR> does not find DNS records:
-<PRE>...
-Looking for TXT in forward map:
-                xy.example.com...[FAILED]
-Looking for TXT in reverse map...[FAILED]
-...</PRE>
- You also experience authentication failure:
-<BR>
-<PRE>Possible authentication failure:
-no acceptable response to our
-first encrypted message</PRE>
-</TD><TD>DNS records are not posted or have not propagated.</TD><TD>Did
- you post the DNS records necessary for OE? If not, do so using the
- instructions in our<A HREF="#quickstart"> quickstart guide</A>. If so,
- wait up to 48 hours for the DNS records to propagate.</TD></TR>
-<TR><TD><VAR>ipsec verify</VAR> does not find DNS records, and you
- experience authentication failure.</TD><TD>For iOE, your ID does not
- match location of forward DNS record.</TD><TD>In<VAR> config setup</VAR>
-, change<VAR> myid=</VAR> to match the forward DNS where you posted the
- record. Restart FreeS/WAN. For reference, see our<A HREF="#opp.client">
- iOE instructions</A>.</TD></TR>
-<TR><TD><VAR>ipsec verify</VAR> finds DNS records, yet there is still
- authentication failure. ( ? )</TD><TD>DNS records are malformed.</TD><TD>
-Re-create the records and send new copies to your DNS administrator.</TD>
-</TR>
-<TR><TD><VAR>ipsec verify</VAR> finds DNS records, yet there is still
- authentication failure. ( ? )</TD><TD>DNS records show different keys
- for a gateway vs. its subnet hosts.</TD><TD>All TXT records for boxes
- protected by an OE gateway must contain the gateway's public key.
- Re-create and re-post any incorrect records using<A HREF="#opp.incoming">
- these instructions</A>.</TD></TR>
-<TR><TD>OE gateway loses connectivity to its subnet. The gateway's
- routing table shows routes to the subnet through IPsec interfaces.</TD><TD>
-The subnet is part of the<VAR> private</VAR> or<VAR> block</VAR> policy
- group on the gateway.</TD><TD>Remove the subnet from the group, and
- reread groups with
-<PRE>ipsec auto --rereadgroups</PRE>
-</TD></TR>
-<TR><TD>OE does not work to hosts on the local LAN.</TD><TD>This is a
- known issue.</TD><TD>See<A HREF="opportunism.known-issues"> this list</A>
- of known issues with OE.</TD></TR>
-<TR><TD>FreeS/WAN does not seem to be executing your default policy. In
- your logs, you see a message like:
-<PRE>/etc/ipsec.d/policies/iprivate-or-clear&quot;
-line 14: subnet &quot;0.0.0.0/0&quot;,
-source 192.0.2.13/32,
-already &quot;private-or-clear&quot;</PRE>
-</TD><TD><A HREF="#fullnet">Fullnet</A> in a policy group file defines
- your default policy. Fullnet should normally be present in only one
- policy group file. The fine print: you can have two default policies
- defined so long as they protect different local endpoints (e.g. the
- FreeS/WAN gateway and a subnet).</TD><TD> Find all policies which
- contain fullnet with:
-<BR>
-<PRE>grep -F 0.0.0.0/0 /etc/ipsec.d/policies/*</PRE>
- then remove the unwanted occurrence(s).</TD></TR>
-</TABLE>
-<H2><A NAME="negotiation"></A>2. During Negotiation</H2>
-<P>When you fail to bring up a tunnel, you'll need to find out:</P>
-<UL>
-<LI><A HREF="#state">what your connection state is,</A> and often</LI>
-<LI><A HREF="#find.pluto.error">an error message</A>.</LI>
-</UL>
-<P>before you can<A HREF="#interpret.pluto.error"> diagnose your problem</A>
-.</P>
-<H3><A NAME="state"></A>2.1 Determine Connection State</H3>
-<H4><A NAME="8_3_1_1">Finding current state</A></H4>
-<P>You can see connection states (STATE_MAIN_I1 and so on) when you
- bring up a connection on the command line. If you have missed this, or
- brought up your connection automatically, use:</P>
-<PRE>ipsec auto --status</PRE>
-<P>The most relevant state is the last one reached.</P>
-<H4><A NAME="8_3_1_2"><VAR>What's this supposed to look like?</VAR></A></H4>
-<P>Negotiations should proceed though various states, in the processes
- of:</P>
-<OL>
-<LI>IKE negotiations (aka Phase 1, Main Mode, STATE_MAIN_*)</LI>
-<LI>IPSEC negotiations (aka Phase 2, Quick Mode, STATE_QUICK_*)</LI>
-</OL>
-<P>These are done and a connection is established when you see messages
- like:</P>
-<PRE>    000 #21: &quot;myconn&quot; STATE_MAIN_I4 (ISAKMP SA established)...
-    000 #2: &quot;myconn&quot; STATE_QUICK_I2 (sent QI2, IPsec SA established)...</PRE>
-<P> Look for the key phrases are &quot;ISAKMP SA established&quot; and &quot;IPSec SA
- established&quot;, with the relevant connection name. Often, this happens at
- STATE_MAIN_I4 and STATE_QUICK_I2, respectively.</P>
-<P><VAR>ipsec auto --status</VAR> will tell you what states<STRONG> have
- been achieved</STRONG>, rather than the current state. Since
- determining the current state is rather more difficult to do, current
- state information is not available from Linux FreeS/WAN. If you are
- actively bringing a connection up, the status report's last states for
- that connection likely reflect its current state. Beware, though, of
- the case where a connection was correctly brought up but is now downed:
- Linux FreeS/WAN will not notice this until it attempts to rekey.
- Meanwhile, the last known state indicates that the connection has been
- established.</P>
-<P>If your connection is stuck at STATE_MAIN_I1, skip straight to<A HREF="#ikepath">
- here</A>.</P>
-<H3><A NAME="find.pluto.error"></A>2.2 Finding error text</H3>
-<P>Solving most errors will require you to find verbose error text,
- either on the command line or in the logs.</P>
-<H4><A NAME="8_3_2_1">Verbose start for more information</A></H4>
-<P> Note that you can get more detail from<VAR> ipsec auto</VAR> using
- the --verbose flag:</P>
-<PRE STYLE="margin-bottom: 0.2in">    ipsec auto --verbose --up west-east</PRE>
-<P> More complete information can be gleaned from the<A HREF="#logusage">
- log files</A>.</P>
-<H4><A NAME="8_3_2_2">Debug levels count</A></H4>
-<P>The amount of description you'll get here depends on ipsec.conf debug
- settings,<VAR> klipsdebug</VAR>= and<VAR> plutodebug</VAR>=. When
- troubleshooting, set at least one of these to<VAR> all</VAR>, and when
- done, reset it to<VAR> none</VAR> so your logs don't fill up. Note that
- you must have enabled the<VAR> klipsdebug</VAR><A HREF="install.html#allbut">
- compile-time option</A> for the<VAR> klipsdebug</VAR> configuration
- switch to work.</P>
-<P>For negotiation problems<VAR> plutodebug</VAR> is most relevant.<VAR>
- klipsdebug</VAR> applies mainly to attempts to use an
- already-established connection. See also<A HREF="#parts"> this</A>
- description of the division of duties within Linux FreeS/WAN.</P>
-<P>After raising your debug levels, restart Linux FreeS/WAN to ensure
- that ipsec.conf is reread, then recreate the error to generate verbose
- logs.</P>
-<H4><A NAME="8_3_2_3"><VAR>ipsec barf</VAR> for lots of debugging
- information</A></H4>
-<P><A HREF="manpage.d/ipsec_barf.8.html"><VAR> ipsec barf (8)</VAR></A>
- collects a bunch of useful debugging information, including these logs
- Use the command</P>
-<PRE>
-    ipsec barf &gt; barf.west
-</PRE>
-<P>to generate one.</P>
-<H4><A NAME="8_3_2_4">Find the error</A></H4>
-<P>Search out the failure point in your logs. Are there a handful of
- lines which succinctly describe how things are going wrong or contrary
- to your expectation? Sometimes the failure point is not immediately
- obvious: Linux FreeS/WAN's errors are usually not marked &quot;Error&quot;. Have
- a look in the<A HREF="faq.html"> FAQ</A> for what some common failures
- look like.</P>
-<P>Tip: problems snowball. Focus your efforts on the first problem,
- which is likely to be the cause of later errors.</P>
-<H4><A NAME="8_3_2_5">Play both sides</A></H4>
-<P>Also find error text on the peer IPSec box. This gives you two
- perspectives on the same failure.</P>
-<P>At times you will require information which only one side has. The
- peer can merely indicate the presence of an error, and its approximate
- point in the negotiations. If one side keeps retrying, it may be
- because there is a show stopper on the other side. Have a look at the
- other side and figure out what it doesn't like.</P>
-<P>If the other end is not Linux FreeS/WAN, the principle is the same:
- replicate the error with its most verbose logging on, and capture the
- output to a file.</P>
-<H3><A NAME="interpret.pluto.error"></A>2.3 Interpreting a Negotiation
- Error</H3>
-<H4><A NAME="ikepath"></A>Connection stuck at STATE_MAIN_I1</H4>
-<P>This error commonly happens because IKE (port 500) packets, needed to
- negotiate an IPSec connection, cannot travel freely between your IPSec
- gateways. See<A HREF="#packets"> our firewall document</A> for details.</P>
-<H4><A NAME="8_3_3_2">Other errors</A></H4>
-<P>Other errors require a bit more digging. Use the following resources:</P>
-<UL>
-<LI><A HREF="faq.html">the FAQ</A> . Since this document is constantly
- updated, the snapshot's FAQ may have a new entry relevant to your
- problem.</LI>
-<LI>our<A HREF="background.html"> background document</A> . Special
- considerations which, while not central to Linux FreeS/WAN, are often
- tripped over. Includes problems with<A href="#MTU.trouble"> packet
- fragmentation</A>, and considerations for testing opportunism.</LI>
-<LI>the<A HREF="#lists"> list archives</A>. Each of the searchable
- archives works differently, so it's worth checking each. Use a search
- term which is generic, but identifies your error, for example &quot;No
- connection is known for&quot;.
-<BR> Often, you will find that your question has been answered in the
- past. Finding an archived answer is quicker than asking the list. You
- may, however, find similar questions without answers. If you do, send
- their URLs to the list with your trouble report. The additional
- examples may help the list tech support person find your answer.</LI>
-<LI>Look into the code where the error is being generated. The pluto
- code is nicely documented with comments and meaningful variable names.</LI>
-</UL>
-<P>If you have failed to solve your problem with the help of these
- resources, send a detailed problem report to the users list, following
- these<A HREF="#prob.report"> guidelines</A>.</P>
-<H2><A NAME="use"></A>3. Using a Connection</H2>
-<H3><A NAME="8_4_1">3.1 Orienting yourself</A></H3>
-<H4><A NAME="8_4_1_1"><VAR>How do I know if it works?</VAR></A></H4>
-<P>Test your connection by sending packets through it. The simplest way
- to do this is with ping, but the ping needs to<STRONG> test the correct
- tunnel.</STRONG> See<A HREF="#testgates"> this example scenario</A> if
- you don't understand this.</P>
-<P></P>
-<P>If your ping returns, test any other connections you've brought u all
- check out, great. You may wish to<A HREF="#bigpacket"> test with large
- packets</A> for MTU problems.</P>
-<H4><A NAME="8_4_1_2"><VAR>ipsec barf</VAR> is useful again</A></H4>
-<P>If your ping fails to return, generate an ipsec barf debugging report
- on each IPSec gateway. On a non-Linux FreeS/WAN implementation, gather
- equivalent information. Use this, and the tips in the next sections, to
- troubleshoot. Are you sure that both endpoints are capable of hearing
- and responding to ping?</P>
-<H3><A NAME="8_4_2">3.2 Those pesky configuration errors</A></H3>
-<P>IPSec may be dropping your ping packets since they do not belong in
- the tunnels you have constructed:</P>
-<UL>
-<LI>Your ping may not test the tunnel you intend to test. For details,
- see our<A HREF="#cantping"> &quot;I can't ping&quot;</A> FAQ.</LI>
-<LI> Alternately, you may have a configuration error. For example, you
- may have configured one of the four possible tunnels between two
- gateways, but not the one required to secure the important traffic
- you're now testing. In this case, add and start the tunnel, and try
- again.</LI>
-</UL>
-<P>In either case, you will often see a message like:</P>
-<PRE>klipsdebug... no eroute</PRE>
-<P>which we discuss in<A HREF="#no_eroute"> this FAQ</A>.</P>
-<P>Note:</P>
-<UL>
-<LI><A HREF="#NAT.gloss">Network Address Translation (NAT)</A> and<A HREF="#masq">
- IP masquerade</A> may have an effect on which tunnels you need to
- configure.</LI>
-<LI>When testing a tunnel that protects a multi-node subnet, try several
- subnet nodes as ping targets, in case one node is routing incorrectly.</LI>
-</UL>
-<H3><A NAME="route.firewall"></A>3.3 Check Routing and Firewalling</H3>
-<P>If you've confirmed your configuration assumptions, the problem is
- almost certainly with routing or firewalling. Isolate the problem using
- interface statistics, firewall statistics, or a packet sniffer.</P>
-<H4><A NAME="8_4_3_1">Background:</A></H4>
-<UL>
-<LI>Linux FreeS/WAN supplies all the special routing it needs; you need
- only route packets out through your IPSec gateway. Verify that on the<VAR>
- subnetted</VAR> machines you are using for your ping-test, your routing
- is as expected. I have seen a tunnel &quot;fail&quot; because the subnet machine
- sending packets out an alternate gateway (not our IPSec gateway) on
- their return path.</LI>
-<LI>Linux FreeS/WAN requires particular<A HREF="firewall.html">
- firewalling considerations</A>. Check the firewall rules on your IPSec
- gateways and ensure that they allow IPSec traffic through. Be sure that
- no other machine - for example a router between the gateways - is
- blocking your IPSec packets.</LI>
-</UL>
-<H4><A NAME="ifconfig"></A>View Interface and Firewall Statistics</H4>
-<P>Interface reports and firewall statistics can help you track down
- lost packets at a glance. Check any firewall statistics you may be
- keeping on your IPSec gateways, for dropped packets.</P>
-<P><STRONG>Tip</STRONG>: You can take a snapshot of the packets
- processed by your firewall with:</P>
-<PRE>    iptables -L -n -v</PRE>
-<P>You can get creative with &quot;diff&quot; to find out what happens to a
- particular packet during transmission.</P>
-<P>Both<VAR> cat /proc/net/dev</VAR> and<VAR> ifconfig</VAR> display
- interface statistics, and both are included in<VAR> ipsec barf</VAR>.
- Use either to check if any interface has dropped packets. If you find
- that one has, test whether this is related to your ping. While you ping
- continuously, print that interface's statistics several times. Does its
- drop count increase in proportion to the ping? If so, check why the
- packets are dropped there.</P>
-<P>To do this, look at the firewall rules that apply to that interface.
- If the interface is an IPSec interface, more information may be
- available in the log. Grep for the word &quot;drop&quot; in a log which was
- created with<VAR> klipsdebug=all</VAR> as the error happened.</P>
-<P>See also this<A HREF="#ifconfig1"> discussion</A> on interpreting<VAR>
- ifconfig</VAR> statistics.</P>
-<H3><A NAME="sniff"></A>3.4 When in doubt, sniff it out</H3>
-<P>If you have checked configuration assumptions, routing, and firewall
- rules, and your interface statistics yield no clue, it remains for you
- to investigate the mystery of the lost packet by the most thorough
- method: with a packet sniffer (providing, of course, that this is legal
- where you are working).</P>
-<P>In order to detect packets on the ipsec virtual interfaces, you will
- need an up-to-date sniffer (tcpdump, ethereal, ksnuffle) on your IPSec
- gateway machines. You may also find it useful to sniff the ping
- endpoints.</P>
-<H4><A NAME="8_4_4_1">Anticipate your packets' path</A></H4>
-<P>Ping, and examine each interface along the projected path, checking
- for your ping's arrival. If it doesn't get to the the next stop, you
- have narrowed down where to look for it. In this way, you can isolate a
- problem area, and narrow your troubleshooting focus.</P>
-<P>Within a machine running Linux FreeS/WAN, this<A HREF="#packets">
- packet flow diagram</A> will help you anticipate a packet's path.</P>
-<P>Note that:</P>
-<UL>
-<LI> from the perspective of the tunneled packet, the entire tunnel is
- one hop. That's explained in<A HREF="#no_trace"> this</A> FAQ.</LI>
-<LI> an encapsulated IPSec packet will look different, when sniffed,
- from the plaintext packet which generated it. You can see plaintext
- packets entering an IPSec interface and the resulting cyphertext
- packets as they emerge from the corresponding physical interface.</LI>
-</UL>
-<P>Once you isolate where the packet is lost, take a closer look at
- firewall rules, routing and configuration assumptions as they affect
- that specific area. If the packet is lost on an IPSec gateway, comb
- through<VAR> klipsdebug</VAR> output for anomalies.</P>
-<P>If the packet goes through both gateways successfully and reaches the
- ping target, but does not return, suspect routing. Check that the ping
- target routes packets back to the IPSec gateway.</P>
-<H3><A NAME="find.use.error"></A>3.5 Check your logs</H3>
-<P>Here, too, log information can be useful. Start with the<A HREF="#find.pluto.error">
- guidelines above</A>.</P>
-<P>For connection use problems, set<VAR> klipsdebug=all</VAR>. Note that
- you must have enabled the<VAR> klipsdebug</VAR><A HREF="install.html#allbut">
- compile-time option</A> to do this. Restart Linux FreeS/WAN so that it
- rereads<VAR> ipsec.conf</VAR>, then recreate the error condition. When
- searching through<VAR> klipsdebug</VAR> data, look especially for the
- keywords &quot;drop&quot; (as in dropped packets) and &quot;error&quot;.</P>
-<P>Often the problem with connection use is not software error, but
- rather that the software is behaving contrary to expectation.</P>
-<H4><A NAME="interpret.use.error"></A>Interpreting log text</H4>
-<P>To interpret the Linux FreeS/WAN log text you've found, use the same
- resources as indicated for troubleshooting connection negotiation:<A HREF="faq.html">
- the FAQ</A> , our<A HREF="background.html"> background document</A>,
- and the<A HREF="#lists"> list archives</A>. Looking in the KLIPS code
- is only for the very brave.</P>
-<P>If you are still stuck, send a<A HREF="#prob.report"> detailed
- problem report</A> to the users' list.</P>
-<H3><A NAME="bigpacket"></A>3.6 More testing for the truly thorough</H3>
-<H4><A NAME="8_4_6_1">Large Packets</A></H4>
-<P>If each of your connections passed the ping test, you may wish to
- test by pinging with large packets (2000 bytes or larger). If it does
- not return, suspect MTU issues, and see this<A HREF="#MTU.trouble">
- discussion</A>.</P>
-<H4><A NAME="8_4_6_2">Stress Tests</A></H4>
-<P>In most users' view, a simple ping test, and perhaps a large-packet
- ping test suffice to indicate a working IPSec connection.</P>
-<P>Some people might like to do additional stress tests prior to
- production use. They may be interested in this<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/12/msg00224.html">
- testing protocol</A> we use at interoperation conferences, aka
- &quot;bakeoffs&quot;. We also have a<VAR> testing</VAR> directory that ships with
- the release.</P>
-<H2><A NAME="prob.report"></A>4. Problem Reporting</H2>
-<H3><A NAME="8_5_1">4.1 How to ask for help</A></H3>
-<P>Ask for troubleshooting help on the users' mailing list,<A HREF="mailto:users@lists.freeswan.org">
- users@lists.freeswan.org</A>. While sometimes an initial query with a
- quick description of your intent and error will twig someone's memory
- of a similar problem, it's often necessary to send a second mail with a
- complete problem report.</P>
-<P>When reporting problems to the mailing list(s), please include:</P>
-<UL>
-<LI>a brief description of the problem</LI>
-<LI>if it's a compile problem, the actual output from make, showing the
- problem. Try to edit it down to only the relevant part, but when in
- doubt, be as complete as you can. If it's a kernel compile problem, any
- relevant out.* files</LI>
-<LI>if it's a run-time problem, pointers to where we can find the
- complete output from &quot;ipsec barf&quot; from BOTH ENDS (not just one of
- them). Remember that it's common outside the US and Canada to pay for
- download volume, so if you can't post barfs on the web and send the URL
- to the mailing list, at least compress them with tar or gzip.
-<BR> If you can, try to simplify the case that is causing the problem.
- In particular, if you clear your logs, start FreeS/WAN with no other
- connections running, cause the problem to happen, and then do<VAR>
- ipsec barf</VAR> on both ends immediately, that gives the smallest and
- least cluttered output.</LI>
-<LI>any other error messages, complaints, etc. that you saw. Please send
- the complete text of the messages, not just a summary.</LI>
-<LI>what your network setup is. Include subnets, gateway addresses, etc.
- A schematic diagram is a good format for this information.</LI>
-<LI>exactly what you were trying to do with Linux FreeS/WAN, and exactly
- what went wrong</LI>
-<LI>a fix, if you have one. But remember, you are sending mail to people
- all over the world; US residents and US citizens in particular, please
- read doc/exportlaws.html before sending code -- even small bug fixes --
- to the list or to us.</LI>
-<LI>When in doubt about whether to include some seemingly-trivial item
- of information, include it. It is rare for problem reports to have too
- much information, and common for them to have too little.</LI>
-</UL>
-<P>Here are some good general guidelines on bug reporting:<A href="http://tuxedo.org/~esr/faqs/smart-questions.html">
- How To Ask Questions The Smart Way</A> and<A href="http://www.chiark.greenend.org.uk/~sgtatham/bugs.html">
- How to Report Bugs Effectively</A>.</P>
-<H3><A NAME="8_5_2">4.2 Where to ask</A></H3>
-<P>To report a problem, send mail about it to the users' list. If you
- are certain that you have found a bug, report it to the bugs list. If
- you encounter a problem while doing your own coding on the Linux
- FreeS/WAN codebase and think it is of interest to the design team,
- notify the design list. When in doubt, default to the users' list. More
- information about the mailing lists is found<A HREF="#lists"> here</A>.</P>
-<P>For a number of reasons -- including export-control regulations
- affecting almost any<STRONG> private</STRONG> discussion of encryption
- software -- we prefer that problem reports and discussions go to the
- lists, not directly to the team. Beware that the list goes worldwide;
- US citizens, read this important information about your<A HREF="#exlaw">
- export laws</A>. If you're using this software, you really should be on
- the lists. To get onto them, visit<A HREF="http://lists.freeswan.org/">
- lists.freeswan.org</A>.</P>
-<P>If you do send private mail to our coders or want a private reply
- from them, please make sure that the return address on your mail (From
- or Reply-To header) is a valid one. They have more important things to
- do than to unravel addresses that have been mangled in an attempt to
- confuse spammers.</P>
-<H2><A NAME="notes"></A>5. Additional Notes on Troubleshooting</H2>
-<P>The following sections supplement the Guide:<A HREF="#system.info">
- information available on your system</A>;<A HREF="#testgates"> testing
- between security gateways</A>;<A HREF="#ifconfig1"> ifconfig reports
- for KLIPS debugging</A>;<A HREF="#gdb"> using GDB on Pluto</A>.</P>
-<H3><A NAME="system.info"></A>5.1 Information available on your system</H3>
-<H4><A NAME="logusage"></A>Logs used</H4>
-<P>Linux FreeS/WAN logs to:</P>
-<UL>
-<LI>/var/log/secure (or, on Debian, /var/log/auth.log)</LI>
-<LI>/var/log/messages</LI>
-</UL>
-<P>Check both places to get full information. If you find nothing, check
- your<VAR> syslogd.conf(5)</VAR> to see where your /etc/syslog.conf or
- equivalent is directing<VAR> authpriv</VAR> messages.</P>
-<H4><A NAME="pages"></A>man pages provided</H4>
-<DL>
-<DT><A HREF="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A></DT>
-<DD> Manual page for IPSEC configuration file.</DD>
-<DT><A HREF="manpage.d/ipsec.8.html"> ipsec(8)</A></DT>
-<DD STYLE="margin-bottom: 0.2in"> Primary man page for ipsec utilities.</DD>
-</DL>
-<P> Other man pages are on<A HREF="manpages.html"> this list</A> and in</P>
-<UL>
-<LI>/usr/local/man/man3</LI>
-<LI>/usr/local/man/man5</LI>
-<LI>/usr/local/man/man8/ipsec_*</LI>
-</UL>
-<H4><A NAME="statusinfo"></A>Status information</H4>
-<DL>
-<DT>ipsec auto --status</DT>
-<DD> Command to get status report from running system. Displays Pluto's
- state. Includes the list of connections which are currently &quot;added&quot; to
- Pluto's internal database; lists state objects reflecting ISAKMP and
- IPsec SAs being negotiated or installed.</DD>
-<DT> ipsec look</DT>
-<DD> Brief status info.</DD>
-<DT> ipsec barf</DT>
-<DD STYLE="margin-bottom: 0.2in"> Copious debugging info.</DD>
-</DL>
-<H3><A NAME="testgates"></A> 5.2 Testing between security gateways</H3>
-<P>Sometimes you need to test a subnet-subnet tunnel. This is a tunnel
- between two security gateways, which protects traffic on behalf of the
- subnets behind these gateways. On this network:</P>
-<PRE>     Sunset==========West------------------East=========Sunrise
-                     IPSec gateway         IPSec gateway
-           local net       untrusted net       local net</PRE>
-<P> you might name this tunnel sunset-sunrise. You can test this tunnel
- by having a machine behind one gateway ping a machine behind the other
- gateway, but this is not always convenient or even possible.</P>
-<P>Simply pinging one gateway from the other is not useful. Such a ping
- does not normally go through the tunnel.<STRONG> The tunnel handles
- traffic between the two protected subnets, not between the gateways</STRONG>
- . Depending on the routing in place, a ping might</P>
-<UL>
-<LI>either succeed by finding an unencrypted route</LI>
-<LI>or fail by finding no route. Packets without an IPSEC eroute are
- discarded.</LI>
-</UL>
-<P><STRONG>Neither event tells you anything about the tunnel</STRONG>.
- You can explicitly create an eroute to force such packets through the
- tunnel, or you can create additional tunnels as described in our<A HREF="#multitunnel">
- configuration document</A>, but those may be unnecessary complications
- in your situation.</P>
-<P>The trick is to explicitly test between<STRONG> both gateways'
- private-side IP addresses</STRONG>. Since the private-side interfaces
- are on the protected subnets, the resulting packets do go via the
- tunnel. Use either ping -I or traceroute -i, both of which allow you to
- specify a source interface. (Note: unsupported on older Linuxes). The
- same principles apply for a road warrior (or other) case where only one
- end of your tunnel is a subnet.</P>
-<H3><A NAME="ifconfig1"></A>5.3 ifconfig reports for KLIPS debugging</H3>
-<P>When diagnosing problems using ifconfig statistics, you may wonder
- what type of activity increments a particular counter for an ipsecN
- device. Here's an index, posted by KLIPS developer Richard Guy Briggs:</P>
-<PRE>Here is a catalogue of the types of errors that can occur for which
-statistics are kept when transmitting and receiving packets via klips.
-I notice that they are not necessarily logged in the right counter.
-. . .
-
-Sources of ifconfig statistics for ipsec devices
-
-rx-errors:
-- packet handed to ipsec_rcv that is not an ipsec packet.
-- ipsec packet with payload length not modulo 4.
-- ipsec packet with bad authenticator length.
-- incoming packet with no SA.
-- replayed packet.
-- incoming authentication failed.
-- got esp packet with length not modulo 8.
-
-tx_dropped:
-- cannot process ip_options.
-- packet ttl expired.
-- packet with no eroute.
-- eroute with no SA.
-- cannot allocate sk_buff.
-- cannot allocate kernel memory.
-- sk_buff internal error.
-
-
-The standard counters are:
-
-struct enet_statistics
-{
-        int        rx_packets;                /* total packets received */
-        int        tx_packets;                /* total packets transmitted */
-        int        rx_errors;                /* bad packets received */
-        int        tx_errors;                /* packet transmit problems */
-        int        rx_dropped;                /* no space in linux buffers */
-        int        tx_dropped;                /* no space available in linux */
-        int        multicast;                /* multicast packets received */
-        int        collisions;
-
-        /* detailed rx_errors: */
-        int        rx_length_errors;
-        int        rx_over_errors;                /* receiver ring buff overflow */
-        int        rx_crc_errors;                /* recved pkt with crc error */
-        int        rx_frame_errors;        /* recv'd frame alignment error */
-        int        rx_fifo_errors;                /* recv'r fifo overrun */
-        int        rx_missed_errors;        /* receiver missed packet */
-
-        /* detailed tx_errors */
-        int        tx_aborted_errors;
-        int        tx_carrier_errors;
-        int        tx_fifo_errors;
-        int        tx_heartbeat_errors;
-        int        tx_window_errors;
-};
-
-of which I think only the first 6 are useful.</PRE>
-<H3><A NAME="gdb"></A> 5.4 Using GDB on Pluto</H3>
-<P>You may need to use the GNU debugger, gdb(1), on Pluto. This should
- be necessary only in unusual cases, for example if you encounter a
- problem which the Pluto developer cannot readily reproduce or if you
- are modifying Pluto.</P>
-<P>Here are the Pluto developer's suggestions for doing this:</P>
-<PRE>Can you get a core dump and use gdb to find out what Pluto was doing
-when it died?
-
-To get a core dump, you will have to set dumpdir to point to a
-suitable directory (see <A HREF="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A>).
-
-To get gdb to tell you interesting stuff:
-        $ script
-        $ cd dump-directory-you-chose
-        $ gdb /usr/local/lib/ipsec/pluto core
-        (gdb) where
-        (gdb) quit
-        $ exit
-
-The resulting output will have been captured by the script command in
-a file called &quot;typescript&quot;.  Send it to the list.
-
-Do not delete the core file.  I may need to ask you to print out some
-more relevant stuff.</PRE>
-<P> Note that the<VAR> dumpdir</VAR> parameter takes effect only when
- the IPsec subsystem is restarted -- reboot or ipsec setup restart.</P>
-<P>
-<BR>
-<BR></P>
-<HR>
-<H1><A name="compat">Linux FreeS/WAN Compatibility Guide</A></H1>
-<P>Much of this document is quoted directly from the Linux FreeS/WAN<A href="mail.html">
- mailing list</A>. Thanks very much to the community of testers,
- patchers and commenters there, especially the ones quoted below but
- also various contributors we haven't quoted.</P>
-<H2><A name="spec">Implemented parts of the IPsec Specification</A></H2>
-<P>In general, do not expect Linux FreeS/WAN to do everything yet. This
- is a work-in-progress and some parts of the IPsec specification are not
- yet implemented.</P>
-<H3><A name="in">In Linux FreeS/WAN</A></H3>
-<P>Things we do, as of version 1.96:</P>
-<UL>
-<LI>key management methods
-<DL>
-<DT>manually keyed</DT>
-<DD>using keys stored in /etc/ipsec.conf</DD>
-<DT>automatically keyed</DT>
-<DD>Automatically negotiating session keys as required. All connections
- are automatically re-keyed periodically. The<A href="#Pluto"> Pluto</A>
- daemon implements this using the<A href="#IKE"> IKE</A> protocol.</DD>
-</DL>
-</LI>
-<LI>Methods of authenticating gateways for IKE
-<DL>
-<DT>shared secrets</DT>
-<DD>stored in<A href="manpage.d/ipsec.secrets.5.html"> ipsec.secrets(5)</A>
-</DD>
-<DT><A href="#RSA">RSA</A> signatures</DT>
-<DD>For details, see<A href="manpage.d/ipsec_pluto.8.html"> pluto(8)</A>
-.</DD>
-<DT>looking up RSA authentication keys from<A href="#DNS"> DNS</A>.</DT>
-<DD>Note that this technique cannot be fully secure until<A href="#SDNS">
- secure DNS</A> is widely deployed.</DD>
-</DL>
-</LI>
-<LI>groups for<A href="#DH"> Diffie-Hellman</A> key negotiation
-<DL>
-<DT>group 2, modp 1024-bit</DT>
-<DT>group 5, modp 1536-bit</DT>
-<DD>We implement these two groups.
-<P>In negotiating a keying connection (ISAKMP SA, Phase 1) we propose
- both groups when we are the initiator, and accept either when a peer
- proposes them. Once the keying connection is made, we propose only the
- alternative agreed there for data connections (IPsec SA's, Phase 2)
- negotiated over that keying connection.</P>
-</DD>
-</DL>
-</LI>
-<LI>encryption transforms
-<DL>
-<DT><A href="#DES">DES</A></DT>
-<DD>DES is in the source code since it is needed to implement 3DES, but
- single DES is not made available to users because<A href="#desnotsecure">
- DES is insecure</A>.</DD>
-<DT><A href="#3DES">Triple DES</A></DT>
-<DD>implemented, and used as the default encryption in Linux FreeS/WAN.</DD>
-</DL>
-</LI>
-<LI>authentication transforms
-<DL>
-<DT><A href="#HMAC">HMAC</A> using<A href="#MD5"> MD5</A></DT>
-<DD>implemented, may be used in IKE or by by AH or ESP transforms.</DD>
-<DT><A href="#HMAC">HMAC</A> using<A href="#SHA"> SHA</A></DT>
-<DD>implemented, may be used in IKE or by AH or ESP transforms.</DD>
-</DL>
-<P>In negotiations, we propose both of these and accept either.</P>
-</LI>
-<LI>compression transforms
-<DL>
-<DT>IPComp</DT>
-<DD>IPComp as described in RFC 2393 was added for FreeS/WAN 1.6. Note
- that Pluto becomes confused if you ask it to do IPComp when the kernel
- cannot.</DD>
-</DL>
-</LI>
-</UL>
-<P>All combinations of implemented transforms are supported. Note that
- some form of packet-level<STRONG> authentication is required whenever
- encryption is used</STRONG>. Without it, the encryption will not be
- secure.</P>
-<H3><A name="dropped">Deliberately omitted</A></H3>
- We do not implement everything in the RFCs because some of those things
- are insecure. See our discussions of avoiding<A href="#weak"> bogus
- security</A>.
-<P>Things we deliberately omit which are required in the RFCs are:</P>
-<UL>
-<LI>null encryption (to use ESP as an authentication-only service)</LI>
-<LI>single DES</LI>
-<LI>DH group 1, a 768-bit modp group</LI>
-</UL>
-<P>Since these are the only encryption algorithms and DH group the RFCs
- require, it is possible in theory to have a standards-conforming
- implementation which will not interpoperate with FreeS/WAN. Such an
- implementation would be inherently insecure, so we do not consider this
- a problem.</P>
-<P>Anyway, most implementations sensibly include more secure options as
- well, so dropping null encryption, single DES and Group 1 does not
- greatly hinder interoperation in practice.</P>
-<P>We also do not implement some optional features allowed by the RFCs:</P>
-<UL>
-<LI>aggressive mode for negotiation of the keying channel or ISAKMP SA.
- This mode is a little faster than main mode, but exposes more
- information to an eavesdropper.</LI>
-</UL>
-<P>In theory, this should cause no interoperation problems since all
- implementations are required to support the more secure main mode,
- whether or not they also allow aggressive mode.</P>
-<P>In practice, it does sometimes produce problems with implementations
- such as Windows 2000 where aggressive mode is the default. Typically,
- these are easily solved with a configuration change that overrides that
- default.</P>
-<H3><A name="not">Not (yet) in Linux FreeS/WAN</A></H3>
-<P>Things we don't yet do, as of version 1.96:</P>
-<UL>
-<LI>key management methods
-<UL>
-<LI>authenticate key negotiations via local<A href="#PKI"> PKI</A>
- server, but see links to user<A href="#patch"> patches</A></LI>
-<LI>authenticate key negotiations via<A href="#SDNS"> secure DNS</A></LI>
-<LI>unauthenticated key management, using<A href="#DH"> Diffie-Hellman</A>
- key agreement protocol without authentication. Arguably, this would be
- worth doing since it is secure against all passive attacks. On the
- other hand, it is vulnerable to an active<A href="#middle">
- man-in-the-middle attack</A>.</LI>
-</UL>
-</LI>
-<LI>encryption transforms
-<P>Currently<A href="#3DES"> Triple DES</A> is the only encryption
- method Pluto will negotiate.</P>
-<P>No additional encryption transforms are implemented, though the RFCs
- allow them and some other IPsec implementations support various of
- them. We are not eager to add more. See this<A href="#other.cipher">
- FAQ question</A>.</P>
-<P><A href="#AES">AES</A>, the successor to the DES standard, is an
- excellent candidate for inclusion in FreeS/WAN, see links to user<A href="#patch">
- patches</A>.</P>
-</LI>
-<LI>authentication transforms
-<P>No optional additional authentication transforms are currently
- implemented. Likely<A href="#SHA-256"> SHA-256, SHA-384 and SHA-512</A>
- will be added when AES is.</P>
-</LI>
-<LI>Policy checking on decrypted packets
-<P>To fully comply with the RFCs, it is not enough just to accept only
- packets which survive any firewall rules in place to limit what IPsec
- packets get in, and then pass KLIPS authentication. That is what
- FreeS/WAN currently does.</P>
-<P>We should also apply additional tests, for example ensuring that all
- packets emerging from a particular tunnel have source and destination
- addresses that fall within the subnets defined for that tunnel, and
- that packets with those addresses that did not emerge from the
- appropriate tunnel are disallowed.</P>
-<P>This will be done as part of a KLIPS rewrite. See these<A href="#applied">
- links</A> and the<A href="mail.html"> design mailing list</A> for
- discussion.</P>
-</LI>
-</UL>
-<H2><A name="pfkey">Our PF-Key implementation</A></H2>
-<P>We use PF-key Version Two for communication between the KLIPS kernel
- code and the Pluto Daemon. PF-Key v2 is defined by<A href="http://www.normos.org/ietf/rfc/rfc2367.txt">
- RFC 2367</A>.</P>
-<P>The &quot;PF&quot; stands for Protocol Family. PF-Inet defines a
- kernel/userspace interface for the TCP/IP Internet protocols (TCP/IP),
- and other members of the PF series handle Netware, Appletalk, etc.
- PF-Key is just a PF for key-related matters.</P>
-<H3><A name="pfk.port">PF-Key portability</A></H3>
-<P>PF-Key came out of Berkeley Unix work and is used in the various BSD
- IPsec implementations, and in Solaris. This means there is some hope of
- porting our Pluto(8) to one of the BSD distributions, or of running
- their photurisd(8) on Linux if you prefer<A href="#photuris"> Photuris</A>
- key management over IKE.</P>
-<P>It is, however, more complex than that. The PK-Key RFC deliberately
- deals only with keying, not policy management. The three PF-Key
- implementations we have looked at -- ours, OpenBSD and KAME -- all have
- extensions to deal with security policy, and the extensions are
- different. There have been discussions aimed at sorting out the
- differences, perhaps for a version three PF-Key spec. All players are
- in favour of this, but everyone involved is busy and it is not clear
- whether or when these discussions might bear fruit.</P>
-<H2><A name="otherk">Kernels other than the latest 2.2.x and 2.4.y</A></H2>
-<P>We develop and test on Redhat Linux using the most recent kernel in
- the 2.2 and 2.4 series. In general, we recommend you use the latest
- kernel in one of those series. Complications and caveats are discussed
- below.</P>
-<H3><A name="kernel.2.0">2.0.x kernels</A></H3>
-<P>Consider upgrading to the 2.2 kernel series. If you want to stay with
- the 2.0 series, then we strongly recommend 2.0.39. Some useful security
- patches were added in 2.0.38.</P>
-<P>Various versions of the code have run at various times on most 2.0.xx
- kernels, but the current version is only lightly tested on 2.0.39, and
- not at all on older kernels.</P>
-<P>Some of our patches for older kernels are shipped in 2.0.37 and
- later, so they are no longer provided in FreeS/WAN. This means recent
- versions of FreeS/WAN will probably not compile on anything earlier
- than 2.0.37.</P>
-<H3><A name="kernel.production">2.2 and 2.4 kernels</A></H3>
-<DL>
-<DT>FreeS/WAN 1.0</DT>
-<DD>ran only on 2.0 kernels</DD>
-<DT>FreeS/WAN 1.1 to 1.8</DT>
-<DD>ran on 2.0 or 2.2 kernels
-<BR> ran on some development kernels, 2.3 or 2.4-test</DD>
-<DT>FreeS/WAN 1.9 to 1.96</DT>
-<DD>runs on 2.0, 2.2 or 2.4 kernels</DD>
-</DL>
-<P>In general,<STRONG> we suggest the latest 2.2 kernel or 2.4 for
- production use</STRONG>.</P>
-<P>Of course no release can be guaranteed to run on kernels more recent
- than it is, so quite often there will be no stable FreeS/WAN for the
- absolute latest kernel. See the<A href="#k.versions"> FAQ</A> for
- discussion.</P>
-<H2><A name="otherdist">Intel Linux distributions other than Redhat</A></H2>
-<P>We develop and test on Redhat 6.1 for 2.2 kernels, and on Redhat 7.1
- or 7.2 for 2.4, so minor changes may be required for other
- distributions.</P>
-<H3><A name="rh7">Redhat 7.0</A></H3>
-<P>There are some problems with FreeS/WAN on Redhat 7.0. They are
- soluble, but we recommend you upgrade to a later Redhat instead..</P>
-<P>Redhat 7 ships with two compilers.</P>
-<UL>
-<LI>Their<VAR> gcc</VAR> is version 2.96. Various people, including the
- GNU compiler developers and Linus, have said fairly emphatically that
- using this was a mistake. 2.96 is a development version, not intended
- for production use. In particular, it will not compile a Linux kernel.</LI>
-<LI>Redhat therefore also ship a separate compiler, which they call<VAR>
- kgcc</VAR>, for compiling kernels.</LI>
-</UL>
-<P>Kernel Makefiles have<VAR> gcc</VAR> as a default, and must be
- adjusted to use<VAR> kgcc</VAR> before a kernel will compile on 7.0.
- This mailing list message gives details:</P>
-<PRE>Subject: Re: AW: Installing IPsec on Redhat 7.0
-   Date: Thu, 1 Feb 2001 14:32:52 -0200 (BRST)
-  From: Mads Rasmussen &lt;mads@cit.com.br&gt;
- 
-&gt; From www.redhat.com/support/docs/gotchas/7.0/gotchas-7-6.html#ss6.1
-
-cd to /usr/src/linux and open the Makefile in your favorite editor. You
-will need to look for a line similar to this:
-
-CC = $(CROSS_COMPILE)gcc -D__KERNEL__ -I$(HPATH)
-
-This line specifies which C compiler to use to build the kernel. It should
-be changed to:
-
-CC = $(CROSS_COMPILE)kgcc -D__KERNEL__ -I$(HPATH)
-
-for Red Hat Linux 7. The kgcc compiler is egcs 2.91.66. From here you can
-proceed with the typical compiling steps.</PRE>
-<P>Check the<A href="mail.html"> mailing list</A> archive for more
- recent news.</P>
-<H3><A name="suse">SuSE Linux</A></H3>
-<P>SuSE 6.3 and later versions, at least in Europe, ship with FreeS/WAN
- included.</P>
-<P>FreeS/WAN packages distributed for SuSE 7.0-7.2 were somehow
- miscompiled. You can find fixed packages on<A HREF="http://www.suse.de/~garloff/linux/FreeSWAN">
- Kurt Garloff's page</A>.</P>
-<P>Here are some notes for an earlier SuSE version.</P>
-<H4><A NAME="9_4_2_1">SuSE Linux 5.3</A></H4>
-<PRE>Date: Mon, 30 Nov 1998
-From: Peter Onion &lt;ponion@srd.bt.co.uk&gt;
-
-... I got Saturdays snapshot working between my two SUSE5.3 machines at home.
-
-The mods to the install process are quite simple.  From memory and looking at
-the files on the SUSE53 machine here at work....
-
-And extra link in each of the /etc/init.d/rc?.d directories called K35ipsec
-which SUSE use to shut a service down.
-
-A few mods in /etc/init.d/ipsec  to cope with the different places that SUSE
-put config info, and remove the inculsion of /etc/rc.d/init.d/functions and .
-/etc/sysconfig/network as they don't exists and 1st one isn't needed anyway.
-
-insert &quot;. /etc/rc.config&quot; to pick up the SUSE config info and use 
-
-  if test -n &quot;$NETCONFIG&quot; -a &quot;$NETCONFIG&quot; != &quot;YAST_ASK&quot; ; then
-
-to replace 
-
-  [ ${NETWORKING} = &quot;no&quot; ] &amp;&amp; exit 0
-
-Create /etc/sysconfig  as SUSE doesn't have one.
-
-I think that was all (but I prob forgot something)....</PRE>
-<P>You may also need to fiddle initialisation scripts to ensure that<VAR>
- /var/run/pluto.pid</VAR> is removed when rebooting. If this file is
- present, Pluto does not come up correctly.</P>
-<H3><A name="slack">Slackware</A></H3>
-<PRE>Subject: Re: linux-IPsec: Slackware distribution
-  Date:  Thu, 15 Apr 1999 12:07:01 -0700
-  From:  Evan Brewer &lt;dmessiah@silcon.com&gt;
-
-&gt; Very shortly, I will be needing to install IPsec on at least gateways that
-&gt; are running Slackware. . . .
-
-The only trick to getting it up is that on the slackware dist there is no
-init.d directory in /etc/rc.d .. so create one.  Then, what I do is take the
-IPsec startup script which normally gets put into the init.d directory, and
-put it in /etc/rc.d and name ir rc.ipsec .. then I symlink it to the file
-in init.d.  The only file in the dist you need to really edit is the
-utils/Makefile, setup4:
-
-Everything else should be just fine.</PRE>
-<P>A year or so later:</P>
-<PRE>Subject: Re: HTML Docs- Need some cleanup?
-   Date: Mon, 8 Jan 2001
-   From: Jody McIntyre &lt;jodym@oeone.com&gt;
-
-I have successfully installed FreeS/WAN on several Slackware 7.1 machines.
-FreeS/WAN installed its rc.ipsec file in /etc/rc.d.  I had to manually call
-this script from rc.inet2.  This seems to be an easier method than Evan
-Brewer's.</PRE>
-<H3><A name="deb">Debian</A></H3>
-<P>A recent (Nov 2001) mailing list points to a<A href="http://www.thing.dyndns.org/debian/vpn.htm">
- web page</A> on setting up several types of tunnel, including IPsec, on
- Debian.</P>
-<P>Some older information:</P>
-<PRE>Subject: FreeS/WAN 1.0 on Debian 2.1
-   Date: Tue, 20 Apr 1999
-  From:  Tim Miller &lt;cerebus+counterpane@haybaler.sackheads.org&gt;
-
-        Compiled and installed without error on a Debian 2.1 system
-with kernel-source-2.0.36 after pointing RCDIR in utils/Makefile to
-/etc/init.d.
-
-        /var/lock/subsys/ doesn't exist on Debian boxen, needs to be
-created; not a fatal error.
-
-        Finally, IPsec scripts appear to be dependant on GNU awk
-(gawk); the default Debian awk (mawk-1.3.3-2) had fatal difficulties.
-With gawk installed and /etc/alternatives/awk linked to /usr/bin/gawk
-operation appears flawless.</PRE>
-<P>The scripts in question have been modified since this was posted. Awk
- versions should no longer be a problem.</P>
-<H3><A name="caldera">Caldera</A></H3>
-<PRE>Subject: Re: HTML Docs- Need some cleanup?
-   Date: Mon, 08 Jan 2001
-   From: Andy Bradford &lt;andyb@calderasystems.com&gt;
-
-On Sun, 07 Jan 2001 22:59:05 EST, Sandy Harris wrote:
-
-&gt;     Intel Linux distributions other than Redhat 5.x and 6.x 
-&gt;         Redhat 7.0 
-&gt;         SuSE Linux 
-&gt;             SuSE Linux 5.3 
-&gt;         Slackware 
-&gt;         Debian 
-
-Can you please include Caldera in this list?  I have tested it since 
-FreeS/Wan 1.1 and it works great with our systems---provided one 
-follows the FreeS/Wan documentation. :-)
-
-Thank you,
-Andy</PRE>
-<H2><A name="CPUs">CPUs other than Intel</A></H2>
-<P>FreeS/WAN has been run sucessfully on a number of different CPU
- architectures. If you have tried it on one not listed here, please post
- to the<A href="mail.html"> mailing list</A>.</P>
-<H3><A name=" strongarm">Corel Netwinder (StrongARM CPU)</A></H3>
-<PRE>Subject: linux-ipsec: Netwinder diffs
-Date: Wed, 06 Jan 1999
-From: rhatfield@plaintree.com
-
-I had a mistake in my IPsec-auto, so I got things working this morning.
-
-Following are the diffs for my changes.  Probably not the best and cleanest way 
-of doing it, but it works. . . . </PRE>
-<P>These diffs are in the 0.92 and later distributions, so these should
- work out-of-the-box on Netwinder.</P>
-<H3><A name="yellowdog">Yellow Dog Linux on Power PC</A></H3>
-<PRE>Subject:  Compiling FreeS/WAN 1.1 on YellowDog Linux (PPC)
-   Date:  11 Dec 1999
-   From:  Darron Froese &lt;darron@fudgehead.com&gt;
-
-I'm summarizing here for the record - because it's taken me many hours to do
-this (multiple times) and because I want to see IPsec on more linuxes than
-just x86.
-
-Also, I can't remember if I actually did summarize it before... ;-) I'm
-working too many late hours.
-
-That said - here goes.
-
-1. Get your linux kernel and unpack into /usr/src/linux/ - I used 2.2.13.
-&lt;http://www.kernel.org/pub/linux/kernel/v2.2/linux-2.2.13.tar.bz2&gt;
-
-2. Get FreeS/WAN and unpack into /usr/src/freeswan-1.1
-&lt;ftp://ftp.xs4all.nl/pub/crypto/freeswan/freeswan-1.1.tar.gz&gt;
-
-3. Get the gmp src rpm from here:
-&lt;ftp://ftp.yellowdoglinux.com//pub/yellowdog/champion-1.1/SRPMS/SRPMS/gmp-2.0.2-9a.src.rpm&gt;
-
-4. Su to root and do this: rpm --rebuild gmp-2.0.2-9a.src.rpm
-
-You will see a lot of text fly by and when you start to see the rpm
-recompiling like this:
-
-Executing: %build
-+ umask 022
-+ cd /usr/src/redhat/BUILD
-+ cd gmp-2.0.2
-+ libtoolize --copy --force
-Remember to add `AM_PROG_LIBTOOL' to `configure.in'.
-You should add the contents of `/usr/share/aclocal/libtool.m4' to
-`aclocal.m4'.
-+ CFLAGS=-O2 -fsigned-char
-+ ./configure --prefix=/usr
-
-Hit Control-C to stop the rebuild. NOTE: We're doing this because for some
-reason the gmp source provided with FreeS/WAN 1.1 won't build properly on
-ydl.
-
-cd /usr/src/redhat/BUILD/
-cp -ar gmp-2.0.2 /usr/src/freeswan-1.1/
-cd /usr/src/freeswan-1.1/
-rm -rf gmp
-mv gmp-2.0.2 gmp
-
-5. Open the freeswan Makefile and change the line that says:
-KERNEL=$(b)zimage (or something like that) to
-KERNEL=vmlinux
-
-6. cd ../linux/
-
-7. make menuconfig
-Select an option or two and then exit - saving your changes.
-
-8. cd ../freeswan-1.1/ ; make menugo
-
-That will start the whole process going - once that's finished compiling,
-you have to install your new kernel and reboot.
-
-That should build FreeS/WAN on ydl (I tried it on 1.1).</PRE>
- And a later message on the same topic:
-<PRE>Subject: Re: FreeS/WAN, PGPnet and E-mail
-   Date: Sat, 22 Jan 2000
-   From: Darron Froese &lt;darron@fudgehead.com&gt;
-
-on 1/22/00 6:47 PM, Philip Trauring at philip@trauring.com wrote:
-
-&gt; I have a PowerMac G3 ...
-
-The PowerMac G3 can run YDL 1.1 just fine. It should also be able to run
-FreeS/WAN 1.2patch1 with a couple minor modifications:
-
-1. In the Makefile it specifies a bzimage for the kernel compile - you have
-to change that to vmlinux for the PPC.
-
-2. The gmp source that comes with FreeS/WAN (for whatever reason) fails to
-compile. I have gotten around this by getting the gmp src rpm from here:
-
-ftp://ftp.yellowdoglinux.com//pub/yellowdog/champion-1.1/SRPMS/SRPMS/gmp-2.0.2-9a.src.rpm
-
-If you rip the source out of there - and place it where the gmp source
-resides it will compile just fine.</PRE>
-<P>FreeS/WAN no longer includes GMP source.</P>
-<H3><A name="mklinux">Mklinux</A></H3>
-<P>One user reports success on the Mach-based<STRONG> m</STRONG>icro<STRONG>
-k</STRONG>ernel Linux.</P>
-<PRE>Subject: Smiles on sparc and ppc
-   Date: Fri, 10 Mar 2000
-   From: Jake Hill &lt;jah@alien.bt.co.uk&gt;
-
-You may or may not be interested to know that I have successfully built
-FreeS/WAN on a number of non intel alpha architectures; namely on ppc
-and sparc and also on osfmach3/ppc (MkLinux). I can report that it just
-works, mostly, with few changes.</PRE>
-<H3><A name="alpha">Alpha 64-bit processors</A></H3>
-<PRE>Subject: IT WORKS (again) between intel &amp; alpha :-)))))
-   Date: Fri, 29 Jan 1999
-   From: Peter Onion &lt;ponion@srd.bt.co.uk&gt;
-
-Well I'm happy to report that I've got an IPsec connection between by intel &amp; alpha machines again :-))
-
-If you look back on this list to 7th of December I wrote...
-
--On 07-Dec-98 Peter Onion wrote:
--&gt; 
--&gt; I've about had enuf of wandering around inside the kernel trying to find out
--&gt; just what is corrupting outgoing packets...
--
--Its 7:30 in the evening .....
--
--I FIXED IT  :-))))))))))))))))))))))))))))))))
--
--It was my own fault :-((((((((((((((((((
--
--If you ask me very nicly I'll tell you where I was a little too over keen to
--change unsigned long int __u32 :-)  OPSE ...
--
--So tomorrow it will full steam ahead to produce a set of diffs/patches against
--0.91 
--
--Peter Onion.</PRE>
-<P>In general (there have been some glitches), FreeS/WAN has been
- running on Alphas since then.</P>
-<H3><A name="SPARC">Sun SPARC processors</A></H3>
-<P>Several users have reported success with FreeS/WAN on SPARC Linux.
- Here is one mailing list message:</P>
-<PRE>Subject: Smiles on sparc and ppc
-   Date: Fri, 10 Mar 2000
-   From: Jake Hill &lt;jah@alien.bt.co.uk&gt;
-
-You may or may not be interested to know that I have successfully built
-FreeS/WAN on a number of non intel alpha architectures; namely on ppc
-and sparc and also on osfmach3/ppc (MkLinux). I can report that it just
-works, mostly, with few changes.
-
-I have a question, before I make up some patches. I need to hack
-gmp/mpn/powerpc32/*.s to build them. Is this ok? The changes are
-trivial, but could I also use a different version of gmp? Is it vanilla
-here?
-
-I guess my only real headache is from ipchains, which appears to stop
-running when IPsec has been started for a while. This is with 2.2.14 on
-sparc.</PRE>
-<P>This message, from a different mailing list, may be relevant for
- anyone working with FreeS/WAN on Suns:</P>
-<PRE>Subject: UltraSPARC DES assembler
-   Date: Thu, 13 Apr 2000
-   From: svolaf@inet.uni2.dk (Svend Olaf Mikkelsen)
-     To: coderpunks@toad.com
-
-An UltraSPARC assembler version of the LibDES/SSLeay/OpenSSL des_enc.c
-file is available at http://inet.uni2.dk/~svolaf/des.htm.
-
-This brings DES on UltraSPARC from slower than Pentium at the same
-clock speed to significantly faster.</PRE>
-<H3><A name="mips">MIPS processors</A></H3>
-<P>We know FreeS/WAN runs on at least some MIPS processors because<A href="http://www.lasat.com">
- Lasat</A> manufacture an IPsec box based on an embedded MIPS running
- Linux with FreeS/WAN. We have no details.</P>
-<H3><A name="crusoe">Transmeta Crusoe</A></H3>
-<P>The Merilus<A href="http://www.merilus.com/products/fc/index.shtml">
- Firecard</A>, a Linux firewall on a PCI card, is based on a Crusoe
- processor and supports FreeS/WAN.</P>
-<H3><A name="coldfire">Motorola Coldfire</A></H3>
-<PRE>Subject: Re: Crypto hardware support
-   Date: Mon, 03 Jul 2000
-   From: Dan DeVault &lt;devault@tampabay.rr.com&gt;
-
-.... I have been running
-uClinux with FreeS/WAN 1.4 on a system built by Moreton Bay  (
-http://www.moretonbay.com )  and it was using a Coldfire processor
-and was able to do the Triple DES encryption at just about
-1 mbit / sec rate.......  they put a Hi/Fn 7901 hardware encryption
-chip on their board and now their system does over 25 mbit of 3DES
-encryption........ pretty significant increase if you ask me.</PRE>
-<H2><A name="multiprocessor">Multiprocessor machines</A></H2>
-<P>FreeS/WAN is designed to work on SMP (symmetric multi-processing)
- Linux machines and is regularly tested on dual processor x86 machines.</P>
-<P>We do not know of any testing on multi-processor machines with other
- CPU architectures or with more than two CPUs. Anyone who does test
- this, please report results to the<A href="mail.html"> mailing list</A>
-.</P>
-<P>The current design does not make particularly efficient use of
- multiprocessor machines; some of the kernel work is single-threaded.</P>
-<H2><A name="hardware">Support for crypto hardware</A></H2>
-<P>Supporting hardware cryptography accelerators has not been a high
- priority for the development team because it raises a number of fairly
- complex issues:</P>
-<UL>
-<LI>Can you trust the hardware? If it is not Open Source, how do you
- audit its security? Even if it is, how do you check that the design has
- no concealed traps?</LI>
-<LI>If an interface is added for such hardware, can that interface be
- subverted or misused?</LI>
-<LI>Is hardware acceleration actually a performance win? It clearly is
- in many cases, but on a fast machine it might be better to use the CPU
- for the encryption than to pay the overheads of moving data to and from
- a crypto board.</LI>
-<LI>the current KLIPS code does not provide a clean interface for
- hardware accelerators</LI>
-</UL>
-<P>That said, we have a<A href="#coldfire"> report</A> of FreeS/WAN
- working with one crypto accelerator and some work is going on to modify
- KLIPS to create a clean generic interface to such products. See this<A href="http://www.jukie.net/~bart/linux-ipsec/">
- web page</A> for some of the design discussion.</P>
-<P>More recently, a patch to support some hardware accelerators has been
- posted:</P>
-<PRE>Subject: [Design] [PATCH] H/W acceleration patch
-   Date: Tue, 18 Sep 2001
-   From: &quot;Martin Gadbois&quot; &lt;martin.gadbois@colubris.com&gt;
- 
-Finally!!
-Here's a web site with H/W acceleration patch for FreeS/WAN 1.91, including
-S/W and Hifn 7901 crypto support.
-
-http://sources.colubris.com/
-
-Martin Gadbois</PRE>
-<P>Hardware accelerators could take performance well beyond what
- FreeS/WAN can do in software (discussed<A href="performance.html"> here</A>
-). Here is some discussion off the IETF IPsec list, October 2001:</P>
-<PRE> ... Currently shipping chips deliver, 600 mbps throughput on a single
- stream of 3DES IPsec traffic.  There are also chips that use multiple
- cores to do 2.4 gbps.  We (Cavium) and others have announced even faster
- chips. ... Mid 2002 versions will handle at line rate (OC48 and OC192)
- IPsec and SSL/TLS traffic not only 3DES CBC but also AES and arc4.</PRE>
-<P>The patches to date support chips that have been in production for
- some time, not the state-of-the-art latest-and-greatest devices
- described in that post. However, they may still outperform software and
- they almost certainly reduce CPU overhead.</P>
-<H2><A name="ipv6">IP version 6 (IPng)</A></H2>
-<P>The Internet currently runs on version four of the IP protocols. IPv4
- is what is in the standard Linux IP stack, and what FreeS/WAN was built
- for. In IPv4, IPsec is an optional feature.</P>
-<P>The next version of the IP protocol suite is version six, usually
- abbreviated either as &quot;IPv6&quot; or as &quot;IPng&quot; for &quot;IP: the next
- generation&quot;. For IPv6, IPsec is a required feature. Any machine doing
- IPv6 is required to support IPsec, much as any machine doing (any
- version of) IP is required to support ICMP.</P>
-<P>There is a Linux implementation of IPv6 in Linux kernels 2.2 and
- above. For details, see the<A href="http://www.cs-ipv6.lancs.ac.uk/ipv6/systems/linux/faq/">
- FAQ</A>. It does not yet support IPsec. The<A href="http://www.linux-ipv6.org/">
- USAGI</A> project are also working on IPv6 for Linux.</P>
-<P>FreeS/WAN was originally built for the current standard, IPv4, but we
- are interested in seeing it work with IPv6. Some progress has been
- made, and a patched version with IPv6 support is<A href="http://www.ipv6.iabg.de/downloadframe/index.html">
- available</A>. For more recent information, check the<A href="mail.html">
- mailing list</A>.</P>
-<H3><A name="v6.back">IPv6 background</A></H3>
-<P>IPv6 has been specified by an IETF<A href="http://www.ietf.org/html.charters/ipngwg-charter.html">
- working group</A>. The group's page lists over 30 RFCs to date, and
- many Internet Drafts as well. The overview is<A href="http://www.ietf.org/rfc/rfc2460.txt">
- RFC 2460</A>. Major features include:</P>
-<UL>
-<LI>expansion of the address space from 32 to 128 bits,</LI>
-<LI>changes to improve support for
-<UL>
-<LI>mobile IP</LI>
-<LI>automatic network configuration</LI>
-<LI>quality of service routing</LI>
-<LI>...</LI>
-</UL>
-</LI>
-<LI>improved security via IPsec</LI>
-</UL>
-<P>A number of projects are working on IPv6 implementation. A prominent
- Open Source effort is<A href="http://www.kame.net/"> KAME</A>, a
- collaboration among several large Japanese companies to implement IPv6
- for Berkeley Unix. Other major players are also working on IPv6. For
- example, see pages at:</P>
-<UL>
-<LI><A href="http://playground.sun.com/pub/ipng/html/ipng-main.html">Sun</A>
-</LI>
-<LI><A href="http://www.cisco.com/warp/public/732/ipv6/index.html">Cisco</A>
-</LI>
-<LI><A href="http://www.microsoft.com/windows2000/techinfo/howitworks/communications/networkbasics/IPv6.asp">
-Microsoft</A></LI>
-</UL>
-<P>The<A href="http://www.6bone.net/"> 6bone</A> (IPv6 backbone) testbed
- network has been up for some time. There is an active<A href="http://www.ipv6.org/">
- IPv6 user group</A>.</P>
-<P>One of the design goals for IPv6 was that it must be possible to
- convert from v4 to v6 via a gradual transition process. Imagine the
- mess if there were a &quot;flag day&quot; after which the entire Internet used
- v6, and all software designed for v4 stopped working. Almost every
- computer on the planet would need major software changes! There would
- be huge costs to replace older equipment. Implementers would be worked
- to death before &quot;the day&quot;, systems administrators and technical support
- would be completely swamped after it. The bugs in every implementation
- would all bite simultaneously. Large chunks of the net would almost
- certainly be down for substantial time periods. ...</P>
-<P>Fortunately, the design avoids any &quot;flag day&quot;. It is therefore a
- little tricky to tell how quickly IPv6 will take over. The transition
- has certainly begun. For examples, see announcements from<A href="http://www.mailbase.ac.uk/lists/internet2/2000-03/0016.html">
- NTT</A> and<A href="http://www.vnunet.com/News/1102383"> Nokia</A>.
- However, it is not yet clear how quickly the process will gain
- momentum, or when it will be completed. Likely large parts of the
- Internet will remain with IPv4 for years to come.</P>
-<HR>
-<A NAME="interop"></A>
-<H1><A NAME="10">Interoperating with FreeS/WAN</A></H1>
-<P>The FreeS/WAN project needs you! We rely on the user community to
- keep up to date. Mail users@lists.freeswan.org with your interop
- success stories.</P>
-<P><STRONG>Please note</STRONG>: Most of our interop examples feature
- Linux FreeS/WAN 1.x config files. You can convert them to 2.x files
- fairly easily with the patch in our<A HREF="#ipsec.conf_v2"> Upgrading
- Guide</A>.</P>
-<H2><A NAME="10_1">Interop at a Glance</A></H2>
-<TABLE BORDER="1">
-<TR><TD>&nbsp;</TD><TD colspan="5">FreeS/WAN VPN</TD><TD>Road Warrior</TD><TD>
-OE</TD></TR>
-<TR><TD>&nbsp;</TD><TD>PSK</TD><TD>RSA Secret</TD><TD>X.509
-<BR><SMALL><A HREF="#interoprules">(requires patch)</A></SMALL></TD><TD>
-NAT-Traversal
-<BR><SMALL><A HREF="#interoprules">(requires patch)</A></SMALL></TD><TD>
-Manual
-<BR>Keying</TD><TD>&nbsp;</TD><TD>&nbsp;</TD></TR>
-<TR><TD colspan="8">More Compatible</TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#freeswan">FreeS/WAN</A><A NAME="freeswan.top"> &nbsp;</A></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#00cc00">Yes</FONT>
-</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#isakmpd">isakmpd (OpenBSD)</A><A NAME="isakmpd.top"> &nbsp;</A>
-</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>
-<FONT color="#cc0000">No&nbsp;&nbsp;&nbsp;&nbsp;</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#kame">Kame (FreeBSD,
-<BR> NetBSD, MacOSX)
-<BR> <SMALL>aka racoon</SMALL></A><A NAME="kame.top"> &nbsp;</A></TD><TD><FONT
-color="#00cc00">Yes</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#mcafee">McAfee VPN
-<BR><SMALL>was PGPNet</SMALL></A><A NAME="mcafee.top"> &nbsp;</A></TD><TD><FONT
-color="#00cc00">Yes</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#microsoft">Microsoft
-<BR> Windows 2000/XP</A><A NAME="microsoft.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#cc0000">
-No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#ssh">SSH Sentinel</A><A NAME="ssh.top"> &nbsp;</A></TD><TD><FONT
-color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT>
-</TD><TD><FONT color="#cccc00">Maybe</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#safenet">Safenet SoftPK
-<BR>/SoftRemote</A><A NAME="safenet.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#cc0000">
-No</FONT></TD></TR>
-<TR><TD colspan="8">Other</TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#6wind">6Wind</A><A NAME="6wind.top"> &nbsp;</A></TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-<FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#alcatel">Alcatel Timestep</A><A NAME="alcatel.top"> &nbsp;</A>
-</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#apple">Apple Macintosh
-<BR>System 10+</A><A NAME="apple.top"> &nbsp;</A></TD><TD><FONT color="#cccc00">
-Maybe</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#cccc00">
-Maybe</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#cccc00">Maybe</FONT></TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#ashleylaurent">AshleyLaurent
-<BR> VPCom</A><A NAME="ashleylaurent.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT
-color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#borderware">Borderware</A><A NAME="borderware.top"> &nbsp;</A>
-</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD><TD><FONT color="#cc0000">
-No</FONT></TD></TR>
-
-<!--
-http://www.cequrux.com/vpn-guides.php3
-"coming soon" guide to connect with FreeS/WAN.
--->
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#checkpoint">Check Point FW-1/VPN-1</A><A NAME="checkpoint.top">
- &nbsp;</A></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>
-<FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#cisco">Cisco with 3DES</A><A NAME="cisco.top"> &nbsp;</A></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#cccc00">Maybe</FONT>
-</TD><TD>&nbsp;</TD><TD><FONT color="#cccc00">Maybe</FONT></TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#equinux">Equinux VPN Tracker
-<BR> (for Mac OS X)</A><A NAME="equinux.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#cccc00">Maybe</FONT></TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#fsecure">F-Secure</A><A NAME="fsecure.top"> &nbsp;</A></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cccc00">
-Maybe</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#gauntlet">Gauntlet GVPN</A><A NAME="gauntlet.top"> &nbsp;</A>
-</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">
-No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#aix">IBM AIX</A><A NAME="aix.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#cccc00">Maybe</FONT></TD><TD>
-&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#as400">IBM AS/400</A><A NAME="as400"> &nbsp;</A></TD><TD><FONT
-color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#intel">Intel Shiva
-<BR>LANRover/Net Structure</A><A NAME="intel.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT
-color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#lancom">LanCom (formerly ELSA)</A><A NAME="lancom.top">
- &nbsp;</A></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#linksys">Linksys</A><A NAME="linksys.top"> &nbsp;</A></TD><TD>
-<FONT color="#cccc00">Maybe</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">
-No</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>
-<FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#lucent">Lucent</A><A NAME="lucent.top"> &nbsp;</A></TD><TD><FONT
-color="#cccc00">Partial</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#netasq">Netasq</A><A NAME="netasq.top"> &nbsp;</A></TD><TD>
-&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#netcelo">netcelo</A><A NAME="netcelo.top"> &nbsp;</A></TD><TD>
-&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#netgear">Netgear fvs318</A><A NAME="netgear.top"> &nbsp;</A>
-</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#netscreen">Netscreen 100
-<BR>or 5xp</A><A NAME="netscreen.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cccc00">
-Maybe</FONT></TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#nortel">Nortel Contivity</A><A NAME="nortel.top"> &nbsp;</A>
-</TD><TD><FONT color="#cccc00">Partial</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#cccc00">Maybe</FONT></TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#radguard">RadGuard</A><A NAME="radguard.top"> &nbsp;</A></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#raptor">Raptor</A><A NAME="raptor"> &nbsp;</A></TD><TD><FONT
-color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#redcreek">Redcreek Ravlin</A><A NAME="redcreek.top"> &nbsp;</A>
-</TD><TD><FONT color="#00cc00">Yes</FONT><FONT color="#cccc00">/Partial</FONT>
-</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">
-No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#sonicwall">SonicWall</A><A NAME="sonicwall.top"> &nbsp;</A></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT
-color="#cccc00">Maybe</FONT></TD><TD><FONT color="#cc0000">No</FONT></TD><TD>
-<FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#sun">Sun Solaris</A><A NAME="sun.top"> &nbsp;</A></TD><TD><FONT
-color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT>
-</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT
-color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#symantec">Symantec</A><A NAME="symantec.top"> &nbsp;</A></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#watchguard">Watchguard
-<BR> Firebox</A><A NAME="watchguard.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#xedia">Xedia Access Point
-<BR>/QVPN</A><A NAME="xedia.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT
-color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#zyxel">Zyxel Zywall
-<BR>/Prestige</A><A NAME="zyxel.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT
-color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE
-
-
-<TR>
-<TD><A HREF="#sample">sample</A></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
--->
-<TR><TD>&nbsp;</TD><TD>PSK</TD><TD>RSA Secret</TD><TD>X.509
-<BR><SMALL><A HREF="#interoprules">(requires patch)</A></SMALL></TD><TD>
-NAT-Traversal
-<BR><SMALL><A HREF="#interoprules">(requires patch)</A></SMALL></TD><TD>
-Manual
-<BR>Keying</TD><TD>&nbsp;</TD><TD>&nbsp;</TD></TR>
-<TR><TD>&nbsp;</TD><TD colspan="5">FreeS/WAN VPN</TD><TD>Road Warrior</TD><TD>
-OE</TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-</TABLE>
-<H3><A NAME="10_1_1">Key</A></H3>
-<TABLE BORDER="1">
-<TR><TD><FONT color="#00cc00">Yes</FONT></TD><TD>People report that this
- works for them.</TD></TR>
-<TR><TD>[Blank]</TD><TD>We don't know.</TD></TR>
-<TR><TD><FONT color="#cc0000">No</FONT></TD><TD>We have reason to
- believe it was, at some point, not possible to get this to work.</TD></TR>
-<TR><TD><FONT color="#cccc00">Partial</FONT></TD><TD>Partial success.
- For example, a connection can be created from one end only.</TD></TR>
-<TR><TD><FONT color="#00cc00">Yes</FONT><FONT color="#cccc00">/Partial</FONT>
-</TD><TD>Mixed reports.</TD></TR>
-<TR><TD><FONT color="#cccc00">Maybe</FONT></TD><TD>We think the answer
- is &quot;yes&quot;, but need confirmation.</TD></TR>
-</TABLE>
-<A NAME="interoprules"></A>
-<H2><A NAME="10_2">Basic Interop Rules</A></H2>
-<P>Vanilla FreeS/WAN implements<A HREF="#compat"> these parts</A> of the
- IPSec specifications. You can add more with<A HREF="http://www.freeswan.ca">
- Super FreeS/WAN</A>, but what we offer may be enough for many users.</P>
-<UL>
-<LI> To use X.509 certificates with FreeS/WAN, you will need the<A HREF="http://www.strongsec.org/freeswan">
- X.509 patch</A> or<A HREF="http://www.freeswan.ca"> Super FreeS/WAN</A>
-, which includes that patch.</LI>
-<LI> To use<A HREF="#NAT.gloss"> Network Address Translation</A> (NAT)
- traversal with FreeS/WAN, you will need Arkoon Network Security's<A HREF="http://open-source.arkoon.net">
- NAT traversal patch</A> or<A HREF="http://www.freeswan.ca"> Super
- FreeS/WAN</A>, which includes it.</LI>
-</UL>
-<P>We offer a set of proposals which is not user-adjustable, but covers
- all combinations that we can offer. FreeS/WAN always proposes triple
- DES encryption and Perfect Forward Secrecy (PFS). In addition, we
- propose Diffie Hellman groups 5 and 2 (in that order), and MD5 and
- SHA-1 hashes. We accept the same proposals, in the same order of
- preference.</P>
-<P>Other interop notes:</P>
-<UL>
-<LI> A<A HREF="http://lists.freeswan.org/archives/users/2003-September/msg00462.html">
- SHA-1 bug in FreeS/WAN 2.00, 2.01 and 2.02</A> may affect some interop
- scenarios. It does not affect 1.x versions, and is fixed in 2.03 and
- later.</LI>
-<LI> Some other implementations will close a connection with FreeS/WAN
- after some time. This may be a problem with rekey lifetimes. Please see<A
-HREF="http://lists.freeswan.org/archives/users/2003-October/msg00293.html">
- this tip</A> and<A HREF="http://lists.freeswan.org/pipermail/users/2001-December/005758.html">
- this workaround</A>.</LI>
-</UL>
-<H2><A NAME="10_3">Longer Stories</A></H2>
-<H3><A NAME="10_3_1">For<EM> More Compatible</EM> Implementations</A></H3>
-<H4><A NAME="freeswan">FreeS/WAN</A></H4>
-<P> See our documentation at<A HREF="http://www.freeswan.org">
- freeswan.org</A> and the Super FreeS/WAN docs at<A HREF="http://www.freeswan.ca">
- freeswan.ca</A>. Some user-written HOWTOs for FreeS/WAN-FreeS/WAN
- connections are listed in<A HREF="#howto"> our Introduction</A>.</P>
-<P>See also:</P>
-<UL>
-<LI><A HREF="http://lugbe.ch/action/reports/ipsec_htbe.phtml"> A German
- FreeS/WAN-FreeS/WAN page by Markus Wernig (X.509)</A></LI>
-</UL>
-<P><A HREF="#freeswan.top">Back to chart</A></P>
-<H4><A NAME="isakmpd">isakmpd (OpenBSD)</A></H4>
-<P><A HREF="http://www.openbsd.org/faq/faq13.html">OpenBSD FAQ: Using
- IPsec</A>
-<BR><A HREF="http://www.rommel.stw.uni-erlangen.de/~hshoexer/ipsec-howto/HOWTO.html">
- Hans-Joerg Hoexer's interop Linux-OpenBSD (PSK)</A>
-<BR><A HREF="http://www.segfault.net/ipsec/"> Skyper's configuration
- (PSK)</A>
-<BR><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
- French page with configs (X.509)</A></P>
-<P><A HREF="#isakmpd.top">Back to chart</A></P>
-<H4><A NAME="kame">Kame</A></H4>
-<UL>
-<LI>For FreeBSD and NetBSD. Ships with Mac OS X; see also our<A HREF="#apple">
- Mac</A> section.</LI>
-<LI>Also known as<EM> racoon</EM>, its keying daemon.</LI>
-</UL>
-<P><A HREF="http://www.kame.net">Kame homepage, with FAQ</A>
-<BR><A HREF="http://www.netbsd.org/Documentation/network/ipsec">
- NetBSD's IPSec FAQ</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/12/msg00560.html">
- Ghislaine's post explaining some interop peculiarities</A></P>
-<P><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/09/msg00511.html">
- Itojun's Kame-FreeS/WAN interop tips (PSK)</A>
-<BR><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2000"> Ghislaine
- Labouret's French page with links to matching FreeS/WAN and Kame
- configs (RSA)</A>
-<BR><A HREF="http://lugbe.ch/lostfound/contrib/freebsd_router/"> Markus
- Wernig's HOWTO (X.509, BSD gateway)</A>
-<BR><A HREF="http://web.morgul.net/~frodo/docs/kame+freeswan_interop.html">
- Frodo's Kame-FreeS/WAN interop (X.509)</A>
-<BR><A HREF="http://www.wavesec.org/kame.phtml"> Kame as a WAVEsec
- client.</A></P>
-<P><A HREF="#kame.top">Back to chart</A></P>
-<H4><A NAME="mcafee">PGPNet/McAfee</A></H4>
-<P></P>
-<UL>
-<LI>Now called McAfee VPN Client.</LI>
-<LI>PGPNet also came in a freeware version which did not support subnets</LI>
-<LI>To support dhcp-over-ipsec, you need the X.509 patch, which is
- included in<A HREF="http://www.freeswan.ca"> Super FreeS/WAN</A>.</LI>
-</UL>
-<P><A HREF="http://www.freeswan.ca/docs/WindowsInterop"> Tim Carr's
- Windows Interop Guide (X.509)</A>
-<BR><A HREF="http://www.rommel.stw.uni-erlangen.de/~hshoexer/ipsec-howto/HOWTO.html#Interop2">
- Hans-Joerg Hoexer's Guide for Linux-PGPNet (PSK)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/04/msg00339.html">
- Kai Martius' instructions using RSA Key-Extractor Tool (RSA)</A>
-<BR> &nbsp;&nbsp;&nbsp;&nbsp;<A HREF="http://www.zengl.net/freeswan/english.html">Christian
- Zeng's page (RSA)</A> based on Kai's work. English or German.
-<BR><A HREF="http://tirnanog.ls.fi.upm.es/CriptoLab/Biblioteca/InfTech/InfTech_CriptoLab.htm">
- Oscar Delgado's PDF (X.509, no configs)</A>
-<BR><A HREF="http://www-ec.njit.edu/~rxt1077/Howto.txt"> Ryan's HOWTO
- for FreeS/WAN-PGPNet (X.509)</A>. Through a Linksys Router with IPsec
- Passthru enabled.
-<BR><A HREF="http://jixen.tripod.com/#RW-PGP-to-Fwan"> Jean-Francois
- Nadeau's Practical Configuration (Road Warrior with PSK)</A>
-<BR><A HREF="http://www.evolvedatacom.nl/freeswan.html#toc"> Wouter
- Prins' HOWTO (Road Warrior with X.509)</A>
-<BR></P>
-<P><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/01/msg00271.html">
- Rekeying problem with FreeS/WAN and older PGPNets</A>
-<BR></P>
-<P><A HREF="http://www.strongsec.com/freeswan/dhcprelay/index.htm"> DHCP
- over IPSEC HOWTO for FreeS/WAN (requires X.509 and dhcprelay patches)</A>
-</P>
-<P><A HREF="#mcafee.top">Back to chart</A></P>
-<H4><A NAME="microsoft">Microsoft Windows 2000/XP</A></H4>
-<UL>
-<LI>IPsec comes with Win2k, and with XP Support Tools. May require<A HREF="http://www.microsoft.com/windows2000/downloads/recommended/encryption/default.asp">
- High Encryption Pack</A>. WinXP users have also reported better results
- with Service Pack 1.</LI>
-<LI>The Road Warrior setup works either way round. Windows (XP or 2K)
- IPsec can connect as a Road Warrior to FreeS/WAN. However, FreeS/WAN
- can also successfully connect as a Road Warrior to Windows IPsec (see
- Nate Carlson's configs below).</LI>
-<LI>FreeS/WAN version 1.92 or later is required to avoid an
- interoperation problem with Windows native IPsec. Earlier FreeS/WAN
- versions did not process the Commit Bit as Windows native IPsec
- expected.</LI>
-</UL>
-<P><A HREF="http://www.freeswan.ca/docs/WindowsInterop"> Tim Carr's
- Windows Interop Guide (X.509)</A>
-<BR><A HREF="http://ipsec.math.ucla.edu/services/ipsec.html"> James
- Carter's instructions (X.509, NAT-T)</A>
-<BR><A HREF="http://jixen.tripod.com/#Win2000-Fwan"> Jean-Francois
- Nadeau's Net-net Configuration (PSK)</A>
-<BR><A HREF="http://security.nta.no/freeswan-w2k.html"> Telenor's
- Node-node Config (Transport-mode PSK)</A>
-<BR><A HREF="http://vpn.ebootis.de"> Marcus Mueller's HOWTO using his
- VPN config tool (X.509).</A> Tool also works with PSK.
-<BR><A HREF="http://www.natecarlson.com/include/showpage.php?cat=linux&page=ipsec-x509">
- Nate Carlson's HOWTO using same tool (Road Warrior with X.509)</A>.
- Unusually, FreeS/WAN is the Road Warrior here.
-<BR><A HREF="http://tirnanog.ls.fi.upm.es/CriptoLab/Biblioteca/InfTech/InfTech_CriptoLab.htm">
- Oscar Delgado's PDF (X.509, no configs)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2003-July/022425.html">
- Tim Scannell's Windows XP Additional Checklist (X.509)</A>
-<BR></P>
-
-<!-- Note to self: Include L2TP references? -->
-<P><A HREF="http://www.microsoft.com/windows2000/en/server/help/default.asp?url=/windows2000/en/server/help/sag_TCPIP_ovr_secfeatures.htm">
- Microsoft's page on Win2k TCP/IP security features</A>
-<BR><A HREF="http://support.microsoft.com/support/kb/articles/Q257/2/25.ASP">
- Microsoft's Win2k IPsec debugging tips</A>
-<BR>
-<!-- Alt-URL http://support.microsoft.com/default.aspx?scid=kb;EN-US;q257225
-Perhaps newer? -->
-<A HREF="http://www.wired.com/news/technology/0,1282,36336,00.html">
- MS VPN may fall back to 1DES</A></P>
-<P><A HREF="#microsoft.top">Back to chart</A></P>
-<H4><A NAME="ssh">SSH Sentinel</A></H4>
-<UL>
-<LI>Popular and well tested.</LI>
-<LI>Also rebranded in<A HREF="http://www.zyxel.com"> Zyxel Zywall</A>.
- Our Zyxel interop notes are<A HREF="#zyxel"> here</A>.</LI>
-<LI> SSH supports IPsec-over-UDP NAT traversal.</LI>
-<LI>There is this<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/12/msg00370.html">
- potential problem</A> if you're not using the Legacy Proposal option.</LI>
-</UL>
-<P><A HREF="http://www.ssh.com/support/sentinel/documents.cfm"> SSH's
- Sentinel-FreeSWAN interop PDF (X.509)</A>
-<BR><A HREF="http://www.nadmm.com/show.php?story=articles/vpn.inc">
- Nadeem Hassan's SUSE-to-Sentinel article (Road warrior with X.509)</A>
-<BR><A HREF="http://www.zerozone.it/documents/Linux/HowTo/VPN-IPsec-Freeswan-HOWTO.html">
- O-Zone's Italian HOWTO (Road Warrior, X.509, DHCP)</A>
-<BR></P>
-<P><A HREF="#ssh.top">Back to chart</A></P>
-<H4><A NAME="safenet">Safenet SoftPK/SoftRemote</A></H4>
-<UL>
-<LI>People recommend SafeNet as a low cost Windows client.</LI>
-<LI>SoftRemote seems to be the newer name for SoftPK.</LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005061.html">
- Whit Blauvelt's SoftRemote tips</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-October/015591.html">
- Tim Wilson's tips (X.509)</A><A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00607.html">
- Workaround for a &quot;gotcha&quot;</A></P>
-<P><A HREF="http://jixen.tripod.com/#Rw-IRE-to-Fwan"> Jean-Francois
- Nadeau's Practical Configuration (Road Warrior with PSK)</A>
-<BR><A HREF="http://www.terradoncommunications.com/security/whitepapers/safe_net-to-free_swan.pdf">
- Terradon Communications' PDF (Road Warrior with PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-October/?????.html">
- Seaan.net's PDF (Road Warrior to Subnet, with PSK)</A>
-<BR><A HREF="http://www.redbaronconsulting.com/freeswan/fswansafenet.pdf">
- Red Baron Consulting's PDF (Road Warrior with X.509)</A></P>
-<P><A HREF="#safenet.top">Back to chart</A></P>
-<H3><A NAME="10_3_2">For<EM> Other Implementations</EM></A></H3>
-<H4><A NAME="6wind">6Wind</A></H4>
-<P><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
- French page with configs (X.509)</A></P>
-<P><A HREF="#6wind.top">Back to chart</A></P>
-<H4><A NAME="alcatel">Alcatel Timestep</A></H4>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-June/011878.html">
- Alain Sabban's settings (PSK or PSK road warrior; through static NAT)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/1999/06/msg00100.html">
- Derick Cassidy's configs (PSK)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/1999/08/msg00194.html">
- David Kerry's Timestep settings (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-August/013711.html">
- Kevin Gerbracht's ipsec.conf (X.509)</A></P>
-<P><A HREF="#alcatel.top">Back to chart</A></P>
-<H4><A NAME="apple">Apple Macintosh System 10+</A></H4>
-<UL>
-<LI>Since the system is based on FreeBSD, this should interoperate<A HREF="#kame">
- just like FreeBSD</A>.</LI>
-<LI> To use Appletalk over IPsec tunnels,<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005116.html">
- run it over TCP/IP</A>, or use Open Door Networks' Shareway IP tool,<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005426.html">
- described here.</A></LI>
-<LI>See also the<A HREF="#equinux"> Equinux VPN Tracker</A> for Mac OS
- X.</LI>
-</UL>
-<P><A HREF="http://ipsec.math.ucla.edu/services/ipsec.html"> James
- Carter's instructions (X.509, NAT-T)</A></P>
-<P><A HREF="#apple.top">Back to chart</A></P>
-<H4><A NAME="ashleylaurent">AshleyLaurent VPCom</A></H4>
-<P><A HREF="http://www.ashleylaurent.com/newsletter/01-28-00.htm">
- Successful interop report, no details</A></P>
-<P><A HREF="#ashleylaurent.top">Back to chart</A></P>
-<H4><A NAME="borderware">Borderware</A></H4>
-<UL>
-<LI>I suspect the Borderware client is a rebranded Safenet. If that's
- true, our<A HREF="#safenet"> Safenet section</A> will help.</LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-March/008288.html">
- Philip Reetz' configs (PSK)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/09/msg00217.html">
- Borderware server does not support FreeS/WAN road warriors</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-February/007733.html">
- Older Borderware may not support Diffie Hellman groups 2, 5</A>
-<BR></P>
-<P><A HREF="#borderware.top">Back to chart</A></P>
-<H4><A NAME="checkpoint">Check Point VPN-1 or FW-1</A></H4>
-<UL>
-<LI><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00099.html">
- Caveat about IP-range inclusion on Check Point.</A></LI>
-<LI> Some versions of Check Point may require an aggressive mode patch
- to interoperate with FreeS/WAN.
-<BR><A HREF="http://www.freeswan.ca/code/super-freeswan"> Super
- FreeS/WAN</A> now features this patch.
-<!--
-<A HREF="http://www.freeswan.ca/patches/aggressivemode">Steve Harvey's 
-aggressive mode patch for FreeS/WAN 1.5</A>
--->
-</LI>
-<LI></LI>
-<LI>A Linux FreeS/WAN-Checkpoint connection may close after some time.
- Try<A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00293.html">
- this tip</A> toward a workaround.</LI>
-</UL>
-<P><A HREF="http://www.fw-1.de/aerasec/ng/vpn-freeswan/CPNG+Linux-FreeSWAN.html">
- AERAsec's Firewall-1 NG site (PSK, X.509, Road Warrior with X.509,
- other algorithms)</A>
-<BR> &nbsp;&nbsp;&nbsp;&nbsp;<A HREF="http://www.fw-1.de/aerasec/ng/vpn-freeswan/CPNG+Linux-FreeSWAN.html#support-matrix">
- AERAsec's detailed Check Point-FreeS/WAN support matrix</A>
-<BR><A HREF="http://support.checkpoint.com/kb/docs/public/firewall1/4_1/pdf/fw-linuxvpn.pdf">
- Checkpoint.com PDF: Linux as a VPN Client to FW-1 (PSK)</A>
-<BR><A HREF="http://www.phoneboy.com"> PhoneBoy's Check Point FAQ (on
- Check Point only, not FreeS/WAN)</A>
-<BR></P>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2001-August/002351.html">
- Chris Harwell's tips FreeS/WAN configs (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-April/009362.html">
- Daniel Tombeil's configs (PSK)</A></P>
-<P><A HREF="#checkpoint.top">Back to chart</A></P>
-<H4><A NAME="cisco">Cisco</A></H4>
-<UL>
-<LI> Cisco supports IPsec-over-UDP NAT traversal.</LI>
-<LI>Cisco VPN Client appears to use nonstandard IPsec and does not work
- with FreeS/WAN.<A HREF="https://mj2.freeswan.org/archives/2003-August/maillist.html">
- This message</A> concerns Cisco VPN Client 4.01.
-<!-- fix link -->
-</LI>
-<LI>A Linux FreeS/WAN-Cisco connection may close after some time.<A HREF="http://lists.freeswan.org/pipermail/users/2001-December/005758.html">
- Here</A> is a workaround, and<A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00293.html">
- here</A> is another comment on the same subject.</LI>
-<LI><A HREF="http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120t/120t2/3desips.htm">
-Older Ciscos</A> purchased outside the United States may not have 3DES,
- which FreeS/WAN requires.</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2001-June/000406.html">
-RSA keying may not be possible between Cisco and FreeS/WAN.</A></LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2001-October/004357.html">
-In ipsec.conf, VPN3000 DN (distinguished name) must be in binary (X.509
- only)</A></LI>
-</UL>
-<P><A HREF="http://rr.sans.org/encryption/cisco_router.php"> SANS
- Institute HOWTO (PSK).</A> Detailed, with extensive references.
-<BR><A HREF="http://www.worldbank.ro/IPSEC/cisco-linux.txt"> Short HOWTO
- (PSK)</A>
-<BR><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
- French page with configs for Cisco IOS, PIX and VPN 3000 (X.509)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2001-August/002966.html">
- Dave McFerren's sample configs (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2001-September/003422.html">
- Wolfgang Tremmel's sample configs (PSK road warrior)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00578.html">
- Old doc from Pete Davis, with William Watson's updated Tips (PSK)</A>
-<BR></P>
-<P><STRONG>Some PIX specific information:</STRONG>
-<BR><A HREF="http://www.wlug.org.nz/FreeSwanToCiscoPix"> Waikato Linux
- Users' Group HOWTO. Nice detail (PSK)</A>
-<BR><A HREF="http://www.johnleach.co.uk/documents/freeswan-pix/freeswan-pix.html">
- John Leach's configs (PSK)</A>
-<BR><A HREF="http://www.diverdown.cc/vpn/freeswanpix.html"> Greg
- Robinson's settings (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-February/007901.html">
- Scott's ipsec.conf for PIX (PSK, FreeS/WAN side only)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2001-October/003949.html">
- Rick Trimble's PIX and FreeS/WAN settings (PSK)</A>
-<BR></P>
-<P><A href="http://www.cisco.com/public/support/tac"> Cisco VPN support
- page</A>
-<BR><A href="http://www.ieng.com/warp/public/707/index.shtml#ipsec">
- Cisco IPsec information page</A></P>
-<P><A HREF="#cisco.top">Back to chart</A></P>
-<H4><A NAME="equinux">Equinux VPN tracker (for Mac OS X)</A></H4>
-<UL>
-<LI>Graphical configurator for Mac OS X IPsec. May be an interface to
- the<A HREF="#apple"> native Mac OS X IPsec</A>, which is essentially<A HREF="#kame">
- KAME</A>.</LI>
-<LI>To use Appletalk over IPsec tunnels,<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005116.html">
- run it over TCP/IP</A>, or use Open Door Networks' Shareway IP tool,<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005426.html">
- described here.</A></LI>
-</UL>
-<P> Equinux provides<A HREF="http://www.equinux.com/download/HowTo_FreeSWAN.pdf">
- this excellent interop PDF</A> (PSK, RSA, X.509).</P>
-<P><A HREF="#equinux.top">Back to chart</A></P>
-<H4><A NAME="fsecure">F-Secure</A></H4>
-<UL>
-<LI>
-<!-- <A HREF="http://lists.freeswan.org/pipermail/users/2002-February/007596.html"> -->
- F-Secure supports IPsec-over-UDP NAT traversal.</LI>
-</UL>
-<P><A HREF="http://www.pingworks.de/tech/vpn/vpn.txt">pingworks.de's
- &quot;Connecting F-Secure's VPN+ to Linux FreeS/WAN&quot; (PSK road warrior)</A>
-<BR> &nbsp;&nbsp;&nbsp;&nbsp;<A HREF="http://www.pingworks.de/tech/vpn/vpn.pdf">Same thing
- as PDF</A>
-<BR><A HREF="http://www.exim.org/pipermail/linux-ipsec/Week-of-Mon-20010122/000061.html">
- Success report, no detail (PSK)</A>
-<BR><A HREF="http://www.exim.org/pipermail/linux-ipsec/Week-of-Mon-20010122/000041.html">
- Success report, no detail (Manual)</A></P>
-
-<!-- Other NAT traversers:
-http://lists.freeswan.org/pipermail/users/2002-April/009136.html
-and ssh sentinel:
-http://lists.freeswan.org/pipermail/users/2001-September/003108.html
--->
-<P><A HREF="#fsecure.top">Back to chart</A></P>
-<H4><A NAME="gauntlet">Gauntlet GVPN</A></H4>
-<P><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00535.html">
- Richard Reiner's ipsec.conf (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-June/011434.html">
- Might work without that pesky firewall... (PSK)</A>
-<BR>
-<!-- insert archive link -->
- In late July, 2003 Alexandar Antik reported success interoperating
- with Gauntlet 6.0 for Solaris (X.509). Unfortunately the message is not
- properly archived at this time.</P>
-<P><A HREF="#gauntlet.top">Back to chart</A></P>
-<H4><A NAME="aix">IBM AIX</A></H4>
-<P><A HREF="http://www-1.ibm.com/servers/esdd/articles/security.html">
- IBM's &quot;Built-In Network Security with AIX&quot; (PSK, X.509)</A>
-<BR><A HREF="http://www-1.ibm.com/servers/aix/products/ibmsw/security/vpn/faqandtips/#ques20">
- IBM's tip: importing Linux FreeS/WAN settings into AIX's<VAR> ikedb</VAR>
- (PSK)</A></P>
-<P><A HREF="#aix.top">Back to chart</A></P>
-<H4><A NAME="as400">IBM AS/400</A></H4>
-<UL>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-April/009106.html">
- Road Warriors may act flaky</A>.</LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-September/014264.html">
- Richard Welty's tips and tricks</A>
-<BR></P>
-<P><A HREF="#as400.top">Back to chart</A></P>
-<H4><A NAME="intel">Intel Shiva LANRover / Net Structure</A></H4>
-<UL>
-<LI>Intel Shiva LANRover is now known as Intel Net Structure.</LI>
-<LI><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/01/msg00298.html">
- Shiva seems to have two modes: IPsec or the proprietary &quot;Shiva Tunnel&quot;.</A>
- Of course, FreeS/WAN will only create IPsec tunnels.</LI>
-<LI><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00293.html">
- AH may not work for Shiva-FreeS/WAN.</A> That's OK, since FreeS/WAN has
- phased out the use of AH.</LI>
-</UL>
-<P><A HREF="http://snowcrash.tdyc.com/freeswan/"> Snowcrash's configs
- (PSK)</A>
-<BR><A HREF="http://www.opus1.com/vpn/index.html"> Old configs from an
- interop (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2001-October/003831.html">
- The day Shiva tickled a Pluto bug (PSK)</A>
-<BR> &nbsp;&nbsp;&nbsp;&nbsp;<A HREF="http://lists.freeswan.org/pipermail/users/2001-October/004270.html">
- Follow up: success!</A></P>
-<P><A HREF="#intel.top">Back to chart</A></P>
-<H4><A NAME="lancom">LanCom (formerly ELSA)</A></H4>
-<UL>
-<LI>This router is popular in Germany.</LI>
-</UL>
-<P> Jakob Curdes successfully created a PSK connection with the LanCom
- 1612 in August 2003.
-<!-- add ML link when it appears -->
-</P>
-<P><A HREF="#lancom.top">Back to chart</A></P>
-<H4><A NAME="linksys">Linksys</A></H4>
-<UL>
-<LI>Linksys may be used as an IPsec tunnel endpoint,<STRONG> OR</STRONG>
- as a router in &quot;IPsec passthrough&quot; mode, so that the IPsec tunnel
- passes through the Linksys.</LI>
-</UL>
-<H5>As tunnel endpoint</H5>
-<P><A HREF="http://www.freeswan.ca/docs/BEFVP41/"> Ken Bantoft's
- instructions (Road Warrior with PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-February/007814.html">
- Nate Carlson's caveats</A></P>
-<H5>In IPsec passthrough mode</H5>
-<P><A HREF="http://www-ec.njit.edu/~rxt1077/Howto.txt"> Sample HOWTO
- through a Linksys Router</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2002/02/msg00114.html">
- Nadeem Hasan's configs</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2002/02/msg00180.html">
- Brock Nanson's tips</A>
-<BR></P>
-<P><A HREF="#linksys.top">Back to chart</A></P>
-<H4><A NAME="lucent">Lucent</A></H4>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010976.html">
- Partial success report; see also the next message in thread</A></P>
-
-<!-- section done -->
-<P><A HREF="#lucent.top">Back to chart</A></P>
-<H4><A NAME="netasq">Netasq</A></H4>
-<P><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
- French page with configs (X.509)</A></P>
-
-<!-- section done -->
-<P><A HREF="#netasq.top">Back to chart</A></P>
-<H4><A NAME="netcelo">Netcelo</A></H4>
-<P><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
- French page with configs (X.509)</A>
-<!-- section done -->
-</P>
-<P><A HREF="#netcelo.top">Back to chart</A></P>
-<H4><A NAME="netgear">Netgear fvs318</A></H4>
-<UL>
-<LI>With a recent Linux FreeS/WAN, you will require the latest (12/2002)
- Netgear firmware, which supports Diffie-Hellman (DH) group 2. For
- security reasons, we phased out DH 1 after Linux FreeS/WAN 1.5.</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-June/011833.html">
- This message</A> reports the incompatibility between Linux FreeS/WAN
- 1.6+ and Netgear fvs318 without the firmware upgrade.</LI>
-<LI>We believe Linux FreeS/WAN 1.5 and earlier will interoperate with
- any NetGear firmware.</LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2003-February/017891.html">
- John Morris' setup (PSK)</A></P>
-<P><A HREF="#netgear.top">Back to chart</A></P>
-<H4><A NAME="netscreen">Netscreen 100 or 5xp</A></H4>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-August/013409.html">
- Errol Neal's settings (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-October/015265.html">
- Corey Rogers' configs (PSK, no PFS)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-August/013051.html">
- Jordan Share's configs (PSK, 2 subnets, through static NAT)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/08/msg00404.html">
- Set src proxy_id to your protected subnet/mask</A>
-<BR><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
- French page with ipsec.conf, Netscreen screen shots (X.509, may need to
- revert to PSK...)</A></P>
-<P><A HREF="http://archives.neohapsis.com/archives/sf/linux/2001-q2/0123.html">
- A report of a company using Netscreen with FreeS/WAN on a large scale
- (FreeS/WAN road warriors?)</A></P>
-<P><A HREF="#netscreen.top">Back to chart</A></P>
-<H4><A NAME="nortel">Nortel Contivity</A></H4>
-<UL>
-<LI> Nortel supports IPsec-over-UDP NAT traversal.</LI>
-<LI><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00417.html">
- Some older versions of Contivity and FreeS/WAN will not communicate.</A>
-</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010924.html">
- FreeS/WAN cannot be used as a &quot;client&quot; to a Nortel Contivity server,
- but can be used as a branch-office tunnel.</A></LI>
-
-<!--  Probably obsoleted by Ken's post
-<LI>
-(Matthias siebler from old interop)
-At one point you could not configure Nortel-FreeS/WAN tunnels as 
-"Client Tunnels" since FreeS/WAN does not support Aggressive Mode.
-Current status of this problem: unknown.
-<LI>
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/004612.html">
-How do we map group and user passwords onto the data that FreeS/WAN wants?
-</A>
-</LI>
--->
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-October/015455.html">
- Contivity does not send Distinguished Names in the order FS wants them
- (X.509).</A></LI>
-<LI><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/03/msg00137.html">
- Connections may time out after 30-40 minutes idle.</A></LI>
-</UL>
-<P><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/03/msg00137.html">
- JJ Streicher-Bremer's mini HOWTO for old new software. (PSK with two
- subnets)</A>
-<BR><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
- French page with configs (X.509)</A>. This succeeds using the above
- X.509 tip.</P>
-
-<!-- I could do more searching but this is a solid start. -->
-<P><A HREF="#nortel.top">Back to chart</A></P>
-<H4><A NAME="radguard">Radguard</A></H4>
-<P><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/05/msg00009.html">
- Marko Hausalo's configs (PSK).</A> Note: These do create a connection,
- as you can see by &quot;IPsec SA established&quot;.
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-October/???.html">
- Claudia Schmeing's comments</A></P>
-<P><A HREF="#radguard.top">Back to chart</A></P>
-<H4><A NAME="raptor">Raptor (NT or Solaris)</A></H4>
-<P></P>
-<UL>
-<LI>Now known as Symantec Enterprise Firewall.</LI>
-<LI>The Raptor does not normally come with X.509, but this may be
- available as an add-on.</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010256.html">
- Raptor requires alphanumberic PSK values, whereas FreeS/WAN uses hex.</A>
-</LI>
-<LI>Raptor's tunnel endpoint may be a host, subnet or group of subnets
- (see<A HREF="http://lists.freeswan.org/pipermail/design/2001-November/001295.html">
- this message</A> ). FreeS/WAN cannot handle the group of subnets; you
- must create separate connections for each in order to interoperate.</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010113.html">
- Some versions of Raptor accept only single DES.</A> According to this
- German message,<A HREF="http://radawana.cg.tuwien.ac.at/mail-archives/lll/200012/msg00065.html">
- the Raptor Mobile Client demo offers single DES only.</A></LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-January/006935.html">
- Peter Mazinger's settings (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005522.html">
- Peter Gerland's configs (PSK)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/07/msg00597.html">
- Charles Griebel's configs (PSK).</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-July/012275.html">
- Lumir Srch's tips (PSK)</A></P>
-<P><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/05/msg00214.html">
- John Hardy's configs (Manual)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/01/msg00236.html">
- Older Raptors want 3DES keys in 3 parts (Manual).</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/06/msg00480.html">
- Different keys for each direction? (Manual)</A>
-<BR></P>
-<P><A HREF="#raptor.top">Back to chart</A></P>
-<H4><A NAME="redcreek">Redcreek Ravlin</A></H4>
-<UL>
-<LI>Known issue #1: The Ravlin expects a quick mode renegotiation right
- after every Main Mode negotiation.</LI>
-<LI> Known issue #2: The Ravlin tries to negotiate a zero connection
- lifetime, which it takes to mean &quot;infinite&quot;.<A HREF="http://www.bear-cave.org.uk/linux/ravlin/">
- Jim Hague's patch</A> addresses both issues.</LI>
-<LI><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/03/msg00191.html">
- Interop works with Ravlin Firmware &gt; 3.33. Includes tips (PSK).</A></LI>
-</UL>
-<P><A HREF="#redcreek.top">Back to chart</A></P>
-<H4><A NAME="sonicwall">SonicWall</A></H4>
-<UL>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2001-June/000998.html">
- Sonicwall cannot be used for Road Warrior setups</A></LI>
-<LI> At one point,<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/05/msg00217.html">
- only Sonicwall PRO supported triple DES</A>.</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-March/008600.html">
- Older Sonicwalls (before Nov 2001) feature Diffie Hellman group 1 only</A>
-.</LI>
-</UL>
-<P><A HREF="http://www.xinit.cx/docs/freeswan.html"> Paul Wouters'
- config (PSK)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00073.html">
- Dilan Arumainathan's configuration (PSK)</A>
-<BR><A HREF="http://www.gravitas.co.uk/vpndebug"> Dariush's setup...
- only opens one way (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2003-July/022302.html">
- Andreas Steffen's tips (X.509)</A>
-<BR></P>
-<P><A HREF="#sonicwall.top">Back to chart</A></P>
-<H4><A NAME="sun">Sun Solaris</A></H4>
-<UL>
-<LI> Solaris 8+ has a native (in kernel) IPsec implementation.</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010503.html">
- Solaris does not seem to support tunnel mode, but you can make IP-in-IP
- tunnels instead, like this.</A></LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2003-June/022216.html">
- Reports of some successful interops</A> from a fellow @sun.com. See
- also<A HREF="http://lists.freeswan.org/pipermail/users/2003-July/022247.html">
- these follow up posts</A>.
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/03/msg00332.html">
- Aleks Shenkman's configs (Manual in transport mode)</A>
-<BR>
-<!--sparc 64 stuff goes where?-->
-</P>
-<P><A HREF="#solaris.top">Back to chart</A></P>
-<H4><A NAME="symantec">Symantec</A></H4>
-<UL>
-<LI>The Raptor, covered<A HREF="#raptor"> above</A>, is now known as
- Symantec Enterprise Firewall.</LI>
-<LI>Symantec's &quot;distinguished name&quot; is a KEY_ID. See Andreas Steffen's
- post, below.</LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-April/009037.html">
- Andreas Steffen's configs for Symantec 200R (PSK)</A></P>
-<P><A HREF="#symantec.top">Back to chart</A></P>
-<H4><A NAME="watchguard">Watchguard Firebox</A></H4>
-<UL>
-<LI>Automatic keying works with WatchGuard 5.0+ only.</LI>
-<LI>Seen to interoperate with WatchGuard 1000, II, III; firmware v. 5,
- 6..</LI>
-<LI>For manual keying, Watchguard's Policy Manager expects SPI numbers
- and encryption and authentication keys in decimal (not hex).</LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-July/012595.html">
- WatchGuard's HOWTO (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-August/013342.html">
- Ronald C. Riviera's Settings (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00179.html">
- Walter Wickersham's Notes (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-October/015587.html">
- Max Enders' Configs (Manual)</A></P>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-April/009404.html">
- Old known issue with auto keying</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00124.html">
- Tips on key generation and format (Manual)</A>
-<BR></P>
-<P><A HREF="#watchguard.top">Back to chart</A></P>
-<H4><A NAME="xedia">Xedia Access Point/QVPN</A></H4>
-<P><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/12/msg00520.html">
- Hybrid IPsec/L2TP connection settings (X.509)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/ipsec/1999/08/msg00140.html">
- Xedia's LAN-LAN links don't use multiple tunnels</A>
-<BR> &nbsp;&nbsp;&nbsp;&nbsp;<A HREF="http://www.sandelman.ottawa.on.ca/ipsec/1999/08/msg00140.html">
- That explanation, continued</A></P>
-<P><A HREF="#xedia.top">Back to chart</A></P>
-<H4><A NAME="zyxel">Zyxel</A></H4>
-<UL>
-<LI>The Zyxel Zywall is a rebranded SSH Sentinel box. See also our
- section on<A HREF="#ssh"> SSH</A>.</LI>
-<LI>There seems to be a problem with keeping this connection alive. This
- is caused at the Zyxel end. See this brief<A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00141.html">
- discussion and solution.</A></LI>
-</UL>
-<P><A HREF="http://www.zyxel.com/support/supportnote/zywall/app/zw_freeswan.htm">
- Zyxel's Zywall to FreeS/WAN instructions (PSK)</A>
-<BR><A HREF="http://www.zyxel.com/support/supportnote/p652/app/zw_freeswan.htm">
- Zyxel's Prestige to FreeS/WAN instructions (PSK)</A>. Note: not all
- Prestige versions include VPN software.
-<BR><A HREF="http://www.lancry.net/techdocs/freeswan-zyxel.txt"> Fabrice
- Cahen's HOWTO (PSK)</A>
-<BR> &nbsp;&nbsp;&nbsp;&nbsp;</P>
-<P><A HREF="#zyxel.top">Back to chart</A></P>
-
-<!-- SAMPLE ENTRY
-
-<H4><A NAME="timestep">Timestep</A></H4>
-
-<P>Text goes here.
-</P>
-
--->
-<HR>
-<H1><A name="performance">Performance of FreeS/WAN</A></H1>
- The performance of FreeS/WAN is adequate for most applications.
-<P>In normal operation, the main concern is the overhead for encryption,
- decryption and authentication of the actual IPsec (<A href="#ESP">ESP</A>
- and/or<A href="#AH"> AH</A>) data packets. Tunnel setup and rekeying
- occur so much less frequently than packet processing that, in general,
- their overheads are not worth worrying about.</P>
-<P>At startup, however, tunnel setup overheads may be significant. If
- you reboot a gateway and it needs to establish many tunnels, expect
- some delay. This and other issues for large gateways are discussed<A href="#biggate">
- below</A>.</P>
-<H2><A name="pub.bench">Published material</A></H2>
-<P>The University of Wales at Aberystwyth has done quite detailed speed
- tests and put<A href="http://tsc.llwybr.org.uk/public/reports/SWANTIME/">
- their results</A> on the web.</P>
-<P>Davide Cerri's<A href="http://www.linux.it/~davide/doc/"> thesis (in
- Italian)</A> includes performance results for FreeS/WAN and for<A href="#TLS">
- TLS</A>. He posted an<A href="http://lists.freeswan.org/pipermail/users/2001-December/006303.html">
- English summary</A> on the mailing list.</P>
-<P>Steve Bellovin used one of AT&amp;T Research's FreeS/WAN gateways as his
- data source for an analysis of the cache sizes required for key
- swapping in IPsec. Available as<A href="http://www.research.att.com/~smb/talks/key-agility.email.txt">
- text</A> or<A href="http://www.research.att.com/~smb/talks/key-agility.pdf">
- PDF slides</A> for a talk on the topic.</P>
-<P>See also the NAI work mentioned in the next section.</P>
-<H2><A name="perf.estimate">Estimating CPU overheads</A></H2>
-<P>We can come up with a formula that roughly relates CPU speed to the
- rate of IPsec processing possible. It is far from exact, but should be
- usable as a first approximation.</P>
-<P>An analysis of authentication overheads for high-speed networks,
- including some tests using FreeS/WAN, is on the<A href="http://www.pgp.com/research/nailabs/cryptographic/adaptive-cryptographic.asp">
- NAI Labs site</A>. In particular, see figure 3 in this<A href="http://download.nai.com/products/media/pgp/pdf/acsa_final_report.pdf">
- PDF document</A>. Their estimates of overheads, measured in Pentium II
- cycles per byte processed are:</P>
-<TABLE align="center" border="1"><TBODY></TBODY>
-<TR><TH></TH><TH>IPsec</TH><TH>authentication</TH><TH>encryption</TH><TH>
-cycles/byte</TH></TR>
-<TR><TD>Linux IP stack alone</TD><TD>no</TD><TD>no</TD><TD>no</TD><TD align="right">
-5</TD></TR>
-<TR><TD>IPsec without crypto</TD><TD>yes</TD><TD>no</TD><TD>no</TD><TD align="right">
-11</TD></TR>
-<TR><TD>IPsec, authentication only</TD><TD>yes</TD><TD>SHA-1</TD><TD>no</TD><TD
-align="right">24</TD></TR>
-<TR><TD>IPsec with encryption</TD><TD>yes</TD><TD>yes</TD><TD>yes</TD><TD
-align="right">not tested</TD></TR>
-</TABLE>
-<P>Overheads for IPsec with encryption were not tested in the NAI work,
- but Antoon Bosselaers'<A href="http://www.esat.kuleuven.ac.be/~bosselae/fast.html">
- web page</A> gives cost for his optimised Triple DES implementation as
- 928 Pentium cycles per block, or 116 per byte. Adding that to the 24
- above, we get 140 cycles per byte for IPsec with encryption.</P>
-<P>At 140 cycles per byte, a 140 MHz machine can handle a megabyte -- 8
- megabits -- per second. Speeds for other machines will be proportional
- to this. To saturate a link with capacity C megabits per second, you
- need a machine running at<VAR> C * 140/8 = C * 17.5</VAR> MHz.</P>
-<P>However, that estimate is not precise. It ignores the differences
- between:</P>
-<UL>
-<LI>NAI's test packets and real traffic</LI>
-<LI>NAI's Pentium II cycles, Bosselaers' Pentium cycles, and your
- machine's cycles</LI>
-<LI>different 3DES implementations</LI>
-<LI>SHA-1 and MD5</LI>
-</UL>
-<P>and does not account for some overheads you will almost certainly
- have:</P>
-<UL>
-<LI>communication on the client-side interface</LI>
-<LI>switching between multiple tunnels -- re-keying, cache reloading and
- so on</LI>
-</UL>
-<P>so we suggest using<VAR> C * 25</VAR> to get an estimate with a bit
- of a built-in safety factor.</P>
-<P>This covers only IP and IPsec processing. If you have other loads on
- your gateway -- for example if it is also working as a firewall -- then
- you will need to add your own safety factor atop that.</P>
-<P>This estimate matches empirical data reasonably well. For example,
- Metheringham's tests, described<A href="#klips.bench"> below</A>, show
- a 733 topping out between 32 and 36 Mbit/second, pushing data as fast
- as it can down a 100 Mbit link. Our formula suggests you need at least
- an 800 to handle a fully loaded 32 Mbit link. The two results are
- consistent.</P>
-<P>Some examples using this estimation method:</P>
-<TABLE align="center" border="1"><TBODY></TBODY>
-<TR><TH colspan="2">Interface</TH><TH colspan="3">Machine speed in MHz</TH>
-</TR>
-<TR><TH>Type</TH><TH>Mbit per
-<BR> second</TH><TH>Estimate
-<BR> Mbit*25</TH><TH>Minimum IPSEC gateway</TH><TH>Minimum with other
- load
-<P>(e.g. firewall)</P>
-</TH></TR>
-<TR><TD>DSL</TD><TD align="right">1</TD><TD align="right">25 MHz</TD><TD rowspan="2">
-whatever you have</TD><TD rowspan="2">133, or better if you have it</TD></TR>
-<TR><TD>cable modem</TD><TD align="right">3</TD><TD align="right">75 MHz</TD>
-</TR>
-<TR><TD><STRONG>any link, light load</STRONG></TD><TD align="right"><STRONG>
-5</STRONG></TD><TD align="right">125 MHz</TD><TD>133</TD><TD>200+,<STRONG>
- almost any surplus machine</STRONG></TD></TR>
-<TR><TD>Ethernet</TD><TD align="right">10</TD><TD align="right">250 MHz</TD><TD>
-surplus 266 or 300</TD><TD>500+</TD></TR>
-<TR><TD><STRONG>fast link, moderate load</STRONG></TD><TD align="right"><STRONG>
-20</STRONG></TD><TD align="right">500 MHz</TD><TD>500</TD><TD>800+,<STRONG>
- any current off-the-shelf PC</STRONG></TD></TR>
-<TR><TD>T3 or E3</TD><TD align="right">45</TD><TD align="right">1125 MHz</TD><TD>
-1200</TD><TD>1500+</TD></TR>
-<TR><TD>fast Ethernet</TD><TD align="right">100</TD><TD align="right">
-2500 MHz</TD><TD align="center" colspan="2" rowspan="2">// not feasible
- with 3DES in software on current machines //</TD></TR>
-<TR><TD>OC3</TD><TD align="right">155</TD><TD align="right">3875 MHz</TD>
-</TR>
-</TABLE>
-<P>Such an estimate is far from exact, but should be usable as minimum
- requirement for planning. The key observations are:</P>
-<UL>
-<LI>older<STRONG> surplus machines</STRONG> are fine for IPsec gateways
- at loads up to<STRONG> 5 megabits per second</STRONG> or so</LI>
-<LI>a<STRONG> mid-range new machine</STRONG> can handle IPsec at rates
- up to<STRONG> 20 megabits per second</STRONG> or more</LI>
-</UL>
-<H3><A name="perf.more">Higher performance alternatives</A></H3>
-<P><A href="#AES">AES</A> is a new US government block cipher standard,
- designed to replace the obsolete<A href="#DES"> DES</A>. If FreeS/WAN
- using<A href="#3DES"> 3DES</A> is not fast enough for your application,
- the AES<A href="#patch"> patch</A> may help.</P>
-<P>To date (March 2002) we have had only one<A href="http://lists.freeswan.org/pipermail/users/2002-February/007771.html">
- mailing list report</A> of measurements with the patch applied. It
- indicates that, at least for the tested load on that user's network,<STRONG>
- AES roughly doubles IPsec throughput</STRONG>. If further testing
- confirms this, it may prove possible to saturate an OC3 link in
- software on a high-end box.</P>
-<P>Also, some work is being done toward support of<A href="#hardware">
- hardware IPsec acceleration</A> which might extend the range of
- requirements FreeS/WAN could meet.</P>
-<H3><A NAME="11_2_2">Other considerations</A></H3>
-<P>CPU speed may be the main issue for IPsec performance, but of course
- it isn't the only one.</P>
-<P>You need good ethernet cards or other network interface hardware to
- get the best performance. See this<A href="http://www.ethermanage.com/ethernet/ethernet.html">
- ethernet information</A> page and this<A href="http://www.scyld.com/diag">
- Linux network driver</A> page.</P>
-<P>The current FreeS/WAN kernel code is largely single-threaded. It is
- SMP safe, and will run just fine on a multiprocessor machine (<A href="#multiprocessor">
-discussion</A>), but the load within the kernel is not shared
- effectively. This means that, for example to saturate a T3 -- which
- needs about a 1200 MHz machine -- you cannot expect something like a
- dual 800 to do the job.</P>
-<P>On the other hand, SMP machines do tend to share loads well so --
- provided one CPU is fast enough for the IPsec work -- a multiprocessor
- machine may be ideal for a gateway with a mixed load.</P>
-<H2><A name="biggate">Many tunnels from a single gateway</A></H2>
-<P>FreeS/WAN allows a single gateway machine to build tunnels to many
- others. There may, however, be some problems for large numbers as
- indicated in this message from the mailing list:</P>
-<PRE>Subject: Re: Maximum number of ipsec tunnels?
-   Date: Tue, 18 Apr 2000
-   From: &quot;John S. Denker&quot; &lt;jsd@research.att.com&gt;
-
-Christopher Ferris wrote:
-
-&gt;&gt; What are the maximum number ipsec tunnels FreeS/WAN can handle??
-
-Henry Spencer wrote:
-
-&gt;There is no particular limit.  Some of the setup procedures currently
-&gt;scale poorly to large numbers of connections, but there are (clumsy)
-&gt;workarounds for that now, and proper fixes are coming.
-
-1) &quot;Large&quot; numbers means anything over 50 or so.  I routinely run boxes
-with about 200 tunnels.  Once you get more than 50 or so, you need to worry
-about several scalability issues:
-
-a) You need to put a &quot;-&quot; sign in syslogd.conf, and rotate the logs daily
-not weekly.
-
-b) Processor load per tunnel is small unless the tunnel is not up, in which
-case a new half-key gets generated every 90 seconds, which can add up if
-you've got a lot of down tunnels.
-
-c) There's other bits of lore you need when running a large number of
-tunnels.  For instance, systematically keeping the .conf file free of
-conflicts requires tools that aren't shipped with the standard freeswan
-package.
-
-d) The pluto startup behavior is quadratic.  With 200 tunnels, this eats up
-several minutes at every restart.   I'm told fixes are coming soon.
-
-2) Other than item (1b), the CPU load depends mainly on the size of the
-pipe attached, not on the number of tunnels.
-</PRE>
-<P>It is worth noting that item (1b) applies only to repeated attempts
- to re-key a data connection (IPsec SA, Phase 2) over an established
- keying connection (ISAKMP SA, Phase 1). There are two ways to reduce
- this overhead using settings in<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A>:</P>
-<UL>
-<LI>set<VAR> keyingtries</VAR> to some small value to limit repetitions</LI>
-<LI>set<VAR> keylife</VAR> to a short time so that a failing data
- connection will be cleaned up when the keying connection is reset.</LI>
-</UL>
-<P>The overheads for establishing keying connections (ISAKMP SAs, Phase
- 1) are lower because for these Pluto does not perform expensive
- operations before receiving a reply from the peer.</P>
-<P>A gateway that does a lot of rekeying -- many tunnels and/or low
- settings for tunnel lifetimes -- will also need a lot of<A href="#random">
- random numbers</A> from the random(4) driver.</P>
-<H2><A name="low-end">Low-end systems</A></H2>
-<P><EM>Even a 486 can handle a T1 line</EM>, according to this mailing
- list message:</P>
-<PRE>Subject: Re: linux-ipsec: IPSec Masquerade
-   Date: Fri, 15 Jan 1999 11:13:22 -0500
-   From: Michael Richardson 
-
-. . . A 486/66 has been clocked by Phil Karn to do
-10Mb/s encryption.. that uses all the CPU, so half that to get some CPU,
-and you have 5Mb/s. 1/3 that for 3DES and you get 1.6Mb/s....</PRE>
-<P>and a piece of mail from project technical lead Henry Spencer:</P>
-<PRE>Oh yes, and a new timing point for Sandy's docs...  A P60 -- yes, a 60MHz
-Pentium, talk about antiques -- running a host-to-host tunnel to another
-machine shows an FTP throughput (that is, end-to-end results with a real
-protocol) of slightly over 5Mbit/s either way.  (The other machine is much
-faster, the network is 100Mbps, and the ether cards are good ones... so
-the P60 is pretty definitely the bottleneck.)</PRE>
-<P>From the above, and from general user experience as reported on the
- list, it seems clear that a cheap surplus machine -- a reasonable 486,
- a minimal Pentium box, a Sparc 5, ... -- can easily handle a home
- office or a small company connection using any of:</P>
-<UL>
-<LI>ADSL service</LI>
-<LI>cable modem</LI>
-<LI>T1</LI>
-<LI>E1</LI>
-</UL>
-<P>If available, we suggest using a Pentium 133 or better. This should
- ensure that, even under maximum load, IPsec will use less than half the
- CPU cycles. You then have enough left for other things you may want on
- your gateway -- firewalling, web caching, DNS and such.</P>
-<H2><A name="klips.bench">Measuring KLIPS</A></H2>
-<P>Here is some additional data from the mailing list.</P>
-<PRE>Subject: FreeSWAN (specically KLIPS) performance measurements
-   Date: Thu, 01 Feb 2001
-   From: Nigel Metheringham &lt;Nigel.Metheringham@intechnology.co.uk&gt;
-
-I've spent a happy morning attempting performance tests against KLIPS 
-(this is due to me not being able to work out the CPU usage of KLIPS so 
-resorting to the crude measurements of maximum throughput to give a 
-baseline to work out loading of a box).
-
-Measurements were done using a set of 4 boxes arranged in a line, each 
-connected to the next by 100Mbit duplex ethernet.  The inner 2 had an 
-ipsec tunnel between them (shared secret, but I was doing measurements 
-when the tunnel was up and running - keying should not be an issue 
-here).  The outer pair of boxes were traffic generators or traffic sink.
-
-The crypt boxes are Compaq DL380s - Uniprocessor PIII/733 with 256K 
-cache.  They have 128M main memory.  Nothing significant was running on 
-the boxes other than freeswan.  The kernel was a 2.2.19pre7 patched 
-with freeswan and ext3.
-
-Without an ipsec tunnel in the chain (ie the 2 inner boxes just being 
-100BaseT routers), throughput (measured with ttcp) was between 10644 
-and 11320 KB/sec
-
-With an ipsec tunnel in place, throughput was between 3268 and 3402 
-KB/sec
-
-These measurements are for data pushed across a TCP link, so the 
-traffic on the wire between the 2 ipsec boxes would have been higher 
-than this....
-
-vmstat (run during some other tests, so not affecting those figures) on 
-the encrypting box shows approx 50% system &amp; 50% idle CPU - which I 
-don't believe at all.  Interactive feel of the box was significantly 
-sluggish.
-
-I also tried running the kernel profiler (see man readprofile) during 
-test runs.
-
-A box doing primarily decrypt work showed basically nothing happening - 
-I assume interrupts were off.
-A box doing encrypt work showed the following:-
- Ticks Function                                   Load
- ~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~    ~~~~~~
-   956 total                                      0.0010
-   532 des_encrypt2                               0.1330
-   110 MD5Transform                               0.0443
-    97 kmalloc                                    0.1880
-    39 des_encrypt3                               0.1336
-    23 speedo_interrupt                           0.0298
-    14 skb_copy_expand                            0.0250
-    13 ipsec_tunnel_start_xmit                    0.0009
-    13 Decode                                     0.1625
-    11 handle_IRQ_event                           0.1019
-    11 .des_ncbc_encrypt_end                      0.0229
-    10 speedo_start_xmit                          0.0188
-     9 satoa                                      0.0225
-     8 kfree                                      0.0118
-     8 ip_fragment                                0.0121
-     7 ultoa                                      0.0365
-     5 speedo_rx                                  0.0071
-     5 .des_encrypt2_end                          5.0000
-     4 _stext                                     0.0140
-     4 ip_fw_check                                0.0035
-     2 rj_match                                   0.0034
-     2 ipfw_output_check                          0.0200
-     2 inet_addr_type                             0.0156
-     2 eth_copy_and_sum                           0.0139
-     2 dev_get                                    0.0294
-     2 addrtoa                                    0.0143
-     1 speedo_tx_buffer_gc                        0.0024
-     1 speedo_refill_rx_buf                       0.0022
-     1 restore_all                                0.0667
-     1 number                                     0.0020
-     1 net_bh                                     0.0021
-     1 neigh_connected_output                     0.0076
-     1 MD5Final                                   0.0083
-     1 kmem_cache_free                            0.0016
-     1 kmem_cache_alloc                           0.0022
-     1 __kfree_skb                                0.0060
-     1 ipsec_rcv                                  0.0001
-     1 ip_rcv                                     0.0014
-     1 ip_options_fragment                        0.0071
-     1 ip_local_deliver                           0.0023
-     1 ipfw_forward_check                         0.0139
-     1 ip_forward                                 0.0011
-     1 eth_header                                 0.0040
-     1 .des_encrypt3_end                          0.0833
-     1 des_decrypt3                               0.0034
-     1 csum_partial_copy_generic                  0.0045
-     1 call_out_firewall                          0.0125
-
-Hope this data is helpful to someone... however the lack of visibility 
-into the decrypt side makes things less clear</PRE>
-<H2><A name="speed.compress">Speed with compression</A></H2>
-<P>Another user reported some results for connections with and without
- IP compression:</P>
-<PRE>Subject: [Users] Speed with compression
-   Date: Fri, 29 Jun 2001
-   From: John McMonagle &lt;johnm@advocap.org&gt;
-
-Did a couple tests with compression using the new 1.91 freeswan.
-
-Running between 2 sites with cable modems.  Both  using approximately
-130 mhz pentium.
-
-Transferred files with ncftp.
-
-Compressed file was a 6mb compressed  installation file.
-Non compressed was 18mb /var/lib/rpm/packages.rpm
-
-                            Compressed vpn          regular vpn
-Compress file                42.59 kBs               42.08 kBs
-regular file                110.84 kBs               41.66 kBs
-
-Load  was about 0 either way.
-Ping times were very similar  a bit above 9 ms.
-
-Compression looks attractive to me.</PRE>
- Later in the same thread, project technical lead Henry Spencer added:
-<PRE>&gt; is there a reason not to switch compression on?  I have large gateway boxes
-&gt; connecting 3 connections, one of them with a measly DS1 link...
-
-Run some timing tests with and without, with data and loads representative
-of what you expect in production.  That's the definitive way to decide. 
-If compression is a net loss, then obviously, leave it turned off.  If it
-doesn't make much difference, leave it off for simplicity and hence
-robustness.  If there's a substantial gain, by all means turn it on. 
-
-If both ends support compression and can successfully negotiate a
-compressed connection (trivially true if both are FreeS/WAN 1.91), then
-the crucial question is CPU cycles. 
-
-Compression has some overhead, so one question is whether *your* data
-compresses well enough to save you more CPU cycles (by reducing the volume
-of data going through CPU-intensive encryption/decryption) than it costs
-you.  Last time I ran such tests on data that was reasonably compressible
-but not deliberately contrived to be so, this generally was not true --
-compression cost extra CPU cycles -- so compression was worthwhile only if
-the link, not the CPU, was the bottleneck.  However, that was before the
-slow-compression bug was fixed.  I haven't had a chance to re-run those
-tests yet, but it sounds like I'd probably see a different result. </PRE>
- The bug he refers to was a problem with the compression libraries that
- had us using C code, rather than assembler, for compression. It was
- fixed before 1.91.
-<H2><A name="methods">Methods of measuring</A></H2>
-<P>If you want to measure the loads FreeS/WAN puts on a system, note
- that tools such as top or measurements such as load average are
- more-or-less useless for this. They are not designed to measure
- something that does most of its work inside the kernel.</P>
-<P>Here is a message from FreeS/WAN kernel programmer Richard Guy Briggs
- on this:</P>
-<PRE>&gt; I have a batch of boxes doing Freeswan stuff.
-&gt; I want to measure the CPU loading of the Freeswan tunnels, but am 
-&gt; having trouble seeing how I get some figures out...
-&gt; 
-&gt;  - Keying etc is in userspace so will show up on the per-process
-&gt;    and load average etc (ie pluto's load)
-
-Correct.
-
-&gt;  - KLIPS is in the kernel space, and does not show up in load average
-&gt;    I think also that the KLIPS per-packet processing stuff is running
-&gt;    as part of an interrupt handler so it does not show up in the
-&gt;    /proc/stat system_cpu or even idle_cpu figures
-
-It is not running in interrupt handler.  It is in the bottom half.
-This is somewhere between user context (careful, this is not
-userspace!) and hardware interrupt context.
-
-&gt; Is this correct, and is there any means of instrumenting how much the 
-&gt; cpu is being loaded - I don't like the idea of a system running out of 
-&gt; steam whilst still showing 100% idle CPU :-)
-
-vmstat seems to do a fairly good job, but use a running tally to get a
-good idea.  A one-off call to vmstat gives different numbers than a
-running stat.  To do this, put an interval on your vmstat command
-line.</PRE>
- and another suggestion from the same thread:
-<PRE>Subject: Re: Measuring the CPU usage of Freeswan
-   Date: Mon, 29 Jan 2001
-   From: Patrick Michael Kane &lt;modus@pr.es.to&gt;
- 
-The only truly accurate way to accurately track FreeSWAN CPU usage is to use
-a CPU soaker. You run it on an unloaded system as a benchmark, then start up
-FreeSWAN and take the difference to determine how much FreeSWAN is eating.
-I believe someone has done this in the past, so you may find something in
-the FreeSWAN archives.  If not, someone recently posted a URL to a CPU
-soaker benchmark tool on linux-kernel.</PRE>
-<HR>
-<H1><A name="test.freeswan">Testing FreeS/WAN</A></H1>
- This document discusses testing FreeS/WAN.
-<P>Not all types of testing are described here. Other parts of the
- documentation describe some tests:</P>
-<DL>
-<DT><A href="#testinstall">installation</A> document</DT>
-<DD>testing for a successful install</DD>
-<DT><A href="config.html#testsetup">configuration</A> document</DT>
-<DD>basic tests for a working configuration</DD>
-<DT><A href="#interop.web">web links</A> document</DT>
-<DD>General information on tests for interoperability between various
- IPsec implementations. This includes links to several test sites.</DD>
-<DT><A href="interop.html">interoperation</A> document.</DT>
-<DD>More specific information on FreeS/WAN interoperation with other
- implementations.</DD>
-<DT><A href="performance.html">performance</A> document</DT>
-<DD>performance measurements</DD>
-</DL>
-<P>The test setups and procedures described here can also be used in
- other testing, but this document focuses on testing the IPsec
- functionality of FreeS/WAN.</P>
-<H2><A NAME="test.oe">Testing opportunistic connections</A></H2>
-<P>This section teaches you how to test your opportunistically encrypted
- (OE) connections. To set up OE, please see the easy instructions in our<A
-HREF="quickstart.html"> quickstart guide</A>.</P>
-<H3><A NAME="12_1_1">Basic OE Test</A></H3>
-<P>This test is for basic OE functionality.
-<!-- You may use it on an 
-<A HREF="quickstart.html#oppo.client">initiate-only OE</A> box or a 
-<A HREF="quickstart.html#opp.incoming">full OE</A> box. -->
- For additional tests, keep
- reading.</P>
-<P>Be sure IPsec is running. You can see whether it is with:</P>
-<PRE>    ipsec setup status</PRE>
-<P>If need be, you can restart it with:</P>
-<PRE>    service ipsec restart</PRE>
-<P>Load a FreeS/WAN test website from the host on which you're running
- FreeS/WAN. Note: the feds may be watching these sites. Type one of:</P>
-<P></P>
-<PRE>   links oetest.freeswan.org</PRE>
-<PRE>   links oetest.freeswan.nl</PRE>
-
-<!--<PRE>   links oetest.freeswan.ca</PRE>-->
-<P>A positive result looks like this:</P>
-<PRE>
-   You  seem  to  be  connecting  from:  192.0.2.11 which DNS says is:
-   gateway.example.com
-     _________________________________________________________________
-                                                                                
-   Status E-route
-   OE    enabled    16    192.139.46.73/32    -&gt;    192.0.2.11/32   =&gt;
-   tun0x2097@192.0.2.11
-   OE    enabled    176    192.139.46.77/32    -&gt;   192.0.2.11/32   =&gt;
-   tun0x208a@192.0.2.11
-</PRE>
-<P>If you see this, congratulations! Your OE box will now encrypt its
- own traffic whenever it can. If you have difficulty, see our<A HREF="#oe.trouble">
- OE troubleshooting tips</A>.</P>
-<H3><A NAME="12_1_2">OE Gateway Test</A></H3>
-<P>If you've set up FreeS/WAN to protect a subnet behind your gateway,
- you'll need to run another simple test, which can be done from a
- machine running any OS. That's right, your Windows box can be protected
- by opportunistic encryption without any FreeS/WAN install or
- configuration on that box. From<STRONG> each protected subnet node</STRONG>
-, load the FreeS/WAN website with:</P>
-<PRE>   links oetest.freeswan.org</PRE>
-<PRE>   links oetest.freeswan.nl</PRE>
-<P>A positive result looks like this:</P>
-<PRE>
-   You  seem  to  be  connecting  from:  192.0.2.98 which DNS says is:
-   box98.example.com
-     _________________________________________________________________
-                                                                                
-   Status E-route
-   OE    enabled    16    192.139.46.73/32    -&gt;    192.0.2.98/32   =&gt;
-   tun0x134ed@192.0.2.11
-   OE    enabled    176    192.139.46.77/32    -&gt;   192.0.2.11/32   =&gt;
-   tun0x134d2@192.0.2.11
-</PRE>
-<P>If you see this, congratulations! Your OE gateway will now encrypt
- traffic for this subnet node whenever it can. If you have difficulty,
- see our<A HREF="#oe.trouble"> OE troubleshooting tips</A>.</P>
-<H3><A NAME="12_1_3">Additional OE tests</A></H3>
-<P>When testing OE, you will often find it useful to execute this
- command on the FreeS/WAN host:</P>
-<PRE>   ipsec eroute</PRE>
-<P>If you have established a connection (either for or for a subnet
- node) you will see a result like:</P>
-<PRE>    192.0.2.11/32   -&gt; 192.139.46.73/32  =&gt; tun0x149f@192.139.46.38
-</PRE>
-<P>Key:</P>
-<TABLE>
-<TR><TD>1.</TD><TD>192.0.2.11/32</TD><TD>Local start point of the
- protected traffic.</TD></TR>
-<TR><TD>2.</TD><TD>192.0.2.194/32</TD><TD>Remote end point of the
- protected traffic.</TD></TR>
-<TR><TD>3.</TD><TD>192.0.48.38</TD><TD>Remote FreeS/WAN node (gateway or
- host). May be the same as (2).</TD></TR>
-<TR><TD>4.</TD><TD>[not shown]</TD><TD>Local FreeS/WAN node (gateway or
- host), where you've produced the output. May be the same as (1).</TD></TR>
-</TABLE>
-<P>For extra assurance, you may wish to use a packet sniffer such as<A HREF="http://www.tcpdump.org">
- tcpdump</A> to verify that packets are being encrypted. You should see
- output that indicates<STRONG> ESP</STRONG> encrypted data, for example:</P>
-<PRE>    02:17:47.353750 PPPoE  [ses 0x1e12] IP 154: xy.example.com &gt; oetest.freeswan.org: ESP(spi=0x87150d16,seq=0x55)</PRE>
-<H2><A name="test.uml">Testing with User Mode Linux</A></H2>
-<P><A href="http://user-mode-linux.sourceforge.net/">User Mode Linux</A>
- allows you to run Linux as a user process on another Linux machine.</P>
-<P>As of 1.92, the distribution has a new directory named testing. It
- contains a collection of test scripts and sample configurations. Using
- these, you can bring up several copies of Linux in user mode and have
- them build tunnels to each other. This lets you do some testing of a
- FreeS/WAN configuration on a single machine.</P>
-<P>You need a moderately well-endowed machine for this to work well.
- Each UML wants about 16 megs of memory by default, which is plenty for
- FreeS/WAN usage. Typical regression testing only occasionally uses as
- many as 4 UMLs. If one is doing nothing else with the machine (in
- particular, not running X on it), then 128 megs and a 500MHz CPU are
- fine.</P>
- Documentation on these scripts is<A href="umltesting.html"> here</A>.
- There is also documentation on automated testing<A href="makecheck.html">
- here</A>.
-<H2><A name="testnet">Configuration for a testbed network</A></H2>
-<P>A common test setup is to put a machine with dual Ethernet cards in
- between two gateways under test. You need at least five machines; two
- gateways, two clients and a testing machine in the middle.</P>
-<P>The central machine both routes packets and provides a place to run
- diagnostic software for checking IPsec packets. See next section for
- discussion of<A href="#tcpdump.faq"> using tcpdump(8)</A> for this.</P>
-<P>This makes things more complicated than if you just connected the two
- gateway machines directly to each other, but it also makes your test
- setup much more like the environment you actually use IPsec in. Those
- environments nearly always involve routing, and quite a few apparent
- IPsec failures turn out to be problems with routing or with firewalls
- dropping packets. This approach lets you deal with those problems on
- your test setup.</P>
-<P>What you end up with looks like:</P>
-<H3><A name="testbed">Testbed network</A></H3>
-<PRE>      subnet a.b.c.0/24
-             |
-      eth1 = a.b.c.1
-         gate1
-      eth0 = 192.168.p.1
-             |
-             |
-      eth0 = 192.168.p.2
-         route/monitor box
-      eth1 = 192.168.q.2
-             |
-             |
-      eth0 = 192.168.q.1
-         gate2
-      eth1 = x.y.z.1
-              |
-       subnet x.y.z.0/24</PRE>
-<PRE>Where p and q are any convenient values that do not interfere with other
-routes you may have. The ipsec.conf(5) file then has, among other things:</PRE>
-<PRE>conn abc-xyz
-      left=192.168.p.1
-      leftnexthop=192.168.p.2
-      right=192.168.q.1
-      rightnexthop=192.168.q.2</PRE>
-<P>Once that works, you can remove the &quot;route/monitor box&quot;, and connect
- the two gateways to the Internet. The only parameters in ipsec.conf(5)
- that need to change are the four shown above. You replace them with
- values appropriate for your Internet connection, and change the eth0 IP
- addresses and the default routes on both gateways.</P>
-<P>Note that nothing on either subnet needs to change. This lets you
- test most of your IPsec setup before connecting to the insecure
- Internet.</P>
-<H3><A name="tcpdump.test">Using packet sniffers in testing</A></H3>
-<P>A number of tools are available for looking at packets. We will
- discuss using<A href="http://www.tcpdump.org/"> tcpdump(8)</A>, a
- common Linux tool included in most distributions. Alternatives
- offerring more-or-less the same functionality include:</P>
-<DL>
-<DT><A href="http://www.ethereal.com">Ethereal</A></DT>
-<DD>Several people on our mailing list report a preference for this over
- tcpdump.</DD>
-<DT><A href="http://netgroup-serv.polito.it/windump/">windump</A></DT>
-<DD>a Windows version of tcpdump(8), possibly handy if you have Windows
- boxes in your network</DD>
-<DT><A href="http://reptile.rug.ac.be/~coder/sniffit/sniffit.html">
-Sniffit</A></DT>
-<DD>A linux sniffer that we don't know much about. If you use it, please
- comment on our mailing list.</DD>
-</DL>
-<P>See also this<A href="http://www.tlsecurity.net/unix/ids/sniffer/">
- index</A> of packet sniffers.</P>
-<P>tcpdump(8) may misbehave if run on the gateways themselves. It is
- designed to look into a normal IP stack and may become confused if you
- ask it to display data from a stack which has IPsec in play.</P>
-<P>At one point, the problem was quite severe. Recent versions of
- tcpdump, however, understand IPsec well enough to be usable on a
- gateway. You can get the latest version from<A href="http://www.tcpdump.org/">
- tcpdump.org</A>.</P>
-<P>Even with a recent tcpdump, some care is required. Here is part of a
- post from Henry on the topic:</P>
-<PRE>&gt; a) data from sunset to sunrise or the other way is not being
-&gt; encrypted (I am using tcpdump (ver. 3.4) -x/ping -p to check
-&gt; packages) 
-
-What *interface* is tcpdump being applied to?  Use the -i option to
-control this.  It matters!  If tcpdump is looking at the ipsecN
-interfaces, e.g. ipsec0, then it is seeing the packets before they are
-encrypted or after they are decrypted, so of course they don't look
-encrypted.  You want to have tcpdump looking at the actual hardware
-interfaces, e.g. eth0. 
-
-Actually, the only way to be *sure* what you are sending on the wire is to
-have a separate machine eavesdropping on the traffic.  Nothing you can do
-on the machines actually running IPsec is 100% guaranteed reliable in this
-area (although tcpdump is a lot better now than it used to be).</PRE>
-<P>The most certain way to examine IPsec packets is to look at them on
- the wire. For security, you need to be certain, so we recommend doing
- that. To do so, you need a<STRONG> separate sniffer machine located
- between the two gateways</STRONG>. This machine can be routing IPsec
- packets, but it must not be an IPsec gateway. Network configuration for
- such testing is discussed<A href="#testnet"> above</A>.</P>
-<P>Here's another mailing list message with advice on using tcpdump(8):</P>
-<PRE>Subject: RE: [Users] Encrypted???
-   Date: Thu, 29 Nov 2001
-   From: &quot;Joe Patterson&quot; &lt;jpatterson@asgardgroup.com&gt;
-
-tcpdump -nl -i $EXT-IF proto 50
-
--nl tells it not to buffer output or resolve names (if you don't do that it
-may confuse you by not outputing anything for a while), -i $EXT-IF (replace
-with your external interface) tells it what interface to listen on, and
-proto 50 is ESP.  Use &quot;proto 51&quot; if for some odd reason you're using AH, and
-&quot;udp port 500&quot; if you want to see the isakmp key exchange/tunnel setup
-packets.
-
-You can also run `tcpdump -nl -i ipsec0` to see what traffic is on that
-virtual interface.  Anything you see there *should* be either encrypted or
-dropped (unless you've turned on some strange options in your ipsec.conf
-file)
-
-Another very handy thing is ethereal (http://www.ethereal.com/) which runs
-on just about anything, has a nice gui interface (or a nice text-based
-interface), and does a great job of protocol  breakdown.  For ESP and AH
-it'll basically just tell you that there's a packet of that protocol, and
-what the spi is, but for isakmp it'll actually show you a lot of the tunnel
-setup information (until it gets to the point in the protocol where isakmp
-is encrypted....)</PRE>
-<H2><A name="verify.crypt">Verifying encryption</A></H2>
-<P>The question of how to verify that messages are actually encrypted
- has been extensively discussed on the mailing list. See this<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/07/msg00262.html">
- thread</A>.</P>
-<P>If you just want to verify that packets are encrypted, look at them
- with a packet sniffer (see<A href="#tcpdump.test"> previous section</A>
-) located between the gateways. The packets should, except for some of
- the header information, be utterly unintelligible.<STRONG> The output
- of good encryption looks<EM> exactly</EM> like random noise</STRONG>.</P>
-<P>A packet sniffer can only tell you that the data you looked at was
- encrypted. If you have stronger requirements -- for example if your
- security policy requires verification that plaintext is not leaked
- during startup or under various anomolous conditions -- then you will
- need to devise much more thorough tests. If you do that, please post
- any results or methodological details which your security policy allows
- you to make public.</P>
-<P>You can put recognizable data into ping packets with something like:</P>
-<PRE>        ping -p feedfacedeadbeef 11.0.1.1</PRE>
-<P>&quot;feedfacedeadbeef&quot; is a legal hexadecimal pattern that is easy to
- pick out of hex dumps.</P>
-<P>For other protocols, you may need to check if you have encrypted data
- or ASCII text. Encrypted data has approximately equal frequencies for
- all 256 possible characters. ASCII text has most characters in the
- printable range 0x20-0x7f, a few control characters less than 0x20, and
- none at all in the range 0x80-0xff. 0x20, space, is a good character to
- look for. In normal English text space occurs about once in seven
- characters, versus about once in 256 for random or encrypted data.</P>
-<P>One thing to watch for: the output of good compression, like that of
- good encryption, looks just like random noise. You cannot tell just by
- looking at a data stream whether it has been compressed, encrypted, or
- both. You need a little care not to mistake compressed data for
- encrypted data in your testing.</P>
-<P>Note also that weak encryption also produces random-looking output.
- You cannot tell whether the encryption is strong by looking at the
- output. To be sure of that, you would need to have both the algorithms
- and the implementation examined by experts.</P>
-<P>For IPsec, you can get partial assurance from interoperability tests.
- See our<A href="interop.html"> interop</A> document. When twenty
- products all claim to implement<A href="#3DES"> 3DES</A>, and they all
- talk to each other, you can be fairly sure they have it right. Of
- course, you might wonder whether all the implementers are consipring to
- trick you or, more plausibly, whether some implementations might have
- &quot;back doors&quot; so they can get also it wrong when required.. If you're
- seriously worried about things like that, you need to get the code you
- use audited (good luck if it is not Open Source), or perhaps to talk to
- a psychiatrist about treatments for paranoia.</P>
-<H2><A name="mail.test">Mailing list pointers</A></H2>
-<P>Additional information on testing can be found in these<A href="mail.html">
- mailing list</A> messages:</P>
-<UL>
-<LI>a user's detailed<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00571.html">
- setup diary</A> for his testbed network</LI>
-<LI>a FreeS/WAN team member's<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00425.html">
- notes</A> from testing at an IPsec interop &quot;bakeoff&quot;</LI>
-</UL>
-<HR>
-<H1><A name="kernelconfig">Kernel configuration for FreeS/WAN</A></H1>
-<P> This section lists many of the options available when configuring a
- Linux kernel, and explains how they should be set on a FreeS/WAN IPsec
- gateway.</P>
-<H2><A name="notall">Not everyone needs to worry about kernel
- configuration</A></H2>
-<P>Note that in many cases you do not need to mess with these.</P>
-<P> You may have a Linux distribution which comes with FreeS/WAN
- installed (see this<A href="#products"> list</A>). In that case, you
- need not do a FreeS/WAN installation or a kernel configuration. Of
- course, you might still want to configure and rebuild your kernel to
- improve performance or security. This can be done with standard tools
- described in the<A href="http://www.linuxdoc.org/HOWTO/Kernel-HOWTO.html">
- Kernel HowTo</A>.</P>
-<P>If you need to install FreeS/WAN, then you do need to configure a
- kernel. However, you may choose to do that using the simplest
- procedure:</P>
-<UL>
-<LI>Configure, build and test a kernel for your system before adding
- FreeS/WAN. See the<A href="http://www.linuxdoc.org/HOWTO/Kernel-HOWTO.html">
- Kernel HowTo</A> for details.<STRONG> This step cannot be skipped</STRONG>
-. FreeS/WAN needs the results of your configuration.</LI>
-<LI>Then use FreeS/WAN's<VAR> make oldgo</VAR> command. This sets
- everything FreeS/WAN needs and retains your values everywhere else.</LI>
-</UL>
-<P> This document is for those who choose to configure their FreeS/WAN
- kernel themselves.</P>
-<H2><A name="assume">Assumptions and notation</A></H2>
-<P> Help text for most kernel options is included with the kernel files,
- and is accessible from within the configuration utilities. We assume
- you will refer to that, and to the<A href="http://www.linuxdoc.org/HOWTO/Kernel-HOWTO.html">
- Kernel HowTo</A>, as necessary. This document covers only the
- FreeS/WAN-specific aspects of the problem.</P>
-<P> To avoid duplication, this document section does not cover settings
- for the additional IPsec-related kernel options which become available
- after you have patched your kernel with FreeS/WAN patches. There is
- help text for those available from within the configuration utility.</P>
-<P> We assume a common configuration in which the FreeS/WAN IPsec
- gateway is also doing ipchains(8) firewalling for a local network, and
- possibly masquerading as well.</P>
-<P> Some suggestions below are labelled as appropriate for &quot;a true
- paranoid&quot;. By this we mean they may cause inconvenience and it is not
- entirely clear they are necessary, but they appear to be the safest
- choice. Not using them might entail some risk. Of course one suggested
- mantra for security administrators is: &quot;I know I'm paranoid. I wonder
- if I'm paranoid enough.&quot;</P>
-<H3><A name="labels">Labels used</A></H3>
-<P> Six labels are used to indicate how options should be set. We mark
- the labels with [square brackets]. For two of these labels, you have no
- choice:</P>
-<DL>
-<DT>[required]</DT>
-<DD>essential for FreeS/WAN operation.</DD>
-<DT>[incompatible]</DT>
-<DD>incompatible with FreeS/WAN.</DD>
-</DL>
-<P>those must be set correctly or FreeS/WAN will not work</P>
-<P>FreeS/WAN should work with any settings of the others, though of
- course not all combinations have been tested. We do label these in
- various ways, but<EM> these labels are only suggestions</EM>.</P>
-<DL>
-<DT>[recommended]</DT>
-<DD>useful on most FreeS/WAN gateways</DD>
-<DT>[disable]</DT>
-<DD>an unwelcome complication on a FreeS/WAN gateway.</DD>
-<DT>[optional]</DT>
-<DD>Your choice. We outline issues you might consider.</DD>
-<DT>[anything]</DT>
-<DD>This option has no direct effect on FreeS/WAN and related tools, so
- you should be able to set it as you please.</DD>
-</DL>
-<P> Of course complexity is an enemy in any effort to build secure
- systems.<STRONG> For maximum security, any feature that can reasonably
- be turned off should be</STRONG>. &quot;If in doubt, leave it out.&quot;</P>
-<H2><A name="kernelopt">Kernel options for FreeS/WAN</A></H2>
-<P> Indentation is based on the nesting shown by 'make menuconfig' with
- a 2.2.16 kernel for the i386 architecture.</P>
-<DL>
-<DT><A name="maturity">Code maturity and level options</A></DT>
-<DD>
-<DL>
-<DT><A name="devel">Prompt for development ... code/drivers</A></DT>
-<DD>[optional] If this is<VAR> no</VAR>, experimental drivers are not
- shown in later menus.
-<P>For most FreeS/WAN work,<VAR> no</VAR> is the preferred setting.
- Using new or untested components is too risky for a security gateway.</P>
-<P>However, for some hardware (such as the author's network cards) the
- only drivers available are marked<VAR> new/experimental</VAR>. In such
- cases, you must enable this option or your cards will not appear under
- &quot;network device support&quot;. A true paranoid would leave this option off
- and replace the cards.</P>
-</DD>
-<DT>Processor type and features</DT>
-<DD>[anything]</DD>
-<DT>Loadable module support</DT>
-<DD>
-<DL>
-<DT>Enable loadable module support</DT>
-<DD>[optional] A true paranoid would disable this. An attacker who has
- root access to your machine can fairly easily install a bogus module
- that does awful things, provided modules are enabled. A common tool for
- attackers is a &quot;rootkit&quot;, a set of tools the attacker uses once he or
- she has become root on your system. The kit introduces assorted
- additional compromises so that the attacker will continue to &quot;own&quot; your
- system despite most things you might do to recovery the situation. For
- Linux, there is a tool called<A href="http://www.sans.org/newlook/resources/IDFAQ/knark.htm">
- knark</A> which is basically a rootkit packaged as a kernel module.
-<P>With modules disabled, an attacker cannot install a bogus module. The
- only way he can achieve the same effects is to install a new kernel and
- reboot. This is considerably more likely to be noticed.</P>
-<P>Many FreeS/WAN gateways run with modules enabled. This simplifies
- some administrative tasks and some ipchains features are available only
- as modules. Once an enemy has root on your machine your security is
- nil, so arguably defenses which come into play only in that situation
- are pointless.</P>
-<P></P>
-</DD>
-<DT>Set version information ....</DT>
-<DD>[optional] This provides a check to prevent loading modules compiled
- for a different kernel.</DD>
-<DT>Kernel module loader</DT>
-<DD>[disable] It gives little benefit on a typical FreeS/WAN gate and
- entails some risk.</DD>
-</DL>
-</DD>
-<DT>General setup</DT>
-<DD>We list here only the options that matter for FreeS/WAN.
-<DL>
-<DT>Networking support</DT>
-<DD>[required]</DD>
-<DT>Sysctl interface</DT>
-<DD>[optional] If this option is turned on and the<VAR> /proc</VAR>
- filesystem installed, then you can control various system behaviours by
- writing to files under<VAR> /proc/sys</VAR>. For example:
-<PRE>        echo 1 &gt; /proc/sys/net/ipv4/ipforward</PRE>
- turns IP forwarding on.
-<P>Disabling this option breaks many firewall scripts. A true paranoid
- would disable it anyway since it might conceivably be of use to an
- attacker.</P>
-</DD>
-</DL>
-</DD>
-<DT>Plug and Play support</DT>
-<DD>[anything]</DD>
-<DT>Block devices</DT>
-<DD>[anything]</DD>
-<DT>Networking options</DT>
-<DD>
-<DL>
-<DT>Packet socket</DT>
-<DD>[optional] This kernel feature supports tools such as tcpdump(8)
- which communicate directly with network hardware, bypassing kernel
- protocols. This is very much a two-edged sword:
-<UL>
-<LI>such tools can be very useful to the firewall admin, especially
- during initial testing</LI>
-<LI>should an evildoer breach your firewall, such tools could give him
- or her a great deal of information about the rest of your network</LI>
-</UL>
- We recommend disabling this option on production gateways.</DD>
-<DT><A name="netlink">Kernel/User netlink socket</A></DT>
-<DD>[optional] Required if you want to use<A href="#adv"> advanced
- router</A> features.</DD>
-<DT>Routing messages</DT>
-<DD>[optional]</DD>
-<DT>Netlink device emulation</DT>
-<DD>[optional]</DD>
-<DT>Network firewalls</DT>
-<DD>[recommended] You need this if the IPsec gateway also functions as a
- firewall.
-<P>Even if the IPsec gateway is not your primary firewall, we suggest
- setting this so that you can protect the gateway with at least basic
- local packet filters.</P>
-</DD>
-<DT>Socket filtering</DT>
-<DD>[disable] This enables an older filtering interface. We suggest
- using ipchains(8) instead. To do that, set the &quot;Network firewalls&quot;
- option just above, and not this one.</DD>
-<DT>Unix domain sockets</DT>
-<DD>[required] These sockets are used for communication between the<A href="manpage.d/ipsec.8.html">
- ipsec(8)</A> commands and the<A href="manpage.d/ipsec_pluto.8.html">
- ipsec_pluto(8)</A> daemon.</DD>
-<DT>TCP/IP networking</DT>
-<DD>[required]
-<DL>
-<DT>IP: multicasting</DT>
-<DD>[anything]</DD>
-<DT><A name="adv">IP: advanced router</A></DT>
-<DD>[optional] This gives you policy routing, which some people have
- used to good advantage in their scripts for FreeS/WAN gateway
- management. It is not used in our distributed scripts, so not required
- unless you want it for custom scripts. It requires the<A href="#netlink">
- netlink</A> interface between kernel code and the iproute2(8) command.</DD>
-<DT>IP: kernel level autoconfiguration</DT>
-<DD>[disable] It gives little benefit on a typical FreeS/WAN gate and
- entails some risk.</DD>
-<DT>IP: firewall packet netlink device</DT>
-<DD>[disable]</DD>
-<DT>IP: transparent proxy support</DT>
-<DD>[optional] This is required in some firewall configurations, but
- should be disabled unless you have a definite need for it.</DD>
-<DT>IP: masquerading</DT>
-<DD>[optional] Required if you want to use<A href="#non-routable">
- non-routable</A> private IP addresses for your local network.</DD>
-<DT>IP: Optimize as router not host</DT>
-<DD>[recommended]</DD>
-<DT>IP: tunneling</DT>
-<DD>[required]</DD>
-<DT>IP: GRE tunnels over IP</DT>
-<DD>[anything]</DD>
-<DT>IP: aliasing support</DT>
-<DD>[anything]</DD>
-<DT>IP: ARP daemon support (EXPERIMENTAL)</DT>
-<DD>Not required on most systems, but might prove useful on
- heavily-loaded gateways.</DD>
-<DT>IP: TCP syncookie support</DT>
-<DD>[recommended] It provides a defense against a<A href="#DOS"> denial
- of service attack</A> which uses bogus TCP connection requests to waste
- resources on the victim machine.</DD>
-<DT>IP: Reverse ARP</DT>
-<DD></DD>
-<DT>IP: large window support</DT>
-<DD>[recommended] unless you have less than 16 meg RAM</DD>
-</DL>
-</DD>
-<DT>IPv6</DT>
-<DD>[optional] FreeS/WAN does not currently support IPv6, though work on
- integrating FreeS/WAN with the Linux IPv6 stack has begun.<A href="#ipv6">
- Details</A>.
-<P> It should be possible to use IPv4 FreeS/WAN on a machine which also
- does IPv6. This combination is not yet well tested. We would be quite
- interested in hearing results from anyone expermenting with it, via the<A
-href="mail.html"> mailing list</A>.</P>
-<P> We do not recommend using IPv6 on production FreeS/WAN gateways
- until more testing has been done.</P>
-</DD>
-<DT>Novell IPX</DT>
-<DD>[disable]</DD>
-<DT>Appletalk</DT>
-<DD>[disable] Quite a few Linux installations use IP but also have some
- other protocol, such as Appletalk or IPX, for communication with local
- desktop machines. In theory it should be possible to configure IPsec
- for the IP side of things without interfering with the second protocol.
-<P>We do not recommend this. Keep the software on your gateway as simple
- as possible. If you need a Linux-based Appletalk or IPX server, use a
- separate machine.</P>
-</DD>
-</DL>
-</DD>
-<DT>Telephony support</DT>
-<DD>[anything]</DD>
-<DT>SCSI support</DT>
-<DD>[anything]</DD>
-<DT>I2O device support</DT>
-<DD>[anything]</DD>
-<DT>Network device support</DT>
-<DD>[anything] should work, but there are some points to note.
-<P>The development team test almost entirely on 10 or 100 megabit
- Ethernet and modems. In principle, any device that can do IP should be
- just fine for IPsec, but in the real world any device that has not been
- well-tested is somewhat risky. By all means try it, but don't bet your
- project on it until you have solid test results.</P>
-<P>If you disabled experimental drivers in the<A href="#maturity"> Code
- maturity</A> section above, then those drivers will not be shown here.
- Check that option before going off to hunt for missing drivers.</P>
-<P>If you want Linux to automatically find more than one ethernet
- interface at boot time, you need to:</P>
-<UL>
-<LI>compile the appropriate driver(s) into your kernel. Modules will not
- work for this</LI>
-<LI>add a line such as
-<PRE>
-   append=&quot;ether=0,0,eth0 ether=0,0,eth1&quot;
-</PRE>
- to your /etc/lilo.conf file. In some cases you may need to specify
- parameters such as IRQ or base address. The example uses &quot;0,0&quot; for
- these, which tells the system to search. If the search does not succeed
- on your hardware, then you should retry with explicit parameters. See
- the lilo.conf(5) man page for details.</LI>
-<LI>run lilo(8)</LI>
-</UL>
- Having Linux find the cards this way is not necessary, but is usually
- more convenient than loading modules in your boot scripts.</DD>
-<DT>Amateur radio support</DT>
-<DD>[anything]</DD>
-<DT>IrDA (infrared) support</DT>
-<DD>[anything]</DD>
-<DT>ISDN subsystem</DT>
-<DD>[anything]</DD>
-<DT>Old CDROM drivers</DT>
-<DD>[anything]</DD>
-<DT>Character devices</DT>
-<DD>The only required character device is:
-<DL>
-<DT>random(4)</DT>
-<DD>[required] This is a source of<A href="#random"> random</A> numbers
- which are required for many cryptographic protocols, including several
- used in IPsec.
-<P>If you are comfortable with C source code, it is likely a good idea
- to go in and adjust the<VAR> #define</VAR> lines in<VAR>
- /usr/src/linux/drivers/char/random.c</VAR> to ensure that all sources
- of randomness are enabled. Relying solely on keyboard and mouse
- randomness is dubious procedure for a gateway machine. You could also
- increase the randomness pool size from the default 512 bytes (128
- 32-bit words).</P>
-</DD>
-</DL>
-</DD>
-<DT>Filesystems</DT>
-<DD>[anything] should work, but we suggest limiting a gateway machine to
- the standard Linux ext2 filesystem in most cases.</DD>
-<DT>Network filesystems</DT>
-<DD>[disable] These systems are an unnecessary risk on an IPsec gateway.</DD>
-<DT>Console drivers</DT>
-<DD>[anything]</DD>
-<DT>Sound</DT>
-<DD>[anything] should work, but we suggest enabling sound only if you
- plan to use audible alarms for firewall problems.</DD>
-<DT>Kernel hacking</DT>
-<DD>[disable] This might be enabled on test machines, but should not be
- on production gateways.</DD>
-</DL>
-</DD>
-</DL>
-<HR>
-<H1><A name="adv_config">Other configuration possibilities</A></H1>
-<P>This document describes various options for FreeS/WAN configuration
- which are less used or more complex (often both) than the standard
- cases described in our<A href="#config"> config</A> and<A href="#quick_guide">
- quickstart</A> documents.</P>
-<H2><A name="thumb">Some rules of thumb about configuration</A></H2>
-<H3><A name="cheap.tunnel">Tunnels are cheap</A></H3>
-<P>Nearly all of the overhead in IPsec processing is in the encryption
- and authentication of packets. Our<A href="performance.html">
- performance</A> document discusses these overheads.</P>
-<P>Beside those overheads, the cost of managing additional tunnels is
- trivial. Whether your gateway supports one tunnel or ten just does not
- matter. A hundred might be a problem; there is a<A href="#biggate">
- section</A> on this in the performance document.</P>
-<P>So, in nearly all cases, if using multiple tunnels gives you a
- reasonable way to describe what you need to do, you should describe it
- that way in your configuration files.</P>
-<P>For example, one user recently asked on a mailing list about this
- network configuration:</P>
-<PRE>        netA---gwA---gwB---netB
-                            |----netC
-
-   netA and B are secured netC not.
-   netA and gwA can not access netC</PRE>
-<P>The user had constructed only one tunnel, netA to netB, and wanted to
- know how to use ip-route to get netC packets into it. This is entirely
- unnecessary. One of the replies was:</P>
-<PRE>  The simplest way and indeed the right way to
-  solve this problem is to set up two connections:
-
-        leftsubnet=NetA
-        left=gwA
-        right=gwB
-        rightsubnet=NetB
-  and
-        leftsubnet=NetA
-        left=gwA
-        right=gwB
-        rightsubnet=NetC</PRE>
-<P>This would still be correct even if we added nets D, E, F, ... to the
- above diagram and needed twenty tunnels.</P>
-<P>Of course another possibility would be to just use one tunnel, with a
- subnet mask that includes both netB and netC (or B, C, D, ...). See
- next section.</P>
-<P>In general, you can construct as many tunnels as you need. Networks
- like netC in this example that do not connect directly to the gateway
- are fine, as long as the gateway can route to them.</P>
-<P>The number of tunnels can become an issue if it reaches 50 or so.
- This is discussed in the<A href="#biggate"> performance</A> document.
- Look there for information on supporting hundreds of Road Warriors from
- one gateway.</P>
-<P>If you find yourself with too many tunnels for some reason like
- having eight subnets at one location and nine at another so you end up
- with 9*8=72 tunnels, read the next section here.</P>
-<H3><A name="subnet.size">Subnet sizes</A></H3>
-<P>The subnets used in<VAR> leftsubnet</VAR> and<VAR> rightsubnet</VAR>
- can be of any size that fits your needs, and they need not correspond
- to physical networks.</P>
-<P>You adjust the size by changing the<A href="#subnet"> subnet mask</A>
-, the number after the slash in the subnet description. For example</P>
-<UL>
-<LI>in 192.168.100.0/24 the /24 mask says 24 bits are used to designate
- the network. This leave 8 bits to label machines. This subnet has 256
- addresses. .0 and .255 are reserved, so it can have 254 machines.</LI>
-<LI>A subnet with a /23 mask would be twice as large, 512 addresses.</LI>
-<LI>A subnet with a /25 mask would be half the size, 128 addresses.</LI>
-<LI>/0 is the whole Internet</LI>
-<LI>/32 is a single machine</LI>
-</UL>
-<P>As an example of using these in connection descriptions, suppose your
- company's head office has four physical networks using the address
- ranges:</P>
-<DL>
-<DT>192.168.100.0/24</DT>
-<DD>development</DD>
-<DT>192.168.101.0/24</DT>
-<DD>production</DD>
-<DT>192.168.102.0/24</DT>
-<DD>marketing</DD>
-<DT>192.168.103.0/24</DT>
-<DD>administration</DD>
-</DL>
-<P>You can use exactly those subnets in your connection descriptions, or
- use larger subnets to grant broad access if required:</P>
-<DL>
-<DT>leftsubnet=192.168.100.0/24</DT>
-<DD>remote hosts can access only development</DD>
-<DT>leftsubnet=192.168.100.0/23</DT>
-<DD>remote hosts can access development or production</DD>
-<DT>leftsubnet=192.168.102.0/23</DT>
-<DD>remote hosts can access marketing or administration</DD>
-<DT>leftsubnet=192.168.100.0/22</DT>
-<DD>remote hosts can access any of the four departments</DD>
-</DL>
-<P>or use smaller subnets to restrict access:</P>
-<DL>
-<DT>leftsubnet=192.168.103.0/24</DT>
-<DD>remote hosts can access any machine in administration</DD>
-<DT>leftsubnet=192.168.103.64/28</DT>
-<DD>remote hosts can access only certain machines in administration.</DD>
-<DT>leftsubnet=192.168.103.42/32</DT>
-<DD>remote hosts can access only one particular machine in
- administration</DD>
-</DL>
-<P>To be exact, 192.68.103.64/28 means all addresses whose top 28 bits
- match 192.168.103.64. There are 16 of these because there are 16
- possibilities for the remainingg 4 bits. Their addresses are
- 192.168.103.64 to 192.168.103.79.</P>
-<P>Each connection description can use a different subnet if required.</P>
-<P>It is possible to use all the examples above on the same FreeS/WAN
- gateway, each in a different connection description, perhaps for
- different classes of user or for different remote offices.</P>
-<P>It is also possible to have multiple tunnels using different<VAR>
- leftsubnet</VAR> descriptions with the same<VAR> right</VAR>. For
- example, when the marketing manager is on the road he or she might have
- access to:</P>
-<DL>
-<DT>leftsubnet=192.168.102.0/24</DT>
-<DD>all machines in marketing</DD>
-<DT>192.168.101.32/29</DT>
-<DD>some machines in production</DD>
-<DT>leftsubnet=192.168.103.42/32</DT>
-<DD>one particular machine in administration</DD>
-</DL>
-<P>This takes three tunnels, but tunnels are cheap. If the laptop is set
- up to build all three tunnels automatically, then he or she can access
- all these machines concurrently, perhaps from different windows.</P>
-<H3><A name="example.more">Other network layouts</A></H3>
-<P>Here is the usual network picture for a site-to-site VPN::</P>
-<PRE>     Sunset==========West------------------East=========Sunrise
-           local net       untrusted net       local net</PRE>
-<P>and for the Road Warrior::</P>
-<PRE>                                           telecommuter's PC or
-                                           traveller's laptop
-     Sunset==========West------------------East
-         corporate LAN     untrusted net</PRE>
-<P>Other configurations are also possible.</P>
-<H4><A name="internet.subnet">The Internet as a big subnet</A></H4>
-<P>A telecommuter might have:</P>
-<PRE>     Sunset==========West------------------East ================= firewall --- the Internet
-         home network      untrusted net        corporate network</PRE>
-<P>This can be described as a special case of the general
- subnet-to-subnet connection. The subnet on the right is 0.0.0.0/0, the
- whole Internet.</P>
-<P>West (the home gateway) can have its firewall rules set up so that
- only IPsec packets to East are allowed out. It will then behave as if
- its only connection to the world was a wire to East.</P>
-<P>When machines on the home network need to reach the Internet, they do
- so via the tunnel, East and the corporate firewall. From the viewpoint
- of the Internet (perhaps of some EvilDoer trying to break in!), those
- home office machines are behind the firewall and protected by it.</P>
-<H4><A name="wireless.config">Wireless</A></H4>
-<P>Another possible configuration comes up when you do not trust the
- local network, either because you have very high security standards or
- because your are using easily-intercepted wireless signals.</P>
-<P>Some wireless networks have built-in encryption called<A href="#WEP">
- WEP</A>, but its security is dubious. It is a fairly common practice to
- use IPsec instead.</P>
-<P>In this case, part of your network may look like this:</P>
-<PRE>          West-----------------------------East == the rest of your network
-     workstation   untrusted wireless net</PRE>
-<P>Of course, there would likely be several wireless workstations, each
- with its own IPsec tunnel to the East gateway.</P>
-<P>The connection descriptions look much like Road Warrior descriptions:</P>
-<UL>
-<LI>each workstation should have its own unique
-<UL>
-<LI>identifier for IPsec</LI>
-<LI>RSA key</LI>
-<LI>connection description.</LI>
-</UL>
-</LI>
-<LI>on the gateway, use<VAR> left=%any</VAR>, or the workstation IP
- address</LI>
-<LI>on workstations,<VAR> left=%defaultroute</VAR>, or the workstation
- IP address</LI>
-<LI><VAR>leftsubnet=</VAR> is not used.</LI>
-</UL>
-<P>The<VAR> rightsubnet=</VAR> parameter might be set in any of several
- ways:</P>
-<DL>
-<DT>rightsubnet=0.0.0.0/0</DT>
-<DD>allowing workstations to access the entire Internet (see<A href="#internet.subnet">
- above</A>)</DD>
-<DT>rightsubnet=a.b.c.0/24</DT>
-<DD>allowing access to your entire local network</DD>
-<DT>rightsubnet=a.b.c.d/32</DT>
-<DD>restricting the workstation to connecting to a particular server</DD>
-</DL>
-<P>Of course you can mix and match these as required. For example, a
- university might allow faculty full Internet access while letting
- student laptops connect only to a group of lab machines.</P>
-<H2><A name="choose">Choosing connection types</A></H2>
-<P>One choice you need to make before configuring additional connections
- is what type or types of connections you will use. There are several
- options, and you can use more than one concurrently.</P>
-<H3><A name="man-auto">Manual vs. automatic keying</A></H3>
-<P>IPsec allows two types of connections, with manual or automatic
- keying. FreeS/WAN starts them with commands such as:</P>
-<PRE>        ipsec manual --up <VAR>name</VAR>
-        ipsec auto --up <VAR>name</VAR></PRE>
-<P>The difference is in how they are keyed.</P>
-<DL>
-<DT><A href="#manual">Manually keyed</A> connections</DT>
-<DD>use keys stored in<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf</A>
-.</DD>
-<DT><A href="#auto">Automatically keyed</A> connections</DT>
-<DD>use keys automatically generated by the Pluto key negotiation
- daemon. The key negotiation protocol,<A href="#IKE"> IKE</A>, must
- authenticate the other system. (It is vulnerable to a<A href="#middle">
- man-in-the-middle attack</A> if used without authentication.) We
- currently support two authentication methods:
-<UL>
-<LI>using shared secrets stored in<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets</A>.</LI>
-<LI>RSA<A href="#public"> public key</A> authentication, with our
- machine's private key in<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets</A>. Public keys for other machines may either be placed
- in<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf</A> or provided via
- DNS.</LI>
-</UL>
-<P>A third method, using RSA keys embedded in<A href="#X509"> X.509</A>
- certtificates, is provided by user<A href="#patch"> patches</A>.</P>
-</DD>
-</DL>
-<P><A href="#manual">Manually keyed</A> connections provide weaker
- security than<A href="#auto"> automatically keyed</A> connections. An
- opponent who reads ipsec.secrets(5) gets your encryption key and can
- read all data encrypted by it. If he or she has an archive of old
- messages, all of them back to your last key change are also readable.</P>
-<P>With automatically-(re)-keyed connections, an opponent who reads
- ipsec.secrets(5) gets the key used to authenticate your system in IKE
- -- the shared secret or your private key, depending what authentication
- mechanism is in use. However, he or she does not automatically gain
- access to any encryption keys or any data.</P>
-<P>An attacker who has your authentication key can mount a<A href="#middle">
- man-in-the-middle attack</A> and, if that succeeds, he or she will get
- encryption keys and data. This is a serious danger, but it is better
- than having the attacker read everyting as soon as he or she breaks
- into ipsec.secrets(5).. Moreover, the keys change often so an opponent
- who gets one key does not get a large amount of data. To read all your
- data, he or she would have to do a man-in-the-middle attack at every
- key change.</P>
-<P>We discuss using<A href="#prodman"> manual keying in production</A>
- below, but this is<STRONG> not recommended</STRONG> except in special
- circumstances, such as needing to communicate with some implementation
- that offers no auto-keyed mode compatible with FreeS/WAN.</P>
-<P>Manual keying may also be useful for testing. There is some
- discussion of this in our<A href="#man4debug"> FAQ</A>.</P>
-<H3><A name="auto-auth">Authentication methods for auto-keying</A></H3>
-<P>The IKE protocol which Pluto uses to negotiate connections between
- gateways must use some form of authentication of peers. A gateway must
- know who it is talking to before it can create a secure connection. We
- support two basic methods for this authentication:</P>
-<UL>
-<LI>shared secrets, stored in<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets(5)</A></LI>
-<LI>RSA authentication</LI>
-</UL>
-<P>There are, howver, several variations on the RSA theme, using
- different methods of managing the RSA keys:</P>
-<UL>
-<LI>our RSA private key in<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets(5)</A> with other gateways' public keys
-<DL>
-<DT>either</DT>
-<DD>stored in<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A></DD>
-<DT>or</DT>
-<DD>looked up via<A href="#DNS"> DNS</A></DD>
-</DL>
-</LI>
-<LI>authentication with<A href="#X509"> x.509</A> certificates.; See our<A
-href="#patch"> links section</A> for information on user-contributed
- patches for this.:</LI>
-</UL>
-<P>Public keys in<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5</A>
-) give a reasonably straightforward method of specifying keys for
- explicitly configured connections.</P>
-<P>Putting public keys in DNS allows us to support<A href="#carpediem">
- opportunistic encryption</A>. Any two FreeS/WAN gateways can provide
- secure communication, without either of them having any preset
- information about the other.</P>
-<P>X.509 certificates may be required to interface to various<A href="#PKI">
- PKI</A>s.</P>
-<H3><A name="adv-pk">Advantages of public key methods</A></H3>
-<P>Authentication with a<A href="#public"> public key</A> method such as<A
-href="#RSA"> RSA</A> has some important advantages over using shared
- secrets.</P>
-<UL>
-<LI>no problem of secure transmission of secrets
-<UL>
-<LI>A shared secret must be shared, so you have the problem of
- transmitting it securely to the other party. If you get this wrong, you
- have no security.</LI>
-<LI>With a public key technique, you transmit only your public key. The
- system is designed to ensure that it does not matter if an enemy
- obtains public keys. The private key never leaves your machine.</LI>
-</UL>
-</LI>
-<LI>easier management
-<UL>
-<LI>Suppose you have 20 branch offices all connecting to one gateway at
- head office, and all using shared secrets. Then the head office admin
- has 20 secrets to manage. Each of them must be kept secret not only
- from outsiders, but also from 19 of the branch office admins. The
- branch office admins have only one secret each to manage.
-<P>If the branch offices need to talk to each other, this becomes
- problematic. You need another 20*19/2 = 190 secrets for
- branch-to-branch communication, each known to exactly two branches. Now
- all the branch admins have the headache of handling 20 keys, each
- shared with exactly one other branch or with head office.</P>
-<P>For larger numbers of branches, the number of connections and secrets
- increases quadratically and managing them becomes a nightmare. A
- 1000-gateway fully connected network needs 499,500 secrets, each known
- to exactly two players. There are ways to reduce this problem, for
- example by introducing a central key server, but these involve
- additional communication overheads, more administrative work, and new
- threats that must be carefully guarded against.</P>
-</LI>
-<LI>With public key techniques, the<EM> only</EM> thing you have to keep
- secret is your private key, and<EM> you keep that secret from everyone</EM>
-.
-<P>As network size increaes, the number of public keys used increases
- linearly with the number of nodes. This still requires careful
- administration in large applications, but is nothing like the disaster
- of a quadratic increase. On a 1000-gateway network, you have 1000
- private keys, each of which must be kept secure on one machine, and
- 1000 public keys which must be distributed. This is not a trivial
- problem, but it is manageable.</P>
-</LI>
-</UL>
-</LI>
-<LI>does not require fixed IP addresses
-<UL>
-<LI>When shared secrets are used in IPsec, the responder must be able to
- tell which secret to use by looking at the IP address on the incoming
- packets. When the other parties do not have a fixed IP address to be
- identified by (for example, on nearly all dialup ISP connections and
- many cable or ADSL links), this does not work well -- all must share
- the same secret!</LI>
-<LI>When RSA authentication is in use, the initiator can identify itself
- by name before the key must be determined. The responder then checks
- that the message is signed with the public key corresponding to that
- name.</LI>
-</UL>
-</LI>
-</UL>
-<P>There is also a disadvantage:</P>
-<UL>
-<LI>your private key is a single point of attack, extremely valuable to
- an enemy
-<UL>
-<LI>with shared secrets, an attacker who steals your ipsec.secrets file
- can impersonate you or try<A href="#middle"> man-in-the-middle</A>
- attacks, but can only attack connections described in that file</LI>
-<LI>an attacker who steals your private key gains the chance to attack
- not only existing connections<EM> but also any future connections</EM>
- created using that key</LI>
-</UL>
-</LI>
-</UL>
-<P>This is partly counterbalanced by the fact that the key is never
- transmitted and remains under your control at all times. It is likely
- necessary, however, to take account of this in setting security policy.
- For example, you should change gateway keys when an administrator
- leaves the company, and should change them periodically in any case.</P>
-<P>Overall, public key methods are<STRONG> more secure, more easily
- managed and more flexible</STRONG>. We recommend that they be used for
- all connections, unless there is a compelling reason to do otherwise.</P>
-<H2><A name="prodsecrets">Using shared secrets in production</A></H2>
-<P>Generally, public key methods are preferred for reasons given above,
- but shared secrets can be used with no loss of security, just more work
- and perhaps more need to take precautions.</P>
-<P>What I call &quot;shared secrets&quot; are sometimes also called &quot;pre-shared
- keys&quot;. They are used only for for authentication, never for encryption.
- Calling them &quot;pre-shared keys&quot; has confused some users into thinking
- they were encryption keys, so I prefer to avoid the term..</P>
-<P>If you are interoperating with another IPsec implementation, you may
- find its documentation calling them &quot;passphrases&quot;.</P>
-<H3><A name="secrets">Putting secrets in ipsec.secrets(5)</A></H3>
-<P>If shared secrets are to be used to<A href="#authentication">
- authenticate</A> communication for the<A href="#DH"> Diffie-Hellman</A>
- key exchange in the<A href="#IKE"> IKE</A> protocol, then those secrets
- must be stored in<VAR> /etc/ipsec.secrets</VAR>. For details, see the<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets(5)</A> man page.</P>
-<P>A few considerations are vital:</P>
-<UL>
-<LI>make the secrets long and unguessable. Since they need not be
- remembered by humans, very long ugly strings may be used. We suggest
- using our<A href="manpage.d/ipsec_ranbits.8.html"> ipsec_ranbits(8)</A>
- utility to generate long (128 bits or more) random strings.</LI>
-<LI>transmit secrets securely. You have to share them with other
- systems, but you lose if they are intercepted and used against you. Use<A
-href="#PGP"> PGP</A>,<A href="#ssh"> SSH</A>, hand delivery of a floppy
- disk which is then destroyed, or some other trustworthy method to
- deliver them.</LI>
-<LI>store secrets securely, in root-owned files with permissions
- rw------.</LI>
-<LI>limit sharing of secrets. Alice, Bob, Carol and Dave may all talk to
- each other, but only Alice and Bob should know the secret for an
- Alice-Bob link.</LI>
-<LI><STRONG>do not share private keys</STRONG>. The private key for RSA
- authentication of your system is stored in<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets(5)</A>, but it is a different class of secret from the
- pre-shared keys used for the &quot;shared secret&quot; authentication. No-one but
- you should have the RSA private key.</LI>
-</UL>
-<P>Each line has the IP addresses of the two gateways plus the secret.
- It should look something like this:</P>
-<PRE>        10.0.0.1 11.0.0.1 : PSK &quot;jxTR1lnmSjuj33n4W51uW3kTR55luUmSmnlRUuWnkjRj3UuTV4T3USSu23Uk55nWu5TkTUnjT&quot;</PRE>
-<P><VAR>PSK</VAR> indicates the use of a<STRONG> p</STRONG>re-<STRONG>s</STRONG>
-hared<STRONG> k</STRONG>ey. The quotes and the whitespace shown are
- required.</P>
-<P>You can use any character string as your secret. For security, it
- should be both long and extremely hard to guess. We provide a utility
- to generate such strings,<A href="manpage.d/ipsec_ranbits.8.html">
- ipsec_ranbits(8)</A>.</P>
-<P>You want the same secret on the two gateways used, so you create a
- line with that secret and the two gateway IP addresses. The
- installation process supplies an example secret, useful<EM> only</EM>
- for testing. You must change it for production use.</P>
-<H3><A name="securing.secrets">File security</A></H3>
-<P>You must deliver this file, or the relevant part of it, to the other
- gateway machine by some<STRONG> secure</STRONG> means.<EM> Don't just
- FTP or mail the file!</EM> It is vital that the secrets in it remain
- secret. An attacker who knew those could easily have<EM> all the data
- on your &quot;secure&quot; connection</EM>.</P>
-<P>This file must be owned by root and should have permissions<VAR>
- rw-------</VAR>.</P>
-<H3><A name="notroadshared">Shared secrets for road warriors</A></H3>
-<P>You can use a shared secret to support a single road warrior
- connecting to your gateway, and this is a reasonable thing to do in
- some circumstances. Public key methods have advantages, discussed<A href="#choose">
- above</A>, but they are not critical in this case.</P>
-<P>To do this, the line in ipsec.secrets(5) is something like:</P>
-<PRE>        10.0.0.1 0.0.0.0 : PSK &quot;jxTR1lnmSjuj33n4W51uW3kTR55luUmSmnlRUuWnkjRj3UuTV4T3USSu23Uk55nWu5TkTUnjT&quot;</PRE>
- where the<VAR> 0.0.0.0</VAR> means that any IP address is acceptable.
-<P><STRONG>For more than one road warrior, shared secrets are<EM> not</EM>
- recommended.</STRONG> If shared secrets are used, then when the
- responder needs to look up the secret, all it knows about the sender is
- an IP address. This is fine if the sender is at a fixed IP address
- specified in the config file. It is also fine if only one road warrior
- uses the wildcard<VAR> 0.0.0.0</VAR> address. However, if you have more
- than one road warrior using shared secret authentication, then they
- must all use that wildcard and therefore<STRONG> all road warriors
- using PSK autentication must use the same secret</STRONG>. Obviously,
- this is insecure.</P>
-<P><STRONG>For multiple road warriors, use public key authentication.</STRONG>
- Each roadwarrior can then have its own identity (our<VAR> leftid=</VAR>
- or<VAR> rightid=</VAR> parameters), its own public/private key pair,
- and its own secure connection.</P>
-<H2><A name="prodman">Using manual keying in production</A></H2>
-<P>Generally,<A href="#auto"> automatic keying</A> is preferred over<A href="#manual">
- manual keying</A> for production use because it is both easier to
- manage and more secure. Automatic keying frees the admin from much of
- the burden of managing keys securely, and can provide<A href="#PFS">
- perfect forward secrecy</A>. This is discussed in more detail<A href="#man-auto">
- above</A>.</P>
-<P>However, it is possible to use manual keying in production if that is
- what you want to do. This might be necessary, for example, in order to
- interoperate with some device that either does not provide automatic
- keying or provides it in some version we cannot talk to.</P>
-<P>Note that with manual keying<STRONG> all security rests with the keys</STRONG>
-. If an adversary acquires your keys, you've had it. He or she can read
- everything ever sent with those keys, including old messages he or she
- may have archived.</P>
-<P>You need to<STRONG> be really paranoid about keys</STRONG> if you're
- going to rely on manual keying for anything important.</P>
-<UL>
-<LI>keep keys in files with 600 permissions, owned by root</LI>
-<LI>be extremely careful about security of your gateway systems. Anyone
- who breaks into a gateway and gains root privileges can get all your
- keys and read everything ever encrypted with those keys, both old
- messages he has archived and any new ones you may send.</LI>
-<LI>change keys regularly. This can be a considerable bother, (and
- provides an excellent reason to consider automatic keying instead), but
- it is<EM> absolutely essential</EM> for security. Consider a manually
- keyed system in which you leave the same key in place for months:
-<UL>
-<LI>an attacker can have a very large sample of text sent with that key
- to work with. This makes various cryptographic attacks much more likely
- to succeed.</LI>
-<LI>The chances of the key being compromised in some non-cryptographic
- manner -- a spy finds it on a discarded notepad, someone breaks into
- your server or your building and steals it, a staff member is bribed,
- tricked, seduced or coerced into revealing it, etc. -- also increase
- over time.</LI>
-<LI>a successful attacker can read everything ever sent with that key.
- This makes any successful attack extremely damaging.</LI>
-</UL>
- It is clear that you must change keys often to have any useful
- security. The only question is how often.</LI>
-<LI>use<A href="#PGP"> PGP</A> or<A href="#ssh"> SSH</A> for all key
- transfers</LI>
-<LI>don't edit files with keys in them when someone can look over your
- shoulder</LI>
-<LI>worry about network security; could someone get keys by snooping
- packets on the LAN between your X desktop and the gateway?</LI>
-<LI>lock up your backup tapes for the gateway system</LI>
-<LI>... and so on</LI>
-</UL>
-<P>Linux FreeS/WAN provides some facilities to help with this. In
- particular, it is good policy to<STRONG> keep keys in separate files</STRONG>
- so you can edit configuration information in /etc/ipsec.conf without
- exposing keys to &quot;shoulder surfers&quot; or network snoops. We support this
- with the<VAR> also=</VAR> and<VAR> include</VAR> syntax in<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A>.</P>
-<P>See the last example in our<A href="examples"> examples</A> file. In
- the /etc/ipsec.conf<VAR> conn samplesep</VAR> section, it has the line:</P>
-<PRE>        also=samplesep-keys</PRE>
-<P>which tells the &quot;ipsec manual&quot; script to insert the configuration
- description labelled &quot;samplesep-keys&quot; if it can find it. The
- /etc/ipsec.conf file must also have a line such as:</P>
-<PRE>include ipsec.*.conf</PRE>
-<P>which tells it to read other files. One of those other files then
- might contain the additional data:</P>
-<PRE>conn samplesep-keys
-  spi=0x200
-  esp=3des-md5-96
-  espenckey=0x01234567_89abcdef_02468ace_13579bdf_12345678_9abcdef0
-  espauthkey=0x12345678_9abcdef0_2468ace0_13579bdf</PRE>
-<P>The first line matches the label in the &quot;also=&quot; line, so the indented
- lines are inserted. The net effect is exactly as if the inserted lines
- had occurred in the original file in place of the &quot;also=&quot; line.</P>
-<P>Variables set here are:</P>
-<DL>
-<DT>spi</DT>
-<DD>A number needed by the manual keying code. Any 3-digit hex number
- will do, but if you have more than one manual connection then<STRONG>
- spi must be different</STRONG> for each connection.</DD>
-<DT>esp</DT>
-<DD>Options for<A href="#ESP"> ESP</A> (Encapsulated Security Payload),
- the usual IPsec encryption mode. Settings here are for<A href="#encryption">
- encryption</A> using<A href="#3DES"> triple DES</A> and<A href="#authentication">
- authentication</A> using<A href="#MD5"> MD5</A>. Note that encryption
- without authentication should not be used; it is insecure.</DD>
-<DT>espenkey</DT>
-<DD>Key for ESP encryption. Here, a 192-bit hex number for triple DES.</DD>
-<DT>espauthkey</DT>
-<DD>Key for ESP authentication. Here, a 128-bit hex number for MD5.</DD>
-</DL>
-<P><STRONG>Note</STRONG> that the<STRONG> example keys we supply</STRONG>
- are intended<STRONG> only for testing</STRONG>. For real use, you
- should go to automatic keying. If that is not possible, create your own
- keys for manual mode and keep them secret</P>
-<P>Of course, any files containing keys<STRONG> must</STRONG> have 600
- permissions and be owned by root.</P>
-<P>If you connect in this way to multiple sites, we recommend that you
- keep keys for each site in a separate file and adopt some naming
- convention that lets you pick them all up with a single &quot;include&quot; line.
- This minimizes the risk of losing several keys to one error or attack
- and of accidentally giving another site admin keys which he or she has
- no business knowing.</P>
-<P>Also note that if you have multiple manually keyed connections on a
- single machine, then the<VAR> spi</VAR> parameter must be different for
- each one. Any 3-digit hex number is OK, provided they are different for
- each connection. We reserve the range 0x100 to 0xfff for manual
- connections. Pluto assigns SPIs from 0x1000 up for automatically keyed
- connections.</P>
-<P>If<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A> contains
- keys for manual mode connections, then it too must have permissions<VAR>
- rw-------</VAR>. We recommend instead that, if you must manual keying
- in production, you keep the keys in separate files.</P>
-<P>Note also that<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf</A>
- is installed with permissions<VAR> rw-r--r--</VAR>. If you plan to use
- manually keyed connections for anything more than initial testing, you<B>
- must</B>:</P>
-<UL>
-<LI>either change permissions to<VAR> rw-------</VAR></LI>
-<LI>or store keys separately in secure files and access them via include
- statements in<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf</A>.</LI>
-</UL>
-<P>We recommend the latter method for all but the simplest
- configurations.</P>
-<H3><A name="ranbits">Creating keys with ranbits</A></H3>
-<P>You can create new<A href="#random"> random</A> keys with the<A href="manpage.d/ipsec_ranbits.8.html">
- ranbits(8)</A> utility. For example, the commands:</P>
-<PRE>      umask 177
-      ipsec ranbits 192  &gt; temp
-      ipsec ranbits 128 &gt;&gt; temp</PRE>
-<P>create keys in the sizes needed for our default algorithms:</P>
-<UL>
-<LI>192-bit key for<A href="#3DES"> 3DES</A> encryption
-<BR> (only 168 bits are used; parity bits are ignored)</LI>
-<LI>128-bit key for keyed<A href="#MD5"> MD5</A> authentication</LI>
-</UL>
-<P>If you want to use<A href="#SHA"> SHA</A> instead of<A href="#MD5">
- MD5</A>, that requires a 160-bit key</P>
-<P>Note that any<STRONG> temporary files</STRONG> used must be kept<STRONG>
- secure</STRONG> since they contain keys. That is the reason for the
- umask command above. The temporary file should be deleted as soon as
- you are done with it. You may also want to change the umask back to its
- default value after you are finished working on keys.</P>
-<P>The ranbits utility may pause for a few seconds if not enough entropy
- is available immediately. See ipsec_ranbits(8) and random(4) for
- details. You may wish to provide some activity to feed entropy into the
- system. For example, you might move the mouse around, type random
- characters, or do<VAR> du /usr &gt; /dev/null</VAR> in the background.</P>
-<H2><A name="boot">Setting up connections at boot time</A></H2>
-<P>You can tell the system to set up connections automatically at boot
- time by putting suitable stuff in /etc/ipsec.conf on both systems. The
- relevant section of the file is labelled by a line reading<VAR> config
- setup</VAR>.</P>
-<P>Details can be found in the<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> man page. We also provide a file of<A href="examples">
- example configurations</A>.</P>
-<P>The most likely options are something like:</P>
-<DL>
-<DT>interfaces=&quot;ipsec0=eth0 ipsec1=ppp0&quot;</DT>
-<DD>Tells KLIPS which interfaces to use. Up to four interfaces numbered
- ipsec[0-3] are supported. Each interface can support an arbitrary
- number of tunnels.
-<P>Note that for PPP, you give the ppp[0-9] device name here, not the
- underlying device such as modem (or eth1 if you are using PPPoE).</P>
-</DD>
-<DT>interfaces=%defaultroute</DT>
-<DD>Alternative setting, useful in simple cases. KLIPS will pick up both
- its interface and the next hop information from the settings of the
- Linux default route.</DD>
-<DT>forwardcontrol=no</DT>
-<DD>Normally &quot;no&quot;. Set to &quot;yes&quot; if the IP forwarding option is disabled
- in your network configuration. (This can be set as a kernel
- configuration option or later. e.g. on Redhat, it's in
- /etc/sysconfig/network and on SuSE you can adjust it with Yast.) Linux
- FreeS/WAN will then enable forwarding when starting up and turn it off
- when going down. This is used to ensure that no packets will be
- forwarded before IPsec comes up and takes control.</DD>
-<DT>syslog=daemon.error</DT>
-<DD>Used in messages to the system logging daemon (syslogd) to specify
- what type of software is sending the messages. If the settings are
- &quot;daemon.error&quot; as in our example, then syslogd treats the messages as
- error messages from a daemon.
-<P>Note that<A href="#Pluto"> Pluto</A> does not currently pay attention
- to this variable. The variable controls setup messages only.</P>
-</DD>
-<DT>klipsdebug=</DT>
-<DD>Debug settings for<A href="#KLIPS"> KLIPS</A>.</DD>
-<DT>plutodebug=</DT>
-<DD>Debug settings for<A href="#Pluto"> Pluto</A>.</DD>
-<DT>... for both the above DEBUG settings</DT>
-<DD>Normally, leave empty as shown above for no debugging output.
-<BR> Use &quot;all&quot; for maximum information.
-<BR> See ipsec_klipsdebug(8) and ipsec_pluto(8) man page for other
- options. Beware that if you set /etc/ipsec.conf to enable debug output,
- your system's log files may get large quickly.</DD>
-<DT>dumpdir=/safe/directory</DT>
-<DD>Normally, programs started by ipsec setup don't crash. If they do,
- by default, no core dump will be produced because such dumps would
- contain secrets. If you find you need to debug such crashes, you can
- set dumpdir to the name of a directory in which to collect the core
- file.</DD>
-<DT>manualstart=</DT>
-<DD>List of manually keyed connections to be automatically started at
- boot time. Useful for testing, but not for long term use. Connections
- which are automatically started should also be automatically re-keyed.</DD>
-<DT>pluto=yes</DT>
-<DD>Whether to start<A href="#Pluto"> Pluto</A> when ipsec startup is
- done.
-<BR> This parameter is optional and defaults to &quot;yes&quot; if not present.
-<P>&quot;yes&quot; is strongly recommended for production use so that the keying
- daemon (Pluto) will automatically re-key the connections regularly. The
- ipsec-auto parameters ikelifetime, ipseclifetime and reykeywindow give
- you control over frequency of rekeying.</P>
-</DD>
-<DT>plutoload=&quot;reno-van reno-adam reno-nyc&quot;</DT>
-<DD>List of tunnels (by name, e.g. fred-susan or reno-van in our
- examples) to be loaded into Pluto's internal database at startup. In
- this example, Pluto loads three tunnels into its database when it is
- started.
-<P>If plutoload is &quot;%search&quot;, Pluto will load any connections whose
- description includes &quot;auto=add&quot; or &quot;auto=start&quot;.</P>
-</DD>
-<DT>plutostart=&quot;reno-van reno-adam reno-nyc&quot;</DT>
-<DD>List of tunnels to attempt to negotiate when Pluto is started.
-<P>If plutostart is &quot;%search&quot;, Pluto will start any connections whose
- description includes &quot;auto=start&quot;.</P>
-<P>Note that, for a connection intended to be permanent,<STRONG> both
- gateways should be set try to start</STRONG> the tunnel. This allows
- quick recovery if either gateway is rebooted or has its IPsec
- restarted. If only one gateway is set to start the tunnel and the other
- gateway restarts, the tunnel may not be rebuilt.</P>
-</DD>
-<DT>plutowait=no</DT>
-<DD>Controls whether Pluto waits for one tunnel to be established before
- starting to negotiate the next. You might set this to &quot;yes&quot;
-<UL>
-<LI>if your gateway is a very limited machine and you need to conserve
- resources.</LI>
-<LI>for debugging; the logs are clearer if only one connection is
- brought up at a time</LI>
-</UL>
- For a busy and resource-laden production gateway, you likely want &quot;no&quot;
- so that connections are brought up in parallel and the whole process
- takes less time.</DD>
-</DL>
-<P>The example assumes you are at the Reno office and will use IPsec to
- Vancouver, New York City and Amsterdam.</P>
-<H2><A name="multitunnel">Multiple tunnels between the same two gateways</A>
-</H2>
-<P>Consider a pair of subnets, each with a security gateway, connected
- via the Internet:</P>
-<PRE>         192.168.100.0/24           left subnet
-              |
-         192.168.100.1
-         North Gateway
-         101.101.101.101            left
-              |
-         101.101.101.1              left next hop
-         [Internet]
-         202.202.202.1              right next hop
-              |
-         202.202.202.202            right
-         South gateway
-         192.168.200.1
-              |
-         192.168.200.0/24           right subnet</PRE>
-<P>A tunnel specification such as:</P>
-<PRE>conn northnet-southnet
-      left=101.101.101.101
-      leftnexthop=101.101.101.1
-      leftsubnet=192.168.100.0/24
-      leftfirewall=yes
-      right=202.202.202.202
-      rightnexthop=202.202.202.1
-      rightsubnet=192.168.200.0/24
-      rightfirewall=yes</PRE>
- will allow machines on the two subnets to talk to each other. You might
- test this by pinging from polarbear (192.168.100.7) to penguin
- (192.168.200.5).
-<P>However,<STRONG> this does not cover other traffic you might want to
- secure</STRONG>. To handle all the possibilities, you might also want
- these connection descriptions:</P>
-<PRE>conn northgate-southnet
-      left=101.101.101.101
-      leftnexthop=101.101.101.1
-      right=202.202.202.202
-      rightnexthop=202.202.202.1
-      rightsubnet=192.168.200.0/24
-      rightfirewall=yes
-
-conn northnet-southgate
-      left=101.101.101.101
-      leftnexthop=101.101.101.1
-      leftsubnet=192.168.100.0/24
-      leftfirewall=yes
-      right=202.202.202.202
-      rightnexthop=202.202.202.1</PRE>
-<P>Without these, neither gateway can do IPsec to the remote subnet.
- There is no IPsec tunnel or eroute set up for the traffic.</P>
-<P>In our example, with the non-routable 192.168.* addresses used,
- packets would simply be discarded. In a different configuration, with
- routable addresses for the remote subnet,<STRONG> they would be sent
- unencrypted</STRONG> since there would be no IPsec eroute and there
- would be a normal IP route.</P>
-<P>You might also want:</P>
-<PRE>conn northgate-southgate
-      left=101.101.101.101
-      leftnexthop=101.101.101.1
-      right=202.202.202.202
-      rightnexthop=202.202.202.1</PRE>
-<P>This is required if you want the two gateways to speak IPsec to each
- other.</P>
-<P>This requires a lot of duplication of details. Judicious use of<VAR>
- also=</VAR> and<VAR> include</VAR> can reduce this problem.</P>
-<P>Note that, while FreeS/WAN supports all four tunnel types, not all
- implementations do. In particular, some versions of Windows 2000 and
- the freely downloadable version of PGP provide only &quot;client&quot;
- functionality. You cannot use them as gateways with a subnet behind
- them. To get that functionality, you must upgrade to Windows 2000
- server or the commercially available PGP products.</P>
-<H3><A name="advroute">One tunnel plus advanced routing</A></H3>
- It is also possible to use the new routing features in 2.2 and later
- kernels to avoid most needs for multple tunnels. Here is one mailing
- list message on the topic:
-<PRE>Subject: Re: linux-ipsec: IPSec packets not entering tunnel?
-   Date: Mon, 20 Nov 2000
-   From: Justin Guyett &lt;jfg@sonicity.com&gt;
-
-On Mon, 20 Nov 2000, Claudia Schmeing wrote:
-
-&gt; Right                                                         Left
-&gt;                      &quot;home&quot;                &quot;office&quot;
-&gt; 10.92.10.0/24 ---- 24.93.85.110 ========= 216.175.164.91 ---- 10.91.10.24/24
-&gt;
-&gt; I've created all four tunnels, and can ping to test each of them,
-&gt; *except* homegate-officenet.
-
-I keep wondering why people create all four tunnels.  Why not route
-traffic generated from home to 10.91.10.24/24 out ipsec0 with iproute2?
-And 99% of the time you don't need to access &quot;office&quot; directly, which
-means you can eliminate all but the subnet&lt;-&gt;subnet connection.</PRE>
- and FreeS/WAN technical lead Henry Spencer's comment:
-<PRE>&gt; I keep wondering why people create all four tunnels.  Why not route
-&gt; traffic generated from home to 10.91.10.24/24 out ipsec0 with iproute2?
-
-This is feasible, given some iproute2 attention to source addresses, but
-it isn't something we've documented yet... (partly because we're still
-making some attempt to support 2.0.xx kernels, which can't do this, but
-mostly because we haven't caught up with it yet).
-
-&gt; And 99% of the time you don't need to access &quot;office&quot; directly, which
-&gt; means you can eliminate all but the subnet&lt;-&gt;subnet connection.
-
-Correct in principle, but people will keep trying to ping to or from the
-gateways during testing, and sometimes they want to run services on the
-gateway machines too.</PRE>
-
-<!-- Is this in the right spot in this document? -->
-<H2><A name="opp.gate">An Opportunistic Gateway</A></H2>
-<H3><A NAME="14_7_1">Start from full opportunism</A></H3>
-<P>Full opportunism allows you to initiate and receive opportunistic
- connections on your machine. The remaining instructions in this section
- assume you have first set up full opportunism on your gateway using<A HREF="#opp.incoming">
- these instructions</A>. Both sets of instructions require mailing DNS
- records to your ISP. Collect DNS records for both the gateway (above)
- and the subnet nodes (below) before contacting your ISP.</P>
-<H3><A NAME="14_7_2">Reverse DNS TXT records for each protected machine</A>
-</H3>
-<P>You need these so that your Opportunistic peers can:</P>
-<UL>
-<LI>discover the gateway's address, knowing only the IP address that
- packets are bound for</LI>
-<LI>verify that the gateway is authorised to encrypt for that endpoint</LI>
-</UL>
-<P>On the gateway, generate a TXT record with:</P>
-<PRE>    ipsec showhostkey --txt 192.0.2.11</PRE>
-<P>Use your gateway address in place of 192.0.2.11.</P>
-<P>You should see (keys are trimmed for clarity throughout our example):</P>
-<PRE>    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;</PRE>
-<P><B>This MUST BE the same key as in your gateway's TXT record, or
- nothing will work.</B></P>
-<P>In a text file, make one copy of this TXT record for each subnet
- node:</P>
-<PRE>    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;
-                                                                                
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;
-                                                                                
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;</PRE>
-<P>Above each entry, insert a line like this:</P>
-<PRE>    98.2.0.192.in-addr.arpa. IN PTR arthur.example.com.</PRE>
-<P>It must include:</P>
-<UL>
-<LI>The subnet node's address in reverse map format. For example,
- 192.0.2.120 becomes<VAR> 120.2.0.192.in-addr.arpa.</VAR>. Note the
- final period.</LI>
-<LI><VAR>IN PTR</VAR></LI>
-<LI>The node's name, ie.<VAR> arthur.example.com.</VAR>. Note the final
- period.</LI>
-</UL>
-<P>The result will be a file of TXT records, like this:</P>
-<PRE>    98.2.0.192.in-addr.arpa. IN PTR arthur.example.com.
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;
-                                                                                
-    99.2.0.192.in-addr.arpa. IN PTR ford.example.com.
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;
-                                                                                
-    100.2.0.192.in-addr.arpa. IN PTR trillian.example.com.
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;</PRE>
-<H3><A NAME="14_7_3">Publish your records</A></H3>
-<P>Ask your ISP to publish all the reverse DNS records you have
- collected. There may be a delay of up to 48 hours as the records
- propagate.</P>
-<H3><A NAME="14_7_4">...and test them</A></H3>
-<P>Check a couple of records with commands like this one:</P>
-<PRE>    ipsec verify --host ford.example.com
-    ipsec verify --host trillian.example.com</PRE>
-<P>The<VAR> verify</VAR> command checks for TXT records for both the
- subnet host and its gateway. You should see output like:</P>
-<PRE>    ...
-    Looking for TXT in reverse map: 99.2.0.192.in-addr.arpa [OK]
-    ...
-    Looking for TXT in reverse map: 11.2.0.192.in-addr.arpa   [OK]
-    ...
-    Looking for TXT in reverse map: 100.2.0.192.in-addr.arpa [OK]
-    ...
-    Looking for TXT in reverse map: 11.2.0.192.in-addr.arpa   [OK]
-    ...</PRE>
-<H3><A NAME="14_7_5">No Configuration Needed</A></H3>
-<P>FreeS/WAN 2.x ships with a built-in, automatically enabled OE
- connection<VAR> conn packetdefault</VAR> which applies OE, if possible,
- to all outbound traffic routed through the FreeS/WAN box. The<A HREF="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5) manual</A> describes this connection in detail. While the
- effect is much the same as<VAR> private-or-clear</VAR>, the
- implementation is different: notably, it does not use policy groups.</P>
-<P>You can create more complex OE configurations for traffic forwarded
- through a FreeS/WAN box, as explained in our<A HREF="#policygroups">
- policy groups document</A>, or disable OE using<A HREF="#disable_policygroups">
- these instructions</A>.</P>
-<H2><A name="extruded.config">Extruded Subnets</A></H2>
-<P>What we call<A href="glossary.html#extruded"> extruded subnets</A>
- are a special case of<A href="glossary.html#VPN.gloss"> VPNs</A>.</P>
-<P>If your buddy has some unused IP addresses, in his subnet far off at
- the other side of the Internet, he can loan them to you... provided
- that the connection between you and him is fast enough to carry all the
- traffic between your machines and the rest of the Internet. In effect,
- he &quot;extrudes&quot; a part of his address space over the network to you, with
- your Internet traffic appearing to originate from behind his Internet
- gateway.</P>
-<P>As far as the Internet is concerned, your new extruded net is behind
- your buddy's gateway. You route all your packets for the Internet at
- large out his gateway, and receive return packets the same way. You
- route your local packets locally.</P>
-<P>Suppose your friend has a.b.c.0/24 and wants to give you
- a.b.c.240/28. The initial situation is:</P>
-<PRE>    subnet           gateway          Internet
-  a.b.c.0/24    a.b.c.1    p.q.r.s</PRE>
- where anything from the Internet destined for any machine in a.b.c.0/24
- is routed via p.q.r.s and that gateway knows what to do from there.
-<P>Of course it is quite normal for various smaller subnets to exist
- behind your friend's gateway. For example, your friend's company might
- have a.b.c.16/28=development, a.b.c.32/28=marketing and so on. The
- Internet neither knows not cares about this; it just delivers packets
- to the p.q.r.s and lets the gateway do whatever needs to be done from
- there.</P>
-<P>What we want to do is take a subnet, perhaps a.b.c.240/28, out of
- your friend's physical location<EM> while still having your friend's
- gateway route to it</EM>. As far as the Internet is concerned, you
- remain behind that gateway.</P>
-<PRE>    subnet           gateway          Internet       your gate  extruded
-
-  a.b.c.0/24   a.b.c.1     p.q.r.s              d.e.f.g         a.b.c.240/28                
-
-                           ========== tunnel ==========</PRE>
-<P>The extruded addresses have to be a complete subnet.</P>
-<P>In our example, the friend's security gateway is also his Internet
- gateway, but this is not necessary. As long as all traffic from the
- Internet to his addresses passes through the Internet gate, the
- security gate could be a machine behind that. The IG would need to
- route all traffic for the extruded subnet to the SG, and the SG could
- handle the rest.</P>
-<P>First, configure your subnet using the extruded addresses. Your
- security gateway's interface to your subnet needs to have an extruded
- address (possibly using a Linux<A href="#virtual"> virtual interface</A>
-, if it also has to have a different address). Your gateway needs to
- have a route to the extruded subnet, pointing to that interface. The
- other machines at your site need to have addresses in that subnet, and
- default routes pointing to your gateway.</P>
-<P>If any of your friend's machines need to talk to the extruded subnet,<EM>
- they</EM> need to have a route for the extruded subnet, pointing at his
- gateway.</P>
-<P>Then set up an IPsec subnet-to-subnet tunnel between your gateway and
- his, with your subnet specified as the extruded subnet, and his subnet
- specified as &quot;0.0.0.0/0&quot;.</P>
-<P>The tunnel description should be:</P>
-<PRE>conn extruded
-        left=p.q.r.s
-        leftsubnet=0.0.0.0/0
-        right=d.e.f.g
-        rightsubnet=a.b.c.0/28</PRE>
-<P>If either side was doing firewalling for the extruded subnet before
- the IPsec connection is set up, you'll need to poke holes in your<A HREF="#firewall">
- firewall</A> to allow packets through.</P>
-<P>And it all just works. Your SG routes traffic for 0.0.0.0/0 -- that
- is, the whole Internet -- through the tunnel to his SG, which then
- sends it onward as if it came from his subnet. When traffic for the
- extruded subnet arrives at his SG, it gets sent through the tunnel to
- your SG, which passes it to the right machine.</P>
-<P>Remember that when ipsec_manual or ipsec_auto takes a connection
- down, it<EM> does not undo the route</EM> it made for that connection.
- This lets you take a connection down and bring up a new one, or a
- modified version of the old one, without having to rebuild the route it
- uses and without any risk of packets which should use IPsec
- accidentally going out in the clear. Because the route always points
- into KLIPS, the packets will always go there. Because KLIPS temporarily
- has no idea what to do with them (no eroute for them), they will be
- discarded.</P>
-<P>If you<EM> do</EM> want to take the route down, this is what the
- &quot;unroute&quot; operation in manual and auto is for. Just do an unroute after
- doing the down.</P>
-<P>Note that the route for a connection may have replaced an existing
- non-IPsec route. Nothing in Linux FreeS/WAN will put that pre-IPsec
- route back. If you need it back, you have to create it with the route
- command.</P>
-<H2><A name="roadvirt">Road Warrior with virtual IP address</A></H2>
-<P>Please note that<A HREF="http://www.freeswan.ca/download.php"> Super
- FreeS/WAN</A> now features DHCP-over-IPsec, which is an alternate
- procedure for Virtual IP address assignment.</P>
-<P></P>
-<P>Here is a mailing list message about another way to configure for
- road warrior support:</P>
-<PRE>Subject: Re: linux-ipsec: understanding the vpn
-   Date: Thu, 28 Oct 1999 10:43:22 -0400
-   From: Irving Reid &lt;irving@nevex.com&gt;
-
-&gt;  local-------linux------internet------mobile
-&gt;  LAN        box                         user
-&gt;  ...
-
-&gt;  now when the mobile user connects to the linux box
-&gt;  it is given a virtual IP address, i have configured it to
-&gt;  be in the 10.x.x.x range. mobile user and linux box 
-&gt;  have a tunnel between them with these IP addresses.
-
-&gt;   Uptil this all is fine.
-
-If it is possible to configure your mobile client software *not* to
-use a virtual IP address, that will make your life easier. It is easier
-to configure FreeS/WAN to use the actual address the mobile user gets
-from its ISP.
-
-Unfortunately, some Windows clients don't let you choose.
-
-&gt;  what i would like to know is that how does the mobile
-&gt;  user communicate with other computers on the local
-&gt;  LAN , of course with the vpn ?
-
-&gt;   what IP address should the local LAN 
-&gt;  computers have ? I guess their default gateway 
-&gt;  should be the linux box ? and does the linux box need
-&gt;  to be a 2 NIC card box or one is fine.
-
-As someone else stated, yes, the Linux box would usually be the default
-IP gateway for the local lan.
-
-However...
-
-If you mobile user has software that *must* use a virtual IP address,
-the whole picture changes. Nobody has put much effort into getting
-FreeS/WAN to play well in this environment, but here's a sketch of one
-approach:
-
-Local Lan 1.0.0.0/24
-    |
-    +- Linux FreeS/WAN 1.0.0.2
-    |
-    | 1.0.0.1
- Router
-    | 2.0.0.1
-    |
-Internet
-    |
-    | 3.0.0.1
-Mobile User
-      Virtual Address: 1.0.0.3
-
-Note that the Local Lan network (1.0.0.x) can be registered, routable
-addresses.
-
-Now, the Mobile User sets up an IPSec security association with the
-Linux box (1.0.0.2); it should ESP encapsulate all traffic to the
-network 1.0.0.x **EXCEPT** UDP port 500. 500/udp is required for the key
-negotiation, which needs to work outside of the IPSec tunnel.
-
-On the Linux side, there's a bunch of stuff you need to do by hand (for
-now). FreeS/WAN should correctly handle setting up the IPSec SA and
-routes, but I haven't tested it so this may not work...
-
-The FreeS/WAN conn should look like:
-
-conn mobile
-        right=1.0.0.2
-        rightsubnet=1.0.0.0/24
-        rightnexthop=1.0.0.1
-        left=0.0.0.0  # The infamous &quot;road warrior&quot;
-        leftsubnet=1.0.0.3/32
-
-Note that the left subnet contains *only* the remote host's virtual
-address.
-
-Hopefully the routing table on the FreeS/WAN box ends up looking like
-this:
-
-% netstat -rn
-Kernel IP routing table
-Destination     Gateway      Genmask         Flags   MSS Window  irtt Iface
-1.0.0.0         0.0.0.0      255.255.255.0   U      1500 0          0 eth0
-127.0.0.0       0.0.0.0      255.0.0.0       U      3584 0          0 lo
-0.0.0.0         1.0.0.1      0.0.0.0         UG     1500 0          0 eth0
-1.0.0.3         1.0.0.1      255.255.255.255 UG     1433 0          0 ipsec0
-
-So, if anybody sends a packet for 1.0.0.3 to the Linux box, it should
-get bundled up and sent through the tunnel. To get the packets for
-1.0.0.3 to the Linux box in the first place, you need to use &quot;proxy
-ARP&quot;.
-
-How this works is: when a host or router on the local Ethernet segment
-wants to send a packet to 1.0.0.3, it sends out an Ethernet level
-broadcast &quot;ARP request&quot;. If 1.0.0.3 was on the local LAN, it would
-reply, saying &quot;send IP packets for 1.0.0.3 to my Ethernet address&quot;.
-
-Instead, you need to set up the Linux box so that _it_ answers ARP
-requests for 1.0.0.3, even though that isn't its IP address. That
-convinces everyone else on the lan to send 1.0.0.3 packets to the Linux
-box, where the usual FreeS/WAN processing and routing take over.
-
-% arp -i eth0 -s 1.0.0.3 -D eth0 pub
-
-This says, if you see an ARP request on interface eth0 asking for
-1.0.0.3, respond with the Ethernet address of interface eth0.
-
-Now, as I said at the very beginning, if it is *at all* possible to
-configure your client *not* to use the virtual IP address, you can avoid
-this whole mess.</PRE>
-<H2><A name="dynamic">Dynamic Network Interfaces</A></H2>
-<P>Sometimes you have to cope with a situation where the network
- interface(s) aren't all there at boot. The common example is notebooks
- with PCMCIA.</P>
-<H3><A name="basicdyn">Basics</A></H3>
-<P>The key issue here is that the<VAR> config setup</VAR> section of the<VAR>
- /etc/ipsec.conf</VAR> configuration file lists the connection between
- ipsecN and hardware interfaces, in the<VAR> interfaces=</VAR> variable.
- At any time when<VAR> ipsec setup start</VAR> or<VAR> ipsec setup
- restart</VAR> is run this variable<STRONG> must</STRONG> correspond to
- the current real situation. More precisely, it<STRONG> must not</STRONG>
- mention any hardware interfaces which don't currently exist. The
- difficulty is that an<VAR> ipsec setup start</VAR> command is normally
- run at boot time so interfaces that are not up then are mis-handled.</P>
-<H3><A name="bootdyn">Boot Time</A></H3>
-<P>Normally, an<VAR> ipsec setup start</VAR> is run at boot time.
- However, if the hardware situation at boot time is uncertain, one of
- two things must be done.</P>
-<UL>
-<LI>One possibility is simply not to have IPsec brought up at boot time.
- To do this:
-<PRE>        chkconfig --level 2345 ipsec off</PRE>
- That's for modern Red Hats or other Linuxes with chkconfig. Systems
- which lack this will require fiddling with symlinks in /etc/rc.d/rc?.d
- or the equivalent.</LI>
-<LI>Another possibility is to bring IPsec up with no interfaces, which
- is less aesthetically satisfying but simpler. Just put
-<PRE>        interfaces=</PRE>
- in the configuration file. KLIPS and Pluto will be started, but won't
- do anything.</LI>
-</UL>
-<H3><A name="changedyn">Change Time</A></H3>
-<P>When the hardware *is* in place, IPsec has to be made aware of it.
- Someday there may be a nice way to do this.</P>
-<P>Right now, the way to do it is to fix the<VAR> /etc/ipsec.conf</VAR>
- file appropriately, so<VAR> interfaces</VAR> reflects the new
- situation, and then restart the IPsec subsystem. This does break any
- existing IPsec connections.</P>
-<P>If IPsec wasn't brought up at boot time, do</P>
-<PRE>        ipsec setup start</PRE>
- while if it was, do
-<PRE>        ipsec setup restart</PRE>
- which won't be as quick.
-<P>If some of the hardware is to be taken out, before doing that, amend
- the configuration file so interfaces no longer includes it, and do</P>
-<PRE>        ipsec setup restart</PRE>
-<P>Again, this breaks any existing connections.</P>
-<H2><A name="unencrypted">Unencrypted tunnels</A></H2>
-<P>Sometimes you might want to create a tunnel without encryption. Often
- this is a bad idea, even if you have some data which need not be
- private. See this<A href="#traffic.resist"> discussion</A>.</P>
-<P>The IPsec protocols provide two ways to do build such tunnels:</P>
-<DL>
-<DT>using ESP with null encryption</DT>
-<DD>not supported by FreeS/WAN</DD>
-<DT>using<A href="#AH"> AH</A> without<A href="#ESP"> ESP</A></DT>
-<DD>supported for manually keyed connections</DD>
-<DD>possible with explicit commands via<A href="manpage.d/ipsec_whack.8.html">
- ipsec_whack(8)</A> (see this<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00190.html">
- list message</A>)</DD>
-<DD>not supported in the<A href="manpage.d/ipsec_auto.8.html">
- ipsec_auto(8)</A> scripts.</DD>
-</DL>
- One situation in which this comes up is when otherwise some data would
- be encrypted twice. Alice wants a secure tunnel from her machine to
- Bob's. Since she's behind one security gateway and he's behind another,
- part of the tunnel that they build passes through the tunnel that their
- site admins have built between the gateways. All of Alice and Bob's
- messages are encrypted twice.
-<P>There are several ways to handle this.</P>
-<UL>
-<LI>Just accept the overhead of double encryption. The site admins might
- choose this if any of the following apply:
-<UL>
-<LI>policy says encrypt everything (usually, it should)</LI>
-<LI>they don't entirely trust Alice and Bob (usually, if they don't have
- to, they shouldn't)</LI>
-<LI>if they don't feel the saved cycles are worth the time they'd need
- to build a non-encrypted tunnel for Alice and Bob's packets (often,
- they aren't)</LI>
-</UL>
-</LI>
-<LI>Use a plain IP-in-IP tunnel. These are not well documented. A good
- starting point is in the Linux kernel source tree, in
- /usr/src/linux/drivers/net/README.tunnel.</LI>
-<LI>Use a manually-keyed AH-only tunnel.</LI>
-</UL>
-<P>Note that if Alice and Bob want end-to-end security, they must build
- a tunnel end-to-end between their machines or use some other end-to-end
- tool such as PGP or SSL that suits their data. The only question is
- whether the admins build some special unencrypted tunnel for those
- already-encrypted packets.</P>
-<HR>
-<H1><A name="install">Installing FreeS/WAN</A></H1>
-<P>This document will teach you how to install Linux FreeS/WAN. If your
- distribution comes with Linux FreeS/WAN, we offer tips to get you
- started.</P>
-<H2><A NAME="15_1">Requirements</A></H2>
-<P>To install FreeS/WAN you must:</P>
-<UL>
-<LI>be running Linux with the 2.4 or 2.2 kernel series. See this<A HREF="http://www.freeswan.ca/download.php#contact">
- kernel compatibility table</A>.
-<BR>We also have experimental support for 2.6 kernels. Here are two
- basic approaches:
-<UL>
-<LI> install FreeS/WAN, including its<A HREF="#parts"> KLIPS</A> kernel
- code. This will remove the native IPsec stack and replace it with
- KLIPS.</LI>
-<LI> install the FreeS/WAN<A HREF="#parts"> userland tools</A> (keying
- daemon and supporting scripts) for use with<A HREF="http://lartc.org/howto/lartc.ipsec.html">
- 2.6 kernel native IPsec</A>,</LI>
-</UL>
- See also these<A HREF="2.6.known-issues"> known issues with 2.6</A>.</LI>
-<LI>have root access to your Linux box</LI>
-<LI>choose the version of FreeS/WAN you wish to install based on<A HREF="http://www.freeswan.org/mail.html">
- mailing list reports</A>
-<!-- or 
-our updates page (coming soon)-->
-</LI>
-</UL>
-<H2><A NAME="15_2">Choose your install method</A></H2>
-<P>There are three basic ways to get FreeS/WAN onto your system:</P>
-<UL>
-<LI>activating and testing a FreeS/WAN that<A HREF="#distroinstall">
- shipped with your Linux distribution</A></LI>
-<LI><A HREF="#rpminstall">RPM install</A></LI>
-<LI><A HREF="#srcinstall">Install from source</A></LI>
-</UL>
-<A NAME="distroinstall"></A>
-<H2><A NAME="15_3">FreeS/WAN ships with some Linuxes</A></H2>
-<P>FreeS/WAN comes with<A HREF="#distwith"> these distributions</A>.</P>
-<P>If you're running one of these, include FreeS/WAN in the choices you
- make during installation, or add it later using the distribution's
- tools.</P>
-<H3><A NAME="15_3_1">FreeS/WAN may be altered...</A></H3>
-<P>Your distribution may have integrated extra features, such as Andreas
- Steffen's X.509 patch, into FreeS/WAN. It may also use custom startup
- script locations or directory names.</P>
-<H3><A NAME="15_3_2">You might need to create an authentication keypair</A>
-</H3>
-<P>If your FreeS/WAN came with your distribution, you may wish to
- generate a fresh RSA key pair. FreeS/WAN will use these keys for
- authentication.</P>
-<P> To do this, become root, and type:</P>
-<PRE>    ipsec newhostkey --output /etc/ipsec.secrets --hostname xy.example.com
-    chmod 600 /etc/ipsec.secrets</PRE>
-<P>where you replace xy.example.com with your machine's fully-qualified
- domain name. Generate some randomness, for example by wiggling your
- mouse, to speed the process.</P>
-<P>The resulting ipsec.secrets looks like:</P>
-<PRE>: RSA   {
-        # RSA 2192 bits   xy.example.com   Sun Jun 8 13:42:19 2003
-        # for signatures only, UNSAFE FOR ENCRYPTION
-        #pubkey=0sAQOFppfeE3cC7wqJi...
-        Modulus: 0x85a697de137702ef0...
-        # everything after this point is secret
-        PrivateExponent: 0x16466ea5033e807...
-        Prime1: 0xdfb5003c8947b7cc88759065...
-        Prime2: 0x98f199b9149fde11ec956c814...
-        Exponent1: 0x9523557db0da7a885af90aee...
-        Exponent2: 0x65f6667b63153eb69db8f300dbb...
-        Coefficient: 0x90ad00415d3ca17bebff123413fc518...
-        }
-# do not change the indenting of that &quot;}&quot;</PRE>
-<P>In the actual file, the strings are much longer.</P>
-<H3><A NAME="15_3_3">Start and test FreeS/WAN</A></H3>
-<P>You can now<A HREF="#starttest"> start FreeS/WAN and test whether
- it's been successfully installed.</A>.</P>
-<A NAME="rpminstall"></A>
-<H2><A NAME="15_4">RPM install</A></H2>
-<P>These instructions are for a recent Red Hat with a stock Red Hat
- kernel. We know that Mandrake and SUSE also produce FreeS/WAN RPMs. If
- you're running either, install using your distribution's tools.</P>
-<H3><A NAME="15_4_1">Download RPMs</A></H3>
-<P>Decide which functionality you need:</P>
-<UL>
-<LI>standard FreeS/WAN RPMs. Use these shortcuts:
-<BR>
-<UL>
-<LI>(for 2.6 kernels: userland only)
-<BR> ncftpget
- ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs/\*userland*
-</LI>
-<LI>(for 2.4 kernels)
-<BR> ncftpget
- ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs/`uname -r
- | tr -d 'a-wy-z'`/\*</LI>
-<LI> or view all the offerings at our<A href="ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs">
- FTP site</A>.</LI>
-</UL>
-</LI>
-<LI>unofficial<A href="http://www.freeswan.ca/download.php"> Super
- FreeS/WAN</A> RPMs, which include Andreas Steffen's X.509 patch and
- more. Super FreeS/WAN RPMs do not currently include<A HREF="#NAT.gloss">
- Network Address Translation</A> (NAT) traversal, but Super FreeS/WAN
- source does.</LI>
-</UL>
-<A NAME="2.6.rpm"></A>
-<P>For 2.6 kernels, get the latest FreeS/WAN userland RPM, for example:</P>
-<PRE>    freeswan-userland-2.04.9-0.i386.rpm</PRE>
-<P>Note: FreeS/WAN's support for 2.6 kernel IPsec is preliminary. Please
- see<A HREf="2.6.known-issues"> 2.6.known-issues</A>, and the latest<A HREF="http://www.freeswan.org/mail.html">
- mailing list reports</A>.</P>
-<P>Change to your new FreeS/WAN directory, and make and install the</P>
-<P>For 2.4 kernels, get both kernel and userland RPMs. Check your kernel
- version with</P>
-<PRE>    uname -r</PRE>
-<P>Get a kernel module which matches that version. For example:</P>
-<PRE>    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm</PRE>
-<P>Note: These modules<B> will only work on the Red Hat kernel they were
- built for</B>, since they are very sensitive to small changes in the
- kernel.</P>
-<P>Get FreeS/WAN utilities to match. For example:</P>
-<PRE>    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm</PRE>
-<H3><A NAME="15_4_2">For freeswan.org RPMs: check signatures</A></H3>
-<P>While you're at our ftp site, grab the RPM signing key</P>
-<PRE>    freeswan-rpmsign.asc</PRE>
-<P>If you're running RedHat 8.x or later, import this key into the RPM
- database:</P>
-<PRE>    rpm --import freeswan-rpmsign.asc</PRE>
-<P>For RedHat 7.x systems, you'll need to add it to your<A HREF="#PGP">
- PGP</A> keyring:</P>
-<PRE>    pgp -ka freeswan-rpmsign.asc</PRE>
-<P>Check the digital signatures on both RPMs using:</P>
-<PRE>    rpm --checksig freeswan*.rpm </PRE>
-<P>You should see that these signatures are good:</P>
-<PRE>    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm: pgp md5 OK
-    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm: pgp md5 OK</PRE>
-<H3><A NAME="15_4_3">Install the RPMs</A></H3>
-<P>Become root:</P>
-<PRE>    su</PRE>
-<P>For a first time install, use:</P>
-<PRE>    rpm -ivh freeswan*.rpm</PRE>
-<P>To upgrade existing RPMs (and keep all .conf files in place), use:</P>
-<PRE>    rpm -Uvh freeswan*.rpm</PRE>
-<P>If you're upgrading from FreeS/WAN 1.x to 2.x RPMs, and encounter
- problems, see<A HREF="#upgrading.rpms"> this note</A>.</P>
-<H3><A NAME="15_4_4">Start and Test FreeS/WAN</A></H3>
-<P>Now,<A HREF="#starttest"> start FreeS/WAN and test your install</A>.</P>
-<A NAME="srcinstall"></A>
-<H2><A NAME="15_5">Install from Source</A></H2>
-
-<!-- Most of this section, along with "Start and Test", can replace 
-INSTALL. -->
-<H3><A NAME="15_5_1">Decide what functionality you need</A></H3>
-<P>Your choices are:</P>
-<UL>
-<LI><A HREF="ftp://ftp.xs4all.nl/pub/crypto/freeswan">standard FreeS/WAN</A>
-,</LI>
-<LI>standard FreeS/WAN plus any of these<A HREF="#patch"> user-supported
- patches</A>, or</LI>
-<LI><A HREF="http://www.freeswan.ca/download">Super FreeS/WAN</A>, an
- unofficial FreeS/WAN pre-patched with many of the above. Provides
- additional algorithms, X.509, SA deletion, dead peer detection, and<A HREF="#NAT.gloss">
- Network Address Translation</A> (NAT) traversal.</LI>
-</UL>
-<H3><A NAME="15_5_2">Download FreeS/WAN</A></H3>
-<P>Download the source tarball you've chosen, along with any patches.</P>
-<H3><A NAME="15_5_3">For freeswan.org source: check its signature</A></H3>
-<P>While you're at our ftp site, get our source signing key</P>
-<PRE>    freeswan-sigkey.asc</PRE>
-<P>Add it to your PGP keyring:</P>
-<PRE>    pgp -ka freeswan-sigkey.asc</PRE>
-<P>Check the signature using:</P>
-<PRE>    pgp freeswan-2.04.tar.gz.sig freeswan-2.04.tar.gz</PRE>
-<P>You should see something like:</P>
-<PRE>    Good signature from user &quot;Linux FreeS/WAN Software Team (build@freeswan.org)&quot;.
-    Signature made 2002/06/26 21:04 GMT using 2047-bit key, key ID 46EAFCE1</PRE>
-
-<!-- Note to self: build@freeswan.org has angled brackets in the original.
-     Changed because it conflicts with HTML tags. -->
-<H3><A NAME="15_5_4">Untar, unzip</A></H3>
-<P>As root, unpack your FreeS/WAN source into<VAR> /usr/src</VAR>.</P>
-<PRE>    su
-    mv freeswan-2.04.tar.gz /usr/src
-    cd /usr/src
-    tar -xzf freeswan-2.04.tar.gz
-</PRE>
-<H3><A NAME="15_5_5">Patch if desired</A></H3>
-<P>Now's the time to add any patches. The contributor may have special
- instructions, or you may simply use the patch command.</P>
-<H3><A NAME="15_5_6">... and Make</A></H3>
-<P>Choose one of the methods below.</P>
-<H4><A NAME="15_5_6_1">Userland-only Install for 2.6 kernels</A></H4>
-<A NAME="2.6.src"></A>
-<P>Note: FreeS/WAN's support for 2.6 kernel IPsec is preliminary. Please
- see<A HREf="2.6.known-issues"> 2.6.known-issues</A>, and the latest<A HREF="http://www.freeswan.org/mail.html">
- mailing list reports</A>.</P>
-<P>Change to your new FreeS/WAN directory, and make and install the
- FreeS/WAN userland tools.</P>
-<PRE>    cd /usr/src/freeswan-2.04
-    make programs
-    make install</PRE>
-<P>Now,<A HREF="#starttest"> start FreeS/WAN and test your install</A>.</P>
-<H4><A NAME="15_5_6_2">KLIPS install for 2.2, 2.4, or 2.6 kernels</A></H4>
-<A NAME="modinstall"></A>
-<P>To make a modular version of KLIPS, along with other FreeS/WAN
- programs you'll need, use the command sequence below. This will change
- to your new FreeS/WAN directory, make the FreeS/WAN module (and other
- stuff), and install it all.</P>
-<PRE>    cd /usr/src/freeswan-2.04
-    make oldmod
-    make minstall</PRE>
-<P><A HREF="#starttest">Start FreeS/WAN and test your install</A>.</P>
-<P>To link KLIPS statically into your kernel (using your old kernel
- settings), and install other FreeS/WAN components, do:</P>
-<PRE>    cd /usr/src/freeswan-2.04
-    make oldmod
-    make minstall</PRE>
-<P>Reboot your system and<A HREF="#testonly"> test your install</A>.</P>
-<P>For other ways to compile KLIPS, see our Makefile.</P>
-<A name="starttest"></A>
-<H2><A NAME="15_6">Start FreeS/WAN and test your install</A></H2>
-<P>Bring FreeS/WAN up with:</P>
-<PRE>    service ipsec start</PRE>
-<P>This is not necessary if you've rebooted.</P>
-<A name="testonly"></A>
-<H2><A NAME="15_7">Test your install</A></H2>
-<P>To check that you have a successful install, run:</P>
-<PRE>    ipsec verify</PRE>
-<P>You should see at least:</P>
-<PRE>
-    Checking your system to see if IPsec got installed and started correctly
-    Version check and ipsec on-path                             [OK]
-    Checking for KLIPS support in kernel                        [OK]
-    Checking for RSA private key (/etc/ipsec.secrets)           [OK]
-    Checking that pluto is running                              [OK]
-</PRE>
-<P>If any of these first four checks fails, see our<A href="#install.check">
- troubleshooting guide</A>.</P>
-<H2><A NAME="15_8">Making FreeS/WAN play well with others</A></H2>
-<P>There are at least a couple of things on your system that might
- interfere with FreeS/WAN, and now's a good time to check these:</P>
-<UL>
-<LI>Firewalling. You need to allow UDP 500 through your firewall, plus
- ESP (protocol 50) and AH (protocol 51). For more information, see our
- updated firewalls document (coming soon).</LI>
-<LI>Network address translation. Do not NAT the packets you will be
- tunneling.</LI>
-</UL>
-<H2><A NAME="15_9">Configure for your needs</A></H2>
-<P>You'll need to configure FreeS/WAN for your local site. Have a look
- at our<A HREF="quickstart.html"> opportunism quickstart guide</A> to
- see if that easy method is right for your needs. Or, see how to<A HREF="config.html">
- configure a network-to-network or Road Warrior style VPN</A>.</P>
-<HR>
-<H1><A NAME="config">How to configure FreeS/WAN</A></H1>
-<P>This page will teach you how to configure a simple network-to-network
- link or a Road Warrior connection between two Linux FreeS/WAN boxes.</P>
-<P>See also these related documents:</P>
-<UL>
-<LI>our<A HREF="#quickstart"> quickstart</A> guide to<A HREF="#carpediem">
- opportunistic encryption</A></LI>
-<LI>our guide to configuration with<A HREF="#policygroups"> policy
- groups</A></LI>
-<LI>our<A HREF="#adv_config"> advanced configuration</A> document</LI>
-</UL>
-<P> The network-to-network setup allows you to connect two office
- networks into one Virtual Private Network, while the Road Warrior
- connection secures a laptop's telecommute to work. Our examples also
- show the basic procedure on the Linux FreeS/WAN side where another
- IPsec peer is in play.</P>
-<P> Shortcut to<A HREF="#config.netnet"> net-to-net</A>.
-<BR> Shortcut to<A HREF="#config.rw"> Road Warrior</A>.</P>
-<H2><A NAME="16_1">Requirements</A></H2>
-<P>To configure the network-to-network connection you must have:</P>
-<UL>
-<LI>two Linux gateways with static IPs</LI>
-<LI>a network behind each gate. Networks must have non-overlapping IP
- ranges.</LI>
-<LI>Linux FreeS/WAN<A HREF="#install"> installed</A> on both gateways</LI>
-<LI><A HREF="http://www.tcpdump.org"><VAR>tcpdump</VAR></A> on the local
- gate, to test the connection</LI>
-</UL>
-<P>For the Road Warrior you need:</P>
-<UL>
-<LI>one Linux box with a static IP</LI>
-<LI>a Linux laptop with a dynamic IP</LI>
-<LI>Linux FreeS/WAN installed on both</LI>
-<LI>for testing,<VAR> tcpdump</VAR> on your gateway or laptop</LI>
-</UL>
-<P>If both IPs are dynamic, your situation is a bit trickier. Your best
- bet is a variation on the<A HREF="#config.rw"> Road Warrior</A>, as
- described in<A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00282.html">
- this mailing list message</A>.</P>
-<H2><A name="config.netnet"></A>Net-to-Net connection</H2>
-<H3><A name="netnet.info.ex">Gather information</A></H3>
-<P>For each gateway, compile the following information:</P>
-<UL>
-<LI>gateway IP</LI>
-<LI>IP range of the subnet you will be protecting. This doesn't have to
- be your whole physical subnet.</LI>
-<LI>a name by which that gateway can identify itself for IPsec
- negotiations. Its form is a Fully Qualified Domain Name preceded by an
- @ sign, ie. @xy.example.com.
-<BR> It does not need to be within a domain that you own. It can be a
- made-up name.</LI>
-</UL>
-<H4><A NAME="16_2_1_1">Get your leftrsasigkey</A></H4>
-<P>On your local Linux FreeS/WAN gateway, print your IPsec public key:</P>
-<PRE>    ipsec showhostkey --left</PRE>
-<P>The output should look like this (with the key shortened for easy
- reading):</P>
-<PRE>    # RSA 2048 bits   xy.example.com   Fri Apr 26 15:01:41 2002
-    leftrsasigkey=0sAQOnwiBPt...</PRE>
-<P>Don't have a key? Use<A HREF="manpage.d/ipsec_newhostkey.8.html"><VAR>
- ipsec newhostkey</VAR></A> to create one.</P>
-<H4><A NAME="16_2_1_2">...and your rightrsasigkey</A></H4>
-<P>Get a console on the remote side:</P>
-<PRE>    ssh2 ab.example.com</PRE>
-<P>In that window, type:</P>
-<PRE>    ipsec showhostkey --right</PRE>
-<P>You'll see something like:</P>
-<PRE>    # RSA 2192 bits   ab.example.com   Thu May 16 15:26:20 2002
-    rightrsasigkey=0sAQOqH55O...</PRE>
-<H3><A NAME="16_2_2">Edit<VAR> /etc/ipsec.conf</VAR></A></H3>
-<P>Back on the local gate, copy our template to<VAR> /etc/ipsec.conf</VAR>
-. (on Mandrake,<VAR> /etc/freeswan/ipsec.conf</VAR>). Substitute the
- information you've gathered for our example data.</P>
-<PRE>conn net-to-net
-    left=192.0.2.2                 # Local vitals
-    leftsubnet=192.0.2.128/29      # 
-    leftid=@xy.example.com         #   
-    leftrsasigkey=0s1LgR7/oUM...   #
-    leftnexthop=%defaultroute      # correct in many situations 
-    right=192.0.2.9                # Remote vitals
-    rightsubnet=10.0.0.0/24        #
-    rightid=@ab.example.com        # 
-    rightrsasigkey=0sAQOqH55O...   #
-    rightnexthop=%defaultroute     # correct in many situations
-    auto=add                       # authorizes but doesn't start this 
-                                   # connection at startup</PRE>
-<P> &quot;Left&quot; and &quot;right&quot; should represent the machines that have FreeS/WAN
- installed on them, and &quot;leftsubnet&quot; and &quot;rightsubnet&quot; machines that are
- being protected. /32 is assumed for left/right and left/rightsubnet
- parameters.</P>
-<P>Copy<VAR> conn net-to-net</VAR> to the remote-side /etc/ipsec.conf.
- If you've made no other modifications to either<VAR> ipsec.conf</VAR>,
- simply:</P>
-<PRE>    scp2 ipsec.conf root@ab.example.com:/etc/ipsec.conf</PRE>
-<H3><A NAME="16_2_3">Start your connection</A></H3>
-<P>Locally, type:</P>
-<PRE>    ipsec auto --up net-to-net</PRE>
-<P>You should see:</P>
-<PRE>    104 &quot;net-net&quot; #223: STATE_MAIN_I1: initiate
-    106 &quot;net-net&quot; #223: STATE_MAIN_I2: sent MI2, expecting MR2
-    108 &quot;net-net&quot; #223: STATE_MAIN_I3: sent MI3, expecting MR3
-    004 &quot;net-net&quot; #223: STATE_MAIN_I4: ISAKMP SA established
-    112 &quot;net-net&quot; #224: STATE_QUICK_I1: initiate
-    004 &quot;net-net&quot; #224: STATE_QUICK_I2: sent QI2, IPsec SA established</PRE>
-<P>The important thing is<VAR> IPsec SA established</VAR>. If you're
- unsuccessful, see our<A HREF="#trouble"> troubleshooting tips</A>.</P>
-<H3><A NAME="16_2_4">Do not MASQ or NAT packets to be tunneled</A></H3>
-<P>If you are using<A HREF="#masq"> IP masquerade</A> or<A HREF="#NAT.gloss">
- Network Address Translation (NAT)</A> on either gateway, you must now
- exempt the packets you wish to tunnel from this treatment. For example,
- if you have a rule like:</P>
-<PRE>iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -j MASQUERADE
-</PRE>
-<P>change it to something like:</P>
-<PRE>iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -d \! 192.0.2.128/29 -j MASQUERADE</PRE>
-<P>This may be necessary on both gateways.</P>
-<H3><A NAME="16_2_5">Test your connection</A></H3>
-<P>Sit at one of your local subnet nodes (not the gateway), and ping a
- subnet node on the other (again, not the gateway).</P>
-<PRE>    ping fileserver.toledo.example.com</PRE>
-<P>While still pinging, go to the local gateway and snoop your outgoing
- interface, for example:</P>
-<PRE>    tcpdump -i ppp0</PRE>
-<P>You want to see ESP (Encapsulating Security Payload) packets moving<B>
- back and forth</B> between the two gateways at the same frequency as
- your pings:</P>
-<PRE>    19:16:32.046220 192.0.2.2 &gt; 192.0.2.9: ESP(spi=0x3be6c4dc,seq=0x3)
-    19:16:32.085630 192.0.2.9 &gt; 192.0.2.2: ESP(spi=0x5fdd1cf8,seq=0x6)</PRE>
-<P>If you see this, congratulations are in order! You have a tunnel
- which will protect any IP data from one subnet to the other, as it
- passes between the two gates. If not, go and<A HREF="#trouble">
- troubleshoot</A>.</P>
-<P>Note: your new tunnel protects only net-net traffic, not
- gateway-gateway, or gateway-subnet. If you need this (for example, if
- machines on one net need to securely contact a fileserver on the IPsec
- gateway), you'll need to create<A HREF="#adv_config"> extra connections</A>
-.</P>
-<H3><A NAME="16_2_6">Finishing touches</A></H3>
-<P>Now that your connection works, name it something sensible, like:</P>
-<PRE>conn winstonnet-toledonet</PRE>
-<P>To have the tunnel come up on-boot, replace</P>
-<PRE>    auto=add</PRE>
-<P>with:</P>
-<PRE>    auto=start</PRE>
-<P>Copy these changes to the other side, for example:</P>
-<PRE>    scp2 ipsec.conf root@ab.example.com:/etc/ipsec.conf</PRE>
-<P>Enjoy!</P>
-<H2><A name="config.rw"></A>Road Warrior Configuration</H2>
-<H3><A name="rw.info.ex">Gather information</A></H3>
-<P>You'll need to know:</P>
-<UL>
-<LI>the gateway's static IP</LI>
-<LI>the IP range of the subnet behind that gateway</LI>
-<LI>a name by which each side can identify itself for IPsec
- negotiations. Its form is a Fully Qualified Domain Name preceded by an
- @ sign, ie. @road.example.com.
-<BR> It does not need to be within a domain that you own. It can be a
- made-up name.</LI>
-</UL>
-<H4><A NAME="16_3_1_1">Get your leftrsasigkey...</A></H4>
-<P>On your laptop, print your IPsec public key:</P>
-<PRE>    ipsec showhostkey --left</PRE>
-<P>The output should look like this (with the key shortened for easy
- reading):</P>
-<PRE>    # RSA 2192 bits   road.example.com   Sun Jun  9 02:45:02 2002
-    leftrsasigkey=0sAQPIPN9uI...</PRE>
-<P>Don't have a key? See<A HREF="old_config.html#genrsakey"> these
- instructions</A>.</P>
-<H4><A NAME="16_3_1_2">...and your rightrsasigkey</A></H4>
-<P>Get a console on the gateway:</P>
-<PRE>    ssh2 xy.example.com</PRE>
-<P>View the gateway's public key with:</P>
-<PRE>    ipsec showhostkey --right</PRE>
-<P>This will yield something like</P>
-<PRE>    # RSA 2048 bits   xy.example.com   Fri Apr 26 15:01:41 2002
-    rightrsasigkey=0sAQOnwiBPt...</PRE>
-<H3><A NAME="16_3_2">Customize<VAR> /etc/ipsec.conf</VAR></A></H3>
-<P>On your laptop, copy this template to<VAR> /etc/ipsec.conf</VAR>. (on
- Mandrake,<VAR> /etc/freeswan/ipsec.conf</VAR>). Substitute the
- information you've gathered for our example data.</P>
-<PRE>conn road
-    left=%defaultroute             # Picks up our dynamic IP 
-    leftnexthop=%defaultroute      # 
-    leftid=@road.example.com       # Local information
-    leftrsasigkey=0sAQPIPN9uI...   #
-    right=192.0.2.10               # Remote information
-    rightsubnet=10.0.0.0/24        #
-    rightid=@xy.example.com        # 
-    rightrsasigkey=0sAQOnwiBPt...  #
-    auto=add                       # authorizes but doesn't start this
-                                   # connection at startup</PRE>
-<P>The template for the gateway is different. Notice how it reverses<VAR>
- left</VAR> and<VAR> right</VAR>, in keeping with our convention that<STRONG>
- L</STRONG>eft is<STRONG> L</STRONG>ocal,<STRONG> R</STRONG>ight<STRONG>
- R</STRONG>emote. Be sure to switch your rsasigkeys in keeping with
- this.</P>
-<PRE>    ssh2 xy.example.com
-    vi /etc/ipsec.conf</PRE>
-<P>and add:</P>
-<PRE>conn road
-    left=192.0.2.2                 # Gateway's information
-    leftid=@xy.example.com         #
-    leftsubnet=192.0.2.128/29      #
-    leftrsasigkey=0sAQOnwiBPt...   #
-    rightnexthop=%defaultroute     # correct in many situations
-    right=%any                     # Wildcard: we don't know the laptop's IP
-    rightid=@road.example.com      #
-    rightrsasigkey=0sAQPIPN9uI...  #
-    auto=add                       # authorizes but doesn't start this
-                                   # connection at startup</PRE>
-<H3><A NAME="16_3_3">Start your connection</A></H3>
-<P>You must start the connection from the Road Warrior side. On your
- laptop, type:</P>
-<PRE>    ipsec auto --start net-to-net</PRE>
-<P>You should see:</P>
-<PRE>104 &quot;net-net&quot; #223: STATE_MAIN_I1: initiate
-106 &quot;road&quot; #301: STATE_MAIN_I2: sent MI2, expecting MR2
-108 &quot;road&quot; #301: STATE_MAIN_I3: sent MI3, expecting MR3
-004 &quot;road&quot; #301: STATE_MAIN_I4: ISAKMP SA established
-112 &quot;road&quot; #302: STATE_QUICK_I1: initiate
-004 &quot;road&quot; #302: STATE_QUICK_I2: sent QI2, IPsec SA established</PRE>
-<P>Look for<VAR> IPsec SA established</VAR>. If you're unsuccessful, see
- our<A HREF="#trouble"> troubleshooting tips</A>.</P>
-<H3><A NAME="16_3_4">Do not MASQ or NAT packets to be tunneled</A></H3>
-<P>If you are using<A HREF="#masq"> IP masquerade</A> or<A HREF="#NAT.gloss">
- Network Address Translation (NAT)</A> on either gateway, you must now
- exempt the packets you wish to tunnel from this treatment. For example,
- if you have a rule like:</P>
-<PRE>iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -j MASQUERADE
-</PRE>
-<P>change it to something like:</P>
-<PRE>iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -d \! 192.0.2.128/29 -j MASQUERADE</PRE>
-<H3><A NAME="16_3_5">Test your connection</A></H3>
-<P>From your laptop, ping a subnet node behind the remote gateway. Do
- not choose the gateway itself for this test.</P>
-<PRE>    ping ns.winston.example.com</PRE>
-<P>Snoop the packets exiting the laptop, with a command like:</P>
-<PRE>    tcpdump -i wlan0</PRE>
-<P>You have success if you see (Encapsulating Security Payload) packets
- travelling<B> in both directions</B>:</P>
-<PRE>    19:16:32.046220 192.0.2.2 &gt; 192.0.2.9: ESP(spi=0x3be6c4dc,seq=0x3)
-    19:16:32.085630 192.0.2.9 &gt; 192.0.2.2: ESP(spi=0x5fdd1cf8,seq=0x6)</PRE>
-<P>If you do, great! Traffic between your Road Warrior and the net
- behind your gateway is protected. If not, see our<A HREF="#trouble">
- troubleshooting hints</A>.</P>
-<P>Your new tunnel protects only traffic addressed to the net, not to
- the IPsec gateway itself. If you need the latter, you'll want to make
- an<A HREF="#adv_config"> extra tunnel.</A>.</P>
-<H3><A NAME="16_3_6">Finishing touches</A></H3>
-<P>On both ends, name your connection wisely, like:</P>
-<PRE>conn mike-to-office</PRE>
-<P><B>On the laptop only,</B> replace</P>
-<PRE>    auto=add</PRE>
-<P>with:</P>
-<PRE>    auto=start</PRE>
-<P>so that you'll be connected on-boot.</P>
-<P>Happy telecommuting!</P>
-<H3><A NAME="16_3_7">Multiple Road Warriors</A></H3>
-<P>If you're using RSA keys, as we did in this example, you can add as
- many Road Warriors as you like. The left/rightid parameter lets Linux
- FreeS/WAN distinguish between multiple Road Warrior peers, each with
- its own public key.</P>
-<P>The situation is different for shared secrets (PSK). During a PSK
- negotiation, ID information is not available at the time Pluto is
- trying to determine which secret to use, so, effectively, you can only
- define one Roadwarrior connection. All your PSK road warriors must
- therefore share one secret.</P>
-<H2><A NAME="16_4">What next?</A></H2>
-<P>Using the principles illustrated here, you can try variations such
- as:</P>
-<UL>
-<LI>a telecommuter with a static IP</LI>
-<LI>a road warrior with a subnet behind it</LI>
-</UL>
-<P>Or, look at some of our<A HREF="#adv_config"> more complex
- configuration examples.</A>.</P>
-<HR>
-<H1><A name="background">Linux FreeS/WAN background</A></H1>
-<P>This section discusses a number of issues which have three things in
- common:</P>
-<UL>
-<LI>They are not specifically FreeS/WAN problems</LI>
-<LI>You may have to understand them to get FreeS/WAN working right</LI>
-<LI>They are not simple questions</LI>
-</UL>
-<P>Grouping them here lets us provide the explanations some users will
- need without unduly complicating the main text.</P>
-<P>The explanations here are intended to be adequate for FreeS/WAN
- purposes (please comment to the<A href="mail.html"> users mailing list</A>
- if you don't find them so), but they are not trying to be complete or
- definitive. If you need more information, see the references provided
- in each section.</P>
-<H2><A name="dns.background">Some DNS background</A></H2>
-<P><A href="#carpediem">Opportunistic encryption</A> requires that the
- gateway systems be able to fetch public keys, and other IPsec-related
- information, from each other's DNS (Domain Name Service) records.</P>
-<P><A href="#DNS">DNS</A> is a distributed database that maps names to
- IP addresses and vice versa.</P>
-<P>Much good reference material is available for DNS, including:</P>
-<UL>
-<LI>the<A href="http://www.linuxdoc.org/HOWTO/DNS-HOWTO.html"> DNS HowTo</A>
-</LI>
-<LI>the standard<A href="#DNS.book"> DNS reference</A> book</LI>
-<LI><A href="http://www.linuxdoc.org/LDP/nag2/index.html">Linux Network
- Administrator's Guide</A></LI>
-<LI><A href="http://www.nominum.com/resources/whitepapers/bind-white-paper.html">
-BIND overview</A></LI>
-<LI><A href="http://www.nominum.com/resources/documentation/Bv9ARM.pdf">
-BIND 9 Administrator's Reference</A></LI>
-</UL>
-<P>We give only a brief overview here, intended to help you use DNS for
- FreeS/WAN purposes.</P>
-<H3><A name="forward.reverse">Forward and reverse maps</A></H3>
-<P>Although the implementation is distributed, it is often useful to
- speak of DNS as if it were just two enormous tables:</P>
-<UL>
-<LI>the forward map: look up a name, get an IP address</LI>
-<LI>the reverse map: look up an IP address, get a name</LI>
-</UL>
-<P>Both maps can optionally contain additional data. For opportunistic
- encryption, we insert the data need for IPsec authentication.</P>
-<P>A system named gateway.example.com with IP address 10.20.30.40 should
- have at least two DNS records, one in each map:</P>
-<DL>
-<DT>gateway.example.com. IN A 10.20.30.40</DT>
-<DD>used to look up the name and get an IP address</DD>
-<DT>40.30.20.10.in-addr.arpa. IN PTR gateway.example.com.</DT>
-<DD>used for reverse lookups, looking up an address to get the
- associated name. Notice that the digits here are in reverse order; the
- actual address is 10.20.30.40 but we use 40.30.20.10 here.</DD>
-</DL>
-<H3><A NAME="17_1_2">Hierarchy and delegation</A></H3>
-<P>For both maps there is a hierarchy of DNS servers and a system of
- delegating authority so that, for example:</P>
-<UL>
-<LI>the DNS administrator for example.com can create entries of the form<VAR>
- name</VAR>.example.com</LI>
-<LI>the example.com admin cannot create an entry for counterexample.com;
- only someone with authority for .com can do that</LI>
-<LI>an admin might have authority for 20.10.in-addr.arpa.</LI>
-<LI>in either map, authority can be delegated
-<UL>
-<LI>the example.com admin could give you authority for
- westcoast.example.com</LI>
-<LI>the 20.10.in-addr.arpa admin could give you authority for
- 30.20.10.in-addr.arpa</LI>
-</UL>
-</LI>
-</UL>
-<P>DNS zones are the units of delegation. There is a hierarchy of zones.</P>
-<H3><A NAME="17_1_3">Syntax of DNS records</A></H3>
-<P>Returning to the example records:</P>
-<PRE>        gateway.example.com. IN A 10.20.30.40
-        40.30.20.10.in-addr.arpa. IN PTR gateway.example.com.</PRE>
-<P>some syntactic details are:</P>
-<UL>
-<LI>the IN indicates that these records are for<STRONG> In</STRONG>
-ternet addresses</LI>
-<LI>The final periods in '.com.' and '.arpa.' are required. They
- indicate the root of the domain name system.</LI>
-</UL>
-<P>The capitalised strings after IN indicate the type of record.
- Possible types include:</P>
-<UL>
-<LI><STRONG>A</STRONG>ddress, for forward lookups</LI>
-<LI><STRONG>P</STRONG>oin<STRONG>T</STRONG>e<STRONG>R</STRONG>, for
- reverse lookups</LI>
-<LI><STRONG>C</STRONG>anonical<STRONG> NAME</STRONG>, records to support
- aliasing, multiple names for one address</LI>
-<LI><STRONG>M</STRONG>ail e<STRONG>X</STRONG>change, used in mail
- routing</LI>
-<LI><STRONG>SIG</STRONG>nature, used in<A href="#SDNS"> secure DNS</A></LI>
-<LI><STRONG>KEY</STRONG>, used in<A href="#SDNS"> secure DNS</A></LI>
-<LI><STRONG>T</STRONG>e<STRONG>XT</STRONG>, a multi-purpose record type</LI>
-</UL>
-<P>To set up for opportunistic encryption, you add some TXT records to
- your DNS data. Details are in our<A href="quickstart.html"> quickstart</A>
- document.</P>
-<H3><A NAME="17_1_4">Cacheing, TTL and propagation delay</A></H3>
-<P>DNS information is extensively cached. With no caching, a lookup by
- your system of &quot;www.freeswan.org&quot; might involve:</P>
-<UL>
-<LI>your system asks your nameserver for &quot;www.freeswan.org&quot;</LI>
-<LI>local nameserver asks root server about &quot;.org&quot;, gets reply</LI>
-<LI>local nameserver asks .org nameserver about &quot;freeswan.org&quot;, gets
- reply</LI>
-<LI>local nameserver asks freeswan.org nameserver about
- &quot;www.freeswan.org&quot;, gets reply</LI>
-</UL>
-<P>However, this can be a bit inefficient. For example, if you are in
- the Phillipines, the closest a root server is in Japan. That might send
- you to a .org server in the US, and then to freeswan.org in Holland. If
- everyone did all those lookups every time they clicked on a web link,
- the net would grind to a halt.</P>
-<P>Nameservers therefore cache information they look up. When you click
- on another link at www.freeswan.org, your local nameserver has the IP
- address for that server in its cache, and no further lookups are
- required.</P>
-<P>Intermediate results are also cached. If you next go to
- lists.freeswan.org, your nameserver can just ask the freeswan.org
- nameserver for that address; it does not need to query the root or .org
- nameservers because it has a cached address for the freeswan.org zone
- server.</P>
-<P>Of course, like any cacheing mechanism, this can create problems of
- consistency. What if the administrator for freeswan.org changes the IP
- address, or the authentication key, for www.freeswan.org? If you use
- old information from the cache, you may get it wrong. On the other
- hand, you cannot afford to look up fresh information every time. Nor
- can you expect the freeswan.org server to notify you; that isn't in the
- protocols.</P>
-<P>The solution that is in the protocols is fairly simple. Cacheable
- records are marked with Time To Live (TTL) information. When the time
- expires, the caching server discards the record. The next time someone
- asks for it, the server fetches a fresh copy. Of course, a server may
- also discard records before their TTL expires if it is running out of
- cache space.</P>
-<P>This implies that there will be some delay before the new version of
- a changed record propagates around the net. Until the TTLs on all
- copies of the old record expire, some users will see it because that is
- what is in their cache. Other users may see the new record immediately
- because they don't have an old one cached.</P>
-<H2><A name="MTU.trouble">Problems with packet fragmentation</A></H2>
-<P>It seems, from mailing list reports, to be moderately common for
- problems to crop up in which small packets pass through the IPsec
- tunnels just fine but larger packets fail.</P>
-<P>These problems are caused by various devices along the way
- mis-handling either packet fragments or<A href="#pathMTU"> path MTU
- discovery</A>.</P>
-<P>IPsec makes packets larger by adding an ESP or AH header. This can
- tickle assorted bugs in fragment handling in routers and firewalls, or
- in path MTU discovery mechanisms, and cause a variety of symptoms which
- are both annoying and, often, quite hard to diagnose.</P>
-<P>An explanation from project technical lead Henry Spencer:</P>
-<PRE>The problem is IP fragmentation; more precisely, the problem is that the
-second, third, etc. fragments of an IP packet are often difficult for
-filtering mechanisms to classify.
-
-Routers cannot rely on reassembling the packet, or remembering what was in
-earlier fragments, because the fragments may be out of order or may even
-follow different routes.  So any general, worst-case filtering decision
-pretty much has to be made on each fragment independently.  (If the router
-knows that it is the only route to the destination, so all fragments
-*must* pass through it, reassembly would be possible... but most routers
-don't want to bother with the complications of that.)
-
-All fragments carry roughly the original IP header, but any higher-level
-header is (for IP purposes) just the first part of the packet data... so
-only the first fragment carries that.  So, for example, on examining the
-second fragment of a TCP packet, you could tell that it's TCP, but not
-what port number it is destined for -- that information is in the TCP
-header, which appears in the first fragment only. 
-
-The result of this classification difficulty is that stupid routers and
-over-paranoid firewalls may just throw fragments away.  To get through
-them, you must reduce your MTU enough that fragmentation will not occur.
-(In some cases, they might be willing to attempt reassembly, but have very
-limited resources to devote to it, meaning that packets must be small and
-fragments few in number, leading to the same conclusion:  smaller MTU.)</PRE>
-<P>In addition to the problem Henry describes, you may also have trouble
- with<A href="#pathMTU"> path MTU discovery</A>.</P>
-<P>By default, FreeS/WAN uses a large<A href="#MTU"> MTU</A> for the
- ipsec device. This avoids some problems, but may complicate others.
- Here's an explanation from Claudia:</P>
-<PRE>Here are a couple of pieces of background information. Apologies if you
-have seen these already. An excerpt from one of my old posts:
-
-    An MTU of 16260 on ipsec0 is usual. The IPSec device defaults to this 
-    high MTU so that it does not fragment incoming packets before encryption 
-    and encapsulation. If after IPSec processing packets are larger than 1500,
-    [ie. the mtu of eth0] then eth0 will fragment them. 
-
-    Adding IPSec headers adds a certain number of bytes to each packet. 
-    The MTU of the IPSec interface refers to the maximum size of the packet
-    before the IPSec headers are added. In some cases, people find it helpful 
-    to set ipsec0's MTU to 1500-(IPSec header size), which IIRC is about 1430.
-
-    That way, the resulting encapsulated packets don't exceed 1500. On most 
-    networks, packets less than 1500 will not need to be fragmented.
-
-and... (from Henry Spencer)
-
-    The way it *ought* to work is that the MTU advertised by the ipsecN
-    interface should be that of the underlying hardware interface, less a
-    pinch for the extra headers needed. 
-
-    Unfortunately, in certain situations this breaks many applications.
-    There is a widespread implicit assumption that the smallest MTUs are 
-    at the ends of paths, not in the middle, and another that MTUs are 
-    never less than 1500.  A lot of code is unprepared to handle paths 
-    where there is an &quot;interior minimum&quot; in the MTU, especially when it's 
-    less than 1500. So we advertise a big MTU and just let the resulting 
-    big packets fragment.
-
-This usually works, but we do get bitten in cases where some intermediate
-point can't handle all that fragmentation.  We can't win on this one.</PRE>
-<P>The MTU can be changed with an<VAR> overridemtu=</VAR> statement in
- the<VAR> config setup</VAR> section of<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf.5</A>.</P>
-<P>For a discussion of MTU issues and some possible solutions using
- Linux advanced routing facilities, see the<A href="http://www.linuxguruz.org/iptables/howto/2.4routing-15.html#ss15.6">
- Linux 2.4 Advanced Routing HOWTO</A>. For a discussion of MTU and NAT
- (Network Address Translation), see<A HREF="http://harlech.math.ucla.edu/services/ipsec.html">
- James Carter's MTU notes</A>.</P>
-<H2><A name="nat.background">Network address translation (NAT)</A></H2>
-<P><STRONG>N</STRONG>etwork<STRONG> A</STRONG>ddress<STRONG> T</STRONG>
-ranslation is a service provided by some gateway machines. Calling it
- NAPT (adding the word<STRONG> P</STRONG>ort) would be more precise, but
- we will follow the widespread usage.</P>
-<P>A gateway doing NAT rewrites the headers of packets it is forwarding,
- changing one or more of:</P>
-<UL>
-<LI>source address</LI>
-<LI>source port</LI>
-<LI>destination address</LI>
-<LI>destination port</LI>
-</UL>
-<P>On Linux 2.4, NAT services are provided by the<A href="http://netfilter.samba.org">
- netfilter(8)</A> firewall code. There are several<A href="http://netfilter.samba.org/documentation/index.html#HOWTO">
- Netfilter HowTos</A> including one on NAT.</P>
-<P>For older versions of Linux, this was referred to as &quot;IP masquerade&quot;
- and different tools were used. See this<A href="http://www.e-infomax.com/ipmasq/">
- resource page</A>.</P>
-<P>Putting an IPsec gateway behind a NAT gateway is not recommended. See
- our<A href="#NAT"> firewalls document</A>.</P>
-<H3><A NAME="17_3_1">NAT to non-routable addresses</A></H3>
-<P>The most common application of NAT uses private<A href="#non-routable">
- non-routable</A> addresses.</P>
-<P>Often a home or small office network will have:</P>
-<UL>
-<LI>one connection to the Internet</LI>
-<LI>one assigned publicly visible IP address</LI>
-<LI>several machines that all need access to the net</LI>
-</UL>
-<P>Of course this poses a problem since several machines cannot use one
- address. The best solution might be to obtain more addresses, but often
- this is impractical or uneconomical.</P>
-<P>A common solution is to have:</P>
-<UL>
-<LI><A href="#non-routable">non-routable</A> addresses on the local
- network</LI>
-<LI>the gateway machine doing NAT</LI>
-<LI>all packets going outside the LAN rewritten to have the gateway as
- their source address</LI>
-</UL>
-<P>The client machines are set up with reserved<A href="#non-routable">
- non-routable</A> IP addresses defined in RFC 1918. The masquerading
- gateway, the machine with the actual link to the Internet, rewrites
- packet headers so that all packets going onto the Internet appear to
- come from one IP address, that of its Internet interface. It then gets
- all the replies, does some table lookups and more header rewriting, and
- delivers the replies to the appropriate client machines.</P>
-<P>As far as anyone else on the Internet is concerned, the systems
- behind the gateway are completely hidden. Only one machine with one IP
- address is visible.</P>
-<P>For IPsec on such a gateway, you can entirely ignore the NAT in:</P>
-<UL>
-<LI><A href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A></LI>
-<LI>firewall rules affecting your Internet-side interface</LI>
-</UL>
-<P>Those can be set up exactly as they would be if your gateway had no
- other systems behind it.</P>
-<P>You do, however, have to take account of the NAT in firewall rules
- which affect packet forwarding.</P>
-<H3><A NAME="17_3_2">NAT to routable addresses</A></H3>
-<P>NAT to routable addresses is also possible, but is less common and
- may make for rather tricky routing problems. We will not discuss it
- here. See the<A href="http://netfilter.samba.org/documentation/index.html#HOWTO">
- Netfilter HowTos</A>.</P>
-<HR>
-<H1><A name="user.examples">FreeS/WAN script examples</A></H1>
- This file is intended to hold a collection of user-written example
- scripts or configuration files for use with FreeS/WAN.
-<P> So far it has only one entry.</P>
-<H2><A name="poltorak">Poltorak's Firewall script</A></H2>
-<PRE>
-From: Poltorak Serguei &lt;poltorak@dataforce.net&gt;
-Subject: [Users] Using FreeS/WAN
-Date: Tue, 16 Oct 2001
-
-Hello.
-
-I'm using FreeS/WAN IPsec for half a year. I learned a lot of things about
-it and I think it would be interesting for someone to see the result of my
-experiments and usage of FreeS/WAN. If you find a mistake in this
-file, please e-mail me. And excuse me for my english... I'm learning.. :)
-
-I'll talk about vary simple configuration:
-
-addresses prefix = 192.168
-
-    lan1          sgw1     .0.0/24 (Internet)       sgw2            lan2
-  .1.0/24---[ .1.1 ; .0.1 ]===================[ .0.10 ; . 2.10 ]---.2.0/24
-
-
-We need to let lan1 see lan2 across Internet like it is behind sgw1. The
-same for lan2. And we need to do IPX bridge for Novel Clients and NDS
-synchronization.
-
-my config:
-------------------- ipsec.conf -------------------
-conn lan1-lan2
-        type=tunnel
-        compress=yes
-        #-------------------
-        left=192.168.0.1
-        leftsubnet=192.168.1.0/24
-        #-------------------
-        right=192.168.0.10
-        rightsubnet=192.168.2.0/24
-        #-------------------
-        auth=esp
-        authby=secret
---------------- end of ipsec.conf ----------------
-
-ping .2.x from .1.y   (y != 1)
-It works?? Fine. Let's continue...
-
-Why y != 1 ?? Because kernel of sgw1 have 2 IP addresses and it will choose
-the first IP (which is used to go to Internet) .0.1 and the packet won't go
-through IPsec tunnel :(  But if do ping on .1.1 kernel will respond from
-that address (.1.1) and the packet will be tunneled. The same problem occurred then
-.2.x sends a packet to .1.2 which is down at the moment. What happens? .1.1
-sends ARP requesting .1.2... after 3 tries it send to .2.x an destunreach,
-but from his &quot;natural&quot; IP or .0.1 . So the error message won't be delivered!
-It's a big problem...
-
-Resolution... One can manipulate with ipsec0 or ipsec0:0 to solve the
-problem (if ipsec0 has .1.1 kernel will send packets correctly), but there
-are powerful and elegant iproute2 :) We simply need to change source address
-of packet that goes to other secure lan. This is done with
-
-ip route replace 192.168.2.0/24 via 192.168.0.10 dev ipsec0 src 192.168.1.1
-
-Cool!! Now it works!!
-
-The second step. We want install firewall on sgw1 and sgw2. Encryption of 
-traffic without security isn't a good idea. I don't use {left|right}firewall, 
-because I'm running firewall from init scripts.
-
-We want IPsec data between lan1-lan2, some ICMP errors (destination
-unreachable, TTL exceeded, parameter problem and source quench), replying on 
-pings from both lans and Internet, ipxtunnel data for IPX and of course SSH
-between sgw1 and sgw2 and from/to one specified host.
-
-I'm using ipchains. With iptables there are some changes.
-
----------------- rc.firewall ---------------------
-#!/bin/sh
-#
-# Firewall for IPsec lan1-lan2
-#
-
-IPC=/sbin/ipchains
-ANY=0.0.0.0/0
-
-# left
-SGW1_EXT=192.168.0.1
-SGW1_INT=192.168.1.1
-LAN1=192.168.1.0/24
-
-# right
-SGW2_EXT=192.168.0.10
-SGW2_INT=192.168.2.10
-LAN2=192.168.2.0/24
-
-# SSH from and to this host
-SSH_PEER_HOST=_SOME_HOST_
-
-# this is for left. exchange these values for right.
-MY_EXT=$SGW1_EXT
-MY_INT=$SGW1_INT
-PEER_EXT=$SGW2_EXT
-PEER_INT=$SGW2_INT
-INT_IF=eth1
-EXT_IF=eth0
-IPSEC_IF=ipsec0
-MY_LAN=$LAN1
-PEER_LAN=$LAN2
-
-$IPC -F
-$IPC -P input DENY
-$IPC -P forward DENY
-$IPC -P output DENY
-
-# Loopback traffic
-$IPC -A input -i lo -j ACCEPT
-$IPC -A output -i lo -j ACCEPT
-
-# for IPsec SGW1-SGW2
-## IKE
-$IPC -A input -p udp -s $PEER_EXT 500 -d $MY_EXT 500 -i $EXT_IF -j ACCEPT
-$IPC -A output -p udp -s $MY_EXT 500 -d $PEER_EXT 500 -i $EXT_IF -j ACCEPT
-## ESP
-$IPC -A input -p 50 -s $PEER_EXT -d $MY_EXT -i $EXT_IF -j ACCEPT
-### we don't need this line ### $IPC -A output -p 50 -s $MY_EXT -d $PEER_EXT -i $EXT_IF -j ACCEPT
-## forward LAN1-LAN2
-$IPC -A forward -s $MY_LAN -d $PEER_LAN -i $IPSEC_IF -j ACCEPT
-$IPC -A forward -s $PEER_LAN -d $MY_LAN -i $INT_IF -j ACCEPT
-$IPC -A output -s $PEER_LAN -d $MY_LAN -i $INT_IF -j ACCEPT
-$IPC -A input -s $PEER_LAN -d $MY_LAN -i $IPSEC_IF -j ACCEPT
-$IPC -A input -s $MY_LAN -d $PEER_LAN -i $INT_IF -j ACCEPT
-$IPC -A output -s $MY_LAN -d $PEER_LAN -i $IPSEC_IF -j ACCEPT
-
-# ICMP
-#
-## Dest unreachable
-### from/to Internet
-$IPC -A input -p icmp --icmp-type destination-unreachable -s $ANY -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type destination-unreachable -s $MY_EXT -d $ANY -i $EXT_IF -j ACCEPT
-### from/to Lan
-$IPC -A input -p icmp --icmp-type destination-unreachable -s $ANY -d $MY_INT -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type destination-unreachable -s $MY_INT -d $ANY -i $INT_IF -j ACCEPT
-### from/to Peer Lan
-$IPC -A input -p icmp --icmp-type destination-unreachable -s $ANY -d $MY_INT -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type destination-unreachable -s $MY_INT -d $ANY -i $IPSEC_IF -j ACCEPT
-#
-## Source quench
-### from/to Internet
-$IPC -A input -p icmp --icmp-type source-quench -s $ANY -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type source-quench -s $MY_EXT -d $ANY -i $EXT_IF -j ACCEPT
-### from/to Lan
-$IPC -A input -p icmp --icmp-type source-quench -s $ANY -d $MY_INT -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type source-quench -s $MY_INT -d $ANY -i $INT_IF -j ACCEPT
-### from/to Peer Lan
-$IPC -A input -p icmp --icmp-type source-quench -s $ANY -d $MY_INT -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type source-quench -s $MY_INT -d $ANY -i $IPSEC_IF -j ACCEPT
-#
-## Parameter problem
-### from/to Internet
-$IPC -A input -p icmp --icmp-type parameter-problem -s $ANY -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type parameter-problem -s $MY_EXT -d $ANY -i $EXT_IF -j ACCEPT
-### from/to Lan
-$IPC -A input -p icmp --icmp-type parameter-problem -s $ANY -d $MY_INT -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type parameter-problem -s $MY_INT -d $ANY -i $INT_IF -j ACCEPT
-### from/to Peer Lan
-$IPC -A input -p icmp --icmp-type parameter-problem -s $ANY -d $MY_INT -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type parameter-problem -s $MY_INT -d $ANY -i $IPSEC_IF -j ACCEPT
-#
-## Time To Live exceeded
-### from/to Internet
-$IPC -A input -p icmp --icmp-type time-exceeded -s $ANY -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type time-exceeded -s $MY_EXT -d $ANY -i $EXT_IF -j ACCEPT
-### to Lan
-$IPC -A input -p icmp --icmp-type time-exceeded -s $ANY -d $MY_INT -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type time-exceeded -s $MY_INT -d $ANY -i $INT_IF -j ACCEPT
-### to Peer Lan
-$IPC -A input -p icmp --icmp-type time-exceeded -s $ANY -d $MY_INT -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type time-exceeded -s $MY_INT -d $ANY -i $IPSEC_IF -j ACCEPT
-
-# ICMP PINGs
-## from Internet
-$IPC -A input -p icmp -s $ANY -d $MY_EXT --icmp-type echo-request  -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp -s $MY_EXT -d $ANY --icmp-type echo-reply  -i $EXT_IF -j ACCEPT
-## from LAN
-$IPC -A input -p icmp -s $ANY -d $MY_INT --icmp-type echo-request -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp -s $MY_INT -d $ANY --icmp-type echo-reply  -i $INT_IF -j ACCEPT
-## from Peer LAN
-$IPC -A input -p icmp -s $ANY -d $MY_INT --icmp-type echo-request -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp -s $MY_INT -d $ANY --icmp-type echo-reply  -i $IPSEC_IF -j ACCEPT
-
-# SSH
-## from SSH_PEER_HOST
-$IPC -A input -p tcp -s $SSH_PEER_HOST -d $MY_EXT 22 -i $EXT_IF -j ACCEPT
-$IPC -A output -p tcp \! -y -s $MY_EXT 22 -d $SSH_PEER_HOST -i $EXT_IF -j ACCEPT
-## to SSH_PEER_HOST
-$IPC -A input -p tcp \! -y -s $SSH_PEER_HOST 22 -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p tcp -s $MY_EXT -d $SSH_PEER_HOST 22 -i $EXT_IF -j ACCEPT
-## from PEER
-$IPC -A input -p tcp -s $PEER_EXT -d $MY_EXT 22 -i $EXT_IF -j ACCEPT
-$IPC -A output -p tcp \! -y -s $MY_EXT 22 -d $PEER_EXT -i $EXT_IF -j ACCEPT
-## to PEER
-$IPC -A input -p tcp \! -y -s $PEER_EXT 22 -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p tcp -s $MY_EXT -d $PEER_EXT 22 -i $EXT_IF -j ACCEPT
-
-# ipxtunnel
-$IPC -A input -p udp -s $PEER_INT 2005 -d $MY_INT 2005 -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p udp -s $MY_INT 2005 -d $PEER_INT 2005 -i $IPSEC_IF -j ACCEPT
-
----------------- end of rc.firewall ----------------------
-
-To understand this we need to look on this scheme:
-
-           ++-----------------------&lt;----------------------------+
-           || ipsec0                                             |
-           \/                                                    |
- eth0  +--------+    /---------/ yes  /---------/ yes +-----------------------+
-------&gt;| INPUT  |--&gt;/ ?local? /-----&gt;/ ?IPsec? /-----&gt;| decrypt decapsulate |
- eth1  +--------+  /---------/      /---------/       +-----------------------+
-                       || no            || no
-                       \/               \/
-                  +----------+      +---------+        +-------+
-                  | routing  |      |  local  |        | local |
-                  | decision |      | deliver |        | send  |
-                  +----------+      +---------+        +-------+
-                       ||                                 ||
-                       \/                                 \/
-                   +---------+                       +----------+
-                   | forward |                       | routing  |
-                   +---------+                       | decision |
-                       ||                            +----------+
-                       ||                                  ||
-                       ++----------------&lt;-----------------++
-                       ||
-                       \/
-                   +--------+ eth0
-                   | OUTPUT | eth1
-                   +--------+ ipsec0
-                       ||
-                       \/
-                   /---------/ yes +-----------------------+
-                  / ?IPsec? /-----&gt;| encrypt encapsulate |
-                 /---------/       +-----------------------+
-                      || no                    ||
-                      ||                       ||
-                      ||                       \/   eth0, eth1
-                      ++-----------------------++--------------&gt;
-
-This explain how a packet traverse TCP/IP stack in IPsec capable kernel.
-
-FIX ME, please, if there are any errors
-
-Test the new firewall now.
-
-
-Now about IPX. I tried 3 programs for tunneling IPX: tipxd, SIB and ipxtunnel
-
-tipxd didn't send packets.. :(
-SIB and ipxtunnel worked fine :)
-With ipxtunnel there was a little problem. In sources there are an error.
-
---------------------- in main.c ------------------------
-&lt;       bytes += p.len;
----
-&gt;       bytes += len;
---------------------------------------------------------
-
-After this FIX everything goes right...
-
-------------------- /etc/ipxtunnel.conf ----------------
-port    2005
-remote  192.168.101.97    2005
-interface eth1
---------------- end of /etc/ipxtunnel.conf -------------
-
-I use IPX tunnel between .1.1 and .2.10 so we don't need to encrypt nor
-authenticate encapsulated IPX packets, it is done with IPsec.
-
-If you don't wont to use iproute2 to change source IP you need to use SIB
-(it is able to bind local address) or establish tunnel between .0.1 and
-.0.10 (external IPs, you need to do encryption in the program, but it isn't
-strong).
-
-For now I'm using ipxtunnel.
-
-I think that's all for the moment. If there are any error, please e-mail me: 
-poltorak@df.ru . It would be cool if someone puts the scheme of TCP/IP in
-kernel and firewall example on FreeS/WAN's manual pages.
-
-PoltoS
-</PRE>
-<HR>
-<H1><A name="makecheck">How to configure to use &quot;make check&quot;</A></H1>
-<H2><A NAME="19_1">What is &quot;make check&quot;</A></H2>
-<P> &quot;make check&quot; is a target in the top level makefile. It takes care of
- running a number of unit and system tests to confirm that FreeSWAN has
- been compiled correctly, and that no new bugs have been introduced.</P>
-<P> As FreeSWAN contains both kernel and userspace components, doing
- testing of FreeSWAN requires that the kernel be simulated. This is
- typically difficult to do as a kernel requires that it be run on bare
- hardware. A technology has emerged that makes this simpler. This is<A HREF="http://user-mode-linux.sourceforge.net">
- User Mode Linux</A>.</P>
-<P> User-Mode Linux is a way to build a Linux kernel such that it can
- run as a process under another Linux (or in the future other) kernel.
- Presently, this can only be done for 2.4 guest kernels. The host kernel
- can be 2.2 or 2.4.</P>
-<P> &quot;make check&quot; expects to be able to build User-Mode Linux kernels
- with FreeSWAN included. To do this it needs to have some files
- downloaded and extracted prior to running &quot;make check&quot;. This is
- described in the<A HREF="umltesting.html"> UML testing</A> document.</P>
-<P> After having run the example in the UML testing document and
- successfully brought up the four machine combination, you are ready to
- use &quot;make check&quot;</P>
-<H2><A NAME="19_2">Running &quot;make check&quot;</A></H2>
-<P> &quot;make check&quot; works by walking the FreeSWAN source tree invoking the
- &quot;check&quot; target at each node. At present there are tests defined only
- for the <CODE>klips</CODE> directory. These tests will use the UML
- infrastructure to test out pieces of the <CODE>klips</CODE> code.</P>
-<P> The results of the tests can be recorded. If the environment
- variable <CODE>$REGRESSRESULTS</CODE> is non-null, then the results of
- each test will be recorded. This can be used as part of a nightly
- regression testing system, see<A HREF="nightly.html"> Nightly testing</A>
- for more details.</P>
-<P> &quot;make check&quot; otherwise prints a minimal amount of output for each
- test, and indicates pass/fail status of each test as they are run.
- Failed tests do not cause failure of the target in the form of exit
- codes.</P>
-<H1><A NAME="20">How to write a &quot;make check&quot; test</A></H1>
-<H2><A NAME="20_1">Structure of a test</A></H2>
-<P> Each test consists of a set of directories under <CODE>testing/</CODE>
-. There are directories for <CODE>klips</CODE>, <CODE>pluto</CODE>, <CODE>
-packaging</CODE> and <CODE>libraries</CODE>. Each directory has a list
- of tests to run is stored in a file called <CODE>TESTLIST</CODE> in
- that directory. e.g. <CODE>testing/klips/TESTLIST</CODE>.</P>
-<H2 NAME="TESTLIST"><A NAME="20_2">The TESTLIST</A></H2>
-<P> This isn't actually a shell script. It just looks like one. Some
- tools other than /bin/sh process it. Lines that start with # are
- comments.</P>
-<PRE>
-# test-kind     directory-containing-test       expectation     [PR#]
-</PRE>
-<P>The first word provides the test type, detailed below.</P>
-<P> The second word is the name of the test to run. This the directory
- in which the test case is to be found..</P>
-<P>The third word may be one of:</P>
-<DL>
-<DT> blank/good</DT>
-<DD>the test is believed to function, report failure</DD>
-<DT> bad</DT>
-<DD> the test is known to fail, report unexpected success</DD>
-<DT> suspended</DT>
-<DD> the test should not be run</DD>
-</DL>
-<P> The fourth word may be a number, which is a PR# if the test is
- failing.</P>
-<H2><A NAME="20_3">Test kinds</A></H2>
- The test types are:
-<DL>
-<DT>skiptest</DT>
-<DD>means run no test.</DD>
-<DT>ctltest</DT>
-<DD>means run a single system without input/output.</DD>
-<DT>klipstest</DT>
-<DD>means run a single system with input/output networks</DD>
-<DT><A HREF="#umlplutotest">umlplutotest</A></DT>
-<DD>means run a pair of systems</DD>
-<DT><A HREF="#umlXhost">umlXhost</A></DT>
-<DD>run an arbitrary number of systems</DD>
-<DT>suntest (TBD)</DT>
-<DD>means run a quad of east/west/sunrise/sunset</DD>
-<DT>roadtest (TBD)</DT>
-<DD>means run a trio of east-sunrise + warrior</DD>
-<DT>extrudedtest (TBD)</DT>
-<DD>means run a quad of east-sunrise + warriorsouth + park</DD>
-<DT>mkinsttest</DT>
-<DD>a test of the &quot;make install&quot; machinery.</DD>
-<DT>kernel_test_patch</DT>
-<DD>a test of the &quot;make kernelpatch&quot; machinery.</DD>
-</DL>
- Tests marked (TBD) have yet to be fully defined.
-<P> Each test directory has a file in it called <CODE>testparams.sh</CODE>
-. This file sets a number of environment variables to define the
- parameters of the test.</P>
-<H2><A NAME="20_4">Common parameters</A></H2>
-<DL>
-<DT>TESTNAME</DT>
-<DD>the name of the test (repeated for checking purposes)</DD>
-<DT>TEST_TYPE</DT>
-<DD>the type of the test (repeat of type type above)</DD>
-<DT>TESTHOST</DT>
-<DD>the name of the UML machine to run for the test, typically &quot;east&quot; or
- &quot;west&quot;</DD>
-<DT>TEST_PURPOSE</DT>
-<DD>The purpose of the test is one of:
-<DL>
-<DT>goal</DT>
-<DD>The goal purpose is where a test is defined for code that is not yet
- finished. The test indicates when the goals have in fact been reached.</DD>
-<DT>regress</DT>
-<DD>This is a test to determine that a previously existing bug has been
- repaired. This test will initially be created to reproduce the bug in
- isolation, and then the bug will be fixed.</DD>
-<DT>exploit</DT>
-<DD>This is a set of packets/programs that causes a vulnerability to be
- exposed. It is a specific variation of the regress option.</DD>
-</DL>
-</DD>
-<DT>TEST_GOAL_ITEM</DT>
-<DT></DT>
-<DD>in the case of a goal test, this is a reference to the requirements
- document</DD>
-<DT>TEST_PROB_REPORT</DT>
-<DD>in the case of regression test, this the problem report number from
- GNATS</DD>
-<DT>TEST_EXPLOIT_URL</DT>
-<DD>in the case of an exploit, this is a URL referencing the paper
- explaining the origin of the test and the origin of exploit software</DD>
-<DT>REF_CONSOLE_OUTPUT</DT>
-<DD>a file in the test directory that contains the sanitized console
- output against which to compare the output of the actual test.</DD>
-<DT>REF_CONSOLE_FIXUPS</DT>
-<DD>a list of scripts (found in <CODE>klips/test/fixups</CODE>) to apply
- to sanitize the console output of the machine under test. These are
- typically perl, awk or sed scripts that remove things in the kernel
- output that change each time the test is run and/or compiled.</DD>
-<DT>INIT_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode prior to starting the tests. This file will usually
- set up any eroute's and SADB entries that are required for the test.</P>
-<P>Lines beginning with # are skipped. Blank lines are skipped.
- Otherwise, a shell prompted is waited for each time (consisting of <CODE>
-\n#</CODE>) and then the command is sent. Note that the prompt is waited
- for before the command and not after, so completion of the last command
- in the script is not required. This is often used to invoke a program
- to monitor the system, e.g. <CODE>ipsec pf_key</CODE>.</P>
-</DD>
-<DT>RUN_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode, before the packets are sent. On single machine tests,
- this script doesn't provide any more power than INIT_SCRIPT, but is
- implemented for consistency's sake.</P>
-</DD>
-<DT>FINAL_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode after the final packet is sent. Similar to
- INIT_SCRIPT, above. If not specified, then the single command &quot;halt&quot; is
- sent. If specified, then the script should end with a halt command to
- nicely shutdown the UML.</P>
-</DD>
-<DT>CONSOLEDIFFDEBUG</DT>
-<DD>If set to &quot;true&quot; then the series of console fixups (see
- REF_CONSOLE_FIXUPS) will be output after it is constructed. (It should
- be set to &quot;false&quot;, or unset otherwise)</DD>
-<DT>NETJIGDEBUG</DT>
-<DD>If set to &quot;true&quot; then the series of console fixups (see
- REF_CONSOLE_FIXUPS) will be output after it is constructed. (It should
- be set to &quot;false&quot;, or unset otherwise)</DD>
-<DT>NETJIGTESTDEBUG</DT>
-<DD> If set to &quot;netjig&quot;, then the results of talking to the <CODE>
-uml_netjig</CODE> will be printed to stderr during the test. In
- addition, the jig will be invoked with --debug, which causes it to log
- its process ID, and wait 60 seconds before continuing. This can be used
- if you are trying to debug the <CODE>uml_netjig</CODE> program itself.</DD>
-<DT>HOSTTESTDEBUG</DT>
-<DD> If set to &quot;hosttest&quot;, then the results of taling to the consoles of
- the UMLs will be printed to stderr during the test.</DD>
-<DT>NETJIGWAITUSER</DT>
-<DD> If set to &quot;waituser&quot;, then the scripts will wait forever for user
- input before they shut the tests down. Use this is if you are debugging
- through the kernel.</DD>
-<DT>PACKETRATE</DT>
-<DD> A number, in miliseconds (default is 500ms) at which packets will
- be replayed by the netjig.</DD>
-</DL>
-<H2><A NAME="20_5">KLIPStest paramaters</A></H2>
-<P> The klipstest function starts a program (<CODE>
-testing/utils/uml_netjig/uml_netjig</CODE>) to setup a bunch of I/O
- sockets (that simulate network interfaces). It then exports the
- references to these sockets to the environment and invokes (using
- system()) a given script. It waits for the script to finish.</P>
-
-<!-- <IMG SRC="single_netjig.png" ALT="block diagram of uml_netjig"> -->
-<P> The script invoked (<CODE>testing/utils/host-test.tcl</CODE>) is a
- TCL<A HREF="http://expect.nist.gov/"> expect</A> script that arranges
- to start the UML and configure it appropriately for the test. The
- configuration is done with the script given above for<VAR> INIT_SCRIPT</VAR>
-. The TCL script then forks, leaves the UML in the background and exits.
- uml_netjig continues. It then starts listening to the simulated network
- answering ARPs and inserting packets as appropriate.</P>
-<P> The klipstest function invokes <CODE>uml_netjig</CODE> with
- arguments to capture output from network interface(s) and insert
- packets as appropriate:</P>
-<DL>
-<DT>PUB_INPUT</DT>
-<DD>a<A HREF="http://www.tcpdump.org/"> pcap</A> file to feed in on the
- public (encrypted) interface. (typically, eth1)</DD>
-<DT>PRIV_INPUT</DT>
-<DD>a pcap file to feed in on the private (plain-text) interface
- (typically, eth0).</DD>
-<DT>REF_PUB_OUTPUT</DT>
-<DD>a text file containing tcpdump output. Packets on the public (eth1)
- interface are captured to a<A HREF="http://www.tcpdump.org/"> pcap</A>
- file by <CODE>uml_netjig</CODE>. The klipstest function then uses
- tcpdump on the file to produce text output, which is compared to the
- file given.</DD>
-<DT>REF_PUB_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further
- processing. Defaults to &quot;cat&quot;.</DD>
-<DT>REF_PRIV_OUTPUT</DT>
-<DD>a text file containing tcpdump output. Packets on the private (eth0)
- interface are captured and compared after conversion by tcpdump, as
- with<VAR> REFPUBOUTPUT</VAR>.</DD>
-<DT>REF_PRIV_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further
- processing. Defaults to &quot;cat&quot;.</DD>
-<DT>EXITONEMPTY</DT>
-<DD>a flag for <CODE>uml_netjig</CODE>. It should contain
- &quot;--exitonempty&quot; of uml_netjig should exit when all of the input (<VAR>
-PUBINPUT</VAR>,<VAR>PRIVINPUT</VAR>) packets have been injected.</DD>
-<DT>ARPREPLY</DT>
-<DD>a flag for <CODE>uml_netjig</CODE>. It should contain &quot;--arpreply&quot;
- if <CODE>uml_netjig</CODE> should reply to ARP requests. One will
- typically set this to avoid having to fudge the ARP cache manually.</DD>
-<DT>TCPDUMPFLAGS</DT>
-<DD>a set of flags for the tcpdump used when converting captured output.
- Typical values will include &quot;-n&quot; to turn off DNS, and often &quot;-E&quot; to set
- the decryption key (tcpdump 3.7.1 and higher only) for ESP packets. The
- &quot;-t&quot; flag (turn off timestamps) is provided automatically</DD>
-<DT>NETJIG_EXTRA</DT>
-<DD>additional comments to be sent to the netjig. This may arrange to
- record or create additional networks, or may toggle options.</DD>
-</DL>
-<H2><A NAME="20_6">mkinsttest paramaters</A></H2>
-<P> The basic concept of the <CODE>mkinsttest</CODE> test type is that
- it performs a &quot;make install&quot; to a temporary $DESTDIR. The resulting
- tree can then be examined to determine if it was done properly. The
- files can be uninstalled to determine if the file list was correct, or
- the contents of files can be examined more precisely.</P>
-<DL>
-<DT>INSTALL_FLAGS</DT>
-<DD>If set, then an install will be done. This provides the set of flags
- to provide for the install. The target to be used (usually &quot;install&quot;)
- must be among the flags.</DD>
-<DT>POSTINSTALL_SCRIPT</DT>
-<DD>If set, a script to run after initial &quot;make install&quot;. Two arguments
- are provided: an absolute path to the root of the FreeSWAN src tree,
- and an absolute path to the temporary installation area.</DD>
-<DT>INSTALL2_FLAGS</DT>
-<DD>If set, a second install will be done using these flags. Similarly
- to INSTALL_FLAGS, the target must be among the flags.</DD>
-<DT>UNINSTALL_FLAGS</DT>
-<DD>If set, an uninstall will be done using these flags. Similarly to
- INSTALL_FLAGS, the target (usually &quot;uninstall&quot;) must be among the
- flags.</DD>
-<DT>REF_FIND_f_l_OUTPUT</DT>
-<DD>If set, a <CODE>find $ROOT ( -type f -or -type -l )</CODE> will be
- done to get a list of a real files and symlinks. The resulting file
- will be compared to the file listed by this option.</DD>
-<DT>REF_FILE_CONTENTS</DT>
-<DD>If set, it should point to a file containing records for the form:
-<PRE>
-  
-<!--VARIABLE-->
-reffile</(null)>   
-<!--VARIABLE-->
-samplefile</(null)>
-</PRE>
- one record per line. A diff between the provided reference file, and
- the sample file (located in the temporary installation root) will be
- done for each record.</DD>
-</DL>
-<H2><A NAME="20_7">rpm_build_install_test paramaters</A></H2>
-<P> The <CODE>rpm_build_install_test</CODE> type is to verify that the
- proper packing list is produced by &quot;make rpm&quot;, and that the mechanisms
- for building the kernel modules produce consistent results.</P>
-<DL>
-<DT>RPM_KERNEL_SOURCE</DT>
-<DD>Point to an extracted copy of the RedHat kernel source code.
- Variables from the environment may be used.</DD>
-<DT>REF_RPM_CONTENTS</DT>
-<DD>This is a file containing one record per line. Each record consists
- of a RPM name (may contain wildcards) and a filename to compare the
- contents to. The RPM will be located and a file list will be produced
- with rpm2cpio.</DD>
-</DL>
-<H2><A NAME="20_8">libtest paramaters</A></H2>
-<P> The libtest test is for testing library routines. The library file
- is expected to provided an <CODE>#ifdef</CODE> by the name of<VAR>
- library</VAR>
-<!--CODE_MAIN</CODE-->
-. The libtest type invokes the C compiler to compile this
- file, links it against <CODE>libfreeswan.a</CODE> (to resolve any other
- dependancies) and runs the test with the <CODE>-r</CODE> argument to
- invoke a regression test.</(null)></P>
-<P>The library test case is expected to do a self-test, exiting with
- status code 0 if everything is okay, and with non-zero otherwise. A
- core dump (exit code greater than 128) is noted specifically.</P>
-<P> Unlike other tests, there are no subdirectories required, or other
- parameters to set.</P>
-<H2 NAME="umlplutotest"><A NAME="20_9">umlplutotest paramaters</A></H2>
-<P> The umlplutotest function starts a pair of user mode line processes.
- This is a 2-host version of umlXhost. The &quot;EAST&quot; and &quot;WEST&quot; slots are
- defined.</P>
-<H2 NAME="umlXhost"><A NAME="20_10">umlXhost parameters</A></H2>
-<P> The umlXtest function starts an arbitrary number of user mode line
- processes.</P>
-
-<!-- <IMG SRC="single_netjig.png" ALT="block diagram of uml_netjig"> -->
-<P> The script invoked (<CODE>testing/utils/Xhost-test.tcl</CODE>) is a
- TCL<A HREF="http://expect.nist.gov/"> expect</A> script that arranges
- to start each UML and configure it appropriately for the test. It then
- starts listening (using uml_netjig) to the simulated network answering
- ARPs and inserting packets as appropriate.</P>
-<P> umlXtest has a series of slots, each of which should be filled by a
- host. The list of slots is controlled by the variable, XHOST_LIST. This
- variable should be set to a space seperated list of slots. The former
- umlplutotest is now implemented as a variation of the umlXhost test,
- with XHOST_LIST=&quot;EAST WEST&quot;.</P>
-<P> For each host slot that is defined, a series of variables should be
- filled in, defining what configuration scripts to use for that host.</P>
-<P> The following are used to control the console input and output to
- the system. Where the string ${host} is present, the host slot should
- be filled in. I.e. for the two host system with XHOST_LIST=&quot;EAST WEST&quot;,
- then the variables: EAST_INIT_SCRIPT and WEST_INIT_SCRIPT will exist.</P>
-<DL>
-<DT>${host}HOST</DT>
-<DD>The name of the UML host which will fill this slot</DD>
-<DT>${host}_INIT_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode prior to starting the tests. This file will usually
- set up any eroute's and SADB entries that are required for the test.
- Similar to INIT_SCRIPT, above.</P>
-</DD>
-<DT>${host}_RUN_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode, before the packets are sent. This set of commands is
- run after all of the virtual machines are initialized. I.e. after
- EAST_INIT_SCRIPT<B> AND</B> WEST_INIT_SCRIPT. This script can therefore
- do things that require that all machines are properly configured.</P>
-</DD>
-<DT>${host}_RUN2_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode, after the packets are sent. This set of commands is
- run before any of the virtual machines have been shut down. (I.e.
- before EAST_FINAL_SCRIPT<B> AND</B> WEST_FINAL_SCRIPT.) This script can
- therefore catch post-activity status reports.</P>
-</DD>
-<DT>${host}_FINAL_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode after the final packet is sent. Similar to
- INIT_SCRIPT, above. If not specified, then the single command &quot;halt&quot; is
- sent. Note that when this script is run, the other virtual machines may
- already have been killed. If specified, then the script should end with
- a halt command to nicely shutdown the UML.</P>
-</DD>
-<DT>REF_${host}_CONSOLE_OUTPUT</DT>
-<DD>Similar to REF_CONSOLE_OUTPUT, above.</DD>
-</DL>
-<P>Some additional flags apply to all hosts:</P>
-<DL>
-<DT>REF_CONSOLE_FIXUPS</DT>
-<DD>a list of scripts (found in <CODE>klips/test/fixups</CODE>) to apply
- to sanitize the console output of the machine under test. These are
- typically perl, awk or sed scripts that remove things in the kernel
- output that change each time the test is run and/or compiled.</DD>
-</DL>
-<P> In addition to input to the console, the networks may have input fed
- to them:</P>
-<DL>
-<DT>EAST_INPUT/WEST_INPUT</DT>
-<DD>a<A HREF="http://www.tcpdump.org/"> pcap</A> file to feed in on the
- private network side of each network. The &quot;EAST&quot; and &quot;WEST&quot; here refer
- to the networks, not the hosts.</DD>
-<DT>REF_PUB_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further
- processing. Defaults to &quot;cat&quot;.</DD>
-<DT>REF_EAST_FILTER/REF_WEST_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further
- processing. Defaults to &quot;cat&quot;.</DD>
-&lt;
-<DT>TCPDUMPFLAGS</DT>
-<DD>a set of flags for the tcpdump used when converting captured output.
- Typical values will include &quot;-n&quot; to turn off DNS, and often &quot;-E&quot; to set
- the decryption key (tcpdump 3.7.1 and higher only) for ESP packets. The
- &quot;-t&quot; flag (turn off timestamps) is provided automatically</DD>
-<DT>REF_EAST_OUTPUT/REF_WEST_OUTPUT</DT>
-<DD>a text file containing tcpdump output. Packets on the private (eth0)
- interface are captured and compared after conversion by tcpdump, as
- with<VAR> REF_PUB_OUTPUT</VAR>.</DD>
-<P> There are two additional environment variables that may be set on
- the command line:</P>
-<DL>
-<DT> NETJIGVERBOSE=verbose export NETJIGVERBOSE</DT>
-<DD> If set, then the test output will be &quot;chatty&quot;, and let you know
- what commands it is running, and as packets are sent. Without it set,
- the output is limited to success/failure messages.</DD>
-<DT> NETJIGTESTDEBUG=netjig export NETJIGTESTDEBUG</DT>
-<DD> This will enable debugging of the communication with uml_netjig,
- and turn on debugging in this utility. This does not imply
- NETJIGVERBOSE.</DD>
-</DL>
-<DT> HOSTTESTDEBUG=hosttest export HOSTTESTDEBUG</DT>
-<DD> This will show all interactions with the user-mode-linux consoles</DD>
-</DL>
-<H2 NAME="kernelpatch"><A NAME="20_11">kernel_patch_test paramaters</A></H2>
-<P> The kernel_patch_test function takes some kernel source, copies it
- with lndir, and then applies the patch as produced by &quot;make
- kernelpatch&quot;.</P>
-<P> The following are used to control the input and output to the
- system:</P>
-<DL>
-<DT>KERNEL_NAME</DT>
-<DD>the kernel name, typically something like &quot;linus&quot; or &quot;rh&quot;</DD>
-<DT>KERNEL_VERSION</DT>
-<DD>the kernel version number, as in &quot;2.2&quot; or &quot;2.4&quot;.</DD>
-<DT>KERNEL_${KERNEL_NAME}${KERNEL_VERSION}_SRC</DT>
-<DD>This variable should set in the environment, probably in
- ~/freeswan-regress-env.sh. Examples of this variables would be
- KERNEL_LINUS2_0_SRC or KERNEL_RH7_3_SRC. This variable should point to
- an extracted copy of the kernel source in question.</DD>
-<DT>REF_PATCH_OUTPUT</DT>
-<DD>a copy of the patch output to compare against</DD>
-<DT>KERNEL_PATCH_LEAVE_SOURCE</DT>
-<DD>If set to a non-empty string, then the patched kernel source is not
- removed at the end of the test. This will typically be set in the
- environment while debugging.</DD>
-</DL>
-<H2 NAME="modtest"><A NAME="20_12">module_compile paramaters</A></H2>
-<P> The module_compile test attempts to build the KLIPS module against a
- given set of kernel source. This is also done by the RPM tests, but in
- a very specific manner.</P>
-<P> There are two variations of this test - one where the kernel either
- doesn't need to be configured, or is already done, and tests were there
- is a local configuration file.</P>
-<P> Where the kernel doesn't need to be configured, the kernel source
- that is found is simply used. It may be a RedHat-style kernel, where
- one can cause it to configure itself via rhconfig.h-style definitions.
- Or, it may just be a kernel tree that has been configured.</P>
-<P> If the variable KERNEL_CONFIG_FILE is set, then a new directory is
- created for the kernel source. It is populated with lndir(1). The
- referenced file is then copied in as .config, and &quot;make oldconfig&quot; is
- used to configure the kernel. This resulting kernel is then used as the
- reference source.</P>
-<P> In all cases, the kernel source is found the same was for the
- kernelpatch test, i.e. via KERNEL_VERSION/KERNEL_NAME and
- KERNEL_${KERNEL_NAME}${KERNEL_VERSION}_SRC.</P>
-<P> Once there is kernel source, the module is compiled using the
- top-level &quot;make module&quot; target.</P>
-<P> The test is considered successful if an executable is found in
- OUTPUT/module/ipsec.o at the end of the test.</P>
-<DL>
-<DT>KERNEL_NAME</DT>
-<DD>the kernel name, typically something like &quot;linus&quot; or &quot;rh&quot;</DD>
-<DT>KERNEL_VERSION</DT>
-<DD>the kernel version number, as in &quot;2.2&quot; or &quot;2.4&quot;.</DD>
-<DT>KERNEL_${KERNEL_NAME}${KERNEL_VERSION}_SRC</DT>
-<DD>This variable should set in the environment, probably in
- ~/freeswan-regress-env.sh. Examples of this variables would be
- KERNEL_LINUS2_0_SRC or KERNEL_RH7_3_SRC. This variable should point to
- an extracted copy of the kernel source in question.</DD>
-<DT>KERNEL_CONFIG_FILE</DT>
-<DD>The configuration file for the kernel.</DD>
-<DT>KERNEL_PATCH_LEAVE_SOURCE</DT>
-<DD>If set to a non-empty string, then the configured kernel source is
- not removed at the end of the test. This will typically be set in the
- environment while debugging.</DD>
-<DT>MODULE_DEF_INCLUDE</DT>
-<DD>The include file that will be used to configure the KLIPS module,
- and possibly the kernel source.</DD>
-</DL>
-<H1><A NAME="21">Current pitfalls</A></H1>
-<DL>
-<DT> &quot;tcpdump dissector&quot; not available.</DT>
-<DD> This is a non-fatal warning. If uml_netjig is invoked with the -t
- option, then it will attempt to use tcpdump's dissector to decode each
- packet that it processes. The dissector is presently not available, so
- this option it normally turned off at compile time. The dissector
- library will be released with tcpdump version 4.0.</DD>
-</DL>
-<HR>
-<H1><A name="umltesting">User-Mode-Linux Testing guide</A></H1>
-<P> User mode linux is a way to compile a linux kernel such that it can
- run as a process in another linux system (potentially as a *BSD or
- Windows process later). See<A HREF="http://user-mode-linux.sourceforge.net/">
- http://user-mode-linux.sourceforge.net/</A></P>
-<P> UML is a good platform for testing and experimenting with FreeS/WAN.
- It allows several network nodes to be simulated on a single machine.
- Creating, configuring, installing, monitoring, and controling these
- nodes is generally easier and easier to script with UML than real
- hardware.</P>
-<P> You'll need about 500Mb of disk space for a full
- sunrise-east-west-sunset setup. You can possibly get this down by 130Mb
- if you remove the sunrise/sunset kernel build. If you just want to run,
- then you can even remove the east/west kernel build.</P>
-<P> Nothing need be done as super user. In a couple of steps, we note
- where super user is required to install commands in system-wide
- directories, but ~/bin could be used instead. UML seems to use a
- system-wide /tmp/uml directory so different users may interfere with
- one another. Later UMLs use ~/.uml instead, so multiple users running
- UML tests should not be a problem, but note that a single user running
- the UML tests will only be able run one set. Further, UMLs sometimes
- get stuck and hang around. These &quot;zombies&quot; (most will actually be in
- the &quot;T&quot; state in the process table) will interfere with subsequent
- tests.</P>
-<H2><A NAME="22_1">Preliminary Notes on BIND</A></H2>
-<P> As of 2003/3/1, the Light-Weight Resolver is used by pluto. This
- requires that BIND9 be running. It also requires that BIND9 development
- libraries be present in the build environment. The DNSSEC code is only
- truly functional in BIND9 snapshots. The library code could be 9.2.2,
- we believe. We are using BIND9 20021115 snapshot code from<A HREF="ftp://ftp.isc.org/isc/bind9/snapshots">
- ftp://ftp.isc.org/isc/bind9/snapshots</A>.</P>
-<P> FreeS/WAN may well require a newer BIND than is on your system. Many
- distributions have moved to BIND9.2.2 recently due to a security
- advisory. BIND is five components.</P>
-<OL>
-<LI> named</LI>
-<LI> dnssec-*</LI>
-<LI> client side resolver libraries</LI>
-<LI> client side utility libraries I thought there were lib and named
- parts to dnsssec...</LI>
-<LI> dynamic DNS update utilities</LI>
-</OL>
-<P> The only piece that we need for *building* is #4. That's the only
- part that has to be on the build host. What is the difference between
- resolver and util libs? If you want to edit
- testing/baseconfigs/all/etc/bind, you'll need a snapshot version. The
- resolver library contains the resolver. FreeS/WAN has its own copy of
- that in lib/liblwres.</P>
-<H2><A NAME="22_2">Steps to Install UML for FreeS/WAN</A></H2>
-<OL>
-<LI> Get the following files:
-<OL type="a">
-<LI> from<A HREF="http://www.sandelman.ottawa.on.ca/freeswan/uml/">
- http://www.sandelman.ottawa.on.ca/freeswan/uml/</A>
- umlfreeroot-15.1.tar.gz (or highest numbered one). This is a debian
- potato root file system. You can use this even on a Redhat host, as it
- has the newer GLIBC2.2 libraries as well.
-<!-- If you are using
-  Redhat 7.2 or newer as your development machine, you can create the
-  image from your installation media. See <A HREF="uml-rhroot.html">Building a RedHat root"></A>.
-  A future document will explain how to build this from .DEB files as well.
--->
-
-<!--
-<LI> umlfreesharemini.tar.gz    (or umlfreeshareall.tar.gz). 
-  If you are a Debian potato user, you don't need it you can use your
-  native /usr/share.
-</UL>
--->
-</LI>
-<LI> From<A HREF="ftp://ftp.xs4all.nl/pub/crypto/freeswan/">
- ftp://ftp.xs4all.nl/pub/crypto/freeswan/</A> a snapshot or release
- (1.92 or better)</LI>
-<LI> From a<A HREF="http://www.kernel.org/mirrors/">
- http://www.kernel.org mirror</A>, the virgin 2.4.19 kernel. Please
- realize that we have defaults in our tree for kernel configuration. We
- try to track the latest UML kernels. If you use a newer kernel, you may
- have faults in the kernel build process. You can see what the latest
- that is being regularly tested by visiting<A HREF="http://bugs.freeswan.org:81/regress/HEAD/lastgood/freeswan-regress-env.sh">
- freeswan-regress-env.sh</A>.</LI>
-<LI>
-<!-- Note: this step is refered to as "step 1d" below. -->
- Get<A HREF="http://ftp.nl.linux.org/uml/">
- http://ftp.nl.linux.org/uml/</A> uml-patch-2.4.19-47.bz2 or the one
- associated with your kernel. As of 2003/03/05, uml-patch-2.4.19-47.bz2
- works for us.<STRONG> More recent versions of the patch have not been
- tested by us.</STRONG></LI>
-<LI> You'll probably want to visit<A HREF="http://user-mode-linux.sourceforge.net">
- http://user-mode-linux.sourceforge.net</A> and get the UML utilities.
- These are not needed for the build or interactive use (but
- recommended). They are necessary for the regression testing procedures
- used by &quot;make check&quot;. We currently use uml_utilities_20020212.tar.bz2.</LI>
-<LI> You need tcpdump version 3.7.1 or better. This is newer than the
- version included in most LINUX distributions. You can check the version
- of an installed tcpdump with the --version flag. If you need a newer
- tcpdump fetch both tcpdump and libpcap source tar files from<A HREF="http://www.tcpdump.org/">
- http://www.tcpdump.org/</A> or a mirror.</LI>
-</OL>
-</LI>
-<LI> Pick a suitable place, and extract the following files:
-<OL type="a">
-<LI>
-<!-- Note: this step is refered to as "step 2a" later. -->
- 2.4.19 kernel. For instance:
-<PRE>
- <CODE>           cd /c2/kernel
-           tar xzvf ../download/pub/linux/kernel/v2.4/linux-2.4.19.tar.gz
-</CODE>
-</PRE>
-</LI>
-<LI> extract the umlfreeroot file
-<!-- (unless you <A HREF="uml-rhroot.html">built your own from RPMs</A>) -->
-
-<PRE>
- <CODE>           mkdir -p /c2/user-mode-linux/basic-root
-           cd /c2/user-mode-linux/basic-root
-           tar xzvf ../download/umlfreeroot-15.1.tar.gz
-</CODE>
-</PRE>
-</LI>
-<LI> FreeSWAN itself (or checkout &quot;all&quot; from CVS)
-<PRE>
- <CODE>           mkdir -p /c2/freeswan/sandbox
-           cd /c2/freeswan/sandbox
-           tar xzvf ../download/snapshot.tar.gz
-</CODE>
-</PRE>
-</LI>
-</OL>
-</LI>
-<LI> If you need to build a newer tcpdump:
-<UL>
-<LI> Make sure you have OpenSSL installed -- it is needed for
- cryptographic routines.</LI>
-<LI> Unpack libpcap and tcpdump source in parallel directories (the
- tcpdump build procedures look for libpcap next door).</LI>
-<LI> Change directory into the libpcap source directory and then build
- the library:
-<PRE>
- <CODE>	./configure
-	make
-</CODE>
-</PRE>
-</LI>
-<LI> Change into the tcpdump source directory, build tcpdump, and
- install it.
-<PRE>
- <CODE>	./configure
-	make
-	# Need to be superuser to install in system directories.
-	# Installing in ~/bin would be an alternative.
-	su -c &quot;make install&quot;
-</CODE>
-</PRE>
-</LI>
-</UL>
-</LI>
-<LI> If you need the uml utilities, unpack them somewhere then build and
- install them:
-<PRE>
- <CODE>	cd tools
-	make all
-	# Need to be superuser to install in system directories.
-	# Installing in ~/bin would be an alternative.
-	su -c &quot;make install BIN_DIR=/usr/local/bin&quot;
-</CODE>
-</PRE>
-</LI>
-<LI> set up the configuration file
-<UL>
-<LI> <CODE>cd /c2/freeswan/sandbox/freeswan-1.97/testing/utils</CODE></LI>
-<LI> copy umlsetup-sample.sh to ../../umlsetup.sh: <CODE> cp
- umlsetup-sample.sh ../../umlsetup.sh</CODE></LI>
-<LI> open up ../../umlsetup.sh in your favorite editor.</LI>
-<LI> change POOLSPACE= to point to the place with at least 500Mb of
- disk. Best if it is on the same partition as the &quot;umlfreeroot&quot;
- extraction, as it will attempt to use hard links if possible to save
- disk space.</LI>
-<LI> Set TESTINGROOT if you intend to run the script outside of the
- sandbox/snapshot/release directory. Otherwise, it will configure
- itself.</LI>
-<LI> KERNPOOL should point to the directory with your 2.4.19 kernel
- tree. This tree should be unconfigured! This is the directory you used
- in step 2a.</LI>
-<LI> UMLPATCH should point at the bz2 file you downloaded at 1d. If
- using a kernel that already includes the patch, set this to /dev/null.</LI>
-<LI> FREESWANDIR should point at the directory where you unpacked the
- snapshot/release. Include the &quot;freeswan-snap2001sep16b&quot; or whatever in
- it. If you are running from CVS, then you point at the directory where
- top, klips, etc. are. The script will fix up the directory so that it
- can be used.</LI>
-<LI> BASICROOT should be set to the directory used in 2b, or to the
- directory that you created with RPMs.</LI>
-<LI> SHAREDIR should be set to the directory used in 2c, to /usr/share
- for Debian potato users, or to $BASICROOT/usr/share.</LI>
-</UL>
-</LI>
-<LI>
-<PRE> <CODE>cd $TESTINGROOT/utils
-sh make-uml.sh
-</CODE></PRE>
- It will grind for awhile. If there are errors it will bail. If so, run
- it under &quot;script&quot; and send the output to bugs@lists.freeswan.org.</LI>
-<LI> You will have a bunch of stuff under $POOLSPACE. Open four xterms:
-<PRE> <CODE>    for i in sunrise sunset east west
-    do
-        xterm -name $i -title $i -e $POOLSPACE/$i/start.sh     done
-</CODE></PRE>
-</LI>
-<LI> Login as root. Password is &quot;root&quot; (Note, these virtual machines are
- networked together, but are not configured to talk to the rest of the
- world.)</LI>
-<LI> verify that pluto started on east/west, run &quot;ipsec look&quot;</LI>
-<LI> login to sunrise. run &quot;ping sunset&quot;</LI>
-<LI> login to west. run &quot;tcpdump -p -i eth1 -n&quot; (tcpdump must be version
- 3.7.1 or newer)</LI>
-<LI> Closing a console xterm will shut down that UML.</LI>
-<LI> You can &quot;make check&quot;, if you want to. It is run from
- /c2/freeswan/sandbox/freeswan-1.97.</LI>
-</OL>
-<H1><A NAME="23">Debugging the kernel with GDB</A></H1>
-<P> With User-Mode-Linux, you can debug the kernel using GDB. See
-<!--HREF="http://user-mode-linux.sourceforge.net/debugging.html"-->
-
- http://user-mode-linux.sourceforge.net/debugging.html.</(null)></P>
-<P> Typically, one will want to address a test case for a failing
- situation. Running GDB from Emacs, or from other front ends is
- possible. First start GDB.</P>
-<P> Tell it to open the UMLPOOL/swan/linux program.</P>
-<P> Note the PID of GDB:</P>
-<PRE>
-marajade-[projects/freeswan/mgmt/planning] mcr 1029 %ps ax | grep gdb
- 1659 pts/9    SN     0:00 /usr/bin/gdb -fullname -cd /mara4/freeswan/kernpatch/UMLPOOL/swan/ linux
-</PRE>
-<P> Set the following in the environment:</P>
-<PRE>
-UML_east_OPT=&quot;debug gdb-pid=1659&quot;
-</PRE>
-<P> Then start the user-mode-linux in the test scheme you wish:</P>
-<PRE>
-marajade-[kernpatch/testing/klips/east-icmp-02] mcr 1220 %../../utils/runme.sh
-</PRE>
- The user-mode-linux will stop on boot, giving you a chance to attach to
- the process:
-<PRE>
-(gdb) file linux
-Reading symbols from linux...done.
-(gdb) attach 1
-Attaching to program: /mara4/freeswan/kernpatch/UMLPOOL/swan/linux, process 1
-0xa0118bc1 in kill () at hostfs_kern.c:770
-</PRE>
-<P> At this point, break points should be created as appropriate.</P>
-<H2><A NAME="23_1">Other notes about debugging</A></H2>
-<P> If you are running a standard test, after all the packets are sent,
- the UML will be shutdown. This can cause problems, because the UML may
- get terminated while you are debugging.</P>
-<P> The environment variable <CODE>NETJIGWAITUSER</CODE> can be set to
- &quot;waituser&quot;. If so, then the testing system will prompt before exiting
- the test.</P>
-<H1><A NAME="24">User-Mode-Linux mysteries</A></H1>
-<UL>
-<LI> running more than one UML of the same name (e.g. &quot;west&quot;) can cause
- problems.</LI>
-<LI> running more than one UML from the same root file system is not a
- good idea.</LI>
-<LI> all this means that running &quot;make check&quot; twice on the same machine
- is probably not a good idea.</LI>
-<LI> occationally, UMLs will get stuck. This can happen like:
-<!--BLOCK-->
- 15134 ? T
- 0:00 /spare/hugh/uml/uml2.4.18-sept5/umlbuild/east/linux (east)
- [/bin/sh] 15138 ? T 0:00
- /spare/hugh/uml/uml2.4.18-sept5/umlbuild/east/linux (east) [halt]</(null)>
- these will need to be killed. Note that they are in &quot;T&quot;racing mode.</LI>
-<LI> UMLs can also hang, and will report &quot;Tracing myself and I can't get
- out&quot;. This is a bug in UML. There are ways to find out what is going on
- and report this to the UML people, but we don't know the magic right
- now.</LI>
-</UL>
-<H1><A NAME="25">Getting more info from uml_netjig</A></H1>
-<P> uml_netjig can be compiled with a built-in tcpdump. This uses
- not-yet-released code from<A HREF="http://www.tcpdump.org/">
- www.tcpdump.org</A>. Please see the instructions in <CODE>
-testing/utils/uml_netjig/Makefile</CODE>.</P>
-<HR>
-<H1><A name="politics">History and politics of cryptography</A></H1>
-<P>Cryptography has a long and interesting history, and has been the
- subject of considerable political controversy.</P>
-<H2><A name="intro.politics">Introduction</A></H2>
-<H3><A NAME="26_1_1">History</A></H3>
-<P>The classic book on the history of cryptography is David Kahn's<A href="#Kahn">
- The Codebreakers</A>. It traces codes and codebreaking from ancient
- Egypt to the 20th century.</P>
-<P>Diffie and Landau<A href="#diffie"> Privacy on the Line: The Politics
- of Wiretapping and Encryption</A> covers the history from the First
- World War to the 1990s, with an emphasis on the US.</P>
-<H4><A NAME="26_1_1_1">World War II</A></H4>
-<P>During the Second World War, the British &quot;Ultra&quot; project achieved one
- of the greatest intelligence triumphs in the history of warfare,
- breaking many Axis codes. One major target was the Enigma cipher
- machine, a German device whose users were convinced it was unbreakable.
- The American &quot;Magic&quot; project had some similar triumphs against Japanese
- codes.</P>
-<P>There are many books on this period. See our bibliography for
- several. Two I particularly like are:</P>
-<UL>
-<LI>Andrew Hodges has done a superb<A href="http://www.turing.org.uk/book/">
- biography</A> of Alan Turing, a key player among the Ultra
- codebreakers. Turing was also an important computer pioneer. The terms<A
-href="http://www.abelard.org/turpap/turpap.htm"> Turing test</A> and<A href="http://plato.stanford.edu/entries/turing-machine/">
- Turing machine</A> are named for him, as is the<A href="http://www.acm.org">
- ACM</A>'s highest technical<A href="http://www.acm.org/awards/taward.html">
- award</A>.</LI>
-<LI>Neal Stephenson's<A href="#neal"> Cryptonomicon</A> is a novel with
- cryptography central to the plot. Parts of it take place during WW II,
- other parts today.</LI>
-</UL>
-<P>Bletchley Park, where much of the Ultra work was done, now has a
- museum and a<A href="http://www.bletchleypark.org.uk/"> web site</A>.</P>
-<P>The Ultra work introduced three major innovations.</P>
-<UL>
-<LI>The first break of Enigma was achieved by Polish Intelligence in
- 1931. Until then most code-breakers had been linguists, but a different
- approach was needed to break machine ciphers. Polish Intelligence
- recruited bright young mathematicians to crack the &quot;unbreakable&quot;
- Enigma. When war came in 1939, the Poles told their allies about this,
- putting Britain on the road to Ultra. The British also adopted a
- mathematical approach.</LI>
-<LI>Machines were extensively used in the attacks. First the Polish
- &quot;Bombe&quot; for attacking Enigma, then British versions of it, then
- machines such as Collosus for attacking other codes. By the end of the
- war, some of these machines were beginning to closely resemble digital
- computers. After the war, a team at Manchester University, several old
- Ultra hands included, built one of the world's first actual
- general-purpose digital computers.</LI>
-<LI>Ultra made codebreaking a large-scale enterprise, producing
- intelligence on an industrial scale. This was not a &quot;black chamber&quot;,
- not a hidden room in some obscure government building with a small crew
- of code-breakers. The whole operation -- from wholesale interception of
- enemy communications by stations around the world, through large-scale
- code-breaking and analysis of the decrypted material (with an enormous
- set of files for cross-referencing), to delivery of intelligence to
- field commanders -- was huge, and very carefully managed.</LI>
-</UL>
-<P>So by the end of the war, Allied code-breakers were expert at
- large-scale mechanised code-breaking. The payoffs were enormous.</P>
-<H4><A name="postwar">Postwar and Cold War</A></H4>
-<P>The wartime innovations were enthusiastically adopted by post-war and
- Cold War signals intelligence agencies. Presumably many nations now
- have some agency capable of sophisticated attacks on communications
- security, and quite a few engage in such activity on a large scale.</P>
-<P>America's<A href="#NSA"> NSA</A>, for example, is said to be both the
- world's largest employer of mathematicians and the world's largest
- purchaser of computer equipment. Such claims may be somewhat
- exaggerated, but beyond doubt the NSA -- and similar agencies in other
- countries -- have some excellent mathematicians, lots of powerful
- computers, sophisticated software, and the organisation and funding to
- apply them on a large scale. Details of the NSA budget are secret, but
- there are some published<A href="http://www.fas.org/irp/nsa/nsabudget.html">
- estimates</A>.</P>
-<P>Changes in the world's communications systems since WW II have
- provided these agencies with new targets. Cracking the codes used on an
- enemy's military or diplomatic communications has been common practice
- for centuries. Extensive use of radio in war made large-scale attacks
- such as Ultra possible. Modern communications make it possible to go
- far beyond that. Consider listening in on cell phones, or intercepting
- electronic mail, or tapping into the huge volumes of data on new media
- such as fiber optics or satellite links. None of these targets existed
- in 1950. All of them can be attacked today, and almost certainly are
- being attacked.</P>
-<P>The Ultra story was not made public until the 1970s. Much of the
- recent history of codes and code-breaking has not been made public, and
- some of it may never be. Two important books are:</P>
-<UL>
-<LI>Bamford's<A href="#puzzle"> The Puzzle Palace</A>, a history of the
- NSA</LI>
-<LI>Hager's<A href="http://www.fas.org/irp/eprint/sp/index.html"> Secret
- Power</A>, about the<A href="http://sg.yahoo.com/government/intelligence/echelon_network/">
- Echelon</A> system -- the US, UK, Canada, Australia and New Zealand
- co-operating to monitor much of the world's communications.</LI>
-</UL>
-<P>Note that these books cover only part of what is actually going on,
- and then only the activities of nations open and democratic enough that
- (some of) what they are doing can be discovered. A full picture,
- including:</P>
-<UL>
-<LI>actions of the English-speaking democracies not covered in those
- books</LI>
-<LI>actions of other more-or-less sane governments</LI>
-<LI>the activities of various more-or-less insane governments</LI>
-<LI>possibilities for unauthorized action by government employees</LI>
-<LI>possible actions by large non-government organisations:
- corporations, criminals, or conspiracies</LI>
-</UL>
-<P>might be really frightening.</P>
-<H4><A name="recent">Recent history -- the crypto wars</A></H4>
-<P>Until quite recently, cryptography was primarily a concern of
- governments, especially of the military, of spies, and of diplomats.
- Much of it was extremely secret.</P>
-<P>In recent years, that has changed a great deal. With computers and
- networking becoming ubiquitous, cryptography is now important to almost
- everyone. Among the developments since the 1970s:</P>
-<UL>
-<LI>The US gov't established the Data Encryption Standard,<A href="#DES">
- DES</A>, a<A href="#block"> block cipher</A> for cryptographic
- protection of unclassfied documents.</LI>
-<LI>DES also became widely used in industry, especially regulated
- industries such as banking.</LI>
-<LI>Other nations produced their own standards, such as<A href="glossary.html#GOST">
- GOST</A> in the Soviet Union.</LI>
-<LI><A href="#public">Public key</A> cryptography was invented by Diffie
- and Hellman.</LI>
-<LI>Academic conferences such as<A href="http://www-cse.ucsd.edu/users/mihir/crypto2k.html">
- Crypto</A> and<A href="http://www.esat.kuleuven.ac.be/cosic/eurocrypt2000/">
- Eurocrypt</A> began.</LI>
-<LI>Several companies began offerring cryptographic products:<A href="#RSAco">
- RSA</A>,<A href="#PGPI"> PGP</A>, the many vendors with<A href="#PKI">
- PKI</A> products, ...</LI>
-<LI>Cryptography appeared in other products: operating systems, word
- processors, ...</LI>
-<LI>Network protocols based on crypto were developed:<A href="#ssh"> SSH</A>
-,<A href="#SSL"> SSL</A>,<A href="#IPSEC"> IPsec</A>, ...</LI>
-<LI>Crytography came into widespread use to secure bank cards,
- terminals, ...</LI>
-<LI>The US government replaced<A href="#DES"> DES</A> with the much
- stronger Advanced Encryption Standard,<A href="#AES"> AES</A></LI>
-</UL>
-<P>This has led to a complex ongoing battle between various mainly
- government groups wanting to control the spread of crypto and various
- others, notably the computer industry and the<A href="http://online.offshore.com.ai/security/">
- cypherpunk</A> crypto advocates, wanting to encourage widespread use.</P>
-<P>Steven Levy has written a fine history of much of this, called<A href="#crypto">
- Crypto: How the Code rebels Beat the Government -- Saving Privacy in
- the Digital Age</A>.</P>
-<P>The FreeS/WAN project is to a large extent an outgrowth of cypherpunk
- ideas. Our reasons for doing the project can be seen in these quotes
- from the<A href="http://www.eff.org/pub/Privacy/Crypto_misc/cypherpunk.manifesto">
- Cypherpunk Manifesto</A>:</P>
-<BLOCKQUOTE> Privacy is necessary for an open society in the electronic
- age. ...
-<P>We cannot expect governments, corporations, or other large, faceless
- organizations to grant us privacy out of their beneficence. It is to
- their advantage to speak of us, and we should expect that they will
- speak. ...</P>
-<P>We must defend our own privacy if we expect to have any. ...</P>
-<P>Cypherpunks write code. We know that someone has to write software to
- defend privacy, and since we can't get privacy unless we all do, we're
- going to write it. We publish our code so that our fellow Cypherpunks
- may practice and play with it. Our code is free for all to use,
- worldwide. We don't much care if you don't approve of the software we
- write. We know that software can't be destroyed and that a widely
- dispersed system can't be shut down.</P>
-<P>Cypherpunks deplore regulations on cryptography, for encryption is
- fundamentally a private act. ...</P>
-<P>For privacy to be widespread it must be part of a social contract.
- People must come and together deploy these systems for the common good.
- ...</P>
-</BLOCKQUOTE>
-<P>To quote project leader John Gilmore:</P>
-<BLOCKQUOTE> We are literally in a race between our ability to build and
- deploy technology, and their ability to build and deploy laws and
- treaties. Neither side is likely to back down or wise up until it has
- definitively lost the race.</BLOCKQUOTE>
-<P>If FreeS/WAN reaches its goal of making<A href="#opp.intro">
- opportunistic encryption</A> widespread so that secure communication
- can become the default for a large part of the net, we will have struck
- a major blow.</P>
-<H3><A name="intro.poli">Politics</A></H3>
-<P>The political problem is that nearly all governments want to monitor
- their enemies' communications, and some want to monitor their citizens.
- They may be very interested in protecting some of their own
- communications, and often some types of business communication, but not
- in having everyone able to communicate securely. They therefore attempt
- to restrict availability of strong cryptography as much as possible.</P>
-<P>Things various governments have tried or are trying include:</P>
-<UL>
-<LI>Echelon, a monitor-the-world project of the US, UK, NZ, Australian
- and Canadian<A href="#SIGINT"> signals intelligence</A> agencies. See
- this<A href="http://sg.yahoo.com/government/intelligence/echelon_network/">
- collection</A> of links and this<A href="http://www.zdnet.com/zdnn/stories/news/0,4586,2640682,00.html">
- story</A> on the French Parliament's reaction.</LI>
-<LI>Others governments may well have their own Echelon-like projects. To
- quote the Dutch Minister of Defense, as reported in a German<A href="http://www.heise.de/tp/english/inhalt/te/4729/1.html">
- magazine</A>:<BLOCKQUOTE> The government believes not only the
- governments associated with Echelon are able to intercept communication
- systems, but that it is an activity of the investigative authorities
- and intelligence services of many countries with governments of
- different political signature.</BLOCKQUOTE> Even if they have nothing
- on the scale of Echelon, most intelligence agencies and police forces
- certainly have some interception capability.</LI>
-<LI><A href="#NSA">NSA</A> tapping of submarine communication cables,
- described in<A href="http://www.zdnet.com/zdnn/stories/news/0,4586,2764372,00.html">
- this article</A></LI>
-<LI>A proposal for international co-operation on<A href="http://www.heise.de/tp/english/special/enfo/4306/1.html">
- Internet surveillance</A>.</LI>
-<LI>Alleged<A href="http://cryptome.org/nsa-sabotage.htm"> sabotage</A>
- of security products by the<A href="#NSA"> NSA</A> (the US signals
- intelligence agency).</LI>
-<LI>The German armed forces and some government departments will stop
- using American software for fear of NSA &quot;back doors&quot;, according to this<A
-href="http://www.theregister.co.uk/content/4/17679.html"> news story</A>
-.</LI>
-<LI>The British Regulation of Investigatory Powers bill. See this<A href="http://www.fipr.org/rip/index.html">
- web page.</A> and perhaps this<A href="http://ars.userfriendly.org/cartoons/?id=20000806&amp;mode=classic">
- cartoon</A>.</LI>
-<LI>A Russian<A href="http://www.eff.org/pub/Privacy/Foreign_and_local/Russia/russian_crypto_ban_english.edict">
- ban</A> on cryptography</LI>
-<LI>Chinese<A href="http://www.eff.org/pub/Misc/Publications/Declan_McCullagh/www/global/china">
- controls</A> on net use.</LI>
-<LI>The FBI's carnivore system for covert searches of email. See this<A href="http://www.zdnet.com/zdnn/stories/news/0,4586,2601502,00.html">
- news coverage</A> and this<A href="http://www.crypto.com/papers/carnivore-risks.html">
- risk assessment</A>. The government had an external review of some
- aspects of this system done. See this<A href="http://www.crypto.com/papers/carnivore_report_comments.html">
- analysis</A> of that review. Possible defenses against Carnivore
- include:
-<UL>
-<LI><A href="#PGP">PGP</A> for end-to-end mail encryption</LI>
-<LI><A href="http://www.home.aone.net.au/qualcomm/">secure sendmail</A>
- for server-to-server encryption</LI>
-<LI>IPsec encryption on the underlying IP network</LI>
-</UL>
-</LI>
-<LI>export laws restricting strong cryptography as a munition. See<A href="#exlaw">
- discussion</A> below.</LI>
-<LI>various attempts to convince people that fundamentally flawed
- cryptography, such as encryption with a<A href="#escrow"> back door</A>
- for government access to data or with<A href="#shortkeys"> inadequate
- key lengths</A>, was adequate for their needs.</LI>
-</UL>
-<P>Of course governments are by no means the only threat to privacy and
- security on the net. Other threats include:</P>
-<UL>
-<LI>industrial espionage, as for example in this<A href="http://www.zdnet.com/zdnn/stories/news/0,4586,2626931,00.html">
- news story</A></LI>
-<LI>attacks by organised criminals, as in this<A href="http://www.sans.org/newlook/alerts/NTE-bank.htm">
- large-scale attack</A></LI>
-<LI>collection of personal data by various companies.
-<UL>
-<LI>for example, consider the various corporate winners of Privacy
- International's<A href="http://www.privacyinternational.org/bigbrother/">
- Big Brother Awards</A>.</LI>
-<LI><A href="http://www.zeroknowledge.com">Zero Knowledge</A> sell tools
- to defend against this</LI>
-</UL>
-</LI>
-<LI>individuals may also be a threat in a variety of ways and for a
- variety of reasons</LI>
-<LI>in particular, an individual with access to government or industry
- data collections could do considerable damage using that data in
- unauthorized ways.</LI>
-</UL>
-<P>One<A href="http://www.zdnet.com/zdnn/stories/news/0,4586,2640674,00.html">
- study</A> enumerates threats and possible responses for small and
- medium businesses. VPNs are a key part of the suggested strategy.</P>
-<P>We consider privacy a human right. See the UN's<A href="http://www.un.org/Overview/rights.html">
- Universal Declaration of Human Rights</A>, article twelve:</P>
-<BLOCKQUOTE> No one shall be subjected to arbitrary interference with
- his privacy, family, home or correspondence, nor to attacks upon his
- honor and reputation. Everyone has the right to the protection of the
- law against such interference or attacks.</BLOCKQUOTE>
-<P>Our objective is to help make privacy possible on the Internet using
- cryptography strong enough not even those well-funded government
- agencies are likely to break it. If we can do that, the chances of
- anyone else breaking it are negliible.</P>
-<H3><A NAME="26_1_3">Links</A></H3>
-<P>Many groups are working in different ways to defend privacy on the
- net and elsewhere. Please consider contributing to one or more of these
- groups:</P>
-<UL>
-<LI>the EFF's<A href="http://www.eff.org/crypto/"> Privacy Now!</A>
- campaign</LI>
-<LI>the<A href="http://www.gilc.org"> Global Internet Liberty Campaign</A>
-</LI>
-<LI><A href="http://www.cpsr.org/program/privacy/privacy.html">Computer
- Professionals for Social Responsibility</A></LI>
-</UL>
-<P>For more on these issues see:</P>
-<UL>
-<LI>Steven Levy (Newsweek's chief technology writer and author of the
- classic &quot;Hackers&quot;) new book<A href="#crypto"> Crypto: How the Code
- Rebels Beat the Government--Saving Privacy in the Digital Age</A></LI>
-<LI>Simson Garfinkel (Boston Globe columnist and author of books on<A href="#PGP">
- PGP</A> and<A href="#practical"> Unix Security</A>) book<A href="#Garfinkel">
- Database Nation: the death of privacy in the 21st century</A></LI>
-</UL>
-<P>There are several collections of<A href="#quotes"> crypto quotes</A>
- on the net.</P>
-<P>See also the<A href="biblio.html"> bibliography</A> and our list of<A href="#policy">
- web references</A> on cryptography law and policy.</P>
-<H3><A NAME="26_1_4">Outline of this section</A></H3>
-<P>The remainder of this section includes two pieces of writing by our
- project leader</P>
-<UL>
-<LI>his<A href="#gilmore"> rationale</A> for starting this</LI>
-<LI>another<A href="#policestate"> discussion</A> of project goals</LI>
-</UL>
-<P>and discussions of:</P>
-<UL>
-<LI><A href="#desnotsecure">why we do not use DES</A></LI>
-<LI><A href="#exlaw">cryptography export laws</A></LI>
-<LI>why<A href="#escrow"> government access to keys</A> is not a good
- idea</LI>
-<LI>the myth that<A href="#shortkeys"> short keys</A> are adequate for
- some security requirements</LI>
-</UL>
-<P>and a section on<A href="#press"> press coverage of FreeS/WAN</A>.</P>
-<H2><A name="leader">From our project leader</A></H2>
-<P>FreeS/WAN project founder John Gilmore wrote a web page about why we
- are doing this. The version below is slightly edited, to fit this
- format and to update some links. For a version without these edits, see
- his<A href="http://www.toad.com/gnu/"> home page</A>.</P>
-<CENTER>
-<H3><A name="gilmore">Swan: Securing the Internet against Wiretapping</A>
-</H3>
-</CENTER>
-<P>My project for 1996 was to<B> secure 5% of the Internet traffic
- against passive wiretapping</B>. It didn't happen in 1996, so I'm still
- working on it in 1997, 1998, and 1999! If we get 5% in 1999 or 2000, we
- can secure 20% the next year, against both active and passive attacks;
- and 80% the following year. Soon the whole Internet will be private and
- secure. The project is called S/WAN or S/Wan or Swan for Secure Wide
- Area Network; since it's free software, we call it FreeSwan to
- distinguish it from various commercial implementations.<A href="http://www.rsa.com/rsa/SWAN/">
- RSA</A> came up with the term &quot;S/WAN&quot;. Our main web site is at<A href="http://www.freeswan.org/">
- http://www.freeswan.org/</A>. Want to help?</P>
-<P>The idea is to deploy PC-based boxes that will sit between your local
- area network and the Internet (near your firewall or router) which
- opportunistically encrypt your Internet packets. Whenever you talk to a
- machine (like a Web site) that doesn't support encryption, your traffic
- goes out &quot;in the clear&quot; as usual. Whenever you connect to a machine
- that does support this kind of encryption, this box automatically
- encrypts all your packets, and decrypts the ones that come in. In
- effect, each packet gets put into an &quot;envelope&quot; on one side of the net,
- and removed from the envelope when it reaches its destination. This
- works for all kinds of Internet traffic, including Web access, Telnet,
- FTP, email, IRC, Usenet, etc.</P>
-<P>The encryption boxes are standard PC's that use freely available
- Linux software that you can download over the Internet or install from
- a cheap CDROM.</P>
-<P>This wasn't just my idea; lots of people have been working on it for
- years. The encryption protocols for these boxes are called<A href="#IPSEC">
- IPSEC (IP Security)</A>. They have been developed by the<A href="http://www.ietf.cnri.reston.va.us/html.charters/ipsec-charter.html">
- IP Security Working Group</A> of the<A href="http://www.ietf.org/">
- Internet Engineering Task Force</A>, and will be a standard part of the
- next major version of the Internet protocols (<A href="http://playground.sun.com/pub/ipng/html/ipng-main.html">
-IPv6</A>). For today's (IP version 4) Internet, they are an option.</P>
-<P>The<A href="http://www.iab.org/iab"> Internet Architecture Board</A>
- and<A href="http://www.ietf.org/"> Internet Engineering Steering Group</A>
- have taken a<A href="iab-iesg.stmt"> strong stand</A> that the Internet
- should use powerful encryption to provide security and privacy. I think
- these protocols are the best chance to do that, because they can be
- deployed very easily, without changing your hardware or software or
- retraining your users. They offer the best security we know how to
- build, using the Triple-DES, RSA, and Diffie-Hellman algorithms.</P>
-<P>This &quot;opportunistic encryption box&quot; offers the &quot;fax effect&quot;. As each
- person installs one for their own use, it becomes more valuable for
- their neighbors to install one too, because there's one more person to
- use it with. The software automatically notices each newly installed
- box, and doesn't require a network administrator to reconfigure it.
- Instead of &quot;virtual private networks&quot; we have a &quot;REAL private network&quot;;
- we add privacy to the real network instead of layering a
- manually-maintained virtual network on top of an insecure Internet.</P>
-<H4><A NAME="26_2_1_1">Deployment of IPSEC</A></H4>
-<P>The US government would like to control the deployment of IP Security
- with its<A href="#exlaw"> crypto export laws</A>. This isn't a problem
- for my effort, because the cryptographic work is happening outside the
- United States. A foreign philanthropist, and others, have donated the
- resources required to add these protocols to the Linux operating
- system.<A href="http://www.linux.org/"> Linux</A> is a complete, freely
- available operating system for IBM PC's and several kinds of
- workstation, which is compatible with Unix. It was written by Linus
- Torvalds, and is still maintained by a talented team of expert
- programmers working all over the world and coordinating over the
- Internet. Linux is distributed under the<A href="#GPL"> GNU Public
- License</A>, which gives everyone the right to copy it, improve it,
- give it to their friends, sell it commercially, or do just about
- anything else with it, without paying anyone for the privilege.</P>
-<P>Organizations that want to secure their network will be able to put
- two Ethernet cards into an IBM PC, install Linux on it from a $30 CDROM
- or by downloading it over the net, and plug it in between their
- Ethernet and their Internet link or firewall. That's all they'll have
- to do to encrypt their Internet traffic everywhere outside their own
- local area network.</P>
-<P>Travelers will be able to run Linux on their laptops, to secure their
- connection back to their home network (and to everywhere else that they
- connect to, such as customer sites). Anyone who runs Linux on a
- standalone PC will also be able to secure their network connections,
- without changing their application software or how they operate their
- computer from day to day.</P>
-<P>There will also be numerous commercially available firewalls that use
- this technology.<A href="http://www.rsa.com/"> RSA Data Security</A> is
- coordinating the<A href="http://www.rsa.com/rsa/SWAN"> S/Wan (Secure
- Wide Area Network)</A> project among more than a dozen vendors who use
- these protocols. There's a<A href="http://www.rsa.com/rsa/SWAN/swan_test.htm">
- compatability chart</A> that shows which vendors have tested their
- boxes against which other vendors to guarantee interoperatility.</P>
-<P>Eventually it will also move into the operating systems and
- networking protocol stacks of major vendors. This will probably take
- longer, because those vendors will have to figure out what they want to
- do about the export controls.</P>
-<H4><A NAME="26_2_1_2">Current status</A></H4>
-<P>My initial goal of securing 5% of the net by Christmas '96 was not
- met. It was an ambitious goal, and inspired me and others to work hard,
- but was ultimately too ambitious. The protocols were in an early stage
- of development, and needed a lot more protocol design before they could
- be implemented. As of April 1999, we have released version 1.0 of the
- software (<A href="ftp://ftp.xs4all.nl/freeswan/freeswan-1.0.tar.gz">
-freeswan-1.0.tar.gz</A>), which is suitable for setting up Virtual
- Private Networks using shared secrets for authentication. It does not
- yet do opportunistic encryption, or use DNSSEC for authentication;
- those features are coming in a future release.</P>
-<DL>
-<DT>Protocols</DT>
-<DD>The low-level encrypted packet formats are defined. The system for
- publishing keys and providing secure domain name service is defined.
- The IP Security working group has settled on an NSA-sponsored protocol
- for key agreement (called ISAKMP/Oakley), but it is still being worked
- on, as the protocol and its documentation is too complex and
- incomplete. There are prototype implementations of ISAKMP. The protocol
- is not yet defined to enable opportunistic encryption or the use of
- DNSSEC keys.</DD>
-<DT>Linux Implementation</DT>
-<DD>The Linux implementation has reached its first major release and is
- ready for production use in manually-configured networks, using Linux
- kernel version 2.0.36.</DD>
-<DT>Domain Name System Security</DT>
-<DD>There is now a release of BIND 8.2 that includes most DNS Security
- features.
-<P>The first prototype implementation of Domain Name System Security was
- funded by<A href="#DARPA"> DARPA</A> as part of their<A href="http://www.darpa.mil/ito/research/is/index.html">
- Information Survivability program</A>.<A href="http://www.tis.com">
- Trusted Information Systems</A> wrote a modified version of<A href="http://www.isc.org/bind.html">
- BIND</A>, the widely-used Berkeley implementation of the Domain Name
- System.</P>
-<P>TIS, ISC, and I merged the prototype into the standard version of
- BIND. The first production version that supports KEY and SIG records is<B>
- bind-4.9.5</B>. This or any later version of BIND will do for
- publishing keys. It is available from the<A href="http://www.isc.org/bind.html">
- Internet Software Consortium</A>. This version of BIND is not
- export-controlled since it does not contain any cryptography. Later
- releases starting with BIND 8.2 include cryptography for authenticating
- DNS records, which is also exportable. Better documentation is needed.</P>
-</DD>
-</DL>
-<H4><A NAME="26_2_1_3">Why?</A></H4>
-<P>Because I can. I have made enough money from several successful
- startup companies, that for a while I don't have to work to support
- myself. I spend my energies and money creating the kind of world that
- I'd like to live in and that I'd like my (future) kids to live in.
- Keeping and improving on the civil rights we have in the United States,
- as we move more of our lives into cyberspace, is a particular goal of
- mine.</P>
-<H4><A NAME="26_2_1_4">What You Can Do</A></H4>
-<DL>
-<DT>Install the latest BIND at your site.</DT>
-<DD>You won't be able to publish any keys for your domain, until you
- have upgraded your copy of BIND. The thing you really need from it is
- the new version of<I> named</I>, the Name Daemon, which knows about the
- new KEY and SIG record types. So, download it from the<A href="http://www.isc.org/bind.html">
- Internet Software Consortium</A> and install it on your name server
- machine (or get your system administrator, or Internet Service
- Provider, to install it). Both your primary DNS site and all of your
- secondary DNS sites will need the new release before you will be able
- to publish your keys. You can tell which sites this is by running the
- Unix command &quot;dig MYDOMAIN ns&quot; and seeing which sites are mentioned in
- your NS (name server) records.</DD>
-<DT>Set up a Linux system and run a 2.0.x kernel on it</DT>
-<DD>Get a machine running Linux (say the 5.2 release from<A href="http://www.redhat.com">
- Red Hat</A>). Give the machine two Ethernet cards.</DD>
-<DT>Install the Linux IPSEC (Freeswan) software</DT>
-<DD>If you're an experienced sysadmin or Linux hacker, install the
- freeswan-1.0 release, or any later release or snapshot. These releases
- do NOT provide automated &quot;opportunistic&quot; operation; they must be
- manually configured for each site you wish to encrypt with.</DD>
-<DT>Get on the linux-ipsec mailing list</DT>
-<DD>The discussion forum for people working on the project, and testing
- the code and documentation, is: linux-ipsec@clinet.fi. To join this
- mailing list, send email to<A href="mailto:linux-ipsec-REQUEST@clinet.fi">
- linux-ipsec-REQUEST@clinet.fi</A> containing a line of text that says
- &quot;subscribe linux-ipsec&quot;. (You can later get off the mailing list the
- same way -- just send &quot;unsubscribe linux-ipsec&quot;).</DD>
-<P></P>
-<DT>Check back at this web page every once in a while</DT>
-<DD>I update this page periodically, and there may be new information in
- it that you haven't seen. My intent is to send email to the mailing
- list when I update the page in any significant way, so subscribing to
- the list is an alternative.</DD>
-</DL>
-<P>Would you like to help? I can use people who are willing to write
- documentation, install early releases for testing, write cryptographic
- code outside the United States, sell pre-packaged software or systems
- including this technology, and teach classes for network administrators
- who want to install this technology. To offer to help, send me email at
- gnu@toad.com. Tell me what country you live in and what your
- citizenship is (it matters due to the export control laws; personally I
- don't care). Include a copy of your resume and the URL of your home
- page. Describe what you'd like to do for the project, and what you're
- uniquely qualified for. Mention what other volunteer projects you've
- been involved in (and how they worked out). Helping out will require
- that you be able to commit to doing particular things, meet your
- commitments, and be responsive by email. Volunteer projects just don't
- work without those things.</P>
-<H4><A NAME="26_2_1_5">Related projects</A></H4>
-<DL>
-<DT>IPSEC for NetBSD</DT>
-<DD>This prototype implementation of the IP Security protocols is for
- another free operating system.<A href="ftp://ftp.funet.fi/pub/unix/security/net/ip/BSDipsec.tar.gz">
- Download BSDipsec.tar.gz</A>.</DD>
-<DT>IPSEC for<A href="http://www.openbsd.org"> OpenBSD</A></DT>
-<DD>This prototype implementation of the IP Security protocols is for
- yet another free operating system. It is directly integrated into the
- OS release, since the OS is maintained in Canada, which has freedom of
- speech in software.</DD>
-</DL>
-<H3><A name="policestate">Stopping wholesale monitoring</A></H3>
-<P>From a message project leader John Gilmore posted to the mailing
- list:</P>
-<PRE>John Denker wrote:
-
-&gt; Indeed there are several ways in which the documentation overstates the 
-&gt; scope of what this project does -- starting with the name 
-&gt; FreeS/WAN.  There's a big difference between having an encrypted IP tunnel 
-&gt; versus having a Secure Wide-Area Network.  This software does a fine job of 
-&gt; the former, which is necessary but not sufficient for the latter.
-
-The goal of the project is to make it very hard to tap your wide area
-communications.  The current system provides very good protection
-against passive attacks (wiretapping and those big antenna farms).
-Active attacks, which involve the intruder sending packets to your
-system (like packets that break into sendmail and give them a root
-shell :-) are much harder to guard against.  Active attacks that
-involve sending people (breaking into your house and replacing parts
-of your computer with ones that transmit what you're doing) are also
-much harder to guard against.  Though we are putting effort into
-protecting against active attacks, it's a much bigger job than merely
-providing strong encryption.  It involves general computer security,
-and general physical security, which are two very expensive problems
-for even a site to solve, let alone to build into a whole society.
-
-The societal benefit of building an infrastructure that protects
-well against passive attacks is that it makes it much harder to do
-undetected bulk monitoring of the population.  It's a defense against
-police-states, not against policemen.
-
-Policemen can put in the effort required to actively attack sites that
-they have strong suspicions about.  But police states won't be able to
-build systems that automatically monitor everyone's communications.
-Either they will be able to monitor only a small subset of the
-populace (by targeting those who screwed up their passive security),
-or their monitoring activities will be detectable by those monitored
-(active attacks leave packet traces or footprints), which can then be
-addressed through the press and through political means if they become
-too widespread.
-
-FreeS/WAN does not protect very well against traffic analysis, which
-is a kind of widespread police-state style monitoring that still
-reveals significant information (who's talking to who) without
-revealing the contents of what was said.  Defenses against traffic
-analysis are an open research problem.  Zero Knowledge Systems is
-actively deploying a system designed to thwart it, designed by Ian
-Goldberg.  The jury is out on whether it actually works; a lot more
-experience with it will be needed.</PRE>
-<P>Notes on things mentioned in that message:</P>
-<UL>
-<LI>Denker is a co-author of a<A href="#applied"> paper</A> on a large
- FreeS/WAN application.</LI>
-<LI>Information on Zero Knowledge is on their<A href="http://www.zks.net/">
- web site</A>. Their Freedom product, designed to provide untracable
- pseudonyms for use on the net, is no longer marketed.</LI>
-<LI>Another section of our documentation discusses ways to<A href="#traffic.resist">
- resist traffic analysis</A>.</LI>
-</UL>
-<H2><A name="weak">Government promotion of weak crypto</A></H2>
-<P>Various groups, especially governments and especially the US
- government, have a long history of advocating various forms of bogus
- security.</P>
-<P>We regard bogus security as extremely dangerous. If users are
- deceived into relying on bogus security, then they may be exposed to
- large risks. They would be better off having no security and knowing
- it. At least then they would be careful about what they said.</P>
-<P><STRONG>Avoiding bogus security is a key design criterion for
- everything we do in FreeS/WAN</STRONG>. The most conspicuous example is
- our refusal to support<A href="#desnotsecure"> single DES</A>. Other
- IPsec &quot;features&quot; which we do not implement are discussed in our<A href="#dropped">
- compatibility</A> document.</P>
-<H3><A name="escrow">Escrowed encryption</A></H3>
-<P>Various governments have made persistent attempts to encourage or
- mandate &quot;escrowed encrytion&quot;, also called &quot;key recovery&quot;, or GAK for
- &quot;government access to keys&quot;. The idea is that cryptographic keys be
- held by some third party and turned over to law enforcement or security
- agencies under some conditions.</P>
-<PRE>  Mary had a little key - she kept it in escrow,
-  and every thing that Mary said,
-  the feds were sure to know.</PRE>
-<P>A<A href="#quotes"> crypto quotes</A> page attributes this to<A href="http://www.scramdisk.clara.net/">
- Sam Simpson</A>.</P>
-<P>There is an excellent paper available on<A href="http://www.cdt.org/crypto/risks98/">
- Risks of Escrowed Encryption</A>, from a group of cryptographic
- luminaries which included our project leader.</P>
-<P>Like any unnecessary complication, GAK tends to weaken security of
- any design it infects. For example:</P>
-<UL>
-<LI>Matt Blaze found a fatal flaw in the US government's Clipper chip
- shortly after design information became public. See his paper &quot;Protocol
- Failure in the Escrowed Encryption Standard&quot; on his<A href="http://www.crypto.com/papers/">
- papers</A> page.</LI>
-<LI>a rather<A href="http://www.pgp.com/other/advisories/adk.asp"> nasty
- bug</A> was found in the &quot;additional decryption keys&quot; &quot;feature&quot; of some
- releases of<A href="#PGP"> PGP</A></LI>
-</UL>
-<P>FreeS/WAN does not support escrowed encryption, and never will.</P>
-<H3><A name="shortkeys">Limited key lengths</A></H3>
-<P>Various governments, and some vendors, have also made persistent
- attempts to convince people that:</P>
-<UL>
-<LI>weak systems are sufficient for some data</LI>
-<LI>strong cryptography should be reserved for cases where the extra
- overheads are justified</LI>
-</UL>
-<P><STRONG>This is utter nonsense</STRONG>.</P>
-<P>Weak systems touted include:</P>
-<UL>
-<LI>the ludicrously weak (deliberately crippled) 40-bit ciphers that
- until recently were all various<A href="#exlaw"> export laws</A>
- allowed</LI>
-<LI>56-bit single DES, discussed<A href="#desnotsecure"> below</A></LI>
-<LI>64-bit symmetric ciphers and 512-bit RSA, the maximums for
- unrestricted export under various current laws</LI>
-</UL>
-<P>The notion that choice of ciphers or keysize should be determined by
- a trade-off between security requirements and overheads is pure
- bafflegab.</P>
-<UL>
-<LI>For most<A href="#symmetric"> symmetric ciphers</A>, it is simply a
- lie. Any block cipher has some natural maximum keysize inherent in the
- design -- 128 bits for<A href="#IDEA"> IDEA</A> or<A href="#CAST128">
- CAST-128</A>, 256 for Serpent or Twofish, 448 for<A href="#Blowfish">
- Blowfish</A> and 2048 for<A href="#RC4"> RC4</A>. Using a key size
- smaller than that limit gives<EM> exactly zero</EM> savings in
- overhead. The crippled 40-bit or 64-bit version of the cipher provides<EM>
- no advantage whatsoever</EM>.</LI>
-<LI><A href="#AES">AES</A> uses 10 rounds with 128-bit keys, 12 rounds
- for 192-bit and 14 rounds for 256-bit, so there actually is a small
- difference in overhead, but not enough to matter in most applications.</LI>
-<LI>For<A href="#3DES"> triple DES</A> there is a grain of truth in the
- argument. 3DES is indeed three times slower than single DES. However,
- the solution is not to use the insecure single DES, but to pick a
- faster secure cipher.<A href="#CAST128"> CAST-128</A>,<A href="#Blowfish">
- Blowfish</A> and the<A href="#AES"> AES candidate</A> ciphers are are
- all considerably faster in software than DES (let alone 3DES!), and
- apparently secure.</LI>
-<LI>For<A href="#public"> public key</A> techniques, there are extra
- overheads for larger keys, but they generally do not affect overall
- performance significantly. Practical public key applications are
- usually<A href="#hybrid"> hybrid</A> systems in which the bulk of the
- work is done by a symmetric cipher. The effect of increasing the cost
- of the public key operations is typically negligible because the public
- key operations use only a tiny fraction of total resources.
-<P>For example, suppose public key operations use use 1% of the time in
- a hybrid system and you triple the cost of public key operations. The
- cost of symmetric cipher operations is unchanged at 99% of the original
- total cost, so the overall effect is a jump from 99 + 1 = 100 to 99 + 3
- = 102, a 2% rise in system cost.</P>
-</LI>
-</UL>
-<P>In short,<STRONG> there has never been any technical reason to use
- inadequate ciphers</STRONG>. The only reason there has ever been for
- anyone to use such ciphers is that government agencies want weak
- ciphers used so that they can crack them. The alleged savings are
- simply propaganda.</P>
-<PRE>   Mary had a little key (It's all she could export),
-   and all the email that she sent was opened at the Fort.</PRE>
-<P>A<A href="#quotes"> crypto quotes</A> page attributes this to<A href="http://theory.lcs.mit.edu:80/~rivest/">
- Ron Rivest</A>. NSA headquarters is at Fort Meade, Maryland.</P>
-<P>Our policy in FreeS/WAN is to use only cryptographic components with
- adequate keylength and no known weaknesses.</P>
-<UL>
-<LI>We do not implement single DES because it is clearly<A href="#desnotsecure">
- insecure</A>, so implemeting it would violate our policy of avoiding
- bogus security. Our default cipher is<A href="#3DES"> 3DES</A></LI>
-<LI>Similarly, we do not implement the 768-bit Group 1 for<A href="#DH">
- Diffie-Hellman</A> key negotiation. We provide only the 1024-bit Group
- 2 and 1536-bit Group 5.</LI>
-</UL>
-<P>Detailed discussion of which IPsec features we implement or omit is
- in out<A href="compat.html"> compatibility document</A>.</P>
-<P>These decisions imply that we cannot fully conform to the IPsec RFCs,
- since those have DES as the only required cipher and Group 1 as the
- only required DH group. (In our view, the standards were subverted into
- offerring bogus security.) Fortunately, we can still interoperate with
- most other IPsec implementations since nearly all implementers provide
- at least 3DES and Group 2 as well.</P>
-<P>We hope that eventually the RFCs will catch up with our (and others')
- current practice and reject dubious components. Some of our team and a
- number of others are working on this in<A href="#ietf"> IETF</A>
- working groups.</P>
-<H4><A NAME="26_3_2_1">Some real trade-offs</A></H4>
-<P>Of course, making systems secure does involve costs, and trade-offs
- can be made between cost and security. However, the real trade-offs
- have nothing to do with using weaker ciphers.</P>
-<P>There can be substantial hardware and software costs. There are often
- substantial training costs, both to train administrators and to
- increase user awareness of security issues and procedures. There are
- almost always substantial staff or contracting costs.</P>
-<P>Security takes staff time for planning, implementation, testing and
- auditing. Some of the issues are subtle; you need good (hence often
- expensive) people for this. You also need people to monitor your
- systems and respond to problems. The best safe ever built is insecure
- if an attacker can work on it for days without anyone noticing. Any
- computer is insecure if the administrator is &quot;too busy&quot; to check the
- logs.</P>
-<P>Moreover, someone in your organisation (or on contract to it) needs
- to spend considerable time keeping up with new developments. EvilDoers<EM>
- will</EM> know about new attacks shortly after they are found. You need
- to know about them before your systems are attacked. If your vendor
- provides a patch, you need to apply it. If the vendor does nothing, you
- need to complain or start looking for another vendor.</P>
-<P>For a fairly awful example, see this<A href="http://www.sans.org/newlook/alerts/NTE-bank.htm">
- report</A>. In that case over a million credit card numbers were taken
- from e-commerce sites, using security flaws in Windows NT servers.
- Microsoft had long since released patches for most or all of the flaws,
- but the site administrators had not applied them.</P>
-<P>At an absolute minimum, you must do something about such issues<EM>
- before</EM> an exploitation tool is posted to the net for downloading
- by dozens of &quot;script kiddies&quot;. Such a tool might appear at any time
- from the announcement of the security hole to several months later.
- Once it appears, anyone with a browser and an attitude can break any
- system whose administrators have done nothing about the flaw.</P>
-<P>Compared to those costs, cipher overheads are an insignificant factor
- in the cost of security.</P>
-<P>The only thing using a weak cipher can do for you is to cause all
- your other investment to be wasted.</P>
-<H2><A name="exlaw">Cryptography Export Laws</A></H2>
-<P>Many nations restrict the export of cryptography and some restrict
- its use by their citizens or others within their borders.</P>
-<H3><A name="USlaw">US Law</A></H3>
-<P>US laws, as currently interpreted by the US government, forbid export
- of most cryptographic software from the US in machine-readable form
- without government permission. In general, the restrictions apply even
- if the software is widely-disseminated or public-domain and even if it
- came from outside the US originally. Cryptography is legally a munition
- and export is tightly controlled under the<A href="#EAR"> EAR</A>
- Export Administration Regulations.</P>
-<P>If you are a US citizen, your brain is considered US territory no
- matter where it is physically located at the moment. The US believes
- that its laws apply to its citizens everywhere, not just within the US.
- Providing technical assistance or advice to foreign &quot;munitions&quot;
- projects is illegal. The US government has very little sense of humor
- about this issue and does not consider good intentions to be sufficient
- excuse. Beware.</P>
-<P>The<A href="http://www.bxa.doc.gov/Encryption/"> official website</A>
- for these regulations is run by the Commerce Department's Bureau of
- Export Administration (BXA).</P>
-<P>The<A href="http://www.eff.org/bernstein/"> Bernstein case</A>
- challenges the export restrictions on Constitutional grounds. Code is
- speech so restrictions on export of code violate the First Amendment's
- free speech provisions. This argument has succeeded in two levels of
- court so far. It is quite likely to go on to the Supreme Court.</P>
-<P>The regulations were changed substantially in January 2000,
- apparently as a government attempt to get off the hook in the Bernstein
- case. It is now legal to export public domain source code for
- encryption, provided you notify the<A href="#BXA"> BXA</A>.</P>
-<P>There are, however, still restrictions in force. Moreover, the
- regulations can still be changed again whenever the government chooses
- to do so. Short of a Supreme Court ruling (in the Berstein case or
- another) that overturns the regulations completely, the problem of
- export regulation is not likely to go away in the forseeable future.</P>
-<H4><A name="UScontrib">US contributions to FreeS/WAN</A></H4>
-<P>The FreeS/WAN project<STRONG> cannot accept software contributions,<EM>
- not even small bug fixes</EM>, from US citizens or residents</STRONG>.
- We want it to be absolutely clear that our distribution is not subject
- to US export law. Any contribution from an American might open that
- question to a debate we'd prefer to avoid. It might also put the
- contributor at serious legal risk.</P>
-<P>Of course Americans can still make valuable contributions (many
- already have) by reporting bugs, or otherwise contributing to
- discussions, on the project<A href="mail.html"> mailing list</A>. Since
- the list is public, this is clearly constitutionally protected free
- speech.</P>
-<P>Note, however, that the export laws restrict Americans from providing
- technical assistance to foreign &quot;munitions&quot; projects. The government
- might claim that private discussions or correspondence with FreeS/WAN
- developers were covered by this. It is not clear what the courts would
- do with such a claim, so we strongly encourage Americans to use the
- list rather than risk the complications.</P>
-<H3><A name="wrong">What's wrong with restrictions on cryptography</A></H3>
-<P>Some quotes from prominent cryptography experts:</P>
-<BLOCKQUOTE> The real aim of current policy is to ensure the continued
- effectiveness of US information warfare assets against individuals,
- businesses and governments in Europe and elsewhere.
-<BR><A href="http://www.cl.cam.ac.uk/users/rja14"> Ross Anderson,
- Cambridge University</A></BLOCKQUOTE><BLOCKQUOTE> If the government
- were honest about its motives, then the debate about crypto export
- policy would have ended years ago.
-<BR><A href="http://www.counterpane.com"> Bruce Schneier, Counterpane
- Systems</A></BLOCKQUOTE><BLOCKQUOTE> The NSA regularly lies to people
- who ask it for advice on export control. They have no reason not to;
- accomplishing their goal by any legal means is fine by them. Lying by
- government employees is legal.
-<BR> John Gilmore.</BLOCKQUOTE>
-<P>The Internet Architecture Board (IAB) and the Internet Engineering
- Steering Group (IESG) made a<A href="iab-iesg.stmt"> strong statement</A>
- in favour of worldwide access to strong cryptography. Essentially the
- same statement is in the appropriately numbered<A href="ftp://ftp.isi.edu/in-notes/rfc1984.txt">
- RFC 1984</A>. Two critical paragraphs are:</P>
-<BLOCKQUOTE> ... various governments have actual or proposed policies on
- access to cryptographic technology ...
-<P>(a) ... export controls ...
-<BR> (b) ... short cryptographic keys ...
-<BR> (c) ... keys should be in the hands of the government or ...
-<BR> (d) prohibit the use of cryptology ...</P>
-<P>We believe that such policies are against the interests of consumers
- and the business community, are largely irrelevant to issues of
- military security, and provide only a marginal or illusory benefit to
- law enforcement agencies, ...</P>
-<P>The IAB and IESG would like to encourage policies that allow ready
- access to uniform strong cryptographic technology for all Internet
- users in all countries.</P>
-</BLOCKQUOTE>
-<P>Our goal in the FreeS/WAN project is to build just such &quot;strong
- cryptographic technology&quot; and to distribute it &quot;for all Internet users
- in all countries&quot;.</P>
-<P>More recently, the same two bodies (IESG and IAB) have issued<A href="ftp://ftp.isi.edu/in-notes/rfc2804.txt">
- RFC 2804</A> on why the IETF should not build wiretapping capabilities
- into protocols for the convenience of security or law enforcement
- agenicies. The abstract from that document is:</P>
-<BLOCKQUOTE> The Internet Engineering Task Force (IETF) has been asked
- to take a position on the inclusion into IETF standards-track documents
- of functionality designed to facilitate wiretapping.
-<P>This memo explains what the IETF thinks the question means, why its
- answer is &quot;no&quot;, and what that answer means.</P>
-</BLOCKQUOTE> A quote from the debate leading up to that RFC:<BLOCKQUOTE>
- We should not be building surveillance technology into standards. Law
- enforcement was not supposed to be easy. Where it is easy, it's called
- a police state.
-<BR> Jeff Schiller of MIT, in a discussion of FBI demands for wiretap
- capability on the net, as quoted by<A href="http://www.wired.com/news/politics/0,1283,31895,00.html">
- Wired</A>.</BLOCKQUOTE>
-<P>The<A href="http://www.ietf.org/mailman/listinfo/raven"> Raven</A>
- mailing list was set up for this IETF discussion.</P>
-<P>Our goal is to go beyond that RFC and prevent Internet wiretapping
- entirely.</P>
-<H3><A name="Wassenaar">The Wassenaar Arrangement</A></H3>
-<P>Restrictions on the export of cryptography are not just US policy,
- though some consider the US at least partly to blame for the policies
- of other nations in this area.</P>
-<P>A number of countries:</P>
-<P>Argentina, Australia, Austria, Belgium, Bulgaria, Canada, Czech
- Republic, Denmark, Finland, France, Germany, Greece, Hungary, Ireland,
- Italy, Japan, Luxembourg, Netherlands, New Zealand, Norway, Poland,
- Portugal, Republic of Korea, Romania, Russian Federation, Slovak
- Republic, Spain, Sweden, Switzerland, Turkey, Ukraine, United Kingdom
- and United States</P>
-<P>have signed the Wassenaar Arrangement which restricts export of
- munitions and other tools of war. Cryptographic sofware is covered
- there.</P>
-<P>Wassenaar details are available from the<A href="http://www.wassenaar.org/">
- Wassenaar Secretariat</A>, and elsewhere in a more readable<A href="http://www.fitug.de/news/wa/index.html">
- HTML version</A>.</P>
-<P>For a critique see the<A href="http://www.gilc.org/crypto/wassenaar">
- GILC site</A>:</P>
-<BLOCKQUOTE> The Global Internet Liberty Campaign (GILC) has begun a
- campaign calling for the removal of cryptography controls from the
- Wassenaar Arrangement.
-<P>The aim of the Wassenaar Arrangement is to prevent the build up of
- military capabilities that threaten regional and international security
- and stability . . .</P>
-<P>There is no sound basis within the Wassenaar Arrangement for the
- continuation of any export controls on cryptographic products.</P>
-</BLOCKQUOTE>
-<P>We agree entirely.</P>
-<P>An interesting analysis of Wassenaar can be found on the<A href="http://www.cyber-rights.org/crypto/wassenaar.htm">
- cyber-rights.org</A> site.</P>
-<H3><A name="status">Export status of Linux FreeS/WAN</A></H3>
-<P>We believe our software is entirely exempt from these controls since
- the Wassenaar<A href="http://www.wassenaar.org/list/GTN%20and%20GSN%20-%2099.pdf">
- General Software Note</A> says:</P>
-<BLOCKQUOTE> The Lists do not control &quot;software&quot; which is either:
-<OL>
-<LI>Generally available to the public by . . . retail . . . or</LI>
-<LI>&quot;In the public domain&quot;.</LI>
-</OL>
-</BLOCKQUOTE>
-<P>There is a note restricting some of this, but it is a sub-heading
- under point 1, so it appears not to apply to public domain software.</P>
-<P>Their glossary defines &quot;In the public domain&quot; as:</P>
-<BLOCKQUOTE> . . . &quot;technology&quot; or &quot;software&quot; which has been made
- available without restrictions upon its further dissemination.
-<P>N.B. Copyright restrictions do not remove &quot;technology&quot; or &quot;software&quot;
- from being &quot;in the public domain&quot;.</P>
-</BLOCKQUOTE>
-<P>We therefore believe that software freely distributed under the<A href="#GPL">
- GNU Public License</A>, such as Linux FreeS/WAN, is exempt from
- Wassenaar restrictions.</P>
-<P>Most of the development work is being done in Canada. Our
- understanding is that the Canadian government accepts this
- interpretation.</P>
-<UL>
-<LI>A web statement of<A href="http://www.dfait-maeci.gc.ca/~eicb/notices/ser113-e.htm">
- Canadian policy</A> is available from the Department of Foreign Affairs
- and International Trade.</LI>
-<LI>Another document from that department states that<A href="http://www.dfait-maeci.gc.ca/~eicb/export/gr1_e.htm">
- public domain software</A> is exempt from the export controls.</LI>
-<LI>A researcher's<A href="http://insight.mcmaster.ca/org/efc/pages/doc/crypto-export.html">
- analysis</A> of Canadian policy is also available.</LI>
-</UL>
-<P>Recent copies of the freely modifiable and distributable source code
- exist in many countries. Citizens all over the world participate in its
- use and evolution, and guard its ongoing distribution. Even if Canadian
- policy were to change, the software would continue to evolve in
- countries which do not restrict exports, and would continue to be
- imported from there into unfree countries. &quot;The Net culture treats
- censorship as damage, and routes around it.&quot;</P>
-<H3><A name="help">Help spread IPsec around</A></H3>
-<P>You can help. If you don't know of a Linux FreeS/WAN archive in your
- own country, please download it now to your personal machine, and
- consider making it publicly accessible if that doesn't violate your own
- laws. If you have the resources, consider going one step further and
- setting up a mirror site for the whole<A href="#munitions"> munitions</A>
- Linux crypto software archive.</P>
-<P>If you make Linux CD-ROMs, please consider including this code, in a
- way that violates no laws (in a free country, or in a domestic-only CD
- product).</P>
-<P>Please send a note about any new archive mirror sites or CD
- distributions to linux-ipsec@clinet.fi so we can update the
- documentation.</P>
-<P>Lists of current<A href="#sites"> mirror sites</A> and of<A href="#distwith">
- distributions</A> which include FreeS/WAN are in our introduction
- section.</P>
-<H2><A name="desnotsecure">DES is Not Secure</A></H2>
-<P>DES, the<STRONG> D</STRONG>ata<STRONG> E</STRONG>ncryption<STRONG> S</STRONG>
-tandard, can no longer be considered secure. While no major flaws in its
- innards are known, it is fundamentally inadequate because its<STRONG>
- 56-bit key is too short</STRONG>. It is vulnerable to<A href="#brute">
- brute-force search</A> of the whole key space, either by large
- collections of general-purpose machines or even more quickly by
- specialized hardware. Of course this also applies to<STRONG> any other
- cipher with only a 56-bit key</STRONG>. The only reason anyone could
- have for using a 56 or 64-bit key is to comply with various<A href="exportlaw.html">
- export laws</A> intended to ensure the use of breakable ciphers.</P>
-<P>Non-government cryptologists have been saying DES's 56-bit key was
- too short for some time -- some of them were saying it in the 70's when
- DES became a standard -- but the US government has consistently
- ridiculed such suggestions.</P>
-<P>A group of well-known cryptographers looked at key lengths in a<A href="http://www.counterpane.com/keylength.html">
- 1996 paper</A>. They suggested a<EM> minimum</EM> of 75 bits to
- consider an existing cipher secure and a<EM> minimum of 90 bits for new
- ciphers</EM>. More recent papers, covering both<A href="#symmetric">
- symmetric</A> and<A href="#public"> public key</A> systems are at<A href="http://www.cryptosavvy.com/">
- cryptosavvy.com</A> and<A href="http://www.rsasecurity.com/rsalabs/bulletins/bulletin13.html">
- rsa.com</A>. For all algorithms, the minimum keylengths recommended in
- such papers are significantly longer than the maximums allowed by
- various export laws.</P>
-<P>In a<A href="http://www.privacy.nb.ca/cryptography/archives/cryptography/html/1998-09/0095.html">
- 1998 ruling</A>, a German court described DES as &quot;out-of-date and not
- safe enough&quot; and held a bank liable for using it.</P>
-<H3><A name="deshware">Dedicated hardware breaks DES in a few days</A></H3>
-<P>The question of DES security has now been settled once and for all.
- In early 1998, the<A href="http://www.eff.org/"> Electronic Frontier
- Foundation</A> built a<A href="http://www.eff.org/descracker.html">
- DES-cracking machine</A>. It can find a DES key in an average of a few
- days' search. The details of all this, including complete code listings
- and complete plans for the machine, have been published in<A href="#EFF">
-<CITE> Cracking DES</CITE></A>, by the Electronic Frontier Foundation.</P>
-<P>That machine cost just over $200,000 to design and build. &quot;Moore's
- Law&quot; is that machines get faster (or cheaper, for the same speed) by
- roughly a factor of two every 18 months. At that rate, their $200,000
- in 1998 becomes $50,000 in 2001.</P>
-<P>However, Moore's Law is not exact and the $50,000 estimate does not
- allow for the fact that a copy based on the published EFF design would
- cost far less than the original. We cannot say exactly what such a
- cracker would cost today, but it would likely be somewhere between
- $10,000 and $100,000.</P>
-<P>A large corporation could build one of these out of petty cash. The
- cost is low enough for a senior manager to hide it in a departmental
- budget and avoid having to announce or justify the project. Any
- government agency, from a major municipal police force up, could afford
- one. Or any other group with a respectable budget -- criminal
- organisations, political groups, labour unions, religious groups, ...
- Or any millionaire with an obsession or a grudge, or just strange taste
- in toys.</P>
-<P>One might wonder if a private security or detective agency would have
- one for rent. They wouldn't need many clients to pay off that
- investment.</P>
-<H3><A name="spooks">Spooks may break DES faster yet</A></H3>
-<P>As for the security and intelligence agencies of various nations,
- they may have had DES crackers for years, and theirs may be much
- faster. It is difficult to make most computer applications work well on
- parallel machines, or to design specialised hardware to accelerate
- them. Cipher-cracking is one of the very few exceptions. It is entirely
- straightforward to speed up cracking by just adding hardware. Within
- very broad limits, you can make it as fast as you like if you have the
- budget. The EFF's $200,000 machine breaks DES in a few days. An<A href="http://www.planepage.com/">
- aviation website</A> gives the cost of a B1 bomber as $200,000,000.
- Spending that much, an intelligence agency could break DES in an
- average time of<EM> six and a half minutes</EM>.</P>
-<P>That estimate assumes they use the EFF's 1998 technology and just
- spend more money. They may have an attack that is superior to brute
- force, they quite likely have better chip technology (Moore's law, a
- bigger budget, and whatever secret advances they may have made) and of
- course they may have spent the price of an aircraft carrier, not just
- one aircraft.</P>
-<P>In short, we have<EM> no idea</EM> how quickly these organisations
- can break DES. Unless they're spectacularly incompetent or horribly
- underfunded, they can certainly break it, but we cannot guess how
- quickly. Pick any time unit between days and milliseconds; none is
- entirely unbelievable. More to the point, none of them is of any
- comfort if you don't want such organisations reading your
- communications.</P>
-<P>Note that this may be a concern even if nothing you do is a threat to
- anyone's national security. An intelligence agency might well consider
- it to be in their national interest for certain companies to do well.
- If you're competing against such companies in a world market and that
- agency can read your secrets, you have a serious problem.</P>
-<P>One might wonder about technology the former Soviet Union and its
- allies developed for cracking DES during the Cold War. They must have
- tried; the cipher was an American standard and widely used. Certainly
- those countries have some fine mathematicians, and those agencies had
- budget. How well did they succeed? Is their technology now for sale or
- rent?</P>
-<H3><A name="desnet">Networks break DES in a few weeks</A></H3>
-<P>Before the definitive EFF effort, DES had been cracked several times
- by people using many machines. See this<A href="http://www.distributed.net/pressroom/DESII-1-PR.html">
- press release</A> for example.</P>
-<P>A major corporation, university, or government department could break
- DES by using spare cycles on their existing collection of computers, by
- dedicating a group of otherwise surplus machines to the problem, or by
- combining the two approaches. It might take them weeks or months,
- rather than the days required for the EFF machine, but they could do
- it.</P>
-<P>What about someone working alone, without the resources of a large
- organisation? For them, cracking DES will not be easy, but it may be
- possible. A few thousand dollars buys a lot of surplus workstations. A
- pile of such machines will certainly heat your garage nicely and might
- break DES in a few months or years. Or enroll at a university and use
- their machines. Or use an employer's machines. Or crack security
- somewhere and steal the resources to crack a DES key. Or write a virus
- that steals small amounts of resources on many machines. Or . . .</P>
-<P>None of these approaches are easy or break DES really quickly, but an
- attacker only needs to find one that is feasible and breaks DES quickly
- enough to be dangerous. How much would you care to bet that this will
- be impossible if the attacker is clever and determined? How valuable is
- your data? Are you authorised to risk it on a dubious bet?</P>
-<H3><A name="no_des">We disable DES</A></H3>
-<P>In short, it is now absolutely clear that<STRONG> DES is not secure</STRONG>
- against</P>
-<UL>
-<LI>any<STRONG> well-funded opponent</STRONG></LI>
-<LI>any opponent (even a penniless one) with access (even stolen access)
- to<STRONG> enough general purpose computers</STRONG></LI>
-</UL>
-<P>That is why<STRONG> Linux FreeS/WAN disables all transforms which use
- plain DES</STRONG> for encryption.</P>
-<P>DES is in the source code, because we need DES to implement our
- default encryption transform,<A href="#3DES"> Triple DES</A>.<STRONG>
- We urge you not to use single DES</STRONG>. We do not provide any easy
- way to enable it in FreeS/WAN, and our policy is to provide no
- assistance to anyone wanting to do so.</P>
-<H3><A name="40joke">40-bits is laughably weak</A></H3>
-<P>The same is true, in spades, of ciphers -- DES or others -- crippled
- by 40-bit keys, as many ciphers were required to be until recently
- under various<A href="#exlaw"> export laws</A>. A brute force search of
- such a cipher's keyspace is 2<SUP>16</SUP> times faster than a similar
- search against DES. The EFF's machine can do a brute-force search of a
- 40-bit key space in<EM> seconds</EM>. One contest to crack a 40-bit
- cipher was won by a student<A href="http://catless.ncl.ac.uk/Risks/18.80.html#subj1">
- using a few hundred idle machines at his university</A>. It took only
- three and half hours.</P>
-<P>We do not, and will not, implement any 40-bit cipher.</P>
-<H3><A name="altdes">Triple DES is almost certainly secure</A></H3>
-<P><A href="#3DES">Triple DES</A>, usually abbreviated 3DES, applies DES
- three times, with three different keys. DES seems to be basically an
- excellent cipher design; it has withstood several decades of intensive
- analysis without any disastrous flaws being found. It's only major flaw
- is that the small keyspace allows brute force attacks to succeeed.
- Triple DES enlarges the key space to 168 bits, making brute-force
- search a ridiculous impossibility.</P>
-<P>3DES is currently the only block cipher implemented in FreeS/WAN.
- 3DES is, unfortunately, about 1/3 the speed of DES, but modern CPUs
- still do it at quite respectable speeds. Some<A href="#benchmarks">
- speed measurements</A> for our code are available.</P>
-<H3><A name="aes.ipsec">AES in IPsec</A></H3>
-<P>The<A href="#AES"> AES</A> project has chosen a replacement for DES,
- a new standard cipher for use in non-classified US government work and
- in regulated industries such as banking. This cipher will almost
- certainly become widely used for many applications, including IPsec.</P>
-<P>The winner, announced in October 2000 after several years of analysis
- and discussion, was the<A href="http://www.esat.kuleuven.ac.be/~rijmen/rijndael/">
- Rijndael</A> cipher from two Belgian designers.</P>
-<P>It is almost certain that FreeS/WAN will add AES support.<A href="#patch">
- AES patches</A> are already available.</P>
-<H2><A name="press">Press coverage of Linux FreeS/WAN:</A></H2>
-<H3><A NAME="26_6_1">FreeS/WAN 1.0 press</A></H3>
-<UL>
-<LI><A href="http://www.wired.com/news/news/technology/story/19136.html">
-Wired</A> &quot;Linux-Based Crypto Stops Snoops&quot;, James Glave April 15 1999</LI>
-<LI><A href="http://slashdot.org/articles/99/04/15/1851212.shtml">
-Slashdot</A></LI>
-<LI><A href="http://dgl.com/itinfo/1999/it990415.html">DGL</A>, Damar
- Group Limited; looking at FreeS/WAN from a perspective of business
- computing</LI>
-<LI><A href="http://linuxtoday.com/stories/5010.html">Linux Today</A></LI>
-<LI><A href="http://www.tbtf.com/archive/1999-04-21.html#Tcep">TBTF</A>,
- Tasty Bits from the Technology Front</LI>
-<LI><A href="http://www.salonmagazine.com/tech/log/1999/04/16/encryption/index.html">
-Salon Magazine</A> &quot;Free Encryption Takes a Big Step&quot;</LI>
-</UL>
-<H3><A name="release">Press release for version 1.0</A></H3>
-<PRE>        Strong Internet Privacy Software Free for Linux Users Worldwide
-
-Toronto, ON, April 14, 1999 - 
-
-The Linux FreeS/WAN project today released free software to protect
-the privacy of Internet communications using strong encryption codes.
-FreeS/WAN automatically encrypts data as it crosses the Internet, to
-prevent unauthorized people from receiving or modifying it.  One
-ordinary PC per site runs this free software under Linux to become a
-secure gateway in a Virtual Private Network, without having to modify
-users' operating systems or application software.  The project built
-and released the software outside the United States, avoiding US
-government regulations which prohibit good privacy protection.
-FreeS/WAN version 1.0 is available immediately for downloading at
-http://www.xs4all.nl/~freeswan/.
-
-&quot;Today's FreeS/WAN release allows network administrators to build
-excellent secure gateways out of old PCs at no cost, or using a cheap
-new PC,&quot; said John Gilmore, the entrepreneur who instigated the
-project in 1996.  &quot;They can build operational experience with strong
-network encryption and protect their users' most important
-communications worldwide.&quot;
-
-&quot;The software was written outside the United States, and we do not
-accept contributions from US citizens or residents, so that it can be
-freely published for use in every country,&quot; said Henry Spencer, who
-built the release in Toronto, Canada.  &quot;Similar products based in the
-US require hard-to-get government export licenses before they can be
-provided to non-US users, and can never be simply published on a Web
-site.  Our product is freely available worldwide for immediate
-downloading, at no cost.&quot;
-
-FreeS/WAN provides privacy against both quiet eavesdropping (such as
-&quot;packet sniffing&quot;) and active attempts to compromise communications
-(such as impersonating participating computers).  Secure &quot;tunnels&quot; carry
-information safely across the Internet between locations such as a
-company's main office, distant sales offices, and roaming laptops.  This
-protects the privacy and integrity of all information sent among those
-locations, including sensitive intra-company email, financial transactions
-such as mergers and acquisitions, business negotiations, personal medical
-records, privileged correspondence with lawyers, and information about
-crimes or civil rights violations.  The software will be particularly
-useful to frequent wiretapping targets such as private companies competing
-with government-owned companies, civil rights groups and lawyers,
-opposition political parties, and dissidents. 
-
-FreeS/WAN provides privacy for Internet packets using the proposed
-standard Internet Protocol Security (IPSEC) protocols.  FreeS/WAN
-negotiates strong keys using Diffie-Hellman key agreement with 1024-bit
-keys, and encrypts each packet with 168-bit Triple-DES (3DES).  A modern
-$500 PC can set up a tunnel in less than a second, and can encrypt
-6 megabits of packets per second, easily handling the whole available
-bandwidth at the vast majority of Internet sites.  In preliminary testing,
-FreeS/WAN interoperated with 3DES IPSEC products from OpenBSD, PGP, SSH,
-Cisco, Raptor, and Xedia.  Since FreeS/WAN is distributed as source code,
-its innards are open to review by outside experts and sophisticated users,
-reducing the chance of undetected bugs or hidden security compromises.
-
-The software has been in development for several years.  It has been
-funded by several philanthropists interested in increased privacy on
-the Internet, including John Gilmore, co-founder of the Electronic
-Frontier Foundation, a leading online civil rights group.
-
-Press contacts:
-Hugh Daniel,   +1 408 353 8124, hugh@toad.com
-Henry Spencer, +1 416 690 6561, henry@spsystems.net
-
-* FreeS/WAN derives its name from S/WAN, which is a trademark of RSA Data
-  Security, Inc; used by permission.</PRE>
-<HR>
-<H1><A name="ipsec.detail">The IPsec protocols</A></H1>
-<P>This section provides information on the IPsec protocols which
- FreeS/WAN implements. For more detail, see the<A href="rfc.html"> RFCs</A>
-.</P>
-<P>The basic idea of IPsec is to provide security functions,<A href="#authentication">
- authentication</A> and<A href="#encryption"> encryption</A>, at the IP
- (Internet Protocol) level. This requires a higher-level protocol (IKE)
- to set things up for the IP-level services (ESP and AH).</P>
-<H2><A NAME="27_1">Protocols and phases</A></H2>
-<P>Three protocols are used in an IPsec implementation:</P>
-<DL>
-<DT>ESP, Encapsulating Security Payload</DT>
-<DD>Encrypts and/or authenticates data</DD>
-<DT>AH, Authentication Header</DT>
-<DD>Provides a packet authentication service</DD>
-<DT>IKE, Internet Key Exchange</DT>
-<DD>Negotiates connection parameters, including keys, for the other two</DD>
-</DL>
-<P>The term &quot;IPsec&quot; (also written as IPSEC) is slightly ambiguous. In
- some contexts, it includes all three of the above but in other contexts
- it refers only to AH and ESP.</P>
-<P>There is more detail below, but a quick summary of how the whole
- thing works is:</P>
-<DL>
-<DT>Phase one IKE (main mode exchange)</DT>
-<DD>sets up a keying channel (ISAKMP SA) between the two gateways</DD>
-<DT>Phase two IKE (quick mode exchange)</DT>
-<DD>sets up data channels (IPsec SAs)</DD>
-<DT>IPsec proper</DT>
-<DD>exchanges data using AH or ESP</DD>
-</DL>
-<P>Both phases of IKE are repeated periodically to automate re-keying.</P>
-<H2><A name="others">Applying IPsec</A></H2>
-<P>Authentication and encryption functions for network data can, of
- course, be provided at other levels. Many security protocols work at
- levels above IP.</P>
-<UL>
-<LI><A href="#PGP">PGP</A> encrypts and authenticates mail messages</LI>
-<LI><A href="#ssh">SSH</A> authenticates remote logins and then encrypts
- the session</LI>
-<LI><A href="#SSL">SSL</A> or<A href="#TLS"> TLS</A> provides security
- at the sockets layer, e.g. for secure web browsing</LI>
-</UL>
-<P>and so on. Other techniques work at levels below IP. For example,
- data on a communications circuit or an entire network can be encrypted
- by specialised hardware. This is common practice in high-security
- applications.</P>
-<H3><A name="advantages">Advantages of IPsec</A></H3>
-<P>There are, however, advantages to doing it at the IP level instead
- of, or as well as, at other levels.</P>
-<P>IPsec is the<STRONG> most general way to provide these services for
- the Internet</STRONG>.</P>
-<UL>
-<LI>Higher-level services protect a<EM> single protocol</EM>; for
- example PGP protects mail.</LI>
-<LI>Lower level services protect a<EM> single medium</EM>; for example a
- pair of encryption boxes on the ends of a line make wiretaps on that
- line useless unless the attacker is capable of breaking the encryption.</LI>
-</UL>
-<P>IPsec, however, can protect<EM> any protocol</EM> running above IP
- and<EM> any medium</EM> which IP runs over. More to the point, it can
- protect a mixture of application protocols running over a complex
- combination of media. This is the normal situation for Internet
- communication; IPsec is the only general solution.</P>
-<P>IPsec can also provide some security services &quot;in the background&quot;,
- with<STRONG> no visible impact on users</STRONG>. To use<A href="#PGP">
- PGP</A> encryption and signatures on mail, for example, the user must
- at least:</P>
-<UL>
-<LI>remember his or her passphrase,</LI>
-<LI>keep it secure</LI>
-<LI>follow procedures to validate correspondents' keys</LI>
-</UL>
-<P>These systems can be designed so that the burden on users is not
- onerous, but any system will place some requirements on users. No such
- system can hope to be secure if users are sloppy about meeting those
- requirements. The author has seen username and password stuck on
- terminals with post-it notes in an allegedly secure environment, for
- example.</P>
-<H3><A name="limitations">Limitations of IPsec</A></H3>
-<P>IPsec is designed to secure IP links between machines. It does that
- well, but it is important to remember that there are many things it
- does not do. Some of the important limitations are:</P>
-<DL>
-<DT><A name="depends">IPsec cannot be secure if your system isn't</A></DT>
-<DD>System security on IPsec gateway machines is an essential
- requirement if IPsec is to function as designed. No system can be
- trusted if the underlying machine has been subverted. See books on Unix
- security such as<A href="#practical"> Garfinkel and Spafford</A> or our
- web references for<A href="#linsec"> Linux security</A> or more general<A
-href="#compsec"> computer security</A>.
-<P>Of course, there is another side to this. IPsec can be a powerful
- tool for improving system and network security. For example, requiring
- packet authentication makes various spoofing attacks harder and IPsec
- tunnels can be extremely useful for secure remote administration of
- various things.</P>
-</DD>
-<DT><A name="not-end-to-end">IPsec is not end-to-end</A></DT>
-<DD>IPsec cannot provide the same end-to-end security as systems working
- at higher levels. IPsec encrypts an IP connection between two machines,
- which is quite a different thing than encrypting messages between users
- or between applications.
-<P>For example, if you need mail encrypted from the sender's desktop to
- the recipient's desktop and decryptable only by the recipient, use<A href="#PGP">
- PGP</A> or another such system. IPsec can encrypt any or all of the
- links involved -- between the two mail servers, or between either
- server and its clients. It could even be used to secure a direct IP
- link from the sender's desktop machine to the recipient's, cutting out
- any sort of network snoop. What it cannot ensure is end-to-end
- user-to-user security. If only IPsec is used to secure mail, then
- anyone with appropriate privileges on any machine where that mail is
- stored (at either end or on any store-and-forward servers in the path)
- can read it.</P>
-<P>In another common setup, IPsec encrypts packets at a security gateway
- machine as they leave the sender's site and decrypts them on arrival at
- the gateway to the recipient's site. This does provide a useful
- security service -- only encrypted data is passed over the Internet --
- but it does not even come close to providing an end-to-end service. In
- particular, anyone with appropriate privileges on either site's LAN can
- intercept the message in unencrypted form.</P>
-</DD>
-<DT><A name="notpanacea">IPsec cannot do everything</A></DT>
-<DD>IPsec also cannot provide all the functions of systems working at
- higher levels of the protocol stack. If you need a document
- electronically signed by a particular person, then you need his or her<A
-href="#signature"> digital signature</A> and a<A href="#public"> public
- key cryptosystem</A> to verify it with.
-<P>Note, however, that IPsec authentication of the underlying
- communication can make various attacks on higher-level protocols more
- difficult. In particular, authentication prevents<A href="#middle">
- man-in-the-middle attacks</A>.</P>
-</DD>
-<DT><A name="no_user">IPsec authenticates machines, not users</A></DT>
-<DD>IPsec uses strong authentication mechanisms to control which
- messages go to which machines, but it does not have the concept of user
- ID, which is vital to many other security mechansims and policies. This
- means some care must be taken in fitting the various security
- mechansims on a network together. For example, if you need to control
- which users access your database server, you need some non-IPsec
- mechansim for that. IPsec can control which machines connect to the
- server, and can ensure that data transfer to those machines is done
- securely, but that is all. Either the machines themselves must control
- user access or there must be some form of user authentication to the
- database, independent of IPsec.</DD>
-<DT><A name="DoS">IPsec does not stop denial of service attacks</A></DT>
-<DD><A href="#DOS">Denial of service</A> attacks aim at causing a system
- to crash, overload, or become confused so that legitimate users cannot
- get whatever services the system is supposed to provide. These are
- quite different from attacks in which the attacker seeks either to use
- the service himself or to subvert the service into delivering incorrect
- results.
-<P>IPsec shifts the ground for DoS attacks; the attacks possible against
- systems using IPsec are different than those that might be used against
- other systems. It does not, however, eliminate the possibility of such
- attacks.</P>
-</DD>
-<DT><A name="traffic">IPsec does not stop traffic analysis</A></DT>
-<DD><A href="#traffic">Traffic analysis</A> is the attempt to derive
- intelligence from messages without regard for their contents. In the
- case of IPsec, it would mean analysis based on things visible in the
- unencrypted headers of encrypted packets -- source and destination
- gateway addresses, packet size, et cetera. Given the resources to
- acquire such data and some skill in analysing it (both of which any
- national intelligence agency should have), this can be a very powerful
- technique.
-<P>IPsec is not designed to defend against this. Partial defenses are
- certainly possible, and some are<A href="#traffic.resist"> described
- below</A>, but it is not clear that any complete defense can be
- provided.</P>
-</DD>
-</DL>
-<H3><A name="uses">IPsec is a general mechanism for securing IP</A></H3>
-<P>While IPsec does not provide all functions of a mail encryption
- package, it can encrypt your mail. In particular, it can ensure that
- all mail passing between a pair or a group of sites is encrypted. An
- attacker looking only at external traffic, without access to anything
- on or behind the IPsec gateway, cannot read your mail. He or she is
- stymied by IPsec just as he or she would be by<A href="#PGP"> PGP</A>.</P>
-<P>The advantage is that IPsec can provide the same protection for<STRONG>
- anything transmitted over IP</STRONG>. In a corporate network example,
- PGP lets the branch offices exchange secure mail with head office. SSL
- and SSH allow them to securely view web pages, connect as terminals to
- machines, and so on. IPsec can support all those applications, plus
- database queries, file sharing (NFS or Windows), other protocols
- encapsulated in IP (Netware, Appletalk, ...), phone-over-IP,
- video-over-IP, ... anything-over-IP. The only limitation is that IP
- Multicast is not yet supported, though there are Internet Draft
- documents for that.</P>
-<P>IPsec creates<STRONG> secure tunnels through untrusted networks</STRONG>
-. Sites connected by these tunnels form VPNs,<A href="#VPN"> Virtual
- Private Networks</A>.</P>
-<P>IPsec gateways can be installed wherever they are required.</P>
-<UL>
-<LI>One organisation might choose to install IPsec only on firewalls
- between their LANs and the Internet. This would allow them to create a
- VPN linking several offices. It would provide protection against anyone
- outside their sites.</LI>
-<LI>Another might install IPsec on departmental servers so everything on
- the corporate backbone net was encrypted. This would protect messages
- on that net from everyone except the sending and receiving department.</LI>
-<LI>Another might be less concerned with information secrecy and more
- with controlling access to certain resources. They might use IPsec
- packet authentication as part of an access control mechanism, with or
- without also using the IPsec encryption service.</LI>
-<LI>It is even possible (assuming adequate processing power and an IPsec
- implementation in each node) to make every machine its own IPsec
- gateway so that everything on a LAN is encrypted. This protects
- information from everyone outside the sending and receiving machine.</LI>
-<LI>These techniques can be combined in various ways. One might, for
- example, require authentication everywhere on a network while using
- encryption only for a few links.</LI>
-</UL>
-<P>Which of these, or of the many other possible variants, to use is up
- to you.<STRONG> IPsec provides mechanisms; you provide the policy</STRONG>
-.</P>
-<P><STRONG>No end user action is required</STRONG> for IPsec security to
- be used; they don't even have to know about it. The site
- administrators, of course, do have to know about it and to put some
- effort into making it work. Poor administration can compromise IPsec as
- badly as the post-it notes mentioned above. It seems reasonable,
- though, for organisations to hope their system administrators are
- generally both more security-conscious than end users and more able to
- follow computer security procedures. If not, at least there are fewer
- of them to educate or replace.</P>
-<P>IPsec can be, and often should be, used with along with security
- protocols at other levels. If two sites communicate with each other via
- the Internet, then IPsec is the obvious way to protect that
- communication. If two others have a direct link between them, either
- link encryption or IPsec would make sense. Choose one or use both.
- Whatever you use at and below the IP level, use other things as
- required above that level. Whatever you use above the IP level,
- consider what can be done with IPsec to make attacks on the higher
- levels harder. For example,<A href="#middle"> man-in-the-middle attacks</A>
- on various protocols become difficult if authentication at packet level
- is in use on the potential victims' communication channel.</P>
-<H3><A name="authonly">Using authentication without encryption</A></H3>
-<P>Where appropriate, IPsec can provide authentication without
- encryption. One might do this, for example:</P>
-<UL>
-<LI>where the data is public but one wants to be sure of getting the
- right data, for example on some web sites</LI>
-<LI>where encryption is judged unnecessary, for example on some company
- or department LANs</LI>
-<LI>where strong encryption is provided at link level, below IP</LI>
-<LI>where strong encryption is provided in other protocols, above IP
-<BR> Note that IPsec authentication may make some attacks on those
- protocols harder.</LI>
-</UL>
-<P>Authentication has lower overheads than encryption.</P>
-<P>The protocols provide four ways to build such connections, using
- either an AH-only connection or ESP using null encryption, and in
- either manually or automatically keyed mode. FreeS/WAN supports only
- one of these, manually keyed AH-only connections, and<STRONG> we do not
- recommend using that</STRONG>. Our reasons are discussed under<A href="#traffic.resist">
- Resisting traffic analysis</A> a few sections further along.</P>
-<H3><A name="encnoauth">Encryption without authentication is dangerous</A>
-</H3>
-<P>Originally, the IPsec encryption protocol<A href="#ESP"> ESP</A>
- didn't do integrity checking. It only did encryption. Steve Bellovin
- found many ways to attack ESP used without authentication. See his
- paper<A href="http://www.research.att.com/~smb/papers/badesp.ps">
- Problem areas for the IP Security Protocols</A>. To make a secure
- connection, you had to add an<A href="#AH"> AH</A> Authentication
- Header as well as ESP. Rather than incur the overhead of several layers
- (and rather than provide an ESP layer that didn't actually protect the
- traffic), the IPsec working group built integrity and replay checking
- directly into ESP.</P>
-<P>Today, typical usage is one of:</P>
-<UL>
-<LI>ESP for encryption and authentication</LI>
-<LI>AH for authentication alone</LI>
-</UL>
-<P>Other variants are allowed by the standard, but not much used:</P>
-<DL>
-<DT>ESP encryption without authentication</DT>
-<DD><STRONG>Bellovin has demonstrated fatal flaws in this. Do not use.</STRONG>
-</DD>
-<DT>ESP encryption with AH authentication</DT>
-<DD>This has higher overheads than using the authentication in ESP, and
- no obvious benefit in most cases. The exception might be a network
- where AH authentication was widely or universally used. If you're going
- to do AH to conform with network policy, why authenticate again in the
- ESP layer?</DD>
-<DT>Authenticate twice, with AH and with ESP</DT>
-<DD>Why? Of course, some folk consider &quot;belt and suspenders&quot; the
- sensible approach to security. If you're among them, you might use both
- protocols here. You might also use both to satisfy different parts of a
- security policy. For example, an organisation might require AH
- authentication everywhere but two users within the organisation might
- use ESP as well.</DD>
-<DT>ESP authentication without encryption</DT>
-<DD>The standard allows this, calling it &quot;null encryption&quot;. FreeS/WAN
- does not support it. We recommend that you use AH instead if
- authentication is all you require. AH authenticates parts of the IP
- header, which ESP-null does not do.</DD>
-</DL>
-<P>Some of these variants cannot be used with FreeS/WAN because we do
- not support ESP-null and do not support automatic keying of AH-only
- connections.</P>
-<P>There are fairly frequent suggestions that AH be dropped entirely
- from the IPsec specifications since ESP and null encryption can handle
- that situation. It is not clear whether this will occur. My guess is
- that it is unlikely.</P>
-<H3><A name="multilayer">Multiple layers of IPsec processing are
- possible</A></H3>
-<P>The above describes combinations possible on a single IPsec
- connection. In a complex network you may have several layers of IPsec
- in play, with any of the above combinations at each layer.</P>
-<P>For example, a connection from a desktop machine to a database server
- might require AH authentication. Working with other host, network and
- database security measures, AH might be just the thing for access
- control. You might decide not to use ESP encryption on such packets,
- since it uses resources and might complicate network debugging. Within
- the site where the server is, then, only AH would be used on those
- packets.</P>
-<P>Users at another office, however, might have their whole connection
- (AH headers and all) passing over an IPsec tunnel connecting their
- office to the one with the database server. Such a tunnel should use
- ESP encryption and authentication. You need authentication in this
- layer because without authentication the encryption is vulnerable and
- the gateway cannot verify the AH authentication. The AH is between
- client and database server; the gateways aren't party to it.</P>
-<P>In this situation, some packets would get multiple layers of IPsec
- applied to them, AH on an end-to-end client-to-server basis and ESP
- from one office's security gateway to the other.</P>
-<H3><A name="traffic.resist">Resisting traffic analysis</A></H3>
-<P><A href="#traffic">Traffic analysis</A> is the attempt to derive
- useful intelligence from encrypted traffic without breaking the
- encryption.</P>
-<P>Is your CEO exchanging email with a venture capital firm? With
- bankruptcy trustees? With an executive recruiting agency? With the
- holder of some important patents? If an eavesdropper learns about any
- of those, then he has interesting intelligence on your company, whether
- or not he can read the messages themselves.</P>
-<P>Even just knowing that there is network traffic between two sites may
- tell an analyst something useful, especially when combined with
- whatever other information he or she may have. For example, if you know
- Company A is having cashflow problems and Company B is looking for
- aquisitions, then knowing that packets are passing between the two is
- interesting. It is more interesting if you can tell it is email, and
- perhaps yet more if you know the sender and recipient.</P>
-<P>Except in the simplest cases, traffic analysis is hard to do well. It
- requires both considerable resources and considerable analytic skill.
- However, intelligence agencies of various nations have been doing it
- for centuries and many of them are likely quite good at it by now.
- Various commercial organisations, especially those working on &quot;targeted
- marketing&quot; may also be quite good at analysing certain types of
- traffic.</P>
-<P>In general, defending against traffic analysis is also difficult.
- Inventing a really good defense could get you a PhD and some
- interesting job offers.</P>
-<P>IPsec is not designed to stop traffic analysis and we know of no
- plausible method of extending it to do so. That said, there are ways to
- make traffic analysis harder. This section describes them.</P>
-<H4><A name="extra">Using &quot;unnecessary&quot; encryption</A></H4>
-<P>One might choose to use encryption even where it appears unnecessary
- in order to make analysis more difficult. Consider two offices which
- pass a small volume of business data between them using IPsec and also
- transfer large volumes of Usenet news. At first glance, it would seem
- silly to encrypt the newsfeed, except possibly for any newsgroups that
- are internal to the company. Why encrypt data that is all publicly
- available from many sites?</P>
-<P>However, if we encrypt a lot of news and send it down the same
- connection as our business data, we make<A href="#traffic"> traffic
- analysis</A> much harder. A snoop cannot now make inferences based on
- patterns in the volume, direction, sizes, sender, destination, or
- timing of our business messages. Those messages are hidden in a mass of
- news messages encapsulated in the same way.</P>
-<P>If we're going to do this we need to ensure that keys change often
- enough to remain secure even with high volumes and with the adversary
- able to get plaintext of much of the data. We also need to look at
- other attacks this might open up. For example, can the adversary use a
- chosen plaintext attack, deliberately posting news articles which, when
- we receive and encrypt them, will help break our encryption? Or can he
- block our business data transmission by flooding us with silly news
- articles? Or ...</P>
-<P>Also, note that this does not provide complete protection against
- traffic analysis. A clever adversary might still deduce useful
- intelligence from statistical analysis (perhaps comparing the input
- newsfeed to encrypted output, or comparing the streams we send to
- different branch offices), or by looking for small packets which might
- indicate establishment of TCP connections, or ...</P>
-<P>As a general rule, though, to improve resistance to traffic analysis,
- you should<STRONG> encrypt as much traffic as possible, not just as
- much as seems necessary.</STRONG></P>
-<H4><A name="multi-encrypt">Using multiple encryption</A></H4>
-<P>This also applies to using multiple layers of encryption. If you have
- an IPsec tunnel between two branch offices, it might appear silly to
- send<A href="#PGP"> PGP</A>-encrypted email through that tunnel.
- However, if you suspect someone is snooping your traffic, then it does
- make sense:</P>
-<UL>
-<LI>it protects the mail headers; they cannot even see who is mailing
- who</LI>
-<LI>it protects against user bungles or software malfunctions that
- accidentally send messages in the clear</LI>
-<LI>it makes any attack on the mail encryption much harder; they have to
- break IPsec or break into your network before they can start on the
- mail encryption</LI>
-</UL>
-<P>Similar arguments apply for<A href="#SSL"> SSL</A>-encrypted web
- traffic or<A href="#ssh"> SSH</A>-encrypted remote login sessions, even
- for end-to-end IPsec tunnels between systems in the two offices.</P>
-<H4><A name="fewer">Using fewer tunnels</A></H4>
-<P>It may also help to use fewer tunnels. For example, if all you
- actually need encrypted is connections between:</P>
-<UL>
-<LI>mail servers at branch and head offices</LI>
-<LI>a few branch office users and the head office database server</LI>
-</UL>
-<P>You might build one tunnel per mail server and one per remote
- database user, restricting traffic to those applications. This gives
- the traffic analyst some information, however. He or she can
- distinguish the tunnels by looking at information in the ESP header
- and, given that distinction and the patterns of tunnel usage, might be
- able to figure out something useful. Perhaps not, but why take the
- risk?</P>
-<P>We suggest instead that you build one tunnel per branch office,
- encrypting everything passing from head office to branches. This has a
- number of advantages:</P>
-<UL>
-<LI>it is easier to build and administer</LI>
-<LI>it resists traffic analysis somewhat better</LI>
-<LI>it provides security for whatever you forgot. For example, if some
- user at a remote office browses proprietary company data on some head
- office web page (that the security people may not even know about!),
- then that data is encrypted before it reaches the Internet.</LI>
-</UL>
-<P>Of course you might also want to add additional tunnels. For example,
- if some of the database data is confidential and should not be exposed
- even within the company, then you need protection from the user's
- desktop to the database server. We suggest you do that in whatever way
- seems appropriate -- IPsec, SSH or SSL might fit -- but, whatever you
- choose, pass it between locations via a gateway-to-gateway IPsec tunnel
- to provide some resistance to traffic analysis.</P>
-<H2><A name="primitives">Cryptographic components</A></H2>
-<P>IPsec combines a number of cryptographic techniques, all of them
- well-known and well-analyzed. The overall design approach was
- conservative; no new or poorly-understood components were included.</P>
-<P>This section gives a brief overview of each technique. It is intended
- only as an introduction. There is more information, and links to
- related topics, in our<A href="glossary.html"> glossary</A>. See also
- our<A href="biblio.html"> bibliography</A> and cryptography<A href="#crypto.link">
- web links</A>.</P>
-<H3><A name="block.cipher">Block ciphers</A></H3>
-<P>The<A href="#encryption"> encryption</A> in the<A href="#ESP"> ESP</A>
- encapsulation protocol is done with a<A href="#block"> block cipher</A>
-.</P>
-<P>We do not implement<A href="#DES"> single DES</A>. It is<A href="#desnotsecure">
- insecure</A>. Our default, and currently only, block cipher is<A href="#3DES">
- triple DES</A>.</P>
-<P>The<A href="#rijndael"> Rijndael</A> block cipher has won the<A href="#AES">
- AES</A> competition to choose a relacement for DES. It will almost
- certainly be added to FreeS/WAN and to other IPsec implementations.<A href="#patch">
- Patches</A> are already available.</P>
-<H3><A name="hash.ipsec">Hash functions</A></H3>
-<H4><A name="hmac.ipsec">The HMAC construct</A></H4>
-<P>IPsec packet authentication is done with the<A href="#HMAC"> HMAC</A>
- construct. This is not just a hash of the packet data, but a more
- complex operation which uses both a hashing algorithm and a key. It
- therefore does more than a simple hash would. A simple hash would only
- tell you that the packet data was not changed in transit, or that
- whoever changed it also regenerated the hash. An HMAC also tells you
- that the sender knew the HMAC key.</P>
-<P>For IPsec HMAC, the output of the hash algorithm is truncated to 96
- bits. This saves some space in the packets. More important, it prevents
- an attacker from seeing all the hash output bits and perhaps creating
- some sort of attack based on that knowledge.</P>
-<H4><A NAME="27_3_2_2">Choice of hash algorithm</A></H4>
-<P>The IPsec RFCs require two hash algorithms --<A href="#MD5"> MD5</A>
- and<A href="#SHA"> SHA-1</A> -- both of which FreeS/WAN implements.</P>
-<P>Various other algorithms -- such as RIPEMD and Tiger -- are listed in
- the RFCs as optional. None of these are in the FreeS/WAN distribution,
- or are likely to be added, although user<A href="#patch"> patches</A>
- exist for several of them.</P>
-<P>Additional hash algorithms --<A href="#SHA-256"> SHA-256, SHA-384 and
- SHA-512</A> -- may be required to give hash strength matching the
- strength of<A href="#AES"> AES</A>. These are likely to be added to
- FreeS/WAN along with AES.</P>
-<H3><A name="DH.keying">Diffie-Hellman key agreement</A></H3>
-<P>The<A href="#DH"> Diffie-Hellman</A> key agreement protocol allows
- two parties (A and B or<A href="#alicebob"> Alice and Bob</A>) to agree
- on a key in such a way that an eavesdropper who intercepts the entire
- conversation cannot learn the key.</P>
-<P>The protocol is based on the<A href="#dlog"> discrete logarithm</A>
- problem and is therefore thought to be secure. Mathematicians have been
- working on that problem for years and seem no closer to a solution,
- though there is no proof that an efficient solution is impossible.</P>
-<H3><A name="RSA.auth">RSA authentication</A></H3>
-<P>The<A href="#RSA"> RSA</A> algorithm (named for its inventors --
- Rivest, Shamir and Adleman) is a very widely used<A href="glossary.html#">
- public key</A> cryptographic technique. It is used in IPsec as one
- method of authenticating gateways for Diffie-Hellman key negotiation.</P>
-<H2><A name="structure">Structure of IPsec</A></H2>
-<P>There are three protocols used in an IPsec implementation:</P>
-<DL>
-<DT>ESP, Encapsulating Security Payload</DT>
-<DD>Encrypts and/or authenticates data</DD>
-<DT>AH, Authentication Header</DT>
-<DD>Provides a packet authentication service</DD>
-<DT>IKE, Internet Key Exchange</DT>
-<DD>Negotiates connection parameters, including keys, for the other two</DD>
-</DL>
-<P>The term &quot;IPsec&quot; is slightly ambiguous. In some contexts, it includes
- all three of the above but in other contexts it refers only to AH and
- ESP.</P>
-<H3><A name="IKE.ipsec">IKE (Internet Key Exchange)</A></H3>
-<P>The IKE protocol sets up IPsec (ESP or AH) connections after
- negotiating appropriate parameters (algorithms to be used, keys,
- connection lifetimes) for them. This is done by exchanging packets on
- UDP port 500 between the two gateways.</P>
-<P>IKE (RFC 2409) was the outcome of a long, complex process in which
- quite a number of protocols were proposed and debated. Oversimplifying
- mildly, IKE combines:</P>
-<DL>
-<DT>ISAKMP (RFC 2408)</DT>
-<DD>The<STRONG> I</STRONG>nternet<STRONG> S</STRONG>ecurity<STRONG> A</STRONG>
-ssociation and<STRONG> K</STRONG>ey<STRONG> M</STRONG>anagement<STRONG>
- P</STRONG>rotocol manages negotiation of connections and defines<A href="#SA">
- SA</A>s (Security Associations) as a means of describing connection
- properties.</DD>
-<DT>IPsec DOI for ISAKMP (RFC 2407)</DT>
-<DD>A<STRONG> D</STRONG>omain<STRONG> O</STRONG>f<STRONG> I</STRONG>
-nterpretation fills in the details necessary to turn the rather abstract
- ISAKMP protocol into a more tightly specified protocol, so it becomes
- applicable in a particular domain.</DD>
-<DT>Oakley key determination protocol (RFC 2412)</DT>
-<DD>Oakley creates keys using the<A href="#DH"> Diffie-Hellman</A> key
- agreement protocol.</DD>
-</DL>
-<P>For all the details, you would need to read the four<A href="rfc.html">
- RFCs</A> just mentioned (over 200 pages) and a number of others. We
- give a summary below, but it is far from complete.</P>
-<H4><A name="phases">Phases of IKE</A></H4>
-<P>IKE negotiations have two phases.</P>
-<DL>
-<DT>Phase one</DT>
-<DD>The two gateways negotiate and set up a two-way ISAKMP SA which they
- can then use to handle phase two negotiations. One such SA between a
- pair of gateways can handle negotiations for multiple tunnels.</DD>
-<DT>Phase two</DT>
-<DD>Using the ISAKMP SA, the gateways negotiate IPsec (ESP and/or AH)
- SAs as required. IPsec SAs are unidirectional (a different key is used
- in each direction) and are always negotiated in pairs to handle two-way
- traffic. There may be more than one pair defined between two gateways.</DD>
-</DL>
-<P>Both of these phases use the UDP protocol and port 500 for their
- negotiations.</P>
-<P>After both IKE phases are complete, you have IPsec SAs to carry your
- encrypted data. These use the ESP or AH protocols. These protocols do
- not have ports. Ports apply only to UDP or TCP.</P>
-<P>The IKE protocol is designed to be extremely flexible. Among the
- things that can be negotiated (separately for each SA) are:</P>
-<UL>
-<LI>SA lifetime before rekeying</LI>
-<LI>encryption algorithm used. We currently support only<A href="#3DES">
- triple DES</A>. Single DES is<A href="#desnotsecure"> insecure</A>. The
- RFCs say you MUST do DES, SHOULD do 3DES and MAY do various others. We
- do not do any of the others.</LI>
-<LI>authentication algorithms. We support<A href="#MD5"> MD5</A> and<A href="#SHA">
- SHA</A>. These are the two the RFCs require.</LI>
-<LI>choice of group for<A href="#DH"> Diffie-Hellman</A> key agreement.
- We currently support Groups 2 and 5 (which are defined modulo primes of
- various lengths) and do not support Group 1 (defined modulo a shorter
- prime, and therefore cryptographically weak) or groups 3 and 4 (defined
- using elliptic curves). The RFCs require only Group 1.</LI>
-</UL>
-<P>The protocol also allows implementations to add their own encryption
- algorithms, authentication algorithms or Diffie-Hellman groups. We do
- not support any such extensions, but there are some<A href="#patch">
- patches</A> that do.</P>
-<P>There are a number of complications:</P>
-<UL>
-<LI>The gateways must be able to authenticate each other's identities
- before they can create a secure connection. This host authentication is
- part of phase one negotiations, and is a required prerequisite for
- packet authentication used later. Host authentication can be done in a
- variety of ways. Those supported by FreeS/WAN are discussed in our<A href="#auto-auth">
- advanced configuration</A> document.</LI>
-<LI>Phase one can be done in two ways.
-<UL>
-<LI>Main Mode is required by the RFCs and supported in FreeS/WAN. It
- uses a 6-packet exzchange.</LI>
-<LI>Aggressive Mode is somewhat faster (only 3 packets) but reveals more
- to an eavesdropper. This is optional in the RFCs, not currently
- supported by FreeS/WAN, and not likely to be.</LI>
-</UL>
-</LI>
-<LI>A new group exchange may take place after phase one but before phase
- two, defining an additional group for use in the<A href="#DH">
- Diffie-Hellman</A> key agreement part of phase two. FreeS/WAN does not
- currently support this.</LI>
-<LI>Phase two always uses Quick Mode, but there are two variants of
- that:
-<UL>
-<LI>One variant provides<A href="#PFS"> Perfect Forward Secrecy (PFS)</A>
-. An attacker that obtains your long-term host authentication key does
- not immediately get any of your short-term packet encryption of packet
- authentication keys. He must conduct another successful attack each
- time you rekey to get the short-term keys. Having some short-term keys
- does not help him learn others. In particular, breaking your system
- today does not let him read messages he archived yestarday, assuming
- you've changed short-term keys in the meanwhile. We enable PFS as the
- default.</LI>
-<LI>The other variant disables PFS and is therefore slightly faster. We
- do not recommend this since it is less secure, but FreeS/WAN does
- support it. You can enable it with a<VAR> pfs=no</VAR> statement in<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A>.</LI>
-<LI>The protocol provides no way to negotiate which variant will be
- used. If one gateway is set for PFS and the other is not, the
- negotiation fails. This has proved a fairly common source of
- interoperation problems.</LI>
-</UL>
-</LI>
-<LI>Several types of notification message may be sent by either side
- during either phase, or later. FreeS/WAN does not currently support
- these, but they are a likely addition in future releases.</LI>
-<LI>There is a commit flag which may optionally be set on some messages.
- The<A href="http://www.lounge.org/ike_doi_errata.html"> errata</A> page
- for the RFCs includes two changes related to this, one to clarify the
- description of its use and one to block a<A href="#DOS"> denial of
- service</A> attack which uses it. We currently do not implement this
- feature.</LI>
-</UL>
-<P>These complications can of course lead to problems, particularly when
- two different implementations attempt to interoperate. For example, we
- have seen problems such as:</P>
-<UL>
-<LI>Some implementations (often products crippled by<A href="#exlaw">
- export laws</A>) have the insecure DES algorithm as their only
- supported encryption method. Other parts of our documentation discuss
- the<A href="#desnotsecure"> reasons we do not implement single DES</A>,
- and<A href="interop.html#noDES"> how to cope with crippled products</A>
-.</LI>
-<LI>Windows 2000 IPsec tries to negotiate using Aggressive Mode, which
- we don't support. Later on, it uses the commit bit, which we also don't
- support.</LI>
-<LI>Various implementations disable PFS by default, and therefore will
- not talk to FreeS/WAN until you either turn on PFS on their end or turn
- it off in FreeS/WAN with a<VAR> pfs=no</VAR> entry in the connection
- description.</LI>
-<LI>FreeS/WAN's interaction with PGPnet is complicated by their use of
- notification messages we do not yet support.</LI>
-</UL>
-<P>Despite this, we do interoperate successfully with many
- implementations, including both Windows 2000 and PGPnet. Details are in
- our<A href="interop.html"> interoperability</A> document.</P>
-<H4><A name="sequence">Sequence of messages in IKE</A></H4>
-<P>Each phase (see<A href="#phases"> previous section</A>)of IKE
- involves a series of messages. In Pluto error messages, these are
- abbreviated using:</P>
-<DL>
-<DT>M</DT>
-<DD><STRONG>M</STRONG>ain mode, settting up the keying channel (ISAKMP
- SA)</DD>
-<DT>Q</DT>
-<DD><STRONG>Q</STRONG>uick mode, setting up the data channel (IPsec SA)</DD>
-<DT>I</DT>
-<DD><STRONG>I</STRONG>nitiator, the machine that starts the negotiation</DD>
-<DT>R</DT>
-<DD><STRONG>R</STRONG>esponder</DD>
-</DL>
-<P>For example, the six messages of a main mode negotiation, in
- sequence, are labelled:</P>
-<PRE>       MI1 ----------&gt;
-           &lt;---------- MR1
-       MI2 ----------&gt; 
-           &lt;---------- MR2
-       MI3 ----------&gt;
-           &lt;---------- MR3</PRE>
-<H4><A name="struct.exchange">Structure of IKE messages</A></H4>
-<P>Here is our Pluto developer explaining some of this on the mailing
- list:</P>
-<PRE>When one IKE system (for example, Pluto) is negotiating with another
-to create an SA, the Initiator proposes a bunch of choices and the
-Responder replies with one that it has selected.
-
-The structure of the choices is fairly complicated.  An SA payload
-contains a list of lists of &quot;Proposals&quot;.  The outer list is a set of
-choices: the selection must be from one element of this list.
-
-Each of these elements is a list of Proposals.  A selection must be
-made from each of the elements of the inner list.  In other words,
-*all* of them apply (that is how, for example, both AH and ESP can
-apply at once).
-
-Within each of these Proposals is a list of Transforms.  For each
-Proposal selected, one Transform must be selected (in other words,
-each Proposal provides a choice of Transforms).
-
-Each Transform is made up of a list of Attributes describing, well,
-attributes.  Such as lifetime of the SA.  Such as algorithm to be
-used.  All the Attributes apply to a Transform.
-
-You will have noticed a pattern here: layers alternate between being
-disjunctions (&quot;or&quot;) and conjunctions (&quot;and&quot;).
-
-For Phase 1 / Main Mode (negotiating an ISAKMP SA), this structure is
-cut back.  There must be exactly one Proposal.  So this degenerates to
-a list of Transforms, one of which must be chosen.</PRE>
-<H3><A name="services">IPsec Services, AH and ESP</A></H3>
-<P>IPsec offers two services,<A href="#authentication"> authentication</A>
- and<A href="#encryption"> encryption</A>. These can be used separately
- but are often used together.</P>
-<DL>
-<DT>Authentication</DT>
-<DD>Packet-level authentication allows you to be confident that a packet
- came from a particular machine and that its contents were not altered
- en route to you. No attempt is made to conceal or protect the contents,
- only to assure their integrity. Packet authentication can be provided
- separately using an<A href="#AH"> Authentication Header</A>, described
- just below, or it can be included as part of the<A href="#ESP"> ESP</A>
- (Encapsulated Security Payload) service, described in the following
- section. That service offers encryption as well as authentication. In
- either case, the<A href="#HMAC"> HMAC</A> construct is used as the
- authentication mechanism.
-<P>There is a separate authentication operation at the IKE level, in
- which each gateway authenticates the other. This can be done in a
- variety of ways.</P>
-</DD>
-<DT>Encryption</DT>
-<DD>Encryption allows you to conceal the contents of a message from
- eavesdroppers.
-<P>In IPsec this is done using a<A href="#block"> block cipher</A>
- (normally<A href="#3DES"> Triple DES</A> for Linux). In the most used
- setup, keys are automatically negotiated, and periodically
- re-negotiated, using the<A href="#IKE"> IKE</A> (Internet Key Exchange)
- protocol. In Linux FreeS/WAN this is handled by the Pluto Daemon.</P>
-<P>The IPsec protocol offering encryption is<A href="#ESP"> ESP</A>,
- Encapsulated Security Payload. It can also include a packet
- authentication service.</P>
-</DD>
-</DL>
-<P>Note that<STRONG> encryption should always be used with some packet
- authentication service</STRONG>. Unauthenticated encryption is
- vulnerable to<A href="#middle"> man-in-the-middle attacks</A>. Also
- note that encryption does not prevent<A href="#traffic"> traffic
- analysis</A>.</P>
-<H3><A name="AH.ipsec">The Authentication Header (AH)</A></H3>
-<P>Packet authentication can be provided separately from encryption by
- adding an authentication header (AH) after the IP header but before the
- other headers on the packet. This is the subject of this section.
- Details are in RFC 2402.</P>
-<P>Each of the several headers on a packet header contains a &quot;next
- protocol&quot; field telling the system what header to look for next. IP
- headers generally have either TCP or UDP in this field. When IPsec
- authentication is used, the packet IP header has AH in this field,
- saying that an Authentication Header comes next. The AH header then has
- the next header type -- usually TCP, UDP or encapsulated IP.</P>
-<P>IPsec packet authentication can be added in transport mode, as a
- modification of standard IP transport. This is shown in this diagram
- from the RFC:</P>
-<PRE>                  BEFORE APPLYING AH
-            ----------------------------
-      IPv4  |orig IP hdr  |     |      |
-            |(any options)| TCP | Data |
-            ----------------------------
-
-                  AFTER APPLYING AH
-            ---------------------------------
-      IPv4  |orig IP hdr  |    |     |      |
-            |(any options)| AH | TCP | Data |
-            ---------------------------------
-            ||
-                 except for mutable fields</PRE>
-<P>Athentication can also be used in tunnel mode, encapsulating the
- underlying IP packet beneath AH and an additional IP header.</P>
-<PRE>                         ||
-IPv4  | new IP hdr* |    | orig IP hdr*  |    |      |
-      |(any options)| AH | (any options) |TCP | Data |
-      ------------------------------------------------
-      ||
-      |           in the new IP hdr                  |</PRE>
-<P>This would normally be used in a gateway-to-gateway tunnel. The
- receiving gateway then strips the outer IP header and the AH header and
- forwards the inner IP packet.</P>
-<P>The mutable fields referred to are things like the time-to-live field
- in the IP header. These cannot be included in authentication
- calculations because they change as the packet travels.</P>
-<H4><A name="keyed">Keyed MD5 and Keyed SHA</A></H4>
-<P>The actual authentication data in the header is typically 96 bits and
- depends both on a secret shared between sender and receiver and on
- every byte of the data being authenticated. The technique used is<A href="#HMAC">
- HMAC</A>, defined in RFC 2104.</P>
-<P>The algorithms involved are the<A href="#MD5"> MD5</A> Message Digest
- Algorithm or<A href="#SHA"> SHA</A>, the Secure Hash Algorithm. For
- details on their use in this application, see RFCs 2403 and 2404
- respectively.</P>
-<P>For descriptions of the algorithms themselves, see RFC 1321 for MD5
- and<A href="#FIPS"> FIPS</A> (Federal Information Processing Standard)
- number 186 from<A href="#NIST"> NIST</A>, the US National Institute of
- Standards and Technology for SHA.<A href="#schneier"><CITE> Applied
- Cryptography</CITE></A> covers both in some detail, MD5 starting on
- page 436 and SHA on 442.</P>
-<P>These algorithms are intended to make it nearly impossible for anyone
- to alter the authenticated data in transit. The sender calculates a
- digest or hash value from that data and includes the result in the
- authentication header. The recipient does the same calculation and
- compares results. For unchanged data, the results will be identical.
- The hash algorithms are designed to make it extremely difficult to
- change the data in any way and still get the correct hash.</P>
-<P>Since the shared secret key is also used in both calculations, an
- interceptor cannot simply alter the authenticated data and change the
- hash value to match. Without the key, he or she (or even the dreaded
- They) cannot produce a usable hash.</P>
-<H4><A name="sequence">Sequence numbers</A></H4>
-<P>The authentication header includes a sequence number field which the
- sender is required to increment for each packet. The receiver can
- ignore it or use it to check that packets are indeed arriving in the
- expected sequence.</P>
-<P>This provides partial protection against<A href="#replay"> replay
- attacks</A> in which an attacker resends intercepted packets in an
- effort to confuse or subvert the receiver. Complete protection is not
- possible since it is necessary to handle legitmate packets which are
- lost, duplicated, or delivered out of order, but use of sequence
- numbers makes the attack much more difficult.</P>
-<P>The RFCs require that sequence numbers never cycle, that a new key
- always be negotiated before the sequence number reaches 2^32-1. This
- protects both against replays attacks using packets from a previous
- cyclce and against<A href="#birthday"> birthday attacks</A> on the the
- packet authentication algorithm.</P>
-<P>In Linux FreeS/WAN, the sequence number is ignored for manually keyed
- connections and checked for automatically keyed ones. In manual mode,
- there is no way to negotiate a new key, or to recover from a sequence
- number problem, so we don't use sequence numbers.</P>
-<H3><A name="ESP.ipsec">Encapsulated Security Payload (ESP)</A></H3>
-<P>The ESP protocol is defined in RFC 2406. It provides one or both of
- encryption and packet authentication. It may be used with or without AH
- packet authentication.</P>
-<P>Note that<STRONG> some form of packet authentication should<EM>
- always</EM> be used whenever data is encrypted</STRONG>. Without
- authentication, the encryption is vulnerable to active attacks which
- may allow an enemy to break the encryption. ESP should<STRONG> always</STRONG>
- either include its own authentication or be used with AH
- authentication.</P>
-<P>The RFCs require support for only two mandatory encryption algorithms
- --<A href="#DES"> DES</A>, and null encryption -- and for two
- authentication methods -- keyed MD5 and keyed SHA. Implementers may
- choose to support additional algorithms in either category.</P>
-<P>The authentication algorithms are the same ones used in the IPsec<A href="#AH">
- authentication header</A>.</P>
-<P>We do not implement single DES since<A href="#desnotsecure"> DES is
- insecure</A>. Instead we provide<A href="#3DES"> triple DES or 3DES</A>
-. This is currently the only encryption algorithm supported.</P>
-<P>We do not implement null encryption since it is obviously insecure.</P>
-<H2><A name="modes">IPsec modes</A></H2>
-<P>IPsec can connect in two modes. Transport mode is a host-to-host
- connection involving only two machines. In tunnel mode, the IPsec
- machines act as gateways and trafiic for any number of client machines
- may be carried.</P>
-<H3><A name="tunnel.ipsec">Tunnel mode</A></H3>
-<P>Security gateways are required to support tunnel mode connections. In
- this mode the gateways provide tunnels for use by client machines
- behind the gateways. The client machines need not do any IPsec
- processing; all they have to do is route things to gateways.</P>
-<H3><A name="transport.ipsec">Transport mode</A></H3>
-<P>Host machines (as opposed to security gateways) with IPsec
- implementations must also support transport mode. In this mode, the
- host does its own IPsec processing and routes some packets via IPsec.</P>
-<H2><A name="parts">FreeS/WAN parts</A></H2>
-<H3><A name="KLIPS.ipsec">KLIPS: Kernel IPsec Support</A></H3>
-<P>KLIPS is<STRONG> K</STRONG>erne<STRONG>L</STRONG><STRONG> IP</STRONG>
-SEC<STRONG> S</STRONG>upport, the modifications necessary to support
- IPsec within the Linux kernel. KILPS does all the actual IPsec
- packet-handling, including</P>
-<UL>
-<LI>encryption</LI>
-<LI>packet authentication calculations</LI>
-<LI>creation of ESP and AH headers for outgoing packets</LI>
-<LI>interpretation of those headers on incoming packets</LI>
-</UL>
-<P>KLIPS also checks all non-IPsec packets to ensure they are not
- bypassing IPsec security policies.</P>
-<H3><A name="Pluto.ipsec">The Pluto daemon</A></H3>
-<P><A href="manpage.d/ipsec_pluto.8.html">Pluto(8)</A> is a daemon which
- implements the IKE protocol. It</P>
-<UL>
-<LI>handles all the Phase one ISAKMP SAs</LI>
-<LI>performs host authentication and negotiates with other gateways</LI>
-<LI>creates IPsec SAs and passes the data required to run them to KLIPS</LI>
-<LI>adjust routing and firewall setup to meet IPsec requirements. See
- our<A href="firewall.html"> IPsec and firewalling</A> document for
- details.</LI>
-</UL>
-<P>Pluto is controlled mainly by the<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> configuration file.</P>
-<H3><A name="command">The ipsec(8) command</A></H3>
-<P>The<A href="manpage.d/ipsec.8.html"> ipsec(8)</A> command is a front
- end shellscript that allows control over IPsec activity.</P>
-<H3><A name="ipsec.conf">Linux FreeS/WAN configuration file</A></H3>
-<P>The configuration file for Linux FreeS/WAN is</P>
-<PRE>        /etc/ipsec.conf</PRE>
-<P>For details see the<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> manual page .</P>
-<H2><A name="key">Key management</A></H2>
-<P>There are several ways IPsec can manage keys. Not all are implemented
- in Linux FreeS/WAN.</P>
-<H3><A name="current">Currently Implemented Methods</A></H3>
-<H4><A name="manual">Manual keying</A></H4>
-<P>IPsec allows keys to be manually set. In Linux FreeS/WAN, such keys
- are stored with the connection definitions in /etc/ipsec.conf.</P>
-<P><A href="#manual">Manual keying</A> is useful for debugging since it
- allows you to test the<A href="#KLIPS"> KLIPS</A> kernel IPsec code
- without the<A href="#Pluto"> Pluto</A> daemon doing key negotiation.</P>
-<P>In general, however, automatic keying is preferred because it is more
- secure.</P>
-<H4><A name="auto">Automatic keying</A></H4>
-<P>In automatic keying, the<A href="#Pluto"> Pluto</A> daemon negotiates
- keys using the<A href="#IKE"> IKE</A> Internet Key Exchange protocol.
- Connections are automatically re-keyed periodically.</P>
-<P>This is considerably more secure than manual keying. In either case
- an attacker who acquires a key can read every message encrypted with
- that key, but automatic keys can be changed every few hours or even
- every few minutes without breaking the connection or requiring
- intervention by the system administrators. Manual keys can only be
- changed manually; you need to shut down the connection and have the two
- admins make changes. Moreover, they have to communicate the new keys
- securely, perhaps with<A href="#PGP"> PGP</A> or<A href="#ssh"> SSH</A>
-. This may be possible in some cases, but as a general solution it is
- expensive, bothersome and unreliable. Far better to let<A href="#Pluto">
- Pluto</A> handle these chores; no doubt the administrators have enough
- to do.</P>
-<P>Also, automatic keying is inherently more secure against an attacker
- who manages to subvert your gateway system. If manual keying is in use
- and an adversary acquires root privilege on your gateway, he reads your
- keys from /etc/ipsec.conf and then reads all messages encrypted with
- those keys.</P>
-<P>If automatic keying is used, an adversary with the same privileges
- can read /etc/ipsec.secrets, but this does not contain any keys, only
- the secrets used to authenticate key exchanges. Having an adversary
- able to authenticate your key exchanges need not worry you overmuch.
- Just having the secrets does not give him any keys. You are still
- secure against<A href="#passive"> passive</A> attacks. This property of
- automatic keying is called<A href="#PFS"> perfect forward secrecy</A>,
- abbreviated PFS.</P>
-<P>Unfortunately, having the secrets does allow an<A href="#active">
- active attack</A>, specifically a<A href="#middle"> man-in-the-middle</A>
- attack. Losing these secrets to an attacker may not be quite as
- disastrous as losing the actual keys, but it is<EM> still a serious
- security breach</EM>. These secrets should be guarded as carefully as
- keys.</P>
-<H3><A name="notyet">Methods not yet implemented</A></H3>
-<H4><A name="noauth">Unauthenticated key exchange</A></H4>
-<P>It would be possible to exchange keys without authenticating the
- players. This would support<A href="#carpediem"> opportunistic
- encryption</A> -- allowing any two systems to encrypt their
- communications without requiring a shared PKI or a previously
- negotiated secret -- and would be secure against<A href="#passive">
- passive attacks</A>. It would, however, be highly vulnerable to active<A
-href="#middle"> man-in-the-middle</A> attacks. RFC 2408 therefore
- specifies that all<A href="#ISAKMP"> ISAKMP</A> key management
- interactions<EM> must</EM> be authenticated.</P>
-<P>There is room for debate here. Should we provide immediate security
- against<A href="#passive"> passive attacks</A> and encourage widespread
- use of encryption, at the expense of risking the more difficult<A href="#active">
- active attacks</A>? Or should we wait until we can implement a solution
- that can both be widespread and offer security against active attacks?</P>
-<P>So far, we have chosen the second course, complying with the RFCs and
- waiting for secure DNS (see<A href="#DNS"> below</A>) so that we can do<A
-href="#carpediem"> opportunistic encryption</A> right.</P>
-<H4><A name="DNS">Key exchange using DNS</A></H4>
-<P>The IPsec RFCs allow key exchange based on authentication services
- provided by<A href="#SDNS"> Secure DNS</A>. Once Secure DNS service
- becomes widely available, we expect to make this the<EM> primary key
- management method for Linux FreeS/WAN</EM>. It is the best way we know
- of to support<A href="#carpediem"> opportunistic encryption</A>,
- allowing two systems without a common PKI or previous negotiation to
- secure their communication.</P>
-<P>We currently have code to acquire RSA keys from DNS but do not yet
- have code to validate Secure DNS signatures.</P>
-<H4><A name="PKI">Key exchange using a PKI</A></H4>
-<P>The IPsec RFCs allow key exchange based on authentication services
- provided by a<A href="#PKI"> PKI</A> or Public Key Infrastructure. With
- many vendors selling such products and many large organisations
- building these infrastructures, this will clearly be an important
- application of IPsec and one Linux FreeS/WAN will eventually support.</P>
-<P>On the other hand, this is not as high a priority for Linux FreeS/WAN
- as solutions based on<A href="#SDNS"> secure DNS</A>. We do not expect
- any PKI to become as universal as DNS.</P>
-<P>Some<A href="#patch"> patches</A> to handle authentication with X.509
- certificates, which most PKIs use, are available.</P>
-<H4><A name="photuris">Photuris</A></H4>
-<P><A href="#photuris">Photuris</A> is another key management protocol,
- an alternative to IKE and ISAKMP, described in RFCs 2522 and 2523 which
- are labelled &quot;experimental&quot;. Adding Photuris support to Linux FreeS/WAN
- might be a good project for a volunteer. The likely starting point
- would be the OpenBSD photurisd code.</P>
-<H4><A name="skip">SKIP</A></H4>
-<P><A href="#SKIP">SKIP</A> is yet another key management protocol,
- developed by Sun. At one point it was fairly widely used, but it now
- seems moribund, displaced by IKE. Sun now (as of Solaris 8.0) ship an
- IPsec implementation using IKE. We have no plans to implement SKIP. If
- a user were to implement it, we would almost certainly not want to add
- the code to our distribution.</P>
-<HR>
-<H1><A name="lists">Mailing lists and newsgroups</A></H1>
-<H2><A name="list.fs">Mailing lists about FreeS/WAN</A></H2>
-<H3><A name="projlist">The project mailing lists</A></H3>
-<P>The Linux FreeS/WAN project has several email lists for user support,
- bug reports and software development discussions.</P>
-<P>We had a single list on clinet.fi for several years (Thanks, folks!),
- then one list on freeswan.org, but now we've split into several lists:</P>
-<DL>
-<DT><A href="mailto:users-request@lists.freeswan.org?body=subscribe">
-users</A></DT>
-<DD>
-<UL>
-<LI>The general list for discussing use of the software</LI>
-<LI>The place for seeking<STRONG> help with problems</STRONG> (but
- please check the<A href="faq.html"> FAQ</A> first).</LI>
-<LI>Anyone can post.</LI>
-</UL>
-</DD>
-<DT><A href="mailto:bugs-request@lists.freeswan.org?body=subscribe">bugs</A>
-</DT>
-<DD>
-<UL>
-<LI>For<STRONG> bug reports</STRONG>.</LI>
-<LI>If you are not certain what is going on -- could be a bug, a
- configuration error, a network problem, ... -- please post to the users
- list instead.</LI>
-<LI>Anyone can post.</LI>
-</UL>
-</DD>
-<DT><A href="mailto:design-request@lists.freeswan.org?body=subscribe">
-design</A></DT>
-<DD>
-<UL>
-<LI><STRONG>Design discussions</STRONG>, for people working on FreeS/WAN
- development or others with an interest in design and security issues.</LI>
-<LI>It would be a good idea to read the existing design papers (see this<A
-href="#applied"> list</A>) before posting.</LI>
-<LI>Anyone can post.</LI>
-</UL>
-</DD>
-<DT><A href="mailto:announce-request@lists.freeswan.org?body=subscribe">
-announce</A></DT>
-<DD>
-<UL>
-<LI>A<STRONG> low-traffic</STRONG> list.</LI>
-<LI><STRONG>Announcements</STRONG> about FreeS/WAN and related software.</LI>
-<LI>All posts here are also sent to the users list. You need not
- subscribe to both.</LI>
-<LI>Only the FreeS/WAN team can post.</LI>
-<LI>If you have something you feel should go on this list, send it to<VAR>
- announce-admin@lists.freeswan.org</VAR>. Unless it is obvious, please
- include a short note explaining why we should post it.</LI>
-</UL>
-</DD>
-<DT><A href="mailto:briefs-request@lists.freeswan.org?body=subscribe">
-briefs</A></DT>
-<DD>
-<UL>
-<LI>A<STRONG> low-traffic</STRONG> list.</LI>
-<LI><STRONG>Weekly summaries</STRONG> of activity on the users list.</LI>
-<LI>All posts here are also sent to the users list. You need not
- subscribe to both.</LI>
-<LI>Only the FreeS/WAN team can post.</LI>
-</UL>
-</DD>
-</DL>
-<P>To subscribe to any of these, you can:</P>
-<UL>
-<LI>just follow the links above</LI>
-<LI>use our<A href="http://www.freeswan.org/mail.html"> web interface</A>
-</LI>
-<LI>send mail to<VAR> listname</VAR>-request@lists.freeswan.org with a
- one-line message body &quot;subscribe&quot;</LI>
-</UL>
-<P>Archives of these lists are available via the<A href="http://www.freeswan.org/mail.html">
- web interface</A>.</P>
-<H4><A name="which.list">Which list should I use?</A></H4>
-<P>For most questions, please check the<A href="faq.html"> FAQ</A>
- first, and if that does not have an answer, ask on the users list. &quot;My
- configuration doesn't work.&quot; does not belong on the bugs list, and &quot;Can
- FreeS/WAN do such-and-such&quot; or &quot;How do I configure it to...&quot; do not
- belong in design discussions.</P>
-<P>Cross-posting the same message to two or more of these lists is
- discouraged. Quite a few people read more than one list and getting
- multiple copies is annoying.</P>
-<H4><A name="policy.list">List policies</A></H4>
-<P><STRONG>US citizens or residents are asked not to post code to the
- lists, not even one-line bug fixes</STRONG>. The project cannot accept
- code which might entangle it in US<A href="#exlaw"> export restrictions</A>
-.</P>
-<P>Non-subscribers can post to some of these lists. This is necessary;
- someone working on a gateway install who encounters a problem may not
- have access to a subscribed account.</P>
-<P>Some spam turns up on these lists from time to time. For discussion
- of why we do not attempt to filter it, see the<A href="#spam"> FAQ</A>.
- Please do not clutter the lists with complaints about this.</P>
-<H3><A name="archive">Archives of the lists</A></H3>
-<P>Searchable archives of the old single list have existed for some
- time. At time of writing, it is not yet clear how they will change for
- the new multi-list structure.</P>
-<UL>
-<LI><A href="http://www.sandelman.ottawa.on.ca/linux-ipsec">Canada</A></LI>
-<LI><A href="http://www.nexial.com">Holland</A></LI>
-</UL>
-<P>Note that these use different search engines. Try both.</P>
-<P>Archives of the new lists are available via the<A href="http://www.freeswan.org/mail.html">
- web interface</A>.</P>
-<H2><A name="indexes">Indexes of mailing lists</A></H2>
-<P><A href="http://paml.net/">PAML</A> is the standard reference for<STRONG>
- P</STRONG>ublicly<STRONG> A</STRONG>ccessible<STRONG> M</STRONG>ailing<STRONG>
- L</STRONG>ists. When we last checked, it had over 7500 lists on an
- amazing variety of topics. It also has FAQ information and a search
- engine.</P>
-<P>There is an index of<A href="http://oslab.snu.ac.kr/~djshin/linux/mail-list/index.shtml">
- Linux mailing lists</A> available.</P>
-<P>A list of<A href="http://xforce.iss.net/maillists/otherlists.php">
- computer security mailing lists</A>, with descriptions.</P>
-<H2><A name="otherlists">Lists for related software and topics</A></H2>
-<P>Most links in this section point to subscription addresses for the
- various lists. Send the one-line message &quot;subscribe<VAR> list_name</VAR>
-&quot; to subscribe to any of them.</P>
-<H3><A NAME="28_3_1">Products that include FreeS/WAN</A></H3>
-<P>Our introduction document gives a<A href="#products"> list of
- products that include FreeS/WAN</A>. If you have, or are considering,
- one of those, check the supplier's web site for information on mailing
- lists for their users.</P>
-<H3><A name="linux.lists">Linux mailing lists</A></H3>
-<UL>
-<LI><A href="mailto:majordomo@vger.kernel.org">
-linux-admin@vger.kernel.org</A>, for Linux system administrators</LI>
-<LI><A href="mailto:netfilter-request@lists.samba.org">
-netfilter@lists.samba.org</A>, about Netfilter, which replaces IPchains
- in kernels 2.3.15 and later</LI>
-<LI><A href="mailto:security-audit-request@ferret.lmh.ox.ac.uk">
-security-audit@ferret.lmh.ox.ac.uk</A>, for people working on security
- audits of various Linux programs</LI>
-<LI><A href="mailto:securedistros-request@humbolt.geo.uu.nl">
-securedistros@humbolt.geo.uu.nl</A>, for discussion of issues common to
- all the half dozen projects working on secure Linux distributions.</LI>
-</UL>
-<P>Each of the scure distribution projects also has its own web site and
- mailing list. Some of the sites are:</P>
-<UL>
-<LI><A href="http://bastille-linux.org/">Bastille Linux</A> scripts to
- harden Redhat, e.g. by changing permissions and modifying inialisation
- scripts</LI>
-<LI><A href="http://immunix.org/">Immunix</A> take a different approach,
- using a modified compiler to build kernel and utilities with better
- resistance to various types of overflow and exploit</LI>
-<LI>the<A href="#NSA"> NSA</A> have contractors working on a<A href="#SElinux">
- Security Enhanced Linux</A>, primarily adding stronger access control
- mechanisms. You can download the current version (which interestingly
- is under GPL and not export resrtricted) or subscribe to the mailing
- list from the<A href="http://www.nsa.gov/selinux"> project web page</A>
-.</LI>
-</UL>
-<H3><A name="ietf">Lists for IETF working groups</A></H3>
-<P>Each<A href="#ietf"> IETF</A> working group has an associated mailing
- list where much of the work takes place.</P>
-<UL>
-<LI><A href="mailto:majordomo@lists.tislabs.com">ipsec@lists.tislabs.com</A>
-, the IPsec<A href="http://www.ietf.org/html.charters/ipsec-charter.html">
- working group</A>. This is where the protocols are discussed, new
- drafts announced, and so on. By now, the IPsec working group is winding
- down since the work is essentially complete. A<A href="http://www.sandelman.ottawa.on.ca/ipsec/">
- list archive</A> is available.</LI>
-<LI><A href="mailto:ipsec-policy-request@vpnc.org">IPsec policy</A>
- list, and its<A href="http://www.vpnc.org/ipsec-policy/"> archive</A></LI>
-<LI><A href="mailto:ietf-ipsra-request@vpnc.org">IP secure remote access</A>
- list, and its<A href="http://www.vpnc.org/ietf-ipsra/mail-archive/">
- archive</A></LI>
-</UL>
-<H3><A name="other">Other mailing lists</A></H3>
-<UL>
-<LI><A href="mailto:ipc-announce-request@privacy.org">
-ipc-announce@privacy.org</A> a low-traffic list with announcements of
- developments in privacy, encryption and online civil rights</LI>
-<LI>a VPN mailing list's<A href="http://kubarb.phsx.ukans.edu/~tbird/vpn.html">
- home page</A></LI>
-</UL>
-<H2><A name="newsgroups">Usenet newsgroups</A></H2>
-<UL>
-<LI>sci.crypt</LI>
-<LI>sci.crypt.research</LI>
-<LI>comp.dcom.vpn</LI>
-<LI>talk.politics.crypto</LI>
-</UL>
-<HR>
-<H1><A name="weblink">Web links</A></H1>
-<H2><A name="freeswan">The Linux FreeS/WAN Project</A></H2>
-<P>The main project web site is<A href="http://www.freeswan.org/">
- www.freeswan.org</A>.</P>
-<P>Links to other project-related<A href="#sites"> sites</A> are
- provided in our introduction section.</P>
-<H3><A name="patch">Add-ons and patches for FreeS/WAN</A></H3>
-<P>Some user-contributed patches have been integrated into the FreeS/WAN
- distribution. For a variety of reasons, those listed below have not.</P>
-<P>Note that not all patches are a good idea.</P>
-<UL>
-<LI>There are a number of &quot;features&quot; of IPsec which we do not implement
- because they reduce security. See this<A href="#dropped"> discussion</A>
-. We do not recommend using patches that implement these. One example is
- aggressive mode.</LI>
-<LI>We do not recommend adding &quot;features&quot; of any sort unless they are
- clearly necessary, or at least have clear benefits. For example,
- FreeS/WAN would not become more secure if it offerred a choice of 14
- ciphers. If even one was flawed, it would certainly become less secure
- for anyone using that cipher. Even with 14 wonderful ciphers, it would
- be harder to maintain and administer, hence more vulnerable to various
- human errors.</LI>
-</UL>
-<P>This is not to say that patches are necessarily bad, only that using
- them requires some deliberation. For example, there might be perfectly
- good reasons to add a specific cipher in your application: perhaps GOST
- to comply with government standards in Eastern Europe, or AES for
- performance benefits.</P>
-<H4><A NAME="29_1_1_1">Current patches</A></H4>
-<P>Patches believed current::</P>
-<UL>
-<LI>patches for<A href="http://www.strongsec.com/freeswan/"> X.509
- certificate support</A>, also available from a<A href="http://www.twi.ch/~sna/strongsec/freeswan/">
- mirror site</A></LI>
-<LI>patches to add<A href="http://www.irrigacion.gov.ar/juanjo/ipsec">
- AES and other ciphers</A>. There is preliminary data indicating AES
- gives a substantial<A href="#perf.more"> performance gain</A>.</LI>
-</UL>
-<P>There is also one add-on that takes the form of a modified FreeS/WAN
- distribution, rather than just patches to the standard distribution:</P>
-<UL>
-<LI><A href="http://www.ipv6.iabg.de/downloadframe/index.html">IPv6
- support</A></LI>
-</UL>
-<P>Before using any of the above,, check the<A href="mail.html"> mailing
- lists</A> for news of newer versions and to see whether they have been
- incorporated into more recent versions of FreeS/WAN.</P>
-<H4><A NAME="29_1_1_2">Older patches</A></H4>
-<UL>
-<LI><A href="http://sources.colubris.com/en/projects/FreeSWAN/">hardware
- acceleration</A></LI>
-<LI>a<A href="http://tzukanov.narod.ru/"> series</A> of patches that
-<UL>
-<LI>provide GOST, a Russian gov't. standard cipher, in MMX assembler</LI>
-<LI>add GOST to OpenSSL</LI>
-<LI>add GOST to the International kernel patch</LI>
-<LI>let FreeS/WAN use International kernel patch ciphers</LI>
-</UL>
-</LI>
-<LI>Neil Dunbar's patches for<A href="ftp://hplose.hpl.hp.com/pub/nd/pluto-openssl.tar.gz">
- certificate support</A>, using code from<A href="http://www.openssl.org">
- Open SSL</A>.</LI>
-<LI>Luc Lanthier's<A href="ftp://ftp.netwinder.org/users/f/firesoul/">
- patches</A> for<A href="#PKIX"> PKIX</A> support.</LI>
-<LI><A href="ftp://ftp.heise.de/pub/ct/listings/9916-180.tgz">patches</A>
- to add<A href="#Blowfish"> Blowfish</A>,<A href="#IDEA"> IDEA</A> and<A href="#CAST128">
- CAST-128</A> to FreeS/WAN</LI>
-<LI>patches for FreeS/WAN 1.3, Pluto support for<A href="http://alcatraz.webcriminals.com/~bastiaan/ipsec/">
- external authentication</A>, for example with a smartcard or SKEYID.</LI>
-<LI><A href="http://www.zengl.net/freeswan/download/">patches and
- utilities</A> for using FreeS/WAN with PGPnet</LI>
-<LI><A href="http://www.freelith.com/lithworks/crypto/freeswan_patch.htm">
-Blowfish encryption and Tiger hash</A></LI>
-<LI><A href="http://www.cendio.se/~bellman/aggressive-pluto.snap.tar.gz">
-patches</A> for aggressive mode support</LI>
-</UL>
-<P>These patches are for older versions of FreeS/WAN and will likely not
- work with the current version. Older versions of FreeS/WAN may be
- available on some of the<A href="#sites"> distribution sites</A>, but
- we recommend using the current release.</P>
-<H4><A name="VPN.masq">VPN masquerade patches</A></H4>
-<P>Finally, there are some patches to other code that may be useful with
- FreeS/WAN:</P>
-<UL>
-<LI>a<A href="ftp://ftp.rubyriver.com/pub/jhardin/masquerade/ip_masq_vpn.html">
- patch</A> to make IPsec, PPTP and SSH VPNs work through a Linux
- firewall with<A href="#masq"> IP masquerade</A>.</LI>
-<LI><A href="http://www.linuxdoc.org/HOWTO/VPN-Masquerade-HOWTO.html">
-Linux VPN Masquerade HOWTO</A></LI>
-</UL>
-<P>Note that this is not required if the same machine does IPsec and
- masquerading, only if you want a to locate your IPsec gateway on a
- masqueraded network. See our<A href="#NAT"> firewalls</A> document for
- discussion of why this is problematic.</P>
-<P>At last report, this patch could not co-exist with FreeS/WAN on the
- same machine.</P>
-<H3><A name="dist">Distributions including FreeS/WAN</A></H3>
-<P>The introductory section of our document set lists several<A href="#distwith">
- Linux distributions</A> which include FreeS/WAN.</P>
-<H3><A name="used">Things FreeS/WAN uses or could use</A></H3>
-<UL>
-<LI><A href="http://openpgp.net/random">/dev/random</A> support page,
- discussion of and code for the Linux<A href="#random"> random number
- driver</A>. Out-of-date when we last checked (January 2000), but still
- useful.</LI>
-<LI>other programs related to random numbers:
-<UL>
-<LI><A href="http://www.mindrot.org/audio-entropyd.html">audio entropy
- daemon</A> to gather noise from a sound card and feed it into
- /dev/random</LI>
-<LI>an<A href="http://www.lothar.com/tech/crypto/"> entropy-gathering
- daemon</A></LI>
-<LI>a driver for the random number generator in recent<A href="http://sourceforge.net/projects/gkernel/">
- Intel chipsets</A>. This driver is included as standard in 2.4 kernels.</LI>
-</UL>
-</LI>
-<LI>a Linux<A href="http://www.marko.net/l2tp/"> L2TP Daemon</A> which
- might be useful for communicating with Windows 2000 which builds L2TP
- tunnels over its IPsec connections</LI>
-<LI>to use opportunistic encryption, you need a recent version of<A href="#BIND">
- BIND</A>. You can get one from the<A href="http://www.isc.org">
- Internet Software Consortium</A> who maintain BIND.</LI>
-</UL>
-<H3><A name="alternatives">Other approaches to VPNs for Linux</A></H3>
-<UL>
-<LI>other Linux<A href="#linuxipsec"> IPsec implementations</A></LI>
-<LI><A href="http://www.tik.ee.ethz.ch/~skip/">ENskip</A>, a free
- implementation of Sun's<A href="#SKIP"> SKIP</A> protocol</LI>
-<LI><A href="http://sunsite.auc.dk/vpnd/">vpnd</A>, a non-IPsec VPN
- daemon for Linux which creates tunnels using<A href="#Blowfish">
- Blowfish</A> encryption</LI>
-<LI><A href="http://www.winton.org.uk/zebedee/">Zebedee</A>, a simple
- GPLd tunnel-building program with Linux and Win32 versions. The name is
- from<STRONG> Z</STRONG>lib compression,<STRONG> B</STRONG>lowfish
- encryption and<STRONG> D</STRONG>iffie-Hellman key exchange.</LI>
-<LI>There are at least two PPTP implementations for Linux
-<UL>
-<LI>Moreton Bay's<A href="http://www.moretonbay.com/vpn/pptp.html">
- PoPToP</A></LI>
-<LI><A href="http://cag.lcs.mit.edu/~cananian/Projects/PPTP/">PPTP-Linux</A>
-</LI>
-</UL>
-</LI>
-<LI><A href="http://sites.inka.de/sites/bigred/devel/cipe.html">CIPE</A>
- (crypto IP encapsulation) project, using their own lightweight protocol
- to encrypt between routers</LI>
-<LI><A href="http://tinc.nl.linux.org/">tinc</A>, a VPN Daemon</LI>
-</UL>
-<P>There is a list of<A href="http://www.securityportal.com/lskb/10000000/kben10000005.html">
- Linux VPN</A> software in the<A href="http://www.securityportal.com/lskb/kben00000001.html">
- Linux Security Knowledge Base</A>.</P>
-<H2><A name="ipsec.link">The IPsec Protocols</A></H2>
-<H3><A name="general">General IPsec or VPN information</A></H3>
-<UL>
-<LI>The<A href="http://www.vpnc.org"> VPN Consortium</A> is a group for
- vendors of IPsec products. Among other things, they have a good
- collection of<A href="http://www.vpnc.org/white-papers.html"> IPsec
- white papers</A>.</LI>
-<LI>A VPN mailing list with a<A href="http://kubarb.phsx.ukans.edu/~tbird/vpn.html">
- home page</A>, a FAQ, some product comparisons, and many links.</LI>
-<LI><A href="http://www.opus1.com/vpn/index.html">VPN pointer page</A></LI>
-<LI>a<A href="http://www.epm.ornl.gov/~dunigan/vpn.html"> collection</A>
- of VPN links, and some explanation</LI>
-</UL>
-<H3><A name="overview">IPsec overview documents or slide sets</A></H3>
-<UL>
-<LI>the FreeS/WAN<A href="ipsec.html"> document section</A> on these
- protocols</LI>
-</UL>
-<H3><A name="otherlang">IPsec information in languages other than
- English</A></H3>
-<UL>
-<LI><A href="http://www.imib.med.tu-dresden.de/imib/Internet/Literatur/ipsec-docu.html">
-German</A></LI>
-<LI><A href="http://www.kame.net/index-j.html">Japanese</A></LI>
-<LI>Feczak Szabolcs' thesis in<A href="http://feczo.koli.kando.hu/vpn/">
- Hungarian</A></LI>
-<LI>Davide Cerri's thesis and some presentation slides<A href="http://www.linux.it/~davide/doc/">
- Italian</A></LI>
-</UL>
-<H3><A name="RFCs1">RFCs and other reference documents</A></H3>
-<UL>
-<LI><A href="rfc.html">Our document</A> listing the RFCs relevant to
- Linux FreeS/WAN and giving various ways of obtaining both RFCs and
- Internet Drafts.</LI>
-<LI><A href="http://www.vpnc.org/vpn-standards.html">VPN Standards</A>
- page maintained by<A href="#VPNC"> VPNC</A>. This covers both RFCs and
- Drafts, and classifies them in a fairly helpful way.</LI>
-<LI><A href="http://www.rfc-editor.org">RFC archive</A></LI>
-<LI><A href="http://www.ietf.org/ids.by.wg/ipsec.html">Internet Drafts</A>
- related to IPsec</LI>
-<LI>US government<A href="http://www.itl.nist.gov/div897/pubs"> site</A>
- with their<A href="#FIPS"> FIPS</A> standards</LI>
-<LI>Archives of the ipsec@tis.com mailing list where discussion of
- drafts takes place.
-<UL>
-<LI><A href="http://www.sandelman.ottawa.on.ca/ipsec">Eastern Canada</A></LI>
-<LI><A href="http://www.vpnc.org/ietf-ipsec">California</A>.</LI>
-</UL>
-</LI>
-</UL>
-<H3><A name="analysis">Analysis and critiques of IPsec protocols</A></H3>
-<UL>
-<LI>Counterpane's<A href="http://www.counterpane.com/ipsec.pdf">
- evaluation</A> of the protocols</LI>
-<LI>Simpson's<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/1999/06/msg00319.html">
- IKE Considered Dangerous</A> paper. Note that this is a link to an
- archive of our mailing list. There are several replies in addition to
- the paper itself.</LI>
-<LI>Fate Labs<A href="http://www.fatelabs.com/loki-vpn.pdf"> Virual
- Private Problems: the Broken Dream</A></LI>
-<LI>Catherine Meadows' paper<CITE> Analysis of the Internet Key Exchange
- Protocol Using the NRL Protocol Analyzer</CITE>, in<A href="http://chacs.nrl.navy.mil/publications/CHACS/1999/1999meadows-IEEE99.pdf">
- PDF</A> or<A href="http://chacs.nrl.navy.mil/publications/CHACS/1999/1999meadows-IEEE99.ps">
- Postscript</A>.</LI>
-<LI>Perlman and Kaufmnan
-<UL>
-<LI><A href="http://snoopy.seas.smu.edu/ee8392_summer01/week7/perlman2.pdf">
-Key Exchange in IPsec</A></LI>
-<LI>a newer<A href="http://sec.femto.org/wetice-2001/papers/radia-paper.pdf">
- PDF paper</A>,<CITE> Analysis of the IPsec Key Exchange Standard</CITE>
-.</LI>
-</UL>
-</LI>
-<LI>Bellovin's<A href="http://www.research.att.com/~smb/papers/index.html">
- papers</A> page including his:
-<UL>
-<LI><CITE>Security Problems in the TCP/IP Protocol Suite</CITE> (1989)</LI>
-<LI><CITE>Problem Areas for the IP Security Protocols</CITE> (1996)</LI>
-<LI><CITE>Probable Plaintext Cryptanalysis of the IP Security Protocols</CITE>
- (1997)</LI>
-</UL>
-</LI>
-<LI>An<A href="http://www.lounge.org/ike_doi_errata.html"> errata list</A>
- for the IPsec RFCs.</LI>
-</UL>
-<H3><A name="IP.background">Background information on IP</A></H3>
-<UL>
-<LI>An<A href="http://ipprimer.windsorcs.com/"> IP tutorial</A> that
- seems to be written mainly for Netware or Microsoft LAN admins entering
- a new world</LI>
-<LI><A href="http://www.iana.org">IANA</A>, Internet Assigned Numbers
- Authority</LI>
-<LI><A href="http://public.pacbell.net/dedicated/cidr.html">CIDR</A>,
- Classless Inter-Domain Routing</LI>
-<LI>Also see our<A href="biblio.html"> bibliography</A></LI>
-</UL>
-<H2><A name="implement">IPsec Implementations</A></H2>
-<H3><A name="linuxprod">Linux products</A></H3>
-<P>Vendors using FreeS/WAN in turnkey firewall or VPN products are
- listed in our<A href="#turnkey"> introduction</A>.</P>
-<P>Other vendors have Linux IPsec products which, as far as we know, do
- not use FreeS/WAN</P>
-<UL>
-<LI><A href="http://www.redcreek.com/products/shareware.html">Redcreek</A>
- provide an open source Linux driver for their PCI hardware VPN card.
- This card has a 100 Mbit Ethernet port, an Intel 960 CPU plus more
- specialised crypto chips, and claimed encryption performance of 45
- Mbit/sec. The PC sees it as an Ethernet board.</LI>
-<LI><A href="http://linuxtoday.com/stories/8428.html?nn">Paktronix</A>
- offer a Linux-based VPN with hardware encryption</LI>
-<LI><A href="http://www.watchguard.com/">Watchguard</A> use Linux in
- their Firebox product.</LI>
-<LI><A href="http://www.entrust.com">Entrust</A> offer a developers'
- toolkit for using their<A href="#PKI"> PKI</A> for IPsec authentication</LI>
-<LI>According to a report on our mailing list,<A href="http://www.axent.com">
- Axent</A> have a Linux version of their product.</LI>
-</UL>
-<H3><A name="router">IPsec in router products</A></H3>
-<P>All the major router vendors support IPsec, at least in some models.</P>
-<UL>
-<LI><A href="http://www.cisco.com/warp/public/707/16.html">Cisco</A>
- IPsec information</LI>
-<LI>Ascend, now part of<A href="http://www.lucent.com/"> Lucent</A>,
- have some IPsec-based products</LI>
-<LI><A href="http://www.nortelnetworks.com/">Bay Networks</A>, now part
- of Nortel, use IPsec in their Contivity switch product line</LI>
-<LI><A href="http://www.3com.com/products/enterprise.html">3Com</A> have
- a number of VPN products, some using IPsec</LI>
-</UL>
-<H3><A name="fw.web">IPsec in firewall products</A></H3>
-<P>Many firewall vendors offer IPsec, either as a standard part of their
- product, or an optional extra. A few we know about are:</P>
-<UL>
-<LI><A href="http://www.borderware.com/">Borderware</A></LI>
-<LI><A href="http://www.ashleylaurent.com/vpn/ipsec_vpn.htm">Ashley
- Laurent</A></LI>
-<LI><A href="http://www.watchguard.com">Watchguard</A></LI>
-<LI><A href="http://www.fx.dk/firewall/ipsec.html">Injoy</A> for OS/2</LI>
-</UL>
-<P>Vendors using FreeS/WAN in turnkey firewall products are listed in
- our<A href="#turnkey"> introduction</A>.</P>
-<H3><A name="ipsecos">Operating systems with IPsec support</A></H3>
-<P>All the major open source operating systems support IPsec. See below
- for details on<A href="#BSD"> BSD-derived</A> Unix variants.</P>
-<P>Among commercial OS vendors, IPsec players include:</P>
-<UL>
-<LI><A href="http://msdn.microsoft.com/isapi/msdnlib.idc?theURL=/library/backgrnd/html/msdn_ip_security.htm">
-Microsoft</A> have put IPsec in their Windows 2000 and XP products</LI>
-<LI><A href="http://www.s390.ibm.com/stories/1999/os390v2r8_pr.html">IBM</A>
- announce a release of OS390 with IPsec support via a crypto
- co-processor</LI>
-<LI><A href="http://www.sun.com/solaris/ds/ds-security/ds-security.pdf">
-Sun</A> include IPsec in Solaris 8</LI>
-<LI><A href="http://www.hp.com/security/products/extranet-security.html">
-Hewlett Packard</A> offer IPsec for their Unix machines</LI>
-<LI>Certicom have IPsec available for the<A href="http://www.certicom.com/products/movian/movianvpn_tech.html">
- Palm</A>.</LI>
-<LI>There were reports before the release that Apple's Mac OS X would
- have IPsec support built in, but it did not seem to be there when we
- last checked. If you find, it please let us know via the<A href="mail.html">
- mailing list</A>.</LI>
-</UL>
-<H3><A NAME="29_3_5">IPsec on network cards</A></H3>
-<P>Network cards with built-in IPsec acceleration are available from at
- least Intel, 3Com and Redcreek.</P>
-<H3><A name="opensource">Open source IPsec implementations</A></H3>
-<H4><A name="linuxipsec">Other Linux IPsec implementations</A></H4>
-<P>We like to think of FreeS/WAN as<EM> the</EM> Linux IPsec
- implementation, but it is not the only one. Others we know of are:</P>
-<UL>
-<LI><A href="http://www.enst.fr/~beyssac/pipsec/">pipsecd</A>, a
- lightweight implementation of IPsec for Linux. Does not require kernel
- recompilation.</LI>
-<LI>Petr Novak's<A href="ftp://ftp.eunet.cz/icz/ipnsec/"> ipnsec</A>,
- based on the OpenBSD IPsec code and using<A href="#photuris"> Photuris</A>
- for key management</LI>
-<LI>A now defunct project at<A href="http://www.cs.arizona.edu/security/hpcc-blue/linux.html">
- U of Arizona</A> (export controlled)</LI>
-<LI><A href="http://snad.ncsl.nist.gov/cerberus">NIST Cerebus</A>
- (export controlled)</LI>
-</UL>
-<H4><A name="BSD">IPsec for BSD Unix</A></H4>
-<UL>
-<LI><A href="http://www.kame.net/project-overview.html">KAME</A>,
- several large Japanese companies co-operating on IPv6 and IPsec</LI>
-<LI><A href="http://web.mit.edu/network/isakmp">US Naval Research Lab</A>
- implementation of IPv6 and of IPsec for IPv4 (export controlled)</LI>
-<LI><A href="http://www.openbsd.org">OpenBSD</A> includes IPsec as a
- standard part of the distribution</LI>
-<LI><A href="http://www.r4k.net/ipsec">IPsec for FreeBSD</A></LI>
-<LI>a<A href="http://www.netbsd.org/Documentation/network/ipsec/"> FAQ</A>
- on NetBSD's IPsec implementation</LI>
-</UL>
-<H4><A name="misc">IPsec for other systems</A></H4>
-<UL>
-<LI><A href="http://www.tcm.hut.fi/Tutkimus/IPSEC/">Helsinki U of
- Technolgy</A> have implemented IPsec for Solaris, Java and Macintosh</LI>
-</UL>
-<H3><A name="interop.web">Interoperability</A></H3>
-<P>The IPsec protocols are designed so that different implementations
- should be able to work together. As they say &quot;the devil is in the
- details&quot;. IPsec has a lot of details, but considerable success has been
- achieved.</P>
-<H4><A name="result">Interoperability results</A></H4>
-<P>Linux FreeS/WAN has been tested for interoperability with many other
- IPsec implementations. Results to date are in our<A href="interop.html">
- interoperability</A> section.</P>
-<P>Various other sites have information on interoperability between
- various IPsec implementations:</P>
-<UL>
-<LI><A href="http://www.opus1.com/vpn/atl99display.html">interop results</A>
- from a bakeoff in Atlanta, September 1999.</LI>
-<LI>a French company, HSC's,<A href="http://www.hsc.fr/ressources/presentations/ipsec99/index.html.en">
- interoperability</A> test data covers FreeS/WAN, Open BSD, KAME, Linux
- pipsecd, Checkpoint, Red Creek Ravlin, and Cisco IOS</LI>
-<LI><A href="http://www.icsa.net/">ICSA</A> offer certification programs
- for various security-related products. See their list of<A href="http://www.icsa.net/html/communities/ipsec/certification/certified_products/index.shtml">
- certified IPsec</A> products. Linux FreeS/WAN is not currently on that
- list, but several products with which we interoperate are.</LI>
-<LI>VPNC have a page on why they are not yet doing<A href="http://www.vpnc.org/interop.html">
- interoperability</A> testing and a page on the<A href="http://www.vpnc.org/conformance.html">
- spec conformance</A> testing that they are doing</LI>
-<LI>a<A href="http://www.commweb.com/article/COM20000912S0009"> review</A>
- comparing a dozen commercial IPsec implemetations. Unfortunately, the
- reviewers did not look at Open Source implementations such as FreeS/WAN
- or OpenBSD.</LI>
-<LI><A href="http://www.tanu.org/~sakane/doc/public/report-ike-interop0007.html">
-results</A> from interoperability tests at a conference. FreeS/WAN was
- not tested there.</LI>
-<LI>test results from the<A href="http://www.hsc.fr/ressources/veille/ipsec/ipsec2000/">
- IPSEC 2000</A> conference</LI>
-</UL>
-<H4><A name="test1">Interoperability test sites</A></H4>
-<UL>
-<LI><A href="http://www.tahi.org/">TAHI</A>, a Japanese IPv6 testing
- project with free IPsec validation software</LI>
-<LI><A href="http://ipsec-wit.antd.nist.gov">National Institute of
- Standards and Technology</A></LI>
-<LI><A href="http://isakmp-test.ssh.fi/">SSH Communications Security</A></LI>
-</UL>
-<H2><A name="linux.link">Linux links</A></H2>
-<H3><A name="linux.basic">Basic and tutorial Linux information</A></H3>
-<UL>
-<LI>Linux<A href="http://linuxcentral.com/linux/LDP/LDP/gs/gs.html">
- Getting Started</A> HOWTO document</LI>
-<LI>A getting started guide from the<A href="http://darkwing.uoregon.edu/~cchome/linuxgettingstarted.html">
- U of Oregon</A></LI>
-<LI>A large<A href="http://www.herring.org/techie.html"> link collection</A>
- which includes a lot of introductory and tutorial material on Unix,
- Linux, the net, . . .</LI>
-</UL>
-<H3><A name="general">General Linux sites</A></H3>
-<UL>
-<LI><A href="http://www.freshmeat.net">Freshmeat</A> Linux news</LI>
-<LI><A href="http://slashdot.org">Slashdot</A> &quot;News for Nerds&quot;</LI>
-<LI><A href="http://www.linux.org">Linux Online</A></LI>
-<LI><A href="http://www.linuxhq.com">Linux HQ</A></LI>
-<LI><A href="http://www.tux.org">tux.org</A></LI>
-</UL>
-<H3><A name="docs.ldp">Documentation</A></H3>
-<P>Nearly any Linux documentation you are likely to want can be found at
- the<A href="http://metalab.unc.edu/LDP"> Linux Documentation Project</A>
- or LDP.</P>
-<UL>
-<LI><A href="http://metalab.unc.edu/LDP/HOWTO/META-FAQ.html">Meta-FAQ</A>
- guide to Linux information sources</LI>
-<LI>The LDP's HowTo documents are a standard Linux reference. See this<A href="http://www.linuxdoc.org/docs.html#howto">
- list</A>. Documents there most relevant to a FreeS/WAN gateway are:
-<UL>
-<LI><A href="http://metalab.unc.edu/LDP/HOWTO/Kernel-HOWTO.html">Kernel
- HOWTO</A></LI>
-<LI><A href="http://metalab.unc.edu/LDP/HOWTO/Networking-Overview-HOWTO.html">
-Networking Overview HOWTO</A></LI>
-<LI><A href="http://metalab.unc.edu/LDP/HOWTO/Security-HOWTO.html">
-Security HOWTO</A></LI>
-</UL>
-</LI>
-<LI>The LDP do a series of Guides, book-sized publications with more
- detail (and often more &quot;why do it this way?&quot;) than the HowTos. See this<A
-href="http://www.linuxdoc.org/guides.html"> list</A>. Documents there
- most relevant to a FreeS/WAN gateway are:
-<UL>
-<LI><A href="http://www.tml.hut.fi/~viu/linux/sag/">System
- Administrator's Guide</A></LI>
-<LI><A href="http://www.linuxdoc.org/LDP/nag2/index.html">Network
- Adminstrator's Guide</A></LI>
-<LI><A href="http://www.seifried.org/lasg/">Linux Administrator's
- Security Guide</A></LI>
-</UL>
-</LI>
-</UL>
-<P>You may not need to go to the LDP to get this material. Most Linux
- distributions include the HowTos on their CDs and several include the
- Guides as well. Also, most of the Guides and some collections of HowTos
- are available in book form from various publishers.</P>
-<P>Much of the LDP material is also available in languages other than
- English. See this<A href="http://www.linuxdoc.org/links/nenglish.html">
- LDP page</A>.</P>
-<H3><A name="advroute.web">Advanced routing</A></H3>
-<P>The Linux IP stack has some new features in 2.4 kernels. Some HowTos
- have been written:</P>
-<UL>
-<LI>several HowTos for the<A href="http://netfilter.samba.org/unreliable-guides/">
- netfilter</A> firewall code in newer kernels</LI>
-<LI><A href="http://www.ds9a.nl/2.4Networking/HOWTO//cvs/2.4routing/output/2.4networking.html">
-2.4 networking</A> HowTo</LI>
-<LI><A href="http://www.ds9a.nl/2.4Networking/HOWTO//cvs/2.4routing/output/2.4routing.html">
-2.4 routing</A> HowTo</LI>
-</UL>
-<H3><A name="linsec">Security for Linux</A></H3>
-<P>See also the<A href="#docs.ldp"> LDP material</A> above.</P>
-<UL>
-<LI><A href="http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html#trinityos">
-Trinity OS guide to setting up Linux</A></LI>
-<LI><A href="http://www.deter.com/unix">Unix security</A> page</LI>
-<LI><A href="http://linux01.gwdg.de/~alatham/">PPDD</A> encrypting
- filesystem</LI>
-<LI><A href="http://EncryptionHOWTO.sourceforge.net/">Linux Encryption
- HowTo</A> (outdated when last checked, had an Oct 2000 revision date in
- March 2002)</LI>
-</UL>
-<H3><A name="firewall.linux">Linux firewalls</A></H3>
-<P>Our<A href="firewall.html"> FreeS/WAN and firewalls</A> document
- includes links to several sets of<A href="#examplefw"> scripts</A>
- known to work with FreeS/WAN.</P>
-<P>Other information sources:</P>
-<UL>
-<LI><A href="http://ipmasq.cjb.net/">IP Masquerade resource page</A></LI>
-<LI><A href="http://netfilter.samba.org/unreliable-guides/">netfilter</A>
- firewall code in 2.4 kernels</LI>
-<LI>Our list of general<A href="#firewall.web"> firewall references</A>
- on the web</LI>
-<LI><A href="http://users.dhp.com/~whisper/mason/">Mason</A>, a tool for
- automatically configuring Linux firewalls</LI>
-<LI>the web cache software<A href="http://www.squid-cache.org/"> squid</A>
- and<A href="http://www.squidguard.org/"> squidguard</A> which turns
- Squid into a filtering web proxy</LI>
-</UL>
-<H3><A name="linux.misc">Miscellaneous Linux information</A></H3>
-<UL>
-<LI><A href="http://lwn.net/current/dists.php3">Linux distribution
- vendors</A></LI>
-<LI><A href="http://www.linux.org/groups/">Linux User Groups</A></LI>
-</UL>
-<H2><A name="crypto.link">Crypto and security links</A></H2>
-<H3><A name="security">Crypto and security resources</A></H3>
-<H4><A name="std.links">The standard link collections</A></H4>
-<P>Two enormous collections of links, each the standard reference in its
- area:</P>
-<DL>
-<DT>Gene Spafford's<A href="http://www.cerias.purdue.edu/coast/hotlist/">
- COAST hotlist</A></DT>
-<DD>Computer and network security.</DD>
-<DT>Peter Gutmann's<A href="http://www.cs.auckland.ac.nz/~pgut001/links.html">
- Encryption and Security-related Resources</A></DT>
-<DD>Cryptography.</DD>
-</DL>
-<H4><A name="FAQ">Frequently Asked Question (FAQ) documents</A></H4>
-<UL>
-<LI><A href="http://www.faqs.org/faqs/cryptography-faq/">Cryptography
- FAQ</A></LI>
-<LI><A href="http://www.interhack.net/pubs/fwfaq">Firewall FAQ</A></LI>
-<LI><A href="http://www.whitefang.com/sup/secure-faq.html">Secure Unix
- Programming FAQ</A></LI>
-<LI>FAQs for specific programs are listed in the<A href="#tools"> tools</A>
- section below.</LI>
-</UL>
-<H4><A name="cryptover">Tutorials</A></H4>
-<UL>
-<LI>Gary Kessler's<A href="http://www.garykessler.net/library/crypto.html">
- Overview of Cryptography</A></LI>
-<LI>Terry Ritter's<A href="http://www.ciphersbyritter.com/LEARNING.HTM">
- introduction</A></LI>
-<LI>Peter Gutman's<A href="http://www.cs.auckland.ac.nz/~pgut001/tutorial/index.html">
- cryptography</A> tutorial (500 slides in PDF format)</LI>
-<LI>Amir Herzberg of IBM's sildes for his course<A href="http://www.hrl.il.ibm.com/mpay/course.html">
- Introduction to Cryptography and Electronic Commerce</A></LI>
-<LI>the<A href="http://www.gnupg.org/gph/en/manual/c173.html"> concepts
- section</A> of the<A href="#GPG"> GNU Privacy Guard</A> documentation</LI>
-<LI>Bruce Schneier's self-study<A href="http://www.counterpane.com/self-study.html">
- cryptanalysis</A> course</LI>
-</UL>
-<P>See also the<A href="#interesting"> interesting papers</A> section
- below.</P>
-<H4><A name="standards">Crypto and security standards</A></H4>
-<UL>
-<LI><A href="http://csrc.nist.gov/cc">Common Criteria</A>, new
- international computer and network security standards to replace the
- &quot;Rainbow&quot; series</LI>
-<LI>AES<A href="http://csrc.nist.gov/encryption/aes/aes_home.htm">
- Advanced Encryption Standard</A> which will replace DES</LI>
-<LI><A href="http://grouper.ieee.org/groups/1363">IEEE P-1363 public key
- standard</A></LI>
-<LI>our collection of links for the<A href="#ipsec.link"> IPsec</A>
- standards</LI>
-<LI>history of<A href="http://www.visi.com/crypto/evalhist/index.html">
- formal evaluation</A> of security policies and implementation</LI>
-</UL>
-<H4><A name="quotes">Crypto quotes</A></H4>
-<P>There are several collections of cryptographic quotes on the net:</P>
-<UL>
-<LI><A href="http://www.eff.org/pub/EFF/quotes.eff">the EFF</A></LI>
-<LI><A href="http://www.samsimpson.com/cquotes.php">Sam Simpson</A></LI>
-<LI><A href="http://www.amk.ca/quotations/cryptography/page-1.html">AM
- Kutchling</A></LI>
-</UL>
-<H3><A name="policy">Cryptography law and policy</A></H3>
-<H4><A name="legal">Surveys of crypto law</A></H4>
-<UL>
-<LI>International survey of<A href="http://cwis.kub.nl/~FRW/PEOPLE/koops/lawsurvy.htm">
- crypto law</A>.</LI>
-<LI>International survey of<A href="http://rechten.kub.nl/simone/ds-lawsu.htm">
- digital signature law</A></LI>
-</UL>
-<H4><A name="oppose">Organisations opposing crypto restrictions</A></H4>
-<UL>
-<LI>The<A href="#EFF"> EFF</A>'s archives on<A href="http://www.eff.org/pub/Privacy/">
- privacy</A> and<A href="http://www.eff.org/pub/Privacy/ITAR_export/">
- export control</A>.</LI>
-<LI><A href="http://www.gilc.org">Global Internet Liberty Campaign</A></LI>
-<LI><A href="http://www.cdt.org/crypto">Center for Democracy and
- Technology</A></LI>
-<LI><A href="http://www.privacyinternational.org/">Privacy International</A>
-, who give out<A href="http://www.bigbrotherawards.org/"> Big Brother
- Awards</A> to snoopy organisations</LI>
-</UL>
-<H4><A name="other.policy">Other information on crypto policy</A></H4>
-<UL>
-<LI><A href="ftp://ftp.isi.edu/in-notes/rfc1984.txt">RFC 1984</A>, the<A href="#IAB">
- IAB</A> and<A href="#IESG"> IESG</A> Statement on Cryptographic
- Technology and the Internet.</LI>
-<LI>John Young's collection of<A href="http://cryptome.org/"> documents</A>
- of interest to the cryptography, open government and privacy movements,
- organized chronologically</LI>
-<LI>AT&amp;T researcher Matt Blaze's Encryption, Privacy and Security<A href="http://www.crypto.com">
- Resource Page</A></LI>
-<LI>A good<A href="http://cryptome.org/crypto97-ne.htm"> overview</A> of
- the issues from Australia.</LI>
-</UL>
-<P>See also our documentation section on the<A href="politics.html">
- history and politics</A> of cryptography.</P>
-<H3><A name="crypto.tech">Cryptography technical information</A></H3>
-<H4><A name="cryptolinks">Collections of crypto links</A></H4>
-<UL>
-<LI><A href="http://www.counterpane.com/hotlist.html">Counterpane</A></LI>
-<LI><A href="http://www.cs.auckland.ac.nz/~pgut001/links.html">Peter
- Gutman's links</A></LI>
-<LI><A href="http://www.pca.dfn.de/eng/team/ske/pem-dok.html">PKI links</A>
-</LI>
-<LI><A href="http://crypto.yashy.com/www/">Robert Guerra's links</A></LI>
-</UL>
-<H4><A name="papers">Lists of online cryptography papers</A></H4>
-<UL>
-<LI><A href="http://www.counterpane.com/biblio">Counterpane</A></LI>
-<LI><A href="http://www.cryptography.com/resources/papers">
-cryptography.com</A></LI>
-<LI><A href="http://www.cryptosoft.com/html/secpub.htm">Cryptosoft</A></LI>
-</UL>
-<H4><A name="interesting">Particularly interesting papers</A></H4>
-<P>These papers emphasize important issues around the use of
- cryptography, and the design and management of secure systems.</P>
-<UL>
-<LI><A href="http://www.counterpane.com/keylength.html">Key length
- requirements for security</A></LI>
-<LI><A href="http://www.cl.cam.ac.uk/users/rja14/wcf.html">Why
- Cryptosystems Fail</A></LI>
-<LI><A href="http://www.cdt.org/crypto/risks98/">Risks of escrowed
- encryption</A></LI>
-<LI><A href="http://www.counterpane.com/pitfalls.html">Security pitfalls
- in cryptography</A></LI>
-<LI><A href="http://www.acm.org/classics/sep95">Reflections on Trusting
- Trust</A>, Ken Thompson on Trojan horse design</LI>
-<LI><A href="http://www.apache-ssl.org/disclosure.pdf">Security against
- Compelled Disclosure</A>, how to maintain privacy in the face of legal
- or other coersion</LI>
-</UL>
-<H3><A name="compsec">Computer and network security</A></H3>
-<H4><A name="seclink">Security links</A></H4>
-<UL>
-<LI><A href="http://www.cs.purdue.edu/coast/hotlist">COAST Hotlist</A></LI>
-<LI>DMOZ open directory project<A href="http://dmoz.org/Computers/Security/">
- computer security</A> links</LI>
-<LI><A href="http://www-cse.ucsd.edu/users/bsy/sec.html">Bennet Yee</A></LI>
-<LI>Mike Fuhr's<A href="http://www.fuhr.org/~mfuhr/computers/security.html">
- link collection</A></LI>
-<LI><A href="http://www.networkintrusion.co.uk/">links</A> with an
- emphasis on intrusion detection</LI>
-</UL>
-<H4><A name="firewall.web">Firewall links</A></H4>
-<UL>
-<LI><A href="http://www.cs.purdue.edu/coast/firewalls">COAST firewalls</A>
-</LI>
-<LI><A href="http://www.zeuros.co.uk">Firewalls Resource page</A></LI>
-</UL>
-<H4><A name="vpn">VPN links</A></H4>
-<UL>
-<LI><A href="http://www.vpnc.org">VPN Consortium</A></LI>
-<LI>First VPN's<A href="http://www.firstvpn.com/research/rhome.html">
- white paper</A> collection</LI>
-</UL>
-<H4><A name="tools">Security tools</A></H4>
-<UL>
-<LI>PGP -- mail encryption
-<UL>
-<LI><A href="http://www.pgp.com/">PGP Inc.</A> (part of NAI) for
- commercial versions</LI>
-<LI><A href="http://web.mit.edu/network/pgp.html">MIT</A> distributes
- the NAI product for non-commercial use</LI>
-<LI><A href="http://www.pgpi.org/">international</A> distribution site</LI>
-<LI><A href="http://gnupg.org">GNU Privacy Guard (GPG)</A></LI>
-<LI><A href="http://www.dk.pgp.net/pgpnet/pgp-faq/">PGP FAQ</A></LI>
-</UL>
- A message in our mailing list archive has considerable detail on<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/12/msg00029.html">
- available versions</A> of PGP and on IPsec support in them.
-<P><STRONG>Note:</STRONG> A fairly nasty bug exists in all commercial
- PGP versions from 5.5 through 6.5.3. If you have one of those,<STRONG>
- upgrade now</STRONG>.</P>
-</LI>
-<LI>SSH -- secure remote login
-<UL>
-<LI><A href="http://www.ssh.fi">SSH Communications Security</A>, for the
- original software. It is free for trial, academic and non-commercial
- use.</LI>
-<LI><A href="http://www.openssh.com/">Open SSH</A>, the Open BSD team's
- free replacement</LI>
-<LI><A href="http://www.freessh.org/">freessh.org</A>, links to free
- implementations for many systems</LI>
-<LI><A href="http://www.uni-karlsruhe.de/~ig25/ssh-faq">SSH FAQ</A></LI>
-<LI><A href="http://www.chiark.greenend.org.uk/~sgtatham/putty/">Putty</A>
-, an SSH client for Windows</LI>
-</UL>
-</LI>
-<LI>Tripwire saves message digests of your system files. Re-calculate
- the digests and compare to saved values to detect any file changes.
- There are several versions available:
-<UL>
-<LI><A href="http://www.tripwiresecurity.com/">commercial version</A></LI>
-<LI><A href="http://www.tripwire.org/">Open Source</A></LI>
-</UL>
-</LI>
-<LI><A href="http://www.snort.org">Snort</A> and<A href="http://www.lids.org">
- LIDS</A> are intrusion detection system for Linux</LI>
-<LI><A href="http://www.fish.com/~zen/satan/satan.html">SATAN</A> System
- Administrators Tool for Analysing Networks</LI>
-<LI><A href="http://www.insecure.org/nmap/">NMAP</A> Network Mapper</LI>
-<LI><A href="ftp://ftp.porcupine.org/pub/security/index.html">Wietse
- Venema's page</A> with various tools</LI>
-<LI><A href="http://ita.ee.lbl.gov/index.html">Internet Traffic Archive</A>
-, various tools to analyze network traffic, mostly scripts to organise
- and format tcpdump(8) output for specific purposes</LI>
-<LI><A name="ssmail">ssmail -- sendmail patched to do</A><A href="#carpediem">
- opportunistic encryption</A>
-<UL>
-<LI><A href="http://www.home.aone.net.au/qualcomm/">web page</A> with
- links to code and to a Usenix paper describing it, in PDF</LI>
-</UL>
-</LI>
-<LI><A href="http://www.openca.org/">Open CA</A> project to develop a
- freely distributed<A href="#CA"> Certification Authority</A> for
- building a open<A href="#PKI"> Public Key Infrastructure</A>.</LI>
-</UL>
-<H3><A name="people">Links to home pages</A></H3>
-<P>David Wagner at Berkeley provides a set of links to<A href="http://www.cs.berkeley.edu/~daw/people/crypto.html">
- home pages</A> of cryptographers, cypherpunks and computer security
- people.</P>
-<HR>
-<H1><A name="ourgloss">Glossary for the Linux FreeS/WAN project</A></H1>
-<P>Entries are in alphabetical order. Some entries are only one line or
- one paragraph long. Others run to several paragraphs. I have tried to
- put the essential information in the first paragraph so you can skip
- the other paragraphs if that seems appropriate.</P>
-<HR>
-<H2><A name="jump">Jump to a letter in the glossary</A></H2>
-<CENTER> <BIG><B><A href="#0">numeric</A><A href="#A"> A</A><A href="#B">
- B</A><A href="#C"> C</A><A href="#D"> D</A><A href="#E"> E</A><A href="#F">
- F</A><A href="#G"> G</A><A href="#H"> H</A><A href="#I"> I</A><A href="#J">
- J</A><A href="#K"> K</A><A href="#L"> L</A><A href="#M"> M</A><A href="#N">
- N</A><A href="#O"> O</A><A href="#P"> P</A><A href="#Q"> Q</A><A href="#R">
- R</A><A href="#S"> S</A><A href="#T"> T</A><A href="#U"> U</A><A href="#V">
- V</A><A href="#W"> W</A><A href="#X"> X</A><A href="#Y"> Y</A><A href="#Z">
- Z</A></B></BIG></CENTER>
-<HR>
-<H2><A name="gloss">Other glossaries</A></H2>
-<P>Other glossaries which overlap this one include:</P>
-<UL>
-<LI>The VPN Consortium's glossary of<A href="http://www.vpnc.org/terms.html">
- VPN terms</A>.</LI>
-<LI>glossary portion of the<A href="http://www.rsa.com/rsalabs/faq/B.html">
- Cryptography FAQ</A></LI>
-<LI>an extensive crytographic glossary on<A href="http://www.ciphersbyritter.com/GLOSSARY.HTM">
- Terry Ritter's</A> page.</LI>
-<LI>The<A href="#NSA"> NSA</A>'s<A href="http://www.sans.org/newlook/resources/glossary.htm">
- glossary of computer security</A> on the<A href="http://www.sans.org">
- SANS Institute</A> site.</LI>
-<LI>a small glossary for Internet Security at<A href="http://www5.zdnet.com/pcmag/pctech/content/special/glossaries/internetsecurity.html">
- PC magazine</A></LI>
-<LI>The<A href="http://www.visi.com/crypto/inet-crypto/glossary.html">
- glossary</A> from Richard Smith's book<A href="#Smith"> Internet
- Cryptography</A></LI>
-</UL>
-<P>Several Internet glossaries are available as RFCs:</P>
-<UL>
-<LI><A href="http://www.rfc-editor.org/rfc/rfc1208.txt">Glossary of
- Networking Terms</A></LI>
-<LI><A href="http://www.rfc-editor.org/rfc/rfc1983.txt">Internet User's
- Glossary</A></LI>
-<LI><A href="http://www.rfc-editor.org/rfc/rfc2828.txt">Internet
- Security Glossary</A></LI>
-</UL>
-<P>More general glossary or dictionary information:</P>
-<UL>
-<LI>Free Online Dictionary of Computing (FOLDOC)
-<UL>
-<LI><A href="http://www.nightflight.com/foldoc">North America</A></LI>
-<LI><A href="http://wombat.doc.ic.ac.uk/foldoc/index.html">Europe</A></LI>
-<LI><A href="http://www.nue.org/foldoc/index.html">Japan</A></LI>
-</UL>
-<P>There are many more mirrors of this dictionary.</P>
-</LI>
-<LI>The Jargon File, the definitive resource for hacker slang and
- folklore
-<UL>
-<LI><A href="http://www.netmeg.net/jargon">North America</A></LI>
-<LI><A href="http://info.wins.uva.nl/~mes/jargon/">Holland</A></LI>
-<LI><A href="http://www.tuxedo.org/~esr/jargon">home page</A></LI>
-</UL>
-<P>There are also many mirrors of this. See the home page for a list.</P>
-</LI>
-<LI>A general<A href="http://www.trinity.edu/~rjensen/245glosf.htm#Navigate">
- technology glossary</A></LI>
-<LI>An<A href="http://www.yourdictionary.com/"> online dictionary
- resource page</A> with pointers to many dictionaries for many languages</LI>
-<LI>A<A href="http://www.onelook.com/"> search engine</A> that accesses
- several hundred online dictionaries</LI>
-<LI>O'Reilly<A href="http://www.ora.com/reference/dictionary/">
- Dictionary of PC Hardware and Data Communications Terms</A></LI>
-<LI><A href="http://www.FreeSoft.org/CIE/index.htm">Connected</A>
- Internet encyclopedia</LI>
-<LI><A href="http://www.whatis.com/">whatis.com</A></LI>
-</UL>
-<HR>
-<H2><A name="definitions">Definitions</A></H2>
-<DL>
-<DT><A name="0">0</A></DT>
-<DT><A name="3DES">3DES (Triple DES)</A></DT>
-<DD>Using three<A href="#DES"> DES</A> encryptions on a single data
- block, with at least two different keys, to get higher security than is
- available from a single DES pass. The three-key version of 3DES is the
- default encryption algorithm for<A href="#FreeSWAN"> Linux FreeS/WAN</A>
-.
-<P><A href="#IPSEC">IPsec</A> always does 3DES with three different
- keys, as required by RFC 2451. For an explanation of the two-key
- variant, see<A href="#2key"> two key triple DES</A>. Both use an<A href="#EDE">
- EDE</A> encrypt-decrypt-encrpyt sequence of operations.</P>
-<P>Single<A href="#DES"> DES</A> is<A href="#desnotsecure"> insecure</A>
-.</P>
-<P>Double DES is ineffective. Using two 56-bit keys, one might expect an
- attacker to have to do 2<SUP>112</SUP> work to break it. In fact, only
- 2<SUP>57</SUP> work is required with a<A href="#meet">
- meet-in-the-middle attack</A>, though a large amount of memory is also
- required. Triple DES is vulnerable to a similar attack, but that just
- reduces the work factor from the 2<SUP>168</SUP> one might expect to 2<SUP>
-112</SUP>. That provides adequate protection against<A href="#brute">
- brute force</A> attacks, and no better attack is known.</P>
-<P>3DES can be somewhat slow compared to other ciphers. It requires
- three DES encryptions per block. DES was designed for hardware
- implementation and includes some operations which are difficult in
- software. However, the speed we get is quite acceptable for many uses.
- See our<A href="performance.html"> performance</A> document for
- details.</P>
-</DD>
-<DT><A name="A">A</A></DT>
-<DT><A name="active">Active attack</A></DT>
-<DD>An attack in which the attacker does not merely eavesdrop (see<A href="#passive">
- passive attack</A>) but takes action to change, delete, reroute, add,
- forge or divert data. Perhaps the best-known active attack is<A href="#middle">
- man-in-the-middle</A>. In general,<A href="#authentication">
- authentication</A> is a useful defense against active attacks.</DD>
-<DT><A name="AES">AES</A></DT>
-<DD>The<B> A</B>dvanced<B> E</B>ncryption<B> S</B>tandard -- a new<A href="#block">
- block cipher</A> standard to replace<A href="#desnotsecure"> DES</A> --
- developed by<A href="#NIST"> NIST</A>, the US National Institute of
- Standards and Technology. DES used 64-bit blocks and a 56-bit key. AES
- ciphers use a 128-bit block and 128, 192 or 256-bit keys. The larger
- block size helps resist<A href="#birthday"> birthday attacks</A> while
- the large key size prevents<A href="#brute"> brute force attacks</A>.
-<P>Fifteen proposals meeting NIST's basic criteria were submitted in
- 1998 and subjected to intense discussion and analysis, &quot;round one&quot;
- evaluation. In August 1999, NIST narrowed the field to five &quot;round two&quot;
- candidates:</P>
-<UL>
-<LI><A href="http://www.research.ibm.com/security/mars.html">Mars</A>
- from IBM</LI>
-<LI><A href="http://www.rsa.com/rsalabs/aes/">RC6</A> from RSA</LI>
-<LI><A href="http://www.esat.kuleuven.ac.be/~rijmen/rijndael/">Rijndael</A>
- from two Belgian researchers</LI>
-<LI><A href="http://www.cl.cam.ac.uk/~rja14/serpent.html">Serpent</A>, a
- British-Norwegian-Israeli collaboration</LI>
-<LI><A href="http://www.counterpane.com/twofish.html">Twofish</A> from
- the consulting firm<A href="http://www.counterpane.com"> Counterpane</A>
-</LI>
-</UL>
-<P>Three of the five finalists -- Rijndael, Serpent and Twofish -- have
- completely open licenses.</P>
-<P>In October 2000, NIST announced the winner -- Rijndael.</P>
-<P>For more information, see:</P>
-<UL>
-<LI>NIST's<A href="http://csrc.nist.gov/encryption/aes/aes_home.htm">
- AES home page</A></LI>
-<LI>the Block Cipher Lounge<A href="http://www.ii.uib.no/~larsr/aes.html">
- AES page</A></LI>
-<LI>Brian Gladman's<A href="http://fp.gladman.plus.com/cryptography_technology/index.htm">
- code and benchmarks</A></LI>
-<LI>Helger Lipmaa's<A href="http://www.tcs.hut.fi/~helger/aes/"> survey
- of implementations</A></LI>
-</UL>
-<P>AES will be added to a future release of<A href="#FreeSWAN"> Linux
- FreeS/WAN</A>. Likely we will add all three of the finalists with good
- licenses. User-written<A href="#patch"> AES patches</A> are already
- available.</P>
-<P>Adding AES may also require adding stronger hashes,<A href="#SHA-256">
- SHA-256, SHA-384 and SHA-512</A>.</P>
-</DD>
-<DT><A name="AH">AH</A></DT>
-<DD>The<A href="#IPSEC"> IPsec</A><B> A</B>uthentication<B> H</B>eader,
- added after the IP header. For details, see our<A href="#AH.ipsec">
- IPsec</A> document and/or RFC 2402.</DD>
-<DT><A name="alicebob">Alice and Bob</A></DT>
-<DD>A and B, the standard example users in writing on cryptography and
- coding theory. Carol and Dave join them for protocols which require
- more players.
-<P>Bruce Schneier extends these with many others such as Eve the
- Eavesdropper and Victor the Verifier. His extensions seem to be in the
- process of becoming standard as well. See page 23 of<A href="#schneier">
- Applied Cryptography</A></P>
-<P>Alice and Bob have an amusing<A href="http://www.conceptlabs.co.uk/alicebob.html">
- biography</A> on the web.</P>
-</DD>
-<DT>ARPA</DT>
-<DD>see<A href="#DARPA"> DARPA</A></DD>
-<DT><A name="ASIO">ASIO</A></DT>
-<DD>Australian Security Intelligence Organisation.</DD>
-<DT>Asymmetric cryptography</DT>
-<DD>See<A href="#public"> public key cryptography</A>.</DD>
-<DT><A name="authentication">Authentication</A></DT>
-<DD>Ensuring that a message originated from the expected sender and has
- not been altered on route.<A href="#IPSEC"> IPsec</A> uses
- authentication in two places:
-<UL>
-<LI>peer authentication, authenticating the players in<A href="#IKE">
- IKE</A>'s<A href="#DH"> Diffie-Hellman</A> key exchanges to prevent<A href="#middle">
- man-in-the-middle attacks</A>. This can be done in a number of ways.
- The methods supported by FreeS/WAN are discussed in our<A href="#choose">
- advanced configuration</A> document.</LI>
-<LI>packet authentication, authenticating packets on an established<A href="#SA">
- SA</A>, either with a separate<A href="#AH"> authentication header</A>
- or with the optional authentication in the<A href="#ESP"> ESP</A>
- protocol. In either case, packet authentication uses a<A href="#HMAC">
- hashed message athentication code</A> technique.</LI>
-</UL>
-<P>Outside IPsec, passwords are perhaps the most common authentication
- mechanism. Their function is essentially to authenticate the person's
- identity to the system. Passwords are generally only as secure as the
- network they travel over. If you send a cleartext password over a
- tapped phone line or over a network with a packet sniffer on it, the
- security provided by that password becomes zero. Sending an encrypted
- password is no better; the attacker merely records it and reuses it at
- his convenience. This is called a<A href="#replay"> replay</A> attack.</P>
-<P>A common solution to this problem is a<A href="#challenge">
- challenge-response</A> system. This defeats simple eavesdropping and
- replay attacks. Of course an attacker might still try to break the
- cryptographic algorithm used, or the<A href="#random"> random number</A>
- generator.</P>
-</DD>
-<DT><A name="auto">Automatic keying</A></DT>
-<DD>A mode in which keys are automatically generated at connection
- establisment and new keys automaically created periodically thereafter.
- Contrast with<A href="#manual"> manual keying</A> in which a single
- stored key is used.
-<P>IPsec uses the<A href="#DH"> Diffie-Hellman key exchange protocol</A>
- to create keys. An<A href="#authentication"> authentication</A>
- mechansim is required for this. FreeS/WAN normally uses<A href="#RSA">
- RSA</A> for this. Other methods supported are discussed in our<A href="#choose">
- advanced configuration</A> document.</P>
-<P>Having an attacker break the authentication is emphatically not a
- good idea. An attacker that breaks authentication, and manages to
- subvert some other network entities (DNS, routers or gateways), can use
- a<A href="#middle"> man-in-the middle attack</A> to break the security
- of your IPsec connections.</P>
-<P>However, having an attacker break the authentication in automatic
- keying is not quite as bad as losing the key in manual keying.</P>
-<UL>
-<LI>An attacker who reads /etc/ipsec.conf and gets the keys for a
- manually keyed connection can, without further effort, read all
- messages encrypted with those keys, including any old messages he may
- have archived.</LI>
-<LI>Automatic keying has a property called<A href="#PFS"> perfect
- forward secrecy</A>. An attacker who breaks the authentication gets
- none of the automatically generated keys and cannot immediately read
- any messages. He has to mount a successful<A href="#middle">
- man-in-the-middle attack</A> in real time before he can read anything.
- He cannot read old archived messages at all and will not be able to
- read any future messages not caught by man-in-the-middle tricks.</LI>
-</UL>
-<P>That said, the secrets used for authentication, stored in<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets(5)</A>, should still be protected as tightly as
- cryptographic keys.</P>
-</DD>
-<DT><A name="B">B</A></DT>
-<DT><A href="http://www.nortelnetworks.com">Bay Networks</A></DT>
-<DD>A vendor of routers, hubs and related products, now a subsidiary of
- Nortel. Interoperation between their IPsec products and Linux FreeS/WAN
- was problematic at last report; see our<A href="interop.html#bay">
- interoperation</A> section.</DD>
-<DT><A name="benchmarks">benchmarks</A></DT>
-<DD>Our default block cipher,<A href="#3DES"> triple DES</A>, is slower
- than many alternate ciphers that might be used. Speeds achieved,
- however, seem adequate for many purposes. For example, the assembler
- code from the<A href="#LIBDES"> LIBDES</A> library we use encrypts 1.6
- megabytes per second on a Pentium 200, according to the test program
- supplied with the library.
-<P>For more detail, see our document on<A href="performance.html">
- FreeS/WAN performance</A>.</P>
-</DD>
-<DT><A name="BIND">BIND</A></DT>
-<DD><B>B</B>erkeley<B> I</B>nternet<B> N</B>ame<B> D</B>aemon, a widely
- used implementation of<A href="#DNS"> DNS</A> (Domain Name Service).
- See our bibliography for a<A href="#DNS"> useful reference</A>. See the<A
-href="http://www.isc.org/bind.html"> BIND home page</A> for more
- information and the latest version.</DD>
-<DT><A name="birthday">Birthday attack</A></DT>
-<DD>A cryptographic attack based on the mathematics exemplified by the<A href="#paradox">
- birthday paradox</A>. This math turns up whenever the question of two
- cryptographic operations producing the same result becomes an issue:
-<UL>
-<LI><A href="#collision">collisions</A> in<A href="#digest"> message
- digest</A> functions.</LI>
-<LI>identical output blocks from a<A href="#block"> block cipher</A></LI>
-<LI>repetition of a challenge in a<A href="#challenge">
- challenge-response</A> system</LI>
-</UL>
-<P>Resisting such attacks is part of the motivation for:</P>
-<UL>
-<LI>hash algorithms such as<A href="#SHA"> SHA</A> and<A href="#RIPEMD">
- RIPEMD-160</A> giving a 160-bit result rather than the 128 bits of<A href="#MD4">
- MD4</A>,<A href="#MD5"> MD5</A> and<A href="#RIPEMD"> RIPEMD-128</A>.</LI>
-<LI><A href="#AES">AES</A> block ciphers using a 128-bit block instead
- of the 64-bit block of most current ciphers</LI>
-<LI><A href="#IPSEC">IPsec</A> using a 32-bit counter for packets sent
- on an<A href="#auto"> automatically keyed</A><A href="#SA"> SA</A> and
- requiring that the connection always be rekeyed before the counter
- overflows.</LI>
-</UL>
-</DD>
-<DT><A name="paradox">Birthday paradox</A></DT>
-<DD>Not really a paradox, just a rather counter-intuitive mathematical
- fact. In a group of 23 people, the chance of a least one pair having
- the same birthday is over 50%.
-<P>The second person has 1 chance in 365 (ignoring leap years) of
- matching the first. If they don't match, the third person's chances of
- matching one of them are 2/365. The 4th, 3/365, and so on. The total of
- these chances grows more quickly than one might guess.</P>
-</DD>
-<DT><A name="block">Block cipher</A></DT>
-<DD>A<A href="#symmetric"> symmetric cipher</A> which operates on
- fixed-size blocks of plaintext, giving a block of ciphertext for each.
- Contrast with<A href="#stream"> stream cipher</A>. Block ciphers can be
- used in various<A href="#mode"> modes</A> when multiple block are to be
- encrypted.
-<P><A href="#DES">DES</A> is among the the best known and widely used
- block ciphers, but is now obsolete. Its 56-bit key size makes it<A href="#desnotsecure">
- highly insecure</A> today.<A href="#3DES"> Triple DES</A> is the
- default block cipher for<A href="#FreeSWAN"> Linux FreeS/WAN</A>.</P>
-<P>The current generation of block ciphers -- such as<A href="#Blowfish">
- Blowfish</A>,<A href="#CAST128"> CAST-128</A> and<A href="#IDEA"> IDEA</A>
- -- all use 64-bit blocks and 128-bit keys. The next generation,<A href="#AES">
- AES</A>, uses 128-bit blocks and supports key sizes up to 256 bits.</P>
-<P>The<A href="http://www.ii.uib.no/~larsr/bc.html"> Block Cipher Lounge</A>
- web site has more information.</P>
-</DD>
-<DT><A name="Blowfish">Blowfish</A></DT>
-<DD>A<A href="#block"> block cipher</A> using 64-bit blocks and keys of
- up to 448 bits, designed by<A href="#schneier"> Bruce Schneier</A> and
- used in several products.
-<P>This is not required by the<A href="#IPSEC"> IPsec</A> RFCs and not
- currently used in<A href="#FreeSWAN"> Linux FreeS/WAN</A>.</P>
-</DD>
-<DT><A name="brute">Brute force attack (exhaustive search)</A></DT>
-<DD>Breaking a cipher by trying all possible keys. This is always
- possible in theory (except against a<A href="#OTP"> one-time pad</A>),
- but it becomes practical only if the key size is inadequate. For an
- important example, see our document on the<A href="#desnotsecure">
- insecurity of DES</A> with its 56-bit key. For an analysis of key sizes
- required to resist plausible brute force attacks, see<A href="http://www.counterpane.com/keylength.html">
- this paper</A>.
-<P>Longer keys protect against brute force attacks. Each extra bit in
- the key doubles the number of possible keys and therefore doubles the
- work a brute force attack must do. A large enough key defeats<STRONG>
- any</STRONG> brute force attack.</P>
-<P>For example, the EFF's<A href="#EFF"> DES Cracker</A> searches a
- 56-bit key space in an average of a few days. Let us assume an attacker
- that can find a 64-bit key (256 times harder) by brute force search in
- a second (a few hundred thousand times faster). For a 96-bit key, that
- attacker needs 2<SUP>32</SUP> seconds, about 135 years. Against a
- 128-bit key, he needs 2<SUP>32</SUP> times that, over 500,000,000,000
- years. Your data is then obviously secure against brute force attacks.
- Even if our estimate of the attacker's speed is off by a factor of a
- million, it still takes him over 500,000 years to crack a message.</P>
-<P>This is why</P>
-<UL>
-<LI>single<A href="#DES"> DES</A> is now considered<A href="#desnotsecure">
- dangerously insecure</A></LI>
-<LI>all of the current generation of<A href="#block"> block ciphers</A>
- use a 128-bit or longer key</LI>
-<LI><A href="#AES">AES</A> ciphers support keysizes 128, 192 and 256
- bits</LI>
-<LI>any cipher we add to Linux FreeS/WAN will have<EM> at least</EM> a
- 128-bit key</LI>
-</UL>
-<P><STRONG>Cautions:</STRONG>
-<BR><EM> Inadequate keylength always indicates a weak cipher</EM> but it
- is important to note that<EM> adequate keylength does not necessarily
- indicate a strong cipher</EM>. There are many attacks other than brute
- force, and adequate keylength<EM> only</EM> guarantees resistance to
- brute force. Any cipher, whatever its key size, will be weak if design
- or implementation flaws allow other attacks.</P>
-<P>Also,<EM> once you have adequate keylength</EM> (somewhere around 90
- or 100 bits),<EM> adding more key bits make no practical difference</EM>
-, even against brute force. Consider our 128-bit example above that
- takes 500,000,000,000 years to break by brute force. We really don't
- care how many zeroes there are on the end of that, as long as the
- number remains ridiculously large. That is, we don't care exactly how
- large the key is as long as it is large enough.</P>
-<P>There may be reasons of convenience in the design of the cipher to
- support larger keys. For example<A href="#Blowfish"> Blowfish</A>
- allows up to 448 bits and<A href="#RC4"> RC4</A> up to 2048, but beyond
- 100-odd bits it makes no difference to practical security.</P>
-</DD>
-<DT>Bureau of Export Administration</DT>
-<DD>see<A href="#BXA"> BXA</A></DD>
-<DT><A name="BXA">BXA</A></DT>
-<DD>The US Commerce Department's<B> B</B>ureau of E<B>x</B>port<B> A</B>
-dministration which administers the<A href="#EAR"> EAR</A> Export
- Administration Regulations controling the export of, among other
- things, cryptography.</DD>
-<DT><A name="C">C</A></DT>
-<DT><A name="CA">CA</A></DT>
-<DD><B>C</B>ertification<B> A</B>uthority, an entity in a<A href="#PKI">
- public key infrastructure</A> that can certify keys by signing them.
- Usually CAs form a hierarchy. The top of this hierarchy is called the<A href="#rootCA">
- root CA</A>.
-<P>See<A href="#web"> Web of Trust</A> for an alternate model.</P>
-</DD>
-<DT><A name="CAST128">CAST-128</A></DT>
-<DD>A<A href="#block"> block cipher</A> using 64-bit blocks and 128-bit
- keys, described in RFC 2144 and used in products such as<A href="#Entrust">
- Entrust</A> and recent versions of<A href="#PGP"> PGP</A>.
-<P>This is not required by the<A href="#IPSEC"> IPsec</A> RFCs and not
- currently used in<A href="#FreeSWAN"> Linux FreeS/WAN</A>.</P>
-</DD>
-<DT>CAST-256</DT>
-<DD><A href="#Entrust">Entrust</A>'s candidate cipher for the<A href="#AES">
- AES standard</A>, largely based on the<A href="#CAST128"> CAST-128</A>
- design.</DD>
-<DT><A name="CBC">CBC mode</A></DT>
-<DD><B>C</B>ipher<B> B</B>lock<B> C</B>haining<A href="#mode"> mode</A>,
- a method of using a<A href="#block"> block cipher</A> in which for each
- block except the first, the result of the previous encryption is XORed
- into the new block before it is encrypted. CBC is the mode used in<A href="#IPSEC">
- IPsec</A>.
-<P>An<A href="#IV"> initialisation vector</A> (IV) must be provided. It
- is XORed into the first block before encryption. The IV need not be
- secret but should be different for each message and unpredictable.</P>
-</DD>
-<DT><A name="CIDR">CIDR</A></DT>
-<DD><B>C</B>lassless<B> I</B>nter-<B>D</B>omain<B> R</B>outing, an
- addressing scheme used to describe networks not restricted to the old
- Class A, B, and C sizes. A CIDR block is written<VAR> address</VAR>/<VAR>
-mask</VAR>, where<VAR> address</VAR> is a 32-bit Internet address. The
- first<VAR> mask</VAR> bits of<VAR> address</VAR> are part of the
- gateway address, while the remaining bits designate other host
- addresses. For example, the CIDR block 192.0.2.96/27 describes a
- network with gateway 192.0.2.96, hosts 192.0.2.96 through 192.0.2.126
- and broadcast 192.0.2.127.
-<P>FreeS/WAN policy group files accept CIDR blocks of the format<VAR>
- address</VAR>/[<VAR>mask</VAR>], where<VAR> address</VAR> may take the
- form<VAR> name.domain.tld</VAR>. An absent<VAR> mask</VAR> is assumed
- to be /32.</P>
-</DD>
-<DT>Certification Authority</DT>
-<DD>see<A href="#CA"> CA</A></DD>
-<DT><A name="challenge">Challenge-response authentication</A></DT>
-<DD>An<A href="#authentication"> authentication</A> system in which one
- player generates a<A href="#random"> random number</A>, encrypts it and
- sends the result as a challenge. The other player decrypts and sends
- back the result. If the result is correct, that proves to the first
- player that the second player knew the appropriate secret, required for
- the decryption. Variations on this technique exist using<A href="#public">
- public key</A> or<A href="#symmetric"> symmetric</A> cryptography. Some
- provide two-way authentication, assuring each player of the other's
- identity.
-<P>This is more secure than passwords against two simple attacks:</P>
-<UL>
-<LI>If cleartext passwords are sent across the wire (e.g. for telnet),
- an eavesdropper can grab them. The attacker may even be able to break
- into other systems if the user has chosen the same password for them.</LI>
-<LI>If an encrypted password is sent, an attacker can record the
- encrypted form and use it later. This is called a replay attack.</LI>
-</UL>
-<P>A challenge-response system never sends a password, either cleartext
- or encrypted. An attacker cannot record the response to one challenge
- and use it as a response to a later challenge. The random number is
- different each time.</P>
-<P>Of course an attacker might still try to break the cryptographic
- algorithm used, or the<A href="#random"> random number</A> generator.</P>
-</DD>
-<DT><A name="mode">Cipher Modes</A></DT>
-<DD>Different ways of using a block cipher when encrypting multiple
- blocks.
-<P>Four standard modes were defined for<A href="#DES"> DES</A> in<A href="#FIPS">
- FIPS</A> 81. They can actually be applied with any block cipher.</P>
-<TABLE><TBODY></TBODY>
-<TR><TD></TD><TD><A href="#ECB">ECB</A></TD><TD>Electronic CodeBook</TD><TD>
-encrypt each block independently</TD></TR>
-<TR><TD></TD><TD><A href="#CBC">CBC</A></TD><TD>Cipher Block Chaining
-<BR></TD><TD>XOR previous block ciphertext into new block plaintext
- before encrypting new block</TD></TR>
-<TR><TD></TD><TD>CFB</TD><TD>Cipher FeedBack</TD><TD></TD></TR>
-<TR><TD></TD><TD>OFB</TD><TD>Output FeedBack</TD><TD></TD></TR>
-</TABLE>
-<P><A href="#IPSEC">IPsec</A> uses<A href="#CBC"> CBC</A> mode since
- this is only marginally slower than<A href="#ECB"> ECB</A> and is more
- secure. In ECB mode the same plaintext always encrypts to the same
- ciphertext, unless the key is changed. In CBC mode, this does not
- occur.</P>
-<P>Various other modes are also possible, but none of them are used in
- IPsec.</P>
-</DD>
-<DT><A name="ciphertext">Ciphertext</A></DT>
-<DD>The encrypted output of a cipher, as opposed to the unencrypted<A href="#plaintext">
- plaintext</A> input.</DD>
-<DT><A href="http://www.cisco.com">Cisco</A></DT>
-<DD>A vendor of routers, hubs and related products. Their IPsec products
- interoperate with Linux FreeS/WAN; see our<A href="#cisco"> interop</A>
- section.</DD>
-<DT><A name="client">Client</A></DT>
-<DD>This term has at least two distinct uses in discussing IPsec:
-<UL>
-<LI>The<STRONG> clients of an IPsec gateway</STRONG> are the machines it
- protects, typically on one or more subnets behind the gateway. In this
- usage, all the machines on an office network are clients of that
- office's IPsec gateway. Laptop or home machines connecting to the
- office, however, are<EM> not</EM> clients of that gateway. They are
- remote gateways, running the other end of an IPsec connection. Each of
- them is also its own client.</LI>
-<LI><STRONG>IPsec client software</STRONG> is used to describe software
- which runs on various standalone machines to let them connect to IPsec
- networks. In this usage, a laptop or home machine connecting to the
- office is a client, and the office gateway is the server.</LI>
-</UL>
-<P>We generally use the term in the first sense. Vendors of Windows
- IPsec solutions often use it in the second. See this<A href="interop.html#client.server">
- discussion</A>.</P>
-</DD>
-<DT><A name="cc">Common Criteria</A></DT>
-<DD>A set of international security classifications which are replacing
- the old US<A href="#rainbow"> Rainbow Book</A> standards and similar
- standards in other countries.
-<P>Web references include this<A href="http://csrc.nist.gov/cc"> US
- government site</A> and this<A href="http://www.commoncriteria.org">
- global home page</A>.</P>
-</DD>
-<DT>Conventional cryptography</DT>
-<DD>See<A href="#symmetric"> symmetric cryptography</A></DD>
-<DT><A name="collision">Collision resistance</A></DT>
-<DD>The property of a<A href="#digest"> message digest</A> algorithm
- which makes it hard for an attacker to find or construct two inputs
- which hash to the same output.</DD>
-<DT>Copyleft</DT>
-<DD>see GNU<A href="#GPL"> General Public License</A></DD>
-<DT><A name="CSE">CSE</A></DT>
-<DD><A href="http://www.cse-cst.gc.ca/">Communications Security
- Establishment</A>, the Canadian organisation for<A href="#SIGINT">
- signals intelligence</A>.</DD>
-<DT><A name="D">D</A></DT>
-<DT><A name="DARPA">DARPA (sometimes just ARPA)</A></DT>
-<DD>The US government's<B> D</B>efense<B> A</B>dvanced<B> R</B>esearch<B>
- P</B>rojects<B> A</B>gency. Projects they have funded over the years
- have included the Arpanet which evolved into the Internet, the TCP/IP
- protocol suite (as a replacement for the original Arpanet suite), the
- Berkeley 4.x BSD Unix projects, and<A href="#SDNS"> Secure DNS</A>.
-<P>For current information, see their<A href="http://www.darpa.mil/ito">
- web site</A>.</P>
-</DD>
-<DT><A name="DOS">Denial of service (DoS) attack</A></DT>
-<DD>An attack that aims at denying some service to legitimate users of a
- system, rather than providing a service to the attacker.
-<UL>
-<LI>One variant is a flooding attack, overwhelming the system with too
- many packets, to much email, or whatever.</LI>
-<LI>A closely related variant is a resource exhaustion attack. For
- example, consider a &quot;TCP SYN flood&quot; attack. Setting up a TCP connection
- involves a three-packet exchange:
-<UL>
-<LI>Initiator: Connection please (SYN)</LI>
-<LI>Responder: OK (ACK)</LI>
-<LI>Initiator: OK here too</LI>
-</UL>
-<P>If the attacker puts bogus source information in the first packet,
- such that the second is never delivered, the responder may wait a long
- time for the third to come back. If responder has already allocated
- memory for the connection data structures, and if many of these bogus
- packets arrive, the responder may run out of memory.</P>
-</LI>
-<LI>Another variant is to feed the system undigestible data, hoping to
- make it sick. For example, IP packets are limited in size to 64K bytes
- and a fragment carries information on where it starts within that 64K
- and how long it is. The &quot;ping of death&quot; delivers fragments that say,
- for example, that they start at 60K and are 20K long. Attempting to
- re-assemble these without checking for overflow can be fatal.</LI>
-</UL>
-<P>The two example attacks discussed were both quite effective when
- first discovered, capable of crashing or disabling many operating
- systems. They were also well-publicised, and today far fewer systems
- are vulnerable to them.</P>
-</DD>
-<DT><A name="DES">DES</A></DT>
-<DD>The<B> D</B>ata<B> E</B>ncryption<B> S</B>tandard, a<A href="#block">
- block cipher</A> with 64-bit blocks and a 56-bit key. Probably the most
- widely used<A href="#symmetric"> symmetric cipher</A> ever devised. DES
- has been a US government standard for their own use (only for
- unclassified data), and for some regulated industries such as banking,
- since the late 70's. It is now being replaced by<A href="#AES"> AES</A>
-.
-<P><A href="#desnotsecure">DES is seriously insecure against current
- attacks.</A></P>
-<P><A href="#FreeSWAN">Linux FreeS/WAN</A> does not include DES, even
- though the RFCs specify it.<B> We strongly recommend that single DES
- not be used.</B></P>
-<P>See also<A href="#3DES"> 3DES</A> and<A href="#DESX"> DESX</A>,
- stronger ciphers based on DES.</P>
-</DD>
-<DT><A name="DESX">DESX</A></DT>
-<DD>An improved<A href="#DES"> DES</A> suggested by Ron Rivest of RSA
- Data Security. It XORs extra key material into the text before and
- after applying the DES cipher.
-<P>This is not required by the<A href="#IPSEC"> IPsec</A> RFCs and not
- currently used in<A href="#FreeSWAN"> Linux FreeS/WAN</A>. DESX would
- be the easiest additional transform to add; there would be very little
- code to write. It would be much faster than 3DES and almost certainly
- more secure than DES. However, since it is not in the RFCs other IPsec
- implementations cannot be expected to have it.</P>
-</DD>
-<DT>DH</DT>
-<DD>see<A href="#DH"> Diffie-Hellman</A></DD>
-<DT><A name="DHCP">DHCP</A></DT>
-<DD><STRONG>D</STRONG>ynamic<STRONG> H</STRONG>ost<STRONG> C</STRONG>
-onfiguration<STRONG> P</STRONG>rotocol, a method of assigning<A href="#dynamic">
- dynamic IP addresses</A>, and providing additional information such as
- addresses of DNS servers and of gateways. See this<A href="http://www.dhcp.org">
- DHCP resource page.</A></DD>
-<DT><A name="DH">Diffie-Hellman (DH) key exchange protocol</A></DT>
-<DD>A protocol that allows two parties without any initial shared secret
- to create one in a manner immune to eavesdropping. Once they have done
- this, they can communicate privately by using that shared secret as a
- key for a block cipher or as the basis for key exchange.
-<P>The protocol is secure against all<A href="#passive"> passive attacks</A>
-, but it is not at all resistant to active<A href="#middle">
- man-in-the-middle attacks</A>. If a third party can impersonate Bob to
- Alice and vice versa, then no useful secret can be created.
- Authentication of the participants is a prerequisite for safe
- Diffie-Hellman key exchange. IPsec can use any of several<A href="#authentication">
- authentication</A> mechanisims. Those supported by FreeS/WAN are
- discussed in our<A href="#choose"> configuration</A> section.</P>
-<P>The Diffie-Hellman key exchange is based on the<A href="#dlog">
- discrete logarithm</A> problem and is secure unless someone finds an
- efficient solution to that problem.</P>
-<P>Given a prime<VAR> p</VAR> and generator<VAR> g</VAR> (explained
- under<A href="#dlog"> discrete log</A> below), Alice:</P>
-<UL>
-<LI>generates a random number<VAR> a</VAR></LI>
-<LI>calculates<VAR> A = g^a modulo p</VAR></LI>
-<LI>sends<VAR> A</VAR> to Bob</LI>
-</UL>
-<P>Meanwhile Bob:</P>
-<UL>
-<LI>generates a random number<VAR> b</VAR></LI>
-<LI>calculates<VAR> B = g^b modulo p</VAR></LI>
-<LI>sends<VAR> B</VAR> to Alice</LI>
-</UL>
-<P>Now Alice and Bob can both calculate the shared secret<VAR> s =
- g^(ab)</VAR>. Alice knows<VAR> a</VAR> and<VAR> B</VAR>, so she
- calculates<VAR> s = B^a</VAR>. Bob knows<VAR> A</VAR> and<VAR> b</VAR>
- so he calculates<VAR> s = A^b</VAR>.</P>
-<P>An eavesdropper will know<VAR> p</VAR> and<VAR> g</VAR> since these
- are made public, and can intercept<VAR> A</VAR> and<VAR> B</VAR> but,
- short of solving the<A href="#dlog"> discrete log</A> problem, these do
- not let him or her discover the secret<VAR> s</VAR>.</P>
-</DD>
-<DT><A name="signature">Digital signature</A></DT>
-<DD>Sender:
-<UL>
-<LI>calculates a<A href="#digest"> message digest</A> of a document</LI>
-<LI>encrypts the digest with his or her private key, using some<A href="#public">
- public key cryptosystem</A>.</LI>
-<LI>attaches the encrypted digest to the document as a signature</LI>
-</UL>
-<P>Receiver:</P>
-<UL>
-<LI>calculates a digest of the document (not including the signature)</LI>
-<LI>decrypts the signature with the signer's public key</LI>
-<LI>verifies that the two results are identical</LI>
-</UL>
-<P>If the public-key system is secure and the verification succeeds,
- then the receiver knows</P>
-<UL>
-<LI>that the document was not altered between signing and verification</LI>
-<LI>that the signer had access to the private key</LI>
-</UL>
-<P>Such an encrypted message digest can be treated as a signature since
- it cannot be created without<EM> both</EM> the document<EM> and</EM>
- the private key which only the sender should possess. The<A href="#legal">
- legal issues</A> are complex, but several countries are moving in the
- direction of legal recognition for digital signatures.</P>
-</DD>
-<DT><A name="dlog">discrete logarithm problem</A></DT>
-<DD>The problem of finding logarithms in a finite field. Given a field
- defintion (such definitions always include some operation analogous to
- multiplication) and two numbers, a base and a target, find the power
- which the base must be raised to in order to yield the target.
-<P>The discrete log problem is the basis of several cryptographic
- systems, including the<A href="#DH"> Diffie-Hellman</A> key exchange
- used in the<A href="#IKE"> IKE</A> protocol. The useful property is
- that exponentiation is relatively easy but the inverse operation,
- finding the logarithm, is hard. The cryptosystems are designed so that
- the user does only easy operations (exponentiation in the field) but an
- attacker must solve the hard problem (discrete log) to crack the
- system.</P>
-<P>There are several variants of the problem for different types of
- field. The IKE/Oakley key determination protocol uses two variants,
- either over a field modulo a prime or over a field defined by an
- elliptic curve. We give an example modulo a prime below. For the
- elliptic curve version, consult an advanced text such as<A href="#handbook">
- Handbook of Applied Cryptography</A>.</P>
-<P>Given a prime<VAR> p</VAR>, a generator<VAR> g</VAR> for the field
- modulo that prime, and a number<VAR> x</VAR> in the field, the problem
- is to find<VAR> y</VAR> such that<VAR> g^y = x</VAR>.</P>
-<P>For example, let p = 13. The field is then the integers from 0 to 12.
- Any integer equals one of these modulo 13. That is, the remainder when
- any integer is divided by 13 must be one of these.</P>
-<P>2 is a generator for this field. That is, the powers of two modulo 13
- run through all the non-zero numbers in the field. Modulo 13 we have:</P>
-<PRE>          y      x
-        2^0  ==  1
-        2^1  ==  2
-        2^2  ==  4
-        2^3  ==  8
-        2^4  ==  3 that is, the remainder from 16/13 is 3
-        2^5  ==  6          the remainder from 32/13 is 6
-        2^6  == 12 and so on
-        2^7  == 11
-        2^8  ==  9
-        2^9  ==  5
-        2^10 == 10
-        2^11 ==  7
-        2^12 ==  1</PRE>
-<P>Exponentiation in such a field is not difficult. Given, say,<NOBR><VAR>
- y = 11</VAR>,calculating<NOBR><VAR> x = 7</VAR>is straightforward. One
- method is just to calculate<NOBR><VAR> 2^11 = 2048</VAR>,then<NOBR><VAR>
- 2048 mod 13 == 7</VAR>.When the field is modulo a large prime (say a
- few 100 digits) you need a silghtly cleverer method and even that is
- moderately expensive in computer time, but the calculation is still not
- problematic in any basic way.</P>
-<P>The discrete log problem is the reverse. In our example, given<NOBR><VAR>
- x = 7</VAR>,find the logarithm<NOBR><VAR> y = 11</VAR>.When the field
- is modulo a large prime (or is based on a suitable elliptic curve),
- this is indeed problematic. No solution method that is not
- catastrophically expensive is known. Quite a few mathematicians have
- tackled this problem. No efficient method has been found and
- mathematicians do not expect that one will be. It seems likely no
- efficient solution to either of the main variants the discrete log
- problem exists.</P>
-<P>Note, however, that no-one has proven such methods do not exist. If a
- solution to either variant were found, the security of any crypto
- system using that variant would be destroyed. This is one reason<A href="#IKE">
- IKE</A> supports two variants. If one is broken, we can switch to the
- other.</P>
-</DD>
-<DT><A name="discretionary">discretionary access control</A></DT>
-<DD>access control mechanisms controlled by the user, for example Unix
- rwx file permissions. These contrast with<A href="#mandatory">
- mandatory access controls</A>.</DD>
-<DT><A name="DNS">DNS</A></DT>
-<DD><B>D</B>omain<B> N</B>ame<B> S</B>ervice, a distributed database
- through which names are associated with numeric addresses and other
- information in the Internet Protocol Suite. See also the<A href="#dns.background">
- DNS background</A> section of our documentation.</DD>
-<DT>DOS attack</DT>
-<DD>see<A href="#DOS"> Denial Of Service</A> attack</DD>
-<DT><A name="dynamic">dynamic IP address</A></DT>
-<DD>an IP address which is automatically assigned, either by<A href="#DHCP">
- DHCP</A> or by some protocol such as<A href="#PPP"> PPP</A> or<A href="#PPPoE">
- PPPoE</A> which the machine uses to connect to the Internet. This is
- the opposite of a<A href="#static"> static IP address</A>, pre-set on
- the machine itself.</DD>
-<DT><A name="E">E</A></DT>
-<DT><A name="EAR">EAR</A></DT>
-<DD>The US government's<B> E</B>xport<B> A</B>dministration<B> R</B>
-egulations, administered by the<A href="#BXA"> Bureau of Export
- Administration</A>. These have replaced the earlier<A href="#ITAR">
- ITAR</A> regulations as the controls on export of cryptography.</DD>
-<DT><A name="ECB">ECB mode</A></DT>
-<DD><B>E</B>lectronic<B> C</B>ode<B>B</B>ook mode, the simplest way to
- use a block cipher. See<A href="#mode"> Cipher Modes</A>.</DD>
-<DT><A name="EDE">EDE</A></DT>
-<DD>The sequence of operations normally used in either the three-key
- variant of<A href="#3DES"> triple DES</A> used in<A href="#IPSEC">
- IPsec</A> or the<A href="#2key"> two-key</A> variant used in some other
- systems.
-<P>The sequence is:</P>
-<UL>
-<LI><B>E</B>ncrypt with key1</LI>
-<LI><B>D</B>ecrypt with key2</LI>
-<LI><B>E</B>ncrypt with key3</LI>
-</UL>
-<P>For the two-key version, key1=key3.</P>
-<P>The &quot;advantage&quot; of this EDE order of operations is that it makes it
- simple to interoperate with older devices offering only single DES. Set
- key1=key2=key3 and you have the worst of both worlds, the overhead of
- triple DES with the &quot;security&quot; of single DES. Since both the<A href="#desnotsecure">
- security of single DES</A> and the overheads of triple DES are
- seriously inferior to many other ciphers, this is a spectacularly
- dubious &quot;advantage&quot;.</P>
-</DD>
-<DT><A name="Entrust">Entrust</A></DT>
-<DD>A Canadian company offerring enterprise<A href="#PKI"> PKI</A>
- products using<A href="#CAST128"> CAST-128</A> symmetric crypto,<A href="#RSA">
- RSA</A> public key and<A href="#X509"> X.509</A> directories.<A href="http://www.entrust.com">
- Web site</A></DD>
-<DT><A name="EFF">EFF</A></DT>
-<DD><A href="http://www.eff.org">Electronic Frontier Foundation</A>, an
- advocacy group for civil rights in cyberspace.</DD>
-<DT><A name="encryption">Encryption</A></DT>
-<DD>Techniques for converting a readable message (<A href="#plaintext">
-plaintext</A>) into apparently random material (<A href="#ciphertext">
-ciphertext</A>) which cannot be read if intercepted. A key is required
- to read the message.
-<P>Major variants include<A href="#symmetric"> symmetric</A> encryption
- in which sender and receiver use the same secret key and<A href="#public">
- public key</A> methods in which the sender uses one of a matched pair
- of keys and the receiver uses the other. Many current systems,
- including<A href="#IPSEC"> IPsec</A>, are<A href="#hybrid"> hybrids</A>
- combining the two techniques.</P>
-</DD>
-<DT><A name="ESP">ESP</A></DT>
-<DD><B>E</B>ncapsulated<B> S</B>ecurity<B> P</B>ayload, the<A href="#IPSEC">
- IPsec</A> protocol which provides<A href="#encryption"> encryption</A>.
- It can also provide<A href="#authentication"> authentication</A>
- service and may be used with null encryption (which we do not
- recommend). For details see our<A href="#ESP.ipsec"> IPsec</A> document
- and/or RFC 2406.</DD>
-<DT><A name="#extruded">Extruded subnet</A></DT>
-<DD>A situation in which something IP sees as one network is actually in
- two or more places.
-<P>For example, the Internet may route all traffic for a particular
- company to that firm's corporate gateway. It then becomes the company's
- problem to get packets to various machines on their<A href="#subnet">
- subnets</A> in various departments. They may decide to treat a branch
- office like a subnet, giving it IP addresses &quot;on&quot; their corporate net.
- This becomes an extruded subnet.</P>
-<P>Packets bound for it are delivered to the corporate gateway, since as
- far as the outside world is concerned, that subnet is part of the
- corporate network. However, instead of going onto the corporate LAN (as
- they would for, say, the accounting department) they are then
- encapsulated and sent back onto the Internet for delivery to the branch
- office.</P>
-<P>For information on doing this with Linux FreeS/WAN, look in our<A href="#extruded.config">
- advanced configuration</A> section.</P>
-</DD>
-<DT>Exhaustive search</DT>
-<DD>See<A href="#brute"> brute force attack</A>.</DD>
-<DT><A name="F">F</A></DT>
-<DT><A name="FIPS">FIPS</A></DT>
-<DD><B>F</B>ederal<B> I</B>nformation<B> P</B>rocessing<B> S</B>tandard,
- the US government's standards for products it buys. These are issued by<A
-href="#NIST"> NIST</A>. Among other things,<A href="#DES"> DES</A> and<A href="#SHA">
- SHA</A> are defined in FIPS documents. NIST have a<A href="http://www.itl.nist.gov/div897/pubs">
- FIPS home page</A>.</DD>
-<DT><A name="FSF">Free Software Foundation (FSF)</A></DT>
-<DD>An organisation to promote free software, free in the sense of these
- quotes from their web pages</DD>
-<DD><BLOCKQUOTE> &quot;Free software&quot; is a matter of liberty, not price. To
- understand the concept, you should think of &quot;free speech&quot;, not &quot;free
- beer.&quot;
-<P>&quot;Free software&quot; refers to the users' freedom to run, copy,
- distribute, study, change and improve the software.</P>
-</BLOCKQUOTE>
-<P>See also<A href="#GNU"> GNU</A>,<A href="#GPL"> GNU General Public
- License</A>, and<A href="http://www.fsf.org"> the FSF site</A>.</P>
-</DD>
-<DT>FreeS/WAN</DT>
-<DD>see<A href="#FreeSWAN"> Linux FreeS/WAN</A></DD>
-<DT><A name="fullnet">Fullnet</A></DT>
-<DD>The CIDR block containing all IPs of its IP version. The<A HREF="#IPv4">
- IPv4</A> fullnet is written 0.0.0.0/0. Also known as &quot;all&quot; and
- &quot;default&quot;, fullnet may be used in a routing table to specify a default
- route, and in a FreeS/WAN<A HREF="#policygroups"> policy group</A> file
- to specify a default IPsec policy.</DD>
-<DT>FSF</DT>
-<DD>see<A href="#FSF"> Free software Foundation</A></DD>
-<DT><A name="G">G</A></DT>
-<DT><A name="GCHQ">GCHQ</A></DT>
-<DD><A href="http://www.gchq.gov.uk">Government Communications
- Headquarters</A>, the British organisation for<A href="#SIGINT">
- signals intelligence</A>.</DD>
-<DT>generator of a prime field</DT>
-<DD>see<A href="#dlog"> discrete logarithm problem</A></DD>
-<DT><A name="GILC">GILC</A></DT>
-<DD><A href="http://www.gilc.org">Global Internet Liberty Campaign</A>,
- an international organisation advocating, among other things, free
- availability of cryptography. They have a<A href="http://www.gilc.org/crypto/wassenaar">
- campaign</A> to remove cryptographic software from the<A href="#Wassenaar.gloss">
- Wassenaar Arrangement</A>.</DD>
-<DT>Global Internet Liberty Campaign</DT>
-<DD>see<A href="#GILC"> GILC</A>.</DD>
-<DT><A name="GTR">Global Trust Register</A></DT>
-<DD>An attempt to create something like a<A href="#rootCA"> root CA</A>
- for<A href="#PGP"> PGP</A> by publishing both<A href="#GTR"> as a book</A>
- and<A href="http://www.cl.cam.ac.uk/Research/Security/Trust-Register">
- on the web</A> the fingerprints of a set of verified keys for
- well-known users and organisations.</DD>
-<DT><A name="GMP">GMP</A></DT>
-<DD>The<B> G</B>NU<B> M</B>ulti-<B>P</B>recision library code, used in<A href="#FreeSWAN">
- Linux FreeS/WAN</A> by<A href="#Pluto"> Pluto</A> for<A href="#public">
- public key</A> calculations. See the<A href="http://www.swox.com/gmp">
- GMP home page</A>.</DD>
-<DT><A name="GNU">GNU</A></DT>
-<DD><B>G</B>NU's<B> N</B>ot<B> U</B>nix, the<A href="#FSF"> Free
- Software Foundation's</A> project aimed at creating a free system with
- at least the capabilities of Unix.<A href="#Linux"> Linux</A> uses GNU
- utilities extensively.</DD>
-<DT><A name="#GOST">GOST</A></DT>
-<DD>a Soviet government standard<A href="#block"> block cipher</A>.<A href="#schneier">
- Applied Cryptography</A> has details.</DD>
-<DT>GPG</DT>
-<DD>see<A href="#GPG"> GNU Privacy Guard</A></DD>
-<DT><A name="GPL">GNU General Public License</A>(GPL, copyleft)</DT>
-<DD>The license developed by the<A href="#FSF"> Free Software Foundation</A>
- under which<A href="#Linux"> Linux</A>,<A href="#FreeSWAN"> Linux
- FreeS/WAN</A> and many other pieces of software are distributed. The
- license allows anyone to redistribute and modify the code, but forbids
- anyone from distributing executables without providing access to source
- code. For more details see the file<A href="../COPYING"> COPYING</A>
- included with GPLed source distributions, including ours, or<A href="http://www.fsf.org/copyleft/gpl.html">
- the GNU site's GPL page</A>.</DD>
-<DT><A name="GPG">GNU Privacy Guard</A></DT>
-<DD>An open source implementation of Open<A href="#PGP"> PGP</A> as
- defined in RFC 2440. See their<A href="http://www.gnupg.org"> web site</A>
-</DD>
-<DT>GPL</DT>
-<DD>see<A href="#GPL"> GNU General Public License</A>.</DD>
-<DT><A name="H">H</A></DT>
-<DT><A name="hash">Hash</A></DT>
-<DD>see<A href="#digest"> message digest</A></DD>
-<DT><A name="HMAC">Hashed Message Authentication Code (HMAC)</A></DT>
-<DD>using keyed<A href="#digest"> message digest</A> functions to
- authenticate a message. This differs from other uses of these
- functions:
-<UL>
-<LI>In normal usage, the hash function's internal variable are
- initialised in some standard way. Anyone can reproduce the hash to
- check that the message has not been altered.</LI>
-<LI>For HMAC usage, you initialise the internal variables from the key.
- Only someone with the key can reproduce the hash. A successful check of
- the hash indicates not only that the message is unchanged but also that
- the creator knew the key.</LI>
-</UL>
-<P>The exact techniques used in<A href="#IPSEC"> IPsec</A> are defined
- in RFC 2104. They are referred to as HMAC-MD5-96 and HMAC-SHA-96
- because they output only 96 bits of the hash. This makes some attacks
- on the hash functions harder.</P>
-</DD>
-<DT>HMAC</DT>
-<DD>see<A href="#HMAC"> Hashed Message Authentication Code</A></DD>
-<DT>HMAC-MD5-96</DT>
-<DD>see<A href="#HMAC"> Hashed Message Authentication Code</A></DD>
-<DT>HMAC-SHA-96</DT>
-<DD>see<A href="#HMAC"> Hashed Message Authentication Code</A></DD>
-<DT><A name="hybrid">Hybrid cryptosystem</A></DT>
-<DD>A system using both<A href="#public"> public key</A> and<A href="#symmetric">
- symmetric cipher</A> techniques. This works well. Public key methods
- provide key management and<A href="#signature"> digital signature</A>
- facilities which are not readily available using symmetric ciphers. The
- symmetric cipher, however, can do the bulk of the encryption work much
- more efficiently than public key methods.</DD>
-<DT><A name="I">I</A></DT>
-<DT><A name="IAB">IAB</A></DT>
-<DD><A href="http://www.iab.org/iab">Internet Architecture Board</A>.</DD>
-<DT><A name="ICMP.gloss">ICMP</A></DT>
-<DD><STRONG>I</STRONG>nternet<STRONG> C</STRONG>ontrol<STRONG> M</STRONG>
-essage<STRONG> P</STRONG>rotocol. This is used for various IP-connected
- devices to manage the network.</DD>
-<DT><A name="IDEA">IDEA</A></DT>
-<DD><B>I</B>nternational<B> D</B>ata<B> E</B>ncrypion<B> A</B>lgorithm,
- developed in Europe as an alternative to exportable American ciphers
- such as<A href="#DES"> DES</A> which were<A href="#desnotsecure"> too
- weak for serious use</A>. IDEA is a<A href="#block"> block cipher</A>
- using 64-bit blocks and 128-bit keys, and is used in products such as<A href="#PGP">
- PGP</A>.
-<P>IDEA is not required by the<A href="#IPSEC"> IPsec</A> RFCs and not
- currently used in<A href="#FreeSWAN"> Linux FreeS/WAN</A>.</P>
-<P>IDEA is patented and, with strictly limited exceptions for personal
- use, using it requires a license from<A href="http://www.ascom.com">
- Ascom</A>.</P>
-</DD>
-<DT><A name="IEEE">IEEE</A></DT>
-<DD><A href="http://www.ieee.org">Institute of Electrical and Electronic
- Engineers</A>, a professional association which, among other things,
- sets some technical standards</DD>
-<DT><A name="IESG">IESG</A></DT>
-<DD><A href="http://www.iesg.org">Internet Engineering Steering Group</A>
-.</DD>
-<DT><A name="IETF">IETF</A></DT>
-<DD><A href="http://www.ietf.org">Internet Engineering Task Force</A>,
- the umbrella organisation whose various working groups make most of the
- technical decisions for the Internet. The IETF<A href="http://www.ietf.org/html.charters/ipsec-charter.html">
- IPsec working group</A> wrote the<A href="#RFC"> RFCs</A> we are
- implementing.</DD>
-<DT><A name="IKE">IKE</A></DT>
-<DD><B>I</B>nternet<B> K</B>ey<B> E</B>xchange, based on the<A href="#DH">
- Diffie-Hellman</A> key exchange protocol. For details, see RFC 2409 and
- our<A href="ipsec.html"> IPsec</A> document. IKE is implemented in<A href="#FreeSWAN">
- Linux FreeS/WAN</A> by the<A href="#Pluto"> Pluto daemon</A>.</DD>
-<DT>IKE v2</DT>
-<DD>A proposed replacement for<A href="#IKE"> IKE</A>. There are other
- candidates, such as<A href="#JFK"> JFK</A>, and at time of writing
- (March 2002) the choice between them has not yet been made and does not
- appear imminent.</DD>
-<DT><A name="iOE">iOE</A></DT>
-<DD>See<A HREF="#initiate-only"> Initiate-only opportunistic encryption</A>
-.</DD>
-<DT><A name="IP">IP</A></DT>
-<DD><B>I</B>nternet<B> P</B>rotocol.</DD>
-<DT><A name="masq">IP masquerade</A></DT>
-<DD>A mostly obsolete term for a method of allowing multiple machines to
- communicate over the Internet when only one IP address is available for
- their use. The more current term is Network Address Translation or<A href="#NAT.gloss">
- NAT</A>.</DD>
-<DT><A name="IPng">IPng</A></DT>
-<DD>&quot;IP the Next Generation&quot;, see<A href="#ipv6.gloss"> IPv6</A>.</DD>
-<DT><A name="IPv4">IPv4</A></DT>
-<DD>The current version of the<A href="#IP"> Internet protocol suite</A>
-.</DD>
-<DT><A name="ipv6.gloss">IPv6 (IPng)</A></DT>
-<DD>Version six of the<A href="#IP"> Internet protocol suite</A>,
- currently being developed. It will replace the current<A href="#IPv4">
- version four</A>. IPv6 has<A href="#IPSEC"> IPsec</A> as a mandatory
- component.
-<P>See this<A href="http://playground.sun.com/pub/ipng/html/ipng-main.html">
- web site</A> for more details, and our<A href="#ipv6"> compatibility</A>
- document for information on FreeS/WAN and the Linux implementation of
- IPv6.</P>
-</DD>
-<DT><A name="IPSEC">IPsec</A> or IPSEC</DT>
-<DD><B>I</B>nternet<B> P</B>rotocol<B> SEC</B>urity, security functions
- (<A href="#authentication">authentication</A> and<A href="#encryption">
- encryption</A>) implemented at the IP level of the protocol stack. It
- is optional for<A href="#IPv4"> IPv4</A> and mandatory for<A href="#ipv6.gloss">
- IPv6</A>.
-<P>This is the standard<A href="#FreeSWAN"> Linux FreeS/WAN</A> is
- implementing. For more details, see our<A href="ipsec.html"> IPsec
- Overview</A>. For the standards, see RFCs listed in our<A href="#RFC">
- RFCs document</A>.</P>
-</DD>
-<DT><A name="IPX">IPX</A></DT>
-<DD>Novell's Netware protocol tunnelled over an IP link. Our<A href="#user.scripts">
- firewalls</A> document includes an example of using this through an
- IPsec tunnel.</DD>
-<DT><A name="ISAKMP">ISAKMP</A></DT>
-<DD><B>I</B>nternet<B> S</B>ecurity<B> A</B>ssociation and<B> K</B>ey<B>
- M</B>anagement<B> P</B>rotocol, defined in RFC 2408.</DD>
-<DT><A name="ITAR">ITAR</A></DT>
-<DD><B>I</B>nternational<B> T</B>raffic in<B> A</B>rms<B> R</B>
-egulations, US regulations administered by the State Department which
- until recently limited export of, among other things, cryptographic
- technology and software. ITAR still exists, but the limits on
- cryptography have now been transferred to the<A href="#EAR"> Export
- Administration Regulations</A> under the Commerce Department's<A href="#BXA">
- Bureau of Export Administration</A>.</DD>
-<DT>IV</DT>
-<DD>see<A href="#IV"> Initialisation vector</A></DD>
-<DT><A name="IV">Initialisation Vector (IV)</A></DT>
-<DD>Some cipher<A href="#mode"> modes</A>, including the<A href="#CBC">
- CBC</A> mode which IPsec uses, require some extra data at the
- beginning. This data is called the initialisation vector. It need not
- be secret, but should be different for each message. Its function is to
- prevent messages which begin with the same text from encrypting to the
- same ciphertext. That might give an analyst an opening, so it is best
- prevented.</DD>
-<DT><A name="initiate-only">Initiate-only opportunistic encryption (iOE)</A>
-</DT>
-<DD>A form of<A HREF="#carpediem"> opportunistic encryption</A> (OE) in
- which a host proposes opportunistic connections, but lacks the reverse
- DNS records necessary to support incoming opportunistic connection
- requests. Common among hosts on cable or pppoe connections where the
- system administrator does not have write access to the DNS reverse map
- for the host's external IP.
-<P>Configuring for initiate-only opportunistic encryption is described
- in our<A href="#opp.client"> quickstart</A> document.</P>
-</DD>
-<DT><A name="J">J</A></DT>
-<DT><A name="JFK">JFK</A></DT>
-<DD><STRONG>J</STRONG>ust<STRONG> F</STRONG>ast<STRONG> K</STRONG>eying,
- a proposed simpler replacement for<A href="#IKE"> IKE.</A></DD>
-<DT><A name="K">K</A></DT>
-<DT><A name="kernel">Kernel</A></DT>
-<DD>The basic part of an operating system (e.g. Linux) which controls
- the hardware and provides services to all other programs.
-<P>In the Linux release numbering system, an even second digit as in 2.<STRONG>
-2</STRONG>.x indicates a stable or production kernel while an odd number
- as in 2.<STRONG>3</STRONG>.x indicates an experimental or development
- kernel. Most users should run a recent kernel version from the
- production series. The development kernels are primarily for people
- doing kernel development. Others should consider using development
- kernels only if they have an urgent need for some feature not yet
- available in production kernels.</P>
-</DD>
-<DT>Keyed message digest</DT>
-<DD>See<A href="#HMAC"> HMAC</A>.</DD>
-<DT>Key length</DT>
-<DD>see<A href="#brute"> brute force attack</A></DD>
-<DT><A name="KLIPS">KLIPS</A></DT>
-<DD><B>K</B>erne<B>l</B><B> IP</B><B> S</B>ecurity, the<A href="#FreeSWAN">
- Linux FreeS/WAN</A> project's changes to the<A href="#Linux"> Linux</A>
- kernel to support the<A href="#IPSEC"> IPsec</A> protocols.</DD>
-<DT><A name="L">L</A></DT>
-<DT><A name="LDAP">LDAP</A></DT>
-<DD><B>L</B>ightweight<B> D</B>irectory<B> A</B>ccess<B> P</B>rotocol,
- defined in RFCs 1777 and 1778, a method of accessing information stored
- in directories. LDAP is used by several<A href="#PKI"> PKI</A>
- implementations, often with X.501 directories and<A href="#X509"> X.509</A>
- certificates. It may also be used by<A href="#IPSEC"> IPsec</A> to
- obtain key certifications from those PKIs. This is not yet implemented
- in<A href="#FreeSWAN"> Linux FreeS/WAN</A>.</DD>
-<DT><A name="LIBDES">LIBDES</A></DT>
-<DD>A publicly available library of<A href="#DES"> DES</A> code, written
- by Eric Young, which<A href="#FreeSWAN"> Linux FreeS/WAN</A> uses in
- both<A href="#KLIPS"> KLIPS</A> and<A href="#Pluto"> Pluto</A>.</DD>
-<DT><A name="Linux">Linux</A></DT>
-<DD>A freely available Unix-like operating system based on a kernel
- originally written for the Intel 386 architecture by (then) student
- Linus Torvalds. Once his 32-bit kernel was available, the<A href="#GNU">
- GNU</A> utilities made it a usable system and contributions from many
- others led to explosive growth.
-<P>Today Linux is a complete Unix replacement available for several CPU
- architectures -- Intel, DEC/Compaq Alpha, Power PC, both 32-bit SPARC
- and the 64-bit UltraSPARC, SrongARM, . . . -- with support for multiple
- CPUs on some architectures.</P>
-<P><A href="#FreeSWAN">Linux FreeS/WAN</A> is intended to run on all
- CPUs supported by Linux and is known to work on several. See our<A href="#CPUs">
- compatibility</A> section for a list.</P>
-</DD>
-<DT><A name="FreeSWAN">Linux FreeS/WAN</A></DT>
-<DD>Our implementation of the<A href="#IPSEC"> IPsec</A> protocols,
- intended to be freely redistributable source code with<A href="#GPL"> a
- GNU GPL license</A> and no constraints under US or other<A href="#exlaw">
- export laws</A>. Linux FreeS/WAN is intended to interoperate with other<A
-href="#IPSEC"> IPsec</A> implementations. The name is partly taken, with
- permission, from the<A href="#SWAN"> S/WAN</A> multi-vendor IPsec
- compatability effort. Linux FreeS/WAN has two major components,<A href="#KLIPS">
- KLIPS</A> (KerneL IPsec Support) and the<A href="#Pluto"> Pluto</A>
- daemon which manages the whole thing.
-<P>See our<A href="ipsec.html"> IPsec section</A> for more detail. For
- the code see our<A href="http://freeswan.org"> primary site</A> or one
- of the mirror sites on<A href="#mirrors"> this list</A>.</P>
-</DD>
-<DT><A name="LSM">Linux Security Modules (LSM)</A></DT>
-<DD>a project to create an interface in the Linux kernel that supports
- plug-in modules for various security policies.
-<P>This allows multiple security projects to take different approaches
- to security enhancement without tying the kernel down to one particular
- approach. As I understand the history, several projects were pressing
- Linus to incorporate their changes, the various sets of changes were
- incompatible, and his answer was more-or-less &quot;a plague on all your
- houses; I'll give you an interface, but I won't incorporate anything&quot;.</P>
-<P>It seems to be working. There is a fairly active<A href="http://mail.wirex.com/mailman/listinfo/linux-security-module">
- LSM mailing list</A>, and several projects are already using the
- interface.</P>
-</DD>
-<DT>LSM</DT>
-<DD>see<A href="#LSM"> Linux Security Modules</A></DD>
-<DT><A name="M">M</A></DT>
-<DT><A name="list">Mailing list</A></DT>
-<DD>The<A href="#FreeSWAN"> Linux FreeS/WAN</A> project has several
- public email lists for bug reports and software development
- discussions. See our document on<A href="mail.html"> mailing lists</A>.</DD>
-<DT><A name="middle">Man-in-the-middle attack</A></DT>
-<DD>An<A href="#active"> active attack</A> in which the attacker
- impersonates each of the legitimate players in a protocol to the other.
-<P>For example, if<A href="#alicebob"> Alice and Bob</A> are negotiating
- a key via the<A href="#DH"> Diffie-Hellman</A> key agreement, and are
- not using<A href="#authentication"> authentication</A> to be certain
- they are talking to each other, then an attacker able to insert himself
- in the communication path can deceive both players.</P>
-<P>Call the attacker Mallory. For Bob, he pretends to be Alice. For
- Alice, he pretends to be Bob. Two keys are then negotiated,
- Alice-to-Mallory and Bob-to-Mallory. Alice and Bob each think the key
- they have is Alice-to-Bob.</P>
-<P>A message from Alice to Bob then goes to Mallory who decrypts it,
- reads it and/or saves a copy, re-encrypts using the Bob-to-Mallory key
- and sends it along to Bob. Bob decrypts successfully and sends a reply
- which Mallory decrypts, reads, re-encrypts and forwards to Alice.</P>
-<P>To make this attack effective, Mallory must</P>
-<UL>
-<LI>subvert some part of the network in some way that lets him carry out
- the deception
-<BR> possible targets: DNS, router, Alice or Bob's machine, mail server,
- ...</LI>
-<LI>beat any authentication mechanism Alice and Bob use
-<BR> strong authentication defeats the attack entirely; this is why<A href="#IKE">
- IKE</A> requires authentication</LI>
-<LI>work in real time, delivering messages without introducing a delay
- large enough to alert the victims
-<BR> not hard if Alice and Bob are using email; quite difficult in some
- situations.</LI>
-</UL>
-<P>If he manages it, however, it is devastating. He not only gets to
- read all the messages; he can alter messages, inject his own, forge
- anything he likes, . . . In fact, he controls the communication
- completely.</P>
-</DD>
-<DT><A name="mandatory">mandatory access control</A></DT>
-<DD>access control mechanisims which are not settable by the user (see<A href="#discretionary">
- discretionary access control</A>), but are enforced by the system.
-<P>For example, a document labelled &quot;secret, zebra&quot; might be readable
- only by someone with secret clearance working on Project Zebra.
- Ideally, the system will prevent any transfer outside those boundaries.
- For example, even if you can read it, you should not be able to e-mail
- it (unless the recipient is appropriately cleared) or print it (unless
- certain printers are authorised for that classification).</P>
-<P>Mandatory access control is a required feature for some levels of<A href="#rainbow">
- Rainbow Book</A> or<A href="#cc"> Common Criteria</A> classification,
- but has not been widely used outside the military and government. There
- is a good discussion of the issues in Anderson's<A href="#anderson">
- Security Engineering</A>.</P>
-<P>The<A href="#SElinux"> Security Enhanced Linux</A> project is adding
- mandatory access control to Linux.</P>
-</DD>
-<DT><A name="manual">Manual keying</A></DT>
-<DD>An IPsec mode in which the keys are provided by the administrator.
- In FreeS/WAN, they are stored in /etc/ipsec.conf. The alternative,<A href="#auto">
- automatic keying</A>, is preferred in most cases. See this<A href="#man-auto">
- discussion</A>.</DD>
-<DT><A name="MD4">MD4</A></DT>
-<DD><A href="#digest">Message Digest Algorithm</A> Four from Ron Rivest
- of<A href="#RSAco"> RSA</A>. MD4 was widely used a few years ago, but
- is now considered obsolete. It has been replaced by its descendants<A href="#MD5">
- MD5</A> and<A href="#SHA"> SHA</A>.</DD>
-<DT><A name="MD5">MD5</A></DT>
-<DD><A href="#digest">Message Digest Algorithm</A> Five from Ron Rivest
- of<A href="#RSAco"> RSA</A>, an improved variant of his<A href="#MD4">
- MD4</A>. Like MD4, it produces a 128-bit hash. For details see RFC
- 1321.
-<P>MD5 is one of two message digest algorithms available in IPsec. The
- other is<A href="#SHA"> SHA</A>. SHA produces a longer hash and is
- therefore more resistant to<A href="#birthday"> birthday attacks</A>,
- but this is not a concern for IPsec. The<A href="#HMAC"> HMAC</A>
- method used in IPsec is secure even if the underlying hash is not
- particularly strong against this attack.</P>
-<P>Hans Dobbertin found a weakness in MD5, and people often ask whether
- this means MD5 is unsafe for IPsec. It doesn't. The IPsec RFCs discuss
- Dobbertin's attack and conclude that it does not affect MD5 as used for
- HMAC in IPsec.</P>
-</DD>
-<DT><A name="meet">Meet-in-the-middle attack</A></DT>
-<DD>A divide-and-conquer attack which breaks a cipher into two parts,
- works against each separately, and compares results. Probably the best
- known example is an attack on double DES. This applies in principle to
- any pair of block ciphers, e.g. to an encryption system using, say,
- CAST-128 and Blowfish, but we will describe it for double DES.
-<P>Double DES encryption and decryption can be written:</P>
-<PRE>        C = E(k2,E(k1,P))
-        P = D(k1,D(k2,C))</PRE>
-<P>Where C is ciphertext, P is plaintext, E is encryption, D is
- decryption, k1 is one key, and k2 is the other key. If we know a P, C
- pair, we can try and find the keys with a brute force attack, trying
- all possible k1, k2 pairs. Since each key is 56 bits, there are 2<SUP>
-112</SUP> such pairs and this attack is painfully inefficient.</P>
-<P>The meet-in-the middle attack re-writes the equations to calculate a
- middle value M:</P>
-<PRE>        M = E(k1,P)
-        M = D(k2,C)</PRE>
-<P>Now we can try some large number of D(k2,C) decryptions with various
- values of k2 and store the results in a table. Then start doing E(k1,P)
- encryptions, checking each result to see if it is in the table.</P>
-<P>With enough table space, this breaks double DES with<NOBR> 2<SUP>56</SUP>
- + 2<SUP>56</SUP> = 2<SUP>57</SUP>work. Against triple DES, you need<NOBR>
- 2<SUP>56</SUP> + 2<SUP>112</SUP> ~= 2<SUP>112</SUP>.</P>
-<P>The memory requirements for such attacks can be prohibitive, but
- there is a whole body of research literature on methods of reducing
- them.</P>
-</DD>
-<DT><A name="digest">Message Digest Algorithm</A></DT>
-<DD>An algorithm which takes a message as input and produces a hash or
- digest of it, a fixed-length set of bits which depend on the message
- contents in some highly complex manner. Design criteria include making
- it extremely difficult for anyone to counterfeit a digest or to change
- a message without altering its digest. One essential property is<A href="#collision">
- collision resistance</A>. The main applications are in message<A href="#authentication">
- authentication</A> and<A href="#signature"> digital signature</A>
- schemes. Widely used algorithms include<A href="#MD5"> MD5</A> and<A href="#SHA">
- SHA</A>. In IPsec, message digests are used for<A href="#HMAC"> HMAC</A>
- authentication of packets.</DD>
-<DT><A name="MTU">MTU</A></DT>
-<DD><STRONG>M</STRONG>aximum<STRONG> T</STRONG>ransmission<STRONG> U</STRONG>
-nit, the largest size of packet that can be sent over a link. This is
- determined by the underlying network, but must be taken account of at
- the IP level.
-<P>IP packets, which can be up to 64K bytes each, must be packaged into
- lower-level packets of the appropriate size for the underlying
- network(s) and re-assembled on the other end. When a packet must pass
- over multiple networks, each with its own MTU, and many of the MTUs are
- unknown to the sender, this becomes a fairly complex problem. See<A href="#pathMTU">
- path MTU discovery</A> for details.</P>
-<P>Often the MTU is a few hundred bytes on serial links and 1500 on
- Ethernet. There are, however, serial link protocols which use a larger
- MTU to avoid fragmentation at the ethernet/serial boundary, and newer
- (especially gigabit) Ethernet networks sometimes support much larger
- packets because these are more efficient in some applications.</P>
-</DD>
-<DT><A name="N">N</A></DT>
-<DT><A name="NAI">NAI</A></DT>
-<DD><A href="http://www.nai.com">Network Associates</A>, a conglomerate
- formed from<A href="#PGPI"> PGP Inc.</A>, TIS (Trusted Information
- Systems, a firewall vendor) and McAfee anti-virus products. Among other
- things, they offer an IPsec-based VPN product.</DD>
-<DT><A name="NAT.gloss">NAT</A></DT>
-<DD><B>N</B>etwork<B> A</B>ddress<B> T</B>ranslation, a process by which
- firewall machines may change the addresses on packets as they go
- through. For discussion, see our<A href="#nat.background"> background</A>
- section.</DD>
-<DT><A name="NIST">NIST</A></DT>
-<DD>The US<A href="http://www.nist.gov"> National Institute of Standards
- and Technology</A>, responsible for<A href="#FIPS"> FIPS standards</A>
- including<A href="#DES"> DES</A> and its replacement,<A href="#AES">
- AES</A>.</DD>
-<DT><A name="nonce">Nonce</A></DT>
-<DD>A<A href="#random"> random</A> value used in an<A href="#authentication">
- authentication</A> protocol.</DD>
-<DT></DT>
-<DT><A name="non-routable">Non-routable IP address</A></DT>
-<DD>An IP address not normally allowed in the &quot;to&quot; or &quot;from&quot; IP address
- field header of IP packets.
-<P>Almost invariably, the phrase &quot;non-routable address&quot; means one of the
- addresses reserved by RFC 1918 for private networks:</P>
-<UL>
-<LI>10.anything</LI>
-<LI>172.x.anything with 16 &lt;= x &lt;= 31</LI>
-<LI>192.168.anything</LI>
-</UL>
-<P>These addresses are commonly used on private networks, e.g. behind a
- Linux machines doing<A href="#masq"> IP masquerade</A>. Machines within
- the private network can address each other with these addresses. All
- packets going outside that network, however, have these addresses
- replaced before they reach the Internet.</P>
-<P>If any packets using these addresses do leak out, they do not go far.
- Most routers automatically discard all such packets.</P>
-<P>Various other addresses -- the 127.0.0.0/8 block reserved for local
- use, 0.0.0.0, various broadcast and network addresses -- cannot be
- routed over the Internet, but are not normally included in the meaning
- when the phrase &quot;non-routable address&quot; is used.</P>
-</DD>
-<DT><A name="NSA">NSA</A></DT>
-<DD>The US<A href="http://www.nsa.gov"> National Security Agency</A>,
- the American organisation for<A href="#SIGINT"> signals intelligence</A>
-, the protection of US government messages and the interception and
- analysis of other messages. For details, see Bamford's<A href="#puzzle">
- &quot;The Puzzle Palace&quot;</A>.
-<P>Some<A href="http://www.gwu.edu/~nsarchiv/NSAEBB/NSAEBB23/index.html">
- history of NSA</A> documents were declassified in response to a FOIA
- (Freedom of Information Act) request.</P>
-</DD>
-<DT><A name="O">O</A></DT>
-<DT><A name="oakley">Oakley</A></DT>
-<DD>A key determination protocol, defined in RFC 2412.</DD>
-<DT>Oakley groups</DT>
-<DD>The groups used as the basis of<A href="#DH"> Diffie-Hellman</A> key
- exchange in the Oakley protocol, and in<A href="#IKE"> IKE</A>. Four
- were defined in the original RFC, and a fifth has been<A href="http://www.lounge.org/ike_doi_errata.html">
- added since</A>.
-<P>Linux FreeS/WAN currently supports the three groups based on finite
- fields modulo a prime (Groups 1, 2 and 5) and does not support the
- elliptic curve groups (3 and 4). For a description of the difference of
- the types, see<A href="#dlog"> discrete logarithms</A>.</P>
-</DD>
-<DT><A name="OTP">One time pad</A></DT>
-<DD>A cipher in which the key is:
-<UL>
-<LI>as long as the total set of messages to be enciphered</LI>
-<LI>absolutely<A href="#random"> random</A></LI>
-<LI>never re-used</LI>
-</UL>
-<P>Given those three conditions, it can easily be proved that the cipher
- is perfectly secure, in the sense that an attacker with intercepted
- message in hand has no better chance of guessing the message than an
- attacker who has not intercepted the message and only knows the message
- length. No such proof exists for any other cipher.</P>
-<P>There are, however, several problems with this &quot;perfect&quot; cipher.</P>
-<P>First, it is<STRONG> wildly impractical</STRONG> for most
- applications. Key management is at best difficult, often completely
- impossible.</P>
-<P>Second, it is<STRONG> extremely fragile</STRONG>. Small changes which
- violate the conditions listed above do not just weaken the cipher
- liitle. Quite often they destroy its security completely.</P>
-<UL>
-<LI>Re-using the pad weakens the cipher to the point where it can be
- broken with pencil and paper. With a computer, the attack is trivially
- easy.</LI>
-<LI>Using<EM> anything</EM> less than truly<A href="#random"> random</A>
- numbers<EM> completely</EM> invalidates the security proof.</LI>
-<LI>In particular, using computer-generated pseudo-random numbers may
- give an extremely weak cipher. It might also produce a good stream
- cipher, if the pseudo-random generator is both well-designed and
- properely seeded.</LI>
-</UL>
-<P>Marketing claims about the &quot;unbreakable&quot; security of various products
- which somewhat resemble one-time pads are common. Such claims are one
- of the surest signs of cryptographic<A href="#snake"> snake oil</A>;
- most systems marketed with such claims are worthless.</P>
-<P>Finally, even if the system is implemented and used correctly, it is<STRONG>
- highly vulnerable to a substitution attack</STRONG>. If an attacker
- knows some plaintext and has an intercepted message, he can discover
- the pad.</P>
-<UL>
-<LI>This does not matter if the attacker is just a<A href="#passive">
- passive</A> eavesdropper. It gives him no plaintext he didn't already
- know and we don't care that he learns a pad which we will never re-use.</LI>
-<LI>However, an<A href="#active"> active</A> attacker who knows the
- plaintext can recover the pad, then use it to encode with whatever he
- chooses. If he can get his version delivered instead of yours, this may
- be a disaster. If you send &quot;attack at dawn&quot;, the delivered message can
- be anything the same length -- perhaps &quot;retreat to east&quot; or &quot;shoot
- generals&quot;.</LI>
-<LI>An active attacker with only a reasonable guess at the plaintext can
- try the same attack. If the guess is correct, this works and the
- attacker's bogus message is delivered. If the guess is wrong, a garbled
- message is delivered.</LI>
-</UL>
-<P>In general then, despite its theoretical perfection, the one-time-pad
- has very limited practical application.</P>
-<P>See also the<A href="http://pubweb.nfr.net/~mjr/pubs/otpfaq/"> one
- time pad FAQ</A>.</P>
-</DD>
-<DT><A name="carpediem">Opportunistic encryption (OE)</A></DT>
-<DD>A situation in which any two IPsec-aware machines can secure their
- communications, without a pre-shared secret and without a common<A href="#PKI">
- PKI</A> or previous exchange of public keys. This is one of the goals
- of the Linux FreeS/WAN project, discussed in our<A href="#goals">
- introduction</A> section.
-<P>Setting up for opportunistic encryption is described in our<A href="#quickstart">
- quickstart</A> document.</P>
-</DD>
-<DT><A name="responder">Opportunistic responder</A></DT>
-<DD>A host which accepts, but does not initiate, requests for<A HREF="#carpediem">
- opportunistic encryption</A> (OE). An opportunistic responder has
- enabled OE in its<A HREF="#passive.OE"> passive</A> form (pOE) only. A
- web server or file server may be usefully set up as an opportunistic
- responder.
-<P>Configuring passive OE is described in our<A href="#policygroups">
- policy groups</A> document.</P>
-</DD>
-<DT><A name="orange">Orange book</A></DT>
-<DD>the most basic and best known of the US government's<A href="#rainbow">
- Rainbow Book</A> series of computer security standards.</DD>
-<DT><A name="P">P</A></DT>
-<DT><A name="P1363">P1363 standard</A></DT>
-<DD>An<A href="#IEEE"> IEEE</A> standard for public key cryptography.<A href="http://grouper.ieee.org/groups/1363">
- Web page</A>.</DD>
-<DT><A name="pOE">pOE</A></DT>
-<DD>See<A href="#passive.OE"> Passive opportunistic encryption</A>.</DD>
-<DT><A name="passive">Passive attack</A></DT>
-<DD>An attack in which the attacker only eavesdrops and attempts to
- analyse intercepted messages, as opposed to an<A href="#active"> active
- attack</A> in which he diverts messages or generates his own.</DD>
-<DT><A name="passive.OE">Passive opportunistic encryption (pOE)</A></DT>
-<DD>A form of<A HREF="#carpediem"> opportunistic encryption</A> (OE) in
- which the host will accept opportunistic connection requests, but will
- not initiate such requests. A host which runs OE in its passive form
- only is known as an<A HREF="#responder"> opportunistic responder</A>.
-<P>Configuring passive OE is described in our<A href="#policygroups">
- policy groups</A> document.</P>
-</DD>
-<DT><A name="pathMTU">Path MTU discovery</A></DT>
-<DD>The process of discovering the largest packet size which all links
- on a path can handle without fragmentation -- that is, without any
- router having to break the packet up into smaller pieces to match the<A href="#MTU">
- MTU</A> of its outgoing link.
-<P>This is done as follows:</P>
-<UL>
-<LI>originator sends the largest packets allowed by<A href="#MTU"> MTU</A>
- of the first link, setting the DF (<STRONG>d</STRONG>on't<STRONG> f</STRONG>
-ragment) bit in the packet header</LI>
-<LI>any router which cannot send the packet on (outgoing MTU is too
- small for it, and DF prevents fragmenting it to match) sends back an<A href="#ICMP.gloss">
- ICMP</A> packet reporting the problem</LI>
-<LI>originator looks at ICMP message and tries a smaller size</LI>
-<LI>eventually, you settle on a size that can pass all routers</LI>
-<LI>thereafter, originator just sends that size and no-one has to
- fragment</LI>
-</UL>
-<P>Since this requires co-operation of many systems, and since the next
- packet may travel a different path, this is one of the trickier areas
- of IP programming. Bugs that have shown up over the years have
- included:</P>
-<UL>
-<LI>malformed ICMP messages</LI>
-<LI>hosts that ignore or mishandle these ICMP messages</LI>
-<LI>firewalls blocking the ICMP messages so host does not see them</LI>
-</UL>
-<P>Since IPsec adds a header, it increases packet size and may require
- fragmentation even where incoming and outgoing MTU are equal.</P>
-</DD>
-<DT><A name="PFS">Perfect forward secrecy (PFS)</A></DT>
-<DD>A property of systems such as<A href="#DH"> Diffie-Hellman</A> key
- exchange which use a long-term key (such as the shared secret in IKE)
- and generate short-term keys as required. If an attacker who acquires
- the long-term key<EM> provably</EM> can
-<UL>
-<LI><EM>neither</EM> read previous messages which he may have archived</LI>
-<LI><EM>nor</EM> read future messages without performing additional
- successful attacks</LI>
-</UL>
-<P>then the system has PFS. The attacker needs the short-term keys in
- order to read the trafiic and merely having the long-term key does not
- allow him to infer those. Of course, it may allow him to conduct
- another attack (such as<A href="#middle"> man-in-the-middle</A>) which
- gives him some short-term keys, but he does not automatically get them
- just by acquiring the long-term key.</P>
-<P>See also<A href="http://sandelman.ottawa.on.ca/ipsec/1996/08/msg00123.html">
- Phil Karn's definition</A>.</P>
-</DD>
-<DT>PFS</DT>
-<DD>see Perfect Forward Secrecy</DD>
-<DT><A name="PGP">PGP</A></DT>
-<DD><B>P</B>retty<B> G</B>ood<B> P</B>rivacy, a personal encryption
- system for email based on public key technology, written by Phil
- Zimmerman.
-<P>The 2.xx versions of PGP used the<A href="#RSA"> RSA</A> public key
- algorithm and used<A href="#IDEA"> IDEA</A> as the symmetric cipher.
- These versions are described in RFC 1991 and in<A href="#PGP">
- Garfinkel's book</A>. Since version 5, the products from<A href="#PGPI">
- PGP Inc</A>. have used<A href="#DH"> Diffie-Hellman</A> public key
- methods and<A href="#CAST128"> CAST-128</A> symmetric encryption. These
- can verify signatures from the 2.xx versions, but cannot exchange
- encryted messages with them.</P>
-<P>An<A href="#IETF"> IETF</A> working group has issued RFC 2440 for an
- &quot;Open PGP&quot; standard, similar to the 5.x versions. PGP Inc. staff were
- among the authors. A free<A href="#GPG"> Gnu Privacy Guard</A> based on
- that standard is now available.</P>
-<P>For more information on PGP, including how to obtain it, see our
- cryptography<A href="#tools"> links</A>.</P>
-</DD>
-<DT><A name="PGPI">PGP Inc.</A></DT>
-<DD>A company founded by Zimmerman, the author of<A href="#PGP"> PGP</A>
-, now a division of<A href="#NAI"> NAI</A>. See the<A href="http://www.pgp.com">
- corporate website</A>. Zimmerman left in 2001, and early in 2002 NAI
- announced that they would no longer sell PGP..
-<P>Versions 6.5 and later of the PGP product include PGPnet, an IPsec
- client for Macintosh or for Windows 95/98/NT. See our<A href="interop.html#pgpnet">
- interoperation documen</A>t.</P>
-</DD>
-<DT><A name="photuris">Photuris</A></DT>
-<DD>Another key negotiation protocol, an alternative to<A href="#IKE">
- IKE</A>, described in RFCs 2522 and 2523.</DD>
-<DT><A name="PPP">PPP</A></DT>
-<DD><B>P</B>oint-to-<B>P</B>oint<B> P</B>rotocol, originally a method of
- connecting over modems or serial lines, but see also PPPoE.</DD>
-<DT><A name="PPPoE">PPPoE</A></DT>
-<DD><B>PPP</B><B> o</B>ver<B> E</B>thernet, a somewhat odd protocol that
- makes Ethernet look like a point-to-point serial link. It is widely
- used for cable or ADSL Internet services, apparently mainly because it
- lets the providers use access control and address assignmment
- mechanisms developed for dialup networks.<A href="http://www.roaringpenguin.com">
- Roaring Penguin</A> provide a widely used Linux implementation.</DD>
-<DT><A name="PPTP">PPTP</A></DT>
-<DD><B>P</B>oint-to-<B>P</B>oint<B> T</B>unneling<B> P</B>rotocol, used
- in some Microsoft VPN implementations. Papers discussing weaknesses in
- it are on<A href="http://www.counterpane.com/publish.html">
- counterpane.com</A>. It is now largely obsolete, replaced by L2TP.</DD>
-<DT><A name="PKI">PKI</A></DT>
-<DD><B>P</B>ublic<B> K</B>ey<B> I</B>nfrastructure, the things an
- organisation or community needs to set up in order to make<A href="#public">
- public key</A> cryptographic technology a standard part of their
- operating procedures.
-<P>There are several PKI products on the market. Typically they use a
- hierarchy of<A href="#CA"> Certification Authorities (CAs)</A>. Often
- they use<A href="#LDAP"> LDAP</A> access to<A href="#X509"> X.509</A>
- directories to implement this.</P>
-<P>See<A href="#web"> Web of Trust</A> for a different sort of
- infrastructure.</P>
-</DD>
-<DT><A name="PKIX">PKIX</A></DT>
-<DD><B>PKI</B> e<B>X</B>change, an<A href="#IETF"> IETF</A> standard
- that allows<A href="#PKI"> PKI</A>s to talk to each other.
-<P>This is required, for example, when users of a corporate PKI need to
- communicate with people at client, supplier or government
- organisations, any of which may have a different PKI in place. I should
- be able to talk to you securely whenever:</P>
-<UL>
-<LI>your organisation and mine each have a PKI in place</LI>
-<LI>you and I are each set up to use those PKIs</LI>
-<LI>the two PKIs speak PKIX</LI>
-<LI>the configuration allows the conversation</LI>
-</UL>
-<P>At time of writing (March 1999), this is not yet widely implemented
- but is under quite active development by several groups.</P>
-</DD>
-<DT><A name="plaintext">Plaintext</A></DT>
-<DD>The unencrypted input to a cipher, as opposed to the encrypted<A href="#ciphertext">
- ciphertext</A> output.</DD>
-<DT><A name="Pluto">Pluto</A></DT>
-<DD>The<A href="#FreeSWAN"> Linux FreeS/WAN</A> daemon which handles key
- exchange via the<A href="#IKE"> IKE</A> protocol, connection
- negotiation, and other higher-level tasks. Pluto calls the<A href="#KLIPS">
- KLIPS</A> kernel code as required. For details, see the manual page
- ipsec_pluto(8).</DD>
-<DT><A name="public">Public Key Cryptography</A></DT>
-<DD>In public key cryptography, keys are created in matched pairs.
- Encrypt with one half of a pair and only the matching other half can
- decrypt it. This contrasts with<A href="#symmetric"> symmetric or
- secret key cryptography</A> in which a single key known to both parties
- is used for both encryption and decryption.
-<P>One half of each pair, called the public key, is made public. The
- other half, called the private key, is kept secret. Messages can then
- be sent by anyone who knows the public key to the holder of the private
- key. Encrypt with the public key and you know that only someone with
- the matching private key can decrypt.</P>
-<P>Public key techniques can be used to create<A href="#signature">
- digital signatures</A> and to deal with key management issues, perhaps
- the hardest part of effective deployment of<A href="#symmetric">
- symmetric ciphers</A>. The resulting<A href="#hybrid"> hybrid
- cryptosystems</A> use public key methods to manage keys for symmetric
- ciphers.</P>
-<P>Many organisations are currently creating<A href="#PKI"> PKIs, public
- key infrastructures</A> to make these benefits widely available.</P>
-</DD>
-<DT>Public Key Infrastructure</DT>
-<DD>see<A href="#PKI"> PKI</A></DD>
-<DT><A name="Q">Q</A></DT>
-<DT><A name="R">R</A></DT>
-<DT><A name="rainbow">Rainbow books</A></DT>
-<DD>A set of US government standards for evaluation of &quot;trusted computer
- systems&quot;, of which the best known was the<A href="#orange"> Orange Book</A>
-. One fairly often hears references to &quot;C2 security&quot; or a product
- &quot;evaluated at B1&quot;. The Rainbow books define the standards referred to
- in those comments.
-<P>See this<A href="http://www.fas.org/irp/nsa/rainbow.htm"> reference
- page</A>.</P>
-<P>The Rainbow books are now mainly obsolete, replaced by the
- international<A href="#cc"> Common Criteria</A> standards.</P>
-</DD>
-<DT><A name="random">Random</A></DT>
-<DD>A remarkably tricky term, far too much so for me to attempt a
- definition here. Quite a few cryptosystems have been broken via attacks
- on weak random number generators, even when the rest of the system was
- sound.
-<P>See<A href="http://nis.nsf.net/internet/documents/rfc/rfc1750.txt">
- RFC 1750</A> for the theory.</P>
-<P>See the manual pages for<A href="manpage.d/ipsec_ranbits.8.html">
- ipsec_ranbits(8)</A> and ipsec_prng(3) for more on FreeS/WAN's use of
- randomness. Both depend on the random(4) device driver..</P>
-<P>A couple of years ago, there was extensive mailing list discussion
- (archived<A href="http://www.openpgp.net/random/index.html"> here</A>
-)of Linux /dev/random and FreeS/WAN. Since then, the design of the
- random(4) driver has changed considerably. Linux 2.4 kernels have the
- new driver..</P>
-</DD>
-<DT>Raptor</DT>
-<DD>A firewall product for Windows NT offerring IPsec-based VPN
- services. Linux FreeS/WAN interoperates with Raptor; see our<A href="#raptor">
- interop</A> document for details. Raptor have recently merged with
- Axent.</DD>
-<DT><A name="RC4">RC4</A></DT>
-<DD><B>R</B>ivest<B> C</B>ipher four, designed by Ron Rivest of<A href="#RSAco">
- RSA</A> and widely used. Believed highly secure with adequate key
- length, but often implemented with inadequate key length to comply with
- export restrictions.</DD>
-<DT><A name="RC6">RC6</A></DT>
-<DD><B>R</B>ivest<B> C</B>ipher six,<A href="#RSAco"> RSA</A>'s<A href="#AES">
- AES</A> candidate cipher.</DD>
-<DT><A name="replay">Replay attack</A></DT>
-<DD>An attack in which the attacker records data and later replays it in
- an attempt to deceive the recipient.</DD>
-<DT><A name="reverse">Reverse map</A></DT>
-<DD>In<A href="#DNS"> DNS</A>, a table where IP addresses can be used as
- the key for lookups which return a system name and/or other
- information.</DD>
-<DT>RFC</DT>
-<DD><B>R</B>equest<B> F</B>or<B> C</B>omments, an Internet document.
- Some RFCs are just informative. Others are standards.
-<P>Our list of<A href="#IPSEC"> IPsec</A> and other security-related
- RFCs is<A href="#RFC"> here</A>, along with information on methods of
- obtaining them.</P>
-</DD>
-<DT><A name="rijndael">Rijndael</A></DT>
-<DD>a<A href="#block"> block cipher</A> designed by two Belgian
- cryptographers, winner of the US government's<A href="#AES"> AES</A>
- contest to pick a replacement for<A href="#DES"> DES</A>. See the<A href="http://www.esat.kuleuven.ac.be/~rijmen/rijndael">
- Rijndael home page</A>.</DD>
-<DT><A name="RIPEMD">RIPEMD</A></DT>
-<DD>A<A href="#digest"> message digest</A> algorithm. The current
- version is RIPEMD-160 which gives a 160-bit hash.</DD>
-<DT><A name="rootCA">Root CA</A></DT>
-<DD>The top level<A href="#CA"> Certification Authority</A> in a
- hierachy of such authorities.</DD>
-<DT><A name="routable">Routable IP address</A></DT>
-<DD>Most IP addresses can be used as &quot;to&quot; and &quot;from&quot; addresses in packet
- headers. These are the routable addresses; we expect routing to be
- possible for them. If we send a packet to one of them, we expect (in
- most cases; there are various complications) that it will be delivered
- if the address is in use and will cause an<A href="#ICMP.gloss"> ICMP</A>
- error packet to come back to us if not.
-<P>There are also several classes of<A href="#non-routable">
- non-routable</A> IP addresses.</P>
-</DD>
-<DT><A name="RSA">RSA algorithm</A></DT>
-<DD><B>R</B>ivest<B> S</B>hamir<B> A</B>dleman<A href="#public"> public
- key</A> algorithm, named for its three inventors. It is widely used and
- likely to become moreso since it became free of patent encumbrances in
- September 2000.
-<P>RSA can be used to provide either<A href="#encryption"> encryption</A>
- or<A href="#signature"> digital signatures</A>. In IPsec, it is used
- only for signatures. These provide gateway-to-gateway<A href="#authentication">
- authentication</A> for<A href="#IKE"> IKE</A> negotiations.</P>
-<P>For a full explanation of the algorithm, consult one of the standard
- references such as<A href="#schneier"> Applied Cryptography</A>. A
- simple explanation is:</P>
-<P>The great 17th century French mathematician<A href="http://www-groups.dcs.st-andrews.ac.uk/~history/Mathematicians/Fermat.html">
- Fermat</A> proved that,</P>
-<P>for any prime p and number x, 0 &lt;= x &lt; p:</P>
-<PRE>        x^p == x         modulo p
-        x^(p-1) == 1     modulo p, non-zero x
-      </PRE>
-<P>From this it follows that if we have a pair of primes p, q and two
- numbers e, d such that:</P>
-<PRE>        ed == 1          modulo lcm( p-1, q-1)
-      </PRE>
- where lcm() is least common multiple, then
-<BR> for all x, 0 &lt;= x &lt; pq:
-<PRE>      x^ed == x           modulo pq
-      </PRE>
-<P>So we construct such as set of numbers p, q, e, d and publish the
- product N=pq and e as the public key. Using c for<A href="#ciphertext">
- ciphertext</A> and i for the input<A href="#plaintext"> plaintext</A>,
- encryption is then:</P>
-<PRE>        c = i^e           modulo N
-      </PRE>
-<P>An attacker cannot deduce i from the cyphertext c, short of either
- factoring N or solving the<A href="#dlog"> discrete logarithm</A>
- problem for this field. If p, q are large primes (hundreds or thousands
- of bits) no efficient solution to either problem is known.</P>
-<P>The receiver, knowing the private key (N and d), can readily recover
- the plaintext p since:</P>
-<PRE>        c^d == (i^e)^d    modulo N
-            == i^ed       modulo N
-            == i          modulo N
-      </PRE>
-<P>This gives an effective public key technique, with only a couple of
- problems. It uses a good deal of computer time, since calculations with
- large integers are not cheap, and there is no proof it is necessarily
- secure since no-one has proven either factoring or discrete log cannot
- be done efficiently. Quite a few good mathematicians have tried both
- problems, and no-one has announced success, but there is no proof they
- are insoluble.</P>
-</DD>
-<DT><A name="RSAco">RSA Data Security</A></DT>
-<DD>A company founded by the inventors of the<A href="#RSA"> RSA</A>
- public key algorithm.</DD>
-<DT><A name="S">S</A></DT>
-<DT><A name="SA">SA</A></DT>
-<DD><B>S</B>ecurity<B> A</B>ssociation, the channel negotiated by the
- higher levels of an<A href="#IPSEC"> IPsec</A> implementation (<A href="#IKE">
-IKE</A>) and used by the lower (<A href="#ESP">ESP</A> and<A href="#AH">
- AH</A>). SAs are unidirectional; you need a pair of them for two-way
- communication.
-<P>An SA is defined by three things -- the destination, the protocol (<A href="#AH">
-AH</A> or<A href="#ESP">ESP</A>) and the<A href="SPI"> SPI</A>, security
- parameters index. It is used as an index to look up other things such
- as session keys and intialisation vectors.</P>
-<P>For more detail, see our section on<A href="ipsec.html"> IPsec</A>
- and/or RFC 2401.</P>
-</DD>
-<DT><A name="SElinux">SE Linux</A></DT>
-<DD><STRONG>S</STRONG>ecurity<STRONG> E</STRONG>nhanced Linux, an<A href="#NSA">
- NSA</A>-funded project to add<A href="#mandatory"> mandatory access
- control</A> to Linux. See the<A href="http://www.nsa.gov/selinux">
- project home page</A>.
-<P>According to their web pages, this work will include extending
- mandatory access controls to IPsec tunnels.</P>
-<P>Recent versions of SE Linux code use the<A href="#LSM"> Linux
- Security Module</A> interface.</P>
-</DD>
-<DT><A name="SDNS">Secure DNS</A></DT>
-<DD>A version of the<A href="#DNS"> DNS or Domain Name Service</A>
- enhanced with authentication services. This is being designed by the<A href="#IETF">
- IETF</A> DNS security<A href="http://www.ietf.org/ids.by.wg/dnssec.html">
- working group</A>. Check the<A href="http://www.isc.org/bind.html">
- Internet Software Consortium</A> for information on implementation
- progress and for the latest version of<A href="#BIND"> BIND</A>.
- Another site has<A href="http://www.toad.com/~dnssec"> more information</A>
-.
-<P><A href="#IPSEC">IPsec</A> can use this plus<A href="#DH">
- Diffie-Hellman key exchange</A> to bootstrap itself. This allows<A href="#carpediem">
- opportunistic encryption</A>. Any pair of machines which can
- authenticate each other via DNS can communicate securely, without
- either a pre-existing shared secret or a shared<A href="#PKI"> PKI</A>.</P>
-</DD>
-<DT>Secret key cryptography</DT>
-<DD>See<A href="#symmetric"> symmetric cryptography</A></DD>
-<DT>Security Association</DT>
-<DD>see<A href="#SA"> SA</A></DD>
-<DT>Security Enhanced Linux</DT>
-<DD>see<A href="#SElinux"> SE Linux</A></DD>
-<DT><A name="sequence">Sequence number</A></DT>
-<DD>A number added to a packet or message which indicates its position
- in a sequence of packets or messages. This provides some security
- against<A href="#replay"> replay attacks</A>.
-<P>For<A href="#auto"> automatic keying</A> mode, the<A href="#IPSEC">
- IPsec</A> RFCs require that the sender generate sequence numbers for
- each packet, but leave it optional whether the receiver does anything
- with them.</P>
-</DD>
-<DT><A name="SHA">SHA</A></DT>
-<DT>SHA-1</DT>
-<DD><B>S</B>ecure<B> H</B>ash<B> A</B>lgorithm, a<A href="#digest">
- message digest algorithm</A> developed by the<A href="#NSA"> NSA</A>
- for use in the Digital Signature standard,<A href="#FIPS"> FIPS</A>
- number 186 from<A href="#NIST"> NIST</A>. SHA is an improved variant of<A
-href="#MD4"> MD4</A> producing a 160-bit hash.
-<P>SHA is one of two message digest algorithms available in IPsec. The
- other is<A href="#MD5"> MD5</A>. Some people do not trust SHA because
- it was developed by the<A href="#NSA"> NSA</A>. There is, as far as we
- know, no cryptographic evidence that SHA is untrustworthy, but this
- does not prevent that view from being strongly held.</P>
-<P>The NSA made one small change after the release of the original SHA.
- They did not give reasons. Iit may be a defense against some attack
- they found and do not wish to disclose. Technically the modified
- algorithm should be called SHA-1, but since it has replaced the
- original algorithm in nearly all applications, it is generally just
- referred to as SHA..</P>
-</DD>
-<DT><A name="SHA-256">SHA-256</A></DT>
-<DT>SHA-384</DT>
-<DT>SHA-512</DT>
-<DD>Newer variants of SHA designed to match the strength of the 128, 192
- and 256-bit keys of<A href="#AES"> AES</A>. The work to break an
- encryption algorithm's strength by<A href="#brute"> brute force</A> is
- 2
-<!--math xmlns="http://www.w3.org/1998/Math/MathML"-->
-
-<!--msup-->
-
-<!--mi-->
- keylength</(null)></(null)></(null)> operations but a<A href="birthday">
- birthday attack</A> on a hash needs only 2
-<!--math xmlns="http://www.w3.org/1998/Math/MathML"-->
-
-<!--msup-->
-
-<!--mrow-->
-
-<!--mi-->
- hashlength</(null)>
-<!--mo-->
- /</(null)>
-<!--mn-->
-
- 2</(null)></(null)></(null)></(null)> , so as a general rule you need a
- hash twice the size of the key to get similar strength. SHA-256,
- SHA-384 and SHA-512 are designed to match the 128, 192 and 256-bit key
- sizes of AES, respectively.</DD>
-<DT><A name="SIGINT">Signals intelligence (SIGINT)</A></DT>
-<DD>Activities of government agencies from various nations aimed at
- protecting their own communications and reading those of others.
- Cryptography, cryptanalysis, wiretapping, interception and monitoring
- of various sorts of signals. The players include the American<A href="#NSA">
- NSA</A>, British<A href="#GCHQ"> GCHQ</A> and Canadian<A href="#CSE">
- CSE</A>.</DD>
-<DT><A name="SKIP">SKIP</A></DT>
-<DD><B>S</B>imple<B> K</B>ey management for<B> I</B>nternet<B> P</B>
-rotocols, an alternative to<A href="#IKE"> IKE</A> developed by Sun and
- being marketed by their<A href="http://skip.incog.com"> Internet
- Commerce Group</A>.</DD>
-<DT><A name="snake">Snake oil</A></DT>
-<DD>Bogus cryptography. See the<A href="http://www.interhack.net/people/cmcurtin/snake-oil-faq.html">
- Snake Oil FAQ</A> or<A href="http://www.counterpane.com/crypto-gram-9902.html#snakeoil">
- this paper</A> by Schneier.</DD>
-<DT><A name="SPI">SPI</A></DT>
-<DD><B>S</B>ecurity<B> P</B>arameter<B> I</B>ndex, an index used within<A
-href="#IPSEC"> IPsec</A> to keep connections distinct. A<A href="#SA">
- Security Association (SA)</A> is defined by destination, protocol and
- SPI. Without the SPI, two connections to the same gateway using the
- same protocol could not be distinguished.
-<P>For more detail, see our<A href="ipsec.html"> IPsec</A> section
- and/or RFC 2401.</P>
-</DD>
-<DT><A name="SSH">SSH</A></DT>
-<DD><B>S</B>ecure<B> SH</B>ell, an encrypting replacement for the
- insecure Berkeley commands whose names begin with &quot;r&quot; for &quot;remote&quot;:
- rsh, rlogin, etc.
-<P>For more information on SSH, including how to obtain it, see our
- cryptography<A href="#tools"> links</A>.</P>
-</DD>
-<DT><A name="SSHco">SSH Communications Security</A></DT>
-<DD>A company founded by the authors of<A href="#SSH"> SSH</A>. Offices
- are in<A href="http://www.ssh.fi"> Finland</A> and<A href="http://www.ipsec.com">
- California</A>. They have a toolkit for developers of IPsec
- applications.</DD>
-<DT><A name="SSL">SSL</A></DT>
-<DD><A href="http://home.netscape.com/eng/ssl3">Secure Sockets Layer</A>
-, a set of encryption and authentication services for web browsers,
- developed by Netscape. Widely used in Internet commerce. Also known as<A
-href="#TLS"> TLS</A>.</DD>
-<DT>SSLeay</DT>
-<DD>A free implementation of<A href="#SSL"> SSL</A> by Eric Young (eay)
- and others. Developed in Australia; not subject to US export controls.</DD>
-<DT><A name="static">static IP address</A></DT>
-<DD>an IP adddress which is pre-set on the machine itself, as opposed to
- a<A href="#dynamic"> dynamic address</A> which is assigned by a<A href="#DHCP">
- DHCP</A> server or obtained as part of the process of establishing a<A href="#PPP">
- PPP</A> or<A href="#PPPoE"> PPPoE</A> connection</DD>
-<DT><A name="stream">Stream cipher</A></DT>
-<DD>A<A href="#symmetric"> symmetric cipher</A> which produces a stream
- of output which can be combined (often using XOR or bytewise addition)
- with the plaintext to produce ciphertext. Contrasts with<A href="#block">
- block cipher</A>.
-<P><A href="#IPSEC">IPsec</A> does not use stream ciphers. Their main
- application is link-level encryption, for example of voice, video or
- data streams on a wire or a radio signal.</P>
-</DD>
-<DT><A name="subnet">subnet</A></DT>
-<DD>A group of IP addresses which are logically one network, typically
- (but not always) assigned to a group of physically connected machines.
- The range of addresses in a subnet is described using a subnet mask.
- See next entry.</DD>
-<DT>subnet mask</DT>
-<DD>A method of indicating the addresses included in a subnet. Here are
- two equivalent examples:
-<UL>
-<LI>101.101.101.0/24</LI>
-<LI>101.101.101.0 with mask 255.255.255.0</LI>
-</UL>
-<P>The '24' is shorthand for a mask with the top 24 bits one and the
- rest zero. This is exactly the same as 255.255.255.0 which has three
- all-ones bytes and one all-zeros byte.</P>
-<P>These indicate that, for this range of addresses, the top 24 bits are
- to be treated as naming a network (often referred to as &quot;the
- 101.101.101.0/24 subnet&quot;) while most combinations of the low 8 bits can
- be used to designate machines on that network. Two addresses are
- reserved; 101.101.101.0 refers to the subnet rather than a specific
- machine while 101.101.101.255 is a broadcast address. 1 to 254 are
- available for machines.</P>
-<P>It is common to find subnets arranged in a hierarchy. For example, a
- large company might have a /16 subnet and allocate /24 subnets within
- that to departments. An ISP might have a large subnet and allocate /26
- subnets (64 addresses, 62 usable) to business customers and /29 subnets
- (8 addresses, 6 usable) to residential clients.</P>
-</DD>
-<DT><A name="SWAN">S/WAN</A></DT>
-<DD>Secure Wide Area Network, a project involving<A href="#RSAco"> RSA
- Data Security</A> and a number of other companies. The goal was to
- ensure that all their<A href="#IPSEC"> IPsec</A> implementations would
- interoperate so that their customers can communicate with each other
- securely.</DD>
-<DT><A name="symmetric">Symmetric cryptography</A></DT>
-<DD>Symmetric cryptography, also referred to as conventional or secret
- key cryptography, relies on a<EM> shared secret key</EM>, identical for
- sender and receiver. Sender encrypts with that key, receiver decrypts
- with it. The idea is that an eavesdropper without the key be unable to
- read the messages. There are two main types of symmetric cipher,<A href="#block">
- block ciphers</A> and<A href="#stream"> stream ciphers</A>.
-<P>Symmetric cryptography contrasts with<A href="#public"> public key</A>
- or asymmetric systems where the two players use different keys.</P>
-<P>The great difficulty in symmetric cryptography is, of course, key
- management. Sender and receiver<EM> must</EM> have identical keys and
- those keys<EM> must</EM> be kept secret from everyone else. Not too
- much of a problem if only two people are involved and they can
- conveniently meet privately or employ a trusted courier. Quite a
- problem, though, in other circumstances.</P>
-<P>It gets much worse if there are many people. An application might be
- written to use only one key for communication among 100 people, for
- example, but there would be serious problems. Do you actually trust all
- of them that much? Do they trust each other that much? Should they?
- What is at risk if that key is compromised? How are you going to
- distribute that key to everyone without risking its secrecy? What do
- you do when one of them leaves the company? Will you even know?</P>
-<P>On the other hand, if you need unique keys for every possible
- connection between a group of 100, then each user must have 99 keys.
- You need either 99*100/2 = 4950<EM> secure</EM> key exchanges between
- users or a central authority that<EM> securely</EM> distributes 100 key
- packets, each with a different set of 99 keys.</P>
-<P>Either of these is possible, though tricky, for 100 users. Either
- becomes an administrative nightmare for larger numbers. Moreover, keys<EM>
- must</EM> be changed regularly, so the problem of key distribution
- comes up again and again. If you use the same key for many messages
- then an attacker has more text to work with in an attempt to crack that
- key. Moreover, one successful crack will give him or her the text of
- all those messages.</P>
-<P>In short, the<EM> hardest part of conventional cryptography is key
- management</EM>. Today the standard solution is to build a<A href="#hybrid">
- hybrid system</A> using<A href="#public"> public key</A> techniques to
- manage keys.</P>
-</DD>
-<DT><A name="T">T</A></DT>
-<DT><A name="TIS">TIS</A></DT>
-<DD>Trusted Information Systems, a firewall vendor now part of<A href="#NAI">
- NAI</A>. Their Gauntlet product offers IPsec VPN services. TIS
- implemented the first version of<A href="#SDNS"> Secure DNS</A> on a<A href="#DARPA">
- DARPA</A> contract.</DD>
-<DT><A name="TLS">TLS</A></DT>
-<DD><B>T</B>ransport<B> L</B>ayer<B> S</B>ecurity, a newer name for<A href="#SSL">
- SSL</A>.</DD>
-<DT><A name="TOS">TOS field</A></DT>
-<DD>The<STRONG> T</STRONG>ype<STRONG> O</STRONG>f<STRONG> S</STRONG>
-ervice field in an IP header, used to control qualkity of service
- routing.</DD>
-<DT><A name="traffic">Traffic analysis</A></DT>
-<DD>Deducing useful intelligence from patterns of message traffic,
- without breaking codes or reading the messages. In one case during
- World War II, the British guessed an attack was coming because all
- German radio traffic stopped. The &quot;radio silence&quot; order, intended to
- preserve security, actually gave the game away.
-<P>In an industrial espionage situation, one might deduce something
- interesting just by knowing that company A and company B were talking,
- especially if one were able to tell which departments were involved, or
- if one already knew that A was looking for acquisitions and B was
- seeking funds for expansion.</P>
-<P>In general, traffic analysis by itself is not very useful. However,
- in the context of a larger intelligence effort where quite a bit is
- already known, it can be very useful. When you are solving a complex
- puzzle, every little bit helps.</P>
-<P><A href="#IPSEC">IPsec</A> itself does not defend against traffic
- analysis, but carefully thought out systems using IPsec can provide at
- least partial protection. In particular, one might want to encrypt more
- traffic than was strictly necessary, route things in odd ways, or even
- encrypt dummy packets, to confuse the analyst. We discuss this<A href="#traffic.resist">
- here</A>.</P>
-</DD>
-<DT><A name="transport">Transport mode</A></DT>
-<DD>An IPsec application in which the IPsec gateway is the destination
- of the protected packets, a machine acts as its own gateway. Contrast
- with<A href="#tunnel"> tunnel mode</A>.</DD>
-<DT>Triple DES</DT>
-<DD>see<A href="#3DES"> 3DES</A></DD>
-<DT><A name="TTL">TTL</A></DT>
-<DD><STRONG>T</STRONG>ime<STRONG> T</STRONG>o<STRONG> L</STRONG>ive,
- used to control<A href="#DNS"> DNS</A> caching. Servers discard cached
- records whose TTL expires</DD>
-<DT><A name="tunnel">Tunnel mode</A></DT>
-<DD>An IPsec application in which an IPsec gateway provides protection
- for packets to and from other systems. Contrast with<A href="#transport">
- transport mode</A>.</DD>
-<DT><A name="2key">Two-key Triple DES</A></DT>
-<DD>A variant of<A href="#3DES"> triple DES or 3DES</A> in which only
- two keys are used. As in the three-key version, the order of operations
- is<A href="#EDE"> EDE</A> or encrypt-decrypt-encrypt, but in the
- two-key variant the first and third keys are the same.
-<P>3DES with three keys has 3*56 = 168 bits of key but has only 112-bit
- strength against a<A href="#meet"> meet-in-the-middle</A> attack, so it
- is possible that the two key version is just as strong. Last I looked,
- this was an open question in the research literature.</P>
-<P>RFC 2451 defines triple DES for<A href="#IPSEC"> IPsec</A> as the
- three-key variant. The two-key variant should not be used and is not
- implemented directly in<A href="#FreeSWAN"> Linux FreeS/WAN</A>. It
- cannot be used in automatically keyed mode without major fiddles in the
- source code. For manually keyed connections, you could make Linux
- FreeS/WAN talk to a two-key implementation by setting two keys the same
- in /etc/ipsec.conf.</P>
-</DD>
-<DT><A name="U">U</A></DT>
-<DT><A name="V">V</A></DT>
-<DT><A name="virtual">Virtual Interface</A></DT>
-<DD>A<A href="#Linux"> Linux</A> feature which allows one physical
- network interface to have two or more IP addresses. See the<CITE> Linux
- Network Administrator's Guide</CITE> in<A href="#kirch"> book form</A>
- or<A href="http://metalab.unc.edu/LDP/LDP/nag/node1.html"> on the web</A>
- for details.</DD>
-<DT>Virtual Private Network</DT>
-<DD>see<A href="#VPN"> VPN</A></DD>
-<DT><A name="VPN">VPN</A></DT>
-<DD><B>V</B>irtual<B> P</B>rivate<B> N</B>etwork, a network which can
- safely be used as if it were private, even though some of its
- communication uses insecure connections. All traffic on those
- connections is encrypted.
-<P><A href="#IPSEC">IPsec</A> is not the only technique available for
- building VPNs, but it is the only method defined by<A href="#RFC"> RFCs</A>
- and supported by many vendors. VPNs are by no means the only thing you
- can do with IPsec, but they may be the most important application for
- many users.</P>
-</DD>
-<DT><A name="VPNC">VPNC</A></DT>
-<DD><A href="http://www.vpnc.org">Virtual Private Network Consortium</A>
-, an association of vendors of VPN products.</DD>
-<DT><A name="W">W</A></DT>
-<DT><A name="Wassenaar.gloss">Wassenaar Arrangement</A></DT>
-<DD>An international agreement restricting export of munitions and other
- tools of war. Unfortunately, cryptographic software is also restricted
- under the current version of the agreement.<A href="#Wassenaar">
- Discussion</A>.</DD>
-<DT><A name="web">Web of Trust</A></DT>
-<DD><A href="#PGP">PGP</A>'s method of certifying keys. Any user can
- sign a key; you decide which signatures or combinations of signatures
- to accept as certification. This contrasts with the hierarchy of<A href="#CA">
- CAs (Certification Authorities)</A> used in many<A href="#PKI"> PKIs
- (Public Key Infrastructures)</A>.
-<P>See<A href="#GTR"> Global Trust Register</A> for an interesting
- addition to the web of trust.</P>
-</DD>
-<DT><A name="WEP">WEP (Wired Equivalent Privacy)</A></DT>
-<DD>The cryptographic part of the<A href="#IEEE"> IEEE</A> standard for
- wireless LANs. As the name suggests, this is designed to be only as
- secure as a normal wired ethernet. Anyone with a network conection can
- tap it. Its advocates would claim this is good design, refusing to
- build in complex features beyond the actual requirements.
-<P>Critics refer to WEP as &quot;Wire<EM>tap</EM> Equivalent Privacy&quot;, and
- consider it a horribly flawed design based on bogus &quot;requirements&quot;. You
- do not control radio waves as you might control your wires, so the
- metaphor in the rationale is utterly inapplicable. A security policy
- that chooses not to invest resources in protecting against certain
- attacks which can only be conducted by people physically plugged into
- your LAN may or may not be reasonable. The same policy is completely
- unreasonable when someone can &quot;plug in&quot; from a laptop half a block
- away..</P>
-<P>There has been considerable analysis indicating that WEP is seriously
- flawed. A FAQ on attacks against WEP is available. Part of it reads:</P>
-<BLOCKQUOTE> ... attacks are practical to mount using only inexpensive
- off-the-shelf equipment. We recommend that anyone using an 802.11
- wireless network not rely on WEP for security, and employ other
- security measures to protect their wireless network. Note that our
- attacks apply to both 40-bit and the so-called 128-bit versions of WEP
- equally well.</BLOCKQUOTE>
-<P>WEP appears to be yet another instance of governments, and
- unfortunately some vendors and standards bodies, deliberately promoting
- hopelessly flawed &quot;security&quot; products, apparently mainly for the
- benefit of eavesdropping agencies. See this<A href="#weak"> discussion</A>
-.</P>
-</DD>
-<DT><A name="X">X</A></DT>
-<DT><A name="X509">X.509</A></DT>
-<DD>A standard from the<A href="http://www.itu.int"> ITU (International
- Telecommunication Union)</A>, for hierarchical directories with
- authentication services, used in many<A href="#PKI"> PKI</A>
- implementations.
-<P>Use of X.509 services, via the<A href="#LDAP"> LDAP protocol</A>, for
- certification of keys is allowed but not required by the<A href="#IPSEC">
- IPsec</A> RFCs. It is not yet implemented in<A href="#FreeSWAN"> Linux
- FreeS/WAN</A>.</P>
-</DD>
-<DT>Xedia</DT>
-<DD>A vendor of router and Internet access products, now part of Lucent.
- Their QVPN products interoperate with Linux FreeS/WAN; see our<A href="#xedia">
- interop document</A>.</DD>
-<DT><A name="Y">Y</A></DT>
-<DT><A name="Z">Z</A></DT>
-</DL>
-<HR>
-<H1><A name="biblio">Bibliography for the Linux FreeS/WAN project</A></H1>
-<P>For extensive bibliographic links, see the<A href="http://liinwww.ira.uka.de/bibliography/index.html">
- Collection of Computer Science Bibliographies</A></P>
-<P>See our<A href="web.html"> web links</A> for material available
- online.</P>
-<HR><A name="adams"> Carlisle Adams and Steve Lloyd<CITE> Understanding
- Public Key Infrastructure</CITE>
-<BR></A> Macmillan 1999 ISBN 1-57870-166-x
-<P>An overview, mainly concentrating on policy and strategic issues
- rather than the technical details. Both authors work for<A href="#PKI">
- PKI</A> vendor<A href="http://www.entrust.com/"> Entrust</A>.</P>
-<HR><A name="DNS.book"> Albitz, Liu &amp; Loukides<CITE> DNS &amp; BIND</CITE>
- 3rd edition
-<BR></A> O'Reilly 1998 ISBN 1-56592-512-2
-<P>The standard reference on the<A href="#DNS"> Domain Name Service</A>
- and<A href="#BIND"> Berkeley Internet Name Daemon</A>.</P>
-<HR><A name="anderson"> Ross Anderson</A>,<CITE> Security Engineering -
- a Guide to Building Dependable Distributed Systems</CITE>
-<BR> Wiley, 2001, ISBN 0471389226
-<P>Easily the best book for the security professional I have seen.<STRONG>
- Highly recommended</STRONG>. See the<A href="http://www.cl.cam.ac.uk/~rja14/book.html">
- book web page</A>.</P>
-<P>This is quite readable, but Schneier's<A href="#secrets"> Secrets and
- Lies</A> might be an easier introduction.</P>
-<HR><A name="puzzle"> Bamford<CITE> The Puzzle Palace, A report on NSA,
- Americas's most Secret Agency</CITE>
-<BR> Houghton Mifflin 1982 ISBN 0-395-31286-8</A>
-<HR> Bamford<CITE> Body of Secrets</CITE>
-<P>The sequel.</P>
-<HR><A name="bander"> David Bander</A>,<CITE> Linux Security Toolkit</CITE>
-<BR> IDG Books, 2000, ISBN: 0764546902
-<P>This book has a short section on FreeS/WAN and includes Caldera Linux
- on CD.</P>
-<HR><A name="CZR"> Chapman, Zwicky &amp; Russell</A>,<CITE> Building
- Internet Firewalls</CITE>
-<BR> O'Reilly 1995 ISBN 1-56592-124-0
-<HR><A name="firewall.book"> Cheswick and Bellovin</A><CITE> Firewalls
- and Internet Security: Repelling the Wily Hacker</CITE>
-<BR> Addison-Wesley 1994 ISBN 0201633574
-<P>A fine book on firewalls in particular and security in general from
- two of AT&amp;T's system adminstrators.</P>
-<P>Bellovin has also done a number of<A href="#papers"> papers</A> on
- IPsec and co-authored a<A href="#applied"> paper</A> on a large
- FreeS/WAN application.</P>
-<HR><A name="comer"> Comer<CITE> Internetworking with TCP/IP</CITE>
-<BR> Prentice Hall</A>
-<UL>
-<LI>Vol. I: Principles, Protocols, &amp; Architecture, 3rd Ed. 1995
- ISBN:0-13-216987-8</LI>
-<LI>Vol. II: Design, Implementation, &amp; Internals, 2nd Ed. 1994
- ISBN:0-13-125527-4</LI>
-<LI>Vol. III: Client/Server Programming &amp; Applications
-<UL>
-<LI>AT&amp;T TLI Version 1994 ISBN:0-13-474230-3</LI>
-<LI>BSD Socket Version 1996 ISBN:0-13-260969-X</LI>
-<LI>Windows Sockets Version 1997 ISBN:0-13-848714-6</LI>
-</UL>
-</LI>
-</UL>
-<P>If you need to deal with the details of the network protocols, read
- either this series or the<A href="#stevens"> Stevens and Wright</A>
- series before you start reading the RFCs.</P>
-<HR><A name="diffie"> Diffie and Landau</A><CITE> Privacy on the Line:
- The Politics of Wiretapping and Encryption</CITE>
-<BR> MIT press 1998 ISBN 0-262-04167-7 (hardcover) or 0-262-54100-9
-<BR>
-<HR><A name="d_and_hark"> Doraswamy and Harkins<CITE> IP Sec: The New
- Security Standard for the Internet, Intranets and Virtual Private
- Networks</CITE>
-<BR> Prentice Hall 1999 ISBN: 0130118982</A>
-<HR><A name="EFF"> Electronic Frontier Foundation<CITE> Cracking DES:
- Secrets of Encryption Research, Wiretap Politics and Chip Design</CITE>
-<BR></A> O'Reilly 1998 ISBN 1-56592-520-3
-<P>To conclusively demonstrate that DES is inadequate for continued use,
- the<A href="#EFF"> EFF</A> built a machine for just over $200,000 that
- breaks DES encryption in under five days on average, under nine in the
- worst case.</P>
-<P>The book provides details of their design and, perhaps even more
- important, discusses why they felt the project was necessary.
- Recommended for anyone interested in any of the three topics mentioned
- in the subtitle.</P>
-<P>See also the<A href="http://www.eff.org/descracker.html"> EFF page on
- this project</A> and our discussion of<A href="#desnotsecure"> DES
- insecurity</A>.</P>
-<HR> Martin Freiss<CITE> Protecting Networks with SATAN</CITE>
-<BR> O'Reilly 1998 ISBN 1-56592-425-8
-<BR> translated from a 1996 work in German
-<P>SATAN is a Security Administrator's Tool for Analysing Networks. This
- book is a tutorial in its use.</P>
-<HR> Gaidosch and Kunzinger<CITE> A Guide to Virtual Private Networks</CITE>
-<BR> Prentice Hall 1999 ISBN: 0130839647
-<HR><A name="Garfinkel"> Simson Garfinkel</A><CITE> Database Nation: the
- death of privacy in the 21st century</CITE>
-<BR> O'Reilly 2000 ISBN 1-56592-653-6
-<P>A thoughtful and rather scary book.</P>
-<HR><A name="PGP"> Simson Garfinkel</A><CITE> PGP: Pretty Good Privacy</CITE>
-<BR> O'Reilly 1995 ISBN 1-56592-098-8
-<P>An excellent introduction and user manual for the<A href="#PGP"> PGP</A>
- email-encryption package. PGP is a good package with a complex and
- poorly-designed user interface. This book or one like it is a must for
- anyone who has to use it at length.</P>
-<P>The book covers using PGP in Unix, PC and Macintosh environments,
- plus considerable background material on both the technical and
- political issues around cryptography.</P>
-<P>The book is now seriously out of date. It does not cover recent
- developments such as commercial versions since PGP 5, the Open PGP
- standard or GNU PG..</P>
-<HR><A name="practical"> Garfinkel and Spafford</A><CITE> Practical Unix
- Security</CITE>
-<BR> O'Reilly 1996 ISBN 1-56592-148-8
-<P>A standard reference.</P>
-<P>Spafford's web page has an excellent collection of<A href="http://www.cs.purdue.edu/coast/hotlist">
- crypto and security links</A>.</P>
-<HR><A name="Kahn"> David Kahn</A><CITE> The Codebreakers: the
- Comprehensive History of Secret Communications from Ancient Times to
- the Internet</CITE>
-<BR> second edition Scribner 1996 ISBN 0684831309
-<P>A history of codes and code-breaking from ancient Egypt to the 20th
- century. Well-written and exhaustively researched.<STRONG> Highly
- recommended</STRONG>, even though it does not have much on computer
- cryptography.</P>
-<HR> David Kahn<CITE> Seizing the Enigma, The Race to Break the German
- U-Boat codes, 1939-1943</CITE>
-<BR> Houghton Mifflin 1991 ISBN 0-395-42739-8
-<HR><A name="kirch"> Olaf Kirch</A><CITE> Linux Network Administrator's
- Guide</CITE>
-<BR> O'Reilly 1995 ISBN 1-56592-087-2
-<P>Now becoming somewhat dated in places, but still a good introductory
- book and general reference.</P>
-<HR><A name="LinVPN"> Kolesnikov and Hatch</A>,<CITE> Building Linux
- Virtual Private Networks (VPNs)</CITE>
-<BR> New Riders 2002
-<P>This has had a number of favorable reviews, including<A href="http://www.slashdot.org/article.pl?sid=02/02/27/0115214&amp;mode=thread&amp;tid=172">
- this one</A> on Slashdot. The book has a<A href="http://www.buildinglinuxvpns.net/">
- web site</A>.</P>
-<HR><A name="RFCs"> Pete Loshin<CITE> Big Book of IPsec RFCs</CITE>
-<BR> Morgan Kaufmann 2000 ISBN: 0-12-455839-9</A>
-<HR><A name="crypto"> Steven Levy<CITE> Crypto: How the Code Rebels Beat
- the Government -- Saving Privacy in the Digital Age</CITE></A>
-<BR> Penguin 2001, ISBN 0-670--85950-8
-<P><STRONG>Highly recommended</STRONG>. A fine history of recent (about
- 1970-2000) developments in the field, and the related political
- controversies. FreeS/WAN project founder and leader John Gilmore
- appears several times.</P>
-<P>The book does not cover IPsec or FreeS/WAN, but this project is very
- much another battle in the same war. See our discussion of the<A href="politics.html">
- politics</A>.</P>
-<HR><A name="GTR"> Matyas, Anderson et al.</A><CITE> The Global Trust
- Register</CITE>
-<BR> Northgate Consultants Ltd 1998 ISBN: 0953239705
-<BR> hard cover edition MIT Press 1999 ISBN 0262511053
-<P>From<A href="http://www.cl.cam.ac.uk/Research/Security/Trust-Register">
- their web page:</A></P>
-<BLOCKQUOTE> This book is a register of the fingerprints of the world's
- most important public keys; it implements a top-level certification
- authority (CA) using paper and ink rather than in an electronic system.</BLOCKQUOTE>
-<HR><A name="handbook"> Menezies, van Oorschot and Vanstone<CITE>
- Handbook of Applied Cryptography</CITE></A>
-<BR> CRC Press 1997
-<BR> ISBN 0-8493-8523-7
-<P>An excellent reference. Read<A href="#schneier"> Schneier</A> before
- tackling this.</P>
-<HR> Michael Padlipsky<CITE> Elements of Networking Style</CITE>
-<BR> Prentice-Hall 1985 ISBN 0-13-268111-0 or 0-13-268129-3
-<P>Probably<STRONG> the funniest technical book ever written</STRONG>,
- this is a vicious but well-reasoned attack on the OSI &quot;seven layer
- model&quot; and all that went with it. Several chapters of it are also
- available as RFCs 871 to 875.</P>
-<HR><A name="matrix"> John S. Quarterman</A><CITE> The Matrix: Computer
- Networks and Conferencing Systems Worldwide</CITE>
-<BR> Digital Press 1990 ISBN 155558-033-5
-<BR> Prentice-Hall ISBN 0-13-565607-9
-<P>The best general treatment of computer-mediated communication we have
- seen. It naturally has much to say about the Internet, but also covers
- UUCP, Fidonet and so on.</P>
-<HR><A name="ranch"> David Ranch</A><CITE> Securing Linux Step by Step</CITE>
-<BR> SANS Institute, 1999
-<P><A href="http://www.sans.org/">SANS</A> is a respected organisation,
- this guide is part of a well-known series, and Ranch has previously
- written the useful<A href=" http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html#trinityos">
- Trinity OS</A> guide to securing Linux, so my guess would be this is a
- pretty good book. I haven't read it yet, so I'm not certain. It can be
- ordered online from<A href="http://www.sans.org/"> SANS</A>.</P>
-<P>Note (Mar 1, 2002): a new edition with different editors in the
- works. Expect it this year.</P>
-<HR><A name="schneier"> Bruce Schneier</A><CITE> Applied Cryptography,
- Second Edition</CITE>
-<BR> John Wiley &amp; Sons, 1996
-<BR> ISBN 0-471-12845-7 hardcover
-<BR> ISBN 0-471-11709-9 paperback
-<P>A standard reference on computer cryptography. For more recent
- essays, see the<A href="http://www.counterpane.com/"> author's
- company's web site</A>.</P>
-<HR><A name="secrets"> Bruce Schneier</A><CITE> Secrets and Lies</CITE>
-<BR> Wiley 2000, ISBN 0-471-25311-1
-<P>An interesting discussion of security and privacy issues, written
- with more of an &quot;executive overview&quot; approach rather than a narrow
- focus on the technical issues.<STRONG> Highly recommended</STRONG>.</P>
-<P>This is worth reading even if you already understand security issues,
- or think you do. To go deeper, follow it with Anderson's<A href="#anderson">
- Security Engineering</A>.</P>
-<HR><A name="VPNbook"> Scott, Wolfe and Irwin<CITE> Virtual Private
- Networks</CITE></A>
-<BR> 2nd edition, O'Reilly 1999 ISBN: 1-56592-529-7
-<P>This is the only O'Reilly book, out of a dozen I own, that I'm
- disappointed with. It deals mainly with building VPNs with various
- proprietary tools --<A href="#PPTP"> PPTP</A>,<A href="#ssh"> SSH</A>,
- Cisco PIX, ... -- and touches only lightly on IPsec-based approaches.</P>
-<P>That said, it appears to deal competently with what it does cover and
- it has readable explanations of many basic VPN and security concepts.
- It may be exactly what some readers require, even if I find the
- emphasis unfortunate.</P>
-<HR><A name="LASG"> Kurt Seifried<CITE> Linux Administrator's Security
- Guide</CITE></A>
-<P>Available online from<A href="http://www.securityportal.com/lasg/">
- Security Portal</A>. It has fairly extensive coverage of IPsec.</P>
-<HR><A name="Smith"> Richard E Smith<CITE> Internet Cryptography</CITE>
-<BR></A> ISBN 0-201-92480-3, Addison Wesley, 1997
-<P>See the book's<A href="http://www.visi.com/crypto/inet-crypto/index.html">
- home page</A></P>
-<HR><A name="neal"> Neal Stephenson<CITE> Cryptonomicon</CITE></A>
-<BR> Hardcover ISBN -380-97346-4, Avon, 1999.
-<P>A novel in which cryptography and the net figure prominently.<STRONG>
- Highly recommended</STRONG>: I liked it enough I immediately went out
- and bought all the author's other books.</P>
-<P>There is also a paperback edition. Sequels are expected.</P>
-<HR><A name="stevens"> Stevens and Wright</A><CITE> TCP/IP Illustrated</CITE>
-<BR> Addison-Wesley
-<UL>
-<LI>Vol. I: The Protocols 1994 ISBN:0-201-63346-9</LI>
-<LI>Vol. II: The Implementation 1995 ISBN:0-201-63354-X</LI>
-<LI>Vol. III: TCP for Transactions, HTTP, NNTP, and the UNIX Domain
- Protocols 1996 ISBN: 0-201-63495-3</LI>
-</UL>
-<P>If you need to deal with the details of the network protocols, read
- either this series or the<A href="#comer"> Comer</A> series before you
- start reading the RFCs.</P>
-<HR><A name="Rubini"> Rubini</A><CITE> Linux Device Drivers</CITE>
-<BR> O'Reilly &amp; Associates, Inc. 1998 ISBN 1-56592-292-1
-<HR><A name="Zeigler"> Robert Zeigler</A><CITE> Linux Firewalls</CITE>
-<BR> Newriders Publishing, 2000 ISBN 0-7537-0900-9
-<P>A good book, with detailed coverage of ipchains(8) firewalls and of
- many related issues.</P>
-<HR>
-<H1><A name="RFC">IPsec RFCs and related documents</A></H1>
-<H2><A name="RFCfile">The RFCs.tar.gz Distribution File</A></H2>
-<P>The Linux FreeS/WAN distribution is available from<A href="http://www.xs4all.nl/~freeswan">
- our primary distribution site</A> and various mirror sites. To give
- people more control over their downloads, the RFCs that define IP
- security are bundled separately in the file RFCs.tar.gz.</P>
-<P>The file you are reading is included in the main distribution and is
- available on the web site. It describes the RFCs included in the<A href="#RFCs.tar.gz">
- RFCs.tar.gz</A> bundle and gives some pointers to<A href="#sources">
- other ways to get them</A>.</P>
-<H2><A name="sources">Other sources for RFCs &amp; Internet drafts</A></H2>
-<H3><A name="RFCdown">RFCs</A></H3>
-<P>RFCs are downloadble at many places around the net such as:</P>
-<UL>
-<LI><A href="http://www.rfc-editor.org">http://www.rfc-editor.org</A></LI>
-<LI><A href="http://nis.nsf.net/internet/documents/rfc">NSF.net</A></LI>
-<LI><A href="http://sunsite.doc.ic.ac.uk/computing/internet/rfc">Sunsite
- in the UK</A></LI>
-</UL>
-<P>browsable in HTML form at others such as:</P>
-<UL>
-<LI><A href="http://www.landfield.com/rfcs/index.html">landfield.com</A></LI>
-<LI><A href="http://www.library.ucg.ie/Connected/RFC">Connected Internet
- Encyclopedia</A></LI>
-</UL>
-<P>and some of them are available in translation:</P>
-<UL>
-<LI><A href="http://www.eisti.fr/eistiweb/docs/normes/">French</A></LI>
-</UL>
-<P>There is also a published<A href="#RFCs"> Big Book of IPSEC RFCs</A>.</P>
-<H3><A name="drafts">Internet Drafts</A></H3>
-<P>Internet Drafts, working documents which sometimes evolve into RFCs,
- are also available.</P>
-<UL>
-<LI><A href="http://www.ietf.org/ID.html">Overall reference page</A></LI>
-<LI><A href="http://www.ietf.org/ids.by.wg/ipsec.html">IPsec</A> working
- group</LI>
-<LI><A href="http://www.ietf.org/ids.by.wg/ipsra.html">IPSRA (IPsec
- Remote Access)</A> working group</LI>
-<LI><A href="http://www.ietf.org/ids.by.wg/ipsp.html">IPsec Policy</A>
- working group</LI>
-<LI><A href="http://www.ietf.org/ids.by.wg/kink.html">KINK (Kerberized
- Internet Negotiation of Keys)</A> working group</LI>
-</UL>
-<P>Note: some of these may be obsolete, replaced by later drafts or by
- RFCs.</P>
-<H3><A name="FIPS1">FIPS standards</A></H3>
-<P>Some things used by<A href="#IPSEC"> IPsec</A>, such as<A href="#DES">
- DES</A> and<A href="#SHA"> SHA</A>, are defined by US government
- standards called<A href="#FIPS"> FIPS</A>. The issuing organisation,<A href="#NIST">
- NIST</A>, have a<A href="http://www.itl.nist.gov/div897/pubs"> FIPS
- home page</A>.</P>
-<H2><A name="RFCs.tar.gz">What's in the RFCs.tar.gz bundle?</A></H2>
-<P>All filenames are of the form rfc*.txt, with the * replaced with the
- RFC number.</P>
-<PRE>RFC#        Title</PRE>
-<H3><A name="rfc.ov">Overview RFCs</A></H3>
-<PRE>2401        Security Architecture for the Internet Protocol
-2411        IP Security Document Roadmap</PRE>
-<H3><A name="basic.prot">Basic protocols</A></H3>
-<PRE>2402        IP Authentication Header
-2406        IP Encapsulating Security Payload (ESP)</PRE>
-<H3><A name="key.ike">Key management</A></H3>
-<PRE>2367        PF_KEY Key Management API, Version 2
-2407        The Internet IP Security Domain of Interpretation for ISAKMP
-2408        Internet Security Association and Key Management Protocol (ISAKMP)
-2409        The Internet Key Exchange (IKE)
-2412        The OAKLEY Key Determination Protocol
-2528        Internet X.509 Public Key Infrastructure</PRE>
-<H3><A name="rfc.detail">Details of various things used</A></H3>
-<PRE>2085        HMAC-MD5 IP Authentication with Replay Prevention
-2104        HMAC: Keyed-Hashing for Message Authentication
-2202        Test Cases for HMAC-MD5 and HMAC-SHA-1
-2207        RSVP Extensions for IPSEC Data Flows
-2403        The Use of HMAC-MD5-96 within ESP and AH
-2404        The Use of HMAC-SHA-1-96 within ESP and AH
-2405        The ESP DES-CBC Cipher Algorithm With Explicit IV
-2410        The NULL Encryption Algorithm and Its Use With IPsec
-2451        The ESP CBC-Mode Cipher Algorithms
-2521        ICMP Security Failures Messages</PRE>
-<H3><A name="rfc.ref">Older RFCs which may be referenced</A></H3>
-<PRE>1321        The MD5 Message-Digest Algorithm
-1828        IP Authentication using Keyed MD5
-1829        The ESP DES-CBC Transform
-1851        The ESP Triple DES Transform
-1852        IP Authentication using Keyed SHA</PRE>
-<H3><A name="rfc.dns">RFCs for secure DNS service, which IPsec may use</A>
-</H3>
-<PRE>2137        Secure Domain Name System Dynamic Update
-2230        Key Exchange Delegation Record for the DNS
-2535        Domain Name System Security Extensions
-2536        DSA KEYs and SIGs in the Domain Name System (DNS)
-2537        RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)
-2538        Storing Certificates in the Domain Name System (DNS)
-2539        Storage of Diffie-Hellman Keys in the Domain Name System (DNS)</PRE>
-<H3><A name="rfc.exp">RFCs labelled &quot;experimental&quot;</A></H3>
-<PRE>2521        ICMP Security Failures Messages
-2522        Photuris: Session-Key Management Protocol
-2523        Photuris: Extended Schemes and Attributes</PRE>
-<H3><A name="rfc.rel">Related RFCs</A></H3>
-<PRE>1750        Randomness Recommendations for Security
-1918        Address Allocation for Private Internets
-1984        IAB and IESG Statement on Cryptographic Technology and the Internet
-2144        The CAST-128 Encryption Algorithm</PRE>
-<HR>
-<H1><A name="roadmap">Distribution Roadmap: What's Where in Linux
- FreeS/WAN</A></H1>
-<P> This file is a guide to the locations of files within the FreeS/WAN
- distribution. Everything described here should be on your system once
- you download, gunzip, and untar the distribution.</P>
-<P>This distribution contains two major subsystems</P>
-<DL>
-<DT><A href="#klips.roadmap">KLIPS</A></DT>
-<DD>the kernel code</DD>
-<DT><A href="#pluto.roadmap">Pluto</A></DT>
-<DD>the user-level key-management daemon</DD>
-</DL>
-<P>plus assorted odds and ends.</P>
-<H2><A name="top">Top directory</A></H2>
-<P>The top directory has essential information in text files:</P>
-<DL>
-<DT>README</DT>
-<DD>introduction to the software</DD>
-<DT>INSTALL</DT>
-<DD>short experts-only installation procedures. More detalied procedures
- are in<A href="install.html"> installation</A> and<A href="config.html">
- configuration</A> HTML documents.</DD>
-<DT>BUGS</DT>
-<DD>major known bugs in the current release.</DD>
-<DT>CHANGES</DT>
-<DD>changes from previous releases</DD>
-<DT>CREDITS</DT>
-<DD>acknowledgement of contributors</DD>
-<DT>COPYING</DT>
-<DD>licensing and distribution information</DD>
-</DL>
-<H2><A name="doc">Documentation</A></H2>
-<P> The doc directory contains the bulk of the documentation, most of it
- in HTML format. See the<A href="index.html"> index file</A> for
- details.</P>
-<H2><A name="klips.roadmap">KLIPS: kernel IP security</A></H2>
-<P><A href="#KLIPS"> KLIPS</A> is<STRONG> K</STRONG>erne<STRONG>L</STRONG><STRONG>
- IP</STRONG><STRONG> S</STRONG>ecurity. It lives in the klips directory,
- of course.</P>
-<DL>
-<DT>klips/doc</DT>
-<DD>documentation</DD>
-<DT>klips/patches</DT>
-<DD>patches for existing kernel files</DD>
-<DT>klips/test</DT>
-<DD>test stuff</DD>
-<DT>klips/utils</DT>
-<DD>low-level user utilities</DD>
-<DT>klips/net/ipsec</DT>
-<DD>actual klips kernel files</DD>
-<DT>klips/src</DT>
-<DD>symbolic link to klips/net/ipsec
-<P>The &quot;make insert&quot; step of installation installs the patches and makes
- a symbolic link from the kernel tree to klips/net/ipsec. The odd name
- of klips/net/ipsec is dictated by some annoying limitations of the
- scripts which build the Linux kernel. The symbolic-link business is a
- bit messy, but all the alternatives are worse.</P>
-<P></P>
-</DD>
-<DT>klips/utils</DT>
-<DD>Utility programs:
-<P></P>
-<DL>
-<DT>eroute</DT>
-<DD>manipulate IPsec extended routing tables</DD>
-<DT>klipsdebug</DT>
-<DD>set Klips (kernel IPsec support) debug features and level</DD>
-<DT>spi</DT>
-<DD>manage IPsec Security Associations</DD>
-<DT>spigrp</DT>
-<DD>group/ungroup IPsec Security Associations</DD>
-<DT>tncfg</DT>
-<DD>associate IPsec virtual interface with real interface</DD>
-</DL>
-<P>These are all normally invoked by ipsec(8) with commands such as</P>
-<PRE>        ipsec tncfg <VAR>arguments</VAR></PRE>
- There are section 8 man pages for all of these; the names have &quot;ipsec_&quot;
- as a prefix, so your man command should be something like:
-<PRE>        man 8 ipsec_tncfg</PRE>
-</DD>
-</DL>
-<H2><A name="pluto.roadmap">Pluto key and connection management daemon</A>
-</H2>
-<P><A href="#Pluto"> Pluto</A> is our key management and negotiation
- daemon. It lives in the pluto directory, along with its low-level user
- utility, whack.</P>
-<P> There are no subdirectories. Documentation is a man page,<A href="manpage.d/ipsec_pluto.8.html">
- pluto.8</A>. This covers whack as well.</P>
-<H2><A name="utils">Utils</A></H2>
-<P> The utils directory contains a growing collection of higher-level
- user utilities, the commands that administer and control the software.
- Most of the things that you will actually have to run yourself are in
- there.</P>
-<DL>
-<DT>ipsec</DT>
-<DD>invoke IPsec utilities
-<P>ipsec(8) is normally the only program installed in a standard
- directory, /usr/local/sbin. It is used to invoke the others, both those
- listed below and the ones in klips/utils mentioned above.</P>
-<P></P>
-</DD>
-<DT>auto</DT>
-<DD>control automatically-keyed IPsec connections</DD>
-<DT>manual</DT>
-<DD>take manually-keyed IPsec connections up and down</DD>
-<DT>barf</DT>
-<DD>generate copious debugging output</DD>
-<DT>look</DT>
-<DD>generate moderate amounts of debugging output</DD>
-</DL>
-<P> There are .8 manual pages for these. look is covered in barf.8. The
- man pages have an &quot;ipsec_&quot; prefix so your man command should be
- something like:</P>
-<PRE>
-        man 8 ipsec_auto
-</PRE>
-<P> Examples are in various files with names utils/*.eg</P>
-<H2><A name="lib">Libraries</A></H2>
-<H3><A name="fswanlib">FreeS/WAN Library</A></H3>
-<P> The lib directory is the FreeS/WAN library, also steadily growing,
- used by both user-level and kernel code.
-<BR /> It includes section 3<A href="manpages.html"> man pages</A> for
- the library routines.</P>
-<H3><A name="otherlib">Imported Libraries</A></H3>
-<H4><A NAME="33_6_2_1">LibDES</A></H4>
- The libdes library, originally from SSLeay, is used by both Klips and
- Pluto for<A href="#3DES"> Triple DES</A> encryption. Single DES is not
- used because<A href="#desnotsecure"> it is insecure</A>.
-<P> Note that this library has its own license, different from the<A href="#GPL">
- GPL</A> used for other code in FreeS/WAN.</P>
-<P> The library includes its own documentation.</P>
-<H4><A NAME="33_6_2_2">GMP</A></H4>
- The GMP (GNU multi-precision) library is used for multi-precision
- arithmetic in Pluto's key-exchange code and public key code.
-<P> Older versions (up to 1.7) of FreeS/WAN included a copy of this
- library in the FreeS/WAN distribution.</P>
-<P> Since 1.8, we have begun to rely on the system copy of GMP.</P>
-<HR>
-<H1><A name="umltesting">User-Mode-Linux Testing guide</A></H1>
-<P> User mode linux is a way to compile a linux kernel such that it can
- run as a process in another linux system (potentially as a *BSD or
- Windows process later). See<A HREF="http://user-mode-linux.sourceforge.net/">
- http://user-mode-linux.sourceforge.net/</A></P>
-<P> UML is a good platform for testing and experimenting with FreeS/WAN.
- It allows several network nodes to be simulated on a single machine.
- Creating, configuring, installing, monitoring, and controling these
- nodes is generally easier and easier to script with UML than real
- hardware.</P>
-<P> You'll need about 500Mb of disk space for a full
- sunrise-east-west-sunset setup. You can possibly get this down by 130Mb
- if you remove the sunrise/sunset kernel build. If you just want to run,
- then you can even remove the east/west kernel build.</P>
-<P> Nothing need be done as super user. In a couple of steps, we note
- where super user is required to install commands in system-wide
- directories, but ~/bin could be used instead. UML seems to use a
- system-wide /tmp/uml directory so different users may interfere with
- one another. Later UMLs use ~/.uml instead, so multiple users running
- UML tests should not be a problem, but note that a single user running
- the UML tests will only be able run one set. Further, UMLs sometimes
- get stuck and hang around. These &quot;zombies&quot; (most will actually be in
- the &quot;T&quot; state in the process table) will interfere with subsequent
- tests.</P>
-<H2><A NAME="34_1">Preliminary Notes on BIND</A></H2>
-<P> As of 2003/3/1, the Light-Weight Resolver is used by pluto. This
- requires that BIND9 be running. It also requires that BIND9 development
- libraries be present in the build environment. The DNSSEC code is only
- truly functional in BIND9 snapshots. The library code could be 9.2.2,
- we believe. We are using BIND9 20021115 snapshot code from<A HREF="ftp://ftp.isc.org/isc/bind9/snapshots">
- ftp://ftp.isc.org/isc/bind9/snapshots</A>.</P>
-<P> FreeS/WAN may well require a newer BIND than is on your system. Many
- distributions have moved to BIND9.2.2 recently due to a security
- advisory. BIND is five components.</P>
-<OL>
-<LI> named</LI>
-<LI> dnssec-*</LI>
-<LI> client side resolver libraries</LI>
-<LI> client side utility libraries I thought there were lib and named
- parts to dnsssec...</LI>
-<LI> dynamic DNS update utilities</LI>
-</OL>
-<P> The only piece that we need for *building* is #4. That's the only
- part that has to be on the build host. What is the difference between
- resolver and util libs? If you want to edit
- testing/baseconfigs/all/etc/bind, you'll need a snapshot version. The
- resolver library contains the resolver. FreeS/WAN has its own copy of
- that in lib/liblwres.</P>
-<H2><A NAME="34_2">Steps to Install UML for FreeS/WAN</A></H2>
-<OL>
-<LI> Get the following files:
-<OL type="a">
-<LI> from<A HREF="http://www.sandelman.ottawa.on.ca/freeswan/uml/">
- http://www.sandelman.ottawa.on.ca/freeswan/uml/</A>
- umlfreeroot-15.1.tar.gz (or highest numbered one). This is a debian
- potato root file system. You can use this even on a Redhat host, as it
- has the newer GLIBC2.2 libraries as well.
-<!-- If you are using
-  Redhat 7.2 or newer as your development machine, you can create the
-  image from your installation media. See <A HREF="uml-rhroot.html">Building a RedHat root"></A>.
-  A future document will explain how to build this from .DEB files as well.
--->
-
-<!--
-<LI> umlfreesharemini.tar.gz    (or umlfreeshareall.tar.gz). 
-  If you are a Debian potato user, you don't need it you can use your
-  native /usr/share.
-</UL>
--->
-</LI>
-<LI> From<A HREF="ftp://ftp.xs4all.nl/pub/crypto/freeswan/">
- ftp://ftp.xs4all.nl/pub/crypto/freeswan/</A> a snapshot or release
- (1.92 or better)</LI>
-<LI> From a<A HREF="http://www.kernel.org/mirrors/">
- http://www.kernel.org mirror</A>, the virgin 2.4.19 kernel. Please
- realize that we have defaults in our tree for kernel configuration. We
- try to track the latest UML kernels. If you use a newer kernel, you may
- have faults in the kernel build process. You can see what the latest
- that is being regularly tested by visiting<A HREF="http://bugs.freeswan.org:81/regress/HEAD/lastgood/freeswan-regress-env.sh">
- freeswan-regress-env.sh</A>.</LI>
-<LI>
-<!-- Note: this step is refered to as "step 1d" below. -->
- Get<A HREF="http://ftp.nl.linux.org/uml/">
- http://ftp.nl.linux.org/uml/</A> uml-patch-2.4.19-47.bz2 or the one
- associated with your kernel. As of 2003/03/05, uml-patch-2.4.19-47.bz2
- works for us.<STRONG> More recent versions of the patch have not been
- tested by us.</STRONG></LI>
-<LI> You'll probably want to visit<A HREF="http://user-mode-linux.sourceforge.net">
- http://user-mode-linux.sourceforge.net</A> and get the UML utilities.
- These are not needed for the build or interactive use (but
- recommended). They are necessary for the regression testing procedures
- used by &quot;make check&quot;. We currently use uml_utilities_20020212.tar.bz2.</LI>
-<LI> You need tcpdump version 3.7.1 or better. This is newer than the
- version included in most LINUX distributions. You can check the version
- of an installed tcpdump with the --version flag. If you need a newer
- tcpdump fetch both tcpdump and libpcap source tar files from<A HREF="http://www.tcpdump.org/">
- http://www.tcpdump.org/</A> or a mirror.</LI>
-</OL>
-</LI>
-<LI> Pick a suitable place, and extract the following files:
-<OL type="a">
-<LI>
-<!-- Note: this step is refered to as "step 2a" later. -->
- 2.4.19 kernel. For instance:
-<PRE>
- <CODE>           cd /c2/kernel
-           tar xzvf ../download/pub/linux/kernel/v2.4/linux-2.4.19.tar.gz
-</CODE>
-</PRE>
-</LI>
-<LI> extract the umlfreeroot file
-<!-- (unless you <A HREF="uml-rhroot.html">built your own from RPMs</A>) -->
-
-<PRE>
- <CODE>           mkdir -p /c2/user-mode-linux/basic-root
-           cd /c2/user-mode-linux/basic-root
-           tar xzvf ../download/umlfreeroot-15.1.tar.gz
-</CODE>
-</PRE>
-</LI>
-<LI> FreeSWAN itself (or checkout &quot;all&quot; from CVS)
-<PRE>
- <CODE>           mkdir -p /c2/freeswan/sandbox
-           cd /c2/freeswan/sandbox
-           tar xzvf ../download/snapshot.tar.gz
-</CODE>
-</PRE>
-</LI>
-</OL>
-</LI>
-<LI> If you need to build a newer tcpdump:
-<UL>
-<LI> Make sure you have OpenSSL installed -- it is needed for
- cryptographic routines.</LI>
-<LI> Unpack libpcap and tcpdump source in parallel directories (the
- tcpdump build procedures look for libpcap next door).</LI>
-<LI> Change directory into the libpcap source directory and then build
- the library:
-<PRE>
- <CODE>	./configure
-	make
-</CODE>
-</PRE>
-</LI>
-<LI> Change into the tcpdump source directory, build tcpdump, and
- install it.
-<PRE>
- <CODE>	./configure
-	make
-	# Need to be superuser to install in system directories.
-	# Installing in ~/bin would be an alternative.
-	su -c &quot;make install&quot;
-</CODE>
-</PRE>
-</LI>
-</UL>
-</LI>
-<LI> If you need the uml utilities, unpack them somewhere then build and
- install them:
-<PRE>
- <CODE>	cd tools
-	make all
-	# Need to be superuser to install in system directories.
-	# Installing in ~/bin would be an alternative.
-	su -c &quot;make install BIN_DIR=/usr/local/bin&quot;
-</CODE>
-</PRE>
-</LI>
-<LI> set up the configuration file
-<UL>
-<LI> <CODE>cd /c2/freeswan/sandbox/freeswan-1.97/testing/utils</CODE></LI>
-<LI> copy umlsetup-sample.sh to ../../umlsetup.sh: <CODE> cp
- umlsetup-sample.sh ../../umlsetup.sh</CODE></LI>
-<LI> open up ../../umlsetup.sh in your favorite editor.</LI>
-<LI> change POOLSPACE= to point to the place with at least 500Mb of
- disk. Best if it is on the same partition as the &quot;umlfreeroot&quot;
- extraction, as it will attempt to use hard links if possible to save
- disk space.</LI>
-<LI> Set TESTINGROOT if you intend to run the script outside of the
- sandbox/snapshot/release directory. Otherwise, it will configure
- itself.</LI>
-<LI> KERNPOOL should point to the directory with your 2.4.19 kernel
- tree. This tree should be unconfigured! This is the directory you used
- in step 2a.</LI>
-<LI> UMLPATCH should point at the bz2 file you downloaded at 1d. If
- using a kernel that already includes the patch, set this to /dev/null.</LI>
-<LI> FREESWANDIR should point at the directory where you unpacked the
- snapshot/release. Include the &quot;freeswan-snap2001sep16b&quot; or whatever in
- it. If you are running from CVS, then you point at the directory where
- top, klips, etc. are. The script will fix up the directory so that it
- can be used.</LI>
-<LI> BASICROOT should be set to the directory used in 2b, or to the
- directory that you created with RPMs.</LI>
-<LI> SHAREDIR should be set to the directory used in 2c, to /usr/share
- for Debian potato users, or to $BASICROOT/usr/share.</LI>
-</UL>
-</LI>
-<LI>
-<PRE> <CODE>cd $TESTINGROOT/utils
-sh make-uml.sh
-</CODE></PRE>
- It will grind for awhile. If there are errors it will bail. If so, run
- it under &quot;script&quot; and send the output to bugs@lists.freeswan.org.</LI>
-<LI> You will have a bunch of stuff under $POOLSPACE. Open four xterms:
-<PRE> <CODE>    for i in sunrise sunset east west
-    do
-        xterm -name $i -title $i -e $POOLSPACE/$i/start.sh     done
-</CODE></PRE>
-</LI>
-<LI> Login as root. Password is &quot;root&quot; (Note, these virtual machines are
- networked together, but are not configured to talk to the rest of the
- world.)</LI>
-<LI> verify that pluto started on east/west, run &quot;ipsec look&quot;</LI>
-<LI> login to sunrise. run &quot;ping sunset&quot;</LI>
-<LI> login to west. run &quot;tcpdump -p -i eth1 -n&quot; (tcpdump must be version
- 3.7.1 or newer)</LI>
-<LI> Closing a console xterm will shut down that UML.</LI>
-<LI> You can &quot;make check&quot;, if you want to. It is run from
- /c2/freeswan/sandbox/freeswan-1.97.</LI>
-</OL>
-<H1><A NAME="35">Debugging the kernel with GDB</A></H1>
-<P> With User-Mode-Linux, you can debug the kernel using GDB. See
-<!--HREF="http://user-mode-linux.sourceforge.net/debugging.html"-->
-
- http://user-mode-linux.sourceforge.net/debugging.html.</(null)></P>
-<P> Typically, one will want to address a test case for a failing
- situation. Running GDB from Emacs, or from other front ends is
- possible. First start GDB.</P>
-<P> Tell it to open the UMLPOOL/swan/linux program.</P>
-<P> Note the PID of GDB:</P>
-<PRE>
-marajade-[projects/freeswan/mgmt/planning] mcr 1029 %ps ax | grep gdb
- 1659 pts/9    SN     0:00 /usr/bin/gdb -fullname -cd /mara4/freeswan/kernpatch/UMLPOOL/swan/ linux
-</PRE>
-<P> Set the following in the environment:</P>
-<PRE>
-UML_east_OPT=&quot;debug gdb-pid=1659&quot;
-</PRE>
-<P> Then start the user-mode-linux in the test scheme you wish:</P>
-<PRE>
-marajade-[kernpatch/testing/klips/east-icmp-02] mcr 1220 %../../utils/runme.sh
-</PRE>
- The user-mode-linux will stop on boot, giving you a chance to attach to
- the process:
-<PRE>
-(gdb) file linux
-Reading symbols from linux...done.
-(gdb) attach 1
-Attaching to program: /mara4/freeswan/kernpatch/UMLPOOL/swan/linux, process 1
-0xa0118bc1 in kill () at hostfs_kern.c:770
-</PRE>
-<P> At this point, break points should be created as appropriate.</P>
-<H2><A NAME="35_1">Other notes about debugging</A></H2>
-<P> If you are running a standard test, after all the packets are sent,
- the UML will be shutdown. This can cause problems, because the UML may
- get terminated while you are debugging.</P>
-<P> The environment variable <CODE>NETJIGWAITUSER</CODE> can be set to
- &quot;waituser&quot;. If so, then the testing system will prompt before exiting
- the test.</P>
-<H1><A NAME="36">User-Mode-Linux mysteries</A></H1>
-<UL>
-<LI> running more than one UML of the same name (e.g. &quot;west&quot;) can cause
- problems.</LI>
-<LI> running more than one UML from the same root file system is not a
- good idea.</LI>
-<LI> all this means that running &quot;make check&quot; twice on the same machine
- is probably not a good idea.</LI>
-<LI> occationally, UMLs will get stuck. This can happen like:
-<!--BLOCK-->
- 15134 ? T
- 0:00 /spare/hugh/uml/uml2.4.18-sept5/umlbuild/east/linux (east)
- [/bin/sh] 15138 ? T 0:00
- /spare/hugh/uml/uml2.4.18-sept5/umlbuild/east/linux (east) [halt]</(null)>
- these will need to be killed. Note that they are in &quot;T&quot;racing mode.</LI>
-<LI> UMLs can also hang, and will report &quot;Tracing myself and I can't get
- out&quot;. This is a bug in UML. There are ways to find out what is going on
- and report this to the UML people, but we don't know the magic right
- now.</LI>
-</UL>
-<H1><A NAME="37">Getting more info from uml_netjig</A></H1>
-<P> uml_netjig can be compiled with a built-in tcpdump. This uses
- not-yet-released code from<A HREF="http://www.tcpdump.org/">
- www.tcpdump.org</A>. Please see the instructions in <CODE>
-testing/utils/uml_netjig/Makefile</CODE>.</P>
-<HR>
-<H1><A name="makecheck">How to configure to use &quot;make check&quot;</A></H1>
-<H2><A NAME="38_1">What is &quot;make check&quot;</A></H2>
-<P> &quot;make check&quot; is a target in the top level makefile. It takes care of
- running a number of unit and system tests to confirm that FreeSWAN has
- been compiled correctly, and that no new bugs have been introduced.</P>
-<P> As FreeSWAN contains both kernel and userspace components, doing
- testing of FreeSWAN requires that the kernel be simulated. This is
- typically difficult to do as a kernel requires that it be run on bare
- hardware. A technology has emerged that makes this simpler. This is<A HREF="http://user-mode-linux.sourceforge.net">
- User Mode Linux</A>.</P>
-<P> User-Mode Linux is a way to build a Linux kernel such that it can
- run as a process under another Linux (or in the future other) kernel.
- Presently, this can only be done for 2.4 guest kernels. The host kernel
- can be 2.2 or 2.4.</P>
-<P> &quot;make check&quot; expects to be able to build User-Mode Linux kernels
- with FreeSWAN included. To do this it needs to have some files
- downloaded and extracted prior to running &quot;make check&quot;. This is
- described in the<A HREF="umltesting.html"> UML testing</A> document.</P>
-<P> After having run the example in the UML testing document and
- successfully brought up the four machine combination, you are ready to
- use &quot;make check&quot;</P>
-<H2><A NAME="38_2">Running &quot;make check&quot;</A></H2>
-<P> &quot;make check&quot; works by walking the FreeSWAN source tree invoking the
- &quot;check&quot; target at each node. At present there are tests defined only
- for the <CODE>klips</CODE> directory. These tests will use the UML
- infrastructure to test out pieces of the <CODE>klips</CODE> code.</P>
-<P> The results of the tests can be recorded. If the environment
- variable <CODE>$REGRESSRESULTS</CODE> is non-null, then the results of
- each test will be recorded. This can be used as part of a nightly
- regression testing system, see<A HREF="nightly.html"> Nightly testing</A>
- for more details.</P>
-<P> &quot;make check&quot; otherwise prints a minimal amount of output for each
- test, and indicates pass/fail status of each test as they are run.
- Failed tests do not cause failure of the target in the form of exit
- codes.</P>
-<H1><A NAME="39">How to write a &quot;make check&quot; test</A></H1>
-<H2><A NAME="39_1">Structure of a test</A></H2>
-<P> Each test consists of a set of directories under <CODE>testing/</CODE>
-. There are directories for <CODE>klips</CODE>, <CODE>pluto</CODE>, <CODE>
-packaging</CODE> and <CODE>libraries</CODE>. Each directory has a list
- of tests to run is stored in a file called <CODE>TESTLIST</CODE> in
- that directory. e.g. <CODE>testing/klips/TESTLIST</CODE>.</P>
-<H2 NAME="TESTLIST"><A NAME="39_2">The TESTLIST</A></H2>
-<P> This isn't actually a shell script. It just looks like one. Some
- tools other than /bin/sh process it. Lines that start with # are
- comments.</P>
-<PRE>
-# test-kind     directory-containing-test       expectation     [PR#]
-</PRE>
-<P>The first word provides the test type, detailed below.</P>
-<P> The second word is the name of the test to run. This the directory
- in which the test case is to be found..</P>
-<P>The third word may be one of:</P>
-<DL>
-<DT> blank/good</DT>
-<DD>the test is believed to function, report failure</DD>
-<DT> bad</DT>
-<DD> the test is known to fail, report unexpected success</DD>
-<DT> suspended</DT>
-<DD> the test should not be run</DD>
-</DL>
-<P> The fourth word may be a number, which is a PR# if the test is
- failing.</P>
-<H2><A NAME="39_3">Test kinds</A></H2>
- The test types are:
-<DL>
-<DT>skiptest</DT>
-<DD>means run no test.</DD>
-<DT>ctltest</DT>
-<DD>means run a single system without input/output.</DD>
-<DT>klipstest</DT>
-<DD>means run a single system with input/output networks</DD>
-<DT><A HREF="#umlplutotest">umlplutotest</A></DT>
-<DD>means run a pair of systems</DD>
-<DT><A HREF="#umlXhost">umlXhost</A></DT>
-<DD>run an arbitrary number of systems</DD>
-<DT>suntest (TBD)</DT>
-<DD>means run a quad of east/west/sunrise/sunset</DD>
-<DT>roadtest (TBD)</DT>
-<DD>means run a trio of east-sunrise + warrior</DD>
-<DT>extrudedtest (TBD)</DT>
-<DD>means run a quad of east-sunrise + warriorsouth + park</DD>
-<DT>mkinsttest</DT>
-<DD>a test of the &quot;make install&quot; machinery.</DD>
-<DT>kernel_test_patch</DT>
-<DD>a test of the &quot;make kernelpatch&quot; machinery.</DD>
-</DL>
- Tests marked (TBD) have yet to be fully defined.
-<P> Each test directory has a file in it called <CODE>testparams.sh</CODE>
-. This file sets a number of environment variables to define the
- parameters of the test.</P>
-<H2><A NAME="39_4">Common parameters</A></H2>
-<DL>
-<DT>TESTNAME</DT>
-<DD>the name of the test (repeated for checking purposes)</DD>
-<DT>TEST_TYPE</DT>
-<DD>the type of the test (repeat of type type above)</DD>
-<DT>TESTHOST</DT>
-<DD>the name of the UML machine to run for the test, typically &quot;east&quot; or
- &quot;west&quot;</DD>
-<DT>TEST_PURPOSE</DT>
-<DD>The purpose of the test is one of:
-<DL>
-<DT>goal</DT>
-<DD>The goal purpose is where a test is defined for code that is not yet
- finished. The test indicates when the goals have in fact been reached.</DD>
-<DT>regress</DT>
-<DD>This is a test to determine that a previously existing bug has been
- repaired. This test will initially be created to reproduce the bug in
- isolation, and then the bug will be fixed.</DD>
-<DT>exploit</DT>
-<DD>This is a set of packets/programs that causes a vulnerability to be
- exposed. It is a specific variation of the regress option.</DD>
-</DL>
-</DD>
-<DT>TEST_GOAL_ITEM</DT>
-<DT></DT>
-<DD>in the case of a goal test, this is a reference to the requirements
- document</DD>
-<DT>TEST_PROB_REPORT</DT>
-<DD>in the case of regression test, this the problem report number from
- GNATS</DD>
-<DT>TEST_EXPLOIT_URL</DT>
-<DD>in the case of an exploit, this is a URL referencing the paper
- explaining the origin of the test and the origin of exploit software</DD>
-<DT>REF_CONSOLE_OUTPUT</DT>
-<DD>a file in the test directory that contains the sanitized console
- output against which to compare the output of the actual test.</DD>
-<DT>REF_CONSOLE_FIXUPS</DT>
-<DD>a list of scripts (found in <CODE>klips/test/fixups</CODE>) to apply
- to sanitize the console output of the machine under test. These are
- typically perl, awk or sed scripts that remove things in the kernel
- output that change each time the test is run and/or compiled.</DD>
-<DT>INIT_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode prior to starting the tests. This file will usually
- set up any eroute's and SADB entries that are required for the test.</P>
-<P>Lines beginning with # are skipped. Blank lines are skipped.
- Otherwise, a shell prompted is waited for each time (consisting of <CODE>
-\n#</CODE>) and then the command is sent. Note that the prompt is waited
- for before the command and not after, so completion of the last command
- in the script is not required. This is often used to invoke a program
- to monitor the system, e.g. <CODE>ipsec pf_key</CODE>.</P>
-</DD>
-<DT>RUN_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode, before the packets are sent. On single machine tests,
- this script doesn't provide any more power than INIT_SCRIPT, but is
- implemented for consistency's sake.</P>
-</DD>
-<DT>FINAL_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode after the final packet is sent. Similar to
- INIT_SCRIPT, above. If not specified, then the single command &quot;halt&quot; is
- sent. If specified, then the script should end with a halt command to
- nicely shutdown the UML.</P>
-</DD>
-<DT>CONSOLEDIFFDEBUG</DT>
-<DD>If set to &quot;true&quot; then the series of console fixups (see
- REF_CONSOLE_FIXUPS) will be output after it is constructed. (It should
- be set to &quot;false&quot;, or unset otherwise)</DD>
-<DT>NETJIGDEBUG</DT>
-<DD>If set to &quot;true&quot; then the series of console fixups (see
- REF_CONSOLE_FIXUPS) will be output after it is constructed. (It should
- be set to &quot;false&quot;, or unset otherwise)</DD>
-<DT>NETJIGTESTDEBUG</DT>
-<DD> If set to &quot;netjig&quot;, then the results of talking to the <CODE>
-uml_netjig</CODE> will be printed to stderr during the test. In
- addition, the jig will be invoked with --debug, which causes it to log
- its process ID, and wait 60 seconds before continuing. This can be used
- if you are trying to debug the <CODE>uml_netjig</CODE> program itself.</DD>
-<DT>HOSTTESTDEBUG</DT>
-<DD> If set to &quot;hosttest&quot;, then the results of taling to the consoles of
- the UMLs will be printed to stderr during the test.</DD>
-<DT>NETJIGWAITUSER</DT>
-<DD> If set to &quot;waituser&quot;, then the scripts will wait forever for user
- input before they shut the tests down. Use this is if you are debugging
- through the kernel.</DD>
-<DT>PACKETRATE</DT>
-<DD> A number, in miliseconds (default is 500ms) at which packets will
- be replayed by the netjig.</DD>
-</DL>
-<H2><A NAME="39_5">KLIPStest paramaters</A></H2>
-<P> The klipstest function starts a program (<CODE>
-testing/utils/uml_netjig/uml_netjig</CODE>) to setup a bunch of I/O
- sockets (that simulate network interfaces). It then exports the
- references to these sockets to the environment and invokes (using
- system()) a given script. It waits for the script to finish.</P>
-
-<!-- <IMG SRC="single_netjig.png" ALT="block diagram of uml_netjig"> -->
-<P> The script invoked (<CODE>testing/utils/host-test.tcl</CODE>) is a
- TCL<A HREF="http://expect.nist.gov/"> expect</A> script that arranges
- to start the UML and configure it appropriately for the test. The
- configuration is done with the script given above for<VAR> INIT_SCRIPT</VAR>
-. The TCL script then forks, leaves the UML in the background and exits.
- uml_netjig continues. It then starts listening to the simulated network
- answering ARPs and inserting packets as appropriate.</P>
-<P> The klipstest function invokes <CODE>uml_netjig</CODE> with
- arguments to capture output from network interface(s) and insert
- packets as appropriate:</P>
-<DL>
-<DT>PUB_INPUT</DT>
-<DD>a<A HREF="http://www.tcpdump.org/"> pcap</A> file to feed in on the
- public (encrypted) interface. (typically, eth1)</DD>
-<DT>PRIV_INPUT</DT>
-<DD>a pcap file to feed in on the private (plain-text) interface
- (typically, eth0).</DD>
-<DT>REF_PUB_OUTPUT</DT>
-<DD>a text file containing tcpdump output. Packets on the public (eth1)
- interface are captured to a<A HREF="http://www.tcpdump.org/"> pcap</A>
- file by <CODE>uml_netjig</CODE>. The klipstest function then uses
- tcpdump on the file to produce text output, which is compared to the
- file given.</DD>
-<DT>REF_PUB_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further
- processing. Defaults to &quot;cat&quot;.</DD>
-<DT>REF_PRIV_OUTPUT</DT>
-<DD>a text file containing tcpdump output. Packets on the private (eth0)
- interface are captured and compared after conversion by tcpdump, as
- with<VAR> REFPUBOUTPUT</VAR>.</DD>
-<DT>REF_PRIV_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further
- processing. Defaults to &quot;cat&quot;.</DD>
-<DT>EXITONEMPTY</DT>
-<DD>a flag for <CODE>uml_netjig</CODE>. It should contain
- &quot;--exitonempty&quot; of uml_netjig should exit when all of the input (<VAR>
-PUBINPUT</VAR>,<VAR>PRIVINPUT</VAR>) packets have been injected.</DD>
-<DT>ARPREPLY</DT>
-<DD>a flag for <CODE>uml_netjig</CODE>. It should contain &quot;--arpreply&quot;
- if <CODE>uml_netjig</CODE> should reply to ARP requests. One will
- typically set this to avoid having to fudge the ARP cache manually.</DD>
-<DT>TCPDUMPFLAGS</DT>
-<DD>a set of flags for the tcpdump used when converting captured output.
- Typical values will include &quot;-n&quot; to turn off DNS, and often &quot;-E&quot; to set
- the decryption key (tcpdump 3.7.1 and higher only) for ESP packets. The
- &quot;-t&quot; flag (turn off timestamps) is provided automatically</DD>
-<DT>NETJIG_EXTRA</DT>
-<DD>additional comments to be sent to the netjig. This may arrange to
- record or create additional networks, or may toggle options.</DD>
-</DL>
-<H2><A NAME="39_6">mkinsttest paramaters</A></H2>
-<P> The basic concept of the <CODE>mkinsttest</CODE> test type is that
- it performs a &quot;make install&quot; to a temporary $DESTDIR. The resulting
- tree can then be examined to determine if it was done properly. The
- files can be uninstalled to determine if the file list was correct, or
- the contents of files can be examined more precisely.</P>
-<DL>
-<DT>INSTALL_FLAGS</DT>
-<DD>If set, then an install will be done. This provides the set of flags
- to provide for the install. The target to be used (usually &quot;install&quot;)
- must be among the flags.</DD>
-<DT>POSTINSTALL_SCRIPT</DT>
-<DD>If set, a script to run after initial &quot;make install&quot;. Two arguments
- are provided: an absolute path to the root of the FreeSWAN src tree,
- and an absolute path to the temporary installation area.</DD>
-<DT>INSTALL2_FLAGS</DT>
-<DD>If set, a second install will be done using these flags. Similarly
- to INSTALL_FLAGS, the target must be among the flags.</DD>
-<DT>UNINSTALL_FLAGS</DT>
-<DD>If set, an uninstall will be done using these flags. Similarly to
- INSTALL_FLAGS, the target (usually &quot;uninstall&quot;) must be among the
- flags.</DD>
-<DT>REF_FIND_f_l_OUTPUT</DT>
-<DD>If set, a <CODE>find $ROOT ( -type f -or -type -l )</CODE> will be
- done to get a list of a real files and symlinks. The resulting file
- will be compared to the file listed by this option.</DD>
-<DT>REF_FILE_CONTENTS</DT>
-<DD>If set, it should point to a file containing records for the form:
-<PRE>
-  
-<!--VARIABLE-->
-reffile</(null)>   
-<!--VARIABLE-->
-samplefile</(null)>
-</PRE>
- one record per line. A diff between the provided reference file, and
- the sample file (located in the temporary installation root) will be
- done for each record.</DD>
-</DL>
-<H2><A NAME="39_7">rpm_build_install_test paramaters</A></H2>
-<P> The <CODE>rpm_build_install_test</CODE> type is to verify that the
- proper packing list is produced by &quot;make rpm&quot;, and that the mechanisms
- for building the kernel modules produce consistent results.</P>
-<DL>
-<DT>RPM_KERNEL_SOURCE</DT>
-<DD>Point to an extracted copy of the RedHat kernel source code.
- Variables from the environment may be used.</DD>
-<DT>REF_RPM_CONTENTS</DT>
-<DD>This is a file containing one record per line. Each record consists
- of a RPM name (may contain wildcards) and a filename to compare the
- contents to. The RPM will be located and a file list will be produced
- with rpm2cpio.</DD>
-</DL>
-<H2><A NAME="39_8">libtest paramaters</A></H2>
-<P> The libtest test is for testing library routines. The library file
- is expected to provided an <CODE>#ifdef</CODE> by the name of<VAR>
- library</VAR>
-<!--CODE_MAIN</CODE-->
-. The libtest type invokes the C compiler to compile this
- file, links it against <CODE>libfreeswan.a</CODE> (to resolve any other
- dependancies) and runs the test with the <CODE>-r</CODE> argument to
- invoke a regression test.</(null)></P>
-<P>The library test case is expected to do a self-test, exiting with
- status code 0 if everything is okay, and with non-zero otherwise. A
- core dump (exit code greater than 128) is noted specifically.</P>
-<P> Unlike other tests, there are no subdirectories required, or other
- parameters to set.</P>
-<H2 NAME="umlplutotest"><A NAME="39_9">umlplutotest paramaters</A></H2>
-<P> The umlplutotest function starts a pair of user mode line processes.
- This is a 2-host version of umlXhost. The &quot;EAST&quot; and &quot;WEST&quot; slots are
- defined.</P>
-<H2 NAME="umlXhost"><A NAME="39_10">umlXhost parameters</A></H2>
-<P> The umlXtest function starts an arbitrary number of user mode line
- processes.</P>
-
-<!-- <IMG SRC="single_netjig.png" ALT="block diagram of uml_netjig"> -->
-<P> The script invoked (<CODE>testing/utils/Xhost-test.tcl</CODE>) is a
- TCL<A HREF="http://expect.nist.gov/"> expect</A> script that arranges
- to start each UML and configure it appropriately for the test. It then
- starts listening (using uml_netjig) to the simulated network answering
- ARPs and inserting packets as appropriate.</P>
-<P> umlXtest has a series of slots, each of which should be filled by a
- host. The list of slots is controlled by the variable, XHOST_LIST. This
- variable should be set to a space seperated list of slots. The former
- umlplutotest is now implemented as a variation of the umlXhost test,
- with XHOST_LIST=&quot;EAST WEST&quot;.</P>
-<P> For each host slot that is defined, a series of variables should be
- filled in, defining what configuration scripts to use for that host.</P>
-<P> The following are used to control the console input and output to
- the system. Where the string ${host} is present, the host slot should
- be filled in. I.e. for the two host system with XHOST_LIST=&quot;EAST WEST&quot;,
- then the variables: EAST_INIT_SCRIPT and WEST_INIT_SCRIPT will exist.</P>
-<DL>
-<DT>${host}HOST</DT>
-<DD>The name of the UML host which will fill this slot</DD>
-<DT>${host}_INIT_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode prior to starting the tests. This file will usually
- set up any eroute's and SADB entries that are required for the test.
- Similar to INIT_SCRIPT, above.</P>
-</DD>
-<DT>${host}_RUN_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode, before the packets are sent. This set of commands is
- run after all of the virtual machines are initialized. I.e. after
- EAST_INIT_SCRIPT<B> AND</B> WEST_INIT_SCRIPT. This script can therefore
- do things that require that all machines are properly configured.</P>
-</DD>
-<DT>${host}_RUN2_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode, after the packets are sent. This set of commands is
- run before any of the virtual machines have been shut down. (I.e.
- before EAST_FINAL_SCRIPT<B> AND</B> WEST_FINAL_SCRIPT.) This script can
- therefore catch post-activity status reports.</P>
-</DD>
-<DT>${host}_FINAL_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode after the final packet is sent. Similar to
- INIT_SCRIPT, above. If not specified, then the single command &quot;halt&quot; is
- sent. Note that when this script is run, the other virtual machines may
- already have been killed. If specified, then the script should end with
- a halt command to nicely shutdown the UML.</P>
-</DD>
-<DT>REF_${host}_CONSOLE_OUTPUT</DT>
-<DD>Similar to REF_CONSOLE_OUTPUT, above.</DD>
-</DL>
-<P>Some additional flags apply to all hosts:</P>
-<DL>
-<DT>REF_CONSOLE_FIXUPS</DT>
-<DD>a list of scripts (found in <CODE>klips/test/fixups</CODE>) to apply
- to sanitize the console output of the machine under test. These are
- typically perl, awk or sed scripts that remove things in the kernel
- output that change each time the test is run and/or compiled.</DD>
-</DL>
-<P> In addition to input to the console, the networks may have input fed
- to them:</P>
-<DL>
-<DT>EAST_INPUT/WEST_INPUT</DT>
-<DD>a<A HREF="http://www.tcpdump.org/"> pcap</A> file to feed in on the
- private network side of each network. The &quot;EAST&quot; and &quot;WEST&quot; here refer
- to the networks, not the hosts.</DD>
-<DT>REF_PUB_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further
- processing. Defaults to &quot;cat&quot;.</DD>
-<DT>REF_EAST_FILTER/REF_WEST_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further
- processing. Defaults to &quot;cat&quot;.</DD>
-&lt;
-<DT>TCPDUMPFLAGS</DT>
-<DD>a set of flags for the tcpdump used when converting captured output.
- Typical values will include &quot;-n&quot; to turn off DNS, and often &quot;-E&quot; to set
- the decryption key (tcpdump 3.7.1 and higher only) for ESP packets. The
- &quot;-t&quot; flag (turn off timestamps) is provided automatically</DD>
-<DT>REF_EAST_OUTPUT/REF_WEST_OUTPUT</DT>
-<DD>a text file containing tcpdump output. Packets on the private (eth0)
- interface are captured and compared after conversion by tcpdump, as
- with<VAR> REF_PUB_OUTPUT</VAR>.</DD>
-<P> There are two additional environment variables that may be set on
- the command line:</P>
-<DL>
-<DT> NETJIGVERBOSE=verbose export NETJIGVERBOSE</DT>
-<DD> If set, then the test output will be &quot;chatty&quot;, and let you know
- what commands it is running, and as packets are sent. Without it set,
- the output is limited to success/failure messages.</DD>
-<DT> NETJIGTESTDEBUG=netjig export NETJIGTESTDEBUG</DT>
-<DD> This will enable debugging of the communication with uml_netjig,
- and turn on debugging in this utility. This does not imply
- NETJIGVERBOSE.</DD>
-</DL>
-<DT> HOSTTESTDEBUG=hosttest export HOSTTESTDEBUG</DT>
-<DD> This will show all interactions with the user-mode-linux consoles</DD>
-</DL>
-<H2 NAME="kernelpatch"><A NAME="39_11">kernel_patch_test paramaters</A></H2>
-<P> The kernel_patch_test function takes some kernel source, copies it
- with lndir, and then applies the patch as produced by &quot;make
- kernelpatch&quot;.</P>
-<P> The following are used to control the input and output to the
- system:</P>
-<DL>
-<DT>KERNEL_NAME</DT>
-<DD>the kernel name, typically something like &quot;linus&quot; or &quot;rh&quot;</DD>
-<DT>KERNEL_VERSION</DT>
-<DD>the kernel version number, as in &quot;2.2&quot; or &quot;2.4&quot;.</DD>
-<DT>KERNEL_${KERNEL_NAME}${KERNEL_VERSION}_SRC</DT>
-<DD>This variable should set in the environment, probably in
- ~/freeswan-regress-env.sh. Examples of this variables would be
- KERNEL_LINUS2_0_SRC or KERNEL_RH7_3_SRC. This variable should point to
- an extracted copy of the kernel source in question.</DD>
-<DT>REF_PATCH_OUTPUT</DT>
-<DD>a copy of the patch output to compare against</DD>
-<DT>KERNEL_PATCH_LEAVE_SOURCE</DT>
-<DD>If set to a non-empty string, then the patched kernel source is not
- removed at the end of the test. This will typically be set in the
- environment while debugging.</DD>
-</DL>
-<H2 NAME="modtest"><A NAME="39_12">module_compile paramaters</A></H2>
-<P> The module_compile test attempts to build the KLIPS module against a
- given set of kernel source. This is also done by the RPM tests, but in
- a very specific manner.</P>
-<P> There are two variations of this test - one where the kernel either
- doesn't need to be configured, or is already done, and tests were there
- is a local configuration file.</P>
-<P> Where the kernel doesn't need to be configured, the kernel source
- that is found is simply used. It may be a RedHat-style kernel, where
- one can cause it to configure itself via rhconfig.h-style definitions.
- Or, it may just be a kernel tree that has been configured.</P>
-<P> If the variable KERNEL_CONFIG_FILE is set, then a new directory is
- created for the kernel source. It is populated with lndir(1). The
- referenced file is then copied in as .config, and &quot;make oldconfig&quot; is
- used to configure the kernel. This resulting kernel is then used as the
- reference source.</P>
-<P> In all cases, the kernel source is found the same was for the
- kernelpatch test, i.e. via KERNEL_VERSION/KERNEL_NAME and
- KERNEL_${KERNEL_NAME}${KERNEL_VERSION}_SRC.</P>
-<P> Once there is kernel source, the module is compiled using the
- top-level &quot;make module&quot; target.</P>
-<P> The test is considered successful if an executable is found in
- OUTPUT/module/ipsec.o at the end of the test.</P>
-<DL>
-<DT>KERNEL_NAME</DT>
-<DD>the kernel name, typically something like &quot;linus&quot; or &quot;rh&quot;</DD>
-<DT>KERNEL_VERSION</DT>
-<DD>the kernel version number, as in &quot;2.2&quot; or &quot;2.4&quot;.</DD>
-<DT>KERNEL_${KERNEL_NAME}${KERNEL_VERSION}_SRC</DT>
-<DD>This variable should set in the environment, probably in
- ~/freeswan-regress-env.sh. Examples of this variables would be
- KERNEL_LINUS2_0_SRC or KERNEL_RH7_3_SRC. This variable should point to
- an extracted copy of the kernel source in question.</DD>
-<DT>KERNEL_CONFIG_FILE</DT>
-<DD>The configuration file for the kernel.</DD>
-<DT>KERNEL_PATCH_LEAVE_SOURCE</DT>
-<DD>If set to a non-empty string, then the configured kernel source is
- not removed at the end of the test. This will typically be set in the
- environment while debugging.</DD>
-<DT>MODULE_DEF_INCLUDE</DT>
-<DD>The include file that will be used to configure the KLIPS module,
- and possibly the kernel source.</DD>
-</DL>
-<H1><A NAME="40">Current pitfalls</A></H1>
-<DL>
-<DT> &quot;tcpdump dissector&quot; not available.</DT>
-<DD> This is a non-fatal warning. If uml_netjig is invoked with the -t
- option, then it will attempt to use tcpdump's dissector to decode each
- packet that it processes. The dissector is presently not available, so
- this option it normally turned off at compile time. The dissector
- library will be released with tcpdump version 4.0.</DD>
-</DL>
-<HR>
-<H1><A name="nightly">Nightly regression testing</A></H1>
-<P> The nightly regression testing system consists of several shell
- scripts and some perl scripts. The goal is to check out a fresh tree,
- run &quot;make check&quot; on it, record the results and summarize the results to
- the team and to the web site.</P>
-<P> Output can be found on<A HREF="http://bugs.freeswan.org:81/"> adams</A>
-, although the tests are actually run on another project machine.</P>
-<H1><A name="nightlyhowto">How to setup the nightly build</A></H1>
-<P> The best way to do nightly testing is to setup a new account. We
- call the account &quot;build&quot; - you could call it something else, but there
- may still be some references to ~build in the scripts.</P>
-<H2><A NAME="42_1"> Files you need to know about</A></H2>
-<P> As few files as possible need to be extracted from the source tree -
- files are run from the source tree whenever possible. However, there
- are some bootstrap and configuration files that are necessary.</P>
-<P> There are 7 files in testing/utils that are involved:</P>
-<DL>
-<DT> nightly-sample.sh</DT>
-<DD> This is the root of the build process. This file should be copied
- out of the CVS tree, to $HOME/bin/nightly.sh of the build account. This
- file should be invoked from cron.</DD>
-<DT> freeswan-regress-env-sample.sh</DT>
-<DD> This file should be copied to $HOME/freeswan-regress-env.sh. It
- should be edited to localize the values. See below.</DD>
-<DT> regress-cleanup.pl</DT>
-<DD> This file needs to be copied to $HOME/bin/regress-cleanup.pl. It is
- invoked by the nightly file before doing anything else. It removes
- previous nights builds in order to free up disk space for the build
- about to be done.</DD>
-<DT> teammail-sample.sh</DT>
-<DD> A script used to send results email to the &quot;team&quot;. This sample
- script could be copied to $HOME/bin/teammail.sh. This version will PGP
- encrypt all the output to the team members. If this script is used,
- then PGP will have to be properly setup to have the right keys.</DD>
-<DT> regress-nightly.sh</DT>
-<DD> This is the first stage of the nightly build. This stage will call
- other scripts as appropriate, and will extract the source code from
- CVS. This script should be copied to $HOME/bin/regress-nightly.sh</DD>
-<DT> regress-stage2.sh</DT>
-<DD> This is the second stage of the nightly build. It is called in
- place. It essentially sets up the UML setup in umlsetup.sh, and calls
- &quot;make check&quot;.</DD>
-<DT> regress-summarize-results.pl</DT>
-<DD> This script will summarize the results from the tests to a
- permanent directory set by $REGRESSRESULTS. It is invoked from the
- stage2 nightly script.</DD>
-<DT> regress-chart.sh</DT>
-<DD> This script is called at the end of the build process, and will
- summarize each night's results (as saved into $REGRESSRESULTS by
- regress-summarize-results.pl) as a chart using gnuplot. Note that this
- requires at least gnuplot 3.7.2.</DD>
-</DL>
-<H2><A NAME="42_2">Configuring freeswan-regress-env.sh</A></H2>
-<P>For more info on KERNPOOL, UMLPATCH, BASICROOT and SHAREDIR, see<A HREF="umltesting.html">
- User-Mode-Linux testing guide</A>.</P>
-<DL>
-<DT> KERNPOOL</DT>
-<DD> Extract copy of some kernel source to be used for UML builds</DD>
-<DT> UMLPATCH</DT>
-<DD> matching User-Mode-Linux patch.</DD>
-<DT> BASICROOT</DT>
-<DD> the root file system image (see<A HREF="umltesting.html">
- User-Mode-Linux testing guide</A>).</DD>
-<DT> SHAREDIR=${BASICROOT}/usr/share</DT>
-<DD> The /usr/share to use.</DD>
-<DT> REGRESSTREE</DT>
-<DD> A directory in which to store the nightly regression results.
- Directories will be created by date in this tree.</DD>
-<DT> TCPDUMP=tcpdump-3.7.1</DT>
-<DD> The path to the<A HREF="http://www.tcpdump.org/"> tcpdump</A> to
- use. This must have crypto compiled in, and must be at least 3.7.1</DD>
-<DT> KERNEL_RH7_2_SRC=/a3/kernel_sources/linux-2.4.9-13/</DT>
-<DD> An extracted copy of the RedHat 7.2. kernel source. If set, then
- the packaging/rpm-rh72-install-01 test will be run, and an RPM will be
- built as a test.</DD>
-<DT> KERNEL_RH7_3_SRC=/a3/kernel_sources/rh/linux-2.4.18-5</DT>
-<DD> An extracted copy of the RedHat 7.3. kernel source. If set, then
- the packaging/rpm-rh73-install-01 test will be run, and an RPM will be
- built as a test.</DD>
-<DT> NIGHTLY_WATCHERS=&quot;userid,userid,userid&quot;</DT>
-<DD> The list of people who should receive nightly output. This is used
- by teammail.sh</DD>
-<DT> FAILLINES=128</DT>
-<DD> How many lines of failed test output to include in the nightly
- output</DD>
-<DT> PATH=$PATH:/sandel/bin export PATH</DT>
-<DD> You can also override the path if necessary here.</DD>
-<DT> CVSROOT=:pserver:anoncvs@ip212.xs4net.freeswan.org:/freeswan/MASTER</DT>
-<DD> The CVSROOT to use. This example may work for anonymous CVS, but
- will be 12 hours behind the primary, and is still experimental</DD>
-<DT> SNAPSHOTSIGDIR=$HOME/snapshot-sig</DT>
-<DD> For the release tools, where to put the generated per-snapshot
- signature keys</DD>
-<DT> LASTREL=1.97</DT>
-<DD> the name of the last release branch (to find the right per-snapshot
- signature</DD>
-<DD></DD>
-</DL>
-</BODY>
-</HTML>
diff --git a/doc/Makefile b/doc/Makefile
deleted file mode 100644
index f8209b3a8..000000000
--- a/doc/Makefile
+++ /dev/null
@@ -1,167 +0,0 @@
-# Makefile to generate various formats from HTML source
-#
-# Assumes the htmldoc utility is available.
-# This can be downloaded from www.easysw.com
-#
-# Also needs lynx(1) for HTML-to-text conversion
-
-.SUFFIXES: .png .fig
-
-FREESWANSRCDIR=..
-include ${FREESWANSRCDIR}/Makefile.inc
-
-# Format arguments for htmldoc
-F="--toclevels 4 --header 1cd"
-
-# source files in subdirectory
-# basic stuff
-a=src/intro.html src/upgrading.html src/quickstart.html \
-  src/policygroups.html src/faq.html
-
-# related
-b=src/manpages.html src/firewall.html src/trouble.html
-
-# more advanced
-c=src/compat.html src/interop.html src/performance.html \
-	src/testing.html src/kernel.html src/adv_config.html \
-	src/install.html src/config.html \
-	src/background.html src/user_examples.html \
-	src/makecheck.html src/umltesting.html \
-
-# background and reference material
-d=src/politics.html src/ipsec.html \
-	src/mail.html src/web.html src/glossary.html src/biblio.html \
-	src/rfc.html src/roadmap.html
-
-# build and release related
-e=src/umltesting.html src/makecheck.html src/nightly.html
-
-sections=$a $b $c $d $e
-
-# separate HTML files built in current directory
-separate=intro.html install.html config.html manpages.html \
-	firewall.html trouble.html kernel.html roadmap.html \
-	compat.html interop.html politics.html ipsec.html \
-	mail.html performance.html testing.html web.html \
-	glossary.html biblio.html rfc.html faq.html \
-	adv_config.html user_examples.html background.html \
-	quickstart.html umltesting.html makecheck.html nightly.html \
-        upgrading.html policygroups.html
-
-# various one-big-file formats
-howto=HowTo.html HowTo.ps HowTo.pdf HowTo.txt
-
-alldocs=${seperate} ${howto} index.html toc.html
-
-srcdir=..
-# where are scripts
-SCRIPTDIR=utils
-
-# where
-TESTINGDIR=${srcdir}/testing
-
-# where do we put HTML manpages?
-HMANDIR=manpage.d
-
-# default, build HTML only
-# dependencies build most of it
-# then we add index
-index.html: toc.html HowTo.html manpages src/index.html
-	cp src/index.html index.html
-
-# separate files plus table of contents
-# and then remove HTML formatting added by htmldoc
-toc.html : $(sections)
-	@htmldoc -t html --path ".;${TESTINGDIR}/doc" -d .  $(sections)
-	@$(SCRIPTDIR)/cleanhtml.sh $(SCRIPTDIR)/cleanhtml.sed $(separate)
-
-# one big HTML file
-HowTo.html : $(sections)
-	@htmldoc -t html --toclevels 4 --header ' cf' -f $@ $(sections)
-
-# other HowTo formats
-HowTo.txt: HowTo.html
-	lynx -dump $< > $@
-
-HowTo.ps : $(sections)
-	htmldoc -f $@ $(sections)
-
-HowTo.pdf : $(sections)
-	@htmldoc -f $@ $(sections)
-
-manpages:	manp
-
-manp:	$(SCRIPTDIR)/mkhtmlman
-	@$(SCRIPTDIR)/mkhtmlman $(HMANDIR) `find ../programs ../lib ../linux -type f -name '*.[1-8]' -print | grep -v lwres | grep -v CVS`
-
-programs: 
-
-all: #$(howto) $(manpages) index.html
-
-clean:
-	@rm -f $(howto) $(separate) toc.html index.html
-	@rm -rf $(HMANDIR)
-
-install:
-#install: ${alldocs} manpages
-#	@mkdir -p ${DOCDIR}
-#	@$(foreach f, $(alldocs), \
-#		$(INSTALL) $f ${DOCDIR} || exit 1;\
-#	)
-#	@find ${HMANDIR} -type f -name "*.html" -print | while read file; \
-#	do \
-#		$(INSTALL) $$file ${DOCDIR} || exit 1;\
-#	done;
-
-install_file_list:
-	@$(foreach f, $(alldocs), \
-		echo ${DOCDIR}/$f; \
-	)
-	@if [ -d ${HMANDIR} ]; then find ${HMANDIR} -type f -name "*.html" -print | while read file; \
-	do \
-		echo ${DOCDIR}/$$file; \
-	done; fi;
-
-checkprograms: ;
-
-check: ;
-
-# not enabled by default, because xml2rfc must be installed first.
-drafts: draft-richardson-ipsec-opportunistic.txt src/draft-richardson-ipsec-opportunistic.html \
-	draft-richardson-ipsec-rr.txt src/draft-richardson-ipsec-rr.html
-
-draft-richardson-ipsec-opportunistic.txt: src/draft-richardson-ipsec-opportunistic.xml
-	XML_LIBRARY=$(XML_LIBRARY):./src xml2rfc xml2rfc $? $@
-
-draft-richardson-ipsec-rr.txt: src/draft-richardson-ipsec-rr.xml
-	XML_LIBRARY=$(XML_LIBRARY):./src xml2rfc xml2rfc $? $@
-
-draft-%.nr: src/draft-%.xml
-	XML_LIBRARY=$(XML_LIBRARY):./src xml2rfc xml2nroff $? $@
-
-draft-%.html: draft-%.xml
-	XML_LIBRARY=$(XML_LIBRARY):./src xml2rfc xml2html $? $@
-
-
-.fig.eps: 
-	fig2dev -L ps $< $@
-
-.fig.png: 
-	fig2dev -L png $< $@
-
-single_netjig.png: testing/single_netjig.fig
-multi_netjig.png: testing/multi_netjig.fig
-
-makecheck.html: single_netjig.png multi_netjig.png
-
-#
-# DocBook based documentation
-#
-xmldocs: mast.html klips/mast.4
-	
-mast.html: klips/mast.xml
-	xmlto html klips/mast.xml
-
-klips/mast.4: klips/mast.xml
-	xmlto -o klips man klips/mast.xml
-
diff --git a/doc/README b/doc/README
deleted file mode 100644
index ff5564e4e..000000000
--- a/doc/README
+++ /dev/null
@@ -1,39 +0,0 @@
-This directory has the HTML FreeS/WAN documentation.
-
-Start from either of:
-
-	toc.html	table of contents for HTML docs
-	index.html	pointers to everything, including
-			 text files not in HTML docs
-
-The Makefile in this directory can generate various
-things from the HTML source:
-
-	./*.html	individual HTML files
-			with previous/contents/next links
-	toc.html	table of contents
-	HowTo.html	one big HTML file
-	HowTo.ps	Postscript
-	HowTo.pdf	PDF
-	HowTo.txt	ASCII text
-
-Not all of the above are in the shipped version. All but
-text are on our website, www.freeswan.org. To get PDF or
-Postscript, either grab them from the web or install
-htmldoc from www.easysw.com, then use the Makefile.
-
-Subdirectories are:
-	src/*.html		HTML source files
-	manpage.d/*.html	HTML versions of man pages
-
-You should not need to look at these, except for following
-links to HTML man pages.
-
-The Internet Drafts are natively in XML format. They have been 
-converted with Marshall Rose's xml2rfc.
-
-xml2rfc is available at xml.resource.org. 
-You may have to install the TclXML package by symlinking it into
-/usr/lib/tcl8.3 or some such.  
-
-
diff --git a/doc/adv_config.html b/doc/adv_config.html
deleted file mode 100644
index 4b779c753..000000000
--- a/doc/adv_config.html
+++ /dev/null
@@ -1,1232 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="kernel.html">Previous</A>
-<A HREF="install.html">Next</A>
-<HR>
-<H1><A name="adv_config">Other configuration possibilities</A></H1>
-<P>This document describes various options for FreeS/WAN configuration
- which are less used or more complex (often both) than the standard
- cases described in our<A href="config.html#config"> config</A> and<A href="quickstart.html#quick_guide">
- quickstart</A> documents.</P>
-<H2><A name="thumb">Some rules of thumb about configuration</A></H2>
-<H3><A name="cheap.tunnel">Tunnels are cheap</A></H3>
-<P>Nearly all of the overhead in IPsec processing is in the encryption
- and authentication of packets. Our<A href="performance.html">
- performance</A> document discusses these overheads.</P>
-<P>Beside those overheads, the cost of managing additional tunnels is
- trivial. Whether your gateway supports one tunnel or ten just does not
- matter. A hundred might be a problem; there is a<A href="performance.html#biggate">
- section</A> on this in the performance document.</P>
-<P>So, in nearly all cases, if using multiple tunnels gives you a
- reasonable way to describe what you need to do, you should describe it
- that way in your configuration files.</P>
-<P>For example, one user recently asked on a mailing list about this
- network configuration:</P>
-<PRE>        netA---gwA---gwB---netB
-                            |----netC
-
-   netA and B are secured netC not.
-   netA and gwA can not access netC</PRE>
-<P>The user had constructed only one tunnel, netA to netB, and wanted to
- know how to use ip-route to get netC packets into it. This is entirely
- unnecessary. One of the replies was:</P>
-<PRE>  The simplest way and indeed the right way to
-  solve this problem is to set up two connections:
-
-        leftsubnet=NetA
-        left=gwA
-        right=gwB
-        rightsubnet=NetB
-  and
-        leftsubnet=NetA
-        left=gwA
-        right=gwB
-        rightsubnet=NetC</PRE>
-<P>This would still be correct even if we added nets D, E, F, ... to the
- above diagram and needed twenty tunnels.</P>
-<P>Of course another possibility would be to just use one tunnel, with a
- subnet mask that includes both netB and netC (or B, C, D, ...). See
- next section.</P>
-<P>In general, you can construct as many tunnels as you need. Networks
- like netC in this example that do not connect directly to the gateway
- are fine, as long as the gateway can route to them.</P>
-<P>The number of tunnels can become an issue if it reaches 50 or so.
- This is discussed in the<A href="performance.html#biggate"> performance</A>
- document. Look there for information on supporting hundreds of Road
- Warriors from one gateway.</P>
-<P>If you find yourself with too many tunnels for some reason like
- having eight subnets at one location and nine at another so you end up
- with 9*8=72 tunnels, read the next section here.</P>
-<H3><A name="subnet.size">Subnet sizes</A></H3>
-<P>The subnets used in<VAR> leftsubnet</VAR> and<VAR> rightsubnet</VAR>
- can be of any size that fits your needs, and they need not correspond
- to physical networks.</P>
-<P>You adjust the size by changing the<A href="glossary.html#subnet">
- subnet mask</A>, the number after the slash in the subnet description.
- For example</P>
-<UL>
-<LI>in 192.168.100.0/24 the /24 mask says 24 bits are used to designate
- the network. This leave 8 bits to label machines. This subnet has 256
- addresses. .0 and .255 are reserved, so it can have 254 machines.</LI>
-<LI>A subnet with a /23 mask would be twice as large, 512 addresses.</LI>
-<LI>A subnet with a /25 mask would be half the size, 128 addresses.</LI>
-<LI>/0 is the whole Internet</LI>
-<LI>/32 is a single machine</LI>
-</UL>
-<P>As an example of using these in connection descriptions, suppose your
- company's head office has four physical networks using the address
- ranges:</P>
-<DL>
-<DT>192.168.100.0/24</DT>
-<DD>development</DD>
-<DT>192.168.101.0/24</DT>
-<DD>production</DD>
-<DT>192.168.102.0/24</DT>
-<DD>marketing</DD>
-<DT>192.168.103.0/24</DT>
-<DD>administration</DD>
-</DL>
-<P>You can use exactly those subnets in your connection descriptions, or
- use larger subnets to grant broad access if required:</P>
-<DL>
-<DT>leftsubnet=192.168.100.0/24</DT>
-<DD>remote hosts can access only development</DD>
-<DT>leftsubnet=192.168.100.0/23</DT>
-<DD>remote hosts can access development or production</DD>
-<DT>leftsubnet=192.168.102.0/23</DT>
-<DD>remote hosts can access marketing or administration</DD>
-<DT>leftsubnet=192.168.100.0/22</DT>
-<DD>remote hosts can access any of the four departments</DD>
-</DL>
-<P>or use smaller subnets to restrict access:</P>
-<DL>
-<DT>leftsubnet=192.168.103.0/24</DT>
-<DD>remote hosts can access any machine in administration</DD>
-<DT>leftsubnet=192.168.103.64/28</DT>
-<DD>remote hosts can access only certain machines in administration.</DD>
-<DT>leftsubnet=192.168.103.42/32</DT>
-<DD>remote hosts can access only one particular machine in
- administration</DD>
-</DL>
-<P>To be exact, 192.68.103.64/28 means all addresses whose top 28 bits
- match 192.168.103.64. There are 16 of these because there are 16
- possibilities for the remainingg 4 bits. Their addresses are
- 192.168.103.64 to 192.168.103.79.</P>
-<P>Each connection description can use a different subnet if required.</P>
-<P>It is possible to use all the examples above on the same FreeS/WAN
- gateway, each in a different connection description, perhaps for
- different classes of user or for different remote offices.</P>
-<P>It is also possible to have multiple tunnels using different<VAR>
- leftsubnet</VAR> descriptions with the same<VAR> right</VAR>. For
- example, when the marketing manager is on the road he or she might have
- access to:</P>
-<DL>
-<DT>leftsubnet=192.168.102.0/24</DT>
-<DD>all machines in marketing</DD>
-<DT>192.168.101.32/29</DT>
-<DD>some machines in production</DD>
-<DT>leftsubnet=192.168.103.42/32</DT>
-<DD>one particular machine in administration</DD>
-</DL>
-<P>This takes three tunnels, but tunnels are cheap. If the laptop is set
- up to build all three tunnels automatically, then he or she can access
- all these machines concurrently, perhaps from different windows.</P>
-<H3><A name="example.more">Other network layouts</A></H3>
-<P>Here is the usual network picture for a site-to-site VPN::</P>
-<PRE>     Sunset==========West------------------East=========Sunrise
-           local net       untrusted net       local net</PRE>
-<P>and for the Road Warrior::</P>
-<PRE>                                           telecommuter's PC or
-                                           traveller's laptop
-     Sunset==========West------------------East
-         corporate LAN     untrusted net</PRE>
-<P>Other configurations are also possible.</P>
-<H4><A name="internet.subnet">The Internet as a big subnet</A></H4>
-<P>A telecommuter might have:</P>
-<PRE>     Sunset==========West------------------East ================= firewall --- the Internet
-         home network      untrusted net        corporate network</PRE>
-<P>This can be described as a special case of the general
- subnet-to-subnet connection. The subnet on the right is 0.0.0.0/0, the
- whole Internet.</P>
-<P>West (the home gateway) can have its firewall rules set up so that
- only IPsec packets to East are allowed out. It will then behave as if
- its only connection to the world was a wire to East.</P>
-<P>When machines on the home network need to reach the Internet, they do
- so via the tunnel, East and the corporate firewall. From the viewpoint
- of the Internet (perhaps of some EvilDoer trying to break in!), those
- home office machines are behind the firewall and protected by it.</P>
-<H4><A name="wireless.config">Wireless</A></H4>
-<P>Another possible configuration comes up when you do not trust the
- local network, either because you have very high security standards or
- because your are using easily-intercepted wireless signals.</P>
-<P>Some wireless networks have built-in encryption called<A href="glossary.html#WEP">
- WEP</A>, but its security is dubious. It is a fairly common practice to
- use IPsec instead.</P>
-<P>In this case, part of your network may look like this:</P>
-<PRE>          West-----------------------------East == the rest of your network
-     workstation   untrusted wireless net</PRE>
-<P>Of course, there would likely be several wireless workstations, each
- with its own IPsec tunnel to the East gateway.</P>
-<P>The connection descriptions look much like Road Warrior descriptions:</P>
-<UL>
-<LI>each workstation should have its own unique
-<UL>
-<LI>identifier for IPsec</LI>
-<LI>RSA key</LI>
-<LI>connection description.</LI>
-</UL>
-</LI>
-<LI>on the gateway, use<VAR> left=%any</VAR>, or the workstation IP
- address</LI>
-<LI>on workstations,<VAR> left=%defaultroute</VAR>, or the workstation
- IP address</LI>
-<LI><VAR>leftsubnet=</VAR> is not used.</LI>
-</UL>
-<P>The<VAR> rightsubnet=</VAR> parameter might be set in any of several
- ways:</P>
-<DL>
-<DT>rightsubnet=0.0.0.0/0</DT>
-<DD>allowing workstations to access the entire Internet (see<A href="#internet.subnet">
- above</A>)</DD>
-<DT>rightsubnet=a.b.c.0/24</DT>
-<DD>allowing access to your entire local network</DD>
-<DT>rightsubnet=a.b.c.d/32</DT>
-<DD>restricting the workstation to connecting to a particular server</DD>
-</DL>
-<P>Of course you can mix and match these as required. For example, a
- university might allow faculty full Internet access while letting
- student laptops connect only to a group of lab machines.</P>
-<H2><A name="choose">Choosing connection types</A></H2>
-<P>One choice you need to make before configuring additional connections
- is what type or types of connections you will use. There are several
- options, and you can use more than one concurrently.</P>
-<H3><A name="man-auto">Manual vs. automatic keying</A></H3>
-<P>IPsec allows two types of connections, with manual or automatic
- keying. FreeS/WAN starts them with commands such as:</P>
-<PRE>        ipsec manual --up <VAR>name</VAR>
-        ipsec auto --up <VAR>name</VAR></PRE>
-<P>The difference is in how they are keyed.</P>
-<DL>
-<DT><A href="glossary.html#manual">Manually keyed</A> connections</DT>
-<DD>use keys stored in<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf</A>
-.</DD>
-<DT><A href="glossary.html#auto">Automatically keyed</A> connections</DT>
-<DD>use keys automatically generated by the Pluto key negotiation
- daemon. The key negotiation protocol,<A href="glossary.html#IKE"> IKE</A>
-, must authenticate the other system. (It is vulnerable to a<A href="glossary.html#middle">
- man-in-the-middle attack</A> if used without authentication.) We
- currently support two authentication methods:
-<UL>
-<LI>using shared secrets stored in<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets</A>.</LI>
-<LI>RSA<A href="glossary.html#public"> public key</A> authentication,
- with our machine's private key in<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets</A>. Public keys for other machines may either be placed
- in<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf</A> or provided via
- DNS.</LI>
-</UL>
-<P>A third method, using RSA keys embedded in<A href="glossary.html#X509">
- X.509</A> certtificates, is provided by user<A href="web.html#patch">
- patches</A>.</P>
-</DD>
-</DL>
-<P><A href="glossary.html#manual">Manually keyed</A> connections provide
- weaker security than<A href="glossary.html#auto"> automatically keyed</A>
- connections. An opponent who reads ipsec.secrets(5) gets your
- encryption key and can read all data encrypted by it. If he or she has
- an archive of old messages, all of them back to your last key change
- are also readable.</P>
-<P>With automatically-(re)-keyed connections, an opponent who reads
- ipsec.secrets(5) gets the key used to authenticate your system in IKE
- -- the shared secret or your private key, depending what authentication
- mechanism is in use. However, he or she does not automatically gain
- access to any encryption keys or any data.</P>
-<P>An attacker who has your authentication key can mount a<A href="glossary.html#middle">
- man-in-the-middle attack</A> and, if that succeeds, he or she will get
- encryption keys and data. This is a serious danger, but it is better
- than having the attacker read everyting as soon as he or she breaks
- into ipsec.secrets(5).. Moreover, the keys change often so an opponent
- who gets one key does not get a large amount of data. To read all your
- data, he or she would have to do a man-in-the-middle attack at every
- key change.</P>
-<P>We discuss using<A href="#prodman"> manual keying in production</A>
- below, but this is<STRONG> not recommended</STRONG> except in special
- circumstances, such as needing to communicate with some implementation
- that offers no auto-keyed mode compatible with FreeS/WAN.</P>
-<P>Manual keying may also be useful for testing. There is some
- discussion of this in our<A href="faq.html#man4debug"> FAQ</A>.</P>
-<H3><A name="auto-auth">Authentication methods for auto-keying</A></H3>
-<P>The IKE protocol which Pluto uses to negotiate connections between
- gateways must use some form of authentication of peers. A gateway must
- know who it is talking to before it can create a secure connection. We
- support two basic methods for this authentication:</P>
-<UL>
-<LI>shared secrets, stored in<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets(5)</A></LI>
-<LI>RSA authentication</LI>
-</UL>
-<P>There are, howver, several variations on the RSA theme, using
- different methods of managing the RSA keys:</P>
-<UL>
-<LI>our RSA private key in<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets(5)</A> with other gateways' public keys
-<DL>
-<DT>either</DT>
-<DD>stored in<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A></DD>
-<DT>or</DT>
-<DD>looked up via<A href="glossary.html#DNS"> DNS</A></DD>
-</DL>
-</LI>
-<LI>authentication with<A href="glossary.html#x509"> x.509</A>
- certificates.; See our<A href="web.html#patch"> links section</A> for
- information on user-contributed patches for this.:</LI>
-</UL>
-<P>Public keys in<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5</A>
-) give a reasonably straightforward method of specifying keys for
- explicitly configured connections.</P>
-<P>Putting public keys in DNS allows us to support<A href="glossary.html#carpediem">
- opportunistic encryption</A>. Any two FreeS/WAN gateways can provide
- secure communication, without either of them having any preset
- information about the other.</P>
-<P>X.509 certificates may be required to interface to various<A href="glossary.html#PKI">
- PKI</A>s.</P>
-<H3><A name="adv-pk">Advantages of public key methods</A></H3>
-<P>Authentication with a<A href="glossary.html#public"> public key</A>
- method such as<A href="glossary.html#RSA"> RSA</A> has some important
- advantages over using shared secrets.</P>
-<UL>
-<LI>no problem of secure transmission of secrets
-<UL>
-<LI>A shared secret must be shared, so you have the problem of
- transmitting it securely to the other party. If you get this wrong, you
- have no security.</LI>
-<LI>With a public key technique, you transmit only your public key. The
- system is designed to ensure that it does not matter if an enemy
- obtains public keys. The private key never leaves your machine.</LI>
-</UL>
-</LI>
-<LI>easier management
-<UL>
-<LI>Suppose you have 20 branch offices all connecting to one gateway at
- head office, and all using shared secrets. Then the head office admin
- has 20 secrets to manage. Each of them must be kept secret not only
- from outsiders, but also from 19 of the branch office admins. The
- branch office admins have only one secret each to manage.
-<P>If the branch offices need to talk to each other, this becomes
- problematic. You need another 20*19/2 = 190 secrets for
- branch-to-branch communication, each known to exactly two branches. Now
- all the branch admins have the headache of handling 20 keys, each
- shared with exactly one other branch or with head office.</P>
-<P>For larger numbers of branches, the number of connections and secrets
- increases quadratically and managing them becomes a nightmare. A
- 1000-gateway fully connected network needs 499,500 secrets, each known
- to exactly two players. There are ways to reduce this problem, for
- example by introducing a central key server, but these involve
- additional communication overheads, more administrative work, and new
- threats that must be carefully guarded against.</P>
-</LI>
-<LI>With public key techniques, the<EM> only</EM> thing you have to keep
- secret is your private key, and<EM> you keep that secret from everyone</EM>
-.
-<P>As network size increaes, the number of public keys used increases
- linearly with the number of nodes. This still requires careful
- administration in large applications, but is nothing like the disaster
- of a quadratic increase. On a 1000-gateway network, you have 1000
- private keys, each of which must be kept secure on one machine, and
- 1000 public keys which must be distributed. This is not a trivial
- problem, but it is manageable.</P>
-</LI>
-</UL>
-</LI>
-<LI>does not require fixed IP addresses
-<UL>
-<LI>When shared secrets are used in IPsec, the responder must be able to
- tell which secret to use by looking at the IP address on the incoming
- packets. When the other parties do not have a fixed IP address to be
- identified by (for example, on nearly all dialup ISP connections and
- many cable or ADSL links), this does not work well -- all must share
- the same secret!</LI>
-<LI>When RSA authentication is in use, the initiator can identify itself
- by name before the key must be determined. The responder then checks
- that the message is signed with the public key corresponding to that
- name.</LI>
-</UL>
-</LI>
-</UL>
-<P>There is also a disadvantage:</P>
-<UL>
-<LI>your private key is a single point of attack, extremely valuable to
- an enemy
-<UL>
-<LI>with shared secrets, an attacker who steals your ipsec.secrets file
- can impersonate you or try<A href="glossary.html#middle">
- man-in-the-middle</A> attacks, but can only attack connections
- described in that file</LI>
-<LI>an attacker who steals your private key gains the chance to attack
- not only existing connections<EM> but also any future connections</EM>
- created using that key</LI>
-</UL>
-</LI>
-</UL>
-<P>This is partly counterbalanced by the fact that the key is never
- transmitted and remains under your control at all times. It is likely
- necessary, however, to take account of this in setting security policy.
- For example, you should change gateway keys when an administrator
- leaves the company, and should change them periodically in any case.</P>
-<P>Overall, public key methods are<STRONG> more secure, more easily
- managed and more flexible</STRONG>. We recommend that they be used for
- all connections, unless there is a compelling reason to do otherwise.</P>
-<H2><A name="prodsecrets">Using shared secrets in production</A></H2>
-<P>Generally, public key methods are preferred for reasons given above,
- but shared secrets can be used with no loss of security, just more work
- and perhaps more need to take precautions.</P>
-<P>What I call &quot;shared secrets&quot; are sometimes also called &quot;pre-shared
- keys&quot;. They are used only for for authentication, never for encryption.
- Calling them &quot;pre-shared keys&quot; has confused some users into thinking
- they were encryption keys, so I prefer to avoid the term..</P>
-<P>If you are interoperating with another IPsec implementation, you may
- find its documentation calling them &quot;passphrases&quot;.</P>
-<H3><A name="secrets">Putting secrets in ipsec.secrets(5)</A></H3>
-<P>If shared secrets are to be used to<A href="glossary.html#authentication">
- authenticate</A> communication for the<A href="glossary.html#DH">
- Diffie-Hellman</A> key exchange in the<A href="glossary.html#IKE"> IKE</A>
- protocol, then those secrets must be stored in<VAR> /etc/ipsec.secrets</VAR>
-. For details, see the<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets(5)</A> man page.</P>
-<P>A few considerations are vital:</P>
-<UL>
-<LI>make the secrets long and unguessable. Since they need not be
- remembered by humans, very long ugly strings may be used. We suggest
- using our<A href="manpage.d/ipsec_ranbits.8.html"> ipsec_ranbits(8)</A>
- utility to generate long (128 bits or more) random strings.</LI>
-<LI>transmit secrets securely. You have to share them with other
- systems, but you lose if they are intercepted and used against you. Use<A
-href="glossary.html#PGP"> PGP</A>,<A href="glossary.html#SSH"> SSH</A>,
- hand delivery of a floppy disk which is then destroyed, or some other
- trustworthy method to deliver them.</LI>
-<LI>store secrets securely, in root-owned files with permissions
- rw------.</LI>
-<LI>limit sharing of secrets. Alice, Bob, Carol and Dave may all talk to
- each other, but only Alice and Bob should know the secret for an
- Alice-Bob link.</LI>
-<LI><STRONG>do not share private keys</STRONG>. The private key for RSA
- authentication of your system is stored in<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets(5)</A>, but it is a different class of secret from the
- pre-shared keys used for the &quot;shared secret&quot; authentication. No-one but
- you should have the RSA private key.</LI>
-</UL>
-<P>Each line has the IP addresses of the two gateways plus the secret.
- It should look something like this:</P>
-<PRE>        10.0.0.1 11.0.0.1 : PSK &quot;jxTR1lnmSjuj33n4W51uW3kTR55luUmSmnlRUuWnkjRj3UuTV4T3USSu23Uk55nWu5TkTUnjT&quot;</PRE>
-<P><VAR>PSK</VAR> indicates the use of a<STRONG> p</STRONG>re-<STRONG>s</STRONG>
-hared<STRONG> k</STRONG>ey. The quotes and the whitespace shown are
- required.</P>
-<P>You can use any character string as your secret. For security, it
- should be both long and extremely hard to guess. We provide a utility
- to generate such strings,<A href="manpage.d/ipsec_ranbits.8.html">
- ipsec_ranbits(8)</A>.</P>
-<P>You want the same secret on the two gateways used, so you create a
- line with that secret and the two gateway IP addresses. The
- installation process supplies an example secret, useful<EM> only</EM>
- for testing. You must change it for production use.</P>
-<H3><A name="securing.secrets">File security</A></H3>
-<P>You must deliver this file, or the relevant part of it, to the other
- gateway machine by some<STRONG> secure</STRONG> means.<EM> Don't just
- FTP or mail the file!</EM> It is vital that the secrets in it remain
- secret. An attacker who knew those could easily have<EM> all the data
- on your &quot;secure&quot; connection</EM>.</P>
-<P>This file must be owned by root and should have permissions<VAR>
- rw-------</VAR>.</P>
-<H3><A name="notroadshared">Shared secrets for road warriors</A></H3>
-<P>You can use a shared secret to support a single road warrior
- connecting to your gateway, and this is a reasonable thing to do in
- some circumstances. Public key methods have advantages, discussed<A href="#choose">
- above</A>, but they are not critical in this case.</P>
-<P>To do this, the line in ipsec.secrets(5) is something like:</P>
-<PRE>        10.0.0.1 0.0.0.0 : PSK &quot;jxTR1lnmSjuj33n4W51uW3kTR55luUmSmnlRUuWnkjRj3UuTV4T3USSu23Uk55nWu5TkTUnjT&quot;</PRE>
- where the<VAR> 0.0.0.0</VAR> means that any IP address is acceptable.
-<P><STRONG>For more than one road warrior, shared secrets are<EM> not</EM>
- recommended.</STRONG> If shared secrets are used, then when the
- responder needs to look up the secret, all it knows about the sender is
- an IP address. This is fine if the sender is at a fixed IP address
- specified in the config file. It is also fine if only one road warrior
- uses the wildcard<VAR> 0.0.0.0</VAR> address. However, if you have more
- than one road warrior using shared secret authentication, then they
- must all use that wildcard and therefore<STRONG> all road warriors
- using PSK autentication must use the same secret</STRONG>. Obviously,
- this is insecure.</P>
-<P><STRONG>For multiple road warriors, use public key authentication.</STRONG>
- Each roadwarrior can then have its own identity (our<VAR> leftid=</VAR>
- or<VAR> rightid=</VAR> parameters), its own public/private key pair,
- and its own secure connection.</P>
-<H2><A name="prodman">Using manual keying in production</A></H2>
-<P>Generally,<A href="glossary.html#auto"> automatic keying</A> is
- preferred over<A href="glossary.html#manual"> manual keying</A> for
- production use because it is both easier to manage and more secure.
- Automatic keying frees the admin from much of the burden of managing
- keys securely, and can provide<A href="glossary.html#PFS"> perfect
- forward secrecy</A>. This is discussed in more detail<A href="#man-auto">
- above</A>.</P>
-<P>However, it is possible to use manual keying in production if that is
- what you want to do. This might be necessary, for example, in order to
- interoperate with some device that either does not provide automatic
- keying or provides it in some version we cannot talk to.</P>
-<P>Note that with manual keying<STRONG> all security rests with the keys</STRONG>
-. If an adversary acquires your keys, you've had it. He or she can read
- everything ever sent with those keys, including old messages he or she
- may have archived.</P>
-<P>You need to<STRONG> be really paranoid about keys</STRONG> if you're
- going to rely on manual keying for anything important.</P>
-<UL>
-<LI>keep keys in files with 600 permissions, owned by root</LI>
-<LI>be extremely careful about security of your gateway systems. Anyone
- who breaks into a gateway and gains root privileges can get all your
- keys and read everything ever encrypted with those keys, both old
- messages he has archived and any new ones you may send.</LI>
-<LI>change keys regularly. This can be a considerable bother, (and
- provides an excellent reason to consider automatic keying instead), but
- it is<EM> absolutely essential</EM> for security. Consider a manually
- keyed system in which you leave the same key in place for months:
-<UL>
-<LI>an attacker can have a very large sample of text sent with that key
- to work with. This makes various cryptographic attacks much more likely
- to succeed.</LI>
-<LI>The chances of the key being compromised in some non-cryptographic
- manner -- a spy finds it on a discarded notepad, someone breaks into
- your server or your building and steals it, a staff member is bribed,
- tricked, seduced or coerced into revealing it, etc. -- also increase
- over time.</LI>
-<LI>a successful attacker can read everything ever sent with that key.
- This makes any successful attack extremely damaging.</LI>
-</UL>
- It is clear that you must change keys often to have any useful
- security. The only question is how often.</LI>
-<LI>use<A href="glossary.html#PGP"> PGP</A> or<A href="glossary.html#SSH">
- SSH</A> for all key transfers</LI>
-<LI>don't edit files with keys in them when someone can look over your
- shoulder</LI>
-<LI>worry about network security; could someone get keys by snooping
- packets on the LAN between your X desktop and the gateway?</LI>
-<LI>lock up your backup tapes for the gateway system</LI>
-<LI>... and so on</LI>
-</UL>
-<P>Linux FreeS/WAN provides some facilities to help with this. In
- particular, it is good policy to<STRONG> keep keys in separate files</STRONG>
- so you can edit configuration information in /etc/ipsec.conf without
- exposing keys to &quot;shoulder surfers&quot; or network snoops. We support this
- with the<VAR> also=</VAR> and<VAR> include</VAR> syntax in<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A>.</P>
-<P>See the last example in our<A href="examples"> examples</A> file. In
- the /etc/ipsec.conf<VAR> conn samplesep</VAR> section, it has the line:</P>
-<PRE>        also=samplesep-keys</PRE>
-<P>which tells the &quot;ipsec manual&quot; script to insert the configuration
- description labelled &quot;samplesep-keys&quot; if it can find it. The
- /etc/ipsec.conf file must also have a line such as:</P>
-<PRE>include ipsec.*.conf</PRE>
-<P>which tells it to read other files. One of those other files then
- might contain the additional data:</P>
-<PRE>conn samplesep-keys
-  spi=0x200
-  esp=3des-md5-96
-  espenckey=0x01234567_89abcdef_02468ace_13579bdf_12345678_9abcdef0
-  espauthkey=0x12345678_9abcdef0_2468ace0_13579bdf</PRE>
-<P>The first line matches the label in the &quot;also=&quot; line, so the indented
- lines are inserted. The net effect is exactly as if the inserted lines
- had occurred in the original file in place of the &quot;also=&quot; line.</P>
-<P>Variables set here are:</P>
-<DL>
-<DT>spi</DT>
-<DD>A number needed by the manual keying code. Any 3-digit hex number
- will do, but if you have more than one manual connection then<STRONG>
- spi must be different</STRONG> for each connection.</DD>
-<DT>esp</DT>
-<DD>Options for<A href="glossary.html#ESP"> ESP</A> (Encapsulated
- Security Payload), the usual IPsec encryption mode. Settings here are
- for<A href="glossary.html#encryption"> encryption</A> using<A href="glossary.html#3DES">
- triple DES</A> and<A href="glossary.html#authentication">
- authentication</A> using<A href="glossary.html#MD5"> MD5</A>. Note that
- encryption without authentication should not be used; it is insecure.</DD>
-<DT>espenkey</DT>
-<DD>Key for ESP encryption. Here, a 192-bit hex number for triple DES.</DD>
-<DT>espauthkey</DT>
-<DD>Key for ESP authentication. Here, a 128-bit hex number for MD5.</DD>
-</DL>
-<P><STRONG>Note</STRONG> that the<STRONG> example keys we supply</STRONG>
- are intended<STRONG> only for testing</STRONG>. For real use, you
- should go to automatic keying. If that is not possible, create your own
- keys for manual mode and keep them secret</P>
-<P>Of course, any files containing keys<STRONG> must</STRONG> have 600
- permissions and be owned by root.</P>
-<P>If you connect in this way to multiple sites, we recommend that you
- keep keys for each site in a separate file and adopt some naming
- convention that lets you pick them all up with a single &quot;include&quot; line.
- This minimizes the risk of losing several keys to one error or attack
- and of accidentally giving another site admin keys which he or she has
- no business knowing.</P>
-<P>Also note that if you have multiple manually keyed connections on a
- single machine, then the<VAR> spi</VAR> parameter must be different for
- each one. Any 3-digit hex number is OK, provided they are different for
- each connection. We reserve the range 0x100 to 0xfff for manual
- connections. Pluto assigns SPIs from 0x1000 up for automatically keyed
- connections.</P>
-<P>If<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A> contains
- keys for manual mode connections, then it too must have permissions<VAR>
- rw-------</VAR>. We recommend instead that, if you must manual keying
- in production, you keep the keys in separate files.</P>
-<P>Note also that<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf</A>
- is installed with permissions<VAR> rw-r--r--</VAR>. If you plan to use
- manually keyed connections for anything more than initial testing, you<B>
- must</B>:</P>
-<UL>
-<LI>either change permissions to<VAR> rw-------</VAR></LI>
-<LI>or store keys separately in secure files and access them via include
- statements in<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf</A>.</LI>
-</UL>
-<P>We recommend the latter method for all but the simplest
- configurations.</P>
-<H3><A name="ranbits">Creating keys with ranbits</A></H3>
-<P>You can create new<A href="glossary.html#random"> random</A> keys
- with the<A href="manpage.d/ipsec_ranbits.8.html"> ranbits(8)</A>
- utility. For example, the commands:</P>
-<PRE>      umask 177
-      ipsec ranbits 192  &gt; temp
-      ipsec ranbits 128 &gt;&gt; temp</PRE>
-<P>create keys in the sizes needed for our default algorithms:</P>
-<UL>
-<LI>192-bit key for<A href="glossary.html#3DES"> 3DES</A> encryption
-<BR> (only 168 bits are used; parity bits are ignored)</LI>
-<LI>128-bit key for keyed<A href="glossary.html#MD5"> MD5</A>
- authentication</LI>
-</UL>
-<P>If you want to use<A href="glossary.html#SHA"> SHA</A> instead of<A href="glossary.html#MD5">
- MD5</A>, that requires a 160-bit key</P>
-<P>Note that any<STRONG> temporary files</STRONG> used must be kept<STRONG>
- secure</STRONG> since they contain keys. That is the reason for the
- umask command above. The temporary file should be deleted as soon as
- you are done with it. You may also want to change the umask back to its
- default value after you are finished working on keys.</P>
-<P>The ranbits utility may pause for a few seconds if not enough entropy
- is available immediately. See ipsec_ranbits(8) and random(4) for
- details. You may wish to provide some activity to feed entropy into the
- system. For example, you might move the mouse around, type random
- characters, or do<VAR> du /usr &gt; /dev/null</VAR> in the background.</P>
-<H2><A name="boot">Setting up connections at boot time</A></H2>
-<P>You can tell the system to set up connections automatically at boot
- time by putting suitable stuff in /etc/ipsec.conf on both systems. The
- relevant section of the file is labelled by a line reading<VAR> config
- setup</VAR>.</P>
-<P>Details can be found in the<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> man page. We also provide a file of<A href="examples">
- example configurations</A>.</P>
-<P>The most likely options are something like:</P>
-<DL>
-<DT>interfaces=&quot;ipsec0=eth0 ipsec1=ppp0&quot;</DT>
-<DD>Tells KLIPS which interfaces to use. Up to four interfaces numbered
- ipsec[0-3] are supported. Each interface can support an arbitrary
- number of tunnels.
-<P>Note that for PPP, you give the ppp[0-9] device name here, not the
- underlying device such as modem (or eth1 if you are using PPPoE).</P>
-</DD>
-<DT>interfaces=%defaultroute</DT>
-<DD>Alternative setting, useful in simple cases. KLIPS will pick up both
- its interface and the next hop information from the settings of the
- Linux default route.</DD>
-<DT>forwardcontrol=no</DT>
-<DD>Normally &quot;no&quot;. Set to &quot;yes&quot; if the IP forwarding option is disabled
- in your network configuration. (This can be set as a kernel
- configuration option or later. e.g. on Redhat, it's in
- /etc/sysconfig/network and on SuSE you can adjust it with Yast.) Linux
- FreeS/WAN will then enable forwarding when starting up and turn it off
- when going down. This is used to ensure that no packets will be
- forwarded before IPsec comes up and takes control.</DD>
-<DT>syslog=daemon.error</DT>
-<DD>Used in messages to the system logging daemon (syslogd) to specify
- what type of software is sending the messages. If the settings are
- &quot;daemon.error&quot; as in our example, then syslogd treats the messages as
- error messages from a daemon.
-<P>Note that<A href="glossary.html#Pluto"> Pluto</A> does not currently
- pay attention to this variable. The variable controls setup messages
- only.</P>
-</DD>
-<DT>klipsdebug=</DT>
-<DD>Debug settings for<A href="glossary.html#KLIPS"> KLIPS</A>.</DD>
-<DT>plutodebug=</DT>
-<DD>Debug settings for<A href="glossary.html#Pluto"> Pluto</A>.</DD>
-<DT>... for both the above DEBUG settings</DT>
-<DD>Normally, leave empty as shown above for no debugging output.
-<BR> Use &quot;all&quot; for maximum information.
-<BR> See ipsec_klipsdebug(8) and ipsec_pluto(8) man page for other
- options. Beware that if you set /etc/ipsec.conf to enable debug output,
- your system's log files may get large quickly.</DD>
-<DT>dumpdir=/safe/directory</DT>
-<DD>Normally, programs started by ipsec setup don't crash. If they do,
- by default, no core dump will be produced because such dumps would
- contain secrets. If you find you need to debug such crashes, you can
- set dumpdir to the name of a directory in which to collect the core
- file.</DD>
-<DT>manualstart=</DT>
-<DD>List of manually keyed connections to be automatically started at
- boot time. Useful for testing, but not for long term use. Connections
- which are automatically started should also be automatically re-keyed.</DD>
-<DT>pluto=yes</DT>
-<DD>Whether to start<A href="glossary.html#Pluto"> Pluto</A> when ipsec
- startup is done.
-<BR> This parameter is optional and defaults to &quot;yes&quot; if not present.
-<P>&quot;yes&quot; is strongly recommended for production use so that the keying
- daemon (Pluto) will automatically re-key the connections regularly. The
- ipsec-auto parameters ikelifetime, ipseclifetime and reykeywindow give
- you control over frequency of rekeying.</P>
-</DD>
-<DT>plutoload=&quot;reno-van reno-adam reno-nyc&quot;</DT>
-<DD>List of tunnels (by name, e.g. fred-susan or reno-van in our
- examples) to be loaded into Pluto's internal database at startup. In
- this example, Pluto loads three tunnels into its database when it is
- started.
-<P>If plutoload is &quot;%search&quot;, Pluto will load any connections whose
- description includes &quot;auto=add&quot; or &quot;auto=start&quot;.</P>
-</DD>
-<DT>plutostart=&quot;reno-van reno-adam reno-nyc&quot;</DT>
-<DD>List of tunnels to attempt to negotiate when Pluto is started.
-<P>If plutostart is &quot;%search&quot;, Pluto will start any connections whose
- description includes &quot;auto=start&quot;.</P>
-<P>Note that, for a connection intended to be permanent,<STRONG> both
- gateways should be set try to start</STRONG> the tunnel. This allows
- quick recovery if either gateway is rebooted or has its IPsec
- restarted. If only one gateway is set to start the tunnel and the other
- gateway restarts, the tunnel may not be rebuilt.</P>
-</DD>
-<DT>plutowait=no</DT>
-<DD>Controls whether Pluto waits for one tunnel to be established before
- starting to negotiate the next. You might set this to &quot;yes&quot;
-<UL>
-<LI>if your gateway is a very limited machine and you need to conserve
- resources.</LI>
-<LI>for debugging; the logs are clearer if only one connection is
- brought up at a time</LI>
-</UL>
- For a busy and resource-laden production gateway, you likely want &quot;no&quot;
- so that connections are brought up in parallel and the whole process
- takes less time.</DD>
-</DL>
-<P>The example assumes you are at the Reno office and will use IPsec to
- Vancouver, New York City and Amsterdam.</P>
-<H2><A name="multitunnel">Multiple tunnels between the same two gateways</A>
-</H2>
-<P>Consider a pair of subnets, each with a security gateway, connected
- via the Internet:</P>
-<PRE>         192.168.100.0/24           left subnet
-              |
-         192.168.100.1
-         North Gateway
-         101.101.101.101            left
-              |
-         101.101.101.1              left next hop
-         [Internet]
-         202.202.202.1              right next hop
-              |
-         202.202.202.202            right
-         South gateway
-         192.168.200.1
-              |
-         192.168.200.0/24           right subnet</PRE>
-<P>A tunnel specification such as:</P>
-<PRE>conn northnet-southnet
-      left=101.101.101.101
-      leftnexthop=101.101.101.1
-      leftsubnet=192.168.100.0/24
-      leftfirewall=yes
-      right=202.202.202.202
-      rightnexthop=202.202.202.1
-      rightsubnet=192.168.200.0/24
-      rightfirewall=yes</PRE>
- will allow machines on the two subnets to talk to each other. You might
- test this by pinging from polarbear (192.168.100.7) to penguin
- (192.168.200.5).
-<P>However,<STRONG> this does not cover other traffic you might want to
- secure</STRONG>. To handle all the possibilities, you might also want
- these connection descriptions:</P>
-<PRE>conn northgate-southnet
-      left=101.101.101.101
-      leftnexthop=101.101.101.1
-      right=202.202.202.202
-      rightnexthop=202.202.202.1
-      rightsubnet=192.168.200.0/24
-      rightfirewall=yes
-
-conn northnet-southgate
-      left=101.101.101.101
-      leftnexthop=101.101.101.1
-      leftsubnet=192.168.100.0/24
-      leftfirewall=yes
-      right=202.202.202.202
-      rightnexthop=202.202.202.1</PRE>
-<P>Without these, neither gateway can do IPsec to the remote subnet.
- There is no IPsec tunnel or eroute set up for the traffic.</P>
-<P>In our example, with the non-routable 192.168.* addresses used,
- packets would simply be discarded. In a different configuration, with
- routable addresses for the remote subnet,<STRONG> they would be sent
- unencrypted</STRONG> since there would be no IPsec eroute and there
- would be a normal IP route.</P>
-<P>You might also want:</P>
-<PRE>conn northgate-southgate
-      left=101.101.101.101
-      leftnexthop=101.101.101.1
-      right=202.202.202.202
-      rightnexthop=202.202.202.1</PRE>
-<P>This is required if you want the two gateways to speak IPsec to each
- other.</P>
-<P>This requires a lot of duplication of details. Judicious use of<VAR>
- also=</VAR> and<VAR> include</VAR> can reduce this problem.</P>
-<P>Note that, while FreeS/WAN supports all four tunnel types, not all
- implementations do. In particular, some versions of Windows 2000 and
- the freely downloadable version of PGP provide only &quot;client&quot;
- functionality. You cannot use them as gateways with a subnet behind
- them. To get that functionality, you must upgrade to Windows 2000
- server or the commercially available PGP products.</P>
-<H3><A name="advroute">One tunnel plus advanced routing</A></H3>
- It is also possible to use the new routing features in 2.2 and later
- kernels to avoid most needs for multple tunnels. Here is one mailing
- list message on the topic:
-<PRE>Subject: Re: linux-ipsec: IPSec packets not entering tunnel?
-   Date: Mon, 20 Nov 2000
-   From: Justin Guyett &lt;jfg@sonicity.com&gt;
-
-On Mon, 20 Nov 2000, Claudia Schmeing wrote:
-
-&gt; Right                                                         Left
-&gt;                      &quot;home&quot;                &quot;office&quot;
-&gt; 10.92.10.0/24 ---- 24.93.85.110 ========= 216.175.164.91 ---- 10.91.10.24/24
-&gt;
-&gt; I've created all four tunnels, and can ping to test each of them,
-&gt; *except* homegate-officenet.
-
-I keep wondering why people create all four tunnels.  Why not route
-traffic generated from home to 10.91.10.24/24 out ipsec0 with iproute2?
-And 99% of the time you don't need to access &quot;office&quot; directly, which
-means you can eliminate all but the subnet&lt;-&gt;subnet connection.</PRE>
- and FreeS/WAN technical lead Henry Spencer's comment:
-<PRE>&gt; I keep wondering why people create all four tunnels.  Why not route
-&gt; traffic generated from home to 10.91.10.24/24 out ipsec0 with iproute2?
-
-This is feasible, given some iproute2 attention to source addresses, but
-it isn't something we've documented yet... (partly because we're still
-making some attempt to support 2.0.xx kernels, which can't do this, but
-mostly because we haven't caught up with it yet).
-
-&gt; And 99% of the time you don't need to access &quot;office&quot; directly, which
-&gt; means you can eliminate all but the subnet&lt;-&gt;subnet connection.
-
-Correct in principle, but people will keep trying to ping to or from the
-gateways during testing, and sometimes they want to run services on the
-gateway machines too.</PRE>
-
-<!-- Is this in the right spot in this document? -->
-<H2><A name="opp.gate">An Opportunistic Gateway</A></H2>
-<H3><A NAME="14_7_1">Start from full opportunism</A></H3>
-<P>Full opportunism allows you to initiate and receive opportunistic
- connections on your machine. The remaining instructions in this section
- assume you have first set up full opportunism on your gateway using<A HREF="quickstart.html#opp.incoming">
- these instructions</A>. Both sets of instructions require mailing DNS
- records to your ISP. Collect DNS records for both the gateway (above)
- and the subnet nodes (below) before contacting your ISP.</P>
-<H3><A NAME="14_7_2">Reverse DNS TXT records for each protected machine</A>
-</H3>
-<P>You need these so that your Opportunistic peers can:</P>
-<UL>
-<LI>discover the gateway's address, knowing only the IP address that
- packets are bound for</LI>
-<LI>verify that the gateway is authorised to encrypt for that endpoint</LI>
-</UL>
-<P>On the gateway, generate a TXT record with:</P>
-<PRE>    ipsec showhostkey --txt 192.0.2.11</PRE>
-<P>Use your gateway address in place of 192.0.2.11.</P>
-<P>You should see (keys are trimmed for clarity throughout our example):</P>
-<PRE>    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;</PRE>
-<P><B>This MUST BE the same key as in your gateway's TXT record, or
- nothing will work.</B></P>
-<P>In a text file, make one copy of this TXT record for each subnet
- node:</P>
-<PRE>    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;
-                                                                                
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;
-                                                                                
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;</PRE>
-<P>Above each entry, insert a line like this:</P>
-<PRE>    98.2.0.192.in-addr.arpa. IN PTR arthur.example.com.</PRE>
-<P>It must include:</P>
-<UL>
-<LI>The subnet node's address in reverse map format. For example,
- 192.0.2.120 becomes<VAR> 120.2.0.192.in-addr.arpa.</VAR>. Note the
- final period.</LI>
-<LI><VAR>IN PTR</VAR></LI>
-<LI>The node's name, ie.<VAR> arthur.example.com.</VAR>. Note the final
- period.</LI>
-</UL>
-<P>The result will be a file of TXT records, like this:</P>
-<PRE>    98.2.0.192.in-addr.arpa. IN PTR arthur.example.com.
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;
-                                                                                
-    99.2.0.192.in-addr.arpa. IN PTR ford.example.com.
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;
-                                                                                
-    100.2.0.192.in-addr.arpa. IN PTR trillian.example.com.
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;</PRE>
-<H3><A NAME="14_7_3">Publish your records</A></H3>
-<P>Ask your ISP to publish all the reverse DNS records you have
- collected. There may be a delay of up to 48 hours as the records
- propagate.</P>
-<H3><A NAME="14_7_4">...and test them</A></H3>
-<P>Check a couple of records with commands like this one:</P>
-<PRE>    ipsec verify --host ford.example.com
-    ipsec verify --host trillian.example.com</PRE>
-<P>The<VAR> verify</VAR> command checks for TXT records for both the
- subnet host and its gateway. You should see output like:</P>
-<PRE>    ...
-    Looking for TXT in reverse map: 99.2.0.192.in-addr.arpa [OK]
-    ...
-    Looking for TXT in reverse map: 11.2.0.192.in-addr.arpa   [OK]
-    ...
-    Looking for TXT in reverse map: 100.2.0.192.in-addr.arpa [OK]
-    ...
-    Looking for TXT in reverse map: 11.2.0.192.in-addr.arpa   [OK]
-    ...</PRE>
-<H3><A NAME="14_7_5">No Configuration Needed</A></H3>
-<P>FreeS/WAN 2.x ships with a built-in, automatically enabled OE
- connection<VAR> conn packetdefault</VAR> which applies OE, if possible,
- to all outbound traffic routed through the FreeS/WAN box. The<A HREF="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5) manual</A> describes this connection in detail. While the
- effect is much the same as<VAR> private-or-clear</VAR>, the
- implementation is different: notably, it does not use policy groups.</P>
-<P>You can create more complex OE configurations for traffic forwarded
- through a FreeS/WAN box, as explained in our<A HREF="policygroups.html#policygroups">
- policy groups document</A>, or disable OE using<A HREF="policygroups.html#disable_policygroups">
- these instructions</A>.</P>
-<H2><A name="extruded.config">Extruded Subnets</A></H2>
-<P>What we call<A href="glossary.html#extruded"> extruded subnets</A>
- are a special case of<A href="glossary.html#VPN.gloss"> VPNs</A>.</P>
-<P>If your buddy has some unused IP addresses, in his subnet far off at
- the other side of the Internet, he can loan them to you... provided
- that the connection between you and him is fast enough to carry all the
- traffic between your machines and the rest of the Internet. In effect,
- he &quot;extrudes&quot; a part of his address space over the network to you, with
- your Internet traffic appearing to originate from behind his Internet
- gateway.</P>
-<P>As far as the Internet is concerned, your new extruded net is behind
- your buddy's gateway. You route all your packets for the Internet at
- large out his gateway, and receive return packets the same way. You
- route your local packets locally.</P>
-<P>Suppose your friend has a.b.c.0/24 and wants to give you
- a.b.c.240/28. The initial situation is:</P>
-<PRE>    subnet           gateway          Internet
-  a.b.c.0/24    a.b.c.1    p.q.r.s</PRE>
- where anything from the Internet destined for any machine in a.b.c.0/24
- is routed via p.q.r.s and that gateway knows what to do from there.
-<P>Of course it is quite normal for various smaller subnets to exist
- behind your friend's gateway. For example, your friend's company might
- have a.b.c.16/28=development, a.b.c.32/28=marketing and so on. The
- Internet neither knows not cares about this; it just delivers packets
- to the p.q.r.s and lets the gateway do whatever needs to be done from
- there.</P>
-<P>What we want to do is take a subnet, perhaps a.b.c.240/28, out of
- your friend's physical location<EM> while still having your friend's
- gateway route to it</EM>. As far as the Internet is concerned, you
- remain behind that gateway.</P>
-<PRE>    subnet           gateway          Internet       your gate  extruded
-
-  a.b.c.0/24   a.b.c.1     p.q.r.s              d.e.f.g         a.b.c.240/28                
-
-                           ========== tunnel ==========</PRE>
-<P>The extruded addresses have to be a complete subnet.</P>
-<P>In our example, the friend's security gateway is also his Internet
- gateway, but this is not necessary. As long as all traffic from the
- Internet to his addresses passes through the Internet gate, the
- security gate could be a machine behind that. The IG would need to
- route all traffic for the extruded subnet to the SG, and the SG could
- handle the rest.</P>
-<P>First, configure your subnet using the extruded addresses. Your
- security gateway's interface to your subnet needs to have an extruded
- address (possibly using a Linux<A href="glossary.html#virtual"> virtual
- interface</A>, if it also has to have a different address). Your
- gateway needs to have a route to the extruded subnet, pointing to that
- interface. The other machines at your site need to have addresses in
- that subnet, and default routes pointing to your gateway.</P>
-<P>If any of your friend's machines need to talk to the extruded subnet,<EM>
- they</EM> need to have a route for the extruded subnet, pointing at his
- gateway.</P>
-<P>Then set up an IPsec subnet-to-subnet tunnel between your gateway and
- his, with your subnet specified as the extruded subnet, and his subnet
- specified as &quot;0.0.0.0/0&quot;.</P>
-<P>The tunnel description should be:</P>
-<PRE>conn extruded
-        left=p.q.r.s
-        leftsubnet=0.0.0.0/0
-        right=d.e.f.g
-        rightsubnet=a.b.c.0/28</PRE>
-<P>If either side was doing firewalling for the extruded subnet before
- the IPsec connection is set up, you'll need to poke holes in your<A HREF="firewall.html#firewall">
- firewall</A> to allow packets through.</P>
-<P>And it all just works. Your SG routes traffic for 0.0.0.0/0 -- that
- is, the whole Internet -- through the tunnel to his SG, which then
- sends it onward as if it came from his subnet. When traffic for the
- extruded subnet arrives at his SG, it gets sent through the tunnel to
- your SG, which passes it to the right machine.</P>
-<P>Remember that when ipsec_manual or ipsec_auto takes a connection
- down, it<EM> does not undo the route</EM> it made for that connection.
- This lets you take a connection down and bring up a new one, or a
- modified version of the old one, without having to rebuild the route it
- uses and without any risk of packets which should use IPsec
- accidentally going out in the clear. Because the route always points
- into KLIPS, the packets will always go there. Because KLIPS temporarily
- has no idea what to do with them (no eroute for them), they will be
- discarded.</P>
-<P>If you<EM> do</EM> want to take the route down, this is what the
- &quot;unroute&quot; operation in manual and auto is for. Just do an unroute after
- doing the down.</P>
-<P>Note that the route for a connection may have replaced an existing
- non-IPsec route. Nothing in Linux FreeS/WAN will put that pre-IPsec
- route back. If you need it back, you have to create it with the route
- command.</P>
-<H2><A name="roadvirt">Road Warrior with virtual IP address</A></H2>
-<P>Please note that<A HREF="http://www.freeswan.ca/download.php"> Super
- FreeS/WAN</A> now features DHCP-over-IPsec, which is an alternate
- procedure for Virtual IP address assignment.</P>
-<P></P>
-<P>Here is a mailing list message about another way to configure for
- road warrior support:</P>
-<PRE>Subject: Re: linux-ipsec: understanding the vpn
-   Date: Thu, 28 Oct 1999 10:43:22 -0400
-   From: Irving Reid &lt;irving@nevex.com&gt;
-
-&gt;  local-------linux------internet------mobile
-&gt;  LAN        box                         user
-&gt;  ...
-
-&gt;  now when the mobile user connects to the linux box
-&gt;  it is given a virtual IP address, i have configured it to
-&gt;  be in the 10.x.x.x range. mobile user and linux box 
-&gt;  have a tunnel between them with these IP addresses.
-
-&gt;   Uptil this all is fine.
-
-If it is possible to configure your mobile client software *not* to
-use a virtual IP address, that will make your life easier. It is easier
-to configure FreeS/WAN to use the actual address the mobile user gets
-from its ISP.
-
-Unfortunately, some Windows clients don't let you choose.
-
-&gt;  what i would like to know is that how does the mobile
-&gt;  user communicate with other computers on the local
-&gt;  LAN , of course with the vpn ?
-
-&gt;   what IP address should the local LAN 
-&gt;  computers have ? I guess their default gateway 
-&gt;  should be the linux box ? and does the linux box need
-&gt;  to be a 2 NIC card box or one is fine.
-
-As someone else stated, yes, the Linux box would usually be the default
-IP gateway for the local lan.
-
-However...
-
-If you mobile user has software that *must* use a virtual IP address,
-the whole picture changes. Nobody has put much effort into getting
-FreeS/WAN to play well in this environment, but here's a sketch of one
-approach:
-
-Local Lan 1.0.0.0/24
-    |
-    +- Linux FreeS/WAN 1.0.0.2
-    |
-    | 1.0.0.1
- Router
-    | 2.0.0.1
-    |
-Internet
-    |
-    | 3.0.0.1
-Mobile User
-      Virtual Address: 1.0.0.3
-
-Note that the Local Lan network (1.0.0.x) can be registered, routable
-addresses.
-
-Now, the Mobile User sets up an IPSec security association with the
-Linux box (1.0.0.2); it should ESP encapsulate all traffic to the
-network 1.0.0.x **EXCEPT** UDP port 500. 500/udp is required for the key
-negotiation, which needs to work outside of the IPSec tunnel.
-
-On the Linux side, there's a bunch of stuff you need to do by hand (for
-now). FreeS/WAN should correctly handle setting up the IPSec SA and
-routes, but I haven't tested it so this may not work...
-
-The FreeS/WAN conn should look like:
-
-conn mobile
-        right=1.0.0.2
-        rightsubnet=1.0.0.0/24
-        rightnexthop=1.0.0.1
-        left=0.0.0.0  # The infamous &quot;road warrior&quot;
-        leftsubnet=1.0.0.3/32
-
-Note that the left subnet contains *only* the remote host's virtual
-address.
-
-Hopefully the routing table on the FreeS/WAN box ends up looking like
-this:
-
-% netstat -rn
-Kernel IP routing table
-Destination     Gateway      Genmask         Flags   MSS Window  irtt Iface
-1.0.0.0         0.0.0.0      255.255.255.0   U      1500 0          0 eth0
-127.0.0.0       0.0.0.0      255.0.0.0       U      3584 0          0 lo
-0.0.0.0         1.0.0.1      0.0.0.0         UG     1500 0          0 eth0
-1.0.0.3         1.0.0.1      255.255.255.255 UG     1433 0          0 ipsec0
-
-So, if anybody sends a packet for 1.0.0.3 to the Linux box, it should
-get bundled up and sent through the tunnel. To get the packets for
-1.0.0.3 to the Linux box in the first place, you need to use &quot;proxy
-ARP&quot;.
-
-How this works is: when a host or router on the local Ethernet segment
-wants to send a packet to 1.0.0.3, it sends out an Ethernet level
-broadcast &quot;ARP request&quot;. If 1.0.0.3 was on the local LAN, it would
-reply, saying &quot;send IP packets for 1.0.0.3 to my Ethernet address&quot;.
-
-Instead, you need to set up the Linux box so that _it_ answers ARP
-requests for 1.0.0.3, even though that isn't its IP address. That
-convinces everyone else on the lan to send 1.0.0.3 packets to the Linux
-box, where the usual FreeS/WAN processing and routing take over.
-
-% arp -i eth0 -s 1.0.0.3 -D eth0 pub
-
-This says, if you see an ARP request on interface eth0 asking for
-1.0.0.3, respond with the Ethernet address of interface eth0.
-
-Now, as I said at the very beginning, if it is *at all* possible to
-configure your client *not* to use the virtual IP address, you can avoid
-this whole mess.</PRE>
-<H2><A name="dynamic">Dynamic Network Interfaces</A></H2>
-<P>Sometimes you have to cope with a situation where the network
- interface(s) aren't all there at boot. The common example is notebooks
- with PCMCIA.</P>
-<H3><A name="basicdyn">Basics</A></H3>
-<P>The key issue here is that the<VAR> config setup</VAR> section of the<VAR>
- /etc/ipsec.conf</VAR> configuration file lists the connection between
- ipsecN and hardware interfaces, in the<VAR> interfaces=</VAR> variable.
- At any time when<VAR> ipsec setup start</VAR> or<VAR> ipsec setup
- restart</VAR> is run this variable<STRONG> must</STRONG> correspond to
- the current real situation. More precisely, it<STRONG> must not</STRONG>
- mention any hardware interfaces which don't currently exist. The
- difficulty is that an<VAR> ipsec setup start</VAR> command is normally
- run at boot time so interfaces that are not up then are mis-handled.</P>
-<H3><A name="bootdyn">Boot Time</A></H3>
-<P>Normally, an<VAR> ipsec setup start</VAR> is run at boot time.
- However, if the hardware situation at boot time is uncertain, one of
- two things must be done.</P>
-<UL>
-<LI>One possibility is simply not to have IPsec brought up at boot time.
- To do this:
-<PRE>        chkconfig --level 2345 ipsec off</PRE>
- That's for modern Red Hats or other Linuxes with chkconfig. Systems
- which lack this will require fiddling with symlinks in /etc/rc.d/rc?.d
- or the equivalent.</LI>
-<LI>Another possibility is to bring IPsec up with no interfaces, which
- is less aesthetically satisfying but simpler. Just put
-<PRE>        interfaces=</PRE>
- in the configuration file. KLIPS and Pluto will be started, but won't
- do anything.</LI>
-</UL>
-<H3><A name="changedyn">Change Time</A></H3>
-<P>When the hardware *is* in place, IPsec has to be made aware of it.
- Someday there may be a nice way to do this.</P>
-<P>Right now, the way to do it is to fix the<VAR> /etc/ipsec.conf</VAR>
- file appropriately, so<VAR> interfaces</VAR> reflects the new
- situation, and then restart the IPsec subsystem. This does break any
- existing IPsec connections.</P>
-<P>If IPsec wasn't brought up at boot time, do</P>
-<PRE>        ipsec setup start</PRE>
- while if it was, do
-<PRE>        ipsec setup restart</PRE>
- which won't be as quick.
-<P>If some of the hardware is to be taken out, before doing that, amend
- the configuration file so interfaces no longer includes it, and do</P>
-<PRE>        ipsec setup restart</PRE>
-<P>Again, this breaks any existing connections.</P>
-<H2><A name="unencrypted">Unencrypted tunnels</A></H2>
-<P>Sometimes you might want to create a tunnel without encryption. Often
- this is a bad idea, even if you have some data which need not be
- private. See this<A href="ipsec.html#traffic.resist"> discussion</A>.</P>
-<P>The IPsec protocols provide two ways to do build such tunnels:</P>
-<DL>
-<DT>using ESP with null encryption</DT>
-<DD>not supported by FreeS/WAN</DD>
-<DT>using<A href="glossary.html#AH"> AH</A> without<A href="glossary.html#ESP">
- ESP</A></DT>
-<DD>supported for manually keyed connections</DD>
-<DD>possible with explicit commands via<A href="manpage.d/ipsec_whack.8.html">
- ipsec_whack(8)</A> (see this<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00190.html">
- list message</A>)</DD>
-<DD>not supported in the<A href="manpage.d/ipsec_auto.8.html">
- ipsec_auto(8)</A> scripts.</DD>
-</DL>
- One situation in which this comes up is when otherwise some data would
- be encrypted twice. Alice wants a secure tunnel from her machine to
- Bob's. Since she's behind one security gateway and he's behind another,
- part of the tunnel that they build passes through the tunnel that their
- site admins have built between the gateways. All of Alice and Bob's
- messages are encrypted twice.
-<P>There are several ways to handle this.</P>
-<UL>
-<LI>Just accept the overhead of double encryption. The site admins might
- choose this if any of the following apply:
-<UL>
-<LI>policy says encrypt everything (usually, it should)</LI>
-<LI>they don't entirely trust Alice and Bob (usually, if they don't have
- to, they shouldn't)</LI>
-<LI>if they don't feel the saved cycles are worth the time they'd need
- to build a non-encrypted tunnel for Alice and Bob's packets (often,
- they aren't)</LI>
-</UL>
-</LI>
-<LI>Use a plain IP-in-IP tunnel. These are not well documented. A good
- starting point is in the Linux kernel source tree, in
- /usr/src/linux/drivers/net/README.tunnel.</LI>
-<LI>Use a manually-keyed AH-only tunnel.</LI>
-</UL>
-<P>Note that if Alice and Bob want end-to-end security, they must build
- a tunnel end-to-end between their machines or use some other end-to-end
- tool such as PGP or SSL that suits their data. The only question is
- whether the admins build some special unencrypted tunnel for those
- already-encrypted packets.</P>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="kernel.html">Previous</A>
-<A HREF="install.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/background.html b/doc/background.html
deleted file mode 100644
index 8f24cad4a..000000000
--- a/doc/background.html
+++ /dev/null
@@ -1,323 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="config.html">Previous</A>
-<A HREF="user_examples.html">Next</A>
-<HR>
-<H1><A name="background">Linux FreeS/WAN background</A></H1>
-<P>This section discusses a number of issues which have three things in
- common:</P>
-<UL>
-<LI>They are not specifically FreeS/WAN problems</LI>
-<LI>You may have to understand them to get FreeS/WAN working right</LI>
-<LI>They are not simple questions</LI>
-</UL>
-<P>Grouping them here lets us provide the explanations some users will
- need without unduly complicating the main text.</P>
-<P>The explanations here are intended to be adequate for FreeS/WAN
- purposes (please comment to the<A href="mail.html"> users mailing list</A>
- if you don't find them so), but they are not trying to be complete or
- definitive. If you need more information, see the references provided
- in each section.</P>
-<H2><A name="dns.background">Some DNS background</A></H2>
-<P><A href="glossary.html#carpediem">Opportunistic encryption</A>
- requires that the gateway systems be able to fetch public keys, and
- other IPsec-related information, from each other's DNS (Domain Name
- Service) records.</P>
-<P><A href="glossary.html#DNS">DNS</A> is a distributed database that
- maps names to IP addresses and vice versa.</P>
-<P>Much good reference material is available for DNS, including:</P>
-<UL>
-<LI>the<A href="http://www.linuxdoc.org/HOWTO/DNS-HOWTO.html"> DNS HowTo</A>
-</LI>
-<LI>the standard<A href="biblio.html#DNS.book"> DNS reference</A> book</LI>
-<LI><A href="http://www.linuxdoc.org/LDP/nag2/index.html">Linux Network
- Administrator's Guide</A></LI>
-<LI><A href="http://www.nominum.com/resources/whitepapers/bind-white-paper.html">
-BIND overview</A></LI>
-<LI><A href="http://www.nominum.com/resources/documentation/Bv9ARM.pdf">
-BIND 9 Administrator's Reference</A></LI>
-</UL>
-<P>We give only a brief overview here, intended to help you use DNS for
- FreeS/WAN purposes.</P>
-<H3><A name="forward.reverse">Forward and reverse maps</A></H3>
-<P>Although the implementation is distributed, it is often useful to
- speak of DNS as if it were just two enormous tables:</P>
-<UL>
-<LI>the forward map: look up a name, get an IP address</LI>
-<LI>the reverse map: look up an IP address, get a name</LI>
-</UL>
-<P>Both maps can optionally contain additional data. For opportunistic
- encryption, we insert the data need for IPsec authentication.</P>
-<P>A system named gateway.example.com with IP address 10.20.30.40 should
- have at least two DNS records, one in each map:</P>
-<DL>
-<DT>gateway.example.com. IN A 10.20.30.40</DT>
-<DD>used to look up the name and get an IP address</DD>
-<DT>40.30.20.10.in-addr.arpa. IN PTR gateway.example.com.</DT>
-<DD>used for reverse lookups, looking up an address to get the
- associated name. Notice that the digits here are in reverse order; the
- actual address is 10.20.30.40 but we use 40.30.20.10 here.</DD>
-</DL>
-<H3><A NAME="17_1_2">Hierarchy and delegation</A></H3>
-<P>For both maps there is a hierarchy of DNS servers and a system of
- delegating authority so that, for example:</P>
-<UL>
-<LI>the DNS administrator for example.com can create entries of the form<VAR>
- name</VAR>.example.com</LI>
-<LI>the example.com admin cannot create an entry for counterexample.com;
- only someone with authority for .com can do that</LI>
-<LI>an admin might have authority for 20.10.in-addr.arpa.</LI>
-<LI>in either map, authority can be delegated
-<UL>
-<LI>the example.com admin could give you authority for
- westcoast.example.com</LI>
-<LI>the 20.10.in-addr.arpa admin could give you authority for
- 30.20.10.in-addr.arpa</LI>
-</UL>
-</LI>
-</UL>
-<P>DNS zones are the units of delegation. There is a hierarchy of zones.</P>
-<H3><A NAME="17_1_3">Syntax of DNS records</A></H3>
-<P>Returning to the example records:</P>
-<PRE>        gateway.example.com. IN A 10.20.30.40
-        40.30.20.10.in-addr.arpa. IN PTR gateway.example.com.</PRE>
-<P>some syntactic details are:</P>
-<UL>
-<LI>the IN indicates that these records are for<STRONG> In</STRONG>
-ternet addresses</LI>
-<LI>The final periods in '.com.' and '.arpa.' are required. They
- indicate the root of the domain name system.</LI>
-</UL>
-<P>The capitalised strings after IN indicate the type of record.
- Possible types include:</P>
-<UL>
-<LI><STRONG>A</STRONG>ddress, for forward lookups</LI>
-<LI><STRONG>P</STRONG>oin<STRONG>T</STRONG>e<STRONG>R</STRONG>, for
- reverse lookups</LI>
-<LI><STRONG>C</STRONG>anonical<STRONG> NAME</STRONG>, records to support
- aliasing, multiple names for one address</LI>
-<LI><STRONG>M</STRONG>ail e<STRONG>X</STRONG>change, used in mail
- routing</LI>
-<LI><STRONG>SIG</STRONG>nature, used in<A href="glossary.html#SDNS">
- secure DNS</A></LI>
-<LI><STRONG>KEY</STRONG>, used in<A href="glossary.html#SDNS"> secure
- DNS</A></LI>
-<LI><STRONG>T</STRONG>e<STRONG>XT</STRONG>, a multi-purpose record type</LI>
-</UL>
-<P>To set up for opportunistic encryption, you add some TXT records to
- your DNS data. Details are in our<A href="quickstart.html"> quickstart</A>
- document.</P>
-<H3><A NAME="17_1_4">Cacheing, TTL and propagation delay</A></H3>
-<P>DNS information is extensively cached. With no caching, a lookup by
- your system of &quot;www.freeswan.org&quot; might involve:</P>
-<UL>
-<LI>your system asks your nameserver for &quot;www.freeswan.org&quot;</LI>
-<LI>local nameserver asks root server about &quot;.org&quot;, gets reply</LI>
-<LI>local nameserver asks .org nameserver about &quot;freeswan.org&quot;, gets
- reply</LI>
-<LI>local nameserver asks freeswan.org nameserver about
- &quot;www.freeswan.org&quot;, gets reply</LI>
-</UL>
-<P>However, this can be a bit inefficient. For example, if you are in
- the Phillipines, the closest a root server is in Japan. That might send
- you to a .org server in the US, and then to freeswan.org in Holland. If
- everyone did all those lookups every time they clicked on a web link,
- the net would grind to a halt.</P>
-<P>Nameservers therefore cache information they look up. When you click
- on another link at www.freeswan.org, your local nameserver has the IP
- address for that server in its cache, and no further lookups are
- required.</P>
-<P>Intermediate results are also cached. If you next go to
- lists.freeswan.org, your nameserver can just ask the freeswan.org
- nameserver for that address; it does not need to query the root or .org
- nameservers because it has a cached address for the freeswan.org zone
- server.</P>
-<P>Of course, like any cacheing mechanism, this can create problems of
- consistency. What if the administrator for freeswan.org changes the IP
- address, or the authentication key, for www.freeswan.org? If you use
- old information from the cache, you may get it wrong. On the other
- hand, you cannot afford to look up fresh information every time. Nor
- can you expect the freeswan.org server to notify you; that isn't in the
- protocols.</P>
-<P>The solution that is in the protocols is fairly simple. Cacheable
- records are marked with Time To Live (TTL) information. When the time
- expires, the caching server discards the record. The next time someone
- asks for it, the server fetches a fresh copy. Of course, a server may
- also discard records before their TTL expires if it is running out of
- cache space.</P>
-<P>This implies that there will be some delay before the new version of
- a changed record propagates around the net. Until the TTLs on all
- copies of the old record expire, some users will see it because that is
- what is in their cache. Other users may see the new record immediately
- because they don't have an old one cached.</P>
-<H2><A name="MTU.trouble">Problems with packet fragmentation</A></H2>
-<P>It seems, from mailing list reports, to be moderately common for
- problems to crop up in which small packets pass through the IPsec
- tunnels just fine but larger packets fail.</P>
-<P>These problems are caused by various devices along the way
- mis-handling either packet fragments or<A href="glossary.html#pathMTU">
- path MTU discovery</A>.</P>
-<P>IPsec makes packets larger by adding an ESP or AH header. This can
- tickle assorted bugs in fragment handling in routers and firewalls, or
- in path MTU discovery mechanisms, and cause a variety of symptoms which
- are both annoying and, often, quite hard to diagnose.</P>
-<P>An explanation from project technical lead Henry Spencer:</P>
-<PRE>The problem is IP fragmentation; more precisely, the problem is that the
-second, third, etc. fragments of an IP packet are often difficult for
-filtering mechanisms to classify.
-
-Routers cannot rely on reassembling the packet, or remembering what was in
-earlier fragments, because the fragments may be out of order or may even
-follow different routes.  So any general, worst-case filtering decision
-pretty much has to be made on each fragment independently.  (If the router
-knows that it is the only route to the destination, so all fragments
-*must* pass through it, reassembly would be possible... but most routers
-don't want to bother with the complications of that.)
-
-All fragments carry roughly the original IP header, but any higher-level
-header is (for IP purposes) just the first part of the packet data... so
-only the first fragment carries that.  So, for example, on examining the
-second fragment of a TCP packet, you could tell that it's TCP, but not
-what port number it is destined for -- that information is in the TCP
-header, which appears in the first fragment only. 
-
-The result of this classification difficulty is that stupid routers and
-over-paranoid firewalls may just throw fragments away.  To get through
-them, you must reduce your MTU enough that fragmentation will not occur.
-(In some cases, they might be willing to attempt reassembly, but have very
-limited resources to devote to it, meaning that packets must be small and
-fragments few in number, leading to the same conclusion:  smaller MTU.)</PRE>
-<P>In addition to the problem Henry describes, you may also have trouble
- with<A href="glossary.html#pathMTU"> path MTU discovery</A>.</P>
-<P>By default, FreeS/WAN uses a large<A href="glossary.html#MTU"> MTU</A>
- for the ipsec device. This avoids some problems, but may complicate
- others. Here's an explanation from Claudia:</P>
-<PRE>Here are a couple of pieces of background information. Apologies if you
-have seen these already. An excerpt from one of my old posts:
-
-    An MTU of 16260 on ipsec0 is usual. The IPSec device defaults to this 
-    high MTU so that it does not fragment incoming packets before encryption 
-    and encapsulation. If after IPSec processing packets are larger than 1500,
-    [ie. the mtu of eth0] then eth0 will fragment them. 
-
-    Adding IPSec headers adds a certain number of bytes to each packet. 
-    The MTU of the IPSec interface refers to the maximum size of the packet
-    before the IPSec headers are added. In some cases, people find it helpful 
-    to set ipsec0's MTU to 1500-(IPSec header size), which IIRC is about 1430.
-
-    That way, the resulting encapsulated packets don't exceed 1500. On most 
-    networks, packets less than 1500 will not need to be fragmented.
-
-and... (from Henry Spencer)
-
-    The way it *ought* to work is that the MTU advertised by the ipsecN
-    interface should be that of the underlying hardware interface, less a
-    pinch for the extra headers needed. 
-
-    Unfortunately, in certain situations this breaks many applications.
-    There is a widespread implicit assumption that the smallest MTUs are 
-    at the ends of paths, not in the middle, and another that MTUs are 
-    never less than 1500.  A lot of code is unprepared to handle paths 
-    where there is an &quot;interior minimum&quot; in the MTU, especially when it's 
-    less than 1500. So we advertise a big MTU and just let the resulting 
-    big packets fragment.
-
-This usually works, but we do get bitten in cases where some intermediate
-point can't handle all that fragmentation.  We can't win on this one.</PRE>
-<P>The MTU can be changed with an<VAR> overridemtu=</VAR> statement in
- the<VAR> config setup</VAR> section of<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf.5</A>.</P>
-<P>For a discussion of MTU issues and some possible solutions using
- Linux advanced routing facilities, see the<A href="http://www.linuxguruz.org/iptables/howto/2.4routing-15.html#ss15.6">
- Linux 2.4 Advanced Routing HOWTO</A>. For a discussion of MTU and NAT
- (Network Address Translation), see<A HREF="http://harlech.math.ucla.edu/services/ipsec.html">
- James Carter's MTU notes</A>.</P>
-<H2><A name="nat.background">Network address translation (NAT)</A></H2>
-<P><STRONG>N</STRONG>etwork<STRONG> A</STRONG>ddress<STRONG> T</STRONG>
-ranslation is a service provided by some gateway machines. Calling it
- NAPT (adding the word<STRONG> P</STRONG>ort) would be more precise, but
- we will follow the widespread usage.</P>
-<P>A gateway doing NAT rewrites the headers of packets it is forwarding,
- changing one or more of:</P>
-<UL>
-<LI>source address</LI>
-<LI>source port</LI>
-<LI>destination address</LI>
-<LI>destination port</LI>
-</UL>
-<P>On Linux 2.4, NAT services are provided by the<A href="http://netfilter.samba.org">
- netfilter(8)</A> firewall code. There are several<A href="http://netfilter.samba.org/documentation/index.html#HOWTO">
- Netfilter HowTos</A> including one on NAT.</P>
-<P>For older versions of Linux, this was referred to as &quot;IP masquerade&quot;
- and different tools were used. See this<A href="http://www.e-infomax.com/ipmasq/">
- resource page</A>.</P>
-<P>Putting an IPsec gateway behind a NAT gateway is not recommended. See
- our<A href="firewall.html#NAT"> firewalls document</A>.</P>
-<H3><A NAME="17_3_1">NAT to non-routable addresses</A></H3>
-<P>The most common application of NAT uses private<A href="glossary.html#non-routable">
- non-routable</A> addresses.</P>
-<P>Often a home or small office network will have:</P>
-<UL>
-<LI>one connection to the Internet</LI>
-<LI>one assigned publicly visible IP address</LI>
-<LI>several machines that all need access to the net</LI>
-</UL>
-<P>Of course this poses a problem since several machines cannot use one
- address. The best solution might be to obtain more addresses, but often
- this is impractical or uneconomical.</P>
-<P>A common solution is to have:</P>
-<UL>
-<LI><A href="glossary.html#non-routable">non-routable</A> addresses on
- the local network</LI>
-<LI>the gateway machine doing NAT</LI>
-<LI>all packets going outside the LAN rewritten to have the gateway as
- their source address</LI>
-</UL>
-<P>The client machines are set up with reserved<A href="glossary.html#non-routable">
- non-routable</A> IP addresses defined in RFC 1918. The masquerading
- gateway, the machine with the actual link to the Internet, rewrites
- packet headers so that all packets going onto the Internet appear to
- come from one IP address, that of its Internet interface. It then gets
- all the replies, does some table lookups and more header rewriting, and
- delivers the replies to the appropriate client machines.</P>
-<P>As far as anyone else on the Internet is concerned, the systems
- behind the gateway are completely hidden. Only one machine with one IP
- address is visible.</P>
-<P>For IPsec on such a gateway, you can entirely ignore the NAT in:</P>
-<UL>
-<LI><A href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A></LI>
-<LI>firewall rules affecting your Internet-side interface</LI>
-</UL>
-<P>Those can be set up exactly as they would be if your gateway had no
- other systems behind it.</P>
-<P>You do, however, have to take account of the NAT in firewall rules
- which affect packet forwarding.</P>
-<H3><A NAME="17_3_2">NAT to routable addresses</A></H3>
-<P>NAT to routable addresses is also possible, but is less common and
- may make for rather tricky routing problems. We will not discuss it
- here. See the<A href="http://netfilter.samba.org/documentation/index.html#HOWTO">
- Netfilter HowTos</A>.</P>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="config.html">Previous</A>
-<A HREF="user_examples.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/biblio.html b/doc/biblio.html
deleted file mode 100644
index d54af5cbf..000000000
--- a/doc/biblio.html
+++ /dev/null
@@ -1,274 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="glossary.html">Previous</A>
-<A HREF="rfc.html">Next</A>
-<HR>
-<H1><A name="biblio">Bibliography for the Linux FreeS/WAN project</A></H1>
-<P>For extensive bibliographic links, see the<A href="http://liinwww.ira.uka.de/bibliography/index.html">
- Collection of Computer Science Bibliographies</A></P>
-<P>See our<A href="web.html"> web links</A> for material available
- online.</P>
-<HR><A name="adams"> Carlisle Adams and Steve Lloyd<CITE> Understanding
- Public Key Infrastructure</CITE>
-<BR></A> Macmillan 1999 ISBN 1-57870-166-x
-<P>An overview, mainly concentrating on policy and strategic issues
- rather than the technical details. Both authors work for<A href="glossary.html#PKI">
- PKI</A> vendor<A href="http://www.entrust.com/"> Entrust</A>.</P>
-<HR><A name="DNS.book"> Albitz, Liu &amp; Loukides<CITE> DNS &amp; BIND</CITE>
- 3rd edition
-<BR></A> O'Reilly 1998 ISBN 1-56592-512-2
-<P>The standard reference on the<A href="glossary.html#DNS"> Domain Name
- Service</A> and<A href="glossary.html#BIND"> Berkeley Internet Name
- Daemon</A>.</P>
-<HR><A name="anderson"> Ross Anderson</A>,<CITE> Security Engineering -
- a Guide to Building Dependable Distributed Systems</CITE>
-<BR> Wiley, 2001, ISBN 0471389226
-<P>Easily the best book for the security professional I have seen.<STRONG>
- Highly recommended</STRONG>. See the<A href="http://www.cl.cam.ac.uk/~rja14/book.html">
- book web page</A>.</P>
-<P>This is quite readable, but Schneier's<A href="#secrets"> Secrets and
- Lies</A> might be an easier introduction.</P>
-<HR><A name="puzzle"> Bamford<CITE> The Puzzle Palace, A report on NSA,
- Americas's most Secret Agency</CITE>
-<BR> Houghton Mifflin 1982 ISBN 0-395-31286-8</A>
-<HR> Bamford<CITE> Body of Secrets</CITE>
-<P>The sequel.</P>
-<HR><A name="bander"> David Bander</A>,<CITE> Linux Security Toolkit</CITE>
-<BR> IDG Books, 2000, ISBN: 0764546902
-<P>This book has a short section on FreeS/WAN and includes Caldera Linux
- on CD.</P>
-<HR><A name="CZR"> Chapman, Zwicky &amp; Russell</A>,<CITE> Building
- Internet Firewalls</CITE>
-<BR> O'Reilly 1995 ISBN 1-56592-124-0
-<HR><A name="firewall.book"> Cheswick and Bellovin</A><CITE> Firewalls
- and Internet Security: Repelling the Wily Hacker</CITE>
-<BR> Addison-Wesley 1994 ISBN 0201633574
-<P>A fine book on firewalls in particular and security in general from
- two of AT&amp;T's system adminstrators.</P>
-<P>Bellovin has also done a number of<A href="web.html#papers"> papers</A>
- on IPsec and co-authored a<A href="intro.html#applied"> paper</A> on a
- large FreeS/WAN application.</P>
-<HR><A name="comer"> Comer<CITE> Internetworking with TCP/IP</CITE>
-<BR> Prentice Hall</A>
-<UL>
-<LI>Vol. I: Principles, Protocols, &amp; Architecture, 3rd Ed. 1995
- ISBN:0-13-216987-8</LI>
-<LI>Vol. II: Design, Implementation, &amp; Internals, 2nd Ed. 1994
- ISBN:0-13-125527-4</LI>
-<LI>Vol. III: Client/Server Programming &amp; Applications
-<UL>
-<LI>AT&amp;T TLI Version 1994 ISBN:0-13-474230-3</LI>
-<LI>BSD Socket Version 1996 ISBN:0-13-260969-X</LI>
-<LI>Windows Sockets Version 1997 ISBN:0-13-848714-6</LI>
-</UL>
-</LI>
-</UL>
-<P>If you need to deal with the details of the network protocols, read
- either this series or the<A href="#stevens"> Stevens and Wright</A>
- series before you start reading the RFCs.</P>
-<HR><A name="diffie"> Diffie and Landau</A><CITE> Privacy on the Line:
- The Politics of Wiretapping and Encryption</CITE>
-<BR> MIT press 1998 ISBN 0-262-04167-7 (hardcover) or 0-262-54100-9
-<BR>
-<HR><A name="d_and_hark"> Doraswamy and Harkins<CITE> IP Sec: The New
- Security Standard for the Internet, Intranets and Virtual Private
- Networks</CITE>
-<BR> Prentice Hall 1999 ISBN: 0130118982</A>
-<HR><A name="EFF"> Electronic Frontier Foundation<CITE> Cracking DES:
- Secrets of Encryption Research, Wiretap Politics and Chip Design</CITE>
-<BR></A> O'Reilly 1998 ISBN 1-56592-520-3
-<P>To conclusively demonstrate that DES is inadequate for continued use,
- the<A href="glossary.html#EFF"> EFF</A> built a machine for just over
- $200,000 that breaks DES encryption in under five days on average,
- under nine in the worst case.</P>
-<P>The book provides details of their design and, perhaps even more
- important, discusses why they felt the project was necessary.
- Recommended for anyone interested in any of the three topics mentioned
- in the subtitle.</P>
-<P>See also the<A href="http://www.eff.org/descracker.html"> EFF page on
- this project</A> and our discussion of<A href="politics.html#desnotsecure">
- DES insecurity</A>.</P>
-<HR> Martin Freiss<CITE> Protecting Networks with SATAN</CITE>
-<BR> O'Reilly 1998 ISBN 1-56592-425-8
-<BR> translated from a 1996 work in German
-<P>SATAN is a Security Administrator's Tool for Analysing Networks. This
- book is a tutorial in its use.</P>
-<HR> Gaidosch and Kunzinger<CITE> A Guide to Virtual Private Networks</CITE>
-<BR> Prentice Hall 1999 ISBN: 0130839647
-<HR><A name="Garfinkel"> Simson Garfinkel</A><CITE> Database Nation: the
- death of privacy in the 21st century</CITE>
-<BR> O'Reilly 2000 ISBN 1-56592-653-6
-<P>A thoughtful and rather scary book.</P>
-<HR><A name="PGP"> Simson Garfinkel</A><CITE> PGP: Pretty Good Privacy</CITE>
-<BR> O'Reilly 1995 ISBN 1-56592-098-8
-<P>An excellent introduction and user manual for the<A href="glossary.html#PGP">
- PGP</A> email-encryption package. PGP is a good package with a complex
- and poorly-designed user interface. This book or one like it is a must
- for anyone who has to use it at length.</P>
-<P>The book covers using PGP in Unix, PC and Macintosh environments,
- plus considerable background material on both the technical and
- political issues around cryptography.</P>
-<P>The book is now seriously out of date. It does not cover recent
- developments such as commercial versions since PGP 5, the Open PGP
- standard or GNU PG..</P>
-<HR><A name="practical"> Garfinkel and Spafford</A><CITE> Practical Unix
- Security</CITE>
-<BR> O'Reilly 1996 ISBN 1-56592-148-8
-<P>A standard reference.</P>
-<P>Spafford's web page has an excellent collection of<A href="http://www.cs.purdue.edu/coast/hotlist">
- crypto and security links</A>.</P>
-<HR><A name="Kahn"> David Kahn</A><CITE> The Codebreakers: the
- Comprehensive History of Secret Communications from Ancient Times to
- the Internet</CITE>
-<BR> second edition Scribner 1996 ISBN 0684831309
-<P>A history of codes and code-breaking from ancient Egypt to the 20th
- century. Well-written and exhaustively researched.<STRONG> Highly
- recommended</STRONG>, even though it does not have much on computer
- cryptography.</P>
-<HR> David Kahn<CITE> Seizing the Enigma, The Race to Break the German
- U-Boat codes, 1939-1943</CITE>
-<BR> Houghton Mifflin 1991 ISBN 0-395-42739-8
-<HR><A name="kirch"> Olaf Kirch</A><CITE> Linux Network Administrator's
- Guide</CITE>
-<BR> O'Reilly 1995 ISBN 1-56592-087-2
-<P>Now becoming somewhat dated in places, but still a good introductory
- book and general reference.</P>
-<HR><A name="LinVPN"> Kolesnikov and Hatch</A>,<CITE> Building Linux
- Virtual Private Networks (VPNs)</CITE>
-<BR> New Riders 2002
-<P>This has had a number of favorable reviews, including<A href="http://www.slashdot.org/article.pl?sid=02/02/27/0115214&amp;mode=thread&amp;tid=172">
- this one</A> on Slashdot. The book has a<A href="http://www.buildinglinuxvpns.net/">
- web site</A>.</P>
-<HR><A name="RFCs"> Pete Loshin<CITE> Big Book of IPsec RFCs</CITE>
-<BR> Morgan Kaufmann 2000 ISBN: 0-12-455839-9</A>
-<HR><A name="crypto"> Steven Levy<CITE> Crypto: How the Code Rebels Beat
- the Government -- Saving Privacy in the Digital Age</CITE></A>
-<BR> Penguin 2001, ISBN 0-670--85950-8
-<P><STRONG>Highly recommended</STRONG>. A fine history of recent (about
- 1970-2000) developments in the field, and the related political
- controversies. FreeS/WAN project founder and leader John Gilmore
- appears several times.</P>
-<P>The book does not cover IPsec or FreeS/WAN, but this project is very
- much another battle in the same war. See our discussion of the<A href="politics.html">
- politics</A>.</P>
-<HR><A name="GTR"> Matyas, Anderson et al.</A><CITE> The Global Trust
- Register</CITE>
-<BR> Northgate Consultants Ltd 1998 ISBN: 0953239705
-<BR> hard cover edition MIT Press 1999 ISBN 0262511053
-<P>From<A href="http://www.cl.cam.ac.uk/Research/Security/Trust-Register">
- their web page:</A></P>
-<BLOCKQUOTE> This book is a register of the fingerprints of the world's
- most important public keys; it implements a top-level certification
- authority (CA) using paper and ink rather than in an electronic system.</BLOCKQUOTE>
-<HR><A name="handbook"> Menezies, van Oorschot and Vanstone<CITE>
- Handbook of Applied Cryptography</CITE></A>
-<BR> CRC Press 1997
-<BR> ISBN 0-8493-8523-7
-<P>An excellent reference. Read<A href="#schneier"> Schneier</A> before
- tackling this.</P>
-<HR> Michael Padlipsky<CITE> Elements of Networking Style</CITE>
-<BR> Prentice-Hall 1985 ISBN 0-13-268111-0 or 0-13-268129-3
-<P>Probably<STRONG> the funniest technical book ever written</STRONG>,
- this is a vicious but well-reasoned attack on the OSI &quot;seven layer
- model&quot; and all that went with it. Several chapters of it are also
- available as RFCs 871 to 875.</P>
-<HR><A name="matrix"> John S. Quarterman</A><CITE> The Matrix: Computer
- Networks and Conferencing Systems Worldwide</CITE>
-<BR> Digital Press 1990 ISBN 155558-033-5
-<BR> Prentice-Hall ISBN 0-13-565607-9
-<P>The best general treatment of computer-mediated communication we have
- seen. It naturally has much to say about the Internet, but also covers
- UUCP, Fidonet and so on.</P>
-<HR><A name="ranch"> David Ranch</A><CITE> Securing Linux Step by Step</CITE>
-<BR> SANS Institute, 1999
-<P><A href="http://www.sans.org/">SANS</A> is a respected organisation,
- this guide is part of a well-known series, and Ranch has previously
- written the useful<A href=" http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html#trinityos">
- Trinity OS</A> guide to securing Linux, so my guess would be this is a
- pretty good book. I haven't read it yet, so I'm not certain. It can be
- ordered online from<A href="http://www.sans.org/"> SANS</A>.</P>
-<P>Note (Mar 1, 2002): a new edition with different editors in the
- works. Expect it this year.</P>
-<HR><A name="schneier"> Bruce Schneier</A><CITE> Applied Cryptography,
- Second Edition</CITE>
-<BR> John Wiley &amp; Sons, 1996
-<BR> ISBN 0-471-12845-7 hardcover
-<BR> ISBN 0-471-11709-9 paperback
-<P>A standard reference on computer cryptography. For more recent
- essays, see the<A href="http://www.counterpane.com/"> author's
- company's web site</A>.</P>
-<HR><A name="secrets"> Bruce Schneier</A><CITE> Secrets and Lies</CITE>
-<BR> Wiley 2000, ISBN 0-471-25311-1
-<P>An interesting discussion of security and privacy issues, written
- with more of an &quot;executive overview&quot; approach rather than a narrow
- focus on the technical issues.<STRONG> Highly recommended</STRONG>.</P>
-<P>This is worth reading even if you already understand security issues,
- or think you do. To go deeper, follow it with Anderson's<A href="#anderson">
- Security Engineering</A>.</P>
-<HR><A name="VPNbook"> Scott, Wolfe and Irwin<CITE> Virtual Private
- Networks</CITE></A>
-<BR> 2nd edition, O'Reilly 1999 ISBN: 1-56592-529-7
-<P>This is the only O'Reilly book, out of a dozen I own, that I'm
- disappointed with. It deals mainly with building VPNs with various
- proprietary tools --<A href="glossary.html#PPTP"> PPTP</A>,<A href="glossary.html#SSH">
- SSH</A>, Cisco PIX, ... -- and touches only lightly on IPsec-based
- approaches.</P>
-<P>That said, it appears to deal competently with what it does cover and
- it has readable explanations of many basic VPN and security concepts.
- It may be exactly what some readers require, even if I find the
- emphasis unfortunate.</P>
-<HR><A name="LASG"> Kurt Seifried<CITE> Linux Administrator's Security
- Guide</CITE></A>
-<P>Available online from<A href="http://www.securityportal.com/lasg/">
- Security Portal</A>. It has fairly extensive coverage of IPsec.</P>
-<HR><A name="Smith"> Richard E Smith<CITE> Internet Cryptography</CITE>
-<BR></A> ISBN 0-201-92480-3, Addison Wesley, 1997
-<P>See the book's<A href="http://www.visi.com/crypto/inet-crypto/index.html">
- home page</A></P>
-<HR><A name="neal"> Neal Stephenson<CITE> Cryptonomicon</CITE></A>
-<BR> Hardcover ISBN -380-97346-4, Avon, 1999.
-<P>A novel in which cryptography and the net figure prominently.<STRONG>
- Highly recommended</STRONG>: I liked it enough I immediately went out
- and bought all the author's other books.</P>
-<P>There is also a paperback edition. Sequels are expected.</P>
-<HR><A name="stevens"> Stevens and Wright</A><CITE> TCP/IP Illustrated</CITE>
-<BR> Addison-Wesley
-<UL>
-<LI>Vol. I: The Protocols 1994 ISBN:0-201-63346-9</LI>
-<LI>Vol. II: The Implementation 1995 ISBN:0-201-63354-X</LI>
-<LI>Vol. III: TCP for Transactions, HTTP, NNTP, and the UNIX Domain
- Protocols 1996 ISBN: 0-201-63495-3</LI>
-</UL>
-<P>If you need to deal with the details of the network protocols, read
- either this series or the<A href="#comer"> Comer</A> series before you
- start reading the RFCs.</P>
-<HR><A name="Rubini"> Rubini</A><CITE> Linux Device Drivers</CITE>
-<BR> O'Reilly &amp; Associates, Inc. 1998 ISBN 1-56592-292-1
-<HR><A name="Zeigler"> Robert Zeigler</A><CITE> Linux Firewalls</CITE>
-<BR> Newriders Publishing, 2000 ISBN 0-7537-0900-9
-<P>A good book, with detailed coverage of ipchains(8) firewalls and of
- many related issues.</P>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="glossary.html">Previous</A>
-<A HREF="rfc.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/compat.html b/doc/compat.html
deleted file mode 100644
index f01efa64c..000000000
--- a/doc/compat.html
+++ /dev/null
@@ -1,707 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="trouble.html">Previous</A>
-<A HREF="interop.html">Next</A>
-<HR>
-<H1><A name="compat">Linux FreeS/WAN Compatibility Guide</A></H1>
-<P>Much of this document is quoted directly from the Linux FreeS/WAN<A href="mail.html">
- mailing list</A>. Thanks very much to the community of testers,
- patchers and commenters there, especially the ones quoted below but
- also various contributors we haven't quoted.</P>
-<H2><A name="spec">Implemented parts of the IPsec Specification</A></H2>
-<P>In general, do not expect Linux FreeS/WAN to do everything yet. This
- is a work-in-progress and some parts of the IPsec specification are not
- yet implemented.</P>
-<H3><A name="in">In Linux FreeS/WAN</A></H3>
-<P>Things we do, as of version 1.96:</P>
-<UL>
-<LI>key management methods
-<DL>
-<DT>manually keyed</DT>
-<DD>using keys stored in /etc/ipsec.conf</DD>
-<DT>automatically keyed</DT>
-<DD>Automatically negotiating session keys as required. All connections
- are automatically re-keyed periodically. The<A href="glossary.html#Pluto">
- Pluto</A> daemon implements this using the<A href="glossary.html#IKE">
- IKE</A> protocol.</DD>
-</DL>
-</LI>
-<LI>Methods of authenticating gateways for IKE
-<DL>
-<DT>shared secrets</DT>
-<DD>stored in<A href="manpage.d/ipsec.secrets.5.html"> ipsec.secrets(5)</A>
-</DD>
-<DT><A href="glossary.html#RSA">RSA</A> signatures</DT>
-<DD>For details, see<A href="manpage.d/ipsec_pluto.8.html"> pluto(8)</A>
-.</DD>
-<DT>looking up RSA authentication keys from<A href="glossary.html#DNS">
- DNS</A>.</DT>
-<DD>Note that this technique cannot be fully secure until<A href="glossary.html#SDNS">
- secure DNS</A> is widely deployed.</DD>
-</DL>
-</LI>
-<LI>groups for<A href="glossary.html#DH"> Diffie-Hellman</A> key
- negotiation
-<DL>
-<DT>group 2, modp 1024-bit</DT>
-<DT>group 5, modp 1536-bit</DT>
-<DD>We implement these two groups.
-<P>In negotiating a keying connection (ISAKMP SA, Phase 1) we propose
- both groups when we are the initiator, and accept either when a peer
- proposes them. Once the keying connection is made, we propose only the
- alternative agreed there for data connections (IPsec SA's, Phase 2)
- negotiated over that keying connection.</P>
-</DD>
-</DL>
-</LI>
-<LI>encryption transforms
-<DL>
-<DT><A href="glossary.html#DES">DES</A></DT>
-<DD>DES is in the source code since it is needed to implement 3DES, but
- single DES is not made available to users because<A href="politics.html#desnotsecure">
- DES is insecure</A>.</DD>
-<DT><A href="glossary.html#3DES">Triple DES</A></DT>
-<DD>implemented, and used as the default encryption in Linux FreeS/WAN.</DD>
-</DL>
-</LI>
-<LI>authentication transforms
-<DL>
-<DT><A href="glossary.html#HMAC">HMAC</A> using<A href="glossary.html#MD5">
- MD5</A></DT>
-<DD>implemented, may be used in IKE or by by AH or ESP transforms.</DD>
-<DT><A href="glossary.html#HMAC">HMAC</A> using<A href="glossary.html#SHA">
- SHA</A></DT>
-<DD>implemented, may be used in IKE or by AH or ESP transforms.</DD>
-</DL>
-<P>In negotiations, we propose both of these and accept either.</P>
-</LI>
-<LI>compression transforms
-<DL>
-<DT>IPComp</DT>
-<DD>IPComp as described in RFC 2393 was added for FreeS/WAN 1.6. Note
- that Pluto becomes confused if you ask it to do IPComp when the kernel
- cannot.</DD>
-</DL>
-</LI>
-</UL>
-<P>All combinations of implemented transforms are supported. Note that
- some form of packet-level<STRONG> authentication is required whenever
- encryption is used</STRONG>. Without it, the encryption will not be
- secure.</P>
-<H3><A name="dropped">Deliberately omitted</A></H3>
- We do not implement everything in the RFCs because some of those things
- are insecure. See our discussions of avoiding<A href="politics.html#weak">
- bogus security</A>.
-<P>Things we deliberately omit which are required in the RFCs are:</P>
-<UL>
-<LI>null encryption (to use ESP as an authentication-only service)</LI>
-<LI>single DES</LI>
-<LI>DH group 1, a 768-bit modp group</LI>
-</UL>
-<P>Since these are the only encryption algorithms and DH group the RFCs
- require, it is possible in theory to have a standards-conforming
- implementation which will not interpoperate with FreeS/WAN. Such an
- implementation would be inherently insecure, so we do not consider this
- a problem.</P>
-<P>Anyway, most implementations sensibly include more secure options as
- well, so dropping null encryption, single DES and Group 1 does not
- greatly hinder interoperation in practice.</P>
-<P>We also do not implement some optional features allowed by the RFCs:</P>
-<UL>
-<LI>aggressive mode for negotiation of the keying channel or ISAKMP SA.
- This mode is a little faster than main mode, but exposes more
- information to an eavesdropper.</LI>
-</UL>
-<P>In theory, this should cause no interoperation problems since all
- implementations are required to support the more secure main mode,
- whether or not they also allow aggressive mode.</P>
-<P>In practice, it does sometimes produce problems with implementations
- such as Windows 2000 where aggressive mode is the default. Typically,
- these are easily solved with a configuration change that overrides that
- default.</P>
-<H3><A name="not">Not (yet) in Linux FreeS/WAN</A></H3>
-<P>Things we don't yet do, as of version 1.96:</P>
-<UL>
-<LI>key management methods
-<UL>
-<LI>authenticate key negotiations via local<A href="glossary.html#PKI">
- PKI</A> server, but see links to user<A href="web.html#patch"> patches</A>
-</LI>
-<LI>authenticate key negotiations via<A href="glossary.html#SDNS">
- secure DNS</A></LI>
-<LI>unauthenticated key management, using<A href="glossary.html#DH">
- Diffie-Hellman</A> key agreement protocol without authentication.
- Arguably, this would be worth doing since it is secure against all
- passive attacks. On the other hand, it is vulnerable to an active<A href="glossary.html#middle">
- man-in-the-middle attack</A>.</LI>
-</UL>
-</LI>
-<LI>encryption transforms
-<P>Currently<A href="glossary.html#3DES"> Triple DES</A> is the only
- encryption method Pluto will negotiate.</P>
-<P>No additional encryption transforms are implemented, though the RFCs
- allow them and some other IPsec implementations support various of
- them. We are not eager to add more. See this<A href="faq.html#other.cipher">
- FAQ question</A>.</P>
-<P><A href="glossary.html#AES">AES</A>, the successor to the DES
- standard, is an excellent candidate for inclusion in FreeS/WAN, see
- links to user<A href="web.html#patch"> patches</A>.</P>
-</LI>
-<LI>authentication transforms
-<P>No optional additional authentication transforms are currently
- implemented. Likely<A href="glossary.html#SHA-256"> SHA-256, SHA-384
- and SHA-512</A> will be added when AES is.</P>
-</LI>
-<LI>Policy checking on decrypted packets
-<P>To fully comply with the RFCs, it is not enough just to accept only
- packets which survive any firewall rules in place to limit what IPsec
- packets get in, and then pass KLIPS authentication. That is what
- FreeS/WAN currently does.</P>
-<P>We should also apply additional tests, for example ensuring that all
- packets emerging from a particular tunnel have source and destination
- addresses that fall within the subnets defined for that tunnel, and
- that packets with those addresses that did not emerge from the
- appropriate tunnel are disallowed.</P>
-<P>This will be done as part of a KLIPS rewrite. See these<A href="intro.html#applied">
- links</A> and the<A href="mail.html"> design mailing list</A> for
- discussion.</P>
-</LI>
-</UL>
-<H2><A name="pfkey">Our PF-Key implementation</A></H2>
-<P>We use PF-key Version Two for communication between the KLIPS kernel
- code and the Pluto Daemon. PF-Key v2 is defined by<A href="http://www.normos.org/ietf/rfc/rfc2367.txt">
- RFC 2367</A>.</P>
-<P>The &quot;PF&quot; stands for Protocol Family. PF-Inet defines a
- kernel/userspace interface for the TCP/IP Internet protocols (TCP/IP),
- and other members of the PF series handle Netware, Appletalk, etc.
- PF-Key is just a PF for key-related matters.</P>
-<H3><A name="pfk.port">PF-Key portability</A></H3>
-<P>PF-Key came out of Berkeley Unix work and is used in the various BSD
- IPsec implementations, and in Solaris. This means there is some hope of
- porting our Pluto(8) to one of the BSD distributions, or of running
- their photurisd(8) on Linux if you prefer<A href="glossary.html#photuris">
- Photuris</A> key management over IKE.</P>
-<P>It is, however, more complex than that. The PK-Key RFC deliberately
- deals only with keying, not policy management. The three PF-Key
- implementations we have looked at -- ours, OpenBSD and KAME -- all have
- extensions to deal with security policy, and the extensions are
- different. There have been discussions aimed at sorting out the
- differences, perhaps for a version three PF-Key spec. All players are
- in favour of this, but everyone involved is busy and it is not clear
- whether or when these discussions might bear fruit.</P>
-<H2><A name="otherk">Kernels other than the latest 2.2.x and 2.4.y</A></H2>
-<P>We develop and test on Redhat Linux using the most recent kernel in
- the 2.2 and 2.4 series. In general, we recommend you use the latest
- kernel in one of those series. Complications and caveats are discussed
- below.</P>
-<H3><A name="kernel.2.0">2.0.x kernels</A></H3>
-<P>Consider upgrading to the 2.2 kernel series. If you want to stay with
- the 2.0 series, then we strongly recommend 2.0.39. Some useful security
- patches were added in 2.0.38.</P>
-<P>Various versions of the code have run at various times on most 2.0.xx
- kernels, but the current version is only lightly tested on 2.0.39, and
- not at all on older kernels.</P>
-<P>Some of our patches for older kernels are shipped in 2.0.37 and
- later, so they are no longer provided in FreeS/WAN. This means recent
- versions of FreeS/WAN will probably not compile on anything earlier
- than 2.0.37.</P>
-<H3><A name="kernel.production">2.2 and 2.4 kernels</A></H3>
-<DL>
-<DT>FreeS/WAN 1.0</DT>
-<DD>ran only on 2.0 kernels</DD>
-<DT>FreeS/WAN 1.1 to 1.8</DT>
-<DD>ran on 2.0 or 2.2 kernels
-<BR> ran on some development kernels, 2.3 or 2.4-test</DD>
-<DT>FreeS/WAN 1.9 to 1.96</DT>
-<DD>runs on 2.0, 2.2 or 2.4 kernels</DD>
-</DL>
-<P>In general,<STRONG> we suggest the latest 2.2 kernel or 2.4 for
- production use</STRONG>.</P>
-<P>Of course no release can be guaranteed to run on kernels more recent
- than it is, so quite often there will be no stable FreeS/WAN for the
- absolute latest kernel. See the<A href="faq.html#k.versions"> FAQ</A>
- for discussion.</P>
-<H2><A name="otherdist">Intel Linux distributions other than Redhat</A></H2>
-<P>We develop and test on Redhat 6.1 for 2.2 kernels, and on Redhat 7.1
- or 7.2 for 2.4, so minor changes may be required for other
- distributions.</P>
-<H3><A name="rh7">Redhat 7.0</A></H3>
-<P>There are some problems with FreeS/WAN on Redhat 7.0. They are
- soluble, but we recommend you upgrade to a later Redhat instead..</P>
-<P>Redhat 7 ships with two compilers.</P>
-<UL>
-<LI>Their<VAR> gcc</VAR> is version 2.96. Various people, including the
- GNU compiler developers and Linus, have said fairly emphatically that
- using this was a mistake. 2.96 is a development version, not intended
- for production use. In particular, it will not compile a Linux kernel.</LI>
-<LI>Redhat therefore also ship a separate compiler, which they call<VAR>
- kgcc</VAR>, for compiling kernels.</LI>
-</UL>
-<P>Kernel Makefiles have<VAR> gcc</VAR> as a default, and must be
- adjusted to use<VAR> kgcc</VAR> before a kernel will compile on 7.0.
- This mailing list message gives details:</P>
-<PRE>Subject: Re: AW: Installing IPsec on Redhat 7.0
-   Date: Thu, 1 Feb 2001 14:32:52 -0200 (BRST)
-  From: Mads Rasmussen &lt;mads@cit.com.br&gt;
- 
-&gt; From www.redhat.com/support/docs/gotchas/7.0/gotchas-7-6.html#ss6.1
-
-cd to /usr/src/linux and open the Makefile in your favorite editor. You
-will need to look for a line similar to this:
-
-CC = $(CROSS_COMPILE)gcc -D__KERNEL__ -I$(HPATH)
-
-This line specifies which C compiler to use to build the kernel. It should
-be changed to:
-
-CC = $(CROSS_COMPILE)kgcc -D__KERNEL__ -I$(HPATH)
-
-for Red Hat Linux 7. The kgcc compiler is egcs 2.91.66. From here you can
-proceed with the typical compiling steps.</PRE>
-<P>Check the<A href="mail.html"> mailing list</A> archive for more
- recent news.</P>
-<H3><A name="suse">SuSE Linux</A></H3>
-<P>SuSE 6.3 and later versions, at least in Europe, ship with FreeS/WAN
- included.</P>
-<P>FreeS/WAN packages distributed for SuSE 7.0-7.2 were somehow
- miscompiled. You can find fixed packages on<A HREF="http://www.suse.de/~garloff/linux/FreeSWAN">
- Kurt Garloff's page</A>.</P>
-<P>Here are some notes for an earlier SuSE version.</P>
-<H4>SuSE Linux 5.3</H4>
-<PRE>Date: Mon, 30 Nov 1998
-From: Peter Onion &lt;ponion@srd.bt.co.uk&gt;
-
-... I got Saturdays snapshot working between my two SUSE5.3 machines at home.
-
-The mods to the install process are quite simple.  From memory and looking at
-the files on the SUSE53 machine here at work....
-
-And extra link in each of the /etc/init.d/rc?.d directories called K35ipsec
-which SUSE use to shut a service down.
-
-A few mods in /etc/init.d/ipsec  to cope with the different places that SUSE
-put config info, and remove the inculsion of /etc/rc.d/init.d/functions and .
-/etc/sysconfig/network as they don't exists and 1st one isn't needed anyway.
-
-insert &quot;. /etc/rc.config&quot; to pick up the SUSE config info and use 
-
-  if test -n &quot;$NETCONFIG&quot; -a &quot;$NETCONFIG&quot; != &quot;YAST_ASK&quot; ; then
-
-to replace 
-
-  [ ${NETWORKING} = &quot;no&quot; ] &amp;&amp; exit 0
-
-Create /etc/sysconfig  as SUSE doesn't have one.
-
-I think that was all (but I prob forgot something)....</PRE>
-<P>You may also need to fiddle initialisation scripts to ensure that<VAR>
- /var/run/pluto.pid</VAR> is removed when rebooting. If this file is
- present, Pluto does not come up correctly.</P>
-<H3><A name="slack">Slackware</A></H3>
-<PRE>Subject: Re: linux-IPsec: Slackware distribution
-  Date:  Thu, 15 Apr 1999 12:07:01 -0700
-  From:  Evan Brewer &lt;dmessiah@silcon.com&gt;
-
-&gt; Very shortly, I will be needing to install IPsec on at least gateways that
-&gt; are running Slackware. . . .
-
-The only trick to getting it up is that on the slackware dist there is no
-init.d directory in /etc/rc.d .. so create one.  Then, what I do is take the
-IPsec startup script which normally gets put into the init.d directory, and
-put it in /etc/rc.d and name ir rc.ipsec .. then I symlink it to the file
-in init.d.  The only file in the dist you need to really edit is the
-utils/Makefile, setup4:
-
-Everything else should be just fine.</PRE>
-<P>A year or so later:</P>
-<PRE>Subject: Re: HTML Docs- Need some cleanup?
-   Date: Mon, 8 Jan 2001
-   From: Jody McIntyre &lt;jodym@oeone.com&gt;
-
-I have successfully installed FreeS/WAN on several Slackware 7.1 machines.
-FreeS/WAN installed its rc.ipsec file in /etc/rc.d.  I had to manually call
-this script from rc.inet2.  This seems to be an easier method than Evan
-Brewer's.</PRE>
-<H3><A name="deb">Debian</A></H3>
-<P>A recent (Nov 2001) mailing list points to a<A href="http://www.thing.dyndns.org/debian/vpn.htm">
- web page</A> on setting up several types of tunnel, including IPsec, on
- Debian.</P>
-<P>Some older information:</P>
-<PRE>Subject: FreeS/WAN 1.0 on Debian 2.1
-   Date: Tue, 20 Apr 1999
-  From:  Tim Miller &lt;cerebus+counterpane@haybaler.sackheads.org&gt;
-
-        Compiled and installed without error on a Debian 2.1 system
-with kernel-source-2.0.36 after pointing RCDIR in utils/Makefile to
-/etc/init.d.
-
-        /var/lock/subsys/ doesn't exist on Debian boxen, needs to be
-created; not a fatal error.
-
-        Finally, IPsec scripts appear to be dependant on GNU awk
-(gawk); the default Debian awk (mawk-1.3.3-2) had fatal difficulties.
-With gawk installed and /etc/alternatives/awk linked to /usr/bin/gawk
-operation appears flawless.</PRE>
-<P>The scripts in question have been modified since this was posted. Awk
- versions should no longer be a problem.</P>
-<H3><A name="caldera">Caldera</A></H3>
-<PRE>Subject: Re: HTML Docs- Need some cleanup?
-   Date: Mon, 08 Jan 2001
-   From: Andy Bradford &lt;andyb@calderasystems.com&gt;
-
-On Sun, 07 Jan 2001 22:59:05 EST, Sandy Harris wrote:
-
-&gt;     Intel Linux distributions other than Redhat 5.x and 6.x 
-&gt;         Redhat 7.0 
-&gt;         SuSE Linux 
-&gt;             SuSE Linux 5.3 
-&gt;         Slackware 
-&gt;         Debian 
-
-Can you please include Caldera in this list?  I have tested it since 
-FreeS/Wan 1.1 and it works great with our systems---provided one 
-follows the FreeS/Wan documentation. :-)
-
-Thank you,
-Andy</PRE>
-<H2><A name="CPUs">CPUs other than Intel</A></H2>
-<P>FreeS/WAN has been run sucessfully on a number of different CPU
- architectures. If you have tried it on one not listed here, please post
- to the<A href="mail.html"> mailing list</A>.</P>
-<H3><A name=" strongarm">Corel Netwinder (StrongARM CPU)</A></H3>
-<PRE>Subject: linux-ipsec: Netwinder diffs
-Date: Wed, 06 Jan 1999
-From: rhatfield@plaintree.com
-
-I had a mistake in my IPsec-auto, so I got things working this morning.
-
-Following are the diffs for my changes.  Probably not the best and cleanest way 
-of doing it, but it works. . . . </PRE>
-<P>These diffs are in the 0.92 and later distributions, so these should
- work out-of-the-box on Netwinder.</P>
-<H3><A name="yellowdog">Yellow Dog Linux on Power PC</A></H3>
-<PRE>Subject:  Compiling FreeS/WAN 1.1 on YellowDog Linux (PPC)
-   Date:  11 Dec 1999
-   From:  Darron Froese &lt;darron@fudgehead.com&gt;
-
-I'm summarizing here for the record - because it's taken me many hours to do
-this (multiple times) and because I want to see IPsec on more linuxes than
-just x86.
-
-Also, I can't remember if I actually did summarize it before... ;-) I'm
-working too many late hours.
-
-That said - here goes.
-
-1. Get your linux kernel and unpack into /usr/src/linux/ - I used 2.2.13.
-&lt;http://www.kernel.org/pub/linux/kernel/v2.2/linux-2.2.13.tar.bz2&gt;
-
-2. Get FreeS/WAN and unpack into /usr/src/freeswan-1.1
-&lt;ftp://ftp.xs4all.nl/pub/crypto/freeswan/freeswan-1.1.tar.gz&gt;
-
-3. Get the gmp src rpm from here:
-&lt;ftp://ftp.yellowdoglinux.com//pub/yellowdog/champion-1.1/SRPMS/SRPMS/gmp-2.0.2-9a.src.rpm&gt;
-
-4. Su to root and do this: rpm --rebuild gmp-2.0.2-9a.src.rpm
-
-You will see a lot of text fly by and when you start to see the rpm
-recompiling like this:
-
-Executing: %build
-+ umask 022
-+ cd /usr/src/redhat/BUILD
-+ cd gmp-2.0.2
-+ libtoolize --copy --force
-Remember to add `AM_PROG_LIBTOOL' to `configure.in'.
-You should add the contents of `/usr/share/aclocal/libtool.m4' to
-`aclocal.m4'.
-+ CFLAGS=-O2 -fsigned-char
-+ ./configure --prefix=/usr
-
-Hit Control-C to stop the rebuild. NOTE: We're doing this because for some
-reason the gmp source provided with FreeS/WAN 1.1 won't build properly on
-ydl.
-
-cd /usr/src/redhat/BUILD/
-cp -ar gmp-2.0.2 /usr/src/freeswan-1.1/
-cd /usr/src/freeswan-1.1/
-rm -rf gmp
-mv gmp-2.0.2 gmp
-
-5. Open the freeswan Makefile and change the line that says:
-KERNEL=$(b)zimage (or something like that) to
-KERNEL=vmlinux
-
-6. cd ../linux/
-
-7. make menuconfig
-Select an option or two and then exit - saving your changes.
-
-8. cd ../freeswan-1.1/ ; make menugo
-
-That will start the whole process going - once that's finished compiling,
-you have to install your new kernel and reboot.
-
-That should build FreeS/WAN on ydl (I tried it on 1.1).</PRE>
- And a later message on the same topic:
-<PRE>Subject: Re: FreeS/WAN, PGPnet and E-mail
-   Date: Sat, 22 Jan 2000
-   From: Darron Froese &lt;darron@fudgehead.com&gt;
-
-on 1/22/00 6:47 PM, Philip Trauring at philip@trauring.com wrote:
-
-&gt; I have a PowerMac G3 ...
-
-The PowerMac G3 can run YDL 1.1 just fine. It should also be able to run
-FreeS/WAN 1.2patch1 with a couple minor modifications:
-
-1. In the Makefile it specifies a bzimage for the kernel compile - you have
-to change that to vmlinux for the PPC.
-
-2. The gmp source that comes with FreeS/WAN (for whatever reason) fails to
-compile. I have gotten around this by getting the gmp src rpm from here:
-
-ftp://ftp.yellowdoglinux.com//pub/yellowdog/champion-1.1/SRPMS/SRPMS/gmp-2.0.2-9a.src.rpm
-
-If you rip the source out of there - and place it where the gmp source
-resides it will compile just fine.</PRE>
-<P>FreeS/WAN no longer includes GMP source.</P>
-<H3><A name="mklinux">Mklinux</A></H3>
-<P>One user reports success on the Mach-based<STRONG> m</STRONG>icro<STRONG>
-k</STRONG>ernel Linux.</P>
-<PRE>Subject: Smiles on sparc and ppc
-   Date: Fri, 10 Mar 2000
-   From: Jake Hill &lt;jah@alien.bt.co.uk&gt;
-
-You may or may not be interested to know that I have successfully built
-FreeS/WAN on a number of non intel alpha architectures; namely on ppc
-and sparc and also on osfmach3/ppc (MkLinux). I can report that it just
-works, mostly, with few changes.</PRE>
-<H3><A name="alpha">Alpha 64-bit processors</A></H3>
-<PRE>Subject: IT WORKS (again) between intel &amp; alpha :-)))))
-   Date: Fri, 29 Jan 1999
-   From: Peter Onion &lt;ponion@srd.bt.co.uk&gt;
-
-Well I'm happy to report that I've got an IPsec connection between by intel &amp; alpha machines again :-))
-
-If you look back on this list to 7th of December I wrote...
-
--On 07-Dec-98 Peter Onion wrote:
--&gt; 
--&gt; I've about had enuf of wandering around inside the kernel trying to find out
--&gt; just what is corrupting outgoing packets...
--
--Its 7:30 in the evening .....
--
--I FIXED IT  :-))))))))))))))))))))))))))))))))
--
--It was my own fault :-((((((((((((((((((
--
--If you ask me very nicly I'll tell you where I was a little too over keen to
--change unsigned long int __u32 :-)  OPSE ...
--
--So tomorrow it will full steam ahead to produce a set of diffs/patches against
--0.91 
--
--Peter Onion.</PRE>
-<P>In general (there have been some glitches), FreeS/WAN has been
- running on Alphas since then.</P>
-<H3><A name="SPARC">Sun SPARC processors</A></H3>
-<P>Several users have reported success with FreeS/WAN on SPARC Linux.
- Here is one mailing list message:</P>
-<PRE>Subject: Smiles on sparc and ppc
-   Date: Fri, 10 Mar 2000
-   From: Jake Hill &lt;jah@alien.bt.co.uk&gt;
-
-You may or may not be interested to know that I have successfully built
-FreeS/WAN on a number of non intel alpha architectures; namely on ppc
-and sparc and also on osfmach3/ppc (MkLinux). I can report that it just
-works, mostly, with few changes.
-
-I have a question, before I make up some patches. I need to hack
-gmp/mpn/powerpc32/*.s to build them. Is this ok? The changes are
-trivial, but could I also use a different version of gmp? Is it vanilla
-here?
-
-I guess my only real headache is from ipchains, which appears to stop
-running when IPsec has been started for a while. This is with 2.2.14 on
-sparc.</PRE>
-<P>This message, from a different mailing list, may be relevant for
- anyone working with FreeS/WAN on Suns:</P>
-<PRE>Subject: UltraSPARC DES assembler
-   Date: Thu, 13 Apr 2000
-   From: svolaf@inet.uni2.dk (Svend Olaf Mikkelsen)
-     To: coderpunks@toad.com
-
-An UltraSPARC assembler version of the LibDES/SSLeay/OpenSSL des_enc.c
-file is available at http://inet.uni2.dk/~svolaf/des.htm.
-
-This brings DES on UltraSPARC from slower than Pentium at the same
-clock speed to significantly faster.</PRE>
-<H3><A name="mips">MIPS processors</A></H3>
-<P>We know FreeS/WAN runs on at least some MIPS processors because<A href="http://www.lasat.com">
- Lasat</A> manufacture an IPsec box based on an embedded MIPS running
- Linux with FreeS/WAN. We have no details.</P>
-<H3><A name="crusoe">Transmeta Crusoe</A></H3>
-<P>The Merilus<A href="http://www.merilus.com/products/fc/index.shtml">
- Firecard</A>, a Linux firewall on a PCI card, is based on a Crusoe
- processor and supports FreeS/WAN.</P>
-<H3><A name="coldfire">Motorola Coldfire</A></H3>
-<PRE>Subject: Re: Crypto hardware support
-   Date: Mon, 03 Jul 2000
-   From: Dan DeVault &lt;devault@tampabay.rr.com&gt;
-
-.... I have been running
-uClinux with FreeS/WAN 1.4 on a system built by Moreton Bay  (
-http://www.moretonbay.com )  and it was using a Coldfire processor
-and was able to do the Triple DES encryption at just about
-1 mbit / sec rate.......  they put a Hi/Fn 7901 hardware encryption
-chip on their board and now their system does over 25 mbit of 3DES
-encryption........ pretty significant increase if you ask me.</PRE>
-<H2><A name="multiprocessor">Multiprocessor machines</A></H2>
-<P>FreeS/WAN is designed to work on SMP (symmetric multi-processing)
- Linux machines and is regularly tested on dual processor x86 machines.</P>
-<P>We do not know of any testing on multi-processor machines with other
- CPU architectures or with more than two CPUs. Anyone who does test
- this, please report results to the<A href="mail.html"> mailing list</A>
-.</P>
-<P>The current design does not make particularly efficient use of
- multiprocessor machines; some of the kernel work is single-threaded.</P>
-<H2><A name="hardware">Support for crypto hardware</A></H2>
-<P>Supporting hardware cryptography accelerators has not been a high
- priority for the development team because it raises a number of fairly
- complex issues:</P>
-<UL>
-<LI>Can you trust the hardware? If it is not Open Source, how do you
- audit its security? Even if it is, how do you check that the design has
- no concealed traps?</LI>
-<LI>If an interface is added for such hardware, can that interface be
- subverted or misused?</LI>
-<LI>Is hardware acceleration actually a performance win? It clearly is
- in many cases, but on a fast machine it might be better to use the CPU
- for the encryption than to pay the overheads of moving data to and from
- a crypto board.</LI>
-<LI>the current KLIPS code does not provide a clean interface for
- hardware accelerators</LI>
-</UL>
-<P>That said, we have a<A href="#coldfire"> report</A> of FreeS/WAN
- working with one crypto accelerator and some work is going on to modify
- KLIPS to create a clean generic interface to such products. See this<A href="http://www.jukie.net/~bart/linux-ipsec/">
- web page</A> for some of the design discussion.</P>
-<P>More recently, a patch to support some hardware accelerators has been
- posted:</P>
-<PRE>Subject: [Design] [PATCH] H/W acceleration patch
-   Date: Tue, 18 Sep 2001
-   From: &quot;Martin Gadbois&quot; &lt;martin.gadbois@colubris.com&gt;
- 
-Finally!!
-Here's a web site with H/W acceleration patch for FreeS/WAN 1.91, including
-S/W and Hifn 7901 crypto support.
-
-http://sources.colubris.com/
-
-Martin Gadbois</PRE>
-<P>Hardware accelerators could take performance well beyond what
- FreeS/WAN can do in software (discussed<A href="performance.html"> here</A>
-). Here is some discussion off the IETF IPsec list, October 2001:</P>
-<PRE> ... Currently shipping chips deliver, 600 mbps throughput on a single
- stream of 3DES IPsec traffic.  There are also chips that use multiple
- cores to do 2.4 gbps.  We (Cavium) and others have announced even faster
- chips. ... Mid 2002 versions will handle at line rate (OC48 and OC192)
- IPsec and SSL/TLS traffic not only 3DES CBC but also AES and arc4.</PRE>
-<P>The patches to date support chips that have been in production for
- some time, not the state-of-the-art latest-and-greatest devices
- described in that post. However, they may still outperform software and
- they almost certainly reduce CPU overhead.</P>
-<H2><A name="ipv6">IP version 6 (IPng)</A></H2>
-<P>The Internet currently runs on version four of the IP protocols. IPv4
- is what is in the standard Linux IP stack, and what FreeS/WAN was built
- for. In IPv4, IPsec is an optional feature.</P>
-<P>The next version of the IP protocol suite is version six, usually
- abbreviated either as &quot;IPv6&quot; or as &quot;IPng&quot; for &quot;IP: the next
- generation&quot;. For IPv6, IPsec is a required feature. Any machine doing
- IPv6 is required to support IPsec, much as any machine doing (any
- version of) IP is required to support ICMP.</P>
-<P>There is a Linux implementation of IPv6 in Linux kernels 2.2 and
- above. For details, see the<A href="http://www.cs-ipv6.lancs.ac.uk/ipv6/systems/linux/faq/">
- FAQ</A>. It does not yet support IPsec. The<A href="http://www.linux-ipv6.org/">
- USAGI</A> project are also working on IPv6 for Linux.</P>
-<P>FreeS/WAN was originally built for the current standard, IPv4, but we
- are interested in seeing it work with IPv6. Some progress has been
- made, and a patched version with IPv6 support is<A href="http://www.ipv6.iabg.de/downloadframe/index.html">
- available</A>. For more recent information, check the<A href="mail.html">
- mailing list</A>.</P>
-<H3><A name="v6.back">IPv6 background</A></H3>
-<P>IPv6 has been specified by an IETF<A href="http://www.ietf.org/html.charters/ipngwg-charter.html">
- working group</A>. The group's page lists over 30 RFCs to date, and
- many Internet Drafts as well. The overview is<A href="http://www.ietf.org/rfc/rfc2460.txt">
- RFC 2460</A>. Major features include:</P>
-<UL>
-<LI>expansion of the address space from 32 to 128 bits,</LI>
-<LI>changes to improve support for
-<UL>
-<LI>mobile IP</LI>
-<LI>automatic network configuration</LI>
-<LI>quality of service routing</LI>
-<LI>...</LI>
-</UL>
-</LI>
-<LI>improved security via IPsec</LI>
-</UL>
-<P>A number of projects are working on IPv6 implementation. A prominent
- Open Source effort is<A href="http://www.kame.net/"> KAME</A>, a
- collaboration among several large Japanese companies to implement IPv6
- for Berkeley Unix. Other major players are also working on IPv6. For
- example, see pages at:</P>
-<UL>
-<LI><A href="http://playground.sun.com/pub/ipng/html/ipng-main.html">Sun</A>
-</LI>
-<LI><A href="http://www.cisco.com/warp/public/732/ipv6/index.html">Cisco</A>
-</LI>
-<LI><A href="http://www.microsoft.com/windows2000/techinfo/howitworks/communications/networkbasics/IPv6.asp">
-Microsoft</A></LI>
-</UL>
-<P>The<A href="http://www.6bone.net/"> 6bone</A> (IPv6 backbone) testbed
- network has been up for some time. There is an active<A href="http://www.ipv6.org/">
- IPv6 user group</A>.</P>
-<P>One of the design goals for IPv6 was that it must be possible to
- convert from v4 to v6 via a gradual transition process. Imagine the
- mess if there were a &quot;flag day&quot; after which the entire Internet used
- v6, and all software designed for v4 stopped working. Almost every
- computer on the planet would need major software changes! There would
- be huge costs to replace older equipment. Implementers would be worked
- to death before &quot;the day&quot;, systems administrators and technical support
- would be completely swamped after it. The bugs in every implementation
- would all bite simultaneously. Large chunks of the net would almost
- certainly be down for substantial time periods. ...</P>
-<P>Fortunately, the design avoids any &quot;flag day&quot;. It is therefore a
- little tricky to tell how quickly IPv6 will take over. The transition
- has certainly begun. For examples, see announcements from<A href="http://www.mailbase.ac.uk/lists/internet2/2000-03/0016.html">
- NTT</A> and<A href="http://www.vnunet.com/News/1102383"> Nokia</A>.
- However, it is not yet clear how quickly the process will gain
- momentum, or when it will be completed. Likely large parts of the
- Internet will remain with IPv4 for years to come.</P>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="trouble.html">Previous</A>
-<A HREF="interop.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/config.html b/doc/config.html
deleted file mode 100644
index 4e9f0a513..000000000
--- a/doc/config.html
+++ /dev/null
@@ -1,308 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="install.html">Previous</A>
-<A HREF="background.html">Next</A>
-<HR>
-<H1><A NAME="config">How to configure FreeS/WAN</A></H1>
-<P>This page will teach you how to configure a simple network-to-network
- link or a Road Warrior connection between two Linux FreeS/WAN boxes.</P>
-<P>See also these related documents:</P>
-<UL>
-<LI>our<A HREF="quickstart.html#quickstart"> quickstart</A> guide to<A HREF="glossary.html#carpediem">
- opportunistic encryption</A></LI>
-<LI>our guide to configuration with<A HREF="policygroups.html#policygroups">
- policy groups</A></LI>
-<LI>our<A HREF="adv_config.html#adv_config"> advanced configuration</A>
- document</LI>
-</UL>
-<P> The network-to-network setup allows you to connect two office
- networks into one Virtual Private Network, while the Road Warrior
- connection secures a laptop's telecommute to work. Our examples also
- show the basic procedure on the Linux FreeS/WAN side where another
- IPsec peer is in play.</P>
-<P> Shortcut to<A HREF="#config.netnet"> net-to-net</A>.
-<BR> Shortcut to<A HREF="#config.rw"> Road Warrior</A>.</P>
-<H2><A NAME="16_1">Requirements</A></H2>
-<P>To configure the network-to-network connection you must have:</P>
-<UL>
-<LI>two Linux gateways with static IPs</LI>
-<LI>a network behind each gate. Networks must have non-overlapping IP
- ranges.</LI>
-<LI>Linux FreeS/WAN<A HREF="install.html#install"> installed</A> on both
- gateways</LI>
-<LI><A HREF="http://www.tcpdump.org"><VAR>tcpdump</VAR></A> on the local
- gate, to test the connection</LI>
-</UL>
-<P>For the Road Warrior you need:</P>
-<UL>
-<LI>one Linux box with a static IP</LI>
-<LI>a Linux laptop with a dynamic IP</LI>
-<LI>Linux FreeS/WAN installed on both</LI>
-<LI>for testing,<VAR> tcpdump</VAR> on your gateway or laptop</LI>
-</UL>
-<P>If both IPs are dynamic, your situation is a bit trickier. Your best
- bet is a variation on the<A HREF="#config.rw"> Road Warrior</A>, as
- described in<A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00282.html">
- this mailing list message</A>.</P>
-<H2><A name="config.netnet"></A>Net-to-Net connection</H2>
-<H3><A name="netnet.info.ex">Gather information</A></H3>
-<P>For each gateway, compile the following information:</P>
-<UL>
-<LI>gateway IP</LI>
-<LI>IP range of the subnet you will be protecting. This doesn't have to
- be your whole physical subnet.</LI>
-<LI>a name by which that gateway can identify itself for IPsec
- negotiations. Its form is a Fully Qualified Domain Name preceded by an
- @ sign, ie. @xy.example.com.
-<BR> It does not need to be within a domain that you own. It can be a
- made-up name.</LI>
-</UL>
-<H4>Get your leftrsasigkey</H4>
-<P>On your local Linux FreeS/WAN gateway, print your IPsec public key:</P>
-<PRE>    ipsec showhostkey --left</PRE>
-<P>The output should look like this (with the key shortened for easy
- reading):</P>
-<PRE>    # RSA 2048 bits   xy.example.com   Fri Apr 26 15:01:41 2002
-    leftrsasigkey=0sAQOnwiBPt...</PRE>
-<P>Don't have a key? Use<A HREF="manpage.d/ipsec_newhostkey.8.html"><VAR>
- ipsec newhostkey</VAR></A> to create one.</P>
-<H4>...and your rightrsasigkey</H4>
-<P>Get a console on the remote side:</P>
-<PRE>    ssh2 ab.example.com</PRE>
-<P>In that window, type:</P>
-<PRE>    ipsec showhostkey --right</PRE>
-<P>You'll see something like:</P>
-<PRE>    # RSA 2192 bits   ab.example.com   Thu May 16 15:26:20 2002
-    rightrsasigkey=0sAQOqH55O...</PRE>
-<H3><A NAME="16_2_2">Edit<VAR> /etc/ipsec.conf</VAR></A></H3>
-<P>Back on the local gate, copy our template to<VAR> /etc/ipsec.conf</VAR>
-. (on Mandrake,<VAR> /etc/freeswan/ipsec.conf</VAR>). Substitute the
- information you've gathered for our example data.</P>
-<PRE>conn net-to-net
-    left=192.0.2.2                 # Local vitals
-    leftsubnet=192.0.2.128/29      # 
-    leftid=@xy.example.com         #   
-    leftrsasigkey=0s1LgR7/oUM...   #
-    leftnexthop=%defaultroute      # correct in many situations 
-    right=192.0.2.9                # Remote vitals
-    rightsubnet=10.0.0.0/24        #
-    rightid=@ab.example.com        # 
-    rightrsasigkey=0sAQOqH55O...   #
-    rightnexthop=%defaultroute     # correct in many situations
-    auto=add                       # authorizes but doesn't start this 
-                                   # connection at startup</PRE>
-<P> &quot;Left&quot; and &quot;right&quot; should represent the machines that have FreeS/WAN
- installed on them, and &quot;leftsubnet&quot; and &quot;rightsubnet&quot; machines that are
- being protected. /32 is assumed for left/right and left/rightsubnet
- parameters.</P>
-<P>Copy<VAR> conn net-to-net</VAR> to the remote-side /etc/ipsec.conf.
- If you've made no other modifications to either<VAR> ipsec.conf</VAR>,
- simply:</P>
-<PRE>    scp2 ipsec.conf root@ab.example.com:/etc/ipsec.conf</PRE>
-<H3><A NAME="16_2_3">Start your connection</A></H3>
-<P>Locally, type:</P>
-<PRE>    ipsec auto --up net-to-net</PRE>
-<P>You should see:</P>
-<PRE>    104 &quot;net-net&quot; #223: STATE_MAIN_I1: initiate
-    106 &quot;net-net&quot; #223: STATE_MAIN_I2: sent MI2, expecting MR2
-    108 &quot;net-net&quot; #223: STATE_MAIN_I3: sent MI3, expecting MR3
-    004 &quot;net-net&quot; #223: STATE_MAIN_I4: ISAKMP SA established
-    112 &quot;net-net&quot; #224: STATE_QUICK_I1: initiate
-    004 &quot;net-net&quot; #224: STATE_QUICK_I2: sent QI2, IPsec SA established</PRE>
-<P>The important thing is<VAR> IPsec SA established</VAR>. If you're
- unsuccessful, see our<A HREF="trouble.html#trouble"> troubleshooting
- tips</A>.</P>
-<H3><A NAME="16_2_4">Do not MASQ or NAT packets to be tunneled</A></H3>
-<P>If you are using<A HREF="glossary.html#masq"> IP masquerade</A> or<A HREF="glossary.html#NAT.gloss">
- Network Address Translation (NAT)</A> on either gateway, you must now
- exempt the packets you wish to tunnel from this treatment. For example,
- if you have a rule like:</P>
-<PRE>iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -j MASQUERADE
-</PRE>
-<P>change it to something like:</P>
-<PRE>iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -d \! 192.0.2.128/29 -j MASQUERADE</PRE>
-<P>This may be necessary on both gateways.</P>
-<H3><A NAME="16_2_5">Test your connection</A></H3>
-<P>Sit at one of your local subnet nodes (not the gateway), and ping a
- subnet node on the other (again, not the gateway).</P>
-<PRE>    ping fileserver.toledo.example.com</PRE>
-<P>While still pinging, go to the local gateway and snoop your outgoing
- interface, for example:</P>
-<PRE>    tcpdump -i ppp0</PRE>
-<P>You want to see ESP (Encapsulating Security Payload) packets moving<B>
- back and forth</B> between the two gateways at the same frequency as
- your pings:</P>
-<PRE>    19:16:32.046220 192.0.2.2 &gt; 192.0.2.9: ESP(spi=0x3be6c4dc,seq=0x3)
-    19:16:32.085630 192.0.2.9 &gt; 192.0.2.2: ESP(spi=0x5fdd1cf8,seq=0x6)</PRE>
-<P>If you see this, congratulations are in order! You have a tunnel
- which will protect any IP data from one subnet to the other, as it
- passes between the two gates. If not, go and<A HREF="trouble.html#trouble">
- troubleshoot</A>.</P>
-<P>Note: your new tunnel protects only net-net traffic, not
- gateway-gateway, or gateway-subnet. If you need this (for example, if
- machines on one net need to securely contact a fileserver on the IPsec
- gateway), you'll need to create<A HREF="adv_config.html#adv_config">
- extra connections</A>.</P>
-<H3><A NAME="16_2_6">Finishing touches</A></H3>
-<P>Now that your connection works, name it something sensible, like:</P>
-<PRE>conn winstonnet-toledonet</PRE>
-<P>To have the tunnel come up on-boot, replace</P>
-<PRE>    auto=add</PRE>
-<P>with:</P>
-<PRE>    auto=start</PRE>
-<P>Copy these changes to the other side, for example:</P>
-<PRE>    scp2 ipsec.conf root@ab.example.com:/etc/ipsec.conf</PRE>
-<P>Enjoy!</P>
-<H2><A name="config.rw"></A>Road Warrior Configuration</H2>
-<H3><A name="rw.info.ex">Gather information</A></H3>
-<P>You'll need to know:</P>
-<UL>
-<LI>the gateway's static IP</LI>
-<LI>the IP range of the subnet behind that gateway</LI>
-<LI>a name by which each side can identify itself for IPsec
- negotiations. Its form is a Fully Qualified Domain Name preceded by an
- @ sign, ie. @road.example.com.
-<BR> It does not need to be within a domain that you own. It can be a
- made-up name.</LI>
-</UL>
-<H4>Get your leftrsasigkey...</H4>
-<P>On your laptop, print your IPsec public key:</P>
-<PRE>    ipsec showhostkey --left</PRE>
-<P>The output should look like this (with the key shortened for easy
- reading):</P>
-<PRE>    # RSA 2192 bits   road.example.com   Sun Jun  9 02:45:02 2002
-    leftrsasigkey=0sAQPIPN9uI...</PRE>
-<P>Don't have a key? See<A HREF="old_config.html#genrsakey"> these
- instructions</A>.</P>
-<H4>...and your rightrsasigkey</H4>
-<P>Get a console on the gateway:</P>
-<PRE>    ssh2 xy.example.com</PRE>
-<P>View the gateway's public key with:</P>
-<PRE>    ipsec showhostkey --right</PRE>
-<P>This will yield something like</P>
-<PRE>    # RSA 2048 bits   xy.example.com   Fri Apr 26 15:01:41 2002
-    rightrsasigkey=0sAQOnwiBPt...</PRE>
-<H3><A NAME="16_3_2">Customize<VAR> /etc/ipsec.conf</VAR></A></H3>
-<P>On your laptop, copy this template to<VAR> /etc/ipsec.conf</VAR>. (on
- Mandrake,<VAR> /etc/freeswan/ipsec.conf</VAR>). Substitute the
- information you've gathered for our example data.</P>
-<PRE>conn road
-    left=%defaultroute             # Picks up our dynamic IP 
-    leftnexthop=%defaultroute      # 
-    leftid=@road.example.com       # Local information
-    leftrsasigkey=0sAQPIPN9uI...   #
-    right=192.0.2.10               # Remote information
-    rightsubnet=10.0.0.0/24        #
-    rightid=@xy.example.com        # 
-    rightrsasigkey=0sAQOnwiBPt...  #
-    auto=add                       # authorizes but doesn't start this
-                                   # connection at startup</PRE>
-<P>The template for the gateway is different. Notice how it reverses<VAR>
- left</VAR> and<VAR> right</VAR>, in keeping with our convention that<STRONG>
- L</STRONG>eft is<STRONG> L</STRONG>ocal,<STRONG> R</STRONG>ight<STRONG>
- R</STRONG>emote. Be sure to switch your rsasigkeys in keeping with
- this.</P>
-<PRE>    ssh2 xy.example.com
-    vi /etc/ipsec.conf</PRE>
-<P>and add:</P>
-<PRE>conn road
-    left=192.0.2.2                 # Gateway's information
-    leftid=@xy.example.com         #
-    leftsubnet=192.0.2.128/29      #
-    leftrsasigkey=0sAQOnwiBPt...   #
-    rightnexthop=%defaultroute     # correct in many situations
-    right=%any                     # Wildcard: we don't know the laptop's IP
-    rightid=@road.example.com      #
-    rightrsasigkey=0sAQPIPN9uI...  #
-    auto=add                       # authorizes but doesn't start this
-                                   # connection at startup</PRE>
-<H3><A NAME="16_3_3">Start your connection</A></H3>
-<P>You must start the connection from the Road Warrior side. On your
- laptop, type:</P>
-<PRE>    ipsec auto --start net-to-net</PRE>
-<P>You should see:</P>
-<PRE>104 &quot;net-net&quot; #223: STATE_MAIN_I1: initiate
-106 &quot;road&quot; #301: STATE_MAIN_I2: sent MI2, expecting MR2
-108 &quot;road&quot; #301: STATE_MAIN_I3: sent MI3, expecting MR3
-004 &quot;road&quot; #301: STATE_MAIN_I4: ISAKMP SA established
-112 &quot;road&quot; #302: STATE_QUICK_I1: initiate
-004 &quot;road&quot; #302: STATE_QUICK_I2: sent QI2, IPsec SA established</PRE>
-<P>Look for<VAR> IPsec SA established</VAR>. If you're unsuccessful, see
- our<A HREF="trouble.html#trouble"> troubleshooting tips</A>.</P>
-<H3><A NAME="16_3_4">Do not MASQ or NAT packets to be tunneled</A></H3>
-<P>If you are using<A HREF="glossary.html#masq"> IP masquerade</A> or<A HREF="glossary.html#NAT.gloss">
- Network Address Translation (NAT)</A> on either gateway, you must now
- exempt the packets you wish to tunnel from this treatment. For example,
- if you have a rule like:</P>
-<PRE>iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -j MASQUERADE
-</PRE>
-<P>change it to something like:</P>
-<PRE>iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -d \! 192.0.2.128/29 -j MASQUERADE</PRE>
-<H3><A NAME="16_3_5">Test your connection</A></H3>
-<P>From your laptop, ping a subnet node behind the remote gateway. Do
- not choose the gateway itself for this test.</P>
-<PRE>    ping ns.winston.example.com</PRE>
-<P>Snoop the packets exiting the laptop, with a command like:</P>
-<PRE>    tcpdump -i wlan0</PRE>
-<P>You have success if you see (Encapsulating Security Payload) packets
- travelling<B> in both directions</B>:</P>
-<PRE>    19:16:32.046220 192.0.2.2 &gt; 192.0.2.9: ESP(spi=0x3be6c4dc,seq=0x3)
-    19:16:32.085630 192.0.2.9 &gt; 192.0.2.2: ESP(spi=0x5fdd1cf8,seq=0x6)</PRE>
-<P>If you do, great! Traffic between your Road Warrior and the net
- behind your gateway is protected. If not, see our<A HREF="trouble.html#trouble">
- troubleshooting hints</A>.</P>
-<P>Your new tunnel protects only traffic addressed to the net, not to
- the IPsec gateway itself. If you need the latter, you'll want to make
- an<A HREF="adv_config.html#adv_config"> extra tunnel.</A>.</P>
-<H3><A NAME="16_3_6">Finishing touches</A></H3>
-<P>On both ends, name your connection wisely, like:</P>
-<PRE>conn mike-to-office</PRE>
-<P><B>On the laptop only,</B> replace</P>
-<PRE>    auto=add</PRE>
-<P>with:</P>
-<PRE>    auto=start</PRE>
-<P>so that you'll be connected on-boot.</P>
-<P>Happy telecommuting!</P>
-<H3><A NAME="16_3_7">Multiple Road Warriors</A></H3>
-<P>If you're using RSA keys, as we did in this example, you can add as
- many Road Warriors as you like. The left/rightid parameter lets Linux
- FreeS/WAN distinguish between multiple Road Warrior peers, each with
- its own public key.</P>
-<P>The situation is different for shared secrets (PSK). During a PSK
- negotiation, ID information is not available at the time Pluto is
- trying to determine which secret to use, so, effectively, you can only
- define one Roadwarrior connection. All your PSK road warriors must
- therefore share one secret.</P>
-<H2><A NAME="16_4">What next?</A></H2>
-<P>Using the principles illustrated here, you can try variations such
- as:</P>
-<UL>
-<LI>a telecommuter with a static IP</LI>
-<LI>a road warrior with a subnet behind it</LI>
-</UL>
-<P>Or, look at some of our<A HREF="adv_config.html#adv_config"> more
- complex configuration examples.</A>.</P>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="install.html">Previous</A>
-<A HREF="background.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/draft-richardson-ipsec-opportunistic.txt b/doc/draft-richardson-ipsec-opportunistic.txt
deleted file mode 100644
index 4c87d857a..000000000
--- a/doc/draft-richardson-ipsec-opportunistic.txt
+++ /dev/null
@@ -1,2688 +0,0 @@
-
-
-Independent submission                                     M. Richardson
-Internet-Draft                                                       SSW
-Expires: November 19, 2003                                 D. Redelmeier
-                                                                  Mimosa
-                                                            May 21, 2003
-
-
-     Opportunistic Encryption using The Internet Key Exchange (IKE)
-              draft-richardson-ipsec-opportunistic-11.txt
-
-Status of this Memo
-
-   This document is an Internet-Draft and is in full conformance with
-   all provisions of Section 10 of RFC2026.
-
-   Internet-Drafts are working documents of the Internet Engineering
-   Task Force (IETF), its areas, and its working groups.  Note that
-   other groups may also distribute working documents as Internet-
-   Drafts.
-
-   Internet-Drafts are draft documents valid for a maximum of six months
-   and may be updated, replaced, or obsoleted by other documents at any
-   time.  It is inappropriate to use Internet-Drafts as reference
-   material or to cite them other than as "work in progress."
-
-   The list of current Internet-Drafts can be accessed at http://
-   www.ietf.org/ietf/1id-abstracts.txt.
-
-   The list of Internet-Draft Shadow Directories can be accessed at
-   http://www.ietf.org/shadow.html.
-
-   This Internet-Draft will expire on November 19, 2003.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (2003).  All Rights Reserved.
-
-Abstract
-
-   This document describes opportunistic encryption (OE) using the
-   Internet Key Exchange (IKE) and IPsec.  Each system administrator
-   adds new resource records to his or her Domain Name System (DNS) to
-   support opportunistic encryption.  The objective is to allow
-   encryption for secure communication without any pre-arrangement
-   specific to the pair of systems involved.
-
-   DNS is used to distribute the public keys of each system involved.
-   This is resistant to passive attacks.  The use of DNS Security
-   (DNSSEC) secures this system against active attackers as well.
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003            [Page 1]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   As a result, the administrative overhead is reduced from the square
-   of the number of systems to a linear dependence, and it becomes
-   possible to make secure communication the default even when the
-   partner is not known in advance.
-
-   This document is offered up as an Informational RFC.
-
-Table of Contents
-
-   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
-   2.  Overview . . . . . . . . . . . . . . . . . . . . . . . . . . .  6
-   3.  Specification  . . . . . . . . . . . . . . . . . . . . . . . . 10
-   4.  Impacts on IKE . . . . . . . . . . . . . . . . . . . . . . . . 21
-   5.  DNS issues . . . . . . . . . . . . . . . . . . . . . . . . . . 24
-   6.  Network address translation interaction  . . . . . . . . . . . 28
-   7.  Host implementations . . . . . . . . . . . . . . . . . . . . . 29
-   8.  Multi-homing . . . . . . . . . . . . . . . . . . . . . . . . . 30
-   9.  Failure modes  . . . . . . . . . . . . . . . . . . . . . . . . 32
-   10. Unresolved issues  . . . . . . . . . . . . . . . . . . . . . . 34
-   11. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
-   12. Security considerations  . . . . . . . . . . . . . . . . . . . 42
-   13. IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 44
-   14. Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 45
-       Normative references . . . . . . . . . . . . . . . . . . . . . 46
-       Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 47
-       Full Copyright Statement . . . . . . . . . . . . . . . . . . . 48
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003            [Page 2]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-1. Introduction
-
-1.1 Motivation
-
-   The objective of opportunistic encryption is to allow encryption
-   without any pre-arrangement specific to the pair of systems involved.
-   Each system administrator adds public key information to DNS records
-   to support opportunistic encryption and then enables this feature in
-   the nodes' IPsec stack.  Once this is done, any two such nodes can
-   communicate securely.
-
-   This document describes opportunistic encryption as designed and
-   mostly implemented by the Linux FreeS/WAN project.  For project
-   information, see http://www.freeswan.org.
-
-   The Internet Architecture Board (IAB) and Internet Engineering
-   Steering Group (IESG) have taken a strong stand that the Internet
-   should use powerful encryption to provide security and privacy [4].
-   The Linux FreeS/WAN project attempts to provide a practical means to
-   implement this policy.
-
-   The project uses the IPsec, ISAKMP/IKE, DNS and DNSSEC protocols
-   because they are standardized, widely available and can often be
-   deployed very easily without changing hardware or software or
-   retraining users.
-
-   The extensions to support opportunistic encryption are simple.  No
-   changes to any on-the-wire formats are needed.  The only changes are
-   to the policy decision making system.  This means that opportunistic
-   encryption can be implemented with very minimal changes to an
-   existing IPsec implementation.
-
-   Opportunistic encryption creates a "fax effect".  The proliferation
-   of the fax machine was possible because it did not require that
-   everyone buy one overnight.  Instead, as each person installed one,
-   the value of having one increased - as there were more people that
-   could receive faxes.  Once opportunistic encryption is installed it
-   automatically recognizes other boxes using opportunistic encryption,
-   without any further configuration by the network administrator.  So,
-   as opportunistic encryption software is installed on more boxes, its
-   value as a tool increases.
-
-   This document describes the infrastructure to permit deployment of
-   Opportunistic Encryption.
-
-   The term S/WAN is a trademark of RSA Data Systems, and is used with
-   permission by this project.
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003            [Page 3]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-1.2 Types of network traffic
-
-   To aid in understanding the relationship between security processing
-   and IPsec we divide network traffic into four categories:
-
-   * Deny: networks to which traffic is always forbidden.
-
-   * Permit: networks to which traffic in the clear is permitted.
-
-   * Opportunistic tunnel: networks to which traffic is encrypted if
-      possible, but otherwise is in the clear or fails depending on the
-      default policy in place.
-
-   * Configured tunnel: networks to which traffic must be encrypted, and
-      traffic in the clear is never permitted.
-
-   Traditional firewall devices handle the first two categories.  No
-   authentication is required.  The permit policy is currently the
-   default on the Internet.
-
-   This document describes the third category - opportunistic tunnel,
-   which is proposed as the new default for the Internet.
-
-   Category four, encrypt traffic or drop it, requires authentication of
-   the end points.  As the number of end points is typically bounded and
-   is typically under a single authority, arranging for distribution of
-   authentication material, while difficult, does not require any new
-   technology.  The mechanism described here provides an additional way
-   to distribute the authentication materials, that of a public key
-   method that does not require deployment of an X.509 based
-   infrastructure.
-
-   Current Virtual Private Networks can often be replaced by an "OE
-   paranoid" policy as described herein.
-
-1.3 Peer authentication in opportunistic encryption
-
-   Opportunistic encryption creates tunnels between nodes that are
-   essentially strangers.  This is done without any prior bilateral
-   arrangement.  There is, therefore, the difficult question of how one
-   knows to whom one is talking.
-
-   One possible answer is that since no useful authentication can be
-   done, none should be tried.  This mode of operation is named
-   "anonymous encryption".  An active man-in-the-middle attack can be
-   used to thwart the privacy of this type of communication.  Without
-   peer authentication, there is no way to prevent this kind of attack.
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003            [Page 4]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   Although a useful mode, anonymous encryption is not the goal of this
-   project.  Simpler methods are available that can achieve anonymous
-   encryption only, but authentication of the peer is a desireable goal.
-   The latter is achieved through key distribution in DNS, leveraging
-   upon the authentication of the DNS in DNSSEC.
-
-   Peers are, therefore, authenticated with DNSSEC when available.
-   Local policy determines how much trust to extend when DNSSEC is not
-   available.
-
-   However, an essential premise of building private connections with
-   strangers is that datagrams received through opportunistic tunnels
-   are no more special than datagrams that arrive in the clear.  Unlike
-   in a VPN, these datagrams should not be given any special exceptions
-   when it comes to auditing, further authentication or firewalling.
-
-   When initiating outbound opportunistic encryption, local
-   configuration determines what happens if tunnel setup fails.  It may
-   be that the packet goes out in the clear, or it may be dropped.
-
-1.4 Use of RFC2119 terms
-
-   The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,
-   SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this
-   document, are to be interpreted as described in [5]
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003            [Page 5]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-2. Overview
-
-2.1 Reference diagram
-
-   ---------------------------------------------------------------------
-
-   The following network diagram is used in the rest of this document as
-   the canonical diagram:
-
-                             [Q]  [R]
-                              .    .              AS2
-     [A]----+----[SG-A].......+....+.......[SG-B]-------[B]
-            |                 ......
-        AS1 |                 ..PI..
-            |                 ......
-     [D]----+----[SG-D].......+....+.......[C] AS3
-
-
-
-                  Figure 1: Reference Network Diagram
-
-   ---------------------------------------------------------------------
-
-   In this diagram, there are four end-nodes: A, B, C and D.  There are
-   three gateways, SG-A, SG-B, SG-D.  A, D, SG-A and SG-D are part of
-   the same administrative authority, AS1.  SG-A and SG-D are on two
-   different exit paths from organization 1.  SG-B/B is an independent
-   organization, AS2.  Nodes Q and R are nodes on the Internet.  PI is
-   the Public Internet ("The Wild").
-
-2.2 Terminology
-
-   The following terminology is used in this document:
-
-   Security gateway: a system that performs IPsec tunnel mode
-      encapsulation/decapsulation.  [SG-x] in the diagram.
-
-   Alice: node [A] in the diagram.  When an IP address is needed, this
-      is 192.1.0.65.
-
-   Bob: node [B] in the diagram.  When an IP address is needed, this is
-      192.2.0.66.
-
-   Carol: node [C] in the diagram.  When an IP address is needed, this
-      is 192.1.1.67.
-
-   Dave: node [D] in the diagram.  When an IP address is needed, this is
-      192.3.0.68.
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003            [Page 6]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   SG-A: Alice's security gateway.  Internally it is 192.1.0.1,
-      externally it is 192.1.1.4.
-
-   SG-B: Bob's security gateway.  Internally it is 192.2.0.1, externally
-      it is 192.1.1.5.
-
-   SG-D: Dave's security gateway.  Also Alice's backup security gateway.
-      Internally it is 192.3.0.1, externally it is 192.1.1.6.
-
-   -  A single dash represents clear-text datagrams.
-
-   =  An equals sign represents phase 2 (IPsec) cipher-text datagrams.
-
-   ~  A single tilde represents clear-text phase 1 datagrams.
-
-   #  A hash sign represents phase 1 (IKE) cipher-text datagrams.
-
-   .  A period represents an untrusted network of unknown type.
-
-   Configured tunnel: a tunnel that is directly and deliberately hand
-      configured on participating gateways.  Configured tunnels are
-      typically given a higher level of trust than opportunistic
-      tunnels.
-
-   Road warrior tunnel: a configured tunnel connecting one node with a
-      fixed IP address and one node with a variable IP address.  A road
-      warrior (RW) connection must be initiated by the variable node,
-      since the fixed node cannot know the current address for the road
-      warrior.
-
-   Anonymous encryption: the process of encrypting a session without any
-      knowledge of who the other parties are.  No authentication of
-      identities is done.
-
-   Opportunistic encryption: the process of encrypting a session with
-      authenticated knowledge of who the other parties are.
-
-   Lifetime: the period in seconds (bytes or datagrams) for which a
-      security association will remain alive before needing to be re-
-      keyed.
-
-   Lifespan: the effective time for which a security association remains
-      useful.  A security association with a lifespan shorter than its
-      lifetime would be removed when no longer needed.  A security
-      association with a lifespan longer than its lifetime would need to
-      be re-keyed one or more times.
-
-   Phase 1 SA: an ISAKMP/IKE security association sometimes referred to
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003            [Page 7]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-      as a keying channel.
-
-   Phase 2 SA: an IPsec security association.
-
-   Tunnel: another term for a set of phase 2 SA (one in each direction).
-
-   NAT: Network Address Translation (see [20]).
-
-   NAPT: Network Address and Port Translation (see [20]).
-
-   AS: an autonomous system (AS) is a group of systems (a network) that
-      are under the administrative control of a single organization.
-
-   Default-free zone: a set of routers that maintain a complete set of
-      routes to all currently reachable destinations.  Having such a
-      list, these routers never make use of a default route.  A datagram
-      with a destination address not matching any route will be dropped
-      by such a router.
-
-
-2.3 Model of operation
-
-   The opportunistic encryption security gateway (OE gateway) is a
-   regular gateway node as described in [2] section 2.4 and [3] with the
-   additional capabilities described here and in [7].  The algorithm
-   described here provides a way to determine, for each datagram,
-   whether or not to encrypt and tunnel the datagram.  Two important
-   things that must be determined are whether or not to encrypt and
-   tunnel and, if so, the destination address or name of the tunnel end
-   point which should be used.
-
-2.3.1 Tunnel authorization
-
-   The OE gateway determines whether or not to create a tunnel based on
-   the destination address of each packet.  Upon receiving a packet with
-   a destination address not recently seen, the OE gateway performs a
-   lookup in DNS for an authorization resource record (see Section 5.2).
-   The record is located using the IP address to perform a search in the
-   in-addr.arpa (IPv4) or ip6.arpa (IPv6) maps.  If an authorization
-   record is found, the OE gateway interprets this as a request for a
-   tunnel to be formed.
-
-2.3.2 Tunnel end-point discovery
-
-   The authorization resource record also provides the address or name
-   of the tunnel end point which should be used.
-
-   The record may also provide the public RSA key of the tunnel end
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003            [Page 8]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   point itself.  This is provided for efficiency only.  If the public
-   RSA key is not present, the OE gateway performs a second lookup to
-   find a KEY resource record for the end point address or name.
-
-   Origin and integrity protection of the resource records is provided
-   by DNSSEC ([16]).  Section 3.2.4.1 documents an optional restriction
-   on the tunnel end point if DNSSEC signatures are not available for
-   the relevant records.
-
-2.3.3 Caching of authorization results
-
-   The OE gateway maintains a cache, in the forwarding plane, of source/
-   destination pairs for which opportunistic encryption has been
-   attempted.  This cache maintains a record of whether or not OE was
-   successful so that subsequent datagrams can be forwarded properly
-   without additional delay.
-
-   Successful negotiation of OE instantiates a new security association.
-   Failure to negotiate OE results in creation of a forwarding policy
-   entry either to drop or transmit in the clear future datagrams.  This
-   negative cache is necessary to avoid the possibly lengthy process of
-   repeatedly looking up the same information.
-
-   The cache is timed out periodically, as described in Section 3.4.
-   This removes entries that are no longer being used and permits the
-   discovery of changes in authorization policy.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003            [Page 9]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-3. Specification
-
-   The OE gateway is modeled to have a forwarding plane and a control
-   plane.  A control channel, such as PF_KEY, connects the two planes.
-   (See [6].) The forwarding plane performs per datagram operations.
-   The control plane contains a keying daemon, such as ISAKMP/IKE, and
-   performs all authorization, peer authentication and key derivation
-   functions.
-
-3.1 Datagram state machine
-
-   Let the OE gateway maintain a collection of objects -- a superset of
-   the security policy database (SPD) specified in [7].  For each
-   combination of source and destination address, an SPD object exists
-   in one of five following states.  Prior to forwarding each datagram,
-   the responder uses the source and destination addresses to pick an
-   entry from the SPD.  The SPD then determines if and how the packet is
-   forwarded.
-
-3.1.1 Non-existent policy
-
-   If the responder does not find an entry, then this policy applies.
-   The responder creates an entry with an initial state of "hold policy"
-   and requests keying material from the keying daemon.  The responder
-   does not forward the datagram, rather it attaches the datagram to the
-   SPD entry as the  "first" datagram and retains it for eventual
-   transmission in a new state.
-
-3.1.2 Hold policy
-
-   The responder requests keying material.  If the interface to the
-   keying system is lossy (PF_KEY, for instance, can be), the
-   implementation SHOULD include a mechanism to retransmit the keying
-   request at a rate limited to less than 1 request per second.  The
-   responder does not forward the datagram.  It attaches the datagram to
-   the SPD entry as the "last" datagram where it is retained for
-   eventual transmission.  If there is a datagram already so stored,
-   then that already stored datagram is discarded.
-
-   Because the "first" datagram is probably a TCP SYN packet, the
-   responder retains the "first" datagram in an attempt to avoid waiting
-   for a TCP retransmit.  The responder retains the "last" datagram in
-   deference to streaming protocols that find it useful to know how much
-   data has been lost.  These are recommendations to decrease latency.
-   There are no operational requirements for this.
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 10]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-3.1.3 Pass-through policy
-
-   The responder forwards the datagram using the normal forwarding
-   table.  The responder enters this state only by command from the
-   keying daemon, and upon entering this state, also forwards the
-   "first" and "last" datagrams.
-
-3.1.4 Deny policy
-
-   The responder discards the datagram.  The responder enters this state
-   only by command from the keying daemon, and upon entering this state,
-   discards the "first" and "last" datagrams.  Local administration
-   decides if further datagrams cause ICMP messages to be generated
-   (i.e.  ICMP Destination Unreachable, Communication Administratively
-   Prohibited.  type=3, code=13).
-
-3.1.5 Encrypt policy
-
-   The responder encrypts the datagram using the indicated security
-   association database (SAD) entry.  The responder enters this state
-   only by command from the keying daemon, and upon entering this state,
-   releases and forwards the "first" and "last" datagrams using the new
-   encrypt policy.
-
-   If the associated SAD entry expires because of byte, packet or time
-   limits, then the entry returns to the Hold policy, and an expire
-   message is sent to the keying daemon.
-
-   All states may be created directly by the keying daemon while acting
-   as a responder.
-
-3.2 Keying state machine - initiator
-
-   Let the keying daemon maintain a collection of objects.  Let them be
-   called "connections" or "conn"s.  There are two categories of
-   connection objects: classes and instances.  A class represents an
-   abstract policy - what could be.  An instance represents an actual
-   connection - what is implemented at the time.
-
-   Let there be two further subtypes of connections: keying channels
-   (Phase 1 SAs) and data channels (Phase 2 SAs).  Each data channel
-   object may have a corresponding SPD and SAD entry maintained by the
-   datagram state machine.
-
-   For the purposes of opportunistic encryption, there MUST, at least,
-   be connection classes known as "deny", "always-clear-text", "OE-
-   permissive", and "OE-paranoid".  The latter two connection classes
-   define a set of source and/or destination addresses for which
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 11]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   opportunistic encryption will be attempted.  The administrator MAY
-   set policy options in a number of additional places.  An
-   implementation MAY create additional connection classes to further
-   refine these policies.
-
-   The simplest system may need only the "OE-permissive" connection, and
-   would list its own (single) IP address as the source address of this
-   policy and the wild-card address 0.0.0.0/0 as the destination IPv4
-   address.  That is, the simplest policy is to try opportunistic
-   encryption with all destinations.
-
-   The distinction between permissive and paranoid OE use will become
-   clear in the state transition differences.  In general a permissive
-   OE will, on failure, install a pass-through policy, while a paranoid
-   OE will, on failure, install a drop policy.
-
-   In this description of the keying machine's state transitions, the
-   states associated with the keying system itself are omitted because
-   they are best documented in the keying system ([8], [9] and [10] for
-   ISAKMP/IKE), and the details are keying system specific.
-   Opportunistic encryption is not dependent upon any specific keying
-   protocol, but this document does provide requirements for those using
-   ISAKMP/IKE to assure that implementations inter-operate.
-
-   The state transitions that may be involved in communicating with the
-   forwarding plane are omitted.  PF_KEY and similar protocols have
-   their own set of states required for message sends and completion
-   notifications.
-
-   Finally, the retransmits and recursive lookups that are normal for
-   DNS are not included in this description of the state machine.
-
-3.2.1 Nonexistent connection
-
-   There is no connection instance for a given source/destination
-   address pair.  Upon receipt of a request for keying material for this
-   source/destination pair, the initiator searches through the
-   connection classes to determine the most appropriate policy.  Upon
-   determining an appropriate connection class, an instance object is
-   created of that type.  Both of the OE types result in a potential OE
-   connection.
-
-   Failure to find an appropriate connection class results in an
-   administrator defined default.
-
-   In each case, when the initiator finds an appropriate class for the
-   new flow, an instance connection is made of the class which matched.
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 12]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-3.2.2 Clear-text connection
-
-   The non-existent connection makes a transition to this state when an
-   always-clear-text class is instantiated, or when an OE-permissive
-   connection fails.  During the transition, the initiator creates a
-   pass-through policy object in the forwarding plane for the
-   appropriate flow.
-
-   Timing out is the only way to leave this state (see Section 3.2.7).
-
-3.2.3 Deny connection
-
-   The empty connection makes a transition to this state when a deny
-   class is instantiated, or when an OE-paranoid connection fails.
-   During the transition, the initiator creates a deny policy object in
-   the forwarding plane for the appropriate flow.
-
-   Timing out is the only way to leave this state (see Section 3.2.7).
-
-3.2.4 Potential OE connection
-
-   The empty connection makes a transition to this state when one of
-   either OE class is instantiated.  During the transition to this
-   state, the initiator creates a hold policy object in the forwarding
-   plane for the appropriate flow.
-
-   In addition, when making a transition into this state, DNS lookup is
-   done in the reverse-map for a TXT delegation resource record (see
-   Section 5.2).  The lookup key is the destination address of the flow.
-
-   There are three ways to exit this state:
-
-   1.  DNS lookup finds a TXT delegation resource record.
-
-   2.  DNS lookup does not find a TXT delegation resource record.
-
-   3.  DNS lookup times out.
-
-   Based upon the results of the DNS lookup, the potential OE connection
-   makes a transition to the pending OE connection state.  The
-   conditions for a successful DNS look are:
-
-   1.  DNS finds an appropriate resource record
-
-   2.  It is properly formatted according to Section 5.2
-
-   3.  if DNSSEC is enabled, then the signature has been vouched for.
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 13]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   Note that if the initiator does not find the public key present in
-   the TXT delegation record, then the public key must be looked up as a
-   sub-state.  Only successful completion of all the DNS lookups is
-   considered a success.
-
-   If DNS lookup does not find a resource record or DNS times out, then
-   the initiator considers the receiver not OE capable.  If this is an
-   OE-paranoid instance, then the potential OE connection makes a
-   transition to the deny connection state.  If this is an OE-permissive
-   instance, then the potential OE connection makes a transition to the
-   clear-text connection state.
-
-   If the initiator finds a resource record but it is not properly
-   formatted, or if DNSSEC is enabled and reports a failure to
-   authenticate, then the potential OE connection should make a
-   transition to the deny connection state.  This action SHOULD be
-   logged.  If the administrator wishes to override this transition
-   between states, then an always-clear class can be installed for this
-   flow.  An implementation MAY make this situation a new class.
-
-3.2.4.1 Restriction on unauthenticated TXT delegation records
-
-   An implementation SHOULD also provide an additional administrative
-   control on delegation records and DNSSEC.  This control would apply
-   to delegation records (the TXT records in the reverse-map) that are
-   not protected by DNSSEC.  Records of this type are only permitted to
-   delegate to their own address as a gateway.  When this option is
-   enabled, an active attack on DNS will be unable to redirect packets
-   to other than the original destination.
-
-3.2.5 Pending OE connection
-
-   The potential OE connection makes a transition to this state when the
-   initiator determines that all the information required from the DNS
-   lookup is present.  Upon entering this state, the initiator attempts
-   to initiate keying to the gateway provided.
-
-   Exit from this state occurs either with a successfully created IPsec
-   SA, or with a failure of some kind.  Successful SA creation results
-   in a transition to the key connection state.
-
-   Three failures have caused significant problems.  They are clearly
-   not the only possible failures from keying.
-
-   Note that if there are multiple gateways available in the TXT
-   delegation records, then a failure can only be declared after all
-   have been tried.  Further, creation of a phase 1 SA does not
-   constitute success.  A set of phase 2 SAs (a tunnel) is considered
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 14]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   success.
-
-   The first failure occurs when an ICMP port unreachable is
-   consistently received without any other communication, or when there
-   is silence from the remote end.  This usually means that either the
-   gateway is not alive, or the keying daemon is not functional.  For an
-   OE-permissive connection, the initiator makes a transition to the
-   clear-text connection but with a low lifespan.  For an OE-pessimistic
-   connection, the initiator makes a transition to the deny connection
-   again with a low lifespan.  The lifespan in both cases is kept low
-   because the remote gateway may be in the process of rebooting or be
-   otherwise temporarily unavailable.
-
-   The length of time to wait for the remote keying daemon to wake up is
-   a matter of some debate.  If there is a routing failure, 5 minutes is
-   usually long enough for the network to re-converge.  Many systems can
-   reboot in that amount of time as well.  However, 5 minutes is far too
-   long for most users to wait to hear that they can not connect using
-   OE.  Implementations SHOULD make this a tunable parameter.
-
-   The second failure occurs after a phase 1 SA has been created, but
-   there is either no response to the phase 2 proposal, or the initiator
-   receives a negative notify (the notify must be authenticated).  The
-   remote gateway is not prepared to do OE at this time.  As before, the
-   initiator makes a transition to the clear-text or the deny connection
-   based upon connection class, but this time with a normal lifespan.
-
-   The third failure occurs when there is signature failure while
-   authenticating the remote gateway.  This can occur when there has
-   been a key roll-over, but DNS has not caught up.  In this case again,
-   the initiator makes a transition to the clear-text or the deny
-   connection based upon the connection class.  However, the lifespan
-   depends upon the remaining time to live in the DNS.  (Note that
-   DNSSEC signed resource records have a different expiry time than non-
-   signed records.)
-
-3.2.6 Keyed connection
-
-   The pending OE connection makes a transition to this state when
-   session keying material (the phase 2 SAs) is derived.  The initiator
-   creates an encrypt policy in the forwarding plane for this flow.
-
-   There are three ways to exit this state.  The first is by receipt of
-   an authenticated delete message (via the keying channel) from the
-   peer.  This is normal teardown and results in a transition to the
-   expired connection state.
-
-   The second exit is by expiry of the forwarding plane keying material.
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 15]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   This starts a re-key operation with a transition back to pending OE
-   connection.  In general, the soft expiry occurs with sufficient time
-   left to continue to use the keys.  A re-key can fail, which may
-   result in the connection failing to clear-text or deny as
-   appropriate.  In the event of a failure, the forwarding plane policy
-   does not change until the phase 2 SA (IPsec SA) reaches its hard
-   expiry.
-
-   The third exit is in response to a negotiation from a remote gateway.
-   If the forwarding plane signals the control plane that it has
-   received an unknown SPI from the remote gateway, or an ICMP is
-   received from the remote gateway indicating an unknown SPI, the
-   initiator should consider that the remote gateway has rebooted or
-   restarted.  Since these indications are easily forged, the
-   implementation must exercise care.  The initiator should make a
-   cautious (rate-limited) attempt to re-key the connection.
-
-3.2.7 Expiring connection
-
-   The initiator will periodically place each of the deny, clear-text,
-   and keyed connections into this sub-state.  See Section 3.4 for more
-   details of how often this occurs.  The initiator queries the
-   forwarding plane for last use time of the appropriate policy.  If the
-   last use time is relatively recent, then the connection returns to
-   the previous deny, clear-text or keyed connection state.  If not,
-   then the connection enters the expired connection state.
-
-   The DNS query and answer that lead to the expiring connection state
-   are also examined.  The DNS query may become stale.  (A negative,
-   i.e.  no such record, answer is valid for the period of time given by
-   the MINIMUM field in an attached SOA record.  See [12] section
-   4.3.4.) If the DNS query is stale, then a new query is made.  If the
-   results change, then the connection makes a transition to a new state
-   as described in potential OE connection state.
-
-   Note that when considering how stale a connection is, both outgoing
-   SPD and incoming SAD must be queried as some flows may be
-   unidirectional for some time.
-
-   Also note that the policy at the forwarding plane is not updated
-   unless there is a conclusion that there should be a change.
-
-3.2.8 Expired connection
-
-   Entry to this state occurs when no datagrams have been forwarded
-   recently via the appropriate SPD and SAD objects.  The objects in the
-   forwarding plane are removed (logging any final byte and packet
-   counts if appropriate) and the connection instance in the keying
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 16]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   plane is deleted.
-
-   The initiator sends an ISAKMP/IKE delete to clean up the phase 2 SAs
-   as described in Section 3.4.
-
-   Whether or not to delete the phase 1 SAs at this time is left as a
-   local implementation issue.  Implementations that do delete the phase
-   1 SAs MUST send authenticated delete messages to indicate that they
-   are doing so.  There is an advantage to keeping the phase 1 SAs until
-   they expire - they may prove useful again in the near future.
-
-3.3 Keying state machine - responder
-
-   The responder has a set of objects identical to those of the
-   initiator.
-
-   The responder receives an invitation to create a keying channel from
-   an initiator.
-
-3.3.1 Unauthenticated OE peer
-
-   Upon entering this state, the responder starts a DNS lookup for a KEY
-   record for the initiator.  The responder looks in the reverse-map for
-   a KEY record for the initiator if the initiator has offered an
-   ID_IPV4_ADDR, and in the forward map if the initiator has offered an
-   ID_FQDN type.  (See [8] section 4.6.2.1.)
-
-   The responder exits this state upon successful receipt of a KEY from
-   DNS, and use of the key to verify the signature of the initiator.
-
-   Successful authentication of the peer results in a transition to the
-   authenticated OE Peer state.
-
-   Note that the unauthenticated OE peer state generally occurs in the
-   middle of the key negotiation protocol.  It is really a form of
-   pseudo-state.
-
-3.3.2 Authenticated OE Peer
-
-   The peer will eventually propose one or more phase 2 SAs.  The
-   responder uses the source and destination address in the proposal to
-   finish instantiating the connection state using the connection class
-   table.  The responder MUST search for an identical connection object
-   at this point.
-
-   If an identical connection is found, then the responder deletes the
-   old instance, and the new object makes a transition to the pending OE
-   connection state.  This means that new ISAKMP connections with a
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 17]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   given peer will always use the latest instance, which is the correct
-   one if the peer has rebooted in the interim.
-
-   If an identical connection is not found, then the responder makes the
-   transition according to the rules given for the initiator.
-
-   Note that if the initiator is in OE-paranoid mode and the responder
-   is in either always-clear-text or deny, then no communication is
-   possible according to policy.  An implementation is permitted to
-   create new types of policies such as "accept OE but do not initiate
-   it".  This is a local matter.
-
-3.4 Renewal and teardown
-
-3.4.1 Aging
-
-   A potentially unlimited number of tunnels may exist.  In practice,
-   only a few tunnels are used during a period of time.  Unused tunnels
-   MUST, therefore, be torn down.  Detecting when tunnels are no longer
-   in use is the subject of this section.
-
-   There are two methods for removing tunnels: explicit deletion or
-   expiry.
-
-   Explicit deletion requires an IKE delete message.  As the deletes
-   MUST be authenticated, both ends of the tunnel must maintain the key
-   channel (phase 1 ISAKMP SA).  An implementation which refuses to
-   either maintain or recreate the keying channel SA will be unable to
-   use this method.
-
-   The tunnel expiry method, simply allows the IKE daemon to expire
-   normally without attempting to re-key it.
-
-   Regardless of which method is used to remove tunnels, the
-   implementation requires a method to determine if the tunnel is still
-   in use.  The specifics are a local matter, but  the FreeS/WAN project
-   uses the following criteria.  These criteria are currently
-   implemented in the key management daemon, but could also be
-   implemented at the SPD layer using an idle timer.
-
-   Set a short initial (soft) lifespan of 1 minute since many net flows
-   last only a few seconds.
-
-   At the end of the lifespan, check to see if the tunnel was used by
-   traffic in either direction during the last 30 seconds.  If so,
-   assign a longer tentative lifespan of 20 minutes after which, look
-   again.  If the tunnel is not in use, then close the tunnel.
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 18]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   The expiring state in the key management system (see Section 3.2.7)
-   implements these timeouts.  The timer above may be in the forwarding
-   plane, but then it must be re-settable.
-
-   The tentative lifespan is independent of re-keying; it is just the
-   time when the tunnel's future is next considered.  (The term lifespan
-   is used here rather than lifetime for this reason.) Unlike re-keying,
-   this tunnel use check is not costly and should happen reasonably
-   frequently.
-
-   A multi-step back-off algorithm is not considered worth the effort
-   here.
-
-   If the security gateway and the client host are the same and not a
-   Bump-in-the-Stack or Bump-in-the-Wire implementation, tunnel teardown
-   decisions MAY pay attention to TCP connection status as reported by
-   the local TCP layer.  A still-open TCP connection is almost a
-   guarantee that more traffic is expected.  Closing of the only TCP
-   connection through a tunnel is a strong hint that no more traffic is
-   expected.
-
-3.4.2 Teardown and cleanup
-
-   Teardown should always be coordinated between the two ends of the
-   tunnel by interpreting and sending delete notifications.  There is a
-   detailed sub-state in the expired connection state of the key manager
-   that relates to retransmits of the delete notifications, but this is
-   considered to be a keying system detail.
-
-   On receiving a delete for the outbound SAs of a tunnel (or some
-   subset of them), tear down the inbound ones also and notify the
-   remote end with a delete.  If the local system receives a delete for
-   a tunnel which is no longer in existence, then two delete messages
-   have crossed paths.  Ignore the delete.  The operation has already
-   been completed.  Do not generate any messages in this situation.
-
-   Tunnels are to be considered as bidirectional entities, even though
-   the low-level protocols don't treat them this way.
-
-   When the deletion is initiated locally, rather than as a response to
-   a received delete, send a delete for (all) the inbound SAs of a
-   tunnel.  If the local system does not receive a responding delete for
-   the outbound SAs, try re-sending the original delete.  Three tries
-   spaced 10 seconds apart seems a reasonable level of effort.  A
-   failure of the other end to respond after 3 attempts, indicates that
-   the possibility of further communication is unlikely.  Remove the
-   outgoing SAs.  (The remote system may be a mobile node that is no
-   longer present or powered on.)
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 19]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   After re-keying, transmission should switch to using the new outgoing
-   SAs (ISAKMP or IPsec) immediately, and the old leftover outgoing SAs
-   should be cleared out promptly (delete should be sent for the
-   outgoing SAs) rather than waiting for them to expire.  This reduces
-   clutter and minimizes confusion for the operator doing diagnostics.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 20]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-4. Impacts on IKE
-
-4.1 ISAKMP/IKE protocol
-
-   The IKE wire protocol needs no modifications.  The major changes are
-   implementation issues relating to how the proposals are interpreted,
-   and from whom they may come.
-
-   As opportunistic encryption is designed to be useful between peers
-   without prior operator configuration, an IKE daemon must be prepared
-   to negotiate phase 1 SAs with any node.  This may require a large
-   amount of resources to maintain cookie state, as well as large
-   amounts of entropy for nonces, cookies and so on.
-
-   The major changes to support opportunistic encryption are at the IKE
-   daemon level.  These changes relate to handling of key acquisition
-   requests, lookup of public keys and TXT records, and interactions
-   with firewalls and other security facilities that may be co-resident
-   on the same gateway.
-
-4.2 Gateway discovery process
-
-   In a typical configured tunnel, the address of SG-B is provided via
-   configuration.  Furthermore, the mapping of an SPD entry to a gateway
-   is typically a 1:1 mapping.  When the 0.0.0.0/0 SPD entry technique
-   is used, then the mapping to a gateway is determined by the reverse
-   DNS records.
-
-   The need to do a DNS lookup and wait for a reply will typically
-   introduce a new state and a new event source (DNS replies) to IKE.
-   Although a synchronous DNS request can be implemented for proof of
-   concept, experience is that it can cause very high latencies when a
-   queue of queries must all timeout in series.
-
-   Use of an asynchronous DNS lookup will also permit overlap of DNS
-   lookups with some of the protocol steps.
-
-4.3 Self identification
-
-   SG-A will have to establish its identity.  Use an IPv4 ID in phase 1.
-
-   There are many situations where the administrator of SG-A may not be
-   able to control the reverse DNS records for SG-A's public IP address.
-   Typical situations include dialup connections and most residential-
-   type broadband Internet access (ADSL, cable-modem) connections.  In
-   these situations, a fully qualified domain name that is under the
-   control of SG-A's administrator may be used when acting as an
-   initiator only.  The FQDN ID should be used in phase 1.  See Section
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 21]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   5.3 for more details and restrictions.
-
-4.4 Public key retrieval process
-
-   Upon receipt of a phase 1 SA proposal with either an IPv4 (IPv6) ID
-   or an FQDN ID, an IKE daemon needs to examine local caches and
-   configuration files to determine if this is part of a configured
-   tunnel.  If no configured tunnels are found, then the implementation
-   should attempt to retrieve a KEY record from the reverse DNS in the
-   case of an IPv4/IPv6 ID, or from the forward DNS in the case of FQDN
-   ID.
-
-   It is reasonable that if other non-local sources of policy are used
-   (COPS, LDAP), they be consulted concurrently but some clear ordering
-   of policy be provided.  Note that due to variances in latency,
-   implementations must wait for positive or negative replies from all
-   sources of policy before making any decisions.
-
-4.5 Interactions with DNSSEC
-
-   The implementation described (1.98) neither uses DNSSEC directly to
-   explicitly verify the authenticity of zone information, nor uses the
-   NXT records to provide authentication of the absence of a TXT or KEY
-   record.  Rather, this implementation uses a trusted path to a DNSSEC
-   capable caching resolver.
-
-   To distinguish between an authenticated and an unauthenticated DNS
-   resource record, a stub resolver capable of returning DNSSEC
-   information MUST be used.
-
-4.6 Required proposal types
-
-4.6.1 Phase 1 parameters
-
-   Main mode MUST be used.
-
-   The initiator MUST offer at least one proposal using some combination
-   of: 3DES, HMAC-MD5 or HMAC-SHA1, DH group 2 or 5.  Group 5 SHOULD be
-   proposed first.  [11]
-
-   The initiator MAY offer additional proposals, but the cipher MUST not
-   be weaker than 3DES.  The initiator SHOULD limit the number of
-   proposals such that the IKE datagrams do not need to be fragmented.
-
-   The responder MUST accept one of the proposals.  If any configuration
-   of the responder is required then the responder is not acting in an
-   opportunistic way.
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 22]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   SG-A SHOULD use an ID_IPV4_ADDR (ID_IPV6_ADDR for IPv6) of the
-   external interface of SG-A for phase 1.  (There is an exception, see
-   Section 5.3.) The authentication method MUST be RSA public key
-   signatures.  The RSA key for SG-A SHOULD be placed into a DNS KEY
-   record in the reverse space of SG-A (i.e.  using in-addr.arpa).
-
-4.6.2 Phase 2 parameters
-
-   SG-A MUST propose a tunnel between Alice and Bob, using 3DES-CBC
-   mode, MD5 or SHA1 authentication.  Perfect Forward Secrecy MUST be
-   specified.
-
-   Tunnel mode MUST be used.
-
-   Identities MUST be ID_IPV4_ADDR_SUBNET with the mask being /32.
-
-   Authorization for SG-A to act on Alice's behalf is determined by
-   looking for a TXT record in the reverse-map at Alice's address.
-
-   Compression SHOULD NOT be mandatory.  It may be offered as an option.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 23]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-5. DNS issues
-
-5.1 Use of KEY record
-
-   In order to establish their own identities, SG-A and SG-B SHOULD
-   publish their public keys in their reverse DNS via DNSSEC's KEY
-   record.  See section 3 of RFC 2535 [16].
-
-   For example:
-
-   KEY 0x4200 4 1 AQNJjkKlIk9...nYyUkKK8
-
-   0x4200: The flag bits, indicating that this key is prohibited for
-      confidentiality use (it authenticates the peer only, a separate
-      Diffie-Hellman exchange is used for confidentiality), and that
-      this key is associated with the non-zone entity whose name is the
-      RR owner name.  No other flags are set.
-
-   4: This indicates that this key is for use by IPsec.
-
-   1: An RSA key is present.
-
-   AQNJjkKlIk9...nYyUkKK8: The public key of the host as described in
-      [17].
-
-   Use of several KEY records allows for key rollover.  The SIG Payload
-   in IKE phase 1 SHOULD be accepted if the public key given by any KEY
-   RR validates it.
-
-5.2 Use of TXT delegation record
-
-   Alice publishes a TXT record to provide authorization for SG-A to act
-   on Alice's behalf.  Bob publishes a TXT record to provide
-   authorization for SG-B to act on Bob's behalf.  These records are
-   located in the reverse DNS (in-addr.arpa) for their respective IP
-   addresses.  The reverse DNS SHOULD be secured by DNSSEC, when it is
-   deployed.  DNSSEC is required to defend against active attacks.
-
-   If Alice's address is P.Q.R.S, then she can authorize another node to
-   act on her behalf by publishing records at:
-
-   S.R.Q.P.in-addr.arpa
-
-   The contents of the resource record are expected to be a string that
-   uses the following syntax, as suggested in [15].  (Note that the
-   reply to query may include other TXT resource records used by other
-   applications.)
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 24]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   ---------------------------------------------------------------------
-
-
-   X-IPsec-Server(P)=A.B.C.D KEY
-
-             Figure 2: Format of reverse delegation record
-
-   ---------------------------------------------------------------------
-
-   P: Specifies a precedence for this record.  This is similar to MX
-      record preferences.  Lower numbers have stronger preference.
-
-   A.B.C.D: Specifies the IP address of the Security Gateway for this
-      client machine.
-
-   KEY: Is the encoded RSA Public key of the Security Gateway.  The key
-      is provided here to avoid a second DNS lookup.  If this field is
-      absent, then a KEY resource record should be looked up in the
-      reverse-map of A.B.C.D.  The key is transmitted in base64 format.
-
-   The pieces of the record are separated by any whitespace (space, tab,
-   newline, carriage return).  An ASCII space SHOULD be used.
-
-   In the case where Alice is located at a public address behind a
-   security gateway that has no fixed address (or no control over its
-   reverse-map), then Alice may delegate to a public key by domain name.
-
-   ---------------------------------------------------------------------
-
-
-   X-IPsec-Server(P)=@FQDN KEY
-
-      Figure 3: Format of reverse delegation record (FQDN version)
-
-   ---------------------------------------------------------------------
-
-   P: Is as above.
-
-   FQDN: Specifies the FQDN that the Security Gateway will identify
-      itself with.
-
-   KEY: Is the encoded RSA Public key of the Security Gateway.
-
-   If there is more than one such TXT record with strongest (lowest
-   numbered) precedence, one Security Gateway is picked arbitrarily from
-   those specified in the strongest-preference records.
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 25]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-5.2.1 Long TXT records
-
-   When packed into transport format, TXT records which are longer than
-   255 characters are divided into smaller <character-strings>.  (See
-   [13] section 3.3 and 3.3.14.) These MUST be reassembled into a single
-   string for processing.  Whitespace characters in the base64 encoding
-   are to be ignored.
-
-5.2.2 Choice of TXT record
-
-   It has been suggested to use the KEY, OPT, CERT, or KX records
-   instead of a TXT record.  None is satisfactory.
-
-   The KEY RR has a protocol field which could be used to indicate a new
-   protocol, and an algorithm field which could be used to indicate
-   different contents in the key data.  However, the KEY record is
-   clearly not intended for storing what are really authorizations, it
-   is just for identities.  Other uses have been discouraged.
-
-   OPT resource records, as defined in [14] are not intended to be used
-   for storage of information.  They are not to be loaded, cached or
-   forwarded.  They are, therefore, inappropriate for use here.
-
-   CERT records [18] can encode almost any set of information.  A custom
-   type code could be used permitting any suitable encoding to be
-   stored, not just X.509.  According to the RFC, the certificate RRs
-   are to be signed internally which may add undesirable and unnecessary
-   bulk.  Larger DNS records may require TCP instead of UDP transfers.
-
-   At the time of protocol design, the CERT RR was not widely deployed
-   and could not be counted upon.  Use of CERT records will be
-   investigated, and may be proposed in a future revision of this
-   document.
-
-   KX records are ideally suited for use instead of TXT records, but had
-   not been deployed at the time of implementation.
-
-5.3 Use of FQDN IDs
-
-   Unfortunately, not every administrator has control over the contents
-   of the reverse-map.  Where the initiator (SG-A) has no suitable
-   reverse-map, the authorization record present in the reverse-map of
-   Alice may refer to a FQDN instead of an IP address.
-
-   In this case, the client's TXT record gives the fully qualified
-   domain name (FQDN) in place of its security gateway's IP address.
-   The initiator should use the ID_FQDN ID-payload in phase 1.  A
-   forward lookup for a KEY record on the FQDN must yield the
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 26]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   initiator's public key.
-
-   This method can also be used when the external address of SG-A is
-   dynamic.
-
-   If SG-A is acting on behalf of Alice, then Alice must still delegate
-   authority for SG-A to do so in her reverse-map.  When Alice and SG-A
-   are one and the same (i.e.  Alice is acting as an end-node) then
-   there is no need for this when initiating only.
-
-   However, Alice must still delegate to  herself if she wishes others
-   to initiate OE to her.  See Figure 3.
-
-5.4 Key roll-over
-
-   Good cryptographic hygiene says that one should replace public/
-   private key pairs periodically.  Some administrators may wish to do
-   this as often as daily.  Typical DNS propagation delays are
-   determined by the SOA Resource Record MINIMUM parameter, which
-   controls how long DNS replies may be cached.  For reasonable
-   operation of DNS servers, administrators usually want this value to
-   be at least several hours, sometimes as a long as a day.  This
-   presents a problem - a new key MUST not be used prior to it
-   propagating through DNS.
-
-   This problem is dealt with by having the Security Gateway generate a
-   new public/private key pair at least MINIMUM seconds in advance of
-   using it.  It then adds this key to the DNS (both as a second KEY
-   record and in additional TXT delegation records) at key generation
-   time.  Note: only one key is allowed in each TXT record.
-
-   When authenticating, all gateways MUST have available all public keys
-   that are found in DNS for this entity.  This permits the
-   authenticating end to check both the key for "today" and the key for
-   "tomorrow".  Note that it is the end which is creating the signature
-   (possesses the private key) that determines which key is to be used.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 27]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-6. Network address translation interaction
-
-   There are no fundamentally new issues for implementing opportunistic
-   encryption in the presence of network address translation.  Rather
-   there are only the regular IPsec issues with NAT traversal.
-
-   There are several situations to consider for NAT.
-
-6.1 Co-located NAT/NAPT
-
-   If SG-A is also performing network address translation on behalf of
-   Alice, then the packet should be translated prior to being subjected
-   to opportunistic encryption.  This is in contrast to typically
-   configured tunnels which often exist to bridge islands of private
-   network address space.  SG-A will use the translated source address
-   for phase 2, and so SG-B will look up that address to confirm SG-A's
-   authorization.
-
-   In the case of NAT (1:1), the address space into which the
-   translation is done MUST be globally unique, and control over the
-   reverse-map is assumed.  Placing of TXT records is possible.
-
-   In the case of NAPT (m:1), the address will be SG-A.  The ability to
-   get KEY and TXT records in place will again depend upon whether or
-   not there is administrative control over the reverse-map.  This is
-   identical to situations involving a single host acting on behalf of
-   itself.  FQDN style can be used to get around a lack of a reverse-map
-   for initiators only.
-
-6.2 SG-A behind NAT/NAPT
-
-   If there is a NAT or NAPT between SG-A and SG-B, then normal IPsec
-   NAT traversal rules apply.  In addition to the transport problem
-   which may be solved by other mechanisms, there is the issue of what
-   phase 1 and phase 2 IDs to use.  While FQDN could be used during
-   phase 1 for SG-A, there is no appropriate ID for phase 2 that permits
-   SG-B to determine that SG-A is in fact authorized to speak for Alice.
-
-6.3 Bob is behind a NAT/NAPT
-
-   If Bob is behind a NAT (perhaps SG-B), then there is, in fact, no way
-   for Alice to address a packet to Bob.  Not only is opportunistic
-   encryption impossible, but it is also impossible for Alice to
-   initiate any communication to Bob.  It may be possible for Bob to
-   initiate in such a situation.  This creates an asymmetry, but this is
-   common for NAPT.
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 28]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-7. Host implementations
-
-   When Alice and SG-A are components of the same system, they are
-   considered to be a host implementation.  The packet sequence scenario
-   remains unchanged.
-
-   Components marked Alice are the upper layers (TCP, UDP, the
-   application), and SG-A is the IP layer.
-
-   Note that tunnel mode is still required.
-
-   As Alice and SG-A are acting on behalf of themselves, no TXT based
-   delegation record is necessary for Alice to initiate.  She can rely
-   on FQDN in a forward map.  This is particularly attractive to mobile
-   nodes such as notebook computers at conferences.  To respond, Alice/
-   SG-A will still need an entry in Alice's reverse-map.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 29]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-8. Multi-homing
-
-   If there are multiple paths between Alice and Bob (as illustrated in
-   the diagram with SG-D), then additional DNS records are required to
-   establish authorization.
-
-   In Figure 1, Alice has two ways to exit her network: SG-A and SG-D.
-   Previously SG-D has been ignored.  Postulate that there are routers
-   between Alice and her set of security gateways (denoted by the +
-   signs and the marking of an autonomous system number for Alice's
-   network).  Datagrams may, therefore, travel to either SG-A or SG-D en
-   route to Bob.
-
-   As long as all network connections are in good order, it does not
-   matter how datagrams exit Alice's network.  When they reach either
-   security gateway, the security gateway will find the TXT delegation
-   record in Bob's reverse-map, and establish an SA with SG-B.
-
-   SG-B has no problem establishing that either of SG-A or SG-D may
-   speak for Alice, because Alice has published two equally weighted TXT
-   delegation records:
-
-   ---------------------------------------------------------------------
-
-
-   X-IPsec-Server(10)=192.1.1.5 AQMM...3s1Q==
-   X-IPsec-Server(10)=192.1.1.6 AAJN...j8r9==
-
-        Figure 4: Multiple gateway delegation example for Alice
-
-   ---------------------------------------------------------------------
-
-   Alice's routers can now do any kind of load sharing needed.  Both SG-
-   A and SG-D send datagrams addressed to Bob through their tunnel to
-   SG-B.
-
-   Alice's use of non-equal weight delegation records to show preference
-   of one gateway over another, has relevance only when SG-B is
-   initiating to Alice.
-
-   If the precedences are the same, then SG-B has a more difficult time.
-   It must decide which of the two tunnels to use.  SG-B has no
-   information about which link is less loaded, nor which security
-   gateway has more cryptographic resources available.  SG-B, in fact,
-   has no knowledge of whether both gateways are even reachable.
-
-   The Public Internet's default-free zone may well know a good route to
-   Alice, but the datagrams that SG-B creates must be addressed to
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 30]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   either SG-A or SG-D; they can not be addressed to Alice directly.
-
-   SG-B may make a number of choices:
-
-   1.  It can ignore the problem and round robin among the tunnels.
-       This causes losses during times when one or the other security
-       gateway is unreachable.  If this worries Alice, she can change
-       the weights in her TXT delegation records.
-
-   2.  It can send to the gateway from which it most recently received
-       datagrams.  This assumes that routing and reachability are
-       symmetrical.
-
-   3.  It can listen to BGP information from the Internet to decide
-       which system is currently up.  This is clearly much more
-       complicated, but if SG-B is already participating in the BGP
-       peering system to announce Bob, the results data may already be
-       available to it.
-
-   4.  It can refuse to negotiate the second tunnel.  (It is unclear
-       whether or not this is even an option.)
-
-   5.  It can silently replace the outgoing portion of the first tunnel
-       with the second one while still retaining the incoming portions
-       of both.  SG-B can, thus, accept datagrams from either SG-A or
-       SG-D, but send only to the gateway that most recently re-keyed
-       with it.
-
-   Local policy determines which choice SG-B makes.  Note that even if
-   SG-B has perfect knowledge about the reachability of SG-A and SG-D,
-   Alice may not be reachable from either of these security gateways
-   because of internal reachability issues.
-
-   FreeS/WAN implements option 5.  Implementing a different option is
-   being considered.  The multi-homing aspects of OE are not well
-   developed and may be the subject of a future document.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 31]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-9. Failure modes
-
-9.1 DNS failures
-
-   If a DNS server fails to respond, local policy decides whether or not
-   to permit communication in the clear as embodied in the connection
-   classes in Section 3.2.  It is easy to mount a denial of service
-   attack on the DNS server responsible for a particular network's
-   reverse-map.  Such an attack may cause all communication with that
-   network to go in the clear if the policy is permissive, or fail
-   completely if the policy is paranoid.  Please note that this is an
-   active attack.
-
-   There are still many networks that do not have properly configured
-   reverse-maps.  Further, if the policy is not to communicate, the
-   above denial of service attack isolates the target network.
-   Therefore, the decision of whether or not to permit communication in
-   the clear MUST be a matter of local policy.
-
-9.2 DNS configured, IKE failures
-
-   DNS records claim that opportunistic encryption should occur, but the
-   target gateway either does not respond on port 500, or refuses the
-   proposal.  This may be because of a crash or reboot, a faulty
-   configuration, or a firewall filtering port 500.
-
-   The receipt of ICMP port, host or network unreachable messages
-   indicates a potential problem, but MUST NOT cause communication to
-   fail immediately.  ICMP messages are easily forged by attackers.  If
-   such a forgery caused immediate failure, then an active attacker
-   could easily prevent any encryption from ever occurring, possibly
-   preventing all communication.
-
-   In these situations a clear log should be produced and local policy
-   should dictate if communication is then permitted in the clear.
-
-9.3 System reboots
-
-   Tunnels sometimes go down because the remote end crashes,
-   disconnects, or has a network link break.  In general there is no
-   notification of this.  Even in the event of a crash and successful
-   reboot, other SGs don't hear about it unless the rebooted SG has
-   specific reason to talk to them immediately.  Over-quick response to
-   temporary network outages is undesirable.  Note that a tunnel can be
-   torn down and then re-established without any effect visible to the
-   user except a pause in traffic.  On the other hand, if one end
-   reboots, the other end can't get datagrams to it at all (except via
-   IKE) until the situation is noticed.  So a bias toward quick response
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 32]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   is appropriate even at the cost of occasional false alarms.
-
-   A mechanism for recovery after reboot is a topic of current research
-   and is not specified in this document.
-
-   A deliberate shutdown should include an attempt, using deletes, to
-   notify all other SGs currently connected by phase 1 SAs that
-   communication is about to fail.  Again, a remote SG will assume this
-   is a teardown.  Attempts by the remote SGs to negotiate new tunnels
-   as replacements should be ignored.  When possible, SGs should attempt
-   to preserve information about currently-connected SGs in non-volatile
-   storage, so that after a crash, an Initial-Contact can be sent to
-   previous partners to indicate loss of all previously established
-   connections.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 33]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-10. Unresolved issues
-
-10.1 Control of reverse DNS
-
-   The method of obtaining information by reverse DNS lookup causes
-   problems for people who cannot control their reverse DNS bindings.
-   This is an unresolved problem in this version, and is out of scope.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 34]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-11. Examples
-
-11.1 Clear-text usage (permit policy)
-
-   Two example scenarios follow.  In the first example GW-A (Gateway A)
-   and GW-B (Gateway B) have always-clear-text policies, and in the
-   second example they have an OE policy.
-
-   ---------------------------------------------------------------------
-
-
-     Alice         SG-A       DNS       SG-B           Bob
-      (1)
-       ------(2)-------------->
-       <-----(3)---------------
-      (4)----(5)----->
-                      ----------(6)------>
-                                          ------(7)----->
-                                         <------(8)------
-                      <----------(9)------
-       <----(10)-----
-      (11)----------->
-                      ----------(12)----->
-                                          -------------->
-                                         <---------------
-                      <-------------------
-       <-------------
-
-                Figure 5: Timing of regular transaction
-
-   ---------------------------------------------------------------------
-
-   Alice wants to communicate with Bob.  Perhaps she wants to retrieve a
-   web page from Bob's web server.  In the absence of opportunistic
-   encryptors, the following events occur:
-
-   (1) Human or application 'clicks' with a name.
-
-   (2) Application looks up name in DNS to get IP address.
-
-   (3) Resolver returns A record to application.
-
-   (4) Application starts a TCP session or UDP session and OS sends
-      datagram.
-
-   (5) Datagram is seen at first gateway from Alice (SG-A).  (SG-A makes
-      a transition through Empty connection to always-clear connection
-      and instantiates a pass-through policy at the forwarding plane.)
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 35]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   (6) Datagram is seen at last gateway before Bob (SG-B).
-
-   (7) First datagram from Alice is seen by Bob.
-
-   (8) First return datagram is sent by Bob.
-
-   (9) Datagram is seen at Bob's gateway.  (SG-B makes a transition
-      through Empty connection to always-clear connection and
-      instantiates a pass-through policy at the forwarding plane.)
-
-   (10) Datagram is seen at Alice's gateway.
-
-   (11) OS hands datagram to application.  Alice sends another datagram.
-
-   (12) A second datagram traverses the Internet.
-
-
-11.2 Opportunistic encryption
-
-   In the presence of properly configured opportunistic encryptors, the
-   event list is extended.
-
-   ---------------------------------------------------------------------
-
-
-     Alice          SG-A      DNS       SG-B           Bob
-      (1)
-       ------(2)-------------->
-       <-----(3)---------------
-      (4)----(5)----->+
-                     ----(5B)->
-                     <---(5C)--
-                     ~~~~~~~~~~~~~(5D)~~~>
-                     <~~~~~~~~~~~~(5E1)~~~
-                     ~~~~~~~~~~~~~(5E2)~~>
-                     <~~~~~~~~~~~~(5E3)~~~
-                     #############(5E4)##>
-                     <############(5E5)###
-                              <----(5F1)--
-                              -----(5F2)->
-                     #############(5G1)##>
-                              <----(5H1)--
-                              -----(5H2)->
-                     <############(5G2)###
-                     #############(5G3)##>
-                      ============(6)====>
-   		                       ------(7)----->
-                                         <------(8)------
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 36]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-                     <==========(9)======
-       <-----(10)----
-      (11)----------->
-                      ==========(12)=====>
-                                          -------------->
-                                         <---------------
-                      <===================
-       <-------------
-
-        Figure 6: Timing of opportunistic encryption transaction
-
-   ---------------------------------------------------------------------
-
-   (1) Human or application clicks with a name.
-
-   (2) Application initiates DNS mapping.
-
-   (3) Resolver returns A record to application.
-
-   (4) Application starts a TCP session or UDP.
-
-   (5) SG-A (host or SG) sees datagram to target, and buffers it.
-
-   (5B) SG-A asks DNS for TXT record.
-
-   (5C) DNS returns TXT record(s).
-
-   (5D) Initial IKE Main Mode Packet goes out.
-
-   (5E) IKE ISAKMP phase 1 succeeds.
-
-   (5F) SG-B asks DNS for TXT record to prove SG-A is an agent for
-      Alice.
-
-   (5G) IKE phase 2 negotiation.
-
-   (5H) DNS lookup by responder (SG-B).
-
-   (6) Buffered datagram is sent by SG-A.
-
-   (7) Datagram is received by SG-B, decrypted, and sent to Bob.
-
-   (8) Bob replies, and datagram is seen by SG-B.
-
-   (9) SG-B already has tunnel up with SG-A, and uses it.
-
-   (10) SG-A decrypts datagram and gives it to Alice.
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 37]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   (11) Alice receives datagram.  Sends new packet to Bob.
-
-   (12) SG-A gets second datagram, sees that tunnel is up, and uses it.
-
-   For the purposes of this section, we will describe only the changes
-   that occur between Figure 5 and Figure 6.  This corresponds to time
-   points 5, 6, 7, 9 and 10 on the list above.
-
-11.2.1 (5) IPsec datagram interception
-
-   At point (5), SG-A intercepts the datagram because this source/
-   destination pair lacks a policy (the non-existent policy state).  SG-
-   A creates a hold policy, and buffers the datagram.  SG-A requests
-   keys from the keying daemon.
-
-11.2.2 (5B) DNS lookup for TXT record
-
-   SG-A's IKE daemon, having looked up the source/destination pair in
-   the connection class list, creates a new Potential OE connection
-   instance.  SG-A starts DNS queries.
-
-11.2.3 (5C) DNS returns TXT record(s)
-
-   DNS returns properly formed TXT delegation records, and SG-A's IKE
-   daemon causes this instance to make a transition from Potential OE
-   connection to Pending OE connection.
-
-   Using the example above, the returned record might contain:
-
-   ---------------------------------------------------------------------
-
-
-   X-IPsec-Server(10)=192.1.1.5 AQMM...3s1Q==
-
-         Figure 7: Example of reverse delegation record for Bob
-
-   ---------------------------------------------------------------------
-
-    with SG-B's IP address and public key listed.
-
-11.2.4 (5D) Initial IKE main mode packet goes out
-
-   Upon entering Pending OE connection, SG-A sends the initial ISAKMP
-   message with proposals.  See Section 4.6.1.
-
-11.2.5 (5E1) Message 2 of phase 1 exchange
-
-   SG-B receives the message.  A new connection instance is created in
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 38]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   the unauthenticated OE peer state.
-
-11.2.6 (5E2) Message 3 of phase 1 exchange
-
-   SG-A sends a Diffie-Hellman exponent.  This is an internal state of
-   the keying daemon.
-
-11.2.7 (5E3) Message 4 of phase 1 exchange
-
-   SG-B responds with a Diffie-Hellman exponent.  This is an internal
-   state of the keying protocol.
-
-11.2.8 (5E4) Message 5 of phase 1 exchange
-
-   SG-A uses the phase 1 SA to send its identity under encryption.  The
-   choice of identity is discussed in Section 4.6.1.  This is an
-   internal state of the keying protocol.
-
-11.2.9 (5F1) Responder lookup of initiator key
-
-   SG-B asks DNS for the public key of the initiator.  DNS looks for a
-   KEY record by IP address in the reverse-map.  That is, a KEY resource
-   record is queried for 4.1.1.192.in-addr.arpa (recall that SG-A's
-   external address is 192.1.1.4).  SG-B uses the resulting public key
-   to authenticate the initiator.  See Section 5.1 for further details.
-
-11.2.10 (5F2) DNS replies with public key of initiator
-
-   Upon successfully authenticating the peer, the connection instance
-   makes a transition to authenticated OE peer on SG-B.
-
-   The format of the TXT record returned is described in Section 5.2.
-
-11.2.11 (5E5) Responder replies with ID and authentication
-
-   SG-B sends its ID along with authentication material.  This is an
-   internal state for the keying protocol.
-
-11.2.12 (5G) IKE phase 2
-
-11.2.12.1 (5G1) Initiator proposes tunnel
-
-   Having established mutually agreeable authentications (via KEY) and
-   authorizations (via TXT), SG-A proposes to create an IPsec tunnel for
-   datagrams transiting from Alice to Bob.  This tunnel is established
-   only for the Alice/Bob combination, not for any subnets that may be
-   behind SG-A and SG-B.
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 39]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-11.2.12.2 (5H1) Responder determines initiator's authority
-
-   While the identity of SG-A has been established, its authority to
-   speak for Alice has not yet been confirmed.  SG-B does a reverse
-   lookup on Alice's address for a TXT record.
-
-   Upon receiving this specific proposal, SG-B's connection instance
-   makes a transition into the potential OE connection state.  SG-B may
-   already have an instance, and the check is made as described above.
-
-11.2.12.3 (5H2) DNS replies with TXT record(s)
-
-   The returned key and IP address should match that of SG-A.
-
-11.2.12.4 (5G2) Responder agrees to proposal
-
-   Should additional communication occur between, for instance, Dave and
-   Bob using SG-A and SG-B, a new tunnel (phase 2 SA) would be
-   established.  The phase 1 SA may be reusable.
-
-   SG-A, having successfully keyed the tunnel, now makes a transition
-   from Pending OE connection to Keyed OE connection.
-
-   The responder MUST setup the inbound IPsec SAs before sending its
-   reply.
-
-11.2.12.5 (5G3) Final acknowledgment from initiator
-
-   The initiator agrees with the responder's choice and sets up the
-   tunnel.  The initiator sets up the inbound and outbound IPsec SAs.
-
-   The proper authorization returned with keys prompts SG-B to make a
-   transition to the keyed OE connection state.
-
-   Upon receipt of this message, the responder may now setup the
-   outbound IPsec SAs.
-
-11.2.13 (6) IPsec succeeds, and sets up tunnel for communication between
-        Alice and Bob
-
-   SG-A sends the datagram saved at step (5) through the newly created
-   tunnel to SG-B, where it gets decrypted and forwarded.  Bob receives
-   it at (7) and replies at (8).
-
-11.2.14 (9) SG-B already has tunnel up with G1 and uses it
-
-   At (9), SG-B has already established an SPD entry mapping Bob->Alice
-   via a tunnel, so this tunnel is simply applied.  The datagram is
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 40]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   encrypted to SG-A, decrypted by SG-A and passed to Alice at (10).
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 41]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-12. Security considerations
-
-12.1 Configured vs opportunistic tunnels
-
-   Configured tunnels are those which are setup using bilateral
-   mechanisms: exchanging public keys (raw RSA, DSA, PKIX), pre-shared
-   secrets, or by referencing keys that are in known places
-   (distinguished name from LDAP, DNS).  These keys are then used to
-   configure a specific tunnel.
-
-   A pre-configured tunnel may be on all the time, or may be keyed only
-   when needed.  The end points of the tunnel are not necessarily
-   static: many mobile applications (road warrior) are considered to be
-   configured tunnels.
-
-   The primary characteristic is that configured tunnels are assigned
-   specific security properties.  They may be trusted in different ways
-   relating to exceptions to firewall rules, exceptions to NAT
-   processing, and to bandwidth or other quality of service
-   restrictions.
-
-   Opportunistic tunnels are not inherently trusted in any strong way.
-   They are created without prior arrangement.  As the two parties are
-   strangers, there MUST be no confusion of datagrams that arrive from
-   opportunistic peers and those that arrive from configured tunnels.  A
-   security gateway MUST take care that an opportunistic peer can not
-   impersonate a configured peer.
-
-   Ingress filtering MUST be used to make sure that only datagrams
-   authorized by negotiation (and the concomitant authentication and
-   authorization) are accepted from a tunnel.  This is to prevent one
-   peer from impersonating another.
-
-   An implementation suggestion is to treat opportunistic tunnel
-   datagrams as if they arrive on a logical interface distinct from
-   other configured tunnels.  As the number of opportunistic tunnels
-   that may be created automatically on a system is potentially very
-   high, careful attention to scaling should be taken into account.
-
-   As with any IKE negotiation, opportunistic encryption cannot be
-   secure without authentication.  Opportunistic encryption relies on
-   DNS for its authentication information and, therefore, cannot be
-   fully secure without a secure DNS.  Without secure DNS, opportunistic
-   encryption can protect against passive eavesdropping but not against
-   active man-in-the-middle attacks.
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 42]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-12.2 Firewalls versus Opportunistic Tunnels
-
-   Typical usage of per datagram access control lists is to implement
-   various kinds of security gateways.  These are typically called
-   "firewalls".
-
-   Typical usage of a virtual private network (VPN) within a firewall is
-   to bypass all or part of the access controls between two networks.
-   Additional trust (as outlined in the previous section) is given to
-   datagrams that arrive in the VPN.
-
-   Datagrams that arrive via opportunistically configured tunnels MUST
-   not be trusted.  Any security policy that would apply to a datagram
-   arriving in the clear SHOULD also be applied to datagrams arriving
-   opportunistically.
-
-12.3 Denial of service
-
-   There are several different forms of denial of service that an
-   implementor should concern themselves with.  Most of these problems
-   are shared with security gateways that have large numbers of mobile
-   peers (road warriors).
-
-   The design of ISAKMP/IKE, and its use of cookies, defend against many
-   kinds of denial of service.  Opportunism changes the assumption that
-   if the phase 1 (ISAKMP) SA is authenticated, that it was worthwhile
-   creating.  Because the gateway will communicate with any machine, it
-   is possible to form phase 1 SAs with any machine on the Internet.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 43]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-13. IANA Considerations
-
-   There are no known numbers which IANA will need to manage.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 44]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-14. Acknowledgments
-
-   Substantive portions of this document are based upon previous work by
-   Henry Spencer.
-
-   Thanks to Tero Kivinen, Sandy Harris, Wes Hardarker, Robert
-   Moskowitz, Jakob Schlyter, Bill Sommerfeld, John Gilmore and John
-   Denker for their comments and constructive criticism.
-
-   Sandra Hoffman and Bill Dickie did the detailed proof reading and
-   editing.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 45]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-Normative references
-
-   [1]   Redelmeier, D. and H. Spencer, "Opportunistic Encryption",
-         paper http://www.freeswan.org/freeswan_trees/freeswan-1.91/doc/
-         opportunism.spec, May 2001.
-
-   [2]   Defense Advanced Research Projects Agency (DARPA), Information
-         Processing Techniques Office and University of Southern
-         California (USC)/Information Sciences Institute, "Internet
-         Protocol", STD 5, RFC 791, September 1981.
-
-   [3]   Braden, R. and J. Postel, "Requirements for Internet gateways",
-         RFC 1009, June 1987.
-
-   [4]   IAB, IESG, Carpenter, B. and F. Baker, "IAB and IESG Statement
-         on Cryptographic Technology and the Internet", RFC 1984, August
-         1996.
-
-   [5]   Bradner, S., "Key words for use in RFCs to Indicate Requirement
-         Levels", BCP 14, RFC 2119, March 1997.
-
-   [6]   McDonald, D., Metz, C. and B. Phan, "PF_KEY Key Management API,
-         Version 2", RFC 2367, July 1998.
-
-   [7]   Kent, S. and R. Atkinson, "Security Architecture for the
-         Internet Protocol", RFC 2401, November 1998.
-
-   [8]   Piper, D., "The Internet IP Security Domain of Interpretation
-         for ISAKMP", RFC 2407, November 1998.
-
-   [9]   Maughan, D., Schneider, M. and M. Schertler, "Internet Security
-         Association and Key Management Protocol (ISAKMP)", RFC 2408,
-         November 1998.
-
-   [10]  Harkins, D. and D. Carrel, "The Internet Key Exchange (IKE)",
-         RFC 2409, November 1998.
-
-   [11]  Kivinen, T. and M. Kojo, "More MODP Diffie-Hellman groups for
-         IKE", RFC 3526, March 2003.
-
-   [12]  Mockapetris, P., "Domain names - concepts and facilities", STD
-         13, RFC 1034, November 1987.
-
-   [13]  Mockapetris, P., "Domain names - implementation and
-         specification", STD 13, RFC 1035, November 1987.
-
-   [14]  Vixie, P., "Extension Mechanisms for DNS (EDNS0)", RFC 2671,
-         August 1999.
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 46]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-   [15]  Rosenbaum, R., "Using the Domain Name System To Store Arbitrary
-         String Attributes", RFC 1464, May 1993.
-
-   [16]  Eastlake, D., "Domain Name System Security Extensions", RFC
-         2535, March 1999.
-
-   [17]  Eastlake, D., "RSA/SHA-1 SIGs and RSA KEYs in the Domain Name
-         System (DNS)", RFC 3110, May 2001.
-
-   [18]  Eastlake, D. and O. Gudmundsson, "Storing Certificates in the
-         Domain Name System (DNS)", RFC 2538, March 1999.
-
-   [19]  Durham, D., Boyle, J., Cohen, R., Herzog, S., Rajan, R. and A.
-         Sastry, "The COPS (Common Open Policy Service) Protocol", RFC
-         2748, January 2000.
-
-   [20]  Srisuresh, P. and M. Holdrege, "IP Network Address Translator
-         (NAT) Terminology and Considerations", RFC 2663, August 1999.
-
-
-Authors' Addresses
-
-   Michael C. Richardson
-   Sandelman Software Works
-   470 Dawson Avenue
-   Ottawa, ON  K1Z 5V7
-   CA
-
-   EMail: mcr@sandelman.ottawa.on.ca
-   URI:   http://www.sandelman.ottawa.on.ca/
-
-
-   D. Hugh Redelmeier
-   Mimosa
-   Toronto, ON
-   CA
-
-   EMail: hugh@mimosa.com
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 47]
-
-Internet-Draft                opportunistic                     May 2003
-
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society (2003).  All Rights Reserved.
-
-   This document and translations of it may be copied and furnished to
-   others, and derivative works that comment on or otherwise explain it
-   or assist in its implementation may be prepared, copied, published
-   and distributed, in whole or in part, without restriction of any
-   kind, provided that the above copyright notice and this paragraph are
-   included on all such copies and derivative works.  However, this
-   document itself may not be modified in any way, such as by removing
-   the copyright notice or references to the Internet Society or other
-   Internet organizations, except as needed for the purpose of
-   developing Internet standards in which case the procedures for
-   copyrights defined in the Internet Standards process must be
-   followed, or as required to translate it into languages other than
-   English.
-
-   The limited permissions granted above are perpetual and will not be
-   revoked by the Internet Society or its successors or assigns.
-
-   This document and the information contained herein is provided on an
-   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
-   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
-   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
-   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-Acknowledgement
-
-   Funding for the RFC Editor function is currently provided by the
-   Internet Society.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson & Redelmeier    Expires November 19, 2003           [Page 48]
-
diff --git a/doc/draft-richardson-ipsec-rr.txt b/doc/draft-richardson-ipsec-rr.txt
deleted file mode 100644
index 7c229b8e1..000000000
--- a/doc/draft-richardson-ipsec-rr.txt
+++ /dev/null
@@ -1,840 +0,0 @@
-
-
-IPSECKEY WG                                                M. Richardson
-Internet-Draft                                                       SSW
-Expires: March 4, 2004                                 September 4, 2003
-
-
-           A method for storing IPsec keying material in DNS.
-                     draft-ietf-ipseckey-rr-07.txt
-
-Status of this Memo
-
-   This document is an Internet-Draft and is in full conformance with
-   all provisions of Section 10 of RFC2026.
-
-   Internet-Drafts are working documents of the Internet Engineering
-   Task Force (IETF), its areas, and its working groups.  Note that
-   other groups may also distribute working documents as Internet-
-   Drafts.
-
-   Internet-Drafts are draft documents valid for a maximum of six months
-   and may be updated, replaced, or obsoleted by other documents at any
-   time.  It is inappropriate to use Internet-Drafts as reference
-   material or to cite them other than as "work in progress."
-
-   The list of current Internet-Drafts can be accessed at http://
-   www.ietf.org/ietf/1id-abstracts.txt.
-
-   The list of Internet-Draft Shadow Directories can be accessed at
-   http://www.ietf.org/shadow.html.
-
-   This Internet-Draft will expire on March 4, 2004.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (2003).  All Rights Reserved.
-
-Abstract
-
-   This document describes a new resource record for DNS.  This record
-   may be used to store public keys for use in IPsec systems.
-
-   This record replaces the functionality of the sub-type #1 of the KEY
-   Resource Record, which has been obsoleted by RFC3445.
-
-
-
-
-
-
-
-
-
-
-Richardson                Expires March 4, 2004                 [Page 1]
-
-Internet-Draft                   ipsecrr                  September 2003
-
-
-Table of Contents
-
-   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
-   1.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . .  3
-   1.2 Usage Criteria . . . . . . . . . . . . . . . . . . . . . . . .  3
-   2.  Storage formats  . . . . . . . . . . . . . . . . . . . . . . .  4
-   2.1 IPSECKEY RDATA format  . . . . . . . . . . . . . . . . . . . .  4
-   2.2 RDATA format - precedence  . . . . . . . . . . . . . . . . . .  4
-   2.3 RDATA format - algorithm type  . . . . . . . . . . . . . . . .  4
-   2.4 RDATA format - gateway type  . . . . . . . . . . . . . . . . .  4
-   2.5 RDATA format - gateway . . . . . . . . . . . . . . . . . . . .  5
-   2.6 RDATA format - public keys . . . . . . . . . . . . . . . . . .  5
-   3.  Presentation formats . . . . . . . . . . . . . . . . . . . . .  7
-   3.1 Representation of IPSECKEY RRs . . . . . . . . . . . . . . . .  7
-   3.2 Examples . . . . . . . . . . . . . . . . . . . . . . . . . . .  7
-   4.  Security Considerations  . . . . . . . . . . . . . . . . . . .  9
-   4.1 Active attacks against unsecured IPSECKEY resource records . .  9
-   5.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 11
-   6.  Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 12
-       Normative references . . . . . . . . . . . . . . . . . . . . . 13
-       Non-normative references . . . . . . . . . . . . . . . . . . . 14
-       Author's Address . . . . . . . . . . . . . . . . . . . . . . . 14
-       Full Copyright Statement . . . . . . . . . . . . . . . . . . . 15
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson                Expires March 4, 2004                 [Page 2]
-
-Internet-Draft                   ipsecrr                  September 2003
-
-
-1. Introduction
-
-   The type number for the IPSECKEY RR is TBD.
-
-1.1 Overview
-
-   The IPSECKEY resource record (RR) is used to publish a public key
-   that is to be associated with a Domain Name System (DNS) name for use
-   with the IPsec protocol suite.  This can be the  public key of a
-   host, network, or application (in the case of per-port keying).
-
-   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
-   "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and "OPTIONAL" in this
-   document are to be interpreted as described in RFC2119 [8].
-
-1.2 Usage Criteria
-
-   An IPSECKEY resource record SHOULD be used in combination with DNSSEC
-   unless some other means of authenticating the IPSECKEY resource
-   record is available.
-
-   It is expected that there will often be multiple IPSECKEY resource
-   records at the same name.  This will be due to the presence of
-   multiple gateways and the need to rollover keys.
-
-   This resource record is class independent.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson                Expires March 4, 2004                 [Page 3]
-
-Internet-Draft                   ipsecrr                  September 2003
-
-
-2. Storage formats
-
-2.1 IPSECKEY RDATA format
-
-   The RDATA for an IPSECKEY RR consists of a precedence value, a public
-   key, algorithm type, and an optional gateway address.
-
-       0                   1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |  precedence   | gateway type  |  algorithm  |     gateway     |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-------------+                 +
-      ~                            gateway                            ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                                                               /
-      /                          public key                           /
-      /                                                               /
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|
-
-
-2.2 RDATA format - precedence
-
-   This is an 8-bit precedence for this record.  This is interpreted in
-   the same way as the PREFERENCE field described in section 3.3.9 of
-   RFC1035 [2].
-
-   Gateways listed in IPSECKEY records with  lower precedence are to be
-   attempted first.  Where there is a tie in precedence, the order
-   should be non-deterministic.
-
-2.3 RDATA format - algorithm type
-
-   The algorithm type field identifies the public key's cryptographic
-   algorithm and determines the format of the public key field.
-
-   A value of 0 indicates that no key is present.
-
-   The following values are defined:
-
-   1  A DSA key is present, in the format defined in RFC2536 [11]
-
-   2  A RSA key is present, in the format defined in RFC3110 [12]
-
-
-2.4 RDATA format - gateway type
-
-   The gateway type field indicates the format of the information that
-   is stored in the gateway field.
-
-
-
-Richardson                Expires March 4, 2004                 [Page 4]
-
-Internet-Draft                   ipsecrr                  September 2003
-
-
-   The following values are defined:
-
-   0  No gateway is present
-
-   1  A 4-byte IPv4 address is present
-
-   2  A 16-byte IPv6 address is present
-
-   3  A wire-encoded domain name is present.  The wire-encoded format is
-      self-describing, so the length is implicit.  The domain name MUST
-      NOT be compressed.
-
-
-2.5 RDATA format - gateway
-
-   The gateway field indicates a gateway to which an IPsec tunnel may be
-   created in order to reach the entity named by this resource record.
-
-   There are three formats:
-
-   A 32-bit IPv4 address is present in the gateway field.  The data
-   portion is an IPv4 address as described in section 3.4.1 of RFC1035
-   [2].  This is a 32-bit number in network byte order.
-
-   A 128-bit IPv6 address is present in the gateway field.  The data
-   portion is an IPv6 address as described in section 2.2 of RFC1886
-   [7].  This is a 128-bit number in network byte order.
-
-   The gateway field is a normal wire-encoded domain name, as described
-   in section 3.3 of RFC1035 [2].  Compression MUST NOT be used.
-
-2.6 RDATA format - public keys
-
-   Both of the public key types defined in this document (RSA and DSA)
-   inherit their public key formats from the corresponding KEY RR
-   formats.  Specifically, the public key field contains the algorithm-
-   specific portion of the KEY RR RDATA, which is all of the KEY RR DATA
-   after the first four octets.  This is the same portion of the KEY RR
-   that must be specified by documents that define a DNSSEC algorithm.
-   Those documents also specify a message digest to be used for
-   generation of SIG RRs; that specification is not relevant for
-   IPSECKEY RR.
-
-   Future algorithms, if they are to be used by both DNSSEC (in the KEY
-   RR) and IPSECKEY, are likely to use the same public key encodings in
-   both records.  Unless otherwise specified, the IPSECKEY public key
-   field will contain the algorithm-specific portion of the KEY RR RDATA
-   for the corresponding algorithm.  The algorithm must still be
-
-
-
-Richardson                Expires March 4, 2004                 [Page 5]
-
-Internet-Draft                   ipsecrr                  September 2003
-
-
-   designated for use by IPSECKEY, and an IPSECKEY algorithm type number
-   (which might be different than the DNSSEC algorithm number) must be
-   assigned to it.
-
-   The DSA key format is defined in RFC2536 [11]
-
-   The RSA key format is defined in RFC3110 [12], with the following
-   changes:
-
-   The earlier definition of RSA/MD5 in RFC2065 limited the exponent and
-   modulus to 2552 bits in length.  RFC3110 extended that limit to 4096
-   bits for RSA/SHA1 keys.  The IPSECKEY RR imposes no length limit on
-   RSA public keys, other than the 65535 octet limit imposed by the two-
-   octet length encoding.  This length extension is applicable only to
-   IPSECKEY and not to KEY RRs.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson                Expires March 4, 2004                 [Page 6]
-
-Internet-Draft                   ipsecrr                  September 2003
-
-
-3. Presentation formats
-
-3.1 Representation of IPSECKEY RRs
-
-   IPSECKEY RRs may appear in a zone data master file.  The precedence,
-   gateway type and algorithm and gateway fields are REQUIRED.  The
-   base64 encoded public key block is OPTIONAL; if not present, then the
-   public key field of the resource record MUST be construed as being
-   zero octets in length.
-
-   The algorithm field is an unsigned integer.  No mnemonics are
-   defined.
-
-   If no gateway is to be indicated, then the gateway type field MUST be
-   zero, and the gateway field MUST be "."
-
-   The Public Key field is represented as a Base64 encoding of the
-   Public Key.  Whitespace is allowed within the Base64 text.  For a
-   definition of Base64 encoding, see RFC1521 [3] Section 5.2.
-
-   The general presentation for the record as as follows:
-
-   IN     IPSECKEY ( precedence gateway-type algorithm
-                     gateway base64-encoded-public-key )
-
-
-3.2 Examples
-
-   An example of a node 192.0.2.38 that will accept IPsec tunnels on its
-   own behalf.
-
-   38.2.0.192.in-addr.arpa. 7200 IN     IPSECKEY ( 10 1 2
-                    192.0.2.38
-                    AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-
-   An example of a node, 192.0.2.38 that has published its key only.
-
-   38.2.0.192.in-addr.arpa. 7200 IN     IPSECKEY ( 10 0 2
-                    .
-                    AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-
-   An example of a node, 192.0.2.38 that has delegated authority to the
-   node 192.0.2.3.
-
-   38.2.0.192.in-addr.arpa. 7200 IN     IPSECKEY ( 10 1 2
-                    192.0.2.3
-                    AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-
-
-
-
-Richardson                Expires March 4, 2004                 [Page 7]
-
-Internet-Draft                   ipsecrr                  September 2003
-
-
-   An example of a node, 192.0.1.38 that has delegated authority to the
-   node with the identity "mygateway.example.com".
-
-   38.1.0.192.in-addr.arpa. 7200 IN     IPSECKEY ( 10 3 2
-                    mygateway.example.com.
-                    AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-
-   An example of a node, 2001:0DB8:0200:1:210:f3ff:fe03:4d0 that has
-   delegated authority to the node 2001:0DB8:c000:0200:2::1
-
-   $ORIGIN 1.0.0.0.0.0.2.8.B.D.0.1.0.0.2.ip6.int.
-   0.d.4.0.3.0.e.f.f.f.3.f.0.1.2.0 7200 IN     IPSECKEY ( 10 2 2
-                    2001:0DB8:0:8002::2000:1
-                    AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson                Expires March 4, 2004                 [Page 8]
-
-Internet-Draft                   ipsecrr                  September 2003
-
-
-4. Security Considerations
-
-   This entire memo pertains to the provision of public keying material
-   for use by key management protocols such as ISAKMP/IKE (RFC2407) [9].
-
-   The IPSECKEY resource record contains information that SHOULD be
-   communicated to the end client in an integral fashion - i.e.  free
-   from modification.  The form of this channel is up to the consumer of
-   the data - there must be a trust relationship between the end
-   consumer of this resource record and the server.  This relationship
-   may be end-to-end DNSSEC validation, a TSIG or SIG(0) channel to
-   another secure source, a secure local channel on the host, or some
-   combination of the above.
-
-   The keying material provided by the IPSECKEY resource record is not
-   sensitive to passive attacks.  The keying material may be freely
-   disclosed to any party without any impact on the security properties
-   of the resulting IPsec session: IPsec and IKE provide for defense
-   against both active and passive attacks.
-
-   Any user of this resource record MUST carefully document their trust
-   model, and why the trust model of DNSSEC is appropriate, if that is
-   the secure channel used.
-
-4.1 Active attacks against unsecured IPSECKEY resource records
-
-   This section deals with active attacks against the DNS.  These
-   attacks require that DNS requests and responses be intercepted and
-   changed.  DNSSEC is designed to defend against attacks of this kind.
-
-   The first kind of active attack is when the attacker replaces the
-   keying material with either a key under its control or with garbage.
-
-   If the attacker is not able to mount a subsequent man-in-the-middle
-   attack on the IKE negotiation after replacing the public key, then
-   this will result in a denial of service, as the authenticator used by
-   IKE would fail.
-
-   If the attacker is able to both to mount active attacks against DNS
-   and is also in a position to perform a man-in-the-middle attack on
-   IKE and IPsec negotiations, then the attacker will be in a position
-   to compromise the resulting IPsec channel.  Note that an attacker
-   must be able to perform active DNS attacks on both sides of the IKE
-   negotiation in order for this to succeed.
-
-   The second kind of active attack is one in which the attacker
-   replaces the the gateway address to point to a node under the
-   attacker's control.  The attacker can then either replace the public
-
-
-
-Richardson                Expires March 4, 2004                 [Page 9]
-
-Internet-Draft                   ipsecrr                  September 2003
-
-
-   key or remove it, thus providing an IPSECKEY record of its own to
-   match the gateway address.
-
-   This later form creates a simple man-in-the-middle since the attacker
-   can then create a second tunnel to the real destination.  Note that,
-   as before, this requires that the attacker also mount an active
-   attack against the responder.
-
-   Note that the man-in-the-middle can not just forward cleartext
-   packets to the original destination.  While the destination may be
-   willing to speak in the clear, replying to the original sender, the
-   sender will have already created a policy expecting ciphertext.
-   Thus, the attacker will need to intercept traffic from both sides.
-   In some cases, the attacker may be able to accomplish the full
-   intercept by use of Network Addresss/Port Translation (NAT/NAPT)
-   technology.
-
-   Note that the danger here only applies to cases where the gateway
-   field of the IPSECKEY RR indicates a different entity than the owner
-   name of the IPSECKEY RR.  In cases where the end-to-end integrity of
-   the IPSECKEY RR is suspect, the end client MUST restrict its use of
-   the IPSECKEY RR to cases where the RR owner name matches the content
-   of the gateway field.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson                Expires March 4, 2004                [Page 10]
-
-Internet-Draft                   ipsecrr                  September 2003
-
-
-5. IANA Considerations
-
-   This document updates the IANA Registry for DNS Resource Record Types
-   by assigning type X to the IPSECKEY record.
-
-   This document creates an IANA registry for the algorithm type field.
-
-   Values 0, 1 and 2 are defined in Section 2.3.  Algorithm numbers 3
-   through 255 can be assigned by IETF Consensus (see RFC2434 [6]).
-
-   This document creates an IANA registry for the gateway type field.
-
-   Values 0, 1, 2 and 3 are defined in Section 2.4.  Algorithm numbers 4
-   through 255 can be assigned by Standards Action (see RFC2434 [6]).
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson                Expires March 4, 2004                [Page 11]
-
-Internet-Draft                   ipsecrr                  September 2003
-
-
-6. Acknowledgments
-
-   My thanks to Paul Hoffman, Sam Weiler, Jean-Jacques Puig, Rob
-   Austein, and Olafur Gurmundsson who reviewed this document carefully.
-   Additional thanks to Olafur Gurmundsson for a reference
-   implementation.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson                Expires March 4, 2004                [Page 12]
-
-Internet-Draft                   ipsecrr                  September 2003
-
-
-Normative references
-
-   [1]  Mockapetris, P., "Domain names - concepts and facilities", STD
-        13, RFC 1034, November 1987.
-
-   [2]  Mockapetris, P., "Domain names - implementation and
-        specification", STD 13, RFC 1035, November 1987.
-
-   [3]  Borenstein, N. and N. Freed, "MIME (Multipurpose Internet Mail
-        Extensions) Part One: Mechanisms for Specifying and Describing
-        the Format of Internet Message Bodies", RFC 1521, September
-        1993.
-
-   [4]  Bradner, S., "The Internet Standards Process -- Revision 3", BCP
-        9, RFC 2026, October 1996.
-
-   [5]  Eastlake, D. and C. Kaufman, "Domain Name System Security
-        Extensions", RFC 2065, January 1997.
-
-   [6]  Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA
-        Considerations Section in RFCs", BCP 26, RFC 2434, October 1998.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson                Expires March 4, 2004                [Page 13]
-
-Internet-Draft                   ipsecrr                  September 2003
-
-
-Non-normative references
-
-   [7]   Thomson, S. and C. Huitema, "DNS Extensions to support IP
-         version 6", RFC 1886, December 1995.
-
-   [8]   Bradner, S., "Key words for use in RFCs to Indicate Requirement
-         Levels", BCP 14, RFC 2119, March 1997.
-
-   [9]   Piper, D., "The Internet IP Security Domain of Interpretation
-         for ISAKMP", RFC 2407, November 1998.
-
-   [10]  Eastlake, D., "Domain Name System Security Extensions", RFC
-         2535, March 1999.
-
-   [11]  Eastlake, D., "DSA KEYs and SIGs in the Domain Name System
-         (DNS)", RFC 2536, March 1999.
-
-   [12]  Eastlake, D., "RSA/SHA-1 SIGs and RSA KEYs in the Domain Name
-         System (DNS)", RFC 3110, May 2001.
-
-   [13]  Massey, D. and S. Rose, "Limiting the Scope of the KEY Resource
-         Record (RR)", RFC 3445, December 2002.
-
-
-Author's Address
-
-   Michael C. Richardson
-   Sandelman Software Works
-   470 Dawson Avenue
-   Ottawa, ON  K1Z 5V7
-   CA
-
-   EMail: mcr@sandelman.ottawa.on.ca
-   URI:   http://www.sandelman.ottawa.on.ca/
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson                Expires March 4, 2004                [Page 14]
-
-Internet-Draft                   ipsecrr                  September 2003
-
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society (2003).  All Rights Reserved.
-
-   This document and translations of it may be copied and furnished to
-   others, and derivative works that comment on or otherwise explain it
-   or assist in its implementation may be prepared, copied, published
-   and distributed, in whole or in part, without restriction of any
-   kind, provided that the above copyright notice and this paragraph are
-   included on all such copies and derivative works.  However, this
-   document itself may not be modified in any way, such as by removing
-   the copyright notice or references to the Internet Society or other
-   Internet organizations, except as needed for the purpose of
-   developing Internet standards in which case the procedures for
-   copyrights defined in the Internet Standards process must be
-   followed, or as required to translate it into languages other than
-   English.
-
-   The limited permissions granted above are perpetual and will not be
-   revoked by the Internet Society or its successors or assigns.
-
-   This document and the information contained herein is provided on an
-   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
-   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
-   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
-   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-Acknowledgement
-
-   Funding for the RFC Editor function is currently provided by the
-   Internet Society.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Richardson                Expires March 4, 2004                [Page 15]
-
diff --git a/doc/draft-spencer-ipsec-ike-implementation.nr b/doc/draft-spencer-ipsec-ike-implementation.nr
deleted file mode 100644
index 5b5776e22..000000000
--- a/doc/draft-spencer-ipsec-ike-implementation.nr
+++ /dev/null
@@ -1,1203 +0,0 @@
-.\" date, expiry date, copyright year, and revision
-.DA "26 Feb 2002"
-.ds e "26 Aug 2002
-.ds c 2002
-.ds r 02
-.\" boilerplate
-.pl 10i
-.nr PL 10i
-.po 0
-.nr PO 0
-.ll 7.2i
-.nr LL 7.2i
-.lt 7.2i
-.nr LT 7.2i
-.hy 0
-.nr HY 0
-.ad l
-.nr PD 1v
-.\" macros for paragraph, section header, reference, TOC
-.de P
-.br
-.LP
-.in 3
-..
-.de H
-.br
-.ne 5
-.LP
-.in 0
-..
-.de R
-.IP "   [\\$1]" 14
-..
-.de T
-.ie \\$1=1 \{\
-.nf
-.ta \n(LLu-3nR
-.\}
-.el \{\
-.fi
-.\}
-..
-.de S
-.ie '\\$1'' \\$2 \a \\$3
-.el \\$1. \\$2 \a \\$3
-..
-.\" headers/footers
-.ds LH "Internet Draft
-.ds CH "IKE Implementation Issues
-.ds RH "\*(DY
-.ds LF "Spencer & Redelmeier
-.ds CF "
-.ds RF "[Page %]
-.\" and let's get started
-.RT
-.nf
-.tl 'Network Working Group''Henry Spencer'
-.tl 'Internet Draft''SP Systems'
-.tl 'Expires: \*e''D. Hugh Redelmeier'
-.tl '''Mimosa Systems'
-.tl '''\*(DY'
-.sp
-.ce 99
-IKE Implementation Issues
-<draft-spencer-ipsec-ike-implementation-\*r.txt>
-.ce 0
-.H
-Status of this Memo
-.P
-This document is an Internet-Draft and is in full conformance with
-all provisions of Section 10 of RFC2026.
-.P
-(If approved as an Informational RFC...)
-This memo provides information for the Internet community.
-This memo does not specify an Internet standard of any kind.
-.P
-Distribution of this memo is unlimited.
-.P
-Internet-Drafts are working documents of the Internet Engineering
-Task Force (IETF), its areas, and its working groups.
-Note that
-other groups may also distribute working documents as Internet-Drafts.
-.P
-Internet-Drafts are draft documents valid for a maximum of six months
-and may be updated, replaced, or obsoleted by other documents at any
-time.
-It is inappropriate to use Internet-Drafts as reference
-material or to cite them other than as "work in progress."
-.P
-The list of current Internet-Drafts can be accessed at
-http://www.ietf.org/ietf/1id-abstracts.txt.
-.P
-The list of Internet-Draft Shadow Directories can be accessed at
-http://www.ietf.org/shadow.html.
-.P
-This Internet-Draft will expire on \*e.
-.H
-Copyright Notice
-.P
-Copyright (C) The Internet Society \*c.  All Rights Reserved.
-.bp
-.H
-Table of Contents
-.P
-.T 1
-.S "1" "Introduction" "3"
-.S "2" "Lower-level Background and Notes" "4"
-.S "2.1" "Packet Handling" "4"
-.S "2.2" "Ciphers" "5"
-.S "2.3" "Interfaces" "5"
-.S "3" "IKE Infrastructural Issues" "5"
-.S "3.1" "Continuous Channel" "5"
-.S "3.2" "Retransmission" "5"
-.S "3.3" "Replay Prevention" "6"
-.S "4" "Basic Keying and Rekeying" "7"
-.S "4.1" "When to Create SAs" "7"
-.S "4.2" "When to Rekey" "8"
-.S "4.3" "Choosing an SA" "9"
-.S "4.4" "Why to Rekey" "9"
-.S "4.5" "Rekeying ISAKMP SAs" "10"
-.S "4.6" "Bulk Negotiation" "10"
-.S "5" "Deletions, Teardowns, Crashes" "11"
-.S "5.1" "Deletions" "11"
-.S "5.2" "Teardowns and Shutdowns" "12"
-.S "5.3" "Crashes" "13"
-.S "5.4" "Network Partitions" "13"
-.S "5.5" "Unknown SAs" "14"
-.S "6" "Misc. IKE Issues" "16"
-.S "6.1" "Groups 1 and 5" "16"
-.S "6.2" "To PFS Or Not To PFS" "16"
-.S "6.3" "Debugging Tools, Lack Thereof" "16"
-.S "6.4" "Terminology, Vagueness Thereof" "17"
-.S "6.5" "A Question of Identity" "17"
-.S "6.6" "Opportunistic Encryption" "17"
-.S "6.7" "Authentication and RSA Keys" "17"
-.S "6.8" "Misc. Snags" "18"
-.S "7" "Security Considerations" "19"
-.S "8" "References" "19"
-.S "" "Authors' Addresses" "20"
-.S "" "Full Copyright Statement" "21"
-.T 0
-.bp
-.H
-Abstract
-.P
-The current IPsec specifications for key exchange and connection management,
-RFCs 2408 [ISAKMP] and 2409 [IKE],
-leave many aspects of connection management unspecified,
-most prominently rekeying practices.
-Pending clarifications in future revisions of the specifications,
-this document sets down some successful experiences,
-to minimize the extent to which new implementors have to rely
-on unwritten folklore.
-.P
-The Linux FreeS/WAN implementation of IPsec interoperates
-with almost every other IPsec implementation.
-This document describes how the FreeS/WAN project has resolved
-some of the gaps in the IPsec specifications
-(and plans to resolve some others),
-and what difficulties have been encountered,
-in hopes that this generally-successful experience
-might be informative to new implementors.
-.P
-This is offered as an Informational RFC.
-.P
-This -\*r revision mainly:
-discusses ISAKMP SA expiry during IPsec-SA rekeying (4.5),
-revises the discussion of bidirectional Deletes (5.1),
-suggests remembering the parameters of successful negotiations
-for later use (4.2, 5.3),
-notes an unsuccessful negotiation from the other end as a hint of a possibly
-broken connection (5.5),
-and adds sections on network partitions (5.4),
-authentication methods and the subtleties of RSA public keys (6.7),
-and miscellaneous interoperability concerns (6.8).
-.H
-1. Introduction
-.P
-The current IPsec specifications for key exchange and connection management,
-RFCs 2408 [ISAKMP] and 2409 [IKE],
-leave many aspects of connection management unspecified,
-most prominently rekeying practices.
-This is a cryptic puzzle which
-each group of implementors has to struggle with,
-and differences in how the ambiguities and gaps are resolved are
-potentially a fruitful source of interoperability problems.
-We can hope that future revisions of the specifications will clear this up.
-Meanwhile, it seems useful to set down some successful experiences,
-to minimize the extent to which new implementors have to rely
-on unwritten folklore.
-.P
-The Linux FreeS/WAN implementation of IPsec interoperates
-with almost every other IPsec implementation,
-and because of its free nature,
-it also sees some use as a reference implementation by other implementors.
-The high degree of interoperability is noteworthy
-given its organizers' strong minimalist bias,
-which has caused them to implement only
-a small subset of the full glory of IPsec.
-This document describes how the FreeS/WAN project has resolved
-some of the gaps in the IPsec specifications
-(and plans to resolve some others),
-and what difficulties have been encountered,
-in hopes that this generally-successful experience
-might be informative to new implementors.
-.P
-One small caution about applicability:
-this experience may not be relevant
-to severely resource-constrained implementations.
-FreeS/WAN's target environment is previous-generation PCs,
-now available at trivial cost (often,
-within an organization, at no cost),
-which have quite impressive CPU power and memory by the standards
-of only a few years ago.
-Some of the approaches discussed here may be inapplicable to
-implementations with severe external constraints which prevent them
-from taking advantage of modern hardware technology.
-.H
-2. Lower-level Background and Notes
-.H
-2.1. Packet Handling
-.P
-FreeS/WAN implements ESP [ESP] and AH [AH] straightforwardly,
-although AH sees little use among our users.
-Our ESP/AH implementation cannot currently handle packets
-with IP options;
-somewhat surprisingly, this has caused little difficulty.
-We insist on encryption and do not support authentication-only
-connections, and this has not caused significant difficulty either.
-.P
-MTU and fragmentation issues, by contrast, have been a constant headache.
-We will not describe the details of our current approach to them,
-because it still needs work.
-One difficulty we have encountered is that many combinations of
-packet source and packet destination
-apparently cannot cope with an "interior minimum" in the path MTU,
-e.g. where an IPsec tunnel intervenes and its headers reduce the MTU
-for an intermediate link.
-This is particularly prevalent when using common PC software to
-connect to large well-known web sites;
-we think it is largely due to
-misconfigured firewalls which do not pass ICMP
-Fragmentation Required messages.
-The only solution we have yet found is to lie about the MTU of the tunnel,
-accepting the (undesirable) fragmentation of the ESP packets
-for the sake of preserving connectivity.
-.P
-We currently zero out the TOS field of ESP packets,
-rather than copying it from the inner header,
-on the grounds that it lends itself too well to traffic analysis
-and covert channels.
-We provide an option to restore RFC 2401 [IPSEC] copying behavior,
-but this appears to see little use.
-.H
-2.2. Ciphers
-.P
-We initially implemented both DES [DES] and 3DES [CIPHERS] for both
-IKE and ESP,
-but after the Deep Crack effort [CRACK] demonstrated its inherent insecurity,
-we dropped support for DES.
-Somewhat surprisingly,
-our insistence on 3DES has caused almost no interoperability problems,
-despite DES being officially mandatory.
-A very few other systems either do not support 3DES or support it only
-as an optional upgrade,
-which inconveniences a few would-be users.
-There have also been one or two cases of systems
-which don't quite seem to know the difference!
-.P
-See also section 6.1 for a consequence of our insistence on 3DES.
-.H
-2.3. Interfaces
-.P
-We currently employ PF_KEY version 2 [PFKEY],
-plus various non-standard extensions,
-as our interface between keying and ESP.
-This has not proven entirely satisfactory.
-Our feeling now is that keying issues and policy issues
-do not really lend
-themselves to the clean separation that PF_KEY envisions.
-.H
-3. IKE Infrastructural Issues
-.P
-A number of problems in IPsec connection management become easier if
-some attention is first paid to providing an infrastructure
-to support solving them.
-.H
-3.1. Continuous Channel
-.P
-FreeS/WAN uses an approximation to the "continuous channel" model,
-in which ISAKMP SAs are maintained between IKEs
-so long as any IPsec SAs are open between the two systems.
-The resource consumption of this is minor:
-the only substantial overhead is occasional rekeying.
-IPsec SA management becomes significantly simpler if there is always
-a channel for transmission of control messages.
-We suggest (although we do not yet fully implement this) that
-inability to maintain (e.g., to rekey) this control path
-should be grounds for tearing down the IPsec SAs as well.
-.P
-As a corollary of this,
-there is one and only one ISAKMP SA maintained between a pair of IKEs
-(although see sections 5.3 and 6.5 for minor complications).
-.H
-3.2. Retransmission
-.P
-The unreliable nature of UDP transmission is a nuisance.
-IKE implementations should always be prepared to retransmit the most recent
-message they sent on an ISAKMP SA,
-since there is some possibility that the other end did not get it.
-This means, in particular,
-that the system sending the supposedly-last message of an exchange
-cannot relax and assume that the exchange is complete,
-at least not until a significant timeout has elapsed.
-.P
-Systems must also retain information about the message most recently received
-in an exchange,
-so that a duplicate of it can be detected
-(and possibly interpreted as a NACK for the response).
-.P
-The retransmission rules FreeS/WAN follows are:
-(1) if a reply is expected, retransmit only if it does not appear
-before a timeout;
-and (2) if a reply is not expected (last message of the exchange),
-retransmit only on receiving a retransmission of the previous message.
-Notably, in case (1) we do NOT retransmit on receiving a retransmission,
-which avoids possible congestion problems arising from packet duplication,
-at the price of slowing response to packet loss.
-The timeout for case (1) is 10 seconds for the first retry,
-20 seconds for the second, and 40 seconds for all subsequent
-retries (normally only one,
-except when
-configuration settings call for persistence and the message is
-the first message of Main Mode with a new peer).
-These retransmission rules have been entirely successful.
-.P
-(Michael Thomas of Cisco has pointed out that the retry timeouts should
-include some random jitter, to de-synchronize hosts which are
-initially synchronized by, e.g., a power outage.
-We already jitter our rekeying times,
-as noted in section 4.2,
-but that does not help with initial startup.
-We're implementing jittered retries,
-but cannot yet report on experience with this.)
-.P
-There is a deeper problem, of course, when an entire "exchange" consists
-of a single message,
-e.g. the ISAKMP Informational Exchange.
-Then there is no way to decide whether or when a retransmission is
-warranted at all.
-This seems like poor design, to put it mildly
-(and there is now talk of fixing it).
-We have no experience in dealing with this problem at this time,
-although it is part of the reason why we have delayed implementing
-Notification messages.
-.H
-3.3. Replay Prevention
-.P
-The unsequenced nature of UDP transmission is also troublesome,
-because it means that higher levels must consider the possibility
-of replay attacks.
-FreeS/WAN takes the position that systematically eliminating this
-possibility at a low level is strongly preferable to forcing careful
-consideration of possible impacts at every step of an exchange.
-RFC 2408 [ISAKMP] section 3.1 states that the Message ID of an
-ISAKMP message must be "unique".
-FreeS/WAN interprets this literally,
-as forbidding duplication of Message IDs
-within the set of all messages sent via a single ISAKMP SA.
-.P
-This requires remembering all Message IDs until the ISAKMP SA is
-superseded by rekeying,
-but that is not costly (four bytes per sent or received message),
-and it ELIMINATES replay attacks from consideration;
-we believe this investment of resources is well worthwhile.
-If the resource consumption becomes excessive\(emin our experience
-it has not\(emthe ISAKMP SA can be rekeyed early to collect the garbage.
-.P
-There is theoretically an interoperability problem when talking to
-implementations which interpret "unique" more loosely
-and may re-use Message IDs,
-but it has not been encountered in practice.
-This approach appears to be completely interoperable.
-.P
-The proposal by
-Andrew Krywaniuk [REPLAY],
-which advocates turning the Message ID into an anti-replay counter,
-would achieve the same goal without the minor per-message memory overhead.
-This may be preferable,
-although it means an actual protocol change and more study is needed.
-.H
-4. Basic Keying and Rekeying
-.H
-4.1. When to Create SAs
-.P
-As Tim Jenkins [REKEY] pointed out,
-there is a potential race condition in Quick Mode:
-a fast lightly-loaded Initiator might start using IPsec SAs very
-shortly after sending QM3 (the third and last message of Quick Mode),
-while a slow heavily-loaded Responder might
-not be ready to receive them until after spending
-a significant amount of time creating its inbound SAs.
-The problem is even worse if QM3 gets delayed or lost.
-.P
-FreeS/WAN's approach to this is what Jenkins called "Responder Pre-Setup":
-the Responder creates its inbound IPsec SAs before it sends QM2,
-so they are always ready and waiting
-when the Initiator sends QM3 and begins sending traffic.
-This approach is simple and reliable,
-and in our experience it interoperates with everybody.
-(There is potentially still a problem if FreeS/WAN is the Initiator
-and the Responder does not use Responder Pre-Setup,
-but no such problems have been seen.)
-The only real weakness of Responder Pre-Setup
-is the possibility of replay attacks,
-which we have eliminated by other means (see section 3.3).
-.P
-With this approach, the Commit Bit is useless,
-and we ignore it.
-In fact, until quite recently we discarded any IKE message containing it,
-and this caused surprisingly few interoperability problems;
-apparently it is not widely used.
-We have recently been persuaded that simply ignoring it is preferable;
-preliminary experience with this indicates that the result is successful
-interoperation with implementations which set it.
-.H
-4.2. When to Rekey
-.P
-To preserve connectivity for user traffic,
-rekeying of a connection
-(that is, creation of new IPsec SAs to supersede the current ones)
-must begin before its current IPsec SAs expire.
-Preferably one end should predictably start rekeying negotiations first,
-to avoid the extra overhead of two simultaneous negotiations,
-although either end should be prepared to rekey if the other does not.
-There is also a problem with "convoys" of keying negotiations:
-for example, a "hub" gateway with many IPsec connections
-can be inundated with rekeying negotiations
-exactly one connection-expiry time after it reboots,
-and the massive overload this induces tends to make this
-situation self-perpetuating,
-so it recurs regularly.
-(Convoys can also evolve gradually from initially-unsynchronized negotiations.)
-.P
-FreeS/WAN has the concept of a "rekeying margin", measured in seconds.
-If FreeS/WAN was the Initiator for the previous rekeying
-(or the startup, if none) of the connection,
-it nominally starts rekeying negotiations at expiry time
-minus one rekeying margin.
-Some random jitter is added to break up convoys:
-rather than starting rekeying exactly at minus one margin,
-it starts at a random time between minus one margin
-and minus two margins.
-(The randomness here need not be cryptographic in quality,
-so long as it varies over time and between hosts.
-We use an ordinary PRNG seeded with a few bytes from a cryptographic
-randomness source.
-The seeding mostly just ensures that the PRNG sequence is different
-for different hosts, even if they start up simultaneously.)
-.P
-If FreeS/WAN was the Responder for the previous rekeying/startup,
-and nothing has been heard from the previous Initiator
-at expiry time minus one-half the rekeying margin,
-FreeS/WAN will initiate rekeying negotiations.
-No jitter is applied;
-we now believe that it should be jittered,
-say between minus one-half margin and minus one-quarter margin.
-.P
-Having the Initiator lead the way is an obvious way of deciding
-who should speak first,
-since there is already an Initiator/Responder asymmetry in the connection.
-Moreover, our experience has been that Initiator lead gives a significantly
-higher probability of successful negotiation!
-The negotiation process itself is asymmetric,
-because the Initiator must make a few specific proposals which the Responder
-can only accept or reject,
-so the Initiator must try to guess where its "acceptable" region
-(in parameter space)
-might overlap with the Responder's.
-We have seen situations where negotiations would succeed or fail
-depending on which end initiated them,
-because one end was making better guesses.
-Given an existing connection,
-we KNOW that the previous Initiator WAS able to initiate a successful
-negotiation,
-so it should (if at all possible) take the lead again.
-Also, the Responder should remember the Initiator's successful proposal,
-and start from that
-rather than from his own default proposals if he must take the lead;
-we don't currently implement this completely but plan to.
-.P
-FreeS/WAN defaults the rekeying margin to 9 minutes,
-although this can be changed by configuration.
-There is also
-a configuration option to alter the permissible range of jitter.
-The defaults were chosen somewhat arbitrarily,
-but they work extremely well
-and the configuration options are rarely used.
-.H
-4.3. Choosing an SA
-.P
-Once rekeying has occurred,
-both old and new IPsec SAs for the connection exist,
-at least momentarily.
-FreeS/WAN accepts incoming traffic
-on either old or new inbound SAs,
-but sends outgoing traffic only on the new outbound ones.
-This approach appears to be significantly more robust than
-using the old ones until they expire,
-notably in cases where renegotiation has occurred because something has
-gone wrong on the other end.
-It avoids having to pay meticulous attention to the state of the other end,
-state which is difficult to learn reliably given the limitations of IKE.
-.P
-This approach has interoperated successfully with ALMOST all other
-implementations.
-The only (well-characterized) problem cases have been implementations
-which rely on receiving a Delete message for the old SAs to tell them
-to switch over to the new ones.
-Since delivery of Delete is unreliable,
-and support for Delete is optional,
-this reliance seems like a serious mistake.
-This is all the more true because Delete
-announces that the deletion has
-already occurred [ISAKMP, section 3.15], not that it is about to occur,
-so packets already in transit in the other direction could be lost.
-Delete should be used for resource cleanup, not for switchover control.
-(These matters are discussed further in section 5.)
-.H
-4.4. Why to Rekey
-.P
-FreeS/WAN currently implements only time-based expiry (life in seconds),
-although we are working toward
-supporting volume-based expiry (life in kilobytes) as well.
-The lack of volume-based expiry has not been an interoperability
-problem so far.
-.P
-Volume-based expiry does add some minor complications.
-In particular, it makes explicit Delete of now-disused SAs more important,
-because once an SA stops being used,
-it might not expire on its own.
-We believe this lacks robustness and is generally unwise,
-especially given the lack of a reliable Delete,
-and expect to use volume-based expiry only as a supplement
-to time-based expiry.
-However, Delete support (see section 5) does seem advisable
-for use with volume-based expiry.
-.P
-We do not believe that volume-based expiry alters the desirability
-of switching immediately to the new SAs after rekeying.
-Rekeying margins are normally a small fraction of the total life of an SA,
-so we feel there is no great need to "use it all up".
-.H
-4.5. Rekeying ISAKMP SAs
-.P
-The above discussion has focused on rekeying for IPsec SAs,
-but FreeS/WAN applies the same approaches to rekeying for ISAKMP SAs,
-with similar success.
-.P
-One issue which we have noticed, but not explicitly dealt with,
-is that difficulties may ensue if an IPsec-SA rekeying negotiation
-is in progress at the time when the relevant ISAKMP SA gets rekeyed.
-The IKE specification [IKE] hints, but does not actually say,
-that a Quick Mode negotiation should remain on a single ISAKMP SA throughout.
-.P
-A reasonable rekeying margin will generally
-prevent the old ISAKMP SA from actually expiring during a negotiation.
-Some attention may be needed to prevent in-progress negotiations from
-being switched to the new ISAKMP SA.
-Any attempt at pre-expiry deletion of the ISAKMP SA must be postponed
-until after such dangling negotiations are completed,
-and there should be enough delay between ISAKMP-SA rekeying and a
-deletion attempt to (more or less)
-ensure that there are no negotiation-starting packets still in transit
-from before the rekeying.
-.P
-At present, FreeS/WAN does none of this,
-and we don't KNOW of any resulting trouble.
-With normal lifetimes, the problem should be uncommon,
-and we speculate that an occasional disrupted negotiation simply gets retried.
-.H
-4.6. Bulk Negotiation
-.P
-Quick Mode nominally provides for negotiating possibly-large numbers of
-similar but unrelated IPsec SAs simultaneously
-[IKE, section 9].
-Nobody appears to do this.
-FreeS/WAN does not support it, and its absence has caused no problems.
-.H
-5. Deletions, Teardowns, Crashes
-.P
-FreeS/WAN currently ignores all Notifications and Deletes,
-and never generates them.
-This has caused little difficulty in interoperability,
-which shouldn't be surprising (since Notification and Delete support is
-officially entirely optional) but does seem to surprise some people.
-Nevertheless, we do plan some changes to this approach
-based on past experience.
-.H
-5.1. Deletions
-.P
-As hinted at above,
-we plan to implement Delete support, done as follows.
-Shortly after rekeying of IPsec SAs,
-the Responder issues a Delete for its old inbound SAs
-(but does not actually delete them yet).
-The Responder initiates this because the Initiator started using the
-new SAs on sending QM3, while the Responder started using them only
-on (or somewhat after) receiving QM3,
-so there is less chance of old-SA packets still being in transit from
-the Initiator.
-The Initiator issues an unsolicited Delete only if it does not hear one
-from the Responder after a longer delay.
-.P
-Either party, on receiving a Delete
-for one or more of the old outbound SAs of a connection,
-deletes ALL the connection's SAs,
-and acknowledges with a Delete for the old inbound SAs.
-A Delete for nonexistent SAs
-(e.g., SAs which have already been expired or deleted) is ignored.
-There is no retransmission of unacknowledged Deletes.
-.P
-In the normal case,
-with prompt reliable transmission (except possibly for loss of the
-Responder's initial Delete)
-and conforming implementations
-on both ends, this results in three Deletes being transmitted,
-resembling the classic three-way handshake.
-Loss of a Delete after the first, or multiple losses,
-will cause the SAs not to be deleted on at least one end.
-It appears difficult to do much better without at least
-a distinction between request and acknowledgement.
-.P
-RFC 2409 section 9 "strongly suggests" that there be no response to
-informational messages such as Deletes,
-but the only rationale offered is prevention of infinite loops
-endlessly exchanging "I don't understand you" informationals.
-Since Deletes cannot lead to such a loop
-(and in any case, the nonexistent-SA rule prevents more than one
-acknowledgement for the same connection),
-we believe this recommendation is inapplicable here.
-.P
-As noted in section 4.3, these Deletes are intended for
-resource cleanup, not to control switching between SAs.
-But we expect that they will improve interoperability
-with some broken implementations.
-.P
-We believe strongly that connections need to be considered as a whole,
-rather than treating each SA as an independent entity.
-We will issue Deletes only for the full set of inbound SAs of
-a connection,
-and will treat a Delete for any outbound SA as equivalent to deletion
-of all the outbound SAs for the associated connection.
-.P
-The above is phrased in terms of IPsec SAs,
-but essentially the same approach can be applied to ISAKMP SAs
-(the Deletes for the old ISAKMP SA should be sent via the new one).
-.H
-5.2. Teardowns and Shutdowns
-.P
-When a connection is not intended to be up permanently,
-there is a need to coordinate teardown,
-so that both ends are aware that the connection is down.
-This is both for recovery of resources,
-and to avoid routing packets through
-dangling SAs which can no longer deliver them.
-.P
-Connection teardown will use the same bidirectional exchange of Deletes
-as discussed in section 5.1:
-a Delete received for current IPsec SAs (not yet obsoleted by rekeying)
-indicates that the other host wishes to tear down the associated connection.
-.P
-A Delete received for a current ISAKMP SA indicates that the other host
-wishes to tear down not only the ISAKMP SA but also all IPsec SAs
-currently under the supervision of that ISAKMP SA.
-The 5.1 bidirectional exchange might seem impossible in this case,
-since reception of an ISAKMP-SA Delete indicates that the other end
-will ignore further traffic on that ISAKMP SA.
-We suggest using the same tactic discussed in 5.1 for IPsec SAs:
-the first Delete is sent without actually doing the deletion,
-and the response to receiving a Delete is to do the deletion and reply
-with another Delete.
-If there is no response to the first Delete,
-retry a small number of times and then give up and do the deletion;
-apart from being robust against packet loss,
-this also maximizes the probability that an implementation which does
-not do the bidirectional Delete will receive at least one of the Deletes.
-.P
-When a host with current connections knows that it is about to shut down,
-it will issue Deletes for all SAs involved (both IPsec and ISAKMP),
-advising its peers (as per the meaning of Delete [ISAKMP, section 3.15])
-that the SAs have become useless.
-It will ignore attempts at rekeying or connection startup thereafter,
-until it shuts down.
-.P
-It would be better to have a Final-Contact notification,
-analogous to Initial-Contact but indicating that no new negotiations
-should be attempted until further notice.
-Initial-Contact actually could be used for shutdown notification (!),
-but in networks where connections are intended to exist permanently,
-it seems likely to provoke unwanted attempts
-to renegotiate the lost connections.
-.H
-5.3. Crashes
-.P
-Systems sometimes crash.
-Coping with the resulting loss of information is easily the most
-difficult problem we have found in implementing robust IPsec systems.
-.P
-When connections are intended to be permanent,
-it is simple to specify renegotiation on reboot.
-With our approach to SA selection (see section 4.3),
-this handles such cases robustly and well.
-We do have to tell users that BOTH hosts should be set this way.
-In cases where crashes are synchronized (e.g. by power interruptions),
-this may result in simultaneous negotiations at reboot.
-We currently allow both negotiations to proceed to completion,
-but our use-newest selection method
-effectively ignores one connection or the other,
-and when one of them rekeys,
-we notice that the new SAs replace those of both old connections,
-and we then refrain from rekeying the other.
-(This duplicate detection is desirable in any event, for robustness,
-to ensure that the system converges on a reasonable state eventually
-after it is perturbed by difficulties or bugs.)
-.P
-When connections are not permanent, the situation is less happy.
-One particular situation in which we see problems is when a number of
-"Road Warrior" hosts occasionally call in to a central server.
-The server is normally configured not to initiate such connections,
-since it does not know when the Road Warrior is available (or what IP
-address it is using).
-Unfortunately, if the server crashes and reboots,
-any Road Warriors then connected have a problem:
-they don't know that the server has crashed,
-so they can't renegotiate,
-and the server has forgotten both the connections and
-their (transient) IP addresses,
-so it cannot renegotiate.
-.P
-We believe that the simplest answer to this problem is what John Denker
-has dubbed "address inertia":
-the server makes a best-effort attempt to remember (in nonvolatile storage)
-which connections were active and what the far-end addresses were
-(and what the successful proposal's parameters were),
-so that it can attempt renegotiation on reboot.
-We have not implemented this yet, but intend to;
-Denker has implemented it himself,
-although in a somewhat messy way,
-and reports excellent results.
-.H
-5.4. Network Partitions
-.P
-A network partition, making the two ends unable to reach each other,
-has many of the same characteristics as having the other end crash... until
-the network reconnects.
-It is desirable that recovery from this be automatic.
-.P
-If the network reconnects before any rekeying attempts
-or other IKE activities occurred,
-recovery is fully transparent,
-because the IKEs have no idea that there was any problem.
-(Complaints such as ICMP Host Unreachable messages are unauthenticated
-and hence cannot be given much weight.)
-This fits the general mold of TCP/IP:
-if nobody wanted to send any traffic, a network outage doesn't matter.
-.P
-If IKE activity did occur,
-the IKE implementation will discover that the other end doesn't seem
-to be responding.
-The preferred response to this depends on the nature of the connection.
-If it was intended to be ephemeral (e.g. opportunistic encryption [OE]),
-closing it down after a few retries is reasonable.
-If the other end is expected to sometimes drop the connection without
-warning, it may not be desirable to retry at all.
-(We support both these forms of configurability,
-and indeed we also have a configuration option to suppress
-rekeying entirely on one end.)
-.P
-If the connection was intended to be permanent, however,
-then persistent attempts to re-establish it are appropriate.
-Some degree of backoff is appropriate here,
-so that retries get less frequent as the outage gets prolonged.
-Backoff should be limited,
-so that re-established connectivity is not followed by a long delay
-before a retry.
-Finally, after many retries (say 24 hours' worth),
-it may be preferable to just declare the connection down and rely
-on manual intervention to re-establish it,
-should this be desirable.
-We do not yet fully support all this.
-.H
-5.5. Unknown SAs
-.P
-A more complete solution to crashes
-would be for an IPsec host to note the arrival
-of ESP packets on an unknown IPsec SA,
-and report it somehow to the other host, which can then decide to renegotiate.
-This arguably might be preferable in any case\(emif
-the non-rebooted host has no traffic to send,
-it does not care whether the connection is intact\(embut
-delays and packet loss will be reduced
-if the connection is renegotiated BEFORE there is traffic for it.
-So unknown-SA detection is best reserved as a fallback method,
-with address inertia used to deal with most such cases.
-.P
-A difficulty with unknown-SA detection is,
-just HOW should the other host be notified?
-IKE provides no good way to do the notification:
-Notification payloads (e.g., Initial-Contact) are unauthenticated
-unless they are sent under protection of an ISAKMP SA.
-A "Security Failures - Bad SPI" ICMP message [SECFAIL]
-is an interesting alternative,
-but has the disadvantage of likewise being unauthenticated.
-It's fundamentally unlikely that there is a simple solution to this,
-given that almost any way of arranging or checking authentication for such a
-notification is costly.
-.P
-We think the best answer to this is a two-step approach.
-An unauthenticated Initial-Contact or
-Security Failures - Bad SPI cannot be taken as a reliable
-report of a problem,
-but can be taken as a hint that a problem MIGHT exist.
-Then there needs to be some reliable way of checking such hints,
-subject to rate limiting since the checks are likely to be costly
-(and checking the same connection repeatedly at short intervals is unlikely
-to be worthwhile anyway).
-So the rebooted host sends the notification,
-and the non-rebooted host\(emwhich still thinks it has a connection\(emchecks
-whether the connection still works,
-and renegotiates if not.
-.P
-Also, if an IPsec host which believes it has a connection to another host
-sees an unsuccessful attempt by that host to negotiate a new one,
-that is also a hint of possible problems,
-justifying a check and possible renegotiation.
-("Unsuccessful" here means a negotiation failure due to lack of a
-satisfactory proposal.
-A failure due to authentication failure
-suggests a denial-of-service attack by a third party,
-rather than a genuine problem on the legitimate other end.)
-As noted in section 4.2,
-it is possible for negotiations to succeed or fail based on which
-end initiates them, and some robustness against that is desirable.
-.P
-We have not yet decided what form the notification should take.
-IKE Initial-Contact is an obvious possibility,
-but has some disadvantages.
-It does not specify which connection has had difficulties.
-Also, the specification [IKE section 4.6.3.3]
-refers to "remote system" and "sending system"
-without clearly specifying just what "system" means;
-in the case of a multi-homed host using multiple forms of identification,
-the question is not trivial.
-Initial-Contact does have the fairly-decisive advantage
-that it is likely to convey the right general
-meaning even to an implementation which does not do things
-exactly the way ours does.
-.P
-A more fundamental difficulty is what form the reliable check takes.
-What is wanted is an "IKE ping",
-verifying that the ISAKMP SA is still intact
-(it being unlikely that IPsec SAs have been lost while the ISAKMP SA has not).
-The lack of such a facility is a serious failing of IKE.
-An acknowledged Notification of some sort would be ideal,
-but there is none at present.
-Some existing implementations are known
-to use the private Notification values 30000 as ping
-and 30002 as ping reply,
-and that seems the most attractive choice at present.
-If it is not recognized, there will probably be no reply,
-and the result will be an unnecessary renegotiation,
-so this needs strict rate limiting.
-(Also, when a new connection is set up,
-it's probably worth determining by experiment whether the other end
-supports IKE ping, and remembering that.)
-.P
-While we think this facility is desirable,
-and is about the best that can be done with the poor tools available,
-we have not gotten very far in implementation and cannot comment
-intelligently about how well it works or interoperates.
-.H
-6. Misc. IKE Issues
-.H
-6.1. Groups 1 and 5
-.P
-We have dropped support for the first Oakley Group (group 1),
-despite it being officially mandatory,
-on the grounds that it is
-grossly too weak to provide enough randomness for 3DES.
-There have been some interoperability problems,
-mostly quite minor:
-ALMOST everyone supports group 2 as well,
-although sometimes it has to be explicitly configured.
-.P
-We also support the quasi-standard group 5 [GROUPS].
-This has not been seriously exercised yet,
-because historically
-we offered group 2 first and almost everyone accepted it.
-We have recently changed to offering group 5 first,
-and no difficulties have been reported.
-.H
-6.2. To PFS Or Not To PFS
-.P
-A persistent small interoperability problem is that
-the presence or absence of PFS (for keys [IKE, section 5.5])
-is neither negotiated nor announced.
-We have it enabled by default,
-and successful interoperation often requires having
-the other end turn it on in their implementation,
-or having the FreeS/WAN end disable it.
-Almost everyone supports it, but it's usually not the default,
-and interoperability is often impossible unless the two ends
-somehow reach prior agreement on it.
-.P
-We do not explicitly support the other flavor of PFS,
-for identities [IKE, section 8],
-and this has caused no interoperability problems.
-.H
-6.3. Debugging Tools, Lack Thereof
-.P
-We find IKE lacking in basic debugging tools.
-Section 5.4, above,
-notes that an IKE ping would be useful for connectivity verification.
-It would also be extremely helpful for determining that UDP/500
-packets get back and forth successfully between the two ends,
-which is often an important first step in debugging.
-.P
-It's also quite common to have IKE negotiate a connection successfully,
-but to have some firewall along the way blocking ESP.
-Users find this mysterious and difficult to diagnose.
-We have no immediate suggestions on what could be done about it.
-.H
-6.4. Terminology, Vagueness Thereof
-.P
-The terminology of IPsec needs work.
-We feel that both the specifications and user-oriented
-documentation would be greatly clarified by concise, intelligible names for
-certain concepts.
-.P
-We semi-consistently use "group" for the set of IPsec SAs which are
-established in one direction
-by a single Quick Mode negotiation and are used together
-to process a packet (e.g., an ESP SA plus an AH SA),
-"connection" for the logical packet path provided
-by a succession of pairs of groups
-(each rekeying providing a new pair, one group in each direction),
-and "keying channel" for the corresponding supervisory path provided
-by a sequence of ISAKMP SAs.
-.P
-We think it's a botch that "PFS" is used to refer to two very different things,
-but we have no specific new terms to suggest, since we only implement
-one kind of PFS and thus can just ignore the other.
-.H
-6.5. A Question of Identity
-.P
-One specification problem deserves note:
-exactly when can an existing phase 1 negotiation
-be re-used for a new phase 2 negotiation,
-as IKE [IKE, section 4] specifies?
-Presumably,
-when it connects the same two "parties"... but exactly what is a "party"?
-.P
-As noted in section 5.4,
-in cases involving multi-homing and multiple identities,
-it's not clear exactly what criteria are used for deciding
-whether the intended far end for a new negotiation is the same one
-as for a previous negotiation.
-Is it by Identification Payload?
-By IP address?
-Or what?
-.P
-We currently use a somewhat-vague notion of "identity",
-basically what gets sent in Identification Payloads,
-for this, and this seems to be successful,
-but we think this needs better specification.
-.H
-6.6. Opportunistic Encryption
-.P
-Further IKE challenges appear in the context of Opportunistic Encryption
-[OE],
-but operational experience with it is too limited as yet for us
-to comment usefully right now.
-.H
-6.7. Authentication and RSA Keys
-.P
-We provide two IKE authentication methods:
-shared secrets ("pre-shared keys")
-and RSA digital signatures.
-(A user-provided add-on package generalizes the latter to limited
-support for certificates;
-we have not worked extensively with it ourselves yet and cannot comment
-on it yet.)
-.P
-Shared secrets, despite their administrative difficulties,
-see considerable use,
-and are also the method of last resort for interoperability problems.
-.P
-For digital signatures,
-we have taken the somewhat unorthodox approach of using "bare" RSA public keys,
-either supplied in configuration files or fetched from DNS,
-rather than getting involved in the complexity of certificates.
-We encode our RSA public keys using the DNS KEY encoding [DNSRSA]
-(aka "RFC 2537", although that RFC is now outdated),
-which has given us no difficulties and which we highly recommend.
-We have seen two difficulties in connection with RSA keys, however.
-.P
-First,
-while a number of IPsec implementations are able to take "bare" RSA public keys,
-each one seems to have its own idea of what format should be used
-for transporting them.
-We've had little success with interoperability here,
-mostly because of key-format issues;
-the implementations generally WILL interoperate successfully if you can
-somehow get an RSA key into them at all, but that's hard.
-X.509 certificates seem to be the lowest (!)
-common denominator for key transfer.
-.P
-Second,
-although the content of RSA public keys has been stable,
-there has been a small but subtle change over time in the content
-of RSA private keys.
-The "internal modulus",
-used to compute the private exponent "d" from the public exponent "e"
-(or vice-versa)
-was originally [RSA] [PKCS1v1] [SCHNEIER] specified to be (p-1)*(q-1),
-where p and q are the two primes.
-However, more recent definitions [PKCS1v2] call it
-"lambda(n)" and define it to be lcm(p-1,\ q-1);
-this appears to be a minor optimization.
-The result is that private keys generated with the new definition
-often fail consistency checks in implementations using the old definition.
-Fortunately, it is seldom necessary to move private keys around.
-Our software now consistently uses the new definition
-(and thus will accept keys generated with either definition),
-but our key generator also has an option to generate old-definition keys,
-for the benefit of users who upgrade their networks incrementally.
-.H
-6.8. Misc. Snags
-.P
-Nonce size is another characteristic that is neither negotiated nor announced
-but that the two ends must somehow be able to agree on.
-Our software accepts anything between 8 and 256, and defaults to 16.
-These numbers were chosen rather arbitrarily,
-but we have seen no interoperability failures here.
-.P
-Nothing in the ISAKMP [ISAKMP] or IKE [IKE] specifications says
-explicitly that a normal Message ID must be non-zero,
-but a zero Message ID in fact causes failures.
-.P
-Similarly, there is nothing in the specs which says that ISAKMP cookies
-must be non-zero, but zero cookies will in fact cause trouble.
-.H
-7. Security Considerations
-.P
-Since this document discusses aspects of building robust and
-interoperable IPsec implementations,
-security considerations permeate it.
-.H
-8. References
-.R AH
-Kent, S., and Atkinson, R.,
-"IP Authentication Header",
-RFC 2402,
-Nov 1998.
-.R CIPHERS
-Pereira, R., and Adams, R.,
-"The ESP CBC-Mode Cipher Algorithms",
-RFC 2451,
-Nov 1998.
-.R CRACK
-Electronic Frontier Foundation,
-"Cracking DES:
-Secrets of Encryption Research, Wiretap Politics and Chip Design",
-O'Reilly 1998,
-ISBN 1-56592-520-3.
-.R DES
-Madson, C., and Doraswamy, N.,
-"The ESP DES-CBC Cipher Algorithm",
-RFC 2405,
-Nov 1998.
-.R DNSRSA
-D. Eastlake 3rd,
-"RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)",
-RFC 3110,
-May 2001.
-.R ESP
-Kent, S., and Atkinson, R.,
-"IP Encapsulating Security Payload (ESP)",
-RFC 2406,
-Nov 1998.
-.R GROUPS
-Kivinen, T., and Kojo, M.,
-"More MODP Diffie-Hellman groups for IKE",
-<draft-ietf-ipsec-ike-modp-groups-04.txt>,
-13 Dec 2001 (work in progress).
-.R IKE
-Harkins, D., and Carrel, D.,
-"The Internet Key Exchange (IKE)",
-RFC 2409, Nov 1998.
-.R IPSEC
-Kent, S., and Atkinson, R.,
-"Security Architecture for the Internet Protocol",
-RFC 2401, Nov 1998.
-.R ISAKMP
-Maughan, D., Schertler, M., Schneider, M., and Turner, J.,
-"Internet Security Association and Key Management Protocol (ISAKMP)",
-RFC 2408, Nov 1998.
-.R OE
-Richardson, M., Redelmeier, D. H., and Spencer, H.,
-"A method for doing opportunistic encryption with IKE",
-<draft-richardson-ipsec-opportunistic-06.txt>,
-21 Feb 2002 (work in progress).
-.R PKCS1v1
-Kaliski, B.,
-"PKCS #1: RSA Encryption, Version 1.5",
-RFC 2313, March 1998.
-.R PKCS1v2
-Kaliski, B., and Staddon, J.,
-"PKCS #1: RSA Cryptography Specifications, Version 2.0",
-RFC 2437, Oct 1998.
-.R PFKEY
-McDonald, D., Metz, C., and Phan, B.,
-"PF_KEY Key Management API, Version 2",
-RFC 2367, July 1998.
-.R REKEY
-Tim Jenkins, "IPsec Re-keying Issues",
-<draft-jenkins-ipsec-rekeying-06.txt>,
-2 May 2000 (draft expired, work no longer in progress).
-.R REPLAY
-Krywaniuk, A.,
-"Using Isakmp Message Ids for Replay Protection",
-<draft-krywaniuk-ipsec-antireplay-00.txt>,
-9 July 2001
-(work in progress).
-.R RSA
-Rivest, R.L., Shamir, A., and Adleman, L.,
-"A Method for Obtaining Digital Signatures and Public-Key
-Cryptosystems",
-Communications of the ACM v21n2, Feb 1978, p. 120.
-.R SCHNEIER
-Bruce Schneier, "Applied Cryptography", 2nd ed.,
-Wiley 1996, ISBN 0-471-11709-9.
-.R SECFAIL
-Karn, P., and Simpson, W.,
-"ICMP Security Failures Messages",
-RFC 2521,
-March 1999.
-.H
-Authors' Addresses
-.P
-.nf
-.ne 8
-Henry Spencer
-SP Systems
-Box 280 Stn. A
-Toronto, Ont. M5W1B2
-Canada
-
-henry@spsystems.net
-416-690-6561
-.ne 8
-.sp 2
-D. Hugh Redelmeier
-Mimosa Systems Inc.
-29 Donino Ave.
-Toronto, Ont. M4N2W6
-Canada
-
-hugh@mimosa.com
-416-482-8253
-.bp
-.H
-Full Copyright Statement
-.P
-Copyright (C) The Internet Society \*c. All Rights
-Reserved.
-
-This document and translations of it may be copied and
-furnished to others, and derivative works that comment on or
-otherwise explain it or assist in its implmentation may be
-prepared, copied, published and distributed, in whole or in
-part, without restriction of any kind, provided that the above
-copyright notice and this paragraph are included on all such
-copies and derivative works.  However, this document itself may
-not be modified in any way, such as by removing the copyright
-notice or references to the Internet Society or other Internet
-organizations, except as needed for the  purpose of developing
-Internet standards in which case the procedures for copyrights
-defined in the Internet Standards process must be followed, or
-as required to translate it into languages other than English.
-
-The limited permissions granted above are perpetual and will
-not be revoked by the Internet Society or its successors or
-assigns.
-
-This document and the information contained herein is provided
-on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET
-ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE
-OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY
-IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A
-PARTICULAR PURPOSE.
diff --git a/doc/draft-spencer-ipsec-ike-implementation.txt b/doc/draft-spencer-ipsec-ike-implementation.txt
deleted file mode 100644
index 145c00ba8..000000000
--- a/doc/draft-spencer-ipsec-ike-implementation.txt
+++ /dev/null
@@ -1,1232 +0,0 @@
-
-
-
-Network Working Group                                      Henry Spencer
-Internet Draft                                                SP Systems
-Expires: 26 Aug 2002                                  D. Hugh Redelmeier
-                                                          Mimosa Systems
-                                                             26 Feb 2002
-
-                       IKE Implementation Issues
-            <draft-spencer-ipsec-ike-implementation-02.txt>
-
-Status of this Memo
-
-   This document is an Internet-Draft and is in full conformance with
-   all provisions of Section 10 of RFC2026.
-
-   (If approved as an Informational RFC...)  This memo provides
-   information for the Internet community.  This memo does not specify
-   an Internet standard of any kind.
-
-   Distribution of this memo is unlimited.
-
-   Internet-Drafts are working documents of the Internet Engineering
-   Task Force (IETF), its areas, and its working groups.  Note that
-   other groups may also distribute working documents as Internet-
-   Drafts.
-
-   Internet-Drafts are draft documents valid for a maximum of six months
-   and may be updated, replaced, or obsoleted by other documents at any
-   time.  It is inappropriate to use Internet-Drafts as reference
-   material or to cite them other than as "work in progress."
-
-   The list of current Internet-Drafts can be accessed at
-   http://www.ietf.org/ietf/1id-abstracts.txt.
-
-   The list of Internet-Draft Shadow Directories can be accessed at
-   http://www.ietf.org/shadow.html.
-
-   This Internet-Draft will expire on 26 Aug 2002.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society 2002.  All Rights Reserved.
-
-
-
-
-
-
-
-
-
-
-Spencer & Redelmeier                                            [Page 1]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-Table of Contents
-
-   1. Introduction ................................................... 3
-   2. Lower-level Background and Notes ............................... 4
-   2.1. Packet Handling .............................................. 4
-   2.2. Ciphers ...................................................... 5
-   2.3. Interfaces ................................................... 5
-   3. IKE Infrastructural Issues ..................................... 5
-   3.1. Continuous Channel ........................................... 5
-   3.2. Retransmission ............................................... 5
-   3.3. Replay Prevention ............................................ 6
-   4. Basic Keying and Rekeying ...................................... 7
-   4.1. When to Create SAs ........................................... 7
-   4.2. When to Rekey ................................................ 8
-   4.3. Choosing an SA ............................................... 9
-   4.4. Why to Rekey ................................................. 9
-   4.5. Rekeying ISAKMP SAs ......................................... 10
-   4.6. Bulk Negotiation ............................................ 10
-   5. Deletions, Teardowns, Crashes ................................. 11
-   5.1. Deletions ................................................... 11
-   5.2. Teardowns and Shutdowns ..................................... 12
-   5.3. Crashes ..................................................... 13
-   5.4. Network Partitions .......................................... 13
-   5.5. Unknown SAs ................................................. 14
-   6. Misc. IKE Issues .............................................. 16
-   6.1. Groups 1 and 5 .............................................. 16
-   6.2. To PFS Or Not To PFS ........................................ 16
-   6.3. Debugging Tools, Lack Thereof ............................... 16
-   6.4. Terminology, Vagueness Thereof .............................. 17
-   6.5. A Question of Identity ...................................... 17
-   6.6. Opportunistic Encryption .................................... 17
-   6.7. Authentication and RSA Keys ................................. 17
-   6.8. Misc. Snags ................................................. 18
-   7. Security Considerations ....................................... 19
-   8. References .................................................... 19
-   Authors' Addresses ............................................... 20
-   Full Copyright Statement ......................................... 21
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Spencer & Redelmeier                                            [Page 2]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-Abstract
-
-   The current IPsec specifications for key exchange and connection
-   management, RFCs 2408 [ISAKMP] and 2409 [IKE], leave many aspects of
-   connection management unspecified, most prominently rekeying
-   practices.  Pending clarifications in future revisions of the
-   specifications, this document sets down some successful experiences,
-   to minimize the extent to which new implementors have to rely on
-   unwritten folklore.
-
-   The Linux FreeS/WAN implementation of IPsec interoperates with almost
-   every other IPsec implementation.  This document describes how the
-   FreeS/WAN project has resolved some of the gaps in the IPsec
-   specifications (and plans to resolve some others), and what
-   difficulties have been encountered, in hopes that this generally-
-   successful experience might be informative to new implementors.
-
-   This is offered as an Informational RFC.
-
-   This -02 revision mainly: discusses ISAKMP SA expiry during IPsec-SA
-   rekeying (4.5), revises the discussion of bidirectional Deletes
-   (5.1), suggests remembering the parameters of successful negotiations
-   for later use (4.2, 5.3), notes an unsuccessful negotiation from the
-   other end as a hint of a possibly broken connection (5.5), and adds
-   sections on network partitions (5.4), authentication methods and the
-   subtleties of RSA public keys (6.7), and miscellaneous
-   interoperability concerns (6.8).
-
-1. Introduction
-
-   The current IPsec specifications for key exchange and connection
-   management, RFCs 2408 [ISAKMP] and 2409 [IKE], leave many aspects of
-   connection management unspecified, most prominently rekeying
-   practices.  This is a cryptic puzzle which each group of implementors
-   has to struggle with, and differences in how the ambiguities and gaps
-   are resolved are potentially a fruitful source of interoperability
-   problems.  We can hope that future revisions of the specifications
-   will clear this up.  Meanwhile, it seems useful to set down some
-   successful experiences, to minimize the extent to which new
-   implementors have to rely on unwritten folklore.
-
-   The Linux FreeS/WAN implementation of IPsec interoperates with almost
-   every other IPsec implementation, and because of its free nature, it
-   also sees some use as a reference implementation by other
-   implementors.  The high degree of interoperability is noteworthy
-   given its organizers' strong minimalist bias, which has caused them
-   to implement only a small subset of the full glory of IPsec.  This
-   document describes how the FreeS/WAN project has resolved some of the
-
-
-
-Spencer & Redelmeier                                            [Page 3]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   gaps in the IPsec specifications (and plans to resolve some others),
-   and what difficulties have been encountered, in hopes that this
-   generally-successful experience might be informative to new
-   implementors.
-
-   One small caution about applicability: this experience may not be
-   relevant to severely resource-constrained implementations.
-   FreeS/WAN's target environment is previous-generation PCs, now
-   available at trivial cost (often, within an organization, at no
-   cost), which have quite impressive CPU power and memory by the
-   standards of only a few years ago.  Some of the approaches discussed
-   here may be inapplicable to implementations with severe external
-   constraints which prevent them from taking advantage of modern
-   hardware technology.
-
-2. Lower-level Background and Notes
-
-2.1. Packet Handling
-
-   FreeS/WAN implements ESP [ESP] and AH [AH] straightforwardly,
-   although AH sees little use among our users.  Our ESP/AH
-   implementation cannot currently handle packets with IP options;
-   somewhat surprisingly, this has caused little difficulty.  We insist
-   on encryption and do not support authentication-only connections, and
-   this has not caused significant difficulty either.
-
-   MTU and fragmentation issues, by contrast, have been a constant
-   headache.  We will not describe the details of our current approach
-   to them, because it still needs work.  One difficulty we have
-   encountered is that many combinations of packet source and packet
-   destination apparently cannot cope with an "interior minimum" in the
-   path MTU, e.g. where an IPsec tunnel intervenes and its headers
-   reduce the MTU for an intermediate link.  This is particularly
-   prevalent when using common PC software to connect to large well-
-   known web sites; we think it is largely due to misconfigured
-   firewalls which do not pass ICMP Fragmentation Required messages.
-   The only solution we have yet found is to lie about the MTU of the
-   tunnel, accepting the (undesirable) fragmentation of the ESP packets
-   for the sake of preserving connectivity.
-
-   We currently zero out the TOS field of ESP packets, rather than
-   copying it from the inner header, on the grounds that it lends itself
-   too well to traffic analysis and covert channels.  We provide an
-   option to restore RFC 2401 [IPSEC] copying behavior, but this appears
-   to see little use.
-
-
-
-
-
-
-Spencer & Redelmeier                                            [Page 4]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-2.2. Ciphers
-
-   We initially implemented both DES [DES] and 3DES [CIPHERS] for both
-   IKE and ESP, but after the Deep Crack effort [CRACK] demonstrated its
-   inherent insecurity, we dropped support for DES.  Somewhat
-   surprisingly, our insistence on 3DES has caused almost no
-   interoperability problems, despite DES being officially mandatory.  A
-   very few other systems either do not support 3DES or support it only
-   as an optional upgrade, which inconveniences a few would-be users.
-   There have also been one or two cases of systems which don't quite
-   seem to know the difference!
-
-   See also section 6.1 for a consequence of our insistence on 3DES.
-
-2.3. Interfaces
-
-   We currently employ PF_KEY version 2 [PFKEY], plus various non-
-   standard extensions, as our interface between keying and ESP.  This
-   has not proven entirely satisfactory.  Our feeling now is that keying
-   issues and policy issues do not really lend themselves to the clean
-   separation that PF_KEY envisions.
-
-3. IKE Infrastructural Issues
-
-   A number of problems in IPsec connection management become easier if
-   some attention is first paid to providing an infrastructure to
-   support solving them.
-
-3.1. Continuous Channel
-
-   FreeS/WAN uses an approximation to the "continuous channel" model, in
-   which ISAKMP SAs are maintained between IKEs so long as any IPsec SAs
-   are open between the two systems.  The resource consumption of this
-   is minor: the only substantial overhead is occasional rekeying.
-   IPsec SA management becomes significantly simpler if there is always
-   a channel for transmission of control messages.  We suggest (although
-   we do not yet fully implement this) that inability to maintain (e.g.,
-   to rekey) this control path should be grounds for tearing down the
-   IPsec SAs as well.
-
-   As a corollary of this, there is one and only one ISAKMP SA
-   maintained between a pair of IKEs (although see sections 5.3 and 6.5
-   for minor complications).
-
-3.2. Retransmission
-
-   The unreliable nature of UDP transmission is a nuisance.  IKE
-   implementations should always be prepared to retransmit the most
-
-
-
-Spencer & Redelmeier                                            [Page 5]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   recent message they sent on an ISAKMP SA, since there is some
-   possibility that the other end did not get it.  This means, in
-   particular, that the system sending the supposedly-last message of an
-   exchange cannot relax and assume that the exchange is complete, at
-   least not until a significant timeout has elapsed.
-
-   Systems must also retain information about the message most recently
-   received in an exchange, so that a duplicate of it can be detected
-   (and possibly interpreted as a NACK for the response).
-
-   The retransmission rules FreeS/WAN follows are: (1) if a reply is
-   expected, retransmit only if it does not appear before a timeout; and
-   (2) if a reply is not expected (last message of the exchange),
-   retransmit only on receiving a retransmission of the previous
-   message.  Notably, in case (1) we do NOT retransmit on receiving a
-   retransmission, which avoids possible congestion problems arising
-   from packet duplication, at the price of slowing response to packet
-   loss.  The timeout for case (1) is 10 seconds for the first retry, 20
-   seconds for the second, and 40 seconds for all subsequent retries
-   (normally only one, except when configuration settings call for
-   persistence and the message is the first message of Main Mode with a
-   new peer).  These retransmission rules have been entirely successful.
-
-   (Michael Thomas of Cisco has pointed out that the retry timeouts
-   should include some random jitter, to de-synchronize hosts which are
-   initially synchronized by, e.g., a power outage.  We already jitter
-   our rekeying times, as noted in section 4.2, but that does not help
-   with initial startup.  We're implementing jittered retries, but
-   cannot yet report on experience with this.)
-
-   There is a deeper problem, of course, when an entire "exchange"
-   consists of a single message, e.g. the ISAKMP Informational Exchange.
-   Then there is no way to decide whether or when a retransmission is
-   warranted at all.  This seems like poor design, to put it mildly (and
-   there is now talk of fixing it).  We have no experience in dealing
-   with this problem at this time, although it is part of the reason why
-   we have delayed implementing Notification messages.
-
-3.3. Replay Prevention
-
-   The unsequenced nature of UDP transmission is also troublesome,
-   because it means that higher levels must consider the possibility of
-   replay attacks.  FreeS/WAN takes the position that systematically
-   eliminating this possibility at a low level is strongly preferable to
-   forcing careful consideration of possible impacts at every step of an
-   exchange.  RFC 2408 [ISAKMP] section 3.1 states that the Message ID
-   of an ISAKMP message must be "unique".  FreeS/WAN interprets this
-   literally, as forbidding duplication of Message IDs within the set of
-
-
-
-Spencer & Redelmeier                                            [Page 6]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   all messages sent via a single ISAKMP SA.
-
-   This requires remembering all Message IDs until the ISAKMP SA is
-   superseded by rekeying, but that is not costly (four bytes per sent
-   or received message), and it ELIMINATES replay attacks from
-   consideration; we believe this investment of resources is well
-   worthwhile.  If the resource consumption becomes excessive--in our
-   experience it has not--the ISAKMP SA can be rekeyed early to collect
-   the garbage.
-
-   There is theoretically an interoperability problem when talking to
-   implementations which interpret "unique" more loosely and may re-use
-   Message IDs, but it has not been encountered in practice.  This
-   approach appears to be completely interoperable.
-
-   The proposal by Andrew Krywaniuk [REPLAY], which advocates turning
-   the Message ID into an anti-replay counter, would achieve the same
-   goal without the minor per-message memory overhead.  This may be
-   preferable, although it means an actual protocol change and more
-   study is needed.
-
-4. Basic Keying and Rekeying
-
-4.1. When to Create SAs
-
-   As Tim Jenkins [REKEY] pointed out, there is a potential race
-   condition in Quick Mode: a fast lightly-loaded Initiator might start
-   using IPsec SAs very shortly after sending QM3 (the third and last
-   message of Quick Mode), while a slow heavily-loaded Responder might
-   not be ready to receive them until after spending a significant
-   amount of time creating its inbound SAs.  The problem is even worse
-   if QM3 gets delayed or lost.
-
-   FreeS/WAN's approach to this is what Jenkins called "Responder Pre-
-   Setup": the Responder creates its inbound IPsec SAs before it sends
-   QM2, so they are always ready and waiting when the Initiator sends
-   QM3 and begins sending traffic.  This approach is simple and
-   reliable, and in our experience it interoperates with everybody.
-   (There is potentially still a problem if FreeS/WAN is the Initiator
-   and the Responder does not use Responder Pre-Setup, but no such
-   problems have been seen.)  The only real weakness of Responder Pre-
-   Setup is the possibility of replay attacks, which we have eliminated
-   by other means (see section 3.3).
-
-   With this approach, the Commit Bit is useless, and we ignore it.  In
-   fact, until quite recently we discarded any IKE message containing
-   it, and this caused surprisingly few interoperability problems;
-   apparently it is not widely used.  We have recently been persuaded
-
-
-
-Spencer & Redelmeier                                            [Page 7]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   that simply ignoring it is preferable; preliminary experience with
-   this indicates that the result is successful interoperation with
-   implementations which set it.
-
-4.2. When to Rekey
-
-   To preserve connectivity for user traffic, rekeying of a connection
-   (that is, creation of new IPsec SAs to supersede the current ones)
-   must begin before its current IPsec SAs expire.  Preferably one end
-   should predictably start rekeying negotiations first, to avoid the
-   extra overhead of two simultaneous negotiations, although either end
-   should be prepared to rekey if the other does not.  There is also a
-   problem with "convoys" of keying negotiations: for example, a "hub"
-   gateway with many IPsec connections can be inundated with rekeying
-   negotiations exactly one connection-expiry time after it reboots, and
-   the massive overload this induces tends to make this situation self-
-   perpetuating, so it recurs regularly.  (Convoys can also evolve
-   gradually from initially-unsynchronized negotiations.)
-
-   FreeS/WAN has the concept of a "rekeying margin", measured in
-   seconds.  If FreeS/WAN was the Initiator for the previous rekeying
-   (or the startup, if none) of the connection, it nominally starts
-   rekeying negotiations at expiry time minus one rekeying margin.  Some
-   random jitter is added to break up convoys: rather than starting
-   rekeying exactly at minus one margin, it starts at a random time
-   between minus one margin and minus two margins.  (The randomness here
-   need not be cryptographic in quality, so long as it varies over time
-   and between hosts.  We use an ordinary PRNG seeded with a few bytes
-   from a cryptographic randomness source.  The seeding mostly just
-   ensures that the PRNG sequence is different for different hosts, even
-   if they start up simultaneously.)
-
-   If FreeS/WAN was the Responder for the previous rekeying/startup, and
-   nothing has been heard from the previous Initiator at expiry time
-   minus one-half the rekeying margin, FreeS/WAN will initiate rekeying
-   negotiations.  No jitter is applied; we now believe that it should be
-   jittered, say between minus one-half margin and minus one-quarter
-   margin.
-
-   Having the Initiator lead the way is an obvious way of deciding who
-   should speak first, since there is already an Initiator/Responder
-   asymmetry in the connection.  Moreover, our experience has been that
-   Initiator lead gives a significantly higher probability of successful
-   negotiation!  The negotiation process itself is asymmetric, because
-   the Initiator must make a few specific proposals which the Responder
-   can only accept or reject, so the Initiator must try to guess where
-   its "acceptable" region (in parameter space) might overlap with the
-   Responder's.  We have seen situations where negotiations would
-
-
-
-Spencer & Redelmeier                                            [Page 8]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   succeed or fail depending on which end initiated them, because one
-   end was making better guesses.  Given an existing connection, we KNOW
-   that the previous Initiator WAS able to initiate a successful
-   negotiation, so it should (if at all possible) take the lead again.
-   Also, the Responder should remember the Initiator's successful
-   proposal, and start from that rather than from his own default
-   proposals if he must take the lead; we don't currently implement this
-   completely but plan to.
-
-   FreeS/WAN defaults the rekeying margin to 9 minutes, although this
-   can be changed by configuration.  There is also a configuration
-   option to alter the permissible range of jitter.  The defaults were
-   chosen somewhat arbitrarily, but they work extremely well and the
-   configuration options are rarely used.
-
-4.3. Choosing an SA
-
-   Once rekeying has occurred, both old and new IPsec SAs for the
-   connection exist, at least momentarily.  FreeS/WAN accepts incoming
-   traffic on either old or new inbound SAs, but sends outgoing traffic
-   only on the new outbound ones.  This approach appears to be
-   significantly more robust than using the old ones until they expire,
-   notably in cases where renegotiation has occurred because something
-   has gone wrong on the other end.  It avoids having to pay meticulous
-   attention to the state of the other end, state which is difficult to
-   learn reliably given the limitations of IKE.
-
-   This approach has interoperated successfully with ALMOST all other
-   implementations.  The only (well-characterized) problem cases have
-   been implementations which rely on receiving a Delete message for the
-   old SAs to tell them to switch over to the new ones.  Since delivery
-   of Delete is unreliable, and support for Delete is optional, this
-   reliance seems like a serious mistake.  This is all the more true
-   because Delete announces that the deletion has already occurred
-   [ISAKMP, section 3.15], not that it is about to occur, so packets
-   already in transit in the other direction could be lost.  Delete
-   should be used for resource cleanup, not for switchover control.
-   (These matters are discussed further in section 5.)
-
-4.4. Why to Rekey
-
-   FreeS/WAN currently implements only time-based expiry (life in
-   seconds), although we are working toward supporting volume-based
-   expiry (life in kilobytes) as well.  The lack of volume-based expiry
-   has not been an interoperability problem so far.
-
-   Volume-based expiry does add some minor complications.  In
-   particular, it makes explicit Delete of now-disused SAs more
-
-
-
-Spencer & Redelmeier                                            [Page 9]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   important, because once an SA stops being used, it might not expire
-   on its own.  We believe this lacks robustness and is generally
-   unwise, especially given the lack of a reliable Delete, and expect to
-   use volume-based expiry only as a supplement to time-based expiry.
-   However, Delete support (see section 5) does seem advisable for use
-   with volume-based expiry.
-
-   We do not believe that volume-based expiry alters the desirability of
-   switching immediately to the new SAs after rekeying.  Rekeying
-   margins are normally a small fraction of the total life of an SA, so
-   we feel there is no great need to "use it all up".
-
-4.5. Rekeying ISAKMP SAs
-
-   The above discussion has focused on rekeying for IPsec SAs, but
-   FreeS/WAN applies the same approaches to rekeying for ISAKMP SAs,
-   with similar success.
-
-   One issue which we have noticed, but not explicitly dealt with, is
-   that difficulties may ensue if an IPsec-SA rekeying negotiation is in
-   progress at the time when the relevant ISAKMP SA gets rekeyed.  The
-   IKE specification [IKE] hints, but does not actually say, that a
-   Quick Mode negotiation should remain on a single ISAKMP SA
-   throughout.
-
-   A reasonable rekeying margin will generally prevent the old ISAKMP SA
-   from actually expiring during a negotiation.  Some attention may be
-   needed to prevent in-progress negotiations from being switched to the
-   new ISAKMP SA.  Any attempt at pre-expiry deletion of the ISAKMP SA
-   must be postponed until after such dangling negotiations are
-   completed, and there should be enough delay between ISAKMP-SA
-   rekeying and a deletion attempt to (more or less) ensure that there
-   are no negotiation-starting packets still in transit from before the
-   rekeying.
-
-   At present, FreeS/WAN does none of this, and we don't KNOW of any
-   resulting trouble.  With normal lifetimes, the problem should be
-   uncommon, and we speculate that an occasional disrupted negotiation
-   simply gets retried.
-
-4.6. Bulk Negotiation
-
-   Quick Mode nominally provides for negotiating possibly-large numbers
-   of similar but unrelated IPsec SAs simultaneously [IKE, section 9].
-   Nobody appears to do this.  FreeS/WAN does not support it, and its
-   absence has caused no problems.
-
-
-
-
-
-Spencer & Redelmeier                                           [Page 10]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-5. Deletions, Teardowns, Crashes
-
-   FreeS/WAN currently ignores all Notifications and Deletes, and never
-   generates them.  This has caused little difficulty in
-   interoperability, which shouldn't be surprising (since Notification
-   and Delete support is officially entirely optional) but does seem to
-   surprise some people.  Nevertheless, we do plan some changes to this
-   approach based on past experience.
-
-5.1. Deletions
-
-   As hinted at above, we plan to implement Delete support, done as
-   follows.  Shortly after rekeying of IPsec SAs, the Responder issues a
-   Delete for its old inbound SAs (but does not actually delete them
-   yet).  The Responder initiates this because the Initiator started
-   using the new SAs on sending QM3, while the Responder started using
-   them only on (or somewhat after) receiving QM3, so there is less
-   chance of old-SA packets still being in transit from the Initiator.
-   The Initiator issues an unsolicited Delete only if it does not hear
-   one from the Responder after a longer delay.
-
-   Either party, on receiving a Delete for one or more of the old
-   outbound SAs of a connection, deletes ALL the connection's SAs, and
-   acknowledges with a Delete for the old inbound SAs.  A Delete for
-   nonexistent SAs (e.g., SAs which have already been expired or
-   deleted) is ignored.  There is no retransmission of unacknowledged
-   Deletes.
-
-   In the normal case, with prompt reliable transmission (except
-   possibly for loss of the Responder's initial Delete) and conforming
-   implementations on both ends, this results in three Deletes being
-   transmitted, resembling the classic three-way handshake.  Loss of a
-   Delete after the first, or multiple losses, will cause the SAs not to
-   be deleted on at least one end.  It appears difficult to do much
-   better without at least a distinction between request and
-   acknowledgement.
-
-   RFC 2409 section 9 "strongly suggests" that there be no response to
-   informational messages such as Deletes, but the only rationale
-   offered is prevention of infinite loops endlessly exchanging "I don't
-   understand you" informationals.  Since Deletes cannot lead to such a
-   loop (and in any case, the nonexistent-SA rule prevents more than one
-   acknowledgement for the same connection), we believe this
-   recommendation is inapplicable here.
-
-   As noted in section 4.3, these Deletes are intended for resource
-   cleanup, not to control switching between SAs.  But we expect that
-   they will improve interoperability with some broken implementations.
-
-
-
-Spencer & Redelmeier                                           [Page 11]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   We believe strongly that connections need to be considered as a
-   whole, rather than treating each SA as an independent entity.  We
-   will issue Deletes only for the full set of inbound SAs of a
-   connection, and will treat a Delete for any outbound SA as equivalent
-   to deletion of all the outbound SAs for the associated connection.
-
-   The above is phrased in terms of IPsec SAs, but essentially the same
-   approach can be applied to ISAKMP SAs (the Deletes for the old ISAKMP
-   SA should be sent via the new one).
-
-5.2. Teardowns and Shutdowns
-
-   When a connection is not intended to be up permanently, there is a
-   need to coordinate teardown, so that both ends are aware that the
-   connection is down.  This is both for recovery of resources, and to
-   avoid routing packets through dangling SAs which can no longer
-   deliver them.
-
-   Connection teardown will use the same bidirectional exchange of
-   Deletes as discussed in section 5.1: a Delete received for current
-   IPsec SAs (not yet obsoleted by rekeying) indicates that the other
-   host wishes to tear down the associated connection.
-
-   A Delete received for a current ISAKMP SA indicates that the other
-   host wishes to tear down not only the ISAKMP SA but also all IPsec
-   SAs currently under the supervision of that ISAKMP SA.  The 5.1
-   bidirectional exchange might seem impossible in this case, since
-   reception of an ISAKMP-SA Delete indicates that the other end will
-   ignore further traffic on that ISAKMP SA.  We suggest using the same
-   tactic discussed in 5.1 for IPsec SAs: the first Delete is sent
-   without actually doing the deletion, and the response to receiving a
-   Delete is to do the deletion and reply with another Delete.  If there
-   is no response to the first Delete, retry a small number of times and
-   then give up and do the deletion; apart from being robust against
-   packet loss, this also maximizes the probability that an
-   implementation which does not do the bidirectional Delete will
-   receive at least one of the Deletes.
-
-   When a host with current connections knows that it is about to shut
-   down, it will issue Deletes for all SAs involved (both IPsec and
-   ISAKMP), advising its peers (as per the meaning of Delete [ISAKMP,
-   section 3.15]) that the SAs have become useless.  It will ignore
-   attempts at rekeying or connection startup thereafter, until it shuts
-   down.
-
-   It would be better to have a Final-Contact notification, analogous to
-   Initial-Contact but indicating that no new negotiations should be
-   attempted until further notice.  Initial-Contact actually could be
-
-
-
-Spencer & Redelmeier                                           [Page 12]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   used for shutdown notification (!), but in networks where connections
-   are intended to exist permanently, it seems likely to provoke
-   unwanted attempts to renegotiate the lost connections.
-
-5.3. Crashes
-
-   Systems sometimes crash.  Coping with the resulting loss of
-   information is easily the most difficult problem we have found in
-   implementing robust IPsec systems.
-
-   When connections are intended to be permanent, it is simple to
-   specify renegotiation on reboot.  With our approach to SA selection
-   (see section 4.3), this handles such cases robustly and well.  We do
-   have to tell users that BOTH hosts should be set this way.  In cases
-   where crashes are synchronized (e.g. by power interruptions), this
-   may result in simultaneous negotiations at reboot.  We currently
-   allow both negotiations to proceed to completion, but our use-newest
-   selection method effectively ignores one connection or the other, and
-   when one of them rekeys, we notice that the new SAs replace those of
-   both old connections, and we then refrain from rekeying the other.
-   (This duplicate detection is desirable in any event, for robustness,
-   to ensure that the system converges on a reasonable state eventually
-   after it is perturbed by difficulties or bugs.)
-
-   When connections are not permanent, the situation is less happy.  One
-   particular situation in which we see problems is when a number of
-   "Road Warrior" hosts occasionally call in to a central server.  The
-   server is normally configured not to initiate such connections, since
-   it does not know when the Road Warrior is available (or what IP
-   address it is using).  Unfortunately, if the server crashes and
-   reboots, any Road Warriors then connected have a problem: they don't
-   know that the server has crashed, so they can't renegotiate, and the
-   server has forgotten both the connections and their (transient) IP
-   addresses, so it cannot renegotiate.
-
-   We believe that the simplest answer to this problem is what John
-   Denker has dubbed "address inertia": the server makes a best-effort
-   attempt to remember (in nonvolatile storage) which connections were
-   active and what the far-end addresses were (and what the successful
-   proposal's parameters were), so that it can attempt renegotiation on
-   reboot.  We have not implemented this yet, but intend to; Denker has
-   implemented it himself, although in a somewhat messy way, and reports
-   excellent results.
-
-5.4. Network Partitions
-
-   A network partition, making the two ends unable to reach each other,
-   has many of the same characteristics as having the other end crash...
-
-
-
-Spencer & Redelmeier                                           [Page 13]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   until the network reconnects.  It is desirable that recovery from
-   this be automatic.
-
-   If the network reconnects before any rekeying attempts or other IKE
-   activities occurred, recovery is fully transparent, because the IKEs
-   have no idea that there was any problem.  (Complaints such as ICMP
-   Host Unreachable messages are unauthenticated and hence cannot be
-   given much weight.)  This fits the general mold of TCP/IP: if nobody
-   wanted to send any traffic, a network outage doesn't matter.
-
-   If IKE activity did occur, the IKE implementation will discover that
-   the other end doesn't seem to be responding.  The preferred response
-   to this depends on the nature of the connection.  If it was intended
-   to be ephemeral (e.g. opportunistic encryption [OE]), closing it down
-   after a few retries is reasonable.  If the other end is expected to
-   sometimes drop the connection without warning, it may not be
-   desirable to retry at all.  (We support both these forms of
-   configurability, and indeed we also have a configuration option to
-   suppress rekeying entirely on one end.)
-
-   If the connection was intended to be permanent, however, then
-   persistent attempts to re-establish it are appropriate.  Some degree
-   of backoff is appropriate here, so that retries get less frequent as
-   the outage gets prolonged.  Backoff should be limited, so that re-
-   established connectivity is not followed by a long delay before a
-   retry.  Finally, after many retries (say 24 hours' worth), it may be
-   preferable to just declare the connection down and rely on manual
-   intervention to re-establish it, should this be desirable.  We do not
-   yet fully support all this.
-
-5.5. Unknown SAs
-
-   A more complete solution to crashes would be for an IPsec host to
-   note the arrival of ESP packets on an unknown IPsec SA, and report it
-   somehow to the other host, which can then decide to renegotiate.
-   This arguably might be preferable in any case--if the non-rebooted
-   host has no traffic to send, it does not care whether the connection
-   is intact--but delays and packet loss will be reduced if the
-   connection is renegotiated BEFORE there is traffic for it.  So
-   unknown-SA detection is best reserved as a fallback method, with
-   address inertia used to deal with most such cases.
-
-   A difficulty with unknown-SA detection is, just HOW should the other
-   host be notified?  IKE provides no good way to do the notification:
-   Notification payloads (e.g., Initial-Contact) are unauthenticated
-   unless they are sent under protection of an ISAKMP SA.  A "Security
-   Failures - Bad SPI" ICMP message [SECFAIL] is an interesting
-   alternative, but has the disadvantage of likewise being
-
-
-
-Spencer & Redelmeier                                           [Page 14]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   unauthenticated.  It's fundamentally unlikely that there is a simple
-   solution to this, given that almost any way of arranging or checking
-   authentication for such a notification is costly.
-
-   We think the best answer to this is a two-step approach.  An
-   unauthenticated Initial-Contact or Security Failures - Bad SPI cannot
-   be taken as a reliable report of a problem, but can be taken as a
-   hint that a problem MIGHT exist.  Then there needs to be some
-   reliable way of checking such hints, subject to rate limiting since
-   the checks are likely to be costly (and checking the same connection
-   repeatedly at short intervals is unlikely to be worthwhile anyway).
-   So the rebooted host sends the notification, and the non-rebooted
-   host--which still thinks it has a connection--checks whether the
-   connection still works, and renegotiates if not.
-
-   Also, if an IPsec host which believes it has a connection to another
-   host sees an unsuccessful attempt by that host to negotiate a new
-   one, that is also a hint of possible problems, justifying a check and
-   possible renegotiation.  ("Unsuccessful" here means a negotiation
-   failure due to lack of a satisfactory proposal.  A failure due to
-   authentication failure suggests a denial-of-service attack by a third
-   party, rather than a genuine problem on the legitimate other end.)
-   As noted in section 4.2, it is possible for negotiations to succeed
-   or fail based on which end initiates them, and some robustness
-   against that is desirable.
-
-   We have not yet decided what form the notification should take.  IKE
-   Initial-Contact is an obvious possibility, but has some
-   disadvantages.  It does not specify which connection has had
-   difficulties.  Also, the specification [IKE section 4.6.3.3] refers
-   to "remote system" and "sending system" without clearly specifying
-   just what "system" means; in the case of a multi-homed host using
-   multiple forms of identification, the question is not trivial.
-   Initial-Contact does have the fairly-decisive advantage that it is
-   likely to convey the right general meaning even to an implementation
-   which does not do things exactly the way ours does.
-
-   A more fundamental difficulty is what form the reliable check takes.
-   What is wanted is an "IKE ping", verifying that the ISAKMP SA is
-   still intact (it being unlikely that IPsec SAs have been lost while
-   the ISAKMP SA has not).  The lack of such a facility is a serious
-   failing of IKE.  An acknowledged Notification of some sort would be
-   ideal, but there is none at present.  Some existing implementations
-   are known to use the private Notification values 30000 as ping and
-   30002 as ping reply, and that seems the most attractive choice at
-   present.  If it is not recognized, there will probably be no reply,
-   and the result will be an unnecessary renegotiation, so this needs
-   strict rate limiting.  (Also, when a new connection is set up, it's
-
-
-
-Spencer & Redelmeier                                           [Page 15]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   probably worth determining by experiment whether the other end
-   supports IKE ping, and remembering that.)
-
-   While we think this facility is desirable, and is about the best that
-   can be done with the poor tools available, we have not gotten very
-   far in implementation and cannot comment intelligently about how well
-   it works or interoperates.
-
-6. Misc. IKE Issues
-
-6.1. Groups 1 and 5
-
-   We have dropped support for the first Oakley Group (group 1), despite
-   it being officially mandatory, on the grounds that it is grossly too
-   weak to provide enough randomness for 3DES.  There have been some
-   interoperability problems, mostly quite minor: ALMOST everyone
-   supports group 2 as well, although sometimes it has to be explicitly
-   configured.
-
-   We also support the quasi-standard group 5 [GROUPS].  This has not
-   been seriously exercised yet, because historically we offered group 2
-   first and almost everyone accepted it.  We have recently changed to
-   offering group 5 first, and no difficulties have been reported.
-
-6.2. To PFS Or Not To PFS
-
-   A persistent small interoperability problem is that the presence or
-   absence of PFS (for keys [IKE, section 5.5]) is neither negotiated
-   nor announced.  We have it enabled by default, and successful
-   interoperation often requires having the other end turn it on in
-   their implementation, or having the FreeS/WAN end disable it.  Almost
-   everyone supports it, but it's usually not the default, and
-   interoperability is often impossible unless the two ends somehow
-   reach prior agreement on it.
-
-   We do not explicitly support the other flavor of PFS, for identities
-   [IKE, section 8], and this has caused no interoperability problems.
-
-6.3. Debugging Tools, Lack Thereof
-
-   We find IKE lacking in basic debugging tools.  Section 5.4, above,
-   notes that an IKE ping would be useful for connectivity verification.
-   It would also be extremely helpful for determining that UDP/500
-   packets get back and forth successfully between the two ends, which
-   is often an important first step in debugging.
-
-   It's also quite common to have IKE negotiate a connection
-   successfully, but to have some firewall along the way blocking ESP.
-
-
-
-Spencer & Redelmeier                                           [Page 16]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   Users find this mysterious and difficult to diagnose.  We have no
-   immediate suggestions on what could be done about it.
-
-6.4. Terminology, Vagueness Thereof
-
-   The terminology of IPsec needs work.  We feel that both the
-   specifications and user-oriented documentation would be greatly
-   clarified by concise, intelligible names for certain concepts.
-
-   We semi-consistently use "group" for the set of IPsec SAs which are
-   established in one direction by a single Quick Mode negotiation and
-   are used together to process a packet (e.g., an ESP SA plus an AH
-   SA), "connection" for the logical packet path provided by a
-   succession of pairs of groups (each rekeying providing a new pair,
-   one group in each direction), and "keying channel" for the
-   corresponding supervisory path provided by a sequence of ISAKMP SAs.
-
-   We think it's a botch that "PFS" is used to refer to two very
-   different things, but we have no specific new terms to suggest, since
-   we only implement one kind of PFS and thus can just ignore the other.
-
-6.5. A Question of Identity
-
-   One specification problem deserves note: exactly when can an existing
-   phase 1 negotiation be re-used for a new phase 2 negotiation, as IKE
-   [IKE, section 4] specifies?  Presumably, when it connects the same
-   two "parties"... but exactly what is a "party"?
-
-   As noted in section 5.4, in cases involving multi-homing and multiple
-   identities, it's not clear exactly what criteria are used for
-   deciding whether the intended far end for a new negotiation is the
-   same one as for a previous negotiation.  Is it by Identification
-   Payload?  By IP address?  Or what?
-
-   We currently use a somewhat-vague notion of "identity", basically
-   what gets sent in Identification Payloads, for this, and this seems
-   to be successful, but we think this needs better specification.
-
-6.6. Opportunistic Encryption
-
-   Further IKE challenges appear in the context of Opportunistic
-   Encryption [OE], but operational experience with it is too limited as
-   yet for us to comment usefully right now.
-
-6.7. Authentication and RSA Keys
-
-   We provide two IKE authentication methods: shared secrets ("pre-
-   shared keys") and RSA digital signatures.  (A user-provided add-on
-
-
-
-Spencer & Redelmeier                                           [Page 17]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   package generalizes the latter to limited support for certificates;
-   we have not worked extensively with it ourselves yet and cannot
-   comment on it yet.)
-
-   Shared secrets, despite their administrative difficulties, see
-   considerable use, and are also the method of last resort for
-   interoperability problems.
-
-   For digital signatures, we have taken the somewhat unorthodox
-   approach of using "bare" RSA public keys, either supplied in
-   configuration files or fetched from DNS, rather than getting involved
-   in the complexity of certificates.  We encode our RSA public keys
-   using the DNS KEY encoding [DNSRSA] (aka "RFC 2537", although that
-   RFC is now outdated), which has given us no difficulties and which we
-   highly recommend.  We have seen two difficulties in connection with
-   RSA keys, however.
-
-   First, while a number of IPsec implementations are able to take
-   "bare" RSA public keys, each one seems to have its own idea of what
-   format should be used for transporting them.  We've had little
-   success with interoperability here, mostly because of key-format
-   issues; the implementations generally WILL interoperate successfully
-   if you can somehow get an RSA key into them at all, but that's hard.
-   X.509 certificates seem to be the lowest (!)  common denominator for
-   key transfer.
-
-   Second, although the content of RSA public keys has been stable,
-   there has been a small but subtle change over time in the content of
-   RSA private keys.  The "internal modulus", used to compute the
-   private exponent "d" from the public exponent "e" (or vice-versa) was
-   originally [RSA] [PKCS1v1] [SCHNEIER] specified to be (p-1)*(q-1),
-   where p and q are the two primes.  However, more recent definitions
-   [PKCS1v2] call it "lambda(n)" and define it to be lcm(p-1, q-1); this
-   appears to be a minor optimization.  The result is that private keys
-   generated with the new definition often fail consistency checks in
-   implementations using the old definition.  Fortunately, it is seldom
-   necessary to move private keys around.  Our software now consistently
-   uses the new definition (and thus will accept keys generated with
-   either definition), but our key generator also has an option to
-   generate old-definition keys, for the benefit of users who upgrade
-   their networks incrementally.
-
-6.8. Misc. Snags
-
-   Nonce size is another characteristic that is neither negotiated nor
-   announced but that the two ends must somehow be able to agree on.
-   Our software accepts anything between 8 and 256, and defaults to 16.
-   These numbers were chosen rather arbitrarily, but we have seen no
-
-
-
-Spencer & Redelmeier                                           [Page 18]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   interoperability failures here.
-
-   Nothing in the ISAKMP [ISAKMP] or IKE [IKE] specifications says
-   explicitly that a normal Message ID must be non-zero, but a zero
-   Message ID in fact causes failures.
-
-   Similarly, there is nothing in the specs which says that ISAKMP
-   cookies must be non-zero, but zero cookies will in fact cause
-   trouble.
-
-7. Security Considerations
-
-   Since this document discusses aspects of building robust and
-   interoperable IPsec implementations, security considerations permeate
-   it.
-
-8. References
-
-   [AH]       Kent, S., and Atkinson, R., "IP Authentication Header",
-              RFC 2402, Nov 1998.
-
-   [CIPHERS]  Pereira, R., and Adams, R., "The ESP CBC-Mode Cipher
-              Algorithms", RFC 2451, Nov 1998.
-
-   [CRACK]    Electronic Frontier Foundation, "Cracking DES: Secrets of
-              Encryption Research, Wiretap Politics and Chip Design",
-              O'Reilly 1998, ISBN 1-56592-520-3.
-
-   [DES]      Madson, C., and Doraswamy, N., "The ESP DES-CBC Cipher
-              Algorithm", RFC 2405, Nov 1998.
-
-   [DNSRSA]   D. Eastlake 3rd, "RSA/SHA-1 SIGs and RSA KEYs in the
-              Domain Name System (DNS)", RFC 3110, May 2001.
-
-   [ESP]      Kent, S., and Atkinson, R., "IP Encapsulating Security
-              Payload (ESP)", RFC 2406, Nov 1998.
-
-   [GROUPS]   Kivinen, T., and Kojo, M., "More MODP Diffie-Hellman
-              groups for IKE", <draft-ietf-ipsec-ike-modp-
-              groups-04.txt>, 13 Dec 2001 (work in progress).
-
-   [IKE]      Harkins, D., and Carrel, D., "The Internet Key Exchange
-              (IKE)", RFC 2409, Nov 1998.
-
-   [IPSEC]    Kent, S., and Atkinson, R., "Security Architecture for the
-              Internet Protocol", RFC 2401, Nov 1998.
-
-
-
-
-
-Spencer & Redelmeier                                           [Page 19]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   [ISAKMP]   Maughan, D., Schertler, M., Schneider, M., and Turner, J.,
-              "Internet Security Association and Key Management Protocol
-              (ISAKMP)", RFC 2408, Nov 1998.
-
-   [OE]       Richardson, M., Redelmeier, D. H., and Spencer, H., "A
-              method for doing opportunistic encryption with IKE",
-              <draft-richardson-ipsec-opportunistic-06.txt>, 21 Feb 2002
-              (work in progress).
-
-   [PKCS1v1]  Kaliski, B., "PKCS #1: RSA Encryption, Version 1.5", RFC
-              2313, March 1998.
-
-   [PKCS1v2]  Kaliski, B., and Staddon, J., "PKCS #1: RSA Cryptography
-              Specifications, Version 2.0", RFC 2437, Oct 1998.
-
-   [PFKEY]    McDonald, D., Metz, C., and Phan, B., "PF_KEY Key
-              Management API, Version 2", RFC 2367, July 1998.
-
-   [REKEY]    Tim Jenkins, "IPsec Re-keying Issues", <draft-jenkins-
-              ipsec-rekeying-06.txt>, 2 May 2000 (draft expired, work no
-              longer in progress).
-
-   [REPLAY]   Krywaniuk, A., "Using Isakmp Message Ids for Replay
-              Protection", <draft-krywaniuk-ipsec-antireplay-00.txt>, 9
-              July 2001 (work in progress).
-
-   [RSA]      Rivest, R.L., Shamir, A., and Adleman, L., "A Method for
-              Obtaining Digital Signatures and Public-Key
-              Cryptosystems", Communications of the ACM v21n2, Feb 1978,
-              p. 120.
-
-   [SCHNEIER] Bruce Schneier, "Applied Cryptography", 2nd ed., Wiley
-              1996, ISBN 0-471-11709-9.
-
-   [SECFAIL]  Karn, P., and Simpson, W., "ICMP Security Failures
-              Messages", RFC 2521, March 1999.
-
-Authors' Addresses
-
-   Henry Spencer
-   SP Systems
-   Box 280 Stn. A
-   Toronto, Ont. M5W1B2
-   Canada
-
-   henry@spsystems.net
-   416-690-6561
-
-
-
-
-Spencer & Redelmeier                                           [Page 20]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-   D. Hugh Redelmeier
-   Mimosa Systems Inc.
-   29 Donino Ave.
-   Toronto, Ont. M4N2W6
-   Canada
-
-   hugh@mimosa.com
-   416-482-8253
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Spencer & Redelmeier                                           [Page 21]
-
-Internet Draft          IKE Implementation Issues            26 Feb 2002
-
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society 2002. All Rights Reserved.
-
-   This document and translations of it may be copied and furnished to
-   others, and derivative works that comment on or otherwise explain it
-   or assist in its implmentation may be prepared, copied, published and
-   distributed, in whole or in part, without restriction of any kind,
-   provided that the above copyright notice and this paragraph are
-   included on all such copies and derivative works.  However, this
-   document itself may not be modified in any way, such as by removing
-   the copyright notice or references to the Internet Society or other
-   Internet organizations, except as needed for the  purpose of
-   developing Internet standards in which case the procedures for
-   copyrights defined in the Internet Standards process must be
-   followed, or as required to translate it into languages other than
-   English.
-
-   The limited permissions granted above are perpetual and will not be
-   revoked by the Internet Society or its successors or assigns.
-
-   This document and the information contained herein is provided on an
-   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
-   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
-   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
-   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Spencer & Redelmeier                                           [Page 22]
-
diff --git a/doc/examples b/doc/examples
deleted file mode 100644
index 315049b04..000000000
--- a/doc/examples
+++ /dev/null
@@ -1,182 +0,0 @@
-# sample connections
-# This file is RCSID $Id: examples,v 1.1 2004/03/15 20:35:21 as Exp $
-
-
-
-# basic configuration
-config setup
-	# THIS SETTING MUST BE CORRECT or almost nothing will work.
-	interfaces="ipsec0=eth1 ipsec1=ppp0"
-	# Debug-logging controls:  "none" for (almost) none, "all" for lots.
-	klipsdebug=none
-	plutodebug=none
-	# Manual connections to be started at startup.
-	manualstart="test1 test2"
-	# Auto connections to be loaded into Pluto at startup.
-	plutoload="samplehth samplefire"
-	# Auto connections to be started at startup.
-	plutostart=samplefire
-
-
-
-# defaults for subsequent connection descriptions
-conn %default
-	# How persistent to be in (re)keying negotiations (0 means very).
-	keyingtries=0
-	# Parameters for manual-keying testing (DON'T USE OPERATIONALLY).
-	spi=0x200
-	esp=3des-md5-96
-	espenckey=0x01234567_89abcdef_02468ace_13579bdf_12345678_9abcdef0
-	espauthkey=0x12345678_9abcdef0_2468ace0_13579bdf
-	# key lifetime (before automatic rekeying)
-	keylife=8h
-
-
-
-# sample connection
-conn sample
-	# Left security gateway and subnet behind it.
-	left=10.0.0.1
-	leftsubnet=172.16.0.0/24
-	# Right security gateway and subnet behind it.
-	right=10.12.12.1
-	rightsubnet=192.168.0.0/24
-	# Authorize this connection, but don't actually start it, at startup.
-	auto=add
-
-# sample tunnel (manually or automatically keyed)
-# Here we just use ESP for both encryption and authentication, which is
-# the simplest and often the best method.
-conn sample
-	# left security gateway (public-network address)
-	left=10.0.0.1
-	# next hop to reach right
-	leftnexthop=10.44.55.66
-	# subnet behind left (omit if left end of the tunnel is just the s.g.)
-	leftsubnet=172.16.0.0/24
-	# right s.g., subnet behind it, and next hop to reach left
-	right=10.12.12.1
-	rightnexthop=10.88.77.66
-	rightsubnet=192.168.0.0/24
-	# (manual) SPI number
-	spi=0x200
-	# (manual) encryption/authentication algorithm and parameters to it
-	esp=3des-md5-96
-	espenckey=[192 bits]
-	espauthkey=[128 bits]
-
-# In the remaining examples, deviations from the sample-tunnel configuration
-# are marked with ###.
-
-# sample host-to-host tunnel (no subnets)
-# Here we assume (for purposes of illustration) that the hosts talk directly
-# to each other, so we don't need next-hop settings.
-conn samplehth
-	### left host (public-network address)
-	left=10.0.0.1
-	### next hop to reach right
-	leftnexthop=
-	### right host
-	right=10.12.12.1
-	### next hop to reach left
-	rightnexthop=
-	### (manual) SPI number
-	spi=0x300
-	# (manual) encryption/authentication algorithm and parameters to it
-	esp=3des-md5-96
-	espenckey=[192 bits]
-	espauthkey=[128 bits]
-
-# sample hybrid tunnel, with a host on one end and a subnet (behind a
-# security gateway) on the other
-# This case is also sometimes called "road warrior".
-conn samplehyb
-	### left host (public-network address)
-	left=10.0.0.1
-	# next hop to reach right
-	leftnexthop=10.44.55.66
-	# subnet behind left
-	leftsubnet=172.16.0.0/24
-	### right host, and next hop to reach left
-	right=10.12.12.1
-	rightnexthop=10.88.77.66
-	### (manual) SPI number
-	spi=0x400
-	# (manual) encryption/authentication algorithm and parameters to it
-	esp=3des-md5-96
-	espenckey=[192 bits]
-	espauthkey=[128 bits]
-
-# sample firewall-penetrating tunnel
-# Here we assume that firewalling is being done on the left side.
-conn samplefire
-	# left security gateway (public-network address)
-	left=10.0.0.1
-	# next hop to reach right
-	leftnexthop=10.44.55.66
-	# subnet behind left (omit if left end of the tunnel is just the s.g.)
-	leftsubnet=172.16.0.0/24
-	### left is firewalling for its subnet
-	leftfirewall=yes
-	# right s.g., subnet behind it, and next hop to reach left
-	right=10.12.12.1
-	rightnexthop=10.88.77.66
-	rightsubnet=192.168.0.0/24
-	### (manual) SPI number
-	spi=0x500
-	# (manual) encryption/authentication algorithm and parameters to it
-	esp=3des-md5-96
-	espenckey=[192 bits]
-	espauthkey=[128 bits]
-
-# sample transport-mode connection (which can only be host-to-host)
-# Here we use the whole nine yards, with encryption done by ESP and
-# authentication by AH; this perhaps is slightly preferable for transport
-# mode, where the IP headers are exposed.
-conn sampletm
-	### transport mode rather than tunnel
-	type=transport
-	### left host (public-network address)
-	left=10.0.0.1
-	# next hop to reach right
-	leftnexthop=10.44.55.66
-	### right host, and next hop to reach left
-	right=10.12.12.1
-	rightnexthop=10.88.77.66
-	### (manual) SPI number
-	spi=0x600
-	### (manual) encryption algorithm and parameters to it
-	esp=3des
-	espenckey=[192 bits]
-	### (manual) authentication algorithm and parameters to it
-	ah=hmac-md5
-	ahkey=[128 bits]
-	### (auto) authentication control
-	auth=ah
-
-# sample description with keys split out into a separate section
-# Normally the key section would go in a separate file, with tighter
-# permissions set on it.
-conn samplesep
-	# left security gateway (public-network address)
-	left=10.0.0.1
-	# next hop to reach right
-	leftnexthop=10.44.55.66
-	# subnet behind left (omit if left end of the tunnel is just the s.g.)
-	leftsubnet=172.16.0.0/24
-	# right s.g., subnet behind it, and next hop to reach left
-	right=10.12.12.1
-	rightnexthop=10.88.77.66
-	rightsubnet=192.168.0.0/24
-	### (manual) SPI number
-	spi=0x700
-	# (manual) encryption/authentication algorithm and parameters to it
-	esp=3des-md5-96
-	also=samplesep-keys
-
-# keys for the previous section
-# Normally this would go in a separate file, picked up using an include line,
-# to allow keeping the keys confidential.
-conn samplesep-keys
-	espenckey=[192 bits]
-	espauthkey=[128 bits]
diff --git a/doc/faq.html b/doc/faq.html
deleted file mode 100644
index b0fed502e..000000000
--- a/doc/faq.html
+++ /dev/null
@@ -1,2339 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="policygroups.html">Previous</A>
-<A HREF="manpages.html">Next</A>
-<HR>
-<H1><A NAME="5">FreeS/WAN FAQ</A></H1>
-<P>This is a collection of questions and answers, mostly taken from the
- FreeS/WAN<A href="mail.html"> mailing list</A>. See the project<A href="http://www.freeswan.org/">
- web site</A> for more information. All the FreeS/WAN documentation is
- online there.</P>
-<P>Contributions to the FAQ are welcome. Please send them to the project<A
-href="mail.html"> mailing list</A>.</P>
-<HR>
-<H2><A name="questions">Index of FAQ questions</A></H2>
-<UL>
-<LI><A href="#whatzit">What is FreeS/WAN?</A></LI>
-<LI><A href="#problems">How do I report a problem or seek help?</A></LI>
-<LI><A href="#generic">Can I get ...</A>
-<UL>
-<LI><A href="#lemme_out">... an off-the-shelf system that includes
- FreeS/WAN?</A></LI>
-<LI><A href="#contractor">... contractors or staff who know FreeS/WAN?</A>
-</LI>
-<LI><A href="#commercial">... commercial support?</A></LI>
-</UL>
-</LI>
-<LI><A href="#release">Release questions</A>
-<UL>
-<LI><A href="#rel.current">What is the current release?</A></LI>
-<LI><A href="#relwhen">When is the next release?</A></LI>
-<LI><A href="#rel.bugs">Are there known bugs in the current release?</A></LI>
-</UL>
-</LI>
-<LI><A href="mod_cons">Modifications and contributions</A>
-<UL>
-<LI><A href="#modify.faq">Can I modify FreeS/WAN to ...?</A></LI>
-<LI><A href="#contrib.faq">Can I contribute to the project?</A></LI>
-<LI><A href="#ddoc.faq">Is there detailed design documentation?</A></LI>
-</UL>
-</LI>
-<LI><A href="#interact">Will FreeS/WAN work in my environment?</A>
-<UL>
-<LI><A href="#interop.faq">Can FreeS/WAN talk to ... ?</A></LI>
-<LI><A href="#old_to_new">Can different FreeS/WAN versions talk to each
- other?</A></LI>
-<LI><A href="#faq.bandwidth">Is there a limit on throughput?</A></LI>
-<LI><A href="#faq.number">Is there a limit on number of connections?</A></LI>
-<LI><A href="#faq.speed">Is a ... fast enough to handle FreeS/WAN with
- my loads?</A></LI>
-</UL>
-</LI>
-<LI><A href="#work_on">Will FreeS/WAN work on ...</A>
-<UL>
-<LI><A href="#versions">... my version of Linux?</A></LI>
-<LI><A href="#nonIntel.faq">... non-Intel CPUs?</A></LI>
-<LI><A href="#multi.faq">... multiprocessors?</A></LI>
-<LI><A href="#k.old">... an older kernel?</A></LI>
-<LI><A href="#k.versions">... the latest kernel version?</A></LI>
-<LI><A href="#interface.faq">... unusual network hardware?</A></LI>
-<LI><A href="#vlan">... a VLAN (802.1q) network?</A></LI>
-</UL>
-</LI>
-<LI><A href="#features.faq">Does FreeS/WAN support ...</A>
-<UL>
-<LI><A href="#VPN.faq">... site-to-site VPN applications</A></LI>
-<LI><A href="#warrior.faq">... remote users connecting to a LAN</A></LI>
-<LI><A href="#road.shared.possible">... remote users using shared secret
- authentication?</A></LI>
-<LI><A href="#wireless.faq">... wireless networks</A></LI>
-<LI><A href="#PKIcert">... X.509 or other PKI certificates?</A></LI>
-<LI><A href="#Radius">... user authentication (Radius, SecureID, Smart
- Card ...)?</A></LI>
-<LI><A href="#NATtraversal">... NAT traversal</A></LI>
-<LI><A href="#virtID">... assigning a &quot;virtual identity&quot; to a remote
- system?</A></LI>
-<LI><A href="#noDES.faq">... single DES encryption?</A></LI>
-<LI><A href="#AES.faq">... AES encryption?</A></LI>
-<LI><A href="#other.cipher">... other encryption algorithms?</A></LI>
-</UL>
-</LI>
-<LI><A href="#canI">Can I ...</A>
-<UL>
-<LI><A href="#policy.preconfig">...use policy groups along with
- explicitly configured connections?</A></LI>
-<LI><A href="#policy.off">...turn off policy groups?</A></LI>
-
-<!--
-      <li><a href="#policy.otherinterface">...use policy groups
-      on an interface other than <VAR>%defaultroute</VAR>?</a></li>
--->
-<LI><A href="#reload">... reload connection info without restarting?</A></LI>
-<LI><A href="#masq.faq">... use several masqueraded subnets?</A></LI>
-<LI><A href="#dup_route">... use subnets masqueraded to the same
- addresses?</A></LI>
-<LI><A href="#road.masq">... assign a road warrior an address on my net
- (a virtual identity)?</A></LI>
-<LI><A href="#road.many">... support many road warriors with one
- gateway?</A></LI>
-<LI><A href="#road.PSK">... have many road warriors using shared secret
- authentication?</A></LI>
-<LI><A href="#QoS">... use Quality of Service routing with FreeS/WAN?</A>
-</LI>
-<LI><A href="#deadtunnel">... recognise dead tunnels and shut them down?</A>
-</LI>
-<LI><A href="#demanddial">... build IPsec tunnels over a demand-dialed
- link?</A></LI>
-<LI><A href="#GRE">... build GRE, L2TP or PPTP tunnels over IPsec?</A></LI>
-<LI><A href="#NetBIOS">... use Network Neighborhood (Samba, NetBIOS)
- over IPsec?</A></LI>
-</UL>
-</LI>
-<LI><A href="#setup.faq">Life's little mysteries</A>
-<UL>
-<LI><A href="#cantping">I cannot ping ....</A></LI>
-<LI><A href="#forever">It takes forever to ...</A></LI>
-<LI><A href="#route">I send packets to the tunnel with route(8) but they
- vanish</A></LI>
-<LI><A href="#down_route">When a tunnel goes down, packets vanish</A></LI>
-<LI><A href="#firewall_ate">The firewall ate my packets!</A></LI>
-<LI><A href="#dropconn">Dropped connections</A></LI>
-<LI><A href="#defaultroutegone">Disappearing %defaultroute</A></LI>
-<LI><A href="#tcpdump.faq">TCPdump on the gateway shows strange things</A>
-</LI>
-<LI><A href="#no_trace">Traceroute does not show anything between the
- gateways</A></LI>
-</UL>
-</LI>
-<LI><A href="#man4debug">Testing in stages (or .... works but ...
- doesn't)</A>
-<UL>
-<LI><A href="#nomanual">Manually keyed connections don't work</A></LI>
-<LI><A href="#spi_error">One manual connection works, but second one
- fails</A></LI>
-<LI><A href="#man_no_auto">Manual connections work, but automatic keying
- doesn't</A></LI>
-<LI><A href="#nocomp">IPsec works, but connections using compression
- fail</A></LI>
-<LI><A href="#pmtu.broken">Small packets work, but large transfers fail</A>
-</LI>
-<LI><A href="#subsub">Subnet-to-subnet works, but tests from the
- gateways don't</A></LI>
-</UL>
-</LI>
-<LI><A href="#compile.faq">Compilation problems</A>
-<UL>
-<LI><A href="#gmp.h_missing">gmp.h: No such file or directory</A></LI>
-<LI><A href="#noVM">... virtual memory exhausted</A></LI>
-</UL>
-</LI>
-<LI><A href="#error">Interpreting error messages</A>
-<UL>
-<LI><A href="#route-client">route-client (or host) exited with status 7</A>
-</LI>
-<LI><A href="#unreachable">SIOCADDRT:Network is unreachable</A></LI>
-<LI><A href="#modprobe">ipsec_setup: modprobe: Can't locate moduleipsec</A>
-</LI>
-<LI><A href="#noKLIPS">ipsec_setup: Fatal error, kernel appears to lack
- KLIPS</A></LI>
-<LI><A href="#noDNS">ipsec_setup: ... failure to fetch key for ... from
- DNS</A></LI>
-<LI><A href="#dup_address">ipsec_setup: ... interfaces ... and ... share
- address ...</A></LI>
-<LI><A href="#kflags">ipsec_setup: Cannot adjust kernel flags</A></LI>
-<LI><A href="#message_num">Message numbers (MI3, QR1, et cetera) in
- Pluto messages</A></LI>
-<LI><A href="#conn_name">Connection names in Pluto error messages</A></LI>
-<LI><A href="#cantorient">Pluto: ... can't orient connection</A></LI>
-<LI><A href="#no.interface">... we have no ipsecN interface for either
- end of this connection</A></LI>
-<LI><A href="#noconn">Pluto: ... no connection is known</A></LI>
-<LI><A href="#nosuit">Pluto: ... no suitable connection ...</A></LI>
-<LI><A href="#noconn.auth">Pluto: ... no connection has been authorized</A>
-</LI>
-<LI><A href="#noDESsupport">Pluto: ... OAKLEY_DES_CBC is not supported.</A>
-</LI>
-<LI><A href="#notransform">Pluto: ... no acceptable transform</A></LI>
-<LI><A href="#rsasigkey">rsasigkey dumps core</A></LI>
-<LI><A href="#sig4">!Pluto failure!: ... exited with ... signal 4</A></LI>
-<LI><A href="#econnrefused">ECONNREFUSED error message</A></LI>
-<LI><A href="#no_eroute">klips_debug: ... no eroute!</A></LI>
-<LI><A href="#SAused">... trouble writing to /dev/ipsec ... SA already
- in use</A></LI>
-<LI><A href="#ignore">... ignoring ... payload</A></LI>
-<LI><A href="#unknown_rightcert">unknown parameter name &quot;rightcert&quot;</A></LI>
-</UL>
-</LI>
-<LI><A href="#spam">Why don't you restrict the mailing lists to reduce
- spam?</A></LI>
-</UL>
-<HR>
-<H2><A name="whatzit">What is FreeS/WAN?</A></H2>
-<P>FreeS/WAN is a Linux implementation of the<A href="glossary.html#IPSEC">
- IPsec</A> protocols, providing security services at the IP (Internet
- Protocol) level of the network.</P>
-<P>For more detail, see our<A href="intro.html"> introduction</A>
- document or the FreeS/WAN project<A href="http://www.freeswan.org/">
- web site</A>.</P>
-<P>To start setting it up, go to our<A href="quickstart.html">
- quickstart guide</A>.</P>
-<P>Our<A href="web.html"> web links</A> document has information on<A href="web.html#implement">
- IPsec for other systems</A>.</P>
-<H2><A name="problems">How do I report a problem or seek help?</A></H2>
-<DL>
-<DT>Read our<A href="trouble.html"> troubleshooting</A> document.</DT>
-<DD>
-<P>It may guide you to a solution. If not, see its<A href="trouble.html#prob.report">
- problem reporting</A> section.</P>
-<P>Basically, what it says is<STRONG> give us the output from<VAR> ipsec
- barf</VAR> from both gateways</STRONG>. Without full information, we
- cannot diagnose a problem. However,<VAR> ipsec barf</VAR> produces a
- lot of output. If at all possible,<STRONG> please make barfs accessible
- via the web or FTP</STRONG> rather than sending enormous mail messages.</P>
-</DD>
-<DT><STRONG>Use the<A href="mail.html"> users mailing list</A> for
- problem reports</STRONG>, rather than mailing developers directly.</DT>
-<DD>
-<UL>
-<LI>This gives you access to more expertise, including users who may
- have encountered and solved the same problems.</LI>
-<LI>It is more likely to get a quick response. Developers may get behind
- on email, or even ignore it entirely for a while, but a list message
- (given a reasonable Subject: line) is certain to be read by a fair
- number of people within hours.</LI>
-<LI>It may also be important because of<A href="politics.html#exlaw">
- cryptography export laws</A>. A US citizen who provides technical
- assistance to foreign cryptographic work might be charged under the
- arms export regulations. Such a charge would be easier to defend if the
- discussion took place on a public mailing list than if it were done in
- private mail.</LI>
-</UL>
-</DD>
-<DT>Try irc.freenode.net#freeswan.</DT>
-<DD>
-<P>FreeS/WAN developers, volunteers and users can often be found there.
- Be patient and be prepared to provide lots of information to support
- your question.</P>
-<P>If your question was really interesting, and you found an answer,
- please share that with the class by posting to the<A href="mail.html">
- users mailing list</A>. That way others with the same problem can find
- your answer in the archives.</P>
-</DD>
-<DT>Premium support is also available.</DT>
-<DD>
-<P>See the next several questions.</P>
-</DD>
-</DL>
-<H2><A name="generic">Can I get ...</A></H2>
-<H3><A name="lemme_out">Can I get an off-the-shelf system that includes
- FreeS/WAN?</A></H3>
-<P>There are a number of Linux distributions or firewall products which
- include FreeS/WAN. See this<A href="intro.html#products"> list</A>.
- Using one of these, chosen to match your requirements and budget, may
- save you considerable time and effort.</P>
-<P>If you don't know your requirements, start by reading Schneier's<A href="biblio.html#secrets">
- Secrets and Lies</A>. That gives the best overview of security issues I
- have seen. Then consider hiring a consultant (see next question) to
- help define your requirements.</P>
-<H3><A name="consultant">Can I hire consultants or staff who know
- FreeS/WAN?</A></H3>
-<P>If you want the help of a contractor, or to hire staff with FreeS/WAN
- expertise, you could:</P>
-<UL>
-<LI>check availability in your area through your local Linux User Group
- (<A href="http://lugww.counter.li.org/">LUG Index</A>)</LI>
-<LI>try asking on our<A href="mail.html"> mailing list</A></LI>
-</UL>
-<P>For companies offerring support, see the next question.</P>
-<H3><A name="commercial">Can I get commercial support?</A></H3>
-<P>Many of the distributions or firewall products which include
- FreeS/WAN (see this<A href="intro.html#products"> list</A>) come with
- commercial support or have it available as an option.</P>
-<P>Various companies specialize in commercial support of open source
- software. Our project leader was a founder of the first such company,
- Cygnus Support. It has since been bought by<A href="http://www.redhat.com">
- Redhat</A>. Another such firm is<A href="http://www.linuxcare.com">
- Linuxcare</A>.</P>
-<H2><A name="release">Release questions</A></H2>
-<H3><A name="rel.current">What is the current release?</A></H3>
-<P>The current release is the highest-numbered tarball on our<A href="ftp://ftp.xs4all.nl/pub/crypto/freeswan">
- distribution site</A>. Almost always, any of<A href="intro.html#mirrors">
- the mirrors</A> will have the same file, though perhaps not for a day
- or so after a release.</P>
-<P>Unfortunately, the web site is not always updated as quickly as it
- should be.</P>
-<H3><A name="relwhen">When is the next release?</A></H3>
-<P>We try to do a release approximately every six to eight weeks.</P>
-<P>If pre-release tests fail and the fix appears complex, or more
- generally if the code does not appear stable when a release is
- scheduled, we will just skip that release.</P>
-<P>For serious bugs, we may bring out an extra bug-fix release. These
- get numbers in the normal release series. For example, there was a bug
- found in FreeS/WAN 1.6, so we did another release less than two weeks
- later. The bug-fix release was called 1.7.</P>
-<H3><A name="rel.bugs">Are there known bugs in the current release?</A></H3>
-<P>Any problems we are aware of at the time of a release are documented
- in the<A href="../BUGS"> BUGS</A> file for that release. You should
- also look at the<A href="../CHANGES"> CHANGES</A> file.</P>
-<P>Bugs discovered after a release are discussed on the<A href="mail.html">
- mailing lists</A>. The easiest way to check for any problems in the
- current code would be to peruse the<A href="http://lists.freeswan.org/pipermail/briefs">
- List In Brief</A>.</P>
-<H2><A name="mod_cons">Modifications and contributions</A></H2>
-<H3><A name="modify.faq">Can I modify FreeS/WAN to ...?</A></H3>
-<P>You are free to modify FreeS/WAN in any way. See the discussion of<A href="intro.html#licensing">
- licensing</A> in our introduction document.</P>
-<P>Before investing much energy in any such project, we suggest that you</P>
-<UL>
-<LI>check the list of<A href="web.html#patch"> existing patches</A></LI>
-<LI>post something about your project to the<A href="mail.html"> design
- mailing list</A></LI>
-</UL>
-<P>This may prevent duplicated effort, or lead to interesting
- collaborations.</P>
-<H3><A name="contrib.faq">Can I contribute to the project?</A></H3>
- In general, we welcome contributions from the community. Various
- contributed patches, either to fix bugs or to add features, have been
- incorporated into our distribution. Other patches, not yet included in
- the distribution, are listed in our<A href="web.html#patch"> web links</A>
- section.
-<P>Users have also contributed heavily to documentation, both by
- creating their own<A href="intro.html#howto"> HowTos</A> and by posting
- things on the<A href="mail.html"> mailing lists</A> which I have quoted
- in these HTML docs.</P>
-<P>There are, however, some caveats.</P>
-<P>FreeS/WAN is being implemented in Canada, by Canadians, largely to
- ensure that is it is entirely free of export restrictions. See this<A href="politics.html#status">
- discussion</A>. We<STRONG> cannot accept code contributions from US
- residents or citizens</STRONG>, not even one-line bugs fixes. The
- reasons for this were recently discussed extensively on the mailing
- list, in a thread starting<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/01/msg00111.html">
- here</A>.</P>
-<P>Not all contributions are of interest to us. The project has a set of
- fairly ambitious and quite specific goals, described in our<A href="intro.html#goals">
- introduction</A>. Contributions that lead toward these goals are likely
- to be welcomed enthusiastically. Other contributions may be seen as
- lower priority, or even as a distraction.</P>
-<P>Discussion of possible contributions takes place on the<A href="mail.html">
- design mailing list</A>.</P>
-<H3><A name="ddoc.faq">Is there detailed design documentation?</A></H3>
- There are:
-<UL>
-<LI><A href="rfc.html">RFCs</A> specifying the protocols we implement</LI>
-<LI><A href="manpages.html">man pages</A> for our utilities, library
- functions and file formats</LI>
-<LI>comments in the source code</LI>
-<LI><A href="index.html">HTML documentation</A> written primarily for
- users</LI>
-<LI>archived discussions from the<A href="mail.html"> mailing lists</A></LI>
-<LI>other papers mentioned in our<A href="intro.html#applied">
- introduction</A></LI>
-</UL>
-<P>The only formal design documents are a few papers in the last
- category above. All the other categories, however, have things to say
- about design as well.</P>
-<H2><A name="interact">Will FreeS/WAN work in my environment?</A></H2>
-<H3><A name="interop.faq">Can FreeS/WAN talk to ...?</A></H3>
-<P>The IPsec protocols are designed to support interoperation. In
- theory, any two IPsec implementations should be able to talk to each
- other. In practice, it is considerably more complex. We have a whole<A href="interop.html">
- interoperation document</A> devoted to this problem.</P>
-<P>An important part of that document is links to the many<A href="interop.html#otherpub">
- user-written HowTos</A> on interoperation between FreeS/WAN and various
- other implementations. Often the users know more than the developers
- about these issues (and almost always more than me :-), so these
- documents may be your best resource.</P>
-<H3><A name="old_to_new">Can different FreeS/WAN versions talk to each
- other?</A></H3>
-<P>Linux FreeS/WAN can interoperate with many IPsec implementations,
- including earlier versions of Linux FreeS/WAN itself.</P>
-<P>In a few cases, there are some complications. See our<A href="interop.html#oldswan">
- interoperation</A> document for details.</P>
-<H3><A name="faq.bandwidth">Is there a limit on throughput?</A></H3>
-<P>There is no hard limit, but see below.</P>
-<H3><A name="faq.number">Is there a limit on number of tunnels?</A></H3>
-<P>There is no hard limit, but see next question.</P>
-<H3><A name="faq.speed">Is a ... fast enough to handle FreeS/WAN with my
- loads?</A></H3>
-<P>A quick summary:</P>
-<DL>
-<DT>Even a limited machine can be useful</DT>
-<DD>A 486 can handle a T1, ADSL or cable link, though the machine may be
- breathing hard.</DD>
-<DT>A mid-range PC (say 800 MHz with good network cards) can do a lot of
- IPsec</DT>
-<DD>With up to roughly 50 tunnels and aggregate bandwidth of 20 Megabits
- per second, it willl have cycles left over for other tasks.</DD>
-<DT>There are limits</DT>
-<DD>Even a high end CPU will not come close to handling a fully loaded
- 100 Mbit/second Ethernet link.
-<P>Beyond about 50 tunnels it needs careful management.</P>
-</DD>
-</DL>
-<P>See our<A href="performance.html"> FreeS/WAN performance</A> document
- for details.</P>
-<H2><A name="work_on">Will FreeS/WAN work on ... ?</A></H2>
-<H3><A name="versions">Will FreeS/WAN run on my version of Linux?</A></H3>
-<P>We build and test on Redhat distributions, but FreeS/WAN runs just
- fine on several other distributions, sometimes with minor fiddles to
- adapt to the local environment. Details are in our<A href="compat.html#otherdist">
- compatibility</A> document. Also, some distributions or products come
- with<A href="intro.html#products"> FreeS/WAN included</A>.</P>
-<H3><A name="nonIntel.faq">Will FreeS/WAN run on non-Intel CPUs?</A></H3>
-<P>FreeS/WAN is<STRONG> intended to run on all CPUs Linux supports</STRONG>
-. We know of it being used in production on x86, ARM, Alpha and MIPS. It
- has also had successful tests on PPC and SPARC, though we don't know of
- actual use there. Details are in our<A href="compat.html#CPUs">
- compatibility</A> document.</P>
-<H3><A name="multi.faq">Will FreeS/WAN run on multiprocessors?</A></H3>
-<P>FreeS/WAN is designed to work on any SMP architecture Linux supports,
- and has been tested successfully on at least dual processor Intel
- architecture machines. Details are in our<A href="compat.html#multiprocessor">
- compatibility</A> document.</P>
-<H3><A name="k.old">Will FreeS/WAN work on an older kernel?</A></H3>
-<P>It might, but we strongly recommend using a recent 2.2 or 2.4 series
- kernel. Sometimes the newer versions include security fixes which can
- be quite important on a gateway.</P>
-<P>Also, we use recent kernels for development and testing, so those are
- better tested and, if you do encounter a problem, more easily
- supported. If something breaks applying recent FreeS/WAN patches to an
- older kernel, then &quot;update your kernel&quot; is almost certain to be the
- first thing we suggest. It may be the only suggestion we have.</P>
-<P>The precise kernel versions supported by a particular FreeS/WAN
- release are given in the<A href="XX"> README</A> file of that release.</P>
-<P>See the following question for more on kernels.</P>
-<H3><A name="k.versions">Will FreeS/WAN run on the latest kernel
- version?</A></H3>
-<P>Sometimes yes, but quite often, no.</P>
-<P>Kernel versions supported are given in the<A href="../README"> README</A>
- file of each FreeS/WAN release. Typically, they are whatever production
- kernels were current at the time of our release (or shortly before; we
- might release for kernel<VAR> n</VAR> just as Linus releases<VAR> n+1</VAR>
-). Often FreeS/WAN will work on slightly later kernels as well, but of
- course this cannot be guaranteed.</P>
-<P>For example, FreeS/WAN 1.91 was released for kernels 2.2.19 or 2.4.5,
- the current kernels at the time. It also worked on 2.4.6, 2.4.7 and
- 2.4.8, but 2.4.9 had changes that caused compilation errors if it was
- patched with FreeS/WAN 1.91.</P>
-<P>When such changes appear, we put a fix in the FreeS/WAN snapshots,
- and distribute it with our next release. However, this is not a high
- priority for us, and it may take anything from a few days to several
- weeks for such a problem to find its way to the top of our kernel
- programmer's To-Do list. In the meanwhile, you have two choices:</P>
-<UL>
-<LI>either stick with a slightly older kernel, even if it is not the
- latest and greatest. This is recommended for production systems; new
- versions may have new bugs.</LI>
-<LI>or fix the problem yourself and send us a patch, via the<A href="mail.html">
- Users mailing list</A>.</LI>
-</UL>
-<P>We don't even try to keep up with kernel changes outside the main 2.2
- and 2.4 branches, such as the 2.4.x-ac patched versions from Alan Cox
- or the 2.5 series of development kernels. We'd rather work on
- developing the FreeS/WAN code than on chasing these moving targets. We
- are, however, happy to get patches for problems discovered there.</P>
-<P>See also the<A href="install.html#choosek"> Choosing a kernel</A>
- section of our installation document.</P>
-<H3><A name="interface.faq">Will FreeS/WAN work on unusual network
- hardware?</A></H3>
-<P>IPsec is designed to work over any network that IP works over, and
- FreeS/WAN is intended to work over any network interface hardware that
- Linux supports.</P>
-<P>If you have working IP on some unusual interface -- perhaps Arcnet,
- Token Ring, ATM or Gigabit Ethernet -- then IPsec should &quot;just work&quot;.</P>
-<P>That said, practice is sometimes less tractable than theory. Our
- testing is done almost entirely on:</P>
-<UL>
-<LI>10 or 100 Mbit Ethernet</LI>
-<LI>ADSL or cable connections, with and without PPPoE</LI>
-<LI>IEEE 802.11 wireless LANs (see<A href="#wireless.faq"> below</A>)</LI>
-</UL>
-<P>If you have some other interface, especially an uncommon one, it is
- entirely possible you will get bitten either by a FreeS/WAN bug which
- our testing did not turn up, or by a bug in the driver that shows up
- only with our loads.</P>
-<P>If IP works on your interface and FreeS/WAN doesn't, seek help on the<A
-href="mail.html"> mailing lists</A>.</P>
-<P>Another FAQ section describes<A href="#pmtu.broken"> MTU problems</A>
-. These are a possibility for some interfaces.</P>
-<H3><A name="vlan">Will FreeS/WAN work on a VLAN (802.1q) network?</A></H3>
-<P> Yes, FreeSwan works fine, though some network drivers have problems
- with jumbo sized ethernet frames. If you used interfaces=%defaultroute
- you do not need to change anything, but if you specified an interface
- (eg eth0) then remember you must change that to reflect the VLAN
- interface (eg eth0.2 for VLAN ID 2).</P>
-<P> The &quot;eepro100&quot; module is known to be broken, use the e100 driver for
- those cards instead (included in 2.4 as 'alternative driver' for the
- Intel EtherExpressPro/100.</P>
-<P> You do not need to change any MTU setting (those are workarounds
- that are only needed for buggy drivers)</P>
-<P><EM>This FAQ contributed by Paul Wouters.</EM></P>
-<H2><A name="features.faq">Does FreeS/WAN support ...</A></H2>
-<P>For a discussion of which parts of the IPsec specifications FreeS/WAN
- does and does not implement, see our<A href="compat.html#spec">
- compatibility</A> document.</P>
-<P>For information on some often-requested features, see below.</P>
-<H3><A name="VPN.faq"></A>Does FreeS/WAN support site-to-site VPN (<A HREF="glossary.html#VPN">
-Virtual Private Network</A>) applications?</H3>
-<P>Absolutely. See this FreeS/WAN-FreeS/WAN<A HREF="config.html">
- configuration example</A>. If only one site is using FreeS/WAN, there
- may be a relevant HOWTO on our<A HREF="interop.html"> interop page</A>.</P>
-<H3><A name="warrior.faq">Does FreeS/WAN support remote users connecting
- to a LAN?</A></H3>
-<P>Yes. We call the remote users &quot;Road Warriors&quot;. Check out our
- FreeS/WAN-FreeS/WAN<A HREF="config.html#config.rw"> Road Warrior
- Configuration Example</A>.</P>
-<P>If your Road Warrior is a Windows or Mac PC, you may need to install
- an IPsec implementation on that machine. Our<A HREF="interop.html">
- interop</A> page lists many available brands, and features links to
- several HOWTOs.</P>
-<H3><A name="road.shared.possible">Does FreeS/WAN support remote users
- using shared secret authentication?</A></H3>
-<P><STRONG>Yes, but</STRONG> there are severe restrictions, so<STRONG>
- we strongly recommend using</STRONG><A href="glossary.html#RSA"><STRONG>
- RSA</STRONG></A><STRONG> keys for</STRONG><A href="glossary.html#authentication">
-<STRONG> authentication</STRONG></A><STRONG> instead</STRONG>.</P>
-<P>See this<A href="#road.PSK"> FAQ question</A>.</P>
-<H3><A name="wireless.faq">Does FreeS/WAN support wireless networks?</A></H3>
-<P>Yes, it is a common practice to use IPsec over wireless networks
- because their built-in encryption,<A href="glossary.html#WEP"> WEP</A>,
- is insecure.</P>
-<P>There is some<A href="adv_config.html#wireless.config"> discussion</A>
- in our advanced configuration document. See also the<A HREF="http://www.wavesec.org">
- WaveSEC site</A>.</P>
-<H3><A name="PKIcert">Does FreeS/WAN support X.509 or other PKI
- certificates?</A></H3>
-<P>Vanilla FreeS/WAN does not support X.509, but Andreas Steffen and
- others have provided a popular, well-supported X.509 patch.</P>
-<UL>
-<LI><A HREF="http://www.strongsec.com/freeswan">patch</A></LI>
-<LI><A HREF="http://www.freeswan.ca">Super FreeS/WAN</A> incorporates
- this and other user-contributed patches.</LI>
-<LI> Kai Martius'<A HREF="http://www.strongsec.com/freeswan/install.htm">
- X.509 Installation and Configuration Guide</A></LI>
-</UL>
-<P> Linux FreeS/WAN features<A HREF="quickstart.html"> Opportunistic
- Encryption</A>, an alternative Public Key Infrastructure based on
- Secure DNS.</P>
-<H3><A name="Radius">Does FreeS/WAN support user authentication (Radius,
- SecureID, Smart Card...)?</A></H3>
-<P>Andreas Steffen's<A HREF="http://www.strongsec.com/freeswan"> X.509
- patch</A> (v. 1.42+) supports Smart Cards. The patch does not ship with
- vanilla FreeS/WAN, but will be incorporated into<A HREF="http://www.freeswan.ca/">
- Super FreeS/WAN 2.01+</A>. The patch implements the PCKS#15
- Cryptographic Token Information Format Standard, using the OpenSC
- smartcard library functions.</P>
-<P>Older news:</P>
-<P>A user-supported patch to FreeS/WAN 1.3, for smart card style
- authentication, is available on<A HREF="http://alcatraz.webcriminals.com/~bastiaan/ipsec">
- Bastiaan's site</A>. It supports skeyid and ibutton. This patch is not
- part of Super FreeS/WAN.</P>
-<P>For a while progress on this front was impeded by a lack of standard.
- The IETF<A href="http://www.ietf.org/html.charters/ipsra-charter.html">
- working group</A> has now nearly completed its recommended solution to
- the problem; meanwhile several vendors have implemented various things.</P>
-
-<!--
-<p>The <a href="web.html#patch">patches</a> section of our web links document
-has links to some user work on this.</p>
--->
-<P>Of course, there are various ways to avoid any requirement for user
- authentication in IPsec. Consider the situation where road warriors
- build IPsec tunnels to your office net and you are considering
- requiring user authentication during tunnel negotiation. Alternatives
- include:</P>
-<UL>
-<LI>If you can trust the road warrior machines, then set them up so that
- only authorised users can create tunnels. If your road warriors use
- laptops, consider the possibility of theft.</LI>
-<LI>If the tunnel only provides access to particular servers and you can
- trust those servers, then set the servers up to require user
- authentication.</LI>
-</UL>
-<P>If either of those is trustworthy, it is not clear that you need user
- authentication in IPsec.</P>
-<H3><A name="NATtraversal">Does FreeS/WAN support NAT traversal?</A></H3>
-<P>Vanilla FreeS/WAN does not, but thanks to Mathieu Lafon and Arkoon
- Network Security, there's a patch to support this.</P>
-<UL>
-<LI><A HREF="http://open-source.arkoon.net">patch and documentation</A></LI>
-<LI><A HREF="http://www.freeswan.ca">Super FreeS/WAN</A> incorporates
- this and other user-contributed patches.</LI>
-</UL>
-<P>The NAT traversal patch has some issues with PSKs, so you may wish to
- authenticate with RSA keys, or X.509 (requires a patch which is also
- included in Super FreeS/WAN). Doing the latter also has advantages when
- dealing with large numbers of clients who may be behind NAT; instead of
- having to make an individual Roadwarrior connection for each virtual
- IP, you can use the &quot;rightsubnetwithin&quot; parameter to specify a range.
- See<A HREF="http://www.strongsec.com/freeswan/install.htm#section_4.4">
- these<VAR> rightsubnetwithin</VAR> instructions</A>.</P>
-<H3><A name="virtID">Does FreeS/WAN support assigning a &quot;virtual
- identity&quot; to a remote system?</A></H3>
-<P>Some IPsec implementations allow you to make the source address on
- packets sent by a Road Warrior machine be something other than the
- address of its interface to the Internet. This is sometimes described
- as assigning a virtual identity to that machine.</P>
-<P>FreeS/WAN does not directly support this, but it can be done. See
- this<A href="#road.masq"> FAQ question</A>.</P>
-<H3><A name="noDES.faq">Does FreeS/WAN support single DES encryption?</A>
-</H3>
-<P><STRONG>No</STRONG>, single DES is not used either at the<A href="glossary.html#IKE">
- IKE</A> level for negotiating connections or at the<A href="glossary.html#IPsec">
- IPsec</A> level for actually building them.</P>
-<P>Single DES is<A href="politics.html#desnotsecure"> insecure</A>. As
- we see it, it is more important to deliver real security than to comply
- with a standard which has been subverted into allowing use of
- inadequate methods. See this<A href="politics.html#weak"> discussion</A>
-.</P>
-<P>If you want to interoperate with an IPsec implementation which offers
- only DES, see our<A href="interop.html#noDES"> interoperation</A>
- document.</P>
-<H3><A name="AES.faq">Does FreeS/WAN support AES encryption?</A></H3>
-<P><A href="glossary.html#AES">AES</A> is a new US government<A href="glossary.html#block">
- block cipher</A> standard to replace the obsolete<A href="glossary.html#DES">
- DES</A>.</P>
-<P>At time of writing (March 2002), the FreeS/WAN distribution does not
- yet support AES but user-written<A href="web.html#patch"> patches</A>
- are available to add it. Our kernel programmer is working on
- integrating those patches into the distribution, and there is active
- discussion of this on the design mailimg list.</P>
-<H3><A name="other.cipher">Does FreeS/WAN support other encryption
- algorithms?</A></H3>
-<P>Currently<A href="glossary.html#3DES"> triple DES</A> is the only
- cipher supported. AES will almost certainly be added (see previous
- question), and it is likely that in the process we will also add the
- other two AES finalists with open licensing, Twofish and Serpent.</P>
-<P>We are extremely reluctant to add other ciphers. This would make both
- use and maintenance of FreeS/WAN more complex without providing any
- clear benefit. Complexity is emphatically not desirable in a security
- product.</P>
-<P>Various users have written patches to add other ciphers. We provide<A href="web.html#patch">
- links</A> to these.</P>
-<H2><A name="canI">Can I ...</A></H2>
-<H3><A name="policy.preconfig">Can I use policy groups along with
- explicitly configured connections?</A></H3>
-<P>Yes, you can, so long as you pay attention to the selection rule,
- which can be summarized &quot;the most specific connection wins&quot;. We
- describe the rule in our<A HREF="policygroups.html#policy.group.notes">
- policy groups</A> document, and provide a more technical explanation in<A
-HREF="manpage.d/ipsec.conf.5.html"> man ipsec.conf</A>.</P>
-<P>A good guideline: If you have a regular connection defined in<VAR>
- ipsec.conf</VAR>, ensure that a subset of that connection is not listed
- in a less restrictive policy group. Otherwise, FreeS/WAN will use the
- subset, with its more specific source/destination pair.</P>
-<P>Here's an example. Suppose you are the system administrator at
- 192.0.2.2. You have this connection in ipsec.conf:<VAR> ipsec.conf</VAR>
-:</P>
-<PRE>conn net-to-net
-    left=192.0.2.2           # you are here
-    right=192.0.2.8
-    rightsubnet=192.0.2.96/27
-    ....
-</PRE>
-<P>If you then place a host or net within<VAR> rightsubnet</VAR>, (let's
- say 192.0.2.98) in<VAR> private-or-clear</VAR>, you may find that
- 192.0.2.2 at times communicates in the clear with 192.0.2.98. That's
- consistent with the rule, but may be contrary to your expectations.</P>
-<P>On the other hand, it's safe to put a larger subnet in a less
- restrictive policy group file. If<VAR> private-or-clear</VAR> contains
- 192.0.2.0/24, then the more specific<VAR> net-to-net</VAR> connection
- is used for any communication to 192.0.2.96/27. The more general policy
- applies only to communication with hosts or subnets in 192.0.2.0/24
- without a more specific policy or connection.</P>
-<H3><A name="policy.off">Can I turn off policy groups?</A></H3>
-<P>Yes. Use<A HREF="policygroups.html#disable_policygroups"> these
- instructions</A>.</P>
-
-<!--
-<h3><a name="policy.otherinterface">Can I use policy groups
- on an interface other than <VAR>%defaultroute</VAR>?</a></h3>
-
-<p>??<p>
--->
-<H3><A name="reload">Can I reload connection info without restarting?</A>
-</H3>
-<P>Yes, you can do this. Here are the details, in a mailing list message
- from Pluto programmer Hugh Redelmeier:</P>
-<PRE>| How can I reload config's without restarting all of pluto and klips?  I am using
-| FreeSWAN -&gt; PGPNet in a medium sized production environment, and would like to be
-| able to add new connections ( i am using include config/* ) without dropping current
-| SA's.
-| 
-| Can this be done?
-| 
-| If not, are there plans to add this kind of feature?
-
-        ipsec auto --add whatever
-This will look in the usual place (/etc/ipsec.conf) for a conn named
-whatever and add it.
-
-If you added new secrets, you need to do
-        ipsec auto --rereadsecrets
-before Pluto needs to know those secrets.
-
-| I have looked (perhaps not thoroughly enough tho) to see how to do this:
-
-There may be more bits to look for, depending on what you are trying
-to do.</PRE>
-<P>Another useful command here is<VAR> ipsec auto --replace &lt;conn_name&gt;</VAR>
- which re-reads data for a named connection.</P>
-<H3><A name="masq.faq">Can I use several masqueraded subnets?</A></H3>
-<P>Yes. This is done all the time. See the discussion in our<A href="config.html#route_or_not">
- setup</A> document. The only restriction is that the subnets on the two
- ends must not overlap. See the next question.</P>
-<P>Here is a mailing list message on the topic. The user incorrectly
- thinks you need a 2.4 kernel for this -- actually various people have
- been doing it on 2.0 and 2.2 for quite some time -- but he has it right
- for 2.4.</P>
-<PRE>Subject: Double NAT and freeswan working :)
-   Date: Sun, 11 Mar 2001
-   From: Paul Wouters &lt;paul@xtdnet.nl&gt;
-
-Just to share my pleasure, and make an entry for people who are searching
-the net on how to do this. Here's the very simple solution to have a double
-NAT'ed network working with freeswan. (Not sure if this is old news, but I'm
-not on the list (too much spam) and I didn't read this in any HOWTO/FAQ/doc
-on the freeswan site yet (Sandy, put it in! :)
-
-10.0.0.0/24 --- 10.0.0.1 a.b.c.d  ---- a.b.c.e {internet} ----+
-                                                              |
-10.0.1.0/24 --- 10.0.1.1 f.g.h.i  ---- f.g.h.j {internet} ----+
-
-the goal is to have the first network do a VPN to the second one, yet also
-have NAT in place for connections not destinated for the other side of the
-NAT. Here the two Linux security gateways have one real IP number (cable
-modem, dialup, whatever.
-
-The problem with NAT is you don't want packets from 10.*.*.* to 10.*.*.*
-to be NAT'ed. While with Linux 2.2, you can't, with Linux 2.4 you can.
-
-(This has been tested and works for 2.4.2 with Freeswan snapshot2001mar8b)
-
-relevant parts of /etc/ipsec.conf:
-
-        left=f.g.h.i
-        leftsubnet=10.0.1.0/24
-        leftnexthop=f.g.h.j
-        leftfirewall=yes
-        leftid=@firewall.netone.nl
-        leftrsasigkey=0x0........
-        right=a.b.c.d
-        rightsubnet=10.0.0.0/24
-        rightnexthop=a.b.c.e
-        rightfirewall=yes
-        rightid=@firewall.nettwo.nl
-        rightrsasigkey=0x0......
-        # To authorize this connection, but not actually start it, at startup,
-        # uncomment this.
-        auto=add
-
-and now the real trick. Setup the NAT correctly on both sites:
-
-iptables -t nat -F
-iptables -t nat -A POSTROUTING -o eth0 -d \! 10.0.0.0/8 -j MASQUERADE
-
-This tells the NAT code to only do NAT for packets with destination other then
-10.* networks. note the backslash to mask the exclamation mark to protect it
-against the shell.
-
-Happy painting :)
-
-Paul</PRE>
-<H3><A name="dup_route">Can I use subnets masqueraded to the same
- addresses?</A></H3>
-<P><STRONG>No.</STRONG> The notion that IP addresses are unique is one
- of the fundamental principles of the IP protocol. Messing with it is
- exceedingly perilous.</P>
-<P>Fairly often a situation comes up where a company has several
- branches, all using the same<A href="glossary.html#non-routable">
- non-routable addresses</A>, perhaps 192.168.0.0/24. This works fine as
- long as those nets are kept distinct. The<A href="glossary.html#masq">
- IP masquerading</A> on their firewalls ensures that packets reaching
- the Internet carry the firewall address, not the private address.</P>
-<P>This can break down when IPsec enters the picture. FreeS/WAN builds a
- tunnel that pokes through both masquerades and delivers packets from<VAR>
- leftsubnet</VAR> to<VAR> rightsubnet</VAR> and vice versa. For this to
- work, the two subnets<EM> must</EM> be distinct.</P>
-<P>There are several solutions to this problem.</P>
-<P>Usually, you<STRONG> re-number the subnets</STRONG>. Perhaps the
- Vancouver office becomes 192.168.101.0/24, Calgary 192.168.102.0/24 and
- so on. FreeS/WAN can happily handle this. With, for example<VAR>
- leftsubnet=192.168.101.0/24</VAR> and<VAR> rightsubnet=192.168.102.0/24</VAR>
- in a connection description, any machine in Calgary can talk to any
- machine in Vancouver. If you want to be more restrictive and use
- something like<VAR> leftsubnet=192.168.101.128/25</VAR> and<VAR>
- rightsubnet=192.168.102.240/28</VAR> so only certain machines on each
- end have access to the tunnel, that's fine too.</P>
-<P>You could also<STRONG> split the subnet</STRONG> into smaller ones,
- for example using<VAR> 192.168.1.0/25</VAR> in Vancouver and<VAR>
- rightsubnet=192.168.0.128/25</VAR> in Calgary.</P>
-<P>Alternately, you can just<STRONG> give up routing</STRONG> directly
- to machines on the subnets. Omit the<VAR> leftsubnet</VAR> and<VAR>
- rightsubnet</VAR> parameters from your connection descriptions. Your
- IPsec tunnels will then run between the public interfaces of the two
- firewalls. Packets will be masqueraded both before they are put into
- tunnels and after they emerge. Your Vancouver client machines will see
- only one Calgary machine, the firewall.</P>
-<H3><A name="road.masq">Can I assign a road warrior an address on my net
- (a virtual identity)?</A></H3>
-<P>Often it would be convenient to be able to give a Road Warrior an IP
- address which appears to be on the local network. Some IPsec
- implementations have support for this, sometimes calling the feature
- &quot;virtual identity&quot;.</P>
-<P>Currently (Sept 2002) FreeS/WAN does not support this, and we have no
- definite plans to add it. The difficulty is that is not yet a standard
- mechanism for it. There is an Internet Draft for a method of doing it
- using<A href="glossary.html#DHCP"> DHCP</A> which looks promising.
- FreeS/WAN may support that in a future release.</P>
-<P>In the meanwhile, you can do it yourself using the Linux iproute2(8)
- facilities. Details are in<A href="http://www.av8n.com/vpn/iproute2.htm">
- this paper</A>.</P>
-<P>Another method has also been discussed on the mailing list.:</P>
-<UL>
-<LI>You can use a variant of the<A href="adv_config.html#extruded.config">
- extruded subnet</A> procedure.</LI>
-<LI>You have to avoid having the road warrior's assigned address within
- the range you actually use at home base. See previous question.</LI>
-<LI>On the other hand, you want the roadwarrior's address to be within
- the range that<EM> seems</EM> to be on your network.</LI>
-</UL>
-<P>For example, you might have:</P>
-<DL>
-<DT>leftsubnet=a.b.c.0/25</DT>
-<DD>head office network</DD>
-<DT>rightsubnet=a.b.c.129/32</DT>
-<DD>extruded to a road warrior. Note that this is not in a.b.c.0/25</DD>
-<DT>a.b.c.0/24</DT>
-<DD>whole network, including both the above</DD>
-</DL>
-<P>You then set up routing so that the office machines use the IPsec
- gateway as their route to a.b.c.128/25. The leftsubnet parameter tells
- the road warriors to use tunnels to reach a.b.c.0/25, so you should
- have two-way communication. Depending or your network and applications,
- there may be some additional work to do on DNS or Windows configuration</P>
-<H3><A name="road.many">Can I support many road warriors with one
- gateway?</A></H3>
-<P>Yes. This is easily done, using</P>
-<DL>
-<DT>either RSA authentication</DT>
-<DD>standard in the FreeS/WAN distribution</DD>
-<DT>or X.509 certificates</DT>
-<DD>requires<A href="#PKIcert"> Super FreeS/WAN or a patch</A>.</DD>
-</DL>
-<P>In either case, each Road Warrior must have a different key or
- certificate.</P>
-<P>It is also possible using pre-shared key authentication, though we
- don't recommend this; see the<A href="#road.PSK"> next question</A> for
- details.</P>
-<P>If you expect to have more than a few dozen Road Warriors connecting
- simultaneously, you may need a fairly powerful gateway machine. See our
- document on<A href="performance.html"> FreeS/WAN performance</A>.</P>
-<H3><A name="road.PSK">Can I have many road warriors using shared secret
- authentication?</A></H3>
-<P><STRONG>Yes, but avoid it if possible</STRONG>.</P>
-<P>You can have multiple Road Warriors using shared secret
- authentication<STRONG> only if they all use the same secret</STRONG>.
- You must also set:</P>
-<P></P>
-<PRE>   uniqueids=no   </PRE>
-<P>in the connection definition.</P>
-<P>Why it's less secure:</P>
-<UL>
-<LI>If you have many users, it becomes almost certain the secret will
- leak</LI>
-<LI>The secret becomes quite valuable to an attacker</LI>
-<LI>All users authenticate the same way, so the gateway cannot tell them
- apart for logging or access control purposes</LI>
-<LI>Changing the secret is difficult. You have to securely notify all
- users.</LI>
-<LI>If you find out the secret has been compromised, you can change it,
- but then what? None of your users can connect without the new secret.
- How will you notify them all, quickly and securely, without using the
- VPN?</LI>
-</UL>
-<P>This is a designed-in limitation of the<A href="glossary.html#IKE">
- IKE</A> key negotiation protocol, not a problem with our
- implementation.</P>
-<P><STRONG>We very strongly recommend that you avoid using shared secret
- authentication for multiple Road Warriors.</STRONG> Use RSA
- authentication instead.</P>
-<P>The longer story: When using shared secrets, the protocol requires
- that the responding gateway be able to determine which secret to use at
- a time when all it knows about the initiator is an IP address. This
- works fine if you know the initiator's address in advance and can use
- it to look up the appropiriate secret. However, it fails for Road
- Warriors since the gateway cannot know their IP addresses in advance.</P>
-<P>With RSA signatures (or certificates) the protocol is slightly
- different. The initiator provides an identifier early in the exchange
- and the responder can use that identifier to look up the correct key or
- certificate. See<A href="#road.many"> above</A>.</P>
-<H3><A name="QoS">Can I use Quality of Service routing with FreeS/WAN?</A>
-</H3>
-<P>From project technical lead Henry Spencer:</P>
-<PRE>&gt; Do QoS add to FreeS/WAN?
-&gt; For example integrating DiffServ and FreeS/WAN?
-
-With a current version of FreeS/WAN, you will have to add hidetos=no to
-the config-setup section of your configuration file.  By default, the TOS
-field of tunnel packets is zeroed; with hidetos=no, it is copied from the
-packet inside.  (This is a modest security hole, which is why it is no
-longer the default.)
-
-DiffServ does not interact well with tunneling in general.  Ways of
-improving this are being studied.</PRE>
-<P>Copying the<A href="glossary.html#TOS"> TOS</A> (type of service)
- information from the encapsulated packet to the outer header reveals
- the TOS information to an eavesdropper. This does not tell him much,
- but it might be of use in<A href="glossary.html#traffic"> traffic
- analysis</A>. Since we do not have to give it to him, our default is
- not to.</P>
-<P>Even with the TOS hidden, you can still:</P>
-<UL>
-<LI>apply QOS rules to the tunneled (ESP) packets; for example, by
- giving ESP packets a certain priority.</LI>
-<LI>apply QOS rules to the packets as they enter or exit the tunnel via
- an IPsec virtual interface (eg.<VAR> ipsec0</VAR>).</LI>
-</UL>
-<P>See<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A> for more
- on the<VAR> hidetos=</VAR> parameter.</P>
-<H3><A name="deadtunnel">Can I recognise dead tunnels and shut them
- down?</A></H3>
-<P>There is no general mechanism to do this is in the IPsec protocols.</P>
-<P>From time to time, there is discussion on the IETF Working Group<A href="mail.html#ietf">
- mailing list</A> of adding a &quot;keep-alive&quot; mechanism (which some say
- should be called &quot;make-dead&quot;), but it is a fairly complex problem and
- no consensus has been reached on whether or how it should be done.</P>
-<P>The protocol does have optional<A href="#ignore"> delete-SA</A>
- messages which one side can send when it closes a connection in hopes
- this will cause the other side to do the same. FreeS/WAN does not
- currently support these. In any case, they would not solve the problem
- since:</P>
-<UL>
-<LI>a gateway that crashes or hangs would not send the messages</LI>
-<LI>the sender is not required to send them</LI>
-<LI>they are not authenticated, so any receiver that trusts them leaves
- itself open to a<A href="glossary.html#DOS"> denial of service</A>
- attack</LI>
-<LI>the receiver is not required to do anything about them</LI>
-<LI>the receiver cannot acknowledge them; the protocol provides no
- mechanism for that</LI>
-<LI>since they are not acknowledged, the sender cannot rely on them</LI>
-</UL>
-<P>However, connections do have limited lifetimes and you can control
- how many attempts your gateway makes to rekey before giving up. For
- example, you can set:</P>
-<PRE>conn default
-        keyingtries=3
-        keylife=30m</PRE>
-<P>With these settings old connections will be cleaned up. Within 30
- minutes of the other end dying, rekeying will be attempted. If it
- succeeds, the new connection replaces the old one. If it fails, no new
- connection is created. Either way, the old connection is taken down
- when its lifetime expires.</P>
-<P>Here is a mailing list message on the topic from FreeS/WAN tech
- support person Claudia Schmeing:</P>
-<PRE>You ask how to determine whether a tunnel is redundant:
-
-&gt; Can anybody explain the best way to determine this. Esp when a RW has
-&gt; disconnected? I thought 'ipsec auto --status' might be one way.
-
-If a tunnel goes down from one end, Linux FreeS/WAN on the
-other end has no way of knowing this until it attempts to rekey.
-Once it tries to rekey and fails, it will 'know' that the tunnel is 
-down.
-
-Because it doesn't have a way of knowing the state until this point, 
-it will also not be able to tell you the state via ipsec auto --status.
-
-&gt; However, comparing output from a working tunnel with that of one that
-&gt; was closed 
-&gt; did not show clearly show tunnel status.
-
-If your tunnel is down but not 'unrouted' (see man ipsec_auto), you
-should not be able to ping the opposite side of the tunnel. You can
-use this as an indicator of tunnel status.
-
-On a related note, you may be interested to know that as of 1.7, 
-redundant tunnels caused by RW disconnections are likely to be 
-less of a pain. From doc/CHANGES:
-
-    There is a new configuration parameter, uniqueids, to control a new Pluto
-    option:  when a new connection is negotiated with the same ID as an old
-    one, the old one is deleted immediately.  This should help eliminate
-    dangling Road Warrior connections when the same Road Warrior reconnects. 
-    It thus requires that IDs not be shared by hosts (a previously legal but
-    probably useless capability).  NOTE WELL:  the sample ipsec.conf now has
-    uniqueids=yes in its config-setup section.
-
-
-Cheers,
-
-Claudia</PRE>
-<H3><A name="demanddial">Can I build IPsec tunnels over a demand-dialed
- link?</A></H3>
-<P>This is possible, but not easy. FreeS/WAN technical lead Henry
- Spencer wrote:</P>
-<PRE>&gt; 5. If the ISDN link goes down in between and is reestablished, the SAs
-&gt; are still up but the eroute are deleted and the IPsec interface shows
-&gt; garbage (with ifconfig)
-&gt; 6. Only restarting IPsec will bring the VPN back online.
-
-This one is awkward to solve.  If the real interface that the IPsec
-interface is mounted on goes down, it takes most of the IPsec machinery
-down with it, and a restart is the only good way to recover. 
-
-The only really clean fix, right now, is to split the machines in two: 
-
-1. A minimal machine serves as the network router, and only it is aware
-that the link goes up and down. 
-
-2. The IPsec is done on a separate gateway machine, which thinks it has
-a permanent network connection, via the router.
-
-This is clumsy but it does work.  Trying to do both functions within a
-single machine is tricky.  There is a software package (diald) which will
-give the illusion of a permanent connection for demand-dialed modem
-connections; I don't know whether it's usable for ISDN, or whether it can
-be made to cooperate properly with FreeS/WAN. 
-
-Doing a restart each time the interface comes up *does* work, although it
-is a bit painful.  I did that with PPP when I was running on a modem link;
-it wasn't hard to arrange the PPP scripts to bring IPsec up and down at
-the right times.  (I'd meant to investigate diald but never found time.)
-
-In principle you don't need to do a complete restart on reconnect, but you
-do have to rebuild some things, and we have no nice clean way of doing
-only the necessary parts.</PRE>
-<P>In the same thread, one user commented:</P>
-<PRE>Subject: Re: linux-ipsec: IPsec and Dial Up Connections
-   Date: Wed, 22 Nov 2000
-   From: Andy Bradford &lt;andyb@calderasystems.com&gt;
-
-On Wed, 22 Nov 2000 19:47:11 +0100, Philip Reetz wrote:
-
-&gt; Are there any ideas what might be the cause of the problem and any way
-&gt; to work around it.
-&gt; Any help is highly appreciated.
-
-On my laptop, when using ppp there is a ip-up script in /etc/ppp that 
-will be executed each time that the ppp interface is brought up.  
-Likewise there is an ip-down script that is called when it is taken 
-down.  You might consider custimzing those to stop and start FreeS/WAN 
-with each connection.  I believe that ISDN uses the same files, though 
-I could be wrong---there should be something similar though.</PRE>
-<H3><A name="GRE">Can I build GRE, L2TP or PPTP tunnels over IPsec?</A></H3>
-<P>Yes. Normally this is not necessary, but it is useful in a few
- special cases. For example, if you must route non-IP packets such as
- IPX, you will need to use a tunneling protocol that can route these
- packets. IPsec can be layered around it for extra security. Another
- example: you can provide failover protection for high availability (HA)
- environments by combining IPsec with other tools. Ken Bantoft describes
- one such setup in<A HREF="http://www.freeswan.ca/docs/HA"> Using
- FreeS/WAN with Linux-HA, GRE, OSPF and BGP for enterprise grade VPN
- solutions</A>.</P>
-<P>GRE over IPsec is covered as part of<A HREF="http://www.freeswan.ca/docs/HA">
- that document</A>.<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/07/msg00209.html">
- Here are links</A> to other GRE resources. Jacco de Leuw has created<A HREF="http://www.jacco2.dds.nl/networking/">
- this page on L2TP over IPsec</A> with instructions for FreeS/WAN and
- several other brands of IPsec software.</P>
-<P>Please let us know of other useful links via the<A HREF="mail.html">
- mailing lists</A>.</P>
-<H3><A name="NetBIOS">... use Network Neighborhood (Samba, NetBIOS) over
- IPsec?</A></H3>
-<P>Your local PC needs to know how to translate NetBIOS names to IP
- addresses. It may do this either via a local LMHOSTS file, or using a
- local or remote WINS server. The WINS server is preferable since it
- provides a centralized source of the information to the entire network.
- To use a WINS server over the<A HREF="glossary.html#VPN"> VPN</A> (or
- any IP-based network), you must enable &quot;NetBIOS over TCP&quot;.</P>
-<P><A HREF="http://www.samba.org">Samba</A> can emulate a WINS server on
- Linux.</P>
-<P> See also several discussions in our<A HREF="http://lists.freeswan.org/pipermail/users/2002-September/thread.html">
- September 2002 Users archives</A></P>
-<H2><A name="setup.faq">Life's little mysteries</A></H2>
-<P>FreeS/WAN is a fairly complex product. (Neither the networks it runs
- on nor the protocols it uses are simple, so it could hardly be
- otherwise.) It therefore sometimes exhibits behaviour which can be
- somewhat confusing, or has problems which are not easy to diagnose.
- This section tries to explain those problems.</P>
-<P>Setup and configuration of FreeS/WAN are covered in other
- documentation sections:</P>
-<UL>
-<LI><A href="quickstart.html">basic setup and configuration</A></LI>
-<LI><A href="adv_config.html">advanced configuration</A></LI>
-<LI><A href="trouble.html">Troubleshooting</A></LI>
-</UL>
-<P>However, we also list some of the commonest problems here.</P>
-<H3><A name="cantping">I cannot ping ....</A></H3>
-<P>This question is dealt with in the advanced configuration section
- under the heading<A href="adv_config.html#multitunnel"> multiple
- tunnels</A>.</P>
-<P>The standard subnet-to-subnet tunnel protects traffic<STRONG> only
- between the subnets</STRONG>. To test it, you must use pings that go
- from one subnet to the other.</P>
-<P>For example, suppose you have:</P>
-<PRE>      subnet a.b.c.0/24
-             |
-      eth1 = a.b.c.1
-         gate1
-      eth0 = 192.0.2.8
-             |
-
-       ~ internet ~
-
-             |
-      eth0 = 192.0.2.11
-         gate2
-      eth1 = x.y.z.1
-              |
-       subnet x.y.z.0/24</PRE>
-<P>and the connection description:</P>
-<PRE>conn abc-xyz
-     left=192.0.2.8
-     leftsubnet=a.b.c.0/24
-     right=192.0.2.11
-     rightsubnet=x.y.z.0/24</PRE>
-<P>You can test this connection description only by sending a ping that
- will actually go through the tunnel. Assuming you have machines at
- addresses a.b.c.2 and x.y.z.2, pings you might consider trying are:</P>
-<DL>
-<DT>ping from x.y.z.2 to a.b.c.2 or vice versa</DT>
-<DD>Succeeds if tunnel is working. This is the<STRONG> only valid test
- of the tunnel</STRONG>.</DD>
-<DT>ping from gate2 to a.b.c.2 or vice versa</DT>
-<DD><STRONG>Does not use tunnel</STRONG>. gate2 is not on protected
- subnet.</DD>
-<DT>ping from gate1 to x.y.z.2 or vice versa</DT>
-<DD><STRONG>Does not use tunnel</STRONG>. gate1 is not on protected
- subnet.</DD>
-<DT>ping from gate1 to gate2 or vice versa</DT>
-<DD><STRONG>Does not use tunnel</STRONG>. Neither gate is on a protected
- subnet.</DD>
-</DL>
-<P>Only the first of these is a useful test of this tunnel. The others
- do not use the tunnel. Depending on other details of your setup and
- routing, they:</P>
-<UL>
-<LI>either fail, telling you nothing about the tunnel</LI>
-<LI>or succeed, telling you nothing about the tunnel since these packets
- use some other route</LI>
-</UL>
-<P>In some cases, you may be able to get around this. For the example
- network above, you could use:</P>
-<PRE>        ping -I a.b.c.1 x.y.z.1</PRE>
-<P>Both the adresses given are within protected subnets, so this should
- go through the tunnel.</P>
-<P>If required, you can build additional tunnels so that all the
- machines involved can talk to all the others. See<A href="adv_config.html#multitunnel">
- multiple tunnels</A> in the advanced configuration document for
- details.</P>
-<H3><A name="forever">It takes forever to ...</A></H3>
-<P>Users fairly often report various problems involving long delays,
- sometimes on tunnel setup and sometimes on operations done through the
- tunnel, occasionally on simple things like ping or more often on more
- complex operations like doing NFS or Samba through the tunnel.</P>
-<P>Almost always, these turn out to involve failure of a DNS lookup. The
- timeouts waiting for DNS are typically set long so that you won't time
- out when a query involves multiple lookups or long paths. Genuine
- failures therefore produce long delays before they are detected.</P>
-<P>A mailing list message from project technical lead Henry Spencer:</P>
-<PRE>&gt; ... when i run /etc/rc.d/init.d/ipsec start, i get:
-&gt; ipsec_setup: Starting FreeS/WAN IPsec 1.5...
-&gt; and it just sits there, doesn't give back my bash prompt.
-
-Almost certainly, the problem is that you're using DNS names in your
-ipsec.conf, but DNS lookups are not working for some reason.  You will
-get your prompt back... eventually.  But the DNS timeouts are long.
-Doing something about this is on our list, but it is not easy.</PRE>
-<P>In the meanwhile, we recommend that connection descriptions in<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> use numeric IP addresses rather than names which will
- require a DNS lookup.</P>
-<P>Names that do not require a lookup are fine. For example:</P>
-<UL>
-<LI>a road warrior might use the identity<VAR>
- rightid=@lancelot.example.org</VAR></LI>
-<LI>the gateway might use<VAR> leftid=@camelot.example.org</VAR></LI>
-</UL>
-<P>These are fine. The @ sign prevents any DNS lookup. However, do not
- attempt to give the gateway address as<VAR> left=camelot.example.org</VAR>
-. That requires a lookup.</P>
-<P>A post from one user after solving a problem with long delays:</P>
-<PRE>Subject: Final Answer to Delay!!!
-   Date: Mon, 19 Feb 2001
-   From: &quot;Felippe Solutions&quot; &lt;felippe@solutionstecnologia.com.br&gt;
-
-Sorry people, but seems like the Delay problem had nothing to do with
-freeswan.
-
-The problem was DNS as some people sad from the beginning, but not the way
-they thought it was happening. Samba, ssh, telnet and other apps try to
-reverse lookup addresses when you use IP numbers (Stupid that ahh).
-
-I could ping very fast because I always ping with &quot;-n&quot; option, but I don't
-know the option on the other apps to stop reverse addressing so I don't use
-it.</PRE>
-<P>This post is fairly typical. These problems are often tricky and
- frustrating to diagnose, and most turn out to be DNS-related.</P>
-<P>One suggestion for diagnosis: test with both names and addresses if
- possible. For example, try all of:</P>
-<UL>
-<LI>ping<VAR> address</VAR></LI>
-<LI>ping -n<VAR> address</VAR></LI>
-<LI>ping<VAR> name</VAR></LI>
-</UL>
-<P>If these behave differently, the problem must be DNS-related since
- the three commands do exactly the same thing except for DNS lookups.</P>
-<H3><A name="route">I send packets to the tunnel with route(8) but they
- vanish</A></H3>
-<P>IPsec connections are designed to carry only packets travelling
- between pre-defined connection endpoints. As project technical lead
- Henry Spencer put it:</P>
-<BLOCKQUOTE> IPsec tunnels are not just virtual wires; they are virtual
- wires with built-in access controls. Negotiation of an IPsec tunnel
- includes negotiation of access rights for it, which don't include
- packets to/from other IP addresses. (The protocols themselves are quite
- inflexible about this, so there are limits to what we can do about it.)</BLOCKQUOTE>
-<P>For fairly obvious security reasons, and to comply with the IPsec
- RFCs,<A href="glossary.html#KLIPS"> KLIPS</A> drops any packets it
- receives that are not allowed on the tunnels currently defined. So if
- you send it packets with<VAR> route(8)</VAR>, and suitable tunnels are
- not defined, the packets vanish. Whether this is reported in the logs
- depends on the setting of<VAR> klipsdebug</VAR> in your<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> file.</P>
-<P>To rescue vanishing packets, you must ensure that suitable tunnels
- for them exist, by editing the connection descriptions in<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A>. For example, supposing you have a simple setup:</P>
-<PRE>         leftsubnet -- leftgateway === internet === roadwarrior</PRE>
-<P>If you want to give the roadwarrior access to some resource that is
- located behind the left gateway but is not in the currently defined
- left subnet, then the usual procedure is to define an additional tunnel
- for those packets by creating a new connection description.</P>
-<P>In some cases, it may be easier to alter an existing connection
- description, enlarging the definition of<VAR> leftsubnet</VAR>. For
- example, instead of two connection descriptions with 192.168.8.0/24 and
- 192.168.9.0/24 as their<VAR> leftsubnet</VAR> parameters, you can use a
- single description with 192.168.8.0/23.</P>
-<P>If you have multiple endpoints on each side, you need to ensure that
- there is a route for each pair of endpoints. See this<A href="adv_config.html#multitunnel">
- example</A>.</P>
-<H3><A name="down_route">When a tunnel goes down, packets vanish</A></H3>
-<P>This is a special case of the vanishing packet problem described in
- the previous question. Whenever KLIPS sees packets for which it does
- not have a tunnel, it drops them.</P>
-<P>When a tunnel goes away, either because negotiations with the other
- gateway failed or because you gave an<VAR> ipsec auto --down</VAR>
- command, the route to its other end is left pointing into KLIPS, and
- KLIPS will drop packets it has no tunnel for.</P>
-<P>This is a documented design decision, not a bug. FreeS/WAN must not
- automatically adjust things to send packets via another route. The
- other route might be insecure.</P>
-<P>Of course, re-routing may be necessary in many cases. In those cases,
- you have to do it manually or via scripts. We provide the<VAR> ipsec
- auto --unroute</VAR> command for these cases.</P>
-<P>From<A href="manpage.d/ipsec_auto.8.html"> ipsec_auto(8)</A>:</P>
-<BLOCKQUOTE> Normally, pluto establishes a route to the destination
- specified for a connection as part of the --up operation. However, the
- route and only the route can be established with the --route operation.
- Until and unless an actual connection is established, this discards any
- packets sent there, which may be preferable to having them sent
- elsewhere based on a more general route (e.g., a default route).</BLOCKQUOTE><BLOCKQUOTE>
- Normally, pluto's route to a destination remains in place when a --down
- operation is used to take the connection down (or if connection setup,
- or later automatic rekeying, fails). This permits establishing a new
- connection (perhaps using a different specification; the route is
- altered as necessary) without having a ``window'' in which packets
- might go elsewhere based on a more general route. Such a route can be
- removed using the --unroute operation (and is implicitly removed by
- --delete).</BLOCKQUOTE>
-<P>See also this mailing list<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00523.html">
- message</A>.</P>
-<H3><A name="firewall_ate">The firewall ate my packets!</A></H3>
-<P>If firewalls filter out:</P>
-<UL>
-<LI>either the UDP port 500 packets used in IKE negotiations</LI>
-<LI>or the ESP and AH (protocols 50 and 51) packets used to implement
- the IPsec tunnel</LI>
-</UL>
-<P>then IPsec cannot work. The first thing to check if packets seem to
- be vanishing is the firewall rules on the two gateway machines and any
- other machines along the path that you have access to.</P>
-<P>For details, see our document on<A href="firewall.html"> firewalls</A>
-.</P>
-<P>Some advice from technical lead Henry Spencer on diagnosing such
- problems:</P>
-<PRE>&gt; &gt; Packets vanishing between the hardware interface and the ipsecN interface
-&gt; &gt; is usually the result of firewalls not being configured to let them in...
-&gt; 
-&gt; Thanks for the suggestion. If only it were that simple! My ipchains startup
-&gt; script does take care of that, but just in case I manually inserted rules 
-&gt; accepting everything from london on dublin. No difference.
-
-The other thing to check is whether the &quot;RX packets dropped&quot; count on the
-ipsecN interface (run &quot;ifconfig ipsecN&quot;, for N=1 or whatever, to see the
-counts) is rising.  If so, then there's some sort of configuration mismatch
-between the two ends, and IPsec itself is rejecting them.  If none of the
-ipsecN counts is rising, then the packets are never reaching the IPsec
-machinery, and the problem is almost certainly in firewalls etc.</PRE>
-<H3><A name="dropconn">Dropped connections</A></H3>
-<P>Networks being what they are, IPsec connections can be broken for any
- number of reasons, ranging from hardware failures to various software
- problems such as the path MTU problems discussed<A href="#pmtu.broken">
- elsewhere in the FAQ</A>. Fortunately, various diagnostic tools exist
- that help you sort out many of the possible problems.</P>
-<P>There is one situation, however, where FreeS/WAN (using default
- settings) may destroy a connection for no readily apparent reason. This
- occurs when things are<STRONG> misconfigured</STRONG> so that<STRONG>
- two tunnels</STRONG> from the same gateway expect<STRONG> the same
- subnet on the far end</STRONG>.</P>
-<P>In this situation, the first tunnel comes up fine and works until the
- second is established. At that point, because of the way we track
- connections internally, the first tunnel ceases to exist as far as this
- gateway is concerned. Of course the far end does not know that, and a
- storm of error messages appears on both systems as it tries to use the
- tunnel.</P>
-<P>If the far end gives up, goes back to square one and negotiates a new
- tunnel, then that wipes out the second tunnel and ...</P>
-<P>The solution is simple.<STRONG> Do not build multiple conn
- descriptions with the same remote subnet</STRONG>.</P>
-<P>This is actually intended to be a feature, rather than a bug.
- Consider the situation where a single remote system goes down, then
- comes back up and reconnects to the gateway. It is useful to have the
- gateway tear down the old tunnel and recover resources when the
- reconnection is made. It recognises that situation by checking the
- remote subnet for each tunnel it builds and discarding duplicates. This
- works fine as long as you don't configure multiple tunnels with the
- same remote subnet.</P>
-<P>If this behaviour is inconvenient for you, you can disable it by
- setting<VAR> uniqueids=no</VAR> in<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A>.</P>
-<H3><A name="defaultroutegone">Disappearing %defaultroute</A></H3>
-<P>When an underlying connection (eg. ppp) goes down, FreeS/WAN will not
- recover properly without a little help. Here are the symptoms that
- FreeS/WAN user Michael Carmody noticed:</P>
-<PRE>
-&gt; After about 24 hours the freeswan connection takes over the default route.
-&gt; 
-&gt; i.e instead of deafult gateway pointing to the router via eth0, it becomes a 
-&gt; pointer to the router via ipsec0.
- 
-&gt; All internet access is then lost as all replies (and not just the link I 
-&gt; wanted) are routed out ipsec0 and the router doesn't respond to the ipsec 
-&gt; traffic.
-</PRE>
-<P>If you're using a FreeS/WAN 2.x/KLIPS system, simply re-attach the
- IPsec virtual interface with<EM> ipsec tnconfig</EM> command such as:</P>
-<PRE>    ipsec tnconfig --attach --virtual ipsec0 --physical ppp0</PRE>
-<P>In your command, name the physical and virtual interfaces as they
- appear paired on your system during regular uptime. For a system with
- several physical/virtual interface pairs on flaky links, you'll need
- more than one such command. If you're using FreeS/WAN 1.x, you must
- restart FreeS/WAN, which is more time consuming.</P>
-<P><A href="http://lists.freeswan.org/pipermail/design/2002-July/003070.html">
- Here</A> is a script which can help to automate the process of
- FreeS/WAN restart at need. It could easily be adapted to use tnconfig
- instead.</P>
-<H3><A name="tcpdump.faq">TCPdump on the gateway shows strange things</A>
-</H3>
- As another user pointed out, keeping the connect
-<P>Attempting to look at IPsec packets by running monitoring tools on
- the IPsec gateway machine can produce silly results. That machine is
- mangling the packets for IPsec, and possibly for firewall or NAT
- purposes as well. If the internals of the machine's IP stack are not
- what the monitoring tool expects, then the tool can misinterpret them
- and produce nonsense output.</P>
-<P>See our<A href="testing.html#tcpdump.test"> testing</A> document for
- more detail.</P>
-<H3><A name="no_trace">Traceroute does not show anything between the
- gateways</A></H3>
-<P>As far as traceroute can see, the two gateways are one hop apart; the
- data packet goes directly from one to the other through the tunnel. Of
- course the outer packets that implement the tunnel pass through
- whatever lies between the gateways, but those packets are built and
- dismantled by the gateways. Traceroute does not see them and cannot
- report anything about their path.</P>
-<P>Here is a mailing list message with more detail.</P>
-<PRE>Date: Mon, 14 May 2001
-To: linux-ipsec@freeswan.org
-From: &quot;John S. Denker&quot; &lt;jsd@research.att.com&lt;
-Subject: Re: traceroute: one virtual hop
-
-At 02:20 PM 5/14/01 -0400, Claudia Schmeing wrote:
-&gt;
-&gt;&gt; &gt; A bonus question: traceroute in subnet to subnet enviroment looks like:
-&gt;&gt; &gt; 
-&gt;&gt; &gt; traceroute to andris.dmz (172.20.24.10), 30 hops max, 38 byte packets
-&gt;&gt; &gt; 1  drama (172.20.1.1)  0.716 ms  0.942 ms  0.434 ms
-&gt;&gt; &gt; 2  * * *
-&gt;&gt; &gt; 3  andris.dmz (172.20.24.10)  73.576 ms  78.858 ms  79.434 ms
-&gt;&gt; &gt; 
-&gt;&gt; &gt; Why aren't there the other hosts which take part in the delivery during 
-&gt;    * * * ?
-&gt;
-&gt;If there is an ipsec tunnel between GateA and Gate B, this tunnel forms a 
-&gt;'virtual wire'.  When it is tunneled, the original packet becomes an inner 
-&gt;packet, and new ESP and/or AH headers are added to create an outer packet 
-&gt;around it. You can see an example of how this is done for AH at 
-&gt;doc/ipsec.html#AH . For ESP it is similar.
-&gt;
-&gt;Think about the packet's path from the inner packet's perspective.
-&gt;It leaves the subnet, goes into the tunnel, and re-emerges in the second
-&gt;subnet. This perspective is also the only one available to the
-&gt;'traceroute' command when the IPSec tunnel is up.
-
-Claudia got this exactly right.  Let me just expand on a couple of points:
-
-*) GateB is exactly one (virtual) hop away from GateA.  This is how it
-would be if there were a physically private wire from A to B.  The
-virtually private connection should work the same, and it does.
-
-*) While the information is in transit from GateA to GateB, the hop count
-of the outer header (the &quot;envelope&quot;) is being decremented.  The hop count
-of the inner header (the &quot;contents&quot; of the envelope) is not decremented and
-should not be decremented.  The hop count of the outer header is not
-derived from and should not be derived from the hop count of the inner header.
-
-Indeed, even if the packets did time out in transit along the tunnel, there
-would be no way for traceroute to find out what happened.  Just as
-information cannot leak _out_ of the tunnel to the outside, information
-cannot leak _into_ the tunnel from outside, and this includes ICMP messages
-from routers along the path.
-
-There are some cases where one might wish for information about what is
-happening at the IP layer (below the tunnel layer) -- but the protocol
-makes no provision for this.  This raises all sorts of conceptual issues.
-AFAIK nobody has ever cared enough to really figure out what _should_
-happen, let alone implement it and standardize it.
-
-*) I consider the &quot;* * *&quot; to be a slight bug.  One might wish for it to be
-replaced by &quot;GateB GateB GateB&quot;.  It has to do with treating host-to-subnet
-traffic different from subnet-to-subnet traffic (and other gory details).
-I fervently hope KLIPS2 will make this problem go away.
-
-*) If you want to ask questions about the link from GateA to GateB at the
-IP level (below the tunnel level), you have to ssh to GateA and launch a
-traceroute from there.</PRE>
-<H2><A name="man4debug">Testing in stages</A></H2>
-<P>It is often useful in debugging to test things one at a time:</P>
-<UL>
-<LI>disable IPsec entirely, for example by turning it off with
- chkconfig(8), and make sure routing works</LI>
-<LI>Once that works, try a manually keyed connection. This does not
- require key negotiation between Pluto and the key daemon on the other
- end.</LI>
-<LI>Once that works, try automatically keyed connections</LI>
-<LI>Once IPsec works, add packet compression</LI>
-<LI>Once everything seems to work, try stress tests with large
- transfers, many connections, frequent re-keying, ...</LI>
-</UL>
-<P>FreeS/WAN releases are tested for all of these, so you can be
- reasonably certain they<EM> can</EM> do them all. Of course, that does
- not mean they<EM> will</EM> on the first try, especially if you have
- some unusual configuration.</P>
-<P>The rest of this section gives information on diagnosing the problem
- when each of the above steps fails.</P>
-<H3><A name="nomanual">Manually keyed connections don't work</A></H3>
-<P>Suspect one of:</P>
-<UL>
-<LI>mis-configuration of IPsec system in the /etc/ipsec.conf file
-<BR> common errors are incorrect interface or next hop information</LI>
-<LI>mis-configuration of manual connection in the /etc/ipsec.conf file</LI>
-<LI>routing problems causing IPsec packets to be lost</LI>
-<LI>bugs in KLIPS</LI>
-<LI>mismatch between the transforms we support and those another IPsec
- implementation offers.</LI>
-</UL>
-<H3><A name="spi_error">One manual connection works, but second one
- fails</A></H3>
-<P>This is a fairly common problem when attempting to configure multiple
- manually keyed connections from a single gateway.</P>
-<P>Each connection must be identified by a unique<A href="glossary.html#SPI">
- SPI</A> value. For automatic connections, these values are assigned
- automatically. For manual connections, you must set them with<VAR> spi=</VAR>
- statements in<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A>.</P>
-<P>Each manual connection must have a unique SPI value in the range
- 0x100 to 0x999. Two or more with the same value will fail. For details,
- see our doc section<A href="adv_config.html#prodman"> Using manual
- keying in production</A> and the man page<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A>.</P>
-<H3><A name="man_no_auto">Manual connections work, but automatic keying
- doesn't</A></H3>
-<P>The most common reason for this behaviour is a firewall dropping the
- UDP port 500 packets used in key negotiation.</P>
-<P>Other possibilities:</P>
-<UL>
-<LI>mis-configuration of auto connection in the /etc/ipsec.conf file.
-<P>One common configuration error is forgetting that you need<VAR>
- auto=add</VAR> to load the connection description on the receiving end
- so it recognises the connection when the other end asks for it.</P>
-</LI>
-<LI>error in shared secret in /etc/ipsec.secrets</LI>
-<LI>one gateway lacks a route to the other so Pluto's UDP packets are
- lost</LI>
-<LI>bugs in Pluto</LI>
-<LI>incompatibilities between Pluto's<A href="glossary.html#IKE"> IKE</A>
- implementation and the IKE at the other end of the tunnel.
-<P>Some possibile problems are discussed in out<A href="interop.html#interop.problem">
- interoperation</A> document.</P>
-</LI>
-</UL>
-<H3><A name="nocomp">IPsec works, but connections using compression fail</A>
-</H3>
-<P>When we first added compression, we saw some problems:</P>
-<UL>
-<LI>compatibility issues with other implementations. We followed the
- RFCs and omitted some extra material that many compression libraries
- add by default. Some other implementations left the extras in</LI>
-<LI>bugs in assembler compression routines on non-Intel CPUs. The
- workaround is to use C code instead of possibly problematic assembler.</LI>
-</UL>
-<P>We have not seen either problem in some time (at least six months as
- I write in March 2002), but if you have some unusual configuration then
- you may see them.</P>
-<H3><A name="pmtu.broken">Small packets work, but large transfers fail</A>
-</H3>
-<P>If tests with ping(1) and a small packet size succeed, but tests or
- transfers with larger packet sizes fail, suspect problems with packet
- fragmentation and perhaps<A href="glossary.html#pathMTU"> path MTU
- discovery</A>.</P>
-<P>Our<A href="trouble.html#bigpacket"> troubleshooting document</A>
- covers these problems. Information on the underlying mechanism is in
- our<A href="background.html#MTU.trouble"> background</A> document.</P>
-<H3><A name="subsub">Subnet-to-subnet works, but tests from the gateways
- don't</A></H3>
-<P>This is described under<A href="#cantping"> I cannot ping...</A>
- above.</P>
-<H2><A name="compile.faq">Compilation problems</A></H2>
-<H3><A name="gmp.h_missing">gmp.h: No such file or directory</A></H3>
-<P>Pluto needs the GMP (<STRONG>G</STRONG>NU</P>
-<P><STRONG>M</STRONG>ulti-<STRONG>P</STRONG>recision) library for the
- large integer calculations it uses in<A href="glossary.html#public">
- public key</A> cryptography. This error message indicates a failure to
- find the library. You must install it before Pluto will compile.</P>
-<P>The GMP library is included in most Linux distributions. Typically,
- there are two RPMs, libgmp and libgmp-devel, You need to<EM> install
- both</EM>, either from your distribution CDs or from your vendor's web
- site.</P>
-<P>On Debian, a mailing list message reports that the command to give is<VAR>
- apt-get install gmp2</VAR>.</P>
-<P>For more information and the latest version, see the<A href="http://www.swox.com/gmp/">
- GMP home page</A>.</P>
-<H3><A name="noVM">... virtual memory exhausted</A></H3>
-<P>We have had several reports of this message appearing, all on SPARC
- Linux. Here is a mailing message on a solution:</P>
-<PRE>&gt; ipsec_sha1.c: In function `SHA1Transform':
-&gt; ipsec_sha1.c:95: virtual memory exhausted
-
-I'm seeing exactly the same problem on an Ultra with 256MB ram and 500
-MB swap.  Except I am compiling version 1.5 and its Red Hat 6.2.
-
-I can get around this by using -O instead of -O2 for the optimization
-level.  So it is probably a bug in the optimizer on the sparc complier. 
-I'll try and chase this down on the sparc lists.</PRE>
-<H2><A name="error">Interpreting error messages</A></H2>
-<H3><A name="route-client">route-client (or host) exited with status 7</A>
-</H3>
-<P>Here is a discussion of this error from FreeS/WAN &quot;listress&quot; (mailing
- list tech support person) Claudia Schmeing. The &quot;FAQ on the network
- unreachable error&quot; which she refers to is the next question below.</P>
-<PRE>&gt; I reached the point where the two boxes (both on dial-up connections, but
-&gt; treated as static IPs by getting the IP and editing ipsec.conf after the
-&gt; connection is established) to the point where they exchange some info, but I
-&gt; get an error like &quot;route-client command exited with status 7 \n internal
-&gt; error&quot;.
-&gt; Where can I find a description of this error?
-
-In general, if the FAQ doesn't cover it, you can search the mailing list 
-archives - I like to use
-http://www.sandelman.ottawa.on.ca/linux-ipsec/
-but you can see doc/mail.html for different archive formats.
-
-
-Your error comes from the _updown script, which performs some
-routing and firewall functions to help Linux FreeS/WAN. More info
-is available at doc/firewall.html and man ipsec.conf. Its routing
-is integral to the health of Linux FreeS/WAN; it also provides facility
-to insert custom firewall rules to be executed when you create or destroy
-a connection.
-
-Yours is, of course, a routing error. You can be fairly sure the routing 
-machinery is saying &quot;network is unreachable&quot;. There's a FAQ on the 
-&quot;network is unreachable&quot; error, but more information is available now; read on.
-
-If your _updown script is recent (for example if it shipped with 
-Linux FreeS/WAN 1.91), you will see another debugging line in your logs 
-that looks something like this:
-
-&gt; output: /usr/local/lib/ipsec/_updown: `route add -net 128.174.253.83 
-&gt; netmask 255.255.255.255 dev ipsec0 gw 66.92.93.161' failed
-
-This is, of course, the system route command that exited with status 7, 
-(ie. failed). Man route for details. Seeing the command typed out yields 
-more information. If your _updown script is older, you may wish to update 
-it to show the command explicitly.
-
-Three parameters fed to the route command: net, netmask and gw [gateway] 
-are derived from things you've put in ipsec.conf.
-
-Net and netmask are derived from the peer's IP and mask. In more detail:
-
-You may see a routing error when routing to a client (ie. subnet), or 
-to a host (IPSec gateway or freestanding host; a box that does IPSec for
-itself). In _updown, the &quot;route-client&quot; section  is responsible to set up 
-the route for IPSec'd (usually, read 'tunneled') packets headed to a 
-peer subnet. Similarly, route-host routes IPSec'd packets to a peer host
-or IPSec gateway.
-
-When routing to a 'client', net and netmask are ipsec.conf's left- or 
-rightsubnet (whichever is not local). Similarly, when routing to a 
-'host' the net is left or right. Host netmask is always /32, indicating a 
-single machine.
-
-Gw is nexthop's value. Again, the value in question is left- or rightnexthop,
-whichever is local. Where left/right or left-/rightnexthop has the special 
-value %defaultroute (described in man ipsec.conf), gw will automagically get
-the value of the next hop on the default route.
-
-Q: &quot;What's a nexthop and why do I need one?&quot;
-
-A: 'nexthop' is a routing kluge; its value is the next hop away
-   from the machine that's doing IPSec, and toward your IPSec peer. 
-   You need it to get the processed packets out of the local system and 
-   onto the wire. While we often route other packets through the machine 
-   that's now doing IPSec, and are done with it, this does not suffice here. 
-   After packets are processed with IPSec, this machine needs to know where 
-   they go next. Of course using the 'IPSec gateway' as their routing gateway 
-   would cause an infinite loop! [To visualize this, see the packet flow 
-   diagram at doc/firewall.html.] To avoid this, we route packets through 
-   the next hop down their projected path.
-
-Now that you know the background, consider:
-1. Did you test routing between the gateways in the absence of Linux
-   FreeS/WAN, as recommended? You need to ensure the two machines that
-   will be running Linux FreeS/WAN can route to one another before trying to 
-   make a secure connection.
-2. Is there anything obviously wrong with the sense of your route command?
-
-Normally, this problem is caused by an incorrect local nexthop parameter.
-Check out the use of %defaultroute, described in man ipsec.conf. This is
-a simple way to set nexthop for most people. To figure nexthop out by hand,
-traceroute in-the-clear to your IPSec peer. Nexthop is the traceroute's 
-first hop after your IPSec gateway.</PRE>
-<H3><A name="unreachable">SIOCADDRT:Network is unreachable</A></H3>
-<P>This message is not from FreeS/WAN, but from the Linux IP stack
- itself. That stack is seeing packets it has no route for, either
- because your routing was broken before FreeS/WAN started or because
- FreeS/WAN's changes broke it.</P>
-<P>Here is a message from Claudia suggesting ways to diagnose and fix
- such problems:</P>
-<PRE>You write,
-&gt; I have correctly installed freeswan-1.8 on RH7.0 kernel 2.2.17, but when 
-&gt; I setup a VPN connection with the other machine(RH5.2 Kernel 2.0.36 
-&gt; freeswan-1.0, it works well.) it told me that 
-&gt; &quot;SIOCADDRT:Network is unreachable&quot;!  But the network connection is no 
-&gt; problem.
-
-Often this error is the result of a misconfiguration. 
-
-Be sure that you can route successfully in the absence of Linux
-FreeS/WAN. (You say this is no problem, so proceed to the next step.)
-
-Use a custom copy of the default updownscript. Do not change the route 
-commands, but add a diagnostic message revealing the exact text of the 
-route command. Is there a problem with the sense of the route command
-that you can see? If so, then re-examine those ipsec.conf settings
-that are being sent to the route command. 
-
-You may wish to use the ipsec auto --route and --unroute commands to 
-troubleshoot the problem. See man ipsec_auto for details.</PRE>
-<P>Since the above message was written, we have modified the updown
- script to provide a better diagnostic for this problem. Check<VAR>
- /var/log/messages</VAR>.</P>
-<P>See also the FAQ question<A href="#route-client"> route-client (or
- host) exited with status 7</A>.</P>
-<H3><A name="modprobe">ipsec_setup: modprobe: Can't locate module ipsec</A>
-</H3>
-<H3><A name="noKLIPS">ipsec_setup: Fatal error, kernel appears to lack
- KLIPS</A></H3>
-<P>These messages indicate an installation failure. The kernel you are
- running does not contain the<A href="glossary.html#KLIPS"> KLIPS
- (kernel IPsec)</A> code.</P>
-<P>Note that the &quot;modprobe: Can't locate module ipsec&quot; message appears
- even if you are not using modules. If there is no KLIPS in your kernel,
- FreeS/WAN tries to load it as a module. If that fails, you get this
- message.</P>
-<P>Commands you can quickly try are:</P>
-<DL>
-<DT><VAR>uname -a</VAR></DT>
-<DD>to get details, including compilation date and time, of the
- currently running kernel</DD>
-<DT><VAR>ls /</VAR></DT>
-<DT><VAR>ls /boot</VAR></DT>
-<DD>to ensure a new kernel is where it should be. If kernel compilation
- puts it in<VAR> /</VAR> but<VAR> lilo</VAR> wants it in<VAR> /boot</VAR>
-, then you should uncomment the<VAR> INSTALL_PATH=/boot</VAR> line in
- the kernel<VAR> Makefile</VAR>.</DD>
-<DT><VAR>more /etc/lilo.conf</VAR></DT>
-<DD>to see that<VAR> lilo</VAR> has correct information</DD>
-<DT><VAR>lilo</VAR></DT>
-<DD>to ensure that information in<VAR> /etc/lilo.conf</VAR> has been
- transferred to the boot sector</DD>
-</DL>
-<P>If those don't find the problem, you have to go back and check
- through the<A href="install.html"> install</A> procedure to see what
- was missed.</P>
-<P>Here is one of Claudia's messages on the topic:</P>
-<PRE>&gt; I tried to install freeswan 1.8 on my mandrake 7.2 test box. ...
-
-&gt; It does show version and some output for whack.
-
-Yes, because the Pluto (daemon) part of ipsec is installed correctly, but
-as we see below the kernel portion is not.
-
-&gt; However, I get the following from /var/log/messages:
-&gt; 
-&gt; Mar 11 22:11:55 pavillion ipsec_setup: Starting FreeS/WAN IPsec 1.8...
-&gt; Mar 11 22:12:02 pavillion ipsec_setup: modprobe: Can't locate module ipsec
-&gt; Mar 11 22:12:02 pavillion ipsec_setup: Fatal error, kernel appears to lack
-&gt; KLIPS.
-
-This is your problem. You have not successfully installed a kernel with
-IPSec machinery in it. 
-
-Did you build Linux FreeS/WAN as a module? If so, you need to ensure that 
-your new module has been installed in the directory where your kernel 
-loader normally finds your modules. If not, you need to ensure
-that the new IPSec-enabled kernel is being loaded correctly.
-
-See also doc/install.html, and INSTALL in the distro.</PRE>
-<H3><A name="noDNS">ipsec_setup: ... failure to fetch key for ... from
- DNS</A></H3>
-<P>Quoting Henry:</P>
-<PRE>Note that by default, FreeS/WAN is now set up to
-     (a) authenticate with RSA keys, and
-     (b) fetch the public key of the far end from DNS.
-Explicit attention to  ipsec.conf will be needed if you want
-to do something different.</PRE>
-<P>and Claudia, responding to the same user:</P>
-<PRE>You write,
-
-&gt;       My current setup in ipsec.conf is leftrsasigkey=%dns I have 
-&gt; commented this and authby=rsasig out. I am able to get ipsec running, 
-&gt; but what I find is that the documentation only specifies for %dns are 
-&gt; there any other values that can be placed in this variable other than 
-&gt; %dns and the key? I am also assuming that this is where I would place 
-&gt; my public key for the left and right side as well is this correct?
-
-Valid values for authby= are rsasig and secret, which entail authentication
-by RSA signature or by shared secret, respectively. Because you have 
-commented authby=rsasig out, you are using the default value of authby=secret. 
-
-When using RSA signatures, there are two ways to get the public key for the
-IPSec peer: either copy it directly into *rsasigkey= in ipsec.conf, or
-fetch it from dns. The magic value %dns for *rsasigkey parameters says to 
-try to fetch the peer's key from dns.
-
-For any parameters, you may find their significance and special values in
-man ipsec.conf. If you are setting up keys or secrets, be sure also to
-reference man ipsec.secrets.</PRE>
-<H3><A name="dup_address">ipsec_setup: ... interfaces ... and ... share
- address ...</A></H3>
-<P>This is a fatal error. FreeS/WAN cannot cope with two or more
- interfaces using the same IP address. You must re-configure to avoid
- this.</P>
-<P>A mailing list message on the topic from Pluto developer Hugh
- Redelmeier:</P>
-<PRE>| I'm trying to get freeswan working between two machine where one has a ppp
-| interface.
-| I've already suceeded with  two machines with ethernet ports but  the ppp
-| interface is causing me problems.
-|  basically when I run ipsec start  i get
-| ipsec_setup: Starting FreeS/WAN IPsec 1.7...
-| ipsec_setup: 003 IP interfaces ppp1 and ppp0 share address 192.168.0.10!
-| ipsec_setup: 003 IP interfaces ppp1 and ppp2 share address 192.168.0.10!
-| ipsec_setup: 003 IP interfaces ppp0 and ppp2 share address 192.168.0.10!
-| ipsec_setup: 003 no public interfaces found
-|
-| followed by lots of cannot work out interface for connection messages
-|
-| now I can specify the interface in ipsec.conf to be ppp0 , but this does
-| not affect the above behaviour. A quick look in server.c indicates that the
-| interfaces value  is not used but some sort of raw detect happens.
-|
-| I guess I could prevent the formation of the extra ppp interfaces or
-| allocate them different ip but I'd  rather not. if at all possible. Any
-| suggestions please.
-
-Pluto won't touch an interface that shares an IP address with another.
-This will eventually change, but it probably won't happen soon.
-
-For now, you will have to give the ppp1 and ppp2 different addresses.</PRE>
-<H3><A name="kflags">ipsec_setup: Cannot adjust kernel flags</A></H3>
-<P>A mailing list message form technical lead Henry Spencer:</P>
-<PRE>&gt; When FreeS/WAN IPsec 1.7 is starting on my 2.0.38 Linux kernel the following
-&gt; error message is generated:
-&gt; ipsec_setup: Cannot adjust kernel flags, no /proc/sys/net/ipsec directory!
-&gt; What is supposed to create this directory and how can I fix this problem?
-
-I think that directory is a 2.2ism, although I'm not certain (I don't have
-a 2.0.xx system handy any more for testing).  Without it, some of the
-ipsec.conf config-setup flags won't work, but otherwise things should
-function. </PRE>
-<P>You also need to enable the<VAR> /proc</VAR> filesystem in your
- kernel configuration for these operations to work.</P>
-<H3><A name="message_num">Message numbers (MI3, QR1, et cetera) in Pluto
- messages</A></H3>
-<P>Pluto messages often indicate where Pluto is in the IKE protocols.
- The letters indicate<STRONG> M</STRONG>ain mode or<STRONG> Q</STRONG>
-uick mode and<STRONG> I</STRONG>nitiator or<STRONG> R</STRONG>esponder.
- The numerals are message sequence numbers. For more detail, see our<A href="ipsec.html#sequence">
- IPsec section</A>.</P>
-<H3><A name="conn_name">Connection names in Pluto error messages</A></H3>
-<P>From Pluto programmer Hugh Redelmeier:</P>
-<PRE>| Jan 17 16:21:10 remus Pluto[13631]: &quot;jumble&quot; #1: responding to Main Mode from Road Warrior 130.205.82.46
-| Jan 17 16:21:11 remus Pluto[13631]: &quot;jumble&quot; #1: no suitable connection for peer @banshee.wittsend.com
-| 
-|     The connection &quot;jumble&quot; has nothing to do with the incoming
-| connection requests, which were meant for the connection &quot;banshee&quot;.
-
-You are right.  The message tells you which Connection Pluto is
-currently using, which need not be the right one.  It need not be the
-right one now for the negotiation to eventually succeed!  This is
-described in ipsec_pluto(8) in the section &quot;Road Warrior Support&quot;.
-
-There are two times when Pluto will consider switching Connections for
-a state object.  Both are in response to receiving ID payloads (one in
-Phase 1 / Main Mode and one in Phase 2 / Quick Mode).  The second is
-not unique to Road Warriors.  In fact, neither is the first any more
-(two connections for the same pair of hosts could differ in Phase 1 ID
-payload; probably nobody else has tried this).</PRE>
-<H3><A name="cantorient">Pluto: ... can't orient connection</A></H3>
-<P>Older versions of FreeS/WAN used this message. The same error now
- gives the &quot;we have no ipsecN ...&quot; error described just below.</P>
-<H3><A name="no.interface">... we have no ipsecN interface for either
- end of this connection</A></H3>
-<P>Your tunnel has no IP address which matches the IP address of any of
- the available IPsec interfaces. Either you've misconfigured the
- connection, or you need to define an appropriate IPsec interface
- connection.<VAR> interfaces=%defaultroute</VAR> works in many cases.</P>
-<P>A longer story: Pluto needs to know whether it is running on the
- machine which the connection description calls<VAR> left</VAR> or on<VAR>
- right</VAR>. It figures that out by:</P>
-<UL>
-<LI>looking at the interfaces given in<VAR> interfaces=</VAR> lines in
- the<VAR> config setup</VAR> section</LI>
-<LI>discovering the IP addresses for those interfaces</LI>
-<LI>searching for a match between those addresses and the ones given in<VAR>
- left=</VAR> or<VAR> right=</VAR> lines.</LI>
-</UL>
-<P>Normally a match is found. Then Pluto knows where it is and can set
- up other things (for example, if it is<VAR> left</VAR>) using
- parameters such as<VAR> leftsubnet</VAR> and<VAR> leftnexthop</VAR>,
- and sending its outgoing packets to<VAR> right</VAR>.</P>
-<P>If no match is found, it emits the above error message.</P>
-<H3><A name="noconn">Pluto: ... no connection is known</A></H3>
-<P>This error message occurs when a remote system attempts to negotiate
- a connection and Pluto does not have a connection description that
- matches what the remote system has requested. The most common cause is
- a configuration error on one end or the other.</P>
-<P>Parameters involved in this match are<VAR> left</VAR>,<VAR> right</VAR>
-,<VAR> leftsubnet</VAR> and<VAR> rightsubnet</VAR>.</P>
-<P><STRONG>The match must be exact</STRONG>. For example, if your left
- subnet is a.b.c.0/24 then neither a single machine in that net nor a
- smaller subnet such as a.b.c.64/26 will be considered a match.</P>
-<P>The message can also occur when an appropriate description exists but
- Pluto has not loaded it. Use an<VAR> auto=add</VAR> statement in the
- connection description, or an<VAR> ipsec auto --add &lt;conn_name&gt;</VAR>
- command, to correct this.</P>
-<P>An explanation from the Pluto developer:</P>
-<PRE>| Jul 12 15:00:22 sohar58 Pluto[574]: &quot;corp_road&quot; #2: cannot respond to IPsec
-| SA request because no connection is known for
-| 216.112.83.112/32===216.112.83.112...216.67.25.118
-
-This is the first message from the Pluto log showing a problem.  It
-means that PGPnet is trying to negotiate a set of SAs with this
-topology:
-
-216.112.83.112/32===216.112.83.112...216.67.25.118
-^^^^^^^^^^^^^^^^^   ^^^^^^^^^^^^^^   ^^^^^^^^^^^^^
-client on our side  our host         PGPnet host, no client
-
-None of the conns you showed look like this.
-
-Use
-        ipsec auto --status
-to see a snapshot of what connections are in pluto, what
-negotiations are going on, and what SAs are established.
-
-The leftsubnet= (client) in your conn is 216.112.83.64/26.  It must
-exactly match what pluto is looking for, and it does not.</PRE>
-<H3><A name="nosuit">Pluto: ... no suitable connection ...</A></H3>
-<P>This is similar to the<A href="#noconn"> no connection known</A>
- error, but occurs at a different point in Pluto processing.</P>
-<P>Here is one of Claudia's messages explaining the problem:</P>
-<PRE>You write,
-
-&gt; What could be the reason of the following error? 
-&gt; &quot;no suitable connection for peer '@xforce'&quot;
-
-When a connection is initiated by the peer, Pluto must choose which entry in 
-the conf file best matches the incoming connection. A preliminary choice is 
-made on the basis of source and destination IPs, since that information is 
-available at that time. 
-
-A payload containing an ID arrives later in the negotiation. Based on this
-id and the *id= parameters, Pluto refines its conn selection. ...
-
-The message &quot;no suitable connection&quot; indicates that in this refining step,
-Pluto does not find a connection that matches that ID.
-
-Please see &quot;Selecting a connection when responding&quot; in man ipsec_pluto for
-more details.</PRE>
-<P>See also<A href="#conn_name"> Connection names in Pluto error
- messages</A>.</P>
-<H3><A name="noconn.auth">Pluto: ... no connection has been authorized</A>
-</H3>
-<P>Here is one of Claudia's messages discussing this problem:</P>
-<PRE>You write,
-
-&gt;  May 22 10:46:31 debian Pluto[25834]: packet from x.y.z.p:10014: 
-&gt;  initial Main Mode message from x.y.z.p:10014 
-                            but no connection has been authorized
-
-This error occurs early in the connection negotiation process,
-at the first step of IKE negotiation (Main Mode), which is itself the 
-first of two negotiation phases involved in creating an IPSec connection.
-
-Here, Linux FreeS/WAN receives a packet from a potential peer, which 
-requests that they begin discussing a connection.
-
-The &quot;no connection has been authorized&quot; means that there is no connection 
-description in Linux FreeS/WAN's internal database that can be used to 
-link your ipsec interface with that peer.
-
-&quot;But of course I configured that connection!&quot; 
-
-It may be that the appropriate connection description exists in ipsec.conf 
-but has not been added to the database with ipsec auto --add myconn or the 
-auto=add method. Or, the connection description may be misconfigured.
-
-The only parameters that are relevant in this decision are left= and right= .
-Local and remote ports are also taken into account -- we see that the port 
-is printed in the message above -- but there is no way to control these
-in ipsec.conf.
-
-
-Failure at &quot;no connection has been authorized&quot; is similar to the
-&quot;no connection is known for...&quot; error in the FAQ, and the &quot;no suitable
-connection&quot; error described in the snapshot's FAQ. In all three cases,
-Linux FreeS/WAN is trying to match parameters received in the
-negotiation with the connection description in the local config file.
-
-As it receives more information, its matches take more parameters into 
-account, and become more precise:  first the pair of potential peers,
-then the peer IDs, then the endpoints (including any subnets).
-
-The &quot;no suitable connection for peer *&quot; occurs toward the end of IKE 
-(Main Mode) negotiation, when the IDs are matched.
-
-&quot;no connection is known for a/b===c...d&quot; is seen at the beginning of IPSec 
-(Quick Mode, phase 2) negotiation, when the connections are matched using
-left, right, and any information about the subnets.</PRE>
-<H3><A name="noDESsupport">Pluto: ... OAKLEY_DES_CBC is not supported.</A>
-</H3>
-<P>This message occurs when the other system attempts to negotiate a
- connection using<A href="glossary.html#DES"> single DES</A>, which we
- do not support because it is<A href="politics.html#desnotsecure">
- insecure</A>.</P>
-<P>Our interoperation document has suggestions for<A href="interop.html#noDES">
- how to deal with</A> systems that attempt to use single DES.</P>
-<H3><A name="notransform">Pluto: ... no acceptable transform</A></H3>
-<P>This message means that the other gateway has made a proposal for
- connection parameters, but nothing they proposed is acceptable to
- Pluto. Possible causes include:</P>
-<UL>
-<LI>misconfiguration on either end</LI>
-<LI>policy incompatibilities, for example we require encrypted
- connections but they are trying to create one with just authentication</LI>
-<LI>interoperation problems, for example they offer only single DES and
- FreeS/WAN does not support that. See<A href="interop.html#interop.problem">
- discussion</A> in our interoperation document.</LI>
-</UL>
-<P>A more detailed explanation, from Pluto programmer Hugh Redelmeier:</P>
-<PRE>Background:
-
-When one IKE system (for example, Pluto) is negotiating with another
-to create an SA, the Initiator proposes a bunch of choices and the
-Responder replies with one that it has selected.
-
-The structure of the choices is fairly complicated.  An SA payload
-contains a list of lists of &quot;Proposals&quot;.  The outer list is a set of
-choices: the selection must be from one element of this list.
-
-Each of these elements is a list of Proposals.  A selection must be
-made from each of the elements of the inner list.  In other words,
-*all* of them apply (that is how, for example, both AH and ESP can
-apply at once).
-
-Within each of these Proposals is a list of Transforms.  For each
-Proposal selected, one Transform must be selected (in other words,
-each Proposal provides a choice of Transforms).
-
-Each Transform is made up of a list of Attributes describing, well,
-attributes.  Such as lifetime of the SA.  Such as algorithm to be
-used.  All the Attributes apply to a Transform.
-
-You will have noticed a pattern here: layers alternate between being
-disjunctions (&quot;or&quot;) and conjunctions (&quot;and&quot;).
-
-For Phase 1 / Main Mode (negotiating an ISAKMP SA), this structure is
-cut back.  There must be exactly one Proposal.  So this degenerates to
-a list of Transforms, one of which must be chosen.
-
-In your case, no proposal was considered acceptable to Pluto (the
-Responder).  So negotiation ceased.  Pluto logs the reason it rejects
-each Transform.  So look back in the log to see what is going wrong.</PRE>
-<H3><A name="rsasigkey">rsasigkey dumps core</A></H3>
- A comment on this error from Henry:
-<PRE>On Fri, 29 Jun 2001, Rodrigo Gruppelli wrote:
-&gt; ...Well, it seem that there's
-&gt; another problem with it. When I try to generate a pair of RSA keys,
-&gt; rsasigkey cores dump...
-
-*That* is a neon sign flashing &quot;GMP LIBRARY IS BROKEN&quot;.  Rsasigkey calls
-GMP a lot, and our own library a little bit, and that's very nearly all it
-does.  Barring bugs in its code or our library -- which have happened, but
-not very often -- a problem in rsasigkey is a problem in GMP.</PRE>
-<P>See the next question for how to deal with GMP errors.</P>
-<H3><A name="sig4">!Pluto failure!: ... exited with ... signal 4</A></H3>
-<P>Pluto has died. Signal 4 is SIGILL, illegal instruction.</P>
-<P>The most likely cause is that your<A href="glossary.html#GMP"> GMP</A>
- (GNU multi-precision) library is compiled for a different processor
- than what you are running on. Pluto uses that library for its public
- key calculations.</P>
-<P>Try getting the GMP sources and recompile for your processor type.
- Most Linux distributions will include this source, or you can download
- it from the<A href="http://www.swox.com/gmp/"> GMP home page</A>.</P>
-<H3><A name="econnrefused">ECONNREFUSED error message</A></H3>
-<P>From John Denker, on the mailing list:</P>
-<PRE>1)  The log message
-  some IKE message we sent has been rejected with 
-  ECONNREFUSED (kernel supplied no details)
-is much more suitable than the previous version.  Thanks.
-
-2) Minor suggestion for further improvement: it might be worth mentioning
-that the command
-  tcpdump -i eth1 icmp[0] != 8 and icmp[0] != 0
-is useful for tracking down the details in question.  We shouldn't expect
-all IPsec users to figure that out on their own.  The log message might
-even provide a hint as to where to look in the docs.</PRE>
-<P>Reply From Pluto developer Hugh Redelmeier</P>
-<PRE>Good idea.
-
-I've added a bit pluto(8)'s BUGS section along these lines.
-I didn't have the heart to lengthen this message.</PRE>
-<H3><A name="no_eroute">klips_debug: ... no eroute!</A></H3>
-<P>This message means<A href="glossary.html#KLIPS"> KLIPS</A> has
- received a packet for which no IPsec tunnel has been defined.</P>
-<P>Here is a more detailed duscussion from the team's tech support
- person Claudia Schmeing, responding to a query on the mailing list:</P>
-<PRE>&gt; Why ipsec reports no eroute! ???? IP Masq... is disabled.
-
-In general, more information is required so that people on the list may
-give you informed input. See doc/prob.report.</PRE>
-<P>The document she refers to has since been replaced by a<A href="trouble.html#prob.report">
- section</A> of the troubleshooting document.</P>
-<PRE>However, I can make some general comments on this type of error.
-
-This error usually looks something like this (clipped from an archived
-message):
-
-&gt; ttl:64 proto:1 chk:45459 saddr:192.168.1.2 daddr:192.168.100.1
-&gt; ... klips_debug:ipsec_findroute: 192.168.1.2-&gt;192.168.100.1
-&gt; ... klips_debug:rj_match: * See if we match exactly as a host destination
-&gt; ... klips_debug:rj_match: ** try to match a leaf, t=0xc1a260b0
-&gt; ... klips_debug:rj_match: *** start searching up the tree, t=0xc1a260b0
-&gt; ... klips_debug:rj_match: **** t=0xc1a260c8
-&gt; ... klips_debug:rj_match: **** t=0xc1fe5960
-&gt; ... klips_debug:rj_match: ***** not found.
-&gt; ... klips_debug:ipsec_tunnel_start_xmit: Original head/tailroom: 2, 28
-&gt; ... klips_debug:ipsec_tunnel_start_xmit: no eroute!: ts=47.3030, dropping.
-
-
-What does this mean?
-- --------------------
-
-&quot;eroute&quot; stands for &quot;extended route&quot;, and is a special type of route 
-internal to Linux FreeS/WAN. For more information about this type of route, 
-see the section of man ipsec_auto on ipsec auto --route.
-
-&quot;no eroute!&quot; here means, roughly, that Linux FreeS/WAN cannot find an 
-appropriate tunnel that should have delivered this packet. Linux 
-FreeS/WAN therefore drops the packet, with the message &quot;no eroute! ...
-dropping&quot;, on the assumption that this packet is not a legitimate 
-transmission through a properly constructed tunnel.
-
-
-How does this situation come about?
-- -----------------------------------
-
-Linux FreeS/WAN has a number of connection descriptions defined in 
-ipsec.conf. These must be successfully brought &quot;up&quot; to form actual tunnels.
-(see doc/setup.html's step 15, man ipsec.conf and man ipsec_auto 
-for details).
-
-Such connections are often specific to the endpoints' IPs. However, in 
-some cases they may be more general, for example in the case of 
-Road Warriors where left or right is the special value %any.
-
-When Linux FreeS/WAN receives a packet, it verifies that the packet has
-come through a legitimate channel, by checking that there is an
-appropriate tunnel through which this packet might legitimately have
-arrived. This is the process we see above.
-
-First, it checks for an eroute that exactly matches the packet. In the 
-example above, we see it checking for a route that begins at 192.168.1.2
-and ends at 192.168.100.1. This search favours the most specific match that
-would apply to the route between these IPs. So, if there is a connection 
-description exactly matching these IPs, the search will end there. If not, 
-the code will search for a more general description matching the IPs.
-If there is no match, either specific or general, the packet will be
-dropped, as we see, above.
-
-Unless you are working with Road Warriors, only the first, specific part 
-of the matching process is likely to be relevant to you.
-
-
-&quot;But I defined the tunnel, and it came up, why do I have this error?&quot;
-- ---------------------------------------------------------------------
-
-One of the most common causes of this error is failure to specify enough
-connection descriptions to cover all needed tunnels between any two 
-gateways and their respective subnets. As you have noticed, troubleshooting
-this error may be complicated by the use of IP Masq. However, this error is
-not limited to cases where IP Masq is used. 
-
-See doc/configuration.html#multitunnel for a detailed example of the 
-solution to this type of problem.</PRE>
-<P>The documentation section she refers to is now<A href="adv_config.html#multitunnel">
- here</A>.</P>
-<H3><A name="SAused">... trouble writing to /dev/ipsec ... SA already in
- use</A></H3>
-<P>This error message occurs when two manual connections are set up with
- the same SPI value.</P>
-<P>See the FAQ for<A href="#spi_error"> One manual connection works, but
- second one fails</A>.</P>
-<H3><A name="ignore">... ignoring ... payload</A></H3>
-<P>This message is harmless. The IKE protocol provides for a number of
- optional messages types:</P>
-<UL>
-<LI>delete SA</LI>
-<LI>initial contact</LI>
-<LI>vendor ID</LI>
-<LI>...</LI>
-</UL>
-<P>An implementation is never required to send these, but they are
- allowed to. The receiver is not required to do anything with them.
- FreeS/WAN ignores them, but notifies you via the logs.</P>
-<P>For the &quot;ignoring delete SA Payload&quot; message, see also our discussion
- of cleaning up<A href="#deadtunnel"> dead tunnels</A>.</P>
-<H3><A name="unknown_rightcert">unknown parameter name &quot;rightcert&quot;</A></H3>
-<P>This message can appear when you've upgraded an X.509-enabled Linux
- FreeS/WAN with a vanilla Linux FreeS/WAN. To use your X.509 configs you
- will need to overwrite the new install with<A HREF="http://www.freeswan.ca">
- Super FreeS/WAN</A>, or add the<A HREF="http://www.strongsec.ca/freeswan">
- X.509 patch</A> by hand.</P>
-<H2><A name="spam">Why don't you restrict the mailing lists to reduce
- spam?</A></H2>
-<P>As a matter of policy, some of our<A href="mail.html"> mailing lists</A>
- need to be open to non-subscribers. Project management feel strongly
- that maintaining this openness is more important than blocking spam.</P>
-<UL>
-<LI>Users should be able to get help or report bugs without subscribing.</LI>
-<LI>Even a user who is subscribed may not have access to his or her
- subscribed account when he or she needs help, miles from home base in
- the middle of setting up a client's gateway.</LI>
-<LI>There is arguably a legal requirement for this policy. A US resident
- or citizen could be charged under munitions export laws for providing
- technical assistance to a foreign cryptographic project. Such a charge
- would be more easily defended if the discussion takes place in public,
- on an open list.</LI>
-</UL>
-<P>This has been discussed several times at some length on the list. See
- the<A href="mail.html#archive"> list archives</A>. Bringing the topic
- up again is unlikely to be useful. Please don't. Or at the very least,
- please don't without reading the archives and being certain that
- whatever you are about to suggest has not yet been discussed.</P>
-<P>Project technical lead Henry Spencer summarised one discussion:</P>
-<BLOCKQUOTE> For the third and last time: this list *will* *not* do
- address-based filtering. This is a policy decision, not an
- implementation problem. The decision is final, and is not open to
- discussion. This needs to be communicated better to people, and steps
- are being taken to do that.</BLOCKQUOTE>
-<P>Adding this FAQ section is one of the steps he refers to.</P>
-<P>You have various options other than just putting up with the spam,
- filtering it yourself, or unsubscribing:</P>
-<UL>
-<LI>subscribe only to one or both of our lists with restricted posting
- rules:
-<UL>
-<LI><A href="mailto:briefs@lists.freeswan.org?body=subscribe">briefs</A>
-, weekly list summaries</LI>
-<LI><A href="mailto:announce@lists.freeswan.org?body=subscribe">announce</A>
-, project-related announcements</LI>
-</UL>
-</LI>
-<LI>read the other lists via the<A href="mail.html#archive"> archives</A>
-</LI>
-</UL>
-<P>A number of tools are available to filter mail.</P>
-<UL>
-<LI>Many mail readers include some filtering capability.</LI>
-<LI>Many Linux distributions include<A href="http://www.procmail.org/">
- procmail(8)</A> for server-side filtering.</LI>
-<LI>The<A href="http://www.spambouncer.org/"> Spam Bouncer</A> is a set
- of procmail(8) filters designed to combat spam.</LI>
-<LI>Roaring Penguin have a<A href="http://www.roaringpenguin.com/mimedefang/">
- MIME defanger</A> that removes potentially dangerous attachments.</LI>
-</UL>
-<P>If you use your ISP's mail server rather than running your own,
- consider suggesting to the ISP that they tag suspected spam as<A href="http://www.msen.com/1997/spam.html#SUSPECTED">
- this ISP</A> does. They could just refuse mail from dubious sources,
- but that is tricky and runs some risk of losing valuable mail or
- senselessly annoying senders and their admins. However, they can safely
- tag and deliver dubious mail. The tags can greatly assist your
- filtering.</P>
-<P>For information on tracking down spammers, see these<A href="http://www.rahul.net/falk/#howtos">
- HowTos</A>, or the<A href="http://www.sputum.com/index2.html"> Sputum</A>
- site. Sputum have a Linux anti-spam screensaver available for download.</P>
-<P>Here is a more detailed message from Henry:</P>
-<PRE>On Mon, 15 Jan 2001, Jay Vaughan wrote:
-&gt; I know I'm flogging a dead horse here, but I'm curious as to the reasons for
-&gt; an aversion for a subscriber-only mailing list?
-
-Once again:  for legal reasons, it is important that discussions of these
-things be held in a public place -- the list -- and we do not want to
-force people to subscribe to the list just to ask one question, because
-that may be more than merely inconvenient for them.  There are also real
-difficulties with people who are temporarily forced to use alternate
-addresses; that is precisely the time when they may be most in need of
-help, yet a subscribers-only policy shuts them out.
-
-These issues do not apply to most mailing lists, but for a list that is
-(necessarily) the primary user support route for a crypto package, they
-are very important.  This is *not* an ordinary mailing list; it has to
-function under awkward constraints that make various simplistic solutions
-inapplicable or undesirable. 
-
-&gt; We're *ALL* sick of hearing about list management problems, not just you
-&gt; old-timers, so why don't you DO SOMETHING EFFECTIVE ABOUT IT...
-
-Because it's a lot harder than it looks, and many existing &quot;solutions&quot;
-have problems when examined closely.
-
-&gt; A suggestion for you, based on 10 years of experience with management of my
-&gt; own mailing lists would be to use mailman, which includes pretty much every
-&gt; feature under the sun that you guys need and want, plus some.  The URL for
-&gt; mailman...
-
-I assure you, we're aware of mailman.  Along with a whole bunch of others,
-including some you almost certainly have never heard of (I hadn't!).
-
-&gt; As for the argument that the list shouldn't be configured to enforce
-&gt; subscription - I contend that it *SHOULD* AT LEAST require manual address
-&gt; verification in order for posts to be redirected.
-
-You do realize, I hope, that interposing such a manual step might cause
-your government to decide that this is not truly a public forum, and thus
-you could go to jail if you don't get approval from them before mailing to
-it?  If you think this sounds irrational, your government is noted for
-making irrational decisions in this area; we can't assume that they will
-suddenly start being sensible.  See above about awkward constraints.  You
-may be willing to take the risk, but we can't, in good conscience, insist
-that all users with problems do so. 
-
-                                                          Henry Spencer
-                                                       henry@spsystems.net</PRE>
-<P>and a message on the topic from project leader John Gilmore:</P>
-<PRE>Subject: Re: The linux-ipsec list's topic
-   Date: Sat, 30 Dec 2000
-   From: John Gilmore &lt;gnu@toad.com&gt;
-
-I'll post this single message, once only, in this discussion, and then
-not burden the list with any further off-topic messages.  I encourage
-everyone on the list to restrain themself from posting ANY off-topic
-messages to the linux-ipsec list.
-
-The topic of the linux-ipsec mailing list is the FreeS/WAN software.
-
-I frequently see &quot;discussions about spam on a list&quot; overwhelm the
-volume of &quot;actual spam&quot; on a list. BOTH kinds of messages are
-off-topic messages.  Twenty anti-spam messages take just as long to
-detect and discard as twenty spam messages.
-
-The Linux-ipsec list encourages on-topic messages from people who have
-not joined the list itself.  We will not censor messages to the list
-based on where they originate, or what return address they contain.
-In other words, non-subscribers ARE allowed to post, and this will not
-change.  My own valid contributions have been rejected out-of-hand by
-too many other mailing lists for me to want to impose that censorship
-on anybody else's contributions.  And every day I see the damage that
-anti-spam zeal is causing in many other ways; that zeal is far more
-damaging to the culture of the Internet than the nuisance of spam.
-
-In general, it is the responsibility of recipients to filter,
-prioritize, or otherwise manage the handling of email that comes to
-them.  It is not the responsibility of the rest of the Internet
-community to refrain from sending messages to recipients that they
-might not want to see.  If your software infrastructure for managing
-your incoming email is insufficient, then improve it.  If you think
-the signal-to-noise ratio on linux-ipsec is too poor, then please
-unsubscribe.  But don't further increase the noise by posting to the
-linux-ipsec list about those topics.
-
-        John Gilmore
-        founder &amp; sponsor, FreeS/WAN project</PRE>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="policygroups.html">Previous</A>
-<A HREF="manpages.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/firewall.html b/doc/firewall.html
deleted file mode 100644
index 0747ab83d..000000000
--- a/doc/firewall.html
+++ /dev/null
@@ -1,767 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="manpages.html">Previous</A>
-<A HREF="trouble.html">Next</A>
-<HR>
-<H1><A name="firewall">FreeS/WAN and firewalls</A></H1>
-<P>FreeS/WAN, or other IPsec implementations, frequently run on gateway
- machines, the same machines running firewall or packet filtering code.
- This document discusses the relation between the two.</P>
-<P>The firewall code in 2.4 and later kernels is called Netfilter. The
- user-space utility to manage a firewall is iptables(8). See the<A href="http://netfilter.samba.org">
- netfilter/iptables web site</A> for details.</P>
-<H2><A name="filters">Filtering rules for IPsec packets</A></H2>
-<P>The basic constraint is that<STRONG> an IPsec gateway must have
- packet filters that allow IPsec packets</STRONG>, at least when talking
- to other IPsec gateways:</P>
-<UL>
-<LI>UDP port 500 for<A href="glossary.html#IKE"> IKE</A> negotiations</LI>
-<LI>protocol 50 if you use<A href="glossary.html#ESP"> ESP</A>
- encryption and/or authentication (the typical case)</LI>
-<LI>protocol 51 if you use<A href="glossary.html#AH"> AH</A>
- packet-level authentication</LI>
-</UL>
-<P>Your gateway and the other IPsec gateways it communicates with must
- be able to exchange these packets for IPsec to work. Firewall rules
- must allow UDP 500 and at least one of<A href="glossary.html#AH"> AH</A>
- or<A href="glossary.html#ESP"> ESP</A> on the interface that
- communicates with the other gateway.</P>
-<P>For nearly all FreeS/WAN applications, you must allow UDP port 500
- and the ESP protocol.</P>
-<P>There are two ways to set this up:</P>
-<DL>
-<DT>easier but less flexible</DT>
-<DD>Just set up your firewall scripts at boot time to allow IPsec
- packets to and from your gateway. Let FreeS/WAN reject any bogus
- packets.</DD>
-<DT>more work, giving you more precise control</DT>
-<DD>Have the<A href="manpage.d/ipsec_pluto.8.html"> ipsec_pluto(8)</A>
- daemon call scripts to adjust firewall rules dynamically as required.
- This is done by naming the scripts in the<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> variables<VAR> prepluto=</VAR>,<VAR> postpluto=</VAR>
-,<VAR> leftupdown=</VAR> and<VAR> rightupdown=</VAR>.</DD>
-</DL>
-<P>Both methods are described in more detail below.</P>
-<H2><A name="examplefw">Firewall configuration at boot</A></H2>
-<P>It is possible to set up both firewalling and IPsec with appropriate
- scripts at boot and then not use<VAR> leftupdown=</VAR> and<VAR>
- rightupdown=</VAR>, or use them only for simple up and down operations.</P>
-<P>Basically, the technique is</P>
-<UL>
-<LI>allow IPsec packets (typically, IKE on UDP port 500 plus ESP,
- protocol 50)
-<UL>
-<LI>incoming, if the destination address is your gateway (and
- optionally, only from known senders)</LI>
-<LI>outgoing, with the from address of your gateway (and optionally,
- only to known receivers)</LI>
-</UL>
-</LI>
-<LI>let<A href="glossary.html#Pluto"> Pluto</A> deal with IKE</LI>
-<LI>let<A href="glossary.html#KLIPS"> KLIPS</A> deal with ESP</LI>
-</UL>
-<P>Since Pluto authenticates its partners during the negotiation, and
- KLIPS drops packets for which no tunnel has been negotiated, this may
- be all you need.</P>
-<H3><A name="simple.rules">A simple set of rules</A></H3>
-<P>In simple cases, you need only a few rules, as in this example:</P>
-<PRE># allow IPsec
-#
-# IKE negotiations
-iptables -I INPUT  -p udp --sport 500 --dport 500 -j ACCEPT
-iptables -I OUTPUT -p udp --sport 500 --dport 500 -j ACCEPT
-# ESP encryption and authentication
-iptables -I INPUT  -p 50 -j ACCEPT
-iptables -I OUTPUT -p 50 -j ACCEPT
-</PRE>
-<P>This should be all you need to allow IPsec through<VAR> lokkit</VAR>,
- which ships with Red Hat 9, on its medium security setting. Once you've
- tweaked to your satisfaction, save your active rule set with:</P>
-<PRE>service iptables save</PRE>
-<H3><A name="complex.rules">Other rules</A></H3>
- You can add additional rules, or modify existing ones, to work with
- IPsec and with your network and policies. We give a some examples in
- this section.
-<P>However, while it is certainly possible to create an elaborate set of
- rules yourself (please let us know via the<A href="mail.html"> mailing
- list</A> if you do), it may be both easier and more secure to use a set
- which has already been published and tested.</P>
-<P>The published rule sets we know of are described in the<A href="#rules.pub">
- next section</A>.</P>
-<H4>Adding additional rules</H4>
- If necessary, you can add additional rules to:
-<DL>
-<DT>reject IPsec packets that are not to or from known gateways</DT>
-<DD>This possibility is discussed in more detail<A href="#unknowngate">
- later</A></DD>
-<DT>allow systems behind your gateway to build IPsec tunnels that pass
- through the gateway</DT>
-<DD>This possibility is discussed in more detail<A href="#through">
- later</A></DD>
-<DT>filter incoming packets emerging from KLIPS.</DT>
-<DD>Firewall rules can recognise packets emerging from IPsec. They are
- marked as arriving on an interface such as<VAR> ipsec0</VAR>, rather
- than<VAR> eth0</VAR>,<VAR> ppp0</VAR> or whatever.</DD>
-</DL>
-<P>It is therefore reasonably straightforward to filter these packets in
- whatever way suits your situation.</P>
-<H4>Modifying existing rules</H4>
-<P>In some cases rules that work fine before you add IPsec may require
- modification to work with IPsec.</P>
-<P>This is especially likely for rules that deal with interfaces on the
- Internet side of your system. IPsec adds a new interface; often the
- rules must change to take account of that.</P>
-<P>For example, consider the rules given in<A href="http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-5.html">
- this section</A> of the Netfilter documentation:</P>
-<PRE>Most people just have a single PPP connection to the Internet, and don't
-want anyone coming back into their network, or the firewall:
-
-    ## Insert connection-tracking modules (not needed if built into kernel).
-    # insmod ip_conntrack
-    # insmod ip_conntrack_ftp
-
-    ## Create chain which blocks new connections, except if coming from inside.
-    # iptables -N block
-    # iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
-    # iptables -A block -m state --state NEW -i ! ppp0 -j ACCEPT
-    # iptables -A block -j DROP
-
-    ## Jump to that chain from INPUT and FORWARD chains.
-    # iptables -A INPUT -j block
-    # iptables -A FORWARD -j block</PRE>
-<P>On an IPsec gateway, those rules may need to be modified. The above
- allows new connections from<EM> anywhere except ppp0</EM>. That means
- new connections from ipsec0 are allowed.</P>
-<P>Do you want to allow anyone who can establish an IPsec connection to
- your gateway to initiate TCP connections to any service on your
- network? Almost certainly not if you are using opportunistic
- encryption. Quite possibly not even if you have only explicitly
- configured connections.</P>
-<P>To disallow incoming connections from ipsec0, change the middle
- section above to:</P>
-<PRE>    ## Create chain which blocks new connections, except if coming from inside.
-    # iptables -N block
-    # iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
-    # iptables -A block -m state --state NEW -i ppp+ -j DROP
-    # iptables -A block -m state --state NEW -i ipsec+ -j DROP
-    # iptables -A block -m state --state NEW -i -j ACCEPT
-    # iptables -A block -j DROP</PRE>
-<P>The original rules accepted NEW connections from anywhere except
- ppp0. This version drops NEW connections from any PPP interface (ppp+)
- and from any ipsec interface (ipsec+), then accepts the survivors.</P>
-<P>Of course, these are only examples. You will need to adapt them to
- your own situation.</P>
-<H3><A name="rules.pub">Published rule sets</A></H3>
-<P>Several sets of firewall rules that work with FreeS/WAN are
- available.</P>
-<H4><A name="Ranch.trinity">Scripts based on Ranch's work</A></H4>
-<P>One user, Rob Hutton, posted his boot time scripts to the mailing
- list, and we included them in previous versions of this documentation.
- They are still available from our<A href="http://www.freeswan.org/freeswan_trees/freeswan-1.5/doc/firewall.html#examplefw">
- web site</A>. However, they were for an earlier FreeS/WAN version so we
- no longer recommend them. Also, they had some bugs. See this<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/04/msg00316.html">
- message</A>.</P>
-<P>Those scripts were based on David Ranch's scripts for his &quot;Trinity
- OS&quot; for setting up a secure Linux. Check his<A href="http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html">
- home page</A> for the latest version and for information on his<A href="biblio.html#ranch">
- book</A> on securing Linux. If you are going to base your firewalling
- on Ranch's scripts, we recommend using his latest version, and sending
- him any IPsec modifications you make for incorporation into later
- versions.</P>
-<H4><A name="seawall">The Seattle firewall</A></H4>
-<P>We have had several mailing lists reports of good results using
- FreeS/WAN with Seawall (the Seattle Firewall). See that project's<A href="http://seawall.sourceforge.net/">
- home page</A> on Sourceforge.</P>
-<H4><A name="rcf">The RCF scripts</A></H4>
-<P>Another set of firewall scripts with IPsec support are the RCF or
- rc.firewall scripts. See their<A href="http://jsmoriss.mvlan.net/linux/rcf.html">
- home page</A>.</P>
-<H4><A name="asgard">Asgard scripts</A></H4>
-<P><A href="http://heimdall.asgardsrealm.net/linux/firewall/">Asgard's
- Realm</A> has set of firewall scripts with FreeS/WAN support, for 2.4
- kernels and iptables.</P>
-<H4><A name="user.scripts">User scripts from the mailing list</A></H4>
-<P>One user gave considerable detail on his scripts, including
- supporting<A href="glossary.html#IPX"> IPX</A> through the tunnel. His
- message was too long to conveniently be quoted here, so I've put it in
- a<A href="user_examples.html"> separate file</A>.</P>
-<H2><A name="updown">Calling firewall scripts, named in ipsec.conf(5)</A>
-</H2>
-<P>The<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A>
- configuration file has three pairs of parameters used to specify an
- interface between FreeS/WAN and firewalling code.</P>
-<P>Note that using these is not required if you have a static firewall
- setup. In that case, you just set your firewall up at boot time (in a
- way that permits the IPsec connections you want) and do not change it
- thereafter. Omit all the FreeS/WAN firewall parameters and FreeS/WAN
- will not attempt to adjust firewall rules at all. See<A href="#examplefw">
- above</A> for some information on appropriate scripts.</P>
-<P>However, if you want your firewall rules to change when IPsec
- connections change, then you need to use these parameters.</P>
-<H3><A name="pre_post">Scripts called at IPsec start and stop</A></H3>
-<P>One pair of parmeters are set in the<VAR> config setup</VAR> section
- of the<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A> file and
- affect all connections:</P>
-<DL>
-<DT>prepluto=</DT>
-<DD>script to be called before<A href="manpage.d/ipsec_pluto.8.html">
- pluto(8)</A> IKE daemon is started.</DD>
-<DT>postpluto=</DT>
-<DD>script to be called after<A href="manpage.d/ipsec_pluto.8.html">
- pluto(8)</A> IKE daemon is stopped.</DD>
-</DL>
- These parameters allow you to change firewall parameters whenever IPsec
- is started or stopped.
-<P>They can also be used in other ways. For example, you might have<VAR>
- prepluto</VAR> add a module to your kernel for the secure network
- interface or make a dialup connection, and then have<VAR> postpluto</VAR>
- remove the module or take the connection down.</P>
-<H3><A name="up_down">Scripts called at connection up and down</A></H3>
-<P>The other parameters are set in connection descriptions. They can be
- set in individual connection descriptions, and could even call
- different scripts for each connection for maximum flexibility. In most
- applications, however, it makes sense to use only one script and to
- call it from<VAR> conn %default</VAR> section so that it applies to all
- connections.</P>
-<P>You can:</P>
-<DL>
-<DT><STRONG>either</STRONG></DT>
-<DD>set<VAR> leftfirewall=yes</VAR> or<VAR> rightfirewall=yes</VAR> to
- use our supplied default script</DD>
-<DT><STRONG>or</STRONG></DT>
-<DD>assign a name in a<VAR> leftupdown=</VAR> or<VAR> rightupdown=</VAR>
- line to use your own script</DD>
-</DL>
-<P>Note that<STRONG> only one of these should be used</STRONG>. You
- cannot sensibly use both. Since<STRONG> our default script is obsolete</STRONG>
- (designed for firewalls using<VAR> ipfwadm(8)</VAR> on 2.0 kernels),
- most users who need this service will<STRONG> need to write a custom
- script</STRONG>.</P>
-<H4><A name="fw.default">The default script</A></H4>
-<P>We supply a default script named<VAR> _updown</VAR>.</P>
-<DL>
-<DT>leftfirewall=</DT>
-<DD></DD>
-<DT>rightfirewall=</DT>
-<DD>indicates that the gateway is doing firewalling and that<A href="manpage.d/ipsec_pluto.8.html">
- pluto(8)</A> should poke holes in the firewall as required.</DD>
-</DL>
-<P>Set these to<VAR> yes</VAR> and Pluto will call our default script<VAR>
- _updown</VAR> with appropriate arguments whenever it:</P>
-<UL>
-<LI>starts or stops IPsec services</LI>
-<LI>brings a connection up or down</LI>
-</UL>
-<P>The supplied default<VAR> _updown</VAR> script is appropriate for
- simple cases using the<VAR> ipfwadm(8)</VAR> firewalling package.</P>
-<H4><A name="userscript">User-written scripts</A></H4>
-<P>You can also write your own script and have Pluto call it. Just put
- the script's name in one of these<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> lines:</P>
-<DL>
-<DT>leftupdown=</DT>
-<DD></DD>
-<DT>rightupdown=</DT>
-<DD>specifies a script to call instead of our default script<VAR>
- _updown</VAR>.</DD>
-</DL>
-<P>Your script should take the same arguments and use the same
- environment variables as<VAR> _updown</VAR>. See the &quot;updown command&quot;
- section of the<A href="manpage.d/ipsec_pluto.8.html"> ipsec_pluto(8)</A>
- man page for details.</P>
-<P>Note that<STRONG> you should not modify our _updown script in place</STRONG>
-. If you did that, then upgraded FreeS/WAN, the upgrade would install a
- new default script, overwriting your changes.</P>
-<H3><A name="ipchains.script">Scripts for ipchains or iptables</A></H3>
-<P>Our<VAR> _updown</VAR> is for firewalls using<VAR> ipfwadm(8)</VAR>,
- the firewall code for the 2.0 series of Linux kernels. If you are using
- the more recent packages<VAR> ipchains(8)</VAR> (for 2.2 kernels) or<VAR>
- iptables(8)</VAR> (2.4 kernels), then you must do one of:</P>
-<UL>
-<LI>use static firewall rules which are set up at boot time as described<A
-href="#examplefw"> above</A> and do not need to be changed by Pluto</LI>
-<LI>limit yourself to ipchains(8)'s ipfwadm(8) emulation mode in order
- to use our script</LI>
-<LI>write your own script and call it with<VAR> leftupdown</VAR> and<VAR>
- rightupdown</VAR>.</LI>
-</UL>
-<P>You can write a script to do whatever you need with firewalling.
- Specify its name in a<VAR> [left|right]updown=</VAR> parameter in<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> and Pluto will automatically call it for you.</P>
-<P>The arguments Pluto passes such a script are the same ones it passes
- to our default _updown script, so the best way to build yours is to
- copy ours and modify the copy.</P>
-<P>Note, however, that<STRONG> you should not modify our _updown script
- in place</STRONG>. If you did that, then upgraded FreeS/WAN, the
- upgrade would install a new default script, overwriting your changes.</P>
-<H2><A name="NAT">A complication: IPsec vs. NAT</A></H2>
-<P><A href="glossary.html#NAT.gloss">Network Address Translation</A>,
- also known as IP masquerading, is a method of allocating IP addresses
- dynamically, typically in circumstances where the total number of
- machines which need to access the Internet exceeds the supply of IP
- addresses.</P>
-<P>Any attempt to perform NAT operations on IPsec packets<EM> between
- the IPsec gateways</EM> creates a basic conflict:</P>
-<UL>
-<LI>IPsec wants to authenticate packets and ensure they are unaltered on
- a gateway-to-gateway basis</LI>
-<LI>NAT rewrites packet headers as they go by</LI>
-<LI>IPsec authentication fails if packets are rewritten anywhere between
- the IPsec gateways</LI>
-</UL>
-<P>For<A href="glossary.html#AH"> AH</A>, which authenticates parts of
- the packet header including source and destination IP addresses, this
- is fatal. If NAT changes those fields, AH authentication fails.</P>
-<P>For<A href="glossary.html#IKE"> IKE</A> and<A href="glossary.html#ESP">
- ESP</A> it is not necessarily fatal, but is certainly an unwelcome
- complication.</P>
-<H3><A name="nat_ok">NAT on or behind the IPsec gateway works</A></H3>
-<P>This problem can be avoided by having the masquerading take place<EM>
- on or behind</EM> the IPsec gateway.</P>
-<P>This can be done physically with two machines, one physically behind
- the other. A picture, using SG to indicate IPsec<STRONG> S</STRONG>
-ecurity<STRONG> G</STRONG>ateways, is:</P>
-<PRE>      clients --- NAT ----- SG ---------- SG
-                  two machines</PRE>
-<P>In this configuration, the actual client addresses need not be given
- in the<VAR> leftsubnet=</VAR> parameter of the FreeS/WAN connection
- description. The security gateway just delivers packets to the NAT box;
- it needs only that machine's address. What that machine does with them
- does not affect FreeS/WAN.</P>
-<P>A more common setup has one machine performing both functions:</P>
-<PRE>      clients ----- NAT/SG ---------------SG
-                  one machine</PRE>
-<P>Here you have a choice of techniques depending on whether you want to
- make your client subnet visible to clients on the other end:</P>
-<UL>
-<LI>If you want the single gateway to behave like the two shown above,
- with your clients hidden behind the NAT, then omit the<VAR> leftsubnet=</VAR>
- parameter. It then defaults to the gateway address. Clients on the
- other end then talk via the tunnel only to your gateway. The gateway
- takes packets emerging from the tunnel, applies normal masquerading,
- and forwards them to clients.</LI>
-<LI>If you want to make your client machines visible, then give the
- client subnet addresses as the<VAR> leftsubnet=</VAR> parameter in the
- connection description and
-<DL>
-<DT>either</DT>
-<DD>set<VAR> leftfirewall=yes</VAR> to use the default<VAR> updown</VAR>
- script</DD>
-<DT>or</DT>
-<DD>use your own script by giving its name in a<VAR> leftupdown=</VAR>
- parameter</DD>
-</DL>
- These scripts are described in their own<A href="#updown"> section</A>.
-<P>In this case, no masquerading is done. Packets to or from the client
- subnet are encrypted or decrypted without any change to their client
- subnet addresses, although of course the encapsulating packets use
- gateway addresses in their headers. Clients behind the right security
- gateway see a route via that gateway to the left subnet.</P>
-</LI>
-</UL>
-<H3><A name="nat_bad">NAT between gateways is problematic</A></H3>
-<P>We recommend not trying to build IPsec connections which pass through
- a NAT machine. This setup poses problems:</P>
-<PRE>      clients --- SG --- NAT ---------- SG</PRE>
-<P>If you must try it, some references are:</P>
-<UL>
-<LI>Jean_Francois Nadeau's document on doing<A href="http://jixen.tripod.com/#NATed gateways">
- IPsec behind NAT</A></LI>
-<LI><A href="web.html#VPN.masq">VPN masquerade patches</A> to make a
- Linux NAT box handle IPsec packets correctly</LI>
-</UL>
-<H3><A name="NAT.ref">Other references on NAT and IPsec</A></H3>
-<P>Other documents which may be relevant include:</P>
-<UL>
-<LI>an Internet Draft on<A href="http://search.ietf.org/internet-drafts/draft-aboba-nat-ipsec-04.txt">
- IPsec and NAT</A> which may eventually evolve into a standard solution
- for this problem.</LI>
-<LI>an informational<A href="http://www.cis.ohio-state.edu/rfc/rfc2709.txt">
- RFC</A>,<CITE> Security Model with Tunnel-mode IPsec for NAT Domains</CITE>
-.</LI>
-<LI>an<A href="http://www.cisco.com/warp/public/759/ipj_3-4/ipj_3-4_nat.html">
- article</A> in Cisco's<CITE> Internet Protocol Journal</CITE></LI>
-</UL>
-<H2><A name="complications">Other complications</A></H2>
-<P>Of course simply allowing UDP 500 and ESP packets is not the whole
- story. Various other issues arise in making IPsec and packet filters
- co-exist and even co-operate. Some of them are summarised below.</P>
-<H3><A name="through">IPsec<EM> through</EM></A> the gateway</H3>
-<P>Basic IPsec packet filtering rules deal only with packets addressed
- to or sent from your IPsec gateway.</P>
-<P>It is a separate policy decision whether to permit such packets to
- pass through the gateway so that client machines can build end-to-end
- IPsec tunnels of their own. This may not be practical if you are using<A
-href="#NAT"> NAT (IP masquerade)</A> on your gateway, and may conflict
- with some corporate security policies.</P>
-<P>Where possible, allowing this is almost certainly a good idea. Using
- IPsec on an end-to-end basis is more secure than gateway-to-gateway.</P>
-<P>Doing it is quite simple. You just need firewall rules that allow UDP
- port 500 and protocols 50 and 51 to pass through your gateway. If you
- wish, you can of course restrict this to certain hosts.</P>
-<H3><A name="ipsec_only">Preventing non-IPsec traffic</A></H3>
- You can also filter<EM> everything but</EM> UDP port 500 and ESP or AH
- to restrict traffic to IPsec only, either for anyone communicating with
- your host or just for specific partners.
-<P>One application of this is for the telecommuter who might have:</P>
-<PRE>     Sunset==========West------------------East ================= firewall --- the Internet
-         home network      untrusted net        corporate network</PRE>
-<P>The subnet on the right is 0.0.0.0/0, the whole Internet. The West
- gateway is set up so that it allows only IPsec packets to East in or
- out.</P>
-<P>This configuration is used in AT&amp;T Research's network. For details,
- see the<A href="intro.html#applied"> papers</A> links in our
- introduction.</P>
-<P>Another application would be to set up firewall rules so that an
- internal machine, such as an employees-only web server, could not talk
- to the outside world except via specific IPsec tunnels.</P>
-<H3><A name="unknowngate">Filtering packets from unknown gateways</A></H3>
-<P>It is possible to use firewall rules to restrict UDP 500, ESP and AH
- packets so that these packets are accepted only from known gateways.
- This is not strictly necessary since FreeS/WAN will discard packets
- from unknown gateways. You might, however, want to do it for any of a
- number of reasons. For example:</P>
-<UL>
-<LI>Arguably, &quot;belt and suspenders&quot; is the sensible approach to
- security. If you can block a potential attack in two ways, use both.
- The only question is whether to look for a third way after implementing
- the first two.</LI>
-<LI>Some admins may prefer to use the firewall code this way because
- they prefer firewall logging to FreeS/WAN's logging.</LI>
-<LI>You may need it to implement your security policy. Consider an
- employee working at home, and a policy that says traffic from the home
- system to the Internet at large must go first via IPsec to the
- corporate LAN and then out to the Internet via the corporate firewall.
- One way to do that is to make<VAR> ipsec0</VAR> the default route on
- the home gateway and provide exceptions only for UDP 500 and ESP to the
- corporate gateway. Everything else is then routed via the tunnel to the
- corporate gateway.</LI>
-</UL>
-<P>It is not possible to use only static firewall rules for this
- filtering if you do not know the other gateways' IP addresses in
- advance, for example if you have &quot;road warriors&quot; who may connect from a
- different address each time or if want to do<A href="glossary.html#carpediem">
- opportunistic encryption</A> to arbitrary gateways. In these cases, you
- can accept UDP 500 IKE packets from anywhere, then use the<A href="#updown">
- updown</A> script feature of<A href="manpage.d/ipsec_pluto.8.html">
- pluto(8)</A> to dynamically adjust firewalling for each negotiated
- tunnel.</P>
-<P>Firewall packet filtering does not much reduce the risk of a<A href="glossary.html#DOS">
- denial of service attack</A> on FreeS/WAN. The firewall can drop
- packets from unknown gateways, but KLIPS does that quite efficiently
- anyway, so you gain little. The firewall cannot drop otherwise
- legitmate packets that fail KLIPS authentication, so it cannot protect
- against an attack designed to exhaust resources by making FreeS/WAN
- perform many expensive authentication operations.</P>
-<P>In summary, firewall filtering of IPsec packets from unknown gateways
- is possible but not strictly necessary.</P>
-<H2><A name="otherfilter">Other packet filters</A></H2>
-<P>When the IPsec gateway is also acting as your firewall, other packet
- filtering rules will be in play. In general, those are outside the
- scope of this document. See our<A href="web.html#firewall.linux"> Linux
- firewall links</A> for information. There are a few types of packet,
- however, which can affect the operation of FreeS/WAN or of diagnostic
- tools commonly used with it. These are discussed below.</P>
-<H3><A name="ICMP">ICMP filtering</A></H3>
-<P><A href="glossary.html#ICMP.gloss">ICMP</A> is the<STRONG> I</STRONG>
-nternet<STRONG> C</STRONG>ontrol<STRONG> M</STRONG>essage<STRONG> P</STRONG>
-rotocol. It is used for messages between IP implementations themselves,
- whereas IP used is used between the clients of those implementations.
- ICMP is, unsurprisingly, used for control messages. For example, it is
- used to notify a sender that a desination is not reachable, or to tell
- a router to reroute certain packets elsewhere.</P>
-<P>ICMP handling is tricky for firewalls.</P>
-<UL>
-<LI>You definitely want some ICMP messages to get through; things won't
- work without them. For example, your clients need to know if some
- destination they ask for is unreachable.</LI>
-<LI>On the other hand, you do equally definitely do not want untrusted
- folk sending arbitrary control messages to your machines. Imagine what
- someone moderately clever and moderately malicious could do to you,
- given control of your network's routing.</LI>
-</UL>
-<P>ICMP does not use ports. Messages are distinguished by a &quot;message
- type&quot; field and, for some types, by an additional &quot;code&quot; field. The
- definitive list of types and codes is on the<A href="http://www.iana.org">
- IANA</A> site.</P>
-<P>One expert uses this definition for ICMP message types to be dropped
- at the firewall.</P>
-<PRE># ICMP types which lack socially redeeming value.
-#  5     Redirect
-#  9     Router Advertisement
-# 10     Router Selection
-# 15     Information Request
-# 16     Information Reply
-# 17     Address Mask Request
-# 18     Address Mask Reply
-
-badicmp='5 9 10 15 16 17 18'</PRE>
-<P>A more conservative approach would be to make a list of allowed types
- and drop everything else.</P>
-<P>Whichever way you do it, your ICMP filtering rules on a FreeS/WAN
- gateway should allow at least the following ICMP packet types:</P>
-<DL>
-<DT>echo (type 8)</DT>
-<DD></DD>
-<DT>echo reply (type 0)</DT>
-<DD>These are used by ping(1). We recommend allowing both types through
- the tunnel and to or from your gateway's external interface, since
- ping(1) is an essential testing tool.
-<P>It is fairly common for firewalls to drop ICMP echo packets addressed
- to machines behind the firewall. If that is your policy, please create
- an exception for such packets arriving via an IPsec tunnel, at least
- during intial testing of those tunnels.</P>
-</DD>
-<DT>destination unreachable (type 3)</DT>
-<DD>This is used, with code 4 (Fragmentation Needed and Don't Fragment
- was Set) in the code field, to control<A href="glossary.html#pathMTU">
- path MTU discovery</A>. Since IPsec processing adds headers, enlarges
- packets and may cause fragmentation, an IPsec gateway should be able to
- send and receive these ICMP messages<STRONG> on both inside and outside
- interfaces</STRONG>.</DD>
-</DL>
-<H3><A name="traceroute">UDP packets for traceroute</A></H3>
-<P>The traceroute(1) utility uses UDP port numbers from 33434 to
- approximately 33633. Generally, these should be allowed through for
- troubleshooting.</P>
-<P>Some firewalls drop these packets to prevent outsiders exploring the
- protected network with traceroute(1). If that is your policy, consider
- creating an exception for such packets arriving via an IPsec tunnel, at
- least during intial testing of those tunnels.</P>
-<H3><A name="l2tp">UDP for L2TP</A></H3>
-<P> Windows 2000 does, and products designed for compatibility with it
- may, build<A href="glossary.html#L2TP"> L2TP</A> tunnels over IPsec
- connections.</P>
-<P>For this to work, you must allow UDP protocol 1701 packets coming out
- of your tunnels to continue to their destination. You can, and probably
- should, block such packets to or from your external interfaces, but
- allow them from<VAR> ipsec0</VAR>.</P>
-<P>See also our Windows 2000<A href="interop.html#win2k"> interoperation
- discussion</A>.</P>
-<H2><A name="packets">How it all works: IPsec packet details</A></H2>
-<P>IPsec uses three main types of packet:</P>
-<DL>
-<DT><A href="glossary.html#IKE">IKE</A> uses<STRONG> the UDP protocol
- and port 500</STRONG>.</DT>
-<DD>Unless you are using only (less secure, not recommended) manual
- keying, you need IKE to negotiate connection parameters, acceptable
- algorithms, key sizes and key setup. IKE handles everything required to
- set up, rekey, repair or tear down IPsec connections.</DD>
-<DT><A href="glossary.html#ESP">ESP</A> is<STRONG> protocol number 50</STRONG>
-</DT>
-<DD>This is required for encrypted connections.</DD>
-<DT><A href="glossary.html#AH">AH</A> is<STRONG> protocol number 51</STRONG>
-</DT>
-<DD>This can be used where only authentication, not encryption, is
- required.</DD>
-</DL>
-<P>All of those packets should have appropriate IPsec gateway addresses
- in both the to and from IP header fields. Firewall rules can check this
- if you wish, though it is not strictly necessary. This is discussed in
- more detail<A href="#unknowngate"> later</A>.</P>
-<P>IPsec processing of incoming packets authenticates them then removes
- the ESP or AH header and decrypts if necessary. Successful processing
- exposes an inner packet which is then delivered back to the firewall
- machinery, marked as having arrived on an<VAR> ipsec[0-3]</VAR>
- interface. Firewall rules can use that interface label to distinguish
- these packets from unencrypted packets which are labelled with the
- physical interface they arrived on (or perhaps with a non-IPsec virtual
- interface such as<VAR> ppp0</VAR>).</P>
-<P>One of our users sent a mailing list message with a<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/12/msg00006.html">
- diagram</A> of the packet flow.</P>
-<H3><A name="noport">ESP and AH do not have ports</A></H3>
-<P>Some protocols, such as TCP and UDP, have the notion of ports. Others
- protocols, including ESP and AH, do not. Quite a few IPsec newcomers
- have become confused on this point. There are no ports<EM> in</EM> the
- ESP or AH protocols, and no ports used<EM> for</EM> them. For these
- protocols,<EM> the idea of ports is completely irrelevant</EM>.</P>
-<H3><A name="header">Header layout</A></H3>
-<P>The protocol numbers for ESP or AH are used in the 'next header'
- field of the IP header. On most non-IPsec packets, that field would
- have one of:</P>
-<UL>
-<LI>1 for ICMP</LI>
-<LI>4 for IP-in-IP encapsulation</LI>
-<LI>6 for TCP</LI>
-<LI>17 for UDP</LI>
-<LI>... or one of about 100 other possibilities listed by<A href="http://www.iana.org">
- IANA</A></LI>
-</UL>
-<P>Each header in the sequence tells what the next header will be. IPsec
- adds headers for ESP or AH near the beginning of the sequence. The
- original headers are kept and the 'next header' fields adjusted so that
- all headers can be correctly interpreted.</P>
-<P>For example, using<STRONG> [</STRONG><STRONG> ]</STRONG> to indicate
- data protected by ESP and unintelligible to an eavesdropper between the
- gateways:</P>
-<UL>
-<LI>a simple packet might have only IP and TCP headers with:
-<UL>
-<LI>IP header says next header --&gt; TCP</LI>
-<LI>TCP header port number --&gt; which process to send data to</LI>
-<LI>data</LI>
-</UL>
-</LI>
-<LI>with ESP<A href="glossary.html#transport"> transport mode</A>
- encapsulation, that packet would have:
-<UL>
-<LI>IP header says next header --&gt; ESP</LI>
-<LI>ESP header<STRONG> [</STRONG> says next --&gt; TCP</LI>
-<LI>TCP header port number --&gt; which process to send data to</LI>
-<LI>data<STRONG> ]</STRONG></LI>
-</UL>
- Note that the IP header is outside ESP protection, visible to an
- attacker, and that the final destination must be the gateway.</LI>
-<LI>with ESP in<A href="glossary.html#tunnel"> tunnel mode</A>, we might
- have:
-<UL>
-<LI>IP header says next header --&gt; ESP</LI>
-<LI>ESP header<STRONG> [</STRONG> says next --&gt; IP</LI>
-<LI>IP header says next header --&gt; TCP</LI>
-<LI>TCP header port number --&gt; which process to send data to</LI>
-<LI>data<STRONG> ]</STRONG></LI>
-</UL>
- Here the inner IP header is protected by ESP, unreadable by an
- attacker. Also, the inner header can have a different IP address than
- the outer IP header, so the decrypted packet can be routed from the
- IPsec gateway to a final destination which may be another machine.</LI>
-</UL>
-<P>Part of the ESP header itself is encrypted, which is why the<STRONG>
- [</STRONG> indicating protected data appears in the middle of some
- lines above. The next header field of the ESP header is protected. This
- makes<A href="glossary.html#traffic"> traffic analysis</A> more
- difficult. The next header field would tell an eavesdropper whether
- your packet was UDP to the gateway, TCP to the gateway, or encapsulated
- IP. It is better not to give this information away. A clever attacker
- may deduce some of it from the pattern of packet sizes and timings, but
- we need not make it easy.</P>
-<P>IPsec allows various combinations of these to match local policies,
- including combinations that use both AH and ESP headers or that nest
- multiple copies of these headers.</P>
-<P>For example, suppose my employer has an IPsec VPN running between two
- offices so all packets travelling between the gateways for those
- offices are encrypted. If gateway policies allow it (The admins could
- block UDP 500 and protocols 50 and 51 to disallow it), I can build an
- IPsec tunnel from my desktop to a machine in some remote office. Those
- packets will have one ESP header throughout their life, for my
- end-to-end tunnel. For part of the route, however, they will also have
- another ESP layer for the corporate VPN's encapsulation. The whole
- header scheme for a packet on the Internet might be:</P>
-<UL>
-<LI>IP header (with gateway address) says next header --&gt; ESP</LI>
-<LI>ESP header<STRONG> [</STRONG> says next --&gt; IP</LI>
-<LI>IP header (with receiving machine address) says next header --&gt; ESP</LI>
-<LI>ESP header<STRONG> [</STRONG> says next --&gt; TCP</LI>
-<LI>TCP header port number --&gt; which process to send data to</LI>
-<LI>data<STRONG> ]]</STRONG></LI>
-</UL>
-<P>The first ESP (outermost) header is for the corporate VPN. The inner
- ESP header is for the secure machine-to-machine link.</P>
-<H3><A name="dhr">DHR on the updown script</A></H3>
-<P>Here are some mailing list comments from<A href="manpage.d/ipsec_pluto.8.html">
- pluto(8)</A> developer Hugh Redelmeier on an earlier draft of this
- document:</P>
-<PRE>There are many important things left out
-
-- firewalling is important but must reflect (implement) policy.  Since
-  policy isn't the same for all our customers, and we're not experts,
-  we should concentrate on FW and MASQ interactions with FreeS/WAN.
-
-- we need a diagram to show packet flow WITHIN ONE MACHINE, assuming
-  IKE, IPsec, FW, and MASQ are all done on that machine.  The flow is
-  obvious if the components are run on different machines (trace the
-  cables).
-
-  IKE input:
-        + packet appears on public IF, as UDP port 500
-        + input firewalling rules are applied (may discard)
-        + Pluto sees the packet.
-
-  IKE output:
-        + Pluto generates the packet &amp; writes to public IF, UDP port 500
-        + output firewalling rules are applied (may discard)
-        + packet sent out public IF
-
-  IPsec input, with encapsulated packet, outer destination of this host:
-        + packet appears on public IF, protocol 50 or 51.  If this
-          packet is the result of decapsulation, it will appear
-          instead on the paired ipsec IF.
-        + input firewalling rules are applied (but packet is opaque)
-        + KLIPS decapsulates it, writes result to paired ipsec IF
-        + input firewalling rules are applied to resulting packet
-          as input on ipsec IF
-        + if the destination of the packet is this machine, the
-          packet is passed on to the appropriate protocol handler.
-          If the original packet was encapsulated more than once
-          and the new outer destination is this machine, that
-          handler will be KLIPS.
-        + otherwise:
-          * routing is done for the resulting packet.  This may well
-            direct it into KLIPS for encoding or encrypting.  What
-            happens then is described elsewhere.
-          * forwarding firewalling rules are applied
-          * output firewalling rules are applied
-          * the packet is sent where routing specified
-
- IPsec input, with encapsulated packet, outer destination of another host:
-        + packet appears on some IF, protocol 50 or 51
-        + input firewalling rules are applied (but packet is opaque)
-        + routing selects where to send the packet
-        + forwarding firewalling rules are applied (but packet is opaque)
-        + packet forwarded, still encapsulated
-
-  IPsec output, from this host or from a client:
-        + if from a client, input firewalling rules are applied as the
-          packet arrives on the private IF
-        + routing directs the packet to an ipsec IF (this is how the
-          system decides KLIPS processing is required)
-        + if from a client, forwarding firewalling rules are applied
-        + KLIPS eroute mechanism matches the source and destination
-          to registered eroutes, yielding a SPI group.  This dictates
-          processing, and where the resulting packet is to be sent
-          (the destinations SG and the nexthop).
-        + output firewalling is not applied to the resulting
-          encapsulated packet
-
-- Until quite recently, KLIPS would double encapsulate packets that
-  didn't strictly need to be.  Firewalling should be prepared for
-  those packets showing up as ESP and AH protocol input packets on
-  an ipsec IF.
-
-- MASQ processing seems to be done as if it were part of the
-  forwarding firewall processing (this should be verified).
-
-- If a firewall is being used, it is likely the case that it needs to
-  be adjusted whenever IPsec SAs are added or removed.  Pluto invokes
-  a script to do this (and to adjust routing) at suitable times.  The
-  default script is only suitable for ipfwadm-managed firewalls.  Under
-  LINUX 2.2.x kernels, ipchains can be managed by ipfwadm (emulation),
-  but ipchains more powerful if manipulated using the ipchains command.
-  In this case, a custom updown script must be used.
-
-  We think that the flexibility of ipchains precludes us supplying an
-  updown script that would be widely appropriate.</PRE>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="manpages.html">Previous</A>
-<A HREF="trouble.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/glossary.html b/doc/glossary.html
deleted file mode 100644
index 3ca33810f..000000000
--- a/doc/glossary.html
+++ /dev/null
@@ -1,2132 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="web.html">Previous</A>
-<A HREF="biblio.html">Next</A>
-<HR>
-<H1><A name="ourgloss">Glossary for the Linux FreeS/WAN project</A></H1>
-<P>Entries are in alphabetical order. Some entries are only one line or
- one paragraph long. Others run to several paragraphs. I have tried to
- put the essential information in the first paragraph so you can skip
- the other paragraphs if that seems appropriate.</P>
-<HR>
-<H2><A name="jump">Jump to a letter in the glossary</A></H2>
-<CENTER> <BIG><B><A href="#0">numeric</A><A href="#A"> A</A><A href="#B">
- B</A><A href="#C"> C</A><A href="#D"> D</A><A href="#E"> E</A><A href="#F">
- F</A><A href="#G"> G</A><A href="#H"> H</A><A href="#I"> I</A><A href="#J">
- J</A><A href="#K"> K</A><A href="#L"> L</A><A href="#M"> M</A><A href="#N">
- N</A><A href="#O"> O</A><A href="#P"> P</A><A href="#Q"> Q</A><A href="#R">
- R</A><A href="#S"> S</A><A href="#T"> T</A><A href="#U"> U</A><A href="#V">
- V</A><A href="#W"> W</A><A href="#X"> X</A><A href="#Y"> Y</A><A href="#Z">
- Z</A></B></BIG></CENTER>
-<HR>
-<H2><A name="gloss">Other glossaries</A></H2>
-<P>Other glossaries which overlap this one include:</P>
-<UL>
-<LI>The VPN Consortium's glossary of<A href="http://www.vpnc.org/terms.html">
- VPN terms</A>.</LI>
-<LI>glossary portion of the<A href="http://www.rsa.com/rsalabs/faq/B.html">
- Cryptography FAQ</A></LI>
-<LI>an extensive crytographic glossary on<A href="http://www.ciphersbyritter.com/GLOSSARY.HTM">
- Terry Ritter's</A> page.</LI>
-<LI>The<A href="#NSA"> NSA</A>'s<A href="http://www.sans.org/newlook/resources/glossary.htm">
- glossary of computer security</A> on the<A href="http://www.sans.org">
- SANS Institute</A> site.</LI>
-<LI>a small glossary for Internet Security at<A href="http://www5.zdnet.com/pcmag/pctech/content/special/glossaries/internetsecurity.html">
- PC magazine</A></LI>
-<LI>The<A href="http://www.visi.com/crypto/inet-crypto/glossary.html">
- glossary</A> from Richard Smith's book<A href="biblio.html#Smith">
- Internet Cryptography</A></LI>
-</UL>
-<P>Several Internet glossaries are available as RFCs:</P>
-<UL>
-<LI><A href="http://www.rfc-editor.org/rfc/rfc1208.txt">Glossary of
- Networking Terms</A></LI>
-<LI><A href="http://www.rfc-editor.org/rfc/rfc1983.txt">Internet User's
- Glossary</A></LI>
-<LI><A href="http://www.rfc-editor.org/rfc/rfc2828.txt">Internet
- Security Glossary</A></LI>
-</UL>
-<P>More general glossary or dictionary information:</P>
-<UL>
-<LI>Free Online Dictionary of Computing (FOLDOC)
-<UL>
-<LI><A href="http://www.nightflight.com/foldoc">North America</A></LI>
-<LI><A href="http://wombat.doc.ic.ac.uk/foldoc/index.html">Europe</A></LI>
-<LI><A href="http://www.nue.org/foldoc/index.html">Japan</A></LI>
-</UL>
-<P>There are many more mirrors of this dictionary.</P>
-</LI>
-<LI>The Jargon File, the definitive resource for hacker slang and
- folklore
-<UL>
-<LI><A href="http://www.netmeg.net/jargon">North America</A></LI>
-<LI><A href="http://info.wins.uva.nl/~mes/jargon/">Holland</A></LI>
-<LI><A href="http://www.tuxedo.org/~esr/jargon">home page</A></LI>
-</UL>
-<P>There are also many mirrors of this. See the home page for a list.</P>
-</LI>
-<LI>A general<A href="http://www.trinity.edu/~rjensen/245glosf.htm#Navigate">
- technology glossary</A></LI>
-<LI>An<A href="http://www.yourdictionary.com/"> online dictionary
- resource page</A> with pointers to many dictionaries for many languages</LI>
-<LI>A<A href="http://www.onelook.com/"> search engine</A> that accesses
- several hundred online dictionaries</LI>
-<LI>O'Reilly<A href="http://www.ora.com/reference/dictionary/">
- Dictionary of PC Hardware and Data Communications Terms</A></LI>
-<LI><A href="http://www.FreeSoft.org/CIE/index.htm">Connected</A>
- Internet encyclopedia</LI>
-<LI><A href="http://www.whatis.com/">whatis.com</A></LI>
-</UL>
-<HR>
-<H2><A name="definitions">Definitions</A></H2>
-<DL>
-<DT><A name="0">0</A></DT>
-<DT><A name="3DES">3DES (Triple DES)</A></DT>
-<DD>Using three<A href="#DES"> DES</A> encryptions on a single data
- block, with at least two different keys, to get higher security than is
- available from a single DES pass. The three-key version of 3DES is the
- default encryption algorithm for<A href="web.html#FreeSWAN"> Linux
- FreeS/WAN</A>.
-<P><A href="#IPSEC">IPsec</A> always does 3DES with three different
- keys, as required by RFC 2451. For an explanation of the two-key
- variant, see<A href="#2key"> two key triple DES</A>. Both use an<A href="#EDE">
- EDE</A> encrypt-decrypt-encrpyt sequence of operations.</P>
-<P>Single<A href="#DES"> DES</A> is<A href="politics.html#desnotsecure">
- insecure</A>.</P>
-<P>Double DES is ineffective. Using two 56-bit keys, one might expect an
- attacker to have to do 2<SUP>112</SUP> work to break it. In fact, only
- 2<SUP>57</SUP> work is required with a<A href="#meet">
- meet-in-the-middle attack</A>, though a large amount of memory is also
- required. Triple DES is vulnerable to a similar attack, but that just
- reduces the work factor from the 2<SUP>168</SUP> one might expect to 2<SUP>
-112</SUP>. That provides adequate protection against<A href="#brute">
- brute force</A> attacks, and no better attack is known.</P>
-<P>3DES can be somewhat slow compared to other ciphers. It requires
- three DES encryptions per block. DES was designed for hardware
- implementation and includes some operations which are difficult in
- software. However, the speed we get is quite acceptable for many uses.
- See our<A href="performance.html"> performance</A> document for
- details.</P>
-</DD>
-<DT><A name="A">A</A></DT>
-<DT><A name="active">Active attack</A></DT>
-<DD>An attack in which the attacker does not merely eavesdrop (see<A href="#passive">
- passive attack</A>) but takes action to change, delete, reroute, add,
- forge or divert data. Perhaps the best-known active attack is<A href="#middle">
- man-in-the-middle</A>. In general,<A href="#authentication">
- authentication</A> is a useful defense against active attacks.</DD>
-<DT><A name="AES">AES</A></DT>
-<DD>The<B> A</B>dvanced<B> E</B>ncryption<B> S</B>tandard -- a new<A href="#block">
- block cipher</A> standard to replace<A href="politics.html#desnotsecure">
- DES</A> -- developed by<A href="#NIST"> NIST</A>, the US National
- Institute of Standards and Technology. DES used 64-bit blocks and a
- 56-bit key. AES ciphers use a 128-bit block and 128, 192 or 256-bit
- keys. The larger block size helps resist<A href="#birthday"> birthday
- attacks</A> while the large key size prevents<A href="#brute"> brute
- force attacks</A>.
-<P>Fifteen proposals meeting NIST's basic criteria were submitted in
- 1998 and subjected to intense discussion and analysis, &quot;round one&quot;
- evaluation. In August 1999, NIST narrowed the field to five &quot;round two&quot;
- candidates:</P>
-<UL>
-<LI><A href="http://www.research.ibm.com/security/mars.html">Mars</A>
- from IBM</LI>
-<LI><A href="http://www.rsa.com/rsalabs/aes/">RC6</A> from RSA</LI>
-<LI><A href="http://www.esat.kuleuven.ac.be/~rijmen/rijndael/">Rijndael</A>
- from two Belgian researchers</LI>
-<LI><A href="http://www.cl.cam.ac.uk/~rja14/serpent.html">Serpent</A>, a
- British-Norwegian-Israeli collaboration</LI>
-<LI><A href="http://www.counterpane.com/twofish.html">Twofish</A> from
- the consulting firm<A href="http://www.counterpane.com"> Counterpane</A>
-</LI>
-</UL>
-<P>Three of the five finalists -- Rijndael, Serpent and Twofish -- have
- completely open licenses.</P>
-<P>In October 2000, NIST announced the winner -- Rijndael.</P>
-<P>For more information, see:</P>
-<UL>
-<LI>NIST's<A href="http://csrc.nist.gov/encryption/aes/aes_home.htm">
- AES home page</A></LI>
-<LI>the Block Cipher Lounge<A href="http://www.ii.uib.no/~larsr/aes.html">
- AES page</A></LI>
-<LI>Brian Gladman's<A href="http://fp.gladman.plus.com/cryptography_technology/index.htm">
- code and benchmarks</A></LI>
-<LI>Helger Lipmaa's<A href="http://www.tcs.hut.fi/~helger/aes/"> survey
- of implementations</A></LI>
-</UL>
-<P>AES will be added to a future release of<A href="web.html#FreeSWAN">
- Linux FreeS/WAN</A>. Likely we will add all three of the finalists with
- good licenses. User-written<A href="web.html#patch"> AES patches</A>
- are already available.</P>
-<P>Adding AES may also require adding stronger hashes,<A href="#SHA-256">
- SHA-256, SHA-384 and SHA-512</A>.</P>
-</DD>
-<DT><A name="AH">AH</A></DT>
-<DD>The<A href="#IPSEC"> IPsec</A><B> A</B>uthentication<B> H</B>eader,
- added after the IP header. For details, see our<A href="ipsec.html#AH.ipsec">
- IPsec</A> document and/or RFC 2402.</DD>
-<DT><A name="alicebob">Alice and Bob</A></DT>
-<DD>A and B, the standard example users in writing on cryptography and
- coding theory. Carol and Dave join them for protocols which require
- more players.
-<P>Bruce Schneier extends these with many others such as Eve the
- Eavesdropper and Victor the Verifier. His extensions seem to be in the
- process of becoming standard as well. See page 23 of<A href="biblio.html#schneier">
- Applied Cryptography</A></P>
-<P>Alice and Bob have an amusing<A href="http://www.conceptlabs.co.uk/alicebob.html">
- biography</A> on the web.</P>
-</DD>
-<DT>ARPA</DT>
-<DD>see<A href="#DARPA"> DARPA</A></DD>
-<DT><A name="ASIO">ASIO</A></DT>
-<DD>Australian Security Intelligence Organisation.</DD>
-<DT>Asymmetric cryptography</DT>
-<DD>See<A href="#public"> public key cryptography</A>.</DD>
-<DT><A name="authentication">Authentication</A></DT>
-<DD>Ensuring that a message originated from the expected sender and has
- not been altered on route.<A href="#IPSEC"> IPsec</A> uses
- authentication in two places:
-<UL>
-<LI>peer authentication, authenticating the players in<A href="#IKE">
- IKE</A>'s<A href="#DH"> Diffie-Hellman</A> key exchanges to prevent<A href="#middle">
- man-in-the-middle attacks</A>. This can be done in a number of ways.
- The methods supported by FreeS/WAN are discussed in our<A href="adv_config.html#choose">
- advanced configuration</A> document.</LI>
-<LI>packet authentication, authenticating packets on an established<A href="#SA">
- SA</A>, either with a separate<A href="#AH"> authentication header</A>
- or with the optional authentication in the<A href="#ESP"> ESP</A>
- protocol. In either case, packet authentication uses a<A href="#HMAC">
- hashed message athentication code</A> technique.</LI>
-</UL>
-<P>Outside IPsec, passwords are perhaps the most common authentication
- mechanism. Their function is essentially to authenticate the person's
- identity to the system. Passwords are generally only as secure as the
- network they travel over. If you send a cleartext password over a
- tapped phone line or over a network with a packet sniffer on it, the
- security provided by that password becomes zero. Sending an encrypted
- password is no better; the attacker merely records it and reuses it at
- his convenience. This is called a<A href="#replay"> replay</A> attack.</P>
-<P>A common solution to this problem is a<A href="#challenge">
- challenge-response</A> system. This defeats simple eavesdropping and
- replay attacks. Of course an attacker might still try to break the
- cryptographic algorithm used, or the<A href="#random"> random number</A>
- generator.</P>
-</DD>
-<DT><A name="auto">Automatic keying</A></DT>
-<DD>A mode in which keys are automatically generated at connection
- establisment and new keys automaically created periodically thereafter.
- Contrast with<A href="ipsec.html#manual"> manual keying</A> in which a
- single stored key is used.
-<P>IPsec uses the<A href="#DH"> Diffie-Hellman key exchange protocol</A>
- to create keys. An<A href="#authentication"> authentication</A>
- mechansim is required for this. FreeS/WAN normally uses<A href="#RSA">
- RSA</A> for this. Other methods supported are discussed in our<A href="adv_config.html#choose">
- advanced configuration</A> document.</P>
-<P>Having an attacker break the authentication is emphatically not a
- good idea. An attacker that breaks authentication, and manages to
- subvert some other network entities (DNS, routers or gateways), can use
- a<A href="#middle"> man-in-the middle attack</A> to break the security
- of your IPsec connections.</P>
-<P>However, having an attacker break the authentication in automatic
- keying is not quite as bad as losing the key in manual keying.</P>
-<UL>
-<LI>An attacker who reads /etc/ipsec.conf and gets the keys for a
- manually keyed connection can, without further effort, read all
- messages encrypted with those keys, including any old messages he may
- have archived.</LI>
-<LI>Automatic keying has a property called<A href="#PFS"> perfect
- forward secrecy</A>. An attacker who breaks the authentication gets
- none of the automatically generated keys and cannot immediately read
- any messages. He has to mount a successful<A href="#middle">
- man-in-the-middle attack</A> in real time before he can read anything.
- He cannot read old archived messages at all and will not be able to
- read any future messages not caught by man-in-the-middle tricks.</LI>
-</UL>
-<P>That said, the secrets used for authentication, stored in<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets(5)</A>, should still be protected as tightly as
- cryptographic keys.</P>
-</DD>
-<DT><A name="B">B</A></DT>
-<DT><A href="http://www.nortelnetworks.com">Bay Networks</A></DT>
-<DD>A vendor of routers, hubs and related products, now a subsidiary of
- Nortel. Interoperation between their IPsec products and Linux FreeS/WAN
- was problematic at last report; see our<A href="interop.html#bay">
- interoperation</A> section.</DD>
-<DT><A name="benchmarks">benchmarks</A></DT>
-<DD>Our default block cipher,<A href="#3DES"> triple DES</A>, is slower
- than many alternate ciphers that might be used. Speeds achieved,
- however, seem adequate for many purposes. For example, the assembler
- code from the<A href="#LIBDES"> LIBDES</A> library we use encrypts 1.6
- megabytes per second on a Pentium 200, according to the test program
- supplied with the library.
-<P>For more detail, see our document on<A href="performance.html">
- FreeS/WAN performance</A>.</P>
-</DD>
-<DT><A name="BIND">BIND</A></DT>
-<DD><B>B</B>erkeley<B> I</B>nternet<B> N</B>ame<B> D</B>aemon, a widely
- used implementation of<A href="ipsec.html#DNS"> DNS</A> (Domain Name
- Service). See our bibliography for a<A href="ipsec.html#DNS"> useful
- reference</A>. See the<A href="http://www.isc.org/bind.html"> BIND home
- page</A> for more information and the latest version.</DD>
-<DT><A name="birthday">Birthday attack</A></DT>
-<DD>A cryptographic attack based on the mathematics exemplified by the<A href="#paradox">
- birthday paradox</A>. This math turns up whenever the question of two
- cryptographic operations producing the same result becomes an issue:
-<UL>
-<LI><A href="#collision">collisions</A> in<A href="#digest"> message
- digest</A> functions.</LI>
-<LI>identical output blocks from a<A href="#block"> block cipher</A></LI>
-<LI>repetition of a challenge in a<A href="#challenge">
- challenge-response</A> system</LI>
-</UL>
-<P>Resisting such attacks is part of the motivation for:</P>
-<UL>
-<LI>hash algorithms such as<A href="#SHA"> SHA</A> and<A href="#RIPEMD">
- RIPEMD-160</A> giving a 160-bit result rather than the 128 bits of<A href="#MD4">
- MD4</A>,<A href="#MD5"> MD5</A> and<A href="#RIPEMD"> RIPEMD-128</A>.</LI>
-<LI><A href="#AES">AES</A> block ciphers using a 128-bit block instead
- of the 64-bit block of most current ciphers</LI>
-<LI><A href="#IPSEC">IPsec</A> using a 32-bit counter for packets sent
- on an<A href="ipsec.html#auto"> automatically keyed</A><A href="#SA">
- SA</A> and requiring that the connection always be rekeyed before the
- counter overflows.</LI>
-</UL>
-</DD>
-<DT><A name="paradox">Birthday paradox</A></DT>
-<DD>Not really a paradox, just a rather counter-intuitive mathematical
- fact. In a group of 23 people, the chance of a least one pair having
- the same birthday is over 50%.
-<P>The second person has 1 chance in 365 (ignoring leap years) of
- matching the first. If they don't match, the third person's chances of
- matching one of them are 2/365. The 4th, 3/365, and so on. The total of
- these chances grows more quickly than one might guess.</P>
-</DD>
-<DT><A name="block">Block cipher</A></DT>
-<DD>A<A href="#symmetric"> symmetric cipher</A> which operates on
- fixed-size blocks of plaintext, giving a block of ciphertext for each.
- Contrast with<A href="#stream"> stream cipher</A>. Block ciphers can be
- used in various<A href="#mode"> modes</A> when multiple block are to be
- encrypted.
-<P><A href="#DES">DES</A> is among the the best known and widely used
- block ciphers, but is now obsolete. Its 56-bit key size makes it<A href="politics.html#desnotsecure">
- highly insecure</A> today.<A href="#3DES"> Triple DES</A> is the
- default block cipher for<A href="web.html#FreeSWAN"> Linux FreeS/WAN</A>
-.</P>
-<P>The current generation of block ciphers -- such as<A href="#Blowfish">
- Blowfish</A>,<A href="#CAST128"> CAST-128</A> and<A href="#IDEA"> IDEA</A>
- -- all use 64-bit blocks and 128-bit keys. The next generation,<A href="#AES">
- AES</A>, uses 128-bit blocks and supports key sizes up to 256 bits.</P>
-<P>The<A href="http://www.ii.uib.no/~larsr/bc.html"> Block Cipher Lounge</A>
- web site has more information.</P>
-</DD>
-<DT><A name="Blowfish">Blowfish</A></DT>
-<DD>A<A href="#block"> block cipher</A> using 64-bit blocks and keys of
- up to 448 bits, designed by<A href="biblio.html#schneier"> Bruce
- Schneier</A> and used in several products.
-<P>This is not required by the<A href="#IPSEC"> IPsec</A> RFCs and not
- currently used in<A href="web.html#FreeSWAN"> Linux FreeS/WAN</A>.</P>
-</DD>
-<DT><A name="brute">Brute force attack (exhaustive search)</A></DT>
-<DD>Breaking a cipher by trying all possible keys. This is always
- possible in theory (except against a<A href="#OTP"> one-time pad</A>),
- but it becomes practical only if the key size is inadequate. For an
- important example, see our document on the<A href="politics.html#desnotsecure">
- insecurity of DES</A> with its 56-bit key. For an analysis of key sizes
- required to resist plausible brute force attacks, see<A href="http://www.counterpane.com/keylength.html">
- this paper</A>.
-<P>Longer keys protect against brute force attacks. Each extra bit in
- the key doubles the number of possible keys and therefore doubles the
- work a brute force attack must do. A large enough key defeats<STRONG>
- any</STRONG> brute force attack.</P>
-<P>For example, the EFF's<A href="#EFF"> DES Cracker</A> searches a
- 56-bit key space in an average of a few days. Let us assume an attacker
- that can find a 64-bit key (256 times harder) by brute force search in
- a second (a few hundred thousand times faster). For a 96-bit key, that
- attacker needs 2<SUP>32</SUP> seconds, about 135 years. Against a
- 128-bit key, he needs 2<SUP>32</SUP> times that, over 500,000,000,000
- years. Your data is then obviously secure against brute force attacks.
- Even if our estimate of the attacker's speed is off by a factor of a
- million, it still takes him over 500,000 years to crack a message.</P>
-<P>This is why</P>
-<UL>
-<LI>single<A href="#DES"> DES</A> is now considered<A href="politics.html#desnotsecure">
- dangerously insecure</A></LI>
-<LI>all of the current generation of<A href="#block"> block ciphers</A>
- use a 128-bit or longer key</LI>
-<LI><A href="#AES">AES</A> ciphers support keysizes 128, 192 and 256
- bits</LI>
-<LI>any cipher we add to Linux FreeS/WAN will have<EM> at least</EM> a
- 128-bit key</LI>
-</UL>
-<P><STRONG>Cautions:</STRONG>
-<BR><EM> Inadequate keylength always indicates a weak cipher</EM> but it
- is important to note that<EM> adequate keylength does not necessarily
- indicate a strong cipher</EM>. There are many attacks other than brute
- force, and adequate keylength<EM> only</EM> guarantees resistance to
- brute force. Any cipher, whatever its key size, will be weak if design
- or implementation flaws allow other attacks.</P>
-<P>Also,<EM> once you have adequate keylength</EM> (somewhere around 90
- or 100 bits),<EM> adding more key bits make no practical difference</EM>
-, even against brute force. Consider our 128-bit example above that
- takes 500,000,000,000 years to break by brute force. We really don't
- care how many zeroes there are on the end of that, as long as the
- number remains ridiculously large. That is, we don't care exactly how
- large the key is as long as it is large enough.</P>
-<P>There may be reasons of convenience in the design of the cipher to
- support larger keys. For example<A href="#Blowfish"> Blowfish</A>
- allows up to 448 bits and<A href="#RC4"> RC4</A> up to 2048, but beyond
- 100-odd bits it makes no difference to practical security.</P>
-</DD>
-<DT>Bureau of Export Administration</DT>
-<DD>see<A href="#BXA"> BXA</A></DD>
-<DT><A name="BXA">BXA</A></DT>
-<DD>The US Commerce Department's<B> B</B>ureau of E<B>x</B>port<B> A</B>
-dministration which administers the<A href="#EAR"> EAR</A> Export
- Administration Regulations controling the export of, among other
- things, cryptography.</DD>
-<DT><A name="C">C</A></DT>
-<DT><A name="CA">CA</A></DT>
-<DD><B>C</B>ertification<B> A</B>uthority, an entity in a<A href="#PKI">
- public key infrastructure</A> that can certify keys by signing them.
- Usually CAs form a hierarchy. The top of this hierarchy is called the<A href="#rootCA">
- root CA</A>.
-<P>See<A href="#web"> Web of Trust</A> for an alternate model.</P>
-</DD>
-<DT><A name="CAST128">CAST-128</A></DT>
-<DD>A<A href="#block"> block cipher</A> using 64-bit blocks and 128-bit
- keys, described in RFC 2144 and used in products such as<A href="#Entrust">
- Entrust</A> and recent versions of<A href="#PGP"> PGP</A>.
-<P>This is not required by the<A href="#IPSEC"> IPsec</A> RFCs and not
- currently used in<A href="web.html#FreeSWAN"> Linux FreeS/WAN</A>.</P>
-</DD>
-<DT>CAST-256</DT>
-<DD><A href="#Entrust">Entrust</A>'s candidate cipher for the<A href="#AES">
- AES standard</A>, largely based on the<A href="#CAST128"> CAST-128</A>
- design.</DD>
-<DT><A name="CBC">CBC mode</A></DT>
-<DD><B>C</B>ipher<B> B</B>lock<B> C</B>haining<A href="#mode"> mode</A>,
- a method of using a<A href="#block"> block cipher</A> in which for each
- block except the first, the result of the previous encryption is XORed
- into the new block before it is encrypted. CBC is the mode used in<A href="#IPSEC">
- IPsec</A>.
-<P>An<A href="#IV"> initialisation vector</A> (IV) must be provided. It
- is XORed into the first block before encryption. The IV need not be
- secret but should be different for each message and unpredictable.</P>
-</DD>
-<DT><A name="CIDR">CIDR</A></DT>
-<DD><B>C</B>lassless<B> I</B>nter-<B>D</B>omain<B> R</B>outing, an
- addressing scheme used to describe networks not restricted to the old
- Class A, B, and C sizes. A CIDR block is written<VAR> address</VAR>/<VAR>
-mask</VAR>, where<VAR> address</VAR> is a 32-bit Internet address. The
- first<VAR> mask</VAR> bits of<VAR> address</VAR> are part of the
- gateway address, while the remaining bits designate other host
- addresses. For example, the CIDR block 192.0.2.96/27 describes a
- network with gateway 192.0.2.96, hosts 192.0.2.96 through 192.0.2.126
- and broadcast 192.0.2.127.
-<P>FreeS/WAN policy group files accept CIDR blocks of the format<VAR>
- address</VAR>/[<VAR>mask</VAR>], where<VAR> address</VAR> may take the
- form<VAR> name.domain.tld</VAR>. An absent<VAR> mask</VAR> is assumed
- to be /32.</P>
-</DD>
-<DT>Certification Authority</DT>
-<DD>see<A href="#CA"> CA</A></DD>
-<DT><A name="challenge">Challenge-response authentication</A></DT>
-<DD>An<A href="#authentication"> authentication</A> system in which one
- player generates a<A href="#random"> random number</A>, encrypts it and
- sends the result as a challenge. The other player decrypts and sends
- back the result. If the result is correct, that proves to the first
- player that the second player knew the appropriate secret, required for
- the decryption. Variations on this technique exist using<A href="#public">
- public key</A> or<A href="#symmetric"> symmetric</A> cryptography. Some
- provide two-way authentication, assuring each player of the other's
- identity.
-<P>This is more secure than passwords against two simple attacks:</P>
-<UL>
-<LI>If cleartext passwords are sent across the wire (e.g. for telnet),
- an eavesdropper can grab them. The attacker may even be able to break
- into other systems if the user has chosen the same password for them.</LI>
-<LI>If an encrypted password is sent, an attacker can record the
- encrypted form and use it later. This is called a replay attack.</LI>
-</UL>
-<P>A challenge-response system never sends a password, either cleartext
- or encrypted. An attacker cannot record the response to one challenge
- and use it as a response to a later challenge. The random number is
- different each time.</P>
-<P>Of course an attacker might still try to break the cryptographic
- algorithm used, or the<A href="#random"> random number</A> generator.</P>
-</DD>
-<DT><A name="mode">Cipher Modes</A></DT>
-<DD>Different ways of using a block cipher when encrypting multiple
- blocks.
-<P>Four standard modes were defined for<A href="#DES"> DES</A> in<A href="#FIPS">
- FIPS</A> 81. They can actually be applied with any block cipher.</P>
-<TABLE><TBODY></TBODY>
-<TR><TD></TD><TD><A href="#ECB">ECB</A></TD><TD>Electronic CodeBook</TD><TD>
-encrypt each block independently</TD></TR>
-<TR><TD></TD><TD><A href="#CBC">CBC</A></TD><TD>Cipher Block Chaining
-<BR></TD><TD>XOR previous block ciphertext into new block plaintext
- before encrypting new block</TD></TR>
-<TR><TD></TD><TD>CFB</TD><TD>Cipher FeedBack</TD><TD></TD></TR>
-<TR><TD></TD><TD>OFB</TD><TD>Output FeedBack</TD><TD></TD></TR>
-</TABLE>
-<P><A href="#IPSEC">IPsec</A> uses<A href="#CBC"> CBC</A> mode since
- this is only marginally slower than<A href="#ECB"> ECB</A> and is more
- secure. In ECB mode the same plaintext always encrypts to the same
- ciphertext, unless the key is changed. In CBC mode, this does not
- occur.</P>
-<P>Various other modes are also possible, but none of them are used in
- IPsec.</P>
-</DD>
-<DT><A name="ciphertext">Ciphertext</A></DT>
-<DD>The encrypted output of a cipher, as opposed to the unencrypted<A href="#plaintext">
- plaintext</A> input.</DD>
-<DT><A href="http://www.cisco.com">Cisco</A></DT>
-<DD>A vendor of routers, hubs and related products. Their IPsec products
- interoperate with Linux FreeS/WAN; see our<A href="interop.html#Cisco">
- interop</A> section.</DD>
-<DT><A name="client">Client</A></DT>
-<DD>This term has at least two distinct uses in discussing IPsec:
-<UL>
-<LI>The<STRONG> clients of an IPsec gateway</STRONG> are the machines it
- protects, typically on one or more subnets behind the gateway. In this
- usage, all the machines on an office network are clients of that
- office's IPsec gateway. Laptop or home machines connecting to the
- office, however, are<EM> not</EM> clients of that gateway. They are
- remote gateways, running the other end of an IPsec connection. Each of
- them is also its own client.</LI>
-<LI><STRONG>IPsec client software</STRONG> is used to describe software
- which runs on various standalone machines to let them connect to IPsec
- networks. In this usage, a laptop or home machine connecting to the
- office is a client, and the office gateway is the server.</LI>
-</UL>
-<P>We generally use the term in the first sense. Vendors of Windows
- IPsec solutions often use it in the second. See this<A href="interop.html#client.server">
- discussion</A>.</P>
-</DD>
-<DT><A name="cc">Common Criteria</A></DT>
-<DD>A set of international security classifications which are replacing
- the old US<A href="#rainbow"> Rainbow Book</A> standards and similar
- standards in other countries.
-<P>Web references include this<A href="http://csrc.nist.gov/cc"> US
- government site</A> and this<A href="http://www.commoncriteria.org">
- global home page</A>.</P>
-</DD>
-<DT>Conventional cryptography</DT>
-<DD>See<A href="#symmetric"> symmetric cryptography</A></DD>
-<DT><A name="collision">Collision resistance</A></DT>
-<DD>The property of a<A href="#digest"> message digest</A> algorithm
- which makes it hard for an attacker to find or construct two inputs
- which hash to the same output.</DD>
-<DT>Copyleft</DT>
-<DD>see GNU<A href="#GPL"> General Public License</A></DD>
-<DT><A name="CSE">CSE</A></DT>
-<DD><A href="http://www.cse-cst.gc.ca/">Communications Security
- Establishment</A>, the Canadian organisation for<A href="#SIGINT">
- signals intelligence</A>.</DD>
-<DT><A name="D">D</A></DT>
-<DT><A name="DARPA">DARPA (sometimes just ARPA)</A></DT>
-<DD>The US government's<B> D</B>efense<B> A</B>dvanced<B> R</B>esearch<B>
- P</B>rojects<B> A</B>gency. Projects they have funded over the years
- have included the Arpanet which evolved into the Internet, the TCP/IP
- protocol suite (as a replacement for the original Arpanet suite), the
- Berkeley 4.x BSD Unix projects, and<A href="#SDNS"> Secure DNS</A>.
-<P>For current information, see their<A href="http://www.darpa.mil/ito">
- web site</A>.</P>
-</DD>
-<DT><A name="DOS">Denial of service (DoS) attack</A></DT>
-<DD>An attack that aims at denying some service to legitimate users of a
- system, rather than providing a service to the attacker.
-<UL>
-<LI>One variant is a flooding attack, overwhelming the system with too
- many packets, to much email, or whatever.</LI>
-<LI>A closely related variant is a resource exhaustion attack. For
- example, consider a &quot;TCP SYN flood&quot; attack. Setting up a TCP connection
- involves a three-packet exchange:
-<UL>
-<LI>Initiator: Connection please (SYN)</LI>
-<LI>Responder: OK (ACK)</LI>
-<LI>Initiator: OK here too</LI>
-</UL>
-<P>If the attacker puts bogus source information in the first packet,
- such that the second is never delivered, the responder may wait a long
- time for the third to come back. If responder has already allocated
- memory for the connection data structures, and if many of these bogus
- packets arrive, the responder may run out of memory.</P>
-</LI>
-<LI>Another variant is to feed the system undigestible data, hoping to
- make it sick. For example, IP packets are limited in size to 64K bytes
- and a fragment carries information on where it starts within that 64K
- and how long it is. The &quot;ping of death&quot; delivers fragments that say,
- for example, that they start at 60K and are 20K long. Attempting to
- re-assemble these without checking for overflow can be fatal.</LI>
-</UL>
-<P>The two example attacks discussed were both quite effective when
- first discovered, capable of crashing or disabling many operating
- systems. They were also well-publicised, and today far fewer systems
- are vulnerable to them.</P>
-</DD>
-<DT><A name="DES">DES</A></DT>
-<DD>The<B> D</B>ata<B> E</B>ncryption<B> S</B>tandard, a<A href="#block">
- block cipher</A> with 64-bit blocks and a 56-bit key. Probably the most
- widely used<A href="#symmetric"> symmetric cipher</A> ever devised. DES
- has been a US government standard for their own use (only for
- unclassified data), and for some regulated industries such as banking,
- since the late 70's. It is now being replaced by<A href="#AES"> AES</A>
-.
-<P><A href="politics.html#desnotsecure">DES is seriously insecure
- against current attacks.</A></P>
-<P><A href="web.html#FreeSWAN">Linux FreeS/WAN</A> does not include DES,
- even though the RFCs specify it.<B> We strongly recommend that single
- DES not be used.</B></P>
-<P>See also<A href="#3DES"> 3DES</A> and<A href="#DESX"> DESX</A>,
- stronger ciphers based on DES.</P>
-</DD>
-<DT><A name="DESX">DESX</A></DT>
-<DD>An improved<A href="#DES"> DES</A> suggested by Ron Rivest of RSA
- Data Security. It XORs extra key material into the text before and
- after applying the DES cipher.
-<P>This is not required by the<A href="#IPSEC"> IPsec</A> RFCs and not
- currently used in<A href="web.html#FreeSWAN"> Linux FreeS/WAN</A>. DESX
- would be the easiest additional transform to add; there would be very
- little code to write. It would be much faster than 3DES and almost
- certainly more secure than DES. However, since it is not in the RFCs
- other IPsec implementations cannot be expected to have it.</P>
-</DD>
-<DT>DH</DT>
-<DD>see<A href="#DH"> Diffie-Hellman</A></DD>
-<DT><A name="DHCP">DHCP</A></DT>
-<DD><STRONG>D</STRONG>ynamic<STRONG> H</STRONG>ost<STRONG> C</STRONG>
-onfiguration<STRONG> P</STRONG>rotocol, a method of assigning<A href="#dynamic">
- dynamic IP addresses</A>, and providing additional information such as
- addresses of DNS servers and of gateways. See this<A href="http://www.dhcp.org">
- DHCP resource page.</A></DD>
-<DT><A name="DH">Diffie-Hellman (DH) key exchange protocol</A></DT>
-<DD>A protocol that allows two parties without any initial shared secret
- to create one in a manner immune to eavesdropping. Once they have done
- this, they can communicate privately by using that shared secret as a
- key for a block cipher or as the basis for key exchange.
-<P>The protocol is secure against all<A href="#passive"> passive attacks</A>
-, but it is not at all resistant to active<A href="#middle">
- man-in-the-middle attacks</A>. If a third party can impersonate Bob to
- Alice and vice versa, then no useful secret can be created.
- Authentication of the participants is a prerequisite for safe
- Diffie-Hellman key exchange. IPsec can use any of several<A href="#authentication">
- authentication</A> mechanisims. Those supported by FreeS/WAN are
- discussed in our<A href="config.html#choose"> configuration</A>
- section.</P>
-<P>The Diffie-Hellman key exchange is based on the<A href="#dlog">
- discrete logarithm</A> problem and is secure unless someone finds an
- efficient solution to that problem.</P>
-<P>Given a prime<VAR> p</VAR> and generator<VAR> g</VAR> (explained
- under<A href="#dlog"> discrete log</A> below), Alice:</P>
-<UL>
-<LI>generates a random number<VAR> a</VAR></LI>
-<LI>calculates<VAR> A = g^a modulo p</VAR></LI>
-<LI>sends<VAR> A</VAR> to Bob</LI>
-</UL>
-<P>Meanwhile Bob:</P>
-<UL>
-<LI>generates a random number<VAR> b</VAR></LI>
-<LI>calculates<VAR> B = g^b modulo p</VAR></LI>
-<LI>sends<VAR> B</VAR> to Alice</LI>
-</UL>
-<P>Now Alice and Bob can both calculate the shared secret<VAR> s =
- g^(ab)</VAR>. Alice knows<VAR> a</VAR> and<VAR> B</VAR>, so she
- calculates<VAR> s = B^a</VAR>. Bob knows<VAR> A</VAR> and<VAR> b</VAR>
- so he calculates<VAR> s = A^b</VAR>.</P>
-<P>An eavesdropper will know<VAR> p</VAR> and<VAR> g</VAR> since these
- are made public, and can intercept<VAR> A</VAR> and<VAR> B</VAR> but,
- short of solving the<A href="#dlog"> discrete log</A> problem, these do
- not let him or her discover the secret<VAR> s</VAR>.</P>
-</DD>
-<DT><A name="signature">Digital signature</A></DT>
-<DD>Sender:
-<UL>
-<LI>calculates a<A href="#digest"> message digest</A> of a document</LI>
-<LI>encrypts the digest with his or her private key, using some<A href="#public">
- public key cryptosystem</A>.</LI>
-<LI>attaches the encrypted digest to the document as a signature</LI>
-</UL>
-<P>Receiver:</P>
-<UL>
-<LI>calculates a digest of the document (not including the signature)</LI>
-<LI>decrypts the signature with the signer's public key</LI>
-<LI>verifies that the two results are identical</LI>
-</UL>
-<P>If the public-key system is secure and the verification succeeds,
- then the receiver knows</P>
-<UL>
-<LI>that the document was not altered between signing and verification</LI>
-<LI>that the signer had access to the private key</LI>
-</UL>
-<P>Such an encrypted message digest can be treated as a signature since
- it cannot be created without<EM> both</EM> the document<EM> and</EM>
- the private key which only the sender should possess. The<A href="web.html#legal">
- legal issues</A> are complex, but several countries are moving in the
- direction of legal recognition for digital signatures.</P>
-</DD>
-<DT><A name="dlog">discrete logarithm problem</A></DT>
-<DD>The problem of finding logarithms in a finite field. Given a field
- defintion (such definitions always include some operation analogous to
- multiplication) and two numbers, a base and a target, find the power
- which the base must be raised to in order to yield the target.
-<P>The discrete log problem is the basis of several cryptographic
- systems, including the<A href="#DH"> Diffie-Hellman</A> key exchange
- used in the<A href="#IKE"> IKE</A> protocol. The useful property is
- that exponentiation is relatively easy but the inverse operation,
- finding the logarithm, is hard. The cryptosystems are designed so that
- the user does only easy operations (exponentiation in the field) but an
- attacker must solve the hard problem (discrete log) to crack the
- system.</P>
-<P>There are several variants of the problem for different types of
- field. The IKE/Oakley key determination protocol uses two variants,
- either over a field modulo a prime or over a field defined by an
- elliptic curve. We give an example modulo a prime below. For the
- elliptic curve version, consult an advanced text such as<A href="biblio.html#handbook">
- Handbook of Applied Cryptography</A>.</P>
-<P>Given a prime<VAR> p</VAR>, a generator<VAR> g</VAR> for the field
- modulo that prime, and a number<VAR> x</VAR> in the field, the problem
- is to find<VAR> y</VAR> such that<VAR> g^y = x</VAR>.</P>
-<P>For example, let p = 13. The field is then the integers from 0 to 12.
- Any integer equals one of these modulo 13. That is, the remainder when
- any integer is divided by 13 must be one of these.</P>
-<P>2 is a generator for this field. That is, the powers of two modulo 13
- run through all the non-zero numbers in the field. Modulo 13 we have:</P>
-<PRE>          y      x
-        2^0  ==  1
-        2^1  ==  2
-        2^2  ==  4
-        2^3  ==  8
-        2^4  ==  3 that is, the remainder from 16/13 is 3
-        2^5  ==  6          the remainder from 32/13 is 6
-        2^6  == 12 and so on
-        2^7  == 11
-        2^8  ==  9
-        2^9  ==  5
-        2^10 == 10
-        2^11 ==  7
-        2^12 ==  1</PRE>
-<P>Exponentiation in such a field is not difficult. Given, say,<NOBR><VAR>
- y = 11</VAR>,calculating<NOBR><VAR> x = 7</VAR>is straightforward. One
- method is just to calculate<NOBR><VAR> 2^11 = 2048</VAR>,then<NOBR><VAR>
- 2048 mod 13 == 7</VAR>.When the field is modulo a large prime (say a
- few 100 digits) you need a silghtly cleverer method and even that is
- moderately expensive in computer time, but the calculation is still not
- problematic in any basic way.</P>
-<P>The discrete log problem is the reverse. In our example, given<NOBR><VAR>
- x = 7</VAR>,find the logarithm<NOBR><VAR> y = 11</VAR>.When the field
- is modulo a large prime (or is based on a suitable elliptic curve),
- this is indeed problematic. No solution method that is not
- catastrophically expensive is known. Quite a few mathematicians have
- tackled this problem. No efficient method has been found and
- mathematicians do not expect that one will be. It seems likely no
- efficient solution to either of the main variants the discrete log
- problem exists.</P>
-<P>Note, however, that no-one has proven such methods do not exist. If a
- solution to either variant were found, the security of any crypto
- system using that variant would be destroyed. This is one reason<A href="#IKE">
- IKE</A> supports two variants. If one is broken, we can switch to the
- other.</P>
-</DD>
-<DT><A name="discretionary">discretionary access control</A></DT>
-<DD>access control mechanisms controlled by the user, for example Unix
- rwx file permissions. These contrast with<A href="#mandatory">
- mandatory access controls</A>.</DD>
-<DT><A name="DNS">DNS</A></DT>
-<DD><B>D</B>omain<B> N</B>ame<B> S</B>ervice, a distributed database
- through which names are associated with numeric addresses and other
- information in the Internet Protocol Suite. See also the<A href="background.html#dns.background">
- DNS background</A> section of our documentation.</DD>
-<DT>DOS attack</DT>
-<DD>see<A href="#DOS"> Denial Of Service</A> attack</DD>
-<DT><A name="dynamic">dynamic IP address</A></DT>
-<DD>an IP address which is automatically assigned, either by<A href="#DHCP">
- DHCP</A> or by some protocol such as<A href="#PPP"> PPP</A> or<A href="#PPPoE">
- PPPoE</A> which the machine uses to connect to the Internet. This is
- the opposite of a<A href="#static"> static IP address</A>, pre-set on
- the machine itself.</DD>
-<DT><A name="E">E</A></DT>
-<DT><A name="EAR">EAR</A></DT>
-<DD>The US government's<B> E</B>xport<B> A</B>dministration<B> R</B>
-egulations, administered by the<A href="#BXA"> Bureau of Export
- Administration</A>. These have replaced the earlier<A href="#ITAR">
- ITAR</A> regulations as the controls on export of cryptography.</DD>
-<DT><A name="ECB">ECB mode</A></DT>
-<DD><B>E</B>lectronic<B> C</B>ode<B>B</B>ook mode, the simplest way to
- use a block cipher. See<A href="#mode"> Cipher Modes</A>.</DD>
-<DT><A name="EDE">EDE</A></DT>
-<DD>The sequence of operations normally used in either the three-key
- variant of<A href="#3DES"> triple DES</A> used in<A href="#IPSEC">
- IPsec</A> or the<A href="#2key"> two-key</A> variant used in some other
- systems.
-<P>The sequence is:</P>
-<UL>
-<LI><B>E</B>ncrypt with key1</LI>
-<LI><B>D</B>ecrypt with key2</LI>
-<LI><B>E</B>ncrypt with key3</LI>
-</UL>
-<P>For the two-key version, key1=key3.</P>
-<P>The &quot;advantage&quot; of this EDE order of operations is that it makes it
- simple to interoperate with older devices offering only single DES. Set
- key1=key2=key3 and you have the worst of both worlds, the overhead of
- triple DES with the &quot;security&quot; of single DES. Since both the<A href="politics.html#desnotsecure">
- security of single DES</A> and the overheads of triple DES are
- seriously inferior to many other ciphers, this is a spectacularly
- dubious &quot;advantage&quot;.</P>
-</DD>
-<DT><A name="Entrust">Entrust</A></DT>
-<DD>A Canadian company offerring enterprise<A href="#PKI"> PKI</A>
- products using<A href="#CAST128"> CAST-128</A> symmetric crypto,<A href="#RSA">
- RSA</A> public key and<A href="#X509"> X.509</A> directories.<A href="http://www.entrust.com">
- Web site</A></DD>
-<DT><A name="EFF">EFF</A></DT>
-<DD><A href="http://www.eff.org">Electronic Frontier Foundation</A>, an
- advocacy group for civil rights in cyberspace.</DD>
-<DT><A name="encryption">Encryption</A></DT>
-<DD>Techniques for converting a readable message (<A href="#plaintext">
-plaintext</A>) into apparently random material (<A href="#ciphertext">
-ciphertext</A>) which cannot be read if intercepted. A key is required
- to read the message.
-<P>Major variants include<A href="#symmetric"> symmetric</A> encryption
- in which sender and receiver use the same secret key and<A href="#public">
- public key</A> methods in which the sender uses one of a matched pair
- of keys and the receiver uses the other. Many current systems,
- including<A href="#IPSEC"> IPsec</A>, are<A href="#hybrid"> hybrids</A>
- combining the two techniques.</P>
-</DD>
-<DT><A name="ESP">ESP</A></DT>
-<DD><B>E</B>ncapsulated<B> S</B>ecurity<B> P</B>ayload, the<A href="#IPSEC">
- IPsec</A> protocol which provides<A href="#encryption"> encryption</A>.
- It can also provide<A href="#authentication"> authentication</A>
- service and may be used with null encryption (which we do not
- recommend). For details see our<A href="ipsec.html#ESP.ipsec"> IPsec</A>
- document and/or RFC 2406.</DD>
-<DT><A name="#extruded">Extruded subnet</A></DT>
-<DD>A situation in which something IP sees as one network is actually in
- two or more places.
-<P>For example, the Internet may route all traffic for a particular
- company to that firm's corporate gateway. It then becomes the company's
- problem to get packets to various machines on their<A href="#subnet">
- subnets</A> in various departments. They may decide to treat a branch
- office like a subnet, giving it IP addresses &quot;on&quot; their corporate net.
- This becomes an extruded subnet.</P>
-<P>Packets bound for it are delivered to the corporate gateway, since as
- far as the outside world is concerned, that subnet is part of the
- corporate network. However, instead of going onto the corporate LAN (as
- they would for, say, the accounting department) they are then
- encapsulated and sent back onto the Internet for delivery to the branch
- office.</P>
-<P>For information on doing this with Linux FreeS/WAN, look in our<A href="adv_config.html#extruded.config">
- advanced configuration</A> section.</P>
-</DD>
-<DT>Exhaustive search</DT>
-<DD>See<A href="#brute"> brute force attack</A>.</DD>
-<DT><A name="F">F</A></DT>
-<DT><A name="FIPS">FIPS</A></DT>
-<DD><B>F</B>ederal<B> I</B>nformation<B> P</B>rocessing<B> S</B>tandard,
- the US government's standards for products it buys. These are issued by<A
-href="#NIST"> NIST</A>. Among other things,<A href="#DES"> DES</A> and<A href="#SHA">
- SHA</A> are defined in FIPS documents. NIST have a<A href="http://www.itl.nist.gov/div897/pubs">
- FIPS home page</A>.</DD>
-<DT><A name="FSF">Free Software Foundation (FSF)</A></DT>
-<DD>An organisation to promote free software, free in the sense of these
- quotes from their web pages</DD>
-<DD><BLOCKQUOTE> &quot;Free software&quot; is a matter of liberty, not price. To
- understand the concept, you should think of &quot;free speech&quot;, not &quot;free
- beer.&quot;
-<P>&quot;Free software&quot; refers to the users' freedom to run, copy,
- distribute, study, change and improve the software.</P>
-</BLOCKQUOTE>
-<P>See also<A href="#GNU"> GNU</A>,<A href="#GPL"> GNU General Public
- License</A>, and<A href="http://www.fsf.org"> the FSF site</A>.</P>
-</DD>
-<DT>FreeS/WAN</DT>
-<DD>see<A href="web.html#FreeSWAN"> Linux FreeS/WAN</A></DD>
-<DT><A name="fullnet">Fullnet</A></DT>
-<DD>The CIDR block containing all IPs of its IP version. The<A HREF="#IPv4">
- IPv4</A> fullnet is written 0.0.0.0/0. Also known as &quot;all&quot; and
- &quot;default&quot;, fullnet may be used in a routing table to specify a default
- route, and in a FreeS/WAN<A HREF="policygroups.html#policygroups">
- policy group</A> file to specify a default IPsec policy.</DD>
-<DT>FSF</DT>
-<DD>see<A href="#FSF"> Free software Foundation</A></DD>
-<DT><A name="G">G</A></DT>
-<DT><A name="GCHQ">GCHQ</A></DT>
-<DD><A href="http://www.gchq.gov.uk">Government Communications
- Headquarters</A>, the British organisation for<A href="#SIGINT">
- signals intelligence</A>.</DD>
-<DT>generator of a prime field</DT>
-<DD>see<A href="#dlog"> discrete logarithm problem</A></DD>
-<DT><A name="GILC">GILC</A></DT>
-<DD><A href="http://www.gilc.org">Global Internet Liberty Campaign</A>,
- an international organisation advocating, among other things, free
- availability of cryptography. They have a<A href="http://www.gilc.org/crypto/wassenaar">
- campaign</A> to remove cryptographic software from the<A href="#Wassenaar.gloss">
- Wassenaar Arrangement</A>.</DD>
-<DT>Global Internet Liberty Campaign</DT>
-<DD>see<A href="#GILC"> GILC</A>.</DD>
-<DT><A name="GTR">Global Trust Register</A></DT>
-<DD>An attempt to create something like a<A href="#rootCA"> root CA</A>
- for<A href="#PGP"> PGP</A> by publishing both<A href="biblio.html#GTR">
- as a book</A> and<A href="http://www.cl.cam.ac.uk/Research/Security/Trust-Register">
- on the web</A> the fingerprints of a set of verified keys for
- well-known users and organisations.</DD>
-<DT><A name="GMP">GMP</A></DT>
-<DD>The<B> G</B>NU<B> M</B>ulti-<B>P</B>recision library code, used in<A href="web.html#FreeSWAN">
- Linux FreeS/WAN</A> by<A href="#Pluto"> Pluto</A> for<A href="#public">
- public key</A> calculations. See the<A href="http://www.swox.com/gmp">
- GMP home page</A>.</DD>
-<DT><A name="GNU">GNU</A></DT>
-<DD><B>G</B>NU's<B> N</B>ot<B> U</B>nix, the<A href="#FSF"> Free
- Software Foundation's</A> project aimed at creating a free system with
- at least the capabilities of Unix.<A href="#Linux"> Linux</A> uses GNU
- utilities extensively.</DD>
-<DT><A name="#GOST">GOST</A></DT>
-<DD>a Soviet government standard<A href="#block"> block cipher</A>.<A href="biblio.html#schneier">
- Applied Cryptography</A> has details.</DD>
-<DT>GPG</DT>
-<DD>see<A href="#GPG"> GNU Privacy Guard</A></DD>
-<DT><A name="GPL">GNU General Public License</A>(GPL, copyleft)</DT>
-<DD>The license developed by the<A href="#FSF"> Free Software Foundation</A>
- under which<A href="#Linux"> Linux</A>,<A href="web.html#FreeSWAN">
- Linux FreeS/WAN</A> and many other pieces of software are distributed.
- The license allows anyone to redistribute and modify the code, but
- forbids anyone from distributing executables without providing access
- to source code. For more details see the file<A href="../COPYING">
- COPYING</A> included with GPLed source distributions, including ours,
- or<A href="http://www.fsf.org/copyleft/gpl.html"> the GNU site's GPL
- page</A>.</DD>
-<DT><A name="GPG">GNU Privacy Guard</A></DT>
-<DD>An open source implementation of Open<A href="#PGP"> PGP</A> as
- defined in RFC 2440. See their<A href="http://www.gnupg.org"> web site</A>
-</DD>
-<DT>GPL</DT>
-<DD>see<A href="#GPL"> GNU General Public License</A>.</DD>
-<DT><A name="H">H</A></DT>
-<DT><A name="hash">Hash</A></DT>
-<DD>see<A href="#digest"> message digest</A></DD>
-<DT><A name="HMAC">Hashed Message Authentication Code (HMAC)</A></DT>
-<DD>using keyed<A href="#digest"> message digest</A> functions to
- authenticate a message. This differs from other uses of these
- functions:
-<UL>
-<LI>In normal usage, the hash function's internal variable are
- initialised in some standard way. Anyone can reproduce the hash to
- check that the message has not been altered.</LI>
-<LI>For HMAC usage, you initialise the internal variables from the key.
- Only someone with the key can reproduce the hash. A successful check of
- the hash indicates not only that the message is unchanged but also that
- the creator knew the key.</LI>
-</UL>
-<P>The exact techniques used in<A href="#IPSEC"> IPsec</A> are defined
- in RFC 2104. They are referred to as HMAC-MD5-96 and HMAC-SHA-96
- because they output only 96 bits of the hash. This makes some attacks
- on the hash functions harder.</P>
-</DD>
-<DT>HMAC</DT>
-<DD>see<A href="#HMAC"> Hashed Message Authentication Code</A></DD>
-<DT>HMAC-MD5-96</DT>
-<DD>see<A href="#HMAC"> Hashed Message Authentication Code</A></DD>
-<DT>HMAC-SHA-96</DT>
-<DD>see<A href="#HMAC"> Hashed Message Authentication Code</A></DD>
-<DT><A name="hybrid">Hybrid cryptosystem</A></DT>
-<DD>A system using both<A href="#public"> public key</A> and<A href="#symmetric">
- symmetric cipher</A> techniques. This works well. Public key methods
- provide key management and<A href="#signature"> digital signature</A>
- facilities which are not readily available using symmetric ciphers. The
- symmetric cipher, however, can do the bulk of the encryption work much
- more efficiently than public key methods.</DD>
-<DT><A name="I">I</A></DT>
-<DT><A name="IAB">IAB</A></DT>
-<DD><A href="http://www.iab.org/iab">Internet Architecture Board</A>.</DD>
-<DT><A name="ICMP.gloss">ICMP</A></DT>
-<DD><STRONG>I</STRONG>nternet<STRONG> C</STRONG>ontrol<STRONG> M</STRONG>
-essage<STRONG> P</STRONG>rotocol. This is used for various IP-connected
- devices to manage the network.</DD>
-<DT><A name="IDEA">IDEA</A></DT>
-<DD><B>I</B>nternational<B> D</B>ata<B> E</B>ncrypion<B> A</B>lgorithm,
- developed in Europe as an alternative to exportable American ciphers
- such as<A href="#DES"> DES</A> which were<A href="politics.html#desnotsecure">
- too weak for serious use</A>. IDEA is a<A href="#block"> block cipher</A>
- using 64-bit blocks and 128-bit keys, and is used in products such as<A href="#PGP">
- PGP</A>.
-<P>IDEA is not required by the<A href="#IPSEC"> IPsec</A> RFCs and not
- currently used in<A href="web.html#FreeSWAN"> Linux FreeS/WAN</A>.</P>
-<P>IDEA is patented and, with strictly limited exceptions for personal
- use, using it requires a license from<A href="http://www.ascom.com">
- Ascom</A>.</P>
-</DD>
-<DT><A name="IEEE">IEEE</A></DT>
-<DD><A href="http://www.ieee.org">Institute of Electrical and Electronic
- Engineers</A>, a professional association which, among other things,
- sets some technical standards</DD>
-<DT><A name="IESG">IESG</A></DT>
-<DD><A href="http://www.iesg.org">Internet Engineering Steering Group</A>
-.</DD>
-<DT><A name="IETF">IETF</A></DT>
-<DD><A href="http://www.ietf.org">Internet Engineering Task Force</A>,
- the umbrella organisation whose various working groups make most of the
- technical decisions for the Internet. The IETF<A href="http://www.ietf.org/html.charters/ipsec-charter.html">
- IPsec working group</A> wrote the<A href="rfc.html#RFC"> RFCs</A> we
- are implementing.</DD>
-<DT><A name="IKE">IKE</A></DT>
-<DD><B>I</B>nternet<B> K</B>ey<B> E</B>xchange, based on the<A href="#DH">
- Diffie-Hellman</A> key exchange protocol. For details, see RFC 2409 and
- our<A href="ipsec.html"> IPsec</A> document. IKE is implemented in<A href="web.html#FreeSWAN">
- Linux FreeS/WAN</A> by the<A href="#Pluto"> Pluto daemon</A>.</DD>
-<DT>IKE v2</DT>
-<DD>A proposed replacement for<A href="#IKE"> IKE</A>. There are other
- candidates, such as<A href="#JFK"> JFK</A>, and at time of writing
- (March 2002) the choice between them has not yet been made and does not
- appear imminent.</DD>
-<DT><A name="iOE">iOE</A></DT>
-<DD>See<A HREF="#initiate-only"> Initiate-only opportunistic encryption</A>
-.</DD>
-<DT><A name="IP">IP</A></DT>
-<DD><B>I</B>nternet<B> P</B>rotocol.</DD>
-<DT><A name="masq">IP masquerade</A></DT>
-<DD>A mostly obsolete term for a method of allowing multiple machines to
- communicate over the Internet when only one IP address is available for
- their use. The more current term is Network Address Translation or<A href="#NAT.gloss">
- NAT</A>.</DD>
-<DT><A name="IPng">IPng</A></DT>
-<DD>&quot;IP the Next Generation&quot;, see<A href="#ipv6.gloss"> IPv6</A>.</DD>
-<DT><A name="IPv4">IPv4</A></DT>
-<DD>The current version of the<A href="#IP"> Internet protocol suite</A>
-.</DD>
-<DT><A name="ipv6.gloss">IPv6 (IPng)</A></DT>
-<DD>Version six of the<A href="#IP"> Internet protocol suite</A>,
- currently being developed. It will replace the current<A href="#IPv4">
- version four</A>. IPv6 has<A href="#IPSEC"> IPsec</A> as a mandatory
- component.
-<P>See this<A href="http://playground.sun.com/pub/ipng/html/ipng-main.html">
- web site</A> for more details, and our<A href="compat.html#ipv6">
- compatibility</A> document for information on FreeS/WAN and the Linux
- implementation of IPv6.</P>
-</DD>
-<DT><A name="IPSEC">IPsec</A> or IPSEC</DT>
-<DD><B>I</B>nternet<B> P</B>rotocol<B> SEC</B>urity, security functions
- (<A href="#authentication">authentication</A> and<A href="#encryption">
- encryption</A>) implemented at the IP level of the protocol stack. It
- is optional for<A href="#IPv4"> IPv4</A> and mandatory for<A href="#ipv6.gloss">
- IPv6</A>.
-<P>This is the standard<A href="web.html#FreeSWAN"> Linux FreeS/WAN</A>
- is implementing. For more details, see our<A href="ipsec.html"> IPsec
- Overview</A>. For the standards, see RFCs listed in our<A href="rfc.html#RFC">
- RFCs document</A>.</P>
-</DD>
-<DT><A name="IPX">IPX</A></DT>
-<DD>Novell's Netware protocol tunnelled over an IP link. Our<A href="firewall.html#user.scripts">
- firewalls</A> document includes an example of using this through an
- IPsec tunnel.</DD>
-<DT><A name="ISAKMP">ISAKMP</A></DT>
-<DD><B>I</B>nternet<B> S</B>ecurity<B> A</B>ssociation and<B> K</B>ey<B>
- M</B>anagement<B> P</B>rotocol, defined in RFC 2408.</DD>
-<DT><A name="ITAR">ITAR</A></DT>
-<DD><B>I</B>nternational<B> T</B>raffic in<B> A</B>rms<B> R</B>
-egulations, US regulations administered by the State Department which
- until recently limited export of, among other things, cryptographic
- technology and software. ITAR still exists, but the limits on
- cryptography have now been transferred to the<A href="#EAR"> Export
- Administration Regulations</A> under the Commerce Department's<A href="#BXA">
- Bureau of Export Administration</A>.</DD>
-<DT>IV</DT>
-<DD>see<A href="#IV"> Initialisation vector</A></DD>
-<DT><A name="IV">Initialisation Vector (IV)</A></DT>
-<DD>Some cipher<A href="#mode"> modes</A>, including the<A href="#CBC">
- CBC</A> mode which IPsec uses, require some extra data at the
- beginning. This data is called the initialisation vector. It need not
- be secret, but should be different for each message. Its function is to
- prevent messages which begin with the same text from encrypting to the
- same ciphertext. That might give an analyst an opening, so it is best
- prevented.</DD>
-<DT><A name="initiate-only">Initiate-only opportunistic encryption (iOE)</A>
-</DT>
-<DD>A form of<A HREF="#carpediem"> opportunistic encryption</A> (OE) in
- which a host proposes opportunistic connections, but lacks the reverse
- DNS records necessary to support incoming opportunistic connection
- requests. Common among hosts on cable or pppoe connections where the
- system administrator does not have write access to the DNS reverse map
- for the host's external IP.
-<P>Configuring for initiate-only opportunistic encryption is described
- in our<A href="quickstart.html#opp.client"> quickstart</A> document.</P>
-</DD>
-<DT><A name="J">J</A></DT>
-<DT><A name="JFK">JFK</A></DT>
-<DD><STRONG>J</STRONG>ust<STRONG> F</STRONG>ast<STRONG> K</STRONG>eying,
- a proposed simpler replacement for<A href="#IKE"> IKE.</A></DD>
-<DT><A name="K">K</A></DT>
-<DT><A name="kernel">Kernel</A></DT>
-<DD>The basic part of an operating system (e.g. Linux) which controls
- the hardware and provides services to all other programs.
-<P>In the Linux release numbering system, an even second digit as in 2.<STRONG>
-2</STRONG>.x indicates a stable or production kernel while an odd number
- as in 2.<STRONG>3</STRONG>.x indicates an experimental or development
- kernel. Most users should run a recent kernel version from the
- production series. The development kernels are primarily for people
- doing kernel development. Others should consider using development
- kernels only if they have an urgent need for some feature not yet
- available in production kernels.</P>
-</DD>
-<DT>Keyed message digest</DT>
-<DD>See<A href="#HMAC"> HMAC</A>.</DD>
-<DT>Key length</DT>
-<DD>see<A href="#brute"> brute force attack</A></DD>
-<DT><A name="KLIPS">KLIPS</A></DT>
-<DD><B>K</B>erne<B>l</B><B> IP</B><B> S</B>ecurity, the<A href="web.html#FreeSWAN">
- Linux FreeS/WAN</A> project's changes to the<A href="#Linux"> Linux</A>
- kernel to support the<A href="#IPSEC"> IPsec</A> protocols.</DD>
-<DT><A name="L">L</A></DT>
-<DT><A name="LDAP">LDAP</A></DT>
-<DD><B>L</B>ightweight<B> D</B>irectory<B> A</B>ccess<B> P</B>rotocol,
- defined in RFCs 1777 and 1778, a method of accessing information stored
- in directories. LDAP is used by several<A href="#PKI"> PKI</A>
- implementations, often with X.501 directories and<A href="#X509"> X.509</A>
- certificates. It may also be used by<A href="#IPSEC"> IPsec</A> to
- obtain key certifications from those PKIs. This is not yet implemented
- in<A href="web.html#FreeSWAN"> Linux FreeS/WAN</A>.</DD>
-<DT><A name="LIBDES">LIBDES</A></DT>
-<DD>A publicly available library of<A href="#DES"> DES</A> code, written
- by Eric Young, which<A href="web.html#FreeSWAN"> Linux FreeS/WAN</A>
- uses in both<A href="#KLIPS"> KLIPS</A> and<A href="#Pluto"> Pluto</A>.</DD>
-<DT><A name="Linux">Linux</A></DT>
-<DD>A freely available Unix-like operating system based on a kernel
- originally written for the Intel 386 architecture by (then) student
- Linus Torvalds. Once his 32-bit kernel was available, the<A href="#GNU">
- GNU</A> utilities made it a usable system and contributions from many
- others led to explosive growth.
-<P>Today Linux is a complete Unix replacement available for several CPU
- architectures -- Intel, DEC/Compaq Alpha, Power PC, both 32-bit SPARC
- and the 64-bit UltraSPARC, SrongARM, . . . -- with support for multiple
- CPUs on some architectures.</P>
-<P><A href="web.html#FreeSWAN">Linux FreeS/WAN</A> is intended to run on
- all CPUs supported by Linux and is known to work on several. See our<A href="compat.html#CPUs">
- compatibility</A> section for a list.</P>
-</DD>
-<DT><A name="FreeSWAN">Linux FreeS/WAN</A></DT>
-<DD>Our implementation of the<A href="#IPSEC"> IPsec</A> protocols,
- intended to be freely redistributable source code with<A href="#GPL"> a
- GNU GPL license</A> and no constraints under US or other<A href="politics.html#exlaw">
- export laws</A>. Linux FreeS/WAN is intended to interoperate with other<A
-href="#IPSEC"> IPsec</A> implementations. The name is partly taken, with
- permission, from the<A href="#SWAN"> S/WAN</A> multi-vendor IPsec
- compatability effort. Linux FreeS/WAN has two major components,<A href="#KLIPS">
- KLIPS</A> (KerneL IPsec Support) and the<A href="#Pluto"> Pluto</A>
- daemon which manages the whole thing.
-<P>See our<A href="ipsec.html"> IPsec section</A> for more detail. For
- the code see our<A href="http://freeswan.org"> primary site</A> or one
- of the mirror sites on<A href="intro.html#mirrors"> this list</A>.</P>
-</DD>
-<DT><A name="LSM">Linux Security Modules (LSM)</A></DT>
-<DD>a project to create an interface in the Linux kernel that supports
- plug-in modules for various security policies.
-<P>This allows multiple security projects to take different approaches
- to security enhancement without tying the kernel down to one particular
- approach. As I understand the history, several projects were pressing
- Linus to incorporate their changes, the various sets of changes were
- incompatible, and his answer was more-or-less &quot;a plague on all your
- houses; I'll give you an interface, but I won't incorporate anything&quot;.</P>
-<P>It seems to be working. There is a fairly active<A href="http://mail.wirex.com/mailman/listinfo/linux-security-module">
- LSM mailing list</A>, and several projects are already using the
- interface.</P>
-</DD>
-<DT>LSM</DT>
-<DD>see<A href="#LSM"> Linux Security Modules</A></DD>
-<DT><A name="M">M</A></DT>
-<DT><A name="list">Mailing list</A></DT>
-<DD>The<A href="web.html#FreeSWAN"> Linux FreeS/WAN</A> project has
- several public email lists for bug reports and software development
- discussions. See our document on<A href="mail.html"> mailing lists</A>.</DD>
-<DT><A name="middle">Man-in-the-middle attack</A></DT>
-<DD>An<A href="#active"> active attack</A> in which the attacker
- impersonates each of the legitimate players in a protocol to the other.
-<P>For example, if<A href="#alicebob"> Alice and Bob</A> are negotiating
- a key via the<A href="#DH"> Diffie-Hellman</A> key agreement, and are
- not using<A href="#authentication"> authentication</A> to be certain
- they are talking to each other, then an attacker able to insert himself
- in the communication path can deceive both players.</P>
-<P>Call the attacker Mallory. For Bob, he pretends to be Alice. For
- Alice, he pretends to be Bob. Two keys are then negotiated,
- Alice-to-Mallory and Bob-to-Mallory. Alice and Bob each think the key
- they have is Alice-to-Bob.</P>
-<P>A message from Alice to Bob then goes to Mallory who decrypts it,
- reads it and/or saves a copy, re-encrypts using the Bob-to-Mallory key
- and sends it along to Bob. Bob decrypts successfully and sends a reply
- which Mallory decrypts, reads, re-encrypts and forwards to Alice.</P>
-<P>To make this attack effective, Mallory must</P>
-<UL>
-<LI>subvert some part of the network in some way that lets him carry out
- the deception
-<BR> possible targets: DNS, router, Alice or Bob's machine, mail server,
- ...</LI>
-<LI>beat any authentication mechanism Alice and Bob use
-<BR> strong authentication defeats the attack entirely; this is why<A href="#IKE">
- IKE</A> requires authentication</LI>
-<LI>work in real time, delivering messages without introducing a delay
- large enough to alert the victims
-<BR> not hard if Alice and Bob are using email; quite difficult in some
- situations.</LI>
-</UL>
-<P>If he manages it, however, it is devastating. He not only gets to
- read all the messages; he can alter messages, inject his own, forge
- anything he likes, . . . In fact, he controls the communication
- completely.</P>
-</DD>
-<DT><A name="mandatory">mandatory access control</A></DT>
-<DD>access control mechanisims which are not settable by the user (see<A href="#discretionary">
- discretionary access control</A>), but are enforced by the system.
-<P>For example, a document labelled &quot;secret, zebra&quot; might be readable
- only by someone with secret clearance working on Project Zebra.
- Ideally, the system will prevent any transfer outside those boundaries.
- For example, even if you can read it, you should not be able to e-mail
- it (unless the recipient is appropriately cleared) or print it (unless
- certain printers are authorised for that classification).</P>
-<P>Mandatory access control is a required feature for some levels of<A href="#rainbow">
- Rainbow Book</A> or<A href="#cc"> Common Criteria</A> classification,
- but has not been widely used outside the military and government. There
- is a good discussion of the issues in Anderson's<A href="biblio.html#anderson">
- Security Engineering</A>.</P>
-<P>The<A href="#SElinux"> Security Enhanced Linux</A> project is adding
- mandatory access control to Linux.</P>
-</DD>
-<DT><A name="manual">Manual keying</A></DT>
-<DD>An IPsec mode in which the keys are provided by the administrator.
- In FreeS/WAN, they are stored in /etc/ipsec.conf. The alternative,<A href="ipsec.html#auto">
- automatic keying</A>, is preferred in most cases. See this<A href="adv_config.html#man-auto">
- discussion</A>.</DD>
-<DT><A name="MD4">MD4</A></DT>
-<DD><A href="#digest">Message Digest Algorithm</A> Four from Ron Rivest
- of<A href="#RSAco"> RSA</A>. MD4 was widely used a few years ago, but
- is now considered obsolete. It has been replaced by its descendants<A href="#MD5">
- MD5</A> and<A href="#SHA"> SHA</A>.</DD>
-<DT><A name="MD5">MD5</A></DT>
-<DD><A href="#digest">Message Digest Algorithm</A> Five from Ron Rivest
- of<A href="#RSAco"> RSA</A>, an improved variant of his<A href="#MD4">
- MD4</A>. Like MD4, it produces a 128-bit hash. For details see RFC
- 1321.
-<P>MD5 is one of two message digest algorithms available in IPsec. The
- other is<A href="#SHA"> SHA</A>. SHA produces a longer hash and is
- therefore more resistant to<A href="#birthday"> birthday attacks</A>,
- but this is not a concern for IPsec. The<A href="#HMAC"> HMAC</A>
- method used in IPsec is secure even if the underlying hash is not
- particularly strong against this attack.</P>
-<P>Hans Dobbertin found a weakness in MD5, and people often ask whether
- this means MD5 is unsafe for IPsec. It doesn't. The IPsec RFCs discuss
- Dobbertin's attack and conclude that it does not affect MD5 as used for
- HMAC in IPsec.</P>
-</DD>
-<DT><A name="meet">Meet-in-the-middle attack</A></DT>
-<DD>A divide-and-conquer attack which breaks a cipher into two parts,
- works against each separately, and compares results. Probably the best
- known example is an attack on double DES. This applies in principle to
- any pair of block ciphers, e.g. to an encryption system using, say,
- CAST-128 and Blowfish, but we will describe it for double DES.
-<P>Double DES encryption and decryption can be written:</P>
-<PRE>        C = E(k2,E(k1,P))
-        P = D(k1,D(k2,C))</PRE>
-<P>Where C is ciphertext, P is plaintext, E is encryption, D is
- decryption, k1 is one key, and k2 is the other key. If we know a P, C
- pair, we can try and find the keys with a brute force attack, trying
- all possible k1, k2 pairs. Since each key is 56 bits, there are 2<SUP>
-112</SUP> such pairs and this attack is painfully inefficient.</P>
-<P>The meet-in-the middle attack re-writes the equations to calculate a
- middle value M:</P>
-<PRE>        M = E(k1,P)
-        M = D(k2,C)</PRE>
-<P>Now we can try some large number of D(k2,C) decryptions with various
- values of k2 and store the results in a table. Then start doing E(k1,P)
- encryptions, checking each result to see if it is in the table.</P>
-<P>With enough table space, this breaks double DES with<NOBR> 2<SUP>56</SUP>
- + 2<SUP>56</SUP> = 2<SUP>57</SUP>work. Against triple DES, you need<NOBR>
- 2<SUP>56</SUP> + 2<SUP>112</SUP> ~= 2<SUP>112</SUP>.</P>
-<P>The memory requirements for such attacks can be prohibitive, but
- there is a whole body of research literature on methods of reducing
- them.</P>
-</DD>
-<DT><A name="digest">Message Digest Algorithm</A></DT>
-<DD>An algorithm which takes a message as input and produces a hash or
- digest of it, a fixed-length set of bits which depend on the message
- contents in some highly complex manner. Design criteria include making
- it extremely difficult for anyone to counterfeit a digest or to change
- a message without altering its digest. One essential property is<A href="#collision">
- collision resistance</A>. The main applications are in message<A href="#authentication">
- authentication</A> and<A href="#signature"> digital signature</A>
- schemes. Widely used algorithms include<A href="#MD5"> MD5</A> and<A href="#SHA">
- SHA</A>. In IPsec, message digests are used for<A href="#HMAC"> HMAC</A>
- authentication of packets.</DD>
-<DT><A name="MTU">MTU</A></DT>
-<DD><STRONG>M</STRONG>aximum<STRONG> T</STRONG>ransmission<STRONG> U</STRONG>
-nit, the largest size of packet that can be sent over a link. This is
- determined by the underlying network, but must be taken account of at
- the IP level.
-<P>IP packets, which can be up to 64K bytes each, must be packaged into
- lower-level packets of the appropriate size for the underlying
- network(s) and re-assembled on the other end. When a packet must pass
- over multiple networks, each with its own MTU, and many of the MTUs are
- unknown to the sender, this becomes a fairly complex problem. See<A href="#pathMTU">
- path MTU discovery</A> for details.</P>
-<P>Often the MTU is a few hundred bytes on serial links and 1500 on
- Ethernet. There are, however, serial link protocols which use a larger
- MTU to avoid fragmentation at the ethernet/serial boundary, and newer
- (especially gigabit) Ethernet networks sometimes support much larger
- packets because these are more efficient in some applications.</P>
-</DD>
-<DT><A name="N">N</A></DT>
-<DT><A name="NAI">NAI</A></DT>
-<DD><A href="http://www.nai.com">Network Associates</A>, a conglomerate
- formed from<A href="#PGPI"> PGP Inc.</A>, TIS (Trusted Information
- Systems, a firewall vendor) and McAfee anti-virus products. Among other
- things, they offer an IPsec-based VPN product.</DD>
-<DT><A name="NAT.gloss">NAT</A></DT>
-<DD><B>N</B>etwork<B> A</B>ddress<B> T</B>ranslation, a process by which
- firewall machines may change the addresses on packets as they go
- through. For discussion, see our<A href="background.html#nat.background">
- background</A> section.</DD>
-<DT><A name="NIST">NIST</A></DT>
-<DD>The US<A href="http://www.nist.gov"> National Institute of Standards
- and Technology</A>, responsible for<A href="#FIPS"> FIPS standards</A>
- including<A href="#DES"> DES</A> and its replacement,<A href="#AES">
- AES</A>.</DD>
-<DT><A name="nonce">Nonce</A></DT>
-<DD>A<A href="#random"> random</A> value used in an<A href="#authentication">
- authentication</A> protocol.</DD>
-<DT></DT>
-<DT><A name="non-routable">Non-routable IP address</A></DT>
-<DD>An IP address not normally allowed in the &quot;to&quot; or &quot;from&quot; IP address
- field header of IP packets.
-<P>Almost invariably, the phrase &quot;non-routable address&quot; means one of the
- addresses reserved by RFC 1918 for private networks:</P>
-<UL>
-<LI>10.anything</LI>
-<LI>172.x.anything with 16 &lt;= x &lt;= 31</LI>
-<LI>192.168.anything</LI>
-</UL>
-<P>These addresses are commonly used on private networks, e.g. behind a
- Linux machines doing<A href="#masq"> IP masquerade</A>. Machines within
- the private network can address each other with these addresses. All
- packets going outside that network, however, have these addresses
- replaced before they reach the Internet.</P>
-<P>If any packets using these addresses do leak out, they do not go far.
- Most routers automatically discard all such packets.</P>
-<P>Various other addresses -- the 127.0.0.0/8 block reserved for local
- use, 0.0.0.0, various broadcast and network addresses -- cannot be
- routed over the Internet, but are not normally included in the meaning
- when the phrase &quot;non-routable address&quot; is used.</P>
-</DD>
-<DT><A name="NSA">NSA</A></DT>
-<DD>The US<A href="http://www.nsa.gov"> National Security Agency</A>,
- the American organisation for<A href="#SIGINT"> signals intelligence</A>
-, the protection of US government messages and the interception and
- analysis of other messages. For details, see Bamford's<A href="biblio.html#puzzle">
- &quot;The Puzzle Palace&quot;</A>.
-<P>Some<A href="http://www.gwu.edu/~nsarchiv/NSAEBB/NSAEBB23/index.html">
- history of NSA</A> documents were declassified in response to a FOIA
- (Freedom of Information Act) request.</P>
-</DD>
-<DT><A name="O">O</A></DT>
-<DT><A name="oakley">Oakley</A></DT>
-<DD>A key determination protocol, defined in RFC 2412.</DD>
-<DT>Oakley groups</DT>
-<DD>The groups used as the basis of<A href="#DH"> Diffie-Hellman</A> key
- exchange in the Oakley protocol, and in<A href="#IKE"> IKE</A>. Four
- were defined in the original RFC, and a fifth has been<A href="http://www.lounge.org/ike_doi_errata.html">
- added since</A>.
-<P>Linux FreeS/WAN currently supports the three groups based on finite
- fields modulo a prime (Groups 1, 2 and 5) and does not support the
- elliptic curve groups (3 and 4). For a description of the difference of
- the types, see<A href="#dlog"> discrete logarithms</A>.</P>
-</DD>
-<DT><A name="OTP">One time pad</A></DT>
-<DD>A cipher in which the key is:
-<UL>
-<LI>as long as the total set of messages to be enciphered</LI>
-<LI>absolutely<A href="#random"> random</A></LI>
-<LI>never re-used</LI>
-</UL>
-<P>Given those three conditions, it can easily be proved that the cipher
- is perfectly secure, in the sense that an attacker with intercepted
- message in hand has no better chance of guessing the message than an
- attacker who has not intercepted the message and only knows the message
- length. No such proof exists for any other cipher.</P>
-<P>There are, however, several problems with this &quot;perfect&quot; cipher.</P>
-<P>First, it is<STRONG> wildly impractical</STRONG> for most
- applications. Key management is at best difficult, often completely
- impossible.</P>
-<P>Second, it is<STRONG> extremely fragile</STRONG>. Small changes which
- violate the conditions listed above do not just weaken the cipher
- liitle. Quite often they destroy its security completely.</P>
-<UL>
-<LI>Re-using the pad weakens the cipher to the point where it can be
- broken with pencil and paper. With a computer, the attack is trivially
- easy.</LI>
-<LI>Using<EM> anything</EM> less than truly<A href="#random"> random</A>
- numbers<EM> completely</EM> invalidates the security proof.</LI>
-<LI>In particular, using computer-generated pseudo-random numbers may
- give an extremely weak cipher. It might also produce a good stream
- cipher, if the pseudo-random generator is both well-designed and
- properely seeded.</LI>
-</UL>
-<P>Marketing claims about the &quot;unbreakable&quot; security of various products
- which somewhat resemble one-time pads are common. Such claims are one
- of the surest signs of cryptographic<A href="#snake"> snake oil</A>;
- most systems marketed with such claims are worthless.</P>
-<P>Finally, even if the system is implemented and used correctly, it is<STRONG>
- highly vulnerable to a substitution attack</STRONG>. If an attacker
- knows some plaintext and has an intercepted message, he can discover
- the pad.</P>
-<UL>
-<LI>This does not matter if the attacker is just a<A href="#passive">
- passive</A> eavesdropper. It gives him no plaintext he didn't already
- know and we don't care that he learns a pad which we will never re-use.</LI>
-<LI>However, an<A href="#active"> active</A> attacker who knows the
- plaintext can recover the pad, then use it to encode with whatever he
- chooses. If he can get his version delivered instead of yours, this may
- be a disaster. If you send &quot;attack at dawn&quot;, the delivered message can
- be anything the same length -- perhaps &quot;retreat to east&quot; or &quot;shoot
- generals&quot;.</LI>
-<LI>An active attacker with only a reasonable guess at the plaintext can
- try the same attack. If the guess is correct, this works and the
- attacker's bogus message is delivered. If the guess is wrong, a garbled
- message is delivered.</LI>
-</UL>
-<P>In general then, despite its theoretical perfection, the one-time-pad
- has very limited practical application.</P>
-<P>See also the<A href="http://pubweb.nfr.net/~mjr/pubs/otpfaq/"> one
- time pad FAQ</A>.</P>
-</DD>
-<DT><A name="carpediem">Opportunistic encryption (OE)</A></DT>
-<DD>A situation in which any two IPsec-aware machines can secure their
- communications, without a pre-shared secret and without a common<A href="#PKI">
- PKI</A> or previous exchange of public keys. This is one of the goals
- of the Linux FreeS/WAN project, discussed in our<A href="intro.html#goals">
- introduction</A> section.
-<P>Setting up for opportunistic encryption is described in our<A href="quickstart.html#quickstart">
- quickstart</A> document.</P>
-</DD>
-<DT><A name="responder">Opportunistic responder</A></DT>
-<DD>A host which accepts, but does not initiate, requests for<A HREF="#carpediem">
- opportunistic encryption</A> (OE). An opportunistic responder has
- enabled OE in its<A HREF="#passive.OE"> passive</A> form (pOE) only. A
- web server or file server may be usefully set up as an opportunistic
- responder.
-<P>Configuring passive OE is described in our<A href="policygroups.html#policygroups">
- policy groups</A> document.</P>
-</DD>
-<DT><A name="orange">Orange book</A></DT>
-<DD>the most basic and best known of the US government's<A href="#rainbow">
- Rainbow Book</A> series of computer security standards.</DD>
-<DT><A name="P">P</A></DT>
-<DT><A name="P1363">P1363 standard</A></DT>
-<DD>An<A href="#IEEE"> IEEE</A> standard for public key cryptography.<A href="http://grouper.ieee.org/groups/1363">
- Web page</A>.</DD>
-<DT><A name="pOE">pOE</A></DT>
-<DD>See<A href="#passive.OE"> Passive opportunistic encryption</A>.</DD>
-<DT><A name="passive">Passive attack</A></DT>
-<DD>An attack in which the attacker only eavesdrops and attempts to
- analyse intercepted messages, as opposed to an<A href="#active"> active
- attack</A> in which he diverts messages or generates his own.</DD>
-<DT><A name="passive.OE">Passive opportunistic encryption (pOE)</A></DT>
-<DD>A form of<A HREF="#carpediem"> opportunistic encryption</A> (OE) in
- which the host will accept opportunistic connection requests, but will
- not initiate such requests. A host which runs OE in its passive form
- only is known as an<A HREF="#responder"> opportunistic responder</A>.
-<P>Configuring passive OE is described in our<A href="policygroups.html#policygroups">
- policy groups</A> document.</P>
-</DD>
-<DT><A name="pathMTU">Path MTU discovery</A></DT>
-<DD>The process of discovering the largest packet size which all links
- on a path can handle without fragmentation -- that is, without any
- router having to break the packet up into smaller pieces to match the<A href="#MTU">
- MTU</A> of its outgoing link.
-<P>This is done as follows:</P>
-<UL>
-<LI>originator sends the largest packets allowed by<A href="#MTU"> MTU</A>
- of the first link, setting the DF (<STRONG>d</STRONG>on't<STRONG> f</STRONG>
-ragment) bit in the packet header</LI>
-<LI>any router which cannot send the packet on (outgoing MTU is too
- small for it, and DF prevents fragmenting it to match) sends back an<A href="#ICMP.gloss">
- ICMP</A> packet reporting the problem</LI>
-<LI>originator looks at ICMP message and tries a smaller size</LI>
-<LI>eventually, you settle on a size that can pass all routers</LI>
-<LI>thereafter, originator just sends that size and no-one has to
- fragment</LI>
-</UL>
-<P>Since this requires co-operation of many systems, and since the next
- packet may travel a different path, this is one of the trickier areas
- of IP programming. Bugs that have shown up over the years have
- included:</P>
-<UL>
-<LI>malformed ICMP messages</LI>
-<LI>hosts that ignore or mishandle these ICMP messages</LI>
-<LI>firewalls blocking the ICMP messages so host does not see them</LI>
-</UL>
-<P>Since IPsec adds a header, it increases packet size and may require
- fragmentation even where incoming and outgoing MTU are equal.</P>
-</DD>
-<DT><A name="PFS">Perfect forward secrecy (PFS)</A></DT>
-<DD>A property of systems such as<A href="#DH"> Diffie-Hellman</A> key
- exchange which use a long-term key (such as the shared secret in IKE)
- and generate short-term keys as required. If an attacker who acquires
- the long-term key<EM> provably</EM> can
-<UL>
-<LI><EM>neither</EM> read previous messages which he may have archived</LI>
-<LI><EM>nor</EM> read future messages without performing additional
- successful attacks</LI>
-</UL>
-<P>then the system has PFS. The attacker needs the short-term keys in
- order to read the trafiic and merely having the long-term key does not
- allow him to infer those. Of course, it may allow him to conduct
- another attack (such as<A href="#middle"> man-in-the-middle</A>) which
- gives him some short-term keys, but he does not automatically get them
- just by acquiring the long-term key.</P>
-<P>See also<A href="http://sandelman.ottawa.on.ca/ipsec/1996/08/msg00123.html">
- Phil Karn's definition</A>.</P>
-</DD>
-<DT>PFS</DT>
-<DD>see Perfect Forward Secrecy</DD>
-<DT><A name="PGP">PGP</A></DT>
-<DD><B>P</B>retty<B> G</B>ood<B> P</B>rivacy, a personal encryption
- system for email based on public key technology, written by Phil
- Zimmerman.
-<P>The 2.xx versions of PGP used the<A href="#RSA"> RSA</A> public key
- algorithm and used<A href="#IDEA"> IDEA</A> as the symmetric cipher.
- These versions are described in RFC 1991 and in<A href="#PGP">
- Garfinkel's book</A>. Since version 5, the products from<A href="#PGPI">
- PGP Inc</A>. have used<A href="#DH"> Diffie-Hellman</A> public key
- methods and<A href="#CAST128"> CAST-128</A> symmetric encryption. These
- can verify signatures from the 2.xx versions, but cannot exchange
- encryted messages with them.</P>
-<P>An<A href="mail.html#IETF"> IETF</A> working group has issued RFC
- 2440 for an &quot;Open PGP&quot; standard, similar to the 5.x versions. PGP Inc.
- staff were among the authors. A free<A href="#GPG"> Gnu Privacy Guard</A>
- based on that standard is now available.</P>
-<P>For more information on PGP, including how to obtain it, see our
- cryptography<A href="web.html#tools"> links</A>.</P>
-</DD>
-<DT><A name="PGPI">PGP Inc.</A></DT>
-<DD>A company founded by Zimmerman, the author of<A href="#PGP"> PGP</A>
-, now a division of<A href="#NAI"> NAI</A>. See the<A href="http://www.pgp.com">
- corporate website</A>. Zimmerman left in 2001, and early in 2002 NAI
- announced that they would no longer sell PGP..
-<P>Versions 6.5 and later of the PGP product include PGPnet, an IPsec
- client for Macintosh or for Windows 95/98/NT. See our<A href="interop.html#pgpnet">
- interoperation documen</A>t.</P>
-</DD>
-<DT><A name="photuris">Photuris</A></DT>
-<DD>Another key negotiation protocol, an alternative to<A href="#IKE">
- IKE</A>, described in RFCs 2522 and 2523.</DD>
-<DT><A name="PPP">PPP</A></DT>
-<DD><B>P</B>oint-to-<B>P</B>oint<B> P</B>rotocol, originally a method of
- connecting over modems or serial lines, but see also PPPoE.</DD>
-<DT><A name="PPPoE">PPPoE</A></DT>
-<DD><B>PPP</B><B> o</B>ver<B> E</B>thernet, a somewhat odd protocol that
- makes Ethernet look like a point-to-point serial link. It is widely
- used for cable or ADSL Internet services, apparently mainly because it
- lets the providers use access control and address assignmment
- mechanisms developed for dialup networks.<A href="http://www.roaringpenguin.com">
- Roaring Penguin</A> provide a widely used Linux implementation.</DD>
-<DT><A name="PPTP">PPTP</A></DT>
-<DD><B>P</B>oint-to-<B>P</B>oint<B> T</B>unneling<B> P</B>rotocol, used
- in some Microsoft VPN implementations. Papers discussing weaknesses in
- it are on<A href="http://www.counterpane.com/publish.html">
- counterpane.com</A>. It is now largely obsolete, replaced by L2TP.</DD>
-<DT><A name="PKI">PKI</A></DT>
-<DD><B>P</B>ublic<B> K</B>ey<B> I</B>nfrastructure, the things an
- organisation or community needs to set up in order to make<A href="#public">
- public key</A> cryptographic technology a standard part of their
- operating procedures.
-<P>There are several PKI products on the market. Typically they use a
- hierarchy of<A href="#CA"> Certification Authorities (CAs)</A>. Often
- they use<A href="#LDAP"> LDAP</A> access to<A href="#X509"> X.509</A>
- directories to implement this.</P>
-<P>See<A href="#web"> Web of Trust</A> for a different sort of
- infrastructure.</P>
-</DD>
-<DT><A name="PKIX">PKIX</A></DT>
-<DD><B>PKI</B> e<B>X</B>change, an<A href="mail.html#IETF"> IETF</A>
- standard that allows<A href="#PKI"> PKI</A>s to talk to each other.
-<P>This is required, for example, when users of a corporate PKI need to
- communicate with people at client, supplier or government
- organisations, any of which may have a different PKI in place. I should
- be able to talk to you securely whenever:</P>
-<UL>
-<LI>your organisation and mine each have a PKI in place</LI>
-<LI>you and I are each set up to use those PKIs</LI>
-<LI>the two PKIs speak PKIX</LI>
-<LI>the configuration allows the conversation</LI>
-</UL>
-<P>At time of writing (March 1999), this is not yet widely implemented
- but is under quite active development by several groups.</P>
-</DD>
-<DT><A name="plaintext">Plaintext</A></DT>
-<DD>The unencrypted input to a cipher, as opposed to the encrypted<A href="#ciphertext">
- ciphertext</A> output.</DD>
-<DT><A name="Pluto">Pluto</A></DT>
-<DD>The<A href="web.html#FreeSWAN"> Linux FreeS/WAN</A> daemon which
- handles key exchange via the<A href="#IKE"> IKE</A> protocol,
- connection negotiation, and other higher-level tasks. Pluto calls the<A href="#KLIPS">
- KLIPS</A> kernel code as required. For details, see the manual page
- ipsec_pluto(8).</DD>
-<DT><A name="public">Public Key Cryptography</A></DT>
-<DD>In public key cryptography, keys are created in matched pairs.
- Encrypt with one half of a pair and only the matching other half can
- decrypt it. This contrasts with<A href="#symmetric"> symmetric or
- secret key cryptography</A> in which a single key known to both parties
- is used for both encryption and decryption.
-<P>One half of each pair, called the public key, is made public. The
- other half, called the private key, is kept secret. Messages can then
- be sent by anyone who knows the public key to the holder of the private
- key. Encrypt with the public key and you know that only someone with
- the matching private key can decrypt.</P>
-<P>Public key techniques can be used to create<A href="#signature">
- digital signatures</A> and to deal with key management issues, perhaps
- the hardest part of effective deployment of<A href="#symmetric">
- symmetric ciphers</A>. The resulting<A href="#hybrid"> hybrid
- cryptosystems</A> use public key methods to manage keys for symmetric
- ciphers.</P>
-<P>Many organisations are currently creating<A href="#PKI"> PKIs, public
- key infrastructures</A> to make these benefits widely available.</P>
-</DD>
-<DT>Public Key Infrastructure</DT>
-<DD>see<A href="#PKI"> PKI</A></DD>
-<DT><A name="Q">Q</A></DT>
-<DT><A name="R">R</A></DT>
-<DT><A name="rainbow">Rainbow books</A></DT>
-<DD>A set of US government standards for evaluation of &quot;trusted computer
- systems&quot;, of which the best known was the<A href="#orange"> Orange Book</A>
-. One fairly often hears references to &quot;C2 security&quot; or a product
- &quot;evaluated at B1&quot;. The Rainbow books define the standards referred to
- in those comments.
-<P>See this<A href="http://www.fas.org/irp/nsa/rainbow.htm"> reference
- page</A>.</P>
-<P>The Rainbow books are now mainly obsolete, replaced by the
- international<A href="#cc"> Common Criteria</A> standards.</P>
-</DD>
-<DT><A name="random">Random</A></DT>
-<DD>A remarkably tricky term, far too much so for me to attempt a
- definition here. Quite a few cryptosystems have been broken via attacks
- on weak random number generators, even when the rest of the system was
- sound.
-<P>See<A href="http://nis.nsf.net/internet/documents/rfc/rfc1750.txt">
- RFC 1750</A> for the theory.</P>
-<P>See the manual pages for<A href="manpage.d/ipsec_ranbits.8.html">
- ipsec_ranbits(8)</A> and ipsec_prng(3) for more on FreeS/WAN's use of
- randomness. Both depend on the random(4) device driver..</P>
-<P>A couple of years ago, there was extensive mailing list discussion
- (archived<A href="http://www.openpgp.net/random/index.html"> here</A>
-)of Linux /dev/random and FreeS/WAN. Since then, the design of the
- random(4) driver has changed considerably. Linux 2.4 kernels have the
- new driver..</P>
-</DD>
-<DT>Raptor</DT>
-<DD>A firewall product for Windows NT offerring IPsec-based VPN
- services. Linux FreeS/WAN interoperates with Raptor; see our<A href="interop.html#Raptor">
- interop</A> document for details. Raptor have recently merged with
- Axent.</DD>
-<DT><A name="RC4">RC4</A></DT>
-<DD><B>R</B>ivest<B> C</B>ipher four, designed by Ron Rivest of<A href="#RSAco">
- RSA</A> and widely used. Believed highly secure with adequate key
- length, but often implemented with inadequate key length to comply with
- export restrictions.</DD>
-<DT><A name="RC6">RC6</A></DT>
-<DD><B>R</B>ivest<B> C</B>ipher six,<A href="#RSAco"> RSA</A>'s<A href="#AES">
- AES</A> candidate cipher.</DD>
-<DT><A name="replay">Replay attack</A></DT>
-<DD>An attack in which the attacker records data and later replays it in
- an attempt to deceive the recipient.</DD>
-<DT><A name="reverse">Reverse map</A></DT>
-<DD>In<A href="ipsec.html#DNS"> DNS</A>, a table where IP addresses can
- be used as the key for lookups which return a system name and/or other
- information.</DD>
-<DT>RFC</DT>
-<DD><B>R</B>equest<B> F</B>or<B> C</B>omments, an Internet document.
- Some RFCs are just informative. Others are standards.
-<P>Our list of<A href="#IPSEC"> IPsec</A> and other security-related
- RFCs is<A href="rfc.html#RFC"> here</A>, along with information on
- methods of obtaining them.</P>
-</DD>
-<DT><A name="rijndael">Rijndael</A></DT>
-<DD>a<A href="#block"> block cipher</A> designed by two Belgian
- cryptographers, winner of the US government's<A href="#AES"> AES</A>
- contest to pick a replacement for<A href="#DES"> DES</A>. See the<A href="http://www.esat.kuleuven.ac.be/~rijmen/rijndael">
- Rijndael home page</A>.</DD>
-<DT><A name="RIPEMD">RIPEMD</A></DT>
-<DD>A<A href="#digest"> message digest</A> algorithm. The current
- version is RIPEMD-160 which gives a 160-bit hash.</DD>
-<DT><A name="rootCA">Root CA</A></DT>
-<DD>The top level<A href="#CA"> Certification Authority</A> in a
- hierachy of such authorities.</DD>
-<DT><A name="routable">Routable IP address</A></DT>
-<DD>Most IP addresses can be used as &quot;to&quot; and &quot;from&quot; addresses in packet
- headers. These are the routable addresses; we expect routing to be
- possible for them. If we send a packet to one of them, we expect (in
- most cases; there are various complications) that it will be delivered
- if the address is in use and will cause an<A href="#ICMP.gloss"> ICMP</A>
- error packet to come back to us if not.
-<P>There are also several classes of<A href="#non-routable">
- non-routable</A> IP addresses.</P>
-</DD>
-<DT><A name="RSA">RSA algorithm</A></DT>
-<DD><B>R</B>ivest<B> S</B>hamir<B> A</B>dleman<A href="#public"> public
- key</A> algorithm, named for its three inventors. It is widely used and
- likely to become moreso since it became free of patent encumbrances in
- September 2000.
-<P>RSA can be used to provide either<A href="#encryption"> encryption</A>
- or<A href="#signature"> digital signatures</A>. In IPsec, it is used
- only for signatures. These provide gateway-to-gateway<A href="#authentication">
- authentication</A> for<A href="#IKE"> IKE</A> negotiations.</P>
-<P>For a full explanation of the algorithm, consult one of the standard
- references such as<A href="biblio.html#schneier"> Applied Cryptography</A>
-. A simple explanation is:</P>
-<P>The great 17th century French mathematician<A href="http://www-groups.dcs.st-andrews.ac.uk/~history/Mathematicians/Fermat.html">
- Fermat</A> proved that,</P>
-<P>for any prime p and number x, 0 &lt;= x &lt; p:</P>
-<PRE>        x^p == x         modulo p
-        x^(p-1) == 1     modulo p, non-zero x
-      </PRE>
-<P>From this it follows that if we have a pair of primes p, q and two
- numbers e, d such that:</P>
-<PRE>        ed == 1          modulo lcm( p-1, q-1)
-      </PRE>
- where lcm() is least common multiple, then
-<BR> for all x, 0 &lt;= x &lt; pq:
-<PRE>      x^ed == x           modulo pq
-      </PRE>
-<P>So we construct such as set of numbers p, q, e, d and publish the
- product N=pq and e as the public key. Using c for<A href="#ciphertext">
- ciphertext</A> and i for the input<A href="#plaintext"> plaintext</A>,
- encryption is then:</P>
-<PRE>        c = i^e           modulo N
-      </PRE>
-<P>An attacker cannot deduce i from the cyphertext c, short of either
- factoring N or solving the<A href="#dlog"> discrete logarithm</A>
- problem for this field. If p, q are large primes (hundreds or thousands
- of bits) no efficient solution to either problem is known.</P>
-<P>The receiver, knowing the private key (N and d), can readily recover
- the plaintext p since:</P>
-<PRE>        c^d == (i^e)^d    modulo N
-            == i^ed       modulo N
-            == i          modulo N
-      </PRE>
-<P>This gives an effective public key technique, with only a couple of
- problems. It uses a good deal of computer time, since calculations with
- large integers are not cheap, and there is no proof it is necessarily
- secure since no-one has proven either factoring or discrete log cannot
- be done efficiently. Quite a few good mathematicians have tried both
- problems, and no-one has announced success, but there is no proof they
- are insoluble.</P>
-</DD>
-<DT><A name="RSAco">RSA Data Security</A></DT>
-<DD>A company founded by the inventors of the<A href="#RSA"> RSA</A>
- public key algorithm.</DD>
-<DT><A name="S">S</A></DT>
-<DT><A name="SA">SA</A></DT>
-<DD><B>S</B>ecurity<B> A</B>ssociation, the channel negotiated by the
- higher levels of an<A href="#IPSEC"> IPsec</A> implementation (<A href="#IKE">
-IKE</A>) and used by the lower (<A href="#ESP">ESP</A> and<A href="#AH">
- AH</A>). SAs are unidirectional; you need a pair of them for two-way
- communication.
-<P>An SA is defined by three things -- the destination, the protocol (<A href="#AH">
-AH</A> or<A href="#ESP">ESP</A>) and the<A href="SPI"> SPI</A>, security
- parameters index. It is used as an index to look up other things such
- as session keys and intialisation vectors.</P>
-<P>For more detail, see our section on<A href="ipsec.html"> IPsec</A>
- and/or RFC 2401.</P>
-</DD>
-<DT><A name="SElinux">SE Linux</A></DT>
-<DD><STRONG>S</STRONG>ecurity<STRONG> E</STRONG>nhanced Linux, an<A href="#NSA">
- NSA</A>-funded project to add<A href="#mandatory"> mandatory access
- control</A> to Linux. See the<A href="http://www.nsa.gov/selinux">
- project home page</A>.
-<P>According to their web pages, this work will include extending
- mandatory access controls to IPsec tunnels.</P>
-<P>Recent versions of SE Linux code use the<A href="#LSM"> Linux
- Security Module</A> interface.</P>
-</DD>
-<DT><A name="SDNS">Secure DNS</A></DT>
-<DD>A version of the<A href="ipsec.html#DNS"> DNS or Domain Name Service</A>
- enhanced with authentication services. This is being designed by the<A href="mail.html#IETF">
- IETF</A> DNS security<A href="http://www.ietf.org/ids.by.wg/dnssec.html">
- working group</A>. Check the<A href="http://www.isc.org/bind.html">
- Internet Software Consortium</A> for information on implementation
- progress and for the latest version of<A href="#BIND"> BIND</A>.
- Another site has<A href="http://www.toad.com/~dnssec"> more information</A>
-.
-<P><A href="#IPSEC">IPsec</A> can use this plus<A href="#DH">
- Diffie-Hellman key exchange</A> to bootstrap itself. This allows<A href="#carpediem">
- opportunistic encryption</A>. Any pair of machines which can
- authenticate each other via DNS can communicate securely, without
- either a pre-existing shared secret or a shared<A href="#PKI"> PKI</A>.</P>
-</DD>
-<DT>Secret key cryptography</DT>
-<DD>See<A href="#symmetric"> symmetric cryptography</A></DD>
-<DT>Security Association</DT>
-<DD>see<A href="#SA"> SA</A></DD>
-<DT>Security Enhanced Linux</DT>
-<DD>see<A href="#SElinux"> SE Linux</A></DD>
-<DT><A name="sequence">Sequence number</A></DT>
-<DD>A number added to a packet or message which indicates its position
- in a sequence of packets or messages. This provides some security
- against<A href="#replay"> replay attacks</A>.
-<P>For<A href="ipsec.html#auto"> automatic keying</A> mode, the<A href="#IPSEC">
- IPsec</A> RFCs require that the sender generate sequence numbers for
- each packet, but leave it optional whether the receiver does anything
- with them.</P>
-</DD>
-<DT><A name="SHA">SHA</A></DT>
-<DT>SHA-1</DT>
-<DD><B>S</B>ecure<B> H</B>ash<B> A</B>lgorithm, a<A href="#digest">
- message digest algorithm</A> developed by the<A href="#NSA"> NSA</A>
- for use in the Digital Signature standard,<A href="#FIPS"> FIPS</A>
- number 186 from<A href="#NIST"> NIST</A>. SHA is an improved variant of<A
-href="#MD4"> MD4</A> producing a 160-bit hash.
-<P>SHA is one of two message digest algorithms available in IPsec. The
- other is<A href="#MD5"> MD5</A>. Some people do not trust SHA because
- it was developed by the<A href="#NSA"> NSA</A>. There is, as far as we
- know, no cryptographic evidence that SHA is untrustworthy, but this
- does not prevent that view from being strongly held.</P>
-<P>The NSA made one small change after the release of the original SHA.
- They did not give reasons. Iit may be a defense against some attack
- they found and do not wish to disclose. Technically the modified
- algorithm should be called SHA-1, but since it has replaced the
- original algorithm in nearly all applications, it is generally just
- referred to as SHA..</P>
-</DD>
-<DT><A name="SHA-256">SHA-256</A></DT>
-<DT>SHA-384</DT>
-<DT>SHA-512</DT>
-<DD>Newer variants of SHA designed to match the strength of the 128, 192
- and 256-bit keys of<A href="#AES"> AES</A>. The work to break an
- encryption algorithm's strength by<A href="#brute"> brute force</A> is
- 2
-<!--math xmlns="http://www.w3.org/1998/Math/MathML"-->
-
-<!--msup-->
-
-<!--mi-->
- keylength</(null)></(null)></(null)> operations but a<A href="birthday">
- birthday attack</A> on a hash needs only 2
-<!--math xmlns="http://www.w3.org/1998/Math/MathML"-->
-
-<!--msup-->
-
-<!--mrow-->
-
-<!--mi-->
- hashlength</(null)>
-<!--mo-->
- /</(null)>
-<!--mn-->
-
- 2</(null)></(null)></(null)></(null)> , so as a general rule you need a
- hash twice the size of the key to get similar strength. SHA-256,
- SHA-384 and SHA-512 are designed to match the 128, 192 and 256-bit key
- sizes of AES, respectively.</DD>
-<DT><A name="SIGINT">Signals intelligence (SIGINT)</A></DT>
-<DD>Activities of government agencies from various nations aimed at
- protecting their own communications and reading those of others.
- Cryptography, cryptanalysis, wiretapping, interception and monitoring
- of various sorts of signals. The players include the American<A href="#NSA">
- NSA</A>, British<A href="#GCHQ"> GCHQ</A> and Canadian<A href="#CSE">
- CSE</A>.</DD>
-<DT><A name="SKIP">SKIP</A></DT>
-<DD><B>S</B>imple<B> K</B>ey management for<B> I</B>nternet<B> P</B>
-rotocols, an alternative to<A href="#IKE"> IKE</A> developed by Sun and
- being marketed by their<A href="http://skip.incog.com"> Internet
- Commerce Group</A>.</DD>
-<DT><A name="snake">Snake oil</A></DT>
-<DD>Bogus cryptography. See the<A href="http://www.interhack.net/people/cmcurtin/snake-oil-faq.html">
- Snake Oil FAQ</A> or<A href="http://www.counterpane.com/crypto-gram-9902.html#snakeoil">
- this paper</A> by Schneier.</DD>
-<DT><A name="SPI">SPI</A></DT>
-<DD><B>S</B>ecurity<B> P</B>arameter<B> I</B>ndex, an index used within<A
-href="#IPSEC"> IPsec</A> to keep connections distinct. A<A href="#SA">
- Security Association (SA)</A> is defined by destination, protocol and
- SPI. Without the SPI, two connections to the same gateway using the
- same protocol could not be distinguished.
-<P>For more detail, see our<A href="ipsec.html"> IPsec</A> section
- and/or RFC 2401.</P>
-</DD>
-<DT><A name="SSH">SSH</A></DT>
-<DD><B>S</B>ecure<B> SH</B>ell, an encrypting replacement for the
- insecure Berkeley commands whose names begin with &quot;r&quot; for &quot;remote&quot;:
- rsh, rlogin, etc.
-<P>For more information on SSH, including how to obtain it, see our
- cryptography<A href="web.html#tools"> links</A>.</P>
-</DD>
-<DT><A name="SSHco">SSH Communications Security</A></DT>
-<DD>A company founded by the authors of<A href="#SSH"> SSH</A>. Offices
- are in<A href="http://www.ssh.fi"> Finland</A> and<A href="http://www.ipsec.com">
- California</A>. They have a toolkit for developers of IPsec
- applications.</DD>
-<DT><A name="SSL">SSL</A></DT>
-<DD><A href="http://home.netscape.com/eng/ssl3">Secure Sockets Layer</A>
-, a set of encryption and authentication services for web browsers,
- developed by Netscape. Widely used in Internet commerce. Also known as<A
-href="#TLS"> TLS</A>.</DD>
-<DT>SSLeay</DT>
-<DD>A free implementation of<A href="#SSL"> SSL</A> by Eric Young (eay)
- and others. Developed in Australia; not subject to US export controls.</DD>
-<DT><A name="static">static IP address</A></DT>
-<DD>an IP adddress which is pre-set on the machine itself, as opposed to
- a<A href="#dynamic"> dynamic address</A> which is assigned by a<A href="#DHCP">
- DHCP</A> server or obtained as part of the process of establishing a<A href="#PPP">
- PPP</A> or<A href="#PPPoE"> PPPoE</A> connection</DD>
-<DT><A name="stream">Stream cipher</A></DT>
-<DD>A<A href="#symmetric"> symmetric cipher</A> which produces a stream
- of output which can be combined (often using XOR or bytewise addition)
- with the plaintext to produce ciphertext. Contrasts with<A href="#block">
- block cipher</A>.
-<P><A href="#IPSEC">IPsec</A> does not use stream ciphers. Their main
- application is link-level encryption, for example of voice, video or
- data streams on a wire or a radio signal.</P>
-</DD>
-<DT><A name="subnet">subnet</A></DT>
-<DD>A group of IP addresses which are logically one network, typically
- (but not always) assigned to a group of physically connected machines.
- The range of addresses in a subnet is described using a subnet mask.
- See next entry.</DD>
-<DT>subnet mask</DT>
-<DD>A method of indicating the addresses included in a subnet. Here are
- two equivalent examples:
-<UL>
-<LI>101.101.101.0/24</LI>
-<LI>101.101.101.0 with mask 255.255.255.0</LI>
-</UL>
-<P>The '24' is shorthand for a mask with the top 24 bits one and the
- rest zero. This is exactly the same as 255.255.255.0 which has three
- all-ones bytes and one all-zeros byte.</P>
-<P>These indicate that, for this range of addresses, the top 24 bits are
- to be treated as naming a network (often referred to as &quot;the
- 101.101.101.0/24 subnet&quot;) while most combinations of the low 8 bits can
- be used to designate machines on that network. Two addresses are
- reserved; 101.101.101.0 refers to the subnet rather than a specific
- machine while 101.101.101.255 is a broadcast address. 1 to 254 are
- available for machines.</P>
-<P>It is common to find subnets arranged in a hierarchy. For example, a
- large company might have a /16 subnet and allocate /24 subnets within
- that to departments. An ISP might have a large subnet and allocate /26
- subnets (64 addresses, 62 usable) to business customers and /29 subnets
- (8 addresses, 6 usable) to residential clients.</P>
-</DD>
-<DT><A name="SWAN">S/WAN</A></DT>
-<DD>Secure Wide Area Network, a project involving<A href="#RSAco"> RSA
- Data Security</A> and a number of other companies. The goal was to
- ensure that all their<A href="#IPSEC"> IPsec</A> implementations would
- interoperate so that their customers can communicate with each other
- securely.</DD>
-<DT><A name="symmetric">Symmetric cryptography</A></DT>
-<DD>Symmetric cryptography, also referred to as conventional or secret
- key cryptography, relies on a<EM> shared secret key</EM>, identical for
- sender and receiver. Sender encrypts with that key, receiver decrypts
- with it. The idea is that an eavesdropper without the key be unable to
- read the messages. There are two main types of symmetric cipher,<A href="#block">
- block ciphers</A> and<A href="#stream"> stream ciphers</A>.
-<P>Symmetric cryptography contrasts with<A href="#public"> public key</A>
- or asymmetric systems where the two players use different keys.</P>
-<P>The great difficulty in symmetric cryptography is, of course, key
- management. Sender and receiver<EM> must</EM> have identical keys and
- those keys<EM> must</EM> be kept secret from everyone else. Not too
- much of a problem if only two people are involved and they can
- conveniently meet privately or employ a trusted courier. Quite a
- problem, though, in other circumstances.</P>
-<P>It gets much worse if there are many people. An application might be
- written to use only one key for communication among 100 people, for
- example, but there would be serious problems. Do you actually trust all
- of them that much? Do they trust each other that much? Should they?
- What is at risk if that key is compromised? How are you going to
- distribute that key to everyone without risking its secrecy? What do
- you do when one of them leaves the company? Will you even know?</P>
-<P>On the other hand, if you need unique keys for every possible
- connection between a group of 100, then each user must have 99 keys.
- You need either 99*100/2 = 4950<EM> secure</EM> key exchanges between
- users or a central authority that<EM> securely</EM> distributes 100 key
- packets, each with a different set of 99 keys.</P>
-<P>Either of these is possible, though tricky, for 100 users. Either
- becomes an administrative nightmare for larger numbers. Moreover, keys<EM>
- must</EM> be changed regularly, so the problem of key distribution
- comes up again and again. If you use the same key for many messages
- then an attacker has more text to work with in an attempt to crack that
- key. Moreover, one successful crack will give him or her the text of
- all those messages.</P>
-<P>In short, the<EM> hardest part of conventional cryptography is key
- management</EM>. Today the standard solution is to build a<A href="#hybrid">
- hybrid system</A> using<A href="#public"> public key</A> techniques to
- manage keys.</P>
-</DD>
-<DT><A name="T">T</A></DT>
-<DT><A name="TIS">TIS</A></DT>
-<DD>Trusted Information Systems, a firewall vendor now part of<A href="#NAI">
- NAI</A>. Their Gauntlet product offers IPsec VPN services. TIS
- implemented the first version of<A href="#SDNS"> Secure DNS</A> on a<A href="#DARPA">
- DARPA</A> contract.</DD>
-<DT><A name="TLS">TLS</A></DT>
-<DD><B>T</B>ransport<B> L</B>ayer<B> S</B>ecurity, a newer name for<A href="#SSL">
- SSL</A>.</DD>
-<DT><A name="TOS">TOS field</A></DT>
-<DD>The<STRONG> T</STRONG>ype<STRONG> O</STRONG>f<STRONG> S</STRONG>
-ervice field in an IP header, used to control qualkity of service
- routing.</DD>
-<DT><A name="traffic">Traffic analysis</A></DT>
-<DD>Deducing useful intelligence from patterns of message traffic,
- without breaking codes or reading the messages. In one case during
- World War II, the British guessed an attack was coming because all
- German radio traffic stopped. The &quot;radio silence&quot; order, intended to
- preserve security, actually gave the game away.
-<P>In an industrial espionage situation, one might deduce something
- interesting just by knowing that company A and company B were talking,
- especially if one were able to tell which departments were involved, or
- if one already knew that A was looking for acquisitions and B was
- seeking funds for expansion.</P>
-<P>In general, traffic analysis by itself is not very useful. However,
- in the context of a larger intelligence effort where quite a bit is
- already known, it can be very useful. When you are solving a complex
- puzzle, every little bit helps.</P>
-<P><A href="#IPSEC">IPsec</A> itself does not defend against traffic
- analysis, but carefully thought out systems using IPsec can provide at
- least partial protection. In particular, one might want to encrypt more
- traffic than was strictly necessary, route things in odd ways, or even
- encrypt dummy packets, to confuse the analyst. We discuss this<A href="ipsec.html#traffic.resist">
- here</A>.</P>
-</DD>
-<DT><A name="transport">Transport mode</A></DT>
-<DD>An IPsec application in which the IPsec gateway is the destination
- of the protected packets, a machine acts as its own gateway. Contrast
- with<A href="#tunnel"> tunnel mode</A>.</DD>
-<DT>Triple DES</DT>
-<DD>see<A href="#3DES"> 3DES</A></DD>
-<DT><A name="TTL">TTL</A></DT>
-<DD><STRONG>T</STRONG>ime<STRONG> T</STRONG>o<STRONG> L</STRONG>ive,
- used to control<A href="ipsec.html#DNS"> DNS</A> caching. Servers
- discard cached records whose TTL expires</DD>
-<DT><A name="tunnel">Tunnel mode</A></DT>
-<DD>An IPsec application in which an IPsec gateway provides protection
- for packets to and from other systems. Contrast with<A href="#transport">
- transport mode</A>.</DD>
-<DT><A name="2key">Two-key Triple DES</A></DT>
-<DD>A variant of<A href="#3DES"> triple DES or 3DES</A> in which only
- two keys are used. As in the three-key version, the order of operations
- is<A href="#EDE"> EDE</A> or encrypt-decrypt-encrypt, but in the
- two-key variant the first and third keys are the same.
-<P>3DES with three keys has 3*56 = 168 bits of key but has only 112-bit
- strength against a<A href="#meet"> meet-in-the-middle</A> attack, so it
- is possible that the two key version is just as strong. Last I looked,
- this was an open question in the research literature.</P>
-<P>RFC 2451 defines triple DES for<A href="#IPSEC"> IPsec</A> as the
- three-key variant. The two-key variant should not be used and is not
- implemented directly in<A href="web.html#FreeSWAN"> Linux FreeS/WAN</A>
-. It cannot be used in automatically keyed mode without major fiddles in
- the source code. For manually keyed connections, you could make Linux
- FreeS/WAN talk to a two-key implementation by setting two keys the same
- in /etc/ipsec.conf.</P>
-</DD>
-<DT><A name="U">U</A></DT>
-<DT><A name="V">V</A></DT>
-<DT><A name="virtual">Virtual Interface</A></DT>
-<DD>A<A href="#Linux"> Linux</A> feature which allows one physical
- network interface to have two or more IP addresses. See the<CITE> Linux
- Network Administrator's Guide</CITE> in<A href="biblio.html#kirch">
- book form</A> or<A href="http://metalab.unc.edu/LDP/LDP/nag/node1.html">
- on the web</A> for details.</DD>
-<DT>Virtual Private Network</DT>
-<DD>see<A href="#VPN"> VPN</A></DD>
-<DT><A name="VPN">VPN</A></DT>
-<DD><B>V</B>irtual<B> P</B>rivate<B> N</B>etwork, a network which can
- safely be used as if it were private, even though some of its
- communication uses insecure connections. All traffic on those
- connections is encrypted.
-<P><A href="#IPSEC">IPsec</A> is not the only technique available for
- building VPNs, but it is the only method defined by<A href="rfc.html#RFC">
- RFCs</A> and supported by many vendors. VPNs are by no means the only
- thing you can do with IPsec, but they may be the most important
- application for many users.</P>
-</DD>
-<DT><A name="VPNC">VPNC</A></DT>
-<DD><A href="http://www.vpnc.org">Virtual Private Network Consortium</A>
-, an association of vendors of VPN products.</DD>
-<DT><A name="W">W</A></DT>
-<DT><A name="Wassenaar.gloss">Wassenaar Arrangement</A></DT>
-<DD>An international agreement restricting export of munitions and other
- tools of war. Unfortunately, cryptographic software is also restricted
- under the current version of the agreement.<A href="politics.html#Wassenaar">
- Discussion</A>.</DD>
-<DT><A name="web">Web of Trust</A></DT>
-<DD><A href="#PGP">PGP</A>'s method of certifying keys. Any user can
- sign a key; you decide which signatures or combinations of signatures
- to accept as certification. This contrasts with the hierarchy of<A href="#CA">
- CAs (Certification Authorities)</A> used in many<A href="#PKI"> PKIs
- (Public Key Infrastructures)</A>.
-<P>See<A href="#GTR"> Global Trust Register</A> for an interesting
- addition to the web of trust.</P>
-</DD>
-<DT><A name="WEP">WEP (Wired Equivalent Privacy)</A></DT>
-<DD>The cryptographic part of the<A href="#IEEE"> IEEE</A> standard for
- wireless LANs. As the name suggests, this is designed to be only as
- secure as a normal wired ethernet. Anyone with a network conection can
- tap it. Its advocates would claim this is good design, refusing to
- build in complex features beyond the actual requirements.
-<P>Critics refer to WEP as &quot;Wire<EM>tap</EM> Equivalent Privacy&quot;, and
- consider it a horribly flawed design based on bogus &quot;requirements&quot;. You
- do not control radio waves as you might control your wires, so the
- metaphor in the rationale is utterly inapplicable. A security policy
- that chooses not to invest resources in protecting against certain
- attacks which can only be conducted by people physically plugged into
- your LAN may or may not be reasonable. The same policy is completely
- unreasonable when someone can &quot;plug in&quot; from a laptop half a block
- away..</P>
-<P>There has been considerable analysis indicating that WEP is seriously
- flawed. A FAQ on attacks against WEP is available. Part of it reads:</P>
-<BLOCKQUOTE> ... attacks are practical to mount using only inexpensive
- off-the-shelf equipment. We recommend that anyone using an 802.11
- wireless network not rely on WEP for security, and employ other
- security measures to protect their wireless network. Note that our
- attacks apply to both 40-bit and the so-called 128-bit versions of WEP
- equally well.</BLOCKQUOTE>
-<P>WEP appears to be yet another instance of governments, and
- unfortunately some vendors and standards bodies, deliberately promoting
- hopelessly flawed &quot;security&quot; products, apparently mainly for the
- benefit of eavesdropping agencies. See this<A href="politics.html#weak">
- discussion</A>.</P>
-</DD>
-<DT><A name="X">X</A></DT>
-<DT><A name="X509">X.509</A></DT>
-<DD>A standard from the<A href="http://www.itu.int"> ITU (International
- Telecommunication Union)</A>, for hierarchical directories with
- authentication services, used in many<A href="#PKI"> PKI</A>
- implementations.
-<P>Use of X.509 services, via the<A href="#LDAP"> LDAP protocol</A>, for
- certification of keys is allowed but not required by the<A href="#IPSEC">
- IPsec</A> RFCs. It is not yet implemented in<A href="web.html#FreeSWAN">
- Linux FreeS/WAN</A>.</P>
-</DD>
-<DT>Xedia</DT>
-<DD>A vendor of router and Internet access products, now part of Lucent.
- Their QVPN products interoperate with Linux FreeS/WAN; see our<A href="interop.html#Xedia">
- interop document</A>.</DD>
-<DT><A name="Y">Y</A></DT>
-<DT><A name="Z">Z</A></DT>
-</DL>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="web.html">Previous</A>
-<A HREF="biblio.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/ikev2/[DoxygenManual] - Doxygen Manual v1.4.5.pdf b/doc/ikev2/[DoxygenManual] - Doxygen Manual v1.4.5.pdf
deleted file mode 100644
index 496421eb5..000000000
--- a/doc/ikev2/[DoxygenManual] - Doxygen Manual v1.4.5.pdf
+++ /dev/null
diff --git a/doc/ikev2/[Horman04] - Understanding And Programming With Netlink Sockets.pdf b/doc/ikev2/[Horman04] - Understanding And Programming With Netlink Sockets.pdf
deleted file mode 100644
index aa2cded2e..000000000
--- a/doc/ikev2/[Horman04] - Understanding And Programming With Netlink Sockets.pdf
+++ /dev/null
diff --git a/doc/ikev2/[IKEAnalysis] - Key Exchange in IPSec - Analysis of IKE.pdf b/doc/ikev2/[IKEAnalysis] - Key Exchange in IPSec - Analysis of IKE.pdf
deleted file mode 100644
index d5d3b43cc..000000000
--- a/doc/ikev2/[IKEAnalysis] - Key Exchange in IPSec - Analysis of IKE.pdf
+++ /dev/null
diff --git a/doc/ikev2/[IKEv2Clarifications] - IKEv2 Clarifications and Implementation Guidelines.txt b/doc/ikev2/[IKEv2Clarifications] - IKEv2 Clarifications and Implementation Guidelines.txt
deleted file mode 100644
index d4c67b161..000000000
--- a/doc/ikev2/[IKEv2Clarifications] - IKEv2 Clarifications and Implementation Guidelines.txt
+++ /dev/null
@@ -1,3248 +0,0 @@
-
-
-
-Network Working Group                                          P. Eronen
-Internet-Draft                                                     Nokia
-Expires: August 6, 2006                                       P. Hoffman
-                                                          VPN Consortium
-                                                        February 2, 2006
-
-
-           IKEv2 Clarifications and Implementation Guidelines
-             draft-eronen-ipsec-ikev2-clarifications-07.txt
-
-Status of this Memo
-
-   By submitting this Internet-Draft, each author represents that any
-   applicable patent or other IPR claims of which he or she is aware
-   have been or will be disclosed, and any of which he or she becomes
-   aware will be disclosed, in accordance with Section 6 of BCP 79.
-
-   Internet-Drafts are working documents of the Internet Engineering
-   Task Force (IETF), its areas, and its working groups.  Note that
-   other groups may also distribute working documents as Internet-
-   Drafts.
-
-   Internet-Drafts are draft documents valid for a maximum of six months
-   and may be updated, replaced, or obsoleted by other documents at any
-   time.  It is inappropriate to use Internet-Drafts as reference
-   material or to cite them other than as "work in progress."
-
-   The list of current Internet-Drafts can be accessed at
-   http://www.ietf.org/ietf/1id-abstracts.txt.
-
-   The list of Internet-Draft Shadow Directories can be accessed at
-   http://www.ietf.org/shadow.html.
-
-   This Internet-Draft will expire on August 6, 2006.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (2006).
-
-Abstract
-
-   This document clarifies many areas of the IKEv2 specification.  It
-   does not to introduce any changes to the protocol, but rather
-   provides descriptions that are less prone to ambiguous
-   interpretations.  The purpose of this document is to encourage the
-   development of interoperable implementations.
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                 [Page 1]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-Table of Contents
-
-   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  4
-   2.  Creating the IKE_SA  . . . . . . . . . . . . . . . . . . . . .  4
-     2.1.  SPI values in IKE_SA_INIT exchange . . . . . . . . . . . .  4
-     2.2.  Message IDs for IKE_SA_INIT messages . . . . . . . . . . .  5
-     2.3.  Retransmissions of IKE_SA_INIT requests  . . . . . . . . .  5
-     2.4.  Interaction of COOKIE and INVALID_KE_PAYLOAD . . . . . . .  6
-     2.5.  Invalid cookies  . . . . . . . . . . . . . . . . . . . . .  8
-   3.  Authentication . . . . . . . . . . . . . . . . . . . . . . . .  8
-     3.1.  Data included in AUTH payload calculation  . . . . . . . .  8
-     3.2.  Hash function for RSA signatures . . . . . . . . . . . . .  9
-     3.3.  Encoding method for RSA signatures . . . . . . . . . . . . 10
-     3.4.  Identification type for EAP  . . . . . . . . . . . . . . . 10
-     3.5.  Identity for policy lookups when using EAP . . . . . . . . 11
-     3.6.  (Section removed)  . . . . . . . . . . . . . . . . . . . . 11
-     3.7.  Certificate encoding types . . . . . . . . . . . . . . . . 11
-     3.8.  Shared key authentication and fixed PRF key size . . . . . 12
-     3.9.  EAP authentication and fixed PRF key size  . . . . . . . . 13
-     3.10. Matching ID payloads to certificate contents . . . . . . . 13
-     3.11. Message IDs for IKE_AUTH messages  . . . . . . . . . . . . 13
-   4.  Creating CHILD_SAs . . . . . . . . . . . . . . . . . . . . . . 13
-     4.1.  Creating SAs with the CREATE_CHILD_SA exchange . . . . . . 14
-     4.2.  Creating an IKE_SA without a CHILD_SA  . . . . . . . . . . 16
-     4.3.  Diffie-Hellman for first CHILD_SA  . . . . . . . . . . . . 16
-     4.4.  Extended Sequence Numbers (ESN) transform  . . . . . . . . 16
-     4.5.  Negotiation of ESP_TFC_PADDING_NOT_SUPPORTED . . . . . . . 17
-     4.6.  Negotiation of NON_FIRST_FRAGMENTS_ALSO  . . . . . . . . . 17
-     4.7.  Semantics of complex traffic selector payloads . . . . . . 18
-     4.8.  ICMP type/code in traffic selector payloads  . . . . . . . 18
-     4.9.  Mobility header in traffic selector payloads . . . . . . . 19
-     4.10. Narrowing the traffic selectors  . . . . . . . . . . . . . 20
-     4.11. SINGLE_PAIR_REQUIRED . . . . . . . . . . . . . . . . . . . 20
-     4.12. Traffic selectors violating own policy . . . . . . . . . . 21
-   5.  Rekeying and deleting SAs  . . . . . . . . . . . . . . . . . . 21
-     5.1.  Rekeying SAs with the CREATE_CHILD_SA exchange . . . . . . 21
-     5.2.  Rekeying the IKE_SA vs. reauthentication . . . . . . . . . 23
-     5.3.  SPIs when rekeying the IKE_SA  . . . . . . . . . . . . . . 23
-     5.4.  SPI when rekeying a CHILD_SA . . . . . . . . . . . . . . . 24
-     5.5.  Changing PRFs when rekeying the IKE_SA . . . . . . . . . . 24
-     5.6.  Deleting vs. closing SAs . . . . . . . . . . . . . . . . . 24
-     5.7.  Deleting a CHILD_SA pair . . . . . . . . . . . . . . . . . 25
-     5.8.  Deleting an IKE_SA . . . . . . . . . . . . . . . . . . . . 25
-     5.9.  Who is the original initiator of IKE_SA  . . . . . . . . . 25
-     5.10. (Section removed)  . . . . . . . . . . . . . . . . . . . . 25
-     5.11. Comparing nonces . . . . . . . . . . . . . . . . . . . . . 26
-     5.12. Exchange collisions  . . . . . . . . . . . . . . . . . . . 26
-     5.13. Diffie-Hellman and rekeying the IKE_SA . . . . . . . . . . 34
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                 [Page 2]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   6.  Configuration payloads . . . . . . . . . . . . . . . . . . . . 35
-     6.1.  Assigning IP addresses . . . . . . . . . . . . . . . . . . 35
-     6.2.  (Section removed)  . . . . . . . . . . . . . . . . . . . . 36
-     6.3.  Requesting any INTERNAL_IP4/IP6_ADDRESS  . . . . . . . . . 36
-     6.4.  INTERNAL_IP4_SUBNET/INTERNAL_IP6_SUBNET  . . . . . . . . . 36
-     6.5.  INTERNAL_IP4_NETMASK . . . . . . . . . . . . . . . . . . . 39
-     6.6.  Configuration payloads for IPv6  . . . . . . . . . . . . . 40
-     6.7.  INTERNAL_IP6_NBNS  . . . . . . . . . . . . . . . . . . . . 42
-     6.8.  INTERNAL_ADDRESS_EXPIRY  . . . . . . . . . . . . . . . . . 42
-     6.9.  Address assignment failures  . . . . . . . . . . . . . . . 42
-   7.  Miscellaneous issues . . . . . . . . . . . . . . . . . . . . . 43
-     7.1.  Matching ID_IPV4_ADDR and ID_IPV6_ADDR . . . . . . . . . . 43
-     7.2.  Relationship of IKEv2 to RFC4301 . . . . . . . . . . . . . 43
-     7.3.  Reducing the window size . . . . . . . . . . . . . . . . . 44
-     7.4.  Minimum size of nonces . . . . . . . . . . . . . . . . . . 44
-     7.5.  Initial zero octets on port 4500 . . . . . . . . . . . . . 44
-     7.6.  Destination port for NAT traversal . . . . . . . . . . . . 45
-     7.7.  SPI values for messages outside of an IKE_SA . . . . . . . 45
-     7.8.  Protocol ID/SPI fields in Notify payloads  . . . . . . . . 46
-     7.9.  Which message should contain INITIAL_CONTACT . . . . . . . 46
-     7.10. Alignment of payloads  . . . . . . . . . . . . . . . . . . 46
-     7.11. Key length transform attribute . . . . . . . . . . . . . . 47
-     7.12. IPsec IANA considerations  . . . . . . . . . . . . . . . . 47
-     7.13. Combining ESP and AH . . . . . . . . . . . . . . . . . . . 48
-   8.  Status of the clarifications . . . . . . . . . . . . . . . . . 48
-   9.  Implementation mistakes  . . . . . . . . . . . . . . . . . . . 50
-   10. Security considerations  . . . . . . . . . . . . . . . . . . . 51
-   11. IANA considerations  . . . . . . . . . . . . . . . . . . . . . 51
-   12. Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 51
-   13. References . . . . . . . . . . . . . . . . . . . . . . . . . . 51
-     13.1. Normative References . . . . . . . . . . . . . . . . . . . 51
-     13.2. Informative References . . . . . . . . . . . . . . . . . . 52
-   Appendix A.  Exchanges and payloads  . . . . . . . . . . . . . . . 53
-     A.1.  IKE_SA_INIT exchange . . . . . . . . . . . . . . . . . . . 54
-     A.2.  IKE_AUTH exchange without EAP  . . . . . . . . . . . . . . 54
-     A.3.  IKE_AUTH exchange with EAP . . . . . . . . . . . . . . . . 55
-     A.4.  CREATE_CHILD_SA exchange for creating/rekeying
-           CHILD_SAs  . . . . . . . . . . . . . . . . . . . . . . . . 56
-     A.5.  CREATE_CHILD_SA exchange for rekeying the IKE_SA . . . . . 56
-     A.6.  INFORMATIONAL exchange . . . . . . . . . . . . . . . . . . 56
-   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 57
-   Intellectual Property and Copyright Statements . . . . . . . . . . 58
-
-
-
-
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                 [Page 3]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-1.  Introduction
-
-   This document clarifies many areas of the IKEv2 specification that
-   may be difficult to understand to developers not intimately familiar
-   with the specification and its history.  The clarifications in this
-   document come from the discussion on the IPsec WG mailing list, from
-   experience in interoperability testing, and from implementation
-   issues that have been brought to the editors' attention.
-
-   Readers are advised that this document is work-in-progress, and may
-   contain incorrect interpretations.  Issues where the clarification is
-   known to be incomplete, or there is no consensus on what the the
-   interpretation should be, are marked as such.
-
-   IKEv2/IPsec can be used for several different purposes, including
-   IPsec-based remote access (sometimes called the "road warrior" case),
-   site-to-site virtual private networks (VPNs), and host-to-host
-   protection of application traffic.  While this document attempts to
-   consider all of these uses, the remote access scenario has perhaps
-   received more attention here than the other uses.
-
-   This document does not place any requirements on anyone, and does not
-   use [RFC2119] keywords such as "MUST" and "SHOULD", except in
-   quotations from the original IKEv2 documents.  The requirements are
-   given in the IKEv2 specification [IKEv2] and IKEv2 cryptographic
-   algorithms document [IKEv2ALG].
-
-   In this document, references to a numbered section (such as "Section
-   2.15") mean that section in [IKEv2].  References to mailing list
-   messages refer to the IPsec WG mailing list at ipsec@ietf.org.
-   Archives of the mailing list can be found at
-   <http://www.ietf.org/mail-archive/web/ipsec/index.html>.
-
-
-2.  Creating the IKE_SA
-
-2.1.  SPI values in IKE_SA_INIT exchange
-
-   Normal IKE messages include the initiator's and responder's SPIs,
-   both of which are non-zero, in the IKE header.  However, there are
-   some corner cases where the IKEv2 specification is not fully
-   consistent about what values should be used.
-
-   First, Section 3.1 says that the Responder's SPI "...MUST NOT be zero
-   in any other message" (than the first message of the IKE_SA_INIT
-   exchange).  However, the figure in Section 2.6 shows the second
-   IKE_SA_INIT message as "HDR(A,0), N(COOKIE)", contradicting the text
-   in 3.1.
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                 [Page 4]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   Since the responder's SPI identifies security-related state held by
-   the responder, and in this case no state is created, sending a zero
-   value seems reasonable.
-
-   Second, in addition to cookies, there are several other cases when
-   the IKE_SA_INIT exchange does not result in the creation of an IKE_SA
-   (for instance, INVALID_KE_PAYLOAD or NO_PROPOSAL_CHOSEN).  What
-   responder SPI value should be used in the IKE_SA_INIT response in
-   this case?
-
-   Since the IKE_SA_INIT request always has a zero responder SPI, the
-   value will not be actually used by the initiator.  Thus, we think
-   sending a zero value is correct also in this case.
-
-   If the responder sends a non-zero responder SPI, the initiator should
-   not reject the response only for that reason.  However, when retrying
-   the IKE_SA_INIT request, the initiator will use a zero responder SPI,
-   as described in Section 3.1: "Responder's SPI [...]  This value MUST
-   be zero in the first message of an IKE Initial Exchange (including
-   repeats of that message including a cookie) [...]".  We believe the
-   intent was to cover repeats of that message due to other reasons,
-   such as INVALID_KE_PAYLOAD, as well.
-
-   (References: "INVALID_KE_PAYLOAD and clarifications document" thread,
-   Sep-Oct 2005.)
-
-2.2.  Message IDs for IKE_SA_INIT messages
-
-   The Message ID for IKE_SA_INIT messages is always zero.  This
-   includes retries of the message due to responses such as COOKIE and
-   INVALID_KE_PAYLOAD.
-
-   This is because Message IDs are part of the IKE_SA state, and when
-   the responder replies to IKE_SA_INIT request with N(COOKIE) or
-   N(INVALID_KE_PAYLOAD), the responder does not allocate any state.
-
-   (References: "Question about N(COOKIE) and N(INVALID_KE_PAYLOAD)
-   combination" thread, Oct 2004.  Tero Kivinen's mail "Comments of
-   draft-eronen-ipsec-ikev2-clarifications-02.txt", 2005-04-05.)
-
-2.3.  Retransmissions of IKE_SA_INIT requests
-
-   When a responder receives an IKE_SA_INIT request, it has to determine
-   whether the packet is a retransmission belonging to an existing
-   "half-open" IKE_SA (in which case the responder retransmits the same
-   response), or a new request (in which case the responder creates a
-   new IKE_SA and sends a fresh response).
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                 [Page 5]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   The specification does not describe in detail how this determination
-   is done.  In particular, it is not sufficient to use the initiator's
-   SPI and/or IP address for this purpose: two different peers behind a
-   single NAT could choose the same initiator SPI (and the probability
-   of this happening is not necessarily small, since IKEv2 does not
-   require SPIs to be chosen randomly).  Instead, the responder should
-   do the IKE_SA lookup using the whole packet or its hash (or at the
-   minimum, the Ni payload which is always chosen randomly).
-
-   For all other packets than IKE_SA_INIT requests, looking up right
-   IKE_SA is of course done based on the the recipient's SPI (either the
-   initiator or responder SPI depending on the value of the Initiator
-   bit in the IKE header).
-
-2.4.  Interaction of COOKIE and INVALID_KE_PAYLOAD
-
-   There are two common reasons why the initiator may have to retry the
-   IKE_SA_INIT exchange: the responder requests a cookie or wants a
-   different Diffie-Hellman group than was included in the KEi payload.
-   Both of these cases are quite simple alone, but it is not totally
-   obvious what happens when they occur at the same time, that is, the
-   IKE_SA_INIT exchange is retried several times.
-
-   The main question seems to be the following: if the initiator
-   receives a cookie from the responder, should it include the cookie in
-   only the next retry of the IKE_SA_INIT request, or in all subsequent
-   retries as well?  Section 3.10.1 says that:
-
-      "This notification MUST be included in an IKE_SA_INIT request
-      retry if a COOKIE notification was included in the initial
-      response."
-
-   This could be interpreted as saying that when a cookie is received in
-   the initial response, it is included in all retries.  On the other
-   hand, Section 2.6 says that:
-
-      "Initiators who receive such responses MUST retry the
-      IKE_SA_INIT with a Notify payload of type COOKIE containing
-      the responder supplied cookie data as the first payload and
-      all other payloads unchanged."
-
-   Including the same cookie in later retries makes sense only if the
-   "all other payloads unchanged" restriction applies only to the first
-   retry, but not to subsequent retries.
-
-   It seems that both interpretations can peacefully co-exist.  If the
-   initiator includes the cookie only in the next retry, one additional
-   roundtrip may be needed in some cases:
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                 [Page 6]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-      Initiator                   Responder
-     -----------                 -----------
-      HDR(A,0), SAi1, KEi, Ni -->
-                              <-- HDR(A,0), N(COOKIE)
-      HDR(A,0), N(COOKIE), SAi1, KEi, Ni  -->
-                              <-- HDR(A,0), N(INVALID_KE_PAYLOAD)
-      HDR(A,0), SAi1, KEi', Ni -->
-                              <-- HDR(A,0), N(COOKIE')
-      HDR(A,0), N(COOKIE'), SAi1, KEi',Ni -->
-                              <-- HDR(A,B), SAr1, KEr, Nr
-
-   An additional roundtrip is needed also if the initiator includes the
-   cookie in all retries, but the responder does not support this.  For
-   instance, if the responder includes the SAi1 and KEi payloads in
-   cookie calculation, it will reject the request by sending a new
-   cookie (see also Section 2.5 of this document for more text about
-   invalid cookies):
-
-      Initiator                   Responder
-     -----------                 -----------
-      HDR(A,0), SAi1, KEi, Ni -->
-                              <-- HDR(A,0), N(COOKIE)
-      HDR(A,0), N(COOKIE), SAi1, KEi, Ni  -->
-                              <-- HDR(A,0), N(INVALID_KE_PAYLOAD)
-      HDR(A,0), N(COOKIE), SAi1, KEi', Ni -->
-                              <-- HDR(A,0), N(COOKIE')
-      HDR(A,0), N(COOKIE'), SAi1, KEi',Ni -->
-                              <-- HDR(A,B), SAr1, KEr, Nr
-
-   If both peers support including the cookie in all retries, a slightly
-   shorter exchange can happen:
-
-      Initiator                   Responder
-     -----------                 -----------
-      HDR(A,0), SAi1, KEi, Ni -->
-                              <-- HDR(A,0), N(COOKIE)
-      HDR(A,0), N(COOKIE), SAi1, KEi, Ni  -->
-                              <-- HDR(A,0), N(INVALID_KE_PAYLOAD)
-      HDR(A,0), N(COOKIE), SAi1, KEi', Ni -->
-                              <-- HDR(A,B), SAr1, KEr, Nr
-
-   This document recommends that implementations should support this
-   shorter exchange, but it must not be assumed the other peer also
-   supports this.
-
-
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                 [Page 7]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   In theory, even this exchange has one unnecessary roundtrip, as both
-   the cookie and Diffie-Hellman group could be checked at the same
-   time:
-
-      Initiator                   Responder
-     -----------                 -----------
-      HDR(A,0), SAi1, KEi, Ni -->
-                              <-- HDR(A,0), N(COOKIE),
-                                            N(INVALID_KE_PAYLOAD)
-      HDR(A,0), N(COOKIE), SAi1, KEi',Ni -->
-                              <-- HDR(A,B), SAr1, KEr, Nr
-
-   However, it is clear that this case is not allowed by the text in
-   Section 2.6, since "all other payloads" clearly includes the KEi
-   payload as well.
-
-   (References: "INVALID_KE_PAYLOAD and clarifications document" thread,
-   Sep-Oct 2005.)
-
-2.5.  Invalid cookies
-
-   There has been some confusion what should be done when an IKE_SA_INIT
-   request containing an invalid cookie is received ("invalid" in the
-   sense that its contents do not match the value expected by the
-   responder).
-
-   The correct action is to ignore the cookie, and process the message
-   as if no cookie had been included (usually this means sending a
-   response containing a new cookie).  This is shown in Section 2.6 when
-   it says "The responder in that case MAY reject the message by sending
-   another response with a new cookie [...]".
-
-   Other possible actions, such as ignoring the whole request (or even
-   all requests from this IP address for some time), create strange
-   failure modes even in the absence of any malicious attackers, and do
-   not provide any additional protection against DoS attacks.
-
-   (References: "Invalid Cookie" thread, Sep-Oct 2005.)
-
-
-3.  Authentication
-
-3.1.  Data included in AUTH payload calculation
-
-   Section 2.15 describes how the AUTH payloads are calculated; this
-   calculation involves values prf(SK_pi,IDi') and prf(SK_pr,IDr').  The
-   text describes the method in words, but does not give clear
-   definitions of what is signed or MACed.
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                 [Page 8]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   The initiator's signed octets can be described as:
-
-       InitiatorSignedOctets = RealMessage1 | NonceRData | MACedIDForI
-       GenIKEHDR = [ four octets 0 if using port 4500 ] | RealIKEHDR
-       RealIKEHDR =  SPIi | SPIr |  . . . | Length
-       RealMessage1 = RealIKEHDR | RestOfMessage1
-       NonceRPayload = PayloadHeader | NonceRData
-       InitiatorIDPayload = PayloadHeader | RestOfIDPayload
-       RestOfInitIDPayload = IDType | RESERVED | InitIDData
-       MACedIDForI = prf(SK_pi, RestOfInitIDPayload)
-
-   The responder's signed octets can be described as:
-
-       ResponderSignedOctets = RealMessage2 | NonceIData | MACedIDForR
-       GenIKEHDR = [ four octets 0 if using port 4500 ] | RealIKEHDR
-       RealIKEHDR =  SPIi | SPIr |  . . . | Length
-       RealMessage2 = RealIKEHDR | RestOfMessage2
-       NonceIPayload = PayloadHeader | NonceIData
-       ResponderIDPayload = PayloadHeader | RestOfIDPayload
-       RestOfRespIDPayload = IDType | RESERVED | InitIDData
-       MACedIDForR = prf(SK_pr, RestOfRespIDPayload)
-
-3.2.  Hash function for RSA signatures
-
-   Section 3.8 says that RSA digital signature is "Computed as specified
-   in section 2.15 using an RSA private key over a PKCS#1 padded hash."
-
-   Unlike IKEv1, IKEv2 does not negotiate a hash function for the
-   IKE_SA.  The algorithm for signatures is selected by the signing
-   party who, in general, may not know beforehand what algorithms the
-   verifying party supports.  Furthermore, [IKEv2ALG] does not say what
-   algorithms implementations are required or recommended to support.
-   This clearly has a potential for causing interoperability problems,
-   since authentication will fail if the signing party selects an
-   algorithm that is not supported by the verifying party, or not
-   acceptable according to the verifying party's policy.
-
-   This document recommends that all implementations support SHA-1, and
-   use SHA-1 as the default hash function when generating the
-   signatures, unless there are good reasons (such as explicit manual
-   configuration) to believe that the other end supports something else.
-
-   Note that hash function collision attacks are not important for the
-   AUTH payloads, since they are not intended for third-party
-   verification, and the data includes fresh nonces.  See [HashUse] for
-   more discussion about hash function attacks and IPsec.
-
-   Another semi-reasonable choice would be to use the hash function that
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                 [Page 9]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   was used by the CA when signing the peer certificate.  However, this
-   does not guarantee that the IKEv2 peer would be able to validate the
-   AUTH payload, since it does not necessarily check the certificate
-   signature.  The peer could be configured with a fingerprint of the
-   certificate, or certificate validation could be performed by an
-   external entity using [SCVP].  Furthermore, not all CERT payloads
-   types include a signature, and the certificate could be signed with
-   some other algorithm than RSA.
-
-   Note that unlike IKEv1, IKEv2 uses the PKCS#1 v1.5 [PKCS1v20]
-   signature encoding method (see next section for details), which
-   includes the algorithm identifier for the hash algorithm.  Thus, when
-   the verifying party receives the AUTH payload it can at least
-   determine which hash function was used.
-
-   (References: Magnus Alstrom's mail "RE:", 2005-01-03.  Pasi Eronen's
-   reply, 2005-01-04.  Tero Kivinen's reply, 2005-01-04.  "First draft
-   of IKEv2.1" thread, Dec 2005/Jan 2006.)
-
-3.3.  Encoding method for RSA signatures
-
-   Section 3.8 says that the RSA digital signature is "Computed as
-   specified in section 2.15 using an RSA private key over a PKCS#1
-   padded hash."
-
-   The PKCS#1 specification [PKCS1v21] defines two different encoding
-   methods (ways of "padding the hash") for signatures.  However, the
-   Internet-Draft approved by the IESG had a reference to the older
-   PKCS#1 v2.0 [PKCS1v20].  That version has only one encoding method
-   for signatures (EMSA-PKCS1-v1_5), and thus there is no ambiguity.
-
-   Note that this encoding method is different from the encoding method
-   used in IKEv1.  If future revisions of IKEv2 provide support for
-   other encoding methods (such as EMSA-PSS), they will be given new
-   Auth Method numbers.
-
-   (References: Pasi Eronen's mail "RE:", 2005-01-04.)
-
-3.4.  Identification type for EAP
-
-   Section 3.5 defines several different types for identification
-   payloads, including, e.g., ID_FQDN, ID_RFC822_ADDR, and ID_KEY_ID.
-   EAP [EAP] does not mandate the use of any particular type of
-   identifier, but often EAP is used with Network Access Identifiers
-   (NAIs) defined in [NAI].  Although NAIs look a bit like email
-   addresses (e.g., "joe@example.com"), the syntax is not exactly the
-   same as the syntax of email address in [RFC822].  This raises the
-   question of which identification type should be used.
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 10]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   This document recommends that ID_RFC822_ADDR identification type is
-   used for those NAIs that include the realm component.  Therefore,
-   responder implementations should not attempt to verify that the
-   contents actually conform to the exact syntax given in [RFC822] or
-   [RFC2822], but instead should accept any reasonable looking NAI.
-
-   For NAIs that do not include the realm component, this document
-   recommends using the ID_KEY_ID identification type.
-
-   (References: "need your help on this IKEv2/i18n/EAP issue" and "IKEv2
-   identifier issue with EAP" threads, Aug 2004.)
-
-3.5.  Identity for policy lookups when using EAP
-
-   When the initiator authentication uses EAP, it is possible that the
-   contents of the IDi payload is used only for AAA routing purposes and
-   selecting which EAP method to use.  This value may be different from
-   the identity authenticated by the EAP method (see [EAP], Sections 5.1
-   and 7.3).
-
-   It is important that policy lookups and access control decisions use
-   the actual authenticated identity.  Often the EAP server is
-   implemented in a separate AAA server that communicates with the IKEv2
-   responder using, e.g., RADIUS [RADEAP].  In this case, the
-   authenticated identity has to be sent from the AAA server to the
-   IKEv2 responder.
-
-   (References: Pasi Eronen's mail "RE: Reauthentication in IKEv2",
-   2004-10-28.  "Policy lookups" thread, Oct/Nov 2004.  RFC 3748,
-   Section 7.3.)
-
-3.6.  (Section removed)
-
-   (This issue was corrected in RFC 4306.)
-
-3.7.  Certificate encoding types
-
-   Section 3.6 defines a total of twelve different certificate encoding
-   types, and continues that "Specific syntax is for some of the
-   certificate type codes above is not defined in this document."
-   However, the text does not provide references to other documents that
-   would contain information about the exact contents and use of those
-   values.
-
-
-
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 11]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   Without this information, it is not possible to develop interoperable
-   implementations.  Therefore, this document recommends that the
-   following certificate encoding values should not be used before new
-   specifications that specify their use are available.
-
-        PKCS #7 wrapped X.509 certificate    1
-        PGP Certificate                      2
-        DNS Signed Key                       3
-        Kerberos Token                       6
-        SPKI Certificate                     9
-
-   (Future versions of this document may also contain clarifications
-   about how these values are to be used.)
-
-   This document recommends that most implementations should use only
-   those values that are "MUST"/"SHOULD" requirements in [IKEv2]; i.e.,
-   "X.509 Certificate - Signature" (4), "Raw RSA Key" (11), "Hash and
-   URL of X.509 certificate" (12), and "Hash and URL of X.509 bundle"
-   (13).
-
-   Furthermore, Section 3.7 says that the "Certificate Encoding" field
-   for the Certificate Request payload uses the same values as for
-   Certificate payload.  However, the contents of the "Certification
-   Authority" field are defined only for X.509 certificates (presumably
-   covering at least types 4, 10, 12, and 13).  This document recommends
-   that other values should not be used before new specifications that
-   specify their use are available.
-
-   The "Raw RSA Key" type needs one additional clarification.  Section
-   3.6 says it contains "a PKCS #1 encoded RSA key".  What this means is
-   a DER-encoded RSAPublicKey structure from PKCS#1 [PKCS1v21].
-
-3.8.  Shared key authentication and fixed PRF key size
-
-   Section 2.15 says that "If the negotiated prf takes a fixed-size key,
-   the shared secret MUST be of that fixed size".  This statement is
-   correct: the shared secret must be of the correct size.  If it is
-   not, it cannot be used; there is no padding, truncation, or other
-   processing involved to force it to that correct size.
-
-   This requirement means that it is difficult to use these PRFs with
-   shared key authentication.  The authors think this part of the
-   specification was very poorly thought out, and using PRFs with a
-   fixed key size is likely to result in interoperability problems.
-   Thus, we recommend that such PRFs should not be used with shared key
-   authentication.  PRF_AES128_XCBC [RFC3664] originally used fixed key
-   sizes; that RFC has been updated to handle variable key sizes in
-   [RFC3664bis].
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 12]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   Note that Section 2.13 also contains text that is related to PRFs
-   with fixed key size: "When the key for the prf function has fixed
-   length, the data provided as a key is truncated or padded with zeros
-   as necessary unless exceptional processing is explained following the
-   formula".  However, this text applies only to the prf+ construction,
-   so it does not contradict the text in Section 2.15.
-
-   (References: Paul Hoffman's mail "Re: ikev2-07: last nits",
-   2003-05-02.  Hugo Krawczyk's reply, 2003-05-12.  Thread "Question
-   about PRFs with fixed size key", Jan 2005.)
-
-3.9.  EAP authentication and fixed PRF key size
-
-   As described in the previous section, PRFs with a fixed key size
-   require a shared secret of exactly that size.  This restriction
-   applies also to EAP authentication.  For instance, a PRF that
-   requires a 128-bit key cannot be used with EAP since [EAP] specifies
-   that the MSK is at least 512 bits long.
-
-   (References: Thread "Question about PRFs with fixed size key", Jan
-   2005.)
-
-3.10.  Matching ID payloads to certificate contents
-
-   In IKEv1, there was some confusion about whether or not the
-   identities in certificates used to authenticate IKE were required to
-   match the contents of the ID payloads.  There has been some work done
-   on this in the PKI4IPSEC Working Group, but that work is not finished
-   at this time.  However, Section 3.5 explicitly says that the ID
-   payload "does not necessarily have to match anything in the CERT
-   payload".
-
-3.11.  Message IDs for IKE_AUTH messages
-
-   According to Section 2.2, "The IKE_SA initial setup messages will
-   always be numbered 0 and 1."  That is true when the IKE_AUTH exchange
-   does not use EAP.  When EAP is used, each pair of messages have their
-   message numbers incremented.  The first pair of AUTH messages will
-   have an ID of 1, the second will be 2, and so on.
-
-   (References: "Question about MsgID in AUTH exchange" thread, April
-   2005.)
-
-
-4.  Creating CHILD_SAs
-
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 13]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-4.1.  Creating SAs with the CREATE_CHILD_SA exchange
-
-   Section 1.3's organization does not lead to clear understanding of
-   what is needed in which environment.  The section can be reorganized
-   with subsections for each use of the CREATE_CHILD_SA exchange
-   (creating child SAs, rekeying IKE SAs, and rekeying child SAs.)
-
-   The new Section 1.3 with subsections and the above changes might look
-   like this.
-
-   NEW-1.3 The CREATE_CHILD_SA Exchange
-
-        The CREATE_CHILD_SA Exchange is used to create new CHILD_SAs and
-        to rekey both IKE_SAs and CHILD_SAs.  This exchange consists of
-        a single request/response pair, and some of its function was
-        referred to as a phase 2 exchange in IKEv1.  It MAY be initiated
-        by either end of the IKE_SA after the initial exchanges are
-        completed.
-
-        All messages following the initial exchange are
-        cryptographically protected using the cryptographic algorithms
-        and keys negotiated in the first two messages of the IKE
-        exchange.  These subsequent messages use the syntax of the
-        Encrypted Payload described in section 3.14.  All subsequent
-        messages include an Encrypted Payload, even if they are referred
-        to in the text as "empty".
-
-        The CREATE_CHILD_SA is used for rekeying IKE_SAs and CHILD_SAs.
-        This section describes the first part of rekeying, the creation
-        of new SAs; Section 2.8 covers the mechanics of rekeying,
-        including moving traffic from old to new SAs and the deletion of
-        the old SAs.  The two sections must be read together to
-        understand the entire process of rekeying.
-
-        Either endpoint may initiate a CREATE_CHILD_SA exchange, so in
-        this section the term initiator refers to the endpoint
-        initiating this exchange.  An implementation MAY refuse all
-        CREATE_CHILD_SA requests within an IKE_SA.
-
-        The CREATE_CHILD_SA request MAY optionally contain a KE payload
-        for an additional Diffie-Hellman exchange to enable stronger
-        guarantees of forward secrecy for the CHILD_SA or IKE_SA.  The
-        keying material for the SA is a function of SK_d established
-        during the establishment of the IKE_SA, the nonces exchanged
-        during the CREATE_CHILD_SA exchange, and the Diffie-Hellman
-        value (if KE payloads are included in the CREATE_CHILD_SA
-        exchange).  The details are described in sections 2.17 and 2.18.
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 14]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-        If a CREATE_CHILD_SA exchange includes a KEi payload, at least
-        one of the SA offers MUST include the Diffie-Hellman group of
-        the KEi.  The Diffie-Hellman group of the KEi MUST be an element
-        of the group the initiator expects the responder to accept
-        (additional Diffie-Hellman groups can be proposed).  If the
-        responder rejects the Diffie-Hellman group of the KEi payload,
-        the responder MUST reject the request and indicate its preferred
-        Diffie-Hellman group in the INVALID_KE_PAYLOAD Notification
-        payload.  In the case of such a rejection, the CREATE_CHILD_SA
-        exchange fails, and the initiator SHOULD retry the exchange with
-        a Diffie-Hellman proposal and KEi in the group that the
-        responder gave in the INVALID_KE_PAYLOAD.
-
-   NEW-1.3.1 Creating New CHILD_SAs with the CREATE_CHILD_SA Exchange
-
-        A CHILD_SA may be created by sending a CREATE_CHILD_SA request.
-        The CREATE_CHILD_SA request for creating a new CHILD_SA is:
-
-            Initiator                                 Responder
-           -----------                               -----------
-            HDR, SK {[N+], SA, Ni, [KEi],
-                       TSi, TSr}        -->
-
-        The initiator sends SA offer(s) in the SA payload, a nonce in
-        the Ni payload, optionally a Diffie-Hellman value in the KEi
-        payload, and the proposed traffic selectors for the proposed
-        CHILD_SA in the TSi and TSr payloads. The request can also
-        contain Notify payloads that specify additional details for the
-        CHILD_SA: these include IPCOMP_SUPPORTED, USE_TRANSPORT_MODE,
-        ESP_TFC_PADDING_NOT_SUPPORTED, and NON_FIRST_FRAGMENTS_ALSO.
-
-        The CREATE_CHILD_SA response for creating a new CHILD_SA is:
-
-                                       <--    HDR, SK {[N+], SA, Nr,
-                                                    [KEr], TSi, TSr}
-
-        The responder replies with the accepted offer in an SA payload,
-        and a Diffie-Hellman value in the KEr payload if KEi was
-        included in the request and the selected cryptographic suite
-        includes that group. As with the request, optional Notification
-        payloads can specify additional details for the CHILD_SA.
-
-        The traffic selectors for traffic to be sent on that SA are
-        specified in the TS payloads in the response, which may be a
-        subset of what the initiator of the CHILD_SA proposed.
-
-   The text about rekeying SAs can be found in Section 5.1 of this
-   document.
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 15]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-4.2.  Creating an IKE_SA without a CHILD_SA
-
-   CHILD_SAs can be created either by being piggybacked on the IKE_AUTH
-   exchange, or using a separate CREATE_CHILD_SA exchange.  The
-   specification is not clear about what happens if creating the
-   CHILD_SA during the IKE_AUTH exchange fails for some reason.
-
-   Our recommendation in this sitation is that the IKE_SA is created as
-   usual.  This is also in line with how the CREATE_CHILD_SA exchange
-   works: a failure to create a CHILD_SA does not close the IKE_SA.
-
-   The list of responses in the IKE_AUTH exchange that do not prevent an
-   IKE_SA from being set up include at least the following:
-   NO_PROPOSAL_CHOSEN, TS_UNACCEPTABLE, SINGLE_PAIR_REQUIRED,
-   INTERNAL_ADDRESS_FAILURE, and FAILED_CP_REQUIRED.
-
-   (References: "Questions about internal address" thread, April, 2005.)
-
-4.3.  Diffie-Hellman for first CHILD_SA
-
-   Section 1.2 shows that IKE_AUTH messages do not contain KEi/KEr or
-   Ni/Nr payloads.  This implies that the SA payload in IKE_AUTH
-   exchange cannot contain Transform Type 4 (Diffie-Hellman Group) with
-   any other value than NONE.  Implementations should probably leave the
-   transform out entirely in this case.
-
-4.4.  Extended Sequence Numbers (ESN) transform
-
-   The description of the ESN transform in Section 3.3 has be proved
-   difficult to understand.  The ESN transform has the following
-   meaning::
-
-   o  A proposal containing one ESN transform with value 0 means "do not
-      use extended sequence numbers".
-
-   o  A proposal containing one ESN transform with value 1 means "use
-      extended sequence numbers".
-
-   o  A proposal containing two ESN transforms with values 0 and 1 means
-      "I support both normal and extended sequence numbers, you choose".
-      (Obviously this case is only allowed in requests; the response
-      will contain only one ESN transform.)
-
-   In most cases, the exchange initiator will include either the first
-   or third alternative in its SA payload.  The second alternative is
-   rarely useful for the initiator: it means that using normal sequence
-   numbers is not acceptable (so if the responder does not support ESNs,
-   the exchange will fail with NO_PROPOSAL_CHOSEN).
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 16]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   Note that including the ESN transform is mandatory when creating
-   ESP/AH SAs (it was optional in earlier drafts of the IKEv2
-   specification).
-
-   (References: "Technical change needed to IKEv2 before publication",
-   "STRAW POLL: Dealing with the ESN negotiation interop issue in IKEv2"
-   and "Results of straw poll regarding: IKEv2 interoperability issue"
-   threads, March-April 2005.)
-
-4.5.  Negotiation of ESP_TFC_PADDING_NOT_SUPPORTED
-
-   The description of ESP_TFC_PADDING_NOT_SUPPORTED notification in
-   Section 3.10.1 says that "This notification asserts that the sending
-   endpoint will NOT accept packets that contain Flow Confidentiality
-   (TFC) padding".
-
-   However, the text does not say in which messages this notification
-   should be included, or whether the scope of this notification is a
-   single CHILD_SA or all CHILD_SAs of the peer.
-
-   Our interpretation is that the scope is a single CHILD_SA, and thus
-   this notification is included in messages containing an SA payload
-   negotiating a CHILD_SA.  If neither endpoint accepts TFC padding,
-   this notification will be included in both the request proposing an
-   SA and the response accepting it.  If this notification is included
-   in only one of the messages, TFC padding can still be sent in one
-   direction.
-
-4.6.  Negotiation of NON_FIRST_FRAGMENTS_ALSO
-
-   NON_FIRST_FRAGMENTS_ALSO notification is described in Section 3.10.1
-   simply as "Used for fragmentation control.  See [RFC4301] for
-   explanation."
-
-   [RFC4301] says "Implementations that will transmit non-initial
-   fragments on a tunnel mode SA that makes use of non-trivial port (or
-   ICMP type/code or MH type) selectors MUST notify a peer via the IKE
-   NOTIFY NON_FIRST_FRAGMENTS_ALSO payload.  The peer MUST reject this
-   proposal if it will not accept non-initial fragments in this context.
-   If an implementation does not successfully negotiate transmission of
-   non-initial fragments for such an SA, it MUST NOT send such fragments
-   over the SA."
-
-   However, it is not clear exactly how the negotiation works.  Our
-   interpretation is that the negotiation works the same way as for
-   IPCOMP_SUPPORTED and USE_TRANSPORT_MODE: sending non-first fragments
-   is enabled only if NON_FIRST_FRAGMENTS_ALSO notification is included
-   in both the request proposing an SA and the response accepting it.
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 17]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   In other words, if the peer "rejects this proposal", it only omits
-   NON_FIRST_FRAGMENTS_ALSO notification from the response, but does not
-   reject the whole CHILD_SA creation.
-
-4.7.  Semantics of complex traffic selector payloads
-
-   As described in Section 3.13, the TSi/TSr payloads can include one or
-   more individual traffic selectors.
-
-   There is no requirement that TSi and TSr contain the same number of
-   individual traffic selectors.  Thus, they are interpreted as follows:
-   a packet matches a given TSi/TSr if it matches at least one of the
-   individual selectors in TSi, and at least one of the individual
-   selectors in TSr.
-
-   For instance, the following traffic selectors:
-
-        TSi = ((17, 100, 192.0.1.66-192.0.1.66),
-               (17, 200, 192.0.1.66-192.0.1.66))
-        TSr = ((17, 300, 0.0.0.0-255.255.255.255),
-               (17, 400, 0.0.0.0-255.255.255.255))
-
-   would match UDP packets from 192.0.1.66 to anywhere, with any of the
-   four combinations of source/destination ports (100,300), (100,400),
-   (200,300), and (200, 400).
-
-   This implies that some types of policies may require several CHILD_SA
-   pairs.  For instance, a policy matching only source/destination ports
-   (100,300) and (200,400), but not the other two combinations, cannot
-   be negotiated as a single CHILD_SA pair using IKEv2.
-
-   (References: "IKEv2 Traffic Selectors?" thread, Feb 2005.)
-
-4.8.  ICMP type/code in traffic selector payloads
-
-   The traffic selector types 7 and 8 can also refer to ICMP type and
-   code fields.  As described in Section 3.13.1, "For the ICMP protocol,
-   the two one-octet fields Type and Code are treated as a single 16-bit
-   integer (with Type in the most significant eight bits and Code in the
-   least significant eight bits) port number for the purposes of
-   filtering based on this field."
-
-   Since ICMP packets do not have separate source and destination port
-   fields, there is some room for confusion what exactly the four TS
-   payloads (two in the request, two in the response, each containing
-   both start and end port fields) should contain.
-
-   The answer to this question can be found from [RFC4301] Section
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 18]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   4.4.1.3.
-
-   To give a concrete example, if a host at 192.0.1.234 wants to create
-   a transport mode SA for sending "Destination Unreachable" packets
-   (ICMPv4 type 3) to 192.0.2.155, but is not willing to receive them
-   over this SA pair, the CREATE_CHILD_SA exchange would look like this:
-
-      Initiator                   Responder
-     -----------                 -----------
-      HDR, SK { N(USE_TRANSPORT_MODE), SA, Ni,
-                TSi(1, 0x0300-0x03FF, 192.0.1.234-192.0.1.234),
-                TSr(1, 65535-0, 192.0.2.155-192.0.2.155) } -->
-
-         <-- HDR, SK { N(USE_TRANSPORT_MODE), SA, Nr,
-                       TSi(1, 0x0300-0x03FF, 192.0.1.234-192.0.1.234),
-                       TSr(1, 65535-0, 192.0.2.155-192.0.2.155) }
-
-   Since IKEv2 always creates IPsec SAs in pairs, two SAs are also
-   created in this case, even though the second SA is never used for
-   data traffic.
-
-   An exchange creating an SA pair that can be used both for sending and
-   receiving "Destination Unreachable" places the same value in all the
-   port:
-
-      Initiator                   Responder
-     -----------                 -----------
-      HDR, SK { N(USE_TRANSPORT_MODE), SA, Ni,
-                TSi(1, 0x0300-0x03FF, 192.0.1.234-192.0.1.234),
-                TSr(1, 0x0300-0x03FF, 192.0.2.155-192.0.2.155) } -->
-
-         <-- HDR, SK { N(USE_TRANSPORT_MODE), SA, Nr,
-                       TSi(1, 0x0300-0x03FF, 192.0.1.234-192.0.1.234),
-                       TSr(1, 0x0300-0x03FF, 192.0.2.155-192.0.2.155) }
-
-   (References: "ICMP and MH TSs for IKEv2" thread, Sep 2005.)
-
-4.9.  Mobility header in traffic selector payloads
-
-   Traffic selectors can use IP Protocol ID 135 to match the IPv6
-   mobility header [MIPv6].  However, the IKEv2 specification does not
-   define how to represent the "MH Type" field in traffic selectors.
-
-   At some point, it was expected that this will be defined in a
-   separate document later.  However, [RFC4301] says that "For IKE, the
-   IPv6 mobility header message type (MH type) is placed in the most
-   significant eight bits of the 16 bit local "port" selector".  The
-   direction semantics of TSi/TSr port fields are the same as for ICMP,
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 19]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   and are described in the previous section.
-
-   (References: Tero Kivinen's mail "Issue #86: Add IPv6 mobility header
-   message type as selector", 2003-10-14.  "ICMP and MH TSs for IKEv2"
-   thread, Sep 2005.)
-
-4.10.  Narrowing the traffic selectors
-
-   Section 2.9 describes how traffic selectors are negotiated when
-   creating a CHILD_SA.  A more concise summary of the narrowing process
-   is presented below.
-
-   o  If the responder's policy does not allow any part of the traffic
-      covered by TSi/TSr, it responds with TS_UNACCEPTABLE.
-
-   o  If the responder's policy allows the entire set of traffic covered
-      by TSi/TSr, no narrowing is necessary, and the responder can
-      return the same TSi/TSr values.
-
-   o  Otherwise, narrowing is needed.  If the responder's policy allows
-      all traffic covered by TSi[1]/TSr[1] (the first traffic selectors
-      in TSi/TSr) but not entire TSi/TSr, the responder narrows to an
-      acceptable subset of TSi/TSr that includes TSi[1]/TSr[1].
-
-   o  If the responder's policy does not allow all traffic covered by
-      TSi[1]/TSr[1], but does allow some parts of TSi/TSr, it narrows to
-      an acceptable subset of TSi/TSr.
-
-   In the last two cases, there may be several subsets that are
-   acceptable (but their union is not); in this case, the responder
-   arbitrarily chooses one of them, and includes ADDITIONAL_TS_POSSIBLE
-   notification in the response.
-
-4.11.  SINGLE_PAIR_REQUIRED
-
-   The description of the SINGLE_PAIR_REQUIRED notify payload in
-   Sections 2.9 and 3.10.1 is not fully consistent.
-
-   We do not attempt to describe this payload in this document either,
-   since it is expected that most implementations will not have policies
-   that require separate SAs for each address pair.
-
-   Thus, if only some part (or parts) of the TSi/TSr proposed by the
-   initiator is (are) acceptable to the responder, most responders
-   should simply narrow TSi/TSr to an acceptable subset (as described in
-   the last two paragraphs of Section 2.9), rather than use
-   SINGLE_PAIR_REQUIRED.
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 20]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-4.12.  Traffic selectors violating own policy
-
-   Section 2.9 describes traffic selector negotiation in great detail.
-   One aspect of this negotiation that may need some clarification is
-   that when creating a new SA, the initiator should not propose traffic
-   selectors that violate its own policy.  If this rule is not followed,
-   valid traffic may be dropped.
-
-   This is best illustrated by an example.  Suppose that host A has a
-   policy whose effect is that traffic to 192.0.1.66 is sent via host B
-   encrypted using AES, and traffic to all other hosts in 192.0.1.0/24
-   is also sent via B, but must use 3DES.  Suppose also that host B
-   accepts any combination of AES and 3DES.
-
-   If host A now proposes an SA that uses 3DES, and includes TSr
-   containing (192.0.1.0-192.0.1.0.255), this will be accepted by host
-   B. Now, host B can also use this SA to send traffic from 192.0.1.66,
-   but those packets will be dropped by A since it requires the use of
-   AES for those traffic.  Even if host A creates a new SA only for
-   192.0.1.66 that uses AES, host B may freely continue to use the first
-   SA for the traffic.  In this situation, when proposing the SA, host A
-   should have followed its own policy, and included a TSr containing
-   ((192.0.1.0-192.0.1.65),(192.0.1.67-192.0.1.255)) instead.
-
-   In general, if (1) the initiator makes a proposal "for traffic X
-   (TSi/TSr), do SA", and (2) for some subset X' of X, the initiator
-   does not actually accept traffic X' with SA, and (3) the initiator
-   would be willing to accept traffic X' with some SA' (!=SA), valid
-   traffic can be unnecessarily dropped since the responder can apply
-   either SA or SA' to traffic X'.
-
-   (References: "Question about "narrowing" ..." thread, Feb 2005.
-   "IKEv2 needs a "policy usage mode"..." thread, Feb 2005.  "IKEv2
-   Traffic Selectors?" thread, Feb 2005.  "IKEv2 traffic selector
-   negotiation examples", 2004-08-08.)
-
-
-5.  Rekeying and deleting SAs
-
-5.1.  Rekeying SAs with the CREATE_CHILD_SA exchange
-
-   Continued from Section 4.1 of this document.
-
-   NEW-1.3.2 Rekeying IKE_SAs with the CREATE_CHILD_SA Exchange
-
-        The CREATE_CHILD_SA request for rekeying an IKE_SA is:
-
-            Initiator                                 Responder
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 21]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-           -----------                               -----------
-            HDR, SK {SA, Ni, [KEi]} -->
-
-        The initiator sends SA offer(s) in the SA payload, a nonce in
-        the Ni payload, and optionally a Diffie-Hellman value in the KEi
-        payload.
-
-        The CREATE_CHILD_SA response for rekeying an IKE_SA is:
-
-                                       <--    HDR, SK {SA, Nr, [KEr]}
-
-        The responder replies (using the same Message ID to respond)
-        with the accepted offer in an SA payload, a nonce in the Nr
-        payload, and, optionally, a Diffie-Hellman value in the KEr
-        payload.
-
-        The new IKE_SA has its message counters set to 0, regardless of
-        what they were in the earlier IKE_SA.  The window size starts at
-        1 for any new IKE_SA.  The new initiator and responder SPIs are
-        supplied in the SPI fields of the SA payloads.
-
-   NEW-1.3.3 Rekeying CHILD_SAs with the CREATE_CHILD_SA Exchange
-
-        The CREATE_CHILD_SA request for rekeying a CHILD_SA is:
-
-            Initiator                                 Responder
-           -----------                               -----------
-            HDR, SK {N(REKEY_SA), [N+], SA,
-                Ni, [KEi], TSi, TSr}  -->
-
-        The leading Notify payload of type REKEY_SA identifies the
-        CHILD_SA being rekeyed, and contains the SPI that the initiator
-        expects in the headers of inbound packets.  In addition, the
-        initiator sends SA offer(s) in the SA payload, a nonce in the Ni
-        payload, optionally a Diffie-Hellman value in the KEi payload,
-        and the proposed traffic selectors in the TSi and TSr payloads.
-        The request can also contain Notify payloads that specify
-        additional details for the CHILD_SA.
-
-        The CREATE_CHILD_SA response for rekeying a CHILD_SA is:
-
-                                       <--    HDR, SK {[N+], SA, Nr,
-                                                    [KEr], TSi, TSr}
-
-        The responder replies with the accepted offer in an SA payload,
-        and a Diffie-Hellman value in the KEr payload if KEi was
-        included in the request and the selected cryptographic suite
-        includes that group.
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 22]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-        The traffic selectors for traffic to be sent on that SA are
-        specified in the TS payloads in the response, which may be a
-        subset of what the initiator of the CHILD_SA proposed.
-
-5.2.  Rekeying the IKE_SA vs. reauthentication
-
-   Rekeying the IKE_SA and reauthentication are different concepts in
-   IKEv2.  Rekeying the IKE_SA establishes new keys for the IKE_SA and
-   resets the Message ID counters, but it does not authenticate the
-   parties again (no AUTH or EAP payloads are involved).
-
-   While rekeying the IKE_SA may be important in some environments,
-   reauthentication (the verification that the parties still have access
-   to the long-term credentials) is often more important.
-
-   IKEv2 does not have any special support for reauthentication.
-   Reauthentication is done by creating a new IKE_SA from scratch (using
-   IKE_SA_INIT/IKE_AUTH exchanges, without any REKEY_SA notify
-   payloads), creating new CHILD_SAs within the new IKE_SA (without
-   REKEY_SA notify payloads), and finally deleting the old IKE_SA (which
-   deletes the old CHILD_SAs as well).
-
-   This means that reauthentication also establishes new keys for the
-   IKE_SA and CHILD_SAs.  Therefore, while rekeying can be performed
-   more often than reauthentication, the situation where "authentication
-   lifetime" is shorter than "key lifetime" does not make sense.
-
-   While creation of a new IKE_SA can be initiated by either party
-   (initiator or responder in the original IKE_SA), the use of EAP
-   authentication and/or configuration payloads means in practice that
-   reauthentication has to be initiated by the same party as the
-   original IKE_SA.  IKEv2 does not currently allow the responder to
-   request reauthentication in this case; however, there is ongoing work
-   to add this functionality [ReAuth].
-
-   (References: "Reauthentication in IKEv2" thread, Oct/Nov 2004.)
-
-5.3.  SPIs when rekeying the IKE_SA
-
-   Section 2.18 says that "New initiator and responder SPIs are supplied
-   in the SPI fields".  This refers to the SPI fields in the Proposal
-   structures inside the Security Association (SA) payloads, not the SPI
-   fields in the IKE header.
-
-   (References: Tom Stiemerling's mail "Rekey IKE SA", 2005-01-24.
-   Geoffrey Huang's reply, 2005-01-24.)
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 23]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-5.4.  SPI when rekeying a CHILD_SA
-
-   Section 3.10.1 says that in REKEY_SA notifications, "The SPI field
-   identifies the SA being rekeyed."
-
-   Since CHILD_SAs always exist in pairs, there are two different SPIs.
-   The SPI placed in the REKEY_SA notification is the SPI the exchange
-   initiator would expect in inbound ESP or AH packets (just as in
-   Delete payloads).
-
-5.5.  Changing PRFs when rekeying the IKE_SA
-
-   When rekeying the IKE_SA, Section 2.18 says that "SKEYSEED for the
-   new IKE_SA is computed using SK_d from the existing IKE_SA as
-   follows:
-
-      SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)"
-
-   If the old and new IKE_SA selected a different PRF, it is not totally
-   clear which PRF should be used.
-
-   Since the rekeying exchange belongs to the old IKE_SA, it is the old
-   IKE_SA's PRF that is used.  This also follows the principle that the
-   same key (the old SK_d) should not be used with multiple
-   cryptographic algorithms.
-
-   Note that this may work poorly if the new IKE_SA's PRF has a fixed
-   key size, since the output of the PRF may not be of the correct size.
-   This supports our opinion earlier in the document that the use of
-   PRFs with a fixed key size is a bad idea.
-
-   (References: "Changing PRFs when rekeying the IKE_SA" thread, June
-   2005.)
-
-5.6.  Deleting vs. closing SAs
-
-   The IKEv2 specification talks about "closing" and "deleting" SAs, but
-   it is not always clear what exactly is meant.  However, other parts
-   of the specification make it clear that when local state related to a
-   CHILD_SA is removed, the SA must also be actively deleted with a
-   Delete payload.
-
-   In particular, Section 2.4 says that "If an IKE endpoint chooses to
-   delete CHILD_SAs, it MUST send Delete payloads to the other end
-   notifying it of the deletion".  Section 1.4 also explains that "ESP
-   and AH SAs always exist in pairs, with one SA in each direction.
-   When an SA is closed, both members of the pair MUST be closed."
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 24]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-5.7.  Deleting a CHILD_SA pair
-
-   Section 1.4 describes how to delete SA pairs using the Informational
-   exchange: "To delete an SA, an INFORMATIONAL exchange with one or
-   more delete payloads is sent listing the SPIs (as they would be
-   expected in the headers of inbound packets) of the SAs to be deleted.
-   The recipient MUST close the designated SAs."
-
-   The "one or more delete payloads" phrase has caused some confusion.
-   You never send delete payloads for the two sides of an SA in a single
-   message.  If you have many SAs to delete at the same time (such as
-   the nested example given in that paragraph), you include delete
-   payloads for in inbound half of each SA in your Informational
-   exchange.
-
-5.8.  Deleting an IKE_SA
-
-   Since IKE_SAs do not exist in pairs, it is not totally clear what the
-   response message should contain when the request deleted the IKE_SA.
-
-   Since there is no information that needs to be sent to the other side
-   (except that the request was received), an empty Informational
-   response seems like the most logical choice.
-
-   (References: "Question about delete IKE SA" thread, May 2005.)
-
-5.9.  Who is the original initiator of IKE_SA
-
-   In the IKEv2 document, "initiator" refers to the party who initiated
-   the exchange being described, and "original initiator" refers to the
-   party who initiated the whole IKE_SA.  However, there is some
-   potential for confusion because the IKE_SA can be rekeyed by either
-   party.
-
-   To clear up this confusion, we propose that "original initiator"
-   always refers to the party who initiated the exchange which resulted
-   in the current IKE_SA.  In other words, if the the "original
-   responder" starts rekeying the IKE_SA, that party becomes the
-   "original initiator" of the new IKE_SA.
-
-   (References: Paul Hoffman's mail "Original initiator in IKEv2", 2005-
-   04-21.)
-
-5.10.  (Section removed)
-
-   (This issue was corrected in RFC 4306.)
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 25]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-5.11.  Comparing nonces
-
-   Section 2.8 about rekeying says that "If redundant SAs are created
-   though such a collision, the SA created with the lowest of the four
-   nonces used in the two exchanges SHOULD be closed by the endpoint
-   that created it."
-
-   Here "lowest" uses an octet-by-octet (lexicographical) comparison
-   (instead of, for instance, comparing the nonces as large integers).
-   In other words, start by comparing the first octet; if they're equal,
-   move to the next octet, and so on.  If you reach the end of one
-   nonce, that nonce is the lower one.
-
-   (References: "IKEv2 rekeying question" thread, July 2005.)
-
-5.12.  Exchange collisions
-
-   Since IKEv2 exchanges can be initiated by both peers, it is possible
-   that two exchanges affecting the same SA partly overlap.  This can
-   lead to a situation where the SA state information is temporarily out
-   of sync, and a peer can receive a request it cannot process in a
-   normal fashion.  Some of these corner cases are discussed in the
-   specification, some are not.
-
-   Obviously, using a window size greater than one leads to infinitely
-   more complex situations, especially if requests are processed out of
-   order.  In this section, we concentrate on problems that can arise
-   even with window size 1.
-
-   (References: "IKEv2: invalid SPI in DELETE payload" thread, Dec 2005/
-   Jan 2006.  "Problem with exchanges collisions" thread, Dec 2005.)
-
-5.12.1.  Simultaneous CHILD_SA close
-
-   Probably the simplest case happens if both peers decide to close the
-   same CHILD_SA pair at the same time:
-
-      Host A                      Host B
-     --------                    --------
-      send req1: D(SPIa) -->
-                              <-- send req2: D(SPIb)
-                              --> recv req1
-                              <-- send resp1: ()
-      recv resp1
-      recv req2
-      send resp2: () -->
-                              --> recv resp2
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 26]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   This case is described in Section 1.4, and is handled by omitting the
-   Delete payloads from the response messages.
-
-5.12.2.  Simultaneous IKE_SA close
-
-   Both peers can also decide to close the IKE_SA at the same time.  The
-   desired end result is obvious; however, in certain cases the final
-   exchanges may not be fully completed.
-
-      Host A                      Host B
-     --------                    --------
-      send req1: D() -->
-                              <-- send req2: D()
-                              --> recv req1
-
-   At this point, host B should reply as usual (with empty Informational
-   response), close the IKE_SA, and stop retransmitting req2.  This is
-   because once host A receives resp1, it may not be able to reply any
-   longer.  The situation is symmetric, so host A should behave the same
-   way.
-
-      Host A                      Host B
-     --------                    --------
-                              <-- send resp1: ()
-      send resp2: ()
-
-   Even if neither resp1 nor resp2 ever arrives, the end result is still
-   correct: the IKE_SA is gone.  The same happens if host A never
-   receives req2.
-
-5.12.3.  Simultaneous CHILD_SA rekeying
-
-   Another case that is described in the specification is simultaneous
-   rekeying.  Section 2.8 says
-
-      "If the two ends have the same lifetime policies, it is possible
-      that both will initiate a rekeying at the same time (which will
-      result in redundant SAs).  To reduce the probability of this
-      happening, the timing of rekeying requests SHOULD be jittered
-      (delayed by a random amount of time after the need for rekeying is
-      noticed).
-
-      This form of rekeying may temporarily result in multiple similar
-      SAs between the same pairs of nodes.  When there are two SAs
-      eligible to receive packets, a node MUST accept incoming packets
-      through either SA.  If redundant SAs are created though such a
-      collision, the SA created with the lowest of the four nonces used
-      in the two exchanges SHOULD be closed by the endpoint that created
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 27]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-      it."
-
-   However, a better explanation on what impact this has on
-   implementations is needed.  Assume that hosts A and B have an
-   existing IPsec SA pair with SPIs (SPIa1,SPIb1), and both start
-   rekeying it at the same time:
-
-      Host A                      Host B
-     --------                    --------
-      send req1: N(REKEY_SA,SPIa1),
-         SA(..,SPIa2,..),Ni1,..  -->
-                              <-- send req2: N(REKEY_SA,SPIb1),
-                                     SA(..,SPIb2,..),Ni2,..
-      recv req2 <--
-
-   At this point, A knows there is a simultaneous rekeying going on.
-   However, it cannot yet know which of the exchanges will have the
-   lowest nonce, so it will just note the situation and respond as
-   usual.
-
-      send resp2: SA(..,SPIa3,..),Nr1,.. -->
-                              --> recv req1
-
-   Now B also knows that simultaneous rekeying is going on.  Similarly
-   as host A, it has to respond as usual.
-
-                              <-- send resp1: SA(..,SPIb3,..),Nr2,..
-       recv resp1 <--
-                              --> recv resp2
-
-   At this point, there are three CHILD_SA pairs between A and B (the
-   old one and two new ones).  A and B can now compare the nonces.
-   Suppose that the lowest nonce was Nr1 in message resp2; in this case,
-   B (the sender of req2) deletes the redundant new SA, and A (the node
-   that initiated the surviving rekeyed SA), deletes the old one.
-
-      send req3: D(SPIa1) -->
-                              <-- send req4: D(SPIb2)
-                              --> recv req3
-                              <-- send resp4: D(SPIb1)
-      recv req4 <--
-      send resp4: D(SPIa3) -->
-
-   The rekeying is now finished.
-
-   However, there is a second possible sequence of events that can
-   happen if some packets are lost in the network, resulting in
-   retransmissions.  The rekeying begins as usual, but A's first packet
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 28]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   (req1) is lost.
-
-      Host A                      Host B
-     --------                    --------
-      send req1: N(REKEY_SA,SPIa1),
-         SA(..,SPIa2,..),Ni1,..  -->  (lost)
-                              <-- send req2: N(REKEY_SA,SPIb1),
-                                     SA(..,SPIb2,..),Ni2,..
-      recv req2 <--
-      send resp2: SA(..,SPIa3,..),Nr1,.. -->
-                              --> recv resp2
-                              <-- send req3: D(SPIb1)
-      recv req3 <--
-      send resp3: D(SPIa1) -->
-                              --> recv resp3
-
-   From B's point of view, the rekeying is now completed, and since it
-   has not yet received A's req1, it does not even know that these was
-   simultaneous rekeying.  However, A will continue retransmitting the
-   message, and eventually it will reach B.
-
-      resend req1 -->
-                               --> recv req1
-
-   What should B do in this point?  To B, it looks like A is trying to
-   rekey an SA that no longer exists; thus failing the request with
-   something non-fatal such as NO_PROPOSAL_CHOSEN seems like a
-   reasonable approach.
-
-                               <-- send resp1: N(NO_PROPOSAL_CHOSEN)
-      recv resp1 <--
-
-   When A receives this error, it already knows there was simultaneous
-   rekeying, so it can ignore the error message.
-
-5.12.4.  Simultaneous IKE_SA rekeying
-
-   Probably the most complex case occurs when both peers try to rekey
-   the IKE_SA at the same time.  Basically, the text in Section 2.8
-   applies to this case as well; however, it is important to ensure that
-   the CHILD_SAs are inherited by the right IKE_SA.
-
-   The case where both endpoints notice the simultaneous rekeying works
-   the same way as with CHILD_SAs.  After the CREATE_CHILD_SA exchanges,
-   three IKE_SAs exist between A and B; the one containing the lowest
-   nonce inherits the CHILD_SAs.
-
-   However, there is a twist to the other case where one rekeying
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 29]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   finishes first:
-
-      Host A                      Host B
-     --------                    --------
-      send req1:
-         SA(..,SPIa1,..),Ni1,.. -->
-                              <-- send req2: SA(..,SPIb1,..),Ni2,..
-                              --> recv req1
-                              <-- send resp1: SA(..,SPIb2,..),Nr2,..
-      recv resp1 <--
-      send req3: D() -->
-                              --> recv req3
-
-   At this point, host B sees a request to close the IKE_SA.  There's
-   not much more to do than to reply as usual.  However, at this point
-   host B should stop retransmitting req2, since once host A receives
-   resp3, it will delete all the state associated with the old IKE_SA,
-   and will not be able to reply to it.
-
-                              <-- send resp3: ()
-
-5.12.5.  Closing and rekeying a CHILD_SA
-
-   A case similar to simultaneous rekeying can occur if one peers
-   decides to close an SA and the other peer tries to rekey it:
-
-      Host A                      Host B
-     --------                    --------
-      send req1: D(SPIa) -->
-                              <-- send req2: N(REKEY_SA,SPIb),SA,..
-                              --> recv req1
-
-   At this point, host B notices that host A is trying to close an SA
-   that host B is currently rekeying.  Replying as usual is probably the
-   best choice:
-
-                              <-- send resp1: D(SPIb)
-
-   Depending on in which order req2 and resp1 arrive, host A sees either
-   a request to rekey an SA that it is currently closing, or a request
-   to rekey an SA that does not exist.  In both cases,
-   NO_PROPOSAL_CHOSEN is probably fine.
-
-      recv req2
-      recv resp1
-      send resp2: N(NO_PROPOSAL_CHOSEN) -->
-                              --> recv resp2
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 30]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-5.12.6.  Closing a new CHILD_SA
-
-   Yet another case occurs when host A creates a CHILD_SA pair, but soon
-   thereafter host B decides to delete it (possible because its policy
-   changed):
-
-      Host A                      Host B
-     --------                    --------
-      send req1: [N(REKEY_SA,SPIa1)],
-         SA(..,SPIa2,..),.. -->
-                              --> recv req1
-                       (lost) <-- send resp1: SA(..,SPIb2,..),..
-
-                              <-- send req2: D(SPIb2)
-      recv req2
-
-   At this point, host A has not yet received message resp1 (and is
-   retransmitting message req1), so it does not recognize SPIb in
-   message req2.  What should host A do?
-
-   One option would be to reply with an empty Informational response.
-   However, this same reply would also be sent if host A has received
-   resp1, but has already sent a new request to delete the SA that was
-   just created.  This would lead to a situation where the peers are no
-   longer in sync about which SAs exist between them.  However, host B
-   would eventually notice that the other half of the CHILD_SA pair has
-   not been deleted.  Section 1.4 describes this case and notes that "a
-   node SHOULD regard half-closed connections as anomalous and audit
-   their existence should they persist", and continues that "if
-   connection state becomes sufficiently messed up, a node MAY close the
-   IKE_SA".
-
-   Another solution that has been proposed is to reply with an
-   INVALID_SPI notification which contains SPIb.  This would explicitly
-   tell host B that the SA was not deleted, so host B could try deleting
-   it again later.  However, this usage is not part of the IKEv2
-   specification, and would not be in line with normal use of the
-   INVALID_SPI notification where the data field contains the SPI the
-   recipient of the notification would put in outbound packets.
-
-   Yet another solution would be to ignore req2 at this time, and wait
-   until we have received resp1.  However, this alternative has not been
-   fully analyzed at this time; in general, ignoring valid requests is
-   always a bit dangerous, because both endpoints could do it, leading
-   to a deadlock.
-
-   Currently, this document recommends the first alternative.
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 31]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-5.12.7.  Rekeying a new CHILD_SA
-
-   Yet another case occurs when a CHILD_SA is rekeyed soon after it has
-   been created:
-
-      Host A                      Host B
-     --------                    --------
-      send req1: [N(REKEY_SA,SPIa1)],
-         SA(..,SPIa2,..),..  -->
-                       (lost) <-- send resp1: SA(..,SPIb2,..),..
-
-                              <-- send req2: N(REKEY_SA,SPIb2),
-                                     SA(..,SPIb3,..),..
-      recv req2 <--
-
-   To host A, this looks like a request to rekey an SA that does not
-   exist.  Like in the simultaneous rekeying case, replying with
-   NO_PROPOSAL_CHOSEN is probably reasonable:
-
-      send resp2: N(NO_PROPOSAL_CHOSEN) -->
-      recv resp1
-
-5.12.8.  Collisions with IKE_SA rekeying
-
-   Another set of cases occur when one peer starts rekeying the IKE_SA
-   at the same time the other peer starts creating, rekeying, or closing
-   a CHILD_SA.  Suppose that host B starts creating a CHILD_SA, and soon
-   after, host A starts rekeying the IKE_SA:
-
-      Host A                      Host B
-     --------                    --------
-                              <-- send req1: SA,Ni1,TSi,TSr
-      send req2: SA,Ni2,.. -->
-                              --> recv req2
-
-   What should host B do at this point?  Replying as usual would seem
-   like a reasonable choice:
-
-                              <-- send resp2: SA,Ni2,..
-      recv resp2 <--
-      send req3: D() -->
-                              --> recv req3
-
-   Now, a problem arises: If host B now replies normally with an empty
-   Informational response, this will cause host A to delete state
-   associated with the IKE_SA.  This means host B should stop
-   retransmitting req1.  However, host B cannot know whether or not host
-   A has received req1.  If host A did receive it, it will move the
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 32]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   CHILD_SA to the new IKE_SA as usual, and the state information will
-   then be out of sync.
-
-   It seems this situation is tricky to handle correctly.  Our proposal
-   is as follows: if a host receives a request to rekey the IKE_SA when
-   it has CHILD_SAs in "half-open" state (currently being created or
-   rekeyed), it should reply with NO_PROPOSAL_CHOSEN.  If a host
-   receives a request to create or rekey a CHILD_SA after it has started
-   rekeying the IKE_SA, it should reply with NO_ADDITIONAL_SAS.
-
-   The case where CHILD_SAs are being closed is even worse.  Our
-   recommendation is that if a host receives a request to rekey the
-   IKE_SA when it has CHILD_SAs in "half-closed" state (currently being
-   closed), it should reply with NO_PROPOSAL_CHOSEN.  And if a host
-   receives a request to close a CHILD_SA after it has started rekeying
-   the IKE_SA, it should reply with an empty Informational response.
-   This ensures that at least the other peer will eventually notice that
-   the CHILD_SA is still in "half-closed" state, and will start a new
-   IKE_SA from scratch.
-
-5.12.9.  Closing and rekeying the IKE_SA
-
-   The final case considered in this section occurs if one peer decides
-   to close the IKE_SA while the other peer tries to rekey it.
-
-      Host A                      Host B
-     --------                    --------
-      send req1: SA(..,SPIa1,..),Ni1 -->
-                              <-- send req2: D()
-                              --> recv req1
-      recv req2 <--
-
-   At this point, host B should probably reply with NO_PROPOSAL_CHOSEN,
-   and host A should reply as usual, close the IKE_SA, and stop
-   retransmitting req1.
-
-                              <-- send resp1: N(NO_PROPOSAL_CHOSEN)
-      send resp2: ()
-
-   If host A wants to continue communication with B, it can now start a
-   new IKE_SA.
-
-5.12.10.  Summary
-
-   If a host receives a request to rekey:
-
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 33]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   o  a CHILD_SA pair that the host is currently trying to close: reply
-      with NO_PROPOSAL_CHOSEN.
-
-   o  a CHILD_SA pair that the host is currently rekeying: reply as
-      usual, but prepare to close redundant SAs later based on the
-      nonces.
-
-   o  a CHILD_SA pair that does not exist: reply with
-      NO_PROPOSAL_CHOSEN.
-
-   o  the IKE_SA, and the host is currently rekeying the IKE_SA: reply
-      as usual, but prepare to close redundant SAs and move inherited
-      CHILD_SAs later based on the nonces.
-
-   o  the IKE_SA, and the host is currently creating, rekeying, or
-      closing a CHILD_SA: reply with NO_PROPOSAL_CHOSEN.
-
-   o  the IKE_SA, and the host is currently trying to close the IKE_SA:
-      reply with NO_PROPOSAL_CHOSEN.
-
-   If a host receives a request to close:
-
-   o  a CHILD_SA pair that the host is currently trying to close: reply
-      without Delete payloads.
-
-   o  a CHILD_SA pair that the host is currently rekeying: reply as
-      usual, with Delete payload.
-
-   o  a CHILD_SA pair that does not exist: reply without Delete
-      payloads.
-
-   o  the IKE_SA, and the host is currently rekeying the IKE_SA: reply
-      as usual, and forget about our own rekeying request.
-
-   o  the IKE_SA, and the host is currently trying to close the IKE_SA:
-      reply as usual, and forget about our own close request.
-
-   If a host receives a request to create or rekey a CHILD_SA when it is
-   currently rekeying the IKE_SA: reply with NO_ADDITIONAL_SAS.
-
-   If a host receives a request to delete a CHILD_SA when it is
-   currently rekeying the IKE_SA: reply without Delete payloads.
-
-5.13.  Diffie-Hellman and rekeying the IKE_SA
-
-   There has been some confusion whether doing a new Diffie-Hellman
-   exchange is mandatory when the IKE_SA is rekeyed.
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 34]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   It seems that this case is allowed by the IKEv2 specification.
-   Section 2.18 shows the Diffie-Hellman term (g^ir) in brackets, and
-   the change history appendix in the draft mentioned this as one change
-   between draft versions -00 and -01.  Section 3.3.3 does not
-   contradict this when it says that including the D-H transform is
-   mandatory: although including the transform is mandatory, it can
-   contain the value "NONE".
-
-   However, having the option to skip the Diffie-Hellman exchange when
-   rekeying the IKE_SA does not add useful functionality to the
-   protocol.  The main purpose of rekeying the IKE_SA is to ensure that
-   the compromise of old keying material does not provide information
-   about the current keys, or vice versa.  This requires performing the
-   Diffie-Hellman exchange when rekeying.  Furthermore, it is likely
-   that this option would have been removed from the protocol as
-   unnecessary complexity had it been discussed earlier.
-
-   Given this, we recommend that implementations should have a hard-
-   coded policy that requires performing a new Diffie-Hellman exchange
-   when rekeying the IKE_SA.  In other words, the initiator should not
-   propose the value "NONE" for the D-H transform, and the responder
-   should not accept such a proposal.  This policy also implies that a
-   succesful exchange rekeying the IKE_SA always includes the KEi/KEr
-   payloads.
-
-   (References: "Rekeying IKE_SAs with the CREATE_CHILD_SA exhange"
-   thread, Oct 2005.  "Comments of
-   draft-eronen-ipsec-ikev2-clarifications-02.txt" thread, Apr 2005.)
-
-
-6.  Configuration payloads
-
-6.1.  Assigning IP addresses
-
-   Section 2.9 talks about traffic selector negotiation and mentions
-   that "In support of the scenario described in section 1.1.3, an
-   initiator may request that the responder assign an IP address and
-   tell the initiator what it is."
-
-   This sentence is correct, but its placement is slightly confusing.
-   IKEv2 does allow the initiator to request assignment of an IP address
-   from the responder, but this is done using configuration payloads,
-   not traffic selector payloads.  An address in a TSi payload in a
-   response does not mean that the responder has assigned that address
-   to the initiator; it only means that if packets matching these
-   traffic selectors are sent by the initiator, IPsec processing can be
-   performed as agreed for this SA.  The TSi payload itself does not
-   give the initiator permission to configure the initiator's TCP/IP
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 35]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   stack with the address and use it as its source address.
-
-   In other words, IKEv2 does not have two different mechanisms for
-   assigning addresses, but only one: configuration payloads.  In the
-   scenario described in Section 1.1.3, both configuration and traffic
-   selector payloads are usually included in the same message, and often
-   contain the same information in the response message (see Section 6.4
-   of this document for some examples).  However, their semantics are
-   still different.
-
-6.2.  (Section removed)
-
-   (This issue was corrected in RFC 4306.)
-
-6.3.  Requesting any INTERNAL_IP4/IP6_ADDRESS
-
-   When describing the INTERNAL_IP4/IP6_ADDRESS attributes, Section
-   3.15.1 says that "In a request message, the address specified is a
-   requested address (or zero if no specific address is requested)".
-   The question here is that does "zero" mean an address "0.0.0.0" or a
-   zero length string?
-
-   Earlier, the same section also says that "If an attribute in the
-   CFG_REQUEST Configuration Payload is not zero-length, it is taken as
-   a suggestion for that attribute".  Also, the table of configuration
-   attributes shows that the length of INTERNAL_IP4_ADDRESS is either "0
-   or 4 octets", and likewise, INTERNAL_IP6_ADDRESS is either "0 or 17
-   octets".
-
-   Thus, if the client does not request a specific address, it includes
-   a zero-length INTERNAL_IP4/IP6_ADDRESS attribute, not an attribute
-   containing an all-zeroes address.  The example in 2.19 is thus
-   incorrect, since it shows the attribute as
-   "INTERNAL_ADDRESS(0.0.0.0)".
-
-   However, since the value is only a suggestion, implementations are
-   recommended to ignore suggestions they do not accept; or in other
-   words, treat the same way a zero-length INTERNAL_IP4_ADDRESS,
-   "0.0.0.0", and any other addresses the implementation does not
-   recognize as a reasonable suggestion.
-
-6.4.  INTERNAL_IP4_SUBNET/INTERNAL_IP6_SUBNET
-
-   Section 3.15.1 describes the INTERNAL_IP4_SUBNET as "The protected
-   sub-networks that this edge-device protects.  This attribute is made
-   up of two fields: the first is an IP address and the second is a
-   netmask.  Multiple sub-networks MAY be requested.  The responder MAY
-   respond with zero or more sub-network attributes."
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 36]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   INTERNAL_IP6_SUBNET is defined in a similar manner.
-
-   This raises two questions: first, since this information is usually
-   included in the TSr payload, what functionality does this attribute
-   add?  And second, what does this attribute mean in CFG_REQUESTs?
-
-   For the first question, there seem to be two sensible
-   interpretations.  Clearly TSr (in IKE_AUTH or CREATE_CHILD_SA
-   response) indicates which subnets are accessible through the SA that
-   was just created.
-
-   The first interpretation of the INTERNAL_IP4/6_SUBNET attributes is
-   that they indicate additional subnets that can be reached through
-   this gateway, but need a separate SA.  According to this
-   interpretation, the INTERNAL_IP4/6_SUBNET attributes are useful
-   mainly when they contain addresses not included in TSr.
-
-   The second interpretation is that the INTERNAL_IP4/6_SUBNET
-   attributes express the gateway's policy about what traffic should be
-   sent through the gateway.  The client can choose whether other
-   traffic (covered by TSr, but not in INTERNAL_IP4/6_SUBNET) is sent
-   through the gateway or directly the destination.  According to this
-   interpretation, the attributes are useful mainly when TSr contains
-   addresses not included in the INTERNAL_IP4/6_SUBNET attributes.
-
-   It turns out that these two interpretations are not incompatible, but
-   rather two sides of the same principle: traffic to the addresses
-   listed in the INTERNAL_IP4/6_SUBNET attributes should be sent via
-   this gateway.  If there are no existing IPsec SAs whose traffic
-   selectors cover the address in question, new SAs have to be created.
-
-   A couple of examples are given below.  For instance, if there are two
-   subnets, 192.0.1.0/26 and 192.0.2.0/24, and the client's request
-   contains the following:
-
-        CP(CFG_REQUEST) =
-          INTERNAL_IP4_ADDRESS()
-        TSi = (0, 0-65535, 0.0.0.0-255.255.255.255)
-        TSr = (0, 0-65535, 0.0.0.0-255.255.255.255)
-
-   Then a valid response could be the following (in which TSr and
-   INTERNAL_IP4_SUBNET contain the same information):
-
-
-
-
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 37]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-        CP(CFG_REPLY) =
-          INTERNAL_IP4_ADDRESS(192.0.1.234)
-          INTERNAL_IP4_SUBNET(192.0.1.0/255.255.255.192)
-          INTERNAL_IP4_SUBNET(192.0.2.0/255.255.255.0)
-        TSi = (0, 0-65535, 192.0.1.234-192.0.1.234)
-        TSr = ((0, 0-65535, 192.0.1.0-192.0.1.63),
-               (0, 0-65535, 192.0.2.0-192.0.2.255))
-
-   In these cases, the INTERNAL_IP4_SUBNET does not really carry any
-   useful information.  Another possible reply would have been this:
-
-        CP(CFG_REPLY) =
-          INTERNAL_IP4_ADDRESS(192.0.1.234)
-          INTERNAL_IP4_SUBNET(192.0.1.0/255.255.255.192)
-          INTERNAL_IP4_SUBNET(192.0.2.0/255.255.255.0)
-        TSi = (0, 0-65535, 192.0.1.234-192.0.1.234)
-        TSr = (0, 0-65535, 0.0.0.0-255.255.255.255)
-
-   This would mean that the client can send all its traffic through the
-   gateway, but the gateway does not mind if the client sends traffic
-   not included by INTERNAL_IP4_SUBNET directly to the destination
-   (without going through the gateway).
-
-   A different situation arises if the gateway has a policy that
-   requires the traffic for the two subnets to be carried in separate
-   SAs.  Then a response like this would indicate to the client that if
-   it wants access to the second subnet, it needs to create a separate
-   SA:
-
-        CP(CFG_REPLY) =
-          INTERNAL_IP4_ADDRESS(192.0.1.234)
-          INTERNAL_IP4_SUBNET(192.0.1.0/255.255.255.192)
-          INTERNAL_IP4_SUBNET(192.0.2.0/255.255.255.0)
-        TSi = (0, 0-65535, 192.0.1.234-192.0.1.234)
-        TSr = (0, 0-65535, 192.0.1.0-192.0.1.63)
-
-   INTERNAL_IP4_SUBNET can also be useful if the client's TSr included
-   only part of the address space.  For instance, if the client requests
-   the following:
-
-        CP(CFG_REQUEST) =
-          INTERNAL_IP4_ADDRESS()
-        TSi = (0, 0-65535, 0.0.0.0-255.255.255.255)
-        TSr = (0, 0-65535, 192.0.2.155-192.0.2.155)
-
-   Then the gateway's reply could be this:
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 38]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-        CP(CFG_REPLY) =
-          INTERNAL_IP4_ADDRESS(192.0.1.234)
-          INTERNAL_IP4_SUBNET(192.0.1.0/255.255.255.192)
-          INTERNAL_IP4_SUBNET(192.0.2.0/255.255.255.0)
-        TSi = (0, 0-65535, 192.0.1.234-192.0.1.234)
-        TSr = (0, 0-65535, 192.0.2.155-192.0.2.155)
-
-   It is less clear what the attributes mean in CFG_REQUESTs, and
-   whether other lengths than zero make sense in this situation (but for
-   INTERNAL_IP6_SUBNET, zero length is not allowed at all!).  Currently
-   this document recommends that implementations should not include
-   INTERNAL_IP4_SUBNET or INTERNAL_IP6_SUBNET attributes in
-   CFG_REQUESTs.
-
-   For the IPv4 case, this document recommends using only netmasks
-   consisting of some amount of "1" bits followed by "0" bits; for
-   instance, "255.0.255.0" would not be a valid netmask for
-   INTERNAL_IP4_SUBNET.
-
-   It is also worthwhile to note that the contents of the INTERNAL_IP4/
-   6_SUBNET attributes do not imply link boundaries.  For instance, a
-   gateway providing access to a large company intranet using addresses
-   from the 10.0.0.0/8 block can send a single INTERNAL_IP4_SUBNET
-   attribute (10.0.0.0/255.0.0.0) even if the intranet has hundreds of
-   routers and separate links.
-
-   (References: Tero Kivinen's mail "Intent of couple of attributes in
-   Configuration Payload in IKEv2?", 2004-11-19.  Srinivasa Rao
-   Addepalli's mail "INTERNAL_IP4_SUBNET and INTERNAL_IP6_SUBNET in
-   IKEv2", 2004-09-10.  Yoav Nir's mail "Re: New I-D: IKEv2
-   Clarifications and Implementation Guidelines", 2005-02-07.
-   "Clarifications open issue: INTERNAL_IP4_SUBNET/NETMASK" thread,
-   April 2005.)
-
-6.5.  INTERNAL_IP4_NETMASK
-
-   Section 3.15.1 defines the INTERNAL_IP4_NETMASK attribute, and says
-   that "The internal network's netmask.  Only one netmask is allowed in
-   the request and reply messages (e.g., 255.255.255.0) and it MUST be
-   used only with an INTERNAL_IP4_ADDRESS attribute".
-
-   However, it is not clear what exactly this attribute means, as the
-   concept of "netmask" is not very well defined for point-to-point
-   links (unlike multi-access links, where it means "you can reach hosts
-   inside this netmask directly using layer 2, instead of sending
-   packets via a router").  Even if the operating system's TCP/IP stack
-   requires a netmask to be configured, for point-to-point links it
-   could be just set to 255.255.255.255.  So, why is this information
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 39]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   sent in IKEv2?
-
-   One possible interpretation would be that the host is given a whole
-   block of IP addresses instead of a single address.  This is also what
-   Framed-IP-Netmask does in [RADIUS], the IPCP "subnet mask" extension
-   does in PPP [IPCPSubnet], and the prefix length in the IPv6 Framed-
-   IPv6-Prefix attribute does in [RADIUS6].  However, nothing in the
-   specification supports this interpretation, and discussions on the
-   IPsec WG mailing list have confirmed it was not intended.  Section
-   3.15.1 also says that multiple addresses are assigned using multiple
-   INTERNAL_IP4/6_ADDRESS attributes.
-
-   Currently, this document's interpretation is the following:
-   INTERNAL_IP4_NETMASK in a CFG_REPLY means roughly the same thing as
-   INTERNAL_IP4_SUBNET containing the same information ("send traffic to
-   these addresses through me"), but also implies a link boundary.  For
-   instance, the client could use its own address and the netmask to
-   calculate the broadcast address of the link.  (Whether the gateway
-   will actually deliver broadcast packets to other VPN clients and/or
-   other nodes connected to this link is another matter.)
-
-   An empty INTERNAL_IP4_NETMASK attribute can be included in a
-   CFG_REQUEST to request this information (although the gateway can
-   send the information even when not requested).  However, it seems
-   that non-empty values for this attribute do not make sense in
-   CFG_REQUESTs.
-
-   Fortunately, Section 4 clearly says that a minimal implementation
-   does not need to include or understand the INTERNAL_IP4_NETMASK
-   attribute, and thus this document recommends that implementations
-   should not use the INTERNAL_IP4_NETMASK attribute or assume that the
-   other peer supports it.
-
-   (References: Charlie Kaufman's mail "RE: Proposed Last Call based
-   revisions to IKEv2", 2004-05-27.  Email discussion with Tero Kivinen,
-   Jan 2005.  Yoav Nir's mail "Re: New I-D: IKEv2 Clarifications and
-   Implementation Guidelines", 2005-02-07.  "Clarifications open issue:
-   INTERNAL_IP4_SUBNET/NETMASK" thread, April 2005.)
-
-6.6.  Configuration payloads for IPv6
-
-   IKEv2 also defines configuration payloads for IPv6.  However, they
-   are based on the corresponding IPv4 payloads, and do not fully follow
-   the "normal IPv6 way of doing things".
-
-
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 40]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   A client can be assigned an IPv6 address using the
-   INTERNAL_IP6_ADDRESS configuration payload.  A minimal exchange could
-   look like this:
-
-        CP(CFG_REQUEST) =
-          INTERNAL_IP6_ADDRESS()
-          INTERNAL_IP6_DNS()
-        TSi = (0, 0-65535, :: - FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF)
-        TSr = (0, 0-65535, :: - FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF)
-
-        CP(CFG_REPLY) =
-          INTERNAL_IP6_ADDRESS(2001:DB8:0:1:2:3:4:5/64)
-          INTERNAL_IP6_DNS(2001:DB8:99:88:77:66:55:44)
-        TSi = (0, 0-65535, 2001:DB8:0:1:2:3:4:5 - 2001:DB8:0:1:2:3:4:5)
-        TSr = (0, 0-65535, :: - FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF)
-
-   In particular, IPv6 stateless autoconfiguration or router
-   advertisement messages are not used; neither is neighbor discovery.
-
-   The client can also send a non-empty INTERNAL_IP6_ADDRESS attribute
-   in the CFG_REQUEST to request a specific address or interface
-   identifier.  The gateway first checks if the specified address is
-   acceptable, and if it is, returns that one.  If the address was not
-   acceptable, the gateway will attempt to use the interface identifier
-   with some other prefix; if even that fails, the gateway will select
-   another interface identifier.
-
-   The INTERNAL_IP6_ADDRESS attribute also contains a prefix length
-   field.  When used in a CFG_REPLY, this corresponds to the
-   INTERNAL_IP4_NETMASK attribute in the IPv4 case (and indeed, was
-   called INTERNAL_IP6_NETMASK in earlier versions of the IKEv2 draft).
-   See the previous section for more details.
-
-   While this approach to configuring IPv6 addresses is reasonably
-   simple, it has some limitations: IPsec tunnels configured using IKEv2
-   are not fully-featured "interfaces" in the IPv6 addressing
-   architecture [IPv6Addr] sense.  In particular, they do not
-   necessarily have link-local addresses, and this may complicate the
-   use of protocols that assume them, such as [MLDv2].  (Whether they
-   are called "interfaces" in some particular operating system is a
-   different issue.)
-
-   (References: "VPN remote host configuration IPv6 ?" thread, May 2004.
-   "Clarifications open issue: INTERNAL_IP4_SUBNET/NETMASK" thread,
-   April 2005.)
-
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 41]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-6.7.  INTERNAL_IP6_NBNS
-
-   Section 3.15.1 defines the INTERNAL_IP6_NBNS attribute for sending
-   the IPv6 address of NetBIOS name servers.
-
-   However, NetBIOS is not defined for IPv6, and probably never will be.
-   Thus, this attribute most likely does not make much sense.
-
-   (Pointed out by Bernard Aboba in the IP Configuration Security (ICOS)
-   BoF at IETF62.)
-
-6.8.  INTERNAL_ADDRESS_EXPIRY
-
-   Section 3.15.1 defines the INTERNAL_ADDRESS_EXPIRY attribute as
-   "Specifies the number of seconds that the host can use the internal
-   IP address.  The host MUST renew the IP address before this expiry
-   time.  Only one of these attributes MAY be present in the reply."
-
-   Expiry times and explicit renewals are primarily useful in
-   environments like DHCP, where the server cannot reliably know when
-   the client has gone away.  However, in IKEv2 this is known, and the
-   gateway can simply free the address when the IKE_SA is deleted.
-
-   Also, Section 4 says that supporting renewals is not mandatory.
-   Given that this functionality is usually not needed, we recommend
-   that gateways should not send the INTERNAL_ADDRESS_EXPIRY attribute.
-   (And since this attribute does not seem to make much sense for
-   CFG_REQUESTs, clients should not send it either.)
-
-   Note that according to Section 4, clients are required to understand
-   INTERNAL_ADDRESS_EXPIRY if the receive it.  A minimum implementation
-   would use the value to limit the lifetime of the IKE_SA.
-
-   (References: Tero Kivinen's mail "Comments of
-   draft-eronen-ipsec-ikev2-clarifications-02.txt", 2005-04-05.
-   "Questions about internal address" thread, April 2005.)
-
-6.9.  Address assignment failures
-
-   If the responder encounters an error while attempting to assign an IP
-   address to the initiator, it responds with an
-   INTERNAL_ADDRESS_FAILURE notification as described in Section 3.10.1.
-   However, there are some more complex error cases.
-
-   First, if the responder does not support configuration payloads at
-   all, it can simply ignore all configuration payloads.  This type of
-   implementation never sends INTERNAL_ADDRESS_FAILURE notifications.
-   If the initiator requires the assignment of an IP address, it will
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 42]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   treat a response without CFG_REPLY as an error.
-
-   A second case is where the responder does support configuration
-   payloads, but only for particular type of addresses (IPv4 or IPv6).
-   Section 4 says that "A minimal IPv4 responder implementation will
-   ignore the contents of the CP payload except to determine that it
-   includes an INTERNAL_IP4_ADDRESS attribute".  If, for instance, the
-   initiator includes both INTERNAL_IP4_ADDRESS and INTERNAL_IP6_ADDRESS
-   in the CFG_REQUEST, an IPv4-only responder can thus simply ignore the
-   IPv6 part and process the IPv4 request as usual.
-
-   A third case is where the initiator requests multiple addresses of a
-   type that the responder supports: what should happen if some (but not
-   all) of the requests fail?  It seems that an optimistic approach
-   would be the best one here: if the responder is able to assign at
-   least one address, it replies with those; it sends
-   INTERNAL_ADDRESS_FAILURE only if no addresses can be assigned.
-
-   (References: "ikev2 and internal_ivpn_address" thread, June 2005.)
-
-
-7.  Miscellaneous issues
-
-7.1.  Matching ID_IPV4_ADDR and ID_IPV6_ADDR
-
-   When using the ID_IPV4_ADDR/ID_IPV6_ADDR identity types in IDi/IDr
-   payloads, IKEv2 does not require this address to match the address in
-   the IP header (of IKEv2 packets), or anything in the TSi/TSr
-   payloads.  The contents of IDi/IDr is used purely to fetch the policy
-   and authentication data related to the other party.
-
-   (References: "Identities types IP address,FQDN/user FQDN and DN and
-   its usage in preshared key authentication" thread, Jan 2005.)
-
-7.2.  Relationship of IKEv2 to RFC4301
-
-   The IKEv2 specification refers to [RFC4301], but it never makes clear
-   what the exact relationship is.
-
-   However, there are some requirements in the specification that make
-   it clear that IKEv2 requires [RFC4301].  In other words, an
-   implementation that does IPsec processing strictly according to
-   [RFC2401] cannot be compliant with the IKEv2 specification.
-
-   One such example can be found in Section 2.24: "Specifically, tunnel
-   encapsulators and decapsulators for all tunnel-mode SAs created by
-   IKEv2 [...]  MUST implement the tunnel encapsulation and
-   decapsulation processing specified in [RFC4301] to prevent discarding
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 43]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   of ECN congestion indications."
-
-   Nevertheless, the changes required to existing [RFC2401]
-   implementations are not very large, especially since supporting many
-   of the new features (such as Extended Sequence Numbers) is optional.
-
-7.3.  Reducing the window size
-
-   In IKEv2, the window size is assumed to be a (possibly configurable)
-   property of a particular implementation, and is not related to
-   congestion control (unlike the window size in TCP, for instance).
-
-   In particular, it is not defined what the responder should do when it
-   receives a SET_WINDOW_SIZE notification containing a smaller value
-   than is currently in effect.  Thus, there is currently no way to
-   reduce the window size of an existing IKE_SA.  However, when rekeying
-   an IKE_SA, the new IKE_SA starts with window size 1 until it is
-   explicitly increased by sending a new SET_WINDOW_SIZE notification.
-
-   (References: Tero Kivinen's mail "Comments of
-   draft-eronen-ipsec-ikev2-clarifications-02.txt", 2005-04-05.)
-
-7.4.  Minimum size of nonces
-
-   Section 2.10 says that "Nonces used in IKEv2 MUST be randomly chosen,
-   MUST be at least 128 bits in size, and MUST be at least half the key
-   size of the negotiated prf."
-
-   However, the initiator chooses the nonce before the outcome of the
-   negotiation is known.  In this case, the nonce has to be long enough
-   for all the PRFs being proposed.
-
-7.5.  Initial zero octets on port 4500
-
-   It is not clear whether a peer sending an IKE_SA_INIT request on port
-   4500 should include the initial four zero octets.  Section 2.23 talks
-   about how to upgrade to tunneling over port 4500 after message 2, but
-   it does not say what to do if message 1 is sent on port 4500.
-
-
-
-
-
-
-
-
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 44]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-       IKE MUST listen on port 4500 as well as port 500.
-
-       [...]
-
-       The IKE initiator MUST check these payloads if present and if
-       they do not match the addresses in the outer packet MUST tunnel
-       all future IKE and ESP packets associated with this IKE_SA over
-       UDP port 4500.
-
-       To tunnel IKE packets over UDP port 4500, the IKE header has four
-       octets of zero prepended and the result immediately follows the
-       UDP header. [...]
-
-   The very beginning of Section 2 says "... though IKE messages may
-   also be received on UDP port 4500 with a slightly different format
-   (see section 2.23)."
-
-   That "slightly different format" is only described in discussing what
-   to do after changing to port 4500.  However, [RFC3948] shows clearly
-   the format has the initial zeros even for initiators on port 4500.
-   Furthermore, without the initial zeros, the processing engine cannot
-   determine whether the packet is an IKE packet or an ESP packet.
-
-   Thus, all packets sent on port 4500 need the four zero prefix;
-   otherwise, the receiver won't know how to handle them.
-
-7.6.  Destination port for NAT traversal
-
-   Section 2.23 says that "an IPsec endpoint that discovers a NAT
-   between it and its correspondent MUST send all subsequent traffic to
-   and from port 4500".
-
-   This sentence is misleading.  The peer "outside" the NAT uses source
-   port 4500 for the traffic it sends, but the destination port is, of
-   course, taken from packets sent by the peer behind the NAT.  This
-   port number is usually dynamically allocated by the NAT.
-
-7.7.  SPI values for messages outside of an IKE_SA
-
-   The IKEv2 specification is not quite clear what SPI values should be
-   used in the IKE header for the small number of notifications that are
-   allowed to be sent outside of an IKE_SA.  Note that such
-   notifications are explicitly *not* Informational exchanges; Section
-   1.5 makes it clear that these are one-way messages that must not be
-   responded to.
-
-   There are two cases when such a one-way notification can be sent:
-   INVALID_IKE_SPI and INVALID_SPI.
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 45]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   In case of INVALID_IKE_SPI, the message sent is a response message,
-   and Section 2.21 says that "If a response is sent, the response MUST
-   be sent to the IP address and port from whence it came with the same
-   IKE SPIs and the Message ID copied."
-
-   In case of INVALID_SPI, however, there are no IKE SPI values that
-   would be meaningful to the recipient of such a notification.  Also,
-   the message sent is now an INFORMATIONAL request.  A strict
-   interpretation of the specification would require the sender to
-   invent garbage values for the SPI fields.  However, we think this was
-   not the intention, and using zero values is acceptable.
-
-   (References: "INVALID_IKE_SPI" thread, June 2005.)
-
-7.8.  Protocol ID/SPI fields in Notify payloads
-
-   Section 3.10 says that the Protocol ID field in Notify payloads "For
-   notifications that do not relate to an existing SA, this field MUST
-   be sent as zero and MUST be ignored on receipt".  However, the
-   specification does not clearly say which notifications are related to
-   existing SAs and which are not.
-
-   Since the main purpose of the Protocol ID field is to specify the
-   type of the SPI, our interpretation is that the Protocol ID field
-   should be non-zero only when the SPI field is non-empty.
-
-   There are currently only two notifications where this is the case:
-   INVALID_SELECTORS and REKEY_SA.
-
-7.9.  Which message should contain INITIAL_CONTACT
-
-   The description of the INITIAL_CONTACT notification in Section 3.10.1
-   says that "This notification asserts that this IKE_SA is the only
-   IKE_SA currently active between the authenticated identities".
-   However, neither Section 2.4 nor 3.10.1 says in which message this
-   payload should be placed.
-
-   The general agreement is that INITIAL_CONTACT is best communicated in
-   the first IKE_AUTH request, not as a separate exchange afterwards.
-
-   (References: "Clarifying the use of INITIAL_CONTACT in IKEv2" thread,
-   April 2005.  "Initial Contact messages" thread, December 2004.
-   "IKEv2 and Initial Contact" thread, September 2004 and April 2005.)
-
-7.10.  Alignment of payloads
-
-   Many IKEv2 payloads contain fields marked as "RESERVED", mostly
-   because IKEv1 had them, and partly because they make the pictures
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 46]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   easier to draw.  In particular, payloads in IKEv2 are not, in
-   general, aligned to 4-byte boundaries.  (Note that payloads were not
-   aligned to 4-byte boundaries in IKEv1 either.)
-
-   (References: "IKEv2: potential 4-byte alignment problem" thread, June
-   2004.)
-
-7.11.  Key length transform attribute
-
-   Section 3.3.5 says that "The only algorithms defined in this document
-   that accept attributes are the AES based encryption, integrity, and
-   pseudo-random functions, which require a single attribute specifying
-   key width."
-
-   This is incorrect.  The AES-based integrity and pseudo-random
-   functions defined in [IKEv2] always use a 128-bit key.  In fact,
-   there are currently no integrity or PRF algorithms that use the key
-   length attribute (and we recommend that they should not be defined in
-   the future either).
-
-   For encryption algorithms, the situation is slightly more complex
-   since there are three different types of algorithms:
-
-   o  The key length attribute is never used with algorithms that use a
-      fixed length key, such as DES and IDEA.
-
-   o  The key length attribute is always included for the currently
-      defined AES-based algorithms (CBC, CTR, CCM and GCM).  Omitting
-      the key length attribute is not allowed; if the proposal does not
-      contain it, the proposal has to be rejected.
-
-   o  For other algorithms, the key length attribute can be included but
-      is not mandatory.  These algorithms include, e.g., RC5, CAST and
-      BLOWFISH.  If the key length attribute is not included, the
-      default value specified in [RFC2451] is used.
-
-7.12.  IPsec IANA considerations
-
-   There are currently three different IANA registry files that contain
-   important numbers for IPsec: ikev2-registry, isakmp-registry, and
-   ipsec-registry.  Implementors should note that IKEv2 may use numbers
-   different from IKEv1 for a particular algorithm.
-
-   For instance, an encryption algorithm can have up to three different
-   numbers: the IKEv2 "Transform Type 1" identifier in ikev2-registry,
-   the IKEv1 phase 1 "Encryption Algorithm" identifier in ipsec-
-   registry, and the IKEv1 phase 2 "IPSEC ESP Transform Identifier"
-   isakmp-registry.  Although some algorithms have the same number in
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 47]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   all three registries, the registries are not identical.
-
-   Similarly, an integrity algorithm can have at least the IKEv2
-   "Transform Type 3" identifier in ikev2-registry, the IKEv1 phase 2
-   "IPSEC AH Transform Identifier" in isakmp-registry, and the IKEv1
-   phase 2 ESP "Authentication Algorithm Security Association Attribute"
-   identifier in isakmp-registry.  And there is also the IKEv1 phase 1
-   "Hash Algorithm" list in ipsec-registry.
-
-   This issue needs special care also when writing a specification for
-   how a new algorithm is used together with IPsec.
-
-7.13.  Combining ESP and AH
-
-   The IKEv2 specification contains some misleading text about how ESP
-   and AH can be combined.
-
-   IKEv2 is based on [RFC4301] which does not include "SA bundles" that
-   were part of [RFC2401].  While a single packet can go through IPsec
-   processing multiple times, each of these passes uses a separate SA,
-   and the passes are coordinated by the forwarding tables.  In IKEv2,
-   each of these SAs has to be created using a separate CREATE_CHILD_SA
-   exchange.  Thus, the text in Section 2.7 about a single proposal
-   containing both ESP and AH is incorrect.
-
-   Morever, the combination of ESP and AH (between the same endpoints)
-   become largely obsolete already in 1998 when RFC 2406 was published.
-   Our recommendation is that IKEv2 implementations should not support
-   this combination, and implementors should not assume the combination
-   can be made to work in interoperable manner.
-
-   (References: "Rekeying SA bundles" thread, Oct 2005.)
-
-
-8.  Status of the clarifications
-
-   This document is work-in-progress, and it contains both relatively
-   stable and finished parts, and other parts that are incomplete or
-   even incorrect.  To help the reader in deciding how much weight
-   should be given to each clarification, this section contains our
-   opinions about which parts we believe to are stable, and which are
-   likely to change in future versions.
-
-   Those clarifications believed to be correct and without controversy
-   are marked with three asterisks (***); those where the clarification
-   is known to be incomplete and/or there is disagreement about what the
-   correct interpretation is are marked with one asterisk (*).  The
-   clarifications marked with two asterisks (**) are somewhere between
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 48]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   the extremes.
-
-   2.   Creating the IKE_SA
-      2.1  SPI values in IKE_SA_INIT exchange                        ***
-      2.2  Message IDs for IKE_SA_INIT messages                      ***
-      2.3  Retransmissions of IKE_SA_INIT requests                   ***
-      2.4  Interaction of COOKIE and INVALID_KE_PAYLOAD              ***
-      2.5  Invalid cookies                                           ***
-   3.   Authentication
-      3.1  Data included in AUTH payload calculation                 ***
-      3.2  Hash function for RSA signatures                          ***
-      3.3  Encoding method for RSA signatures                        ***
-      3.4  Identification type for EAP                               ***
-      3.5  Identity for policy lookups when using EAP                ***
-      3.6  (Section removed)
-      3.7  Certificate encoding types                                ***
-      3.8  Shared key authentication and fixed PRF key size          ***
-      3.9  EAP authentication and fixed PRF key size                 ***
-      3.10 Matching ID payloads to certificate contents              ***
-      3.11 Message IDs for IKE_AUTH messages                         ***
-   4.   Creating CHILD_SAs
-      4.1  Creating SAs with the CREATE_CHILD_SA exchange            **
-      4.2  Creating an IKE_SA without a CHILD_SA                     ***
-      4.3  Diffie-Hellman for first CHILD_SA                         ***
-      4.4  Extended Sequence Numbers (ESN) transform                 ***
-      4.5  Negotiation of ESP_TFC_PADDING_NOT_SUPPORTED              ***
-      4.6  Negotiation of NON_FIRST_FRAGMENTS_ALSO                   ***
-      4.7  Semantics of complex traffic selector payloads            ***
-      4.8  ICMP type/code in traffic selector payloads               ***
-      4.9  Mobility header in traffic selector payloads              ***
-      4.10 Narrowing the traffic selectors                           ***
-      4.11 SINGLE_PAIR_REQUIRED                                      ***
-      4.12 Traffic selectors violating own policy                    ***
-   5.   Rekeying and deleting SAs
-      5.1  Rekeying SAs with the CREATE_CHILD_SA exchange            **
-      5.2  Rekeying the IKE_SA vs. reauthentication                  ***
-      5.3  SPIs when rekeying the IKE_SA                             ***
-      5.4  SPI when rekeying a CHILD_SA                              ***
-      5.5  Changing PRFs when rekeying the IKE_SA                    ***
-      5.6  Deleting vs. closing SAs                                  ***
-      5.7  Deleting an SA pair                                       ***
-      5.8  Deleting an IKE_SA                                        ***
-      5.9  Who is the original initiator of IKE_SA                   ***
-      5.10 (Section removed)
-      5.11 Comparing nonces                                          ***
-      5.12 Exchange collisions                                       *
-      5.13 Diffie-Hellman and rekeying the IKE_SA                    **
-   6.   Configuration payloads
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 49]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-      6.1  Assigning IP addresses                                    ***
-      6.2  (Section removed)
-      6.3  Requesting any INTERNAL_IP4/IP6_ADDRESS                   ***
-      6.4  INTERNAL_IP4_SUBNET/INTERNAL_IP6_SUBNET                   ***
-      6.5  INTERNAL_IP4_NETMASK                                      **
-      6.6  Configuration payloads for IPv6                           **
-      6.7  INTERNAL_IP6_NBNS                                         ***
-      6.8  INTERNAL_ADDRESS_EXPIRY                                   ***
-      6.9  Address assignment failures                               **
-   7.   Miscellaneous issues
-      7.1  Matching ID_IPV4_ADDR and ID_IPV6_ADDR                    ***
-      7.2  Relationship of IKEv2 to RFC4301                          ***
-      7.3  Reducing the window size                                  ***
-      7.4  Minimum size of nonces                                    ***
-      7.5  Initial zero octets on port 4500                          ***
-      7.6  Destination port for NAT traversal                        ***
-      7.7  SPI values for messages outside of an IKE_SA              ***
-      7.8  Protocol ID/SPI fields in Notify payloads                 ***
-      7.9  Which message should contain INITIAL_CONTACT              ***
-      7.10 Alignment of payloads                                     ***
-      7.11 Key length transform attribute                            ***
-      7.12 IPsec IANA considerations                                 **
-      7.13 Combining ESP and AH                                      *
-
-   Future versions of this document will, of course, change these
-   estimates (and changes in both directions are possible, though
-   hopefully it's more towards higher confidence).
-
-
-9.  Implementation mistakes
-
-   Some implementers at the early IKEv2 bakeoffs didn't do everything
-   correctly.  This may seem like an obvious statement, but it is
-   probably useful to list a few things that were clear in the document
-   and not needing clarification, that some implementors didn't do.  All
-   of these things caused interoperability problems.
-
-   o  Some implementations continued to send traffic on a CHILD_SA after
-      it was rekeyed, even after receiving an DELETE payload.
-
-   o  After rekeying an IKE_SA, some implementations did not reset their
-      message counters to zero.  One set the counter to 2, another did
-      not reset the counter at all.
-
-   o  Some implementations could only handle a single pair of traffic
-      selectors, or would only process the first pair in the proposal.
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 50]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   o  Some implementations responded to a delete request by sending an
-      empty INFORMATIONAL response, and then initiated their own
-      INFORMATIONAL exchange with the pair of SAs to delete.
-
-   o  Although this did not happen at the bakeoff, from the discussion
-      there, it is clear that some people had not implemented message
-      window sizes correctly.  Some implementations might have sent
-      messages that did not fit into the responder's message windows,
-      and some implementations may not have torn down an SA if they did
-      not ever receive a message that they know they should have.
-
-
-10.  Security considerations
-
-   This document does not introduce any new security considerations to
-   IKEv2.  If anything, clarifying complex areas of the specification
-   can reduce the likelihood of implementation problems that may have
-   security implications.
-
-
-11.  IANA considerations
-
-   This document does not change or create any IANA-registered values.
-
-
-12.  Acknowledgments
-
-   This document is mainly based on conversations on the IPsec WG
-   mailing list.  The authors would especially like to thank Bernard
-   Aboba, Jari Arkko, Vijay Devarapalli, William Dixon, Francis Dupont,
-   Mika Joutsenvirta, Charlie Kaufman, Stephen Kent, Tero Kivinen, Yoav
-   Nir, Michael Richardson, and Joel Snyder for their contributions.
-
-   In addition, the authors would like to thank all the participants of
-   the first public IKEv2 bakeoff, held in Santa Clara in February 2005,
-   for their questions and proposed clarifications.
-
-
-13.  References
-
-13.1.  Normative References
-
-   [IKEv2]    Kaufman, C., Ed., "Internet Key Exchange (IKEv2)
-              Protocol", RFC 4306, December 2005.
-
-   [IKEv2ALG]
-              Schiller, J., "Cryptographic Algorithms for Use in the
-              Internet Key Exchange Version 2 (IKEv2)", RFC 4307,
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 51]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-              December 2005.
-
-   [PKCS1v20]
-              Kaliski, B. and J. Staddon, "PKCS #1: RSA Cryptography
-              Specifications Version 2.0", RFC 2437, October 1998.
-
-   [PKCS1v21]
-              Jonsson, J. and B. Kaliski, "Public-Key Cryptography
-              Standards (PKCS) #1: RSA Cryptography Specifications
-              Version 2.1", RFC 3447, February 2003.
-
-   [RFC2401]  Kent, S. and R. Atkinson, "Security Architecture for the
-              Internet Protocol", RFC 2401, November 1998.
-
-   [RFC4301]  Kent, S. and K. Seo, "Security Architecture for the
-              Internet Protocol", RFC 4301, December 2005.
-
-13.2.  Informative References
-
-   [EAP]      Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H.
-              Levkowetz, "Extensible Authentication Protocol (EAP)",
-              RFC 3748, June 2004.
-
-   [HashUse]  Hoffman, P., "Use of Hash Algorithms in IKE and IPsec",
-              draft-hoffman-ike-ipsec-hash-use-01 (work in progress),
-              December 2005.
-
-   [IPCPSubnet]
-              Cisco Systems, Inc., "IPCP Subnet Mask Support
-              Enhancements",  http://www.cisco.com/univercd/cc/td/doc/
-              product/software/ios121/121newft/121limit/121dc/121dc3/
-              ipcp_msk.htm, January 2003.
-
-   [IPv6Addr]
-              Hinden, R. and S. Deering, "Internet Protocol Version 6
-              (IPv6) Addressing  Architecture", RFC 3513, April 2004.
-
-   [MIPv6]    Johnson, D., Perkins, C., and J. Arkko, "Mobility Support
-              in IPv6", RFC 3775, June 2004.
-
-   [MLDv2]    Vida, R. and L. Costa, "Multicast Listener Discovery
-              Version 2 (MLDv2) for IPv6", RFC 3810, June 2004.
-
-   [NAI]      Aboba, B., Beadles, M., Arkko, J., and P. Eronen, "The
-              Network Access Identifier", RFC 4282, December 2005.
-
-   [RADEAP]   Aboba, B. and P. Calhoun, "RADIUS (Remote Authentication
-              Dial In User Service) Support For Extensible
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 52]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-              Authentication Protocol (EAP)", RFC 3579, September 2003.
-
-   [RADIUS]   Rigney, C., Willens, S., Rubens, A., and W. Simpson,
-              "Remote Authentication Dial In User Service (RADIUS)",
-              RFC 2865, June 2000.
-
-   [RADIUS6]  Aboba, B., Zorn, G., and D. Mitton, "RADIUS and IPv6",
-              RFC 3162, August 2001.
-
-   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
-              Requirement  Levels", RFC 2119, March 1997.
-
-   [RFC2451]  Pereira, R. and R. Adams, "The ESP CBC-Mode Cipher
-              Algorithms", RFC 2451, November 1998.
-
-   [RFC2822]  Resnick, P., "Internet Message Format", RFC 2822,
-              April 2001.
-
-   [RFC3664]  Hoffman, P., "The AES-XCBC-PRF-128 Algorithm for the
-              Internet Key Exchange Protocol (IKE)", RFC 3664,
-              January 2004.
-
-   [RFC3664bis]
-              Hoffman, P., "The AES-XCBC-PRF-128 Algorithm for the
-              Internet Key Exchange Protocol (IKE)",
-              draft-hoffman-rfc3664bis (work in progress), October 2005.
-
-   [RFC3948]  Huttunen, A., Swander, B., Volpe, V., DiBurro, L., and M.
-              Stenberg, "UDP Encapsulation of IPsec ESP Packets",
-              RFC 3948, January 2005.
-
-   [RFC822]   Crocker, D., "Standard for the format of ARPA Internet
-              text messages", RFC 822, August 1982.
-
-   [ReAuth]   Nir, Y., "Repeated Authentication in IKEv2",
-              draft-nir-ikev2-auth-lt-03 (work in progress),
-              November 2005.
-
-   [SCVP]     Freeman, T., Housley, R., Malpani, A., Cooper, D., and T.
-              Polk, "Simple Certificate Validation Protocol (SCVP)",
-              draft-ietf-pkix-scvp-21 (work in progress), October 2005.
-
-
-Appendix A.  Exchanges and payloads
-
-   This appendix contains a short summary of the IKEv2 exchanges, and
-   what payloads can appear in which message.  This appendix is purely
-   informative; if it disagrees with the body of this document or the
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 53]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-   IKEv2 specification, the other text is considered correct.
-
-   Vendor-ID (V) payloads may be included in any place in any message.
-   This sequence shows what are, in our opinion, the most logical places
-   for them.
-
-   The specification does not say which messages can contain
-   N(SET_WINDOW_SIZE).  It can possibly be included in any message, but
-   it is not yet shown below.
-
-A.1.  IKE_SA_INIT exchange
-
-   request             --> [N(COOKIE)],
-                           SA, KE, Ni,
-                           [N(NAT_DETECTION_SOURCE_IP)+,
-                            N(NAT_DETECTION_DESTINATION_IP)],
-                           [V+]
-
-   normal response     <-- SA, KE, Nr,
-   (no cookie)             [N(NAT_DETECTION_SOURCE_IP),
-                            N(NAT_DETECTION_DESTINATION_IP)],
-                           [[N(HTTP_CERT_LOOKUP_SUPPORTED)], CERTREQ+],
-                           [V+]
-
-A.2.  IKE_AUTH exchange without EAP
-
-   request             --> IDi, [CERT+],
-                           [N(INITIAL_CONTACT)],
-                           [[N(HTTP_CERT_LOOKUP_SUPPORTED)], CERTREQ+],
-                           [IDr],
-                           AUTH,
-                           [CP(CFG_REQUEST)],
-                           [N(IPCOMP_SUPPORTED)+],
-                           [N(USE_TRANSPORT_MODE)],
-                           [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
-                           [N(NON_FIRST_FRAGMENTS_ALSO)],
-                           SA, TSi, TSr,
-                           [V+]
-
-   response            <-- IDr, [CERT+],
-                           AUTH,
-                           [CP(CFG_REPLY)],
-                           [N(IPCOMP_SUPPORTED)],
-                           [N(USE_TRANSPORT_MODE)],
-                           [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
-                           [N(NON_FIRST_FRAGMENTS_ALSO)],
-                           SA, TSi, TSr,
-                           [N(ADDITIONAL_TS_POSSIBLE)],
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 54]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-                           [V+]
-
-A.3.  IKE_AUTH exchange with EAP
-
-   first request       --> IDi,
-                           [N(INITIAL_CONTACT)],
-                           [[N(HTTP_CERT_LOOKUP_SUPPORTED)], CERTREQ+],
-                           [IDr],
-                           [CP(CFG_REQUEST)],
-                           [N(IPCOMP_SUPPORTED)+],
-                           [N(USE_TRANSPORT_MODE)],
-                           [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
-                           [N(NON_FIRST_FRAGMENTS_ALSO)],
-                           SA, TSi, TSr,
-                           [V+]
-
-   first response      <-- IDr, [CERT+], AUTH,
-                           EAP,
-                           [V+]
-
-                     / --> EAP
-   repeat 1..N times |
-                     \ <-- EAP
-
-   last request        --> AUTH
-
-   last response       <-- AUTH,
-                           [CP(CFG_REPLY)],
-                           [N(IPCOMP_SUPPORTED)],
-                           [N(USE_TRANSPORT_MODE)],
-                           [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
-                           [N(NON_FIRST_FRAGMENTS_ALSO)],
-                           SA, TSi, TSr,
-                           [N(ADDITIONAL_TS_POSSIBLE)],
-                           [V+]
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 55]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-A.4.  CREATE_CHILD_SA exchange for creating/rekeying CHILD_SAs
-
-   request             --> [N(REKEY_SA)],
-                           [N(IPCOMP_SUPPORTED)+],
-                           [N(USE_TRANSPORT_MODE)],
-                           [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
-                           [N(NON_FIRST_FRAGMENTS_ALSO)],
-                           SA, Ni, [KEi], TSi, TSr
-
-   response            <-- [N(IPCOMP_SUPPORTED)],
-                           [N(USE_TRANSPORT_MODE)],
-                           [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
-                           [N(NON_FIRST_FRAGMENTS_ALSO)],
-                           SA, Nr, [KEr], TSi, TSr,
-                           [N(ADDITIONAL_TS_POSSIBLE)]
-
-A.5.  CREATE_CHILD_SA exchange for rekeying the IKE_SA
-
-   request             --> SA, Ni, [KEi]
-
-   response            <-- SA, Nr, [KEr]
-
-A.6.  INFORMATIONAL exchange
-
-   request             --> [N+],
-                           [D+],
-                           [CP(CFG_REQUEST)]
-
-   response            <-- [N+],
-                           [D+],
-                           [CP(CFG_REPLY)]
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 56]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-Authors' Addresses
-
-   Pasi Eronen
-   Nokia Research Center
-   P.O. Box 407
-   FIN-00045 Nokia Group
-   Finland
-
-   Email: pasi.eronen@nokia.com
-
-
-   Paul Hoffman
-   VPN Consortium
-   127 Segre Place
-   Santa Cruz, CA 95060
-   USA
-
-   Email: paul.hoffman@vpnc.org
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 57]
-
-Internet-Draft            IKEv2 Clarifications             February 2006
-
-
-Intellectual Property Statement
-
-   The IETF takes no position regarding the validity or scope of any
-   Intellectual Property Rights or other rights that might be claimed to
-   pertain to the implementation or use of the technology described in
-   this document or the extent to which any license under such rights
-   might or might not be available; nor does it represent that it has
-   made any independent effort to identify any such rights.  Information
-   on the procedures with respect to rights in RFC documents can be
-   found in BCP 78 and BCP 79.
-
-   Copies of IPR disclosures made to the IETF Secretariat and any
-   assurances of licenses to be made available, or the result of an
-   attempt made to obtain a general license or permission for the use of
-   such proprietary rights by implementers or users of this
-   specification can be obtained from the IETF on-line IPR repository at
-   http://www.ietf.org/ipr.
-
-   The IETF invites any interested party to bring to its attention any
-   copyrights, patents or patent applications, or other proprietary
-   rights that may cover technology that may be required to implement
-   this standard.  Please address the information to the IETF at
-   ietf-ipr@ietf.org.
-
-
-Disclaimer of Validity
-
-   This document and the information contained herein are provided on an
-   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
-   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
-   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
-   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
-   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
-   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-
-Copyright Statement
-
-   Copyright (C) The Internet Society (2006).  This document is subject
-   to the rights, licenses and restrictions contained in BCP 78, and
-   except as set forth therein, the authors retain all their rights.
-
-
-Acknowledgment
-
-   Funding for the RFC Editor function is currently provided by the
-   Internet Society.
-
-
-
-
-Eronen & Hoffman         Expires August 6, 2006                [Page 58]
-
diff --git a/doc/ikev2/[IKEv2Draft] - Internet Key Exchange (IKEv2) Protocol Draft v17.txt b/doc/ikev2/[IKEv2Draft] - Internet Key Exchange (IKEv2) Protocol Draft v17.txt
deleted file mode 100644
index c1493c197..000000000
--- a/doc/ikev2/[IKEv2Draft] - Internet Key Exchange (IKEv2) Protocol Draft v17.txt
+++ /dev/null
@@ -1,6535 +0,0 @@
-
-
-INTERNET-DRAFT                                Charlie Kaufman, Editor
-draft-ietf-ipsec-ikev2-17.txt
-Obsoletes: 2407, 2408, 2409                        September 23, 2004
-Expires: March 2005
-
-
-                 Internet Key Exchange (IKEv2) Protocol
-
-
-Status of this Memo
-
-   This document is an Internet-Draft and is subject to all provisions
-   of Section 10 of RFC2026. Internet-Drafts are working documents of
-   the Internet Engineering Task Force (IETF), its areas, and its
-   working groups. Note that other groups may also distribute working
-   documents as Internet-Drafts.
-
-   Internet-Drafts are draft documents valid for a maximum of six months
-   and may be updated, replaced, or obsoleted by other documents at any
-   time. It is inappropriate to use Internet-Drafts as reference
-   material or to cite them other than as "work in progress."
-
-   The list of current Internet-Drafts can be accessed at
-   http://www.ietf.org/1id-abstracts.html
-
-   The list of Internet-Draft Shadow Directories can be accessed at
-   http://www.ietf.org/shadow.html
-
-   This document is a submission by the IPSEC Working Group of the
-   Internet Engineering Task Force (IETF).  Comments should be submitted
-   to the ipsec@lists.tislabs.com mailing list.
-
-   Distribution of this memo is unlimited.
-
-   This Internet-Draft expires in March 2005.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (2004).  All Rights Reserved.
-
-Abstract
-
-   This document describes version 2 of the Internet Key Exchange (IKE)
-   protocol.  IKE is a component of IPsec used for performing mutual
-   authentication and establishing and maintaining security associations
-   (SAs).
-
-   This version of the IKE specification combines the contents of what
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt             [Page 1]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   were previously separate documents, including ISAKMP (RFC 2408), IKE
-   (RFC 2409), the Internet DOI (RFC 2407), NAT Traversal, Legacy
-   authentication, and remote address acquisition.
-
-   Version 2 of IKE does not interoperate with version 1, but it has
-   enough of the header format in common that both versions can
-   unambiguously run over the same UDP port.
-
-Table of Contents
-
-
-   1 Introduction...............................................3
-   1.1 Usage Scenarios..........................................5
-   1.2 The Initial Exchanges....................................7
-   1.3 The CREATE_CHILD_SA Exchange.............................9
-   1.4 The INFORMATIONAL Exchange..............................10
-   1.5 Informational Messages outside of an IKE_SA.............12
-   2 IKE Protocol Details and Variations.......................12
-   2.1 Use of Retransmission Timers............................13
-   2.2 Use of Sequence Numbers for Message ID..................13
-   2.3 Window Size for overlapping requests....................14
-   2.4 State Synchronization and Connection Timeouts...........15
-   2.5 Version Numbers and Forward Compatibility...............16
-   2.6 Cookies.................................................18
-   2.7 Cryptographic Algorithm Negotiation.....................20
-   2.8 Rekeying................................................21
-   2.9 Traffic Selector Negotiation............................23
-   2.10 Nonces.................................................25
-   2.11 Address and Port Agility...............................26
-   2.12 Reuse of Diffie-Hellman Exponentials...................26
-   2.13 Generating Keying Material.............................27
-   2.14 Generating Keying Material for the IKE_SA..............28
-   2.15 Authentication of the IKE_SA...........................29
-   2.16 Extensible Authentication Protocol Methods.............30
-   2.17 Generating Keying Material for CHILD_SAs...............32
-   2.18 Rekeying IKE_SAs using a CREATE_CHILD_SA exchange......33
-   2.19 Requesting an internal address on a remote network.....33
-   2.20 Requesting a Peer's Version............................35
-   2.21 Error Handling.........................................35
-   2.22 IPComp.................................................36
-   2.23 NAT Traversal..........................................37
-   2.24 ECN (Explicit Congestion Notification).................40
-   3 Header and Payload Formats................................40
-   3.1 The IKE Header..........................................40
-   3.2 Generic Payload Header..................................43
-   3.3 Security Association Payload............................44
-   3.4 Key Exchange Payload....................................54
-   3.5 Identification Payloads.................................55
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt             [Page 2]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   3.6 Certificate Payload.....................................57
-   3.7 Certificate Request Payload.............................60
-   3.8 Authentication Payload..................................62
-   3.9 Nonce Payload...........................................62
-   3.10 Notify Payload.........................................63
-   3.11 Delete Payload.........................................71
-   3.12 Vendor ID Payload......................................72
-   3.13 Traffic Selector Payload...............................73
-   3.14 Encrypted Payload......................................76
-   3.15 Configuration Payload..................................77
-   3.16 Extensible Authentication Protocol (EAP) Payload.......82
-   4 Conformance Requirements..................................84
-   5 Security Considerations...................................86
-   6 IANA Considerations.......................................89
-   7 Acknowledgements..........................................89
-   8 References................................................90
-   8.1 Normative References....................................90
-   8.2 Informative References..................................91
-   Appendix A: Summary of Changes from IKEv1...................94
-   Appendix B: Diffie-Hellman Groups...........................96
-   Change History (To be removed from RFC).....................97
-   Editor's Address...........................................108
-   Full Copyright Statement...................................108
-   Intellectual Property Statement............................108
-
-Requirements Terminology
-
-   Keywords "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT" and
-   "MAY" that appear in this document are to be interpreted as described
-   in [Bra97].
-
-   The term "Expert Review" is to be interpreted as defined in
-   [RFC2434].
-
-1 Introduction
-
-   IP Security (IPsec) provides confidentiality, data integrity, access
-   control, and data source authentication to IP datagrams. These
-   services are provided by maintaining shared state between the source
-   and the sink of an IP datagram. This state defines, among other
-   things, the specific services provided to the datagram, which
-   cryptographic algorithms will be used to provide the services, and
-   the keys used as input to the cryptographic algorithms.
-
-   Establishing this shared state in a manual fashion does not scale
-   well.  Therefore a protocol to establish this state dynamically is
-   needed.  This memo describes such a protocol-- the Internet Key
-   Exchange (IKE).  This is version 2 of IKE. Version 1 of IKE was
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt             [Page 3]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   defined in RFCs 2407, 2408, and 2409. This single document is
-   intended to replace all three of those RFCs.
-
-   Definitions of the primitive terms in this document (such as Security
-   Association or SA) can be found in [RFC2401bis].
-
-   IKE performs mutual authentication between two parties and
-   establishes an IKE security association (SA) that includes shared
-   secret information that can be used to efficiently establish SAs for
-   ESP [RFC2406] and/or AH [RFC2402] and a set of cryptographic
-   algorithms to be used by the SAs to protect the traffic that they
-   carry.  In this document, the term "suite" or "cryptographic suite"
-   refers to a complete set of algorithms used to protect an SA. An
-   initiator proposes one or more suites by listing supported algorithms
-   that can be combined into suites in a mix and match fashion.  IKE can
-   also negotiate use of IPComp [IPCOMP] in connection with an ESP
-   and/or AH SA.  We call the IKE SA an "IKE_SA". The SAs for ESP and/or
-   AH that get set up through that IKE_SA we call "CHILD_SA"s.
-
-   All IKE communications consist of pairs of messages: a request and a
-   response. The pair is called an "exchange".  We call the first
-   messages establishing an IKE_SA IKE_SA_INIT and IKE_AUTH exchanges
-   and subsequent IKE exchanges CREATE_CHILD_SA or INFORMATIONAL
-   exchanges. In the common case, there is a single IKE_SA_INIT exchange
-   and a single IKE_AUTH exchange (a total of four messages) to
-   establish the IKE_SA and the first CHILD_SA. In exceptional cases,
-   there may be more than one of each of these exchanges. In all cases,
-   all IKE_SA_INIT exchanges MUST complete before any other exchange
-   type, then all IKE_AUTH exchanges MUST complete, and following that
-   any number of CREATE_CHILD_SA and INFORMATIONAL exchanges may occur
-   in any order.  In some scenarios, only a single CHILD_SA is needed
-   between the IPsec endpoints and therefore there would be no
-   additional exchanges. Subsequent exchanges MAY be used to establish
-   additional CHILD_SAs between the same authenticated pair of endpoints
-   and to perform housekeeping functions.
-
-   IKE message flow always consists of a request followed by a response.
-   It is the responsibility of the requester to ensure reliability.  If
-   the response is not received within a timeout interval, the requester
-   needs to retransmit the request (or abandon the connection).
-
-   The first request/response of an IKE session (IKE_SA_INIT) negotiates
-   security parameters for the IKE_SA, sends nonces, and sends Diffie-
-   Hellman values.
-
-   The second request/response (IKE_AUTH) transmits identities, proves
-   knowledge of the secrets corresponding to the two identities, and
-   sets up an SA for the first (and often only) AH and/or ESP CHILD_SA.
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt             [Page 4]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   The types of subsequent exchanges are CREATE_CHILD_SA (which creates
-   a CHILD_SA), and INFORMATIONAL (which deletes an SA, reports error
-   conditions, or does other housekeeping).  Every request requires a
-   response. An INFORMATIONAL request with no payloads (other than the
-   empty Encrypted payload required by the syntax) is commonly used as a
-   check for liveness.  These subsequent exchanges cannot be used until
-   the initial exchanges have completed.
-
-   In the description that follows, we assume that no errors occur.
-   Modifications to the flow should errors occur are described in
-   section 2.21.
-
-1.1 Usage Scenarios
-
-   IKE is expected to be used to negotiate ESP and/or AH SAs in a number
-   of different scenarios, each with its own special requirements.
-
-1.1.1 Security Gateway to Security Gateway Tunnel
-
-                    +-+-+-+-+-+            +-+-+-+-+-+
-                    !         ! IPsec      !         !
-       Protected    !Tunnel   ! Tunnel     !Tunnel   !     Protected
-       Subnet   <-->!Endpoint !<---------->!Endpoint !<--> Subnet
-                    !         !            !         !
-                    +-+-+-+-+-+            +-+-+-+-+-+
-
-             Figure 1:  Security Gateway to Security Gateway Tunnel
-
-   In this scenario, neither endpoint of the IP connection implements
-   IPsec, but network nodes between them protect traffic for part of the
-   way. Protection is transparent to the endpoints, and depends on
-   ordinary routing to send packets through the tunnel endpoints for
-   processing. Each endpoint would announce the set of addresses
-   "behind" it, and packets would be sent in Tunnel Mode where the inner
-   IP header would contain the IP addresses of the actual endpoints.
-
-1.1.2 Endpoint to Endpoint Transport
-
-       +-+-+-+-+-+                                          +-+-+-+-+-+
-       !         !                 IPsec Transport          !         !
-       !Protected!                or Tunnel Mode SA         !Protected!
-       !Endpoint !<---------------------------------------->!Endpoint !
-       !         !                                          !         !
-       +-+-+-+-+-+                                          +-+-+-+-+-+
-
-                       Figure 2:  Endpoint to Endpoint
-
-   In this scenario, both endpoints of the IP connection implement
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt             [Page 5]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   IPsec, as required of hosts in [RFC2401bis]. Transport mode will
-   commonly be used with no inner IP header.  If there is an inner IP
-   header, the inner addresses will be the same as the outer addresses.
-   A single pair of addresses will be negotiated for packets to be
-   protected by this SA. These endpoints MAY implement application layer
-   access controls based on the IPsec authenticated identities of the
-   participants. This scenario enables the end-to-end security that has
-   been a guiding principle for the Internet since [RFC1958], [RFC2775],
-   and a method of limiting the inherent problems with complexity in
-   networks noted by [RFC3439].  While this scenario may not be fully
-   applicable to the IPv4 Internet, it has been deployed successfully in
-   specific scenarios within intranets using IKEv1. It should be more
-   broadly enabled during the transition to IPv6 and with the adoption
-   of IKEv2.
-
-   It is possible in this scenario that one or both of the protected
-   endpoints will be behind a network address translation (NAT) node, in
-   which case the tunneled packets will have to be UDP encapsulated so
-   that port numbers in the UDP headers can be used to identify
-   individual endpoints "behind" the NAT (see section 2.23).
-
-1.1.3 Endpoint to Security Gateway Transport
-
-       +-+-+-+-+-+                          +-+-+-+-+-+
-       !         !         IPsec            !         !     Protected
-       !Protected!         Tunnel           !Tunnel   !     Subnet
-       !Endpoint !<------------------------>!Endpoint !<--- and/or
-       !         !                          !         !     Internet
-       +-+-+-+-+-+                          +-+-+-+-+-+
-
-                 Figure 3:  Endpoint to Security Gateway Tunnel
-
-   In this scenario, a protected endpoint (typically a portable roaming
-   computer) connects back to its corporate network through an IPsec
-   protected tunnel. It might use this tunnel only to access information
-   on the corporate network or it might tunnel all of its traffic back
-   through the corporate network in order to take advantage of
-   protection provided by a corporate firewall against Internet based
-   attacks. In either case, the protected endpoint will want an IP
-   address associated with the security gateway so that packets returned
-   to it will go to the security gateway and be tunneled back. This IP
-   address may be static or may be dynamically allocated by the security
-   gateway. In support of the latter case, IKEv2 includes a mechanism
-   for the initiator to request an IP address owned by the security
-   gateway for use for the duration of its SA.
-
-   In this scenario, packets will use tunnel mode. On each packet from
-   the protected endpoint, the outer IP header will contain the source
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt             [Page 6]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   IP address associated with its current location (i.e., the address
-   that will get traffic routed to the endpoint directly) while the
-   inner IP header will contain the source IP address assigned by the
-   security gateway (i.e., the address that will get traffic routed to
-   the security gateway for forwarding to the endpoint). The outer
-   destination address will always be that of the security gateway,
-   while the inner destination address will be the ultimate destination
-   for the packet.
-
-   In this scenario, it is possible that the protected endpoint will be
-   behind a NAT. In that case, the IP address as seen by the security
-   gateway will not be the same as the IP address sent by the protected
-   endpoint, and packets will have to be UDP encapsulated in order to be
-   routed properly.
-
-1.1.4 Other Scenarios
-
-   Other scenarios are possible, as are nested combinations of the
-   above.  One notable example combines aspects of 1.1.1 and 1.1.3. A
-   subnet may make all external accesses through a remote security
-   gateway using an IPsec tunnel, where the addresses on the subnet are
-   routed to the security gateway by the rest of the Internet. An
-   example would be someone's home network being virtually on the
-   Internet with static IP addresses even though connectivity is
-   provided by an ISP that assigns a single dynamically assigned IP
-   address to the user's security gateway (where the static IP addresses
-   and an IPsec relay is provided by a third party located elsewhere).
-
-1.2 The Initial Exchanges
-
-   Communication using IKE always begins with IKE_SA_INIT and IKE_AUTH
-   exchanges (known in IKEv1 as Phase 1). These initial exchanges
-   normally consist of four messages, though in some scenarios that
-   number can grow. All communications using IKE consist of
-   request/response pairs.  We'll describe the base exchange first,
-   followed by variations.  The first pair of messages (IKE_SA_INIT)
-   negotiate cryptographic algorithms, exchange nonces, and do a Diffie-
-   Hellman exchange.
-
-   The second pair of messages (IKE_AUTH) authenticate the previous
-   messages, exchange identities and certificates, and establish the
-   first CHILD_SA. Parts of these messages are encrypted and integrity
-   protected with keys established through the IKE_SA_INIT exchange, so
-   the identities are hidden from eavesdroppers and all fields in all
-   the messages are authenticated.
-
-   In the following description, the payloads contained in the message
-   are indicated by names such as SA. The details of the contents of
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt             [Page 7]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   each payload are described later. Payloads which may optionally
-   appear will be shown in brackets, such as [CERTREQ], would indicate
-   that optionally a certificate request payload can be included.
-
-   The initial exchanges are as follows:
-
-       Initiator                          Responder
-      -----------                        -----------
-       HDR, SAi1, KEi, Ni   -->
-
-   HDR contains the SPIs, version numbers, and flags of various sorts.
-   The SAi1 payload states the cryptographic algorithms the initiator
-   supports for the IKE_SA.  The KE payload sends the initiator's
-   Diffie-Hellman value. Ni is the initiator's nonce.
-
-                            <--    HDR, SAr1, KEr, Nr, [CERTREQ]
-
-   The responder chooses a cryptographic suite from the initiator's
-   offered choices and expresses that choice in the SAr1 payload,
-   completes the Diffie-Hellman exchange with the KEr payload, and sends
-   its nonce in the Nr payload.
-
-   At this point in the negotiation each party can generate SKEYSEED,
-   from which all keys are derived for that IKE_SA.  All but the headers
-   of all the messages that follow are encrypted and integrity
-   protected.  The keys used for the encryption and integrity protection
-   are derived from SKEYSEED and are known as SK_e (encryption) and SK_a
-   (authentication, a.k.a.  integrity protection). A separate SK_e and
-   SK_a is computed for each direction.  In addition to the keys SK_e
-   and SK_a derived from the DH value for protection of the IKE_SA,
-   another quantity SK_d is derived and used for derivation of further
-   keying material for CHILD_SAs.  The notation SK { ... } indicates
-   that these payloads are encrypted and integrity protected using that
-   direction's SK_e and SK_a.
-
-       HDR, SK {IDi, [CERT,] [CERTREQ,] [IDr,]
-                  AUTH, SAi2, TSi, TSr}     -->
-
-   The initiator asserts its identity with the IDi payload, proves
-   knowledge of the secret corresponding to IDi and integrity protects
-   the contents of the first message using the AUTH payload (see section
-   2.15).  It might also send its certificate(s) in CERT payload(s) and
-   a list of its trust anchors in CERTREQ payload(s). If any CERT
-   payloads are included, the first certificate provided MUST contain
-   the public key used to verify the AUTH field.  The optional payload
-   IDr enables the initiator to specify which of the responder's
-   identities it wants to talk to. This is useful when the machine on
-   which the responder is running is hosting multiple identities at the
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt             [Page 8]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   same IP address.  The initiator begins negotiation of a CHILD_SA
-   using the SAi2 payload. The final fields (starting with SAi2) are
-   described in the description of the CREATE_CHILD_SA exchange.
-
-                                   <--    HDR, SK {IDr, [CERT,] AUTH,
-                                                SAr2, TSi, TSr}
-
-   The responder asserts its identity with the IDr payload, optionally
-   sends one or more certificates (again with the certificate containing
-   the public key used to verify AUTH listed first), authenticates its
-   identity and protects the integrity of the second message with the
-   AUTH payload, and completes negotiation of a CHILD_SA with the
-   additional fields described below in the CREATE_CHILD_SA exchange.
-
-   The recipients of messages 3 and 4 MUST verify that all signatures
-   and MACs are computed correctly and that the names in the ID payloads
-   correspond to the keys used to generate the AUTH payload.
-
-1.3 The CREATE_CHILD_SA Exchange
-
-   This exchange consists of a single request/response pair, and was
-   referred to as a phase 2 exchange in IKEv1. It MAY be initiated by
-   either end of the IKE_SA after the initial exchanges are completed.
-
-   All messages following the initial exchange are cryptographically
-   protected using the cryptographic algorithms and keys negotiated in
-   the first two messages of the IKE exchange.  These subsequent
-   messages use the syntax of the Encrypted Payload described in section
-   3.14. All subsequent messages included an Encrypted Payload, even if
-   they are referred to in the text as "empty".
-
-   Either endpoint may initiate a CREATE_CHILD_SA exchange, so in this
-   section the term initiator refers to the endpoint initiating this
-   exchange.
-
-   A CHILD_SA is created by sending a CREATE_CHILD_SA request.  The
-   CREATE_CHILD_SA request MAY optionally contain a KE payload for an
-   additional Diffie-Hellman exchange to enable stronger guarantees of
-   forward secrecy for the CHILD_SA. The keying material for the
-   CHILD_SA is a function of SK_d established during the establishment
-   of the IKE_SA, the nonces exchanged during the CREATE_CHILD_SA
-   exchange, and the Diffie-Hellman value (if KE payloads are included
-   in the CREATE_CHILD_SA exchange).
-
-   In the CHILD_SA created as part of the initial exchange, a second KE
-   payload and nonce MUST NOT be sent. The nonces from the initial
-   exchange are used in computing the keys for the CHILD_SA.
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt             [Page 9]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   The CREATE_CHILD_SA request contains:
-
-       Initiator                                 Responder
-      -----------                               -----------
-       HDR, SK {[N], SA, Ni, [KEi],
-           [TSi, TSr]}             -->
-
-   The initiator sends SA offer(s) in the SA payload, a nonce in the Ni
-   payload, optionally a Diffie-Hellman value in the KEi payload, and
-   the proposed traffic selectors in the TSi and TSr payloads. If this
-   CREATE_CHILD_SA exchange is rekeying an existing SA other than the
-   IKE_SA, the leading N payload of type REKEY_SA MUST identify the SA
-   being rekeyed. If this CREATE_CHILD_SA exchange is not rekeying an
-   existing SA, the N payload MUST be omitted.  If the SA offers include
-   different Diffie-Hellman groups, KEi MUST be an element of the group
-   the initiator expects the responder to accept. If it guesses wrong,
-   the CREATE_CHILD_SA exchange will fail and it will have to retry with
-   a different KEi.
-
-   The message following the header is encrypted and the message
-   including the header is integrity protected using the cryptographic
-   algorithms negotiated for the IKE_SA.
-
-   The CREATE_CHILD_SA response contains:
-
-                                  <--    HDR, SK {SA, Nr, [KEr],
-                                               [TSi, TSr]}
-
-   The responder replies (using the same Message ID to respond) with the
-   accepted offer in an SA payload, and a Diffie-Hellman value in the
-   KEr payload if KEi was included in the request and the selected
-   cryptographic suite includes that group.  If the responder chooses a
-   cryptographic suite with a different group, it MUST reject the
-   request. The initiator SHOULD repeat the request, but now with a KEi
-   payload from the group the responder selected.
-
-   The traffic selectors for traffic to be sent on that SA are specified
-   in the TS payloads, which may be a subset of what the initiator of
-   the CHILD_SA proposed. Traffic selectors are omitted if this
-   CREATE_CHILD_SA request is being used to change the key of the
-   IKE_SA.
-
-1.4 The INFORMATIONAL Exchange
-
-   At various points during the operation of an IKE_SA, peers may desire
-   to convey control messages to each other regarding errors or
-   notifications of certain events. To accomplish this IKE defines an
-   INFORMATIONAL exchange.  INFORMATIONAL exchanges MUST ONLY occur
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 10]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   after the initial exchanges and are cryptographically protected with
-   the negotiated keys.
-
-   Control messages that pertain to an IKE_SA MUST be sent under that
-   IKE_SA. Control messages that pertain to CHILD_SAs MUST be sent under
-   the protection of the IKE_SA which generated them (or its successor
-   if the IKE_SA was replaced for the purpose of rekeying).
-
-   Messages in an INFORMATIONAL Exchange contain zero or more
-   Notification, Delete, and Configuration payloads. The Recipient of an
-   INFORMATIONAL Exchange request MUST send some response (else the
-   Sender will assume the message was lost in the network and will
-   retransmit it). That response MAY be a message with no payloads. The
-   request message in an INFORMATIONAL Exchange MAY also contain no
-   payloads. This is the expected way an endpoint can ask the other
-   endpoint to verify that it is alive.
-
-   ESP and AH SAs always exist in pairs, with one SA in each direction.
-   When an SA is closed, both members of the pair MUST be closed. When
-   SAs are nested, as when data (and IP headers if in tunnel mode) are
-   encapsulated first with IPComp, then with ESP, and finally with AH
-   between the same pair of endpoints, all of the SAs MUST be deleted
-   together. Each endpoint MUST close its incoming SAs and allow the
-   other endpoint to close the other SA in each pair. To delete an SA,
-   an INFORMATIONAL Exchange with one or more delete payloads is sent
-   listing the SPIs (as they would be expected in the headers of inbound
-   packets) of the SAs to be deleted. The recipient MUST close the
-   designated SAs. Normally, the reply in the INFORMATIONAL Exchange
-   will contain delete payloads for the paired SAs going in the other
-   direction. There is one exception.  If by chance both ends of a set
-   of SAs independently decide to close them, each may send a delete
-   payload and the two requests may cross in the network. If a node
-   receives a delete request for SAs for which it has already issued a
-   delete request, it MUST delete the outgoing SAs while processing the
-   request and the incoming SAs while processing the response. In that
-   case, the responses MUST NOT include delete payloads for the deleted
-   SAs, since that would result in duplicate deletion and could in
-   theory delete the wrong SA.
-
-   A node SHOULD regard half closed connections as anomalous and audit
-   their existence should they persist. Note that this specification
-   nowhere specifies time periods, so it is up to individual endpoints
-   to decide how long to wait. A node MAY refuse to accept incoming data
-   on half closed connections but MUST NOT unilaterally close them and
-   reuse the SPIs. If connection state becomes sufficiently messed up, a
-   node MAY close the IKE_SA which will implicitly close all SAs
-   negotiated under it. It can then rebuild the SAs it needs on a clean
-   base under a new IKE_SA.
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 11]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   The INFORMATIONAL Exchange is defined as:
-
-       Initiator                        Responder
-      -----------                      -----------
-       HDR, SK {[N,] [D,] [CP,] ...} -->
-                                   <-- HDR, SK {[N,] [D,] [CP], ...}
-
-   The processing of an INFORMATIONAL Exchange is determined by its
-   component payloads.
-
-1.5 Informational Messages outside of an IKE_SA
-
-   If an encrypted IKE packet arrives on port 500 or 4500 with an
-   unrecognized SPI, it could be because the receiving node has recently
-   crashed and lost state or because of some other system malfunction or
-   attack. If the receiving node has an active IKE_SA to the IP address
-   from whence the packet came, it MAY send a notification of the
-   wayward packet over that IKE_SA in an informational exchange.  If it
-   does not have such an IKE_SA, it MAY send an Informational message
-   without cryptographic protection to the source IP address. Such a
-   message is not part of an informational exchange, and the receiving
-   node MUST NOT respond to it. Doing so could cause a message loop.
-
-2 IKE Protocol Details and Variations
-
-   IKE normally listens and sends on UDP port 500, though IKE messages
-   may also be received on UDP port 4500 with a slightly different
-   format (see section 2.23).  Since UDP is a datagram (unreliable)
-   protocol, IKE includes in its definition recovery from transmission
-   errors, including packet loss, packet replay, and packet forgery. IKE
-   is designed to function so long as (1) at least one of a series of
-   retransmitted packets reaches its destination before timing out; and
-   (2) the channel is not so full of forged and replayed packets so as
-   to exhaust the network or CPU capacities of either endpoint. Even in
-   the absence of those minimum performance requirements, IKE is
-   designed to fail cleanly (as though the network were broken).
-
-   While IKEv2 messages are intended to be short, they contain
-   structures with no hard upper bound on size (in particular, X.509
-   certificates), and IKEv2 itself does not have a mechanism for
-   fragmenting large messages. IP defines a mechanism for fragmentation
-   of oversize UDP messages, but implementations vary in the maximum
-   message size supported. Further, use of IP fragmentation opens an
-   implementation to denial of service attacks [KPS03]. Finally, some
-   NAT and/or firewall implementations may block IP fragments.
-
-   All IKEv2 implementations MUST be able to send, receive, and process
-   IKE messages that are up to 1280 bytes long, and they SHOULD be able
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 12]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   to send, receive, and process messages that are up to 3000 bytes
-   long.  IKEv2 implementations SHOULD be aware of the maximum UDP
-   message size supported and MAY shorten messages by leaving out some
-   certificates or cryptographic suite proposals if that will keep
-   messages below the maximum.  Use of the "Hash and URL" formats rather
-   then including certificates in exchanges where possible can avoid
-   most problems. Implementations and configuration should keep in mind,
-   however, that if the URL lookups are only possible after the IPsec SA
-   is established, recursion issues could prevent this technique from
-   working.
-
-2.1 Use of Retransmission Timers
-
-   All messages in IKE exist in pairs: a request and a response.  The
-   setup of an IKE_SA normally consists of two request/response pairs.
-   Once the IKE_SA is set up, either end of the security association may
-   initiate requests at any time, and there can be many requests and
-   responses "in flight" at any given moment. But each message is
-   labeled as either a request or a response and for each
-   request/response pair one end of the security association is the
-   initiator and the other is the responder.
-
-   For every pair of IKE messages, the initiator is responsible for
-   retransmission in the event of a timeout. The responder MUST never
-   retransmit a response unless it receives a retransmission of the
-   request. In that event, the responder MUST ignore the retransmitted
-   request except insofar as it triggers a retransmission of the
-   response. The initiator MUST remember each request until it receives
-   the corresponding response. The responder MUST remember each response
-   until it receives a request whose sequence number is larger than the
-   sequence number in the response plus its window size (see section
-   2.3).
-
-   IKE is a reliable protocol, in the sense that the initiator MUST
-   retransmit a request until either it receives a corresponding reply
-   OR it deems the IKE security association to have failed and it
-   discards all state associated with the IKE_SA and any CHILD_SAs
-   negotiated using that IKE_SA.
-
-2.2 Use of Sequence Numbers for Message ID
-
-   Every IKE message contains a Message ID as part of its fixed header.
-   This Message ID is used to match up requests and responses, and to
-   identify retransmissions of messages.
-
-   The Message ID is a 32 bit quantity, which is zero for the first IKE
-   request in each direction. The IKE_SA initial setup messages will
-   always be numbered 0 and 1.  Each endpoint in the IKE Security
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 13]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   Association maintains two "current" Message IDs: the next one to be
-   used for a request it initiates and the next one it expects to see in
-   a request from the other end. These counters increment as requests
-   are generated and received. Responses always contain the same message
-   ID as the corresponding request. That means that after the initial
-   exchange, each integer n may appear as the message ID in four
-   distinct messages: The nth request from the original IKE initiator,
-   the corresponding response, the nth request from the original IKE
-   responder, and the corresponding response. If the two ends make very
-   different numbers of requests, the Message IDs in the two directions
-   can be very different. There is no ambiguity in the messages,
-   however, because the (I)nitiator and (R)esponse bits in the message
-   header specify which of the four messages a particular one is.
-
-   Note that Message IDs are cryptographically protected and provide
-   protection against message replays. In the unlikely event that
-   Message IDs grow too large to fit in 32 bits, the IKE_SA MUST be
-   closed. Rekeying an IKE_SA resets the sequence numbers.
-
-2.3 Window Size for overlapping requests
-
-   In order to maximize IKE throughput, an IKE endpoint MAY issue
-   multiple requests before getting a response to any of them if the
-   other endpoint has indicated its ability to handle such requests. For
-   simplicity, an IKE implementation MAY choose to process requests
-   strictly in order and/or wait for a response to one request before
-   issuing another. Certain rules must be followed to assure
-   interoperability between implementations using different strategies.
-
-   After an IKE_SA is set up, either end can initiate one or more
-   requests. These requests may pass one another over the network. An
-   IKE endpoint MUST be prepared to accept and process a request while
-   it has a request outstanding in order to avoid a deadlock in this
-   situation. An IKE endpoint SHOULD be prepared to accept and process
-   multiple requests while it has a request outstanding.
-
-   An IKE endpoint MUST wait for a response to each of its messages
-   before sending a subsequent message unless it has received a
-   SET_WINDOW_SIZE Notify message from its peer informing it that the
-   peer is prepared to maintain state for multiple outstanding messages
-   in order to allow greater throughput.
-
-   An IKE endpoint MUST NOT exceed the peer's stated window size for
-   transmitted IKE requests. In other words, if the responder stated its
-   window size is N, then when the initiator needs to make a request X,
-   it MUST wait until it has received responses to all requests up
-   through request X-N. An IKE endpoint MUST keep a copy of (or be able
-   to regenerate exactly) each request it has sent until it receives the
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 14]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   corresponding response. An IKE endpoint MUST keep a copy of (or be
-   able to regenerate exactly) the number of previous responses equal to
-   its declared window size in case its response was lost and the
-   initiator requests its retransmission by retransmitting the request.
-
-   An IKE endpoint supporting a window size greater than one SHOULD be
-   capable of processing incoming requests out of order to maximize
-   performance in the event of network failures or packet reordering.
-
-2.4 State Synchronization and Connection Timeouts
-
-   An IKE endpoint is allowed to forget all of its state associated with
-   an IKE_SA and the collection of corresponding CHILD_SAs at any time.
-   This is the anticipated behavior in the event of an endpoint crash
-   and restart. It is important when an endpoint either fails or
-   reinitializes its state that the other endpoint detect those
-   conditions and not continue to waste network bandwidth by sending
-   packets over discarded SAs and having them fall into a black hole.
-
-   Since IKE is designed to operate in spite of Denial of Service (DoS)
-   attacks from the network, an endpoint MUST NOT conclude that the
-   other endpoint has failed based on any routing information (e.g.,
-   ICMP messages) or IKE messages that arrive without cryptographic
-   protection (e.g., Notify messages complaining about unknown SPIs). An
-   endpoint MUST conclude that the other endpoint has failed only when
-   repeated attempts to contact it have gone unanswered for a timeout
-   period or when a cryptographically protected INITIAL_CONTACT
-   notification is received on a different IKE_SA to the same
-   authenticated identity. An endpoint SHOULD suspect that the other
-   endpoint has failed based on routing information and initiate a
-   request to see whether the other endpoint is alive. To check whether
-   the other side is alive, IKE specifies an empty INFORMATIONAL message
-   that (like all IKE requests) requires an acknowledgment (note that
-   within the context of an IKE_SA, an "empty" message consists of an
-   IKE header followed by an Encrypted payload that contains no
-   payloads). If a cryptographically protected message has been received
-   from the other side recently, unprotected notifications MAY be
-   ignored. Implementations MUST limit the rate at which they take
-   actions based on unprotected messages.
-
-   Numbers of retries and lengths of timeouts are not covered in this
-   specification because they do not affect interoperability. It is
-   suggested that messages be retransmitted at least a dozen times over
-   a period of at least several minutes before giving up on an SA, but
-   different environments may require different rules.  To be a good
-   network citizen, retranmission times MUST increase exponentially to
-   avoid flooding the network and making an existing congestion
-   situation worse.  If there has only been outgoing traffic on all of
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 15]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   the SAs associated with an IKE_SA, it is essential to confirm
-   liveness of the other endpoint to avoid black holes. If no
-   cryptographically protected messages have been received on an IKE_SA
-   or any of its CHILD_SAs recently, the system needs to perform a
-   liveness check in order to prevent sending messages to a dead peer.
-   Receipt of a fresh cryptographically protected message on an IKE_SA
-   or any of its CHILD_SAs assures liveness of the IKE_SA and all of its
-   CHILD_SAs. Note that this places requirements on the failure modes of
-   an IKE endpoint. An implementation MUST NOT continue sending on any
-   SA if some failure prevents it from receiving on all of the
-   associated SAs. If CHILD_SAs can fail independently from one another
-   without the associated IKE_SA being able to send a delete message,
-   then they MUST be negotiated by separate IKE_SAs.
-
-   There is a Denial of Service attack on the initiator of an IKE_SA
-   that can be avoided if the initiator takes the proper care. Since the
-   first two messages of an SA setup are not cryptographically
-   protected, an attacker could respond to the initiator's message
-   before the genuine responder and poison the connection setup attempt.
-   To prevent this, the initiator MAY be willing to accept multiple
-   responses to its first message, treat each as potentially legitimate,
-   respond to it, and then discard all the invalid half open connections
-   when it receives a valid cryptographically protected response to any
-   one of its requests.  Once a cryptographically valid response is
-   received, all subsequent responses should be ignored whether or not
-   they are cryptographically valid.
-
-   Note that with these rules, there is no reason to negotiate and agree
-   upon an SA lifetime. If IKE presumes the partner is dead, based on
-   repeated lack of acknowledgment to an IKE message, then the IKE SA
-   and all CHILD_SAs set up through that IKE_SA are deleted.
-
-   An IKE endpoint may at any time delete inactive CHILD_SAs to recover
-   resources used to hold their state. If an IKE endpoint chooses to
-   delete CHILD_SAs, it MUST send Delete payloads to the other end
-   notifying it of the deletion. It MAY similarly time out the IKE_SA.
-   Closing the IKE_SA implicitly closes all associated CHILD_SAs. In
-   this case, an IKE endpoint SHOULD send a Delete payload indicating
-   that it has closed the IKE_SA.
-
-2.5 Version Numbers and Forward Compatibility
-
-   This document describes version 2.0 of IKE, meaning the major version
-   number is 2 and the minor version number is zero. It is likely that
-   some implementations will want to support both version 1.0 and
-   version 2.0, and in the future, other versions.
-
-   The major version number should only be incremented if the packet
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 16]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   formats or required actions have changed so dramatically that an
-   older version node would not be able to interoperate with a newer
-   version node if it simply ignored the fields it did not understand
-   and took the actions specified in the older specification. The minor
-   version number indicates new capabilities, and MUST be ignored by a
-   node with a smaller minor version number, but used for informational
-   purposes by the node with the larger minor version number. For
-   example, it might indicate the ability to process a newly defined
-   notification message. The node with the larger minor version number
-   would simply note that its correspondent would not be able to
-   understand that message and therefore would not send it.
-
-   If an endpoint receives a message with a higher major version number,
-   it MUST drop the message and SHOULD send an unauthenticated
-   notification message containing the highest version number it
-   supports.  If an endpoint supports major version n, and major version
-   m, it MUST support all versions between n and m. If it receives a
-   message with a major version that it supports, it MUST respond with
-   that version number. In order to prevent two nodes from being tricked
-   into corresponding with a lower major version number than the maximum
-   that they both support, IKE has a flag that indicates that the node
-   is capable of speaking a higher major version number.
-
-   Thus the major version number in the IKE header indicates the version
-   number of the message, not the highest version number that the
-   transmitter supports. If the initiator is capable of speaking
-   versions n, n+1, and n+2, and the responder is capable of speaking
-   versions n and n+1, then they will negotiate speaking n+1, where the
-   initiator will set the flag indicating its ability to speak a higher
-   version. If they mistakenly (perhaps through an active attacker
-   sending error messages) negotiate to version n, then both will notice
-   that the other side can support a higher version number, and they
-   MUST break the connection and reconnect using version n+1.
-
-   Note that IKEv1 does not follow these rules, because there is no way
-   in v1 of noting that you are capable of speaking a higher version
-   number. So an active attacker can trick two v2-capable nodes into
-   speaking v1.  When a v2-capable node negotiates down to v1, it SHOULD
-   note that fact in its logs.
-
-   Also for forward compatibility, all fields marked RESERVED MUST be
-   set to zero by a version 2.0 implementation and their content MUST be
-   ignored by a version 2.0 implementation ("Be conservative in what you
-   send and liberal in what you receive"). In this way, future versions
-   of the protocol can use those fields in a way that is guaranteed to
-   be ignored by implementations that do not understand them.
-   Similarly, payload types that are not defined are reserved for future
-   use and implementations of version 2.0 MUST skip over those payloads
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 17]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   and ignore their contents.
-
-   IKEv2 adds a "critical" flag to each payload header for further
-   flexibility for forward compatibility. If the critical flag is set
-   and the payload type is unrecognized, the message MUST be rejected
-   and the response to the IKE request containing that payload MUST
-   include a Notify payload UNSUPPORTED_CRITICAL_PAYLOAD, indicating an
-   unsupported critical payload was included. If the critical flag is
-   not set and the payload type is unsupported, that payload MUST be
-   ignored.
-
-   While new payload types may be added in the future and may appear
-   interleaved with the fields defined in this specification,
-   implementations MUST send the payloads defined in this specification
-   in the order shown in the figures in section 2 and implementations
-   SHOULD reject as invalid a message with those payloads in any other
-   order.
-
-2.6 Cookies
-
-   The term "cookies" originates with Karn and Simpson [RFC2522] in
-   Photuris, an early proposal for key management with IPsec, and it has
-   persisted.  The ISAKMP fixed message header includes two eight octet
-   fields titled "cookies", and that syntax is used by both IKEv1 and
-   IKEv2 though in IKEv2 they are referred to as the IKE SPI and there
-   is a new separate field in a Notify payload holding the cookie. The
-   initial two eight octet fields in the header are used as a connection
-   identifier at the beginning of IKE packets. Each endpoint chooses one
-   of the two SPIs and SHOULD choose them so as to be unique identifiers
-   of an IKE_SA. An SPI value of zero is special and indicates that the
-   remote SPI value is not yet known by the sender.
-
-   Unlike ESP and AH where only the recipient's SPI appears in the
-   header of a message, in IKE the sender's SPI is also sent in every
-   message. Since the SPI chosen by the original initiator of the IKE_SA
-   is always sent first, an endpoint with multiple IKE_SAs open that
-   wants to find the appropriate IKE_SA using the SPI it assigned must
-   look at the I(nitiator) Flag bit in the header to determine whether
-   it assigned the first or the second eight octets.
-
-   In the first message of an initial IKE exchange, the initiator will
-   not know the responder's SPI value and will therefore set that field
-   to zero.
-
-   An expected attack against IKE is state and CPU exhaustion, where the
-   target is flooded with session initiation requests from forged IP
-   addresses. This attack can be made less effective if an
-   implementation of a responder uses minimal CPU and commits no state
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 18]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   to an SA until it knows the initiator can receive packets at the
-   address from which it claims to be sending them. To accomplish this,
-   a responder SHOULD - when it detects a large number of half-open
-   IKE_SAs - reject initial IKE messages unless they contain a Notify
-   payload of type COOKIE. It SHOULD instead send an unprotected IKE
-   message as a response and include COOKIE Notify payload with the
-   cookie data to be returned.  Initiators who receive such responses
-   MUST retry the IKE_SA_INIT with a Notify payload of type COOKIE
-   containing the responder supplied cookie data as the first payload
-   and all other payloads unchanged.  The initial exchange will then be
-   as follows:
-
-       Initiator                          Responder
-       -----------                        -----------
-       HDR(A,0), SAi1, KEi, Ni   -->
-
-                                 <-- HDR(A,0), N(COOKIE)
-
-       HDR(A,0), N(COOKIE), SAi1, KEi, Ni   -->
-
-                                 <-- HDR(A,B), SAr1, KEr, Nr, [CERTREQ]
-
-       HDR(A,B), SK {IDi, [CERT,] [CERTREQ,] [IDr,]
-           AUTH, SAi2, TSi, TSr} -->
-
-                                 <-- HDR(A,B), SK {IDr, [CERT,] AUTH,
-                                                SAr2, TSi, TSr}
-
-
-   The first two messages do not affect any initiator or responder state
-   except for communicating the cookie. In particular, the message
-   sequence numbers in the first four messages will all be zero and the
-   message sequence numbers in the last two messages will be one. 'A' is
-   the SPI assigned by the initiator, while 'B' is the SPI assigned by
-   the responder.
-
-   An IKE implementation SHOULD implement its responder cookie
-   generation in such a way as to not require any saved state to
-   recognize its valid cookie when the second IKE_SA_INIT message
-   arrives.  The exact algorithms and syntax they use to generate
-   cookies does not affect interoperability and hence is not specified
-   here. The following is an example of how an endpoint could use
-   cookies to implement limited DOS protection.
-
-   A good way to do this is to set the responder cookie to be:
-
-      Cookie = <VersionIDofSecret> | Hash(Ni | IPi | SPIi | <secret>)
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 19]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   where <secret> is a randomly generated secret known only to the
-   responder and periodically changed and | indicates concatenation.
-   <VersionIDofSecret> should be changed whenever <secret> is
-   regenerated.  The cookie can be recomputed when the IKE_SA_INIT
-   arrives the second time and compared to the cookie in the received
-   message. If it matches, the responder knows that SPIr was generated
-   since the last change to <secret> and that IPi must be the same as
-   the source address it saw the first time. Incorporating SPIi into the
-   calculation assures that if multiple IKE_SAs are being set up in
-   parallel they will all get different cookies (assuming the initiator
-   chooses unique SPIi's).  Incorporating Ni into the hash assures that
-   an attacker who sees only message 2 can't successfully forge a
-   message 3.
-
-   If a new value for <secret> is chosen while there are connections in
-   the process of being initialized, an IKE_SA_INIT might be returned
-   with other than the current <VersionIDofSecret>.  The responder in
-   that case MAY reject the message by sending another response with a
-   new cookie or it MAY keep the old value of <secret> around for a
-   short time and accept cookies computed from either one.  The
-   responder SHOULD NOT accept cookies indefinitely after <secret> is
-   changed, since that would defeat part of the denial of service
-   protection. The responder SHOULD change the value of <secret>
-   frequently, especially if under attack.
-
-2.7 Cryptographic Algorithm Negotiation
-
-   The payload type known as "SA" indicates a proposal for a set of
-   choices of IPsec protocols (IKE, ESP, and/or AH) for the SA as well
-   as cryptographic algorithms associated with each protocol.
-
-   An SA payload consists of one or more proposals. Each proposal
-   includes one or more protocols (usually one). Each protocol contains
-   one or more transforms - each specifying a cryptographic algorithm.
-   Each transform contains zero or more attributes (attributes are only
-   needed if the transform identifier does not completely specify the
-   cryptographic algorithm).
-
-   This hierarchical structure was designed to efficiently encode
-   proposals for cryptographic suites when the number of supported
-   suites is large because multiple values are acceptable for multiple
-   transforms. The responder MUST choose a single suite, which MAY be
-   any subset of the SA proposal following the rules below:
-
-
-      Each proposal contains one or more protocols. If a proposal is
-      accepted, the SA response MUST contain the same protocols in the
-      same order as the proposal. The responder MUST accept a single
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 20]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-      proposal or reject them all and return an error. (Example: if a
-      single proposal contains ESP and AH and that proposal is accepted,
-      both ESP and AH MUST be accepted. If ESP and AH are included in
-      separate proposals, the responder MUST accept only one of them).
-
-      Each IPsec protocol proposal contains one or more transforms. Each
-      transform contains a transform type. The accepted cryptographic
-      suite MUST contain exactly one transform of each type included in
-      the proposal. For example: if an ESP proposal includes transforms
-      ENCR_3DES, ENCR_AES w/keysize 128, ENCR_AES w/keysize 256,
-      AUTH_HMAC_MD5, and AUTH_HMAC_SHA, the accepted suite MUST contain
-      one of the ENCR_ transforms and one of the AUTH_ transforms. Thus
-      six combinations are acceptable.
-
-   Since the initiator sends its Diffie-Hellman value in the
-   IKE_SA_INIT, it must guess the Diffie-Hellman group that the
-   responder will select from its list of supported groups.  If the
-   initiator guesses wrong, the responder will respond with a Notify
-   payload of type INVALID_KE_PAYLOAD indicating the selected group.  In
-   this case, the initiator MUST retry the IKE_SA_INIT with the
-   corrected Diffie-Hellman group. The initiator MUST again propose its
-   full set of acceptable cryptographic suites because the rejection
-   message was unauthenticated and otherwise an active attacker could
-   trick the endpoints into negotiating a weaker suite than a stronger
-   one that they both prefer.
-
-2.8 Rekeying
-
-   IKE, ESP, and AH security associations use secret keys which SHOULD
-   only be used for a limited amount of time and to protect a limited
-   amount of data. This limits the lifetime of the entire security
-   association. When the lifetime of a security association expires the
-   security association MUST NOT be used.  If there is demand, new
-   security associations MAY be established.  Reestablishment of
-   security associations to take the place of ones which expire is
-   referred to as "rekeying".
-
-   To allow for minimal IPsec implementations, the ability to rekey SAs
-   without restarting the entire IKE_SA is optional. An implementation
-   MAY refuse all CREATE_CHILD_SA requests within an IKE_SA. If an SA
-   has expired or is about to expire and rekeying attempts using the
-   mechanisms described here fail, an implementation MUST close the
-   IKE_SA and any associated CHILD_SAs and then MAY start new ones.
-   Implementations SHOULD support in place rekeying of SAs, since doing
-   so offers better performance and is likely to reduce the number of
-   packets lost during the transition.
-
-   To rekey a CHILD_SA within an existing IKE_SA, create a new,
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 21]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   equivalent SA (see section 2.17 below), and when the new one is
-   established, delete the old one.  To rekey an IKE_SA, establish a new
-   equivalent IKE_SA (see section 2.18 below) with the peer to whom the
-   old IKE_SA is shared using a CREATE_CHILD_SA within the existing
-   IKE_SA. An IKE_SA so created inherits all of the original IKE_SA's
-   CHILD_SAs.  Use the new IKE_SA for all control messages needed to
-   maintain the CHILD_SAs created by the old IKE_SA, and delete the old
-   IKE_SA. The Delete payload to delete itself MUST be the last request
-   sent over an IKE_SA.
-
-   SAs SHOULD be rekeyed proactively, i.e., the new SA should be
-   established before the old one expires and becomes unusable. Enough
-   time should elapse between the time the new SA is established and the
-   old one becomes unusable so that traffic can be switched over to the
-   new SA.
-
-   A difference between IKEv1 and IKEv2 is that in IKEv1 SA lifetimes
-   were negotiated. In IKEv2, each end of the SA is responsible for
-   enforcing its own lifetime policy on the SA and rekeying the SA when
-   necessary.  If the two ends have different lifetime policies, the end
-   with the shorter lifetime will end up always being the one to request
-   the rekeying.  If an SA bundle has been inactive for a long time and
-   if an endpoint would not initiate the SA in the absence of traffic,
-   the endpoint MAY choose to close the SA instead of rekeying it when
-   its lifetime expires. It SHOULD do so if there has been no traffic
-   since the last time the SA was rekeyed.
-
-   If the two ends have the same lifetime policies, it is possible that
-   both will initiate a rekeying at the same time (which will result in
-   redundant SAs). To reduce the probability of this happening, the
-   timing of rekeying requests SHOULD be jittered (delayed by a random
-   amount of time after the need for rekeying is noticed).
-
-   This form of rekeying may temporarily result in multiple similar SAs
-   between the same pairs of nodes. When there are two SAs eligible to
-   receive packets, a node MUST accept incoming packets through either
-   SA. If redundant SAs are created though such a collision, the SA
-   created with the lowest of the four nonces used in the two exchanges
-   SHOULD be closed by the endpoint that created it.
-
-   Note that IKEv2 deliberately allows parallel SAs with the same
-   traffic selectors between common endpoints. One of the purposes of
-   this is to support traffic QoS differences among the SAs (see section
-   4.1 of [RFC2983]). Hence unlike IKEv1, the combination of the
-   endpoints and the traffic selectors may not uniquely identify an SA
-   between those endpoints, so the IKEv1 rekeying heuristic of deleting
-   SAs on the basis of duplicate traffic selectors SHOULD NOT be used.
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 22]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   The node that initiated the surviving rekeyed SA SHOULD delete the
-   replaced SA after the new one is established.
-
-   There are timing windows - particularly in the presence of lost
-   packets - where endpoints may not agree on the state of an SA. The
-   responder to a CREATE_CHILD_SA MUST be prepared to accept messages on
-   an SA before sending its response to the creation request, so there
-   is no ambiguity for the initiator. The initiator MAY begin sending on
-   an SA as soon as it processes the response. The initiator, however,
-   cannot receive on a newly created SA until it receives and processes
-   the response to its CREATE_CHILD_SA request. How, then, is the
-   responder to know when it is OK to send on the newly created SA?
-
-   From a technical correctness and interoperability perspective, the
-   responder MAY begin sending on an SA as soon as it sends its response
-   to the CREATE_CHILD_SA request. In some situations, however, this
-   could result in packets unnecessarily being dropped, so an
-   implementation MAY want to defer such sending.
-
-   The responder can be assured that the initiator is prepared to
-   receive messages on an SA if either (1) it has received a
-   cryptographically valid message on the new SA, or (2) the new SA
-   rekeys an existing SA and it receives an IKE request to close the
-   replaced SA. When rekeying an SA, the responder SHOULD continue to
-   send requests on the old SA until it one of those events occurs. When
-   establishing a new SA, the responder MAY defer sending messages on a
-   new SA until either it receives one or a timeout has occurred. If an
-   initiator receives a message on an SA for which it has not received a
-   response to its CREATE_CHILD_SA request, it SHOULD interpret that as
-   a likely packet loss and retransmit the CREATE_CHILD_SA request. An
-   initiator MAY send a dummy message on a newly created SA if it has no
-   messages queued in order to assure the responder that the initiator
-   is ready to receive messages.
-
-2.9 Traffic Selector Negotiation
-
-   When an IP packet is received by an RFC2401 compliant IPsec subsystem
-   and matches a "protect" selector in its SPD, the subsystem MUST
-   protect that packet with IPsec. When no SA exists yet it is the task
-   of IKE to create it. Maintenance of a system's SPD is outside the
-   scope of IKE (see [PFKEY] for an example protocol), though some
-   implementations might update their SPD in connection with the running
-   of IKE (for an example scenario, see section 1.1.3).
-
-   Traffic Selector (TS) payloads allow endpoints to communicate some of
-   the information from their SPD to their peers. TS payloads specify
-   the selection criteria for packets that will be forwarded over the
-   newly set up SA.  This can serve as a consistency check in some
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 23]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   scenarios to assure that the SPDs are consistent. In others, it
-   guides the dynamic update of the SPD.
-
-   Two TS payloads appear in each of the messages in the exchange that
-   creates a CHILD_SA pair. Each TS payload contains one or more Traffic
-   Selectors. Each Traffic Selector consists of an address range (IPv4
-   or IPv6), a port range, and an IP protocol ID. In support of the
-   scenario described in section 1.1.3, an initiator may request that
-   the responder assign an IP address and tell the initiator what it is.
-
-   IKEv2 allows the responder to choose a subset of the traffic proposed
-   by the initiator.  This could happen when the configuration of the
-   two endpoints are being updated but only one end has received the new
-   information.  Since the two endpoints may be configured by different
-   people, the incompatibility may persist for an extended period even
-   in the absence of errors. It also allows for intentionally different
-   configurations, as when one end is configured to tunnel all addresses
-   and depends on the other end to have the up to date list.
-
-   The first of the two TS payloads is known as TSi (Traffic Selector-
-   initiator).  The second is known as TSr (Traffic Selector-responder).
-   TSi specifies the source address of traffic forwarded from (or the
-   destination address of traffic forwarded to) the initiator of the
-   CHILD_SA pair. TSr specifies the destination address of the traffic
-   forwarded from (or the source address of the traffic forwarded to)
-   the responder of the CHILD_SA pair.  For example, if the original
-   initiator request the creation of a CHILD_SA pair, and wishes to
-   tunnel all traffic from subnet 192.0.1.* on the initiator's side to
-   subnet 192.0.2.* on the responder's side, the initiator would include
-   a single traffic selector in each TS payload. TSi would specify the
-   address range (192.0.1.0 - 192.0.1.255) and TSr would specify the
-   address range (192.0.2.0 - 192.0.2.255). Assuming that proposal was
-   acceptable to the responder, it would send identical TS payloads
-   back. [Note: the IP address range 192.0.1.* has been reserved for use
-   in examples in RFCs and similar documents. This document needed two
-   such ranges, and so also used 192.0.2.*. This should not be confused
-   with any actual address].
-
-   The responder is allowed to narrow the choices by selecting a subset
-   of the traffic, for instance by eliminating or narrowing the range of
-   one or more members of the set of traffic selectors, provided the set
-   does not become the NULL set.
-
-   It is possible for the responder's policy to contain multiple smaller
-   ranges, all encompassed by the initiator's traffic selector, and with
-   the responder's policy being that each of those ranges should be sent
-   over a different SA. Continuing the example above, the responder
-   might have a policy of being willing to tunnel those addresses to and
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 24]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   from the initiator, but might require that each address pair be on a
-   separately negotiated CHILD_SA. If the initiator generated its
-   request in response to an incoming packet from 192.0.1.43 to
-   192.0.2.123, there would be no way for the responder to determine
-   which pair of addresses should be included in this tunnel, and it
-   would have to make a guess or reject the request with a status of
-   SINGLE_PAIR_REQUIRED.
-
-   To enable the responder to choose the appropriate range in this case,
-   if the initiator has requested the SA due to a data packet, the
-   initiator SHOULD include as the first traffic selector in each of TSi
-   and TSr a very specific traffic selector including the addresses in
-   the packet triggering the request. In the example, the initiator
-   would include in TSi two traffic selectors: the first containing the
-   address range (192.0.1.43 - 192.0.1.43) and the source port and IP
-   protocol from the packet and the second containing (192.0.1.0 -
-   192.0.1.255) with all ports and IP protocols. The initiator would
-   similarly include two traffic selectors in TSr.
-
-   If the responder's policy does not allow it to accept the entire set
-   of traffic selectors in the initiator's request, but does allow him
-   to accept the first selector of TSi and TSr, then the responder MUST
-   narrow the traffic selectors to a subset that includes the
-   initiator's first choices. In this example, the responder might
-   respond with TSi being (192.0.1.43 - 192.0.1.43) with all ports and
-   IP protocols.
-
-   If the initiator creates the CHILD_SA pair not in response to an
-   arriving packet, but rather - say - upon startup, then there may be
-   no specific addresses the initiator prefers for the initial tunnel
-   over any other.  In that case, the first values in TSi and TSr MAY be
-   ranges rather than specific values, and the responder chooses a
-   subset of the initiator's TSi and TSr that are acceptable. If more
-   than one subset is acceptable but their union is not, the responder
-   MUST accept some subset and MAY include a Notify payload of type
-   ADDITIONAL_TS_POSSIBLE to indicate that the initiator might want to
-   try again. This case will only occur when the initiator and responder
-   are configured differently from one another. If the initiator and
-   responder agree on the granularity of tunnels, the initiator will
-   never request a tunnel wider than the responder will accept.  Such
-   misconfigurations SHOULD be recorded in error logs.
-
-2.10 Nonces
-
-   The IKE_SA_INIT messages each contain a nonce. These nonces are used
-   as inputs to cryptographic functions.  The CREATE_CHILD_SA request
-   and the CREATE_CHILD_SA response also contain nonces. These nonces
-   are used to add freshness to the key derivation technique used to
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 25]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   obtain keys for CHILD_SA, and to ensure creation of strong
-   pseudorandom bits from the Diffie-Hellman key. Nonces used in IKEv2
-   MUST be randomly chosen, MUST be at least 128 bits in size, and MUST
-   be at least half the key size of the negotiated prf. ("prf" refers to
-   "pseudo-random function", one of the cryptographic algorithms
-   negotiated in the IKE exchange). If the same random number source is
-   used for both keys and nonces, care must be taken to ensure that the
-   latter use does not compromise the former.
-
-2.11 Address and Port Agility
-
-   IKE runs over UDP ports 500 and 4500, and implicitly sets up ESP and
-   AH associations for the same IP addresses it runs over. The IP
-   addresses and ports in the outer header are, however, not themselves
-   cryptographically protected, and IKE is designed to work even through
-   Network Address Translation (NAT) boxes. An implementation MUST
-   accept incoming requests even if the source port is not 500 or 4500,
-   and MUST respond to the address and port from which the request was
-   received. It MUST specify the address and port at which the request
-   was received as the source address and port in the response.  IKE
-   functions identically over IPv4 or IPv6.
-
-2.12 Reuse of Diffie-Hellman Exponentials
-
-   IKE generates keying material using an ephemeral Diffie-Hellman
-   exchange in order to gain the property of "perfect forward secrecy".
-   This means that once a connection is closed and its corresponding
-   keys are forgotten, even someone who has recorded all of the data
-   from the connection and gets access to all of the long-term keys of
-   the two endpoints cannot reconstruct the keys used to protect the
-   conversation without doing a brute force search of the session key
-   space.
-
-   Achieving perfect forward secrecy requires that when a connection is
-   closed, each endpoint MUST forget not only the keys used by the
-   connection but any information that could be used to recompute those
-   keys. In particular, it MUST forget the secrets used in the Diffie-
-   Hellman calculation and any state that may persist in the state of a
-   pseudo-random number generator that could be used to recompute the
-   Diffie-Hellman secrets.
-
-   Since the computing of Diffie-Hellman exponentials is computationally
-   expensive, an endpoint may find it advantageous to reuse those
-   exponentials for multiple connection setups. There are several
-   reasonable strategies for doing this. An endpoint could choose a new
-   exponential only periodically though this could result in less-than-
-   perfect forward secrecy if some connection lasts for less than the
-   lifetime of the exponential. Or it could keep track of which
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 26]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   exponential was used for each connection and delete the information
-   associated with the exponential only when some corresponding
-   connection was closed. This would allow the exponential to be reused
-   without losing perfect forward secrecy at the cost of maintaining
-   more state.
-
-   Decisions as to whether and when to reuse Diffie-Hellman exponentials
-   is a private decision in the sense that it will not affect
-   interoperability.  An implementation that reuses exponentials MAY
-   choose to remember the exponential used by the other endpoint on past
-   exchanges and if one is reused to avoid the second half of the
-   calculation.
-
-2.13 Generating Keying Material
-
-   In the context of the IKE_SA, four cryptographic algorithms are
-   negotiated: an encryption algorithm, an integrity protection
-   algorithm, a Diffie-Hellman group, and a pseudo-random function
-   (prf). The pseudo-random function is used for the construction of
-   keying material for all of the cryptographic algorithms used in both
-   the IKE_SA and the CHILD_SAs.
-
-   We assume that each encryption algorithm and integrity protection
-   algorithm uses a fixed size key, and that any randomly chosen value
-   of that fixed size can serve as an appropriate key. For algorithms
-   that accept a variable length key, a fixed key size MUST be specified
-   as part of the cryptographic transform negotiated.  For algorithms
-   for which not all values are valid keys (such as DES or 3DES with key
-   parity), they algorithm by which keys are derived from arbitrary
-   values MUST be specified by the cryptographic transform.  For
-   integrity protection functions based on HMAC, the fixed key size is
-   the size of the output of the underlying hash function. When the prf
-   function takes a variable length key, variable length data, and
-   produces a fixed length output (e.g., when using HMAC), the formulas
-   in this document apply. When the key for the prf function has fixed
-   length, the data provided as a key is truncated or padded with zeros
-   as necessary unless exceptional processing is explained following the
-   formula.
-
-   Keying material will always be derived as the output of the
-   negotiated prf algorithm. Since the amount of keying material needed
-   may be greater than the size of the output of the prf algorithm, we
-   will use the prf iteratively.  We will use the terminology prf+ to
-   describe the function that outputs a pseudo-random stream based on
-   the inputs to a prf as follows: (where | indicates concatenation)
-
-   prf+ (K,S) = T1 | T2 | T3 | T4 | ...
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 27]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   where:
-   T1 = prf (K, S | 0x01)
-   T2 = prf (K, T1 | S | 0x02)
-   T3 = prf (K, T2 | S | 0x03)
-   T4 = prf (K, T3 | S | 0x04)
-
-   continuing as needed to compute all required keys. The keys are taken
-   from the output string without regard to boundaries (e.g., if the
-   required keys are a 256 bit AES key and a 160 bit HMAC key, and the
-   prf function generates 160 bits, the AES key will come from T1 and
-   the beginning of T2, while the HMAC key will come from the rest of T2
-   and the beginning of T3).
-
-   The constant concatenated to the end of each string feeding the prf
-   is a single octet. prf+ in this document is not defined beyond 255
-   times the size of the prf output.
-
-2.14 Generating Keying Material for the IKE_SA
-
-   The shared keys are computed as follows.  A quantity called SKEYSEED
-   is calculated from the nonces exchanged during the IKE_SA_INIT
-   exchange and the Diffie-Hellman shared secret established during that
-   exchange.  SKEYSEED is used to calculate seven other secrets: SK_d
-   used for deriving new keys for the CHILD_SAs established with this
-   IKE_SA; SK_ai and SK_ar used as a key to the integrity protection
-   algorithm for authenticating the component messages of subsequent
-   exchanges; SK_ei and SK_er used for encrypting (and of course
-   decrypting) all subsequent exchanges; and SK_pi and SK_pr which are
-   used when generating an AUTH payload.
-
-   SKEYSEED and its derivatives are computed as follows:
-
-       SKEYSEED = prf(Ni | Nr, g^ir)
-
-       {SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr }
-                 = prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr )
-
-   (indicating that the quantities SK_d, SK_ai, SK_ar, SK_ei, SK_er,
-   SK_pi, and SK_pr are taken in order from the generated bits of the
-   prf+).  g^ir is the shared secret from the ephemeral Diffie-Hellman
-   exchange.  g^ir is represented as a string of octets in big endian
-   order padded with zeros if necessary to make it the length of the
-   modulus. Ni and Nr are the nonces, stripped of any headers. If the
-   negotiated prf takes a fixed length key and the lengths of Ni and Nr
-   do not add up to that length, half the bits must come from Ni and
-   half from Nr, taking the first bits of each.
-
-   The two directions of traffic flow use different keys. The keys used
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 28]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   to protect messages from the original initiator are SK_ai and SK_ei.
-   The keys used to protect messages in the other direction are SK_ar
-   and SK_er. Each algorithm takes a fixed number of bits of keying
-   material, which is specified as part of the algorithm.  For integrity
-   algorithms based on a keyed hash, the key size is always equal to the
-   length of the output of the underlying hash function.
-
-2.15 Authentication of the IKE_SA
-
-   When not using extensible authentication (see section 2.16), the
-   peers are authenticated by having each sign (or MAC using a shared
-   secret as the key) a block of data.  For the responder, the octets to
-   be signed start with the first octet of the first SPI in the header
-   of the second message and end with the last octet of the last payload
-   in the second message.  Appended to this (for purposes of computing
-   the signature) are the initiator's nonce Ni (just the value, not the
-   payload containing it), and the value prf(SK_pr,IDr') where IDr' is
-   the responder's ID payload excluding the fixed header. Note that
-   neither the nonce Ni nor the value prf(SK_pr,IDr') are transmitted.
-   Similarly, the initiator signs the first message, starting with the
-   first octet of the first SPI in the header and ending with the last
-   octet of the last payload.  Appended to this (for purposes of
-   computing the signature) are the responder's nonce Nr, and the value
-   prf(SK_pi,IDi'). In the above calculation, IDi' and IDr' are the
-   entire ID payloads excluding the fixed header.  It is critical to the
-   security of the exchange that each side sign the other side's nonce.
-
-   Note that all of the payloads are included under the signature,
-   including any payload types not defined in this document. If the
-   first message of the exchange is sent twice (the second time with a
-   responder cookie and/or a different Diffie-Hellman group), it is the
-   second version of the message that is signed.
-
-   Optionally, messages 3 and 4 MAY include a certificate, or
-   certificate chain providing evidence that the key used to compute a
-   digital signature belongs to the name in the ID payload. The
-   signature or MAC will be computed using algorithms dictated by the
-   type of key used by the signer, and specified by the Auth Method
-   field in the Authentication payload.  There is no requirement that
-   the initiator and responder sign with the same cryptographic
-   algorithms. The choice of cryptographic algorithms depends on the
-   type of key each has.  In particular, the initiator may be using a
-   shared key while the responder may have a public signature key and
-   certificate.  It will commonly be the case (but it is not required)
-   that if a shared secret is used for authentication that the same key
-   is used in both directions.  Note that it is a common but typically
-   insecure practice to have a shared key derived solely from a user
-   chosen password without incorporating another source of randomness.
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 29]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   This is typically insecure because user chosen passwords are unlikely
-   to have sufficient unpredictability to resist dictionary attacks and
-   these attacks are not prevented in this authentication method.
-   (Applications using password-based authentication for bootstrapping
-   and IKE_SA should use the authentication method in section 2.16,
-   which is designed to prevent off-line dictionary attacks).  The pre-
-   shared key SHOULD contain as much unpredictability as the strongest
-   key being negotiated.  In the case of a pre-shared key, the AUTH
-   value is computed as:
-
-      AUTH = prf(prf(Shared Secret,"Key Pad for IKEv2"), <msg octets>)
-
-   where the string "Key Pad for IKEv2" is 17 ASCII characters without
-   null termination. The shared secret can be variable length. The pad
-   string is added so that if the shared secret is derived from a
-   password, the IKE implementation need not store the password in
-   cleartext, but rather can store the value prf(Shared Secret,"Key Pad
-   for IKEv2"), which could not be used as a password equivalent for
-   protocols other than IKEv2.  As noted above, deriving the shared
-   secret from a password is not secure.  This construction is used
-   because it is anticipated that people will do it anyway. The
-   management interface by which the Shared Secret is provided MUST
-   accept ASCII strings of at least 64 octets and MUST NOT add a null
-   terminator before using them as shared secrets. It MUST also accept a
-   HEX encoding of the Shared Secret. The management interface MAY
-   accept other encodings if the algorithm for translating the encoding
-   to a binary string is specified. If the negotiated prf takes a fixed
-   size key, the shared secret MUST be of that fixed size.
-
-2.16 Extensible Authentication Protocol Methods
-
-   In addition to authentication using public key signatures and shared
-   secrets, IKE supports authentication using methods defined in RFC
-   3748 [EAP]. Typically, these methods are asymmetric (designed for a
-   user authenticating to a server), and they may not be mutual. For
-   this reason, these protocols are typically used to authenticate the
-   initiator to the responder and MUST be used in conjunction with a
-   public key signature based authentication of the responder to the
-   initiator. These methods are often associated with mechanisms
-   referred to as "Legacy Authentication" mechanisms.
-
-   While this memo references [EAP] with the intent that new methods can
-   be added in the future without updating this specification, some
-   simpler variations are documented here and in section 3.16.  [EAP]
-   defines an authentication protocol requiring a variable number of
-   messages. Extensible Authentication is implemented in IKE as
-   additional IKE_AUTH exchanges that MUST be completed in order to
-   initialize the IKE_SA.
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 30]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   An initiator indicates a desire to use extensible authentication by
-   leaving out the AUTH payload from message 3. By including an IDi
-   payload but not an AUTH payload, the initiator has declared an
-   identity but has not proven it. If the responder is willing to use an
-   extensible authentication method, it will place an EAP payload in
-   message 4 and defer sending SAr2, TSi, and TSr until initiator
-   authentication is complete in a subsequent IKE_AUTH exchange. In the
-   case of a minimal extensible authentication, the initial SA
-   establishment will appear as follows:
-
-       Initiator                          Responder
-      -----------                        -----------
-       HDR, SAi1, KEi, Ni         -->
-
-                                  <--    HDR, SAr1, KEr, Nr, [CERTREQ]
-
-       HDR, SK {IDi, [CERTREQ,] [IDr,]
-                SAi2, TSi, TSr}   -->
-
-                                  <--    HDR, SK {IDr, [CERT,] AUTH,
-                                                EAP }
-
-       HDR, SK {EAP}              -->
-
-                                  <--    HDR, SK {EAP (success)}
-
-       HDR, SK {AUTH}             -->
-
-                                  <--    HDR, SK {AUTH, SAr2, TSi, TSr }
-
-   For EAP methods that create a shared key as a side effect of
-   authentication, that shared key MUST be used by both the initiator
-   and responder to generate AUTH payloads in messages 5 and 6 using the
-   syntax for shared secrets specified in section 2.15. The shared key
-   from EAP is the field from the EAP specification named MSK. The
-   shared key generated during an IKE exchange MUST NOT be used for any
-   other purpose.
-
-   EAP methods that do not establish a shared key SHOULD NOT be used, as
-   they are subject to a number of man-in-the-middle attacks [EAPMITM]
-   if these EAP methods are used in other protocols that do not use a
-   server-authenticated tunnel.  Please see the Security Considerations
-   section for more details. If EAP methods that do not generate a
-   shared key are used, the AUTH payloads in messages 7 and 8 MUST be
-   generated using SK_pi and SK_pr respectively.
-
-   The initiator of an IKE_SA using EAP SHOULD be capable of extending
-   the initial protocol exchange to at least ten IKE_AUTH exchanges in
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 31]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   the event the responder sends notification messages and/or retries
-   the authentication prompt.  Once the protocol exchange defined by the
-   chosen EAP authentication method has successfully terminated, the
-   responder MUST send an EAP payload containing the Success message.
-   Similarly, if the authentication method has failed, the responder
-   MUST send an EAP payload containing the Failure message. The
-   responder MAY at any time terminate the IKE exchange by sending an
-   EAP payload containing the Failure message.
-
-   Following such an extended exchange, the EAP AUTH payloads MUST be
-   included in the two messages following the one containing the EAP
-   Success message.
-
-2.17 Generating Keying Material for CHILD_SAs
-
-   CHILD_SAs are created either by being piggybacked on the IKE_AUTH
-   exchange, or in a CREATE_CHILD_SA exchange. Keying material for them
-   is generated as follows:
-
-      KEYMAT = prf+(SK_d, Ni | Nr)
-
-   Where Ni and Nr are the Nonces from the IKE_SA_INIT exchange if this
-   request is the first CHILD_SA created or the fresh Ni and Nr from the
-   CREATE_CHILD_SA exchange if this is a subsequent creation.
-
-   For CREATE_CHILD_SA exchanges including an optional Diffie-Hellman
-   exchange, the keying material is defined as:
-
-      KEYMAT = prf+(SK_d, g^ir (new) | Ni | Nr )
-
-   where g^ir (new) is the shared secret from the ephemeral Diffie-
-   Hellman exchange of this CREATE_CHILD_SA exchange (represented as an
-   octet string in big endian order padded with zeros in the high order
-   bits if necessary to make it the length of the modulus).
-
-   A single CHILD_SA negotiation may result in multiple security
-   associations. ESP and AH SAs exist in pairs (one in each direction),
-   and four SAs could be created in a single CHILD_SA negotiation if a
-   combination of ESP and AH is being negotiated.
-
-   Keying material MUST be taken from the expanded KEYMAT in the
-   following order:
-
-      All keys for SAs carrying data from the initiator to the responder
-      are taken before SAs going in the reverse direction.
-
-      If multiple IPsec protocols are negotiated, keying material is
-      taken in the order in which the protocol headers will appear in
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 32]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-      the encapsulated packet.
-
-      If a single protocol has both encryption and authentication keys,
-      the encryption key is taken from the first octets of KEYMAT and
-      the authentication key is taken from the next octets.
-
-   Each cryptographic algorithm takes a fixed number of bits of keying
-   material specified as part of the algorithm.
-
-2.18 Rekeying IKE_SAs using a CREATE_CHILD_SA exchange
-
-   The CREATE_CHILD_SA exchange can be used to rekey an existing IKE_SA
-   (see section 2.8).  New initiator and responder SPIs are supplied in
-   the SPI fields. The TS payloads are omitted when rekeying an IKE_SA.
-   SKEYSEED for the new IKE_SA is computed using SK_d from the existing
-   IKE_SA as follows:
-
-       SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)
-
-   where g^ir (new) is the shared secret from the ephemeral Diffie-
-   Hellman exchange of this CREATE_CHILD_SA exchange (represented as an
-   octet string in big endian order padded with zeros if necessary to
-   make it the length of the modulus) and Ni and Nr are the two nonces
-   stripped of any headers.
-
-   The new IKE_SA MUST reset its message counters to 0.
-
-   SK_d, SK_ai, SK_ar, and SK_ei, and SK_er are computed from SKEYSEED
-   as specified in section 2.14.
-
-2.19 Requesting an internal address on a remote network
-
-   Most commonly occurring in the endpoint to security gateway scenario,
-   an endpoint may need an IP address in the network protected by the
-   security gateway, and may need to have that address dynamically
-   assigned. A request for such a temporary address can be included in
-   any request to create a CHILD_SA (including the implicit request in
-   message 3) by including a CP payload.
-
-   This function provides address allocation to an IRAC (IPsec Remote
-   Access Client) trying to tunnel into a network protected by an IRAS
-   (IPsec Remote Access Server).  Since the IKE_AUTH exchange creates an
-   IKE_SA and a CHILD_SA, the IRAC MUST request the IRAS controlled
-   address (and optionally other information concerning the protected
-   network) in the IKE_AUTH exchange.  The IRAS may procure an address
-   for the IRAC from any number of sources such as a DHCP/BOOTP server
-   or its own address pool.
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 33]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-       Initiator                           Responder
-      -----------------------------       ---------------------------
-       HDR, SK {IDi, [CERT,] [CERTREQ,]
-        [IDr,] AUTH, CP(CFG_REQUEST),
-        SAi2, TSi, TSr}              -->
-
-                                     <--   HDR, SK {IDr, [CERT,] AUTH,
-                                            CP(CFG_REPLY), SAr2,
-                                            TSi, TSr}
-
-   In all cases, the CP payload MUST be inserted before the SA payload.
-   In variations of the protocol where there are multiple IKE_AUTH
-   exchanges, the CP payloads MUST be inserted in the messages
-   containing the SA payloads.
-
-   CP(CFG_REQUEST) MUST contain at least an INTERNAL_ADDRESS attribute
-   (either IPv4 or IPv6) but MAY contain any number of additional
-   attributes the initiator wants returned in the response.
-
-   For example, message from initiator to responder:
-      CP(CFG_REQUEST)=
-        INTERNAL_ADDRESS(0.0.0.0)
-        INTERNAL_NETMASK(0.0.0.0)
-        INTERNAL_DNS(0.0.0.0)
-      TSi = (0, 0-65536,0.0.0.0-255.255.255.255)
-      TSr = (0, 0-65536,0.0.0.0-255.255.255.255)
-
-   NOTE: Traffic Selectors contain (protocol, port range, address range)
-
-   Message from responder to initiator:
-
-      CP(CFG_REPLY)=
-        INTERNAL_ADDRESS(192.0.2.202)
-        INTERNAL_NETMASK(255.255.255.0)
-        INTERNAL_SUBNET(192.0.2.0/255.255.255.0)
-      TSi = (0, 0-65536,192.0.2.202-192.0.2.202)
-      TSr = (0, 0-65536,192.0.2.0-192.0.2.255)
-
-   All returned values will be implementation dependent.  As can be seen
-   in the above example, the IRAS MAY also send other attributes that
-   were not included in CP(CFG_REQUEST) and MAY ignore the non-
-   mandatory attributes that it does not support.
-
-   The responder MUST NOT send a CFG_REPLY without having first received
-   a CP(CFG_REQUEST) from the initiator, because we do not want the IRAS
-   to perform an unnecessary configuration lookup if the IRAC cannot
-   process the REPLY. In the case where the IRAS's configuration
-   requires that CP be used for a given identity IDi, but IRAC has
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 34]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   failed to send a CP(CFG_REQUEST), IRAS MUST fail the request, and
-   terminate the IKE exchange with a FAILED_CP_REQUIRED error.
-
-2.20 Requesting the Peer's Version
-
-   An IKE peer wishing to inquire about the other peer's IKE software
-   version information MAY use the method below.  This is an example of
-   a configuration request within an INFORMATIONAL Exchange, after the
-   IKE_SA and first CHILD_SA have been created.
-
-   An IKE implementation MAY decline to give out version information
-   prior to authentication or even after authentication to prevent
-   trolling in case some implementation is known to have some security
-   weakness. In that case, it MUST either return an empty string or no
-   CP payload if CP is not supported.
-
-       Initiator                           Responder
-      -----------------------------       --------------------------
-      HDR, SK{CP(CFG_REQUEST)}      -->
-                                    <--    HDR, SK{CP(CFG_REPLY)}
-
-      CP(CFG_REQUEST)=
-        APPLICATION_VERSION("")
-
-      CP(CFG_REPLY)
-        APPLICATION_VERSION("foobar v1.3beta, (c) Foo Bar Inc.")
-
-2.21 Error Handling
-
-   There are many kinds of errors that can occur during IKE processing.
-   If a request is received that is badly formatted or unacceptable for
-   reasons of policy (e.g., no matching cryptographic algorithms), the
-   response MUST contain a Notify payload indicating the error. If an
-   error occurs outside the context of an IKE request (e.g., the node is
-   getting ESP messages on a nonexistent SPI), the node SHOULD initiate
-   an INFORMATIONAL Exchange with a Notify payload describing the
-   problem.
-
-   Errors that occur before a cryptographically protected IKE_SA is
-   established must be handled very carefully. There is a trade-off
-   between wanting to be helpful in diagnosing a problem and responding
-   to it and wanting to avoid being a dupe in a denial of service attack
-   based on forged messages.
-
-   If a node receives a message on UDP port 500 or 4500 outside the
-   context of an IKE_SA known to it (and not a request to start one), it
-   may be the result of a recent crash of the node.  If the message is
-   marked as a response, the node MAY audit the suspicious event but
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 35]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   MUST NOT respond. If the message is marked as a request, the node MAY
-   audit the suspicious event and MAY send a response. If a response is
-   sent, the response MUST be sent to the IP address and port from
-   whence it came with the same IKE SPIs and the Message ID copied. The
-   response MUST NOT be cryptographically protected and MUST contain a
-   Notify payload indicating INVALID_IKE_SPI.
-
-   A node receiving such an unprotected Notify payload MUST NOT respond
-   and MUST NOT change the state of any existing SAs. The message might
-   be a forgery or might be a response the genuine correspondent was
-   tricked into sending. A node SHOULD treat such a message (and also a
-   network message like ICMP destination unreachable) as a hint that
-   there might be problems with SAs to that IP address and SHOULD
-   initiate a liveness test for any such IKE_SA. An implementation
-   SHOULD limit the frequency of such tests to avoid being tricked into
-   participating in a denial of service attack.
-
-   A node receiving a suspicious message from an IP address with which
-   it has an IKE_SA MAY send an IKE Notify payload in an IKE
-   INFORMATIONAL exchange over that SA. The recipient MUST NOT change
-   the state of any SA's as a result but SHOULD audit the event to aid
-   in diagnosing malfunctions. A node MUST limit the rate at which it
-   will send messages in response to unprotected messages.
-
-2.22 IPComp
-
-   Use of IP compression [IPCOMP] can be negotiated as part of the setup
-   of a CHILD_SA. While IP compression involves an extra header in each
-   packet and a CPI (compression parameter index), the virtual
-   "compression association" has no life outside the ESP or AH SA that
-   contains it. Compression associations disappear when the
-   corresponding ESP or AH SA goes away, and is not explicitly mentioned
-   in any DELETE payload.
-
-   Negotiation of IP compression is separate from the negotiation of
-   cryptographic parameters associated with a CHILD_SA. A node
-   requesting a CHILD_SA MAY advertise its support for one or more
-   compression algorithms though one or more Notify payloads of type
-   IPCOMP_SUPPORTED. The response MAY indicate acceptance of a single
-   compression algorithm with a Notify payload of type IPCOMP_SUPPORTED.
-   These payloads MUST NOT occur messages that do not contain SA
-   payloads.
-
-   While there has been discussion of allowing multiple compression
-   algorithms to be accepted and to have different compression
-   algorithms available for the two directions of a CHILD_SA,
-   implementations of this specification MUST NOT accept an IPComp
-   algorithm that was not proposed, MUST NOT accept more than one, and
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 36]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   MUST NOT compress using an algorithm other than one proposed and
-   accepted in the setup of the CHILD_SA.
-
-   A side effect of separating the negotiation of IPComp from
-   cryptographic parameters is that it is not possible to propose
-   multiple cryptographic suites and propose IP compression with some of
-   them but not others.
-
-2.23 NAT Traversal
-
-   NAT (Network Address Translation) gateways are a controversial
-   subject.  This section briefly describes what they are and how they
-   are likely to act on IKE traffic. Many people believe that NATs are
-   evil and that we should not design our protocols so as to make them
-   work better. IKEv2 does specify some unintuitive processing rules in
-   order that NATs are more likely to work.
-
-   NATs exist primarily because of the shortage of IPv4 addresses,
-   though there are other rationales. IP nodes that are "behind" a NAT
-   have IP addresses that are not globally unique, but rather are
-   assigned from some space that is unique within the network behind the
-   NAT but which are likely to be reused by nodes behind other NATs.
-   Generally, nodes behind NATs can communicate with other nodes behind
-   the same NAT and with nodes with globally unique addresses, but not
-   with nodes behind other NATs.  There are exceptions to that rule.
-   When those nodes make connections to nodes on the real Internet, the
-   NAT gateway "translates" the IP source address to an address that
-   will be routed back to the gateway. Messages to the gateway from the
-   Internet have their destination addresses "translated" to the
-   internal address that will route the packet to the correct endnode.
-
-   NATs are designed to be "transparent" to endnodes. Neither software
-   on the node behind the NAT nor the node on the Internet require
-   modification to communicate through the NAT. Achieving this
-   transparency is more difficult with some protocols than with others.
-   Protocols that include IP addresses of the endpoints within the
-   payloads of the packet will fail unless the NAT gateway understands
-   the protocol and modifies the internal references as well as those in
-   the headers. Such knowledge is inherently unreliable, is a network
-   layer violation, and often results in subtle problems.
-
-   Opening an IPsec connection through a NAT introduces special
-   problems.  If the connection runs in transport mode, changing the IP
-   addresses on packets will cause the checksums to fail and the NAT
-   cannot correct the checksums because they are cryptographically
-   protected. Even in tunnel mode, there are routing problems because
-   transparently translating the addresses of AH and ESP packets
-   requires special logic in the NAT and that logic is heuristic and
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 37]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   unreliable in nature. For that reason, IKEv2 can negotiate UDP
-   encapsulation of IKE and ESP packets.  This encoding is slightly less
-   efficient but is easier for NATs to process. In addition, firewalls
-   may be configured to pass IPsec traffic over UDP but not ESP/AH or
-   vice versa.
-
-   It is a common practice of NATs to translate TCP and UDP port numbers
-   as well as addresses and use the port numbers of inbound packets to
-   decide which internal node should get a given packet. For this
-   reason, even though IKE packets MUST be sent from and to UDP port
-   500, they MUST be accepted coming from any port and responses MUST be
-   sent to the port from whence they came. This is because the ports may
-   be modified as the packets pass through NATs. Similarly, IP addresses
-   of the IKE endpoints are generally not included in the IKE payloads
-   because the payloads are cryptographically protected and could not be
-   transparently modified by NATs.
-
-   Port 4500 is reserved for UDP encapsulated ESP and IKE.  When working
-   through a NAT, it is generally better to pass IKE packets over port
-   4500 because some older NATs handle IKE traffic on port 500 cleverly
-   in an attempt to transparently establish IPsec connections between
-   endpoints that don't handle NAT traversal themselves. Such NATs may
-   interfere with the straightforward NAT traversal envisioned by this
-   document, so an IPsec endpoint that discovers a NAT between it and
-   its correspondent MUST send all subsequent traffic to and from port
-   4500, which NATs should not treat specially (as they might with port
-   500).
-
-   The specific requirements for supporting NAT traversal are listed
-   below.  Support for NAT traversal is optional. In this section only,
-   requirements listed as MUST only apply to implementations supporting
-   NAT traversal.
-
-      IKE MUST listen on port 4500 as well as port 500. IKE MUST respond
-      to the IP address and port from which packets arrived.
-
-      Both IKE initiator and responder MUST include in their IKE_SA_INIT
-      packets Notify payloads of type NAT_DETECTION_SOURCE_IP and
-      NAT_DETECTION_DESTINATION_IP. Those payloads can be used to detect
-      if there is NAT between the hosts, and which end is behind the
-      NAT. The location of the payloads in the IKE_SA_INIT packets are
-      just after the Ni and Nr payloads (before the optional CERTREQ
-      payload).
-
-      If none of the NAT_DETECTION_SOURCE_IP payload(s) received matches
-      the hash of the source IP and port found from the IP header of the
-      packet containing the payload, it means that the other end is
-      behind NAT (i.e., someone along the route changed the source
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 38]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-      address of the original packet to match the address of the NAT
-      box). In this case this end should allow dynamic update of the
-      other ends IP address, as described later.
-
-      If the NAT_DETECTION_DESTINATION_IP payload received does not
-      match the hash of the destination IP and port found from the IP
-      header of the packet containing the payload, it means that this
-      end is behind a NAT. In this case, this end SHOULD start sending
-      keepalive packets as explained in [Hutt04].
-
-      The IKE initiator MUST check these payloads if present and if they
-      do not match the addresses in the outer packet MUST tunnel all
-      future IKE and ESP packets associated with this IKE_SA over UDP
-      port 4500.
-
-      To tunnel IKE packets over UDP port 4500, the IKE header has four
-      octets of zero prepended and the result immediately follows the
-      UDP header. To tunnel ESP packets over UDP port 4500, the ESP
-      header immediately follows the UDP header. Since the first four
-      bytes of the ESP header contain the SPI, and the SPI cannot
-      validly be zero, it is always possible to distinguish ESP and IKE
-      messages.
-
-      The original source and destination IP address required for the
-      transport mode TCP and UDP packet checksum fixup (see [Hutt04])
-      are obtained from the Traffic Selectors associated with the
-      exchange. In the case of NAT traversal, the Traffic Selectors MUST
-      contain exactly one IP address which is then used as the original
-      IP address.
-
-      There are cases where a NAT box decides to remove mappings that
-      are still alive (for example, the keepalive interval is too long,
-      or the NAT box is rebooted). To recover in these cases, hosts that
-      are not behind a NAT SHOULD send all packets (including
-      retransmission packets) to the IP address and port from the last
-      valid authenticated packet from the other end (i.e., dynamically
-      update the address). A host behind a NAT SHOULD NOT do this
-      because it opens a DoS attack possibility. Any authenticated IKE
-      packet or any authenticated UDP encapsulated ESP packet can be
-      used to detect that the IP address or the port has changed.
-
-      Note that similar but probably not identical actions will likely
-      be needed to make IKE work with Mobile IP, but such processing is
-      not addressed by this document.
-
-
-
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 39]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-2.24 ECN (Explicit Congestion Notification)
-
-   When IPsec tunnels behave as originally specified in [RFC2401], ECN
-   usage is not appropriate for the outer IP headers because tunnel
-   decapsulation processing discards ECN congestion indications to the
-   detriment of the network. ECN support for IPsec tunnels for
-   IKEv1-based IPsec requires multiple operating modes and negotiation
-   (see RFC3168]).  IKEv2 simplifies this situation by requiring that
-   ECN be usable in the outer IP headers of all tunnel-mode IPsec SAs
-   created by IKEv2.  Specifically, tunnel encapsulators and
-   decapsulators for all tunnel-mode Security Associations (SAs) created
-   by IKEv2 MUST support the ECN full-functionality option for tunnels
-   specified in [RFC3168] and MUST implement the tunnel encapsulation
-   and decapsulation processing specified in [RFC2401bis] to prevent
-   discarding of ECN congestion indications.
-
-3 Header and Payload Formats
-
-3.1 The IKE Header
-
-   IKE messages use UDP ports 500 and/or 4500, with one IKE message per
-   UDP datagram. Information from the beginning of the packet through
-   the UDP header is largely ignored except that the IP addresses and
-   UDP ports from the headers are reversed and used for return packets.
-   When sent on UDP port 500, IKE messages begin immediately following
-   the UDP header. When sent on UDP port 4500, IKE messages have
-   prepended four octets of zero.  These four octets of zero are not
-   part of the IKE message and are not included in any of the length
-   fields or checksums defined by IKE.  Each IKE message begins with the
-   IKE header, denoted HDR in this memo. Following the header are one or
-   more IKE payloads each identified by a "Next Payload" field in the
-   preceding payload. Payloads are processed in the order in which they
-   appear in an IKE message by invoking the appropriate processing
-   routine according to the "Next Payload" field in the IKE header and
-   subsequently according to the "Next Payload" field in the IKE payload
-   itself until a "Next Payload" field of zero indicates that no
-   payloads follow. If a payload of type "Encrypted" is found, that
-   payload is decrypted and its contents parsed as additional payloads.
-   An Encrypted payload MUST be the last payload in a packet and an
-   encrypted payload MUST NOT contain another encrypted payload.
-
-   The Recipient SPI in the header identifies an instance of an IKE
-   security association. It is therefore possible for a single instance
-   of IKE to multiplex distinct sessions with multiple peers.
-
-   All multi-octet fields representing integers are laid out in big
-   endian order (aka most significant byte first, or network byte
-   order).
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 40]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   The format of the IKE header is shown in Figure 4.
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                       IKE_SA Initiator's SPI                  !
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                       IKE_SA Responder's SPI                  !
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !  Next Payload ! MjVer ! MnVer ! Exchange Type !     Flags     !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                          Message ID                           !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                            Length                             !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                       Figure 4:  IKE Header Format
-
-      o  Initiator's SPI (8 octets) - A value chosen by the
-         initiator to identify a unique IKE security association. This
-         value MUST NOT be zero.
-
-      o  Responder's SPI (8 octets) - A value chosen by the
-         responder to identify a unique IKE security association. This
-         value MUST be zero in the first message of an IKE Initial
-         Exchange (including repeats of that message including a
-         cookie) and MUST NOT be zero in any other message.
-
-      o  Next Payload (1 octet) - Indicates the type of payload that
-         immediately follows the header. The format and value of each
-         payload is defined below.
-
-      o  Major Version (4 bits) - indicates the major version of the IKE
-         protocol in use.  Implementations based on this version of IKE
-         MUST set the Major Version to 2. Implementations based on
-         previous versions of IKE and ISAKMP MUST set the Major Version
-         to 1. Implementations based on this version of IKE MUST reject
-         or ignore messages containing a version number greater than
-         2.
-
-      o  Minor Version (4 bits) - indicates the minor version of the
-         IKE protocol in use.  Implementations based on this version of
-         IKE MUST set the Minor Version to 0. They MUST ignore the minor
-         version number of received messages.
-
-      o  Exchange Type (1 octet) - indicates the type of exchange being
-         used.  This constrains the payloads sent in each message and
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 41]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-         orderings of messages in an exchange.
-
-                       Exchange Type            Value
-
-                       RESERVED                 0-33
-                       IKE_SA_INIT              34
-                       IKE_AUTH                 35
-                       CREATE_CHILD_SA          36
-                       INFORMATIONAL            37
-                       RESERVED TO IANA         38-239
-                       Reserved for private use 240-255
-
-      o  Flags (1 octet) - indicates specific options that are set
-         for the message. Presence of options are indicated by the
-         appropriate bit in the flags field being set. The bits are
-         defined LSB first, so bit 0 would be the least significant
-         bit of the Flags octet. In the description below, a bit
-         being 'set' means its value is '1', while 'cleared' means
-         its value is '0'.
-
-       --  X(reserved) (bits 0-2) - These bits MUST be cleared
-           when sending and MUST be ignored on receipt.
-
-       --  I(nitiator) (bit 3 of Flags) - This bit MUST be set in
-           messages sent by the original initiator of the IKE_SA
-           and MUST be cleared in messages sent by the original
-           responder. It is used by the recipient to determine
-           which eight octets of the SPI was generated by the
-           recipient.
-
-       --  V(ersion) (bit 4 of Flags) - This bit indicates that
-           the transmitter is capable of speaking a higher major
-           version number of the protocol than the one indicated
-           in the major version number field. Implementations of
-           IKEv2 must clear this bit when sending and MUST ignore
-           it in incoming messages.
-
-       --  R(esponse) (bit 5 of Flags) - This bit indicates that
-           this message is a response to a message containing
-           the same message ID. This bit MUST be cleared in all
-           request messages and MUST be set in all responses.
-           An IKE endpoint MUST NOT generate a response to a
-           message that is marked as being a response.
-
-       --  X(reserved) (bits 6-7 of Flags) - These bits MUST be
-           cleared when sending and MUST be ignored on receipt.
-
-      o  Message ID (4 octets) - Message identifier used to control
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 42]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-         retransmission of lost packets and matching of requests and
-         responses. It is essential to the security of the protocol
-         because it is used to prevent message replay attacks.
-         See sections 2.1 and 2.2.
-
-      o  Length (4 octets) - Length of total message (header + payloads)
-         in octets.
-
-3.2 Generic Payload Header
-
-   Each IKE payload defined in sections 3.3 through 3.16 begins with a
-   generic payload header, shown in Figure 5. Figures for each payload
-   below will include the generic payload header but for brevity the
-   description of each field will be omitted.
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                         Figure 5:  Generic Payload Header
-
-   The Generic Payload Header fields are defined as follows:
-
-   o  Next Payload (1 octet) - Identifier for the payload type of the
-      next payload in the message.  If the current payload is the last
-      in the message, then this field will be 0.  This field provides
-      a "chaining" capability whereby additional payloads can be
-      added to a message by appending it to the end of the message
-      and setting the "Next Payload" field of the preceding payload
-      to indicate the new payload's type. An Encrypted payload,
-      which must always be the last payload of a message, is an
-      exception. It contains data structures in the format of
-      additional payloads. In the header of an Encrypted payload,
-      the Next Payload field is set to the payload type of the first
-      contained payload (instead of 0).
-
-      Payload Type Values
-
-          Next Payload Type               Notation  Value
-
-          No Next Payload                              0
-
-          RESERVED                                   1-32
-          Security Association             SA         33
-          Key Exchange                     KE         34
-          Identification - Initiator       IDi        35
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 43]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-          Identification - Responder       IDr        36
-          Certificate                      CERT       37
-          Certificate Request              CERTREQ    38
-          Authentication                   AUTH       39
-          Nonce                            Ni, Nr     40
-          Notify                           N          41
-          Delete                           D          42
-          Vendor ID                        V          43
-          Traffic Selector - Initiator     TSi        44
-          Traffic Selector - Responder     TSr        45
-          Encrypted                        E          46
-          Configuration                    CP         47
-          Extensible Authentication        EAP        48
-          RESERVED TO IANA                          49-127
-          PRIVATE USE                              128-255
-
-      Payload type values 1-32 should not be used so that there is no
-      overlap with the code assignments for IKEv1.  Payload type values
-      49-127 are reserved to IANA for future assignment in IKEv2 (see
-      section 6). Payload type values 128-255 are for private use among
-      mutually consenting parties.
-
-   o  Critical (1 bit) - MUST be set to zero if the sender wants
-      the recipient to skip this payload if it does not
-      understand the payload type code in the Next Payload field
-      of the previous payload. MUST be set to one if the
-      sender wants the recipient to reject this entire message
-      if it does not understand the payload type. MUST be ignored
-      by the recipient if the recipient understands the payload type
-      code. MUST be set to zero for payload types defined in this
-      document. Note that the critical bit applies to the current
-      payload rather than the "next" payload whose type code
-      appears in the first octet. The reasoning behind not setting
-      the critical bit for payloads defined in this document is
-      that all implementations MUST understand all payload types
-      defined in this document and therefore must ignore the
-      Critical bit's value. Skipped payloads are expected to
-      have valid Next Payload and Payload Length fields.
-
-   o  RESERVED (7 bits) - MUST be sent as zero; MUST be ignored on
-      receipt.
-
-   o  Payload Length (2 octets) - Length in octets of the current
-      payload, including the generic payload header.
-
-3.3 Security Association Payload
-
-   The Security Association Payload, denoted SA in this memo, is used to
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 44]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   negotiate attributes of a security association. Assembly of Security
-   Association Payloads requires great peace of mind. An SA payload MAY
-   contain multiple proposals. If there is more than one, they MUST be
-   ordered from most preferred to least preferred.  Each proposal may
-   contain multiple IPsec protocols (where a protocol is IKE, ESP, or
-   AH), each protocol MAY contain multiple transforms, and each
-   transform MAY contain multiple attributes. When parsing an SA, an
-   implementation MUST check that the total Payload Length is consistent
-   with the payload's internal lengths and counts.  Proposals,
-   Transforms, and Attributes each have their own variable length
-   encodings. They are nested such that the Payload Length of an SA
-   includes the combined contents of the SA, Proposal, Transform, and
-   Attribute information. The length of a Proposal includes the lengths
-   of all Transforms and Attributes it contains. The length of a
-   Transform includes the lengths of all Attributes it contains.
-
-   The syntax of Security Associations, Proposals, Transforms, and
-   Attributes is based on ISAKMP, however the semantics are somewhat
-   different. The reason for the complexity and the hierarchy is to
-   allow for multiple possible combinations of algorithms to be encoded
-   in a single SA. Sometimes there is a choice of multiple algorithms,
-   while other times there is a combination of algorithms.  For example,
-   an initiator might want to propose using (AH w/MD5 and ESP w/3DES) OR
-   (ESP w/MD5 and 3DES).
-
-   One of the reasons the semantics of the SA payload has changed from
-   ISAKMP and IKEv1 is to make the encodings more compact in common
-   cases.
-
-   The Proposal structure contains within it a Proposal # and an IPsec
-   protocol ID.  Each structure MUST have the same Proposal # as the
-   previous one or be one (1) greater. The first Proposal MUST have a
-   Proposal # of one (1). If two successive structures have the same
-   Proposal number, it means that the proposal consists of the first
-   structure AND the second. So a proposal of AH AND ESP would have two
-   proposal structures, one for AH and one for ESP and both would have
-   Proposal #1. A proposal of AH OR ESP would have two proposal
-   structures, one for AH with proposal #1 and one for ESP with proposal
-   #2.
-
-   Each Proposal/Protocol structure is followed by one or more transform
-   structures. The number of different transforms is generally
-   determined by the Protocol. AH generally has a single transform: an
-   integrity check algorithm. ESP generally has two: an encryption
-   algorithm and an integrity check algorithm. IKE generally has four
-   transforms: a Diffie-Hellman group, an integrity check algorithm, a
-   prf algorithm, and an encryption algorithm. If an algorithm that
-   combines encryption and integrity protection is proposed, it MUST be
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 45]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   proposed as an encryption algorithm and an integrity protection
-   algorithm MUST NOT be proposed.  For each Protocol, the set of
-   permissible transforms are assigned transform ID numbers, which
-   appear in the header of each transform.
-
-   If there are multiple transforms with the same Transform Type, the
-   proposal is an OR of those transforms. If there are multiple
-   Transforms with different Transform Types, the proposal is an AND of
-   the different groups. For example, to propose ESP with (3DES or IDEA)
-   and (HMAC_MD5 or HMAC_SHA), the ESP proposal would contain two
-   Transform Type 1 candidates (one for 3DES and one for IDEA) and two
-   Transform Type 2 candidates (one for HMAC_MD5 and one for HMAC_SHA).
-   This effectively proposes four combinations of algorithms. If the
-   initiator wanted to propose only a subset of those - say (3DES and
-   HMAC_MD5) or (IDEA and HMAC_SHA), there is no way to encode that as
-   multiple transforms within a single Proposal. Instead, the initiator
-   would have to construct two different Proposals, each with two
-   transforms.
-
-   A given transform MAY have one or more Attributes. Attributes are
-   necessary when the transform can be used in more than one way, as
-   when an encryption algorithm has a variable key size. The transform
-   would specify the algorithm and the attribute would specify the key
-   size. Most transforms do not have attributes. A transform MUST NOT
-   have multiple attributes of the same type.  To propose alternate
-   values for an attribute (for example, multiple key sizes for the AES
-   encryption algorithm), and implementation MUST include multiple
-   Transforms with the same Transform Type each with a single Attribute.
-
-   Note that the semantics of Transforms and Attributes are quite
-   different than in IKEv1. In IKEv1, a single Transform carried
-   multiple algorithms for a protocol with one carried in the Transform
-   and the others carried in the Attributes.
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                          <Proposals>                          ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 6:  Security Association Payload
-
-      o  Proposals (variable) - one or more proposal substructures.
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 46]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-      The payload type for the Security Association Payload is thirty
-      three (33).
-
-3.3.1 Proposal Substructure
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! 0 (last) or 2 !   RESERVED    !         Proposal Length       !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Proposal #    !  Protocol ID  !    SPI Size   !# of Transforms!
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~                        SPI (variable)                         ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                        <Transforms>                           ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 7:  Proposal Substructure
-
-      o  0 (last) or 2 (more) (1 octet) - Specifies whether this is the
-         last Proposal Substructure in the SA. This syntax is inherited
-         from ISAKMP, but is unnecessary because the last Proposal
-         could be identified from the length of the SA. The value (2)
-         corresponds to a Payload Type of Proposal in IKEv1, and the
-         first four octets of the Proposal structure are designed to
-         look somewhat like the header of a Payload.
-
-      o  RESERVED (1 octet) - MUST be sent as zero; MUST be ignored on
-         receipt.
-
-      o  Proposal Length (2 octets) - Length of this proposal,
-         including all transforms and attributes that follow.
-
-      o  Proposal # (1 octet) - When a proposal is made, the first
-         proposal in an SA payload MUST be #1, and subsequent proposals
-         MUST either be the same as the previous proposal (indicating
-         an AND of the two proposals) or one more than the previous
-         proposal (indicating an OR of the two proposals). When a
-         proposal is accepted, all of the proposal numbers in the
-         SA payload MUST be the same and MUST match the number on the
-         proposal sent that was accepted.
-
-
-
-
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 47]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-      o  Protocol ID (1 octet) - Specifies the IPsec protocol
-         identifier for the current negotiation. The defined values
-         are:
-
-          Protocol               Protocol ID
-          RESERVED                0
-          IKE                     1
-          AH                      2
-          ESP                     3
-          RESERVED TO IANA        4-200
-          PRIVATE USE             201-255
-
-
-      o  SPI Size (1 octet) - For an initial IKE_SA negotiation,
-         this field MUST be zero; the SPI is obtained from the
-         outer header. During subsequent negotiations,
-         it is equal to the size, in octets, of the SPI of the
-         corresponding protocol (8 for IKE, 4 for ESP and AH).
-
-      o  # of Transforms (1 octet) - Specifies the number of
-         transforms in this proposal.
-
-      o  SPI (variable) - The sending entity's SPI. Even if the SPI
-         Size is not a multiple of 4 octets, there is no padding
-         applied to the payload. When the SPI Size field is zero,
-         this field is not present in the Security Association
-         payload.
-
-      o  Transforms (variable) - one or more transform substructures.
-
-
-3.3.2 Transform Substructure
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! 0 (last) or 3 !   RESERVED    !        Transform Length       !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !Transform Type !   RESERVED    !          Transform ID         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                      Transform Attributes                     ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 8:  Transform Substructure
-
-   o  0 (last) or 3 (more) (1 octet) - Specifies whether this is the
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 48]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-      last Transform Substructure in the Proposal. This syntax is
-      inherited from ISAKMP, but is unnecessary because the last
-      Proposal could be identified from the length of the SA. The
-      value (3) corresponds to a Payload Type of Transform in IKEv1,
-      and the first four octets of the Transform structure are
-      designed to look somewhat like the header of a Payload.
-
-   o  RESERVED - MUST be sent as zero; MUST be ignored on receipt.
-
-   o  Transform Length - The length (in octets) of the Transform
-      Substructure including Header and Attributes.
-
-   o  Transform Type (1 octet) - The type of transform being specified
-      in this transform. Different protocols support different
-      transform types. For some protocols, some of the transforms
-      may be optional. If a transform is optional and the initiator
-      wishes to propose that the transform be omitted, no transform
-      of the given type is included in the proposal. If the
-      initiator wishes to make use of the transform optional to
-      the responder, it includes a transform substructure with
-      transform ID = 0 as one of the options.
-
-   o  Transform ID (2 octets) - The specific instance of the transform
-      type being proposed.
-
-   Transform Type Values
-
-                                     Transform    Used In
-                                        Type
-          RESERVED                        0
-          Encryption Algorithm (ENCR)     1  (IKE and ESP)
-          Pseudo-random Function (PRF)    2  (IKE)
-          Integrity Algorithm (INTEG)     3  (IKE, AH, optional in ESP)
-          Diffie-Hellman Group (D-H)      4  (IKE, optional in AH & ESP)
-          Extended Sequence Numbers (ESN) 5  (Optional in AH and ESP)
-          RESERVED TO IANA                6-240
-          PRIVATE USE                     241-255
-
-   For Transform Type 1 (Encryption Algorithm), defined Transform IDs
-   are:
-
-          Name                     Number           Defined In
-          RESERVED                    0
-          ENCR_DES_IV64               1              (RFC1827)
-          ENCR_DES                    2              (RFC2405)
-          ENCR_3DES                   3              (RFC2451)
-          ENCR_RC5                    4              (RFC2451)
-          ENCR_IDEA                   5              (RFC2451)
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 49]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-          ENCR_CAST                   6              (RFC2451)
-          ENCR_BLOWFISH               7              (RFC2451)
-          ENCR_3IDEA                  8              (RFC2451)
-          ENCR_DES_IV32               9
-          RESERVED                   10
-          ENCR_NULL                  11              (RFC2410)
-          ENCR_AES_CBC               12              (RFC3602)
-          ENCR_AES_CTR               13              (RFC3664)
-
-          values 14-1023 are reserved to IANA. Values 1024-65535 are for
-          private use among mutually consenting parties.
-
-   For Transform Type 2 (Pseudo-random Function), defined Transform IDs
-   are:
-
-          Name                     Number                 Defined In
-          RESERVED                    0
-          PRF_HMAC_MD5                1                   (RFC2104)
-          PRF_HMAC_SHA1               2                   (RFC2104)
-          PRF_HMAC_TIGER              3                   (RFC2104)
-          PRF_AES128_CBC              4                   (RFC3664)
-
-          values 5-1023 are reserved to IANA. Values 1024-65535 are for
-          private use among mutually consenting parties.
-
-
-   For Transform Type 3 (Integrity Algorithm), defined Transform IDs
-   are:
-
-          Name                     Number                 Defined In
-          NONE                       0
-          AUTH_HMAC_MD5_96           1                     (RFC2403)
-          AUTH_HMAC_SHA1_96          2                     (RFC2404)
-          AUTH_DES_MAC               3
-          AUTH_KPDK_MD5              4                     (RFC1826)
-          AUTH_AES_XCBC_96           5                     (RFC3566)
-
-          values 6-1023 are reserved to IANA. Values 1024-65535 are for
-          private use among mutually consenting parties.
-
-   For Transform Type 4 (Diffie-Hellman Group), defined Transform IDs
-   are:
-
-          Name                                Number
-          NONE                               0
-          Defined in Appendix B              1 - 2
-          RESERVED                           3 - 4
-          Defined in [ADDGROUP]              5
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 50]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-          RESERVED TO IANA                   6 - 13
-          Defined in [ADDGROUP]              14 - 18
-          RESERVED TO IANA                   19 - 1023
-          PRIVATE USE                        1024-65535
-
-
-
-   For Transform Type 5 (Extended Sequence Numbers), defined Transform
-   IDs are:
-
-          Name                                Number
-          No Extended Sequence Numbers       0
-          Extended Sequence Numbers          1
-          RESERVED                           2 - 65535
-
-          If Transform Type 5 is not included in a proposal, use of
-          Extended Sequence Numbers is assumed.
-
-3.3.3 Valid Transform Types by Protocol
-
-   The number and type of transforms that accompany an SA payload are
-   dependent on the protocol in the SA itself. An SA payload proposing
-   the establishment of an SA has the following mandatory and optional
-   transform types. A compliant implementation MUST understand all
-   mandatory and optional types for each protocol it supports (though it
-   need not accept proposals with unacceptable suites). A proposal MAY
-   omit the optional types if the only value for them it will accept is
-   NONE.
-
-          Protocol  Mandatory Types        Optional Types
-            IKE     ENCR, PRF, INTEG, D-H
-            ESP     ENCR                   INTEG, D-H, ESN
-            AH      INTEG                  D-H, ESN
-
-3.3.4 Mandatory Transform IDs
-
-   The specification of suites that MUST and SHOULD be supported for
-   interoperability has been removed from this document because they are
-   likely to change more rapidly than this document evolves.
-
-   An important lesson learned from IKEv1 is that no system should only
-   implement the mandatory algorithms and expect them to be the best
-   choice for all customers. For example, at the time that this document
-   was being written, many IKEv1 implementers are starting to migrate to
-   AES in CBC mode for VPN applications. Many IPsec systems based on
-   IKEv2 will implement AES, additional Diffie-Hellman groups, and
-   additional hash algorithms, and some IPsec customers already require
-   these algorithms in addition to the ones listed above.
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 51]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   It is likely that IANA will add additional transforms in the future,
-   and some users may want to use private suites, especially for IKE
-   where implementations should be capable of supporting different
-   parameters, up to certain size limits. In support of this goal, all
-   implementations of IKEv2 SHOULD include a management facility that
-   allows specification (by a user or system administrator) of Diffie-
-   Hellman parameters (the generator, modulus, and exponent lengths and
-   values) for new DH groups. Implementations SHOULD provide a
-   management interface via which these parameters and the associated
-   transform IDs may be entered (by a user or system administrator), to
-   enable negotiating such groups.
-
-   All implementations of IKEv2 MUST include a management facility that
-   enables a user or system administrator to specify the suites that are
-   acceptable for use with IKE. Upon receipt of a payload with a set of
-   transform IDs, the implementation MUST compare the transmitted
-   transform IDs against those locally configured via the management
-   controls, to verify that the proposed suite is acceptable based on
-   local policy.  The implementation MUST reject SA proposals that are
-   not authorized by these IKE suite controls. Note that cryptographic
-   suites that MUST be implemented need not be configured as acceptable
-   to local policy.
-
-3.3.5 Transform Attributes
-
-   Each transform in a Security Association payload may include
-   attributes that modify or complete the specification of the
-   transform. These attributes are type/value pairs and are defined
-   below. For example, if an encryption algorithm has a variable length
-   key, the key length to be used may be specified as an attribute.
-   Attributes can have a value with a fixed two octet length or a
-   variable length value. For the latter, the attribute is encoded as
-   type/length/value.
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !A!       Attribute Type        !    AF=0  Attribute Length     !
-      !F!                             !    AF=1  Attribute Value      !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                   AF=0  Attribute Value                       !
-      !                   AF=1  Not Transmitted                       !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                      Figure 9:  Data Attributes
-
-      o  Attribute Type (2 octets) - Unique identifier for each type of
-         attribute (see below).
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 52]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-         The most significant bit of this field is the Attribute Format
-         bit (AF). It indicates whether the data attributes follow the
-         Type/Length/Value (TLV) format or a shortened Type/Value (TV)
-         format.  If the AF bit is zero (0), then the Data Attributes
-         are of the Type/Length/Value (TLV) form. If the AF bit is a
-         one (1), then the Data Attributes are of the Type/Value form.
-
-      o  Attribute Length (2 octets) - Length in octets of the Attribute
-         Value.  When the AF bit is a one (1), the Attribute Value is
-         only 2 octets and the Attribute Length field is not present.
-
-      o  Attribute Value (variable length) - Value of the Attribute
-         associated with the Attribute Type.  If the AF bit is a
-         zero (0), this field has a variable length defined by the
-         Attribute Length field.  If the AF bit is a one (1), the
-         Attribute Value has a length of 2 octets.
-
-   Note that only a single attribute type (Key Length) is defined, and
-   it is fixed length. The variable length encoding specification is
-   included only for future extensions.  The only algorithms defined in
-   this document that accept attributes are the AES based encryption,
-   integrity, and pseudo-random functions, which require a single
-   attribute specifying key width.
-
-   Attributes described as basic MUST NOT be encoded using the variable
-   length encoding.  Variable length attributes MUST NOT be encoded as
-   basic even if their value can fit into two octets. NOTE: This is a
-   change from IKEv1, where increased flexibility may have simplified
-   the composer of messages but certainly complicated the parser.
-
-         Attribute Type                 value        Attribute Format
-      --------------------------------------------------------------
-      RESERVED                           0-13
-      Key Length (in bits)               14                 TV
-      RESERVED                           15-17
-      RESERVED TO IANA                   18-16383
-      PRIVATE USE                        16384-32767
-
-   Values 0-13 and 15-17 were used in a similar context in IKEv1, and
-   should not be assigned except to matching values. Values 18-16383 are
-   reserved to IANA. Values 16384-32767 are for private use among
-   mutually consenting parties.
-
-   - Key Length
-
-      When using an Encryption Algorithm that has a variable length key,
-      this attribute specifies the key length in bits. (MUST use network
-      byte order). This attribute MUST NOT be used when the specified
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 53]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-      Encryption Algorithm uses a fixed length key.
-
-3.3.6 Attribute Negotiation
-
-   During security association negotiation initiators present offers to
-   responders. Responders MUST select a single complete set of
-   parameters from the offers (or reject all offers if none are
-   acceptable).  If there are multiple proposals, the responder MUST
-   choose a single proposal number and return all of the Proposal
-   substructures with that Proposal number.  If there are multiple
-   Transforms with the same type the responder MUST choose a single one.
-   Any attributes of a selected transform MUST be returned unmodified.
-   The initiator of an exchange MUST check that the accepted offer is
-   consistent with one of its proposals, and if not that response MUST
-   be rejected.
-
-   Negotiating Diffie-Hellman groups presents some special challenges.
-   SA offers include proposed attributes and a Diffie-Hellman public
-   number (KE) in the same message. If in the initial exchange the
-   initiator offers to use one of several Diffie-Hellman groups, it
-   SHOULD pick the one the responder is most likely to accept and
-   include a KE corresponding to that group. If the guess turns out to
-   be wrong, the responder will indicate the correct group in the
-   response and the initiator SHOULD pick an element of that group for
-   its KE value when retrying the first message. It SHOULD, however,
-   continue to propose its full supported set of groups in order to
-   prevent a man in the middle downgrade attack.
-
-   Implementation Note:
-
-      Certain negotiable attributes can have ranges or could have
-      multiple acceptable values. These include the key length of a
-      variable key length symmetric cipher. To further interoperability
-      and to support upgrading endpoints independently, implementers of
-      this protocol SHOULD accept values which they deem to supply
-      greater security. For instance if a peer is configured to accept a
-      variable lengthed cipher with a key length of X bits and is
-      offered that cipher with a larger key length, the implementation
-      SHOULD accept the offer if it supports use of the longer key.
-
-   Support of this capability allows an implementation to express a
-   concept of "at least" a certain level of security-- "a key length of
-   _at least_ X bits for cipher Y".
-
-3.4 Key Exchange Payload
-
-   The Key Exchange Payload, denoted KE in this memo, is used to
-   exchange Diffie-Hellman public numbers as part of a Diffie-Hellman
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 54]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   key exchange.  The Key Exchange Payload consists of the IKE generic
-   payload header followed by the Diffie-Hellman public value itself.
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !          DH Group #           !           RESERVED            !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                       Key Exchange Data                       ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                Figure 10:  Key Exchange Payload Format
-
-   A key exchange payload is constructed by copying one's Diffie-Hellman
-   public value into the "Key Exchange Data" portion of the payload.
-   The length of the Diffie-Hellman public value MUST be equal to the
-   length of the prime modulus over which the exponentiation was
-   performed, prepending zero bits to the value if necessary.
-
-   The DH Group # identifies the Diffie-Hellman group in which the Key
-   Exchange Data was computed (see section 3.3.2).  If the selected
-   proposal uses a different Diffie-Hellman group, the message MUST be
-   rejected with a Notify payload of type INVALID_KE_PAYLOAD.
-
-   The payload type for the Key Exchange payload is thirty four (34).
-
-3.5 Identification Payloads
-
-   The Identification Payloads, denoted IDi and IDr in this memo, allow
-   peers to assert an identity to one another. This identity may be used
-   for policy lookup, but does not necessarily have to match anything in
-   the CERT payload; both fields may be used by an implementation to
-   perform access control decisions.
-
-   NOTE: In IKEv1, two ID payloads were used in each direction to hold
-   Traffic Selector information for data passing over the SA. In IKEv2,
-   this information is carried in Traffic Selector (TS) payloads (see
-   section 3.13).
-
-   The Identification Payload consists of the IKE generic payload header
-   followed by identification fields as follows:
-
-
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 55]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !   ID Type     !                 RESERVED                      |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                   Identification Data                         ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 11:  Identification Payload Format
-
-   o  ID Type (1 octet) - Specifies the type of Identification being
-      used.
-
-   o  RESERVED - MUST be sent as zero; MUST be ignored on receipt.
-
-   o  Identification Data (variable length) - Value, as indicated by
-      the Identification Type. The length of the Identification Data
-      is computed from the size in the ID payload header.
-
-   The payload types for the Identification Payload are thirty five (35)
-   for IDi and thirty six (36) for IDr.
-
-   The following table lists the assigned values for the Identification
-   Type field, followed by a description of the Identification Data
-   which follows:
-
-      ID Type                           Value
-      -------                           -----
-      RESERVED                            0
-
-      ID_IPV4_ADDR                        1
-
-            A single four (4) octet IPv4 address.
-
-      ID_FQDN                             2
-
-            A fully-qualified domain name string.  An example of a
-            ID_FQDN is, "example.com".  The string MUST not contain any
-            terminators (e.g., NULL, CR, etc.).
-
-      ID_RFC822_ADDR                      3
-
-            A fully-qualified RFC822 email address string, An example of
-            a ID_RFC822_ADDR is, "jsmith@example.com".  The string MUST
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 56]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-            not contain any terminators.
-
-      Reserved to IANA                    4
-
-      ID_IPV6_ADDR                        5
-
-            A single sixteen (16) octet IPv6 address.
-
-      Reserved to IANA                    6 - 8
-
-      ID_DER_ASN1_DN                      9
-
-            The binary DER encoding of an ASN.1 X.500 Distinguished Name
-            [X.501].
-
-      ID_DER_ASN1_GN                      10
-
-            The binary DER encoding of an ASN.1 X.500 GeneralName
-            [X.509].
-
-      ID_KEY_ID                           11
-
-            An opaque octet stream which may be used to pass vendor-
-            specific information necessary to do certain proprietary
-            types of identification.
-
-      Reserved to IANA                    12-200
-
-      Reserved for private use            201-255
-
-   Two implementations will interoperate only if each can generate a
-   type of ID acceptable to the other. To assure maximum
-   interoperability, implementations MUST be configurable to send at
-   least one of ID_IPV4_ADDR, ID_FQDN, ID_RFC822_ADDR, or ID_KEY_ID, and
-   MUST be configurable to accept all of these types. Implementations
-   SHOULD be capable of generating and accepting all of these types.
-   IPv6 capable implementations MUST additionally be configurable to
-   accept ID_IPV6_ADDR.  IPv6 only implementations MAY be configurable
-   to send only ID_IPV6_ADDR.
-
-
-3.6 Certificate Payload
-
-   The Certificate Payload, denoted CERT in this memo, provides a means
-   to transport certificates or other authentication related information
-   via IKE. Certificate payloads SHOULD be included in an exchange if
-   certificates are available to the sender unless the peer has
-   indicated an ability to retrieve this information from elsewhere
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 57]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   using an HTTP_CERT_LOOKUP_SUPPORTED Notify payload. Note that the
-   term "Certificate Payload" is somewhat misleading, because not all
-   authentication mechanisms use certificates and data other than
-   certificates may be passed in this payload.
-
-   The Certificate Payload is defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Cert Encoding !                                               !
-      +-+-+-+-+-+-+-+-+                                               !
-      ~                       Certificate Data                        ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                Figure 12:  Certificate Payload Format
-
-      o  Certificate Encoding (1 octet) - This field indicates the type
-         of certificate or certificate-related information contained
-         in the Certificate Data field.
-
-           Certificate Encoding               Value
-           --------------------               -----
-           RESERVED                             0
-           PKCS #7 wrapped X.509 certificate    1
-           PGP Certificate                      2
-           DNS Signed Key                       3
-           X.509 Certificate - Signature        4
-           Kerberos Token                       6
-           Certificate Revocation List (CRL)    7
-           Authority Revocation List (ARL)      8
-           SPKI Certificate                     9
-           X.509 Certificate - Attribute       10
-           Raw RSA Key                         11
-           Hash and URL of X.509 certificate   12
-           Hash and URL of X.509 bundle        13
-           RESERVED to IANA                  14 - 200
-           PRIVATE USE                      201 - 255
-
-      o  Certificate Data (variable length) - Actual encoding of
-         certificate data.  The type of certificate is indicated
-         by the Certificate Encoding field.
-
-   The payload type for the Certificate Payload is thirty seven (37).
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 58]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   Specific syntax is for some of the certificate type codes above is
-   not defined in this document.  The types whose syntax is defined in
-   this document are:
-
-      X.509 Certificate - Signature (4) contains a DER encoded X.509
-      certificate whose public key is used to validate the sender's AUTH
-      payload.
-
-      Certificate Revocation List (7) contains a DER encoded X.509
-      certificate revocation list.
-
-      Raw RSA Key (11) contains a PKCS #1 encoded RSA key.
-
-      Hash and URL encodings (12-13) allow IKE messages to remain short
-      by replacing long data structures with a 20 octet SHA-1 hash of
-      the replaced value followed by a variable length URL that resolves
-      to the DER encoded data structure itself. This improves efficiency
-      when the endpoints have certificate data cached and makes IKE less
-      subject to denial of service attacks that become easier to mount
-      when IKE messages are large enough to require IP fragmentation
-      [KPS03].
-
-      Use the following ASN.1 definition for an X.509 bundle:
-
-            CertBundle
-              { iso(1) identified-organization(3) dod(6) internet(1)
-                security(5) mechanisms(5) pkix(7) id-mod(0)
-                id-mod-cert-bundle(34) }
-
-            DEFINITIONS EXPLICIT TAGS ::=
-            BEGIN
-
-            IMPORTS
-              Certificate, CertificateList
-              FROM PKIX1Explicit88
-                 { iso(1) identified-organization(3) dod(6)
-                   internet(1) security(5) mechanisms(5) pkix(7)
-                   id-mod(0) id-pkix1-explicit(18) } ;
-
-           CertificateOrCRL ::= CHOICE {
-             cert [0] Certificate,
-             crl  [1] CertificateList }
-
-           CertificateBundle ::= SEQUENCE OF CertificateOrCRL
-
-           END
-
-   Implementations MUST be capable of being configured to send and
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 59]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   accept up to four X.509 certificates in support of authentication,
-   and also MUST be capable of being configured to send and accept the
-   first two Hash and URL formats (with HTTP URLs).  Implementations
-   SHOULD be capable of being configured to send and accept Raw RSA
-   keys.  If multiple certificates are sent, the first certificate MUST
-   contain the public key used to sign the AUTH payload. The other
-   certificates may be sent in any order.
-
-3.7 Certificate Request Payload
-
-   The Certificate Request Payload, denoted CERTREQ in this memo,
-   provides a means to request preferred certificates via IKE and can
-   appear in the IKE_INIT_SA response and/or the IKE_AUTH request.
-   Certificate Request payloads MAY be included in an exchange when the
-   sender needs to get the certificate of the receiver.  If multiple CAs
-   are trusted and the cert encoding does not allow a list, then
-   multiple Certificate Request payloads SHOULD be transmitted.
-
-   The Certificate Request Payload is defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Cert Encoding !                                               !
-      +-+-+-+-+-+-+-+-+                                               !
-      ~                    Certification Authority                    ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-            Figure 13:  Certificate Request Payload Format
-
-   o  Certificate Encoding (1 octet) - Contains an encoding of the type
-      or format of certificate requested. Values are listed in section
-      3.6.
-
-   o  Certification Authority (variable length) - Contains an encoding
-      of an acceptable certification authority for the type of
-      certificate requested.
-
-   The payload type for the Certificate Request Payload is thirty eight
-   (38).
-
-   The Certificate Encoding field has the same values as those defined
-   in section 3.6. The Certification Authority field contains an
-   indicator of trusted authorities for this certificate type.  The
-   Certification Authority value is a concatenated list of SHA-1 hashes
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 60]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   of the public keys of trusted CAs.  Each is encoded as the SHA-1 hash
-   of the Subject Public Key Info element (see section 4.1.2.7 of
-   [RFC3280]) from each Trust Anchor certificate.  The twenty-octet
-   hashes are concatenated and included with no other formatting.
-
-   Note that the term "Certificate Request" is somewhat misleading, in
-   that values other than certificates are defined in a "Certificate"
-   payload and requests for those values can be present in a Certificate
-   Request Payload. The syntax of the Certificate Request payload in
-   such cases is not defined in this document.
-
-   The Certificate Request Payload is processed by inspecting the "Cert
-   Encoding" field to determine whether the processor has any
-   certificates of this type. If so the "Certification Authority" field
-   is inspected to determine if the processor has any certificates which
-   can be validated up to one of the specified certification
-   authorities. This can be a chain of certificates.
-
-   If an end-entity certificate exists which satisfies the criteria
-   specified in the CERTREQ, a certificate or certificate chain SHOULD
-   be sent back to the certificate requestor if:
-
-    - the recipient of the CERTREQ is configured to use certificate
-   authentication,
-
-    - is allowed to send a CERT payload,
-
-    - has matching CA trust policy governing the current negotiation,
-   and
-
-    - has at least one time-wise and usage appropriate end-entity
-   certificate chaining to a CA provided in the CERTREQ.
-
-   Certificate revocation checking must be considered during the
-   chaining process used to select a certificate. Note that even if two
-   peers are configured to use two different CAs, cross-certification
-   relationships should be supported by appropriate selection logic. The
-   intent is not to prevent communication through the strict adherence
-   of selection of a certificate based on CERTREQ, when an alternate
-   certificate could be selected by the sender which would still enable
-   the recipient to successfully validate and trust it through trust
-   conveyed by cross-certification, CRLs or other out-of-band configured
-   means. Thus the processing of a CERTREQ should be seen as a
-   suggestion for a certificate to select, not a mandated one. If no
-   certificates exist then the CERTREQ is ignored. This is not an error
-   condition of the protocol. There may be cases where there is a
-   preferred CA sent in the CERTREQ, but an alternate might be
-   acceptable (perhaps after prompting a human operator).
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 61]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-3.8 Authentication Payload
-
-   The Authentication Payload, denoted AUTH in this memo, contains data
-   used for authentication purposes. The syntax of the Authentication
-   data varies according to the Auth Method as specified below.
-
-   The Authentication Payload is defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Auth Method   !                RESERVED                       !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                      Authentication Data                      ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                 Figure 14:  Authentication Payload Format
-
-   o  Auth Method (1 octet) - Specifies the method of authentication
-      used. Values defined are:
-
-        RSA Digital Signature (1) - Computed as specified in section
-        2.15 using an RSA private key over a PKCS#1 padded hash.
-
-        Shared Key Message Integrity Code (2) - Computed as specified in
-        section 2.15 using the shared key associated with the identity
-        in the ID payload and the negotiated prf function
-
-        DSS Digital Signature (3) - Computed as specified in section
-        2.15 using a DSS private key over a SHA-1 hash.
-
-        The values 0 and 4-200 are reserved to IANA. The values 201-255
-        are available for private use.
-
-   o  Authentication Data (variable length) - see section 2.15.
-
-   The payload type for the Authentication Payload is thirty nine (39).
-
-3.9 Nonce Payload
-
-   The Nonce Payload, denoted Ni and Nr in this memo for the initiator's
-   and responder's nonce respectively, contains random data used to
-   guarantee liveness during an exchange and protect against replay
-   attacks.
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 62]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   The Nonce Payload is defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                            Nonce Data                         ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                   Figure 15:  Nonce Payload Format
-
-   o  Nonce Data (variable length) - Contains the random data generated
-      by the transmitting entity.
-
-   The payload type for the Nonce Payload is forty (40).
-
-   The size of a Nonce MUST be between 16 and 256 octets inclusive.
-   Nonce values MUST NOT be reused.
-
-3.10 Notify Payload
-
-   The Notify Payload, denoted N in this document, is used to transmit
-   informational data, such as error conditions and state transitions,
-   to an IKE peer. A Notify Payload may appear in a response message
-   (usually specifying why a request was rejected), in an INFORMATIONAL
-   Exchange (to report an error not in an IKE request), or in any other
-   message to indicate sender capabilities or to modify the meaning of
-   the request.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 63]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   The Notify Payload is defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !  Protocol ID  !   SPI Size    !      Notify Message Type      !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                Security Parameter Index (SPI)                 ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                       Notification Data                       ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 16:  Notification Payload Format
-
-   o  Protocol ID (1 octet) - If this notification concerns
-      an existing SA, this field indicates the type of that SA.
-      For IKE_SA notifications, this field MUST be one (1). For
-      notifications concerning IPsec SAs this field MUST contain
-      either (2) to indicate AH or (3) to indicate ESP. For
-      notifications which do not relate to an existing SA, this
-      field MUST be sent as zero and MUST be ignored on receipt.
-      All other values for this field are reserved to IANA for future
-      assignment.
-
-   o  SPI Size (1 octet) - Length in octets of the SPI as defined by
-      the IPsec protocol ID or zero if no SPI is applicable.  For a
-      notification concerning the IKE_SA, the SPI Size MUST be zero.
-
-   o  Notify Message Type (2 octets) - Specifies the type of
-      notification message.
-
-   o  SPI (variable length) - Security Parameter Index.
-
-   o  Notification Data (variable length) - Informational or error data
-      transmitted in addition to the Notify Message Type. Values for
-      this field are type specific (see below).
-
-   The payload type for the Notification Payload is forty one (41).
-
-
-
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 64]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-3.10.1 Notify Message Types
-
-   Notification information can be error messages specifying why an SA
-   could not be established.  It can also be status data that a process
-   managing an SA database wishes to communicate with a peer process.
-   The table below lists the Notification messages and their
-   corresponding values.  The number of different error statuses was
-   greatly reduced from IKE V1 both for simplification and to avoid
-   giving configuration information to probers.
-
-   Types in the range 0 - 16383 are intended for reporting errors.  An
-   implementation receiving a Notify payload with one of these types
-   that it does not recognize in a response MUST assume that the
-   corresponding request has failed entirely. Unrecognized error types
-   in a request and status types in a request or response MUST be
-   ignored except that they SHOULD be logged.
-
-   Notify payloads with status types MAY be added to any message and
-   MUST be ignored if not recognized. They are intended to indicate
-   capabilities, and as part of SA negotiation are used to negotiate
-   non-cryptographic parameters.
-
-        NOTIFY MESSAGES - ERROR TYPES           Value
-        -----------------------------           -----
-        RESERVED                                  0
-
-        UNSUPPORTED_CRITICAL_PAYLOAD              1
-
-            Sent if the payload has the "critical" bit set and the
-            payload type is not recognized. Notification Data contains
-            the one octet payload type.
-
-        INVALID_IKE_SPI                           4
-
-            Indicates an IKE message was received with an unrecognized
-            destination SPI. This usually indicates that the recipient
-            has rebooted and forgotten the existence of an IKE_SA.
-
-        INVALID_MAJOR_VERSION                     5
-
-            Indicates the recipient cannot handle the version of IKE
-            specified in the header. The closest version number that the
-            recipient can support will be in the reply header.
-
-        INVALID_SYNTAX                            7
-
-            Indicates the IKE message was received was invalid because
-            some type, length, or value was out of range or because the
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 65]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-            request was rejected for policy reasons. To avoid a denial
-            of service attack using forged messages, this status may
-            only be returned for and in an encrypted packet if the
-            message ID and cryptographic checksum were valid. To avoid
-            leaking information to someone probing a node, this status
-            MUST be sent in response to any error not covered by one of
-            the other status types. To aid debugging, more detailed
-            error information SHOULD be written to a console or log.
-
-        INVALID_MESSAGE_ID                        9
-
-            Sent when an IKE message ID outside the supported window is
-            received.  This Notify MUST NOT be sent in a response; the
-            invalid request MUST NOT be acknowledged.  Instead, inform
-            the other side by initiating an INFORMATIONAL exchange with
-            Notification data containing the four octet invalid message
-            ID. Sending this notification is optional and notifications
-            of this type MUST be rate limited.
-
-        INVALID_SPI                              11
-
-            MAY be sent in an IKE INFORMATIONAL Exchange when a node
-            receives an ESP or AH packet with an invalid SPI. The
-            Notification Data contains the SPI of the invalid packet.
-            This usually indicates a node has rebooted and forgotten an
-            SA.  If this Informational Message is sent outside the
-            context of an IKE_SA, it should only be used by the
-            recipient as a "hint" that something might be wrong (because
-            it could easily be forged).
-
-        NO_PROPOSAL_CHOSEN                       14
-
-            None of the proposed crypto suites was acceptable.
-
-        INVALID_KE_PAYLOAD                       17
-
-            The D-H Group # field in the KE payload is not the group #
-            selected by the responder for this exchange. There are two
-            octets of data associated with this notification: the
-            accepted D-H Group # in big endian order.
-
-        AUTHENTICATION_FAILED                    24
-
-            Sent in the response to an IKE_AUTH message when for some
-            reason the authentication failed. There is no associated
-            data.
-
-        SINGLE_PAIR_REQUIRED                     34
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 66]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-            This error indicates that a CREATE_CHILD_SA request is
-            unacceptable because its sender is only willing to accept
-            traffic selectors specifying a single pair of addresses.
-            The requestor is expected to respond by requesting an SA for
-            only the specific traffic it is trying to forward.
-
-        NO_ADDITIONAL_SAS                        35
-
-            This error indicates that a CREATE_CHILD_SA request is
-            unacceptable because the responder is unwilling to accept
-            any more CHILD_SAs on this IKE_SA. Some minimal
-            implementations may only accept a single CHILD_SA setup in
-            the context of an initial IKE exchange and reject any
-            subsequent attempts to add more.
-
-        INTERNAL_ADDRESS_FAILURE                 36
-
-            Indicates an error assigning an internal address (i.e.,
-            INTERNAL_IP4_ADDRESS or INTERNAL_IP6_ADDRESS) during the
-            processing of a Configuration Payload by a responder.  If
-            this error is generated within an IKE_AUTH exchange no
-            CHILD_SA will be created.
-
-        FAILED_CP_REQUIRED                       37
-
-            Sent by responder in the case where CP(CFG_REQUEST) was
-            expected but not received, and so is a conflict with locally
-            configured policy. There is no associated data.
-
-        TS_UNACCEPTABLE                          38
-
-            Indicates that none of the addresses/protocols/ports in the
-            supplied traffic selectors is acceptable.
-
-        INVALID_SELECTORS                        39
-
-            MAY be sent in an IKE INFORMATIONAL Exchange when a node
-            receives an ESP or AH packet whose selectors do not match
-            those of the SA on which it was delivered (and which caused
-            the packet to be dropped). The Notification Data contains
-            the start of the offending packet (as in ICMP messages) and
-            the SPI field of the notification is set to match the SPI of
-            the IPsec SA.
-        RESERVED TO IANA - Error types         40 - 8191
-
-        Private Use - Errors                8192 - 16383
-
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 67]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-        NOTIFY MESSAGES - STATUS TYPES           Value
-        ------------------------------           -----
-
-        INITIAL_CONTACT                          16384
-
-            This notification asserts that this IKE_SA is the only
-            IKE_SA currently active between the authenticated
-            identities. It MAY be sent when an IKE_SA is established
-            after a crash, and the recipient MAY use this information to
-            delete any other IKE_SAs it has to the same authenticated
-            identity without waiting for a timeout.  This notification
-            MUST NOT be sent by an entity that may be replicated (e.g.,
-            a roaming user's credentials where the user is allowed to
-            connect to the corporate firewall from two remote systems at
-            the same time).
-
-        SET_WINDOW_SIZE                          16385
-
-            This notification asserts that the sending endpoint is
-            capable of keeping state for multiple outstanding exchanges,
-            permitting the recipient to send multiple requests before
-            getting a response to the first. The data associated with a
-            SET_WINDOW_SIZE notification MUST be 4 octets long and
-            contain the big endian representation of the number of
-            messages the sender promises to keep. Window size is always
-            one until the initial exchanges complete.
-
-        ADDITIONAL_TS_POSSIBLE                   16386
-
-            This notification asserts that the sending endpoint narrowed
-            the proposed traffic selectors but that other traffic
-            selectors would also have been acceptable, though only in a
-            separate SA (see section 2.9). There is no data associated
-            with this Notify type. It may only be sent as an additional
-            payload in a message including accepted TSs.
-
-        IPCOMP_SUPPORTED                         16387
-
-            This notification may only be included in a message
-            containing an SA payload negotiating a CHILD_SA and
-            indicates a willingness by its sender to use IPComp on this
-            SA. The data associated with this notification includes a
-            two octet IPComp CPI followed by a one octet transform ID
-            optionally followed by attributes whose length and format is
-            defined by that transform ID. A message proposing an SA may
-            contain multiple IPCOMP_SUPPORTED notifications to indicate
-            multiple supported algorithms. A message accepting an SA may
-            contain at most one.
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 68]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-            The transform IDs currently defined are:
-
-                 NAME         NUMBER  DEFINED IN
-                 -----------  ------  -----------
-                 RESERVED       0
-                 IPCOMP_OUI     1
-                 IPCOMP_DEFLATE 2     RFC 2394
-                 IPCOMP_LZS     3     RFC 2395
-                 IPCOMP_LZJH    4     RFC 3051
-
-                 values 5-240 are reserved to IANA. Values 241-255 are
-                 for private use among mutually consenting parties.
-
-        NAT_DETECTION_SOURCE_IP                  16388
-
-            This notification is used by its recipient to determine
-            whether the source is behind a NAT box. The data associated
-            with this notification is a SHA-1 digest of the SPIs (in the
-            order they appear in the header), IP address and port on
-            which this packet was sent.  There MAY be multiple Notify
-            payloads of this type in a message if the sender does not
-            know which of several network attachments will be used to
-            send the packet. The recipient of this notification MAY
-            compare the supplied value to a SHA-1 hash of the SPIs,
-            source IP address and port and if they don't match it SHOULD
-            enable NAT traversal (see section 2.23).  Alternately, it
-            MAY reject the connection attempt if NAT traversal is not
-            supported.
-
-        NAT_DETECTION_DESTINATION_IP             16389
-
-            This notification is used by its recipient to determine
-            whether it is behind a NAT box. The data associated with
-            this notification is a SHA-1 digest of the SPIs (in the
-            order they appear in the header), IP address and port to
-            which this packet was sent.  The recipient of this
-            notification MAY compare the supplied value to a hash of the
-            SPIs, destination IP address and port and if they don't
-            match it SHOULD invoke NAT traversal (see section 2.23). If
-            they don't match, it means that this end is behind a NAT and
-            this end SHOULD start sending keepalive packets as defined
-            in [Hutt04].  Alternately, it MAY reject the connection
-            attempt if NAT traversal is not supported.
-
-        COOKIE                                   16390
-
-            This notification MAY be included in an IKE_SA_INIT
-            response. It indicates that the request should be retried
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 69]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-            with a copy of this notification as the first payload.  This
-            notification MUST be included in an IKE_SA_INIT request
-            retry if a COOKIE notification was included in the initial
-            response.  The data associated with this notification MUST
-            be between 1 and 64 octets in length (inclusive).
-
-        USE_TRANSPORT_MODE                       16391
-
-            This notification MAY be included in a request message that
-            also includes an SA payload requesting a CHILD_SA. It
-            requests that the CHILD_SA use transport mode rather than
-            tunnel mode for the SA created. If the request is accepted,
-            the response MUST also include a notification of type
-            USE_TRANSPORT_MODE. If the responder declines the request,
-            the CHILD_SA will be established in tunnel mode. If this is
-            unacceptable to the initiator, the initiator MUST delete the
-            SA. Note: except when using this option to negotiate
-            transport mode, all CHILD_SAs will use tunnel mode.
-
-            Note: The ECN decapsulation modifications specified in
-            [RFC2401bis] MUST be performed for every tunnel mode SA
-            created by IKEv2.
-
-        HTTP_CERT_LOOKUP_SUPPORTED               16392
-
-            This notification MAY be included in any message that can
-            include a CERTREQ payload and indicates that the sender is
-            capable of looking up certificates based on an HTTP-based
-            URL (and hence presumably would prefer to receive
-            certificate specifications in that format).
-
-        REKEY_SA                                 16393
-
-            This notification MUST be included in a CREATE_CHILD_SA
-            exchange if the purpose of the exchange is to replace an
-            existing ESP or AH SA. The SPI field identifies the SA being
-            rekeyed. There is no data.
-
-        ESP_TFC_PADDING_NOT_SUPPORTED            16394
-
-            This notification asserts that the sending endpoint will NOT
-            accept packets that contain Flow Confidentiality (TFC)
-            padding.
-
-        NON_FIRST_FRAGMENTS_ALSO                 16395
-
-            Used for fragmentation control. See [RFC2401bis] for
-            explanation.
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 70]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-        RESERVED TO IANA - STATUS TYPES      16396 - 40959
-
-        Private Use - STATUS TYPES           40960 - 65535
-
-3.11 Delete Payload
-
-   The Delete Payload, denoted D in this memo, contains a protocol
-   specific security association identifier that the sender has removed
-   from its security association database and is, therefore, no longer
-   valid.  Figure 17 shows the format of the Delete Payload. It is
-   possible to send multiple SPIs in a Delete payload, however, each SPI
-   MUST be for the same protocol. Mixing of protocol identifiers MUST
-   NOT be performed in a the Delete payload. It is permitted, however,
-   to include multiple Delete payloads in a single INFORMATIONAL
-   Exchange where each Delete payload lists SPIs for a different
-   protocol.
-
-   Deletion of the IKE_SA is indicated by a protocol ID of 1 (IKE) but
-   no SPIs.  Deletion of a CHILD_SA, such as ESP or AH, will contain the
-   IPsec protocol ID of that protocol (2 for AH, 3 for ESP) and the SPI
-   is the SPI the sending endpoint would expect in inbound ESP or AH
-   packets.
-
-   The Delete Payload is defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Protocol ID   !   SPI Size    !           # of SPIs           !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~               Security Parameter Index(es) (SPI)              ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                  Figure 17:  Delete Payload Format
-
-   o  Protocol ID (1 octet) - Must be 1 for an IKE_SA, 2 for AH, or
-      3 for ESP.
-
-   o  SPI Size (1 octet) - Length in octets of the SPI as defined by
-      the protocol ID.  It MUST be zero for IKE (SPI is in message
-      header) or four for AH and ESP.
-
-   o  # of SPIs (2 octets) - The number of SPIs contained in the Delete
-      payload.  The size of each SPI is defined by the SPI Size field.
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 71]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   o  Security Parameter Index(es) (variable length) - Identifies the
-      specific security association(s) to delete. The length of this
-      field is determined by the SPI Size and # of SPIs fields.
-
-   The payload type for the Delete Payload is forty two (42).
-
-3.12 Vendor ID Payload
-
-   The Vendor ID Payload contains a vendor defined constant.  The
-   constant is used by vendors to identify and recognize remote
-   instances of their implementations.  This mechanism allows a vendor
-   to experiment with new features while maintaining backwards
-   compatibility.
-
-   A Vendor ID payload MAY announce that the sender is capable to
-   accepting certain extensions to the protocol, or it MAY simply
-   identify the implementation as an aid in debugging.  A Vendor ID
-   payload MUST NOT change the interpretation of any information defined
-   in this specification (i.e., the critical bit MUST be set to 0).
-   Multiple Vendor ID payloads MAY be sent. An implementation is NOT
-   REQUIRED to send any Vendor ID payload at all.
-
-   A Vendor ID payload may be sent as part of any message.  Reception of
-   a familiar Vendor ID payload allows an implementation to make use of
-   Private USE numbers described throughout this memo-- private
-   payloads, private exchanges, private notifications, etc. Unfamiliar
-   Vendor IDs MUST be ignored.
-
-   Writers of Internet-Drafts who wish to extend this protocol MUST
-   define a Vendor ID payload to announce the ability to implement the
-   extension in the Internet-Draft. It is expected that Internet-Drafts
-   which gain acceptance and are standardized will be given "magic
-   numbers" out of the Future Use range by IANA and the requirement to
-   use a Vendor ID will go away.
-
-   The Vendor ID Payload fields are defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                        Vendor ID (VID)                        ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                 Figure 18:  Vendor ID Payload Format
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 72]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   o  Vendor ID (variable length) - It is the responsibility of
-      the person choosing the Vendor ID to assure its uniqueness
-      in spite of the absence of any central registry for IDs.
-      Good practice is to include a company name, a person name
-      or some such. If you want to show off, you might include
-      the latitude and longitude and time where you were when
-      you chose the ID and some random input. A message digest
-      of a long unique string is preferable to the long unique
-      string itself.
-
-   The payload type for the Vendor ID Payload is forty three (43).
-
-
-3.13 Traffic Selector Payload
-
-   The Traffic Selector Payload, denoted TS in this memo, allows peers
-   to identify packet flows for processing by IPsec security services.
-   The Traffic Selector Payload consists of the IKE generic payload
-   header followed by individual traffic selectors as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Number of TSs !                 RESERVED                      !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                       <Traffic Selectors>                     ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 19:  Traffic Selectors Payload Format
-
-   o  Number of TSs (1 octet) - Number of traffic selectors
-      being provided.
-
-   o  RESERVED - This field MUST be sent as zero and MUST be ignored
-      on receipt.
-
-   o  Traffic Selectors (variable length) - one or more individual
-      traffic selectors.
-
-   The length of the Traffic Selector payload includes the TS header and
-   all the traffic selectors.
-
-   The payload type for the Traffic Selector payload is forty four (44)
-   for addresses at the initiator's end of the SA and forty five (45)
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 73]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   for addresses at the responder's end.
-
-3.13.1 Traffic Selector
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !   TS Type     !IP Protocol ID*|       Selector Length         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |           Start Port*         |           End Port*           |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                         Starting Address*                     ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                         Ending Address*                       ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                  Figure 20: Traffic Selector
-
-   *Note: all fields other than TS Type and Selector Length depend on
-   the TS Type. The fields shown are for TS Types 7 and 8, the only two
-   values currently defined.
-
-   o  TS Type (one octet) - Specifies the type of traffic selector.
-
-   o  IP protocol ID (1 octet) - Value specifying an associated IP
-      protocol ID (e.g., UDP/TCP/ICMP). A value of zero means that
-      the protocol ID is not relevant to this traffic selector--
-      the SA can carry all protocols.
-
-   o  Selector Length - Specifies the length of this Traffic
-      Selector Substructure including the header.
-
-   o  Start Port (2 octets) - Value specifying the smallest port
-      number allowed by this Traffic Selector. For protocols for
-      which port is undefined, or if all ports are allowed,
-      this field MUST be zero. For the
-      ICMP protocol, the two one octet fields Type and Code are
-      treated as a single 16 bit integer (with Type in the most
-      significant eight bits and Code in the least significant
-      eight bits) port number for the purposes of filtering based
-      on this field.
-
-   o  End Port (2 octets) - Value specifying the largest port
-      number allowed by this Traffic Selector. For protocols for
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 74]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-      which port is undefined, or if all ports are allowed,
-      this field MUST be 65535. For the
-      ICMP protocol, the two one octet fields Type and Code are
-      treated as a single 16 bit integer (with Type in the most
-      significant eight bits and Code in the least significant
-      eight bits) port number for the purposed of filtering based
-      on this field.
-
-   o  Starting Address - The smallest address included in this
-      Traffic Selector (length determined by TS type).
-
-   o  Ending Address - The largest address included in this
-      Traffic Selector (length determined by TS type).
-
-   Systems that are complying with [RFC2401bis] that wish to indicate
-   "ANY" ports MUST set the start port to 0 and the end port to 65535;
-   note that according to [RFC2401bis], "ANY" includes "OPAQUE". Systems
-   working with [RFC2401bis] that wish to indicate "OPAQUE" ports, but
-   not "ANY" ports, MUST set the start port to 65535 and the end port to
-   0.
-
-   The following table lists the assigned values for the Traffic
-   Selector Type field and the corresponding Address Selector Data.
-
-      TS Type                           Value
-      -------                           -----
-      RESERVED                           0-6
-
-      TS_IPV4_ADDR_RANGE                  7
-
-            A range of IPv4 addresses, represented by two four (4) octet
-            values.  The first value is the beginning IPv4 address
-            (inclusive) and the second value is the ending IPv4 address
-            (inclusive). All addresses falling between the two specified
-            addresses are considered to be within the list.
-
-      TS_IPV6_ADDR_RANGE                  8
-
-            A range of IPv6 addresses, represented by two sixteen (16)
-            octet values.  The first value is the beginning IPv6 address
-            (inclusive) and the second value is the ending IPv6 address
-            (inclusive). All addresses falling between the two specified
-            addresses are considered to be within the list.
-
-      RESERVED TO IANA                    9-240
-      PRIVATE USE                         241-255
-
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 75]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-3.14 Encrypted Payload
-
-   The Encrypted Payload, denoted SK{...} in this memo, contains other
-   payloads in encrypted form. The Encrypted Payload, if present in a
-   message, MUST be the last payload in the message. Often, it is the
-   only payload in the message.
-
-   The algorithms for encryption and integrity protection are negotiated
-   during IKE_SA setup, and the keys are computed as specified in
-   sections 2.14 and 2.18.
-
-   The encryption and integrity protection algorithms are modeled after
-   the ESP algorithms described in RFCs 2104, 2406, 2451. This document
-   completely specifies the cryptographic processing of IKE data, but
-   those documents should be consulted for design rationale. We assume a
-   block cipher with a fixed block size and an integrity check algorithm
-   that computes a fixed length checksum over a variable size message.
-
-   The payload type for an Encrypted payload is forty six (46).  The
-   Encrypted Payload consists of the IKE generic payload header followed
-   by individual fields as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                     Initialization Vector                     !
-      !         (length is block size for encryption algorithm)       !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                    Encrypted IKE Payloads                     !
-      +               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !               !             Padding (0-255 octets)            !
-      +-+-+-+-+-+-+-+-+                               +-+-+-+-+-+-+-+-+
-      !                                               !  Pad Length   !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~                    Integrity Checksum Data                    ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 21:  Encrypted Payload Format
-
-   o  Next Payload - The payload type of the first embedded payload.
-      Note that this is an exception in the standard header format,
-      since the Encrypted payload is the last payload in the
-      message and therefore the Next Payload field would normally
-      be zero. But because the content of this payload is embedded
-      payloads and there was no natural place to put the type of
-      the first one, that type is placed here.
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 76]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   o  Payload Length - Includes the lengths of the header, IV,
-      Encrypted IKE Payloads, Padding, Pad Length and Integrity
-      Checksum Data.
-
-   o  Initialization Vector - A randomly chosen value whose length
-      is equal to the block length of the underlying encryption
-      algorithm. Recipients MUST accept any value. Senders SHOULD
-      either pick this value pseudo-randomly and independently for
-      each message or use the final ciphertext block of the previous
-      message sent. Senders MUST NOT use the same value for each
-      message, use a sequence of values with low hamming distance
-      (e.g., a sequence number), or use ciphertext from a received
-      message.
-
-   o  IKE Payloads are as specified earlier in this section. This
-      field is encrypted with the negotiated cipher.
-
-   o  Padding MAY contain any value chosen by the sender, and MUST
-      have a length that makes the combination of the Payloads, the
-      Padding, and the Pad Length to be a multiple of the encryption
-      block size. This field is encrypted with the negotiated
-      cipher.
-
-   o  Pad Length is the length of the Padding field. The sender
-      SHOULD set the Pad Length to the minimum value that makes
-      the combination of the Payloads, the Padding, and the Pad
-      Length a multiple of the block size, but the recipient MUST
-      accept any length that results in proper alignment. This
-      field is encrypted with the negotiated cipher.
-
-   o  Integrity Checksum Data is the cryptographic checksum of
-      the entire message starting with the Fixed IKE Header
-      through the Pad Length. The checksum MUST be computed over
-      the encrypted message. Its length is determined by the
-      integrity algorithm negotiated.
-
-3.15 Configuration Payload
-
-   The Configuration payload, denoted CP in this document, is used to
-   exchange configuration information between IKE peers. The exchange is
-   for an IRAC to request an internal IP address from an IRAS and to
-   exchange other information of the sort that one would acquire with
-   DHCP if the IRAC were directly connected to a LAN.
-
-   Configuration payloads are of type CFG_REQUEST/CFG_REPLY or
-   CFG_SET/CFG_ACK (see CFG Type in the payload description below).
-   CFG_REQUEST and CFG_SET payloads may optionally be added to any IKE
-   request. The IKE response MUST include either a corresponding
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 77]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   CFG_REPLY or CFG_ACK or a Notify payload with an error type
-   indicating why the request could not be honored. An exception is that
-   a minimal implementation MAY ignore all CFG_REQUEST and CFG_SET
-   payloads, so a response message without a corresponding CFG_REPLY or
-   CFG_ACK MUST be accepted as an indication that the request was not
-   supported.
-
-   "CFG_REQUEST/CFG_REPLY" allows an IKE endpoint to request information
-   from its peer.  If an attribute in the CFG_REQUEST Configuration
-   Payload is not zero length it is taken as a suggestion for that
-   attribute.  The CFG_REPLY Configuration Payload MAY return that
-   value, or a new one.  It MAY also add new attributes and not include
-   some requested ones. Requestors MUST ignore returned attributes that
-   they do not recognize.
-
-   Some attributes MAY be multi-valued, in which case multiple attribute
-   values of the same type are sent and/or returned. Generally, all
-   values of an attribute are returned when the attribute is requested.
-   For some attributes (in this version of the specification only
-   internal addresses), multiple requests indicates a request that
-   multiple values be assigned. For these attributes, the number of
-   values returned SHOULD NOT exceed the number requested.
-
-   If the data type requested in a CFG_REQUEST is not recognized or not
-   supported, the responder MUST NOT return an error type but rather
-   MUST either send a CFG_REPLY which MAY be empty or a reply not
-   containing a CFG_REPLY payload at all. Error returns are reserved for
-   cases where the request is recognized but cannot be performed as
-   requested or the request is badly formatted.
-
-   "CFG_SET/CFG_ACK" allows an IKE endpoint to push configuration data
-   to its peer.  In this case the CFG_SET Configuration Payload contains
-   attributes the initiator wants its peer to alter.  The responder MUST
-   return a Configuration Payload if it accepted any of the
-   configuration data and it MUST contain the attributes that the
-   responder accepted with zero length data.  Those attributes that it
-   did not accept MUST NOT be in the CFG_ACK Configuration Payload. If
-   no attributes were accepted, the responder MUST return either an
-   empty CFG_ACK payload or a response message without a CFG_ACK
-   payload.  There are currently no defined uses for the CFG_SET/CFG_ACK
-   exchange, though they may be used in connection with extensions based
-   on Vendor IDs. An minimal implementation of this specification MAY
-   ignore CFG_SET payloads.
-
-   Extensions via the CP payload SHOULD NOT be used for general purpose
-   management.  Its main intent is to provide a bootstrap mechanism to
-   exchange information within IPsec from IRAS to IRAC.  While it MAY be
-   useful to use such a method to exchange information between some
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 78]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   Security Gateways (SGW) or small networks, existing management
-   protocols such as DHCP [DHCP], RADIUS [RADIUS], SNMP or LDAP [LDAP]
-   should be preferred for enterprise management as well as subsequent
-   information exchanges.
-
-   The Configuration Payload is defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C! RESERVED    !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !   CFG Type    !                    RESERVED                   !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                   Configuration Attributes                    ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 22:  Configuration Payload Format
-
-   The payload type for the Configuration Payload is forty seven (47).
-
-   o  CFG Type (1 octet) - The type of exchange represented by the
-      Configuration Attributes.
-
-             CFG Type       Value
-             ===========    =====
-             RESERVED         0
-             CFG_REQUEST      1
-             CFG_REPLY        2
-             CFG_SET          3
-             CFG_ACK          4
-
-      values 5-127 are reserved to IANA. Values 128-255 are for private
-      use among mutually consenting parties.
-
-   o  RESERVED (3 octets)  - MUST be sent as zero; MUST be ignored on
-      receipt.
-
-   o  Configuration Attributes (variable length) - These are type
-      length values specific to the Configuration Payload and are
-      defined below. There may be zero or more Configuration
-      Attributes in this payload.
-
-
-
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 79]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-3.15.1 Configuration Attributes
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !R|         Attribute Type      !            Length             |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                                                               |
-      ~                             Value                             ~
-      |                                                               |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 23:  Configuration Attribute Format
-
-   o  Reserved (1 bit) - This bit MUST be set to zero and MUST be
-      ignored on receipt.
-
-   o  Attribute Type (7 bits) - A unique identifier for each of the
-      Configuration Attribute Types.
-
-   o  Length (2 octets) - Length in octets of Value.
-
-   o  Value (0 or more octets) - The variable length value of this
-      Configuration Attribute.
-
-   The following attribute types have been defined:
-
-                                      Multi-
-        Attribute Type          Value Valued Length
-        ======================= ===== ====== ==================
-         RESERVED                 0
-         INTERNAL_IP4_ADDRESS     1    YES*  0 or 4 octets
-         INTERNAL_IP4_NETMASK     2    NO    0 or 4 octets
-         INTERNAL_IP4_DNS         3    YES   0 or 4 octets
-         INTERNAL_IP4_NBNS        4    YES   0 or 4 octets
-         INTERNAL_ADDRESS_EXPIRY  5    NO    0 or 4 octets
-         INTERNAL_IP4_DHCP        6    YES   0 or 4 octets
-         APPLICATION_VERSION      7    NO    0 or more
-         INTERNAL_IP6_ADDRESS     8    YES*  0 or 17 octets
-         RESERVED                 9
-         INTERNAL_IP6_DNS        10    YES   0 or 16 octets
-         INTERNAL_IP6_NBNS       11    YES   0 or 16 octets
-         INTERNAL_IP6_DHCP       12    YES   0 or 16 octets
-         INTERNAL_IP4_SUBNET     13    YES   0 or 8 octets
-         SUPPORTED_ATTRIBUTES    14    NO    Multiple of 2
-         INTERNAL_IP6_SUBNET     15    YES   17 octets
-
-      * These attributes may be multi-valued on return only if
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 80]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-        multiple values were requested.
-
-        Types 16-16383 are reserved to IANA. Values 16384-32767 are for
-        private use among mutually consenting parties.
-
-      o  INTERNAL_IP4_ADDRESS, INTERNAL_IP6_ADDRESS - An address on the
-         internal network, sometimes called a red node address or
-         private address and MAY be a private address on the Internet.
-         In a request message, the address specified is a requested
-         address (or zero if no specific address is requested). If a
-         specific address is requested, it likely indicates that a
-         previous connection existed with this address and the requestor
-         would like to reuse that address. With IPv6, a requestor
-         MAY supply the low order address bytes it wants to use.
-         Multiple internal addresses MAY be requested by requesting
-         multiple internal address attributes.  The responder MAY only
-         send up to the number of addresses requested. The
-         INTERNAL_IP6_ADDRESS is made up of two fields; the first
-         being a 16 octet IPv6 address and the second being a one octet
-         prefix-length as defined in [ADDRIPV6].
-
-         The requested address is valid until the expiry time defined
-         with the INTERNAL_ADDRESS EXPIRY attribute or there are no
-         IKE_SAs between the peers.
-
-      o  INTERNAL_IP4_NETMASK - The internal network's netmask.  Only
-         one netmask is allowed in the request and reply messages
-         (e.g., 255.255.255.0) and it MUST be used only with an
-         INTERNAL_IP4_ADDRESS attribute.
-
-      o  INTERNAL_IP4_DNS, INTERNAL_IP6_DNS - Specifies an address of a
-         DNS server within the network.  Multiple DNS servers MAY be
-         requested.  The responder MAY respond with zero or more DNS
-         server attributes.
-
-      o  INTERNAL_IP4_NBNS, INTERNAL_IP6_NBNS - Specifies an address of
-         a NetBios Name Server (WINS) within the network.  Multiple NBNS
-         servers MAY be requested.  The responder MAY respond with zero
-         or more NBNS server attributes.
-
-      o  INTERNAL_ADDRESS_EXPIRY - Specifies the number of seconds that
-         the host can use the internal IP address.  The host MUST renew
-         the IP address before this expiry time.  Only one of these
-         attributes MAY be present in the reply.
-
-      o  INTERNAL_IP4_DHCP, INTERNAL_IP6_DHCP - Instructs the host to
-         send any internal DHCP requests to the address contained within
-         the attribute.  Multiple DHCP servers MAY be requested.  The
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 81]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-         responder MAY respond with zero or more DHCP server attributes.
-
-      o  APPLICATION_VERSION - The version or application information of
-         the IPsec host.  This is a string of printable ASCII characters
-         that is NOT null terminated.
-
-      o  INTERNAL_IP4_SUBNET - The protected sub-networks that this
-         edge-device protects.  This attribute is made up of two fields;
-         the first being an IP address and the second being a netmask.
-         Multiple sub-networks MAY be requested.  The responder MAY
-         respond with zero or more sub-network attributes.
-
-      o  SUPPORTED_ATTRIBUTES - When used within a Request, this
-         attribute MUST be zero length and specifies a query to the
-         responder to reply back with all of the attributes that it
-         supports.  The response contains an attribute that contains a
-         set of attribute identifiers each in 2 octets.  The length
-         divided by 2 (octets) would state the number of supported
-         attributes contained in the response.
-
-      o  INTERNAL_IP6_SUBNET - The protected sub-networks that this
-         edge-device protects.  This attribute is made up of two fields;
-         the first being a 16 octet IPv6 address the second being a one
-         octet prefix-length as defined in [ADDRIPV6].  Multiple
-         sub-networks MAY be requested.  The responder MAY respond with
-         zero or more sub-network attributes.
-
-      Note that no recommendations are made in this document how an
-      implementation actually figures out what information to send in a
-      reply.  i.e., we do not recommend any specific method of an IRAS
-      determining which DNS server should be returned to a requesting
-      IRAC.
-
-3.16 Extensible Authentication Protocol (EAP) Payload
-
-   The Extensible Authentication Protocol Payload, denoted EAP in this
-   memo, allows IKE_SAs to be authenticated using the protocol defined
-   in RFC 3748 [EAP] and subsequent extensions to that protocol. The
-   full set of acceptable values for the payload are defined elsewhere,
-   but a short summary of RFC 3748 is included here to make this
-   document stand alone in the common cases.
-
-
-
-
-
-
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 82]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-                            1                   2                   3
-        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-       ! Next Payload  !C!  RESERVED   !         Payload Length        !
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-       !                                                               !
-       ~                       EAP Message                             ~
-       !                                                               !
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                      Figure 24:  EAP Payload Format
-
-      The payload type for an EAP Payload is forty eight (48).
-
-                            1                   2                   3
-        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-       !     Code      ! Identifier    !           Length              !
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-       !     Type      ! Type_Data...
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
-                      Figure 25:  EAP Message Format
-
-   o  Code (one octet) indicates whether this message is a
-      Request (1), Response (2), Success (3), or Failure (4).
-
-   o  Identifier (one octet) is used in PPP to distinguish replayed
-      messages from repeated ones. Since in IKE, EAP runs over a
-      reliable protocol, it serves no function here. In a response
-      message this octet MUST be set to match the identifier in the
-      corresponding request. In other messages, this field MAY
-      be set to any value.
-
-   o  Length (two octets) is the length of the EAP message and MUST
-      be four less than the Payload Length of the encapsulating
-      payload.
-
-   o  Type (one octet) is present only if the Code field is Request
-      (1) or Response (2). For other codes, the EAP message length
-      MUST be four octets and the Type and Type_Data fields MUST NOT
-      be present. In a Request (1) message, Type indicates the
-      data being requested. In a Response (2) message, Type MUST
-      either be Nak or match the type of the data requested. The
-      following types are defined in RFC 3748:
-
-      1  Identity
-      2  Notification
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 83]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-      3  Nak (Response Only)
-      4  MD5-Challenge
-      5  One-Time Password (OTP)
-      6  Generic Token Card
-
-   o  Type_Data (Variable Length) varies with the Type of Request
-      and the associated Response. For the documentation of the
-      EAP methods, see [EAP].
-
-   Note that since IKE passes an indication of initiator identity in
-   message 3 of the protocol, the responder SHOULD NOT send EAP Identity
-   requests. The initiator SHOULD, however, respond to such requests if
-   it receives them.
-
-4 Conformance Requirements
-
-   In order to assure that all implementations of IKEv2 can
-   interoperate, there are MUST support requirements in addition to
-   those listed elsewhere. Of course, IKEv2 is a security protocol, and
-   one of its major functions is to only allow authorized parties to
-   successfully complete establishment of SAs.  So a particular
-   implementation may be configured with any of a number of restrictions
-   concerning algorithms and trusted authorities that will prevent
-   universal interoperability.
-
-   IKEv2 is designed to permit minimal implementations that can
-   interoperate with all compliant implementations. There are a series
-   of optional features that can easily be ignored by a particular
-   implementation if it does not support that feature. Those features
-   include:
-
-      Ability to negotiate SAs through a NAT and tunnel the resulting
-      ESP SA over UDP.
-
-      Ability to request (and respond to a request for) a temporary IP
-      address on the remote end of a tunnel.
-
-      Ability to support various types of legacy authentication.
-
-      Ability to support window sizes greater than one.
-
-      Ability to establish multiple ESP and/or AH SAs within a single
-      IKE_SA.
-
-      Ability to rekey SAs.
-
-   To assure interoperability, all implementations MUST be capable of
-   parsing all payload types (if only to skip over them) and to ignore
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 84]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   payload types that it does not support unless the critical bit is set
-   in the payload header. If the critical bit is set in an unsupported
-   payload header, all implementations MUST reject the messages
-   containing those payloads.
-
-   Every implementation MUST be capable of doing four message
-   IKE_SA_INIT and IKE_AUTH exchanges establishing two SAs (one for IKE,
-   one for ESP and/or AH).  Implementations MAY be initiate-only or
-   respond-only if appropriate for their platform. Every implementation
-   MUST be capable of responding to an INFORMATIONAL exchange, but a
-   minimal implementation MAY respond to any INFORMATIONAL message with
-   an empty INFORMATIONAL reply (note that within the context of an
-   IKE_SA, an "empty" message consists of an IKE header followed by an
-   Encrypted payload with no payloads contained in it). A minimal
-   implementation MAY support the CREATE_CHILD_SA exchange only in so
-   far as to recognize requests and reject them with a Notify payload of
-   type NO_ADDITIONAL_SAS. A minimal implementation need not be able to
-   initiate CREATE_CHILD_SA or INFORMATIONAL exchanges. When an SA
-   expires (based on locally configured values of either lifetime or
-   octets passed), and implementation MAY either try to renew it with a
-   CREATE_CHILD_SA exchange or it MAY delete (close) the old SA and
-   create a new one. If the responder rejects the CREATE_CHILD_SA
-   request with a NO_ADDITIONAL_SAS notification, the implementation
-   MUST be capable of instead closing the old SA and creating a new one.
-
-   Implementations are not required to support requesting temporary IP
-   addresses or responding to such requests. If an implementation does
-   support issuing such requests, it MUST include a CP payload in
-   message 3 containing at least a field of type INTERNAL_IP4_ADDRESS or
-   INTERNAL_IP6_ADDRESS. All other fields are optional. If an
-   implementation supports responding to such requests, it MUST parse
-   the CP payload of type CFG_REQUEST in message 3 and recognize a field
-   of type INTERNAL_IP4_ADDRESS or INTERNAL_IP6_ADDRESS. If it supports
-   leasing an address of the appropriate type, it MUST return a CP
-   payload of type CFG_REPLY containing an address of the requested
-   type. The responder SHOULD include all of the other related
-   attributes if it has them.
-
-   A minimal IPv4 responder implementation will ignore the contents of
-   the CP payload except to determine that it includes an
-   INTERNAL_IP4_ADDRESS attribute and will respond with the address and
-   other related attributes regardless of whether the initiator
-   requested them.
-
-   A minimal IPv4 initiator will generate a CP payload containing only
-   an INTERNAL_IP4_ADDRESS attribute and will parse the response
-   ignoring attributes it does not know how to use. The only attribute
-   it MUST be able to process is INTERNAL_ADDRESS_EXPIRY, which it must
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 85]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   use to bound the lifetime of the SA unless it successfully renews the
-   lease before it expires. Minimal initiators need not be able to
-   request lease renewals and minimal responders need not respond to
-   them.
-
-   For an implementation to be called conforming to this specification,
-   it MUST be possible to configure it to accept the following:
-
-   PKIX Certificates containing and signed by RSA keys of size 1024 or
-   2048 bits, where the ID passed is any of ID_KEY_ID, ID_FQDN,
-   ID_RFC822_ADDR, or ID_DER_ASN1_DN.
-
-   Shared key authentication where the ID passes is any of ID_KEY_ID,
-   ID_FQDN, or ID_RFC822_ADDR.
-
-   Authentication where the responder is authenticated using PKIX
-   Certificates and the initiator is authenticated using shared key
-   authentication.
-
-5 Security Considerations
-
-   While this protocol is designed to minimize disclosure of
-   configuration information to unauthenticated peers, some such
-   disclosure is unavoidable.  One peer or the other must identify
-   itself first and prove its identity first.  To avoid probing, the
-   initiator of an exchange is required to identify itself first, and
-   usually is required to authenticate itself first. The initiator can,
-   however, learn that the responder supports IKE and what cryptographic
-   protocols it supports. The responder (or someone impersonating the
-   responder) can probe the initiator not only for its identity, but
-   using CERTREQ payloads may be able to determine what certificates the
-   initiator is willing to use.
-
-   Use of EAP authentication changes the probing possibilities somewhat.
-   When EAP authentication is used, the responder proves its identity
-   before the initiator does, so an initiator that knew the name of a
-   valid initiator could probe the responder for both its name and
-   certificates.
-
-   Repeated rekeying using CREATE_CHILD_SA without additional Diffie-
-   Hellman exchanges leaves all SAs vulnerable to cryptanalysis of a
-   single key or overrun of either endpoint. Implementers should take
-   note of this fact and set a limit on CREATE_CHILD_SA exchanges
-   between exponentiations.  This memo does not prescribe such a limit.
-
-   The strength of a key derived from a Diffie-Hellman exchange using
-   any of the groups defined here depends on the inherent strength of
-   the group, the size of the exponent used, and the entropy provided by
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 86]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   the random number generator used. Due to these inputs it is difficult
-   to determine the strength of a key for any of the defined groups.
-   Diffie-Hellman group number two, when used with a strong random
-   number generator and an exponent no less than 200 bits, is common for
-   use with 3DES.  Group five provides greater security than group two.
-   Group one is for historic purposes only and does not provide
-   sufficient strength except for use with DES, which is also for
-   historic use only. Implementations should make note of these
-   estimates when establishing policy and negotiating security
-   parameters.
-
-   Note that these limitations are on the Diffie-Hellman groups
-   themselves.  There is nothing in IKE which prohibits using stronger
-   groups nor is there anything which will dilute the strength obtained
-   from stronger groups (limited by the strength of the other algorithms
-   negotiated including the prf function).  In fact, the extensible
-   framework of IKE encourages the definition of more groups; use of
-   elliptical curve groups may greatly increase strength using much
-   smaller numbers.
-
-   It is assumed that all Diffie-Hellman exponents are erased from
-   memory after use. In particular, these exponents MUST NOT be derived
-   from long-lived secrets like the seed to a pseudo-random generator
-   that is not erased after use.
-
-   The strength of all keys are limited by the size of the output of the
-   negotiated prf function. For this reason, a prf function whose output
-   is less than 128 bits (e.g., 3DES-CBC) MUST NOT be used with this
-   protocol.
-
-   The security of this protocol is critically dependent on the
-   randomness of the randomly chosen parameters. These should be
-   generated by a strong random or properly seeded pseudo-random source
-   (see [RFC1750]).  Implementers should take care to ensure that use of
-   random numbers for both keys and nonces is engineered in a fashion
-   that does not undermine the security of the keys.
-
-   For information on the rationale of many of the cryptographic design
-   choices in this protocol, see [SIGMA]. Though the security of
-   negotiated CHILD_SAs does not depend on the strength of the
-   encryption and integrity protection negotiated in the IKE_SA,
-   implementations MUST NOT negotiate NONE as the IKE integrity
-   protection algorithm or ENCR_NULL as the IKE encryption algorithm.
-
-   When using pre-shared keys, a critical consideration is how to assure
-   the randomness of these secrets. The strongest practice is to ensure
-   that any pre-shared key contain as much randomness as the strongest
-   key being negotiated. Deriving a shared secret from a password, name,
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 87]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   or other low entropy source is not secure. These sources are subject
-   to dictionary and social engineering attacks, among others.
-
-   The NAT_DETECTION_*_IP notifications contain a hash of the addresses
-   and ports in an attempt to hide internal IP addresses behind a NAT.
-   Since the IPv4 address space is only 32 bits, and it is usually very
-   sparse, it would be possible for an attacker to find out the internal
-   address used behind the NAT box by trying all possible IP-addresses
-   and trying to find the matching hash. The port numbers are normally
-   fixed to 500, and the SPIs can be extracted from the packet. This
-   reduces the number of hash calculations to 2^32. With an educated
-   guess of the use of private address space, the number of hash
-   calculations is much smaller. Designers should therefore not assume
-   that use of IKE will not leak internal address information.
-
-   When using an EAP authentication method that does not generate a
-   shared key for protecting a subsequent AUTH payload, certain man-in-
-   the-middle and server impersonation attacks are possible [EAPMITM].
-   These vulnerabilities occur when EAP is also used in protocols which
-   are not protected with a secure tunnel. Since EAP is a general-
-   purpose authentication protocol, which is often used to provide
-   single-signon facilities, a deployed IPsec solution which relies on
-   an EAP authentication method that does not generate a shared key
-   (also known as a non-key-generating EAP method) can become
-   compromised due to the deployment of an entirely unrelated
-   application that also happens to use the same non-key-generating EAP
-   method, but in an unprotected fashion. Note that this vulnerability
-   is not limited to just EAP, but can occur in other scenarios where an
-   authentication infrastructure is reused. For example, if the EAP
-   mechanism used by IKEv2 utilizes a token authenticator, a man-in-the-
-   middle attacker could impersonate the web server, intercept the token
-   authentication exchange, and use it to initiate an IKEv2 connection.
-   For this reason, use of non-key-generating EAP methods SHOULD be
-   avoided where possible. Where they are used, it is extremely
-   important that all usages of these EAP methods SHOULD utilize a
-   protected tunnel, where the initiator validates the responder's
-   certificate before initiating the EAP exchange. Implementers SHOULD
-   describe the vulnerabilities of using non-key-generating EAP methods
-   in the documentation of their implementations so that the
-   administrators deploying IPsec solutions are aware of these dangers.
-
-   An implementation using EAP MUST also use a public key based
-   authentication of the server to the client before the EAP exchange
-   begins, even if the EAP method offers mutual authentication. This
-   avoids having additional IKEv2 protocol variations and protects the
-   EAP data from active attackers.
-
-   If the messages of IKEv2 are long enough that IP level fragmentation
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 88]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   is necessary, it is possible that attackers could prevent the
-   exchange from completing by exhausting the reassembly buffers. The
-   chances of this can be minimized by using the Hash and URL encodings
-   instead of sending certificates (see section 3.6). Additional
-   mitigations are discussed in [KPS03].
-
-6 IANA Considerations
-
-   This document defines a number of new field types and values where
-   future assignments will be managed by the IANA.
-
-   The following registries should be created:
-
-      IKEv2 Exchange Types (section 3.1)
-      IKEv2 Payload Types (section 3.2)
-      IKEv2 Transform Types (section 3.3.2)
-          IKEv2 Transform Attribute Types (section 3.3.2)
-          IKEv2 Encryption Transform IDs (section 3.3.2)
-          IKEv2 Pseudo-random Function Transform IDs (section 3.3.2)
-          IKEv2 Integrity Algorithm Transform IDs (section 3.3.2)
-          IKEv2 Diffie-Hellman Transform IDs (section 3.3.2)
-      IKEv2 Identification Payload ID Types (section 3.5)
-      IKEv2 Certificate Encodings (section 3.6)
-      IKEv2 Authentication Method (section 3.8)
-      IKEv2 Notify Message Types (section 3.10.1)
-          IKEv2 Notification IPCOMP Transform IDs (section 3.10.1)
-      IKEv2 Security Protocol Identifiers (section 3.3.1)
-      IKEv2 Traffic Selector Types (section 3.13.1)
-      IKEv2 Configuration Payload CFG Types (section 3.15)
-      IKEv2 Configuration Payload Attribute Types (section 3.15.1)
-
-   Note: when creating a new Transform Type, a new registry for it must
-   be created.
-
-   Changes and additions to any of those registries are by expert
-   review.
-
-7 Acknowledgements
-
-   This document is a collaborative effort of the entire IPsec WG. If
-   there were no limit to the number of authors that could appear on an
-   RFC, the following, in alphabetical order, would have been listed:
-   Bill Aiello, Stephane Beaulieu, Steve Bellovin, Sara Bitan, Matt
-   Blaze, Ran Canetti, Darren Dukes, Dan Harkins, Paul Hoffman, John
-   Ioannidis, Charlie Kaufman, Steve Kent, Angelos Keromytis, Tero
-   Kivinen, Hugo Krawczyk, Andrew Krywaniuk, Radia Perlman, Omer
-   Reingold, and Michael Richardson. Many other people contributed to
-   the design. It is an evolution of IKEv1, ISAKMP, and the IPsec DOI,
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 89]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   each of which has its own list of authors.  Hugh Daniel suggested the
-   feature of having the initiator, in message 3, specify a name for the
-   responder, and gave the feature the cute name "You Tarzan, Me Jane".
-   David Faucher and Valery Smyzlov helped refine the design of the
-   traffic selector negotiation.
-
-8 References
-
-8.1 Normative References
-
-   [ADDGROUP] Kivinen, T., and Kojo, M., "More Modular Exponential
-              (MODP) Diffie-Hellman groups for Internet Key
-              Exchange (IKE)", RFC 3526, May 2003.
-
-   [ADDRIPV6] Hinden, R., and Deering, S.,
-              "Internet Protocol Version 6 (IPv6) Addressing
-              Architecture", RFC 3513, April 2003.
-
-   [Bra97]    Bradner, S., "Key Words for use in RFCs to indicate
-              Requirement Levels", BCP 14, RFC 2119, March 1997.
-
-   [EAP]      Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and
-              Levkowetz, H., "Extensible Authentication Protocol
-              (EAP)", RFC 3748, June 2004.
-
-   [ESPCBC]   Pereira, R., Adams, R., "The ESP CBC-Mode Cipher
-              Algorithms", RFC 2451, November 1998.
-
-   [Hutt04]   Huttunen, A. et. al., "UDP Encapsulation of IPsec
-              Packets", draft-ietf-ipsec-udp-encaps-08.txt, February
-              2004, work in progress.
-
-   [RFC2401bis] Kent, S. and Atkinson, R., "Security Architecture
-              for the Internet Protocol",
-              draft-ietf-ipsec-rfc2401bis-02.txt, April 2004, work
-              in progress.
-
-   [RFC2434]  Narten, T. and H. Alvestrand, "Guidelines for Writing
-              an IANA Considerations Section in RFCs", BCP 26, RFC 2434,
-              October 1998.
-
-   [RFC3168]  Ramakrishnan, K., Floyd, S., and Black, D.,
-              "The Addition of Explicit Congestion Notification (ECN)
-              to IP", RFC 3168, September 2001.
-
-   [RFC3280]  Housley, R., Polk, W., Ford, W., Solo, D., "Internet
-              X.509 Public Key Infrastructure Certificate and
-              Certificate Revocation List (CRL) Profile", RFC 3280,
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 90]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-              April 2002.
-
-   [RFC3667]  Bradner, S., "IETF Rights in Submissions", BCP 78,
-              RFC 3667, February 2004.
-
-   [RFC3668]  Bradner, S., "Intellectual Property Rights in IETF
-              Technology", BCP 79, RFC 3668, February 2004.
-
-8.2 Informative References
-
-   [DES]      ANSI X3.106, "American National Standard for Information
-              Systems-Data Link Encryption", American National Standards
-              Institute, 1983.
-
-   [DH]       Diffie, W., and Hellman M., "New Directions in
-              Cryptography", IEEE Transactions on Information Theory, V.
-              IT-22, n. 6, June 1977.
-
-   [DHCP]     R. Droms, "Dynamic Host Configuration Protocol",
-              RFC2131
-
-   [DSS]      NIST, "Digital Signature Standard", FIPS 186, National
-              Institute of Standards and Technology, U.S. Department of
-              Commerce, May, 1994.
-
-   [EAPMITM]  Asokan, N., Nierni, V., and Nyberg, K., "Man-in-the-Middle
-              in Tunneled Authentication Protocols",
-              http://eprint.iacr.org/2002/163, November 2002.
-
-   [HC98]     Harkins, D., Carrel, D., "The Internet Key Exchange
-              (IKE)", RFC 2409, November 1998.
-
-   [IDEA]     Lai, X., "On the Design and Security of Block Ciphers,"
-              ETH Series in Information Processing, v. 1, Konstanz:
-              Hartung-Gorre Verlag, 1992
-
-   [IPCOMP]   Shacham, A., Monsour, R., Pereira, R., and Thomas, M., "IP
-              Payload Compression Protocol (IPComp)", RFC 3173,
-              September 2001.
-
-   [KPS03]    Kaufman, C., Perlman, R., and Sommerfeld, B., "DoS
-              protection for UDP-based protocols", ACM Conference on
-              Computer and Communications Security, October 2003.
-
-   [KBC96]    Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
-              Hashing for Message Authentication", RFC 2104, February
-              1997.
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 91]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   [LDAP]     M. Wahl, T. Howes, S. Kille., "Lightweight Directory
-              Access Protocol (v3)", RFC 2251
-
-   [MD5]      Rivest, R., "The MD5 Message Digest Algorithm", RFC 1321,
-              April 1992.
-
-   [MSST98]   Maughhan, D., Schertler, M., Schneider, M., and Turner, J.
-              "Internet Security Association and Key Management Protocol
-              (ISAKMP)", RFC 2408, November 1998.
-
-   [Orm96]    Orman, H., "The Oakley Key Determination Protocol", RFC
-              2412, November 1998.
-
-   [PFKEY]    McDonald, D., Metz, C., and Phan, B., "PFKEY Key
-              Management API, Version 2", RFC 2367, July 1998.
-
-   [PKCS1]    Kaliski, B., and J. Staddon, "PKCS #1: RSA Cryptography
-              Specifications Version 2", September 1998.
-
-   [PK01]     Perlman, R., and Kaufman, C., "Analysis of the IPsec key
-              exchange Standard", WET-ICE Security Conference, MIT,2001,
-              http://sec.femto.org/wetice-2001/papers/radia-paper.pdf.
-
-   [Pip98]    Piper, D., "The Internet IP Security Domain Of
-              Interpretation for ISAKMP", RFC 2407, November 1998.
-
-   [RADIUS]   C. Rigney, A. Rubens, W. Simpson, S. Willens, "Remote
-              Authentication Dial In User Service (RADIUS)", RFC 2138
-
-   [RFC1750]  Eastlake, D., Crocker, S., and Schiller, J., "Randomness
-              Recommendations for Security", RFC 1750, December 1994.
-
-   [RFC1958]  Carpenter, B., "Architectural Principles of the
-              Internet", RFC 1958, June 1996.
-
-   [RFC2401]  Kent, S., and Atkinson, R., "Security Architecture for
-              the Internet Protocol", RFC 2401, November 1998.
-
-   [RFC2402]  Kent, S., and Atkinson, R., "IP Authentication Header",
-              RFC 2402, November 1998.
-
-   [RFC2406]  Kent, S., and Atkinson, R., "IP Encapsulating Security
-              Payload (ESP)", RFC 2406, November 1998.
-
-   [RFC2474]  Nichols, K., Blake, S., Baker, F. and Black, D.,
-              "Definition of the Differentiated Services Field (DS
-              Field) in the IPv4 and IPv6 Headers", RFC 2474,
-              December 1998.
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 92]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   [RFC2475]  Blake, S., Black, D., Carlson, M., Davies, E., Wang, Z.
-              and Weiss, W., "An Architecture for Differentiated
-              Services", RFC 2475, December 1998.
-
-   [RFC2522]  Karn, P., and Simpson, W., "Photuris: Session-Key
-              Management Protocol", RFC 2522, March 1999.
-
-   [RFC2775]  Carpenter, B., "Internet Transparency", RFC 2775,
-              February 2000.
-
-   [RFC2983]  Black, D., "Differentiated Services and Tunnels",
-              RFC 2983, October 2000.
-
-   [RFC3439]  Bush, R. and D. Meyer, "Some Internet Architectural
-              Guidelines and Philosophy", RFC 3429, December 2002.
-
-   [RFC3715]  Aboba, B and Dixon, W., "IPsec-Network Address
-              Translation (NAT) Compatibility Requirements",
-              RFC 3715, March 2004.
-
-   [RSA]      Rivest, R., Shamir, A., and Adleman, L., "A Method for
-              Obtaining Digital Signatures and Public-Key
-              Cryptosystems", Communications of the ACM, v. 21, n. 2,
-              February 1978.
-
-   [SHA]      NIST, "Secure Hash Standard", FIPS 180-1, National
-              Institute of Standards and Technology, U.S. Department
-              of Commerce, May 1994.
-
-   [SIGMA]    Krawczyk, H., "SIGMA: the `SIGn-and-MAc' Approach to
-              Authenticated Diffie-Hellman and its Use in the IKE
-              Protocols", in Advances in Cryptography - CRYPTO 2003
-              Proceedings, LNCS 2729, Springer, 2003. Available at:
-              http://www.ee.technion.ac.il/~hugo/sigma.html
-
-   [SKEME]    Krawczyk, H., "SKEME: A Versatile Secure Key Exchange
-              Mechanism for Internet", from IEEE Proceedings of the
-              1996 Symposium on Network and Distributed Systems
-              Security.
-
-   [X.501]    ITU-T Recommendation X.501: Information Technology -
-              Open Systems Interconnection - The Directory: Models,
-              1993.
-
-   [X.509]    ITU-T Recommendation X.509 (1997 E): Information
-              Technology - Open Systems Interconnection - The
-              Directory: Authentication Framework, June 1997.
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 93]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-Appendix A: Summary of changes from IKEv1
-
-
-   The goals of this revision to IKE are:
-
-   1) To define the entire IKE protocol in a single document, replacing
-   RFCs 2407, 2408, and 2409 and incorporating subsequent changes to
-   support NAT Traversal, Extensible Authentication, and Remote Address
-   acquisition.
-
-   2) To simplify IKE by replacing the eight different initial exchanges
-   with a single four message exchange (with changes in authentication
-   mechanisms affecting only a single AUTH payload rather than
-   restructuring the entire exchange);
-
-   3) To remove the Domain of Interpretation (DOI), Situation (SIT), and
-   Labeled Domain Identifier fields, and the Commit and Authentication
-   only bits;
-
-   4) To decrease IKE's latency in the common case by making the initial
-   exchange be 2 round trips (4 messages), and allowing the ability to
-   piggyback setup of a CHILD_SA on that exchange;
-
-   5) To replace the cryptographic syntax for protecting the IKE
-   messages themselves with one based closely on ESP to simplify
-   implementation and security analysis;
-
-   6) To reduce the number of possible error states by making the
-   protocol reliable (all messages are acknowledged) and sequenced. This
-   allows shortening CREATE_CHILD_SA exchanges from 3 messages to 2;
-
-   7) To increase robustness by allowing the responder to not do
-   significant processing until it receives a message proving that the
-   initiator can receive messages at its claimed IP address, and not
-   commit any state to an exchange until the initiator can be
-   cryptographically authenticated;
-
-   8) To fix cryptographic weaknesses such as the problem with
-   symmetries in hashes used for authentication documented by Tero
-   Kivinen.
-
-   9) To specify Traffic Selectors in their own payloads type rather
-   than overloading ID payloads, and making more flexible the Traffic
-   Selectors that may be specified;
-
-   10) To specify required behavior under certain error conditions or
-   when data that is not understood is received in order to make it
-   easier to make future revisions in a way that does not break
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 94]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   backwards compatibility;
-
-   11) To simplify and clarify how shared state is maintained in the
-   presence of network failures and Denial of Service attacks; and
-
-   12) To maintain existing syntax and magic numbers to the extent
-   possible to make it likely that implementations of IKEv1 can be
-   enhanced to support IKEv2 with minimum effort.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 95]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-Appendix B: Diffie-Hellman Groups
-
-   There are two Diffie-Hellman groups defined here for use in IKE.
-   These groups were generated by Richard Schroeppel at the University
-   of Arizona. Properties of these primes are described in [Orm96].
-
-   The strength supplied by group one may not be sufficient for the
-   mandatory-to-implement encryption algorithm and is here for historic
-   reasons.
-
-   Additional Diffie-Hellman groups have been defined in [ADDGROUP].
-
-B.1 Group 1 - 768 Bit MODP
-
-   This group is assigned id 1 (one).
-
-   The prime is: 2^768 - 2 ^704 - 1 + 2^64 * { [2^638 pi] + 149686 }
-   Its hexadecimal value is:
-
-        FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08
-        8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B
-        302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9
-        A63A3620 FFFFFFFF FFFFFFFF
-
-   The generator is 2.
-
-B.2 Group 2 - 1024 Bit MODP
-
-   This group is assigned id 2 (two).
-
-   The prime is 2^1024 - 2^960 - 1 + 2^64 * { [2^894 pi] + 129093 }.
-   Its hexadecimal value is:
-
-        FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08
-        8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B
-        302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9
-        A637ED6B 0BFF5CB6 F406B7ED EE386BFB 5A899FA5 AE9F2411 7C4B1FE6
-        49286651 ECE65381 FFFFFFFF FFFFFFFF
-
-   The generator is 2.
-
-
-
-
-
-
-
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 96]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-Change History (To be removed from RFC)
-
-H.1 Changes from IKEv2-00 to IKEv2-01 February 2002
-
-   1) Changed Appendix B to specify the encryption and authentication
-   processing for IKE rather than referencing ESP. Simplified the format
-   by removing idiosyncrasies not needed for IKE.
-
-   2) Added option for authentication via a shared secret key.
-
-   3) Specified different keys in the two directions of IKE messages.
-   Removed requirement of different cookies in the two directions since
-   now no longer required.
-
-   4) Change the quantities signed by the two ends in AUTH fields to
-   assure the two parties sign different quantities.
-
-   5) Changed reference to AES to AES_128.
-
-   6) Removed requirement that Diffie-Hellman be repeated when rekeying
-   IKE_SA.
-
-   7) Fixed typos.
-
-   8) Clarified requirements around use of port 500 at the remote end in
-   support of NAT.
-
-   9) Clarified required ordering for payloads.
-
-   10) Suggested mechanisms for avoiding DoS attacks.
-
-   11) Removed claims in some places that the first phase 2 piggybacked
-   on phase 1 was optional.
-
-H.2 Changes from IKEv2-01 to IKEv2-02 April 2002
-
-   1) Moved the Initiator CERTREQ payload from message 1 to message 3.
-
-   2) Added a second optional ID payload in message 3 for the Initiator
-   to name a desired Responder to support the case where multiple named
-   identities are served by a single IP address.
-
-   3) Deleted the optimization whereby the Diffie-Hellman group did not
-   need to be specified in phase 2 if it was the same as in phase 1 (it
-   complicated the design with no meaningful benefit).
-
-   4) Added a section on the implications of reusing Diffie-Hellman
-   exponentials
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 97]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   5) Changed the specification of sequence numbers to being at 0 in
-   both directions.
-
-   6) Many editorial changes and corrections, the most significant being
-   a global replace of "byte" with "octet".
-
-H.3 Changes from IKEv2-02 to IKEv2-03 October 2002
-
-   1) Reorganized the document moving introductory material to the
-   front.
-
-   2) Simplified the specification of Traffic Selectors to allow only
-   IPv4 and IPv6 address ranges, as was done in the JFK spec.
-
-   3) Fixed the problem brought up by David Faucher with the fix
-   suggested by Valery Smyslov. If Bob needs to narrow the selector
-   range, but has more than one matching narrower range, then if Alice's
-   first selector is a single address pair, Bob chooses the range that
-   encompasses that.
-
-   4) To harmonize with the JFK spec, changed the exchange so that the
-   initial exchange can be completed in four messages even if the
-   responder must invoke an anti-clogging defense and the initiator
-   incorrectly anticipates the responder's choice of Diffie-Hellman
-   group.
-
-   5) Replaced the hierarchical SA payload with a simplified version
-   that only negotiates suites of cryptographic algorithms.
-
-H.4 Changes from IKEv2-03 to IKEv2-04 January 2003
-
-   1) Integrated NAT traversal changes (including Appendix A).
-
-   2) Moved the anti-clogging token (cookie) from the SPI to a NOTIFY
-   payload; changed negotiation back to 6 messages when a cookie is
-   needed.
-
-   3) Made capitalization of IKE_SA and CHILD_SA consistent.
-
-   4) Changed how IPComp was negotiated.
-
-   5) Added usage scenarios.
-
-   6) Added configuration payload for acquiring internal addresses on
-   remote networks.
-
-   7) Added negotiation of tunnel vs. transport mode.
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 98]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-H.5 Changes from IKEv2-04 to IKEv2-05 February 2003
-
-   1) Shortened Abstract
-
-   2) Moved NAT Traversal from Appendix to section 2. Moved changes from
-   IKEv2 to Appendix A. Renumbered sections.
-
-   3) Made language more consistent. Removed most references to Phase 1
-   and Phase 2.
-
-   4) Made explicit the requirements for support of NAT Traversal.
-
-   5) Added support for Extended Authentication Protocol methods.
-
-   6) Added Response bit to message header.
-
-   7) Made more explicit the encoding of Diffie-Hellman numbers in key
-   expansion algorithms.
-
-   8) Added ID payloads to AUTH payload computation.
-
-   9) Expanded set of defined cryptographic suites.
-
-   10) Added text for MUST/SHOULD support for ID payloads.
-
-   11) Added new certificate formats and added MUST/SHOULD text.
-
-   12) Clarified use of CERTREQ.
-
-   13) Deleted "MUST SUPPORT" column in CP payload specification (it was
-   inconsistent with surrounding text).
-
-   14) Extended and clarified Conformance Requirements section,
-   including specification of a minimal implementation.
-
-   15) Added text to specify ECN handling.
-
-H.6 Changes from IKEv2-05 to IKEv2-06 March 2003
-
-   1) Changed the suite based crypto negotiation back to ala carte.
-
-   2) Eliminated some awkward page breaks, typographical errors, and
-   other formatting issues.
-
-   3) Tightened language describing cryptographic strength.
-
-   4) Added references.
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt            [Page 99]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   5) Added more specific error codes.
-
-   6) Added rationale for unintuitive key generation hash with shared
-   secret based authentication.
-
-   7) Changed the computation of the authenticating AUTH payload as
-   proposed by Hugo Krawczyk.
-
-   8) Changed the dashes (-) to underscores (_) in the names of fields
-   and constants.
-
-H.7 Changes from IKEv2-06 to IKEv2-07 April 2003
-
-   1) Added a list of payload types to section 3.2.
-
-   2) Clarified use of SET_WINDOW_SIZE Notify payload.
-
-   3) Removed references to COOKIE_REQUIRED Notify payload.
-
-   4) Specified how to use a prf with a fixed key size.
-
-   5) Removed g^ir from data processed by prf+.
-
-   6) Strengthened cautions against using passwords as shared keys.
-
-   7) Renamed Protocol_id field SECURITY_PROTOCOL_ID when it is not the
-   Protocol ID from IP, and changed its values for consistency with
-   IKEv1.
-
-   8) Clarified use of ID payload in access control decisions.
-
-   9) Gave IDr and TSr their own payload type numbers.
-
-   10) Added Intellectual Property rights section.
-
-   11) Clarified some issues in NAT Traversal.
-
-H.8 Changes from IKEv2-07 to IKEv2-08 May 2003
-
-   1) Numerous editorial corrections and clarifications.
-
-   2) Renamed Gateway to Security Gateway.
-
-   3) Made explicit that the ability to rekey SAs without restarting IKE
-   was optional.
-
-   4) Removed last references to MUST and SHOULD cipher suites.
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt           [Page 100]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   5) Changed examples to "example.com".
-
-   6) Changed references to status codes to status types.
-
-   7) Simplified IANA Considerations section
-
-   8) Updated References
-
-H.9 Changes from IKEv2-08 to IKEv2-09 August 2003
-
-   1) Numerous editorial corrections and clarifications.
-
-   2) Added REKEY_SA notify payload to the first message of a
-   CREATE_CHILD_SA exchange if the new exchange was rekeying an existing
-   SA.
-
-   3) Renamed AES_ENCR128 to AES_ENCR and made it take a single
-   parameter that is the key size (which may be 128, 192, or 256 bits).
-
-   4) Clarified when a newly created SA is useable.
-
-   5) Added additional text to section 2.23 specifying how to negotiate
-   NAT Traversal.
-
-   6) Replaced specification of ECN handling with a reference to
-   [RFC2401bis].
-
-   7) Renumbered payloads so that numbers would not collide with IKEv1
-   payload numbers in hopes of making code implementing both protocols
-   simpler.
-
-   8) Expanded the Transform ID field (also referred to as Diffie-
-   Hellman group number) from one byte to two bytes.
-
-   9) Removed ability to negotiate Diffie-Hellman groups by explicitly
-   passing parameters. They must now be negotiated using Transform IDs.
-
-   10) Renumbered status codes to be contiguous.
-
-   11) Specified the meaning of the "Port" fields in Traffic Selectors
-   when the ICMP protocol is being used.
-
-   12) Removed the specification of D-H Group #5 since it is already
-   specified in [ADDGROUP].
-
-
-
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt           [Page 101]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-H.10 Changes from IKEv2-09 to IKEv2-10 August 2003
-
-   1) Numerous boilerplate and formatting corrections to comply with RFC
-   Editorial Guidelines and procedures.
-
-   2) Fixed five typographical errors.
-
-   3) Added a sentence to the end of "Security considerations"
-   discouraging the use of non-key-generating EAP mechanisms.
-
-H.11 Changes from IKEv2-10 to IKEv2-11 October 2003
-
-   1) Added SHOULD NOT language concerning use of non-key-generating EAP
-   authentication methods and added reference [EAPMITM].
-
-   2) Clarified use of parallel SAs with identical traffic selectors for
-   purposes of QoS handling.
-
-   3) Fixed description of ECN handling to make normative references to
-   [RFC2401bis] and [RFC3168].
-
-   4) Fixed two typos in the description of NAT traversal.
-
-   5) Added specific ASN.1 encoding of certificate bundles in section
-   3.6.
-
-H.12 Changes from IKEv2-11 to IKEv2-12 January 2004
-
-   1) Made the values of the one byte IPsec Protocol ID consistent
-   between payloads and made the naming more nearly consistent.
-
-   2) Changed the specification to require that AUTH payloads be
-   provided in EAP exchanges even when a non-key generating EAP method
-   is used.  This protects against certain obscure cryptographic
-   threats.
-
-   3) Changed all example IP addresses to be within subnet 10.
-
-   4) Specified that issues surrounding weak keys and DES key parity
-   must be addressed in algorithm documents.
-
-   5) Removed the unsupported (and probably untrue) claim that Photuris
-   cookies were given that name because the IETF always supports
-   proposals involving cookies.
-
-   6) Fixed some text that specified that Transform ID was 1 octet while
-   everywhere else said it was 2 octets.
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt           [Page 102]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   7) Corrected the ASN.1 specification of the encoding of X.509
-   certificate bundles.
-
-   8) Added an INVALID_SELECTORS error type.
-
-   9) Replaced IANA considerations section with a reference to draft-
-   ietf-ipsec-ikev2-iana-00.txt.
-
-   10) Removed 2 obsolete informative references and added one to a
-   paper on UDP fragmentation problems.
-
-   11) 41 Editorial Corrections and Clarifications.
-
-   12) 6 Grammatical and Spelling errors fixed.
-
-   13) 4 Corrected capitalizations of MAY/MUST/etc.
-
-   14) 4 Attempts to make capitalization and use of underscores more
-   consistent.
-
-H.13 Changes from IKEv2-12 to IKEv2-13 March 2004
-
-   1) Updated copyright and intellectual property right sections per RFC
-   3667.  Added normative references to RFC 3667 and RFC 3668.
-
-   2) Updated IANA Considerations section and adjusted some assignment
-   tables to be consistent with the IANA registries document. Added
-   Michael Richardson to the acknowledgements.
-
-   3) Changed the cryptographic formula for computing the AUTH payload
-   in the case where EAP authentication is used and the EAP algorithm
-   does not produce a shared key. Clarified the case where it does
-   produce a shared key.
-
-   4) Extended the EAP authentication protocol by two messages so that
-   the AUTH message is always sent after the success status is received.
-
-   5) Updated reference to ESP encapsulation in UDP and made it
-   normative.
-
-   6) Added notification type ESP_TFC_PADDING_NOT_SUPPORTED.
-
-   7) Clarified encoding of port number fields in transport selectors in
-   the cases of ICMP and OPAQUE.
-
-   8) Clarified that the length of the integrity checksum is fixed
-   length and determined by the negotiated integrity algorithm.
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt           [Page 103]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   9) Added an informative reference to RFC 3715 (NAT Compatibility
-   Requirements).
-
-   10) Fixed 2 typos.
-
-H.14 Changes from IKEv2-13 to IKEv2-14 May 2004
-
-   1) ISSUE #99: Clarified use of tunnel mode vs. transport mode.
-
-   2) Changed the cryptographic formula for computing the AUTH payload
-   in response to a suggestion from Hugo Krawczyk.
-
-   3) Fixed a wording error in the explanation of why NAT traversal
-   works as it does related to processing by legacy NAT gateways.
-
-   4) Corrected the label AUTH_AES_XCBC_96 to AUTH_AES_PRF_128.
-
-   5) Deleted suggestion that ID_KEY_ID field might be used to pass an
-   account name.
-
-   6) Listed the newly allocated OID for certificate bundle.
-
-   7) Added NON_FIRST_FRAGMENTS_ALSO notification for negotiating the
-   ability to send non-initial fragments of packets on the same SA as
-   the initial fragments.
-
-   8) ISSUE #97: Removed language concerning the relative strength of
-   Diffie-Hellman groups.
-
-   9) ISSUE #100: Reduced requirements concerning sending of
-   certificates to allow implementations to by more coy about their
-   identities and protect themselves from probing attacks. Listed in
-   Security Considerations some issues an implementer might consider in
-   deciding how to deal with such attacks.
-
-   10) Made the punctuation of references to RFCs more consistent.
-
-   11) Fixed fourteen typos.
-
-H.15 Changes from IKEv2-14 to IKEv2-15 August 2004
-
-   1) ISSUE #111, 113: Made support for "Hash and URL" as a substitute
-   for certificates mandatory, and added explanatory text about the
-   dangers of depending on IP fragmentation for large messages.
-
-   2) ISSUE #110: Made support for configuring shared keys by means of a
-   HEX encoded byte string mandatory.
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt           [Page 104]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   3) Clarified use of special traffic selectors with a port range from
-   65535 - 0.
-
-   4) ISSUE #110: Added reference to RFC2401bis for definitions of
-   terms.
-
-   5) ISSUE #110, 114: Made required support of ID_IPV4_ADDR and
-   ID_IPV6_ADDR depend on support of IPv4 vs. IPv6 as a transport.
-
-   6) ISSUE #114: Removed INTERNAL_IP6_NETMASK and replaced it with text
-   describing how an endpoint should request an IP address with
-   specified low order bytes.
-
-   7) ISSUE #101, 102, 104, 105, 106, and 107: Fold in information from
-   draft-ietf-ipsec-ikev2-iana-00.txt to make that document unnecessary
-   for initial IANA settings. Deleted it from references.
-
-   8) ISSUE #110: Removed reference to ENCR_RC4.
-
-   9) ISSUE #112: Removed reference to draft-keromytis-ike-id-00.txt,
-   which will not be published as an RFC.
-
-   10) ISSUE #112: Removed text incorrectly implying that AH could be
-   tunneled over port 4500.
-
-   11) ISSUE #112: Removed reference to draft-ietf-ipsec-nat-
-   reqts-04.txt.
-
-   12) ISSUE #112: Removed reference to draft-ipsec-ike-hash-
-   revised-02.txt, and substituted a short explanation of the problem
-   addressed.
-
-   13) ISSUE #112: Changed the label of PRF_AES_CBC to PRF_AES128_CBC
-
-   14) ISSUE #110: Clarified distinction between Informational messages
-   and Informational exchanges.
-
-   15) ISSUE #110: Clarified distinction between SA payloads and SAs.
-
-   16) ISSUE #109: Clarified that cryptographic algorithms that MUST be
-   supported can still be configured as off.
-
-   17) ISSUE #110: Changed example IP addresses from 10.*.*.* to
-   192.0.*.*.
-
-   18) ISSUE #108: Rephrased to avoid use of the undefined acronyms PFS
-   and NAT-T.
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt           [Page 105]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   19) ISSUE #113: Added requirement that backoff timers on
-   retransmissions must increase exponentially to avoid network
-   congestion.
-
-   20) Replaced dubious explanation of NON_FIRST_FRAGMENTS_ALSO with a
-   reference to RFC2401bis.
-
-   21) Fixed 16 spelling/typographical/gramatical errors.
-
-H.16 Changes from IKEv2-15 to IKEv2-16 September 2004
-
-   1) Added the text: "All IKEv2 implementations MUST be able to send,
-   receive, and process IKE messages that are up to 1280 bytes long, and
-   they SHOULD be able to send, receive, and process messages that are
-   up to 3000 bytes long."
-
-   2) Removed the two ECC groups from Appendix B.
-
-   3) Changed references to RFC 2284 to RFC 3748, references to Extended
-   Authentication Protocol to Extensible Authentication Protocol, and
-   made some editorial corrections related to EAP proposed by Jari
-   Arkko.
-
-   4) Added a note to security considerations saying that IKE MUST NOT
-   negotiate NONE as its integrity protection algorithm or ENCR_NULL as
-   its encryption algorithm.
-
-   5) Added I-D boilerplate concerning IPR claim disclosure.
-
-   6) Clarified that "empty" messages included a single empty Encrypted
-   payload.
-
-   7) Added (SA) after first reference to "Security Association".
-
-   8) Noted that incompatible configurations of traffic selectors SHOULD
-   be noted in error logs.
-
-   9) 3 minor editorial clarifications.
-
-H.17 Changes from IKEv2-16 to IKEv2-17 September 2004
-
-   1) Removed all references to Alice and Bob, replacing them with "the
-   initiator" and "the responder". Also fixed the corresponding he/she,
-   his/her, and the capitalization of initiator and responder.
-
-   2) Changed specification of BER encoded fields to be DER encoded
-   fields.
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt           [Page 106]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   3) Removed obsolete reference to CA names appearing in CERTREQ
-   fields.
-
-   4) Fixed the specification of INTERNAL_IPx_SUBNET Configuration
-   Attributes to indicate that they could be multi-valued.
-
-   5) Added informative references to RFC 2402 and RFC 2406.
-
-   6) Fixed a formatting glitch in the computation of AUTH.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt           [Page 107]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-Editor's Address
-
-   Charlie Kaufman
-   Microsoft Corporation
-   1 Microsoft Way
-   Redmond, WA 98052
-   1-425-707-3335
-
-   charliek@microsoft.com
-
-   By submitting this Internet-Draft, the editor represents that any
-   applicable patent or other IPR claims of which he is aware have been
-   or will be disclosed, and any of which he becomes aware will be
-   disclosed, in accordance with RFC 3668.
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society (2004).  This document is subject
-   to the rights, licenses and restrictions contained in BCP 78 and
-   except as set forth therein, the authors retain all their rights.
-
-   This document and the information contained herein are provided on an
-   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
-   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
-   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
-   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
-   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
-   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-Intellectual Property Statement
-
-   The IETF takes no position regarding the validity or scope of any
-   Intellectual Property Rights or other rights that might be claimed to
-   pertain to the implementation or use of the technology described in
-   this document or the extent to which any license under such rights
-   might or might not be available; nor does it represent that it has
-   made any independent effort to identify any such rights.  Information
-   on the procedures with respect to rights in RFC documents can be
-   found in BCP 78 and BCP 79.
-
-   Copies of IPR disclosures made to the IETF Secretariat and any
-   assurances of licenses to be made available, or the result of an
-   attempt made to obtain a general license or permission for the use of
-   such proprietary rights by implementers or users of this
-   specification can be obtained from the IETF on-line IPR repository at
-   http://www.ietf.org/ipr.
-
-   The IETF invites any interested party to bring to its attention any
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt           [Page 108]
-
-
-
-
-
-Internet-Draft                                        September 23, 2004
-
-
-   copyrights, patents or patent applications, or other proprietary
-   rights that may cover technology that may be required to implement
-   this standard.  Please address the information to the IETF at ietf-
-   ipr@ietf.org.
-
-Acknowledgement
-
-   Funding for the RFC Editor function is currently provided by the
-   Internet Society.
-
-Expiration
-
-   This Internet-Draft (draft-ietf-ipsec-ikev2-17.txt) expires in March
-   2005.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-IKEv2                 draft-ietf-ipsec-ikev2-17.txt           [Page 109]
-
diff --git a/doc/ikev2/[IKEv2bis] - draft-hoffman-ikev2bis-00.txt b/doc/ikev2/[IKEv2bis] - draft-hoffman-ikev2bis-00.txt
deleted file mode 100644
index 9d1b9d74d..000000000
--- a/doc/ikev2/[IKEv2bis] - draft-hoffman-ikev2bis-00.txt
+++ /dev/null
@@ -1,6776 +0,0 @@
-
-
-
-Network Working Group                                         C. Kaufman
-Internet-Draft                                                 Microsoft
-Expires: August 27, 2006                                      P. Hoffman
-                                                          VPN Consortium
-                                                               P. Eronen
-                                                                   Nokia
-                                                       February 23, 2006
-
-
-                 Internet Key Exchange Protocol: IKEv2
-                     draft-hoffman-ikev2bis-00.txt
-
-Status of this Memo
-
-   By submitting this Internet-Draft, each author represents that any
-   applicable patent or other IPR claims of which he or she is aware
-   have been or will be disclosed, and any of which he or she becomes
-   aware will be disclosed, in accordance with Section 6 of BCP 79.
-
-   Internet-Drafts are working documents of the Internet Engineering
-   Task Force (IETF), its areas, and its working groups.  Note that
-   other groups may also distribute working documents as Internet-
-   Drafts.
-
-   Internet-Drafts are draft documents valid for a maximum of six months
-   and may be updated, replaced, or obsoleted by other documents at any
-   time.  It is inappropriate to use Internet-Drafts as reference
-   material or to cite them other than as "work in progress."
-
-   The list of current Internet-Drafts can be accessed at
-   http://www.ietf.org/ietf/1id-abstracts.txt.
-
-   The list of Internet-Draft Shadow Directories can be accessed at
-   http://www.ietf.org/shadow.html.
-
-   This Internet-Draft will expire on August 27, 2006.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (2006).
-
-Abstract
-
-   This document describes version 2 of the Internet Key Exchange (IKE)
-   protocol.  It is a restatement of RFC 4306, and includes all of the
-   clarifications from the "IKEv2 Clarifications" document.
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006                [Page 1]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-Table of Contents
-
-   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   5
-     1.1.  Usage Scenarios . . . . . . . . . . . . . . . . . . . . .   6
-       1.1.1.  Security Gateway to Security Gateway Tunnel . . . . .   7
-       1.1.2.  Endpoint-to-Endpoint Transport  . . . . . . . . . . .   7
-       1.1.3.  Endpoint to Security Gateway Tunnel . . . . . . . . .   8
-       1.1.4.  Other Scenarios . . . . . . . . . . . . . . . . . . .   9
-     1.2.  The Initial Exchanges . . . . . . . . . . . . . . . . . .   9
-     1.3.  The CREATE_CHILD_SA Exchange  . . . . . . . . . . . . . .  12
-       1.3.1.  Creating New CHILD_SAs with the CREATE_CHILD_SA
-               Exchange  . . . . . . . . . . . . . . . . . . . . . .  13
-       1.3.2.  Rekeying IKE_SAs with the CREATE_CHILD_SA Exchange  .  14
-       1.3.3.  Rekeying CHILD_SAs with the CREATE_CHILD_SA
-               Exchange  . . . . . . . . . . . . . . . . . . . . . .  14
-     1.4.  The INFORMATIONAL Exchange  . . . . . . . . . . . . . . .  15
-     1.5.  Informational Messages outside of an IKE_SA . . . . . . .  16
-     1.6.  Requirements Terminology  . . . . . . . . . . . . . . . .  17
-     1.7.  Differences Between RFC 4306 and This Document  . . . . .  17
-   2.  IKE Protocol Details and Variations . . . . . . . . . . . . .  18
-     2.1.  Use of Retransmission Timers  . . . . . . . . . . . . . .  19
-     2.2.  Use of Sequence Numbers for Message ID  . . . . . . . . .  19
-     2.3.  Window Size for Overlapping Requests  . . . . . . . . . .  20
-     2.4.  State Synchronization and Connection Timeouts . . . . . .  21
-     2.5.  Version Numbers and Forward Compatibility . . . . . . . .  23
-     2.6.  Cookies . . . . . . . . . . . . . . . . . . . . . . . . .  25
-       2.6.1.  Interaction of COOKIE and INVALID_KE_PAYLOAD  . . . .  27
-     2.7.  Cryptographic Algorithm Negotiation . . . . . . . . . . .  28
-     2.8.  Rekeying  . . . . . . . . . . . . . . . . . . . . . . . .  29
-       2.8.1.  Simultaneous CHILD_SA rekeying  . . . . . . . . . . .  31
-       2.8.2.  Rekeying the IKE_SA Versus Reauthentication . . . . .  33
-     2.9.  Traffic Selector Negotiation  . . . . . . . . . . . . . .  34
-       2.9.1.  Traffic Selectors Violating Own Policy  . . . . . . .  37
-     2.10. Nonces  . . . . . . . . . . . . . . . . . . . . . . . . .  38
-     2.11. Address and Port Agility  . . . . . . . . . . . . . . . .  38
-     2.12. Reuse of Diffie-Hellman Exponentials  . . . . . . . . . .  38
-     2.13. Generating Keying Material  . . . . . . . . . . . . . . .  39
-     2.14. Generating Keying Material for the IKE_SA . . . . . . . .  40
-     2.15. Authentication of the IKE_SA  . . . . . . . . . . . . . .  41
-     2.16. Extensible Authentication Protocol Methods  . . . . . . .  43
-     2.17. Generating Keying Material for CHILD_SAs  . . . . . . . .  45
-     2.18. Rekeying IKE_SAs Using a CREATE_CHILD_SA Exchange . . . .  46
-     2.19. Requesting an Internal Address on a Remote Network  . . .  47
-     2.20. Requesting the Peer's Version . . . . . . . . . . . . . .  48
-     2.21. Error Handling  . . . . . . . . . . . . . . . . . . . . .  49
-     2.22. IPComp  . . . . . . . . . . . . . . . . . . . . . . . . .  50
-     2.23. NAT Traversal . . . . . . . . . . . . . . . . . . . . . .  50
-     2.24. Explicit Congestion Notification (ECN)  . . . . . . . . .  53
-
-
-
-Kaufman, et al.          Expires August 27, 2006                [Page 2]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   3.  Header and Payload Formats  . . . . . . . . . . . . . . . . .  53
-     3.1.  The IKE Header  . . . . . . . . . . . . . . . . . . . . .  53
-     3.2.  Generic Payload Header  . . . . . . . . . . . . . . . . .  56
-     3.3.  Security Association Payload  . . . . . . . . . . . . . .  58
-       3.3.1.  Proposal Substructure . . . . . . . . . . . . . . . .  60
-       3.3.2.  Transform Substructure  . . . . . . . . . . . . . . .  62
-       3.3.3.  Valid Transform Types by Protocol . . . . . . . . . .  64
-       3.3.4.  Mandatory Transform IDs . . . . . . . . . . . . . . .  65
-       3.3.5.  Transform Attributes  . . . . . . . . . . . . . . . .  66
-       3.3.6.  Attribute Negotiation . . . . . . . . . . . . . . . .  67
-     3.4.  Key Exchange Payload  . . . . . . . . . . . . . . . . . .  68
-     3.5.  Identification Payloads . . . . . . . . . . . . . . . . .  69
-     3.6.  Certificate Payload . . . . . . . . . . . . . . . . . . .  71
-     3.7.  Certificate Request Payload . . . . . . . . . . . . . . .  74
-     3.8.  Authentication Payload  . . . . . . . . . . . . . . . . .  76
-     3.9.  Nonce Payload . . . . . . . . . . . . . . . . . . . . . .  77
-     3.10. Notify Payload  . . . . . . . . . . . . . . . . . . . . .  77
-       3.10.1. Notify Message Types  . . . . . . . . . . . . . . . .  78
-     3.11. Delete Payload  . . . . . . . . . . . . . . . . . . . . .  84
-     3.12. Vendor ID Payload . . . . . . . . . . . . . . . . . . . .  85
-     3.13. Traffic Selector Payload  . . . . . . . . . . . . . . . .  86
-       3.13.1. Traffic Selector  . . . . . . . . . . . . . . . . . .  88
-     3.14. Encrypted Payload . . . . . . . . . . . . . . . . . . . .  90
-     3.15. Configuration Payload . . . . . . . . . . . . . . . . . .  92
-       3.15.1. Configuration Attributes  . . . . . . . . . . . . . .  94
-       3.15.2. Meaning of INTERNAL_IP4_SUBNET/INTERNAL_IP6_SUBNET  .  97
-       3.15.3. Configuration payloads for IPv6 . . . . . . . . . . .  99
-       3.15.4. Address Assignment Failures . . . . . . . . . . . . . 100
-     3.16. Extensible Authentication Protocol (EAP) Payload  . . . . 100
-   4.  Conformance Requirements  . . . . . . . . . . . . . . . . . . 102
-   5.  Security Considerations . . . . . . . . . . . . . . . . . . . 104
-     5.1.  Traffic selector authorization  . . . . . . . . . . . . . 107
-   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . . 108
-   7.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . 108
-   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . . 109
-     8.1.  Normative References  . . . . . . . . . . . . . . . . . . 109
-     8.2.  Informative References  . . . . . . . . . . . . . . . . . 110
-   Appendix A.  Summary of changes from IKEv1  . . . . . . . . . . . 114
-   Appendix B.  Diffie-Hellman Groups  . . . . . . . . . . . . . . . 115
-     B.1.  Group 1 - 768 Bit MODP  . . . . . . . . . . . . . . . . . 115
-     B.2.  Group 2 - 1024 Bit MODP . . . . . . . . . . . . . . . . . 115
-   Appendix C.  Exchanges and Payloads . . . . . . . . . . . . . . . 116
-     C.1.  IKE_SA_INIT Exchange  . . . . . . . . . . . . . . . . . . 116
-     C.2.  IKE_AUTH Exchange without EAP . . . . . . . . . . . . . . 117
-     C.3.  IKE_AUTH Exchange with EAP  . . . . . . . . . . . . . . . 118
-     C.4.  CREATE_CHILD_SA Exchange for Creating or Rekeying
-           CHILD_SAs . . . . . . . . . . . . . . . . . . . . . . . . 119
-     C.5.  CREATE_CHILD_SA Exchange for Rekeying the IKE_SA  . . . . 119
-
-
-
-Kaufman, et al.          Expires August 27, 2006                [Page 3]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-     C.6.  INFORMATIONAL Exchange  . . . . . . . . . . . . . . . . . 119
-   Appendix D.  Changes Between Internet Draft Versions  . . . . . . 119
-     D.1.  Changes from IKEv2 to draft -00 . . . . . . . . . . . . . 119
-   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . . 120
-   Intellectual Property and Copyright Statements  . . . . . . . . . 120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006                [Page 4]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-1.  Introduction
-
-   {{ An introduction to the differences between RFC 4306 [IKEV2] and
-   this document is given at the end of Section 1.  It is put there
-   (instead of here) to preserve the section numbering of the original
-   IKEv2 document. }}
-
-   IP Security (IPsec) provides confidentiality, data integrity, access
-   control, and data source authentication to IP datagrams.  These
-   services are provided by maintaining shared state between the source
-   and the sink of an IP datagram.  This state defines, among other
-   things, the specific services provided to the datagram, which
-   cryptographic algorithms will be used to provide the services, and
-   the keys used as input to the cryptographic algorithms.
-
-   Establishing this shared state in a manual fashion does not scale
-   well.  Therefore, a protocol to establish this state dynamically is
-   needed.  This memo describes such a protocol -- the Internet Key
-   Exchange (IKE).  Version 1 of IKE was defined in RFCs 2407 [DOI],
-   2408 [ISAKMP], and 2409 [IKEV1].  IKEv2 was defined in [IKEV2].  This
-   single document is intended to replace all three of those RFCs.
-
-   Definitions of the primitive terms in this document (such as Security
-   Association or SA) can be found in [IPSECARCH]. {{ Clarif-7.2 }} It
-   should be noted that parts of IKEv2 rely on some of the processing
-   rules in [IPSECARCH], as described in various sections of this
-   document.
-
-   IKE performs mutual authentication between two parties and
-   establishes an IKE security association (SA) that includes shared
-   secret information that can be used to efficiently establish SAs for
-   Encapsulating Security Payload (ESP) [ESP] and/or Authentication
-   Header (AH) [AH] and a set of cryptographic algorithms to be used by
-   the SAs to protect the traffic that they carry.  In this document,
-   the term "suite" or "cryptographic suite" refers to a complete set of
-   algorithms used to protect an SA.  An initiator proposes one or more
-   suites by listing supported algorithms that can be combined into
-   suites in a mix-and-match fashion.  IKE can also negotiate use of IP
-   Compression (IPComp) [IPCOMP] in connection with an ESP and/or AH SA.
-   We call the IKE SA an "IKE_SA".  The SAs for ESP and/or AH that get
-   set up through that IKE_SA we call "CHILD_SAs".
-
-   All IKE communications consist of pairs of messages: a request and a
-   response.  The pair is called an "exchange".  We call the first
-   messages establishing an IKE_SA IKE_SA_INIT and IKE_AUTH exchanges
-   and subsequent IKE exchanges CREATE_CHILD_SA or INFORMATIONAL
-   exchanges.  In the common case, there is a single IKE_SA_INIT
-   exchange and a single IKE_AUTH exchange (a total of four messages) to
-
-
-
-Kaufman, et al.          Expires August 27, 2006                [Page 5]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   establish the IKE_SA and the first CHILD_SA.  In exceptional cases,
-   there may be more than one of each of these exchanges.  In all cases,
-   all IKE_SA_INIT exchanges MUST complete before any other exchange
-   type, then all IKE_AUTH exchanges MUST complete, and following that
-   any number of CREATE_CHILD_SA and INFORMATIONAL exchanges may occur
-   in any order.  In some scenarios, only a single CHILD_SA is needed
-   between the IPsec endpoints, and therefore there would be no
-   additional exchanges.  Subsequent exchanges MAY be used to establish
-   additional CHILD_SAs between the same authenticated pair of endpoints
-   and to perform housekeeping functions.
-
-   IKE message flow always consists of a request followed by a response.
-   It is the responsibility of the requester to ensure reliability.  If
-   the response is not received within a timeout interval, the requester
-   needs to retransmit the request (or abandon the connection).
-
-   The first request/response of an IKE session (IKE_SA_INIT) negotiates
-   security parameters for the IKE_SA, sends nonces, and sends Diffie-
-   Hellman values.
-
-   The second request/response (IKE_AUTH) transmits identities, proves
-   knowledge of the secrets corresponding to the two identities, and
-   sets up an SA for the first (and often only) AH and/or ESP CHILD_SA.
-
-   The types of subsequent exchanges are CREATE_CHILD_SA (which creates
-   a CHILD_SA) and INFORMATIONAL (which deletes an SA, reports error
-   conditions, or does other housekeeping).  Every request requires a
-   response.  An INFORMATIONAL request with no payloads (other than the
-   empty Encrypted payload required by the syntax) is commonly used as a
-   check for liveness.  These subsequent exchanges cannot be used until
-   the initial exchanges have completed.
-
-   In the description that follows, we assume that no errors occur.
-   Modifications to the flow should errors occur are described in
-   Section 2.21.
-
-1.1.  Usage Scenarios
-
-   IKE is expected to be used to negotiate ESP and/or AH SAs in a number
-   of different scenarios, each with its own special requirements.
-
-
-
-
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006                [Page 6]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-1.1.1.  Security Gateway to Security Gateway Tunnel
-
-                +-+-+-+-+-+            +-+-+-+-+-+
-                !         ! IPsec      !         !
-   Protected    !Tunnel   ! tunnel     !Tunnel   !     Protected
-   Subnet   <-->!Endpoint !<---------->!Endpoint !<--> Subnet
-                !         !            !         !
-                +-+-+-+-+-+            +-+-+-+-+-+
-
-          Figure 1:  Security Gateway to Security Gateway Tunnel
-
-   In this scenario, neither endpoint of the IP connection implements
-   IPsec, but network nodes between them protect traffic for part of the
-   way.  Protection is transparent to the endpoints, and depends on
-   ordinary routing to send packets through the tunnel endpoints for
-   processing.  Each endpoint would announce the set of addresses
-   "behind" it, and packets would be sent in tunnel mode where the inner
-   IP header would contain the IP addresses of the actual endpoints.
-
-1.1.2.  Endpoint-to-Endpoint Transport
-
-   +-+-+-+-+-+                                          +-+-+-+-+-+
-   !         !                 IPsec transport          !         !
-   !Protected!                or tunnel mode SA         !Protected!
-   !Endpoint !<---------------------------------------->!Endpoint !
-   !         !                                          !         !
-   +-+-+-+-+-+                                          +-+-+-+-+-+
-
-                    Figure 2:  Endpoint to Endpoint
-
-   In this scenario, both endpoints of the IP connection implement
-   IPsec, as required of hosts in [IPSECARCH].  Transport mode will
-   commonly be used with no inner IP header.  If there is an inner IP
-   header, the inner addresses will be the same as the outer addresses.
-   A single pair of addresses will be negotiated for packets to be
-   protected by this SA.  These endpoints MAY implement application
-   layer access controls based on the IPsec authenticated identities of
-   the participants.  This scenario enables the end-to-end security that
-   has been a guiding principle for the Internet since [ARCHPRINC],
-   [TRANSPARENCY], and a method of limiting the inherent problems with
-   complexity in networks noted by [ARCHGUIDEPHIL].  Although this
-   scenario may not be fully applicable to the IPv4 Internet, it has
-   been deployed successfully in specific scenarios within intranets
-   using IKEv1.  It should be more broadly enabled during the transition
-   to IPv6 and with the adoption of IKEv2.
-
-   It is possible in this scenario that one or both of the protected
-   endpoints will be behind a network address translation (NAT) node, in
-
-
-
-Kaufman, et al.          Expires August 27, 2006                [Page 7]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   which case the tunneled packets will have to be UDP encapsulated so
-   that port numbers in the UDP headers can be used to identify
-   individual endpoints "behind" the NAT (see Section 2.23).
-
-1.1.3.  Endpoint to Security Gateway Tunnel
-
-   +-+-+-+-+-+                          +-+-+-+-+-+
-   !         !         IPsec            !         !     Protected
-   !Protected!         tunnel           !Tunnel   !     Subnet
-   !Endpoint !<------------------------>!Endpoint !<--- and/or
-   !         !                          !         !     Internet
-   +-+-+-+-+-+                          +-+-+-+-+-+
-
-              Figure 3:  Endpoint to Security Gateway Tunnel
-
-   In this scenario, a protected endpoint (typically a portable roaming
-   computer) connects back to its corporate network through an IPsec-
-   protected tunnel.  It might use this tunnel only to access
-   information on the corporate network, or it might tunnel all of its
-   traffic back through the corporate network in order to take advantage
-   of protection provided by a corporate firewall against Internet-based
-   attacks.  In either case, the protected endpoint will want an IP
-   address associated with the security gateway so that packets returned
-   to it will go to the security gateway and be tunneled back.  This IP
-   address may be static or may be dynamically allocated by the security
-   gateway. {{ Clarif-6.1 }} In support of the latter case, IKEv2
-   includes a mechanism (namely, configuration payloads) for the
-   initiator to request an IP address owned by the security gateway for
-   use for the duration of its SA.
-
-   In this scenario, packets will use tunnel mode.  On each packet from
-   the protected endpoint, the outer IP header will contain the source
-   IP address associated with its current location (i.e., the address
-   that will get traffic routed to the endpoint directly), while the
-   inner IP header will contain the source IP address assigned by the
-   security gateway (i.e., the address that will get traffic routed to
-   the security gateway for forwarding to the endpoint).  The outer
-   destination address will always be that of the security gateway,
-   while the inner destination address will be the ultimate destination
-   for the packet.
-
-   In this scenario, it is possible that the protected endpoint will be
-   behind a NAT.  In that case, the IP address as seen by the security
-   gateway will not be the same as the IP address sent by the protected
-   endpoint, and packets will have to be UDP encapsulated in order to be
-   routed properly.
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006                [Page 8]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-1.1.4.  Other Scenarios
-
-   Other scenarios are possible, as are nested combinations of the
-   above.  One notable example combines aspects of 1.1.1 and 1.1.3.  A
-   subnet may make all external accesses through a remote security
-   gateway using an IPsec tunnel, where the addresses on the subnet are
-   routed to the security gateway by the rest of the Internet.  An
-   example would be someone's home network being virtually on the
-   Internet with static IP addresses even though connectivity is
-   provided by an ISP that assigns a single dynamically assigned IP
-   address to the user's security gateway (where the static IP addresses
-   and an IPsec relay are provided by a third party located elsewhere).
-
-1.2.  The Initial Exchanges
-
-   Communication using IKE always begins with IKE_SA_INIT and IKE_AUTH
-   exchanges (known in IKEv1 as Phase 1).  These initial exchanges
-   normally consist of four messages, though in some scenarios that
-   number can grow.  All communications using IKE consist of request/
-   response pairs.  We'll describe the base exchange first, followed by
-   variations.  The first pair of messages (IKE_SA_INIT) negotiate
-   cryptographic algorithms, exchange nonces, and do a Diffie-Hellman
-   exchange [DH].
-
-   The second pair of messages (IKE_AUTH) authenticate the previous
-   messages, exchange identities and certificates, and establish the
-   first CHILD_SA.  Parts of these messages are encrypted and integrity
-   protected with keys established through the IKE_SA_INIT exchange, so
-   the identities are hidden from eavesdroppers and all fields in all
-   the messages are authenticated.
-
-   In the following descriptions, the payloads contained in the message
-   are indicated by names as listed below.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006                [Page 9]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   Notation    Payload
-   -----------------------------------------
-   AUTH        Authentication
-   CERT        Certificate
-   CERTREQ     Certificate Request
-   CP          Configuration
-   D           Delete
-   E           Encrypted
-   EAP         Extensible Authentication
-   HDR         IKE Header
-   IDi         Identification - Initiator
-   IDr         Identification - Responder
-   KE          Key Exchange
-   Ni, Nr      Nonce
-   N           Notify
-   SA          Security Association
-   TSi         Traffic Selector - Initiator
-   TSr         Traffic Selector - Responder
-   V           Vendor ID
-
-   The details of the contents of each payload are described in section
-   3.  Payloads that may optionally appear will be shown in brackets,
-   such as [CERTREQ], indicate that optionally a certificate request
-   payload can be included.
-
-   {{ Clarif-7.10 }} Many payloads contain fields marked as "RESERVED".
-   Some payloads in IKEv2 (and historically in IKEv1) are not aligned to
-   4-byte boundaries.
-
-   The initial exchanges are as follows:
-
-   Initiator                         Responder
-   -------------------------------------------------------------------
-   HDR, SAi1, KEi, Ni  -->
-
-   HDR contains the Security Parameter Indexes (SPIs), version numbers,
-   and flags of various sorts.  The SAi1 payload states the
-   cryptographic algorithms the initiator supports for the IKE_SA.  The
-   KE payload sends the initiator's Diffie-Hellman value.  Ni is the
-   initiator's nonce.
-
-                                <--  HDR, SAr1, KEr, Nr, [CERTREQ]
-
-   The responder chooses a cryptographic suite from the initiator's
-   offered choices and expresses that choice in the SAr1 payload,
-   completes the Diffie-Hellman exchange with the KEr payload, and sends
-   its nonce in the Nr payload.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 10]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   At this point in the negotiation, each party can generate SKEYSEED,
-   from which all keys are derived for that IKE_SA.  All but the headers
-   of all the messages that follow are encrypted and integrity
-   protected.  The keys used for the encryption and integrity protection
-   are derived from SKEYSEED and are known as SK_e (encryption) and SK_a
-   (authentication, a.k.a. integrity protection).  A separate SK_e and
-   SK_a is computed for each direction.  In addition to the keys SK_e
-   and SK_a derived from the DH value for protection of the IKE_SA,
-   another quantity SK_d is derived and used for derivation of further
-   keying material for CHILD_SAs.  The notation SK { ... } indicates
-   that these payloads are encrypted and integrity protected using that
-   direction's SK_e and SK_a.
-
-   HDR, SK {IDi, [CERT,] [CERTREQ,]
-       [IDr,] AUTH, SAi2,
-       TSi, TSr}  -->
-
-   The initiator asserts its identity with the IDi payload, proves
-   knowledge of the secret corresponding to IDi and integrity protects
-   the contents of the first message using the AUTH payload (see
-   Section 2.15).  It might also send its certificate(s) in CERT
-   payload(s) and a list of its trust anchors in CERTREQ payload(s).  If
-   any CERT payloads are included, the first certificate provided MUST
-   contain the public key used to verify the AUTH field.  The optional
-   payload IDr enables the initiator to specify which of the responder's
-   identities it wants to talk to.  This is useful when the machine on
-   which the responder is running is hosting multiple identities at the
-   same IP address.  The initiator begins negotiation of a CHILD_SA
-   using the SAi2 payload.  The final fields (starting with SAi2) are
-   described in the description of the CREATE_CHILD_SA exchange.
-
-                                <--  HDR, SK {IDr, [CERT,] AUTH,
-                                         SAr2, TSi, TSr}
-
-   The responder asserts its identity with the IDr payload, optionally
-   sends one or more certificates (again with the certificate containing
-   the public key used to verify AUTH listed first), authenticates its
-   identity and protects the integrity of the second message with the
-   AUTH payload, and completes negotiation of a CHILD_SA with the
-   additional fields described below in the CREATE_CHILD_SA exchange.
-
-   The recipients of messages 3 and 4 MUST verify that all signatures
-   and MACs are computed correctly and that the names in the ID payloads
-   correspond to the keys used to generate the AUTH payload.
-
-   {{ Clarif-4.2}} If creating the CHILD_SA during the IKE_AUTH exchange
-   fails for some reason, the IKE_SA is still created as usual.  The
-   list of responses in the IKE_AUTH exchange that do not prevent an
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 11]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   IKE_SA from being set up include at least the following:
-   NO_PROPOSAL_CHOSEN, TS_UNACCEPTABLE, SINGLE_PAIR_REQUIRED,
-   INTERNAL_ADDRESS_FAILURE, and FAILED_CP_REQUIRED.
-
-   {{ Clarif-4.3 }} Note that IKE_AUTH messages do not contain KEi/KEr
-   or Ni/Nr payloads.  Thus, the SA payload in IKE_AUTH exchange cannot
-   contain Transform Type 4 (Diffie-Hellman Group) with any value other
-   than NONE.  Implementations SHOULD NOT send such a transform because
-   it cannot be interpreted consistently, and implementations SHOULD
-   ignore any such tranforms they receive.
-
-1.3.  The CREATE_CHILD_SA Exchange
-
-   {{ This is a heavy rewrite of most of this section.  The major
-   organization changes are described in Clarif-4.1 and Clarif-5.1. }}
-
-   The CREATE_CHILD_SA exchange is used to create new CHILD_SAs and to
-   rekey both IKE_SAs and CHILD_SAs.  This exchange consists of a single
-   request/response pair, and some of its function was referred to as a
-   phase 2 exchange in IKEv1.  It MAY be initiated by either end of the
-   IKE_SA after the initial exchanges are completed.
-
-   All messages following the initial exchange are cryptographically
-   protected using the cryptographic algorithms and keys negotiated in
-   the first two messages of the IKE exchange.  These subsequent
-   messages use the syntax of the Encrypted Payload described in
-   Section 3.14.  All subsequent messages include an Encrypted Payload,
-   even if they are referred to in the text as "empty".  For both
-   messages in the CREATE_CHILD_SA, the message following the header is
-   encrypted and the message including the header is integrity protected
-   using the cryptographic algorithms negotiated for the IKE_SA.
-
-   The CREATE_CHILD_SA is also used for rekeying IKE_SAs and CHILD_SAs.
-   An SA is rekeyed by creating a new SA and then deleting the old one.
-   This section describes the first part of rekeying, the creation of
-   new SAs; Section 2.8 covers the mechanics of rekeying, including
-   moving traffic from old to new SAs and the deletion of the old SAs.
-   The two sections must be read together to understand the entire
-   process of rekeying.
-
-   Either endpoint may initiate a CREATE_CHILD_SA exchange, so in this
-   section the term initiator refers to the endpoint initiating this
-   exchange.  An implementation MAY refuse all CREATE_CHILD_SA requests
-   within an IKE_SA.
-
-   The CREATE_CHILD_SA request MAY optionally contain a KE payload for
-   an additional Diffie-Hellman exchange to enable stronger guarantees
-   of forward secrecy for the CHILD_SA.  The keying material for the
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 12]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   CHILD_SA is a function of SK_d established during the establishment
-   of the IKE_SA, the nonces exchanged during the CREATE_CHILD_SA
-   exchange, and the Diffie-Hellman value (if KE payloads are included
-   in the CREATE_CHILD_SA exchange).
-
-   If a CREATE_CHILD_SA exchange includes a KEi payload, at least one of
-   the SA offers MUST include the Diffie-Hellman group of the KEi.  The
-   Diffie-Hellman group of the KEi MUST be an element of the group the
-   initiator expects the responder to accept (additional Diffie-Hellman
-   groups can be proposed).  If the responder rejects the Diffie-Hellman
-   group of the KEi payload, the responder MUST reject the request and
-   indicate its preferred Diffie-Hellman group in the INVALID_KE_PAYLOAD
-   Notification payload.  In the case of such a rejection, the
-   CREATE_CHILD_SA exchange fails, and the initiator will probably retry
-   the exchange with a Diffie-Hellman proposal and KEi in the group that
-   the responder gave in the INVALID_KE_PAYLOAD.
-
-1.3.1.  Creating New CHILD_SAs with the CREATE_CHILD_SA Exchange
-
-   A CHILD_SA may be created by sending a CREATE_CHILD_SA request.  The
-   CREATE_CHILD_SA request for creating a new CHILD_SA is:
-
-   Initiator                         Responder
-   -------------------------------------------------------------------
-   HDR, SK {SA, Ni, [KEi],
-              TSi, TSr}  -->
-
-   The initiator sends SA offer(s) in the SA payload, a nonce in the Ni
-   payload, optionally a Diffie-Hellman value in the KEi payload, and
-   the proposed traffic selectors for the proposed CHILD_SA in the TSi
-   and TSr payloads.
-
-   The CREATE_CHILD_SA response for creating a new CHILD_SA is:
-
-                                <--  HDR, SK {SA, Nr, [KEr],
-                                         TSi, TSr}
-
-   The responder replies (using the same Message ID to respond) with the
-   accepted offer in an SA payload, and a Diffie-Hellman value in the
-   KEr payload if KEi was included in the request and the selected
-   cryptographic suite includes that group.
-
-   The traffic selectors for traffic to be sent on that SA are specified
-   in the TS payloads in the response, which may be a subset of what the
-   initiator of the CHILD_SA proposed.
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 13]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-1.3.2.  Rekeying IKE_SAs with the CREATE_CHILD_SA Exchange
-
-   The CREATE_CHILD_SA request for rekeying an IKE_SA is:
-
-   Initiator                         Responder
-   -------------------------------------------------------------------
-   HDR, SK {SA, Ni, KEi} -->
-
-   The initiator sends SA offer(s) in the SA payload, a nonce in the Ni
-   payload, and a Diffie-Hellman value in the KEi payload.  New
-   initiator and responder SPIs are supplied in the SPI fields.
-
-   The CREATE_CHILD_SA response for rekeying an IKE_SA is:
-
-                                <--  HDR, SK {SA, Nr, KEr}
-
-   The responder replies (using the same Message ID to respond) with the
-   accepted offer in an SA payload, and a Diffie-Hellman value in the
-   KEr payload if the selected cryptographic suite includes that group.
-
-   The new IKE_SA has its message counters set to 0, regardless of what
-   they were in the earlier IKE_SA.  The window size starts at 1 for any
-   new IKE_SA.
-
-   KEi and KEr are required for rekeying an IKE_SA.
-
-1.3.3.  Rekeying CHILD_SAs with the CREATE_CHILD_SA Exchange
-
-   The CREATE_CHILD_SA request for rekeying a CHILD_SA is:
-
-   Initiator                         Responder
-   -------------------------------------------------------------------
-   HDR, SK {N, SA, Ni, [KEi],
-       TSi, TSr}   -->
-
-   The initiator sends SA offer(s) in the SA payload, a nonce in the Ni
-   payload, optionally a Diffie-Hellman value in the KEi payload, and
-   the proposed traffic selectors for the proposed CHILD_SA in the TSi
-   and TSr payloads.  When rekeying an existing CHILD_SA, the leading N
-   payload of type REKEY_SA MUST be included and MUST give the SPI (as
-   they would be expected in the headers of inbound packets) of the SAs
-   being rekeyed.
-
-   The CREATE_CHILD_SA response for rekeying a CHILD_SA is:
-
-                                <--  HDR, SK {SA, Nr, [KEr],
-                                         Si, TSr}
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 14]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   The responder replies (using the same Message ID to respond) with the
-   accepted offer in an SA payload, and a Diffie-Hellman value in the
-   KEr payload if KEi was included in the request and the selected
-   cryptographic suite includes that group.
-
-   The traffic selectors for traffic to be sent on that SA are specified
-   in the TS payloads in the response, which may be a subset of what the
-   initiator of the CHILD_SA proposed.
-
-1.4.  The INFORMATIONAL Exchange
-
-   At various points during the operation of an IKE_SA, peers may desire
-   to convey control messages to each other regarding errors or
-   notifications of certain events.  To accomplish this, IKE defines an
-   INFORMATIONAL exchange.  INFORMATIONAL exchanges MUST ONLY occur
-   after the initial exchanges and are cryptographically protected with
-   the negotiated keys.
-
-   Control messages that pertain to an IKE_SA MUST be sent under that
-   IKE_SA.  Control messages that pertain to CHILD_SAs MUST be sent
-   under the protection of the IKE_SA which generated them (or its
-   successor if the IKE_SA was replaced for the purpose of rekeying).
-
-   Messages in an INFORMATIONAL exchange contain zero or more
-   Notification, Delete, and Configuration payloads.  The Recipient of
-   an INFORMATIONAL exchange request MUST send some response (else the
-   Sender will assume the message was lost in the network and will
-   retransmit it).  That response MAY be a message with no payloads.
-   The request message in an INFORMATIONAL exchange MAY also contain no
-   payloads.  This is the expected way an endpoint can ask the other
-   endpoint to verify that it is alive.
-
-   {{ Clarif-5.6 }} ESP and AH SAs always exist in pairs, with one SA in
-   each direction.  When an SA is closed, both members of the pair MUST
-   be closed (that is, deleted).  When SAs are nested, as when data (and
-   IP headers if in tunnel mode) are encapsulated first with IPComp,
-   then with ESP, and finally with AH between the same pair of
-   endpoints, all of the SAs MUST be deleted together.  Each endpoint
-   MUST close its incoming SAs and allow the other endpoint to close the
-   other SA in each pair.  To delete an SA, an INFORMATIONAL exchange
-   with one or more delete payloads is sent listing the SPIs (as they
-   would be expected in the headers of inbound packets) of the SAs to be
-   deleted.  The recipient MUST close the designated SAs. {{ Clarif-5.7
-   }} Note that one never sends delete payloads for the two sides of an
-   SA in a single message.  If there are many SAs to delete at the same
-   time (such as for nested SAs), one includes delete payloads for in
-   inbound half of each SA pair in your Informational exchange.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 15]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   Normally, the reply in the INFORMATIONAL exchange will contain delete
-   payloads for the paired SAs going in the other direction.  There is
-   one exception.  If by chance both ends of a set of SAs independently
-   decide to close them, each may send a delete payload and the two
-   requests may cross in the network.  If a node receives a delete
-   request for SAs for which it has already issued a delete request, it
-   MUST delete the outgoing SAs while processing the request and the
-   incoming SAs while processing the response.  In that case, the
-   responses MUST NOT include delete payloads for the deleted SAs, since
-   that would result in duplicate deletion and could in theory delete
-   the wrong SA.
-
-   {{ Demoted the SHOULD }} Half-closed connections are anomalous, and a
-   node with auditing capability should probably audit their existence
-   if they persist.  Note that this specification nowhere specifies time
-   periods, so it is up to individual endpoints to decide how long to
-   wait.  A node MAY refuse to accept incoming data on half-closed
-   connections but MUST NOT unilaterally close them and reuse the SPIs.
-   If connection state becomes sufficiently messed up, a node MAY close
-   the IKE_SA; doing so will implicitly close all SAs negotiated under
-   it.  It can then rebuild the SAs it needs on a clean base under a new
-   IKE_SA. {{ Clarif-5.8 }} The response to a request that deletes the
-   IKE_SA is an empty Informational response.
-
-   The INFORMATIONAL exchange is defined as:
-
-   Initiator                         Responder
-   -------------------------------------------------------------------
-   HDR, SK {[N,] [D,]
-       [CP,] ...}  -->
-                                <--  HDR, SK {[N,] [D,]
-                                         [CP], ...}
-
-   The processing of an INFORMATIONAL exchange is determined by its
-   component payloads.
-
-1.5.  Informational Messages outside of an IKE_SA
-
-   If an encrypted IKE packet arrives on port 500 or 4500 with an
-   unrecognized SPI, it could be because the receiving node has recently
-   crashed and lost state or because of some other system malfunction or
-   attack.  If the receiving node has an active IKE_SA to the IP address
-   from whence the packet came, it MAY send a notification of the
-   wayward packet over that IKE_SA in an INFORMATIONAL exchange.  If it
-   does not have such an IKE_SA, it MAY send an Informational message
-   without cryptographic protection to the source IP address.  Such a
-   message is not part of an informational exchange, and the receiving
-   node MUST NOT respond to it.  Doing so could cause a message loop.
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 16]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   {{ Clarif-7.7 }} There are two cases when such a one-way notification
-   is sent: INVALID_IKE_SPI and INVALID_SPI.  These notifications are
-   sent outside of an IKE_SA.  Note that such notifications are
-   explicitly not Informational exchanges; these are one-way messages
-   that must not be responded to.  In case of INVALID_IKE_SPI, the
-   message sent is a response message, and thus it is sent to the IP
-   address and port from whence it came with the same IKE SPIs and the
-   Message ID copied.  In case of INVALID_SPI, however, there are no IKE
-   SPI values that would be meaningful to the recipient of such a
-   notification.  Using zero values or random values are both
-   acceptable.
-
-1.6.  Requirements Terminology
-
-   Keywords "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT" and
-   "MAY" that appear in this document are to be interpreted as described
-   in [MUSTSHOULD].
-
-   The term "Expert Review" is to be interpreted as defined in
-   [IANACONS].
-
-1.7.  Differences Between RFC 4306 and This Document
-
-   {{ Added this entire section, including this recursive remark. }}
-
-   This document contains clarifications and amplifications to IKEv2
-   [IKEV2].  The clarifications are mostly based on [Clarif].  The
-   changes listed in that document were discussed in the IPsec Working
-   Group and, after the Working Group was disbanded, on the IPsec
-   mailing list.  That document contains detailed explanations of areas
-   that were unclear in IKEv2, and is thus useful to implementers of
-   IKEv2.
-
-   The protocol described in this document retains the same major
-   version number (2) and minor version number (0) as was used in RFC
-   4306.
-
-   In the body of this document, notes that are enclosed in double curly
-   braces {{ such as this }} point out changes from IKEv2.  Changes that
-   come from [Clarif] are marked with the section from that document,
-   such as "{{ Clarif-2.10 }}".
-
-   This document also make the figures and references a bit more regular
-   than in [IKEV2].
-
-   IKEv2 developers have noted that the SHOULD-level requirements are
-   often unclear in that they don't say when it is OK to not obey the
-   requirements.  They also have noted that there are MUST-level
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 17]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   requirements that are not related to interoperability.  This document
-   has more explanation of some of these requirements.  All non-
-   capitalized uses of the words SHOULD and MUST now mean their normal
-   English sense, not the interoperability sense of [MUSTSHOULD].
-
-   IKEv2 (and IKEv1) developers have noted that there is a great deal of
-   material in the tables of codes in Section 3.10.  This leads to
-   implementers not having all the needed information in the main body
-   of the docment.  A later version of this document may move much of
-   the material from those tables into the associated parts of the main
-   body of the document.
-
-   A later version of this document will probably have all the {{ }}
-   comments removed from the body of the document and instead appear in
-   an appendix.
-
-
-2.  IKE Protocol Details and Variations
-
-   IKE normally listens and sends on UDP port 500, though IKE messages
-   may also be received on UDP port 4500 with a slightly different
-   format (see Section 2.23).  Since UDP is a datagram (unreliable)
-   protocol, IKE includes in its definition recovery from transmission
-   errors, including packet loss, packet replay, and packet forgery.
-   IKE is designed to function so long as (1) at least one of a series
-   of retransmitted packets reaches its destination before timing out;
-   and (2) the channel is not so full of forged and replayed packets so
-   as to exhaust the network or CPU capacities of either endpoint.  Even
-   in the absence of those minimum performance requirements, IKE is
-   designed to fail cleanly (as though the network were broken).
-
-   Although IKEv2 messages are intended to be short, they contain
-   structures with no hard upper bound on size (in particular, X.509
-   certificates), and IKEv2 itself does not have a mechanism for
-   fragmenting large messages.  IP defines a mechanism for fragmentation
-   of oversize UDP messages, but implementations vary in the maximum
-   message size supported.  Furthermore, use of IP fragmentation opens
-   an implementation to denial of service attacks [DOSUDPPROT].
-   Finally, some NAT and/or firewall implementations may block IP
-   fragments.
-
-   All IKEv2 implementations MUST be able to send, receive, and process
-   IKE messages that are up to 1280 bytes long, and they SHOULD be able
-   to send, receive, and process messages that are up to 3000 bytes
-   long. {{ Demoted the SHOULD }} IKEv2 implementations need to be aware
-   of the maximum UDP message size supported and MAY shorten messages by
-   leaving out some certificates or cryptographic suite proposals if
-   that will keep messages below the maximum.  Use of the "Hash and URL"
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 18]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   formats rather than including certificates in exchanges where
-   possible can avoid most problems. {{ Demoted the SHOULD }}
-   Implementations and configuration need to keep in mind, however, that
-   if the URL lookups are possible only after the IPsec SA is
-   established, recursion issues could prevent this technique from
-   working.
-
-   {{ Clarif-7.5 }} All packets sent on port 4500 MUST begin with the
-   prefix of four zeros; otherwise, the receiver won't know how to
-   handle them.
-
-2.1.  Use of Retransmission Timers
-
-   All messages in IKE exist in pairs: a request and a response.  The
-   setup of an IKE_SA normally consists of two request/response pairs.
-   Once the IKE_SA is set up, either end of the security association may
-   initiate requests at any time, and there can be many requests and
-   responses "in flight" at any given moment.  But each message is
-   labeled as either a request or a response, and for each request/
-   response pair one end of the security association is the initiator
-   and the other is the responder.
-
-   For every pair of IKE messages, the initiator is responsible for
-   retransmission in the event of a timeout.  The responder MUST never
-   retransmit a response unless it receives a retransmission of the
-   request.  In that event, the responder MUST ignore the retransmitted
-   request except insofar as it triggers a retransmission of the
-   response.  The initiator MUST remember each request until it receives
-   the corresponding response.  The responder MUST remember each
-   response until it receives a request whose sequence number is larger
-   than the sequence number in the response plus its window size (see
-   Section 2.3).
-
-   IKE is a reliable protocol, in the sense that the initiator MUST
-   retransmit a request until either it receives a corresponding reply
-   OR it deems the IKE security association to have failed and it
-   discards all state associated with the IKE_SA and any CHILD_SAs
-   negotiated using that IKE_SA.
-
-2.2.  Use of Sequence Numbers for Message ID
-
-   Every IKE message contains a Message ID as part of its fixed header.
-   This Message ID is used to match up requests and responses, and to
-   identify retransmissions of messages.
-
-   The Message ID is a 32-bit quantity, which is zero for the first IKE
-   request in each direction. {{ Clarif-3.10 }} When the IKE_AUTH
-   exchange does not use EAP, the IKE_SA initial setup messages will
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 19]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   always be numbered 0 and 1.  When EAP is used, each pair of messages
-   have their message numbers incremented; the first pair of AUTH
-   messages will have an ID of 1, the second will be 2, and so on.
-
-   Each endpoint in the IKE Security Association maintains two "current"
-   Message IDs: the next one to be used for a request it initiates and
-   the next one it expects to see in a request from the other end.
-   These counters increment as requests are generated and received.
-   Responses always contain the same message ID as the corresponding
-   request.  That means that after the initial exchange, each integer n
-   may appear as the message ID in four distinct messages: the nth
-   request from the original IKE initiator, the corresponding response,
-   the nth request from the original IKE responder, and the
-   corresponding response.  If the two ends make very different numbers
-   of requests, the Message IDs in the two directions can be very
-   different.  There is no ambiguity in the messages, however, because
-   the (I)nitiator and (R)esponse bits in the message header specify
-   which of the four messages a particular one is.
-
-   {{ Clarif-2.2 }} The Message ID for IKE_SA_INIT messages is always
-   zero, including for retries of the message due to responses such as
-   COOKIE and INVALID_KE_PAYLOAD.
-
-   Note that Message IDs are cryptographically protected and provide
-   protection against message replays.  In the unlikely event that
-   Message IDs grow too large to fit in 32 bits, the IKE_SA MUST be
-   closed.  Rekeying an IKE_SA resets the sequence numbers.
-
-   {{ Clarif-2.3 }} When a responder receives an IKE_SA_INIT request, it
-   has to determine whether the packet is a retransmission belonging to
-   an existing "half-open" IKE_SA (in which case the responder
-   retransmits the same response), or a new request (in which case the
-   responder creates a new IKE_SA and sends a fresh response), or it is
-   a retransmission of a now-opened IKE_SA (in whcih case the responder
-   ignores it).  It is not sufficient to use the initiator's SPI and/or
-   IP address to differentiate between the two cases because two
-   different peers behind a single NAT could choose the same initiator
-   SPI.  Instead, a robust responder will do the IKE_SA lookup using the
-   whole packet, its hash, or the Ni payload.
-
-2.3.  Window Size for Overlapping Requests
-
-   In order to maximize IKE throughput, an IKE endpoint MAY issue
-   multiple requests before getting a response to any of them if the
-   other endpoint has indicated its ability to handle such requests.
-   For simplicity, an IKE implementation MAY choose to process requests
-   strictly in order and/or wait for a response to one request before
-   issuing another.  Certain rules must be followed to ensure
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 20]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   interoperability between implementations using different strategies.
-
-   After an IKE_SA is set up, either end can initiate one or more
-   requests.  These requests may pass one another over the network.  An
-   IKE endpoint MUST be prepared to accept and process a request while
-   it has a request outstanding in order to avoid a deadlock in this
-   situation. {{ Downgraded the SHOULD }} An IKE endpoint may also
-   accept and process multiple requests while it has a request
-   outstanding.
-
-   An IKE endpoint MUST wait for a response to each of its messages
-   before sending a subsequent message unless it has received a
-   SET_WINDOW_SIZE Notify message from its peer informing it that the
-   peer is prepared to maintain state for multiple outstanding messages
-   in order to allow greater throughput.
-
-   An IKE endpoint MUST NOT exceed the peer's stated window size for
-   transmitted IKE requests.  In other words, if the responder stated
-   its window size is N, then when the initiator needs to make a request
-   X, it MUST wait until it has received responses to all requests up
-   through request X-N.  An IKE endpoint MUST keep a copy of (or be able
-   to regenerate exactly) each request it has sent until it receives the
-   corresponding response.  An IKE endpoint MUST keep a copy of (or be
-   able to regenerate exactly) the number of previous responses equal to
-   its declared window size in case its response was lost and the
-   initiator requests its retransmission by retransmitting the request.
-
-   An IKE endpoint supporting a window size greater than one ought to be
-   capable of processing incoming requests out of order to maximize
-   performance in the event of network failures or packet reordering.
-
-   {{ Clarif-7.3 }} The window size is normally a (possibly
-   configurable) property of a particular implementation, and is not
-   related to congestion control (unlike the window size in TCP, for
-   example).  In particular, it is not defined what the responder should
-   do when it receives a SET_WINDOW_SIZE notification containing a
-   smaller value than is currently in effect.  Thus, there is currently
-   no way to reduce the window size of an existing IKE_SA; you can only
-   increase it.  When rekeying an IKE_SA, the new IKE_SA starts with
-   window size 1 until it is explicitly increased by sending a new
-   SET_WINDOW_SIZE notification.
-
-2.4.  State Synchronization and Connection Timeouts
-
-   An IKE endpoint is allowed to forget all of its state associated with
-   an IKE_SA and the collection of corresponding CHILD_SAs at any time.
-   This is the anticipated behavior in the event of an endpoint crash
-   and restart.  It is important when an endpoint either fails or
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 21]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   reinitializes its state that the other endpoint detect those
-   conditions and not continue to waste network bandwidth by sending
-   packets over discarded SAs and having them fall into a black hole.
-
-   Since IKE is designed to operate in spite of Denial of Service (DoS)
-   attacks from the network, an endpoint MUST NOT conclude that the
-   other endpoint has failed based on any routing information (e.g.,
-   ICMP messages) or IKE messages that arrive without cryptographic
-   protection (e.g., Notify messages complaining about unknown SPIs).
-   An endpoint MUST conclude that the other endpoint has failed only
-   when repeated attempts to contact it have gone unanswered for a
-   timeout period or when a cryptographically protected INITIAL_CONTACT
-   notification is received on a different IKE_SA to the same
-   authenticated identity. {{ Demoted the SHOULD }} An endpoint should
-   suspect that the other endpoint has failed based on routing
-   information and initiate a request to see whether the other endpoint
-   is alive.  To check whether the other side is alive, IKE specifies an
-   empty INFORMATIONAL message that (like all IKE requests) requires an
-   acknowledgement (note that within the context of an IKE_SA, an
-   "empty" message consists of an IKE header followed by an Encrypted
-   payload that contains no payloads).  If a cryptographically protected
-   message has been received from the other side recently, unprotected
-   notifications MAY be ignored.  Implementations MUST limit the rate at
-   which they take actions based on unprotected messages.
-
-   Numbers of retries and lengths of timeouts are not covered in this
-   specification because they do not affect interoperability.  It is
-   suggested that messages be retransmitted at least a dozen times over
-   a period of at least several minutes before giving up on an SA, but
-   different environments may require different rules.  To be a good
-   network citizen, retranmission times MUST increase exponentially to
-   avoid flooding the network and making an existing congestion
-   situation worse.  If there has only been outgoing traffic on all of
-   the SAs associated with an IKE_SA, it is essential to confirm
-   liveness of the other endpoint to avoid black holes.  If no
-   cryptographically protected messages have been received on an IKE_SA
-   or any of its CHILD_SAs recently, the system needs to perform a
-   liveness check in order to prevent sending messages to a dead peer.
-   Receipt of a fresh cryptographically protected message on an IKE_SA
-   or any of its CHILD_SAs ensures liveness of the IKE_SA and all of its
-   CHILD_SAs.  Note that this places requirements on the failure modes
-   of an IKE endpoint.  An implementation MUST NOT continue sending on
-   any SA if some failure prevents it from receiving on all of the
-   associated SAs.  If CHILD_SAs can fail independently from one another
-   without the associated IKE_SA being able to send a delete message,
-   then they MUST be negotiated by separate IKE_SAs.
-
-   There is a Denial of Service attack on the initiator of an IKE_SA
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 22]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   that can be avoided if the initiator takes the proper care.  Since
-   the first two messages of an SA setup are not cryptographically
-   protected, an attacker could respond to the initiator's message
-   before the genuine responder and poison the connection setup attempt.
-   To prevent this, the initiator MAY be willing to accept multiple
-   responses to its first message, treat each as potentially legitimate,
-   respond to it, and then discard all the invalid half-open connections
-   when it receives a valid cryptographically protected response to any
-   one of its requests.  Once a cryptographically valid response is
-   received, all subsequent responses should be ignored whether or not
-   they are cryptographically valid.
-
-   Note that with these rules, there is no reason to negotiate and agree
-   upon an SA lifetime.  If IKE presumes the partner is dead, based on
-   repeated lack of acknowledgement to an IKE message, then the IKE SA
-   and all CHILD_SAs set up through that IKE_SA are deleted.
-
-   An IKE endpoint may at any time delete inactive CHILD_SAs to recover
-   resources used to hold their state.  If an IKE endpoint chooses to
-   delete CHILD_SAs, it MUST send Delete payloads to the other end
-   notifying it of the deletion.  It MAY similarly time out the IKE_SA.
-   {{ Clarified the SHOULD }} Closing the IKE_SA implicitly closes all
-   associated CHILD_SAs.  In this case, an IKE endpoint SHOULD send a
-   Delete payload indicating that it has closed the IKE_SA unless the
-   other endpoint is no longer responding.
-
-2.5.  Version Numbers and Forward Compatibility
-
-   This document describes version 2.0 of IKE, meaning the major version
-   number is 2 and the minor version number is 0. {{ Restated the
-   relationship to RFC 4306 }} This document is a clarification of
-   [IKEV2].  It is likely that some implementations will want to support
-   version 1.0 and version 2.0, and in the future, other versions.
-
-   The major version number should be incremented only if the packet
-   formats or required actions have changed so dramatically that an
-   older version node would not be able to interoperate with a newer
-   version node if it simply ignored the fields it did not understand
-   and took the actions specified in the older specification.  The minor
-   version number indicates new capabilities, and MUST be ignored by a
-   node with a smaller minor version number, but used for informational
-   purposes by the node with the larger minor version number.  For
-   example, it might indicate the ability to process a newly defined
-   notification message.  The node with the larger minor version number
-   would simply note that its correspondent would not be able to
-   understand that message and therefore would not send it.
-
-   If an endpoint receives a message with a higher major version number,
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 23]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   it MUST drop the message and SHOULD send an unauthenticated
-   notification message containing the highest version number it
-   supports.  If an endpoint supports major version n, and major version
-   m, it MUST support all versions between n and m.  If it receives a
-   message with a major version that it supports, it MUST respond with
-   that version number.  In order to prevent two nodes from being
-   tricked into corresponding with a lower major version number than the
-   maximum that they both support, IKE has a flag that indicates that
-   the node is capable of speaking a higher major version number.
-
-   Thus, the major version number in the IKE header indicates the
-   version number of the message, not the highest version number that
-   the transmitter supports.  If the initiator is capable of speaking
-   versions n, n+1, and n+2, and the responder is capable of speaking
-   versions n and n+1, then they will negotiate speaking n+1, where the
-   initiator will set the flag indicating its ability to speak a higher
-   version.  If they mistakenly (perhaps through an active attacker
-   sending error messages) negotiate to version n, then both will notice
-   that the other side can support a higher version number, and they
-   MUST break the connection and reconnect using version n+1.
-
-   Note that IKEv1 does not follow these rules, because there is no way
-   in v1 of noting that you are capable of speaking a higher version
-   number.  So an active attacker can trick two v2-capable nodes into
-   speaking v1. {{ Demoted the SHOULD }} When a v2-capable node
-   negotiates down to v1, it should note that fact in its logs.
-
-   Also for forward compatibility, all fields marked RESERVED MUST be
-   set to zero by an implementation running version 2.0 or later, and
-   their content MUST be ignored by an implementation running version
-   2.0 or later ("Be conservative in what you send and liberal in what
-   you receive").  In this way, future versions of the protocol can use
-   those fields in a way that is guaranteed to be ignored by
-   implementations that do not understand them.  Similarly, payload
-   types that are not defined are reserved for future use;
-   implementations of a version where they are undefined MUST skip over
-   those payloads and ignore their contents.
-
-   IKEv2 adds a "critical" flag to each payload header for further
-   flexibility for forward compatibility.  If the critical flag is set
-   and the payload type is unrecognized, the message MUST be rejected
-   and the response to the IKE request containing that payload MUST
-   include a Notify payload UNSUPPORTED_CRITICAL_PAYLOAD, indicating an
-   unsupported critical payload was included.  If the critical flag is
-   not set and the payload type is unsupported, that payload MUST be
-   ignored.
-
-   {{ Demoted the SHOULD in the second clause }}Although new payload
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 24]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   types may be added in the future and may appear interleaved with the
-   fields defined in this specification, implementations MUST send the
-   payloads defined in this specification in the order shown in the
-   figures in Section 2; implementations are explicitly allowed to
-   reject as invalid a message with those payloads in any other order.
-
-2.6.  Cookies
-
-   The term "cookies" originates with Karn and Simpson [PHOTURIS] in
-   Photuris, an early proposal for key management with IPsec, and it has
-   persisted.  The Internet Security Association and Key Management
-   Protocol (ISAKMP) [ISAKMP] fixed message header includes two eight-
-   octet fields titled "cookies", and that syntax is used by both IKEv1
-   and IKEv2 though in IKEv2 they are referred to as the IKE SPI and
-   there is a new separate field in a Notify payload holding the cookie.
-   The initial two eight-octet fields in the header are used as a
-   connection identifier at the beginning of IKE packets. {{ Demoted the
-   SHOULD }} Each endpoint chooses one of the two SPIs and needs to
-   choose them so as to be unique identifiers of an IKE_SA.  An SPI
-   value of zero is special and indicates that the remote SPI value is
-   not yet known by the sender.
-
-   Unlike ESP and AH where only the recipient's SPI appears in the
-   header of a message, in IKE the sender's SPI is also sent in every
-   message.  Since the SPI chosen by the original initiator of the
-   IKE_SA is always sent first, an endpoint with multiple IKE_SAs open
-   that wants to find the appropriate IKE_SA using the SPI it assigned
-   must look at the I(nitiator) Flag bit in the header to determine
-   whether it assigned the first or the second eight octets.
-
-   In the first message of an initial IKE exchange, the initiator will
-   not know the responder's SPI value and will therefore set that field
-   to zero.
-
-   An expected attack against IKE is state and CPU exhaustion, where the
-   target is flooded with session initiation requests from forged IP
-   addresses.  This attack can be made less effective if an
-   implementation of a responder uses minimal CPU and commits no state
-   to an SA until it knows the initiator can receive packets at the
-   address from which it claims to be sending them.  To accomplish this,
-   a responder SHOULD -- when it detects a large number of half-open
-   IKE_SAs -- reject initial IKE messages unless they contain a Notify
-   payload of type COOKIE. {{ Clarified the SHOULD }} If the responder
-   wants to set up an SA, it SHOULD instead send an unprotected IKE
-   message as a response and include COOKIE Notify payload with the
-   cookie data to be returned.  Initiators who receive such responses
-   MUST retry the IKE_SA_INIT with a Notify payload of type COOKIE
-   containing the responder supplied cookie data as the first payload
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 25]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   and all other payloads unchanged.  The initial exchange will then be
-   as follows:
-
-   Initiator                         Responder
-   -------------------------------------------------------------------
-   HDR(A,0), SAi1, KEi, Ni  -->
-                                <--  HDR(A,0), N(COOKIE)
-   HDR(A,0), N(COOKIE), SAi1,
-       KEi, Ni  -->
-                                <--  HDR(A,B), SAr1, KEr,
-                                         Nr, [CERTREQ]
-   HDR(A,B), SK {IDi, [CERT,]
-       [CERTREQ,] [IDr,] AUTH,
-       SAi2, TSi, TSr}  -->
-                                <--  HDR(A,B), SK {IDr, [CERT,]
-                                         AUTH, SAr2, TSi, TSr}
-
-   The first two messages do not affect any initiator or responder state
-   except for communicating the cookie.  In particular, the message
-   sequence numbers in the first four messages will all be zero and the
-   message sequence numbers in the last two messages will be one.  'A'
-   is the SPI assigned by the initiator, while 'B' is the SPI assigned
-   by the responder.
-
-   {{ Clarif-2.1 }} Because the responder's SPI identifies security-
-   related state held by the responder, and in this case no state is
-   created, the responder sends a zero value for the responder's SPI.
-
-   {{ Demoted the SHOULD }} An IKE implementation should implement its
-   responder cookie generation in such a way as to not require any saved
-   state to recognize its valid cookie when the second IKE_SA_INIT
-   message arrives.  The exact algorithms and syntax they use to
-   generate cookies do not affect interoperability and hence are not
-   specified here.  The following is an example of how an endpoint could
-   use cookies to implement limited DOS protection.
-
-   A good way to do this is to set the responder cookie to be:
-
-   Cookie = <VersionIDofSecret> | Hash(Ni | IPi | SPIi | <secret>)
-
-   where <secret> is a randomly generated secret known only to the
-   responder and periodically changed and | indicates concatenation.
-   <VersionIDofSecret> should be changed whenever <secret> is
-   regenerated.  The cookie can be recomputed when the IKE_SA_INIT
-   arrives the second time and compared to the cookie in the received
-   message.  If it matches, the responder knows that the cookie was
-   generated since the last change to <secret> and that IPi must be the
-   same as the source address it saw the first time.  Incorporating SPIi
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 26]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   into the calculation ensures that if multiple IKE_SAs are being set
-   up in parallel they will all get different cookies (assuming the
-   initiator chooses unique SPIi's).  Incorporating Ni into the hash
-   ensures that an attacker who sees only message 2 can't successfully
-   forge a message 3.
-
-   If a new value for <secret> is chosen while there are connections in
-   the process of being initialized, an IKE_SA_INIT might be returned
-   with other than the current <VersionIDofSecret>.  The responder in
-   that case MAY reject the message by sending another response with a
-   new cookie or it MAY keep the old value of <secret> around for a
-   short time and accept cookies computed from either one. {{ Demoted
-   the SHOULD NOT }} The responder should not accept cookies
-   indefinitely after <secret> is changed, since that would defeat part
-   of the denial of service protection. {{ Demoted the SHOULD }} The
-   responder should change the value of <secret> frequently, especially
-   if under attack.
-
-   {{ Clarif-2.1 }} In addition to cookies, there are several cases
-   where the IKE_SA_INIT exchange does not result in the creation of an
-   IKE_SA (such as INVALID_KE_PAYLOAD or NO_PROPOSAL_CHOSEN).  In such a
-   case, sending a zero value for the Responder's SPI is correct.  If
-   the responder sends a non-zero responder SPI, the initiator should
-   not reject the response for only that reason.
-
-   {{ Clarif-2.5 }} When one party receives an IKE_SA_INIT request
-   containing a cookie whose contents do not match the value expected,
-   that party MUST ignore the cookie and process the message as if no
-   cookie had been included; usually this means sending a response
-   containing a new cookie.
-
-2.6.1.  Interaction of COOKIE and INVALID_KE_PAYLOAD
-
-   {{ This section added by Clarif-2.4 }}
-
-   There are two common reasons why the initiator may have to retry the
-   IKE_SA_INIT exchange: the responder requests a cookie or wants a
-   different Diffie-Hellman group than was included in the KEi payload.
-   If the initiator receives a cookie from the responder, the initiator
-   needs to decide whether or not to include the cookie in only the next
-   retry of the IKE_SA_INIT request, or in all subsequent retries as
-   well.
-
-   If the initiator includes the cookie only in the next retry, one
-   additional roundtrip may be needed in some cases.  An additional
-   roundtrip is needed also if the initiator includes the cookie in all
-   retries, but the responder does not support this.  For instance, if
-   the responder includes the SAi1 and KEi payloads in cookie
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 27]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   calculation, it will reject the request by sending a new cookie.
-
-   If both peers support including the cookie in all retries, a slightly
-   shorter exchange can happen.  Implementations SHOULD support this
-   shorter exchange, but MUST NOT fail if other implementations do not
-   support this shorter exchange.
-
-2.7.  Cryptographic Algorithm Negotiation
-
-   The payload type known as "SA" indicates a proposal for a set of
-   choices of IPsec protocols (IKE, ESP, and/or AH) for the SA as well
-   as cryptographic algorithms associated with each protocol.
-
-   An SA payload consists of one or more proposals.  Each proposal
-   includes one or more protocols (usually one).  Each protocol contains
-   one or more transforms -- each specifying a cryptographic algorithm.
-   Each transform contains zero or more attributes (attributes are
-   needed only if the transform identifier does not completely specify
-   the cryptographic algorithm).
-
-   This hierarchical structure was designed to efficiently encode
-   proposals for cryptographic suites when the number of supported
-   suites is large because multiple values are acceptable for multiple
-   transforms.  The responder MUST choose a single suite, which MAY be
-   any subset of the SA proposal following the rules below:
-
-   Each proposal contains one or more protocols.  If a proposal is
-   accepted, the SA response MUST contain the same protocols in the same
-   order as the proposal.  The responder MUST accept a single proposal
-   or reject them all and return an error.  (Example: if a single
-   proposal contains ESP and AH and that proposal is accepted, both ESP
-   and AH MUST be accepted.  If ESP and AH are included in separate
-   proposals, the responder MUST accept only one of them).
-
-   Each IPsec protocol proposal contains one or more transforms.  Each
-   transform contains a transform type.  The accepted cryptographic
-   suite MUST contain exactly one transform of each type included in the
-   proposal.  For example: if an ESP proposal includes transforms
-   ENCR_3DES, ENCR_AES w/keysize 128, ENCR_AES w/keysize 256,
-   AUTH_HMAC_MD5, and AUTH_HMAC_SHA, the accepted suite MUST contain one
-   of the ENCR_ transforms and one of the AUTH_ transforms.  Thus, six
-   combinations are acceptable.
-
-   Since the initiator sends its Diffie-Hellman value in the
-   IKE_SA_INIT, it must guess the Diffie-Hellman group that the
-   responder will select from its list of supported groups.  If the
-   initiator guesses wrong, the responder will respond with a Notify
-   payload of type INVALID_KE_PAYLOAD indicating the selected group.  In
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 28]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   this case, the initiator MUST retry the IKE_SA_INIT with the
-   corrected Diffie-Hellman group.  The initiator MUST again propose its
-   full set of acceptable cryptographic suites because the rejection
-   message was unauthenticated and otherwise an active attacker could
-   trick the endpoints into negotiating a weaker suite than a stronger
-   one that they both prefer.
-
-2.8.  Rekeying
-
-   {{ Demoted the SHOULD }} IKE, ESP, and AH security associations use
-   secret keys that should be used only for a limited amount of time and
-   to protect a limited amount of data.  This limits the lifetime of the
-   entire security association.  When the lifetime of a security
-   association expires, the security association MUST NOT be used.  If
-   there is demand, new security associations MAY be established.
-   Reestablishment of security associations to take the place of ones
-   that expire is referred to as "rekeying".
-
-   To allow for minimal IPsec implementations, the ability to rekey SAs
-   without restarting the entire IKE_SA is optional.  An implementation
-   MAY refuse all CREATE_CHILD_SA requests within an IKE_SA.  If an SA
-   has expired or is about to expire and rekeying attempts using the
-   mechanisms described here fail, an implementation MUST close the
-   IKE_SA and any associated CHILD_SAs and then MAY start new ones. {{
-   Demoted the SHOULD }} Implementations may wish to support in-place
-   rekeying of SAs, since doing so offers better performance and is
-   likely to reduce the number of packets lost during the transition.
-
-   To rekey a CHILD_SA within an existing IKE_SA, create a new,
-   equivalent SA (see Section 2.17 below), and when the new one is
-   established, delete the old one.  To rekey an IKE_SA, establish a new
-   equivalent IKE_SA (see Section 2.18 below) with the peer to whom the
-   old IKE_SA is shared using a CREATE_CHILD_SA within the existing
-   IKE_SA.  An IKE_SA so created inherits all of the original IKE_SA's
-   CHILD_SAs.  Use the new IKE_SA for all control messages needed to
-   maintain the CHILD_SAs created by the old IKE_SA, and delete the old
-   IKE_SA.  The Delete payload to delete itself MUST be the last request
-   sent over an IKE_SA.
-
-   {{ Demoted the SHOULD }} SAs should be rekeyed proactively, i.e., the
-   new SA should be established before the old one expires and becomes
-   unusable.  Enough time should elapse between the time the new SA is
-   established and the old one becomes unusable so that traffic can be
-   switched over to the new SA.
-
-   A difference between IKEv1 and IKEv2 is that in IKEv1 SA lifetimes
-   were negotiated.  In IKEv2, each end of the SA is responsible for
-   enforcing its own lifetime policy on the SA and rekeying the SA when
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 29]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   necessary.  If the two ends have different lifetime policies, the end
-   with the shorter lifetime will end up always being the one to request
-   the rekeying.  If an SA bundle has been inactive for a long time and
-   if an endpoint would not initiate the SA in the absence of traffic,
-   the endpoint MAY choose to close the SA instead of rekeying it when
-   its lifetime expires. {{ Demoted the SHOULD }} It should do so if
-   there has been no traffic since the last time the SA was rekeyed.
-
-   Note that IKEv2 deliberately allows parallel SAs with the same
-   traffic selectors between common endpoints.  One of the purposes of
-   this is to support traffic quality of service (QoS) differences among
-   the SAs (see [DIFFSERVFIELD], [DIFFSERVARCH], and section 4.1 of
-   [DIFFTUNNEL]).  Hence unlike IKEv1, the combination of the endpoints
-   and the traffic selectors may not uniquely identify an SA between
-   those endpoints, so the IKEv1 rekeying heuristic of deleting SAs on
-   the basis of duplicate traffic selectors SHOULD NOT be used.
-
-   {{ Demoted the SHOULD }} The node that initiated the surviving
-   rekeyed SA should delete the replaced SA after the new one is
-   established.
-
-   There are timing windows -- particularly in the presence of lost
-   packets -- where endpoints may not agree on the state of an SA.  The
-   responder to a CREATE_CHILD_SA MUST be prepared to accept messages on
-   an SA before sending its response to the creation request, so there
-   is no ambiguity for the initiator.  The initiator MAY begin sending
-   on an SA as soon as it processes the response.  The initiator,
-   however, cannot receive on a newly created SA until it receives and
-   processes the response to its CREATE_CHILD_SA request.  How, then, is
-   the responder to know when it is OK to send on the newly created SA?
-
-   From a technical correctness and interoperability perspective, the
-   responder MAY begin sending on an SA as soon as it sends its response
-   to the CREATE_CHILD_SA request.  In some situations, however, this
-   could result in packets unnecessarily being dropped, so an
-   implementation MAY want to defer such sending.
-
-   The responder can be assured that the initiator is prepared to
-   receive messages on an SA if either (1) it has received a
-   cryptographically valid message on the new SA, or (2) the new SA
-   rekeys an existing SA and it receives an IKE request to close the
-   replaced SA.  When rekeying an SA, the responder continues to send
-   traffic on the old SA until one of those events occurs.  When
-   establishing a new SA, the responder MAY defer sending messages on a
-   new SA until either it receives one or a timeout has occurred. {{
-   Demoted the SHOULD }} If an initiator receives a message on an SA for
-   which it has not received a response to its CREATE_CHILD_SA request,
-   it interprets that as a likely packet loss and retransmits the
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 30]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   CREATE_CHILD_SA request.  An initiator MAY send a dummy message on a
-   newly created SA if it has no messages queued in order to assure the
-   responder that the initiator is ready to receive messages.
-
-   {{ Clarif-5.9 }} Throughout this document, "initiator" refers to the
-   party who initiated the exchange being described, and "original
-   initiator" refers to the party who initiated the whole IKE_SA.  The
-   "original initiator" always refers to the party who initiated the
-   exchange which resulted in the current IKE_SA.  In other words, if
-   the the "original responder" starts rekeying the IKE_SA, that party
-   becomes the "original initiator" of the new IKE_SA.
-
-2.8.1.  Simultaneous CHILD_SA rekeying
-
-   {{ The first two paragraphs were moved, and the rest was added, based
-   on Clarif-5.11 }}
-
-   If the two ends have the same lifetime policies, it is possible that
-   both will initiate a rekeying at the same time (which will result in
-   redundant SAs).  To reduce the probability of this happening, the
-   timing of rekeying requests SHOULD be jittered (delayed by a random
-   amount of time after the need for rekeying is noticed).
-
-   This form of rekeying may temporarily result in multiple similar SAs
-   between the same pairs of nodes.  When there are two SAs eligible to
-   receive packets, a node MUST accept incoming packets through either
-   SA.  If redundant SAs are created though such a collision, the SA
-   created with the lowest of the four nonces used in the two exchanges
-   SHOULD be closed by the endpoint that created it. {{ Clarif-5.10 }}
-   "Lowest" means an octet-by-octet, lexicographical comparison (instead
-   of, for instance, comparing the nonces as large integers).  In other
-   words, start by comparing the first octet; if they're equal, move to
-   the next octet, and so on.  If you reach the end of one nonce, that
-   nonce is the lower one.
-
-   The following is an explanation on the impact this has on
-   implementations.  Assume that hosts A and B have an existing IPsec SA
-   pair with SPIs (SPIa1,SPIb1), and both start rekeying it at the same
-   time:
-
-   Host A                            Host B
-   -------------------------------------------------------------------
-   send req1: N(REKEY_SA,SPIa1),
-       SA(..,SPIa2,..),Ni1,..  -->
-                                <--  send req2: N(REKEY_SA,SPIb1),
-                                         SA(..,SPIb2,..),Ni2
-   recv req2 <--
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 31]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   At this point, A knows there is a simultaneous rekeying going on.
-   However, it cannot yet know which of the exchanges will have the
-   lowest nonce, so it will just note the situation and respond as
-   usual.
-
-   send resp2: SA(..,SPIa3,..),
-        Nr1,..  -->
-                                -->  recv req1
-
-   Now B also knows that simultaneous rekeying is going on.  It responds
-   as usual.
-
-                               <--  send resp1: SA(..,SPIb3,..),
-                                        Nr2,..
-   recv resp1 <--
-                               -->  recv resp2
-
-   At this point, there are three CHILD_SA pairs between A and B (the
-   old one and two new ones).  A and B can now compare the nonces.
-   Suppose that the lowest nonce was Nr1 in message resp2; in this case,
-   B (the sender of req2) deletes the redundant new SA, and A (the node
-   that initiated the surviving rekeyed SA), deletes the old one.
-
-   send req3: D(SPIa1) -->
-                                <--  send req4: D(SPIb2)
-                                -->  recv req3
-                                <--  send resp4: D(SPIb1)
-   recv req4 <--
-   send resp4: D(SPIa3) -->
-
-   The rekeying is now finished.
-
-   However, there is a second possible sequence of events that can
-   happen if some packets are lost in the network, resulting in
-   retransmissions.  The rekeying begins as usual, but A's first packet
-   (req1) is lost.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 32]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   Host A                            Host B
-   -------------------------------------------------------------------
-   send req1: N(REKEY_SA,SPIa1),
-       SA(..,SPIa2,..),
-       Ni1,..  -->  (lost)
-                                <--  send req2: N(REKEY_SA,SPIb1),
-                                         SA(..,SPIb2,..),Ni2
-   recv req2 <--
-   send resp2: SA(..,SPIa3,..),
-       Nr1,.. -->
-                                -->  recv resp2
-                                <--  send req3: D(SPIb1)
-   recv req3 <--
-   send resp3: D(SPIa1) -->
-                                -->  recv resp3
-
-   From B's point of view, the rekeying is now completed, and since it
-   has not yet received A's req1, it does not even know that there was
-   simultaneous rekeying.  However, A will continue retransmitting the
-   message, and eventually it will reach B.
-
-   resend req1 -->
-                                -->  recv req1
-
-   To B, it looks like A is trying to rekey an SA that no longer exists;
-   thus, B responds to the request with something non-fatal such as
-   NO_PROPOSAL_CHOSEN.
-
-                                <--  send resp1: N(NO_PROPOSAL_CHOSEN)
-   recv resp1 <--
-
-   When A receives this error, it already knows there was simultaneous
-   rekeying, so it can ignore the error message.
-
-2.8.2.   Rekeying the IKE_SA Versus Reauthentication
-
-   {{ Added this section from Clarif-5.2 }}
-
-   Rekeying the IKE_SA and reauthentication are different concepts in
-   IKEv2.  Rekeying the IKE_SA establishes new keys for the IKE_SA and
-   resets the Message ID counters, but it does not authenticate the
-   parties again (no AUTH or EAP payloads are involved).
-
-   Although rekeying the IKE_SA may be important in some environments,
-   reauthentication (the verification that the parties still have access
-   to the long-term credentials) is often more important.
-
-   IKEv2 does not have any special support for reauthentication.
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 33]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   Reauthentication is done by creating a new IKE_SA from scratch (using
-   IKE_SA_INIT/IKE_AUTH exchanges, without any REKEY_SA notify
-   payloads), creating new CHILD_SAs within the new IKE_SA (without
-   REKEY_SA notify payloads), and finally deleting the old IKE_SA (which
-   deletes the old CHILD_SAs as well).
-
-   This means that reauthentication also establishes new keys for the
-   IKE_SA and CHILD_SAs.  Therefore, while rekeying can be performed
-   more often than reauthentication, the situation where "authentication
-   lifetime" is shorter than "key lifetime" does not make sense.
-
-   While creation of a new IKE_SA can be initiated by either party
-   (initiator or responder in the original IKE_SA), the use of EAP
-   authentication and/or configuration payloads means in practice that
-   reauthentication has to be initiated by the same party as the
-   original IKE_SA.  IKEv2 does not currently allow the responder to
-   request reauthentication in this case; however, there is ongoing work
-   to add this functionality [REAUTH].
-
-2.9.  Traffic Selector Negotiation
-
-   {{ Clarif-7.2 }} When an RFC4301-compliant IPsec subsystem receives
-   an IP packet and matches a "protect" selector in its Security Policy
-   Database (SPD), the subsystem protects that packet with IPsec.  When
-   no SA exists yet, it is the task of IKE to create it.  Maintenance of
-   a system's SPD is outside the scope of IKE (see [PFKEY] for an
-   example protocol), though some implementations might update their SPD
-   in connection with the running of IKE (for an example scenario, see
-   Section 1.1.3).
-
-   Traffic Selector (TS) payloads allow endpoints to communicate some of
-   the information from their SPD to their peers.  TS payloads specify
-   the selection criteria for packets that will be forwarded over the
-   newly set up SA.  This can serve as a consistency check in some
-   scenarios to assure that the SPDs are consistent.  In others, it
-   guides the dynamic update of the SPD.
-
-   Two TS payloads appear in each of the messages in the exchange that
-   creates a CHILD_SA pair.  Each TS payload contains one or more
-   Traffic Selectors.  Each Traffic Selector consists of an address
-   range (IPv4 or IPv6), a port range, and an IP protocol ID.  In
-   support of the scenario described in Section 1.1.3, an initiator may
-   request that the responder assign an IP address and tell the
-   initiator what it is. {{ Clarif-6.1 }} That request is done using
-   configuration payloads, not traffic selectors.  An address in a TSi
-   payload in a response does not mean that the responder has assigned
-   that address to the initiator: it only means that if packets matching
-   these traffic selectors are sent by the initiator, IPsec processing
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 34]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   can be performed as agreed for this SA.
-
-   IKEv2 allows the responder to choose a subset of the traffic proposed
-   by the initiator.  This could happen when the configurations of the
-   two endpoints are being updated but only one end has received the new
-   information.  Since the two endpoints may be configured by different
-   people, the incompatibility may persist for an extended period even
-   in the absence of errors.  It also allows for intentionally different
-   configurations, as when one end is configured to tunnel all addresses
-   and depends on the other end to have the up-to-date list.
-
-   The first of the two TS payloads is known as TSi (Traffic Selector-
-   initiator).  The second is known as TSr (Traffic Selector-responder).
-   TSi specifies the source address of traffic forwarded from (or the
-   destination address of traffic forwarded to) the initiator of the
-   CHILD_SA pair.  TSr specifies the destination address of the traffic
-   forwarded to (or the source address of the traffic forwarded from)
-   the responder of the CHILD_SA pair.  For example, if the original
-   initiator request the creation of a CHILD_SA pair, and wishes to
-   tunnel all traffic from subnet 192.0.1.* on the initiator's side to
-   subnet 192.0.2.* on the responder's side, the initiator would include
-   a single traffic selector in each TS payload.  TSi would specify the
-   address range (192.0.1.0 - 192.0.1.255) and TSr would specify the
-   address range (192.0.2.0 - 192.0.2.255).  Assuming that proposal was
-   acceptable to the responder, it would send identical TS payloads
-   back.  (Note: The IP address range 192.0.2.* has been reserved for
-   use in examples in RFCs and similar documents.  This document needed
-   two such ranges, and so also used 192.0.1.*.  This should not be
-   confused with any actual address.)
-
-   The responder is allowed to narrow the choices by selecting a subset
-   of the traffic, for instance by eliminating or narrowing the range of
-   one or more members of the set of traffic selectors, provided the set
-   does not become the NULL set.
-
-   It is possible for the responder's policy to contain multiple smaller
-   ranges, all encompassed by the initiator's traffic selector, and with
-   the responder's policy being that each of those ranges should be sent
-   over a different SA.  Continuing the example above, the responder
-   might have a policy of being willing to tunnel those addresses to and
-   from the initiator, but might require that each address pair be on a
-   separately negotiated CHILD_SA.  If the initiator generated its
-   request in response to an incoming packet from 192.0.1.43 to
-   192.0.2.123, there would be no way for the responder to determine
-   which pair of addresses should be included in this tunnel, and it
-   would have to make a guess or reject the request with a status of
-   SINGLE_PAIR_REQUIRED.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 35]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   {{ Clarif-4.11 }} Few implementations will have policies that require
-   separate SAs for each address pair.  Because of this, if only some
-   part (or parts) of the TSi/TSr proposed by the initiator is (are)
-   acceptable to the responder, responders SHOULD narrow TSi/TSr to an
-   acceptable subset rather than use SINGLE_PAIR_REQUIRED.
-
-   To enable the responder to choose the appropriate range in this case,
-   if the initiator has requested the SA due to a data packet, the
-   initiator SHOULD include as the first traffic selector in each of TSi
-   and TSr a very specific traffic selector including the addresses in
-   the packet triggering the request.  In the example, the initiator
-   would include in TSi two traffic selectors: the first containing the
-   address range (192.0.1.43 - 192.0.1.43) and the source port and IP
-   protocol from the packet and the second containing (192.0.1.0 -
-   192.0.1.255) with all ports and IP protocols.  The initiator would
-   similarly include two traffic selectors in TSr.
-
-   If the responder's policy does not allow it to accept the entire set
-   of traffic selectors in the initiator's request, but does allow him
-   to accept the first selector of TSi and TSr, then the responder MUST
-   narrow the traffic selectors to a subset that includes the
-   initiator's first choices.  In this example, the responder might
-   respond with TSi being (192.0.1.43 - 192.0.1.43) with all ports and
-   IP protocols.
-
-   If the initiator creates the CHILD_SA pair not in response to an
-   arriving packet, but rather, say, upon startup, then there may be no
-   specific addresses the initiator prefers for the initial tunnel over
-   any other.  In that case, the first values in TSi and TSr MAY be
-   ranges rather than specific values, and the responder chooses a
-   subset of the initiator's TSi and TSr that are acceptable.  If more
-   than one subset is acceptable but their union is not, the responder
-   MUST accept some subset and MAY include a Notify payload of type
-   ADDITIONAL_TS_POSSIBLE to indicate that the initiator might want to
-   try again.  This case will occur only when the initiator and
-   responder are configured differently from one another.  If the
-   initiator and responder agree on the granularity of tunnels, the
-   initiator will never request a tunnel wider than the responder will
-   accept. {{ Demoted the SHOULD }} Such misconfigurations should be
-   recorded in error logs.
-
-   {{ Clarif-4.10 }} A concise summary of the narrowing process is:
-
-   o  If the responder's policy does not allow any part of the traffic
-      covered by TSi/TSr, it responds with TS_UNACCEPTABLE.
-
-   o  If the responder's policy allows the entire set of traffic covered
-      by TSi/TSr, no narrowing is necessary, and the responder can
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 36]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-      return the same TSi/TSr values.
-
-   o  Otherwise, narrowing is needed.  If the responder's policy allows
-      all traffic covered by TSi[1]/TSr[1] (the first traffic selectors
-      in TSi/TSr) but not entire TSi/TSr, the responder narrows to an
-      acceptable subset of TSi/TSr that includes TSi[1]/TSr[1].
-
-   o  If the responder's policy does not allow all traffic covered by
-      TSi[1]/TSr[1], but does allow some parts of TSi/TSr, it narrows to
-      an acceptable subset of TSi/TSr.
-
-   In the last two cases, there may be several subsets that are
-   acceptable (but their union is not); in this case, the responder
-   arbitrarily chooses one of them, and includes ADDITIONAL_TS_POSSIBLE
-   notification in the response.
-
-2.9.1.  Traffic Selectors Violating Own Policy
-
-   {{ Clarif-4.12 }}
-
-   When creating a new SA, the initiator needs to avoid proposing
-   traffic selectors that violate its own policy.  If this rule is not
-   followed, valid traffic may be dropped.
-
-   This is best illustrated by an example.  Suppose that host A has a
-   policy whose effect is that traffic to 192.0.1.66 is sent via host B
-   encrypted using AES, and traffic to all other hosts in 192.0.1.0/24
-   is also sent via B, but must use 3DES.  Suppose also that host B
-   accepts any combination of AES and 3DES.
-
-   If host A now proposes an SA that uses 3DES, and includes TSr
-   containing (192.0.1.0-192.0.1.0.255), this will be accepted by host
-   B. Now, host B can also use this SA to send traffic from 192.0.1.66,
-   but those packets will be dropped by A since it requires the use of
-   AES for those traffic.  Even if host A creates a new SA only for
-   192.0.1.66 that uses AES, host B may freely continue to use the first
-   SA for the traffic.  In this situation, when proposing the SA, host A
-   should have followed its own policy, and included a TSr containing
-   ((192.0.1.0-192.0.1.65),(192.0.1.67-192.0.1.255)) instead.
-
-   In general, if (1) the initiator makes a proposal "for traffic X
-   (TSi/TSr), do SA", and (2) for some subset X' of X, the initiator
-   does not actually accept traffic X' with SA, and (3) the initiator
-   would be willing to accept traffic X' with some SA' (!=SA), valid
-   traffic can be unnecessarily dropped since the responder can apply
-   either SA or SA' to traffic X'.
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 37]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-2.10.  Nonces
-
-   The IKE_SA_INIT messages each contain a nonce.  These nonces are used
-   as inputs to cryptographic functions.  The CREATE_CHILD_SA request
-   and the CREATE_CHILD_SA response also contain nonces.  These nonces
-   are used to add freshness to the key derivation technique used to
-   obtain keys for CHILD_SA, and to ensure creation of strong pseudo-
-   random bits from the Diffie-Hellman key.  Nonces used in IKEv2 MUST
-   be randomly chosen, MUST be at least 128 bits in size, and MUST be at
-   least half the key size of the negotiated prf. ("prf" refers to
-   "pseudo-random function", one of the cryptographic algorithms
-   negotiated in the IKE exchange.) {{ Clarif-7.4 }} However, the
-   initiator chooses the nonce before the outcome of the negotiation is
-   known.  Because of that, the nonce has to be long enough for all the
-   PRFs being proposed.  If the same random number source is used for
-   both keys and nonces, care must be taken to ensure that the latter
-   use does not compromise the former.
-
-2.11.  Address and Port Agility
-
-   IKE runs over UDP ports 500 and 4500, and implicitly sets up ESP and
-   AH associations for the same IP addresses it runs over.  The IP
-   addresses and ports in the outer header are, however, not themselves
-   cryptographically protected, and IKE is designed to work even through
-   Network Address Translation (NAT) boxes.  An implementation MUST
-   accept incoming requests even if the source port is not 500 or 4500,
-   and MUST respond to the address and port from which the request was
-   received.  It MUST specify the address and port at which the request
-   was received as the source address and port in the response.  IKE
-   functions identically over IPv4 or IPv6.
-
-2.12.  Reuse of Diffie-Hellman Exponentials
-
-   IKE generates keying material using an ephemeral Diffie-Hellman
-   exchange in order to gain the property of "perfect forward secrecy".
-   This means that once a connection is closed and its corresponding
-   keys are forgotten, even someone who has recorded all of the data
-   from the connection and gets access to all of the long-term keys of
-   the two endpoints cannot reconstruct the keys used to protect the
-   conversation without doing a brute force search of the session key
-   space.
-
-   Achieving perfect forward secrecy requires that when a connection is
-   closed, each endpoint MUST forget not only the keys used by the
-   connection but also any information that could be used to recompute
-   those keys.  In particular, it MUST forget the secrets used in the
-   Diffie-Hellman calculation and any state that may persist in the
-   state of a pseudo-random number generator that could be used to
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 38]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   recompute the Diffie-Hellman secrets.
-
-   Since the computing of Diffie-Hellman exponentials is computationally
-   expensive, an endpoint may find it advantageous to reuse those
-   exponentials for multiple connection setups.  There are several
-   reasonable strategies for doing this.  An endpoint could choose a new
-   exponential only periodically though this could result in less-than-
-   perfect forward secrecy if some connection lasts for less than the
-   lifetime of the exponential.  Or it could keep track of which
-   exponential was used for each connection and delete the information
-   associated with the exponential only when some corresponding
-   connection was closed.  This would allow the exponential to be reused
-   without losing perfect forward secrecy at the cost of maintaining
-   more state.
-
-   Decisions as to whether and when to reuse Diffie-Hellman exponentials
-   is a private decision in the sense that it will not affect
-   interoperability.  An implementation that reuses exponentials MAY
-   choose to remember the exponential used by the other endpoint on past
-   exchanges and if one is reused to avoid the second half of the
-   calculation.
-
-2.13.  Generating Keying Material
-
-   In the context of the IKE_SA, four cryptographic algorithms are
-   negotiated: an encryption algorithm, an integrity protection
-   algorithm, a Diffie-Hellman group, and a pseudo-random function
-   (prf).  The pseudo-random function is used for the construction of
-   keying material for all of the cryptographic algorithms used in both
-   the IKE_SA and the CHILD_SAs.
-
-   We assume that each encryption algorithm and integrity protection
-   algorithm uses a fixed-size key and that any randomly chosen value of
-   that fixed size can serve as an appropriate key.  For algorithms that
-   accept a variable length key, a fixed key size MUST be specified as
-   part of the cryptographic transform negotiated.  For algorithms for
-   which not all values are valid keys (such as DES or 3DES with key
-   parity), the algorithm by which keys are derived from arbitrary
-   values MUST be specified by the cryptographic transform.  For
-   integrity protection functions based on Hashed Message Authentication
-   Code (HMAC), the fixed key size is the size of the output of the
-   underlying hash function.  When the prf function takes a variable
-   length key, variable length data, and produces a fixed-length output
-   (e.g., when using HMAC), the formulas in this document apply.  When
-   the key for the prf function has fixed length, the data provided as a
-   key is truncated or padded with zeros as necessary unless exceptional
-   processing is explained following the formula.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 39]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   Keying material will always be derived as the output of the
-   negotiated prf algorithm.  Since the amount of keying material needed
-   may be greater than the size of the output of the prf algorithm, we
-   will use the prf iteratively.  We will use the terminology prf+ to
-   describe the function that outputs a pseudo-random stream based on
-   the inputs to a prf as follows: (where | indicates concatenation)
-
-   prf+ (K,S) = T1 | T2 | T3 | T4 | ...
-
-   where:
-   T1 = prf (K, S | 0x01)
-   T2 = prf (K, T1 | S | 0x02)
-   T3 = prf (K, T2 | S | 0x03)
-   T4 = prf (K, T3 | S | 0x04)
-
-   continuing as needed to compute all required keys.  The keys are
-   taken from the output string without regard to boundaries (e.g., if
-   the required keys are a 256-bit Advanced Encryption Standard (AES)
-   key and a 160-bit HMAC key, and the prf function generates 160 bits,
-   the AES key will come from T1 and the beginning of T2, while the HMAC
-   key will come from the rest of T2 and the beginning of T3).
-
-   The constant concatenated to the end of each string feeding the prf
-   is a single octet. prf+ in this document is not defined beyond 255
-   times the size of the prf output.
-
-2.14.  Generating Keying Material for the IKE_SA
-
-   The shared keys are computed as follows.  A quantity called SKEYSEED
-   is calculated from the nonces exchanged during the IKE_SA_INIT
-   exchange and the Diffie-Hellman shared secret established during that
-   exchange.  SKEYSEED is used to calculate seven other secrets: SK_d
-   used for deriving new keys for the CHILD_SAs established with this
-   IKE_SA; SK_ai and SK_ar used as a key to the integrity protection
-   algorithm for authenticating the component messages of subsequent
-   exchanges; SK_ei and SK_er used for encrypting (and of course
-   decrypting) all subsequent exchanges; and SK_pi and SK_pr, which are
-   used when generating an AUTH payload.
-
-   SKEYSEED and its derivatives are computed as follows:
-
-   SKEYSEED = prf(Ni | Nr, g^ir)
-
-   {SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr }
-                   = prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr )
-
-   (indicating that the quantities SK_d, SK_ai, SK_ar, SK_ei, SK_er,
-   SK_pi, and SK_pr are taken in order from the generated bits of the
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 40]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   prf+). g^ir is the shared secret from the ephemeral Diffie-Hellman
-   exchange. g^ir is represented as a string of octets in big endian
-   order padded with zeros if necessary to make it the length of the
-   modulus.  Ni and Nr are the nonces, stripped of any headers.  If the
-   negotiated prf takes a fixed-length key and the lengths of Ni and Nr
-   do not add up to that length, half the bits must come from Ni and
-   half from Nr, taking the first bits of each.
-
-   The two directions of traffic flow use different keys.  The keys used
-   to protect messages from the original initiator are SK_ai and SK_ei.
-   The keys used to protect messages in the other direction are SK_ar
-   and SK_er.  Each algorithm takes a fixed number of bits of keying
-   material, which is specified as part of the algorithm.  For integrity
-   algorithms based on a keyed hash, the key size is always equal to the
-   length of the output of the underlying hash function.
-
-2.15.  Authentication of the IKE_SA
-
-   When not using extensible authentication (see Section 2.16), the
-   peers are authenticated by having each sign (or MAC using a shared
-   secret as the key) a block of data.  For the responder, the octets to
-   be signed start with the first octet of the first SPI in the header
-   of the second message and end with the last octet of the last payload
-   in the second message.  Appended to this (for purposes of computing
-   the signature) are the initiator's nonce Ni (just the value, not the
-   payload containing it), and the value prf(SK_pr,IDr') where IDr' is
-   the responder's ID payload excluding the fixed header.  Note that
-   neither the nonce Ni nor the value prf(SK_pr,IDr') are transmitted.
-   Similarly, the initiator signs the first message, starting with the
-   first octet of the first SPI in the header and ending with the last
-   octet of the last payload.  Appended to this (for purposes of
-   computing the signature) are the responder's nonce Nr, and the value
-   prf(SK_pi,IDi').  In the above calculation, IDi' and IDr' are the
-   entire ID payloads excluding the fixed header.  It is critical to the
-   security of the exchange that each side sign the other side's nonce.
-
-   {{ Clarif-3.1 }}
-
-   The initiator's signed octets can be described as:
-
-   InitiatorSignedOctets = RealMessage1 | NonceRData | MACedIDForI
-   GenIKEHDR = [ four octets 0 if using port 4500 ] | RealIKEHDR
-   RealIKEHDR =  SPIi | SPIr |  . . . | Length
-   RealMessage1 = RealIKEHDR | RestOfMessage1
-   NonceRPayload = PayloadHeader | NonceRData
-   InitiatorIDPayload = PayloadHeader | RestOfIDPayload
-   RestOfInitIDPayload = IDType | RESERVED | InitIDData
-   MACedIDForI = prf(SK_pi, RestOfInitIDPayload)
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 41]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   The responder's signed octets can be described as:
-
-   ResponderSignedOctets = RealMessage2 | NonceIData | MACedIDForR
-   GenIKEHDR = [ four octets 0 if using port 4500 ] | RealIKEHDR
-   RealIKEHDR =  SPIi | SPIr |  . . . | Length
-   RealMessage2 = RealIKEHDR | RestOfMessage2
-   NonceIPayload = PayloadHeader | NonceIData
-   ResponderIDPayload = PayloadHeader | RestOfIDPayload
-   RestOfRespIDPayload = IDType | RESERVED | InitIDData
-   MACedIDForR = prf(SK_pr, RestOfRespIDPayload)
-
-   Note that all of the payloads are included under the signature,
-   including any payload types not defined in this document.  If the
-   first message of the exchange is sent twice (the second time with a
-   responder cookie and/or a different Diffie-Hellman group), it is the
-   second version of the message that is signed.
-
-   Optionally, messages 3 and 4 MAY include a certificate, or
-   certificate chain providing evidence that the key used to compute a
-   digital signature belongs to the name in the ID payload.  The
-   signature or MAC will be computed using algorithms dictated by the
-   type of key used by the signer, and specified by the Auth Method
-   field in the Authentication payload.  There is no requirement that
-   the initiator and responder sign with the same cryptographic
-   algorithms.  The choice of cryptographic algorithms depends on the
-   type of key each has.  In particular, the initiator may be using a
-   shared key while the responder may have a public signature key and
-   certificate.  It will commonly be the case (but it is not required)
-   that if a shared secret is used for authentication that the same key
-   is used in both directions.  Note that it is a common but typically
-   insecure practice to have a shared key derived solely from a user-
-   chosen password without incorporating another source of randomness.
-
-   This is typically insecure because user-chosen passwords are unlikely
-   to have sufficient unpredictability to resist dictionary attacks and
-   these attacks are not prevented in this authentication method.
-   (Applications using password-based authentication for bootstrapping
-   and IKE_SA should use the authentication method in Section 2.16,
-   which is designed to prevent off-line dictionary attacks.) {{ Demoted
-   the SHOULD }} The pre-shared key needs to contain as much
-   unpredictability as the strongest key being negotiated.  In the case
-   of a pre-shared key, the AUTH value is computed as:
-
-   AUTH = prf(prf(Shared Secret,"Key Pad for IKEv2"), <msg octets>)
-
-   where the string "Key Pad for IKEv2" is 17 ASCII characters without
-   null termination.  The shared secret can be variable length.  The pad
-   string is added so that if the shared secret is derived from a
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 42]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   password, the IKE implementation need not store the password in
-   cleartext, but rather can store the value prf(Shared Secret,"Key Pad
-   for IKEv2"), which could not be used as a password equivalent for
-   protocols other than IKEv2.  As noted above, deriving the shared
-   secret from a password is not secure.  This construction is used
-   because it is anticipated that people will do it anyway.  The
-   management interface by which the Shared Secret is provided MUST
-   accept ASCII strings of at least 64 octets and MUST NOT add a null
-   terminator before using them as shared secrets.  It MUST also accept
-   a hex encoding of the Shared Secret.  The management interface MAY
-   accept other encodings if the algorithm for translating the encoding
-   to a binary string is specified.
-
-   {{ Clarif-3.7 }} If the negotiated prf takes a fixed-size key, the
-   shared secret MUST be of that fixed size.  This requirement means
-   that it is difficult to use these PRFs with shared key authentication
-   because it limits the shared secrets that can be used.  Thus, PRFs
-   that require a fixed-size key SHOULD NOT be used with shared key
-   authentication.  For example, PRF_AES128_CBC [PRFAES128CBC]
-   originally used fixed key sizes; that RFC has been updated to handle
-   variable key sizes in [PRFAES128CBC-bis].  Note that Section 2.13
-   also contains text that is related to PRFs with fixed key size.
-   However, the text in that section applies only to the prf+
-   construction.
-
-2.16.  Extensible Authentication Protocol Methods
-
-   In addition to authentication using public key signatures and shared
-   secrets, IKE supports authentication using methods defined in RFC
-   3748 [EAP].  Typically, these methods are asymmetric (designed for a
-   user authenticating to a server), and they may not be mutual. {{ In
-   the next sentence, changed "public key signature based" to "strong"
-   }} For this reason, these protocols are typically used to
-   authenticate the initiator to the responder and MUST be used in
-   conjunction with a strong authentication of the responder to the
-   initiator.  These methods are often associated with mechanisms
-   referred to as "Legacy Authentication" mechanisms.
-
-   While this memo references [EAP] with the intent that new methods can
-   be added in the future without updating this specification, some
-   simpler variations are documented here and in Section 3.16.  [EAP]
-   defines an authentication protocol requiring a variable number of
-   messages.  Extensible Authentication is implemented in IKE as
-   additional IKE_AUTH exchanges that MUST be completed in order to
-   initialize the IKE_SA.
-
-   An initiator indicates a desire to use extensible authentication by
-   leaving out the AUTH payload from message 3.  By including an IDi
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 43]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   payload but not an AUTH payload, the initiator has declared an
-   identity but has not proven it.  If the responder is willing to use
-   an extensible authentication method, it will place an Extensible
-   Authentication Protocol (EAP) payload in message 4 and defer sending
-   SAr2, TSi, and TSr until initiator authentication is complete in a
-   subsequent IKE_AUTH exchange.  In the case of a minimal extensible
-   authentication, the initial SA establishment will appear as follows:
-
-   Initiator                         Responder
-   -------------------------------------------------------------------
-   HDR, SAi1, KEi, Ni  -->
-                                <--  HDR, SAr1, KEr, Nr, [CERTREQ]
-   HDR, SK {IDi, [CERTREQ,]
-       [IDr,] SAi2,
-       TSi, TSr}  -->
-                                <--  HDR, SK {IDr, [CERT,] AUTH,
-                                         EAP }
-   HDR, SK {EAP}  -->
-                                <--  HDR, SK {EAP (success)}
-   HDR, SK {AUTH}  -->
-                                <--  HDR, SK {AUTH, SAr2, TSi, TSr }
-
-   {{ Clarif-3.10 }} As described in Section 2.2, when EAP is used, each
-   pair of IKE_SA initial setup messages will have their message numbers
-   incremented; the first pair of AUTH messages will have an ID of 1,
-   the second will be 2, and so on.
-
-   For EAP methods that create a shared key as a side effect of
-   authentication, that shared key MUST be used by both the initiator
-   and responder to generate AUTH payloads in messages 7 and 8 using the
-   syntax for shared secrets specified in Section 2.15.  The shared key
-   from EAP is the field from the EAP specification named MSK.  The
-   shared key generated during an IKE exchange MUST NOT be used for any
-   other purpose.
-
-   EAP methods that do not establish a shared key SHOULD NOT be used, as
-   they are subject to a number of man-in-the-middle attacks [EAPMITM]
-   if these EAP methods are used in other protocols that do not use a
-   server-authenticated tunnel.  Please see the Security Considerations
-   section for more details.  If EAP methods that do not generate a
-   shared key are used, the AUTH payloads in messages 7 and 8 MUST be
-   generated using SK_pi and SK_pr, respectively.
-
-   {{ Demoted the SHOULD }} The initiator of an IKE_SA using EAP needs
-   to be capable of extending the initial protocol exchange to at least
-   ten IKE_AUTH exchanges in the event the responder sends notification
-   messages and/or retries the authentication prompt.  Once the protocol
-   exchange defined by the chosen EAP authentication method has
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 44]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   successfully terminated, the responder MUST send an EAP payload
-   containing the Success message.  Similarly, if the authentication
-   method has failed, the responder MUST send an EAP payload containing
-   the Failure message.  The responder MAY at any time terminate the IKE
-   exchange by sending an EAP payload containing the Failure message.
-
-   Following such an extended exchange, the EAP AUTH payloads MUST be
-   included in the two messages following the one containing the EAP
-   Success message.
-
-   {{ Clarif-3.5 }} When the initiator authentication uses EAP, it is
-   possible that the contents of the IDi payload is used only for AAA
-   routing purposes and selecting which EAP method to use.  This value
-   may be different from the identity authenticated by the EAP method.
-   It is important that policy lookups and access control decisions use
-   the actual authenticated identity.  Often the EAP server is
-   implemented in a separate AAA server that communicates with the IKEv2
-   responder.  In this case, the authenticated identity has to be sent
-   from the AAA server to the IKEv2 responder.
-
-   {{ Clarif-3.8 }} The information in Section 2.17 about PRFs with
-   fixed-size keys also applies to EAP authentication.  For instance, a
-   PRF that requires a 128-bit key cannot be used with EAP because
-   specifies that the MSK is at least 512 bits long.
-
-2.17.  Generating Keying Material for CHILD_SAs
-
-   A single CHILD_SA is created by the IKE_AUTH exchange, and additional
-   CHILD_SAs can optionally be created in CREATE_CHILD_SA exchanges.
-   Keying material for them is generated as follows:
-
-   KEYMAT = prf+(SK_d, Ni | Nr)
-
-   Where Ni and Nr are the nonces from the IKE_SA_INIT exchange if this
-   request is the first CHILD_SA created or the fresh Ni and Nr from the
-   CREATE_CHILD_SA exchange if this is a subsequent creation.
-
-   For CREATE_CHILD_SA exchanges including an optional Diffie-Hellman
-   exchange, the keying material is defined as:
-
-   KEYMAT = prf+(SK_d, g^ir (new) | Ni | Nr )
-
-   where g^ir (new) is the shared secret from the ephemeral Diffie-
-   Hellman exchange of this CREATE_CHILD_SA exchange (represented as an
-   octet string in big endian order padded with zeros in the high-order
-   bits if necessary to make it the length of the modulus).
-
-   A single CHILD_SA negotiation may result in multiple security
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 45]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   associations.  ESP and AH SAs exist in pairs (one in each direction),
-   and four SAs could be created in a single CHILD_SA negotiation if a
-   combination of ESP and AH is being negotiated.
-
-   Keying material MUST be taken from the expanded KEYMAT in the
-   following order:
-
-   o  All keys for SAs carrying data from the initiator to the responder
-      are taken before SAs going in the reverse direction.
-
-   o  If multiple IPsec protocols are negotiated, keying material is
-      taken in the order in which the protocol headers will appear in
-      the encapsulated packet.
-
-   o  If a single protocol has both encryption and authentication keys,
-      the encryption key is taken from the first octets of KEYMAT and
-      the authentication key is taken from the next octets.
-
-   Each cryptographic algorithm takes a fixed number of bits of keying
-   material specified as part of the algorithm.
-
-2.18.  Rekeying IKE_SAs Using a CREATE_CHILD_SA Exchange
-
-   The CREATE_CHILD_SA exchange can be used to rekey an existing IKE_SA
-   (see Section 2.8). {{ Clarif-5.3 }} New initiator and responder SPIs
-   are supplied in the SPI fields in the Proposal structures inside the
-   Security Association (SA) payloads (not the SPI fields in the IKE
-   header).  The TS payloads are omitted when rekeying an IKE_SA.
-   SKEYSEED for the new IKE_SA is computed using SK_d from the existing
-   IKE_SA as follows:
-
-   SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)
-
-   where g^ir (new) is the shared secret from the ephemeral Diffie-
-   Hellman exchange of this CREATE_CHILD_SA exchange (represented as an
-   octet string in big endian order padded with zeros if necessary to
-   make it the length of the modulus) and Ni and Nr are the two nonces
-   stripped of any headers.
-
-   {{ Clarif-5.5 }} The old and new IKE_SA may have selected a different
-   PRF.  Because the rekeying exchange belongs to the old IKE_SA, it is
-   the old IKE_SA's PRF that is used.  Note that this may not work if
-   the new IKE_SA's PRF has a fixed key size because the output of the
-   PRF may not be of the correct size.
-
-   The new IKE_SA MUST reset its message counters to 0.
-
-   SK_d, SK_ai, SK_ar, SK_ei, and SK_er are computed from SKEYSEED as
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 46]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   specified in Section 2.14.
-
-2.19.  Requesting an Internal Address on a Remote Network
-
-   Most commonly occurring in the endpoint-to-security-gateway scenario,
-   an endpoint may need an IP address in the network protected by the
-   security gateway and may need to have that address dynamically
-   assigned.  A request for such a temporary address can be included in
-   any request to create a CHILD_SA (including the implicit request in
-   message 3) by including a CP payload.
-
-   This function provides address allocation to an IPsec Remote Access
-   Client (IRAC) trying to tunnel into a network protected by an IPsec
-   Remote Access Server (IRAS).  Since the IKE_AUTH exchange creates an
-   IKE_SA and a CHILD_SA, the IRAC MUST request the IRAS-controlled
-   address (and optionally other information concerning the protected
-   network) in the IKE_AUTH exchange.  The IRAS may procure an address
-   for the IRAC from any number of sources such as a DHCP/BOOTP server
-   or its own address pool.
-
-   Initiator                         Responder
-   -------------------------------------------------------------------
-    HDR, SK {IDi, [CERT,]
-       [CERTREQ,] [IDr,] AUTH,
-       CP(CFG_REQUEST), SAi2,
-       TSi, TSr}  -->
-                                <--  HDR, SK {IDr, [CERT,] AUTH,
-                                         CP(CFG_REPLY), SAr2,
-                                         TSi, TSr}
-
-   In all cases, the CP payload MUST be inserted before the SA payload.
-   In variations of the protocol where there are multiple IKE_AUTH
-   exchanges, the CP payloads MUST be inserted in the messages
-   containing the SA payloads.
-
-   CP(CFG_REQUEST) MUST contain at least an INTERNAL_ADDRESS attribute
-   (either IPv4 or IPv6) but MAY contain any number of additional
-   attributes the initiator wants returned in the response.
-
-   For example, message from initiator to responder:
-
-   CP(CFG_REQUEST)=
-     INTERNAL_ADDRESS()
-   TSi = (0, 0-65535,0.0.0.0-255.255.255.255)
-   TSr = (0, 0-65535,0.0.0.0-255.255.255.255)
-
-   NOTE: Traffic Selectors contain (protocol, port range, address
-   range).
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 47]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   Message from responder to initiator:
-
-   CP(CFG_REPLY)=
-     INTERNAL_ADDRESS(192.0.2.202)
-     INTERNAL_NETMASK(255.255.255.0)
-     INTERNAL_SUBNET(192.0.2.0/255.255.255.0)
-   TSi = (0, 0-65535,192.0.2.202-192.0.2.202)
-   TSr = (0, 0-65535,192.0.2.0-192.0.2.255)
-
-   All returned values will be implementation dependent.  As can be seen
-   in the above example, the IRAS MAY also send other attributes that
-   were not included in CP(CFG_REQUEST) and MAY ignore the non-
-   mandatory attributes that it does not support.
-
-   The responder MUST NOT send a CFG_REPLY without having first received
-   a CP(CFG_REQUEST) from the initiator, because we do not want the IRAS
-   to perform an unnecessary configuration lookup if the IRAC cannot
-   process the REPLY.  In the case where the IRAS's configuration
-   requires that CP be used for a given identity IDi, but IRAC has
-   failed to send a CP(CFG_REQUEST), IRAS MUST fail the request, and
-   terminate the IKE exchange with a FAILED_CP_REQUIRED error.
-
-2.20.  Requesting the Peer's Version
-
-   An IKE peer wishing to inquire about the other peer's IKE software
-   version information MAY use the method below.  This is an example of
-   a configuration request within an INFORMATIONAL exchange, after the
-   IKE_SA and first CHILD_SA have been created.
-
-   An IKE implementation MAY decline to give out version information
-   prior to authentication or even after authentication to prevent
-   trolling in case some implementation is known to have some security
-   weakness.  In that case, it MUST either return an empty string or no
-   CP payload if CP is not supported.
-
-   Initiator                         Responder
-   -------------------------------------------------------------------
-   HDR, SK{CP(CFG_REQUEST)}  -->
-                                <--  HDR, SK{CP(CFG_REPLY)}
-
-   CP(CFG_REQUEST)=
-     APPLICATION_VERSION("")
-
-   CP(CFG_REPLY) APPLICATION_VERSION("foobar v1.3beta, (c) Foo Bar
-     Inc.")
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 48]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-2.21.  Error Handling
-
-   There are many kinds of errors that can occur during IKE processing.
-   If a request is received that is badly formatted or unacceptable for
-   reasons of policy (e.g., no matching cryptographic algorithms), the
-   response MUST contain a Notify payload indicating the error.  If an
-   error occurs outside the context of an IKE request (e.g., the node is
-   getting ESP messages on a nonexistent SPI), the node SHOULD initiate
-   an INFORMATIONAL exchange with a Notify payload describing the
-   problem.
-
-   Errors that occur before a cryptographically protected IKE_SA is
-   established must be handled very carefully.  There is a trade-off
-   between wanting to be helpful in diagnosing a problem and responding
-   to it and wanting to avoid being a dupe in a denial of service attack
-   based on forged messages.
-
-   If a node receives a message on UDP port 500 or 4500 outside the
-   context of an IKE_SA known to it (and not a request to start one), it
-   may be the result of a recent crash of the node.  If the message is
-   marked as a response, the node MAY audit the suspicious event but
-   MUST NOT respond.  If the message is marked as a request, the node
-   MAY audit the suspicious event and MAY send a response.  If a
-   response is sent, the response MUST be sent to the IP address and
-   port from whence it came with the same IKE SPIs and the Message ID
-   copied.  The response MUST NOT be cryptographically protected and
-   MUST contain a Notify payload indicating INVALID_IKE_SPI.
-
-   A node receiving such an unprotected Notify payload MUST NOT respond
-   and MUST NOT change the state of any existing SAs.  The message might
-   be a forgery or might be a response the genuine correspondent was
-   tricked into sending. {{ Demoted two SHOULDs }} A node should treat
-   such a message (and also a network message like ICMP destination
-   unreachable) as a hint that there might be problems with SAs to that
-   IP address and should initiate a liveness test for any such IKE_SA.
-   An implementation SHOULD limit the frequency of such tests to avoid
-   being tricked into participating in a denial of service attack.
-
-   A node receiving a suspicious message from an IP address with which
-   it has an IKE_SA MAY send an IKE Notify payload in an IKE
-   INFORMATIONAL exchange over that SA. {{ Demoted the SHOULD }} The
-   recipient MUST NOT change the state of any SAs as a result, but may
-   wish to audit the event to aid in diagnosing malfunctions.  A node
-   MUST limit the rate at which it will send messages in response to
-   unprotected messages.
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 49]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-2.22.  IPComp
-
-   Use of IP compression [IPCOMP] can be negotiated as part of the setup
-   of a CHILD_SA.  While IP compression involves an extra header in each
-   packet and a compression parameter index (CPI), the virtual
-   "compression association" has no life outside the ESP or AH SA that
-   contains it.  Compression associations disappear when the
-   corresponding ESP or AH SA goes away.  It is not explicitly mentioned
-   in any DELETE payload.
-
-   Negotiation of IP compression is separate from the negotiation of
-   cryptographic parameters associated with a CHILD_SA.  A node
-   requesting a CHILD_SA MAY advertise its support for one or more
-   compression algorithms through one or more Notify payloads of type
-   IPCOMP_SUPPORTED.  The response MAY indicate acceptance of a single
-   compression algorithm with a Notify payload of type IPCOMP_SUPPORTED.
-   These payloads MUST NOT occur in messages that do not contain SA
-   payloads.
-
-   Although there has been discussion of allowing multiple compression
-   algorithms to be accepted and to have different compression
-   algorithms available for the two directions of a CHILD_SA,
-   implementations of this specification MUST NOT accept an IPComp
-   algorithm that was not proposed, MUST NOT accept more than one, and
-   MUST NOT compress using an algorithm other than one proposed and
-   accepted in the setup of the CHILD_SA.
-
-   A side effect of separating the negotiation of IPComp from
-   cryptographic parameters is that it is not possible to propose
-   multiple cryptographic suites and propose IP compression with some of
-   them but not others.
-
-2.23.  NAT Traversal
-
-   Network Address Translation (NAT) gateways are a controversial
-   subject.  This section briefly describes what they are and how they
-   are likely to act on IKE traffic.  Many people believe that NATs are
-   evil and that we should not design our protocols so as to make them
-   work better.  IKEv2 does specify some unintuitive processing rules in
-   order that NATs are more likely to work.
-
-   NATs exist primarily because of the shortage of IPv4 addresses,
-   though there are other rationales.  IP nodes that are "behind" a NAT
-   have IP addresses that are not globally unique, but rather are
-   assigned from some space that is unique within the network behind the
-   NAT but that are likely to be reused by nodes behind other NATs.
-   Generally, nodes behind NATs can communicate with other nodes behind
-   the same NAT and with nodes with globally unique addresses, but not
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 50]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   with nodes behind other NATs.  There are exceptions to that rule.
-   When those nodes make connections to nodes on the real Internet, the
-   NAT gateway "translates" the IP source address to an address that
-   will be routed back to the gateway.  Messages to the gateway from the
-   Internet have their destination addresses "translated" to the
-   internal address that will route the packet to the correct endnode.
-
-   NATs are designed to be "transparent" to endnodes.  Neither software
-   on the node behind the NAT nor the node on the Internet requires
-   modification to communicate through the NAT.  Achieving this
-   transparency is more difficult with some protocols than with others.
-   Protocols that include IP addresses of the endpoints within the
-   payloads of the packet will fail unless the NAT gateway understands
-   the protocol and modifies the internal references as well as those in
-   the headers.  Such knowledge is inherently unreliable, is a network
-   layer violation, and often results in subtle problems.
-
-   Opening an IPsec connection through a NAT introduces special
-   problems.  If the connection runs in transport mode, changing the IP
-   addresses on packets will cause the checksums to fail and the NAT
-   cannot correct the checksums because they are cryptographically
-   protected.  Even in tunnel mode, there are routing problems because
-   transparently translating the addresses of AH and ESP packets
-   requires special logic in the NAT and that logic is heuristic and
-   unreliable in nature.  For that reason, IKEv2 can negotiate UDP
-   encapsulation of IKE and ESP packets.  This encoding is slightly less
-   efficient but is easier for NATs to process.  In addition, firewalls
-   may be configured to pass IPsec traffic over UDP but not ESP/AH or
-   vice versa.
-
-   It is a common practice of NATs to translate TCP and UDP port numbers
-   as well as addresses and use the port numbers of inbound packets to
-   decide which internal node should get a given packet.  For this
-   reason, even though IKE packets MUST be sent from and to UDP port
-   500, they MUST be accepted coming from any port and responses MUST be
-   sent to the port from whence they came.  This is because the ports
-   may be modified as the packets pass through NATs.  Similarly, IP
-   addresses of the IKE endpoints are generally not included in the IKE
-   payloads because the payloads are cryptographically protected and
-   could not be transparently modified by NATs.
-
-   Port 4500 is reserved for UDP-encapsulated ESP and IKE.  When working
-   through a NAT, it is generally better to pass IKE packets over port
-   4500 because some older NATs handle IKE traffic on port 500 cleverly
-   in an attempt to transparently establish IPsec connections between
-   endpoints that don't handle NAT traversal themselves.  Such NATs may
-   interfere with the straightforward NAT traversal envisioned by this
-   document. {{ Clarif-7.6 }} An IPsec endpoint that discovers a NAT
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 51]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   between it and its correspondent MUST send all subsequent traffic
-   from port 4500, which NATs should not treat specially (as they might
-   with port 500).
-
-   The specific requirements for supporting NAT traversal [NATREQ] are
-   listed below.  Support for NAT traversal is optional.  In this
-   section only, requirements listed as MUST apply only to
-   implementations supporting NAT traversal.
-
-   o  IKE MUST listen on port 4500 as well as port 500.  IKE MUST
-      respond to the IP address and port from which packets arrived.
-
-   o  Both IKE initiator and responder MUST include in their IKE_SA_INIT
-      packets Notify payloads of type NAT_DETECTION_SOURCE_IP and
-      NAT_DETECTION_DESTINATION_IP.  Those payloads can be used to
-      detect if there is NAT between the hosts, and which end is behind
-      the NAT.  The location of the payloads in the IKE_SA_INIT packets
-      are just after the Ni and Nr payloads (before the optional CERTREQ
-      payload).
-
-   o  If none of the NAT_DETECTION_SOURCE_IP payload(s) received matches
-      the hash of the source IP and port found from the IP header of the
-      packet containing the payload, it means that the other end is
-      behind NAT (i.e., someone along the route changed the source
-      address of the original packet to match the address of the NAT
-      box).  In this case, this end should allow dynamic update of the
-      other ends IP address, as described later.
-
-   o  If the NAT_DETECTION_DESTINATION_IP payload received does not
-      match the hash of the destination IP and port found from the IP
-      header of the packet containing the payload, it means that this
-      end is behind a NAT.  In this case, this end SHOULD start sending
-      keepalive packets as explained in [UDPENCAPS].
-
-   o  The IKE initiator MUST check these payloads if present and if they
-      do not match the addresses in the outer packet MUST tunnel all
-      future IKE and ESP packets associated with this IKE_SA over UDP
-      port 4500.
-
-   o  To tunnel IKE packets over UDP port 4500, the IKE header has four
-      octets of zero prepended and the result immediately follows the
-      UDP header.  To tunnel ESP packets over UDP port 4500, the ESP
-      header immediately follows the UDP header.  Since the first four
-      bytes of the ESP header contain the SPI, and the SPI cannot
-      validly be zero, it is always possible to distinguish ESP and IKE
-      messages.
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 52]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   o  The original source and destination IP address required for the
-      transport mode TCP and UDP packet checksum fixup (see [UDPENCAPS])
-      are obtained from the Traffic Selectors associated with the
-      exchange.  In the case of NAT traversal, the Traffic Selectors
-      MUST contain exactly one IP address, which is then used as the
-      original IP address.
-
-   o  There are cases where a NAT box decides to remove mappings that
-      are still alive (for example, the keepalive interval is too long,
-      or the NAT box is rebooted).  To recover in these cases, hosts
-      that are not behind a NAT SHOULD send all packets (including
-      retransmission packets) to the IP address and port from the last
-      valid authenticated packet from the other end (i.e., dynamically
-      update the address).  A host behind a NAT SHOULD NOT do this
-      because it opens a DoS attack possibility.  Any authenticated IKE
-      packet or any authenticated UDP-encapsulated ESP packet can be
-      used to detect that the IP address or the port has changed.
-
-   Note that similar but probably not identical actions will likely be
-   needed to make IKE work with Mobile IP, but such processing is not
-   addressed by this document.
-
-2.24.  Explicit Congestion Notification (ECN)
-
-   When IPsec tunnels behave as originally specified in [IPSECARCH-OLD],
-   ECN usage is not appropriate for the outer IP headers because tunnel
-   decapsulation processing discards ECN congestion indications to the
-   detriment of the network.  ECN support for IPsec tunnels for IKEv1-
-   based IPsec requires multiple operating modes and negotiation (see
-   [ECN]).  IKEv2 simplifies this situation by requiring that ECN be
-   usable in the outer IP headers of all tunnel-mode IPsec SAs created
-   by IKEv2.  Specifically, tunnel encapsulators and decapsulators for
-   all tunnel-mode SAs created by IKEv2 MUST support the ECN full-
-   functionality option for tunnels specified in [ECN] and MUST
-   implement the tunnel encapsulation and decapsulation processing
-   specified in [IPSECARCH] to prevent discarding of ECN congestion
-   indications.
-
-
-3.  Header and Payload Formats
-
-3.1.  The IKE Header
-
-   IKE messages use UDP ports 500 and/or 4500, with one IKE message per
-   UDP datagram.  Information from the beginning of the packet through
-   the UDP header is largely ignored except that the IP addresses and
-   UDP ports from the headers are reversed and used for return packets.
-   When sent on UDP port 500, IKE messages begin immediately following
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 53]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   the UDP header.  When sent on UDP port 4500, IKE messages have
-   prepended four octets of zero.  These four octets of zero are not
-   part of the IKE message and are not included in any of the length
-   fields or checksums defined by IKE.  Each IKE message begins with the
-   IKE header, denoted HDR in this memo.  Following the header are one
-   or more IKE payloads each identified by a "Next Payload" field in the
-   preceding payload.  Payloads are processed in the order in which they
-   appear in an IKE message by invoking the appropriate processing
-   routine according to the "Next Payload" field in the IKE header and
-   subsequently according to the "Next Payload" field in the IKE payload
-   itself until a "Next Payload" field of zero indicates that no
-   payloads follow.  If a payload of type "Encrypted" is found, that
-   payload is decrypted and its contents parsed as additional payloads.
-   An Encrypted payload MUST be the last payload in a packet and an
-   Encrypted payload MUST NOT contain another Encrypted payload.
-
-   The Recipient SPI in the header identifies an instance of an IKE
-   security association.  It is therefore possible for a single instance
-   of IKE to multiplex distinct sessions with multiple peers.
-
-   All multi-octet fields representing integers are laid out in big
-   endian order (aka most significant byte first, or network byte
-   order).
-
-   The format of the IKE header is shown in Figure 4.
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                       IKE_SA Initiator's SPI                  !
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                       IKE_SA Responder's SPI                  !
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !  Next Payload ! MjVer ! MnVer ! Exchange Type !     Flags     !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                          Message ID                           !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                            Length                             !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                    Figure 4:  IKE Header Format
-
-   o  Initiator's SPI (8 octets) - A value chosen by the initiator to
-      identify a unique IKE security association.  This value MUST NOT
-      be zero.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 54]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   o  Responder's SPI (8 octets) - A value chosen by the responder to
-      identify a unique IKE security association.  This value MUST be
-      zero in the first message of an IKE Initial Exchange (including
-      repeats of that message including a cookie). {{ The phrase "and
-      MUST NOT be zero in any other message" was removed; Clarif-2.1 }}
-
-   o  Next Payload (1 octet) - Indicates the type of payload that
-      immediately follows the header.  The format and value of each
-      payload are defined below.
-
-   o  Major Version (4 bits) - Indicates the major version of the IKE
-      protocol in use.  Implementations based on this version of IKE
-      MUST set the Major Version to 2.  Implementations based on
-      previous versions of IKE and ISAKMP MUST set the Major Version to
-      1.  Implementations based on this version of IKE MUST reject or
-      ignore messages containing a version number greater than 2.
-
-   o  Minor Version (4 bits) - Indicates the minor version of the IKE
-      protocol in use.  Implementations based on this version of IKE
-      MUST set the Minor Version to 0.  They MUST ignore the minor
-      version number of received messages.
-
-   o  Exchange Type (1 octet) - Indicates the type of exchange being
-      used.  This constrains the payloads sent in each message and
-      orderings of messages in an exchange.
-
-      Exchange Type             Value
-      ----------------------------------
-      RESERVED                  0-33
-      IKE_SA_INIT               34
-      IKE_AUTH                  35
-      CREATE_CHILD_SA           36
-      INFORMATIONAL             37
-      RESERVED TO IANA          38-239
-      Reserved for private use  240-255
-
-   o  Flags (1 octet) - Indicates specific options that are set for the
-      message.  Presence of options are indicated by the appropriate bit
-      in the flags field being set.  The bits are defined LSB first, so
-      bit 0 would be the least significant bit of the Flags octet.  In
-      the description below, a bit being 'set' means its value is '1',
-      while 'cleared' means its value is '0'.
-
-      *  X(reserved) (bits 0-2) - These bits MUST be cleared when
-         sending and MUST be ignored on receipt.
-
-      *  I(nitiator) (bit 3 of Flags) - This bit MUST be set in messages
-         sent by the original initiator of the IKE_SA and MUST be
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 55]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-         cleared in messages sent by the original responder.  It is used
-         by the recipient to determine which eight octets of the SPI
-         were generated by the recipient.
-
-      *  V(ersion) (bit 4 of Flags) - This bit indicates that the
-         transmitter is capable of speaking a higher major version
-         number of the protocol than the one indicated in the major
-         version number field.  Implementations of IKEv2 must clear this
-         bit when sending and MUST ignore it in incoming messages.
-
-      *  R(esponse) (bit 5 of Flags) - This bit indicates that this
-         message is a response to a message containing the same message
-         ID.  This bit MUST be cleared in all request messages and MUST
-         be set in all responses.  An IKE endpoint MUST NOT generate a
-         response to a message that is marked as being a response.
-
-      *  X(reserved) (bits 6-7 of Flags) - These bits MUST be cleared
-         when sending and MUST be ignored on receipt.
-
-   o  Message ID (4 octets) - Message identifier used to control
-      retransmission of lost packets and matching of requests and
-      responses.  It is essential to the security of the protocol
-      because it is used to prevent message replay attacks.  See
-      Section 2.1 and Section 2.2.
-
-   o  Length (4 octets) - Length of total message (header + payloads) in
-      octets.
-
-3.2.  Generic Payload Header
-
-   Each IKE payload defined in Section 3.3 through Section 3.16 begins
-   with a generic payload header, shown in Figure 5.  Figures for each
-   payload below will include the generic payload header, but for
-   brevity the description of each field will be omitted.
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C!  RESERVED   !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                      Figure 5:  Generic Payload Header
-
-   The Generic Payload Header fields are defined as follows:
-
-   o  Next Payload (1 octet) - Identifier for the payload type of the
-      next payload in the message.  If the current payload is the last
-      in the message, then this field will be 0.  This field provides a
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 56]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-      "chaining" capability whereby additional payloads can be added to
-      a message by appending it to the end of the message and setting
-      the "Next Payload" field of the preceding payload to indicate the
-      new payload's type.  An Encrypted payload, which must always be
-      the last payload of a message, is an exception.  It contains data
-      structures in the format of additional payloads.  In the header of
-      an Encrypted payload, the Next Payload field is set to the payload
-      type of the first contained payload (instead of 0).  The payload
-      type values are:
-
-      Next Payload Type                Notation  Value
-      --------------------------------------------------
-      No Next Payload                             0
-      RESERVED                                    1-32
-      Security Association             SA         33
-      Key Exchange                     KE         34
-      Identification - Initiator       IDi        35
-      Identification - Responder       IDr        36
-      Certificate                      CERT       37
-      Certificate Request              CERTREQ    38
-      Authentication                   AUTH       39
-      Nonce                            Ni, Nr     40
-      Notify                           N          41
-      Delete                           D          42
-      Vendor ID                        V          43
-      Traffic Selector - Initiator     TSi        44
-      Traffic Selector - Responder     TSr        45
-      Encrypted                        E          46
-      Configuration                    CP         47
-      Extensible Authentication        EAP        48
-      RESERVED TO IANA                            49-127
-      PRIVATE USE                                 128-255
-
-      (Payload type values 1-32 should not be assigned in the
-      future so that there is no overlap with the code assignments
-      for IKEv1.)
-
-   o  Critical (1 bit) - MUST be set to zero if the sender wants the
-      recipient to skip this payload if it does not understand the
-      payload type code in the Next Payload field of the previous
-      payload.  MUST be set to one if the sender wants the recipient to
-      reject this entire message if it does not understand the payload
-      type.  MUST be ignored by the recipient if the recipient
-      understands the payload type code.  MUST be set to zero for
-      payload types defined in this document.  Note that the critical
-      bit applies to the current payload rather than the "next" payload
-      whose type code appears in the first octet.  The reasoning behind
-      not setting the critical bit for payloads defined in this document
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 57]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-      is that all implementations MUST understand all payload types
-      defined in this document and therefore must ignore the Critical
-      bit's value.  Skipped payloads are expected to have valid Next
-      Payload and Payload Length fields.
-
-   o  RESERVED (7 bits) - MUST be sent as zero; MUST be ignored on
-      receipt.
-
-   o  Payload Length (2 octets) - Length in octets of the current
-      payload, including the generic payload header.
-
-3.3.  Security Association Payload
-
-   The Security Association Payload, denoted SA in this memo, is used to
-   negotiate attributes of a security association.  Assembly of Security
-   Association Payloads requires great peace of mind.  An SA payload MAY
-   contain multiple proposals.  If there is more than one, they MUST be
-   ordered from most preferred to least preferred.  Each proposal may
-   contain multiple IPsec protocols (where a protocol is IKE, ESP, or
-   AH), each protocol MAY contain multiple transforms, and each
-   transform MAY contain multiple attributes.  When parsing an SA, an
-   implementation MUST check that the total Payload Length is consistent
-   with the payload's internal lengths and counts.  Proposals,
-   Transforms, and Attributes each have their own variable length
-   encodings.  They are nested such that the Payload Length of an SA
-   includes the combined contents of the SA, Proposal, Transform, and
-   Attribute information.  The length of a Proposal includes the lengths
-   of all Transforms and Attributes it contains.  The length of a
-   Transform includes the lengths of all Attributes it contains.
-
-   The syntax of Security Associations, Proposals, Transforms, and
-   Attributes is based on ISAKMP; however the semantics are somewhat
-   different.  The reason for the complexity and the hierarchy is to
-   allow for multiple possible combinations of algorithms to be encoded
-   in a single SA.  Sometimes there is a choice of multiple algorithms,
-   whereas other times there is a combination of algorithms.  For
-   example, an initiator might want to propose using (AH w/MD5 and ESP
-   w/3DES) OR (ESP w/MD5 and 3DES).
-
-   One of the reasons the semantics of the SA payload has changed from
-   ISAKMP and IKEv1 is to make the encodings more compact in common
-   cases.
-
-   The Proposal structure contains within it a Proposal # and an IPsec
-   protocol ID.  Each structure MUST have the same Proposal # as the
-   previous one or be one (1) greater.  The first Proposal MUST have a
-   Proposal # of one (1).  If two successive structures have the same
-   Proposal number, it means that the proposal consists of the first
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 58]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   structure AND the second.  So a proposal of AH AND ESP would have two
-   proposal structures, one for AH and one for ESP and both would have
-   Proposal #1.  A proposal of AH OR ESP would have two proposal
-   structures, one for AH with Proposal #1 and one for ESP with Proposal
-   #2.
-
-   Each Proposal/Protocol structure is followed by one or more transform
-   structures.  The number of different transforms is generally
-   determined by the Protocol.  AH generally has a single transform: an
-   integrity check algorithm.  ESP generally has two: an encryption
-   algorithm and an integrity check algorithm.  IKE generally has four
-   transforms: a Diffie-Hellman group, an integrity check algorithm, a
-   prf algorithm, and an encryption algorithm.  If an algorithm that
-   combines encryption and integrity protection is proposed, it MUST be
-   proposed as an encryption algorithm and an integrity protection
-   algorithm MUST NOT be proposed.  For each Protocol, the set of
-   permissible transforms is assigned transform ID numbers, which appear
-   in the header of each transform.
-
-   If there are multiple transforms with the same Transform Type, the
-   proposal is an OR of those transforms.  If there are multiple
-   Transforms with different Transform Types, the proposal is an AND of
-   the different groups.  For example, to propose ESP with (3DES or
-   IDEA) and (HMAC_MD5 or HMAC_SHA), the ESP proposal would contain two
-   Transform Type 1 candidates (one for 3DES and one for IDEA) and two
-   Transform Type 2 candidates (one for HMAC_MD5 and one for HMAC_SHA).
-   This effectively proposes four combinations of algorithms.  If the
-   initiator wanted to propose only a subset of those, for example (3DES
-   and HMAC_MD5) or (IDEA and HMAC_SHA), there is no way to encode that
-   as multiple transforms within a single Proposal.  Instead, the
-   initiator would have to construct two different Proposals, each with
-   two transforms.
-
-   A given transform MAY have one or more Attributes.  Attributes are
-   necessary when the transform can be used in more than one way, as
-   when an encryption algorithm has a variable key size.  The transform
-   would specify the algorithm and the attribute would specify the key
-   size.  Most transforms do not have attributes.  A transform MUST NOT
-   have multiple attributes of the same type.  To propose alternate
-   values for an attribute (for example, multiple key sizes for the AES
-   encryption algorithm), and implementation MUST include multiple
-   Transforms with the same Transform Type each with a single Attribute.
-
-   Note that the semantics of Transforms and Attributes are quite
-   different from those in IKEv1.  In IKEv1, a single Transform carried
-   multiple algorithms for a protocol with one carried in the Transform
-   and the others carried in the Attributes.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 59]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C!  RESERVED   !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                          <Proposals>                          ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-            Figure 6:  Security Association Payload
-
-   o  Proposals (variable) - One or more proposal substructures.
-
-   The payload type for the Security Association Payload is thirty three
-   (33).
-
-3.3.1.  Proposal Substructure
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! 0 (last) or 2 !   RESERVED    !         Proposal Length       !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Proposal #    !  Protocol ID  !    SPI Size   !# of Transforms!
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ~                        SPI (variable)                         ~
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                        <Transforms>                           ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-            Figure 7:  Proposal Substructure
-
-   o  0 (last) or 2 (more) (1 octet) - Specifies whether this is the
-      last Proposal Substructure in the SA.  This syntax is inherited
-      from ISAKMP, but is unnecessary because the last Proposal could be
-      identified from the length of the SA.  The value (2) corresponds
-      to a Payload Type of Proposal in IKEv1, and the first four octets
-      of the Proposal structure are designed to look somewhat like the
-      header of a Payload.
-
-   o  RESERVED (1 octet) - MUST be sent as zero; MUST be ignored on
-      receipt.
-
-   o  Proposal Length (2 octets) - Length of this proposal, including
-      all transforms and attributes that follow.
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 60]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   o  Proposal # (1 octet) - When a proposal is made, the first proposal
-      in an SA payload MUST be #1, and subsequent proposals MUST either
-      be the same as the previous proposal (indicating an AND of the two
-      proposals) or one more than the previous proposal (indicating an
-      OR of the two proposals).  When a proposal is accepted, all of the
-      proposal numbers in the SA payload MUST be the same and MUST match
-      the number on the proposal sent that was accepted.
-
-   o  Protocol ID (1 octet) - Specifies the IPsec protocol identifier
-      for the current negotiation.  The defined values are:
-
-      Protocol                Protocol ID
-      -----------------------------------
-      RESERVED                0
-      IKE                     1
-      AH                      2
-      ESP                     3
-      RESERVED TO IANA        4-200
-      PRIVATE USE             201-255
-
-   o  SPI Size (1 octet) - For an initial IKE_SA negotiation, this field
-      MUST be zero; the SPI is obtained from the outer header.  During
-      subsequent negotiations, it is equal to the size, in octets, of
-      the SPI of the corresponding protocol (8 for IKE, 4 for ESP and
-      AH).
-
-   o  # of Transforms (1 octet) - Specifies the number of transforms in
-      this proposal.
-
-   o  SPI (variable) - The sending entity's SPI.  Even if the SPI Size
-      is not a multiple of 4 octets, there is no padding applied to the
-      payload.  When the SPI Size field is zero, this field is not
-      present in the Security Association payload.
-
-   o  Transforms (variable) - One or more transform substructures.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 61]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-3.3.2.  Transform Substructure
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! 0 (last) or 3 !   RESERVED    !        Transform Length       !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !Transform Type !   RESERVED    !          Transform ID         !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                      Transform Attributes                     ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-            Figure 8:  Transform Substructure
-
-   o  0 (last) or 3 (more) (1 octet) - Specifies whether this is the
-      last Transform Substructure in the Proposal.  This syntax is
-      inherited from ISAKMP, but is unnecessary because the last
-      Proposal could be identified from the length of the SA.  The value
-      (3) corresponds to a Payload Type of Transform in IKEv1, and the
-      first four octets of the Transform structure are designed to look
-      somewhat like the header of a Payload.
-
-   o  RESERVED - MUST be sent as zero; MUST be ignored on receipt.
-
-   o  Transform Length - The length (in octets) of the Transform
-      Substructure including Header and Attributes.
-
-   o  Transform Type (1 octet) - The type of transform being specified
-      in this transform.  Different protocols support different
-      transform types.  For some protocols, some of the transforms may
-      be optional.  If a transform is optional and the initiator wishes
-      to propose that the transform be omitted, no transform of the
-      given type is included in the proposal.  If the initiator wishes
-      to make use of the transform optional to the responder, it
-      includes a transform substructure with transform ID = 0 as one of
-      the options.
-
-   o  Transform ID (2 octets) - The specific instance of the transform
-      type being proposed.
-
-   The tranform type values are:
-
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 62]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   Description                     Trans.  Used In
-                                   Type
-   ------------------------------------------------------------------
-   RESERVED                        0
-   Encryption Algorithm (ENCR)     1       IKE and ESP
-   Pseudo-random Function (PRF)    2       IKE
-   Integrity Algorithm (INTEG)     3       IKE, AH, optional in ESP
-   Diffie-Hellman Group (D-H)      4       IKE, optional in AH & ESP
-   Extended Sequence Numbers (ESN) 5       AH and ESP
-   RESERVED TO IANA                6-240
-   PRIVATE USE                     241-255
-
-   For Transform Type 1 (Encryption Algorithm), defined Transform IDs
-   are:
-
-   Name                 Number      Defined In
-   ---------------------------------------------------
-   RESERVED             0
-   ENCR_DES_IV64        1           (RFC1827)
-   ENCR_DES             2           (RFC2405), [DES]
-   ENCR_3DES            3           (RFC2451)
-   ENCR_RC5             4           (RFC2451)
-   ENCR_IDEA            5           (RFC2451), [IDEA]
-   ENCR_CAST            6           (RFC2451)
-   ENCR_BLOWFISH        7           (RFC2451)
-   ENCR_3IDEA           8           (RFC2451)
-   ENCR_DES_IV32        9
-   RESERVED             10
-   ENCR_NULL            11          (RFC2410)
-   ENCR_AES_CBC         12          (RFC3602)
-   ENCR_AES_CTR         13          (RFC3664)
-   RESERVED TO IANA     14-1023
-   PRIVATE USE          1024-65535
-
-   For Transform Type 2 (Pseudo-random Function), defined Transform IDs
-   are:
-
-   Name                        Number    Defined In
-   ------------------------------------------------------
-   RESERVED                    0
-   PRF_HMAC_MD5                1         (RFC2104), [MD5]
-   PRF_HMAC_SHA1               2         (RFC2104), [SHA]
-   PRF_HMAC_TIGER              3         (RFC2104)
-   PRF_AES128_XCBC             4         (RFC3664)
-   RESERVED TO IANA            5-1023
-   PRIVATE USE                 1024-65535
-
-   For Transform Type 3 (Integrity Algorithm), defined Transform IDs
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 63]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   are:
-
-   Name                 Number   Defined In
-   ----------------------------------------
-   NONE                 0
-   AUTH_HMAC_MD5_96     1        (RFC2403)
-   AUTH_HMAC_SHA1_96    2        (RFC2404)
-   AUTH_DES_MAC         3
-   AUTH_KPDK_MD5        4        (RFC1826)
-   AUTH_AES_XCBC_96     5        (RFC3566)
-   RESERVED TO IANA     6-1023
-   PRIVATE USE          1024-65535
-
-   For Transform Type 4 (Diffie-Hellman Group), defined Transform IDs
-   are:
-
-   Name                       Number
-   --------------------------------------
-   NONE                       0
-   Defined in Appendix B      1 - 2
-   RESERVED                   3 - 4
-   Defined in [ADDGROUP]      5
-   RESERVED TO IANA           6 - 13
-   Defined in [ADDGROUP]      14 - 18
-   RESERVED TO IANA           19 - 1023
-   PRIVATE USE                1024-65535
-
-   For Transform Type 5 (Extended Sequence Numbers), defined Transform
-   IDs are:
-
-   Name                               Number
-   --------------------------------------------
-   No Extended Sequence Numbers       0
-   Extended Sequence Numbers          1
-   RESERVED                           2 - 65535
-
-3.3.3.  Valid Transform Types by Protocol
-
-   The number and type of transforms that accompany an SA payload are
-   dependent on the protocol in the SA itself.  An SA payload proposing
-   the establishment of an SA has the following mandatory and optional
-   transform types.  A compliant implementation MUST understand all
-   mandatory and optional types for each protocol it supports (though it
-   need not accept proposals with unacceptable suites).  A proposal MAY
-   omit the optional types if the only value for them it will accept is
-   NONE.
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 64]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   Protocol    Mandatory Types          Optional Types
-   ---------------------------------------------------
-   IKE         ENCR, PRF, INTEG, D-H
-   ESP         ENCR, ESN                INTEG, D-H
-   AH          INTEG, ESN               D-H
-
-3.3.4.  Mandatory Transform IDs
-
-   The specification of suites that MUST and SHOULD be supported for
-   interoperability has been removed from this document because they are
-   likely to change more rapidly than this document evolves.
-
-   An important lesson learned from IKEv1 is that no system should only
-   implement the mandatory algorithms and expect them to be the best
-   choice for all customers.  For example, at the time that this
-   document was written, many IKEv1 implementers were starting to
-   migrate to AES in Cipher Block Chaining (CBC) mode for Virtual
-   Private Network (VPN) applications.  Many IPsec systems based on
-   IKEv2 will implement AES, additional Diffie-Hellman groups, and
-   additional hash algorithms, and some IPsec customers already require
-   these algorithms in addition to the ones listed above.
-
-   It is likely that IANA will add additional transforms in the future,
-   and some users may want to use private suites, especially for IKE
-   where implementations should be capable of supporting different
-   parameters, up to certain size limits.  In support of this goal, all
-   implementations of IKEv2 SHOULD include a management facility that
-   allows specification (by a user or system administrator) of Diffie-
-   Hellman (DH) parameters (the generator, modulus, and exponent lengths
-   and values) for new DH groups.  Implementations SHOULD provide a
-   management interface through which these parameters and the
-   associated transform IDs may be entered (by a user or system
-   administrator), to enable negotiating such groups.
-
-   All implementations of IKEv2 MUST include a management facility that
-   enables a user or system administrator to specify the suites that are
-   acceptable for use with IKE.  Upon receipt of a payload with a set of
-   transform IDs, the implementation MUST compare the transmitted
-   transform IDs against those locally configured via the management
-   controls, to verify that the proposed suite is acceptable based on
-   local policy.  The implementation MUST reject SA proposals that are
-   not authorized by these IKE suite controls.  Note that cryptographic
-   suites that MUST be implemented need not be configured as acceptable
-   to local policy.
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 65]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-3.3.5.  Transform Attributes
-
-   Each transform in a Security Association payload may include
-   attributes that modify or complete the specification of the
-   transform.  These attributes are type/value pairs and are defined
-   below.  For example, if an encryption algorithm has a variable-length
-   key, the key length to be used may be specified as an attribute.
-   Attributes can have a value with a fixed two octet length or a
-   variable-length value.  For the latter, the attribute is encoded as
-   type/length/value.
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !A!       Attribute Type        !    AF=0  Attribute Length     !
-   !F!                             !    AF=1  Attribute Value      !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                   AF=0  Attribute Value                       !
-   !                   AF=1  Not Transmitted                       !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                   Figure 9:  Data Attributes
-
-   o  Attribute Type (2 octets) - Unique identifier for each type of
-      attribute (see below).  The most significant bit of this field is
-      the Attribute Format bit (AF).  It indicates whether the data
-      attributes follow the Type/Length/Value (TLV) format or a
-      shortened Type/Value (TV) format.  If the AF bit is zero (0), then
-      the Data Attributes are of the Type/Length/Value (TLV) form.  If
-      the AF bit is a one (1), then the Data Attributes are of the Type/
-      Value form.
-
-   o  Attribute Length (2 octets) - Length in octets of the Attribute
-      Value.  When the AF bit is a one (1), the Attribute Value is only
-      2 octets and the Attribute Length field is not present.
-
-   o  Attribute Value (variable length) - Value of the Attribute
-      associated with the Attribute Type.  If the AF bit is a zero (0),
-      this field has a variable length defined by the Attribute Length
-      field.  If the AF bit is a one (1), the Attribute Value has a
-      length of 2 octets.
-
-   o  Key Length - When using an Encryption Algorithm that has a
-      variable-length key, this attribute specifies the key length in
-      bits (MUST use network byte order).  This attribute MUST NOT be
-      used when the specified Encryption Algorithm uses a fixed-length
-      key.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 66]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   Note that only a single attribute type (Key Length) is defined, and
-   it is fixed length.  The variable-length encoding specification is
-   included only for future extensions. {{ Clarif-7.11 removed the
-   sentence that listed, incorrectly, the algorithms defined in the
-   document that accept attributes. }}
-
-   Attributes described as basic MUST NOT be encoded using the variable-
-   length encoding.  Variable-length attributes MUST NOT be encoded as
-   basic even if their value can fit into two octets.  NOTE: This is a
-   change from IKEv1, where increased flexibility may have simplified
-   the composer of messages but certainly complicated the parser.
-
-   Attribute Type         Value         Attribute Format
-   ------------------------------------------------------------
-   RESERVED               0-13
-   Key Length (in bits)   14            TV
-   RESERVED               15-17
-   RESERVED TO IANA       18-16383
-   PRIVATE USE            16384-32767
-   Values 0-13 and 15-17 were used in a similar context in
-   IKEv1, and should not be assigned except to matching values.
-
-3.3.6.  Attribute Negotiation
-
-   During security association negotiation initiators present offers to
-   responders.  Responders MUST select a single complete set of
-   parameters from the offers (or reject all offers if none are
-   acceptable).  If there are multiple proposals, the responder MUST
-   choose a single proposal number and return all of the Proposal
-   substructures with that Proposal number.  If there are multiple
-   Transforms with the same type, the responder MUST choose a single
-   one.  Any attributes of a selected transform MUST be returned
-   unmodified.  The initiator of an exchange MUST check that the
-   accepted offer is consistent with one of its proposals, and if not
-   that response MUST be rejected.
-
-   Negotiating Diffie-Hellman groups presents some special challenges.
-   SA offers include proposed attributes and a Diffie-Hellman public
-   number (KE) in the same message.  If in the initial exchange the
-   initiator offers to use one of several Diffie-Hellman groups, it
-   SHOULD pick the one the responder is most likely to accept and
-   include a KE corresponding to that group.  If the guess turns out to
-   be wrong, the responder will indicate the correct group in the
-   response and the initiator SHOULD pick an element of that group for
-   its KE value when retrying the first message.  It SHOULD, however,
-   continue to propose its full supported set of groups in order to
-   prevent a man-in-the-middle downgrade attack.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 67]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   Implementation Note:
-
-   Certain negotiable attributes can have ranges or could have multiple
-   acceptable values.  These include the key length of a variable key
-   length symmetric cipher.  To further interoperability and to support
-   upgrading endpoints independently, implementers of this protocol
-   SHOULD accept values that they deem to supply greater security.  For
-   instance, if a peer is configured to accept a variable-length cipher
-   with a key length of X bits and is offered that cipher with a larger
-   key length, the implementation SHOULD accept the offer if it supports
-   use of the longer key.
-
-   Support of this capability allows an implementation to express a
-   concept of "at least" a certain level of security-- "a key length of
-   _at least_ X bits for cipher Y".
-
-3.4.  Key Exchange Payload
-
-   The Key Exchange Payload, denoted KE in this memo, is used to
-   exchange Diffie-Hellman public numbers as part of a Diffie-Hellman
-   key exchange.  The Key Exchange Payload consists of the IKE generic
-   payload header followed by the Diffie-Hellman public value itself.
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C!  RESERVED   !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !          DH Group #           !           RESERVED            !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                       Key Exchange Data                       ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-             Figure 10:  Key Exchange Payload Format
-
-   A key exchange payload is constructed by copying one's Diffie-Hellman
-   public value into the "Key Exchange Data" portion of the payload.
-   The length of the Diffie-Hellman public value MUST be equal to the
-   length of the prime modulus over which the exponentiation was
-   performed, prepending zero bits to the value if necessary.
-
-   The DH Group # identifies the Diffie-Hellman group in which the Key
-   Exchange Data was computed (see Section 3.3.2).  If the selected
-   proposal uses a different Diffie-Hellman group, the message MUST be
-   rejected with a Notify payload of type INVALID_KE_PAYLOAD.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 68]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   The payload type for the Key Exchange payload is thirty four (34).
-
-3.5.  Identification Payloads
-
-   The Identification Payloads, denoted IDi and IDr in this memo, allow
-   peers to assert an identity to one another.  This identity may be
-   used for policy lookup, but does not necessarily have to match
-   anything in the CERT payload; both fields may be used by an
-   implementation to perform access control decisions. {{ Clarif-7.1 }}
-   When using the ID_IPV4_ADDR/ID_IPV6_ADDR identity types in IDi/IDr
-   payloads, IKEv2 does not require this address to match the address in
-   the IP header of IKEv2 packets, or anything in the TSi/TSr payloads.
-   The contents of IDi/IDr is used purely to fetch the policy and
-   authentication data related to the other party.
-
-   NOTE: In IKEv1, two ID payloads were used in each direction to hold
-   Traffic Selector (TS) information for data passing over the SA.  In
-   IKEv2, this information is carried in TS payloads (see Section 3.13).
-
-   The Identification Payload consists of the IKE generic payload header
-   followed by identification fields as follows:
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C!  RESERVED   !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !   ID Type     !                 RESERVED                      |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                   Identification Data                         ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-            Figure 11:  Identification Payload Format
-
-   o  ID Type (1 octet) - Specifies the type of Identification being
-      used.
-
-   o  RESERVED - MUST be sent as zero; MUST be ignored on receipt.
-
-   o  Identification Data (variable length) - Value, as indicated by the
-      Identification Type.  The length of the Identification Data is
-      computed from the size in the ID payload header.
-
-   The payload types for the Identification Payload are thirty five (35)
-   for IDi and thirty six (36) for IDr.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 69]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   The following table lists the assigned values for the Identification
-   Type field:
-
-   ID Type                           Value
-   -------------------------------------------------------------------
-   RESERVED                            0
-
-   ID_IPV4_ADDR                        1
-       A single four (4) octet IPv4 address.
-
-   ID_FQDN                             2
-       A fully-qualified domain name string.  An example of a ID_FQDN
-       is, "example.com".  The string MUST not contain any terminators
-       (e.g., NULL, CR, etc.).
-
-   ID_RFC822_ADDR                      3
-       A fully-qualified RFC822 email address string, An example of a
-       ID_RFC822_ADDR is, "jsmith@example.com".  The string MUST not
-       contain any terminators.
-
-   RESERVED TO IANA                    4
-
-   ID_IPV6_ADDR                        5
-       A single sixteen (16) octet IPv6 address.
-
-   RESERVED TO IANA                    6 - 8
-
-   ID_DER_ASN1_DN                      9
-       The binary Distinguished Encoding Rules (DER) encoding of an
-       ASN.1 X.500 Distinguished Name [X.501].
-
-   ID_DER_ASN1_GN                      10
-       The binary DER encoding of an ASN.1 X.500 GeneralName [X.509].
-
-   ID_KEY_ID                           11
-       An opaque octet stream which may be used to pass vendor-
-       specific information necessary to do certain proprietary
-       types of identification.
-
-   RESERVED TO IANA                    12-200
-
-   PRIVATE USE                         201-255
-
-   Two implementations will interoperate only if each can generate a
-   type of ID acceptable to the other.  To assure maximum
-   interoperability, implementations MUST be configurable to send at
-   least one of ID_IPV4_ADDR, ID_FQDN, ID_RFC822_ADDR, or ID_KEY_ID, and
-   MUST be configurable to accept all of these types.  Implementations
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 70]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   SHOULD be capable of generating and accepting all of these types.
-   IPv6-capable implementations MUST additionally be configurable to
-   accept ID_IPV6_ADDR.  IPv6-only implementations MAY be configurable
-   to send only ID_IPV6_ADDR.
-
-   {{ Clarif-3.4 }} EAP [EAP] does not mandate the use of any particular
-   type of identifier, but often EAP is used with Network Access
-   Identifiers (NAIs) defined in [NAI].  Although NAIs look a bit like
-   email addresses (e.g., "joe@example.com"), the syntax is not exactly
-   the same as the syntax of email address in [MAILFORMAT].  For those
-   NAIs that include the realm component, the ID_RFC822_ADDR
-   identification type SHOULD be used.  Responder implementations should
-   not attempt to verify that the contents actually conform to the exact
-   syntax given in [MAILFORMAT], but instead should accept any
-   reasonable-looking NAI.  For NAIs that do not include the realm
-   component,the ID_KEY_ID identification type SHOULD be used.
-
-3.6.  Certificate Payload
-
-   The Certificate Payload, denoted CERT in this memo, provides a means
-   to transport certificates or other authentication-related information
-   via IKE.  Certificate payloads SHOULD be included in an exchange if
-   certificates are available to the sender unless the peer has
-   indicated an ability to retrieve this information from elsewhere
-   using an HTTP_CERT_LOOKUP_SUPPORTED Notify payload.  Note that the
-   term "Certificate Payload" is somewhat misleading, because not all
-   authentication mechanisms use certificates and data other than
-   certificates may be passed in this payload.
-
-   The Certificate Payload is defined as follows:
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C!  RESERVED   !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Cert Encoding !                                               !
-   +-+-+-+-+-+-+-+-+                                               !
-   ~                       Certificate Data                        ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-             Figure 12:  Certificate Payload Format
-
-   o  Certificate Encoding (1 octet) - This field indicates the type of
-      certificate or certificate-related information contained in the
-      Certificate Data field.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 71]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-      Certificate Encoding                 Value
-      -------------------------------------------------
-      RESERVED                             0
-      PKCS #7 wrapped X.509 certificate    1
-      PGP Certificate                      2
-      DNS Signed Key                       3
-      X.509 Certificate - Signature        4
-      Kerberos Token                       6
-      Certificate Revocation List (CRL)    7
-      Authority Revocation List (ARL)      8
-      SPKI Certificate                     9
-      X.509 Certificate - Attribute        10
-      Raw RSA Key                          11
-      Hash and URL of X.509 certificate    12
-      Hash and URL of X.509 bundle         13
-      RESERVED to IANA                     14 - 200
-      PRIVATE USE                          201 - 255
-
-   o  Certificate Data (variable length) - Actual encoding of
-      certificate data.  The type of certificate is indicated by the
-      Certificate Encoding field.
-
-   The payload type for the Certificate Payload is thirty seven (37).
-
-   Specific syntax is for some of the certificate type codes above is
-   not defined in this document.  The types whose syntax is defined in
-   this document are:
-
-   o  X.509 Certificate - Signature (4) contains a DER encoded X.509
-      certificate whose public key is used to validate the sender's AUTH
-      payload.
-
-   o  Certificate Revocation List (7) contains a DER encoded X.509
-      certificate revocation list.
-
-   o  {{ Added "DER-encoded RSAPublicKey structure" from Clarif-3.6 }}
-      Raw RSA Key (11) contains a PKCS #1 encoded RSA key, that is, a
-      DER-encoded RSAPublicKey structure (see [RSA] and [PKCS1]).
-
-   o  Hash and URL encodings (12-13) allow IKE messages to remain short
-      by replacing long data structures with a 20 octet SHA-1 hash (see
-      [SHA]) of the replaced value followed by a variable-length URL
-      that resolves to the DER encoded data structure itself.  This
-      improves efficiency when the endpoints have certificate data
-      cached and makes IKE less subject to denial of service attacks
-      that become easier to mount when IKE messages are large enough to
-      require IP fragmentation [DOSUDPPROT].
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 72]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   Use the following ASN.1 definition for an X.509 bundle:
-
-   CertBundle
-     { iso(1) identified-organization(3) dod(6) internet(1)
-       security(5) mechanisms(5) pkix(7) id-mod(0)
-       id-mod-cert-bundle(34) }
-
-   DEFINITIONS EXPLICIT TAGS ::=
-   BEGIN
-
-   IMPORTS
-     Certificate, CertificateList
-     FROM PKIX1Explicit88
-        { iso(1) identified-organization(3) dod(6)
-          internet(1) security(5) mechanisms(5) pkix(7)
-          id-mod(0) id-pkix1-explicit(18) } ;
-
-   CertificateOrCRL ::= CHOICE {
-     cert [0] Certificate,
-     crl  [1] CertificateList }
-
-   CertificateBundle ::= SEQUENCE OF CertificateOrCRL
-
-   END
-
-   Implementations MUST be capable of being configured to send and
-   accept up to four X.509 certificates in support of authentication,
-   and also MUST be capable of being configured to send and accept the
-   first two Hash and URL formats (with HTTP URLs).  Implementations
-   SHOULD be capable of being configured to send and accept Raw RSA
-   keys.  If multiple certificates are sent, the first certificate MUST
-   contain the public key used to sign the AUTH payload.  The other
-   certificates may be sent in any order.
-
-   {{ Clarif-3.6 }} Because the contents and use of some of the
-   certificate types are not defined, they SHOULD NOT be used.  In
-   specific, implementations SHOULD NOT use the following types unless
-   they are later defined in a standards-track document:
-
-   PKCS #7 wrapped X.509 certificate    1
-   PGP Certificate                      2
-   DNS Signed Key                       3
-   Kerberos Token                       6
-   SPKI Certificate                     9
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 73]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-3.7.  Certificate Request Payload
-
-   The Certificate Request Payload, denoted CERTREQ in this memo,
-   provides a means to request preferred certificates via IKE and can
-   appear in the IKE_INIT_SA response and/or the IKE_AUTH request.
-   Certificate Request payloads MAY be included in an exchange when the
-   sender needs to get the certificate of the receiver.  If multiple CAs
-   are trusted and the cert encoding does not allow a list, then
-   multiple Certificate Request payloads SHOULD be transmitted.
-
-   The Certificate Request Payload is defined as follows:
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C!  RESERVED   !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Cert Encoding !                                               !
-   +-+-+-+-+-+-+-+-+                                               !
-   ~                    Certification Authority                    ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-         Figure 13:  Certificate Request Payload Format
-
-   o  Certificate Encoding (1 octet) - Contains an encoding of the type
-      or format of certificate requested.  Values are listed in
-      Section 3.6.
-
-   o  Certification Authority (variable length) - Contains an encoding
-      of an acceptable certification authority for the type of
-      certificate requested.
-
-   The payload type for the Certificate Request Payload is thirty eight
-   (38).
-
-   The Certificate Encoding field has the same values as those defined
-   in Section 3.6.  The Certification Authority field contains an
-   indicator of trusted authorities for this certificate type.  The
-   Certification Authority value is a concatenated list of SHA-1 hashes
-   of the public keys of trusted Certification Authorities (CAs).  Each
-   is encoded as the SHA-1 hash of the Subject Public Key Info element
-   (see section 4.1.2.7 of [PKIX]) from each Trust Anchor certificate.
-   The twenty-octet hashes are concatenated and included with no other
-   formatting.
-
-   {{ Clarif-3.6 }} The contents of the "Certification Authority" field
-   are defined only for X.509 certificates, which are types 4, 10, 12,
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 74]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   and 13.  Other values SHOULD NOT be used until standards-track
-   specifications that specify their use are published.
-
-   Note that the term "Certificate Request" is somewhat misleading, in
-   that values other than certificates are defined in a "Certificate"
-   payload and requests for those values can be present in a Certificate
-   Request Payload.  The syntax of the Certificate Request payload in
-   such cases is not defined in this document.
-
-   The Certificate Request Payload is processed by inspecting the "Cert
-   Encoding" field to determine whether the processor has any
-   certificates of this type.  If so, the "Certification Authority"
-   field is inspected to determine if the processor has any certificates
-   that can be validated up to one of the specified certification
-   authorities.  This can be a chain of certificates.
-
-   If an end-entity certificate exists that satisfies the criteria
-   specified in the CERTREQ, a certificate or certificate chain SHOULD
-   be sent back to the certificate requestor if the recipient of the
-   CERTREQ:
-
-   o  is configured to use certificate authentication,
-
-   o  is allowed to send a CERT payload,
-
-   o  has matching CA trust policy governing the current negotiation,
-      and
-
-   o  has at least one time-wise and usage appropriate end-entity
-      certificate chaining to a CA provided in the CERTREQ.
-
-   Certificate revocation checking must be considered during the
-   chaining process used to select a certificate.  Note that even if two
-   peers are configured to use two different CAs, cross-certification
-   relationships should be supported by appropriate selection logic.
-
-   The intent is not to prevent communication through the strict
-   adherence of selection of a certificate based on CERTREQ, when an
-   alternate certificate could be selected by the sender that would
-   still enable the recipient to successfully validate and trust it
-   through trust conveyed by cross-certification, CRLs, or other out-of-
-   band configured means.  Thus, the processing of a CERTREQ should be
-   seen as a suggestion for a certificate to select, not a mandated one.
-   If no certificates exist, then the CERTREQ is ignored.  This is not
-   an error condition of the protocol.  There may be cases where there
-   is a preferred CA sent in the CERTREQ, but an alternate might be
-   acceptable (perhaps after prompting a human operator).
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 75]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-3.8.  Authentication Payload
-
-   The Authentication Payload, denoted AUTH in this memo, contains data
-   used for authentication purposes.  The syntax of the Authentication
-   data varies according to the Auth Method as specified below.
-
-   The Authentication Payload is defined as follows:
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C!  RESERVED   !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Auth Method   !                RESERVED                       !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                      Authentication Data                      ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-              Figure 14:  Authentication Payload Format
-
-   o  Auth Method (1 octet) - Specifies the method of authentication
-      used.  Values defined are:
-
-      *  RSA Digital Signature (1) - Computed as specified in
-         Section 2.15 using an RSA private key over a PKCS#1 padded hash
-         (see [RSA] and [PKCS1]). {{ Clarif-3.2 }} To promote
-         interoperability, implementations that support this type SHOULD
-         support signatures that use SHA-1 as the hash function and
-         SHOULD use SHA-1 as the default hash function when generating
-         signatures. {{ Clarif-3.3 }} A newer version of PKCS#1 (v2.1)
-         defines two different encoding methods (ways of "padding the
-         hash") for signatures.  However, IKEv2 and this document point
-         specifically to the PKCS#1 v2.0 which has only one encoding
-         method for signatures (EMSA-PKCS1- v1_5).
-
-      *  Shared Key Message Integrity Code (2) - Computed as specified
-         in Section 2.15 using the shared key associated with the
-         identity in the ID payload and the negotiated prf function
-
-      *  DSS Digital Signature (3) - Computed as specified in
-         Section 2.15 using a DSS private key (see [DSS]) over a SHA-1
-         hash.
-
-      *  The values 0 and 4-200 are reserved to IANA.  The values 201-
-         255 are available for private use.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 76]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   o  Authentication Data (variable length) - see Section 2.15.
-
-   The payload type for the Authentication Payload is thirty nine (39).
-
-3.9.  Nonce Payload
-
-   The Nonce Payload, denoted Ni and Nr in this memo for the initiator's
-   and responder's nonce respectively, contains random data used to
-   guarantee liveness during an exchange and protect against replay
-   attacks.
-
-   The Nonce Payload is defined as follows:
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C!  RESERVED   !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                            Nonce Data                         ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                Figure 15:  Nonce Payload Format
-
-   o  Nonce Data (variable length) - Contains the random data generated
-      by the transmitting entity.
-
-   The payload type for the Nonce Payload is forty (40).
-
-   The size of a Nonce MUST be between 16 and 256 octets inclusive.
-   Nonce values MUST NOT be reused.
-
-3.10.  Notify Payload
-
-   The Notify Payload, denoted N in this document, is used to transmit
-   informational data, such as error conditions and state transitions,
-   to an IKE peer.  A Notify Payload may appear in a response message
-   (usually specifying why a request was rejected), in an INFORMATIONAL
-   Exchange (to report an error not in an IKE request), or in any other
-   message to indicate sender capabilities or to modify the meaning of
-   the request.
-
-   The Notify Payload is defined as follows:
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 77]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C!  RESERVED   !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !  Protocol ID  !   SPI Size    !      Notify Message Type      !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                Security Parameter Index (SPI)                 ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                       Notification Data                       ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-            Figure 16:  Notify Payload Format
-
-   o  Protocol ID (1 octet) - If this notification concerns an existing
-      SA, this field indicates the type of that SA.  For IKE_SA
-      notifications, this field MUST be one (1).  For notifications
-      concerning IPsec SAs this field MUST contain either (2) to
-      indicate AH or (3) to indicate ESP. {{ Clarif-7.8 }} For
-      notifications that do not relate to an existing SA, this field
-      MUST be sent as zero and MUST be ignored on receipt; this is
-      currently only true for the INVALID_SELECTORS and REKEY_SA
-      notifications.  All other values for this field are reserved to
-      IANA for future assignment.
-
-   o  SPI Size (1 octet) - Length in octets of the SPI as defined by the
-      IPsec protocol ID or zero if no SPI is applicable.  For a
-      notification concerning the IKE_SA, the SPI Size MUST be zero.
-
-   o  Notify Message Type (2 octets) - Specifies the type of
-      notification message.
-
-   o  SPI (variable length) - Security Parameter Index.
-
-   o  Notification Data (variable length) - Informational or error data
-      transmitted in addition to the Notify Message Type.  Values for
-      this field are type specific (see below).
-
-   The payload type for the Notify Payload is forty one (41).
-
-3.10.1.  Notify Message Types
-
-   Notification information can be error messages specifying why an SA
-   could not be established.  It can also be status data that a process
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 78]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   managing an SA database wishes to communicate with a peer process.
-   The table below lists the Notification messages and their
-   corresponding values.  The number of different error statuses was
-   greatly reduced from IKEv1 both for simplification and to avoid
-   giving configuration information to probers.
-
-   Types in the range 0 - 16383 are intended for reporting errors.  An
-   implementation receiving a Notify payload with one of these types
-   that it does not recognize in a response MUST assume that the
-   corresponding request has failed entirely. {{ Demoted the SHOULD }}
-   Unrecognized error types in a request and status types in a request
-   or response MUST be ignored, and they should be logged.
-
-   Notify payloads with status types MAY be added to any message and
-   MUST be ignored if not recognized.  They are intended to indicate
-   capabilities, and as part of SA negotiation are used to negotiate
-   non-cryptographic parameters.
-
-   NOTIFY messages: error types              Value
-   -------------------------------------------------------------------
-
-   RESERVED                                  0
-
-   UNSUPPORTED_CRITICAL_PAYLOAD              1
-       Sent if the payload has the "critical" bit set and the payload
-       type is not recognized. Notification Data contains the one-octet
-       payload type.
-
-   INVALID_IKE_SPI                           4
-       Indicates an IKE message was received with an unrecognized
-       destination SPI. This usually indicates that the recipient has
-       rebooted and forgotten the existence of an IKE_SA.
-
-   INVALID_MAJOR_VERSION                     5
-       Indicates the recipient cannot handle the version of IKE
-       specified in the header. The closest version number that the
-       recipient can support will be in the reply header.
-
-   INVALID_SYNTAX                            7
-       Indicates the IKE message that was received was invalid because
-       some type, length, or value was out of range or because the
-       request was rejected for policy reasons. To avoid a denial of
-       service attack using forged messages, this status may only be
-       returned for and in an encrypted packet if the message ID and
-       cryptographic checksum were valid. To avoid leaking information
-       to someone probing a node, this status MUST be sent in response
-       to any error not covered by one of the other status types.
-       {{ Demoted the SHOULD }} To aid debugging, more detailed error
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 79]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-       information should be written to a console or log.
-
-   INVALID_MESSAGE_ID                        9
-       Sent when an IKE message ID outside the supported window is
-       received. This Notify MUST NOT be sent in a response; the invalid
-       request MUST NOT be acknowledged. Instead, inform the other side
-       by initiating an INFORMATIONAL exchange with Notification data
-       containing the four octet invalid message ID. Sending this
-       notification is optional, and notifications of this type MUST be
-       rate limited.
-
-   INVALID_SPI                              11
-       MAY be sent in an IKE INFORMATIONAL exchange when a node receives
-       an ESP or AH packet with an invalid SPI. The Notification Data
-       contains the SPI of the invalid packet. This usually indicates a
-       node has rebooted and forgotten an SA. If this Informational
-       Message is sent outside the context of an IKE_SA, it should only
-       be used by the recipient as a "hint" that something might be
-       wrong (because it could easily be forged).
-
-   NO_PROPOSAL_CHOSEN                       14
-       None of the proposed crypto suites was acceptable.
-
-   INVALID_KE_PAYLOAD                       17
-       The D-H Group # field in the KE payload is not the group #
-       selected by the responder for this exchange. There are two octets
-       of data associated with this notification: the accepted D-H Group
-       # in big endian order.
-
-   AUTHENTICATION_FAILED                    24
-       Sent in the response to an IKE_AUTH message when for some reason
-       the authentication failed. There is no associated data.
-
-   SINGLE_PAIR_REQUIRED                     34
-       This error indicates that a CREATE_CHILD_SA request is
-       unacceptable because its sender is only willing to accept traffic
-       selectors specifying a single pair of addresses. The requestor is
-       expected to respond by requesting an SA for only the specific
-       traffic it is trying to forward.
-
-   NO_ADDITIONAL_SAS                        35
-       This error indicates that a CREATE_CHILD_SA request is
-       unacceptable because the responder is unwilling to accept any
-       more CHILD_SAs on this IKE_SA. Some minimal implementations may
-       only accept a single CHILD_SA setup in the context of an initial
-       IKE exchange and reject any subsequent attempts to add more.
-
-   INTERNAL_ADDRESS_FAILURE                 36
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 80]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-       Indicates an error assigning an internal address (i.e.,
-       INTERNAL_IP4_ADDRESS or INTERNAL_IP6_ADDRESS) during the
-       processing of a Configuration Payload by a responder.  If this
-       error is generated within an IKE_AUTH exchange, no CHILD_SA will
-       be created.
-
-   FAILED_CP_REQUIRED                       37
-       Sent by responder in the case where CP(CFG_REQUEST) was expected
-       but not received, and so is a conflict with locally configured
-       policy. There is no associated data.
-
-   TS_UNACCEPTABLE                          38
-       Indicates that none of the addresses/protocols/ports in the
-       supplied traffic selectors is acceptable.
-
-   INVALID_SELECTORS                        39
-       MAY be sent in an IKE INFORMATIONAL exchange when a node receives
-       an ESP or AH packet whose selectors do not match those of the SA
-       on which it was delivered (and that caused the packet to be
-       dropped). The Notification Data contains the start of the
-       offending packet (as in ICMP messages) and the SPI field of the
-       notification is set to match the SPI of the IPsec SA.
-
-   RESERVED TO IANA                         40-8191
-
-   PRIVATE USE                              8192-16383
-
-
-   NOTIFY messages: status types            Value
-   -------------------------------------------------------------------
-
-   INITIAL_CONTACT                          16384
-       This notification asserts that this IKE_SA is the only IKE_SA
-       currently active between the authenticated identities. It MAY be
-       sent when an IKE_SA is established after a crash, and the
-       recipient MAY use this information to delete any other IKE_SAs it
-       has to the same authenticated identity without waiting for a
-       timeout. This notification MUST NOT be sent by an entity that may
-       be replicated (e.g., a roaming user's credentials where the user
-       is allowed to connect to the corporate firewall from two remote
-       systems at the same time). {{ Clarif-7.9 }} The INITIAL_CONTACT
-       notification, if sent, SHOULD be in the first IKE_AUTH request,
-       not as a separate exchange afterwards; however, receiving
-       parties need to deal with it in other requests.
-
-   SET_WINDOW_SIZE                          16385
-       This notification asserts that the sending endpoint is capable of
-       keeping state for multiple outstanding exchanges, permitting the
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 81]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-       recipient to send multiple requests before getting a response to
-       the first. The data associated with a SET_WINDOW_SIZE
-       notification MUST be 4 octets long and contain the big endian
-       representation of the number of messages the sender promises to
-       keep. Window size is always one until the initial exchanges
-       complete.
-
-   ADDITIONAL_TS_POSSIBLE                   16386
-       This notification asserts that the sending endpoint narrowed the
-       proposed traffic selectors but that other traffic selectors would
-       also have been acceptable, though only in a separate SA (see
-       section 2.9). There is no data associated with this Notify type.
-       It may be sent only as an additional payload in a message
-       including accepted TSs.
-
-   IPCOMP_SUPPORTED                         16387
-       This notification may be included only in a message containing an
-       SA payload negotiating a CHILD_SA and indicates a willingness by
-       its sender to use IPComp on this SA. The data associated with
-       this notification includes a two-octet IPComp CPI followed by a
-       one-octet transform ID optionally followed by attributes whose
-       length and format are defined by that transform ID. A message
-       proposing an SA may contain multiple IPCOMP_SUPPORTED
-       notifications to indicate multiple supported algorithms. A
-       message accepting an SA may contain at most one.
-
-       The transform IDs currently defined are:
-
-       Name              Number   Defined In
-       -------------------------------------
-       RESERVED          0
-       IPCOMP_OUI        1
-       IPCOMP_DEFLATE    2        RFC 2394
-       IPCOMP_LZS        3        RFC 2395
-       IPCOMP_LZJH       4        RFC 3051
-       RESERVED TO IANA  5-240
-       PRIVATE USE       241-255
-
-   NAT_DETECTION_SOURCE_IP                  16388
-       This notification is used by its recipient to determine whether
-       the source is behind a NAT box. The data associated with this
-       notification is a SHA-1 digest of the SPIs (in the order they
-       appear in the header), IP address, and port on which this packet
-       was sent. There MAY be multiple Notify payloads of this type in a
-       message if the sender does not know which of several network
-       attachments will be used to send the packet. The recipient of
-       this notification MAY compare the supplied value to a SHA-1 hash
-       of the SPIs, source IP address, and port, and if they don't match
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 82]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-       it SHOULD enable NAT traversal (see section 2.23). Alternately,
-       it MAY reject the connection attempt if NAT traversal is not
-       supported.
-
-   NAT_DETECTION_DESTINATION_IP             16389
-       This notification is used by its recipient to determine whether
-       it is behind a NAT box. The data associated with this
-       notification is a SHA-1 digest of the SPIs (in the order they
-       appear in the header), IP address, and port to which this packet
-       was sent. The recipient of this notification MAY compare the
-       supplied value to a hash of the SPIs, destination IP address, and
-       port, and if they don't match it SHOULD invoke NAT traversal (see
-       section 2.23). If they don't match, it means that this end is
-       behind a NAT and this end SHOULD start sending keepalive packets
-       as defined in [UDPENCAPS]. Alternately, it MAY reject the
-       connection attempt if NAT traversal is not supported.
-
-   COOKIE                                   16390
-       This notification MAY be included in an IKE_SA_INIT response. It
-       indicates that the request should be retried with a copy of this
-       notification as the first payload. This notification MUST be
-       included in an IKE_SA_INIT request retry if a COOKIE notification
-       was included in the initial response. The data associated with
-       this notification MUST be between 1 and 64 octets in length
-       (inclusive).
-
-   USE_TRANSPORT_MODE                       16391
-       This notification MAY be included in a request message that also
-       includes an SA payload requesting a CHILD_SA. It requests that
-       the CHILD_SA use transport mode rather than tunnel mode for the
-       SA created. If the request is accepted, the response MUST also
-       include a notification of type USE_TRANSPORT_MODE. If the
-       responder declines the request, the CHILD_SA will be established
-       in tunnel mode. If this is unacceptable to the initiator, the
-       initiator MUST delete the SA. Note: Except when using this option
-       to negotiate transport mode, all CHILD_SAs will use tunnel mode.
-
-       Note: The ECN decapsulation modifications specified in
-       [IPSECARCH] MUST be performed for every tunnel mode SA created
-       by IKEv2.
-
-   HTTP_CERT_LOOKUP_SUPPORTED               16392
-       This notification MAY be included in any message that can include
-       a CERTREQ payload and indicates that the sender is capable of
-       looking up certificates based on an HTTP-based URL (and hence
-       presumably would prefer to receive certificate specifications in
-       that format).
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 83]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   REKEY_SA                                 16393
-       This notification MUST be included in a CREATE_CHILD_SA exchange
-       if the purpose of the exchange is to replace an existing ESP or
-       AH SA. The SPI field identifies the SA being rekeyed.
-       {{ Clarif-5.4 }} The SPI placed in the REKEY_SA
-       notification is the SPI the exchange initiator would expect in
-       inbound ESP or AH packets. There is no data.
-
-   ESP_TFC_PADDING_NOT_SUPPORTED            16394
-       This notification asserts that the sending endpoint will NOT
-       accept packets that contain Flow Confidentiality (TFC) padding.
-       {{ Clarif-4.5 }} The scope of this message is a single
-       CHILD_SA, and thus this notification is included in messages
-       containing an SA payload negotiating a CHILD_SA.  If neither
-       endpoint accepts TFC padding, this notification SHOULD be
-       included in both the request proposing an SA and the response
-       accepting it.  If this notification is included in only one of
-       the messages, TFC padding can still be sent in the other
-       direction.
-
-   NON_FIRST_FRAGMENTS_ALSO                 16395
-       Used for fragmentation control. See [IPSECARCH] for explanation.
-       {{ Clarif-4.6 }} Sending non-first fragments is
-       enabled only if NON_FIRST_FRAGMENTS_ALSO notification is
-       included in both the request proposing an SA and the response
-       accepting it. If the peer rejects this proposal, the peer only
-       omits NON_FIRST_FRAGMENTS_ALSO notification from the response,
-       but does not reject the whole CHILD_SA creation.
-
-   RESERVED TO IANA                         16396-40959
-
-   PRIVATE USE                              40960-65535
-
-3.11.  Delete Payload
-
-   The Delete Payload, denoted D in this memo, contains a protocol
-   specific security association identifier that the sender has removed
-   from its security association database and is, therefore, no longer
-   valid.  Figure 17 shows the format of the Delete Payload.  It is
-   possible to send multiple SPIs in a Delete payload; however, each SPI
-   MUST be for the same protocol.  Mixing of protocol identifiers MUST
-   NOT be performed in the Delete payload.  It is permitted, however, to
-   include multiple Delete payloads in a single INFORMATIONAL exchange
-   where each Delete payload lists SPIs for a different protocol.
-
-   Deletion of the IKE_SA is indicated by a protocol ID of 1 (IKE) but
-   no SPIs.  Deletion of a CHILD_SA, such as ESP or AH, will contain the
-   IPsec protocol ID of that protocol (2 for AH, 3 for ESP), and the SPI
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 84]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   is the SPI the sending endpoint would expect in inbound ESP or AH
-   packets.
-
-   The Delete Payload is defined as follows:
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C!  RESERVED   !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Protocol ID   !   SPI Size    !           # of SPIs           !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~               Security Parameter Index(es) (SPI)              ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 17:  Delete Payload Format
-
-   o  Protocol ID (1 octet) - Must be 1 for an IKE_SA, 2 for AH, or 3
-      for ESP.
-
-   o  SPI Size (1 octet) - Length in octets of the SPI as defined by the
-      protocol ID.  It MUST be zero for IKE (SPI is in message header)
-      or four for AH and ESP.
-
-   o  # of SPIs (2 octets) - The number of SPIs contained in the Delete
-      payload.  The size of each SPI is defined by the SPI Size field.
-
-   o  Security Parameter Index(es) (variable length) - Identifies the
-      specific security association(s) to delete.  The length of this
-      field is determined by the SPI Size and # of SPIs fields.
-
-   The payload type for the Delete Payload is forty two (42).
-
-3.12.  Vendor ID Payload
-
-   The Vendor ID Payload, denoted V in this memo, contains a vendor
-   defined constant.  The constant is used by vendors to identify and
-   recognize remote instances of their implementations.  This mechanism
-   allows a vendor to experiment with new features while maintaining
-   backward compatibility.
-
-   A Vendor ID payload MAY announce that the sender is capable to
-   accepting certain extensions to the protocol, or it MAY simply
-   identify the implementation as an aid in debugging.  A Vendor ID
-   payload MUST NOT change the interpretation of any information defined
-   in this specification (i.e., the critical bit MUST be set to 0).
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 85]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   Multiple Vendor ID payloads MAY be sent.  An implementation is NOT
-   REQUIRED to send any Vendor ID payload at all.
-
-   A Vendor ID payload may be sent as part of any message.  Reception of
-   a familiar Vendor ID payload allows an implementation to make use of
-   Private USE numbers described throughout this memo-- private
-   payloads, private exchanges, private notifications, etc.  Unfamiliar
-   Vendor IDs MUST be ignored.
-
-   Writers of Internet-Drafts who wish to extend this protocol MUST
-   define a Vendor ID payload to announce the ability to implement the
-   extension in the Internet-Draft.  It is expected that Internet-Drafts
-   that gain acceptance and are standardized will be given "magic
-   numbers" out of the Future Use range by IANA, and the requirement to
-   use a Vendor ID will go away.
-
-   The Vendor ID Payload fields are defined as follows:
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C!  RESERVED   !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                        Vendor ID (VID)                        ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-              Figure 18:  Vendor ID Payload Format
-
-   o  Vendor ID (variable length) - It is the responsibility of the
-      person choosing the Vendor ID to assure its uniqueness in spite of
-      the absence of any central registry for IDs.  Good practice is to
-      include a company name, a person name, or some such.  If you want
-      to show off, you might include the latitude and longitude and time
-      where you were when you chose the ID and some random input.  A
-      message digest of a long unique string is preferable to the long
-      unique string itself.
-
-   The payload type for the Vendor ID Payload is forty three (43).
-
-3.13.  Traffic Selector Payload
-
-   The Traffic Selector Payload, denoted TS in this memo, allows peers
-   to identify packet flows for processing by IPsec security services.
-   The Traffic Selector Payload consists of the IKE generic payload
-   header followed by individual traffic selectors as follows:
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 86]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C!  RESERVED   !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Number of TSs !                 RESERVED                      !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                       <Traffic Selectors>                     ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-            Figure 19:  Traffic Selectors Payload Format
-
-   o  Number of TSs (1 octet) - Number of traffic selectors being
-      provided.
-
-   o  RESERVED - This field MUST be sent as zero and MUST be ignored on
-      receipt.
-
-   o  Traffic Selectors (variable length) - One or more individual
-      traffic selectors.
-
-   The length of the Traffic Selector payload includes the TS header and
-   all the traffic selectors.
-
-   The payload type for the Traffic Selector payload is forty four (44)
-   for addresses at the initiator's end of the SA and forty five (45)
-   for addresses at the responder's end.
-
-   {{ Clarif-4.7 }} There is no requirement that TSi and TSr contain the
-   same number of individual traffic selectors.  Thus, they are
-   interpreted as follows: a packet matches a given TSi/TSr if it
-   matches at least one of the individual selectors in TSi, and at least
-   one of the individual selectors in TSr.
-
-   For instance, the following traffic selectors:
-
-   TSi = ((17, 100, 192.0.1.66-192.0.1.66),
-          (17, 200, 192.0.1.66-192.0.1.66))
-   TSr = ((17, 300, 0.0.0.0-255.255.255.255),
-          (17, 400, 0.0.0.0-255.255.255.255))
-
-   would match UDP packets from 192.0.1.66 to anywhere, with any of the
-   four combinations of source/destination ports (100,300), (100,400),
-   (200,300), and (200, 400).
-
-   Thus, some types of policies may require several CHILD_SA pairs.  For
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 87]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   instance, a policy matching only source/destination ports (100,300)
-   and (200,400), but not the other two combinations, cannot be
-   negotiated as a single CHILD_SA pair.
-
-3.13.1.  Traffic Selector
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !   TS Type     !IP Protocol ID*|       Selector Length         |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |           Start Port*         |           End Port*           |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                         Starting Address*                     ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                         Ending Address*                       ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 20: Traffic Selector
-
-   *Note: All fields other than TS Type and Selector Length depend on
-   the TS Type.  The fields shown are for TS Types 7 and 8, the only two
-   values currently defined.
-
-   o  TS Type (one octet) - Specifies the type of traffic selector.
-
-   o  IP protocol ID (1 octet) - Value specifying an associated IP
-      protocol ID (e.g., UDP/TCP/ICMP).  A value of zero means that the
-      protocol ID is not relevant to this traffic selector-- the SA can
-      carry all protocols.
-
-   o  Selector Length - Specifies the length of this Traffic Selector
-      Substructure including the header.
-
-   o  Start Port (2 octets) - Value specifying the smallest port number
-      allowed by this Traffic Selector.  For protocols for which port is
-      undefined, or if all ports are allowed, this field MUST be zero.
-      For the ICMP protocol, the two one-octet fields Type and Code are
-      treated as a single 16-bit integer (with Type in the most
-      significant eight bits and Code in the least significant eight
-      bits) port number for the purposes of filtering based on this
-      field.
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 88]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   o  End Port (2 octets) - Value specifying the largest port number
-      allowed by this Traffic Selector.  For protocols for which port is
-      undefined, or if all ports are allowed, this field MUST be 65535.
-      For the ICMP protocol, the two one-octet fields Type and Code are
-      treated as a single 16-bit integer (with Type in the most
-      significant eight bits and Code in the least significant eight
-      bits) port number for the purposed of filtering based on this
-      field.
-
-   o  Starting Address - The smallest address included in this Traffic
-      Selector (length determined by TS type).
-
-   o  Ending Address - The largest address included in this Traffic
-      Selector (length determined by TS type).
-
-   Systems that are complying with [IPSECARCH] that wish to indicate
-   "ANY" ports MUST set the start port to 0 and the end port to 65535;
-   note that according to [IPSECARCH], "ANY" includes "OPAQUE".  Systems
-   working with [IPSECARCH] that wish to indicate "OPAQUE" ports, but
-   not "ANY" ports, MUST set the start port to 65535 and the end port to
-   0.
-
-   {{ Added from Clarif-4.8 }} The traffic selector types 7 and 8 can
-   also refer to ICMP type and code fields.  Note, however, that ICMP
-   packets do not have separate source and destination port fields.  The
-   method for specifying the traffic selectors for ICMP is shown by
-   example in Section 4.4.1.3 of [IPSECARCH].
-
-   {{ Added from Clarif-4.9 }} Traffic selectors can use IP Protocol ID
-   135 to match the IPv6 mobility header [MIPV6].  This document does
-   not specify how to represent the "MH Type" field in traffic
-   selectors, although it is likely that a different document will
-   specify this in the future.  Note that [IPSECARCH] says that the IPv6
-   mobility header (MH) message type is placed in the most significant
-   eight bits of the 16-bit local port selector.  The direction
-   semantics of TSi/TSr port fields are the same as for ICMP.
-
-   The following table lists the assigned values for the Traffic
-   Selector Type field and the corresponding Address Selector Data.
-
-
-
-
-
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 89]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   TS Type                            Value
-   -------------------------------------------------------------------
-   RESERVED                            0-6
-
-   TS_IPV4_ADDR_RANGE                  7
-
-       A range of IPv4 addresses, represented by two four-octet
-       values. The first value is the beginning IPv4 address
-       (inclusive) and the second value is the ending IPv4 address
-       (inclusive). All addresses falling between the two specified
-       addresses are considered to be within the list.
-
-   TS_IPV6_ADDR_RANGE                  8
-
-       A range of IPv6 addresses, represented by two sixteen-octet
-       values. The first value is the beginning IPv6 address
-       (inclusive) and the second value is the ending IPv6 address
-       (inclusive). All addresses falling between the two specified
-       addresses are considered to be within the list.
-
-   RESERVED TO IANA                    9-240
-   PRIVATE USE                         241-255
-
-3.14.  Encrypted Payload
-
-   The Encrypted Payload, denoted SK{...} or E in this memo, contains
-   other payloads in encrypted form.  The Encrypted Payload, if present
-   in a message, MUST be the last payload in the message.  Often, it is
-   the only payload in the message.
-
-   The algorithms for encryption and integrity protection are negotiated
-   during IKE_SA setup, and the keys are computed as specified in
-   Section 2.14 and Section 2.18.
-
-   The encryption and integrity protection algorithms are modeled after
-   the ESP algorithms described in RFCs 2104 [HMAC], 4303 [ESP], and
-   2451 [ESPCBC].  This document completely specifies the cryptographic
-   processing of IKE data, but those documents should be consulted for
-   design rationale.  We require a block cipher with a fixed block size
-   and an integrity check algorithm that computes a fixed-length
-   checksum over a variable size message.
-
-   The payload type for an Encrypted payload is forty six (46).  The
-   Encrypted Payload consists of the IKE generic payload header followed
-   by individual fields as follows:
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 90]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C!  RESERVED   !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                     Initialization Vector                     !
-   !         (length is block size for encryption algorithm)       !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ~                    Encrypted IKE Payloads                     ~
-   +               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !               !             Padding (0-255 octets)            !
-   +-+-+-+-+-+-+-+-+                               +-+-+-+-+-+-+-+-+
-   !                                               !  Pad Length   !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ~                    Integrity Checksum Data                    ~
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-            Figure 21:  Encrypted Payload Format
-
-   o  Next Payload - The payload type of the first embedded payload.
-      Note that this is an exception in the standard header format,
-      since the Encrypted payload is the last payload in the message and
-      therefore the Next Payload field would normally be zero.  But
-      because the content of this payload is embedded payloads and there
-      was no natural place to put the type of the first one, that type
-      is placed here.
-
-   o  Payload Length - Includes the lengths of the header, IV, Encrypted
-      IKE Payloads, Padding, Pad Length, and Integrity Checksum Data.
-
-   o  Initialization Vector - A randomly chosen value whose length is
-      equal to the block length of the underlying encryption algorithm.
-      Recipients MUST accept any value.  Senders SHOULD either pick this
-      value pseudo-randomly and independently for each message or use
-      the final ciphertext block of the previous message sent.  Senders
-      MUST NOT use the same value for each message, use a sequence of
-      values with low hamming distance (e.g., a sequence number), or use
-      ciphertext from a received message.
-
-   o  IKE Payloads are as specified earlier in this section.  This field
-      is encrypted with the negotiated cipher.
-
-   o  Padding MAY contain any value chosen by the sender, and MUST have
-      a length that makes the combination of the Payloads, the Padding,
-      and the Pad Length to be a multiple of the encryption block size.
-      This field is encrypted with the negotiated cipher.
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 91]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   o  Pad Length is the length of the Padding field.  The sender SHOULD
-      set the Pad Length to the minimum value that makes the combination
-      of the Payloads, the Padding, and the Pad Length a multiple of the
-      block size, but the recipient MUST accept any length that results
-      in proper alignment.  This field is encrypted with the negotiated
-      cipher.
-
-   o  Integrity Checksum Data is the cryptographic checksum of the
-      entire message starting with the Fixed IKE Header through the Pad
-      Length.  The checksum MUST be computed over the encrypted message.
-      Its length is determined by the integrity algorithm negotiated.
-
-3.15.  Configuration Payload
-
-   The Configuration payload, denoted CP in this document, is used to
-   exchange configuration information between IKE peers.  The exchange
-   is for an IRAC to request an internal IP address from an IRAS and to
-   exchange other information of the sort that one would acquire with
-   Dynamic Host Configuration Protocol (DHCP) if the IRAC were directly
-   connected to a LAN.
-
-   Configuration payloads are of type CFG_REQUEST/CFG_REPLY or CFG_SET/
-   CFG_ACK (see CFG Type in the payload description below).  CFG_REQUEST
-   and CFG_SET payloads may optionally be added to any IKE request.  The
-   IKE response MUST include either a corresponding CFG_REPLY or CFG_ACK
-   or a Notify payload with an error type indicating why the request
-   could not be honored.  An exception is that a minimal implementation
-   MAY ignore all CFG_REQUEST and CFG_SET payloads, so a response
-   message without a corresponding CFG_REPLY or CFG_ACK MUST be accepted
-   as an indication that the request was not supported.
-
-   "CFG_REQUEST/CFG_REPLY" allows an IKE endpoint to request information
-   from its peer.  If an attribute in the CFG_REQUEST Configuration
-   Payload is not zero-length, it is taken as a suggestion for that
-   attribute.  The CFG_REPLY Configuration Payload MAY return that
-   value, or a new one.  It MAY also add new attributes and not include
-   some requested ones.  Requestors MUST ignore returned attributes that
-   they do not recognize.
-
-   Some attributes MAY be multi-valued, in which case multiple attribute
-   values of the same type are sent and/or returned.  Generally, all
-   values of an attribute are returned when the attribute is requested.
-   For some attributes (in this version of the specification only
-   internal addresses), multiple requests indicates a request that
-   multiple values be assigned.  For these attributes, the number of
-   values returned SHOULD NOT exceed the number requested.
-
-   If the data type requested in a CFG_REQUEST is not recognized or not
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 92]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   supported, the responder MUST NOT return an error type but rather
-   MUST either send a CFG_REPLY that MAY be empty or a reply not
-   containing a CFG_REPLY payload at all.  Error returns are reserved
-   for cases where the request is recognized but cannot be performed as
-   requested or the request is badly formatted.
-
-   "CFG_SET/CFG_ACK" allows an IKE endpoint to push configuration data
-   to its peer.  In this case, the CFG_SET Configuration Payload
-   contains attributes the initiator wants its peer to alter.  The
-   responder MUST return a Configuration Payload if it accepted any of
-   the configuration data and it MUST contain the attributes that the
-   responder accepted with zero-length data.  Those attributes that it
-   did not accept MUST NOT be in the CFG_ACK Configuration Payload.  If
-   no attributes were accepted, the responder MUST return either an
-   empty CFG_ACK payload or a response message without a CFG_ACK
-   payload.  There are currently no defined uses for the CFG_SET/CFG_ACK
-   exchange, though they may be used in connection with extensions based
-   on Vendor IDs.  An minimal implementation of this specification MAY
-   ignore CFG_SET payloads.
-
-   {{ Demoted the SHOULD }} Extensions via the CP payload should not be
-   used for general purpose management.  Its main intent is to provide a
-   bootstrap mechanism to exchange information within IPsec from IRAS to
-   IRAC.  While it MAY be useful to use such a method to exchange
-   information between some Security Gateways (SGW) or small networks,
-   existing management protocols such as DHCP [DHCP], RADIUS [RADIUS],
-   SNMP, or LDAP [LDAP] should be preferred for enterprise management as
-   well as subsequent information exchanges.
-
-   The Configuration Payload is defined as follows:
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C! RESERVED    !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !   CFG Type    !                    RESERVED                   !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                   Configuration Attributes                    ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-            Figure 22:  Configuration Payload Format
-
-   The payload type for the Configuration Payload is forty seven (47).
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 93]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   o  CFG Type (1 octet) - The type of exchange represented by the
-      Configuration Attributes.
-
-      CFG Type           Value
-      --------------------------
-      RESERVED           0
-      CFG_REQUEST        1
-      CFG_REPLY          2
-      CFG_SET            3
-      CFG_ACK            4
-      RESERVED TO IANA   5-127
-      PRIVATE USE        128-255
-
-   o  RESERVED (3 octets) - MUST be sent as zero; MUST be ignored on
-      receipt.
-
-   o  Configuration Attributes (variable length) - These are type length
-      values specific to the Configuration Payload and are defined
-      below.  There may be zero or more Configuration Attributes in this
-      payload.
-
-3.15.1.  Configuration Attributes
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !R|         Attribute Type      !            Length             |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                                                               |
-   ~                             Value                             ~
-   |                                                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-            Figure 23:  Configuration Attribute Format
-
-   o  Reserved (1 bit) - This bit MUST be set to zero and MUST be
-      ignored on receipt.
-
-   o  Attribute Type (15 bits) - A unique identifier for each of the
-      Configuration Attribute Types.
-
-   o  Length (2 octets) - Length in octets of Value.
-
-   o  Value (0 or more octets) - The variable-length value of this
-      Configuration Attribute.  The following attribute types have been
-      defined:
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 94]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-                                      Multi-
-      Attribute Type           Value  Valued  Length
-      -------------------------------------------------------
-      RESERVED                 0
-      INTERNAL_IP4_ADDRESS     1      YES*    0 or 4 octets
-      INTERNAL_IP4_NETMASK     2      NO      0 or 4 octets
-      INTERNAL_IP4_DNS         3      YES     0 or 4 octets
-      INTERNAL_IP4_NBNS        4      YES     0 or 4 octets
-      INTERNAL_ADDRESS_EXPIRY  5      NO      0 or 4 octets
-      INTERNAL_IP4_DHCP        6      YES     0 or 4 octets
-      APPLICATION_VERSION      7      NO      0 or more
-      INTERNAL_IP6_ADDRESS     8      YES*    0 or 17 octets
-      RESERVED                 9
-      INTERNAL_IP6_DNS         10     YES     0 or 16 octets
-      INTERNAL_IP6_NBNS        11     YES     0 or 16 octets
-      INTERNAL_IP6_DHCP        12     YES     0 or 16 octets
-      INTERNAL_IP4_SUBNET      13     YES     0 or 8 octets
-      SUPPORTED_ATTRIBUTES     14     NO      Multiple of 2
-      INTERNAL_IP6_SUBNET      15     YES     17 octets
-      RESERVED TO IANA         16-16383
-      PRIVATE USE              16384-32767
-
-      * These attributes may be multi-valued on return only if
-        multiple values were requested.
-
-   o  INTERNAL_IP4_ADDRESS, INTERNAL_IP6_ADDRESS - An address on the
-      internal network, sometimes called a red node address or private
-      address and MAY be a private address on the Internet. {{
-      Clarif-6.2}} In a request message, the address specified is a
-      requested address (or a zero-length address if no specific address
-      is requested).  If a specific address is requested, it likely
-      indicates that a previous connection existed with this address and
-      the requestor would like to reuse that address.  With IPv6, a
-      requestor MAY supply the low-order address bytes it wants to use.
-      Multiple internal addresses MAY be requested by requesting
-      multiple internal address attributes.  The responder MAY only send
-      up to the number of addresses requested.  The INTERNAL_IP6_ADDRESS
-      is made up of two fields: the first is a 16-octet IPv6 address,
-      and the second is a one-octet prefix-length as defined in
-      [ADDRIPV6].
-
-      The requested address is valid until the expiry time defined with
-      the INTERNAL_ADDRESS_EXPIRY attribute or there are no IKE_SAs
-      between the peers.
-
-   o  INTERNAL_IP4_NETMASK - The internal network's netmask.  Only one
-      netmask is allowed in the request and reply messages (e.g.,
-      255.255.255.0), and it MUST be used only with an
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 95]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-      INTERNAL_IP4_ADDRESS attribute. {{ Clarif-6.4 }}
-      INTERNAL_IP4_NETMASK in a CFG_REPLY means roughly the same thing
-      as INTERNAL_IP4_SUBNET containing the same information ("send
-      traffic to these addresses through me"), but also implies a link
-      boundary.  For instance, the client could use its own address and
-      the netmask to calculate the broadcast address of the link.  An
-      empty INTERNAL_IP4_NETMASK attribute can be included in a
-      CFG_REQUEST to request this information (although the gateway can
-      send the information even when not requested).  Non-empty values
-      for this attribute in a CFG_REQUEST do not make sense and thus
-      MUST NOT be included.
-
-   o  INTERNAL_IP4_DNS, INTERNAL_IP6_DNS - Specifies an address of a DNS
-      server within the network.  Multiple DNS servers MAY be requested.
-      The responder MAY respond with zero or more DNS server attributes.
-
-   o  INTERNAL_IP4_NBNS, INTERNAL_IP6_NBNS - Specifies an address of a
-      NetBios Name Server (WINS) within the network.  Multiple NBNS
-      servers MAY be requested.  The responder MAY respond with zero or
-      more NBNS server attributes. {{ Clarif-6.6 }} NetBIOS is not
-      defined for IPv6; therefore, INTERNAL_IP6_NBNS SHOULD NOT be used.
-
-   o  INTERNAL_ADDRESS_EXPIRY - Specifies the number of seconds that the
-      host can use the internal IP address.  The host MUST renew the IP
-      address before this expiry time.  Only one of these attributes MAY
-      be present in the reply. {{ Clarif-6.7 }} Expiry times and
-      explicit renewals are primarily useful in environments like DHCP,
-      where the server cannot reliably know when the client has gone
-      away.  However, in IKEv2, this is known, and the gateway can
-      simply free the address when the IKE_SA is deleted.  Further,
-      supporting renewals is not mandatory.  Thus
-      INTERNAL_ADDRESS_EXPIRY attribute MUST NOT be used.
-
-   o  INTERNAL_IP4_DHCP, INTERNAL_IP6_DHCP - Instructs the host to send
-      any internal DHCP requests to the address contained within the
-      attribute.  Multiple DHCP servers MAY be requested.  The responder
-      MAY respond with zero or more DHCP server attributes.
-
-   o  APPLICATION_VERSION - The version or application information of
-      the IPsec host.  This is a string of printable ASCII characters
-      that is NOT null terminated.
-
-   o  INTERNAL_IP4_SUBNET - The protected sub-networks that this edge-
-      device protects.  This attribute is made up of two fields: the
-      first being an IP address and the second being a netmask.
-      Multiple sub-networks MAY be requested.  The responder MAY respond
-      with zero or more sub-network attributes.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 96]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   o  SUPPORTED_ATTRIBUTES - When used within a Request, this attribute
-      MUST be zero-length and specifies a query to the responder to
-      reply back with all of the attributes that it supports.  The
-      response contains an attribute that contains a set of attribute
-      identifiers each in 2 octets.  The length divided by 2 (octets)
-      would state the number of supported attributes contained in the
-      response.
-
-   o  INTERNAL_IP6_SUBNET - The protected sub-networks that this edge-
-      device protects.  This attribute is made up of two fields: the
-      first is a 16-octet IPv6 address, and the second is a one-octet
-      prefix-length as defined in [ADDRIPV6].  Multiple sub-networks MAY
-      be requested.  The responder MAY respond with zero or more sub-
-      network attributes.
-
-   Note that no recommendations are made in this document as to how an
-   implementation actually figures out what information to send in a
-   reply.  That is, we do not recommend any specific method of an IRAS
-   determining which DNS server should be returned to a requesting IRAC.
-
-3.15.2.  Meaning of INTERNAL_IP4_SUBNET/INTERNAL_IP6_SUBNET
-
-   {{ Section added based on Clarif-6.3 }}
-
-   INTERNAL_IP4/6_SUBNET attributes can indicate additional subnets,
-   ones that need one or more separate SAs, that can be reached through
-   the gateway that announces the attributes.  INTERNAL_IP4/6_SUBNET
-   attributes may also express the gateway's policy about what traffic
-   should be sent through the gateway; the client can choose whether
-   other traffic (covered by TSr, but not in INTERNAL_IP4/6_SUBNET) is
-   sent through the gateway or directly to the destination.  Thus,
-   traffic to the addresses listed in the INTERNAL_IP4/6_SUBNET
-   attributes should be sent through the gateway that announces the
-   attributes.  If there are no existing IPsec SAs whose traffic
-   selectors cover the address in question, new SAs need to be created.
-
-   For instance, if there are two subnets, 192.0.1.0/26 and
-   192.0.2.0/24, and the client's request contains the following:
-
-   CP(CFG_REQUEST) =
-     INTERNAL_IP4_ADDRESS()
-   TSi = (0, 0-65535, 0.0.0.0-255.255.255.255)
-   TSr = (0, 0-65535, 0.0.0.0-255.255.255.255)
-
-   then a valid response could be the following (in which TSr and
-   INTERNAL_IP4_SUBNET contain the same information):
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 97]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   CP(CFG_REPLY) =
-     INTERNAL_IP4_ADDRESS(192.0.1.234)
-     INTERNAL_IP4_SUBNET(192.0.1.0/255.255.255.192)
-     INTERNAL_IP4_SUBNET(192.0.2.0/255.255.255.0)
-   TSi = (0, 0-65535, 192.0.1.234-192.0.1.234)
-   TSr = ((0, 0-65535, 192.0.1.0-192.0.1.63),
-          (0, 0-65535, 192.0.2.0-192.0.2.255))
-
-   In these cases, the INTERNAL_IP4_SUBNET does not really carry any
-   useful information.
-
-   A different possible reply would have been this:
-
-   CP(CFG_REPLY) =
-     INTERNAL_IP4_ADDRESS(192.0.1.234)
-     INTERNAL_IP4_SUBNET(192.0.1.0/255.255.255.192)
-     INTERNAL_IP4_SUBNET(192.0.2.0/255.255.255.0)
-   TSi = (0, 0-65535, 192.0.1.234-192.0.1.234)
-   TSr = (0, 0-65535, 0.0.0.0-255.255.255.255)
-
-   That reply would mean that the client can send all its traffic
-   through the gateway, but the gateway does not mind if the client
-   sends traffic not included by INTERNAL_IP4_SUBNET directly to the
-   destination (without going through the gateway).
-
-   A different situation arises if the gateway has a policy that
-   requires the traffic for the two subnets to be carried in separate
-   SAs.  Then a response like this would indicate to the client that if
-   it wants access to the second subnet, it needs to create a separate
-   SA:
-
-   CP(CFG_REPLY) =
-     INTERNAL_IP4_ADDRESS(192.0.1.234)
-     INTERNAL_IP4_SUBNET(192.0.1.0/255.255.255.192)
-     INTERNAL_IP4_SUBNET(192.0.2.0/255.255.255.0)
-   TSi = (0, 0-65535, 192.0.1.234-192.0.1.234)
-   TSr = (0, 0-65535, 192.0.1.0-192.0.1.63)
-
-   INTERNAL_IP4_SUBNET can also be useful if the client's TSr included
-   only part of the address space.  For instance, if the client requests
-   the following:
-
-   CP(CFG_REQUEST) =
-     INTERNAL_IP4_ADDRESS()
-   TSi = (0, 0-65535, 0.0.0.0-255.255.255.255)
-   TSr = (0, 0-65535, 192.0.2.155-192.0.2.155)
-
-   then the gateway's reply might be:
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 98]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   CP(CFG_REPLY) =
-     INTERNAL_IP4_ADDRESS(192.0.1.234)
-     INTERNAL_IP4_SUBNET(192.0.1.0/255.255.255.192)
-     INTERNAL_IP4_SUBNET(192.0.2.0/255.255.255.0)
-   TSi = (0, 0-65535, 192.0.1.234-192.0.1.234)
-   TSr = (0, 0-65535, 192.0.2.155-192.0.2.155)
-
-   Because the meaning of INTERNAL_IP4_SUBNET/INTERNAL_IP6_SUBNET is in
-   CFG_REQUESTs is unclear, they cannot be used reliably in
-   CFG_REQUESTs.
-
-3.15.3.  Configuration payloads for IPv6
-
-   {{ Added this section from Clarif-6.5 }}
-
-   The configuration payloads for IPv6 are based on the corresponding
-   IPv4 payloads, and do not fully follow the "normal IPv6 way of doing
-   things".  In particular, IPv6 stateless autoconfiguration or router
-   advertisement messages are not used; neither is neighbor discovery.
-
-   A client can be assigned an IPv6 address using the
-   INTERNAL_IP6_ADDRESS configuration payload.  A minimal exchange might
-   look like this:
-
-   CP(CFG_REQUEST) =
-     INTERNAL_IP6_ADDRESS()
-     INTERNAL_IP6_DNS()
-   TSi = (0, 0-65535, :: - FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF)
-   TSr = (0, 0-65535, :: - FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF)
-
-   CP(CFG_REPLY) =
-     INTERNAL_IP6_ADDRESS(2001:DB8:0:1:2:3:4:5/64)
-     INTERNAL_IP6_DNS(2001:DB8:99:88:77:66:55:44)
-   TSi = (0, 0-65535, 2001:DB8:0:1:2:3:4:5 - 2001:DB8:0:1:2:3:4:5)
-   TSr = (0, 0-65535, :: - FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF)
-
-   The client MAY send a non-empty INTERNAL_IP6_ADDRESS attribute in the
-   CFG_REQUEST to request a specific address or interface identifier.
-   The gateway first checks if the specified address is acceptable, and
-   if it is, returns that one.  If the address was not acceptable, the
-   gateway attempts to use the interface identifier with some other
-   prefix; if even that fails, the gateway selects another interface
-   identifier.
-
-   The INTERNAL_IP6_ADDRESS attribute also contains a prefix length
-   field.  When used in a CFG_REPLY, this corresponds to the
-   INTERNAL_IP4_NETMASK attribute in the IPv4 case.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006               [Page 99]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   Although this approach to configuring IPv6 addresses is reasonably
-   simple, it has some limitations.  IPsec tunnels configured using
-   IKEv2 are not fully-featured "interfaces" in the IPv6 addressing
-   architecture sense [IPV6ADDR].  In particular, they do not
-   necessarily have link-local addresses, and this may complicate the
-   use of protocols that assume them, such as [MLDV2].
-
-3.15.4.  Address Assignment Failures
-
-   {{ Added this section from Clarif-6.8 }}
-
-   If the responder encounters an error while attempting to assign an IP
-   address to the initiator, it responds with an
-   INTERNAL_ADDRESS_FAILURE notification.  However, there are some more
-   complex error cases.
-
-   If the responder does not support configuration payloads at all, it
-   can simply ignore all configuration payloads.  This type of
-   implementation never sends INTERNAL_ADDRESS_FAILURE notifications.
-   If the initiator requires the assignment of an IP address, it will
-   treat a response without CFG_REPLY as an error.
-
-   The initiator may request a particular type of address (IPv4 or IPv6)
-   that the responder does not support, even though the responder
-   supports configuration payloads.  In this case, the responder simply
-   ignores the type of address it does not support and processes the
-   rest of the request as usual.
-
-   If the initiator requests multiple addresses of a type that the
-   responder supports, and some (but not all) of the requests fail, the
-   responder replies with the successful addresses only.  The responder
-   sends INTERNAL_ADDRESS_FAILURE only if no addresses can be assigned.
-
-3.16.  Extensible Authentication Protocol (EAP) Payload
-
-   The Extensible Authentication Protocol Payload, denoted EAP in this
-   memo, allows IKE_SAs to be authenticated using the protocol defined
-   in RFC 3748 [EAP] and subsequent extensions to that protocol.  The
-   full set of acceptable values for the payload is defined elsewhere,
-   but a short summary of RFC 3748 is included here to make this
-   document stand alone in the common cases.
-
-
-
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 100]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Next Payload  !C!  RESERVED   !         Payload Length        !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                                                               !
-   ~                       EAP Message                             ~
-   !                                                               !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                   Figure 24:  EAP Payload Format
-
-   The payload type for an EAP Payload is forty eight (48).
-
-                        1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !     Code      ! Identifier    !           Length              !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !     Type      ! Type_Data...
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
-                   Figure 25:  EAP Message Format
-
-   o  Code (1 octet) indicates whether this message is a Request (1),
-      Response (2), Success (3), or Failure (4).
-
-   o  Identifier (1 octet) is used in PPP to distinguish replayed
-      messages from repeated ones.  Since in IKE, EAP runs over a
-      reliable protocol, it serves no function here.  In a response
-      message, this octet MUST be set to match the identifier in the
-      corresponding request.  In other messages, this field MAY be set
-      to any value.
-
-   o  Length (2 octets) is the length of the EAP message and MUST be
-      four less than the Payload Length of the encapsulating payload.
-
-   o  Type (1 octet) is present only if the Code field is Request (1) or
-      Response (2).  For other codes, the EAP message length MUST be
-      four octets and the Type and Type_Data fields MUST NOT be present.
-      In a Request (1) message, Type indicates the data being requested.
-      In a Response (2) message, Type MUST either be Nak or match the
-      type of the data requested.  The following types are defined in
-      RFC 3748:
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 101]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-      1  Identity
-      2  Notification
-      3  Nak (Response Only)
-      4  MD5-Challenge
-      5  One-Time Password (OTP)
-      6  Generic Token Card
-
-   o  Type_Data (Variable Length) varies with the Type of Request and
-      the associated Response.  For the documentation of the EAP
-      methods, see [EAP].
-
-   {{ Demoted the SHOULD NOT and SHOULD }} Note that since IKE passes an
-   indication of initiator identity in message 3 of the protocol, the
-   responder should not send EAP Identity requests.  The initiator may,
-   however, respond to such requests if it receives them.
-
-
-4.  Conformance Requirements
-
-   In order to assure that all implementations of IKEv2 can
-   interoperate, there are "MUST support" requirements in addition to
-   those listed elsewhere.  Of course, IKEv2 is a security protocol, and
-   one of its major functions is to allow only authorized parties to
-   successfully complete establishment of SAs.  So a particular
-   implementation may be configured with any of a number of restrictions
-   concerning algorithms and trusted authorities that will prevent
-   universal interoperability.
-
-   IKEv2 is designed to permit minimal implementations that can
-   interoperate with all compliant implementations.  There are a series
-   of optional features that can easily be ignored by a particular
-   implementation if it does not support that feature.  Those features
-   include:
-
-   o  Ability to negotiate SAs through a NAT and tunnel the resulting
-      ESP SA over UDP.
-
-   o  Ability to request (and respond to a request for) a temporary IP
-      address on the remote end of a tunnel.
-
-   o  Ability to support various types of legacy authentication.
-
-   o  Ability to support window sizes greater than one.
-
-   o  Ability to establish multiple ESP and/or AH SAs within a single
-      IKE_SA.
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 102]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   o  Ability to rekey SAs.
-
-   To assure interoperability, all implementations MUST be capable of
-   parsing all payload types (if only to skip over them) and to ignore
-   payload types that it does not support unless the critical bit is set
-   in the payload header.  If the critical bit is set in an unsupported
-   payload header, all implementations MUST reject the messages
-   containing those payloads.
-
-   Every implementation MUST be capable of doing four-message
-   IKE_SA_INIT and IKE_AUTH exchanges establishing two SAs (one for IKE,
-   one for ESP and/or AH).  Implementations MAY be initiate-only or
-   respond-only if appropriate for their platform.  Every implementation
-   MUST be capable of responding to an INFORMATIONAL exchange, but a
-   minimal implementation MAY respond to any INFORMATIONAL message with
-   an empty INFORMATIONAL reply (note that within the context of an
-   IKE_SA, an "empty" message consists of an IKE header followed by an
-   Encrypted payload with no payloads contained in it).  A minimal
-   implementation MAY support the CREATE_CHILD_SA exchange only in so
-   far as to recognize requests and reject them with a Notify payload of
-   type NO_ADDITIONAL_SAS.  A minimal implementation need not be able to
-   initiate CREATE_CHILD_SA or INFORMATIONAL exchanges.  When an SA
-   expires (based on locally configured values of either lifetime or
-   octets passed), and implementation MAY either try to renew it with a
-   CREATE_CHILD_SA exchange or it MAY delete (close) the old SA and
-   create a new one.  If the responder rejects the CREATE_CHILD_SA
-   request with a NO_ADDITIONAL_SAS notification, the implementation
-   MUST be capable of instead deleting the old SA and creating a new
-   one.
-
-   Implementations are not required to support requesting temporary IP
-   addresses or responding to such requests.  If an implementation does
-   support issuing such requests, it MUST include a CP payload in
-   message 3 containing at least a field of type INTERNAL_IP4_ADDRESS or
-   INTERNAL_IP6_ADDRESS.  All other fields are optional.  If an
-   implementation supports responding to such requests, it MUST parse
-   the CP payload of type CFG_REQUEST in message 3 and recognize a field
-   of type INTERNAL_IP4_ADDRESS or INTERNAL_IP6_ADDRESS.  If it supports
-   leasing an address of the appropriate type, it MUST return a CP
-   payload of type CFG_REPLY containing an address of the requested
-   type. {{ Demoted the SHOULD }} The responder may include any other
-   related attributes.
-
-   A minimal IPv4 responder implementation will ignore the contents of
-   the CP payload except to determine that it includes an
-   INTERNAL_IP4_ADDRESS attribute and will respond with the address and
-   other related attributes regardless of whether the initiator
-   requested them.
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 103]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   A minimal IPv4 initiator will generate a CP payload containing only
-   an INTERNAL_IP4_ADDRESS attribute and will parse the response
-   ignoring attributes it does not know how to use. {{ Clarif-6.7
-   removes the sentence about processing INTERNAL_ADDRESS_EXPIRY. }}
-   Minimal initiators need not be able to request lease renewals and
-   minimal responders need not respond to them.
-
-   For an implementation to be called conforming to this specification,
-   it MUST be possible to configure it to accept the following:
-
-   o  PKIX Certificates containing and signed by RSA keys of size 1024
-      or 2048 bits, where the ID passed is any of ID_KEY_ID, ID_FQDN,
-      ID_RFC822_ADDR, or ID_DER_ASN1_DN.
-
-   o  Shared key authentication where the ID passes is any of ID_KEY_ID,
-      ID_FQDN, or ID_RFC822_ADDR.
-
-   o  Authentication where the responder is authenticated using PKIX
-      Certificates and the initiator is authenticated using shared key
-      authentication.
-
-
-5.  Security Considerations
-
-   While this protocol is designed to minimize disclosure of
-   configuration information to unauthenticated peers, some such
-   disclosure is unavoidable.  One peer or the other must identify
-   itself first and prove its identity first.  To avoid probing, the
-   initiator of an exchange is required to identify itself first, and
-   usually is required to authenticate itself first.  The initiator can,
-   however, learn that the responder supports IKE and what cryptographic
-   protocols it supports.  The responder (or someone impersonating the
-   responder) can probe the initiator not only for its identity, but
-   using CERTREQ payloads may be able to determine what certificates the
-   initiator is willing to use.
-
-   Use of EAP authentication changes the probing possibilities somewhat.
-   When EAP authentication is used, the responder proves its identity
-   before the initiator does, so an initiator that knew the name of a
-   valid initiator could probe the responder for both its name and
-   certificates.
-
-   Repeated rekeying using CREATE_CHILD_SA without additional Diffie-
-   Hellman exchanges leaves all SAs vulnerable to cryptanalysis of a
-   single key or overrun of either endpoint.  Implementers should take
-   note of this fact and set a limit on CREATE_CHILD_SA exchanges
-   between exponentiations.  This memo does not prescribe such a limit.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 104]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   The strength of a key derived from a Diffie-Hellman exchange using
-   any of the groups defined here depends on the inherent strength of
-   the group, the size of the exponent used, and the entropy provided by
-   the random number generator used.  Due to these inputs, it is
-   difficult to determine the strength of a key for any of the defined
-   groups.  Diffie-Hellman group number two, when used with a strong
-   random number generator and an exponent no less than 200 bits, is
-   common for use with 3DES.  Group five provides greater security than
-   group two.  Group one is for historic purposes only and does not
-   provide sufficient strength except for use with DES, which is also
-   for historic use only.  Implementations should make note of these
-   estimates when establishing policy and negotiating security
-   parameters.
-
-   Note that these limitations are on the Diffie-Hellman groups
-   themselves.  There is nothing in IKE that prohibits using stronger
-   groups nor is there anything that will dilute the strength obtained
-   from stronger groups (limited by the strength of the other algorithms
-   negotiated including the prf function).  In fact, the extensible
-   framework of IKE encourages the definition of more groups; use of
-   elliptical curve groups may greatly increase strength using much
-   smaller numbers.
-
-   It is assumed that all Diffie-Hellman exponents are erased from
-   memory after use.  In particular, these exponents MUST NOT be derived
-   from long-lived secrets like the seed to a pseudo-random generator
-   that is not erased after use.
-
-   The strength of all keys is limited by the size of the output of the
-   negotiated prf function.  For this reason, a prf function whose
-   output is less than 128 bits (e.g., 3DES-CBC) MUST NOT be used with
-   this protocol.
-
-   The security of this protocol is critically dependent on the
-   randomness of the randomly chosen parameters.  These should be
-   generated by a strong random or properly seeded pseudo-random source
-   (see [RANDOMNESS]).  Implementers should take care to ensure that use
-   of random numbers for both keys and nonces is engineered in a fashion
-   that does not undermine the security of the keys.
-
-   For information on the rationale of many of the cryptographic design
-   choices in this protocol, see [SIGMA] and [SKEME].  Though the
-   security of negotiated CHILD_SAs does not depend on the strength of
-   the encryption and integrity protection negotiated in the IKE_SA,
-   implementations MUST NOT negotiate NONE as the IKE integrity
-   protection algorithm or ENCR_NULL as the IKE encryption algorithm.
-
-   When using pre-shared keys, a critical consideration is how to assure
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 105]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   the randomness of these secrets.  The strongest practice is to ensure
-   that any pre-shared key contain as much randomness as the strongest
-   key being negotiated.  Deriving a shared secret from a password,
-   name, or other low-entropy source is not secure.  These sources are
-   subject to dictionary and social engineering attacks, among others.
-
-   The NAT_DETECTION_*_IP notifications contain a hash of the addresses
-   and ports in an attempt to hide internal IP addresses behind a NAT.
-   Since the IPv4 address space is only 32 bits, and it is usually very
-   sparse, it would be possible for an attacker to find out the internal
-   address used behind the NAT box by trying all possible IP addresses
-   and trying to find the matching hash.  The port numbers are normally
-   fixed to 500, and the SPIs can be extracted from the packet.  This
-   reduces the number of hash calculations to 2^32.  With an educated
-   guess of the use of private address space, the number of hash
-   calculations is much smaller.  Designers should therefore not assume
-   that use of IKE will not leak internal address information.
-
-   When using an EAP authentication method that does not generate a
-   shared key for protecting a subsequent AUTH payload, certain man-in-
-   the-middle and server impersonation attacks are possible [EAPMITM].
-   These vulnerabilities occur when EAP is also used in protocols that
-   are not protected with a secure tunnel.  Since EAP is a general-
-   purpose authentication protocol, which is often used to provide
-   single-signon facilities, a deployed IPsec solution that relies on an
-   EAP authentication method that does not generate a shared key (also
-   known as a non-key-generating EAP method) can become compromised due
-   to the deployment of an entirely unrelated application that also
-   happens to use the same non-key-generating EAP method, but in an
-   unprotected fashion.  Note that this vulnerability is not limited to
-   just EAP, but can occur in other scenarios where an authentication
-   infrastructure is reused.  For example, if the EAP mechanism used by
-   IKEv2 utilizes a token authenticator, a man-in-the-middle attacker
-   could impersonate the web server, intercept the token authentication
-   exchange, and use it to initiate an IKEv2 connection.  For this
-   reason, use of non-key-generating EAP methods SHOULD be avoided where
-   possible.  Where they are used, it is extremely important that all
-   usages of these EAP methods SHOULD utilize a protected tunnel, where
-   the initiator validates the responder's certificate before initiating
-   the EAP exchange. {{ Demoted the SHOULD }} Implementers should
-   describe the vulnerabilities of using non-key-generating EAP methods
-   in the documentation of their implementations so that the
-   administrators deploying IPsec solutions are aware of these dangers.
-
-   An implementation using EAP MUST also use a public-key-based
-   authentication of the server to the client before the EAP exchange
-   begins, even if the EAP method offers mutual authentication.  This
-   avoids having additional IKEv2 protocol variations and protects the
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 106]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   EAP data from active attackers.
-
-   If the messages of IKEv2 are long enough that IP-level fragmentation
-   is necessary, it is possible that attackers could prevent the
-   exchange from completing by exhausting the reassembly buffers.  The
-   chances of this can be minimized by using the Hash and URL encodings
-   instead of sending certificates (see Section 3.6).  Additional
-   mitigations are discussed in [DOSUDPPROT].
-
-5.1.  Traffic selector authorization
-
-   {{ Added this section from Clarif-4.13 }}
-
-   IKEv2 relies on information in the Peer Authorization Database (PAD)
-   when determining what kind of IPsec SAs a peer is allowed to create.
-   This process is described in [IPSECARCH] Section 4.4.3.  When a peer
-   requests the creation of an IPsec SA with some traffic selectors, the
-   PAD must contain "Child SA Authorization Data" linking the identity
-   authenticated by IKEv2 and the addresses permitted for traffic
-   selectors.
-
-   For example, the PAD might be configured so that authenticated
-   identity "sgw23.example.com" is allowed to create IPsec SAs for
-   192.0.2.0/24, meaning this security gateway is a valid
-   "representative" for these addresses.  Host-to-host IPsec requires
-   similar entries, linking, for example, "fooserver4.example.com" with
-   192.0.1.66/32, meaning this identity a valid "owner" or
-   "representative" of the address in question.
-
-   As noted in [IPSECARCH], "It is necessary to impose these constraints
-   on creation of child SAs to prevent an authenticated peer from
-   spoofing IDs associated with other, legitimate peers."  In the
-   example given above, a correct configuration of the PAD prevents
-   sgw23 from creating IPsec SAs with address 192.0.1.66, and prevents
-   fooserver4 from creating IPsec SAs with addresses from 192.0.2.0/24.
-
-   It is important to note that simply sending IKEv2 packets using some
-   particular address does not imply a permission to create IPsec SAs
-   with that address in the traffic selectors.  For example, even if
-   sgw23 would be able to spoof its IP address as 192.0.1.66, it could
-   not create IPsec SAs matching fooserver4's traffic.
-
-   The IKEv2 specification does not specify how exactly IP address
-   assignment using configuration payloads interacts with the PAD.  Our
-   interpretation is that when a security gateway assigns an address
-   using configuration payloads, it also creates a temporary PAD entry
-   linking the authenticated peer identity and the newly allocated inner
-   address.
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 107]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   It has been recognized that configuring the PAD correctly may be
-   difficult in some environments.  For instance, if IPsec is used
-   between a pair of hosts whose addresses are allocated dynamically
-   using DHCP, it is extremely difficult to ensure that the PAD
-   specifies the correct "owner" for each IP address.  This would
-   require a mechanism to securely convey address assignments from the
-   DHCP server, and link them to identities authenticated using IKEv2.
-
-   Due to this limitation, some vendors have been known to configure
-   their PADs to allow an authenticated peer to create IPsec SAs with
-   traffic selectors containing the same address that was used for the
-   IKEv2 packets.  In environments where IP spoofing is possible (i.e.,
-   almost everywhere) this essentially allows any peer to create IPsec
-   SAs with any traffic selectors.  This is not an appropriate or secure
-   configuration in most circumstances.  See [H2HIPSEC] for an extensive
-   discussion about this issue, and the limitations of host-to-host
-   IPsec in general.
-
-
-6.  IANA Considerations
-
-   {{ This section was changed to not re-define any new IANA registries.
-   }}
-
-   [IKEV2] defined many field types and values.  IANA has already
-   registered those types and values, so the are not listed here again.
-   No new types or values are registered in this document.
-
-
-7.  Acknowledgements
-
-   The acknowledgements from the IKEv2 document were:
-
-   This document is a collaborative effort of the entire IPsec WG.  If
-   there were no limit to the number of authors that could appear on an
-   RFC, the following, in alphabetical order, would have been listed:
-   Bill Aiello, Stephane Beaulieu, Steve Bellovin, Sara Bitan, Matt
-   Blaze, Ran Canetti, Darren Dukes, Dan Harkins, Paul Hoffman, John
-   Ioannidis, Charlie Kaufman, Steve Kent, Angelos Keromytis, Tero
-   Kivinen, Hugo Krawczyk, Andrew Krywaniuk, Radia Perlman, Omer
-   Reingold, and Michael Richardson.  Many other people contributed to
-   the design.  It is an evolution of IKEv1, ISAKMP, and the IPsec DOI,
-   each of which has its own list of authors.  Hugh Daniel suggested the
-   feature of having the initiator, in message 3, specify a name for the
-   responder, and gave the feature the cute name "You Tarzan, Me Jane".
-   David Faucher and Valery Smyzlov helped refine the design of the
-   traffic selector negotiation.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 108]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   This paragraph lists references that appear only in figures.  The
-   section is only here to keep the 'xml2rfc' program happy, and will be
-   removed when the document is published.  Feel free to ignore it.
-   [DES] [IDEA] [MD5] [X.501] [X.509]
-
-
-8.  References
-
-8.1.  Normative References
-
-   [ADDGROUP]
-              Kivinen, T. and M. Kojo, "More Modular Exponential (MODP)
-              Diffie-Hellman groups for Internet Key Exchange (IKE)",
-              RFC 3526, May 2003.
-
-   [ADDRIPV6]
-              Hinden, R. and S. Deering, "Internet Protocol Version 6
-              (IPv6) Addressing Architecture", RFC 3513, April 2003.
-
-   [Clarif]   "IKEv2 Clarifications and Implementation Guidelines",
-              draft-eronen-ipsec-ikev2-clarifications (work in
-              progress).
-
-   [EAP]      Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H.
-              Levkowetz, "Extensible Authentication Protocol (EAP)",
-              RFC 3748, June 2004.
-
-   [ECN]      Ramakrishnan, K., Floyd, S., and D. Black, "The Addition
-              of Explicit Congestion Notification (ECN) to IP",
-              RFC 3168, September 2001.
-
-   [ESPCBC]   Pereira, R. and R. Adams, "The ESP CBC-Mode Cipher
-              Algorithms", RFC 2451, November 1998.
-
-   [IANACONS]
-              Narten, T. and H. Alvestrand, "Guidelines for Writing an
-              IANA Considerations Section in RFCs", BCP 26, RFC 2434.
-
-   [IKEV2]    Kaufman, C., "Internet Key Exchange (IKEv2) Protocol",
-              RFC 4306, December 2005.
-
-   [IPSECARCH]
-              Kent, S. and K. Seo, "Security Architecture for the
-              Internet Protocol", RFC 4301, December 2005.
-
-   [MUSTSHOULD]
-              Bradner, S., "Key Words for use in RFCs to indicate
-              Requirement Levels", BCP 14, RFC 2119, March 1997.
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 109]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   [PKIX]     Housley, R., Polk, W., Ford, W., and D. Solo, "Internet
-              X.509 Public Key Infrastructure Certificate and
-              Certificate Revocation List (CRL) Profile", RFC 3280,
-              April 2002.
-
-   [UDPENCAPS]
-              Huttunen, A., Swander, B., Volpe, V., DiBurro, L., and M.
-              Stenberg, "UDP Encapsulation of IPsec ESP Packets",
-              RFC 3948, January 2005.
-
-8.2.  Informative References
-
-   [AH]       Kent, S., "IP Authentication Header", RFC 4302,
-              December 2005.
-
-   [ARCHGUIDEPHIL]
-              Bush, R. and D. Meyer, "Some Internet Architectural
-              Guidelines and Philosophy", RFC 3439, December 2002.
-
-   [ARCHPRINC]
-              Carpenter, B., "Architectural Principles of the Internet",
-              RFC 1958, June 1996.
-
-   [DES]      American National Standards Institute, "American National
-              Standard for Information Systems-Data Link Encryption",
-              ANSI X3.106, 1983.
-
-   [DH]       Diffie, W. and M. Hellman, "New Directions in
-              Cryptography", IEEE Transactions on Information Theory,
-              V.IT-22 n. 6, June 1977.
-
-   [DHCP]     Droms, R., "Dynamic Host Configuration Protocol",
-              RFC 2131, March 1997.
-
-   [DIFFSERVARCH]
-              Blake, S., Black, D., Carlson, M., Davies, E., Wang, Z.,
-              and W. Weiss, "An Architecture for Differentiated
-              Services", RFC 2475.
-
-   [DIFFSERVFIELD]
-              Nichols, K., Blake, S., Baker, F., and D. Black,
-              "Definition of the Differentiated Services Field (DS
-              Field) in the IPv4 and IPv6 Headers", RFC 2474,
-              December 1998.
-
-   [DIFFTUNNEL]
-              Black, D., "Differentiated Services and Tunnels",
-              RFC 2983, October 2000.
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 110]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   [DOI]      Piper, D., "The Internet IP Security Domain of
-              Interpretation for ISAKMP", RFC 2407, November 1998.
-
-   [DOSUDPPROT]
-              C. Kaufman, R. Perlman, and B. Sommerfeld, "DoS protection
-              for UDP-based protocols", ACM Conference on Computer and
-              Communications Security , October 2003.
-
-   [DSS]      National Institute of Standards and Technology, U.S.
-              Department of Commerce, "Digital Signature Standard",
-              FIPS 186, May 1994.
-
-   [EAPMITM]  N. Asokan, V. Nierni, and K. Nyberg, "Man-in-the-Middle in
-              Tunneled Authentication Protocols", November 2002,
-              <http://eprint.iacr.org/2002/163>.
-
-   [ESP]      Kent, S., "IP Encapsulating Security Payload (ESP)",
-              RFC 4303, December 2005.
-
-   [EXCHANGEANALYSIS]
-              R. Perlman and C. Kaufman, "Analysis of the IPsec key
-              exchange Standard", WET-ICE Security Conference, MIT ,
-              2001,
-              <http://sec.femto.org/wetice-2001/papers/radia-paper.pdf>.
-
-   [H2HIPSEC]
-              Aura, T., Roe, M., and A. Mohammed, "Experiences with
-              Host-to-Host IPsec", 13th International Workshop on
-              Security Protocols, Cambridge, UK, April 2005.
-
-   [HMAC]     Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
-              Hashing for Message Authentication", RFC 2104,
-              February 1997.
-
-   [IDEA]     X. Lai, "On the Design and Security of Block Ciphers", ETH
-              Series in Information Processing, v. 1, Konstanz: Hartung-
-              Gorre Verlag, 1992.
-
-   [IKEV1]    Harkins, D. and D. Carrel, "The Internet Key Exchange
-              (IKE)", RFC 2409, November 1998.
-
-   [IPCOMP]   Shacham, A., Monsour, B., Pereira, R., and M. Thomas, "IP
-              Payload Compression Protocol (IPComp)", RFC 3173,
-              September 2001.
-
-   [IPSECARCH-OLD]
-              Kent, S. and R. Atkinson, "Security Architecture for the
-              Internet Protocol", RFC 2401, November 1998.
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 111]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   [IPV6ADDR]
-              Hinden, R. and S. Deering, "Internet Protocol Version 6
-              (IPv6) Addressing Architecture", RFC 3513, April 2003.
-
-   [ISAKMP]   Maughan, D., Schneider, M., and M. Schertler, "Internet
-              Security Association and Key Management Protocol
-              (ISAKMP)", RFC 2408, November 1998.
-
-   [LDAP]     Wahl, M., Howes, T., and S. Kille, "Lightweight Directory
-              Access Protocol (v3)", RFC 2251, December 1997.
-
-   [MAILFORMAT]
-              Resnick, P., "Internet Message Format", RFC 2822,
-              April 2001.
-
-   [MD5]      Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321,
-              April 1992.
-
-   [MIPV6]    Johnson, D., Perkins, C., and J. Arkko, "Mobility Support
-              in IPv6", RFC 3775, June 2004.
-
-   [MLDV2]    Vida, R. and L. Costa, "Multicast Listener Discovery
-              Version 2 (MLDv2) for IPv6", RFC 3810, June 2004.
-
-   [NAI]      Aboba, B. and M. Beadles, "The Network Access Identifier",
-              RFC 2486, January 1999.
-
-   [NATREQ]   Aboba, B. and W. Dixon, "IPsec-Network Address Translation
-              (NAT) Compatibility Requirements", RFC 3715, March 2004.
-
-   [OAKLEY]   Orman, H., "The OAKLEY Key Determination Protocol",
-              RFC 2412, November 1998.
-
-   [PFKEY]    McDonald, D., Metz, C., and B. Phan, "PF_KEY Key
-              Management API, Version 2", RFC 2367, July 1998.
-
-   [PHOTURIS]
-              Karn, P. and W. Simpson, "Photuris: Session-Key Management
-              Protocol", RFC 2522, March 1999.
-
-   [PKCS1]    B. Kaliski and J. Staddon, "PKCS #1: RSA Cryptography
-              Specifications Version 2", September 1998.
-
-   [PRFAES128CBC]
-              Hoffman, P., "The AES-XCBC-PRF-128 Algorithm for the
-              Internet Key Exchange Protocol (IKE)", RFC 3664,
-              January 2004.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 112]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   [PRFAES128CBC-bis]
-              Hoffman, P., "The AES-XCBC-PRF-128 Algorithm for the
-              Internet Key Exchange Protocol (IKE)",
-              draft-hoffman-rfc3664bis (work in progress), October 2005.
-
-   [RADIUS]   Rigney, C., Rubens, A., Simpson, W., and S. Willens,
-              "Remote Authentication Dial In User Service (RADIUS)",
-              RFC 2138, April 1997.
-
-   [RANDOMNESS]
-              Eastlake, D., Schiller, J., and S. Crocker, "Randomness
-              Requirements for Security", BCP 106, RFC 4086, June 2005.
-
-   [REAUTH]   Nir, Y., ""Repeated Authentication in IKEv2",
-              draft-nir-ikev2-auth-lt (work in progress), May 2005.
-
-   [RSA]      R. Rivest, A. Shamir, and L. Adleman, "A Method for
-              Obtaining Digital Signatures and Public-Key
-              Cryptosystems", February 1978.
-
-   [SHA]      National Institute of Standards and Technology, U.S.
-              Department of Commerce, "Secure Hash Standard",
-              FIPS 180-1, May 1994.
-
-   [SIGMA]    H. Krawczyk, "SIGMA: the `SIGn-and-MAc' Approach to
-              Authenticated Diffie-Hellman and its Use in the IKE
-              Protocols", Advances in Cryptography - CRYPTO 2003
-              Proceedings LNCS 2729, 2003, <http://
-              www.informatik.uni-trier.de/~ley/db/conf/crypto/
-              crypto2003.html>.
-
-   [SKEME]    H. Krawczyk, "SKEME: A Versatile Secure Key Exchange
-              Mechanism for Internet", IEEE Proceedings of the 1996
-              Symposium on Network and Distributed Systems Security ,
-              1996.
-
-   [TRANSPARENCY]
-              Carpenter, B., "Internet Transparency", RFC 2775,
-              February 2000.
-
-   [X.501]    ITU-T, "Recommendation X.501: Information Technology -
-              Open Systems Interconnection - The Directory: Models",
-              1993.
-
-   [X.509]    ITU-T, "Recommendation X.509 (1997 E): Information
-              Technology - Open Systems Interconnection - The Directory:
-              Authentication Framework", 1997.
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 113]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-Appendix A.  Summary of changes from IKEv1
-
-   The goals of this revision to IKE are:
-
-   1.   To define the entire IKE protocol in a single document,
-        replacing RFCs 2407, 2408, and 2409 and incorporating subsequent
-        changes to support NAT Traversal, Extensible Authentication, and
-        Remote Address acquisition;
-
-   2.   To simplify IKE by replacing the eight different initial
-        exchanges with a single four-message exchange (with changes in
-        authentication mechanisms affecting only a single AUTH payload
-        rather than restructuring the entire exchange) see
-        [EXCHANGEANALYSIS];
-
-   3.   To remove the Domain of Interpretation (DOI), Situation (SIT),
-        and Labeled Domain Identifier fields, and the Commit and
-        Authentication only bits;
-
-   4.   To decrease IKE's latency in the common case by making the
-        initial exchange be 2 round trips (4 messages), and allowing the
-        ability to piggyback setup of a CHILD_SA on that exchange;
-
-   5.   To replace the cryptographic syntax for protecting the IKE
-        messages themselves with one based closely on ESP to simplify
-        implementation and security analysis;
-
-   6.   To reduce the number of possible error states by making the
-        protocol reliable (all messages are acknowledged) and sequenced.
-        This allows shortening CREATE_CHILD_SA exchanges from 3 messages
-        to 2;
-
-   7.   To increase robustness by allowing the responder to not do
-        significant processing until it receives a message proving that
-        the initiator can receive messages at its claimed IP address,
-        and not commit any state to an exchange until the initiator can
-        be cryptographically authenticated;
-
-   8.   To fix cryptographic weaknesses such as the problem with
-        symmetries in hashes used for authentication documented by Tero
-        Kivinen;
-
-   9.   To specify Traffic Selectors in their own payloads type rather
-        than overloading ID payloads, and making more flexible the
-        Traffic Selectors that may be specified;
-
-   10.  To specify required behavior under certain error conditions or
-        when data that is not understood is received in order to make it
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 114]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-        easier to make future revisions in a way that does not break
-        backwards compatibility;
-
-   11.  To simplify and clarify how shared state is maintained in the
-        presence of network failures and Denial of Service attacks; and
-
-   12.  To maintain existing syntax and magic numbers to the extent
-        possible to make it likely that implementations of IKEv1 can be
-        enhanced to support IKEv2 with minimum effort.
-
-
-Appendix B.  Diffie-Hellman Groups
-
-   There are two Diffie-Hellman groups defined here for use in IKE.
-   These groups were generated by Richard Schroeppel at the University
-   of Arizona.  Properties of these primes are described in [OAKLEY].
-
-   The strength supplied by group one may not be sufficient for the
-   mandatory-to-implement encryption algorithm and is here for historic
-   reasons.
-
-   Additional Diffie-Hellman groups have been defined in [ADDGROUP].
-
-B.1.  Group 1 - 768 Bit MODP
-
-   This group is assigned id 1 (one).
-
-   The prime is: 2^768 - 2 ^704 - 1 + 2^64 * { [2^638 pi] + 149686 }
-   Its hexadecimal value is:
-
-   FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
-   29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
-   EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
-   E485B576 625E7EC6 F44C42E9 A63A3620 FFFFFFFF FFFFFFFF
-
-   The generator is 2.
-
-B.2.  Group 2 - 1024 Bit MODP
-
-   This group is assigned id 2 (two).
-
-
-
-
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 115]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   The prime is 2^1024 - 2^960 - 1 + 2^64 * { [2^894 pi] + 129093 }.
-   Its hexadecimal value is:
-
-   FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
-   29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
-   EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
-   E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
-   EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE65381
-   FFFFFFFF FFFFFFFF
-
-   The generator is 2.
-
-
-Appendix C.  Exchanges and Payloads
-
-   {{ Clarif-AppA }}
-
-   This appendix contains a short summary of the IKEv2 exchanges, and
-   what payloads can appear in which message.  This appendix is purely
-   informative; if it disagrees with the body of this document, the
-   other text is considered correct.
-
-   Vendor-ID (V) payloads may be included in any place in any message.
-   This sequence here shows what are the most logical places for them.
-
-C.1.  IKE_SA_INIT Exchange
-
-   request             --> [N(COOKIE)],
-                           SA, KE, Ni,
-                           [N(NAT_DETECTION_SOURCE_IP)+,
-                            N(NAT_DETECTION_DESTINATION_IP)],
-                           [V+]
-
-   normal response     <-- SA, KE, Nr,
-   (no cookie)             [N(NAT_DETECTION_SOURCE_IP),
-                            N(NAT_DETECTION_DESTINATION_IP)],
-                           [[N(HTTP_CERT_LOOKUP_SUPPORTED)], CERTREQ+],
-                           [V+]
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 116]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-C.2.  IKE_AUTH Exchange without EAP
-
-   request             --> IDi, [CERT+],
-                           [N(INITIAL_CONTACT)],
-                           [[N(HTTP_CERT_LOOKUP_SUPPORTED)], CERTREQ+],
-                           [IDr],
-                           AUTH,
-                           [CP(CFG_REQUEST)],
-                           [N(IPCOMP_SUPPORTED)+],
-                           [N(USE_TRANSPORT_MODE)],
-                           [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
-                           [N(NON_FIRST_FRAGMENTS_ALSO)],
-                           SA, TSi, TSr,
-                           [V+]
-
-   response            <-- IDr, [CERT+],
-                           AUTH,
-                           [CP(CFG_REPLY)],
-                           [N(IPCOMP_SUPPORTED)],
-                           [N(USE_TRANSPORT_MODE)],
-                           [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
-                           [N(NON_FIRST_FRAGMENTS_ALSO)],
-                           SA, TSi, TSr,
-                           [N(ADDITIONAL_TS_POSSIBLE)],
-                           [V+]
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 117]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-C.3.  IKE_AUTH Exchange with EAP
-
-   first request       --> IDi,
-                           [N(INITIAL_CONTACT)],
-                           [[N(HTTP_CERT_LOOKUP_SUPPORTED)], CERTREQ+],
-                           [IDr],
-                           [CP(CFG_REQUEST)],
-                           [N(IPCOMP_SUPPORTED)+],
-                           [N(USE_TRANSPORT_MODE)],
-                           [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
-                           [N(NON_FIRST_FRAGMENTS_ALSO)],
-                           SA, TSi, TSr,
-                           [V+]
-
-   first response      <-- IDr, [CERT+], AUTH,
-                           EAP,
-                           [V+]
-
-                     / --> EAP
-   repeat 1..N times |
-                     \ <-- EAP
-
-   last request        --> AUTH
-
-   last response       <-- AUTH,
-                           [CP(CFG_REPLY)],
-                           [N(IPCOMP_SUPPORTED)],
-                           [N(USE_TRANSPORT_MODE)],
-                           [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
-                           [N(NON_FIRST_FRAGMENTS_ALSO)],
-                           SA, TSi, TSr,
-                           [N(ADDITIONAL_TS_POSSIBLE)],
-                           [V+]
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 118]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-C.4.  CREATE_CHILD_SA Exchange for Creating or Rekeying CHILD_SAs
-
-   request             --> [N(REKEY_SA)],
-                           [N(IPCOMP_SUPPORTED)+],
-                           [N(USE_TRANSPORT_MODE)],
-                           [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
-                           [N(NON_FIRST_FRAGMENTS_ALSO)],
-                           SA, Ni, [KEi], TSi, TSr
-
-   response            <-- [N(IPCOMP_SUPPORTED)],
-                           [N(USE_TRANSPORT_MODE)],
-                           [N(ESP_TFC_PADDING_NOT_SUPPORTED)],
-                           [N(NON_FIRST_FRAGMENTS_ALSO)],
-                           SA, Nr, [KEr], TSi, TSr,
-                           [N(ADDITIONAL_TS_POSSIBLE)]
-
-C.5.  CREATE_CHILD_SA Exchange for Rekeying the IKE_SA
-
-   request             --> SA, Ni, [KEi]
-
-   response            <-- SA, Nr, [KEr]
-
-C.6.  INFORMATIONAL Exchange
-
-   request             --> [N+],
-                           [D+],
-                           [CP(CFG_REQUEST)]
-
-   response            <-- [N+],
-                           [D+],
-                           [CP(CFG_REPLY)]
-
-
-Appendix D.  Changes Between Internet Draft Versions
-
-   This section will be removed before publication as an RFC.
-
-D.1.  Changes from IKEv2 to draft -00
-
-   There were a zillion additions from the Clarifications document.
-   These are noted with "{{ Clarif-nn }}".  The numbers used in the text
-   of this version are based on
-   draft-eronen-ipsec-ikev2-clarifications-08.txt, which has different
-   numbers than earlier versions of that draft.
-
-   Cleaned up many of the figures.  Made the table headings consistent.
-   Made some tables easier to read by removing blank spaces.  Removed
-   the "reserved to IANA" and "private use" text wording and moved it
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 119]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   into the tables.
-
-   Changed many SHOULD requirements to better match RFC 2119.  These are
-   also marked with comments such as "{{ Demoted the SHOULD }}".
-
-   In Section 2.16, changed the MUST requirement of authenticating the
-   responder from "public key signature based" to "strong" because that
-   is what most current IKEv2 implementations do, and it better matches
-   the actual security requirement.
-
-
-Authors' Addresses
-
-   Charlie Kaufman
-   Microsoft
-   1 Microsoft Way
-   Redmond, WA  98052
-   US
-
-   Phone: 1-425-707-3335
-   Email: charliek@microsoft.com
-
-
-   Paul Hoffman
-   VPN Consortium
-   127 Segre Place
-   Santa Cruz, CA  95060
-   US
-
-   Phone: 1-831-426-9827
-   Email: paul.hoffman@vpnc.org
-
-
-   Pasi Eronen
-   Nokia Research Center
-   P.O. Box 407
-   FIN-00045 Nokia Group
-   Finland
-
-   Email: pasi.eronen@nokia.com
-
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society (2006).
-
-   This document is subject to the rights, licenses and restrictions
-   contained in BCP 78, and except as set forth therein, the authors
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 120]
-
-Internet-Draft                  IKEv2bis                   February 2006
-
-
-   retain all their rights.
-
-   This document and the information contained herein are provided on an
-   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
-   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
-   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
-   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
-   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
-   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-
-Intellectual Property
-
-   The IETF takes no position regarding the validity or scope of any
-   Intellectual Property Rights or other rights that might be claimed to
-   pertain to the implementation or use of the technology described in
-   this document or the extent to which any license under such rights
-   might or might not be available; nor does it represent that it has
-   made any independent effort to identify any such rights.  Information
-   on the procedures with respect to rights in RFC documents can be
-   found in BCP 78 and BCP 79.
-
-   Copies of IPR disclosures made to the IETF Secretariat and any
-   assurances of licenses to be made available, or the result of an
-   attempt made to obtain a general license or permission for the use of
-   such proprietary rights by implementers or users of this
-   specification can be obtained from the IETF on-line IPR repository at
-   http://www.ietf.org/ipr.
-
-   The IETF invites any interested party to bring to its attention any
-   copyrights, patents or patent applications, or other proprietary
-   rights that may cover technology that may be required to implement
-   this standard.  Please address the information to the IETF at
-   ietf-ipr@ietf.org.
-
-
-Acknowledgment
-
-   Funding for the RFC Editor function is currently provided by the
-   Internet Society.
-
-
-
-
-
-
-
-
-
-
-
-Kaufman, et al.          Expires August 27, 2006              [Page 121]
-
diff --git a/doc/ikev2/[IPsecArch] - Security Architecture for the Internet Protocol.txt b/doc/ikev2/[IPsecArch] - Security Architecture for the Internet Protocol.txt
deleted file mode 100644
index 863ffe3ff..000000000
--- a/doc/ikev2/[IPsecArch] - Security Architecture for the Internet Protocol.txt
+++ /dev/null
@@ -1,5657 +0,0 @@
-Network Working Group                                            S. Kent
-Internet Draft                                                    K. Seo
-draft-ietf-ipsec-rfc2401bis-06.txt                      BBN Technologies
-Obsoletes: RFC 2401                                           March 2005
-Expires September 2005
-
-
-
-
-
-
-
-            Security Architecture for the Internet Protocol
-
-
-
-      Dedicated to the memory of Charlie Lynn, a long time senior
-      colleague at BBN, who made very significant contributions to
-                          the IPsec documents.
-
-
-
-Status of this Memo
-
-   By submitting this Internet-Draft, I certify that any applicable
-   patent or other IPR claims of which I am aware have been disclosed,
-   and any of which I become aware will be disclosed, in accordance with
-   RFC 3668.
-
-   This document is an Internet Draft and is subject to all provisions
-   of Section 10 of RFC2026. Internet-Drafts are working documents of
-   the Internet Engineering Task Force (IETF), its areas, and its
-   working groups. Note that other groups may also distribute working
-   documents as Internet-Drafts. Internet-Drafts are draft documents
-   valid for a maximum of six months and may be updated, replaced, or
-   obsoleted by other documents at any time.  It is inappropriate to use
-   Internet-Drafts as reference material or to cite them other than as
-   "work in progress". The list of current Internet-Drafts can be
-   accessed at http://www.ietf.org/1id-abstracts.html.  The list of
-   Internet-Draft Shadow Directories can be accessed at
-   http://www.ietf.org/shadow.html.
-
-   Copyright (C) The Internet Society (2005).  All Rights Reserved.
-
-Abstract
-
-   This document describes an updated version of the "Security
-   Architecture for IP", which is designed to provide security services
-   for traffic at the IP layer. This document obsoletes RFC 2401
-   (November 1998).
-
-   Comments should be sent to Stephen Kent (kent@bbn.com).  [RFC Editor:
-   Please remove this line prior to publication as an RFC.]
-
-
-
-Kent & Seo                                                      [Page 1]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-Table of Contents
-1. Introduction........................................................4
-    1.1 Summary of Contents of Document................................4
-    1.2 Audience.......................................................4
-    1.3 Related Documents..............................................5
-2. Design Objectives...................................................5
-    2.1 Goals/Objectives/Requirements/Problem Description..............5
-    2.2 Caveats and Assumptions........................................6
-3. System Overview ....................................................7
-    3.1 What IPsec Does................................................7
-    3.2 How IPsec Works................................................9
-    3.3 Where IPsec Can Be Implemented................................10
-4. Security Associations..............................................11
-    4.1 Definition and Scope..........................................11
-    4.2 SA Functionality..............................................16
-    4.3 Combining SAs.................................................17
-    4.4 Major IPsec Databases.........................................17
-       4.4.1 The Security Policy Database (SPD).......................19
-          4.4.1.1 Selectors...........................................25
-          4.4.1.2 Structure of an SPD entry...........................29
-          4.4.1.3 More re: Fields Associated with Next Layer
-                  Protocols...........................................31
-       4.4.2 Security Association Database (SAD)......................33
-          4.4.2.1 Data Items in the SAD...............................34
-          4.4.2.2 Relationship between SPD, PFP flag, packet, and SAD.36
-       4.4.3 Peer Authorization Database (PAD)........................41
-          4.4.3.1 PAD Entry IDs and Matching Rules....................42
-          4.4.3.2 IKE Peer Authentication Data........................43
-          4.4.3.3 Child SA Authorization Data.........................44
-          4.4.3.4 How the PAD Is Used.................................44
-    4.5 SA and Key Management.........................................45
-       4.5.1 Manual Techniques........................................46
-       4.5.2 Automated SA and Key Management..........................46
-       4.5.3 Locating a Security Gateway..............................47
-    4.6 SAs and Multicast.............................................48
-5. IP Traffic Processing..............................................48
-    5.1 Outbound IP Traffic Processing (protected-to-unprotected).....49
-       5.1.1 Handling an Outbound Packet That Must Be Discarded.......52
-       5.1.2 Header Construction for Tunnel Mode......................53
-          5.1.2.1 IPv4 -- Header Construction for Tunnel Mode.........55
-          5.1.2.2 IPv6 -- Header Construction for Tunnel Mode.........56
-    5.2 Processing Inbound IP Traffic (unprotected-to-protected)......57
-6. ICMP Processing ...................................................61
-    6.1 Processing ICMP Error Messages Directed to an IPsec
-                   Implementation.....................................61
-       6.1.1 ICMP Error Messages Received on the Unprotected
-                   Side of the Boundary...............................61
-       6.1.2 ICMP Error Messages Received on the Protected
-                   Side of the Boundary...............................62
-
-
-Kent & Seo                                                      [Page 2]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-    6.2 Processing Protected, Transit ICMP Error Messages.............62
-7. Handling Fragments (on the protected side of the IPsec boundary)...64
-    7.1 Tunnel Mode SAs that Carry Initial and Non-Initial Fragments..65
-    7.2 Separate Tunnel Mode SAs for Non-Initial Fragments............65
-    7.3 Stateful Fragment Checking....................................66
-    7.4 BYPASS/DISCARD traffic........................................66
-8. Path MTU/DF Processing.............................................67
-    8.1 DF Bit........................................................67
-    8.2 Path MTU (PMTU) Discovery.....................................67
-       8.2.1 Propagation of PMTU......................................68
-       8.2.2 PMTU Aging...............................................68
-9. Auditing...........................................................69
-10. Conformance Requirements..........................................69
-11. Security Considerations...........................................69
-12. IANA Considerations...............................................70
-13. Differences from RFC 2401.........................................70
-Acknowledgements......................................................73
-Appendix A -- Glossary................................................74
-Appendix B -- Decorrelation...........................................77
-Appendix C -- ASN.1 for an SPD Entry..................................80
-Appendix D -- Fragment Handling Rationale.............................86
-    D.1 Transport Mode and Fragments..................................86
-    D.2 Tunnel Mode and Fragments.....................................87
-    D.3 The Problem of Non-Initial Fragments..........................88
-    D.4 BYPASS/DISCARD traffic........................................91
-    D.5 Just say no to ports?.........................................91
-    D.6 Other Suggested Solutions.....................................92
-    D.7 Consistency...................................................93
-    D.8 Conclusions...................................................93
-Appendix E -- Example of Supporting Nested SAs via SPD and Forwarding
-                    Table Entries.....................................94
-References............................................................96
-Author Information....................................................99
-Notices..............................................................100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                      [Page 3]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-1. Introduction
-
-1.1 Summary of Contents of Document
-
-   This document specifies the base architecture for IPsec compliant
-   systems.  It describes how to provide a set of security services for
-   traffic at the IP layer, in both the IPv4 [Pos81a] and IPv6 [DH98]
-   environments.  This document describes the requirements for systems
-   that implement IPsec, the fundamental elements of such systems, and
-   how the elements fit together and fit into the IP environment.  It
-   also describes the security services offered by the IPsec protocols,
-   and how these services can be employed in the IP environment.  This
-   document does not address all aspects of the IPsec architecture.
-   Other documents address additional architectural details in
-   specialized environments, e.g., use of IPsec in Network Address
-   Translation (NAT) environments and more comprehensive support for IP
-   multicast.  The fundamental components of the IPsec security
-   architecture are discussed in terms of their underlying, required
-   functionality.  Additional RFCs (see Section 1.3 for pointers to
-   other documents) define the protocols in (a), (c), and (d).
-
-        a. Security Protocols -- Authentication Header (AH) and
-           Encapsulating Security Payload (ESP)
-        b. Security Associations -- what they are and how they work,
-           how they are managed, associated processing
-        c. Key Management -- manual and automated (The Internet Key
-           Exchange (IKE))
-        d. Cryptographic algorithms for authentication and encryption
-
-   This document is not a Security Architecture for the Internet; it
-   addresses security only at the IP layer, provided through the use of
-   a combination of cryptographic and protocol security mechanisms.
-
-   The spelling "IPsec" is preferred and used throughout this and all
-   related IPsec standards.  All other capitalizations of IPsec (e.g.,
-   IPSEC, IPSec, ipsec) are deprecated. However, any capitalization of
-   the sequence of letters "IPsec" should be understood to refer to the
-   IPsec protocols.
-
-   The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,
-   SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this
-   document, are to be interpreted as described in RFC 2119 [Bra97].
-
-1.2 Audience
-
-   The target audience for this document is primarily individuals who
-   implement this IP security technology or who architect systems that
-   will use this technology.  Technically adept users of this technology
-   (end users or system administrators) also are part of the target
-
-
-Kent & Seo                                                      [Page 4]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   audience.  A glossary is provided in Appendix A to help fill in gaps
-   in background/vocabulary.  This document assumes that the reader is
-   familiar with the Internet Protocol (IP), related networking
-   technology, and general information system security terms and
-   concepts.
-
-1.3 Related Documents
-
-   As mentioned above, other documents provide detailed definitions of
-   some of the components of IPsec and of their inter-relationship.
-   They include RFCs on the following topics:
-
-        a. security protocols -- RFCs describing the Authentication
-           Header (AH) [Ken05b] and Encapsulating Security Payload
-          (ESP) [Ken05a] protocols.
-        b. cryptographic algorithms for integrity and encryption - one
-           RFC that defines the mandatory, default algorithms for use
-           with AH and ESP [Eas05], a similar RFC that defines the
-           mandatory algorithms for use with IKE v2 [Sch05] plus a
-           separate RFC for each cryptographic algorithm.
-        c. automatic key management -- RFCs on "The Internet Key
-           Exchange (IKE v2) Protocol" [Kau05] and "Cryptographic
-           Algorithms for use in the Internet Key Exchange Version 2"
-           [Sch05].
-
-
-2. Design Objectives
-
-2.1 Goals/Objectives/Requirements/Problem Description
-
-   IPsec is designed to provide interoperable, high quality,
-   cryptographically-based security for IPv4 and IPv6.  The set of
-   security services offered includes access control, connectionless
-   integrity, data origin authentication, detection and rejection of
-   replays (a form of partial sequence integrity), confidentiality (via
-   encryption), and limited traffic flow confidentiality.  These
-   services are provided at the IP layer, offering protection in a
-   standard fashion for all protocols that may be carried over IP
-   (including IP itself).
-
-   IPsec includes a specification for minimal firewall functionality,
-   since that is an essential aspect of access control at the IP layer.
-   Implementations are free to provide more sophisticated firewall
-   mechanisms, and to implement the IPsec-mandated functionality using
-   those more sophisticated mechanisms. (Note that interoperability may
-   suffer if additional firewall constraints on traffic flows are
-   imposed by an IPsec implementation but cannot be negotiated based on
-   the traffic selector features defined in this document and negotiated
-   via IKE v2.) The IPsec firewall function makes use of the
-
-
-Kent & Seo                                                      [Page 5]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   cryptographically-enforced authentication and integrity provided for
-   all IPsec traffic to offer better access control than could be
-   obtained through use of a firewall (one not privy to IPsec internal
-   parameters) plus separate cryptographic protection.
-
-   Most of the security services are provided through use of two traffic
-   security protocols, the Authentication Header (AH) and the
-   Encapsulating Security Payload (ESP), and through the use of
-   cryptographic key management procedures and protocols.  The set of
-   IPsec protocols employed in a context, and the ways in which they are
-   employed, will be determined by the users/administrators in that
-   context. It is the goal of the IPsec architecture to ensure that
-   compliant implementations include the services and management
-   interfaces needed to meet the security requirements of a broad user
-   population.
-
-   When IPsec is correctly implemented and deployed, it ought not
-   adversely affect users, hosts, and other Internet components that do
-   not employ IPsec for traffic protection.  IPsec security protocols
-   (AH & ESP, and to a lesser extent, IKE) are designed to be
-   cryptographic algorithm-independent.  This modularity permits
-   selection of different sets of cryptographic algorithms as
-   appropriate, without affecting the other parts of the implementation.
-   For example, different user communities may select different sets of
-   cryptographic algorithms (creating cryptographically-enforced
-   cliques) if required.
-
-   To facilitate interoperability in the global Internet, a set of
-   default cryptographic algorithms for use with AH and ESP is specified
-   in [Eas05] and a set of mandatory-to-implement algorithms for IKE v2
-   is specified in [Sch05].  [Eas05] and [Sch05] will be periodically
-   updated to keep pace with computational and cryptologic advances.  By
-   specifying these algorithms in documents that are separate from the
-   AH, ESP, and IKE v2 specifications, these algorithms can be updated
-   or replaced without affecting the standardization progress of the
-   rest of the IPsec document suite. The use of these cryptographic
-   algorithms, in conjunction with IPsec traffic protection and key
-   management protocols, is intended to permit system and application
-   developers to deploy high quality, Internet layer, cryptographic
-   security technology.
-
-2.2 Caveats and Assumptions
-
-   The suite of IPsec protocols and associated default cryptographic
-   algorithms are designed to provide high quality security for Internet
-   traffic.  However, the security offered by use of these protocols
-   ultimately depends on the quality of the their implementation, which
-   is outside the scope of this set of standards.  Moreover, the
-   security of a computer system or network is a function of many
-
-
-Kent & Seo                                                      [Page 6]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   factors, including personnel, physical, procedural, compromising
-   emanations, and computer security practices.  Thus IPsec is only one
-   part of an overall system security architecture.
-
-   Finally, the security afforded by the use of IPsec is critically
-   dependent on many aspects of the operating environment in which the
-   IPsec implementation executes.  For example, defects in OS security,
-   poor quality of random number sources, sloppy system management
-   protocols and practices, etc. can all degrade the security provided
-   by IPsec.  As above, none of these environmental attributes are
-   within the scope of this or other IPsec standards.
-
-3. System Overview
-
-   This section provides a high level description of how IPsec works,
-   the components of the system, and how they fit together to provide
-   the security services noted above.  The goal of this description is
-   to enable the reader to "picture" the overall process/system, see how
-   it fits into the IP environment, and to provide context for later
-   sections of this document, which describe each of the components in
-   more detail.
-
-   An IPsec implementation operates in a host, as a security gateway, or
-   as an independent device, affording protection to IP traffic. (A
-   security gateway is an intermediate system implementing IPsec, e.g.,
-   a firewall or router that has been IPsec-enabled.) More detail on
-   these classes of implementations is provided later, in Section 3.3.
-   The protection offered by IPsec is based on requirements defined by a
-   Security Policy Database (SPD) established and maintained by a user
-   or system administrator, or by an application operating within
-   constraints established by either of the above.  In general, packets
-   are selected for one of three processing actions based on IP and next
-   layer header information (Selectors, Section 4.4.1.1) matched against
-   entries in the Security Policy Database (SPD).  Each packet is either
-   PROTECTed using IPsec security services, DISCARDed, or allowed to
-   BYPASS IPsec protection, based on the applicable SPD policies
-   identified by the Selectors.
-
-
-3.1 What IPsec Does
-
-   IPsec creates a boundary between unprotected and protected
-   interfaces, for a host or a network (see Figure 1 below). Traffic
-   traversing the boundary is subject to the access controls specified
-   by the user or administrator responsible for the IPsec configuration.
-   These controls indicate whether packets cross the boundary unimpeded,
-   are afforded security services via AH or ESP, or are discarded. IPsec
-   security services are offered at the IP layer through selection of
-   appropriate security protocols, cryptographic algorithms, and
-
-
-Kent & Seo                                                      [Page 7]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   cryptographic keys.  IPsec can be used to protect one or more "paths"
-   (a) between a pair of hosts, (b) between a pair of security gateways,
-   or (c) between a security gateway and a host. A compliant host
-   implementation MUST support (a) and (c) and a compliant security
-   gateway must support all three of these forms of connectivity, since
-   under certain circumstances a security gateway acts as a host.
-
-                        Unprotected
-                         ^       ^
-                         |       |
-           +-------------|-------|-------+
-           | +-------+   |       |       |
-           | |Discard|<--|       V       |
-           | +-------+   |B  +--------+  |
-         ................|y..| AH/ESP |..... IPsec Boundary
-           |   +---+     |p  +--------+  |
-           |   |IKE|<----|a      ^       |
-           |   +---+     |s      |       |
-           | +-------+   |s      |       |
-           | |Discard|<--|       |       |
-           | +-------+   |       |       |
-           +-------------|-------|-------+
-                         |       |
-                         V       V
-                         Protected
-
-            Figure 1.  Top Level IPsec Processing Model
-
-
-   In this diagram, "unprotected" refers to an interface that might also
-   be described as "black" or "ciphertext." Here, "protected" refers to
-   an interface that might also be described as "red" or "plaintext."
-   The protected interface noted above may be internal, e.g., in a host
-   implementation of IPsec, the protected interface may link to a socket
-   layer interface presented by the OS. In this document, the term
-   "inbound" refers to traffic entering an IPsec implementation via the
-   unprotected interface or emitted by the implementation on the
-   unprotected side of the boundary and directed towards the protected
-   interface. The term "outbound" refers to traffic entering the
-   implementation via the protected interface, or emitted by the
-   implementation on the protected side of the boundary and directed
-   toward the unprotected interface.  An IPsec implementation may
-   support more than one interface on either or both sides of the
-   boundary.
-
-   Note the facilities for discarding traffic on either side of the
-   IPsec boundary, the BYPASS facility that allows traffic to transit
-   the boundary without cryptographic protection, and the reference to
-   IKE as a protected-side key and security management function.
-
-
-Kent & Seo                                                      [Page 8]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   IPsec optionally supports negotiation of IP compression [SMPT01],
-   motivated in part by the observation that when encryption is employed
-   within IPsec, it prevents effective compression by lower protocol
-   layers.
-
-3.2 How IPsec Works
-
-   IPsec uses two protocols to provide traffic security services --
-   Authentication Header (AH) and Encapsulating Security Payload (ESP).
-   Both protocols are described in detail in their respective RFCs
-   [Ken05b, Ken05a]. IPsec implementations MUST support ESP and MAY
-   support AH. (Support for AH has been downgraded to MAY because
-   experience has shown that there are very few contexts in which ESP
-   cannot provide the requisite security services. Note that ESP can be
-   used to provide only integrity, without confidentiality, making it
-   comparable to AH in most contexts.)
-
-    o The IP Authentication Header (AH) [Ken05b] offers integrity and
-      data origin authentication, with optional (at the discretion of
-      the receiver) anti-replay features.
-
-    o The Encapsulating Security Payload (ESP) protocol [Ken05a] offers
-      the same set of services, and also offers confidentiality. Use of
-      ESP to provide confidentiality without integrity is NOT
-      RECOMMENDED. When ESP is used with confidentiality enabled, there
-      are provisions for limited traffic flow confidentiality, i.e.,
-      provisions for concealing packet length, and for facilitating
-      efficient generation and discard of dummy packets. This capability
-      is likely to be effective primarily in VPN and overlay network
-      contexts.
-
-    o Both AH and ESP offer access control, enforced through the
-      distribution of cryptographic keys and the management of traffic
-      flows as dictated by the Security Policy Database (SPD, Section
-      4.4.1).
-
-   These protocols may be applied individually or in combination with
-   each other to provide IPv4 and IPv6 security services. However, most
-   security requirements can be met through the use of ESP by itself.
-   Each protocol supports two modes of use: transport mode and tunnel
-   mode.  In transport mode, AH and ESP provide protection primarily for
-   next layer protocols; in tunnel mode, AH and ESP are applied to
-   tunneled IP packets.  The differences between the two modes are
-   discussed in Section 4.1.
-
-   IPsec allows the user (or system administrator) to control the
-   granularity at which a security service is offered.  For example, one
-   can create a single encrypted tunnel to carry all the traffic between
-   two security gateways or a separate encrypted tunnel can be created
-
-
-Kent & Seo                                                      [Page 9]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   for each TCP connection between each pair of hosts communicating
-   across these gateways.  IPsec, through the SPD management paradigm,
-   incorporates facilities for specifying:
-
-    o which security protocol (AH or ESP) to employ, the mode (transport
-      or tunnel), security service options, what cryptographic
-      algorithms to use, and in what combinations to use the specified
-      protocols and services,
-
-    o the granularity at which protection should be applied.
-
-   Because most of the security services provided by IPsec require the
-   use of cryptographic keys, IPsec relies on a separate set of
-   mechanisms for putting these keys in place. This document requires
-   support for both manual and automated distribution of keys.  It
-   specifies a specific public-key based approach (IKE v2 [Kau05]) for
-   automated key management, but other automated key distribution
-   techniques MAY be used.
-
-   Note: This document mandates support for several features for which
-   support is available in IKE v2 but not in IKE v1, e.g., negotiation
-   of an SA representing ranges of local and remote ports or negotiation
-   of multiple SAs with the same selectors. Therefore this document
-   assumes use of IKE v2 or a key and security association management
-   system with comparable features.
-
-3.3 Where IPsec Can Be Implemented
-
-   There are many ways in which IPsec may be implemented in a host, or
-   in conjunction with a router or firewall to create a security
-   gateway, or as an independent security device.
-
-   a. IPsec may be integrated into the native IP stack.  This requires
-      access to the IP source code and is applicable to both hosts and
-      security gateways, although native host implementations benefit
-      the most from this strategy, as explained later (Section 4.4.1,
-      paragraph 6; Section 4.4.1.1, last paragraph).
-
-   b. In a "bump-in-the-stack" (BITS) implementation, IPsec is
-      implemented "underneath" an existing implementation of an IP
-      protocol stack, between the native IP and the local network
-      drivers.  Source code access for the IP stack is not required in
-      this context, making this implementation approach appropriate for
-      use with legacy systems.  This approach, when it is adopted, is
-      usually employed in hosts.
-
-   c. The use of a dedicated, inline security protocol processor is a
-      common design feature of systems used by the military, and of some
-      commercial systems as well.  It is sometimes referred to as a
-
-
-Kent & Seo                                                     [Page 10]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      "bump-in-the-wire" (BITW) implementation.  Such implementations
-      may be designed to serve either a host or a gateway.  Usually the
-      BITW device is itself IP addressable.  When supporting a single
-      host, it may be quite analogous to a BITS implementation, but in
-      supporting a router or firewall, it must operate like a security
-      gateway.
-
-   This document often talks in terms of use of IPsec by a host or a
-   security gateway, without regard to whether the implementation is
-   native, BITS or BITW. When the distinctions among these
-   implementation options are significant, the document makes reference
-   to specific implementation approaches.
-
-   A host implementation of IPsec may appear in devices that might not
-   be viewed as "hosts." For example, a router might employ IPsec to
-   protect routing protocols (e.g., BGP) and management functions (e.g.,
-   Telnet), without affecting subscriber traffic traversing the router.
-   A security gateway might employ separate IPsec implementations to
-   protect its management traffic and subscriber traffic. The
-   architecture described in this document is very flexible. For
-   example, a computer with a full-featured, compliant, native OS IPsec
-   implementation should be capable of being configured to protect
-   resident (host) applications and to provide security gateway
-   protection for traffic traversing the computer. Such configuration
-   would make use of the forwarding tables and the SPD selection
-   function described in Sections 5.1 and 5.2.
-
-4. Security Associations
-
-   This section defines Security Association management requirements for
-   all IPv6 implementations and for those IPv4 implementations that
-   implement AH, ESP, or both AH and ESP.  The concept of a "Security
-   Association" (SA) is fundamental to IPsec.  Both AH and ESP make use
-   of SAs and a major function of IKE is the establishment and
-   maintenance of SAs.  All implementations of AH or ESP MUST support
-   the concept of an SA as described below.  The remainder of this
-   section describes various aspects of SA management, defining required
-   characteristics for SA policy management and SA management
-   techniques.
-
-4.1 Definition and Scope
-
-   An SA is a simplex "connection" that affords security services to the
-   traffic carried by it.  Security services are afforded to an SA by
-   the use of AH, or ESP, but not both.  If both AH and ESP protection
-   are applied to a traffic stream, then two SAs must be created and
-   coordinated to effect protection through iterated application of the
-   security protocols.  To secure typical, bi-directional communication
-   between two IPsec-enabled systems, a pair of SAs (one in each
-
-
-Kent & Seo                                                     [Page 11]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   direction) is required. IKE explicitly creates SA pairs in
-   recognition of this common usage requirement.
-
-   For an SA used to carry unicast traffic, the SPI (Security Parameters
-   Index - see Appendix A and AH [Ken05b] and ESP [Ken05a]
-   specifications) by itself suffices to specify an SA. However, as a
-   local matter, an implementation may choose to use the SPI in
-   conjunction with the IPsec protocol type (AH or ESP) for SA
-   identification. If an IPsec implementation supports multicast, then
-   it MUST support multicast SAs using the algorithm below for mapping
-   inbound IPsec datagrams to SAs. Implementations that support only
-   unicast traffic need not implement this demultiplexing algorithm.
-
-   In many secure multicast architectures, e.g., [RFC3740], a central
-   Group Controller/Key Server unilaterally assigns the Group Security
-   Association's (GSA's) SPI.  This SPI assignment is not negotiated or
-   coordinated with the key management (e.g., IKE) subsystems that
-   reside in the individual end systems that constitute the group.
-   Consequently, it is possible that a GSA and a unicast SA can
-   simultaneously use the same SPI. A multicast-capable IPsec
-   implementation MUST correctly de-multiplex inbound traffic even in
-   the context of SPI collisions.
-
-   Each entry in the SA Database (SAD) (Section 4.4.2) must indicate
-   whether the SA lookup makes use of the destination IP address, or the
-   destination and source IP addresses, in addition to the SPI. For
-   multicast SAs, the protocol field is not employed for SA lookups. For
-   each inbound, IPsec-protected packet, an implementation must conduct
-   its search of the SAD such that it finds the entry that matches the
-   "longest" SA identifier. In this context, if two or more SAD entries
-   match based on the SPI value, then the entry that also matches based
-   on destination address, or destination and source address (as
-   indicated in the SAD entry) is the "longest" match. This implies a
-   logical ordering of the SAD search as follows:
-
-
-      1. Search the SAD for a match on the combination of SPI,
-         destination address, and source address. If an SAD entry
-         matches, then process the inbound packet with that
-         matching SAD entry. Otherwise, proceed to step 2.
-
-      2. Search the SAD for a match on both SPI and destination address.
-         If the SAD entry matches then process the inbound packet
-         with that matching SAD entry. Otherwise, proceed to step 3.
-
-      3. Search the SAD for a match on only SPI if the receiver has
-         chosen to maintain a single SPI space for AH and ESP, and on
-         both SPI  and protocol otherwise. If an SAD entry matches then
-         process the inbound packet with that matching SAD entry.
-
-
-Kent & Seo                                                     [Page 12]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-         Otherwise, discard the packet and log an auditable event.
-
-
-   In practice, an implementation may choose any method (or none at all)
-   to accelerate this search, although its externally visible behavior
-   MUST be functionally equivalent to having searched the SAD in the
-   above order. For example, a software-based implementation could index
-   into a hash table by the SPI. The SAD entries in each hash table
-   bucket's linked list could be kept sorted to have those SAD entries
-   with the longest SA identifiers first in that linked list. Those SAD
-   entries having the shortest SA identifiers could be sorted so that
-   they are the last entries in the linked list. A hardware-based
-   implementation may be able to effect the longest match search
-   intrinsically, using commonly available Ternary Content-Addressable
-   Memory (TCAM) features.
-
-   The indication of whether source and destination address matching is
-   required to map inbound IPsec traffic to SAs MUST be set either as a
-   side effect of manual SA configuration or via negotiation using an SA
-   management protocol, e.g., IKE or GDOI [RFC3547]. Typically,
-   Source-Specific Multicast (SSM) [HC03] groups use a 3-tuple SA
-   identifier composed of an SPI, a destination multicast address, and
-   source address. An Any-Source Multicast group SA requires only an SPI
-   and a destination multicast address as an identifier.
-
-   If different classes of traffic (distinguished by Differentiated
-   Services CodePoint (DSCP) bits [NiBlBaBL98], [Gro02]) are sent on the
-   same SA, and if the receiver is employing the optional anti-replay
-   feature available in both AH and ESP, this could result in
-   inappropriate discarding of lower priority packets due to the
-   windowing mechanism used by this feature.  Therefore a sender SHOULD
-   put traffic of different classes, but with the same selector values,
-   on different SAs to support QoS appropriately.  To permit this, the
-   IPsec implementation MUST permit establishment and maintenance of
-   multiple SAs between a given sender and receiver, with the same
-   selectors.  Distribution of traffic among these parallel SAs to
-   support QoS is locally determined by the sender and is not negotiated
-   by IKE. The receiver MUST process the packets from the different SAs
-   without prejudice. These requirements apply to both transport and
-   tunnel mode SAs. In the case of tunnel mode SAs, the DSCP values in
-   question appear in the inner IP header. In transport mode, the DSCP
-   value might change en route, but this should not cause problems with
-   respect to IPsec processing since the value is not employed for SA
-   selection and MUST NOT be checked as part of SA/packet validation.
-   However, if significant re-ordering of packets occurs in an SA, e.g.,
-   as a result of changes to DSCP values en route, this may trigger
-   packet discarding by a receiver due to application of the anti-replay
-   mechanism.
-
-
-
-Kent & Seo                                                     [Page 13]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   DISCUSSION: While the DSCP [NiBlBaBL98, Gro02] and Explicit
-   Congestion Notification (ECN) [RaFlBl01] fields are not "selectors",
-   as that term in used in this architecture, the sender will need a
-   mechanism to direct packets with a given (set of) DSCP values to the
-   appropriate SA.  This mechanism might be termed a "classifier".
-
-   As noted above, two types of SAs are defined: transport mode and
-   tunnel mode. IKE creates pairs of SAs, so for simplicity, we choose
-   to require that both SAs in a pair be of the same mode, transport or
-   tunnel.
-
-   A transport mode SA is an SA typically employed between a pair of
-   hosts to provide end-to-end security services. When security is
-   desired between two intermediate systems along a path (vs. end-to-end
-   use of IPsec), transport mode MAY be used between security gateways
-   or between a security gateway and a host.  In the case where
-   transport mode is used between security gateways or between a
-   security gateway and a host, transport mode may be used to support
-   in-IP tunneling (e.g., IP-in-IP [Per96] or GRE tunneling
-   [FaLiHaMeTr00] or Dynamic routing [ToEgWa04]) over transport mode
-   SAs. To clarify, the use of transport mode by an intermediate system
-   (e.g., a security gateway) is permitted only when applied to packets
-   whose source address (for outbound packets) or destination address
-   (for inbound packets) is an address belonging to the intermediate
-   system itself. The access control functions that are an important
-   part of IPsec are significantly limited in this context, as they
-   cannot be applied to the end-to-end headers of the packets that
-   traverse a transport mode SA used in this fashion. Thus this way of
-   using transport mode should be evaluated carefully before being
-   employed in a specific context.
-
-   In IPv4, a transport mode security protocol header appears
-   immediately after the IP header and any options, and before any next
-   layer protocols (e.g., TCP or UDP).  In IPv6, the security protocol
-   header appears after the base IP header and selected extension
-   headers, but may appear before or after destination options; it MUST
-   appear before next layer protocols (e.g., TCP, UDP, SCTP).  In the
-   case of ESP, a transport mode SA provides security services only for
-   these next layer protocols, not for the IP header or any extension
-   headers preceding the ESP header.  In the case of AH, the protection
-   is also extended to selected portions of the IP header preceding it,
-   selected portions of extension headers, and selected options
-   (contained in the IPv4 header, IPv6 Hop-by-Hop extension header, or
-   IPv6 Destination extension headers).  For more details on the
-   coverage afforded by AH, see the AH specification [Ken05b].
-
-   A tunnel mode SA is essentially an SA applied to an IP tunnel, with
-   the access controls applied to the headers of the traffic inside the
-   tunnel.  Two hosts MAY establish a tunnel mode SA between themselves.
-
-
-Kent & Seo                                                     [Page 14]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   Aside from the two exceptions below, whenever either end of a
-   security association is a security gateway, the SA MUST be tunnel
-   mode.  Thus an SA between two security gateways is typically a tunnel
-   mode SA, as is an SA between a host and a security gateway.  The two
-   exceptions are as follows.
-
-    o Where traffic is destined for a security gateway, e.g., SNMP
-      commands, the security gateway is acting as a host and transport
-      mode is allowed.  In this case, the SA terminates at a host
-      (management) function within a security gateway and thus merits
-      different treatment.
-
-    o As noted above, security gateways MAY support a transport mode SA
-      to provide security for IP traffic between two intermediate
-      systems along a path, e.g., between a host and a security gateway
-      or between two security gateways.
-
-   Several concerns motivate the use of tunnel mode for an SA involving
-   a security gateway. For example, if there are multiple paths (e.g.,
-   via different security gateways) to the same destination behind a
-   security gateway, it is important that an IPsec packet be sent to the
-   security gateway with which the SA was negotiated.  Similarly, a
-   packet that might be fragmented en-route must have all the fragments
-   delivered to the same IPsec instance for reassembly prior to
-   cryptographic processing. Also, when a fragment is processed by IPsec
-   and transmitted, then fragmented en-route, it is critical that there
-   be inner and outer headers to retain the fragmentation state data for
-   the pre- and post-IPsec packet formats. Hence there are several
-   reasons for employing tunnel mode when either end of an SA is a
-   security gateway. (Use of an IP-in-IP tunnel in conjunction with
-   transport mode can also address these fragmentation issues. However,
-   this configuration limits the ability of IPsec to enforce access
-   control policies on traffic.)
-
-   Note: AH and ESP cannot be applied using transport mode to IPv4
-   packets that are fragments. Only tunnel mode can be employed in such
-   cases. For IPv6, it would be feasible to carry a plaintext fragment
-   on a transport mode SA; however, for simplicity, this restriction
-   also applies to IPv6 packets.  See Section 7 for more details on
-   handling plaintext fragments on the protected side of the IPsec
-   barrier.
-
-   For a tunnel mode SA, there is an "outer" IP header that specifies
-   the IPsec processing source and destination, plus an "inner" IP
-   header that specifies the (apparently) ultimate source and
-   destination for the packet. The security protocol header appears
-   after the outer IP header, and before the inner IP header.  If AH is
-   employed in tunnel mode, portions of the outer IP header are afforded
-   protection (as above), as well as all of the tunneled IP packet
-
-
-Kent & Seo                                                     [Page 15]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   (i.e., all of the inner IP header is protected, as well as next layer
-   protocols).  If ESP is employed, the protection is afforded only to
-   the tunneled packet, not to the outer header.
-
-   In summary,
-
-   a) A host implementation of IPsec MUST support both transport and
-      tunnel mode. This is true for native, BITS, and BITW
-      implementations for hosts.
-
-   b) A security gateway MUST support tunnel mode and MAY support
-      transport mode.  If it supports transport mode, that should be
-      used only when the security gateway is acting as a host, e.g., for
-      network management, or to provide security between two
-      intermediate systems along a path.
-
-4.2 SA Functionality
-
-   The set of security services offered by an SA depends on the security
-   protocol selected, the SA mode, the endpoints of the SA, and on the
-   election of optional services within the protocol.
-
-   For example, both AH and ESP offer integrity and authentication
-   services, but the coverage differs for each protocol and differs for
-   transport vs. tunnel mode. If the integrity of an IPv4 option or IPv6
-   extension header must be protected en-route between sender and
-   receiver, AH can provide this service, except for IP or extension
-   headers that may change in a fashion not predictable by the sender.
-   However, the same security may be achieved in some contexts by
-   applying ESP to a tunnel carrying a packet.
-
-   The granularity of access control provided is determined by the
-   choice of the selectors that define each SA. Moreover, the
-   authentication means employed by IPsec peers, e.g., during creation
-   of an IKE (vs. child) SA also effects the granularity of the access
-   control afforded.
-
-   If confidentiality is selected, then an ESP (tunnel mode) SA between
-   two security gateways can offer partial traffic flow confidentiality.
-   The use of tunnel mode allows the inner IP headers to be encrypted,
-   concealing the identities of the (ultimate) traffic source and
-   destination.  Moreover, ESP payload padding also can be invoked to
-   hide the size of the packets, further concealing the external
-   characteristics of the traffic. Similar traffic flow confidentiality
-   services may be offered when a mobile user is assigned a dynamic IP
-   address in a dialup context, and establishes a (tunnel mode) ESP SA
-   to a corporate firewall (acting as a security gateway).  Note that
-   fine granularity SAs generally are more vulnerable to traffic
-   analysis than coarse granularity ones that are carrying traffic from
-
-
-Kent & Seo                                                     [Page 16]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   many subscribers.
-
-   Note: A compliant implementation MUST NOT allow instantiation of an
-   ESP SA that employs both NULL encryption and no integrity algorithm.
-   An attempt to negotiate such an SA is an auditable event by both
-   initiator and responder. The audit log entry for this event SHOULD
-   include the current date/time, local IKE IP address, and remote IKE
-   IP address.  The initiator SHOULD record the relevant SPD entry.
-
-4.3 Combining SAs
-
-   This document does not require support for nested security
-   associations or for what RFC 2401 called "SA bundles." These features
-   still can be effected by appropriate configuration of both the SPD
-   and the local forwarding functions (for inbound and outbound
-   traffic), but this capability is outside of the IPsec module and thus
-   the scope of this specification. As a result, management of
-   nested/bundled SAs is potentially more complex and less assured than
-   under the model implied by RFC 2401. An implementation that provides
-   support for nested SAs SHOULD provide a management interface that
-   enables a user or administrator to express the nesting requirement,
-   and then create the appropriate SPD entries and forwarding table
-   entries to effect the requisite processing. (See Appendix E for an
-   example of how to configure nested SAs.)
-
-4.4 Major IPsec Databases
-
-   Many of the details associated with processing IP traffic in an IPsec
-   implementation are largely a local matter, not subject to
-   standardization.  However, some external aspects of the processing
-   must be standardized to ensure interoperability and to provide a
-   minimum management capability that is essential for productive use of
-   IPsec.  This section describes a general model for processing IP
-   traffic relative to IPsec functionality, in support of these
-   interoperability and functionality goals.  The model described below
-   is nominal; implementations need not match details of this model as
-   presented, but the external behavior of implementations MUST
-   correspond to the externally observable characteristics of this model
-   in order to be compliant.
-
-   There are three nominal databases in this model: the Security Policy
-   Database (SPD), the Security Association Database (SAD), and the Peer
-   Authorization Database (PAD).  The first specifies the policies that
-   determine the disposition of all IP traffic inbound or outbound from
-   a host or security gateway (Section 4.4.1).  The second database
-   contains parameters that are associated with each established (keyed)
-   SA (Section 4.4.2). The third database, the Peer Authorization
-   Database (PAD) provides a link between an SA management protocol like
-   IKE and the SPD (Section 4.4.3).
-
-
-Kent & Seo                                                     [Page 17]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   Multiple Separate IPsec Contexts
-
-      If an IPsec implementation acts as a security gateway for multiple
-      subscribers, it MAY implement multiple separate IPsec contexts.
-      Each context MAY have and MAY use completely independent
-      identities, policies, key management SAs, and/or IPsec SAs.  This
-      is for the most part a local implementation matter. However, a
-      means for associating inbound (SA) proposals with local contexts
-      is required.  To this end, if supported by the key management
-      protocol in use, context identifiers MAY be conveyed from
-      initiator to responder in the signaling messages, with the result
-      that IPsec SAs are created with a binding to a particular context.
-      For example, a security gateway that provides VPN service to
-      multiple customers will be able to associate each customer's
-      traffic with the correct VPN.
-
-   Forwarding vs Security Decisions
-
-      The IPsec model described here embodies a clear separation between
-      forwarding (routing) and security decisions, to accommodate a wide
-      range of contexts where IPsec may be employed. Forwarding may be
-      trivial, in the case where there are only two interfaces, or it
-      may be complex, e.g., if the context in which IPsec is implemented
-      employs a sophisticated forwarding function. IPsec assumes only
-      that outbound and inbound traffic that has passed through IPsec
-      processing is forwarded in a fashion consistent with the context
-      in which IPsec is implemented. Support for nested SAs is optional;
-      if required, it requires coordination between forwarding tables
-      and SPD entries to cause a packet to traverse the IPsec boundary
-      more than once.
-
-   "Local" vs "Remote"
-
-      In this document, with respect to IP addresses and ports, the
-      terms "Local" and "Remote" are used for policy rules.  "Local"
-      refers to the entity being protected by an IPsec implementation,
-      i.e., the "source" address/port of outbound packets or the
-      "destination" address/port of inbound packets. "Remote" refers to
-      a peer entity or peer entities.  The terms "source" and
-      "destination" are used for packet header fields.
-
-   "Non-initial" vs "Initial" Fragments
-
-      Throughout this document, the phrase "non-initial" fragments is
-      used to mean fragments that do not contain all of the selector
-      values that may be needed for access control (e.g., they might not
-      contain Next Layer Protocol, source and destination ports, ICMP
-      message type/code, Mobility Header type). And the phrase "initial"
-      fragment is used to mean a fragment that contains all the selector
-
-
-Kent & Seo                                                     [Page 18]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      values needed for access control. However, it should be noted that
-      for IPv6, which fragment contains the Next Layer Protocol and
-      ports (or ICMP message type/code or Mobility Header type) will
-      depend on the kind and number of extension headers present.  The
-      "initial" fragment might not be the first fragment, in this
-      context.
-
-4.4.1 The Security Policy Database (SPD)
-
-   An SA is a management construct used to enforce security policy for
-   traffic crossing the IPsec boundary. Thus an essential element of SA
-   processing is an underlying Security Policy Database (SPD) that
-   specifies what services are to be offered to IP datagrams and in what
-   fashion.  The form of the database and its interface are outside the
-   scope of this specification.  However, this section specifies minimum
-   management functionality that must be provided, to allow a user or
-   system administrator to control whether and how IPsec is applied to
-   traffic transmitted or received by a host or transiting a security
-   gateway.  The SPD, or relevant caches, must be consulted during the
-   processing of all traffic (inbound and outbound), including traffic
-   not protected by IPsec, that traverses the IPsec boundary.  This
-   includes IPsec management traffic such as IKE.  An IPsec
-   implementation MUST have at least one SPD, and it MAY support
-   multiple SPDs, if appropriate for the context in which the IPsec
-   implementation operates. There is no requirement to maintain SPDs on
-   a per interface basis, as was specified in RFC 2401. However, if an
-   implementation supports multiple SPDs, then it MUST include an
-   explicit SPD selection function, that is invoked to select the
-   appropriate SPD for outbound traffic processing. The inputs to this
-   function are the outbound packet and any local metadata (e.g., the
-   interface via which the packet arrived) required to effect the SPD
-   selection function. The output of the function is an SPD identifier
-   (SPD-ID).
-
-   The SPD is an ordered database, consistent with the use of ACLs or
-   packet filters in firewalls, routers, etc. The ordering requirement
-   arises because entries often will overlap due to the presence of
-   (non-trivial) ranges as values for selectors.  Thus a user or
-   administrator MUST be able to order the entries to express a desired
-   access control policy. There is no way to impose a general, canonical
-   order on SPD entries, because of the allowed use of wildcards for
-   selector values and because the different types of selectors are not
-   hierarchically related.
-
-   Processing Choices:  DISCARD, BYPASS, PROTECT
-
-      An SPD must discriminate among traffic that is afforded IPsec
-      protection and traffic that is allowed to bypass IPsec. This
-      applies to the IPsec protection to be applied by a sender and to
-
-
-Kent & Seo                                                     [Page 19]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      the IPsec protection that must be present at the receiver.  For
-      any outbound or inbound datagram, three processing choices are
-      possible: DISCARD, BYPASS IPsec, or PROTECT using IPsec.  The
-      first choice refers to traffic that is not allowed to traverse the
-      IPsec boundary (in the specified direction).  The second choice
-      refers to traffic that is allowed to cross the IPsec boundary
-      without IPsec protection.  The third choice refers to traffic that
-      is afforded IPsec protection, and for such traffic the SPD must
-      specify the security protocols to be employed, their mode,
-      security service options, and the cryptographic algorithms to be
-      used.
-
-   SPD-S, SPD-I, SPD-O
-
-      An SPD is logically divided into three pieces. The SPD-S (secure
-      traffic) contains entries for all traffic subject to IPsec
-      protection. SPD-O (outbound) contains entries for all outbound
-      traffic that is to be bypassed or discarded. SPD-I (inbound) is
-      applied to inbound traffic that will be bypassed or discarded. All
-      three of these can be decorrelated (with the exception noted above
-      for native host implementations) to facilitate caching.  If an
-      IPsec implementation supports only one SPD, then the SPD consists
-      of all three parts. If multiple SPDs are supported, some of them
-      may be partial, e.g., some SPDs might contain only SPD-I entries,
-      to control inbound bypassed traffic on a per-interface basis.  The
-      split allows SPD-I to be consulted without having to consult
-      SPD-S, for such traffic. Since the SPD-I is just a part of the
-      SPD, if a packet that is looked up in the SPD-I cannot be matched
-      to an entry there, then the packet MUST be discarded.  Note that
-      for outbound traffic, if a match is not found in SPD-S, then SPD-O
-      must be checked to see if the traffic should be bypassed.
-      Similarly, if SPD-O is checked first and no match is found, then
-      SPD-S must be checked. In an ordered, non-decorrelated SPD, the
-      entries for the SPD-S, SPD-I, and SPD-O are interleaved.  So there
-      is one look up in the SPD.
-
-   SPD entries
-
-      Each SPD entry specifies packet disposition as BYPASS, DISCARD, or
-      PROTECT. The entry is keyed by a list of one or more selectors.
-      The SPD contains an ordered list of these entries. The required
-      selector types are defined in Section 4.4.1.1. These selectors are
-      used to define the granularity of the SAs that are created in
-      response to an outbound packet or in response to a proposal from a
-      peer. The detailed structure of an SPD entry is described in
-      Section 4.4.1.2. Every SPD SHOULD have a nominal, final entry that
-      matches anything that is otherwise unmatched, and discards it.
-
-      The SPD MUST permit a user or administrator to specify policy
-
-
-Kent & Seo                                                     [Page 20]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      entries as follows:
-
-       - SPD-I: For inbound traffic that is to be bypassed or discarded,
-         the entry consists of the values of the selectors that apply to
-         the traffic to be bypassed or discarded.
-
-       - SPD-O: For outbound traffic that is to be bypassed or
-         discarded, the entry consists of the values of the selectors
-         that apply to the traffic to be bypassed or discarded.
-
-       - SPD-S: For traffic that is to be protected using IPsec, the
-         entry consists of the values of the selectors that apply to the
-         traffic to be protected via AH or ESP, controls on how to
-         create SAs based on these selectors, and the parameters needed
-         to effect this protection (e.g., algorithms, modes, etc.). Note
-         that an SPD-S entry also contains information such as "populate
-         from packet" (PFP) flag (see paragraphs below on "How To Derive
-         the Values for an SAD entry") and bits indicating whether the
-         SA lookup makes use of the local and remote IP addresses in
-         addition to the SPI (see AH [Ken05b] or ESP [Ken05a]
-         specifications).
-
-   Representing directionality in an SPD entry
-
-      For traffic protected by IPsec, the Local and Remote address and
-      ports in an SPD entry are swapped to represent directionality,
-      consistent with IKE conventions. In general, the protocols that
-      IPsec deals with have the property of requiring symmetric SAs with
-      flipped Local/Remote IP addresses. However, for ICMP, there is
-      often no such bi-directional authorization requirement.
-      Nonetheless, for the sake of uniformity and simplicity, SPD
-      entries for ICMP are specified in the same way as for other
-      protocols. Note also that for ICMP, Mobility Header, and
-      non-initial fragments, there are no port fields in these packets.
-      ICMP has message type and code and Mobility Header has mobility
-      header type. Thus SPD entries have provisions for expressing
-      access controls appropriate for these protocols, in lieu of the
-      normal port field controls. For bypassed or discarded traffic,
-      separate inbound and outbound entries are supported, e.g., to
-      permit unidirectional flows if required.
-
-   OPAQUE and ANY
-
-      For each selector in an SPD entry, in addition to the literal
-      values that define a match, there are two special values: ANY and
-      OPAQUE. ANY is a wildcard that matches any value in the
-      corresponding field of the packet, or that matches packets where
-      that field is not present or is obscured. OPAQUE indicates that
-      the corresponding selector field is not available for examination
-
-
-Kent & Seo                                                     [Page 21]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      because it may not be present in a fragment, does not exist for
-      the given Next Layer Protocol, or because prior application of
-      IPsec may have encrypted the value. The ANY value encompasses the
-      OPAQUE value. Thus OPAQUE need be used only when it is necessary
-      to distinguish between the case of any allowed value for a field,
-      vs. the absence or unavailability (e.g., due to encryption) of the
-      field.
-
-   How To Derive the Values for an SAD entry
-
-      For each selector in an SPD entry, the entry specifies how to
-      derive the corresponding values for a new SA Database (SAD, see
-      Section 4.4.2) entry from those in the SPD and the packet. The
-      goal is to allow an SAD entry and an SPD cache entry to be created
-      based on specific selector values from the packet, or from the
-      matching SPD entry. For outbound traffic, there are SPD-S cache
-      entries and SPD-O cache entries.  For inbound traffic not
-      protected by IPsec, there are SPD-I cache entries and there is the
-      SAD, which represents the cache for inbound IPsec-protected
-      traffic (See Section 4.4.2).  If IPsec processing is specified for
-      an entry, a "populate from packet" (PFP) flag may be asserted for
-      one or more of the selectors in the SPD entry (Local IP address;
-      Remote IP address; Next Layer Protocol; and, depending on Next
-      Layer Protocol, Local port and Remote port, or ICMP type/code, or
-      Mobility Header type).  If asserted for a given selector X, the
-      flag indicates that the SA to be created should take its value for
-      X from the value in the packet.  Otherwise, the SA should take its
-      value(s) for X from the value(s) in the SPD entry.  Note: In the
-      non-PFP case, the selector values negotiated by the SA management
-      protocol (e.g., IKE v2) may be a subset of those in the SPD entry,
-      depending on the SPD policy of the peer.  Also, whether a single
-      flag is used for, e.g., source port, ICMP type/code, and MH type,
-      or a separate flag is used for each, is a local matter.
-
-      The following example illustrates the use of the PFP flag in the
-      context of a security gateway or a BITS/BITW implementation.
-      Consider an SPD entry where the allowed value for Remote address
-      is a range of IPv4 addresses: 192.0.2.1 to 192.0.2.10. Suppose an
-      outbound packet arrives with a destination address of 192.0.2.3,
-      and there is no extant SA to carry this packet. The value used for
-      the SA created to transmit this packet could be either of the two
-      values shown below, depending on what the SPD entry for this
-      selector says is the source of the selector value:
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 22]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-          PFP flag value  example of new
-          for the Remote  SAD dest. address
-          addr. selector  selector value
-          --------------- ------------
-          a. PFP TRUE     192.0.2.3 (one host)
-          b. PFP FALSE    192.0.2.1 to 192.0.2.10 (range of hosts)
-
-      Note that if the SPD entry above had a value of ANY for the Remote
-      address, then the SAD selector value would have to be ANY for case
-      (b), but would still be as illustrated for case (a).  Thus the PFP
-      flag can be used to prohibit sharing of an SA, even among packets
-      that match the same SPD entry.
-
-   Management Interface
-
-      For every IPsec implementation, there MUST be a management
-      interface that allows a user or system administrator to manage the
-      SPD. The interface must allow the user (or administrator) to
-      specify the security processing to be applied to every packet that
-      traverses the IPsec boundary. (In a native host IPsec
-      implementation making use of a socket interface, the SPD may not
-      need to be consulted on a per packet basis, as noted above.)  The
-      management interface for the SPD MUST allow creation of entries
-      consistent with the selectors defined in Section 4.4.1.1, and MUST
-      support (total) ordering of these entries, as seen via this
-      interface. The SPD entries' selectors are analogous to the ACL or
-      packet filters commonly found in a stateless firewall or packet
-      filtering router and which are currently managed this way.
-
-      In host systems, applications MAY be allowed to create SPD
-      entries.  (The means of signaling such requests to the IPsec
-      implementation are outside the scope of this standard.)  However,
-      the system administrator MUST be able to specify whether or not a
-      user or application can override (default) system policies. The
-      form of the management interface is not specified by this document
-      and may differ for hosts vs. security gateways, and within hosts
-      the interface may differ for socket-based vs. BITS
-      implementations.  However, this document does specify a standard
-      set of SPD elements that all IPsec implementations MUST support.
-
-   Decorrelation
-
-      The processing model described in this document assumes the
-      ability to decorrelate overlapping SPD entries to permit caching,
-      which enables more efficient processing of outbound traffic in
-      security gateways and BITS/BITW implementations. Decorrelation
-      [CoSa04] is only a means of improving performance and simplifying
-      the processing description. This RFC does not require a compliant
-      implementation to make use of decorrelation. For example, native
-
-
-Kent & Seo                                                     [Page 23]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      host implementations typically make use of caching implicitly
-      because they bind SAs to socket interfaces, and thus there is no
-      requirement to be able to decorrelate SPD entries in these
-      implementations.
-
-      Note:  Unless otherwise qualified, the use of "SPD" refers to the
-      body of policy information in both ordered or decorrelated
-      (unordered) state.  Appendix B provides an algorithm that can be
-      used to decorrelate SPD entries, but any algorithm that produces
-      equivalent output may be used. Note that when an SPD entry is
-      decorrelated all the resulting entries MUST be linked together, so
-      that all members of the group derived from an individual, SPD
-      entry (prior to decorrelation) can all be placed into caches and
-      into the SAD at the same time.  For example, suppose one starts
-      with an entry A (from an ordered SPD) that when decorrelated,
-      yields entries A1, A2 and A3.  When a packet comes along that
-      matches, say A2, and triggers the creation of an SA, the SA
-      management protocol, e.g., IKE v2, negotiates A.  And all 3
-      decorrelated entries, A1, A2, and A3 are placed in the appropriate
-      SPD-S cache and linked to the SA. The intent is that use of a
-      decorrelated SPD ought not to create more SAs than would have
-      resulted from use of a not-decorrelated SPD.
-
-      If a decorrelated SPD is employed, there are three options for
-      what an initiator sends to a peer via an SA management protocol
-      (e.g., IKE). By sending the complete set of linked, decorrelated
-      entries that were selected from the SPD, a peer is given the best
-      possible information to enable selection of the appropriate SPD
-      entry at its end, especially if the peer has also decorrelated its
-      SPD. However, if a large number of decorrelated entries are
-      linked, this may create large packets for SA negotiation, and
-      hence fragmentation problems for the SA management protocol.
-
-      Alternatively, the original entry from the (correlated) SPD may be
-      retained and passed to the SA management protocol. Passing the
-      correlated SPD entry keeps the use of a decorrelated SPD a local
-      matter, not visible to peers, and avoids possible fragmentation
-      concerns, although it provides less precise info to a responder
-      for matching against the responder's SPD.
-
-      An intermediate approach is to send a subset of the complete set
-      of linked, decorrelated SPD entries. This approach can avoid the
-      fragmentation problems cited above and yet provide better
-      information than the original, correlated entry. The major
-      shortcoming of this approach is that it may cause additional SAs
-      to be created later, since only a subset of the linked,
-      decorrelated entries are sent to a peer. Implementers are free to
-      employ any of the approaches cited above.
-
-
-
-Kent & Seo                                                     [Page 24]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      A responder uses the traffic selector proposals it receives via an
-      SA management protocol to select an appropriate entry in its SPD.
-      The intent of the matching is to select an SPD entry and create an
-      SA that most closely matches the intent of the initiator, so that
-      traffic traversing the resulting SA will be accepted at both ends.
-      If the responder employs a decorrelated SPD, it SHOULD use the
-      decorrelated SPD entries for matching, as this will generally
-      result in creation of SAs that are more likely to match the intent
-      of both peers. If the responder has a correlated SPD, then it
-      SHOULD match the proposals against the correlated entries.  For
-      IKE v2, use of a decorrelated SPD  offers the best opportunity for
-      a responder to generate a "narrowed" response.
-
-      In all cases, when a decorrelated SPD is available, the
-      decorrelated entries are used to populate the SPD-S cache. If the
-      SPD is not decorrelated, caching is not allowed and an ordered
-      search of SPD MUST be performed to verify that inbound traffic
-      arriving on an SA is consistent with the access control policy
-      expressed in the SPD.
-
-   Handling Changes to the SPD while the System is Running
-
-      If a change is made to the SPD while the system is running, a
-      check SHOULD be made of the effect of this change on extant SAs.
-      An implementation SHOULD check the impact of an SPD change on
-      extant SAs and SHOULD provide a user/administrator with a
-      mechanism for configuring what actions to take, e.g., delete an
-      affected SA, allow an affected SA to continue unchanged, etc.
-
-4.4.1.1  Selectors
-
-   An SA may be fine-grained or coarse-grained, depending on the
-   selectors used to define the set of traffic for the SA.  For example,
-   all traffic between two hosts may be carried via a single SA, and
-   afforded a uniform set of security services.  Alternatively, traffic
-   between a pair of hosts might be spread over multiple SAs, depending
-   on the applications being used (as defined by the Next Layer Protocol
-   and related fields, e.g., ports), with different security services
-   offered by different SAs.  Similarly, all traffic between a pair of
-   security gateways could be carried on a single SA, or one SA could be
-   assigned for each communicating host pair.  The following selector
-   parameters MUST be supported by all IPsec implementations to
-   facilitate control of SA granularity. Note that both Local and Remote
-   addresses should either be IPv4 or IPv6, but not a mix of address
-   types. Also, note that the Local/Remote port selectors (and ICMP
-   message type and code, and Mobility Header type) may be labeled as
-   OPAQUE to accommodate situations where these fields are inaccessible
-   due to packet fragmentation.
-
-
-
-Kent & Seo                                                     [Page 25]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      - Remote IP Address(es) (IPv4 or IPv6): this is a list of ranges
-        of IP addresses (unicast, broadcast (IPv4 only)). This structure
-        allows expression of a single IP address (via a trivial range),
-        or a list of addresses (each a trivial range), or a range of
-        addresses (low and high values, inclusive), as well as the most
-        generic form of a list of ranges.  Address ranges are used to
-        support more than one remote system sharing the same SA, e.g.,
-        behind a security gateway.
-
-      - Local IP Address(es) (IPv4 or IPv6): this is a list of ranges of
-        IP addresses (unicast, broadcast (IPv4 only)). This structure
-        allows expression of a single IP address (via a trivial range),
-        or a list of addresses (each a trivial range), or a range of
-        addresses (low and high values, inclusive), as well as the most
-        generic form of a list of ranges.  Address ranges are used to
-        support more than one source system sharing the same SA, e.g.,
-        behind a security gateway.  Local refers to the address(es)
-        being protected by this implementation (or policy entry).
-
-        Note: The SPD does not include support for multicast address
-        entries. To support multicast SAs, an implementation should make
-        use of a Group SPD (GSPD) as defined in [RFC3740]. GSPD entries
-        require a different structure, i.e., one cannot use of the
-        symmetric relationship associated with local and remote address
-        values for unicast SAs in a multicast context. Specifically,
-        outbound traffic directed to a multicast address on an SA would
-        not be received on a companion, inbound SA with the multicast
-        address as the source.
-
-      - Next Layer Protocol: Obtained from the IPv4 "Protocol" or the
-        IPv6 "Next Header" fields.  This is an individual protocol
-        number, ANY, or for IPv6 only, OPAQUE. The Next Layer Protocol
-        is whatever comes after any IP extension headers that are
-        present. To simplify locating the Next Layer Protocol, there
-        SHOULD be a mechanism for configuring which IPv6 extension
-        headers to skip.  The default configuration for which protocols
-        to skip SHOULD include the following protocols: 0 (Hop-by-hop
-        options), 43 (Routing Header), 44 (Fragmentation Header), and 60
-        (Destination Options).  Note: The default list does NOT include
-        51 (AH), or 50 (ESP).  From a selector lookup point of view,
-        IPsec treats AH and ESP as Next Layer Protocols.
-
-        Several additional selectors depend on the Next Layer Protocol
-        value:
-
-         * If the Next Layer Protocol uses two ports (e.g., TCP, UDP,
-           SCTP, ...), then there are selectors for Local and Remote
-           Ports. Each of these selectors has a list of ranges of
-           values. Note that the Local and Remote ports may not be
-
-
-Kent & Seo                                                     [Page 26]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-           available in the case of receipt of a fragmented packet or if
-           the port fields have been protected by IPsec (encrypted),
-           thus a value of OPAQUE also MUST be supported.  Note: In a
-           non-initial fragment, port values will not be available. If a
-           port selector specifies a value other than ANY or OPAQUE, it
-           cannot match packets that are non-initial fragments.  If the
-           SA requires a port value other than ANY or OPAQUE, an
-           arriving fragment without ports MUST be discarded. (See
-           Section 7 Handling Fragments.)
-
-         * If the Next Layer Protocol is a Mobility Header, then there
-           is a selector for IPv6 Mobility Header Message Type (MH type)
-           [Mobip].  This is an 8-bit value that identifies a particular
-           mobility message.  Note that the MH type may not be available
-           in the case of receipt of a fragmented packet. (See Section 7
-           Handling Fragments.) For IKE, the IPv6 mobility header
-           message type (MH type) is placed in the most significant
-           eight bits of the 16-bit local "port" selector.
-
-         * If the Next Layer Protocol value is ICMP then there is a
-           16-bit selector for the ICMP message type and code. The
-           message type is a single 8-bit value, which defines the type
-           of an ICMP message, or ANY. The ICMP code is a single 8-bit
-           value that defines a specific subtype for an ICMP message.
-           For IKE, the message type is placed in the most significant 8
-           bits of the 16-bit selector and the code is placed in the
-           least significant 8 bits. This 16-bit selector can contain a
-           single type and a range of codes, a single type and ANY code,
-           ANY type and ANY code. Given a policy entry with a range of
-           Types (T-start to T-end) and a range of Codes (C-start to
-           C-end), and an ICMP packet with Type t and Code c, an
-           implementation MUST test for a match using
-
-               (T-start*256) + C-start <= (t*256) + c <= (T-end*256) +
-               C-end
-
-           Note that the ICMP message type and code may not be available
-           in the case of receipt of a fragmented packet. (See Section 7
-           Handling Fragments.)
-
-      - Name:  This is not a selector like the others above.  It is not
-        acquired from a packet. A name may be used as a symbolic
-        identifier for an IPsec Local or Remote address. Named SPD
-        entries are used in two ways:
-
-         1. A named SPD entry is used by a responder (not an initiator)
-            in support of access control when an IP address would not be
-            appropriate for the Remote IP address selector, e.g., for
-            "road warriors."  The name used to match this field is
-
-
-Kent & Seo                                                     [Page 27]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-            communicated during the IKE negotiation in the ID payload.
-            In this context, the initiator's Source IP address (inner IP
-            header in tunnel mode) is bound to the Remote IP address in
-            the SAD entry created by the IKE negotiation. This address
-            overrides the Remote IP address value in the SPD, when the
-            SPD entry is selected in this fashion.  All IPsec
-            implementations MUST support this use of names.
-
-         2. A named SPD entry may be used by an initiator to identify a
-            user for whom an IPsec SA will be created (or for whom
-            traffic may be bypassed).  The initiator's IP source address
-            (from inner IP header in tunnel mode) is used to replace the
-            following if and when they are created:
-
-                    - local address in the SPD cache entry
-                    - local address in the outbound SAD entry
-                    - remote address in the inbound SAD entry
-
-            Support for this use is optional for multi-user, native host
-            implementations and not applicable to other implementations.
-            Note that this name is used only locally; it is not
-            communicated by the key management protocol.  Also, name
-            forms other than those used for case 1 above (responder) are
-            applicable in the initiator context (see below).
-
-         An SPD entry can contain both a name (or a list of names) and
-         also values for the Local or Remote IP address.
-
-         For case 1, responder, the identifiers employed in named SPD
-         entries are one of the following four types:
-
-                 a. a fully qualified user name string (email), e.g.,
-                    mozart@foo.example.com
-                    (this corresponds to ID_RFC822_ADDR in IKE v2)
-
-                 b. a fully qualified DNS name, e.g.,
-                    foo.example.com
-                    (this corresponds to ID_FQDN in IKE v2)
-
-                 c. X.500 distinguished name, e.g., [WaKiHo97],
-
-
-                    CN = Stephen T. Kent, O = BBN Technologies,
-                    SP = MA, C = US
-
-                    (this corresponds to ID_DER_ASN1_DN in IKE v2, after
-                    decoding)
-
-                 d. a byte string
-
-
-Kent & Seo                                                     [Page 28]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-                    (this corresponds to Key_ID in IKE v2)
-
-         For case 2, initiator, the identifiers employed in named SPD
-         entries are of type byte string.  They are likely to be Unix
-         UIDs, Windows security IDs or something similar, but could also
-         be a user name or account name. In all cases, this identifier
-         is only of local concern and is not transmitted.
-
-   The IPsec implementation context determines how selectors are used.
-   For example, a native host implementation typically makes use of a
-   socket interface.  When a new connection is established the SPD can
-   be consulted and an SA bound to the socket.  Thus traffic sent via
-   that socket need not result in additional lookups to the SPD (SPD-O
-   and SPD-S) cache.  In contrast, a BITS, BITW, or security gateway
-   implementation needs to look at each packet and perform an
-   SPD-O/SPD-S cache lookup based on the selectors.
-
-4.4.1.2  Structure of an SPD entry
-
-   This section contains a prose description of an SPD entry. Also,
-   Appendix C provides an example of an ASN.1 definition of an SPD
-   entry.
-
-   This text describes the SPD in a fashion that is intended to map
-   directly into IKE payloads to ensure that the policy required by SPD
-   entries can be negotiated through IKE. Unfortunately, the semantics
-   of the version of IKE v2 published concurrently with this document
-   [Kau05] do not align precisely with those defined for the SPD.
-   Specifically, IKE v2 does not enable negotiation of a single SA that
-   binds multiple pairs of local and remote addresses and ports to a
-   single SA. Instead, when multiple local and remote addresses and
-   ports are negotiated for an SA, IKE v2 treats these not as pairs, but
-   as (unordered) sets of local and remote values that can be
-   arbitrarily paired. Until IKE provides a facility that conveys the
-   semantics that are expressed in the SPD via selector sets (as
-   described below), users MUST NOT include multiple selector sets in a
-   single SPD entry unless the access control intent aligns with the IKE
-   "mix and match" semantics. An implementation MAY warn users, to alert
-   them to this problem if users create SPD entries with multiple
-   selector sets, the syntax of which indicates possible conflicts with
-   current IKE semantics.
-
-   The management GUI can offer the user other forms of data entry and
-   display, e.g., the option of using address prefixes as well as
-   ranges, and symbolic names for protocols, ports, etc. (Do not confuse
-   the use of symbolic names in a management interface with the SPD
-   selector "Name".) Note that Remote/Local apply only to IP addresses
-   and ports, not to ICMP message type/code or Mobility Header type.
-   Also, if the reserved, symbolic selector value OPAQUE or ANY is
-
-
-Kent & Seo                                                     [Page 29]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   employed for a given selector type, only that value may appear in the
-   list for that selector, and it must appear only once in the list for
-   that selector.  Note that ANY and OPAQUE are local syntax conventions
-   -- IKE v2 negotiates these values via the ranges indicated below:
-
-          ANY:     start = 0        end = <max>
-          OPAQUE:  start = <max>    end = 0
-
-   An SPD is an ordered list of entries each of which contains the
-   following fields.
-
-           o Name -- a list of IDs.  This quasi-selector is optional.
-             The forms that MUST be supported are described above in
-             Section 4.4.1.1 under "Name".
-
-           o PFP flags -- one per traffic selector. A given flag, e.g.,
-             for Next Layer Protocol, applies to the relevant selector
-             across all "selector sets" (see below) contained in an SPD
-             entry.  When creating an SA, each flag specifies for the
-             corresponding traffic selector whether to instantiate the
-             selector from the corresponding field in the packet that
-
-             triggered the creation of the SA or from the value(s) in
-             the corresponding SPD entry (see Section 4.4.1, "How To
-             Derive the Values for an SAD entry"). Whether a single
-             flag is used for, e.g., source port, ICMP type/code, and
-             MH type, or a separate flag is used for each, is a local
-             matter. There are PFP flags for:
-                - Local Address
-                - Remote Address
-                - Next Layer Protocol
-                - Local Port, or ICMP message type/code or Mobility
-                  Header type (depending on the next layer protocol)
-                - Remote Port, or ICMP message type/code or Mobility
-                  Header type (depending on the next layer protocol)
-
-           o One to N selector sets that correspond to the "condition"
-             for applying a particular IPsec action. Each selector set
-             contains:
-                - Local Address
-                - Remote Address
-                - Next Layer Protocol
-                - Local Port, or ICMP message type/code or Mobility
-                  Header type (depending on the next layer protocol)
-                - Remote Port, or ICMP message type/code or Mobility
-                  Header type (depending on the next layer protocol)
-
-             Note: The "next protocol" selector is an individual value
-             (unlike the local and remote IP addresses) in a selector
-
-
-Kent & Seo                                                     [Page 30]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-             set entry. This is consistent with how IKE v2 negotiates
-             the TS values for an SA. It also makes sense because one
-             may need to associate different port fields with different
-             protocols. It is possible to associate multiple protocols
-             (and ports) with a single SA by specifying multiple
-             selector sets for that SA.
-
-           o processing info -- which action is required -- PROTECT,
-             BYPASS, or DISCARD. There is just one action that goes with
-             all the selector sets, not a separate action for each set.
-             If the required processing is PROTECT, the entry contains
-             the following information.
-                - IPsec mode -- tunnel or transport
-                - (if tunnel mode) local tunnel address -- For a
-                  non-mobile host, if there is just one interface, this
-                  is straightforward; and if there are multiple
-                  interfaces, this must be statically configured. For a
-                  mobile host, the specification of the local address
-                  is handled externally to IPsec.
-                - (if tunnel mode) remote tunnel address -- There is no
-                  standard way to determine this. See 4.5.3 "Locating a
-                  Security Gateway".
-                - extended sequence number -- Is this SA using extended
-                  sequence numbers?
-                - stateful fragment checking -- Is this SA using
-                  stateful fragment checking (see Section 7 for more
-                  details)
-                - Bypass DF bit (T/F) -- applicable to tunnel mode SAs
-                - Bypass DSCP (T/F) or map to unprotected DSCP values
-                  (array) if needed to restrict bypass of DSCP values --
-                  applicable to tunnel mode SAs
-                - IPsec protocol -- AH or ESP
-                - algorithms -- which ones to use for AH, which ones to
-                  use for ESP, which ones to use for combined mode,
-                  ordered by decreasing priority
-
-   It is a local matter as to what information is kept with regard to
-   handling extant SAs when the SPD is changed.
-
-4.4.1.3 More re: Fields Associated with Next Layer Protocols
-
-   Additional selectors are often associated with fields in the Next
-   Layer Protocol header. A particular Next Layer Protocol can have
-   zero, one, or two selectors.  There may be situations where there
-   aren't both local and remote selectors for the fields that are
-   dependent on the Next Layer Protocol. The IPv6 Mobility Header has
-   only a Mobility Header message type. AH and ESP have no further
-   selector fields.  A system may be willing to send an ICMP message
-   type and code that it does not want to receive. In the descriptions
-
-
-Kent & Seo                                                     [Page 31]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   below, "port" is used to mean a field that is dependent on the Next
-   Layer Protocol.
-
-        A. If a Next Layer Protocol has no "port" selectors, then
-           the Local and Remote "port" selectors are set to OPAQUE in
-           the relevant SPD entry, e.g.,
-
-           Local's
-             next layer protocol = AH
-             "port" selector     = OPAQUE
-
-           Remote's
-             next layer protocol = AH
-             "port" selector     = OPAQUE
-
-        B. If a Next Layer Protocol has only one selector, e.g.,
-           Mobility Header type, then that field is placed in the
-           Local "port" selector in the relevant SPD entry, and the
-           Remote "port" selector is set to OPAQUE in the relevant
-           SPD entry, e.g.,
-
-           Local's
-             next layer protocol = Mobility Header
-             "port" selector     = Mobility Header message type
-
-           Remote's
-             next layer protocol = Mobility Header
-             "port" selector     = OPAQUE
-
-        C. If a system is willing to send traffic with a particular
-           "port" value but NOT receive traffic with that kind of
-           port value, the system's traffic selectors are set as
-           follows in the relevant SPD entry:
-
-           Local's
-             next layer protocol = ICMP
-             "port" selector     = <specific ICMP type & code>
-
-           Remote's
-             next layer protocol = ICMP
-             "port" selector     = OPAQUE
-
-        D. To indicate that a system is willing to receive traffic
-           with a particular "port" value but NOT send that kind of
-           traffic, the system's traffic selectors are set as follows
-           in the relevant SPD entry:
-
-           Local's
-             next layer protocol = ICMP
-
-
-Kent & Seo                                                     [Page 32]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-             "port" selector     = OPAQUE
-
-           Remote's
-             next layer protocol = ICMP
-             "port" selector     = <specific ICMP type & code>
-
-           For example, if a security gateway is willing to allow
-           systems behind it to send ICMP traceroutes, but is not
-           willing to let outside systems run ICMP traceroutes to
-           systems behind it, then the security gateway's traffic
-           selectors are set as follows in the relevant SPD entry:
-
-           Local's
-             next layer protocol = 1 (ICMPv4)
-             "port" selector     = 30 (traceroute)
-
-           Remote's
-             next layer protocol = 1 (ICMPv4)
-             "port" selector     = OPAQUE
-
-4.4.2 Security Association Database (SAD)
-
-   In each IPsec implementation there is a nominal Security Association
-   Database (SAD), in which each entry defines the parameters associated
-   with one SA.  Each SA has an entry in the SAD. For outbound
-   processing, each SAD entry is pointed to by entries in the SPD-S part
-   of the SPD cache. For inbound processing, for unicast SAs, the SPI is
-   used either alone to look up an SA, or the SPI may be used in
-   conjunction with the IPsec protocol type.  If an IPsec implementation
-   supports multicast, the SPI plus destination address, or SPI plus
-   destination and source addresses are used to look up the SA. (See
-   Section 4.1 for details on the algorithm that MUST be used for
-   mapping inbound IPsec datagrams to SAs.) The following parameters are
-   associated with each entry in the SAD.  They should all be present
-   except where otherwise noted, e.g., AH Authentication algorithm. This
-   description does not purport to be a MIB, only a specification of the
-   minimal data items required to support an SA in an IPsec
-   implementation.
-
-   For each of the selectors defined in Section 4.4.1.1, the entry for
-   an inbound SA in the SAD MUST be initially populated with the value
-   or values negotiated at the time the SA was created. (See Section
-   4.4.1, paragraph on  Handling Changes to the SPD while the System is
-   Running for guidance on the effect of SPD changes on extant SAs.) For
-   a receiver, these values are used to check that the header fields of
-   an inbound packet (after IPsec processing) match the selector values
-   negotiated for the SA. Thus, the SAD acts as a cache for checking the
-   selectors of inbound traffic arriving on SAs.  For the receiver, this
-   is part of verifying that a packet arriving on an SA is consistent
-
-
-Kent & Seo                                                     [Page 33]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   with the policy for the SA. (See Section 6 for rules for ICMP
-   messages.)  These fields can have the form of specific values,
-   ranges, ANY, or OPAQUE, as described in section 4.4.1.1, "Selectors."
-   Note also, that there are a couple of situations in which the SAD can
-   have entries for SAs that do not have corresponding entries in the
-   SPD. Since 2401bis does not mandate that the SAD be selectively
-   cleared when the SPD is changed, SAD entries can remain when the SPD
-   entries that created them are changed or deleted. Also, if a manually
-   keyed SA is created, there could be an SAD entry for this SA that
-   does not correspond to any SPD entry.
-
-   Note: The SAD can support multicast SAs, if manually configured. An
-   outbound multicast SA has the same structure as a unicast SA. The
-   source address is that of the sender and the destination address is
-   the multicast group address. An inbound, multicast SA must be
-   configured with the source addresses of each peer authorized to
-   transmit to the multicast SA in question. The SPI value for a
-   multicast SA is provided by a multicast group controller, not by the
-   receiver, as for a unicast SA. Because an SAD entry may be required
-   to accommodate multiple, individual IP source addresses that were
-   part of an SPD entry (for unicast SAs), the required facility for
-   inbound, multicast SAs is a feature already present in an IPsec
-   implementation. However, because the SPD has no provisions for
-   accommodating multicast entries, this document does not specify an
-   automated way to create an SAD entry for a multicast, inbound SA.
-   Only manually configured SAD entries can be created to accommodate
-   inbound, multicast traffic.
-
-4.4.2.1 Data Items in the SAD
-
-   The following data items MUST be in the SAD:
-
-    o Security Parameter Index (SPI): a 32-bit value selected by the
-      receiving end of an SA to uniquely identify the SA. In an SAD
-      entry for an outbound SA, the SPI is used to construct the
-      packet's AH or ESP header. In an SAD entry for an inbound SA, the
-      SPI is used to map traffic to the appropriate SA (see text on
-      unicast/multicast in Section 4.1).
-
-    o Sequence Number Counter: a 64-bit counter used to generate the
-      Sequence Number field in AH or ESP headers. 64-bit sequence
-      numbers are the default, but 32-bit sequence numbers are also
-      supported if negotiated.
-
-    o Sequence Counter Overflow: a flag indicating whether overflow of
-      the Sequence Number Counter should generate an auditable event and
-      prevent transmission of additional packets on the SA, or whether
-      rollover is permitted. The audit log entry for this event SHOULD
-      include the SPI value, current date/time, Local Address, Remote
-
-
-Kent & Seo                                                     [Page 34]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      Address, and the selectors from the relevant SAD entry.
-
-    o Anti-Replay Window: a 64-bit counter and a bit-map (or equivalent)
-      used to determine whether an inbound AH or ESP packet is a replay.
-
-      Note: If anti-replay has been disabled by the receiver for an SA,
-      e.g., in the case of a manually keyed SA, then the Anti-Replay
-      Window is ignored for the SA in question. 64-bit sequence numbers
-      are the default, but this counter size accommodates 32-bit
-      sequence numbers as well.
-
-    o AH Authentication algorithm, key, etc. This is required only if AH
-      is supported.
-
-    o ESP Encryption algorithm, key, mode, IV, etc. If a combined mode
-      algorithm is used, these fields will not be applicable.
-
-
-    o ESP integrity algorithm, keys, etc. If the integrity service is
-      not selected, these fields will not be applicable. If a combined
-      mode algorithm is used, these fields will not be applicable.
-
-
-    o ESP combined mode algorithms, key(s), etc. This data is used when
-      a combined mode (encryption and integrity) algorithm is used with
-      ESP. If a combined mode algorithm is not used, these fields are
-      not applicable.
-
-    o Lifetime of this SA: a time interval after which an SA must be
-      replaced with a new SA (and new SPI) or terminated, plus an
-      indication of which of these actions should occur.  This may be
-      expressed as a time or byte count, or a simultaneous use of both
-      with the first lifetime to expire taking precedence. A compliant
-      implementation MUST support both types of lifetimes, and MUST
-      support a simultaneous use of both.  If time is employed, and if
-      IKE employs X.509 certificates for SA establishment, the SA
-      lifetime must be constrained by the validity intervals of the
-      certificates, and the NextIssueDate of the CRLs used in the IKE
-      exchange for the SA.  Both initiator and responder are responsible
-      for constraining the SA lifetime in this fashion.  Note: The
-      details of how to handle the refreshing of keys when SAs expire is
-      a local matter.  However, one reasonable approach is:
-
-     (a) If byte count is used, then the implementation SHOULD count the
-         number of bytes to which the IPsec cryptographic algorithm is
-         applied.  For ESP, this is the encryption algorithm (including
-         Null encryption) and for AH, this is the authentication
-         algorithm.  This includes pad bytes, etc.  Note that
-         implementations MUST be able to handle having the counters at
-
-
-Kent & Seo                                                     [Page 35]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-         the ends of an SA get out of synch, e.g., because of packet
-         loss or because the implementations at each end of the SA
-         aren't doing things the same way.
-
-     (b) There SHOULD be two kinds of lifetime -- a soft lifetime that
-         warns the implementation to initiate action such as setting up
-         a replacement SA; and a hard lifetime when the current SA ends
-         and is destroyed.
-
-     (c) If the entire packet does not get delivered during the SAs
-         lifetime, the packet SHOULD be discarded.
-
-    o IPsec protocol mode: tunnel or transport.  Indicates which mode of
-      AH or ESP is applied to traffic on this SA.
-
-    o Stateful fragment checking flag. Indicates whether or not stateful
-      fragment checking applies to this SA.
-
-    o Bypass DF bit (T/F) - applicable to tunnel mode SAs where both
-      inner and outer headers are IPv4.
-
-    o DSCP values -- the set of DSCP values allowed for packets carried
-      over this SA. If no values are specified, no DSCP-specific
-      filtering is applied. If one or more values are specified, these
-      are used to select one SA among several that match the traffic
-      selectors for an outbound packet. Note that these values are NOT
-      checked against inbound traffic arriving on the SA.
-
-    o Bypass DSCP (T/F) or map to unprotected DSCP values (array) if
-      needed to restrict bypass of DSCP values - applicable to tunnel
-      mode SAs. This feature maps DSCP values from an inner header to
-      values in an outer header, e.g., to address covert channel
-      signaling concerns.
-
-    o Path MTU: any observed path MTU and aging variables.
-
-    o Tunnel header IP source and destination address - both addresses
-      must be either IPv4 or IPv6 addresses. The version implies the
-      type of IP header to be used.  Only used when the IPsec protocol
-      mode is tunnel.
-
-4.4.2.2 Relationship between SPD, PFP flag, packet, and SAD
-
-      For each selector, the following tables show the relationship
-      between the value in the SPD, the PFP flag, the value in the
-      triggering packet and the resulting value in the SAD.  Note that
-      the administrative interface for IPsec can use various syntactic
-      options to make it easier for the administrator to enter rules.
-      For example, although a list of ranges is what IKE v2 sends, it
-
-
-Kent & Seo                                                     [Page 36]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      might be clearer and less error prone for the user to enter a
-      single IP address or IP address prefix.
-
-                                        Value in
-                                        Triggering   Resulting SAD
-         Selector  SPD Entry        PFP Packet       Entry
-         --------  ---------------- --- ------------ --------------
-         loc addr  list of ranges    0  IP addr "S"  list of ranges
-                   ANY               0  IP addr "S"  ANY
-                   list of ranges    1  IP addr "S"  "S"
-                   ANY               1  IP addr "S"  "S"
-
-         rem addr  list of ranges    0  IP addr "D"  list of ranges
-                   ANY               0  IP addr "D"  ANY
-                   list of ranges    1  IP addr "D"  "D"
-                   ANY               1  IP addr "D"  "D"
-
-         protocol  list of prot's*   0  prot. "P"    list of prot's*
-                   ANY**             0  prot. "P"    ANY
-                   OPAQUE****        0  prot. "P"    OPAQUE
-
-                   list of prot's*   0  not avail.   discard packet
-                   ANY**             0  not avail.   ANY
-                   OPAQUE****        0  not avail.   OPAQUE
-
-                   list of prot's*   1  prot. "P"    "P"
-                   ANY**             1  prot. "P"    "P"
-                   OPAQUE****        1  prot. "P"    ***
-
-                   list of prot's*   1  not avail.   discard packet
-                   ANY**             1  not avail.   discard packet
-                   OPAQUE****        1  not avail.   ***
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 37]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      If the protocol is one that has two ports then there will be
-      selectors for both Local and Remote ports.
-
-                                        Value in
-                                        Triggering   Resulting SAD
-         Selector  SPD Entry        PFP Packet       Entry
-         --------  ---------------- --- ------------ --------------
-         loc port  list of ranges    0  src port "s" list of ranges
-                   ANY               0  src port "s" ANY
-                   OPAQUE            0  src port "s" OPAQUE
-
-                   list of ranges    0  not avail.   discard packet
-                   ANY               0  not avail.   ANY
-                   OPAQUE            0  not avail.   OPAQUE
-
-                   list of ranges    1  src port "s" "s"
-                   ANY               1  src port "s" "s"
-                   OPAQUE            1  src port "s" ***
-
-                   list of ranges    1  not avail.   discard packet
-                   ANY               1  not avail.   discard packet
-                   OPAQUE            1  not avail.   ***
-
-
-         rem port  list of ranges    0  dst port "d" list of ranges
-                   ANY               0  dst port "d" ANY
-                   OPAQUE            0  dst port "d" OPAQUE
-
-                   list of ranges    0  not avail.   discard packet
-                   ANY               0  not avail.   ANY
-                   OPAQUE            0  not avail.   OPAQUE
-
-                   list of ranges    1  dst port "d" "d"
-                   ANY               1  dst port "d" "d"
-                   OPAQUE            1  dst port "d" ***
-
-                   list of ranges    1  not avail.   discard packet
-                   ANY               1  not avail.   discard packet
-                   OPAQUE            1  not avail.   ***
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 38]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      If the protocol is mobility header then there will be a selector
-      for mh type.
-
-                                        Value in
-                                        Triggering   Resulting SAD
-         Selector  SPD Entry        PFP Packet       Entry
-         --------  ---------------- --- ------------ --------------
-         mh type   list of ranges    0  mh type "T"  list of ranges
-                   ANY               0  mh type "T"  ANY
-                   OPAQUE            0  mh type "T"  OPAQUE
-
-                   list of ranges    0  not avail.   discard packet
-                   ANY               0  not avail.   ANY
-                   OPAQUE            0  not avail.   OPAQUE
-
-                   list of ranges    1  mh type "T"  "T"
-                   ANY               1  mh type "T"  "T"
-                   OPAQUE            1  mh type "T"  ***
-
-                   list of ranges    1  not avail.   discard packet
-                   ANY               1  not avail.   discard packet
-                   OPAQUE            1  not avail.   ***
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 39]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      If the protocol is ICMP, then there will be a 16-bit selector for
-      ICMP type and ICMP code.  Note that the type and code are bound to
-      each other, i.e., the codes apply to the particular type. This
-      16-bit selector can contain a single type and a range of codes, a
-      single type and ANY code, and ANY type and ANY code.
-
-                                         Value in
-                                         Triggering   Resulting SAD
-         Selector   SPD Entry        PFP Packet       Entry
-         ---------  ---------------- --- ------------ --------------
-         ICMP type  a single type &   0  type "t" &   single type &
-         and code    range of codes        code "c"    range of codes
-                    a single type &   0  type "t" &   single type &
-                     ANY code              code "c"    ANY code
-                    ANY type & ANY    0  type "t" &   ANY type &
-                     code                  code "c"    ANY code
-                    OPAQUE            0  type "t" &   OPAQUE
-                                           code "c"
-
-                    a single type &   0  not avail.   discard packet
-                     range of codes
-                    a single type &   0  not avail.   discard packet
-                     ANY code
-                    ANY type &        0  not avail.   ANY type &
-                     ANY code                          ANY code
-                    OPAQUE            0  not avail.   OPAQUE
-
-                    a single type &   1  type "t" &   "t" and "c"
-                     range of codes        code "c"
-                    a single type &   1  type "t" &   "t" and "c"
-                     ANY code              code "c"
-                    ANY type &        1  type "t" &   "t" and "c"
-                     ANY code              code "c"
-                    OPAQUE            1  type "t" &   ***
-                                           code "c"
-
-                    a single type &   1  not avail.   discard packet
-                     range of codes
-                    a single type &   1  not avail.   discard packet
-                     ANY code
-                    ANY type &        1  not avail.   discard packet
-                     ANY code
-                    OPAQUE            1  not avail.   ***
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 40]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      If the name selector is used...
-
-                                         Value in
-                                         Triggering   Resulting SAD
-         Selector   SPD Entry        PFP Packet       Entry
-         ---------  ---------------- --- ------------ --------------
-         name       list of user or  N/A     N/A           N/A
-                    system names
-
-
-            * "List of protocols" is the information, not the way
-              that the SPD or SAD or IKv2 have to represent this
-              information.
-           ** 0 (zero) is used by IKE to indicate ANY for
-              protocol.
-          *** Use of PFP=1 with an OPAQUE value is an error and
-              SHOULD be prohibited by an IPsec implementation.
-         **** The protocol field cannot be OPAQUE in IPv4.  This
-              table entry applies only to IPv6.
-
-4.4.3 Peer Authorization Database (PAD)
-
-   The Peer Authorization Database (PAD) provides the link between the
-   SPD and a security association management protocol such as IKE. It
-   embodies several critical functions:
-
-        o identifies the peers or groups of peers that are authorized
-          to communicate with this IPsec entity
-        o specifies the protocol and method used to authenticate each
-          peer
-        o provides the authentication data for each peer
-        o constrains the types and values of IDs that can be asserted
-          by a peer with regard to child SA creation, to ensure that the
-          peer does not assert identities for lookup in the SPD that it
-          is not authorized to represent, when child SAs are created
-        o peer gateway location info, e.g., IP address(es) or DNS names,
-          MAY be included for peers that are known to be "behind" a
-          security gateway
-   The PAD provides these functions for an IKE peer when the peer acts
-   as either the initiator or the responder.
-
-   To perform these functions, the PAD contains an entry for each peer
-   or group of peers with which the IPsec entity will communicate. An
-   entry names an individual peer (a user, end system or security
-   gateway) or specifies a group of peers (using ID matching rules
-   defined below). The entry specifies the authentication protocol
-   (e.g., IKE v1, IKE v2, KINK) method used (e.g., certificates or pre-
-   shared secrets) and the authentication data (e.g., the pre-shared
-   secret or the trust anchor relative to which the peer's certificate
-
-
-Kent & Seo                                                     [Page 41]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   will be validated). For certificate-based authentication, the entry
-   also may provide information to assist in verifying the revocation
-   status of the peer, e.g., a pointer to a CRL repository or the name
-   of an OSCP server associated with the peer or with the trust anchor
-   associated with the peer.
-
-   Each entry also specifies whether the IKE ID payload will be used as
-   a symbolic name for SPD lookup, or whether the remote IP address
-   provided in traffic selector payloads will be used for SPD lookups
-   when child SAs are created.
-
-   Note that the PAD information MAY be used to support creation of more
-   than one tunnel mode SA at a time between two peers, e.g., two
-   tunnels to protect the same addresses/hosts, but with different
-   tunnel endpoints.
-
-4.4.3.1 PAD Entry IDs and Matching Rules
-
-   The PAD is an ordered database, where the order is defined by an
-   administrator (or a user in the case of a single-user end system).
-   Usually, the same administrator will be responsible for both the PAD
-   and SPD, since the two databases must be coordinated. The ordering
-   requirement for the PAD arises for the same reason as for the SPD,
-   i.e., because use of "star name" entries allows for overlaps in the
-   set of IKE IDs that could match a specific entry.
-
-   Six types of IDs are supported for entries in the PAD, consistent
-   with the symbolic name types and IP addresses used to identify SPD
-   entries. The ID for each entry acts as the index for the PAD, i.e.,
-   it is the value used to select an entry. All of these ID types can be
-   used to match IKE ID payload types. The six types are:
-           o DNS name (specific or partial)
-           o Distinguished Name (complete or sub-tree constrained)
-           o RFC822 email address (complete or partially qualified)
-           o IPv4 address (range)
-           o IPv6 address (range)
-           o Key ID (exact match only)
-
-   The first three name types can accommodate sub-tree matching as well
-   as exact matches. A DNS name may be fully qualified and thus match
-   exactly one name, e.g., foo.example.com. Alternatively, the name may
-   encompass a group of peers by being partially specified, e.g., the
-   string ".example.com" could be used to match any DNS name ending in
-   these two domain name components.
-
-   Similarly, a Distinguished Name may specify a complete DN to match
-   exactly one entry, e.g., CN = Stephen, O = BBN Technologies, SP = MA,
-   C = US. Alternatively, an entry may encompass a group of peers by
-   specifying a sub-tree, e.g., an entry of the form "C = US, SP = MA"
-
-
-Kent & Seo                                                     [Page 42]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   might be used to match all DNs that contain these two attributes as
-   the top two RDNs.
-
-   For an RFC822 e-mail addresses, the same options exist. A complete
-   address such as foo@example.com matches one entity, but a sub-tree
-   name such as "@example.com" could be used to match all the entities
-   with names ending in those two domain names to the right of the @.
-
-   The specific syntax used by an implementation to accommodate sub-tree
-   matching for distinguished names, domain names or RFC822 e-mail
-   addresses is a local matter. But, at a minimum, sub-tree matching of
-   the sort described above MUST be supported. (Substring matching
-   within a DN, DNS name or RFC822 address MAY be supported, but is not
-   required.)
-
-   For IPv4 and IPv6 addresses, the same address range syntax used for
-   SPD entries MUST be supported. This allows specification of an
-   individual address (via a trivial range), an address prefix (by
-   choosing a range that adheres to CIDR-style prefixes), or an
-   arbitrary address range.
-
-   The Key ID field is defined as an OCTET string in IKE. For this name
-   type, only exact match syntax MUST be supported (since there is no
-   explicit structure for this ID type. Additional matching functions
-   MAY be supported for this ID type.
-
-4.4.3.2 IKE Peer Authentication Data
-
-   Once an entry is located based on an ordered search of the PAD based
-   on ID field matching, it is necessary to verify the asserted
-   identity, i.e., to authenticate the asserted ID. For each PAD entry
-   there is an indication of the type of authentication to be performed.
-   This document requires support for two required authentication data
-   types:
-
-        - X.509 certificate
-        - pre-shared secret
-
-   For authentication based on an X.509 certificate, the PAD entry
-   contains a trust anchor via which the end entity (EE) certificate for
-   the peer must be verifiable, either directly or via a certificate
-   path. See RFC 3280 for the definition of a trust anchor. An entry
-   used with certificate-based authentication MAY include additional
-   data to facilitate certificate revocation status, e.g., a list of
-   appropriate OCSP responders or CRL repositories, and associated
-   authentication data. For authentication based on a pre-shared secret,
-   the PAD contains the pre-shared secret to be used by IKE.
-
-   This document does not require that the IKE ID asserted by a peer be
-
-
-Kent & Seo                                                     [Page 43]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   syntactically related to a specific field in an end entity
-   certificate that is employed to authenticate the identity of that
-   peer. However, it often will be appropriate to impose such a
-   requirement, e.g., when a single entry represents a set of peers each
-   of whom may have a distinct SPD entry. Thus implementations MUST
-   provide a means for an administrator to require a match between an
-   asserted IKE ID and the subject name or subject alt name in a
-   certificate. The former is applicable to IKE IDs expressed as
-   distinguished names; the latter is appropriate for DNS names, RFC822
-   e-mail addresses, and IP addresses. Since KEY ID is intended for
-   identifying a peer authenticated via a pre-shred secret, there is no
-   requirement to match this ID type to a certificate field.
-
-   See IKE v1 [HarCar98] and IKE v2 [Kau05] for details of how IKE
-   performs peer authentication using certificates or pre-shared
-   secrets.
-
-   This document does not mandate support for any other authentication
-   methods, although such methods MAY be employed.
-
-4.4.3.3 Child SA Authorization Data
-
-   Once an IKE peer is authenticated, child SAs may be created. Each PAD
-   entry contains data to constrain the set of IDs that can be asserted
-   by an IKE peer, for matching against the SPD. Each PAD entry
-   indicates whether the IKE ID is to be used as a symbolic name for SPD
-   matching, or whether an IP address asserted in a traffic selector
-   payload is to be used.
-
-   If the entry indicates that the IKE ID is to be used, then the PAD
-   entry ID field defines the authorized set of IDs. If the entry
-   indicates that child SAs traffic selectors are to be used, then an
-   additional data element is required, in the form of IPv4 and/or IPv6
-   address ranges. (A peer may be authorized for both address types, so
-   there MUST be provision for both a v4 and a v6 address range.)
-
-4.4.3.4 How the PAD Is Used
-
-   During the initial IKE exchange, the initiator and responder each
-   assert their identity via the IKE ID payload, and send an AUTH
-   payload to verify the asserted identity. One or more CERT payloads
-   may be transmitted to facilitate the verification of each asserted
-   identity.
-
-   When an IKE entity receives an IKE ID payload, it uses the asserted
-   ID to locate an entry in the PAD, using the matching rules described
-   above. The PAD entry specifies the authentication method to be
-   employed for the identified peer. This ensures that the right method
-   is used for each peer and that different methods can be used for
-
-
-Kent & Seo                                                     [Page 44]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   different peers. The entry also specifies the authentication data
-   that will be used to verify the asserted identity.  This data is
-   employed in conjunction with the specified method to authenticate the
-   peer, before any CHILD SAs are created.
-
-
-   Child SAs are created based on the exchange of traffic selector
-   payloads, either at the end of the initial IKE exchange, or in
-   subsequent CREATE_CHILD_SA exchanges. The PAD entry for the (now
-   authenticated) IKE peer is used to constrain creation of child SAs,
-   specifically the PAD entry specifies how the SPD is searched using a
-   traffic selector proposal from a peer. There are two choices: either
-   the IKE ID asserted by the peer is used to find an SPD entry via its
-   symbolic name, or peer IP addresses asserted in traffic selector
-   payloads are used for SPD lookups based on the remote IP address
-   field portion of an SPD entry. It is necessary to impose these
-   constraints on creation of child SAs, to prevent an authenticated
-   peer from spoofing IDs associated with other, legitimate peers.
-
-   Note that because the PAD is checked before searching for an SPD
-   entry, this safeguard protects an initiator against spoofing attacks.
-   For example, assume that IKE A receives an outbound packet destined
-   for IP address X, a host served by a security gateway. RFC 2401 and
-   2401bis do not specify how A determines the address of the IKE peer
-   serving X. However, any peer contacted by A as the presumed
-   representative for X must be registered in the PAD in order to allow
-   the IKE exchange to be authenticated. Moreover, when the
-   authenticated peer asserts that it represents X in its traffic
-   selector exchange, the PAD will be consulted to determine if the peer
-   in question is authorized to represent X. Thus the PAD provides a
-   binding of address ranges (or name sub-spaces) to peers, to counter
-   such attacks.
-
-
-4.5 SA and Key Management
-
-   All IPsec implementations MUST support both manual and automated SA
-   and cryptographic key management.  The IPsec protocols, AH and ESP,
-   are largely independent of the associated SA management techniques,
-   although the techniques involved do affect some of the security
-   services offered by the protocols. For example, the optional
-   anti-replay service available for AH and ESP requires automated SA
-   management.  Moreover, the granularity of key distribution employed
-   with IPsec determines the granularity of authentication provided. In
-   general, data origin authentication in AH and ESP is limited by the
-   extent to which secrets used with the integrity algorithm (or with a
-   key management protocol that creates such secrets) are shared among
-   multiple possible sources.
-
-
-
-Kent & Seo                                                     [Page 45]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   The following text describes the minimum requirements for both types
-   of SA management.
-
-4.5.1 Manual Techniques
-
-   The simplest form of management is manual management, in which a
-   person manually configures each system with keying material and SA
-   management data relevant to secure communication with other systems.
-   Manual techniques are practical in small, static environments but
-   they do not scale well.  For example, a company could create a
-   Virtual Private Network (VPN) using IPsec in security gateways at
-   several sites.  If the number of sites is small, and since all the
-   sites come under the purview of a single administrative domain, this
-   might be a feasible context for manual management techniques.  In
-   this case, the security gateway might selectively protect traffic to
-   and from other sites within the organization using a manually
-   configured key, while not protecting traffic for other destinations.
-   It also might be appropriate when only selected communications need
-   to be secured.  A similar argument might apply to use of IPsec
-   entirely within an organization for a small number of hosts and/or
-   gateways.  Manual management techniques often employ statically
-   configured, symmetric keys, though other options also exist.
-
-4.5.2 Automated SA and Key Management
-
-   Widespread deployment and use of IPsec requires an Internet-standard,
-   scalable, automated, SA management protocol. Such support is required
-   to facilitate use of the anti-replay features of AH and ESP, and to
-   accommodate on-demand creation of SAs, e.g., for user- and
-   session-oriented keying.  (Note that the notion of "rekeying" an SA
-   actually implies creation of a new SA with a new SPI, a process that
-   generally implies use of an automated SA/key management protocol.)
-
-   The default automated key management protocol selected for use with
-   IPsec is IKE v2 [Kau05].  This document assumes the availability of
-   certain functions from the key management protocol which are not
-   supported by IKE v1. Other automated SA management protocols MAY be
-   employed.
-
-   When an automated SA/key management protocol is employed, the output
-   from this protocol is used to generate multiple keys for a single SA.
-   This also occurs because distinct keys are used for each of the two
-   SAs created by IKE. If both integrity and confidentiality are
-   employed, then a minimum of four keys are required.  Additionally,
-   some cryptographic algorithms may require multiple keys, e.g., 3DES.
-
-   The Key Management System may provide a separate string of bits for
-   each key or it may generate one string of bits from which all keys
-   are extracted.  If a single string of bits is provided, care needs to
-
-
-Kent & Seo                                                     [Page 46]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   be taken to ensure that the parts of the system that map the string
-   of bits to the required keys do so in the same fashion at both ends
-   of the SA.  To ensure that the IPsec implementations at each end of
-   the SA use the same bits for the same keys, and irrespective of which
-   part of the system divides the string of bits into individual keys,
-   the encryption keys MUST be taken from the first (left-most,
-   high-order) bits and the integrity keys MUST be taken from the
-   remaining bits.  The number of bits for each key is defined in the
-   relevant cryptographic algorithm specification RFC. In the case of
-   multiple encryption keys or multiple integrity keys, the
-   specification for the cryptographic algorithm must specify the order
-   in which they are to be selected from a single string of bits
-   provided to the cryptographic algorithm.
-
-4.5.3 Locating a Security Gateway
-
-   This section discusses issues relating to how a host learns about the
-   existence of relevant security gateways and once a host has contacted
-   these security gateways, how it knows that these are the correct
-   security gateways. The details of where the required information is
-   stored is a local matter, but the Peer Authorization Database
-   described in Section 4.4 is the most likely candidate. (Note: S*
-   indicates a system that is running IPsec, e.g., SH1 and SG2 below.)
-
-   Consider a situation in which a remote host (SH1) is using the
-   Internet to gain access to a server or other machine (H2) and there
-   is a security gateway (SG2), e.g., a firewall, through which H1's
-   traffic must pass. An example of this situation would be a mobile
-   host crossing the Internet to his home organization's firewall (SG2).
-   This situation raises several issues:
-
-   1. How does SH1 know/learn about the existence of the security
-      gateway SG2?
-
-   2. How does it authenticate SG2, and once it has authenticated SG2,
-      how does it confirm that SG2 has been authorized to represent H2?
-
-   3. How does SG2 authenticate SH1 and verify that SH1 is authorized to
-      contact H2?
-
-   4. How does SH1 know/learn about any additional gateways that provide
-      alternate paths to H2?
-
-   To address these problems, an IPsec-supporting host or security
-   gateway MUST have an administrative interface that allows the
-   user/administrator to configure the address of one or more security
-   gateways for ranges of destination addresses that require its use.
-   This includes the ability to configure information for locating and
-   authenticating one or more security gateways and verifying the
-
-
-Kent & Seo                                                     [Page 47]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   authorization of these gateways to represent the destination host.
-   (The authorization function is implied in the PAD.) This document
-   does not address the issue of how to automate the
-   discovery/verification of security gateways.
-
-4.6 SAs and Multicast
-
-   The receiver-orientation of the SA implies that, in the case of
-   unicast traffic, the destination system will select the SPI value.
-   By having the destination select the SPI value, there is no potential
-   for manually configured SAs to conflict with automatically configured
-   (e.g., via a key management protocol) SAs or for SAs from multiple
-   sources to conflict with each other.  For multicast traffic, there
-   are multiple destination systems associated with a single SA.  So
-   some system or person will need to coordinate among all multicast
-   groups to select an SPI or SPIs on behalf of each multicast group and
-   then communicate the group's IPsec information to all of the
-   legitimate members of that multicast group via mechanisms not defined
-   here.
-
-   Multiple senders to a multicast group SHOULD use a single Security
-   Association (and hence SPI) for all traffic to that group when a
-   symmetric key encryption or integrity algorithm is employed. In such
-   circumstances, the receiver knows only that the message came from a
-   system possessing the key for that multicast group.  In such
-   circumstances, a receiver generally will not be able to authenticate
-   which system sent the multicast traffic.  Specifications for other,
-   more general multicast approaches are deferred to the IETF Multicast
-   Security Working Group.
-
-5. IP Traffic Processing
-
-   As mentioned in Section 4.4.1 "The Security Policy Database (SPD)",
-   the SPD (or associated caches) MUST be consulted during the
-   processing of all traffic that crosses the IPsec protection boundary,
-   including IPsec management traffic. If no policy is found in the SPD
-   that matches a packet (for either inbound or outbound traffic), the
-   packet MUST be discarded. To simplify processing, and to allow for
-   very fast SA lookups (for SG/BITS/BITW), this document introduces the
-   notion of an SPD cache for all outbound traffic (SPD-O plus SPD-S),
-   and a cache for inbound, non-IPsec-protected traffic (SPD-I).  (As
-   mentioned earlier, the SAD acts as a cache for checking the selectors
-   of inbound IPsec-protected traffic arriving on SAs.) There is
-   nominally one cache per SPD. For the purposes of this specification,
-   it is assumed that each cached entry will map to exactly one SA.
-   Note, however, exceptions arise when one uses multiple SAs to carry
-   traffic of different priorities (e.g., as indicated by distinct DSCP
-   values) but the same selectors.  Note also, that there are a couple
-   of situations in which the SAD can have entries for SAs that do not
-
-
-Kent & Seo                                                     [Page 48]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   have corresponding entries in the SPD. Since 2401bis does not mandate
-   that the SAD be selectively cleared when the SPD is changed, SAD
-   entries can remain when the SPD entries that created them are changed
-   or deleted. Also, if a manually keyed SA is created, there could be
-   an SAD entry for this SA that does not correspond to any SPD entry.
-
-   Since SPD entries may overlap, one cannot safely cache these entries
-   in general. Simple caching might result in a match against a cache
-   entry whereas an ordered search of the SPD would have resulted in a
-   match against a different entry. But, if the SPD entries are first
-   decorrelated, then the resulting entries can safely be cached. Each
-   cached entry will indicate that matching traffic should be bypassed
-   or discarded, appropriately. (Note: The original SPD entry might
-   result in multiple SAs, e.g., because of PFP.) Unless otherwise
-   noted, all references below to the "SPD" or "SPD cache" or "cache"
-   are to a decorrelated SPD (SPD-I, SPD-O, SPD-S) or the SPD cache
-   containing entries from the decorrelated SPD.
-
-   Note: In a host IPsec implementation based on sockets, the SPD will
-   be consulted whenever a new socket is created, to determine what, if
-   any, IPsec processing will be applied to the traffic that will flow
-   on that socket.  This provides an implicit caching mechanism and the
-   portions of the preceding discussion that address caching can be
-   ignored in such implementations.
-
-   Note: It is assumed that one starts with a correlated SPD because
-   that is how users and administrators are accustomed to managing these
-   sorts of access control lists or firewall filter rules. Then the
-   decorrelation algorithm is applied to build a list of cache-able SPD
-   entries. The decorrelation is invisible at the management interface.
-
-   For inbound IPsec traffic, the SAD entry selected by the SPI serves
-   as the cache for the selectors to be matched against arriving IPsec
-   packets, after AH or ESP processing has been performed.
-
-5.1 Outbound IP Traffic Processing (protected-to-unprotected)
-
-   First consider the path for traffic entering the implementation via a
-   protected interface and exiting via an unprotected interface.
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 49]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-                          Unprotected Interface
-                                   ^
-                                   |
-            (nested SAs)      +----------+
-           -------------------|Forwarding|<-----+
-           |                  +----------+      |
-           |                        ^           |
-           |                        | BYPASS    |
-           V                     +-----+        |
-       +-------+                 | SPD |     +--------+
-    ...| SPD-I |.................|Cache|.....|PROCESS |...IPsec
-       |  (*)  |                 | (*) |---->|(AH/ESP)|   boundary
-       +-------+                 +-----+     +--------+
-           |        +-------+     /  ^
-           |        |DISCARD| <--/   |
-           |        +-------+        |
-           |                         |
-           |                 +-------------+
-           |---------------->|SPD Selection|
-                             +-------------+
-                                    ^
-                                    |     +------+
-                                    |  -->| ICMP |
-                                    | /   +------+
-                                    |/
-                                    |
-                                    |
-                            Protected Interface
-
-
-         Figure 2.  Processing Model for Outbound Traffic
-                    (*) = The SPD caches are shown here. If there
-                          is a cache miss, then the SPD is checked.
-                          There is no requirement that an
-                          implementation buffer the packet if
-                          there is a cache miss.
-
-
-   IPsec MUST perform the following steps when processing outbound
-   packets:
-
-   1. When a packet arrives from the subscriber (protected) interface,
-      invoke the SPD selection function to obtain the SPD-ID needed to
-      choose the appropriate SPD. (If the implementation uses only one
-      SPD, this step is a no-op.)
-
-   2. Match the packet headers against the cache for the SPD specified
-      by the SPD-ID from step 1. Note that this cache contains entries
-      from SPD-O and SPD-S.
-
-
-Kent & Seo                                                     [Page 50]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   3a. If there is a match, then process the packet as specified by the
-      matching cache entry, i.e., BYPASS, DISCARD, or PROTECT using AH
-      or ESP. If IPsec processing is applied, there is a link from the
-      SPD cache entry to the relevant SAD entry (specifying the mode,
-      cryptographic algorithms, keys, SPI, PMTU, etc.).  IPsec
-      processing is as previously defined, for tunnel or transport modes
-      and for AH or ESP, as specified in their respective RFCs [Ken05b
-      and Ken05a]. Note that the SA PMTU value, plus the value of the
-      stateful fragment checking flag (and the DF bit in the IP header
-      of the outbound packet) determine whether the packet can (must) be
-      fragmented prior to or after IPsec processing, or if it must be
-      discarded and an ICMP PMTU message is sent.
-
-   3b. If no match is found in the cache, search the SPD (SPD-S and
-      SPD-O parts) specified by SPD-ID. If the SPD entry calls for
-      BYPASS or DISCARD, create one or more new outbound SPD cache
-      entries and if BYPASS, create one or more new inbound SPD cache
-      entries. (More than one cache entry may be created since a
-      decorrelated SPD entry may be linked to other such entries that
-      were created as a side effect of the decorrelation process.) If
-      the SPD entry calls for PROTECT, i.e., creation of an SA, the key
-      management mechanism (e.g., IKE v2) is invoked to create the SA.
-      If SA creation succeeds, a new outbound (SPD-S) cache entry is
-      created, along with outbound and inbound SAD entries, otherwise
-      the packet is discarded. (A packet that triggers an SPD lookup MAY
-      be discarded by the implementation, or it MAY be processed against
-      the newly created cache entry, if one is created.)  Since SAs are
-      created in pairs, an SAD entry for the corresponding inbound SA
-      also is created, and it contains the selector values derived from
-      the SPD entry (and packet, if any PFP flags were "true") used to
-      create the inbound SA, for use in checking inbound traffic
-      delivered via the SA.
-
-   4. The packet is passed to the outbound forwarding function
-      (operating outside of the IPsec implementation), to select the
-      interface to which the packet will be directed. This function may
-      cause the packet to be passed back across the IPsec boundary, for
-      additional IPsec processing, e.g., in support of nested SAs. If
-      so, there MUST be an entry in SPD-I database that permits inbound
-      bypassing of the packet, otherwise the packet will be discarded.
-      If necessary, i.e., if there is more than one SPD-I, the traffic
-      being looped back MAY be tagged as coming from this internal
-      interface.  This would allow the use of a different SPD-I for
-      "real" external traffic vs looped traffic, if needed.
-
-   Note: With the exception of IPv4 and IPv6 transport mode, an SG,
-   BITS, or BITW  implementation MAY fragment packets before applying
-   IPsec. (This applies only to IPv4.  For IPv6 packets, only the
-   originator is allowed to fragment them.) The device SHOULD have a
-
-
-Kent & Seo                                                     [Page 51]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   configuration setting to disable this.  The resulting fragments are
-   evaluated against the SPD in the normal manner.  Thus, fragments not
-   containing port numbers (or ICMP message type and code, or Mobility
-   Header type) will only match rules having port (or ICMP message type
-   and code, or MH type) selectors of OPAQUE or ANY. (See section 7 for
-   more details.)
-
-
-
-   Note: With regard to determining and enforcing the PMTU of an SA, the
-   IPsec system MUST follow the steps described in Section 8.2.
-
-5.1.1 Handling an Outbound Packet That Must Be Discarded
-
-   If an IPsec system receives an outbound packet that it finds it must
-   discard, it SHOULD be capable of generating and sending an ICMP
-   message to indicate to the sender of the outbound packet that the
-   packet was discarded.  The type and code of the ICMP message will
-   depend on the reason for discarding the packet, as specified below.
-   The reason SHOULD be recorded in the audit log. The audit log entry
-   for this event SHOULD include the reason, current date/time, and the
-   selector values from the packet.
-
-    a. The selectors of the packet matched an SPD entry requiring the
-       packet to be discarded.
-
-           IPv4 Type = 3 (destination unreachable) Code = 13
-                (Communication Administratively Prohibited)
-
-           IPv6 Type = 1 (destination unreachable) Code = 1
-                (Communication with destination administratively
-                prohibited)
-
-   b1. The IPsec system successfully reached the remote peer but was
-       unable to negotiate the SA required by the SPD entry matching the
-       packet, e.g., because the remote peer is administratively
-       prohibited from communicating with the initiator, or the
-       initiating peer was unable to authenticate itself to the remote
-       peer, or the remote peer was unable to authenticate itself to the
-       initiating peer, or SPD at remote peer did not have a suitable
-       entry, etc.
-
-           IPv4 Type = 3 (destination unreachable) Code = 13
-                (Communication Administratively Prohibited)
-
-           IPv6 Type = 1 (destination unreachable) Code = 1
-                (Communication with destination administratively
-                prohibited)
-
-
-
-Kent & Seo                                                     [Page 52]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   b2. The IPsec system was unable to set up the SA required by the SPD
-       entry matching the packet because the IPsec peer at the other end
-       of the exchange could not be contacted.
-
-           IPv4 Type = 3 (destination unreachable) Code = 1 (host
-                unreachable)
-
-           IPv6 Type = 1 (destination unreachable) Code = 3 (address
-                unreachable)
-
-   Note that an attacker behind a security gateway could send packets
-   with a spoofed source address, W.X.Y.Z, to an IPsec entity causing it
-   to send ICMP messages to W.X.Y.Z.  This creates an opportunity for a
-   DoS attack among hosts behind a security gateway. To address this, a
-   security gateway SHOULD include a management control to allow an
-   administrator to configure an IPsec implementation to send or not
-   send the ICMP messages under these circumstances, and if this
-   facility is selected, to rate limit the transmission of such ICMP
-   responses.
-
-5.1.2 Header Construction for Tunnel Mode
-
-   This section describes the handling of the inner and outer IP
-   headers, extension headers, and options for AH and ESP tunnels, with
-   regard to outbound traffic processing.  This includes how to
-   construct the encapsulating (outer) IP header, how to process fields
-   in the inner IP header, and what other actions should be taken for
-   outbound, tunnel mode traffic.  The general processing described here
-   is modeled after RFC 2003, "IP Encapsulation with IP" [Per96]:
-
-    o The outer IP header Source Address and Destination Address
-      identify the "endpoints" of the tunnel (the encapsulator and
-      decapsulator).  The inner IP header Source Address and Destination
-      Addresses identify the original sender and recipient of the
-      datagram, (from the perspective of this tunnel), respectively.
-      (See footnote 3 after the table in 5.1.2.1 for more details on the
-      encapsulating source IP address.)
-
-    o The inner IP header is not changed except as noted below for TTL
-      (or Hop Limit) and the DS/ECN Fields.  The inner IP header
-      otherwise remains unchanged during its delivery to the tunnel exit
-      point.
-
-    o No change to IP options or extension headers in the inner header
-      occurs during delivery of the encapsulated datagram through the
-      tunnel.
-
-   Note: IPsec tunnel mode is different from IP-in-IP tunneling (RFC
-   2003) in several ways:
-
-
-Kent & Seo                                                     [Page 53]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-    o IPsec offers certain controls to a security administrator to
-      manage covert channels (which would not normally be a concern for
-      tunneling) and to ensure that the receiver examines the right
-      portions of the received packet re: application of access
-      controls. An IPsec implementation MAY be configurable with regard
-      to how it processes the outer DS field for tunnel mode for
-      transmitted packets. For outbound traffic, one configuration
-      setting for the outer DS field will operate as described in the
-      following sections on IPv4 and IPv6 header processing for IPsec
-      tunnels. Another will allow the outer DS field to be mapped to a
-      fixed value, which MAY be configured on a per SA basis. (The value
-      might really be fixed for all traffic outbound from a device, but
-      per SA granularity allows that as well.) This configuration option
-      allows a local administrator to decide whether the covert channel
-      provided by copying these bits outweighs the benefits of copying.
-
-    o IPsec describes how to handle ECN or DS and provides the ability
-      to control propagation of changes in these fields between
-      unprotected and protected domains. In general, propagation from a
-      protected to an unprotected domain is a covert channel and thus
-      controls are provided to manage the bandwidth of this channel.
-      Propagation of ECN values in the other direction are controlled so
-      that only legitimate ECN changes (indicating occurrence of
-      congestion between the tunnel endpoints) are propagated.  By
-      default, DS propagation from an unprotected domain to a protected
-      domain is not permitted.  However, if the sender and receiver do
-      not share the same DS code space, and the receiver has no way of
-      learning how to map between the two spaces, then it may be
-      appropriate to deviate from the default. Specifically, an IPsec
-      implementation MAY be configurable in terms of how it processes
-      the outer DS field for tunnel mode for received packets. It may be
-      configured to either discard the outer DS value (the default) OR
-      to overwrite the inner DS field with the outer DS field.  If
-      offered, the discard vs. overwrite behavior MAY be configured on a
-      per SA basis. This configuration option allows a local
-      administrator to decide whether the vulnerabilities created by
-      copying these bits outweigh the benefits of copying.  See [RFC
-      2983] for further information on when each of these behaviors may
-      be useful, and also for the possible need for diffserv traffic
-      conditioning prior or subsequent to IPsec processing (including
-      tunnel decapsulation).
-
-    o IPsec allows the IP version of the encapsulating header to be
-      different from that of the inner header.
-
-   The tables in the following sub-sections show the handling for the
-   different header/option fields ("constructed" means that the value in
-   the outer field is constructed independently of the value in the
-   inner).
-
-
-Kent & Seo                                                     [Page 54]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-5.1.2.1 IPv4 -- Header Construction for Tunnel Mode
-
-                         <-- How Outer Hdr Relates to Inner Hdr -->
-                         Outer Hdr at                 Inner Hdr at
-    IPv4                 Encapsulator                 Decapsulator
-      Header fields:     --------------------         ------------
-        version          4 (1)                        no change
-        header length    constructed                  no change
-        DS Field         copied from inner hdr (5)    no change
-        ECN Field        copied from inner hdr        constructed (6)
-        total length     constructed                  no change
-        ID               constructed                  no change
-        flags (DF,MF)    constructed, DF (4)          no change
-        fragment offset  constructed                  no change
-        TTL              constructed (2)              decrement (2)
-        protocol         AH, ESP                      no change
-        checksum         constructed                  constructed (2)(6)
-        src address      constructed (3)              no change
-        dest address     constructed (3)              no change
-      Options            never copied                 no change
-             1. The IP version in the encapsulating header can be
-                different from the value in the inner header.
-
-             2. The TTL in the inner header is decremented by the
-                encapsulator prior to forwarding and by the decapsulator
-                if it forwards the packet.  (The IPv4 checksum changes
-                when the TTL changes.)
-
-                Note: Decrementing the TTL value is a normal part of
-                forwarding a packet.  Thus, a packet originating from
-                the same node as the encapsulator does not have its TTL
-                decremented, since the sending node is originating the
-                packet rather than forwarding it.
-
-             3. Local and Remote addresses depend on the SA, which is
-                used to determine the Remote address which in turn
-                determines which Local address (net interface) is used
-                to forward the packet.
-
-                Note: For multicast traffic, the destination address, or
-                source and destination addresses, may be required for
-                demuxing. In that case, it is important to ensure
-                consistency over the lifetime of the SA by ensuring that
-                the source address that appears in the encapsulating
-                tunnel header is the same as the one that was negotiated
-                during the SA establishment process. There is an
-                exception to this general rule, i.e., a mobile IPsec
-                implementation will update its source address as it
-                moves.
-
-
-Kent & Seo                                                     [Page 55]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-             4. Configuration determines whether to copy from the inner
-                header (IPv4 only), clear, or set the DF.
-
-             5. If the packet will immediately enter a domain for which
-                the DSCP value in the outer header is not appropriate,
-                that value MUST be mapped to an appropriate value for
-                the domain [RFC 2474].  See RFC 2475[BBCDWW98] for
-                further information.
-
-             6. If the ECN field in the inner header is set to ECT(0) or
-                ECT(1) and the ECN field in the outer header is set to
-                CE, then set the ECN field in the inner header to CE,
-                otherwise make no change to the ECN field in the inner
-                header.  (The IPv4 checksum changes when the ECN
-                changes.)
-
-   Note: IPsec does not copy the options from the inner header into the
-   outer header, nor does IPsec construct the options in the outer
-   header. However, post-IPsec code MAY insert/construct options for the
-   outer header.
-
-5.1.2.2 IPv6 -- Header Construction for Tunnel Mode
-
-   See previous section 5.1.2.1 for notes 1-6 indicated by (footnote
-   number).
-
-                         <-- How Outer Hdr  Relates Inner Hdr --->
-                         Outer Hdr at                 Inner Hdr at
-    IPv6                 Encapsulator                 Decapsulator
-      Header fields:     --------------------         ------------
-        version          6 (1)                        no change
-        DS Field         copied from inner hdr (5)    no change (9)
-        ECN Field        copied from inner hdr        constructed (6)
-        flow label       copied or configured (8)     no change
-        payload length   constructed                  no change
-        next header      AH,ESP,routing hdr           no change
-        hop limit        constructed (2)              decrement (2)
-        src address      constructed (3)              no change
-        dest address     constructed (3)              no change
-      Extension headers  never copied (7)             no change
-
-             7. IPsec does not copy the extension headers from the inner
-                packet into outer headers, nor does IPsec construct
-                extension headers in the outer header. However,
-                post-IPsec code MAY insert/construct extension headers
-                for the outer header.
-
-             8. See [RaCoCaDe04]. Copying is acceptable only for end
-                systems, not SGs. If an SG copied flow labels from the
-
-
-Kent & Seo                                                     [Page 56]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-                inner header to the outer header, collisions might
-                result.
-
-             9. An implementation MAY choose to provide a facility to
-                pass the DS value from the outer header to the inner
-                header, on a per SA basis, for received tunnel mode
-                packets. The motivation for providing this feature is to
-                accommodate situations in which the DS code space at the
-                receiver is different from that of the sender and the
-                receiver has no way of knowing how to translate from the
-                sender's space. There is a danger in copying this value
-                from the outer header to the inner header, since it
-                enables an attacker to modify the outer DSCP value in a
-                fashion that may adversely affect other traffic at the
-                receiver.  Hence the default behavior for IPsec
-                implementations is NOT to permit such copying.
-
-5.2 Processing Inbound IP Traffic (unprotected-to-protected)
-
-   Inbound processing is somewhat different from outbound processing,
-   because of the use of SPIs to map IPsec protected traffic to SAs. The
-   inbound SPD cache (SPD-I) is applied only to bypassed or discarded
-   traffic. If an arriving packet appears to be an IPsec fragment from
-   an unprotected interface, reassembly is performed prior to IPsec
-   processing.  The intent for any SPD cache is that a packet that fails
-   to match any entry is then referred to the corresponding SPD. Every
-   SPD SHOULD have a nominal, final entry that catches anything that is
-   otherwise unmatched, and discards it. This ensures that non-IPsec
-   protected traffic that arrives and does not match any SPD-I entry
-   will be discarded.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 57]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-
-                      Unprotected Interface
-                                |
-                                V
-                             +-----+   IPsec protected
-         ------------------->|Demux|-------------------+
-         |                   +-----+                   |
-         |                      |                      |
-         |            Not IPsec |                      |
-         |                      |                      |
-         |                      V                      |
-         |     +-------+    +---------+                |
-         |     |DISCARD|<---|SPD-I (*)|                |
-         |     +-------+    +---------+                |
-         |                   |                         |
-         |                   |-----+                   |
-         |                   |     |                   |
-         |                   |     V                   |
-         |                   |  +------+               |
-         |                   |  | ICMP |               |
-         |                   |  +------+               |
-         |                   |                         V
-      +---------+            |                   +---------+
-  ....|SPD-O (*)|............|...................|PROCESS**|...IPsec
-      +---------+            |                   |(AH/ESP) | Boundary
-         ^                   |                   +---------+
-         |                   |       +---+             |
-         |            BYPASS |   +-->|IKE|             |
-         |                   |   |   +---+             |
-         |                   V   |                     V
-         |               +----------+          +---------+   +----+
-         |--------<------|Forwarding|<---------|SAD Check|-->|ICMP|
-           nested SAs    +----------+          | (***)   |   +----+
-                               |               +---------+
-                               V
-                       Protected Interface
-
-            Figure 3.  Inbound Traffic Processing Model
-                       (*) = The caches are shown here. If there is
-                             a cache miss, then the SPD is checked.
-                             There is no requirement that an
-                             implementation buffer the packet if
-                             there is a cache miss.
-                      (**) = This processing includes using the
-                             packet's SPI, etc to look up the SA
-                             in the SAD, which forms a cache of the
-                             SPD for inbound packets (except for
-                             cases noted in Sections 4.4.2 and 5) -
-                             see step 3a below.
-
-
-Kent & Seo                                                     [Page 58]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-                     (***) = This SAD check refers to step 4 below.
-
-
-   Prior to performing AH or ESP processing, any IP fragments that
-   arrive via the unprotected interface are reassembled (by IP).  Each
-   inbound IP datagram to which IPsec processing will be applied is
-   identified by the appearance of the AH or ESP values in the IP Next
-   Protocol field (or of AH or ESP as a next layer protocol in the IPv6
-   context).
-
-   IPsec MUST perform the following steps:
-
-   1. When a packet arrives, it may be tagged with the ID of the
-      interface (physical or virtual) via which it arrived, if necessary
-      to support multiple SPDs and associated SPD-I caches. (The
-      interface ID is mapped to a corresponding SPD-ID.)
-
-   2. The packet is examined and demuxed into one of two categories:
-       - If the packet appears to be IPsec protected and it is addressed
-         to this device, an attempt is made to map it to an active SA
-         via the SAD. Note that the device may have multiple IP
-         addresses that may be used in the SAD lookup, e.g., in the case
-         of protocols such as SCTP.
-       - Traffic not addressed to this device, or addressed to this
-         device and not AH or ESP, is directed to SPD-I lookup. (This
-         implies that IKE traffic MUST have an explicit BYPASS entry in
-         the SPD.) If multiple SPDs are employed, the tag assigned to
-         the packet in step 1 is used to select the appropriate SPD-I
-         (and cache) to search.  SPD-I lookup determines whether the
-         action is DISCARD or BYPASS.
-
-   3a. If the packet is addressed to the IPsec device and AH or ESP is
-      specified as the protocol, the packet is looked up in the SAD. For
-      unicast traffic, use only the SPI (or SPI plus protocol). For
-      multicast traffic, use the SPI plus the destination or SPI plus
-      destination and source addresses, as specified in section 4.1. In
-      either case (unicast or multicast), if there is no match, discard
-      the traffic.  This is an auditable event. The audit log entry for
-      this event SHOULD include the current date/time, SPI, source and
-      destination of the packet, IPsec protocol, and any other selector
-      values of the packet that are available.  If the packet is found
-      in the SAD, process it accordingly (see step 4).
-
-   3b. If the packet is not addressed to the device or is addressed to
-      this device and is not AH or ESP, look up the packet header in the
-      (appropriate) SPD-I cache. If there is a match and the packet is
-      to be discarded or bypassed, do so. If there is no cache match,
-      look up the packet in the corresponding SPD-I and create a cache
-      entry as appropriate. (No SAs are created in response to receipt
-
-
-Kent & Seo                                                     [Page 59]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      of a packet that requires IPsec protection; only BYPASS or DISCARD
-      cache entries can be created this way.) If there is no match,
-      discard the traffic. This is an auditable event. The audit log
-      entry for this event SHOULD include the current date/time, SPI if
-      available, IPsec protocol if available, source and destination of
-      the packet, and any other selector values of the packet that are
-      available.
-
-   3c. Processing of ICMP messages is assumed to take place on the
-      unprotected side of the IPsec boundary. Unprotected ICMP messages
-      are examined and local policy is applied to determine whether to
-      accept or reject these messages and, if accepted, what action to
-      take as a result. For example, if an ICMP unreachable message is
-      received, the implementation must decide whether to act on it,
-      reject it, or act on it with constraints. (See Section 6.)
-
-   4. Apply AH or ESP processing as specified, using the SAD entry
-      selected in step 3a above.  Then match the packet against the
-      inbound selectors identified by the SAD entry to verify that the
-      received packet is appropriate for the SA via which it was
-      received.
-
-   5. If an IPsec system receives an inbound packet on an SA and the
-      packet's header fields are not consistent with the selectors for
-      the SA, it MUST discard the packet. This is an auditable event.
-      The audit log entry for this event SHOULD include the current
-      date/time, SPI, IPsec protocol(s), source and destination of the
-      packet, and any other selector values of the packet that are
-      available, and the selector values from the relevant SAD entry.
-      The system SHOULD also be capable of generating and sending an IKE
-      notification of INVALID_SELECTORS to the sender (IPsec peer),
-      indicating that the received packet was discarded because of
-      failure to pass selector checks.
-
-   To minimize the impact of a DoS attack, or a mis-configured peer, the
-   IPsec system SHOULD include a management control to allow an
-   administrator to configure the IPsec implementation to send or not
-   send this IKE notification, and if this facility is selected, to rate
-   limit the transmission of such notifications.
-
-   After traffic is bypassed or processed through IPsec, it is handed to
-   the inbound forwarding function for disposition. This function may
-   cause the packet to be sent (outbound) across the IPsec boundary for
-   additional inbound IPsec processing, e.g., in support of nested SAs.
-   If so, then as with ALL outbound traffic that is to be bypassed, the
-   packet MUST be matched against an SPD-O entry. Ultimately, the packet
-   should be forwarded to the destination host or process for
-   disposition.
-
-
-
-Kent & Seo                                                     [Page 60]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-6. ICMP Processing
-
-   This section describes IPsec handling of ICMP traffic.  There are two
-   categories of ICMP traffic: error messages (e.g., type = destination
-   unreachable) and non-error messages (e.g., type = echo). This section
-   applies exclusively to error messages.  Disposition of non-error,
-   ICMP messages (that are not addressed to the IPsec implementation
-   itself) MUST be explicitly accounted for using SPD entries.
-
-   The discussion in this section applies to ICMPv6 as well as to
-   ICMPv4. Also, a mechanism SHOULD be provided to allow an
-   administrator to cause ICMP error messages (selected, all, or none)
-   to be logged as an aid to problem diagnosis.
-
-6.1 Processing ICMP Error Messages Directed to an IPsec Implementation
-
-6.1.1 ICMP Error Messages Received on the Unprotected Side of the
-Boundary
-
-   Figure 3 in Section 5.2 shows a distinct ICMP processing module on
-   the unprotected side of the IPsec boundary, for processing ICMP
-   messages (error or otherwise) that are addressed to the IPsec device
-   and that are not protected via AH or ESP. An ICMP message of this
-   sort is unauthenticated and its processing may result in denial or
-   degradation of service.  This suggests that, in general, it would be
-   desirable to ignore such messages. However, many ICMP messages will
-   be received by hosts or security gateways from unauthenticated
-   sources, e.g., routers in the public Internet. Ignoring these ICMP
-   messages can degrade service, e.g., because of a failure to process
-   PMTU message and redirection messages. Thus there is also a
-   motivation for accepting and acting upon unauthenticated ICMP
-   messages.
-
-   To accommodate both ends of this spectrum, a compliant IPsec
-   implementation MUST permit a local administrator to configure an
-   IPsec implementation to accept or reject unauthenticated ICMP
-   traffic.  This control MUST be at the granularity of ICMP type and
-   MAY be at the granularity of ICMP type and code. Additionally, an
-   implementation SHOULD incorporate mechanisms and parameters for
-   dealing with such traffic. For example, there could be the ability to
-   establish a minimum PMTU for traffic (on a per destination basis), to
-   prevent receipt of an unauthenticated ICMP from setting the PMTU to a
-   trivial size.
-
-   If an ICMP PMTU message passes the checks above and the system is
-   configured to accept it, then there are two possibilities. If the
-   implementation applies fragmentation on the ciphertext side of the
-   boundary, then the accepted PMTU information is passed to the
-   forwarding module (outside of the IPsec implementation) which uses it
-
-
-Kent & Seo                                                     [Page 61]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   to manage outbound packet fragmentation. If the implementation is
-   configured to effect plaintext side fragmentation, then the PMTU
-   information is passed to the plaintext side and processed as
-   described in Section 8.2.
-
-6.1.2 ICMP Error Messages Received on the Protected Side of the Boundary
-
-   These ICMP messages are not authenticated, but they do come from
-   sources on the protected side of the IPsec boundary. Thus these
-   messages generally are viewed as more "trustworthy" than their
-   counterparts arriving from sources on the unprotected side of the
-   boundary. The major security concern here is that a compromised host
-   or router might emit erroneous ICMP error messages that could degrade
-   service for other devices "behind" the security gateway, or that
-   could even result in violations of confidentiality. For example, if a
-   bogus ICMP redirect were consumed by a security gateway, it could
-   cause the forwarding table on the protected side of the boundary to
-   be modified so as to deliver traffic to an inappropriate destination
-   "behind" the gateway. Thus implementers MUST provide controls to
-   allow local administrators to constrain the processing of ICMP error
-   messages received on the protected side of the boundary, and directed
-   to the IPsec implementation. These controls are of the same type as
-   those employed on the unprotected side, described above in Section
-   6.1.1.
-
-6.2 Processing Protected, Transit ICMP Error Messages
-
-   When an ICMP error message is transmitted via an SA to a device
-   "behind" an IPsec implementation, both the payload and the header of
-   the ICMP message require checking from an access control perspective.
-   If one of these messages is forwarded to a host behind a security
-   gateway, the receiving host IP implementation will make decisions
-   based on the payload, i.e., the header of the packet that purportedly
-   triggered the error response. Thus an IPsec implementation MUST be
-   configurable to check that this payload header information is
-   consistent with the SA via which it arrives. (This means that the
-   payload header, with source and destination address and port fields
-   reversed, matches the traffic selectors for the SA.) If this sort of
-   check is not performed, then for example, anyone with whom the
-   receiving IPsec system (A) has an active SA could send an ICMP
-   destination dead message that refers to any host/net with which A is
-   currently communicating, and thus effect a highly efficient DoS
-   attack re: communication with other peers of A.  Normal IPsec
-   receiver processing of traffic is not sufficient to protect against
-   such attacks. However, not all contexts may require such checks, so
-   it is also necessary to allow a local administrator to configure an
-   implementation to NOT perform such checks.
-
-   To accommodate both policies, the following convention is adopted. If
-
-
-Kent & Seo                                                     [Page 62]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   an administrator wants to allow ICMP error messages to be carried by
-   an SA without inspection of the payload, then configure an SPD entry
-   that explicitly allows for carriage of such traffic. If an
-   administrator wants IPsec to check the payload of ICMP error messages
-   for consistency, then do not create any SPD entries that accommodate
-   carriage of such traffic based on the ICMP packet header. This
-   convention motivates the following processing description.
-
-   IPsec senders and receivers MUST support the following processing for
-   ICMP error messages that are sent and received via SAs.
-
-   If an SA exists that accommodates an outbound ICMP error message,
-   then the message is mapped to the SA and only the IP and ICMP headers
-   are checked upon receipt, just as would be the case for other
-   traffic.  If no SA exists that matches the traffic selectors
-   associated with an ICMP error message, then the SPD is searched to
-   determine if such an SA can be created. If so, the SA is created and
-   the ICMP error message is transmitted via that SA. Upon receipt, this
-   message is subject to the usual traffic selector checks at the
-   receiver. This processing is exactly what would happen for traffic in
-   general, and thus does not represent any special processing for ICMP
-   error messages.
-
-   If no SA exists that would carry the outbound ICMP message in
-   question, and if no SPD entry would allow carriage of this outbound
-   ICMP error message, then an IPsec implementation MUST map the message
-   to the SA that would carry the return traffic associated with the
-   packet that triggered the ICMP error message. This requires an IPsec
-   implementation to detect outbound ICMP error messages that map to no
-   extant SA or SPD entry, and treat them specially with regard to SA
-   creation and lookup. The implementation extracts the header for the
-   packet that triggered the error (from the ICMP message payload),
-   reverses the source and destination IP address fields, extracts the
-   protocol field, and reverses the port fields (if accessible). It then
-   uses this extracted information to locate an appropriate, active
-   outbound SA, and transmits the error message via this SA.  If no such
-   SA exists, no SA will be created, and this is an auditable event.
-
-   If an IPsec implementation receives an inbound ICMP error message on
-   an SA, and the IP and ICMP headers of the message do not match the
-   traffic selectors for the SA, the receiver MUST process the received
-   message in a special fashion. Specifically, the receiver must extract
-   the header of the triggering packet from the ICMP payload, and
-   reverse fields as described above to determine if the packet is
-   consistent with the selectors for the SA via which the ICMP error
-   message was received. If the packet fails this check, the IPsec
-   implementation MUST NOT forwarded the ICMP message to the
-   destination.  This is an auditable event.
-
-
-
-Kent & Seo                                                     [Page 63]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-7. Handling Fragments (on the protected side of the IPsec boundary)
-
-   Earlier sections of this document describe mechanisms for (a)
-   fragmenting an outbound packet after IPsec processing has been
-   applied and reassembling it at the receiver before IPsec processing
-   and (b) handling inbound fragments received from the unprotected side
-   of the IPsec boundary.  This section describes how an implementation
-   should handle the processing of outbound plaintext fragments on the
-   protected side of the IPsec boundary. (See Appendix D for discussion
-   of Fragment Handling Rationale.) In particular, it addresses:
-
-           o mapping an outbound non-initial fragment to the right SA
-             (or finding the right SPD entry)
-           o verifying that a received non-initial fragment is
-             authorized for the SA via which it was received
-           o mapping outbound and inbound non-initial fragments to the
-             right SPD-O/SPD-I entry or the relevant cache entry, for
-             BYPASS/DISCARD traffic
-
-   Note: In Section 4.1, transport mode SAs have been defined to not
-   carry fragments (IPv4 or IPv6).  Note also that in Section 4.4.1, two
-   special values, ANY and OPAQUE, were defined for selectors and that
-   ANY includes OPAQUE. The term "non-trivial" is used to mean that the
-   selector has a value other than OPAQUE or ANY.
-
-   Note: The term "non-initial fragment" is used here to indicate a
-   fragment that does not contain all the selector values that may be
-   needed for access control.  As observed in Section 4.4.1, depending
-   on the Next Layer Protocol, in addition to Ports, the ICMP message
-   type/code or Mobility Header type could be missing from non-initial
-   fragments.  Also, for IPv6, even the first fragment might NOT contain
-   the Next Layer Protocol or Ports (or ICMP message type/code, or
-   Mobility Header type) depending on the kind and number of extension
-   headers present.  If a non-initial fragment contains the Port (or
-   ICMP type and code or Mobility header type) but not the Next Layer
-   Protocol, then unless there is an SPD entry for the relevant
-   Local/Remote addresses with ANY for Next Layer Protocol and Port (or
-   ICMP type and code or Mobility header type), the fragment would not
-   contain all the selector information needed for access control.
-
-   To address the above issues, three approaches have been defined:
-
-       o Tunnel mode SAs that carry initial and non-initial fragments
-         (See Section 7.1)
-       o Separate tunnel mode SAs for non-initial fragments (See
-         Section 7.2)
-       o Stateful fragment checking (See Section 7.3)
-
-
-
-
-Kent & Seo                                                     [Page 64]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-7.1 Tunnel Mode SAs that Carry Initial and Non-Initial Fragments
-
-   All implementations MUST support tunnel mode SAs that are configured
-   to pass traffic without regard to port field (or ICMP type/code or
-   Mobility Header type) values. If the SA will carry traffic for
-   specified protocols, the selector set for the SA MUST specify the
-   port fields (or ICMP type/code or Mobility Header type) as ANY. An SA
-   defined in this fashion will carry all traffic including initial and
-   non-initial fragments for the indicated Local/Remote addresses and
-   specified Next Layer protocol(s). If the SA will carry traffic
-   without regard to a specific protocol value (i.e., ANY is specified
-   as the (Next Layer) protocol selector value), then the port field
-   values are undefined and MUST be set to ANY as well. (As noted in
-   4.4.1, ANY includes OPAQUE as well as all specific values.)
-
-7.2 Separate Tunnel Mode SAs for Non-Initial Fragments
-
-   An implementation MAY support tunnel mode SAs that will carry only
-   non-initial fragments, separate from non-fragmented packets and
-   initial fragments. The OPAQUE value will be used to specify port (or
-   ICMP type/code or Mobility Header type) field selectors for an SA to
-   carry such fragments. Receivers MUST perform a minimum offset check
-   on IPv4 (non-initial) fragments to protect against overlapping
-   fragment attacks when SAs of this type are employed. Because such
-   checks cannot be performed on IPv6 non-initial fragments, users and
-   administrators are advised that carriage of such fragments may be
-   dangerous, and implementers may choose to NOT support such SAs for
-   IPv6 traffic. Also, an SA of this sort will carry all non-initial
-   fragments that match a specified Local/Remote address pair and
-   protocol value, i.e., the fragments carried on this SA belong to
-   packets that if not fragmented, might have gone on separate SAs of
-   differing security.  Therefore users and administrators are advised
-   to protect such traffic using ESP (with integrity) and the
-   "strongest" integrity and encryption algorithms in use between both
-   peers.  (Determination of the "strongest" algorithms requires
-   imposing an ordering of the available algorithms, a local
-   determination at the discretion of the initiator of the SA.)
-
-   Specific port (or ICMP type/code or Mobility header type) selector
-   values will be used to define SAs to carry initial fragments and
-   non-fragmented packets. This approach can be used if a user or
-   administrator wants to create one or more tunnel mode SAs between the
-   same Local/Remote addresses that discriminate based on port (or ICMP
-   type/code or Mobility header type) fields.  These SAs MUST have
-   non-trivial protocol selector values, otherwise approach #1 above
-   MUST be used.
-
-   Note: In general, for the approach described in this section, one
-   needs only a single SA between two implementations to carry all
-
-
-Kent & Seo                                                     [Page 65]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   non-initial fragments.  However, if one chooses to have multiple SAs
-   between the two implementations for QoS differentiation, then one
-   might also want multiple SAs to carry fragments-without-ports, one
-   for each supported QoS class.  Since support for QoS via distinct SAs
-   is a local matter, not mandated by this document, the choice to have
-   multiple SAs to carry non-initial fragments should also be local.
-
-7.3 Stateful Fragment Checking
-
-   An implementation MAY support some form of stateful fragment checking
-   for a tunnel mode SA with non-trivial port (or ICMP type/code or MH
-   type) field values (not ANY or OPAQUE).  Implementations that will
-   transmit non-initial fragments on a tunnel mode SA that makes use of
-   non-trivial port (or ICMP type/code or MH type) selectors MUST notify
-   a peer via the IKE NOTIFY NON_FIRST_FRAGMENTS_ALSO payload.
-
-   The peer MUST reject this proposal if it will not accept non-initial
-   fragments in this context. If an implementation does not successfully
-   negotiate transmission of non-initial fragments for such an SA, it
-   MUST NOT send such fragments over the SA.  This standard does not
-   specify how peers will deal with such fragments, e.g., via reassembly
-   or other means, at either sender or receiver. However, a receiver
-   MUST discard non-initial fragments that arrive on an SA with
-   non-trivial port (or ICMP type/code or MH type) selector values
-   unless this feature has been negotiated.  Also, the receiver MUST
-   discard non-initial fragments that do not comply with the security
-   policy applied to the overall packet.  Discarding such packets is an
-   auditable event. Note that in network configurations where fragments
-   of a packet might be sent or received via different security gateways
-   or BITW implementations, stateful strategies for tracking fragments
-   may fail.
-
-7.4 BYPASS/DISCARD traffic
-
-   All implementations MUST support DISCARDing of fragments using the
-   normal SPD packet classification mechanisms. All implementations MUST
-   support stateful fragment checking to accommodate BYPASS traffic for
-   which a non-trivial port range is specified. The concern is that
-   BYPASS of a cleartext, non-initial fragment arriving at an IPsec
-   implementation could undermine the security afforded IPsec-protected
-   traffic directed to the same destination. For example, consider an
-   IPsec implementation configured with an SPD entry that calls for
-   IPsec-protection of traffic between a specific source/destination
-   address pair, and for a specific protocol and destination port, e.g.,
-   TCP traffic on port 23 (Telnet). Assume that the implementation also
-   allows BYPASS of traffic from the same source/destination address
-   pair and protocol, but for a different destination port, e.g., port
-   119 (NNTP). An attacker could send a non-initial fragment (with a
-   forged source address) that, if bypassed, could overlap with
-
-
-Kent & Seo                                                     [Page 66]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   IPsec-protected traffic from the same source and thus violate the
-   integrity of the IPsec-protected traffic. Requiring stateful fragment
-   checking for BYPASS entries with non-trivial port ranges prevents
-   attacks of this sort. As noted above, in network configurations where
-   fragments of a packet might be sent or received via different
-   security gateways or BITW implementations, stateful strategies for
-   tracking fragments may fail.
-
-8. Path MTU/DF Processing
-
-   The application of AH or ESP to an outbound packet increases the size
-   of a packet and thus may cause a packet to exceed the PMTU for the SA
-   via which the packet will travel. An IPsec implementation also may
-   receive an unprotected ICMP PMTU message and, if it choose to act
-   upon it, the result will affect outbound traffic processing. This
-   section describes the processing required of an IPsec implementation
-   to deal with these two PMTU issues.
-
-8.1 DF Bit
-
-   All IPsec implementations MUST support the option of copying the DF
-   bit from an outbound packet to the tunnel mode header that it emits,
-   when traffic is carried via a tunnel mode SA. This means that it MUST
-   be possible to configure the implementation's treatment of the DF bit
-   (set, clear, copy from inner header) for each SA. This applies to SAs
-   where both inner and outer headers are IPv4.
-
-8.2 Path MTU Discovery (PMTU)
-
-   This section discusses IPsec handling for unprotected Path MTU
-   Discovery messages.  ICMP PMTU is used here to refer to an ICMP
-   message for:
-
-           IPv4 (RFC 792 [Pos81b]):
-                   - Type = 3 (Destination Unreachable)
-                   - Code = 4 (Fragmentation needed and DF set)
-                   - Next--Hop MTU in the low-order 16 bits of the
-                     second word of the ICMP header (labeled "unused"
-                     in RFC 792), with high-order 16 bits set to zero)
-
-           IPv6 (RFC 2463 [CD98]):
-                   - Type = 2 (Packet Too Big)
-                   - Code = 0 (Fragmentation needed)
-                   - Next-Hop MTU in the 32 bit MTU field of the ICMP6
-                     message
-
-
-
-
-
-
-Kent & Seo                                                     [Page 67]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-8.2.1 Propagation of PMTU
-
-   When an IPsec implementation receives an unauthenticated PMTU
-   message, and it is configured to process (vs. ignore) such messages,
-   it maps the message to the SA to which it corresponds. This mapping
-   is effected by extracting the header information from the payload of
-   the PMTU message and applying the procedure described in Section 5.2.
-   The PMTU determined by this message is used to update the SAD PMTU
-   field, taking into account the size of the AH or ESP header that will
-   be applied, any crypto synchronization data, and the overhead imposed
-   by an additional IP header, in the case of a tunnel mode SA.
-
-   In a native host implementation, it is possible to maintain PMTU data
-   at the same granularity as for unprotected communication, so there is
-   no loss of functionality. Signaling of the PMTU information is
-   internal to the host. For all other IPsec implementation options, the
-   PMTU data must be propagated via a synthesized ICMP PMTU. In these
-   cases, the IPsec implementation SHOULD wait for outbound traffic to
-   be mapped to the SAD entry. When such traffic arrives, if the traffic
-   would exceed the updated PMTU value the traffic MUST be handled as
-   follows:
-
-       Case 1: Original (cleartext) packet is IPv4 and has the DF
-               bit set.  The implementation SHOULD discard the packet
-               and send a PMTU ICMP message.
-
-       Case 2: Original (cleartext) packet is IPv4 and has the DF
-               bit clear. The implementation SHOULD fragment (before or
-               after encryption per its configuration) and then forward
-               the fragments.  It SHOULD NOT send a PMTU ICMP message.
-
-       Case 3: Original (cleartext) packet is IPv6. The implementation
-               SHOULD discard the packet and send a PMTU ICMP message.
-
-8.2.2 PMTU Aging
-
-   In all IPsec implementations the PMTU associated with an SA MUST be
-   "aged" and some mechanism is required to update the PMTU in a timely
-   manner, especially for discovering if the PMTU is smaller than
-   required by current network conditions.  A given PMTU has to remain
-   in place long enough for a packet to get from the source of the SA to
-   the peer, and to propagate an ICMP error message if the current PMTU
-   is too big.
-
-   Implementations SHOULD use the approach described in the Path MTU
-   Discovery document (RFC 1191 [MD90], Section 6.3), which suggests
-   periodically resetting the PMTU to the first-hop data-link MTU and
-   then letting the normal PMTU Discovery processes update the PMTU as
-   necessary. The period SHOULD be configurable.
-
-
-Kent & Seo                                                     [Page 68]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-9. Auditing
-
-   IPsec implementations are not required to support auditing.  For the
-   most part, the granularity of auditing is a local matter.  However,
-   several auditable events are identified in this document and for each
-   of these events a minimum set of information that SHOULD be included
-   in an audit log is defined.  Additional information also MAY be
-   included in the audit log for each of these events, and additional
-   events, not explicitly called out in this specification, also MAY
-   result in audit log entries.  There is no requirement for the
-   receiver to transmit any message to the purported transmitter in
-   response to the detection of an auditable event, because of the
-   potential to induce denial of service via such action.
-
-10. Conformance Requirements
-
-   All IPv4 IPsec implementations MUST comply with all requirements of
-   this document.  All IPv6 implementations MUST comply with all
-   requirements of this document.
-
-11. Security Considerations
-
-   The focus of this document is security; hence security considerations
-   permeate this specification.
-
-   IPsec imposes stringent constraints on bypass of IP header data in
-   both directions, across the IPsec barrier, especially when tunnel
-   mode SAs are employed. Some constraints are absolute, while others
-   are subject to local administrative controls, often on a per-SA
-   basis. For outbound traffic, these constraints are designed to limit
-   covert channel bandwidth. For inbound traffic, the constraints are
-   designed to prevent an adversary who has the ability to tamper with
-   one data stream (on the unprotected side of the IPsec barrier) from
-   adversely affecting other data streams (on the protected side of the
-   barrier). The discussion in Section 5 dealing with processing DSCP
-   values for tunnel mode SAs illustrates this concern.
-
-   If an IPsec implementation is configured to pass ICMP error messages
-   over SAs based on the ICMP header values, without checking the header
-   information from the ICMP message payload, serious vulnerabilities
-   may arise. Consider a scenario in which several sites (A, B, and C)
-   are connected to one another via ESP-protected tunnels: A-B, A-C, and
-   B-C. Also assume that the traffic selectors for each tunnel specify
-   ANY for protocol and port fields and IP source/destination address
-   ranges that encompass the address range for the systems behind the
-   security gateways serving each site. This would allow a host at site
-   B to send an ICMP destination dead message to any host at site A,
-   that declares all hosts on the net at site C to be unreachable. This
-   is a very efficient DoS attack that could have been prevented if the
-
-
-Kent & Seo                                                     [Page 69]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   ICMP error messages were subjected to the checks that IPsec provides,
-   if the SPD is suitably configured, as described in Section 6.2.
-
-12. IANA Considerations
-
-   Upon approval of this draft for publication as an RFC, this document
-   requests that IANA fill in the number (xx) for the asn1-modules
-   registry and assign the object identifier (yy) for the spd-module in
-   Appendix C "ASN.1 for an SPD Entry".
-
-13. Differences from RFC 2401
-
-   This architecture document differs substantially from RFC 2401 in
-   detail and in organization, but the fundamental notions are
-   unchanged.
-
-   o The processing model has been revised to address new IPsec
-      scenarios, improve performance and simplify implementation.  This
-      includes a separation between forwarding (routing) and SPD
-      selection, several SPD changes, and the addition of an outbound
-      SPD cache and an inbound SPD cache for bypassed or discarded
-      traffic.  There is also a new database, the Peer Authorization
-      Database (PAD). This provides a link between an SA management
-      protocol like IKE and the SPD.
-
-   o There is no longer a requirement to support nested SAs or "SA
-      bundles."  Instead this functionality can be achieved through SPD
-      and forwarding table configuration.  An example of a configuration
-      has been added in Appendix E.
-
-   o SPD entries were redefined to provide more flexibility. Each SPD
-      entry now consists of 1 to N sets of selectors, where each
-      selector set contains one protocol and a "list of ranges" can now
-      be specified for the Local IP address, Remote IP address, and
-      whatever fields (if any) are associated with the Next Layer
-      Protocol (Local Port, Remote Port, ICMP message type and code, and
-      Mobility Header Type).  An individual value for a selector is
-      represented via a trivial range and ANY is represented via a range
-      than spans all values for the selector. An example of an ASN.1
-      description is included in Appendix C.
-
-   o TOS (IPv4) and Traffic Class (IPv6) have been replaced by DSCP and
-      ECN. The tunnel section has been updated to explain how to handle
-      DSCP and ECN bits.
-
-   o For tunnel mode SAs, an SG, BITS, or BITW implementation is now
-      allowed to fragment packets before applying IPsec.  This applies
-      only to IPv4.  For IPv6 packets, only the originator is allowed to
-      fragment them.
-
-
-Kent & Seo                                                     [Page 70]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   o When security is desired between two intermediate systems along a
-      path or between an intermediate system and an end system,
-      transport mode may now be used between security gateways and
-      between a security gateway and a host.
-
-   o This document clarifies that for all traffic that crosses the IPsec
-      boundary, including IPsec management traffic, the SPD or
-      associated caches must be consulted.
-
-   o This document defines how to handle the situation of a security
-      gateway with multiple subscribers requiring separate IPsec
-      contexts.
-
-   o A definition of reserved SPIs has been added.
-
-   o Text has been added explaining why ALL IP packets must be checked
-      -- IPsec includes minimal firewall functionality to support access
-      control at the IP layer.
-
-   o The tunnel section has been updated to clarify how to handle the IP
-      options field and IPv6 extension headers when constructing the
-      outer header.
-
-   o SA mapping for inbound traffic has been updated to be consistent
-      with the changes made in AH and ESP for support of unicast and
-      multicast SAs.
-
-   o Guidance has been added re: how to handle the covert channel
-      created in tunnel mode by copying the DSCP value to outer header.
-
-   o Support for AH in both IPv4 and IPv6 is no longer required.
-
-   o PMTU handling has been updated. The appendix on
-      PMTU/DF/Fragmentation has been deleted.
-
-
-   o Three approaches have been added for handling plaintext fragments
-      on the protected side of the IPsec boundary. Appendix D documents
-      the rationale behind them.
-
-   o Added revised text describing how to derive selector values for SAs
-      (from the SPD entry or from the packet, etc.)
-
-   o Added a new table describing the relationship between selector
-      values in an SPD entry, the PFP flag, and resulting selector
-      values in the corresponding SAD entry.
-
-   o Added Appendix B to describe decorrelation.
-
-
-
-Kent & Seo                                                     [Page 71]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   o Added text describing how to handle an outbound packet which must
-      be discarded.
-
-   o Added text describing how to handle a DISCARDED inbound packet,
-      i.e., one that does not match the SA upon which it arrived.
-
-   o IPv6 mobility header has been added as a possible Next Layer
-      Protocol. IPv6 mobility header message type has been added as a
-      selector.
-
-   o ICMP message type and code have been added as selectors.
-
-   o The selector "data sensitivity level" has been removed to simplify
-      things.
-
-   o Updated text describing handling ICMP error messages.  The appendix
-      on "Categorization of ICMP messages" has been deleted.
-
-   o The text for the selector name has been updated and clarified.
-
-   o The "Next Layer Protocol" has been further explained and a default
-      list of protocols to skip when looking for the Next Layer Protocol
-      has been added.
-
-   o The text has been amended to say that this document assumes use of
-      IKE v2 or an SA management protocol with comparable features.
-
-   o Text has been added clarifying the algorithm for mapping inbound
-      IPsec datagrams to SAs in the presence of multicast SAs.
-
-   o The appendix "Sequence Space Window Code Example" has been removed.
-
-   o With respect to IP addresses and ports, the terms "Local" and
-      "Remote" are used for policy rules (replacing source and
-      destination).  "Local" refers to the entity being protected by an
-      IPsec implementation, i.e., the "source" address/port of outbound
-      packets or the "destination" address/port of inbound packets.
-      "Remote" refers to a peer entity or peer entities. The terms
-      "source" and "destination" are still used for packet header
-      fields.
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 72]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-Acknowledgements
-
-   The authors would like to acknowledge the contributions of Ran
-   Atkinson, who played a critical role in initial IPsec activities, and
-   who authored the first series of IPsec standards: RFCs 1825-1827; and
-   Charlie Lynn, who made significant contributions to the second series
-   of IPsec standards (RFCs 2401,2402,and 2406) and to the current
-   versions, especially with regard to IPv6 issues.  The authors also
-   would like to thank the members of the IPsec and MSEC working groups
-   who have contributed to the development of this protocol
-   specification.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 73]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-Appendix A -- Glossary
-
-This section provides definitions for several key terms that are
-employed in this document.  Other documents provide additional
-definitions and background information relevant to this technology,
-e.g., [Shi00, VK83, HA94].  Included in this glossary are generic
-security service and security mechanism terms, plus IPsec-specific
-terms.
-
-   Access Control
-      Access control is a security service that prevents unauthorized
-      use of a resource, including the prevention of use of a resource
-      in an unauthorized manner.  In the IPsec context, the resource to
-      which access is being controlled is often:
-               o for a host, computing cycles or data
-               o for a security gateway, a network behind the gateway
-                 or bandwidth on that network.
-
-   Anti-replay
-      [See "Integrity" below]
-
-   Authentication
-      This term is used informally to refer to the combination of two
-      nominally distinct security services, data origin authentication
-      and connectionless integrity.  See the definitions below for each
-      of these services.
-
-   Availability
-      Availability, when viewed as a security service, addresses the
-      security concerns engendered by attacks against networks that deny
-      or degrade service.  For example, in the IPsec context, the use of
-      anti-replay mechanisms in AH and ESP support availability.
-
-   Confidentiality
-      Confidentiality is the security service that protects data from
-      unauthorized disclosure.  The primary confidentiality concern in
-      most instances is unauthorized disclosure of application level
-      data, but disclosure of the external characteristics of
-      communication also can be a concern in some circumstances.
-      Traffic flow confidentiality is the service that addresses this
-      latter concern by concealing source and destination addresses,
-      message length, or frequency of communication.  In the IPsec
-      context, using ESP in tunnel mode, especially at a security
-      gateway, can provide some level of traffic flow confidentiality.
-      (See also traffic analysis, below.)
-
-   Data Origin Authentication
-      Data origin authentication is a security service that verifies the
-      identity of the claimed source of data.  This service is usually
-
-
-Kent & Seo                                                     [Page 74]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      bundled with connectionless integrity service.
-
-   Encryption
-      Encryption is a security mechanism used to transform data from an
-      intelligible form (plaintext) into an unintelligible form
-      (ciphertext), to provide confidentiality.  The inverse
-      transformation process is designated "decryption".  Oftimes the
-      term "encryption" is used to generically refer to both processes.
-
-   Integrity
-      Integrity is a security service that ensures that modifications to
-      data are detectable.  Integrity comes in various flavors to match
-      application requirements.  IPsec supports two forms of integrity:
-      connectionless and a form of partial sequence integrity.
-      Connectionless integrity is a service that detects modification of
-      an individual IP datagram, without regard to the ordering of the
-      datagram in a stream of traffic.  The form of partial sequence
-      integrity offered in IPsec is referred to as anti-replay
-      integrity, and it detects arrival of duplicate IP datagrams
-      (within a constrained window).  This is in contrast to
-      connection-oriented integrity, which imposes more stringent
-      sequencing requirements on traffic, e.g., to be able to detect
-      lost or re-ordered messages.  Although authentication and
-      integrity services often are cited separately, in practice they
-      are intimately connected and almost always offered in tandem.
-
-   Protected vs Unprotected
-      "Protected" refers to the systems or interfaces that are inside
-      the IPsec protection boundary and "unprotected" refers to the
-      systems or interfaces that are outside the IPsec protection
-      boundary. IPsec provides a boundary through which traffic passes.
-      There is an asymmetry to this barrier, which is reflected in the
-      processing model. Outbound data, if not discarded or bypassed, is
-      protected via the application of AH or ESP and the addition of the
-      corresponding headers.  Inbound data, if not discarded or
-      bypassed, is processed via the removal of AH or ESP headers. In
-      this document, inbound traffic enters an IPsec implementation from
-      the "unprotected" interface.  Outbound traffic enters the
-      implementation via the "protected" interface, or is internally
-      generated by the implementation on the "protected" side of the
-      boundary and directed toward the "unprotected" interface. An IPsec
-      implementation may support more than one interface on either or
-      both sides of the boundary.  The protected interface may be
-      internal, e.g., in a host implementation of IPsec.  The protected
-      interface may link to a socket layer interface presented by the
-      OS.
-
-   Security Association (SA)
-      A simplex (uni-directional) logical connection, created for
-
-
-Kent & Seo                                                     [Page 75]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-      security purposes.  All traffic traversing an SA is provided the
-      same security processing.  In IPsec, an SA is an internet layer
-      abstraction implemented through the use of AH or ESP.  State data
-      associated with an SA is represented in the SA Database (SAD).
-
-   Security Gateway
-      A security gateway is an intermediate system that acts as the
-      communications interface between two networks.  The set of hosts
-      (and networks) on the external side of the security gateway is
-      termed unprotected (they are generally at least less protected
-      than those "behind" the SG), while the networks and hosts on the
-      internal side are viewed as protected.  The internal subnets and
-      hosts served by a security gateway are presumed to be trusted by
-      virtue of sharing a common, local, security administration.  (See
-      "Trusted Subnetwork" below.)  In the IPsec context, a security
-      gateway is a point at which AH and/or ESP is implemented in order
-      to serve a set of internal hosts, providing security services for
-      these hosts when they communicate with external hosts also
-      employing IPsec (either directly or via another security gateway).
-
-   SPI
-      Acronym for "Security Parameters Index" (SPI). The SPI is an
-      arbitrary 32-bit value that is used by a receiver to identify the
-      SA to which an incoming packet should be bound. For a unicast SA,
-      the SPI can be used by itself to specify an SA, or it may be used
-      in conjunction with the IPsec protocol type.  Additional IP
-      address information is used to identify multicast SAs. The SPI is
-      carried in AH and ESP protocols to enable the receiving system to
-      select the SA under which a received packet will be processed.  An
-      SPI has only local significance, as defined by the creator of the
-      SA (usually the receiver of the packet carrying the SPI); thus an
-      SPI is generally viewed as an opaque bit string.  However, the
-      creator of an SA may choose to interpret the bits in an SPI to
-      facilitate local processing.
-
-   Traffic Analysis
-      The analysis of network traffic flow for the purpose of deducing
-      information that is useful to an adversary.  Examples of such
-      information are frequency of transmission, the identities of the
-      conversing parties, sizes of packets, flow identifiers, etc.
-      [Sch94]
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 76]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-Appendix B - Decorrelation
-
-   This appendix is based on work done for caching of policies in the IP
-   Security Policy Working Group by Luis Sanchez, Matt Condell, and John
-   Zao.
-
-   Two SPD entries are correlated if there is a non-null intersection
-   between the values of corresponding selectors in each entry.  Caching
-   correlated SPD entries can lead to incorrect policy enforcement.  A
-   solution to this problem, that still allows for caching, is to remove
-   the ambiguities by decorrelating the entries.  That is, the SPD
-   entries must be rewritten so that for every pair of entries there
-   exists a selector for which there is a null intersection between the
-   values in both of the entries. Once the entries are decorrelated,
-   there is no longer any ordering requirement on them, since only one
-   entry will match any lookup.  The next section describes
-   decorrelation in more detail and presents an algorithm that may be
-   used to implement decorrelation.
-
-   B.1 Decorrelation Algorithm
-
-   The basic decorrelation algorithm takes each entry in a correlated
-   SPD and divides it up into a set of entries using a tree structure.
-   The nodes of the tree are the selectors that may overlap between the
-   policies.  At each node, the algorithm creates a branch for each of
-   the values of the selector.  It also creates one branch for the
-   complement of the union of all selector values.  Policies are then
-   formed by traversing the tree from the root to each leaf.  The
-   policies at the leaves are compared to the set of already
-   decorrelated policy rules. Each policy at a leaf is either completely
-   overridden by a policy in the already decorrelated set and is
-   discarded or is decorrelated with all the policies in the
-   decorrelated set and is added to it.
-
-   The basic algorithm does not guarantee an optimal set of decorrelated
-   entries.  That is, the entries may be broken up into smaller sets
-   than is necessary, though they will still provide all the necessary
-   policy information.  Some extensions to the basic algorithm are
-   described later to improve this and improve the performance of the
-   algorithm.
-
-           C  A set of ordered, correlated entries (a correlated SPD)
-           Ci The ith entry in C.
-           U  The set of decorrelated entries being built from C
-           Ui The ith entry in U.
-           Sik The kth selection for policy Ci
-           Ai The action for policy Ci
-
-   A policy (SPD entry) P may be expressed as a sequence of selector
-
-
-Kent & Seo                                                     [Page 77]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   values and an action (BYPASS, DISCARD, or PROTECT):
-
-           Ci = Si1 x Si2 x ... x Sik -> Ai
-
-   1) Put C1 in set U as U1
-
-   For each policy Cj (j > 1) in C
-
-   2) If Cj is decorrelated with every entry in U, then add it to U.
-
-   3) If Cj is correlated with one or more entries in U, create a tree
-   rooted at the policy Cj that partitions Cj into a set of decorrelated
-   entries.  The algorithm starts with a root node where no selectors
-   have yet been chosen.
-
-     A) Choose a selector in Cj, Sjn, that has not yet been chosen when
-        traversing the tree from the root to this node.  If there are no
-        selectors not yet used, continue to the next unfinished branch
-        until all branches have been completed.  When the tree is
-        completed, go to step D.
-
-        T is the set of entries in U that are correlated with the entry
-        at this node.
-
-        The entry at this node is the entry formed by the selector
-        values of each of the branches between the root and this node.
-        Any selector values that are not yet represented by branches
-        assume the corresponding selector value in Cj, since the values
-        in Cj represent the maximum value for each selector.
-
-     B) Add a branch to the tree for each value of the selector Sjn that
-        appears in any of the entries in T.  (If the value is a superset
-        of the value of Sjn in Cj, then use the value in Cj, since that
-        value represents the universal set.)  Also add a branch for the
-        complement of the union of all the values of the selector Sjn
-        in T.  When taking the complement, remember that the universal
-        set is the value of Sjn in Cj.  A branch need not be created
-        for the null set.
-
-     C) Repeat A and B until the tree is completed.
-
-     D) The entry to each leaf now represents an entry that is a subset
-        of Cj.  The entries at the leaves completely partition Cj in
-        such a way that each entry is either completely overridden by
-        an entry in U, or is decorrelated with the entries in U.
-
-        Add all the decorrelated entries at the leaves of the tree to U.
-
-   4) Get next Cj and go to 2.
-
-
-Kent & Seo                                                     [Page 78]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-
-   5) When all entries in C have been processed, then U will contain an
-   decorrelated version of C.
-
-   There are several optimizations that can be made to this algorithm.
-   A few of them are presented here.
-
-   It is possible to optimize, or at least improve, the amount of
-   branching that occurs by carefully choosing the order of the
-   selectors used for the next branch.  For example, if a selector Sjn
-   can be chosen so that all the values for that selector in T are equal
-   to or a superset of the value of Sjn in Cj, then only a single branch
-   needs to be created (since the complement will be null).
-
-   Branches of the tree do not have to proceed with the entire
-   decorrelation algorithm.  For example, if a node represents an entry
-   that is decorrelated with all the entries in U, then there is no
-   reason to continue decorrelating that branch.  Also, if a branch is
-   completely overridden by an entry in U, then there is no reason to
-   continue decorrelating the branch.
-
-   An additional optimization is to check to see if a branch is
-   overridden by one of the CORRELATED entries in set C that has already
-   been decorrelated.  That is, if the branch is part of decorrelating
-   Cj, then check to see if it was overridden by an entry Cm, m < j.
-   This is a valid check, since all the entries Cm are already expressed
-   in U.
-
-   Along with checking if an entry is already decorrelated in step 2,
-   check if Cj is overridden by any entry in U. If it is, skip it since
-   it is not relevant.  An entry x is overridden by another entry y if
-   every selector in x is equal to or a subset of the corresponding
-   selector in entry y.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 79]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-Appendix C -- ASN.1 for an SPD Entry
-
-   This appendix is included as an additional way to describe SPD
-   entries, as defined in Section 4.4.1. It uses ASN.1 syntax which has
-   been successfully compiled. This syntax is merely illustrative and
-   need not be employed in an implementation to achieve compliance. The
-   SPD description in Section 4.4.1 is normative.
-
-
-   SPDModule
-
-    {iso(1) org (3) dod (6) internet (1) security (5) mechanisms (5)
-     asn1-modules (xx) spd-module (yy) }
-
-       DEFINITIONS IMPLICIT TAGS ::=
-
-       BEGIN
-
-       IMPORTS
-           RDNSequence FROM PKIX1Explicit88
-             { iso(1) identified-organization(3)
-               dod(6) internet(1) security(5) mechanisms(5) pkix(7)
-               id-mod(0) id-pkix1-explicit(18) } ;
-
-       -- An SPD is a list of policies in decreasing order of preference
-       SPD ::= SEQUENCE OF SPDEntry
-
-       SPDEntry ::= CHOICE {
-           iPsecEntry       IPsecEntry,               -- PROTECT traffic
-           bypassOrDiscard  [0] BypassOrDiscardEntry } -- DISCARD/BYPASS
-
-       IPsecEntry ::= SEQUENCE {       -- Each entry consists of
-           name        NameSets OPTIONAL,
-           pFPs        PacketFlags,    -- Populate from packet flags
-                              -- Applies to ALL of the corresponding
-                              -- traffic selectors in the SelectorLists
-           condition   SelectorLists,  -- Policy "condition"
-           processing  Processing      -- Policy "action"
-           }
-
-       BypassOrDiscardEntry ::= SEQUENCE {
-           bypass      BOOLEAN,        -- TRUE BYPASS, FALSE DISCARD
-           condition   InOutBound }
-
-       InOutBound ::= CHOICE {
-           outbound    [0] SelectorLists,
-           inbound     [1] SelectorLists,
-           bothways    [2] BothWays }
-
-
-
-Kent & Seo                                                     [Page 80]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-       BothWays ::= SEQUENCE {
-           inbound     SelectorLists,
-           outbound    SelectorLists }
-
-       NameSets ::= SEQUENCE {
-           passed      SET OF Names-R,  -- Matched to IKE ID by
-                                        -- responder
-           local       SET OF Names-I } -- Used internally by IKE
-                                        -- initiator
-
-       Names-R ::= CHOICE {                   -- IKE v2 IDs
-           dName       RDNSequence,           -- ID_DER_ASN1_DN
-           fqdn        FQDN,                  -- ID_FQDN
-           rfc822      [0] RFC822Name,        -- ID_RFC822_ADDR
-           keyID       OCTET STRING }         -- KEY_ID
-
-       Names-I ::= OCTET STRING       -- Used internally by IKE
-                                      -- initiator
-
-       FQDN ::= IA5String
-
-       RFC822Name ::= IA5String
-
-       PacketFlags ::= BIT STRING {
-                   -- if set, take selector value from packet
-                   -- establishing SA
-                   -- else use value in SPD entry
-           localAddr  (0),
-           remoteAddr (1),
-           protocol   (2),
-           localPort  (3),
-           remotePort (4)  }
-
-       SelectorLists ::= SET OF SelectorList
-
-       SelectorList ::= SEQUENCE {
-           localAddr   AddrList,
-           remoteAddr  AddrList,
-           protocol    ProtocolChoice }
-
-       Processing ::= SEQUENCE {
-           extSeqNum   BOOLEAN, -- TRUE 64 bit counter, FALSE 32 bit
-           seqOverflow BOOLEAN, -- TRUE rekey, FALSE terminate & audit
-           fragCheck   BOOLEAN, -- TRUE stateful fragment checking,
-                                -- FALSE no stateful fragment checking
-           lifetime    SALifetime,
-           spi         ManualSPI,
-           algorithms  ProcessingAlgs,
-           tunnel      TunnelOptions OPTIONAL } -- if absent, use
-
-
-Kent & Seo                                                     [Page 81]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-                                                -- transport mode
-
-       SALifetime ::= SEQUENCE {
-           seconds   [0] INTEGER OPTIONAL,
-           bytes     [1] INTEGER OPTIONAL }
-
-       ManualSPI ::= SEQUENCE {
-           spi     INTEGER,
-           keys    KeyIDs }
-
-       KeyIDs ::= SEQUENCE OF OCTET STRING
-
-       ProcessingAlgs ::= CHOICE {
-           ah          [0] IntegrityAlgs,  -- AH
-           esp         [1] ESPAlgs}        -- ESP
-
-       ESPAlgs ::= CHOICE {
-           integrity       [0] IntegrityAlgs,       -- integrity only
-           confidentiality [1] ConfidentialityAlgs, -- confidentiality
-                                                    -- only
-           both            [2] IntegrityConfidentialityAlgs,
-           combined        [3] CombinedModeAlgs }
-
-       IntegrityConfidentialityAlgs ::= SEQUENCE {
-           integrity       IntegrityAlgs,
-           confidentiality ConfidentialityAlgs }
-
-       -- Integrity Algorithms, ordered by decreasing preference
-       IntegrityAlgs ::= SEQUENCE OF IntegrityAlg
-
-       -- Confidentiality Algorithms, ordered by decreasing preference
-       ConfidentialityAlgs ::= SEQUENCE OF ConfidentialityAlg
-
-       -- Integrity Algorithms
-       IntegrityAlg ::= SEQUENCE {
-           algorithm   IntegrityAlgType,
-           parameters  ANY -- DEFINED BY algorithm -- OPTIONAL }
-
-       IntegrityAlgType ::= INTEGER {
-           none              (0),
-           auth-HMAC-MD5-96  (1),
-           auth-HMAC-SHA1-96 (2),
-           auth-DES-MAC      (3),
-           auth-KPDK-MD5     (4),
-           auth-AES-XCBC-96  (5)
-       --  tbd (6..65535)
-           }
-
-       -- Confidentiality Algorithms
-
-
-Kent & Seo                                                     [Page 82]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-       ConfidentialityAlg ::= SEQUENCE {
-           algorithm   ConfidentialityAlgType,
-           parameters  ANY -- DEFINED BY algorithm -- OPTIONAL }
-
-       ConfidentialityAlgType ::= INTEGER {
-           encr-DES-IV64   (1),
-           encr-DES        (2),
-           encr-3DES       (3),
-           encr-RC5        (4),
-           encr-IDEA       (5),
-           encr-CAST       (6),
-           encr-BLOWFISH   (7),
-           encr-3IDEA      (8),
-           encr-DES-IV32   (9),
-           encr-RC4       (10),
-           encr-NULL      (11),
-           encr-AES-CBC   (12),
-           encr-AES-CTR   (13)
-       --  tbd (14..65535)
-           }
-
-       CombinedModeAlgs ::= SEQUENCE OF CombinedModeAlg
-
-       CombinedModeAlg ::= SEQUENCE {
-           algorithm   CombinedModeType,
-           parameters  ANY -- DEFINED BY algorithm} -- defined outside
-                                    -- of this document for AES modes.
-
-       CombinedModeType ::= INTEGER {
-           comb-AES-CCM    (1),
-           comb-AES-GCM    (2)
-       --  tbd (3..65535)
-           }
-
-       TunnelOptions ::= SEQUENCE {
-           dscp        DSCP,
-           ecn         BOOLEAN,    -- TRUE Copy CE to inner header
-           df          DF,
-           addresses   TunnelAddresses }
-
-       TunnelAddresses ::= CHOICE {
-           ipv4        IPv4Pair,
-           ipv6        [0] IPv6Pair }
-
-       IPv4Pair ::= SEQUENCE {
-           local       OCTET STRING (SIZE(4)),
-           remote      OCTET STRING (SIZE(4)) }
-
-       IPv6Pair ::= SEQUENCE {
-
-
-Kent & Seo                                                     [Page 83]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-           local       OCTET STRING (SIZE(16)),
-           remote      OCTET STRING (SIZE(16)) }
-
-       DSCP ::= SEQUENCE {
-           copy      BOOLEAN, -- TRUE copy from inner header
-                              -- FALSE do not copy
-           mapping   OCTET STRING OPTIONAL} -- points to table
-                                            -- if no copy
-
-       DF ::= INTEGER {
-           clear   (0),
-           set     (1),
-           copy    (2) }
-
-       ProtocolChoice::= CHOICE {
-           anyProt  AnyProtocol,              -- for ANY protocol
-           noNext   [0] NoNextLayerProtocol,  -- has no next layer
-                                              -- items
-           oneNext  [1] OneNextLayerProtocol, -- has one next layer
-                                              -- item
-           twoNext  [2] TwoNextLayerProtocol, -- has two next layer
-                                              -- items
-           fragment FragmentNoNext }          -- has no next layer
-                                              -- info
-
-       AnyProtocol ::= SEQUENCE {
-           id          INTEGER (0),    -- ANY protocol
-           nextLayer   AnyNextLayers }
-
-       AnyNextLayers ::= SEQUENCE {      -- with either
-           first       AnyNextLayer,     -- ANY next layer selector
-           second      AnyNextLayer }    -- ANY next layer selector
-
-       NoNextLayerProtocol ::= INTEGER (2..254)
-
-       FragmentNoNext ::= INTEGER (44)   -- Fragment identifier
-
-       OneNextLayerProtocol ::= SEQUENCE {
-           id          INTEGER (1..254),   -- ICMP, MH, ICMPv6
-           nextLayer   NextLayerChoice }   -- ICMP Type*256+Code
-                                           -- MH   Type*256
-
-       TwoNextLayerProtocol ::= SEQUENCE {
-           id          INTEGER (2..254),   -- Protocol
-           local       NextLayerChoice,    -- Local and
-           remote      NextLayerChoice }   -- Remote ports
-
-       NextLayerChoice ::= CHOICE {
-           any         AnyNextLayer,
-
-
-Kent & Seo                                                     [Page 84]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-           opaque      [0] OpaqueNextLayer,
-           range       [1] NextLayerRange }
-
-       -- Representation of ANY in next layer field
-       AnyNextLayer ::= SEQUENCE {
-           start       INTEGER (0),
-           end         INTEGER (65535) }
-
-       -- Representation of OPAQUE in next layer field.
-       -- Matches IKE convention
-       OpaqueNextLayer ::= SEQUENCE {
-           start       INTEGER (65535),
-           end         INTEGER (0) }
-
-       -- Range for a next layer field
-       NextLayerRange ::= SEQUENCE {
-           start       INTEGER (0..65535),
-           end         INTEGER (0..65535) }
-
-       -- List of IP addresses
-       AddrList ::= SEQUENCE {
-           v4List      IPv4List OPTIONAL,
-           v6List      [0] IPv6List OPTIONAL }
-
-       -- IPv4 address representations
-       IPv4List ::= SEQUENCE OF IPv4Range
-
-       IPv4Range ::= SEQUENCE {    -- close, but not quite right ...
-           ipv4Start   OCTET STRING (SIZE (4)),
-           ipv4End     OCTET STRING (SIZE (4)) }
-
-       -- IPv6 address representations
-       IPv6List ::= SEQUENCE OF IPv6Range
-
-       IPv6Range ::= SEQUENCE {    -- close, but not quite right ...
-           ipv6Start   OCTET STRING (SIZE (16)),
-           ipv6End     OCTET STRING (SIZE (16)) }
-
-
-       END
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 85]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-Appendix D -- Fragment Handling Rationale
-
-   There are three issues that must be resolved re processing of
-   (plaintext) fragments in IPsec:
-
-        - mapping a non-initial, outbound fragment to the right SA
-          (or finding the right SPD entry)
-        - verifying that a received, non-initial fragment is authorized
-          for the SA via which it is received
-        - mapping outbound and inbound non-initial fragments to the
-          right SPD/cache entry, for BYPASS/DISCARD traffic.
-
-   The first and third issues arise because we need a deterministic
-   algorithm for mapping traffic to SAs (and SPD/cache entries). All
-   three issues are important because we want to make sure that
-   non-initial fragments that cross the IPsec boundary do not cause the
-   access control policies in place at the receiver (or transmitter) to
-   be violated.
-
-D.1 Transport Mode and Fragments
-
-   First, we note that transport mode SAs have been defined to not carry
-   fragments. This is a carryover from RFC 2401, where transport mode
-   SAs always terminated at end points. This is a fundamental
-   requirement because, in the worst case, an IPv4 fragment to which
-   IPsec was applied, might then be fragmented (as a ciphertext packet),
-   en route to the destination. IP fragment reassembly procedures at the
-   IPsec receiver would not be able to distinguish between pre-IPsec
-   fragments and fragments created after IPsec processing.
-
-   For IPv6, only the sender is allowed to fragment a packet. As for
-   IPv4, an IPsec implementation is allowed to fragment tunnel mode
-   packets after IPsec processing, because it is the sender relative to
-   the (outer) tunnel header. However, unlike IPv4, it would be feasible
-   to carry a plaintext fragment on a transport mode SA, because the
-   fragment header in IPv6 would appear after the AH or ESP header, and
-   thus would not cause confusion at the receiver re reassembly.
-   Specifically, the receiver would not attempt reassembly for the
-   fragment until after IPsec processing.  To keep things simple, this
-   specification prohibits carriage of fragments on transport mode SAs
-   for IPv6 traffic.
-
-   When only end systems used transport mode SAs, the prohibition on
-   carriage of fragments was not a problem, since we assumed that the
-   end system could be configured to not offer a fragment to IPsec. For
-   a native host implementation this seems reasonable, and, as someone
-   already noted, RFC 2401 warned that a BITS implementation might have
-   to reassemble fragments before performing an SA lookup. (It would
-   then apply AH or ESP and could re-fragment the packet after IPsec
-
-
-Kent & Seo                                                     [Page 86]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   processing.) Because a BITS implementation is assumed to be able to
-   have access to all traffic emanating from its host, even if the host
-   has multiple interfaces, this was deemed a reasonable mandate.
-
-   In this specification, it is acceptable to use transport mode in
-   cases where the IPsec implementation is not the ultimate destination,
-   e.g., between two SGs. In principle, this creates a new opportunity
-   for outbound, plaintext fragments to be mapped to a transport mode SA
-   for IPsec processing. However, in these new contexts in which a
-   transport mode SA is now approved for use, it seems likely that we
-   can continue to prohibit transmission of fragments, as seen by IPsec,
-   i.e., packets that have an "outer header" with a non-zero fragment
-   offset field. For example, in an IP overlay network, packets being
-   sent over transport mode SAs are IP-in-IP tunneled and thus have the
-   necessary inner header to accommodate fragmentation prior to IPsec
-   processing. When carried via a transport mode SA, IPsec would not
-   examine the inner IP header for such traffic, and thus would not
-   consider the packet to be a fragment.
-
-D.2 Tunnel Mode and Fragments
-
-   For tunnel mode SAs, it has always been the case that outbound
-   fragments might arrive for processing at an IPsec implementation. The
-   need to accommodate fragmented outbound packets can pose a problem
-   because a non-initial fragment generally will not contain the port
-   fields associated with a next layer protocol such as TCP, UDP, or
-   SCTP. Thus, depending on the SPD configuration for a given IPsec
-   implementation, plaintext fragments might or might not pose a
-   problem.
-
-   For example, if the SPD requires that all traffic between two address
-   ranges is offered IPsec protection (no BYPASS or DISCARD SPD entries
-   apply to this address range), then it should be easy to carry
-   non-initial fragments on the SA defined for this address range, since
-   the SPD entry implies an intent to carry ALL traffic between the
-   address ranges. But, if there are multiple SPD entries that could
-   match a fragment, and if these entries reference different subsets of
-   port fields (vs. ANY), then it is not possible to map an outbound
-   non-initial fragment to the right entry, unambiguously. (If we choose
-   to allow carriage of fragments on transport mode SAs for IPv6, the
-   problems arises in that context as well.)
-
-   This problem largely, though not exclusively, motivated the
-   definition of OPAQUE as a selector value for port fields in RFC 2401.
-   The other motivation for OPAQUE is the observation that port fields
-   might not be accessible due to the prior application of IPsec. For
-   example, if a host applied IPsec to its traffic and that traffic
-   arrived at an SG, these fields would be encrypted. The algorithm
-   specified for locating the "next layer protocol" described in RFC
-
-
-Kent & Seo                                                     [Page 87]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   2401 also motivated use of OPAQUE to accommodate an encrypted next
-   layer protocol field in such circumstances. Nonetheless, the primary
-   use of the OPAQUE value was to match traffic selector fields in
-   packets that did not contain port fields (non-initial fragments), or
-   packets in which the port fields were already encrypted (as a result
-   of nested application of IPsec). RFC 2401 was ambiguous in discussing
-   the use of OPAQUE vs. ANY, suggesting in some places that ANY might
-   be an alternative to OPAQUE.
-
-   We gain additional access control capability by defining both ANY and
-   OPAQUE values. OPAQUE can be defined to match only fields that are
-   not accessible. We could define ANY as the complement of OPAQUE,
-   i.e., it would match all values but only for accessible port fields.
-   We have therefore simplified the procedure employed to locate the
-   next layer protocol in this document, so that we treat ESP and AH as
-   next layer protocols. As a result, the notion of an encrypted next
-   layer protocol field has vanished, and there is also no need to worry
-   about encrypted port fields either. And accordingly, OPAQUE will be
-   applicable only to non-initial fragments.
-
-   Since we have adopted the definitions above for ANY and OPAQUE, we
-   need to clarify how these values work when the specified protocol
-   does not have port fields, and when ANY is used for the protocol
-   selector.  Accordingly, if a specific protocol value is used as a
-   selector, and if that protocol has no port fields, then the port
-   field selectors are to be ignored and ANY MUST be specified as the
-   value for the port fields. (In this context, ICMP TYPE and CODE
-   values are lumped together as a single port field (for IKE v2
-   negotiation), as is the IPv6 Mobility Header TYPE value.) If the
-   protocol selector is ANY, then this should be treated as equivalent
-   to specifying a protocol for which no port fields are defined, and
-   thus the port selectors should be ignored, and MUST be set to ANY.
-
-D.3. The Problem of Non-Initial Fragments
-
-   For an SG implementation, it is obvious that fragments might arrive
-   from end systems behind the SG. A BITW implementation also may
-   encounter fragments from a host or gateway behind it. (As noted
-   earlier, native host implementations and BITS implementations
-   probably can avoid the problems described below.) In the worst case,
-   fragments from a packet might arrive at distinct BITW or SG
-   instantiations and thus preclude reassembly as a solution option.
-   Hence, in RFC 2401 we adopted a general requirement that fragments
-   must be accommodated in tunnel mode for all implementations. However,
-   RFC 2401 did not provide a perfect solution. The use of OPAQUE as a
-   selector value for port fields (a SHOULD in RFC 2401) allowed an SA
-   to carry non-initial fragments.
-
-   Using the features defined in RFC 2401, if one defined an SA between
-
-
-Kent & Seo                                                     [Page 88]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   two IPsec (SG or BITW) implementations using the OPAQUE value for
-   both port fields, then all non-initial fragments matching the S/D
-   address and protocol values for the SA would be mapped to that SA.
-   Initial fragments would NOT map to this SA, if we adopt a strict
-   definition of OPAQUE. However, RFC 2401 did not provide detailed
-   guidance on this and thus it may not have been apparent that use of
-   this feature would essentially create a "non-initial fragment only"
-   SA.
-
-   In the course of discussing the "fragment-only" SA approach, it was
-   noted that some subtle problems, problems not considered in RFC 2401,
-   would have to be avoided. For example, an SA of this sort must be
-   configured to offer the "highest quality" security services for any
-   traffic between the indicated S/D addresses (for the specified
-   protocol). This is necessary to ensure that any traffic captured by
-   the fragment-only SA is not offered degraded security relative to
-   what it would have been offered if the packet were not fragmented. A
-   possible problem here is that we may not be able to identify the
-   "highest quality" security services defined for use between two IPsec
-   implementation, since the choice of security protocols, options, and
-   algorithms is a lattice, not a totally ordered set. (We might safely
-   say that BYPASS < AH < ESP w/integrity, but it gets complicated if we
-   have multiple ESP encryption or integrity algorithm options.) So, one
-   has to impose a total ordering on these security parameters to make
-   this work, but this can be done locally.
-
-   However, this conservative strategy has a possible performance down
-   side; if most traffic traversing an IPsec implementation for a given
-   S/D address pair (and specified protocol) is bypassed, then a
-   fragment-only SA for that address pair might cause a dramatic
-   increase in the volume of traffic afforded crypto processing. If the
-   crypto implementation cannot support high traffic rates, this could
-   cause problems. (An IPsec implementation that is capable of line rate
-   or near line rate crypto performance would not be adversely affected
-   by this SA configuration approach. Nonetheless, the performance
-   impact is a potential concern, specific to implementation
-   capabilities.)
-
-   Another concern is that non-initial fragments sent over a dedicated
-   SA might be used to effect overlapping reassembly attacks, when
-   combined with an apparently acceptable initial fragment. (This sort
-   of attack assumes creation of bogus fragments, and is not a side
-   effect of normal fragmentation.) This concern is easily addressed in
-   IPv4, by checking the fragment offset value to ensure that no
-   non-initial fragments have a small enough offset to overlap port
-   fields that should be contained in the initial fragment. Recall that
-   the IPv4 MTU minimum is 576 bytes, and the max IP header length is 60
-   bytes, so any ports should be present in the initial fragment. If we
-   require all non-initial fragments to have an offset of say 128 or
-
-
-Kent & Seo                                                     [Page 89]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   greater, just to be on the safe side, this should prevent successful
-   attacks of this sort. If the intent is only to protect against this
-   sort of reassembly attack, this check need be implemented only by a
-   receiver.
-
-   IPv6 also has a fragment offset, carried in the fragmentation
-   extension header. However, IPv6 extension headers are variable in
-   length and there is no analogous max header length value that we can
-   use to check non-initial fragments, to reject ones that might be used
-   for an attack of the sort noted above. A receiver would need to
-   maintain state analogous to reassembly state, to provide equivalent
-   protection. So, only for IPv4 it is feasible to impose a fragment
-   offset check that would reject attacks designed to circumvent port
-   field checks by IPsec (or firewalls) when passing non-initial
-   fragments.
-
-   Another possible concern is that in some topologies and SPD
-   configurations this approach might result in an access control
-   surprise. The notion is that if we create an SA to carry ALL
-   (non-initial) fragments then that SA would carry some traffic that
-   might otherwise arrive as plaintext via a separate path, e.g., a path
-   monitored by a proxy firewall. But, this concern arises only if the
-   other path allows initial fragments to traverse it without requiring
-   reassembly, presumably a bad idea for a proxy firewall. Nonetheless,
-   this does represent a potential problem in some topologies and under
-   certain assumptions re: SPD and (other) firewall rule sets, and
-   administrators need to be warned of this possibility.
-
-   A less serious concern is that non-initial fragments sent over a
-   non-initial fragment-only SA might represent a DoS opportunity, in
-   that they could be sent when no valid, initial fragment will ever
-   arrive. This might be used to attack hosts behind an SG or BITW
-   device. However, the incremental risk posed by this sort of attack,
-   which can be mounted only by hosts behind an SG or BITW device, seems
-   small.
-
-   If we interpret the ANY selector value as encompassing OPAQUE, then a
-   single SA with ANY values for both port fields would be able to
-   accommodate all traffic matching the S/D address and protocol traffic
-   selectors, an alternative to using the OPAQUE value. But, using ANY
-   here precludes multiple, distinct SAs between the same IPsec
-   implementations for the same address pairs and protocol. So, it is
-   not an exactly equivalent alternative.
-
-   Fundamentally, fragment handling problems arise only when more than
-   one SA is defined with the same S/D address and protocol selector
-   values, but with different port field selector values.
-
-
-
-
-Kent & Seo                                                     [Page 90]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-D.4 BYPASS/DISCARD Traffic
-
-   We also have to address the non-initial fragment processing issue for
-   BYPASS/DISCARD entries, independent of SA processing. This is largely
-   a local matter for two reasons:
-           1) We have no means for coordinating SPD entries for such
-              traffic between IPsec implementations since IKE is not
-              invoked.
-           2) Many of these entries refer to traffic that is NOT
-              directed to or received from a location that is using
-              IPsec. So there is no peer IPsec implementation with
-              which to coordinate via any means.
-
-   However, this document should provide guidance here, consistent with
-   our goal of offering a well-defined, access control function for all
-   traffic, relative to the IPsec boundary. To that end, this document
-   says that implementations MUST support fragment reassembly for
-   BYPASS/DISCARD traffic when port fields are specified. An
-   implementation also MUST permit a user or administrator to accept
-   such traffic or reject such traffic using the SPD conventions
-   described in Secion 4.4.1.  The concern is that BYPASS of a
-   cleartext, non-initial fragment arriving at an IPsec implementation
-   could undermine the security afforded IPsec-protected traffic
-   directed to the same destination. For example, consider an IPsec
-   implementation configured with an SPD entry that calls for
-   IPsec-protection of traffic between a specific source/destination
-   address pair, and for a specific protocol and destination port, e.g.,
-   TCP traffic on port 23 (Telnet). Assume that the implementation also
-   allows BYPASS of traffic from the same source/destination address
-   pair and protocol, but for a different destination port, e.g., port
-   119 (NNTP). An attacker could send a non-initial fragment (with a
-   forged source address) that, if bypassed, could overlap with
-   IPsec-protected traffic from the same source and thus violate the
-   integrity of the IPsec-protected traffic. Requiring stateful fragment
-   checking for BYPASS entries with non-trivial port ranges prevents
-   attacks of this sort.
-
-D.5 Just say no to ports?
-
-   It has been suggested that we could avoid the problems described
-   above by not allowing port field selectors to be used in tunnel mode.
-   But the discussion above shows this to be an unnecessarily stringent
-   approach, i.e., since no problems arise for the native OS and BITS
-   implementations. Moreover, some WG members have described scenarios
-   where use of tunnel mode SAs with (non-trivial) port field selectors
-   is appropriate. So the challenge is defining a strategy that can deal
-   with this problem in BITW and SG contexts. Also note that
-   BYPASS/DISCARD entries in the SPD that make use of ports pose the
-   same problems, irrespective of tunnel vs. transport mode notions.
-
-
-Kent & Seo                                                     [Page 91]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   Some folks have suggested that a firewall behind an SG or BITW should
-   be left to enforce port level access controls, and the effects of
-   fragmentation. However, this seems to be an incongruous suggestion in
-   that elsewhere in IPsec (e.g., in IKE payloads) we are concerned
-   about firewalls that always discard fragments. If many firewalls
-   don't pass fragments in general, why should we expect them to deal
-   with fragments in this case? So, this analysis rejects the suggestion
-   of disallowing use of port field selectors with tunnel mode SAs.
-
-D.6 Other Suggested Solutions
-
-   One suggestion is to reassemble fragments at the sending IPsec
-   implementation, and thus avoid the problem entirely. This approach is
-   invisible to a receiver and thus could be adopted as a purely local
-   implementation option.
-
-   A more sophisticated version of this suggestion calls for
-   establishing and maintaining minimal state from each initial fragment
-   encountered, to allow non-initial fragments to be matched to the
-   right SAs or SPD/cache entries. This implies an extension to the
-   current processing model (and the old one). The IPsec implementation
-   would intercept all fragments, capture Source/Destination IP
-   addresses, protocol, packet ID, and port fields from initial
-   fragments and then use this data to map non-initial fragments to SAs
-   that require port fields. If this approach is employed, the receiver
-   needs to employ an equivalent scheme, as it too must verify that
-   received fragments are consistent with SA selector values. A
-   non-initial fragment that arrives prior to an initial fragment could
-   be cached or discarded, awaiting arrival of the corresponding initial
-   fragment.
-
-   A downside of both approaches noted above is that they will not
-   always work. When a BITW device or SG is configured in a topology
-   that might allow some fragments for a packet to be processed at
-   different SGs or BITW devices, then there is no guarantee that all
-   fragments will ever arrive at the same IPsec device. This approach
-   also raises possible processing problems. If the sender caches
-   non-initial fragments until the corresponding initial fragment
-   arrives, buffering problems might arise, especially at high speeds.
-   If the non-initial fragments are discarded rather than cached, there
-   is no guarantee that traffic will ever pass, e.g., retransmission
-   will result in different packet IDs that cannot be matched with prior
-   transmissions. In any case, housekeeping procedures will be needed to
-   decide when to delete the fragment state data, adding some complexity
-   to the system. Nonetheless, this is a viable solution in some
-   topologies, and these are likely to be common topologies.
-
-   The Working Group rejected an earlier version of the convention of
-   creating an SA to carry only non-initial fragments, something that
-
-
-Kent & Seo                                                     [Page 92]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   was supported implicitly under the RFC 2401 model via use of OPAQUE
-   port fields, but never clearly articulated in RFC 2401. The
-   (rejected) text called for each non-initial fragment to be treated as
-   protocol 44 (the IPv6 fragment header protocol ID) by the sender and
-   receiver. This approach has the potential to make IPv4 and IPv6
-   fragment handling more uniform, but it does not fundamentally change
-   the problem, nor does it address the issue of fragment handling for
-   BYPASS/DISCARD traffic. Given the fragment overlap attack problem
-   that IPv6 poses, it does not seem that it is worth the effort to
-   adopt this strategy.
-
-D.7 Consistency
-
-   Earlier the WG agreed to allow an IPsec BITS, BITW or SG to perform
-   fragmentation prior to IPsec processing. If this fragmentation is
-   performed after SA lookup at the sender, there is no "mapping to the
-   right SA" problem. But, the receiver still needs to be able to verify
-   that the non-initial fragments are consistent with the SA via which
-   they are received. Since the initial fragment might be lost en route,
-   the receiver encounters all of the potential problems noted above.
-   Thus, if we are to be consistent in our decisions, we need to say how
-   a receiver will deal with the non-initial fragments that arrive.
-
-D.8 Conclusions
-
-   There is no simple, uniform way to handle fragments in all contexts.
-   Different approaches work better in different contexts.  Thus this
-   document offers 3 choices -- one MUST and two MAYs.  At some point in
-   the future, if the community gains experience with the two MAYs, they
-   may become SHOULDs or MUSTs or other approaches may be proposed.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 93]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-Appendix E - Example of Supporting Nested SAs via SPD and Forwarding
-Table Entries
-
-   This appendix provides an example of how to configure the SPD and
-   forwarding tables to support a nested pair of SAs, consistent with
-   the new processing model.  For simplicity, this example assumes just
-   one SPD-I.
-
-   The goal in this example is to support a transport mode SA from A to
-   C, carried over a tunnel mode SA from A to B. For example, A might be
-   a laptop connected to the public internet, B a firewall that protects
-   a corporate network, and C a server on the corporate network that
-   demands end-to-end authentication of A's traffic.
-
-         +---+     +---+  +---+
-         | A |=====| B |  | C |
-         |   |------------|   |
-         |   |=====|   |  |   |
-         +---+     +---+  +---+
-
-   A's SPD contains entries of the form:
-
-                        Next Layer
-      Rule Local Remote Protocol   Action
-      ---- ----- ------ ---------- -----------------------
-       1     C     A     ESP       BYPASS
-       2     A     C     ICMP,ESP  PROTECT(ESP,tunnel,integr+conf)
-       3     A     C     ANY       PROTECT(ESP,transport,integr-only)
-       4     A     B     ICMP,IKE  BYPASS
-
-   A's unprotected-side forwarding table is set so that outbound packets
-   destined for C are looped back to the protected side. A's protected
-   side forwarding table is set so that inbound ESP packets are looped
-   back to the unprotected side. A's forwarding tables contain entries
-   of the form:
-
-      Unprotected-side forwarding table
-
-        Rule Local Remote Protocol Action
-        ---- ----- ------ -------- ---------------------------
-         1     A     C       ANY   loop back to protected side
-         2     A     B       ANY   forward to B
-
-      Protected-side forwarding table
-
-        Rule Local Remote Protocol Action
-        ---- ----- ------ -------- -----------------------------
-         1     A     C       ESP   loop back to unprotected side
-
-
-
-Kent & Seo                                                     [Page 94]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   An outbound TCP packet from A to C would match SPD rule 3 and have
-   transport mode ESP applied to it. The unprotected-side forwarding
-   table would then loop back the packet. The packet is compared against
-   SPD-I (see Figure 2), matches SPD rule 1, and so it is BYPASSed. The
-   packet is treated as an outbound packet and compared against the SPD
-   for a third time. This time it matches SPD rule 2, so ESP is applied
-   in tunnel mode. This time the forwarding table doesn't loop back the
-   packet, because the outer destination address is B, so the packet
-   goes out onto the wire.
-
-   An inbound TCP packet from C to A, is wrapped in two ESP headers; the
-   outer header (ESP in tunnel mode) shows B as the source whereas the
-   inner header (ESP transport mode) shows C as the source. Upon arrival
-   at A, the packet would be mapped to an SA based on the SPI, have the
-   outer header removed, and be decrypted and integrity-checked. Then it
-   would be matched against the SAD selectors for this SA, which would
-   specify C as the source and A as the destination, derived from SPD
-   rule 2. The protected-side forwarding function would then send it
-   back to the unprotected side based on the addresses and the next
-   layer protocol (ESP), indicative of nesting. It is compared against
-   SPD-O (see figure 3) and found to match SPD rule 1, so it is
-   BYPASSed. The packet is mapped to an SA based on the SPI,
-   integrity-checked, and compared against the SAD selectors derived
-   from SPD rule 3. The forwarding function then passes it up to the
-   next layer, because it isn't an ESP packet.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 95]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-References
-
-
-Normative
-
-   [BBCDWW98]Blake, S., Black, D., Carlson, M., Davies, E., Wang, Z.,
-             and W. Weiss, "An Architecture for Differentiated Service",
-             RFC 2475, December 1998.
-
-   [Bra97]   Bradner, S., "Key words for use in RFCs to Indicate
-             Requirement Level", BCP 14, RFC 2119, March 1997.
-
-   [CD98]    Conta, A. and S. Deering, "Internet Control Message
-             Protocol (ICMPv6) for the Internet Protocol Version 6
-             (IPv6) Specification", RFC 2463, December 1998.
-
-   [DH98]    Deering, S., and R. Hinden, "Internet Protocol, Version 6
-             (IPv6) Specification", RFC 2460, December 1998.
-
-   [Eas05]   Eastlake, D., "Cryptographic Algorithm Implementation
-             Requirements For ESP And AH", ???, ???? 200?.
-
-             [RFC Editor: Please update reference [Eas05] "Cryptographic
-             Algorithm Implementation Requirements For ESP And AH"
-             (draft-ietf-ipsec-esp-ah-algorithms-02.txt) with the RFC
-             number and month and year when it is issued.]
-
-   [HarCar98]Harkins, D., and Carrel, D., "The Internet Key Exchange
-             (IKE)", RFC 2409, November 1998.
-
-   [Kau05]   Kaufman, C., "The Internet Key Exchange (IKEv2) Protocol",
-             RFC ???, ???? 200?.
-
-             [RFC Editor: Please update the reference [Kau05] "The
-             Internet Key Exchange (IKEv2) Protocol"
-             (draft-ietf-ipsec-ikev2-17.txt) with the RFC number and
-             month and year when it is issued.]
-
-   [Ken05a]  Kent, S., "IP Encapsulating Security Payload (ESP)", RFC
-             ???, ????  200?.
-
-             [RFC Editor: Please update the reference [Ken05a] "IP
-             Encapsulating Security Payload (ESP)"
-             (draft-ietf-ipsec-esp-v3-09.txt) with the RFC number and
-             month and year when it is issued.]
-
-   [Ken05b]  Kent, S., "IP Authentication Header", RFC ???, ??? 200?.
-
-             [RFC Editor: Please update the reference [Ken05b] "IP
-
-
-Kent & Seo                                                     [Page 96]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-             Authentication Header" (draft-ietf-ipsec-rfc2402bis-09.txt)
-             with the RFC number and month and year when it is issued.]
-
-   [MD90]    Mogul, J. and S. Deering, "Path MTU discovery", RFC 1191,
-             November 1990.
-
-   [Pos81a]  Postel, J., "Internet Protocol", STD 5, RFC 791, September
-             1981
-
-   [Pos81b]  Postel, J., "Internet Control Message Protocol", RFC 792,
-             September 1981
-
-   [Sch05]   Schiller, J., "Cryptographic Algorithms for use in the
-             Internet Key Exchange Version 2", RFC ???, ???? 200?
-
-             [RFC Editor: Please update the reference [Sch05]
-             "Cryptographic Algorithms for use in the Internet Key
-             Exchange Version 2"
-             (draft-ietf-ipsec-ikev2-algorithms-05.txt) with the RFC
-             number and month and year when it is issued.]
-
-   [WaKiHo97]Wahl, M., Kille, S., Howes, T., "Lightweight Directory
-             Access Protocol (v3): UTF-8 String Representation of
-             Distinguished Names", RFC 2253, December 1997
-
-Informative
-
-   [CoSa04]  Condell, M., and Sanchez, L. On the Deterministic
-             Enforcement of Un-ordered Security Policies", BBN Technical
-             Memo 1346, March 2004
-
-   [FaLiHaMeTr00]Farinacci, D., Li, T., Hanks, S., Meyer, D., Traina,
-             P., "Generic Routing Encapsulation (GRE), RFC 2784, March
-             2000.
-
-   [Gro02]   Grossman, D., "New Terminology and Clarifications for
-             Diffserv", RFC 3260, April 2002.
-   [HC03]    Holbrook, H., and Cain, B., "Source Specific Multicast for
-             IP", WWork in Progress, November 3, 2002.
-
-   [HA94]    Haller, N., and Atkinson, R., "On Internet Authentication",
-             RFC 1704, October 1994
-
-   [Mobip]   Johnson, D., Perkins, C., Arkko, J., "Mobility Support in
-             IPv6", RFC 3775, June 2004
-
-   [NiBlBaBL98]Nichols, K., Blake, S., Baker, F., Black, D., "Definition
-             of the Differentiated Services Field (DS Field) in the IPv4
-             and IPv6 Headers", RFC2474, December 1998.
-
-
-Kent & Seo                                                     [Page 97]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   [Per96]   Perkins, C., "IP Encapsulation within IP", RFC 2003,
-             October 1996.
-
-   [RaFlBl01]Ramakrishnan, K., Floyd, S., Black, D., "The Addition of
-             Explicit Congestion Notification (ECN) to IP", RFC 3168,
-             September 2001.
-
-   [RFC3547] Baugher, M., Weis, B., Hardjono, T., Harney, H., "The Group
-             Domain of Interpretation", RFC 3547, July 2003.
-
-   [RFC3740] Hardjono, T., Weis, B., "The Multicast Group Security
-             Architecture", RFC 3740, March 2004.
-
-   [RaCoCaDe04]Rajahalme, J., Conta, A., Carpenter, B., Deering, S.,
-             "IPv6 Flow Label Specification, RFC 3697, March 2004.
-
-   [Sch94]   Schneier, B.,  Applied Cryptography, Section 8.6, John
-             Wiley & Sons, New York, NY, 1994.
-
-   [Shi00]   Shirey, R., "Internet Security Glossary", RFC 2828, May
-             2000.
-
-   [SMPT01]  Shacham, A., Monsour, B., Pereira, R., and M. Thomas, "IP
-             Payload Compression Protocol (IPComp)", RFC 3173, September
-             2001.
-
-   [ToEgWa04]Touch, J., Eggert, L., Wang, Y., Use of IPsec Transport
-             Mode for Dynamic Routing, RFC 3884, September 2004.
-
-   [VK83]    V.L. Voydock & S.T. Kent, "Security Mechanisms in
-             High-level Networks", ACM Computing Surveys, Vol. 15, No.
-             2, June 1983.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 98]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-Author Information
-
-   Stephen Kent
-   BBN Technologies
-   10 Moulton Street
-   Cambridge, MA  02138
-   USA
-   Phone: +1 (617) 873-3988
-   EMail: kent@bbn.com
-
-   Karen Seo
-   BBN Technologies
-   10 Moulton Street
-   Cambridge, MA  02138
-   USA
-   Phone: +1 (617) 873-3152
-   EMail: kseo@bbn.com
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                     [Page 99]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-Notices
-
-
-   Intellectual Property
-
-   The IETF takes no position regarding the validity or scope of any
-   Intellectual Property Rights or other rights that might be claimed to
-   pertain to the implementation or use of the technology described in
-   this document or the extent to which any license under such rights
-   might or might not be available; nor does it represent that it has
-   made any independent effort to identify any such rights.  Information
-   on the procedures with respect to rights in RFC documents can be
-   found in BCP 78 and BCP 79.
-
-   Copies of IPR disclosures made to the IETF Secretariat and any
-   assurances of licenses to be made available, or the result of an
-   attempt made to obtain a general license or permission for the use of
-   such proprietary rights by implementers or users of this
-   specification can be obtained from the IETF on-line IPR repository at
-   http://www.ietf.org/ipr.
-
-   The IETF invites any interested party to bring to its attention any
-   copyrights, patents or patent applications, or other proprietary
-   rights that may cover technology that may be required to implement
-   this standard.  Please address the information to the IETF at ietf-
-   ipr@ietf.org.
-
-   Full Copyright Statement
-
-   Copyright (C) The Internet Society (2005). This document is subject
-   to the rights, licenses and restrictions contained in BCP 78, and
-   except as set forth therein, the authors retain all their rights.
-
-   This document and translations of it may be copied and furnished to
-   others, and derivative works that comment on or otherwise explain it
-   or assist in its implmentation may be prepared, copied, published and
-   distributed, in whole or in part, without restriction of any kind,
-   provided that the above copyright notice and this paragraph are
-   included on all such copies and derivative works.  However, this
-   document itself may not be modified in any way, such as by removing
-   the copyright notice or references to the Internet Society or other
-   Internet organizations, except as needed for the purpose of
-   developing Internet standards in which case the procedures for
-   copyrights defined in the Internet Standards process must be
-   followed, or as required to translate it into languages other than
-   English.  The limited permissions granted above are perpetual and
-   will not be revoked by the Internet Society or its successors or
-   assigns.
-
-
-
-Kent & Seo                                                    [Page 100]
-
-Internet Draft        Security Architecture for IP            March 2005
-
-
-   This document and the information contained herein are provided on an
-   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
-   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
-   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
-   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
-   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
-   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-
-
-
-Expires September 2005
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                                                    [Page 101]
diff --git a/doc/ikev2/[QuantitativeAnalyses] - IKEv1 and IKEv2 - A Quantitative Analyses.pdf b/doc/ikev2/[QuantitativeAnalyses] - IKEv1 and IKEv2 - A Quantitative Analyses.pdf
deleted file mode 100644
index a467aea78..000000000
--- a/doc/ikev2/[QuantitativeAnalyses] - IKEv1 and IKEv2 - A Quantitative Analyses.pdf
+++ /dev/null
diff --git a/doc/ikev2/[RFC2104] - HMAC - Keyed-Hashing for Message Authentication.txt b/doc/ikev2/[RFC2104] - HMAC - Keyed-Hashing for Message Authentication.txt
deleted file mode 100644
index 1fb8fe11a..000000000
--- a/doc/ikev2/[RFC2104] - HMAC - Keyed-Hashing for Message Authentication.txt
+++ /dev/null
@@ -1,619 +0,0 @@
-
-
-
-
-
-
-Network Working Group                                       H. Krawczyk
-Request for Comments: 2104                                          IBM
-Category: Informational                                      M. Bellare
-                                                                   UCSD
-                                                             R. Canetti
-                                                                    IBM
-                                                          February 1997
-
-
-             HMAC: Keyed-Hashing for Message Authentication
-
-Status of This Memo
-
-   This memo provides information for the Internet community.  This memo
-   does not specify an Internet standard of any kind.  Distribution of
-   this memo is unlimited.
-
-Abstract
-
-   This document describes HMAC, a mechanism for message authentication
-   using cryptographic hash functions. HMAC can be used with any
-   iterative cryptographic hash function, e.g., MD5, SHA-1, in
-   combination with a secret shared key.  The cryptographic strength of
-   HMAC depends on the properties of the underlying hash function.
-
-1. Introduction
-
-   Providing a way to check the integrity of information transmitted
-   over or stored in an unreliable medium is a prime necessity in the
-   world of open computing and communications. Mechanisms that provide
-   such integrity check based on a secret key are usually called
-   "message authentication codes" (MAC). Typically, message
-   authentication codes are used between two parties that share a secret
-   key in order to validate information transmitted between these
-   parties. In this document we present such a MAC mechanism based on
-   cryptographic hash functions. This mechanism, called HMAC, is based
-   on work by the authors [BCK1] where the construction is presented and
-   cryptographically analyzed. We refer to that work for the details on
-   the rationale and security analysis of HMAC, and its comparison to
-   other keyed-hash methods.
-
-
-
-
-
-
-
-
-
-
-
-Krawczyk, et. al.            Informational                      [Page 1]
-
-RFC 2104                          HMAC                     February 1997
-
-
-   HMAC can be used in combination with any iterated cryptographic hash
-   function. MD5 and SHA-1 are examples of such hash functions. HMAC
-   also uses a secret key for calculation and verification of the
-   message authentication values. The main goals behind this
-   construction are
-
-   * To use, without modifications, available hash functions.
-     In particular, hash functions that perform well in software,
-     and for which code is freely and widely available.
-
-   * To preserve the original performance of the hash function without
-     incurring a significant degradation.
-
-   * To use and handle keys in a simple way.
-
-   * To have a well understood cryptographic analysis of the strength of
-     the authentication mechanism based on reasonable assumptions on the
-     underlying hash function.
-
-   * To allow for easy replaceability of the underlying hash function in
-     case that faster or more secure hash functions are found or
-     required.
-
-   This document specifies HMAC using a generic cryptographic hash
-   function (denoted by H). Specific instantiations of HMAC need to
-   define a particular hash function. Current candidates for such hash
-   functions include SHA-1 [SHA], MD5 [MD5], RIPEMD-128/160 [RIPEMD].
-   These different realizations of HMAC will be denoted by HMAC-SHA1,
-   HMAC-MD5, HMAC-RIPEMD, etc.
-
-   Note: To the date of writing of this document MD5 and SHA-1 are the
-   most widely used cryptographic hash functions. MD5 has been recently
-   shown to be vulnerable to collision search attacks [Dobb].  This
-   attack and other currently known weaknesses of MD5 do not compromise
-   the use of MD5 within HMAC as specified in this document (see
-   [Dobb]); however, SHA-1 appears to be a cryptographically stronger
-   function. To this date, MD5 can be considered for use in HMAC for
-   applications where the superior performance of MD5 is critical.   In
-   any case, implementers and users need to be aware of possible
-   cryptanalytic developments regarding any of these cryptographic hash
-   functions, and the eventual need to replace the underlying hash
-   function. (See section 6 for more information on the security of
-   HMAC.)
-
-
-
-
-
-
-
-
-Krawczyk, et. al.            Informational                      [Page 2]
-
-RFC 2104                          HMAC                     February 1997
-
-
-2. Definition of HMAC
-
-   The definition of HMAC requires a cryptographic hash function, which
-   we denote by H, and a secret key K. We assume H to be a cryptographic
-   hash function where data is hashed by iterating a basic compression
-   function on blocks of data.   We denote by B the byte-length of such
-   blocks (B=64 for all the above mentioned examples of hash functions),
-   and by L the byte-length of hash outputs (L=16 for MD5, L=20 for
-   SHA-1).  The authentication key K can be of any length up to B, the
-   block length of the hash function.  Applications that use keys longer
-   than B bytes will first hash the key using H and then use the
-   resultant L byte string as the actual key to HMAC. In any case the
-   minimal recommended length for K is L bytes (as the hash output
-   length). See section 3 for more information on keys.
-
-   We define two fixed and different strings ipad and opad as follows
-   (the 'i' and 'o' are mnemonics for inner and outer):
-
-                   ipad = the byte 0x36 repeated B times
-                  opad = the byte 0x5C repeated B times.
-
-   To compute HMAC over the data `text' we perform
-
-                    H(K XOR opad, H(K XOR ipad, text))
-
-   Namely,
-
-    (1) append zeros to the end of K to create a B byte string
-        (e.g., if K is of length 20 bytes and B=64, then K will be
-         appended with 44 zero bytes 0x00)
-    (2) XOR (bitwise exclusive-OR) the B byte string computed in step
-        (1) with ipad
-    (3) append the stream of data 'text' to the B byte string resulting
-        from step (2)
-    (4) apply H to the stream generated in step (3)
-    (5) XOR (bitwise exclusive-OR) the B byte string computed in
-        step (1) with opad
-    (6) append the H result from step (4) to the B byte string
-        resulting from step (5)
-    (7) apply H to the stream generated in step (6) and output
-        the result
-
-   For illustration purposes, sample code based on MD5 is provided as an
-   appendix.
-
-
-
-
-
-
-
-Krawczyk, et. al.            Informational                      [Page 3]
-
-RFC 2104                          HMAC                     February 1997
-
-
-3. Keys
-
-   The key for HMAC can be of any length (keys longer than B bytes are
-   first hashed using H).  However, less than L bytes is strongly
-   discouraged as it would decrease the security strength of the
-   function.  Keys longer than L bytes are acceptable but the extra
-   length would not significantly increase the function strength. (A
-   longer key may be advisable if the randomness of the key is
-   considered weak.)
-
-   Keys need to be chosen at random (or using a cryptographically strong
-   pseudo-random generator seeded with a random seed), and periodically
-   refreshed.  (Current attacks do not indicate a specific recommended
-   frequency for key changes as these attacks are practically
-   infeasible.  However, periodic key refreshment is a fundamental
-   security practice that helps against potential weaknesses of the
-   function and keys, and limits the damage of an exposed key.)
-
-4. Implementation Note
-
-   HMAC is defined in such a way that the underlying hash function H can
-   be used with no modification to its code. In particular, it uses the
-   function H with the pre-defined initial value IV (a fixed value
-   specified by each iterative hash function to initialize its
-   compression function).  However, if desired, a performance
-   improvement can be achieved at the cost of (possibly) modifying the
-   code of H to support variable IVs.
-
-   The idea is that the intermediate results of the compression function
-   on the B-byte blocks (K XOR ipad) and (K XOR opad) can be precomputed
-   only once at the time of generation of the key K, or before its first
-   use. These intermediate results are stored and then used to
-   initialize the IV of H each time that a message needs to be
-   authenticated.  This method saves, for each authenticated message,
-   the application of the compression function of H on two B-byte blocks
-   (i.e., on (K XOR ipad) and (K XOR opad)). Such a savings may be
-   significant when authenticating short streams of data.  We stress
-   that the stored intermediate values need to be treated and protected
-   the same as secret keys.
-
-   Choosing to implement HMAC in the above way is a decision of the
-   local implementation and has no effect on inter-operability.
-
-
-
-
-
-
-
-
-
-Krawczyk, et. al.            Informational                      [Page 4]
-
-RFC 2104                          HMAC                     February 1997
-
-
-5. Truncated output
-
-   A well-known practice with message authentication codes is to
-   truncate the output of the MAC and output only part of the bits
-   (e.g., [MM, ANSI]).  Preneel and van Oorschot [PV] show some
-   analytical advantages of truncating the output of hash-based MAC
-   functions. The results in this area are not absolute as for the
-   overall security advantages of truncation. It has advantages (less
-   information on the hash result available to an attacker) and
-   disadvantages (less bits to predict for the attacker).  Applications
-   of HMAC can choose to truncate the output of HMAC by outputting the t
-   leftmost bits of the HMAC computation for some parameter t (namely,
-   the computation is carried in the normal way as defined in section 2
-   above but the end result is truncated to t bits). We recommend that
-   the output length t be not less than half the length of the hash
-   output (to match the birthday attack bound) and not less than 80 bits
-   (a suitable lower bound on the number of bits that need to be
-   predicted by an attacker).  We propose denoting a realization of HMAC
-   that uses a hash function H with t bits of output as HMAC-H-t. For
-   example, HMAC-SHA1-80 denotes HMAC computed using the SHA-1 function
-   and with the output truncated to 80 bits.  (If the parameter t is not
-   specified, e.g. HMAC-MD5, then it is assumed that all the bits of the
-   hash are output.)
-
-6. Security
-
-   The security of the message authentication mechanism presented here
-   depends on cryptographic properties of the hash function H: the
-   resistance to collision finding (limited to the case where the
-   initial value is secret and random, and where the output of the
-   function is not explicitly available to the attacker), and the
-   message authentication property of the compression function of H when
-   applied to single blocks (in HMAC these blocks are partially unknown
-   to an attacker as they contain the result of the inner H computation
-   and, in particular, cannot be fully chosen by the attacker).
-
-   These properties, and actually stronger ones, are commonly assumed
-   for hash functions of the kind used with HMAC. In particular, a hash
-   function for which the above properties do not hold would become
-   unsuitable for most (probably, all) cryptographic applications,
-   including alternative message authentication schemes based on such
-   functions.  (For a complete analysis and rationale of the HMAC
-   function the reader is referred to [BCK1].)
-
-
-
-
-
-
-
-
-Krawczyk, et. al.            Informational                      [Page 5]
-
-RFC 2104                          HMAC                     February 1997
-
-
-   Given the limited confidence gained so far as for the cryptographic
-   strength of candidate hash functions, it is important to observe the
-   following two properties of the HMAC construction and its secure use
-   for message authentication:
-
-   1. The construction is independent of the details of the particular
-   hash function H in use and then the latter can be replaced by any
-   other secure (iterative) cryptographic hash function.
-
-   2. Message authentication, as opposed to encryption, has a
-   "transient" effect. A published breaking of a message authentication
-   scheme would lead to the replacement of that scheme, but would have
-   no adversarial effect on information authenticated in the past.  This
-   is in sharp contrast with encryption, where information encrypted
-   today may suffer from exposure in the future if, and when, the
-   encryption algorithm is broken.
-
-   The strongest attack known against HMAC is based on the frequency of
-   collisions for the hash function H ("birthday attack") [PV,BCK2], and
-   is totally impractical for minimally reasonable hash functions.
-
-   As an example, if we consider a hash function like MD5 where the
-   output length equals L=16 bytes (128 bits) the attacker needs to
-   acquire the correct message authentication tags computed (with the
-   _same_ secret key K!) on about 2**64 known plaintexts.  This would
-   require the processing of at least 2**64 blocks under H, an
-   impossible task in any realistic scenario (for a block length of 64
-   bytes this would take 250,000 years in a continuous 1Gbps link, and
-   without changing the secret key K during all this time).  This attack
-   could become realistic only if serious flaws in the collision
-   behavior of the function H are discovered (e.g.  collisions found
-   after 2**30 messages). Such a discovery would determine the immediate
-   replacement of the function H (the effects of such failure would be
-   far more severe for the traditional uses of H in the context of
-   digital signatures, public key certificates, etc.).
-
-   Note: this attack needs to be strongly contrasted with regular
-   collision attacks on cryptographic hash functions where no secret key
-   is involved and where 2**64 off-line parallelizable (!) operations
-   suffice to find collisions.  The latter attack is approaching
-   feasibility [VW] while the birthday attack on HMAC is totally
-   impractical.  (In the above examples, if one uses a hash function
-   with, say, 160 bit of output then 2**64 should be replaced by 2**80.)
-
-
-
-
-
-
-
-
-Krawczyk, et. al.            Informational                      [Page 6]
-
-RFC 2104                          HMAC                     February 1997
-
-
-   A correct implementation of the above construction, the choice of
-   random (or cryptographically pseudorandom) keys, a secure key
-   exchange mechanism, frequent key refreshments, and good secrecy
-   protection of keys are all essential ingredients for the security of
-   the integrity verification mechanism provided by HMAC.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Krawczyk, et. al.            Informational                      [Page 7]
-
-RFC 2104                          HMAC                     February 1997
-
-
-Appendix -- Sample Code
-
-   For the sake of illustration we provide the following sample code for
-   the implementation of HMAC-MD5 as well as some corresponding test
-   vectors (the code is based on MD5 code as described in [MD5]).
-
-/*
-** Function: hmac_md5
-*/
-
-void
-hmac_md5(text, text_len, key, key_len, digest)
-unsigned char*  text;                /* pointer to data stream */
-int             text_len;            /* length of data stream */
-unsigned char*  key;                 /* pointer to authentication key */
-int             key_len;             /* length of authentication key */
-caddr_t         digest;              /* caller digest to be filled in */
-
-{
-        MD5_CTX context;
-        unsigned char k_ipad[65];    /* inner padding -
-                                      * key XORd with ipad
-                                      */
-        unsigned char k_opad[65];    /* outer padding -
-                                      * key XORd with opad
-                                      */
-        unsigned char tk[16];
-        int i;
-        /* if key is longer than 64 bytes reset it to key=MD5(key) */
-        if (key_len > 64) {
-
-                MD5_CTX      tctx;
-
-                MD5Init(&tctx);
-                MD5Update(&tctx, key, key_len);
-                MD5Final(tk, &tctx);
-
-                key = tk;
-                key_len = 16;
-        }
-
-        /*
-         * the HMAC_MD5 transform looks like:
-         *
-         * MD5(K XOR opad, MD5(K XOR ipad, text))
-         *
-         * where K is an n byte key
-         * ipad is the byte 0x36 repeated 64 times
-
-
-
-Krawczyk, et. al.            Informational                      [Page 8]
-
-RFC 2104                          HMAC                     February 1997
-
-
-         * opad is the byte 0x5c repeated 64 times
-         * and text is the data being protected
-         */
-
-        /* start out by storing key in pads */
-        bzero( k_ipad, sizeof k_ipad);
-        bzero( k_opad, sizeof k_opad);
-        bcopy( key, k_ipad, key_len);
-        bcopy( key, k_opad, key_len);
-
-        /* XOR key with ipad and opad values */
-        for (i=0; i<64; i++) {
-                k_ipad[i] ^= 0x36;
-                k_opad[i] ^= 0x5c;
-        }
-        /*
-         * perform inner MD5
-         */
-        MD5Init(&context);                   /* init context for 1st
-                                              * pass */
-        MD5Update(&context, k_ipad, 64)      /* start with inner pad */
-        MD5Update(&context, text, text_len); /* then text of datagram */
-        MD5Final(digest, &context);          /* finish up 1st pass */
-        /*
-         * perform outer MD5
-         */
-        MD5Init(&context);                   /* init context for 2nd
-                                              * pass */
-        MD5Update(&context, k_opad, 64);     /* start with outer pad */
-        MD5Update(&context, digest, 16);     /* then results of 1st
-                                              * hash */
-        MD5Final(digest, &context);          /* finish up 2nd pass */
-}
-
-Test Vectors (Trailing '\0' of a character string not included in test):
-
-  key =         0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b
-  key_len =     16 bytes
-  data =        "Hi There"
-  data_len =    8  bytes
-  digest =      0x9294727a3638bb1c13f48ef8158bfc9d
-
-  key =         "Jefe"
-  data =        "what do ya want for nothing?"
-  data_len =    28 bytes
-  digest =      0x750c783e6ab0b503eaa86e310a5db738
-
-  key =         0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-
-
-
-Krawczyk, et. al.            Informational                      [Page 9]
-
-RFC 2104                          HMAC                     February 1997
-
-
-  key_len       16 bytes
-  data =        0xDDDDDDDDDDDDDDDDDDDD...
-                ..DDDDDDDDDDDDDDDDDDDD...
-                ..DDDDDDDDDDDDDDDDDDDD...
-                ..DDDDDDDDDDDDDDDDDDDD...
-                ..DDDDDDDDDDDDDDDDDDDD
-  data_len =    50 bytes
-  digest =      0x56be34521d144c88dbb8c733f0e8b3f6
-
-Acknowledgments
-
-   Pau-Chen Cheng, Jeff Kraemer, and Michael Oehler, have provided
-   useful comments on early drafts, and ran the first interoperability
-   tests of this specification. Jeff and Pau-Chen kindly provided the
-   sample code and test vectors that appear in the appendix.  Burt
-   Kaliski, Bart Preneel, Matt Robshaw, Adi Shamir, and Paul van
-   Oorschot have provided useful comments and suggestions during the
-   investigation of the HMAC construction.
-
-References
-
-   [ANSI]  ANSI X9.9, "American National Standard for Financial
-           Institution Message Authentication (Wholesale)," American
-           Bankers Association, 1981.   Revised 1986.
-
-   [Atk]   Atkinson, R., "IP Authentication Header", RFC 1826, August
-           1995.
-
-   [BCK1]  M. Bellare, R. Canetti, and H. Krawczyk,
-           "Keyed Hash Functions and Message Authentication",
-           Proceedings of Crypto'96, LNCS 1109, pp. 1-15.
-           (http://www.research.ibm.com/security/keyed-md5.html)
-
-   [BCK2]  M. Bellare, R. Canetti, and H. Krawczyk,
-           "Pseudorandom Functions Revisited: The Cascade Construction",
-           Proceedings of FOCS'96.
-
-   [Dobb]  H. Dobbertin, "The Status of MD5  After a Recent Attack",
-           RSA Labs' CryptoBytes, Vol. 2 No. 2, Summer 1996.
-           http://www.rsa.com/rsalabs/pubs/cryptobytes.html
-
-   [PV]    B. Preneel and P. van Oorschot, "Building fast MACs from hash
-           functions", Advances in Cryptology -- CRYPTO'95 Proceedings,
-           Lecture Notes in Computer Science, Springer-Verlag Vol.963,
-           1995, pp. 1-14.
-
-   [MD5]   Rivest, R., "The MD5 Message-Digest Algorithm",
-           RFC 1321, April 1992.
-
-
-
-Krawczyk, et. al.            Informational                     [Page 10]
-
-RFC 2104                          HMAC                     February 1997
-
-
-   [MM]    Meyer, S. and Matyas, S.M., Cryptography, New York Wiley,
-           1982.
-
-   [RIPEMD] H. Dobbertin, A. Bosselaers, and B. Preneel, "RIPEMD-160: A
-            strengthened version of RIPEMD", Fast Software Encryption,
-            LNCS Vol 1039, pp. 71-82.
-            ftp://ftp.esat.kuleuven.ac.be/pub/COSIC/bosselae/ripemd/.
-
-   [SHA]   NIST, FIPS PUB 180-1: Secure Hash Standard, April 1995.
-
-   [Tsu]   G. Tsudik, "Message authentication with one-way hash
-           functions", In Proceedings of Infocom'92, May 1992.
-           (Also in "Access Control and Policy Enforcement in
-            Internetworks", Ph.D. Dissertation, Computer Science
-            Department, University of Southern California, April 1991.)
-
-   [VW]    P. van Oorschot and M. Wiener, "Parallel Collision
-           Search with Applications to Hash Functions and Discrete
-           Logarithms", Proceedings of the 2nd ACM Conf. Computer and
-           Communications Security, Fairfax, VA, November 1994.
-
-Authors' Addresses
-
-   Hugo Krawczyk
-   IBM T.J. Watson Research Center
-   P.O.Box 704
-   Yorktown Heights, NY 10598
-
-   EMail: hugo@watson.ibm.com
-
-   Mihir Bellare
-   Dept of Computer Science and Engineering
-   Mail Code 0114
-   University of California at San Diego
-   9500 Gilman Drive
-   La Jolla, CA 92093
-
-   EMail: mihir@cs.ucsd.edu
-
-   Ran Canetti
-   IBM T.J. Watson Research Center
-   P.O.Box 704
-   Yorktown Heights, NY 10598
-
-   EMail: canetti@watson.ibm.com
-
-
-
-
-
-
-Krawczyk, et. al.            Informational                     [Page 11]
-
diff --git a/doc/ikev2/[RFC2407] - The Internet IP Security Domain of Interpretation for ISAKMP.txt b/doc/ikev2/[RFC2407] - The Internet IP Security Domain of Interpretation for ISAKMP.txt
deleted file mode 100644
index 7b2f87c85..000000000
--- a/doc/ikev2/[RFC2407] - The Internet IP Security Domain of Interpretation for ISAKMP.txt
+++ /dev/null
@@ -1,1795 +0,0 @@
-
-
-
-
-
-
-Network Working Group                                           D. Piper
-Request for Comments: 2407                               Network Alchemy
-Category: Standards Track                                  November 1998
-
-
-      The Internet IP Security Domain of Interpretation for ISAKMP
-
-Status of this Memo
-
-   This document specifies an Internet standards track protocol for the
-   Internet community, and requests discussion and suggestions for
-   improvements.  Please refer to the current edition of the "Internet
-   Official Protocol Standards" (STD 1) for the standardization state
-   and status of this protocol.  Distribution of this memo is unlimited.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (1998).  All Rights Reserved.
-
-IESG Note
-
-   Section 4.4.4.2 states, "All implememtations within the IPSEC DOI
-   MUST support ESP_DES...".  Recent work in the area of cryptanalysis
-   suggests that DES may not be sufficiently strong for many
-   applications.  Therefore, it is very likely that the IETF will
-   deprecate the use of ESP_DES as a mandatory cipher suite in the near
-   future.  It will remain as an optional use protocol.  Although the
-   IPsec working group and the IETF in general have not settled on an
-   alternative algorithm (taking into account concerns of security and
-   performance), implementers may want to heed the recommendations of
-   section 4.4.4.3 on the use of ESP_3DES.
-
-1. Abstract
-
-   The Internet Security Association and Key Management Protocol
-   (ISAKMP) defines a framework for security association management and
-   cryptographic key establishment for the Internet.  This framework
-   consists of defined exchanges, payloads, and processing guidelines
-   that occur within a given Domain of Interpretation (DOI).  This
-   document defines the Internet IP Security DOI (IPSEC DOI), which
-   instantiates ISAKMP for use with IP when IP uses ISAKMP to negotiate
-   security associations.
-
-   For a list of changes since the previous version of the IPSEC DOI,
-   please see Section 7.
-
-
-
-
-
-
-Piper                       Standards Track                     [Page 1]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-2. Introduction
-
-   Within ISAKMP, a Domain of Interpretation is used to group related
-   protocols using ISAKMP to negotiate security associations.  Security
-   protocols sharing a DOI choose security protocol and cryptographic
-   transforms from a common namespace and share key exchange protocol
-   identifiers.  They also share a common interpretation of DOI-specific
-   payload data content, including the Security Association and
-   Identification payloads.
-
-   Overall, ISAKMP places the following requirements on a DOI
-   definition:
-
-     o  define the naming scheme for DOI-specific protocol identifiers
-     o  define the interpretation for the Situation field
-     o  define the set of applicable security policies
-     o  define the syntax for DOI-specific SA Attributes (Phase II)
-     o  define the syntax for DOI-specific payload contents
-     o  define additional Key Exchange types, if needed
-     o  define additional Notification Message types, if needed
-
-   The remainder of this document details the instantiation of these
-   requirements for using the IP Security (IPSEC) protocols to provide
-   authentication, integrity, and/or confidentiality for IP packets sent
-   between cooperating host systems and/or firewalls.
-
-   For a description of the overall IPSEC architecture, see [ARCH],
-   [AH], and [ESP].
-
-3. Terms and Definitions
-
-   The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,
-   SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this
-   document, are to be interpreted as described in [RFC 2119].
-
-4.1 IPSEC Naming Scheme
-
-   Within ISAKMP, all DOI's must be registered with the IANA in the
-   "Assigned Numbers" RFC [STD-2].  The IANA Assigned Number for the
-   Internet IP Security DOI (IPSEC DOI) is one (1).  Within the IPSEC
-   DOI, all well-known identifiers MUST be registered with the IANA
-   under the IPSEC DOI.  Unless otherwise noted, all tables within this
-   document refer to IANA Assigned Numbers for the IPSEC DOI.  See
-   Section 6 for further information relating to the IANA registry for
-   the IPSEC DOI.
-
-   All multi-octet binary values are stored in network byte order.
-
-
-
-
-Piper                       Standards Track                     [Page 2]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-4.2 IPSEC Situation Definition
-
-   Within ISAKMP, the Situation provides information that can be used by
-   the responder to make a policy determination about how to process the
-   incoming Security Association request.  For the IPSEC DOI, the
-   Situation field is a four (4) octet bitmask with the following
-   values.
-
-       Situation                   Value
-       ---------                   -----
-       SIT_IDENTITY_ONLY           0x01
-       SIT_SECRECY                 0x02
-       SIT_INTEGRITY               0x04
-
-4.2.1 SIT_IDENTITY_ONLY
-
-   The SIT_IDENTITY_ONLY type specifies that the security association
-   will be identified by source identity information present in an
-   associated Identification Payload.  See Section 4.6.2 for a complete
-   description of the various Identification types.  All IPSEC DOI
-   implementations MUST support SIT_IDENTITY_ONLY by including an
-   Identification Payload in at least one of the Phase I Oakley
-   exchanges ([IKE], Section 5) and MUST abort any association setup
-   that does not include an Identification Payload.
-
-   If an initiator supports neither SIT_SECRECY nor SIT_INTEGRITY, the
-   situation consists only of the 4 octet situation bitmap and does not
-   include the Labeled Domain Identifier field (Figure 1, Section 4.6.1)
-   or any subsequent label information.  Conversely, if the initiator
-   supports either SIT_SECRECY or SIT_INTEGRITY, the Labeled Domain
-   Identifier MUST be included in the situation payload.
-
-4.2.2 SIT_SECRECY
-
-   The SIT_SECRECY type specifies that the security association is being
-   negotiated in an environment that requires labeled secrecy.  If
-   SIT_SECRECY is present in the Situation bitmap, the Situation field
-   will be followed by variable-length data that includes a sensitivity
-   level and compartment bitmask.  See Section 4.6.1 for a complete
-   description of the Security Association Payload format.
-
-   If an initiator does not support SIT_SECRECY, SIT_SECRECY MUST NOT be
-   set in the Situation bitmap and no secrecy level or category bitmaps
-   shall be included.
-
-   If a responder does not support SIT_SECRECY, a SITUATION-NOT-
-   SUPPORTED Notification Payload SHOULD be returned and the security
-   association setup MUST be aborted.
-
-
-
-Piper                       Standards Track                     [Page 3]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-4.2.3 SIT_INTEGRITY
-
-   The SIT_INTEGRITY type specifies that the security association is
-   being negotiated in an environment that requires labeled integrity.
-   If SIT_INTEGRITY is present in the Situation bitmap, the Situation
-   field will be followed by variable-length data that includes an
-   integrity level and compartment bitmask.  If SIT_SECRECY is also in
-   use for the association, the integrity information immediately
-   follows the variable-length secrecy level and categories.  See
-   section 4.6.1 for a complete description of the Security Association
-   Payload format.
-
-   If an initiator does not support SIT_INTEGRITY, SIT_INTEGRITY MUST
-   NOT be set in the Situation bitmap and no integrity level or category
-   bitmaps shall be included.
-
-   If a responder does not support SIT_INTEGRITY, a SITUATION-NOT-
-   SUPPORTED Notification Payload SHOULD be returned and the security
-   association setup MUST be aborted.
-
-4.3 IPSEC Security Policy Requirements
-
-   The IPSEC DOI does not impose specific security policy requirements
-   on any implementation.  Host system policy issues are outside of the
-   scope of this document.
-
-   However, the following sections touch on some of the issues that must
-   be considered when designing an IPSEC DOI host implementation.  This
-   section should be considered only informational in nature.
-
-4.3.1 Key Management Issues
-
-   It is expected that many systems choosing to implement ISAKMP will
-   strive to provide a protected domain of execution for a combined IKE
-   key management daemon.  On protected-mode multiuser operating
-   systems, this key management daemon will likely exist as a separate
-   privileged process.
-
-   In such an environment, a formalized API to introduce keying material
-   into the TCP/IP kernel may be desirable.  The IP Security
-   architecture does not place any requirements for structure or flow
-   between a host TCP/IP kernel and its key management provider.
-
-
-
-
-
-
-
-
-
-Piper                       Standards Track                     [Page 4]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-4.3.2 Static Keying Issues
-
-   Host systems that implement static keys, either for use directly by
-   IPSEC, or for authentication purposes (see [IKE] Section 5.4), should
-   take steps to protect the static keying material when it is not
-   residing in a protected memory domain or actively in use by the
-   TCP/IP kernel.
-
-   For example, on a laptop, one might choose to store the static keys
-   in a configuration store that is, itself, encrypted under a private
-   password.
-
-   Depending on the operating system and utility software installed, it
-   may not be possible to protect the static keys once they've been
-   loaded into the TCP/IP kernel, however they should not be trivially
-   recoverable on initial system startup without having to satisfy some
-   additional form of authentication.
-
-4.3.3 Host Policy Issues
-
-   It is not realistic to assume that the transition to IPSEC will occur
-   overnight.  Host systems must be prepared to implement flexible
-   policy lists that describe which systems they desire to speak
-   securely with and which systems they require speak securely to them.
-   Some notion of proxy firewall addresses may also be required.
-
-   A minimal approach is probably a static list of IP addresses, network
-   masks, and a security required flag or flags.
-
-   A more flexible implementation might consist of a list of wildcard
-   DNS names (e.g. '*.foo.bar'), an in/out bitmask, and an optional
-   firewall address.  The wildcard DNS name would be used to match
-   incoming or outgoing IP addresses, the in/out bitmask would be used
-   to determine whether or not security was to be applied and in which
-   direction, and the optional firewall address would be used to
-   indicate whether or not tunnel mode would be needed to talk to the
-   target system though an intermediate firewall.
-
-4.3.4 Certificate Management
-
-   Host systems implementing a certificate-based authentication scheme
-   will need a mechanism for obtaining and managing a database of
-   certificates.
-
-   Secure DNS is to be one certificate distribution mechanism, however
-   the pervasive availability of secure DNS zones, in the short term, is
-   doubtful for many reasons.  What's far more likely is that hosts will
-
-
-
-
-Piper                       Standards Track                     [Page 5]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-   need an ability to import certificates that they acquire through
-   secure, out-of-band mechanisms, as well as an ability to export their
-   own certificates for use by other systems.
-
-   However, manual certificate management should not be done so as to
-   preclude the ability to introduce dynamic certificate discovery
-   mechanisms and/or protocols as they become available.
-
-4.4 IPSEC Assigned Numbers
-
-   The following sections list the Assigned Numbers for the IPSEC DOI:
-   Situation Identifiers, Protocol Identifiers, Transform Identifiers,
-   AH, ESP, and IPCOMP Transform Identifiers, Security Association
-   Attribute Type Values, Labeled Domain Identifiers, ID Payload Type
-   Values, and Notify Message Type Values.
-
-4.4.1 IPSEC Security Protocol Identifier
-
-   The ISAKMP proposal syntax was specifically designed to allow for the
-   simultaneous negotiation of multiple Phase II security protocol
-   suites within a single negotiation.  As a result, the protocol suites
-   listed below form the set of protocols that can be negotiated at the
-   same time.  It is a host policy decision as to what protocol suites
-   might be negotiated together.
-
-   The following table lists the values for the Security Protocol
-   Identifiers referenced in an ISAKMP Proposal Payload for the IPSEC
-   DOI.
-
-       Protocol ID                         Value
-       -----------                         -----
-       RESERVED                            0
-       PROTO_ISAKMP                        1
-       PROTO_IPSEC_AH                      2
-       PROTO_IPSEC_ESP                     3
-       PROTO_IPCOMP                        4
-
-4.4.1.1 PROTO_ISAKMP
-
-   The PROTO_ISAKMP type specifies message protection required during
-   Phase I of the ISAKMP protocol.  The specific protection mechanism
-   used for the IPSEC DOI is described in [IKE].  All implementations
-   within the IPSEC DOI MUST support PROTO_ISAKMP.
-
-   NB: ISAKMP reserves the value one (1) across all DOI definitions.
-
-
-
-
-
-
-Piper                       Standards Track                     [Page 6]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-4.4.1.2 PROTO_IPSEC_AH
-
-   The PROTO_IPSEC_AH type specifies IP packet authentication.  The
-   default AH transform provides data origin authentication, integrity
-   protection, and replay detection.  For export control considerations,
-   confidentiality MUST NOT be provided by any PROTO_IPSEC_AH transform.
-
-4.4.1.3 PROTO_IPSEC_ESP
-
-   The PROTO_IPSEC_ESP type specifies IP packet confidentiality.
-   Authentication, if required, must be provided as part of the ESP
-   transform.  The default ESP transform includes data origin
-   authentication, integrity protection, replay detection, and
-   confidentiality.
-
-4.4.1.4 PROTO_IPCOMP
-
-   The PROTO_IPCOMP type specifies IP payload compression as defined in
-   [IPCOMP].
-
-4.4.2 IPSEC ISAKMP Transform Identifiers
-
-   As part of an ISAKMP Phase I negotiation, the initiator's choice of
-   Key Exchange offerings is made using some host system policy
-   description.  The actual selection of Key Exchange mechanism is made
-   using the standard ISAKMP Proposal Payload.  The following table
-   lists the defined ISAKMP Phase I Transform Identifiers for the
-   Proposal Payload for the IPSEC DOI.
-
-       Transform                           Value
-       ---------                           -----
-       RESERVED                            0
-       KEY_IKE                             1
-
-   Within the ISAKMP and IPSEC DOI framework it is possible to define
-   key establishment protocols other than IKE (Oakley).  Previous
-   versions of this document defined types both for manual keying and
-   for schemes based on use of a generic Key Distribution Center (KDC).
-   These identifiers have been removed from the current document.
-
-   The IPSEC DOI can still be extended later to include values for
-   additional non-Oakley key establishment protocols for ISAKMP and
-   IPSEC, such as Kerberos [RFC-1510] or the Group Key Management
-   Protocol (GKMP) [RFC-2093].
-
-
-
-
-
-
-
-Piper                       Standards Track                     [Page 7]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-4.4.2.1 KEY_IKE
-
-   The KEY_IKE type specifies the hybrid ISAKMP/Oakley Diffie-Hellman
-   key exchange (IKE) as defined in the [IKE] document.  All
-   implementations within the IPSEC DOI MUST support KEY_IKE.
-
-4.4.3 IPSEC AH Transform Identifiers
-
-   The Authentication Header Protocol (AH) defines one mandatory and
-   several optional transforms used to provide authentication,
-   integrity, and replay detection.  The following table lists the
-   defined AH Transform Identifiers for the ISAKMP Proposal Payload for
-   the IPSEC DOI.
-
-   Note: the Authentication Algorithm attribute MUST be specified to
-   identify the appropriate AH protection suite.  For example, AH_MD5
-   can best be thought of as a generic AH transform using MD5.  To
-   request the HMAC construction with AH, one specifies the AH_MD5
-   transform ID along with the Authentication Algorithm attribute set to
-   HMAC-MD5.  This is shown using the "Auth(HMAC-MD5)" notation in the
-   following sections.
-
-       Transform ID                        Value
-       ------------                        -----
-       RESERVED                            0-1
-       AH_MD5                              2
-       AH_SHA                              3
-       AH_DES                              4
-
-   Note: all mandatory-to-implement algorithms are listed as "MUST"
-   implement (e.g. AH_MD5) in the following sections.  All other
-   algorithms are optional and MAY be implemented in any particular
-   implementation.
-
-4.4.3.1 AH_MD5
-
-   The AH_MD5 type specifies a generic AH transform using MD5.  The
-   actual protection suite is determined in concert with an associated
-   SA attribute list.  A generic MD5 transform is currently undefined.
-
-   All implementations within the IPSEC DOI MUST support AH_MD5 along
-   with the Auth(HMAC-MD5) attribute.  This suite is defined as the
-   HMAC-MD5-96 transform described in [HMACMD5].
-
-   The AH_MD5 type along with the Auth(KPDK) attribute specifies the AH
-   transform (Key/Pad/Data/Key) described in RFC-1826.
-
-
-
-
-
-Piper                       Standards Track                     [Page 8]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-   Use of AH_MD5 with any other Authentication Algorithm attribute value
-   is currently undefined.
-
-4.4.3.2 AH_SHA
-
-   The AH_SHA type specifies a generic AH transform using SHA-1.  The
-   actual protection suite is determined in concert with an associated
-   SA attribute list.  A generic SHA transform is currently undefined.
-
-   All implementations within the IPSEC DOI MUST support AH_SHA along
-   with the Auth(HMAC-SHA) attribute.  This suite is defined as the
-   HMAC-SHA-1-96 transform described in [HMACSHA].
-
-   Use of AH_SHA with any other Authentication Algorithm attribute value
-   is currently undefined.
-
-4.4.3.3 AH_DES
-
-   The AH_DES type specifies a generic AH transform using DES.  The
-   actual protection suite is determined in concert with an associated
-   SA attribute list.  A generic DES transform is currently undefined.
-
-   The IPSEC DOI defines AH_DES along with the Auth(DES-MAC) attribute
-   to be a DES-MAC transform.  Implementations are not required to
-   support this mode.
-
-   Use of AH_DES with any other Authentication Algorithm attribute value
-   is currently undefined.
-
-4.4.4 IPSEC ESP Transform Identifiers
-
-   The Encapsulating Security Payload (ESP) defines one mandatory and
-   many optional transforms used to provide data confidentiality.  The
-   following table lists the defined ESP Transform Identifiers for the
-   ISAKMP Proposal Payload for the IPSEC DOI.
-
-   Note: when authentication, integrity protection, and replay detection
-   are required, the Authentication Algorithm attribute MUST be
-   specified to identify the appropriate ESP protection suite.  For
-   example, to request HMAC-MD5 authentication with 3DES, one specifies
-   the ESP_3DES transform ID with the Authentication Algorithm attribute
-   set to HMAC-MD5.  For additional processing requirements, see Section
-   4.5 (Authentication Algorithm).
-
-
-
-
-
-
-
-
-Piper                       Standards Track                     [Page 9]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-       Transform ID                        Value
-       ------------                        -----
-       RESERVED                            0
-       ESP_DES_IV64                        1
-       ESP_DES                             2
-       ESP_3DES                            3
-       ESP_RC5                             4
-       ESP_IDEA                            5
-       ESP_CAST                            6
-       ESP_BLOWFISH                        7
-       ESP_3IDEA                           8
-       ESP_DES_IV32                        9
-       ESP_RC4                             10
-       ESP_NULL                            11
-
-   Note: all mandatory-to-implement algorithms are listed as "MUST"
-   implement (e.g. ESP_DES) in the following sections.  All other
-   algorithms are optional and MAY be implemented in any particular
-   implementation.
-
-4.4.4.1 ESP_DES_IV64
-
-   The ESP_DES_IV64 type specifies the DES-CBC transform defined in
-   RFC-1827 and RFC-1829 using a 64-bit IV.
-
-4.4.4.2 ESP_DES
-
-   The ESP_DES type specifies a generic DES transform using DES-CBC.
-   The actual protection suite is determined in concert with an
-   associated SA attribute list.  A generic transform is currently
-   undefined.
-
-   All implementations within the IPSEC DOI MUST support ESP_DES along
-   with the Auth(HMAC-MD5) attribute.  This suite is defined as the
-   [DES] transform, with authentication and integrity provided by HMAC
-   MD5 [HMACMD5].
-
-4.4.4.3 ESP_3DES
-
-   The ESP_3DES type specifies a generic triple-DES transform.  The
-   actual protection suite is determined in concert with an associated
-   SA attribute list.  The generic transform is currently undefined.
-
-   All implementations within the IPSEC DOI are strongly encouraged to
-   support ESP_3DES along with the Auth(HMAC-MD5) attribute.  This suite
-   is defined as the [ESPCBC] transform, with authentication and
-   integrity provided by HMAC MD5 [HMACMD5].
-
-
-
-
-Piper                       Standards Track                    [Page 10]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-4.4.4.4 ESP_RC5
-
-   The ESP_RC5 type specifies the RC5 transform defined in [ESPCBC].
-
-4.4.4.5 ESP_IDEA
-
-   The ESP_IDEA type specifies the IDEA transform defined in [ESPCBC].
-
-4.4.4.6 ESP_CAST
-
-   The ESP_CAST type specifies the CAST transform defined in [ESPCBC].
-
-4.4.4.7 ESP_BLOWFISH
-
-   The ESP_BLOWFISH type specifies the BLOWFISH transform defined in
-   [ESPCBC].
-
-4.4.4.8 ESP_3IDEA
-
-   The ESP_3IDEA type is reserved for triple-IDEA.
-
-4.4.4.9 ESP_DES_IV32
-
-   The ESP_DES_IV32 type specifies the DES-CBC transform defined in
-   RFC-1827 and RFC-1829 using a 32-bit IV.
-
-4.4.4.10 ESP_RC4
-
-   The ESP_RC4 type is reserved for RC4.
-
-4.4.4.11 ESP_NULL
-
-   The ESP_NULL type specifies no confidentiality is to be provided by
-   ESP.  ESP_NULL is used when ESP is being used to tunnel packets which
-   require only authentication, integrity protection, and replay
-   detection.
-
-   All implementations within the IPSEC DOI MUST support ESP_NULL.  The
-   ESP NULL transform is defined in [ESPNULL].  See the Authentication
-   Algorithm attribute description in Section 4.5 for additional
-   requirements relating to the use of ESP_NULL.
-
-4.4.5 IPSEC IPCOMP Transform Identifiers
-
-   The IP Compression (IPCOMP) transforms define optional compression
-   algorithms that can be negotiated to provide for IP payload
-   compression ([IPCOMP]).  The following table lists the defined IPCOMP
-   Transform Identifiers for the ISAKMP Proposal Payload within the
-
-
-
-Piper                       Standards Track                    [Page 11]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-   IPSEC DOI.
-
-       Transform ID                        Value
-       ------------                        -----
-       RESERVED                            0
-       IPCOMP_OUI                          1
-       IPCOMP_DEFLATE                      2
-       IPCOMP_LZS                          3
-
-4.4.5.1 IPCOMP_OUI
-
-   The IPCOMP_OUI type specifies a proprietary compression transform.
-   The IPCOMP_OUI type must be accompanied by an attribute which further
-   identifies the specific vendor algorithm.
-
-4.4.5.2 IPCOMP_DEFLATE
-
-   The IPCOMP_DEFLATE type specifies the use of the "zlib" deflate
-   algorithm as specified in [DEFLATE].
-
-4.4.5.3 IPCOMP_LZS
-
-   The IPCOMP_LZS type specifies the use of the Stac Electronics LZS
-   algorithm as specified in [LZS].
-
-4.5 IPSEC Security Association Attributes
-
-   The following SA attribute definitions are used in Phase II of an IKE
-   negotiation.  Attribute types can be either Basic (B) or Variable-
-   Length (V).  Encoding of these attributes is defined in the base
-   ISAKMP specification.
-
-   Attributes described as basic MUST NOT be encoded as variable.
-   Variable length attributes MAY be encoded as basic attributes if
-   their value can fit into two octets.  See [IKE] for further
-   information on attribute encoding in the IPSEC DOI.  All restrictions
-   listed in [IKE] also apply to the IPSEC DOI.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Piper                       Standards Track                    [Page 12]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-       Attribute Types
-
-             class               value           type
-       -------------------------------------------------
-       SA Life Type                1               B
-       SA Life Duration            2               V
-       Group Description           3               B
-       Encapsulation Mode          4               B
-       Authentication Algorithm    5               B
-       Key Length                  6               B
-       Key Rounds                  7               B
-       Compress Dictionary Size    8               B
-       Compress Private Algorithm  9               V
-
-       Class Values
-
-         SA Life Type
-         SA Duration
-
-           Specifies the time-to-live for the overall security
-           association.  When the SA expires, all keys negotiated under
-           the association (AH or ESP) must be renegotiated.  The life
-           type values are:
-
-           RESERVED                0
-           seconds                 1
-           kilobytes               2
-
-           Values 3-61439 are reserved to IANA.  Values 61440-65535 are
-           for private use.  For a given Life Type, the value of the
-           Life Duration attribute defines the actual length of the
-           component lifetime -- either a number of seconds, or a number
-           of Kbytes that can be protected.
-
-           If unspecified, the default value shall be assumed to be
-           28800 seconds (8 hours).
-
-           An SA Life Duration attribute MUST always follow an SA Life
-           Type which describes the units of duration.
-
-           See Section 4.5.4 for additional information relating to
-           lifetime notification.
-
-         Group Description
-
-           Specifies the Oakley Group to be used in a PFS QM
-           negotiation.  For a list of supported values, see Appendix A
-           of [IKE].
-
-
-
-Piper                       Standards Track                    [Page 13]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-         Encapsulation Mode
-           RESERVED                0
-           Tunnel                  1
-           Transport               2
-
-           Values 3-61439 are reserved to IANA.  Values 61440-65535 are
-           for private use.
-
-           If unspecified, the default value shall be assumed to be
-           unspecified (host-dependent).
-
-         Authentication Algorithm
-           RESERVED                0
-           HMAC-MD5                1
-           HMAC-SHA                2
-           DES-MAC                 3
-           KPDK                    4
-
-           Values 5-61439 are reserved to IANA.  Values 61440-65535 are
-           for private use.
-
-           There is no default value for Auth Algorithm, as it must be
-           specified to correctly identify the applicable AH or ESP
-           transform, except in the following case.
-
-           When negotiating ESP without authentication, the Auth
-           Algorithm attribute MUST NOT be included in the proposal.
-
-           When negotiating ESP without confidentiality, the Auth
-           Algorithm attribute MUST be included in the proposal and the
-           ESP transform ID must be ESP_NULL.
-
-         Key Length
-           RESERVED                0
-
-           There is no default value for Key Length, as it must be
-           specified for transforms using ciphers with variable key
-           lengths.  For fixed length ciphers, the Key Length attribute
-           MUST NOT be sent.
-
-         Key Rounds
-           RESERVED                0
-
-           There is no default value for Key Rounds, as it must be
-           specified for transforms using ciphers with varying numbers
-           of rounds.
-
-
-
-
-
-Piper                       Standards Track                    [Page 14]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-         Compression Dictionary Size
-           RESERVED                0
-
-           Specifies the log2 maximum size of the dictionary.
-
-           There is no default value for dictionary size.
-
-         Compression Private Algorithm
-
-           Specifies a private vendor compression algorithm.  The first
-           three (3) octets must be an IEEE assigned company_id (OUI).
-           The next octet may be a vendor specific compression subtype,
-           followed by zero or more octets of vendor data.
-
-4.5.1 Required Attribute Support
-
-   To ensure basic interoperability, all implementations MUST be
-   prepared to negotiate all of the following attributes.
-
-           SA Life Type
-           SA Duration
-           Auth Algorithm
-
-4.5.2 Attribute Parsing Requirement (Lifetime)
-
-   To allow for flexible semantics, the IPSEC DOI requires that a
-   conforming ISAKMP implementation MUST correctly parse an attribute
-   list that contains multiple instances of the same attribute class, so
-   long as the different attribute entries do not conflict with one
-   another.  Currently, the only attributes which requires this
-   treatment are Life Type and Duration.
-
-   To see why this is important, the following example shows the binary
-   encoding of a four entry attribute list that specifies an SA Lifetime
-   of either 100MB or 24 hours.  (See Section 3.3 of [ISAKMP] for a
-   complete description of the attribute encoding format.)
-
-     Attribute #1:
-       0x80010001  (AF = 1, type = SA Life Type, value = seconds)
-
-     Attribute #2:
-       0x00020004  (AF = 0, type = SA Duration, length = 4 bytes)
-       0x00015180  (value = 0x15180 = 86400 seconds = 24 hours)
-
-     Attribute #3:
-       0x80010002  (AF = 1, type = SA Life Type, value = KB)
-
-
-
-
-
-Piper                       Standards Track                    [Page 15]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-     Attribute #4:
-       0x00020004  (AF = 0, type = SA Duration, length = 4 bytes)
-       0x000186A0  (value = 0x186A0 = 100000KB = 100MB)
-
-   If conflicting attributes are detected, an ATTRIBUTES-NOT-SUPPORTED
-   Notification Payload SHOULD be returned and the security association
-   setup MUST be aborted.
-
-4.5.3 Attribute Negotiation
-
-   If an implementation receives a defined IPSEC DOI attribute (or
-   attribute value) which it does not support, an ATTRIBUTES-NOT-SUPPORT
-   SHOULD be sent and the security association setup MUST be aborted,
-   unless the attribute value is in the reserved range.
-
-   If an implementation receives an attribute value in the reserved
-   range, an implementation MAY chose to continue based on local policy.
-
-4.5.4 Lifetime Notification
-
-   When an initiator offers an SA lifetime greater than what the
-   responder desires based on their local policy, the responder has
-   three choices: 1) fail the negotiation entirely; 2) complete the
-   negotiation but use a shorter lifetime than what was offered; 3)
-   complete the negotiation and send an advisory notification to the
-   initiator indicating the responder's true lifetime.  The choice of
-   what the responder actually does is implementation specific and/or
-   based on local policy.
-
-   To ensure interoperability in the latter case, the IPSEC DOI requires
-   the following only when the responder wishes to notify the initiator:
-   if the initiator offers an SA lifetime longer than the responder is
-   willing to accept, the responder SHOULD include an ISAKMP
-   Notification Payload in the exchange that includes the responder's
-   IPSEC SA payload.  Section 4.6.3.1 defines the payload layout for the
-   RESPONDER-LIFETIME Notification Message type which MUST be used for
-   this purpose.
-
-4.6 IPSEC Payload Content
-
-   The following sections describe those ISAKMP payloads whose data
-   representations are dependent on the applicable DOI.
-
-4.6.1 Security Association Payload
-
-   The following diagram illustrates the content of the Security
-   Association Payload for the IPSEC DOI.  See Section 4.2 for a
-   description of the Situation bitmap.
-
-
-
-Piper                       Standards Track                    [Page 16]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !  Next Payload !   RESERVED    !        Payload Length         !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                Domain of Interpretation (IPSEC)               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                       Situation (bitmap)                      !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                    Labeled Domain Identifier                  !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !  Secrecy Length (in octets)   !           RESERVED            !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ~                        Secrecy Level                          ~
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Secrecy Cat. Length (in bits) !           RESERVED            !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ~                    Secrecy Category Bitmap                    ~
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Integrity Length (in octets)  !           RESERVED            !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ~                       Integrity Level                         ~
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ! Integ. Cat. Length (in bits)  !           RESERVED            !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ~                  Integrity Category Bitmap                    ~
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 1: Security Association Payload Format
-
-   The Security Association Payload is defined as follows:
-
-     o  Next Payload (1 octet) - Identifier for the payload type of
-        the next payload in the message.  If the current payload is the
-        last in the message, this field will be zero (0).
-
-     o  RESERVED (1 octet) - Unused, must be zero (0).
-
-     o  Payload Length (2 octets) - Length, in octets, of the current
-        payload, including the generic header.
-
-     o  Domain of Interpretation (4 octets) - Specifies the IPSEC DOI,
-        which has been assigned the value one (1).
-
-     o  Situation (4 octets) - Bitmask used to interpret the remainder
-        of the Security Association Payload.  See Section 4.2 for a
-        complete list of values.
-
-
-
-
-
-Piper                       Standards Track                    [Page 17]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-     o  Labeled Domain Identifier (4 octets) - IANA Assigned Number used
-        to interpret the Secrecy and Integrity information.
-
-     o  Secrecy Length (2 octets) - Specifies the length, in octets, of
-        the secrecy level identifier, excluding pad bits.
-
-     o  RESERVED (2 octets) - Unused, must be zero (0).
-
-     o  Secrecy Level (variable length) - Specifies the mandatory
-        secrecy level required.  The secrecy level MUST be padded with
-        zero (0) to align on the next 32-bit boundary.
-
-     o  Secrecy Category Length (2 octets) - Specifies the length, in
-        bits, of the secrecy category (compartment) bitmap, excluding
-        pad bits.
-
-     o  RESERVED (2 octets) - Unused, must be zero (0).
-
-     o  Secrecy Category Bitmap (variable length) - A bitmap used to
-        designate secrecy categories (compartments) that are required.
-        The bitmap MUST be padded with zero (0) to align on the next
-        32-bit boundary.
-
-     o  Integrity Length (2 octets) - Specifies the length, in octets,
-        of the integrity level identifier, excluding pad bits.
-
-     o  RESERVED (2 octets) - Unused, must be zero (0).
-
-     o  Integrity Level (variable length) - Specifies the mandatory
-        integrity level required.  The integrity level MUST be padded
-        with zero (0) to align on the next 32-bit boundary.
-
-     o  Integrity Category Length (2 octets) - Specifies the length, in
-        bits, of the integrity category (compartment) bitmap, excluding
-        pad bits.
-
-     o  RESERVED (2 octets) - Unused, must be zero (0).
-
-     o  Integrity Category Bitmap (variable length) - A bitmap used to
-        designate integrity categories (compartments) that are required.
-        The bitmap MUST be padded with zero (0) to align on the next
-        32-bit boundary.
-
-4.6.1.1 IPSEC Labeled Domain Identifiers
-
-   The following table lists the assigned values for the Labeled Domain
-   Identifier field contained in the Situation field of the Security
-   Association Payload.
-
-
-
-Piper                       Standards Track                    [Page 18]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-       Domain                              Value
-       -------                             -----
-       RESERVED                            0
-
-4.6.2 Identification Payload Content
-
-   The Identification Payload is used to identify the initiator of the
-   Security Association.  The identity of the initiator SHOULD be used
-   by the responder to determine the correct host system security policy
-   requirement for the association.  For example, a host might choose to
-   require authentication and integrity without confidentiality (AH)
-   from a certain set of IP addresses and full authentication with
-   confidentiality (ESP) from another range of IP addresses.  The
-   Identification Payload provides information that can be used by the
-   responder to make this decision.
-
-   During Phase I negotiations, the ID port and protocol fields MUST be
-   set to zero or to UDP port 500.  If an implementation receives any
-   other values, this MUST be treated as an error and the security
-   association setup MUST be aborted.  This event SHOULD be auditable.
-
-   The following diagram illustrates the content of the Identification
-   Payload.
-
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !  Next Payload !   RESERVED    !        Payload Length         !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !   ID Type     !  Protocol ID  !             Port              !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   ~                     Identification Data                       ~
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                  Figure 2: Identification Payload Format
-
-   The Identification Payload fields are defined as follows:
-
-     o  Next Payload (1 octet) - Identifier for the payload type of
-        the next payload in the message.  If the current payload is the
-        last in the message, this field will be zero (0).
-
-     o  RESERVED (1 octet) - Unused, must be zero (0).
-
-     o  Payload Length (2 octets) - Length, in octets, of the
-        identification data, including the generic header.
-
-     o  Identification Type (1 octet) - Value describing the identity
-        information found in the Identification Data field.
-
-
-
-Piper                       Standards Track                    [Page 19]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-     o  Protocol ID (1 octet) - Value specifying an associated IP
-        protocol ID (e.g. UDP/TCP).  A value of zero means that the
-        Protocol ID field should be ignored.
-
-     o  Port (2 octets) - Value specifying an associated port.  A value
-        of zero means that the Port field should be ignored.
-
-     o  Identification Data (variable length) - Value, as indicated by
-        the Identification Type.
-
-4.6.2.1 Identification Type Values
-
-   The following table lists the assigned values for the Identification
-   Type field found in the Identification Payload.
-
-       ID Type                   Value
-       -------                   -----
-       RESERVED                            0
-       ID_IPV4_ADDR                        1
-       ID_FQDN                             2
-       ID_USER_FQDN                        3
-       ID_IPV4_ADDR_SUBNET                 4
-       ID_IPV6_ADDR                        5
-       ID_IPV6_ADDR_SUBNET                 6
-       ID_IPV4_ADDR_RANGE                  7
-       ID_IPV6_ADDR_RANGE                  8
-       ID_DER_ASN1_DN                      9
-       ID_DER_ASN1_GN                      10
-       ID_KEY_ID                           11
-
-   For types where the ID entity is variable length, the size of the ID
-   entity is computed from size in the ID payload header.
-
-   When an IKE exchange is authenticated using certificates (of any
-   format), any ID's used for input to local policy decisions SHOULD be
-   contained in the certificate used in the authentication of the
-   exchange.
-
-4.6.2.2 ID_IPV4_ADDR
-
-   The ID_IPV4_ADDR type specifies a single four (4) octet IPv4 address.
-
-4.6.2.3 ID_FQDN
-
-   The ID_FQDN type specifies a fully-qualified domain name string.  An
-   example of a ID_FQDN is, "foo.bar.com".  The string should not
-   contain any terminators.
-
-
-
-
-Piper                       Standards Track                    [Page 20]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-4.6.2.4 ID_USER_FQDN
-
-   The ID_USER_FQDN type specifies a fully-qualified username string, An
-   example of a ID_USER_FQDN is, "piper@foo.bar.com".  The string should
-   not contain any terminators.
-
-4.6.2.5 ID_IPV4_ADDR_SUBNET
-
-   The ID_IPV4_ADDR_SUBNET type specifies a range of IPv4 addresses,
-   represented by two four (4) octet values.  The first value is an IPv4
-   address.  The second is an IPv4 network mask.  Note that ones (1s) in
-   the network mask indicate that the corresponding bit in the address
-   is fixed, while zeros (0s) indicate a "wildcard" bit.
-
-4.6.2.6 ID_IPV6_ADDR
-
-   The ID_IPV6_ADDR type specifies a single sixteen (16) octet IPv6
-   address.
-
-4.6.2.7 ID_IPV6_ADDR_SUBNET
-
-   The ID_IPV6_ADDR_SUBNET type specifies a range of IPv6 addresses,
-   represented by two sixteen (16) octet values.  The first value is an
-   IPv6 address.  The second is an IPv6 network mask.  Note that ones
-   (1s) in the network mask indicate that the corresponding bit in the
-   address is fixed, while zeros (0s) indicate a "wildcard" bit.
-
-4.6.2.8 ID_IPV4_ADDR_RANGE
-
-   The ID_IPV4_ADDR_RANGE type specifies a range of IPv4 addresses,
-   represented by two four (4) octet values.  The first value is the
-   beginning IPv4 address (inclusive) and the second value is the ending
-   IPv4 address (inclusive).  All addresses falling between the two
-   specified addresses are considered to be within the list.
-
-4.6.2.9 ID_IPV6_ADDR_RANGE
-
-   The ID_IPV6_ADDR_RANGE type specifies a range of IPv6 addresses,
-   represented by two sixteen (16) octet values.  The first value is the
-   beginning IPv6 address (inclusive) and the second value is the ending
-   IPv6 address (inclusive).  All addresses falling between the two
-   specified addresses are considered to be within the list.
-
-4.6.2.10 ID_DER_ASN1_DN
-
-   The ID_DER_ASN1_DN type specifies the binary DER encoding of an ASN.1
-   X.500 Distinguished Name [X.501] of the principal whose certificates
-   are being exchanged to establish the SA.
-
-
-
-Piper                       Standards Track                    [Page 21]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-4.6.2.11 ID_DER_ASN1_GN
-
-   The ID_DER_ASN1_GN type specifies the binary DER encoding of an ASN.1
-   X.500 GeneralName [X.509] of the principal whose certificates are
-   being exchanged to establish the SA.
-
-4.6.2.12 ID_KEY_ID
-
-   The ID_KEY_ID type specifies an opaque byte stream which may be used
-   to pass vendor-specific information necessary to identify which pre-
-   shared key should be used to authenticate Aggressive mode
-   negotiations.
-
-4.6.3 IPSEC Notify Message Types
-
-   ISAKMP defines two blocks of Notify Message codes, one for errors and
-   one for status messages.  ISAKMP also allocates a portion of each
-   block for private use within a DOI.  The IPSEC DOI defines the
-   following private message types for its own use.
-
-       Notify Messages - Error Types       Value
-       -----------------------------       -----
-       RESERVED                            8192
-
-       Notify Messages - Status Types      Value
-       ------------------------------      -----
-       RESPONDER-LIFETIME                  24576
-       REPLAY-STATUS                       24577
-       INITIAL-CONTACT                     24578
-
-   Notification Status Messages MUST be sent under the protection of an
-   ISAKMP SA: either as a payload in the last Main Mode exchange; in a
-   separate Informational Exchange after Main Mode or Aggressive Mode
-   processing is complete; or as a payload in any Quick Mode exchange.
-   These messages MUST NOT be sent in Aggressive Mode exchange, since
-   Aggressive Mode does not provide the necessary protection to bind the
-   Notify Status Message to the exchange.
-
-   Nota Bene: a Notify payload is fully protected only in Quick Mode,
-   where the entire payload is included in the HASH(n) digest.  In Main
-   Mode, while the notify payload is encrypted, it is not currently
-   included in the HASH(n) digests.  As a result, an active substitution
-   attack on the Main Mode ciphertext could cause the notify status
-   message type to be corrupted.  (This is true, in general, for the
-   last message of any Main Mode exchange.)  While the risk is small, a
-   corrupt notify message might cause the receiver to abort the entire
-   negotiation thinking that the sender encountered a fatal error.
-
-
-
-
-Piper                       Standards Track                    [Page 22]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-   Implementation Note: the ISAKMP protocol does not guarantee delivery
-   of Notification Status messages when sent in an ISAKMP Informational
-   Exchange.  To ensure receipt of any particular message, the sender
-   SHOULD include a Notification Payload in a defined Main Mode or Quick
-   Mode exchange which is protected by a retransmission timer.
-
-4.6.3.1 RESPONDER-LIFETIME
-
-   The RESPONDER-LIFETIME status message may be used to communicate the
-   IPSEC SA lifetime chosen by the responder.
-
-   When present, the Notification Payload MUST have the following
-   format:
-
-     o  Payload Length - set to length of payload + size of data (var)
-     o  DOI - set to IPSEC DOI (1)
-     o  Protocol ID - set to selected Protocol ID from chosen SA
-     o  SPI Size - set to either sixteen (16) (two eight-octet ISAKMP
-        cookies) or four (4) (one IPSEC SPI)
-     o  Notify Message Type - set to RESPONDER-LIFETIME (Section 4.6.3)
-     o  SPI - set to the two ISAKMP cookies or to the sender's inbound
-        IPSEC SPI
-     o  Notification Data - contains an ISAKMP attribute list with the
-        responder's actual SA lifetime(s)
-
-   Implementation Note: saying that the Notification Data field contains
-   an attribute list is equivalent to saying that the Notification Data
-   field has zero length and the Notification Payload has an associated
-   attribute list.
-
-4.6.3.2 REPLAY-STATUS
-
-   The REPLAY-STATUS status message may be used for positive
-   confirmation of the responder's election on whether or not he is to
-   perform anti-replay detection.
-
-   When present, the Notification Payload MUST have the following
-   format:
-
-     o  Payload Length - set to length of payload + size of data (4)
-     o  DOI - set to IPSEC DOI (1)
-     o  Protocol ID - set to selected Protocol ID from chosen SA
-     o  SPI Size - set to either sixteen (16) (two eight-octet ISAKMP
-        cookies) or four (4) (one IPSEC SPI)
-     o  Notify Message Type - set to REPLAY-STATUS
-     o  SPI - set to the two ISAKMP cookies or to the sender's inbound
-        IPSEC SPI
-     o  Notification Data - a 4 octet value:
-
-
-
-Piper                       Standards Track                    [Page 23]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-          0 = replay detection disabled
-          1 = replay detection enabled
-
-4.6.3.3 INITIAL-CONTACT
-
-   The INITIAL-CONTACT status message may be used when one side wishes
-   to inform the other that this is the first SA being established with
-   the remote system.  The receiver of this Notification Message might
-   then elect to delete any existing SA's it has for the sending system
-   under the assumption that the sending system has rebooted and no
-   longer has access to the original SA's and their associated keying
-   material.  When used, the content of the Notification Data field
-   SHOULD be null (i.e. the Payload Length should be set to the fixed
-   length of Notification Payload).
-
-   When present, the Notification Payload MUST have the following
-   format:
-
-     o  Payload Length - set to length of payload + size of data (0)
-     o  DOI - set to IPSEC DOI (1)
-     o  Protocol ID - set to selected Protocol ID from chosen SA
-     o  SPI Size - set to sixteen (16) (two eight-octet ISAKMP cookies)
-     o  Notify Message Type - set to INITIAL-CONTACT
-     o  SPI - set to the two ISAKMP cookies
-     o  Notification Data - <not included>
-
-4.7 IPSEC Key Exchange Requirements
-
-   The IPSEC DOI introduces no additional Key Exchange types.
-
-5. Security Considerations
-
-   This entire memo pertains to the Internet Key Exchange protocol
-   ([IKE]), which combines ISAKMP ([ISAKMP]) and Oakley ([OAKLEY]) to
-   provide for the derivation of cryptographic keying material in a
-   secure and authenticated manner.  Specific discussion of the various
-   security protocols and transforms identified in this document can be
-   found in the associated base documents and in the cipher references.
-
-6. IANA Considerations
-
-   This document contains many "magic" numbers to be maintained by the
-   IANA.  This section explains the criteria to be used by the IANA to
-   assign additional numbers in each of these lists.  All values not
-   explicitly defined in previous sections are reserved to IANA.
-
-
-
-
-
-
-Piper                       Standards Track                    [Page 24]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-6.1 IPSEC Situation Definition
-
-   The Situation Definition is a 32-bit bitmask which represents the
-   environment under which the IPSEC SA proposal and negotiation is
-   carried out.  Requests for assignments of new situations must be
-   accompanied by an RFC which describes the interpretation for the
-   associated bit.
-
-   If the RFC is not on the standards-track (i.e., it is an
-   informational or experimental RFC), it must be explicitly reviewed
-   and approved by the IESG before the RFC is published and the
-   transform identifier is assigned.
-
-   The upper two bits are reserved for private use amongst cooperating
-   systems.
-
-6.2 IPSEC Security Protocol Identifiers
-
-   The Security Protocol Identifier is an 8-bit value which identifies a
-   security protocol suite being negotiated.  Requests for assignments
-   of new security protocol identifiers must be accompanied by an RFC
-   which describes the requested security protocol.  [AH] and [ESP] are
-   examples of security protocol documents.
-
-   If the RFC is not on the standards-track (i.e., it is an
-   informational or experimental RFC), it must be explicitly reviewed
-   and approved by the IESG before the RFC is published and the
-   transform identifier is assigned.
-
-   The values 249-255 are reserved for private use amongst cooperating
-   systems.
-
-6.3 IPSEC ISAKMP Transform Identifiers
-
-   The IPSEC ISAKMP Transform Identifier is an 8-bit value which
-   identifies a key exchange protocol to be used for the negotiation.
-   Requests for assignments of new ISAKMP transform identifiers must be
-   accompanied by an RFC which describes the requested key exchange
-   protocol.  [IKE] is an example of one such document.
-
-   If the RFC is not on the standards-track (i.e., it is an
-   informational or experimental RFC), it must be explicitly reviewed
-   and approved by the IESG before the RFC is published and the
-   transform identifier is assigned.
-
-   The values 249-255 are reserved for private use amongst cooperating
-   systems.
-
-
-
-
-Piper                       Standards Track                    [Page 25]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-6.4 IPSEC AH Transform Identifiers
-
-   The IPSEC AH Transform Identifier is an 8-bit value which identifies
-   a particular algorithm to be used to provide integrity protection for
-   AH.  Requests for assignments of new AH transform identifiers must be
-   accompanied by an RFC which describes how to use the algorithm within
-   the AH framework ([AH]).
-
-   If the RFC is not on the standards-track (i.e., it is an
-   informational or experimental RFC), it must be explicitly reviewed
-   and approved by the IESG before the RFC is published and the
-   transform identifier is assigned.
-
-   The values 249-255 are reserved for private use amongst cooperating
-   systems.
-
-6.5 IPSEC ESP Transform Identifiers
-
-   The IPSEC ESP Transform Identifier is an 8-bit value which identifies
-   a particular algorithm to be used to provide secrecy protection for
-   ESP.  Requests for assignments of new ESP transform identifiers must
-   be accompanied by an RFC which describes how to use the algorithm
-   within the ESP framework ([ESP]).
-
-   If the RFC is not on the standards-track (i.e., it is an
-   informational or experimental RFC), it must be explicitly reviewed
-   and approved by the IESG before the RFC is published and the
-   transform identifier is assigned.
-
-   The values 249-255 are reserved for private use amongst cooperating
-   systems.
-
-6.6 IPSEC IPCOMP Transform Identifiers
-
-   The IPSEC IPCOMP Transform Identifier is an 8-bit value which
-   identifier a particular algorithm to be used to provide IP-level
-   compression before ESP.  Requests for assignments of new IPCOMP
-   transform identifiers must be accompanied by an RFC which describes
-   how to use the algorithm within the IPCOMP framework ([IPCOMP]).  In
-   addition, the requested algorithm must be published and in the public
-   domain.
-
-   If the RFC is not on the standards-track (i.e., it is an
-   informational or experimental RFC), it must be explicitly reviewed
-   and approved by the IESG before the RFC is published and the
-   transform identifier is assigned.
-
-
-
-
-
-Piper                       Standards Track                    [Page 26]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-   The values 1-47 are reserved for algorithms for which an RFC has been
-   approved for publication.  The values 48-63 are reserved for private
-   use amongst cooperating systems.  The values 64-255 are reserved for
-   future expansion.
-
-6.7 IPSEC Security Association Attributes
-
-   The IPSEC Security Association Attribute consists of a 16-bit type
-   and its associated value.  IPSEC SA attributes are used to pass
-   miscellaneous values between ISAKMP peers.  Requests for assignments
-   of new IPSEC SA attributes must be accompanied by an Internet Draft
-   which describes the attribute encoding (Basic/Variable-Length) and
-   its legal values.  Section 4.5 of this document provides an example
-   of such a description.
-
-   The values 32001-32767 are reserved for private use amongst
-   cooperating systems.
-
-6.8 IPSEC Labeled Domain Identifiers
-
-   The IPSEC Labeled Domain Identifier is a 32-bit value which
-   identifies a namespace in which the Secrecy and Integrity levels and
-   categories values are said to exist.  Requests for assignments of new
-   IPSEC Labeled Domain Identifiers should be granted on demand.  No
-   accompanying documentation is required, though Internet Drafts are
-   encouraged when appropriate.
-
-   The values 0x80000000-0xffffffff are reserved for private use amongst
-   cooperating systems.
-
-6.9 IPSEC Identification Type
-
-   The IPSEC Identification Type is an 8-bit value which is used as a
-   discriminant for interpretation of the variable-length Identification
-   Payload.  Requests for assignments of new IPSEC Identification Types
-   must be accompanied by an RFC which describes how to use the
-   identification type within IPSEC.
-
-   If the RFC is not on the standards-track (i.e., it is an
-   informational or experimental RFC), it must be explicitly reviewed
-   and approved by the IESG before the RFC is published and the
-   transform identifier is assigned.
-
-   The values 249-255 are reserved for private use amongst cooperating
-   systems.
-
-
-
-
-
-
-Piper                       Standards Track                    [Page 27]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-6.10 IPSEC Notify Message Types
-
-   The IPSEC Notify Message Type is a 16-bit value taken from the range
-   of values reserved by ISAKMP for each DOI.  There is one range for
-   error messages (8192-16383) and a different range for status messages
-   (24576-32767).  Requests for assignments of new Notify Message Types
-   must be accompanied by an Internet Draft which describes how to use
-   the identification type within IPSEC.
-
-   The values 16001-16383 and the values 32001-32767 are reserved for
-   private use amongst cooperating systems.
-
-7. Change Log
-
-7.1 Changes from V9
-
-     o  add explicit reference to [IPCOMP], [DEFLATE], and [LZS]
-     o  allow RESPONDER-LIFETIME and REPLAY-STATUS to be directed
-        at an IPSEC SPI in addition to the ISAKMP "SPI"
-     o  added padding exclusion to Secrecy and Integrity Length text
-     o  added forward reference to Section 4.5 in Section 4.4.4
-     o  update document references
-
-7.2 Changes from V8
-
-     o  update IPCOMP identifier range to better reflect IPCOMP draft
-     o  update IANA considerations per Jeff/Ted's suggested text
-     o  eliminate references to DES-MAC ID ([DESMAC])
-     o  correct bug in Notify section; ISAKMP Notify values are 16-bits
-
-7.3 Changes from V7
-
-     o  corrected name of IPCOMP (IP Payload Compression)
-     o  corrected references to [ESPCBC]
-     o  added missing Secrecy Level and Integrity Level to Figure 1
-     o  removed ID references to PF_KEY and ARCFOUR
-     o  updated Basic/Variable text to align with [IKE]
-     o  updated document references and add intro pointer to [ARCH]
-     o  updated Notification requirements; remove aggressive reference
-     o  added clarification about protection for Notify payloads
-     o  restored RESERVED to ESP transform ID namespace; moved ESP_NULL
-     o  added requirement for ESP_NULL support and [ESPNULL] reference
-     o  added clarification on Auth Alg use with AH/ESP
-     o  added restriction against using conflicting AH/Auth combinations
-
-7.4 Changes from V6
-
-   The following changes were made relative to the IPSEC DOI V6:
-
-
-
-Piper                       Standards Track                    [Page 28]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-     o  added IANA Considerations section
-     o  moved most IANA numbers to IANA Considerations section
-     o  added prohibition on sending (V) encoding for (B) attributes
-     o  added prohibition on sending Key Length attribute for fixed
-        length ciphers (e.g. DES)
-     o  replaced references to ISAKMP/Oakley with IKE
-     o  renamed ESP_ARCFOUR to ESP_RC4
-     o  updated Security Considerations section
-     o  updated document references
-
-7.5 Changes from V5
-
-   The following changes were made relative to the IPSEC DOI V5:
-
-     o  changed SPI size in Lifetime Notification text
-     o  changed REPLAY-ENABLED to REPLAY-STATUS
-     o  moved RESPONDER-LIFETIME payload definition from Section 4.5.4
-        to Section 4.6.3.1
-     o  added explicit payload layout for 4.6.3.3
-     o  added Implementation Note to Section 4.6.3 introduction
-     o  changed AH_SHA text to require SHA-1 in addition to MD5
-     o  updated document references
-
-7.6 Changes from V4
-
-   The following changes were made relative to the IPSEC DOI V4:
-
-     o  moved compatibility AH KPDK authentication method from AH
-        transform ID to Authentication Algorithm identifier
-     o  added REPLAY-ENABLED notification message type per Architecture
-     o  added INITIAL-CONTACT notification message type per list
-     o  added text to ensure protection for Notify Status messages
-     o  added Lifetime qualification to attribute parsing section
-     o  added clarification that Lifetime notification is optional
-     o  removed private Group Description list (now points at [IKE])
-     o  replaced Terminology with pointer to RFC-2119
-     o  updated HMAC MD5 and SHA-1 ID references
-     o  updated Section 1 (Abstract)
-     o  updated Section 4.4 (IPSEC Assigned Numbers)
-     o  added restriction for ID port/protocol values for Phase I
-
-7.7 Changes from V3 to V4
-
-   The following changes were made relative to the IPSEC DOI V3, that
-   was posted to the IPSEC mailing list prior to the Munich IETF:
-
-     o  added ESP transform identifiers for NULL and ARCFOUR
-
-
-
-
-Piper                       Standards Track                    [Page 29]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-     o  renamed HMAC Algorithm to Auth Algorithm to accommodate
-        DES-MAC and optional authentication/integrity for ESP
-     o  added AH and ESP DES-MAC algorithm identifiers
-     o  removed KEY_MANUAL and KEY_KDC identifier definitions
-     o  added lifetime duration MUST follow lifetype attribute to
-        SA Life Type and SA Life Duration attribute definition
-     o  added lifetime notification and IPSEC DOI message type table
-     o  added optional authentication and confidentiality
-        restrictions to MAC Algorithm attribute definition
-     o  corrected attribute parsing example (used obsolete attribute)
-     o  corrected several Internet Draft document references
-     o  added ID_KEY_ID per ipsec list discussion (18-Mar-97)
-     o  removed Group Description default for PFS QM ([IKE] MUST)
-
-Acknowledgments
-
-   This document is derived, in part, from previous works by Douglas
-   Maughan, Mark Schertler, Mark Schneider, Jeff Turner, Dan Harkins,
-   and Dave Carrel.  Matt Thomas, Roy Pereira, Greg Carter, and Ran
-   Atkinson also contributed suggestions and, in many cases, text.
-
-References
-
-   [AH]      Kent, S., and R. Atkinson, "IP Authentication Header", RFC
-             2402, November 1998.
-
-   [ARCH]    Kent, S., and R. Atkinson, "Security Architecture for the
-             Internet Protocol", RFC 2401, November 1998.
-
-   [DEFLATE] Pereira, R., "IP Payload Compression Using DEFLATE", RFC
-             2394, August 1998.
-
-   [ESP]     Kent, S., and R. Atkinson, "IP Encapsulating Security
-             Payload (ESP)", RFC 2406, November 1998.
-
-   [ESPCBC]  Pereira, R., and R. Adams, "The ESP CBC-Mode Cipher
-             Algorithms", RFC 2451, November 1998.
-
-   [ESPNULL] Glenn, R., and S. Kent, "The NULL Encryption Algorithm and
-             Its Use With IPsec", RFC 2410, November 1998.
-
-   [DES]     Madson, C., and N. Doraswamy, "The ESP DES-CBC Cipher
-             Algorithm With Explicit IV", RFC 2405, November 1998.
-
-   [HMACMD5] Madson, C., and R. Glenn, "The Use of HMAC-MD5 within ESP
-             and AH", RFC 2403, November 1998.
-
-
-
-
-
-Piper                       Standards Track                    [Page 30]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-   [HMACSHA] Madson, C., and R. Glenn, "The Use of HMAC-SHA-1-96 within
-             ESP and AH", RFC 2404, November 1998.
-
-   [IKE]     Harkins, D., and D. Carrel, D., "The Internet Key Exchange
-             (IKE)", RFC 2409, November 1998.
-
-   [IPCOMP]  Shacham, A., Monsour, R., Pereira, R., and M. Thomas, "IP
-             Payload Compression Protocol (IPComp)", RFC 2393, August
-             1998.
-
-   [ISAKMP]  Maughan, D., Schertler, M., Schneider, M., and J. Turner,
-             "Internet Security Association and Key Management Protocol
-             (ISAKMP)", RFC 2408, November 1998.
-
-   [LZS]     Friend, R., and R. Monsour, "IP Payload Compression Using
-             LZS", RFC 2395, August 1998.
-
-   [OAKLEY]  Orman, H., "The OAKLEY Key Determination Protocol", RFC
-             2412, November 1998.
-
-   [X.501]   ISO/IEC 9594-2, "Information Technology - Open Systems
-             Interconnection - The Directory:  Models", CCITT/ITU
-             Recommendation X.501, 1993.
-
-   [X.509]   ISO/IEC 9594-8, "Information Technology - Open Systems
-             Interconnection - The Directory:  Authentication
-             Framework", CCITT/ITU Recommendation X.509, 1993.
-
-Author's Address
-
-   Derrell Piper
-   Network Alchemy
-   1521.5 Pacific Ave
-   Santa Cruz, California, 95060
-   United States of America
-
-   Phone: +1 408 460-3822
-   EMail: ddp@network-alchemy.com
-
-
-
-
-
-
-
-
-
-
-
-
-
-Piper                       Standards Track                    [Page 31]
-
-RFC 2407          IP Security Domain of Interpretation     November 1998
-
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society (1998).  All Rights Reserved.
-
-   This document and translations of it may be copied and furnished to
-   others, and derivative works that comment on or otherwise explain it
-   or assist in its implementation may be prepared, copied, published
-   and distributed, in whole or in part, without restriction of any
-   kind, provided that the above copyright notice and this paragraph are
-   included on all such copies and derivative works.  However, this
-   document itself may not be modified in any way, such as by removing
-   the copyright notice or references to the Internet Society or other
-   Internet organizations, except as needed for the purpose of
-   developing Internet standards in which case the procedures for
-   copyrights defined in the Internet Standards process must be
-   followed, or as required to translate it into languages other than
-   English.
-
-   The limited permissions granted above are perpetual and will not be
-   revoked by the Internet Society or its successors or assigns.
-
-   This document and the information contained herein is provided on an
-   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
-   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
-   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
-   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Piper                       Standards Track                    [Page 32]
-
diff --git a/doc/ikev2/[RFC2408] - Internet Security Association and Key Management Protocol (ISAKMP).txt b/doc/ikev2/[RFC2408] - Internet Security Association and Key Management Protocol (ISAKMP).txt
deleted file mode 100644
index c3af56268..000000000
--- a/doc/ikev2/[RFC2408] - Internet Security Association and Key Management Protocol (ISAKMP).txt
+++ /dev/null
@@ -1,4819 +0,0 @@
-
-
-
-
-
-
-Network Working Group                                      D. Maughan
-Request for Comments: 2408                   National Security Agency
-Category: Standards Track                                M. Schertler
-                                                       Securify, Inc.
-                                                         M. Schneider
-                                             National Security Agency
-                                                            J. Turner
-                                              RABA Technologies, Inc.
-                                                        November 1998
-
-
-   Internet Security Association and Key Management Protocol (ISAKMP)
-
-Status of this Memo
-
-   This document specifies an Internet standards track protocol for the
-   Internet community, and requests discussion and suggestions for
-   improvements.  Please refer to the current edition of the "Internet
-   Official Protocol Standards" (STD 1) for the standardization state
-   and status of this protocol.  Distribution of this memo is unlimited.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (1998).  All Rights Reserved.
-
-Abstract
-
-   This memo describes a protocol utilizing security concepts necessary
-   for establishing Security Associations (SA) and cryptographic keys in
-   an Internet environment.  A Security Association protocol that
-   negotiates, establishes, modifies and deletes Security Associations
-   and their attributes is required for an evolving Internet, where
-   there will be numerous security mechanisms and several options for
-   each security mechanism.  The key management protocol must be robust
-   in order to handle public key generation for the Internet community
-   at large and private key requirements for those private networks with
-   that requirement.  The Internet Security Association and Key
-   Management Protocol (ISAKMP) defines the procedures for
-   authenticating a communicating peer, creation and management of
-   Security Associations, key generation techniques, and threat
-   mitigation (e.g.  denial of service and replay attacks).  All of
-   these are necessary to establish and maintain secure communications
-   (via IP Security Service or any other security protocol) in an
-   Internet environment.
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                     [Page 1]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-Table of Contents
-
-   1 Introduction                                                     4
-     1.1 Requirements Terminology  . . . . . . . . . . . . . . . . .  5
-     1.2 The Need for Negotiation  . . . . . . . . . . . . . . . . .  5
-     1.3 What can be Negotiated?   . . . . . . . . . . . . . . . . .  6
-     1.4 Security Associations and Management  . . . . . . . . . . .  7
-       1.4.1 Security Associations and Registration  . . . . . . . .  7
-       1.4.2 ISAKMP Requirements   . . . . . . . . . . . . . . . . .  8
-     1.5 Authentication  . . . . . . . . . . . . . . . . . . . . . .  8
-       1.5.1 Certificate Authorities   . . . . . . . . . . . . . . .  9
-       1.5.2 Entity Naming   . . . . . . . . . . . . . . . . . . . .  9
-       1.5.3 ISAKMP Requirements   . . . . . . . . . . . . . . . . . 10
-     1.6 Public Key Cryptography . . . . . . . . . . . . . . . . . . 10
-       1.6.1 Key Exchange Properties   . . . . . . . . . . . . . . . 11
-       1.6.2 ISAKMP Requirements   . . . . . . . . . . . . . . . . . 12
-     1.7 ISAKMP Protection . . . . . . . . . . . . . . . . . . . . . 12
-       1.7.1 Anti-Clogging (Denial of Service)   . . . . . . . . . . 12
-       1.7.2 Connection Hijacking  . . . . . . . . . . . . . . . . . 13
-       1.7.3 Man-in-the-Middle Attacks   . . . . . . . . . . . . . . 13
-     1.8 Multicast Communications  . . . . . . . . . . . . . . . . . 13
-   2 Terminology and Concepts                                        14
-     2.1 ISAKMP Terminology  . . . . . . . . . . . . . . . . . . . . 14
-     2.2 ISAKMP Placement  . . . . . . . . . . . . . . . . . . . . . 16
-     2.3 Negotiation Phases  . . . . . . . . . . . . . . . . . . . . 16
-     2.4 Identifying Security Associations . . . . . . . . . . . . . 17
-     2.5 Miscellaneous . . . . . . . . . . . . . . . . . . . . . . . 20
-       2.5.1 Transport Protocol  . . . . . . . . . . . . . . . . . . 20
-       2.5.2 RESERVED Fields   . . . . . . . . . . . . . . . . . . . 20
-       2.5.3 Anti-Clogging Token ("Cookie") Creation   . . . . . . . 20
-   3 ISAKMP Payloads                                                 21
-     3.1 ISAKMP Header Format  . . . . . . . . . . . . . . . . . . . 21
-     3.2 Generic Payload Header  . . . . . . . . . . . . . . . . . . 25
-     3.3 Data Attributes . . . . . . . . . . . . . . . . . . . . . . 25
-     3.4 Security Association Payload  . . . . . . . . . . . . . . . 27
-     3.5 Proposal Payload  . . . . . . . . . . . . . . . . . . . . . 28
-     3.6 Transform Payload . . . . . . . . . . . . . . . . . . . . . 29
-     3.7 Key Exchange Payload  . . . . . . . . . . . . . . . . . . . 31
-     3.8 Identification Payload  . . . . . . . . . . . . . . . . . . 32
-     3.9 Certificate Payload . . . . . . . . . . . . . . . . . . . . 33
-     3.10 Certificate Request Payload  . . . . . . . . . . . . . . . 34
-     3.11 Hash Payload   . . . . . . . . . . . . . . . . . . . . . . 36
-     3.12 Signature Payload  . . . . . . . . . . . . . . . . . . . . 37
-     3.13 Nonce Payload  . . . . . . . . . . . . . . . . . . . . . . 37
-     3.14 Notification Payload   . . . . . . . . . . . . . . . . . . 38
-       3.14.1 Notify Message Types   . . . . . . . . . . . . . . . . 40
-     3.15 Delete Payload   . . . . . . . . . . . . . . . . . . . . . 41
-     3.16 Vendor ID Payload  . . . . . . . . . . . . . . . . . . . . 43
-
-
-
-Maughan, et. al.            Standards Track                     [Page 2]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   4 ISAKMP Exchanges                                                44
-     4.1 ISAKMP Exchange Types . . . . . . . . . . . . . . . . . . . 45
-       4.1.1 Notation  . . . . . . . . . . . . . . . . . . . . . . . 46
-     4.2 Security Association Establishment  . . . . . . . . . . . . 46
-       4.2.1 Security Association Establishment Examples   . . . . . 48
-     4.3 Security Association Modification . . . . . . . . . . . . . 50
-     4.4 Base Exchange . . . . . . . . . . . . . . . . . . . . . . . 51
-     4.5 Identity Protection Exchange  . . . . . . . . . . . . . . . 52
-     4.6 Authentication Only Exchange  . . . . . . . . . . . . . . . 54
-     4.7 Aggressive Exchange . . . . . . . . . . . . . . . . . . . . 55
-     4.8 Informational Exchange  . . . . . . . . . . . . . . . . . . 57
-   5 ISAKMP Payload Processing                                       58
-     5.1 General Message Processing  . . . . . . . . . . . . . . . . 58
-     5.2 ISAKMP Header Processing  . . . . . . . . . . . . . . . . . 59
-     5.3 Generic Payload Header Processing . . . . . . . . . . . . . 61
-     5.4 Security Association Payload Processing . . . . . . . . . . 62
-     5.5 Proposal Payload Processing . . . . . . . . . . . . . . . . 63
-     5.6 Transform Payload Processing  . . . . . . . . . . . . . . . 64
-     5.7 Key Exchange Payload Processing . . . . . . . . . . . . . . 65
-     5.8 Identification Payload Processing . . . . . . . . . . . . . 66
-     5.9 Certificate Payload Processing  . . . . . . . . . . . . . . 66
-     5.10 Certificate Request Payload Processing   . . . . . . . . . 67
-     5.11 Hash Payload Processing  . . . . . . . . . . . . . . . . . 69
-     5.12 Signature Payload Processing   . . . . . . . . . . . . . . 69
-     5.13 Nonce Payload Processing   . . . . . . . . . . . . . . . . 70
-     5.14 Notification Payload Processing  . . . . . . . . . . . . . 71
-     5.15 Delete Payload Processing  . . . . . . . . . . . . . . . . 73
-   6 Conclusions                                                     75
-   A ISAKMP Security Association Attributes                          77
-     A.1 Background/Rationale  . . . . . . . . . . . . . . . . . . . 77
-     A.2 Internet IP Security DOI Assigned Value . . . . . . . . . . 77
-     A.3 Supported Security Protocols  . . . . . . . . . . . . . . . 77
-     A.4 ISAKMP Identification Type Values . . . . . . . . . . . . . 78
-       A.4.1 ID_IPV4_ADDR  . . . . . . . . . . . . . . . . . . . . . 78
-       A.4.2 ID_IPV4_ADDR_SUBNET . . . . . . . . . . . . . . . . . . 78
-       A.4.3 ID_IPV6_ADDR  . . . . . . . . . . . . . . . . . . . . . 78
-       A.4.4 ID_IPV6_ADDR_SUBNET   . . . . . . . . . . . . . . . . . 78
-   B Defining a new Domain of Interpretation                         79
-     B.1 Situation . . . . . . . . . . . . . . . . . . . . . . . . . 79
-     B.2 Security Policies . . . . . . . . . . . . . . . . . . . . . 80
-     B.3 Naming Schemes  . . . . . . . . . . . . . . . . . . . . . . 80
-     B.4 Syntax for Specifying Security Services . . . . . . . . . . 80
-     B.5 Payload Specification . . . . . . . . . . . . . . . . . . . 80
-     B.6 Defining new Exchange Types . . . . . . . . . . . . . . . . 80
-   Security Considerations                                           81
-   IANA Considerations                                               81
-   Domain of Interpretation                                          81
-   Supported Security Protocols                                      82
-
-
-
-Maughan, et. al.            Standards Track                     [Page 3]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   Acknowledgements                                                  82
-   References                                                        82
-   Authors' Addresses                                                85
-   Full Copyright Statement                                          86
-
-List of Figures
-
-   1   ISAKMP Relationships  . . . . . . . . . . . . . . . . . . . 16
-   2   ISAKMP Header Format  . . . . . . . . . . . . . . . . . . . 22
-   3   Generic Payload Header  . . . . . . . . . . . . . . . . . . 25
-   4   Data Attributes . . . . . . . . . . . . . . . . . . . . . . 26
-   5   Security Association Payload  . . . . . . . . . . . . . . . 27
-   6   Proposal Payload Format . . . . . . . . . . . . . . . . . . 28
-   7   Transform Payload Format  . . . . . . . . . . . . . . . . . 30
-   8   Key Exchange Payload Format . . . . . . . . . . . . . . . . 31
-   9   Identification Payload Format . . . . . . . . . . . . . . . 32
-   10  Certificate Payload Format  . . . . . . . . . . . . . . . . 33
-   11  Certificate Request Payload Format  . . . . . . . . . . . . 34
-   12  Hash Payload Format . . . . . . . . . . . . . . . . . . . . 36
-   13  Signature Payload Format  . . . . . . . . . . . . . . . . . 37
-   14  Nonce Payload Format  . . . . . . . . . . . . . . . . . . . 38
-   15  Notification Payload Format . . . . . . . . . . . . . . . . 39
-   16  Delete Payload Format . . . . . . . . . . . . . . . . . . . 42
-   17  Vendor ID Payload Format  . . . . . . . . . . . . . . . . . 44
-
-1 Introduction
-
-   This document describes an Internet Security Association and Key
-   Management Protocol (ISAKMP). ISAKMP combines the security concepts
-   of authentication, key management, and security associations to
-   establish the required security for government, commercial, and
-   private communications on the Internet.
-
-   The Internet Security Association and Key Management Protocol
-   (ISAKMP) defines procedures and packet formats to establish,
-   negotiate, modify and delete Security Associations (SA). SAs contain
-   all the information required for execution of various network
-   security services, such as the IP layer services (such as header
-   authentication and payload encapsulation), transport or application
-   layer services, or self-protection of negotiation traffic.  ISAKMP
-   defines payloads for exchanging key generation and authentication
-   data.  These formats provide a consistent framework for transferring
-   key and authentication data which is independent of the key
-   generation technique, encryption algorithm and authentication
-   mechanism.
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                     [Page 4]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   ISAKMP is distinct from key exchange protocols in order to cleanly
-   separate the details of security association management (and key
-   management) from the details of key exchange.  There may be many
-   different key exchange protocols, each with different security
-   properties.  However, a common framework is required for agreeing to
-   the format of SA attributes, and for negotiating, modifying, and
-   deleting SAs.  ISAKMP serves as this common framework.
-
-   Separating the functionality into three parts adds complexity to the
-   security analysis of a complete ISAKMP implementation.  However, the
-   separation is critical for interoperability between systems with
-   differing security requirements, and should also simplify the
-   analysis of further evolution of a ISAKMP server.
-
-   ISAKMP is intended to support the negotiation of SAs for security
-   protocols at all layers of the network stack (e.g., IPSEC, TLS, TLSP,
-   OSPF, etc.).  By centralizing the management of the security
-   associations, ISAKMP reduces the amount of duplicated functionality
-   within each security protocol.  ISAKMP can also reduce connection
-   setup time, by negotiating a whole stack of services at once.
-
-   The remainder of section 1 establishes the motivation for security
-   negotiation and outlines the major components of ISAKMP, i.e.
-   Security Associations and Management, Authentication, Public Key
-   Cryptography, and Miscellaneous items.  Section 2 presents the
-   terminology and concepts associated with ISAKMP. Section 3 describes
-   the different ISAKMP payload formats.  Section 4 describes how the
-   payloads of ISAKMP are composed together as exchange types to
-   establish security associations and perform key exchanges in an
-   authenticated manner.  Additionally, security association
-   modification, deletion, and error notification are discussed.
-   Section 5 describes the processing of each payload within the context
-   of ISAKMP exchanges, including error handling and associated actions.
-   The appendices provide the attribute values necessary for ISAKMP and
-   requirement for defining a new Domain of Interpretation (DOI) within
-   ISAKMP.
-
-1.1 Requirements Terminology
-
-   The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,
-   SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this
-   document, are to be interpreted as described in [RFC-2119].
-
-1.2 The Need for Negotiation
-
-   ISAKMP extends the assertion in [DOW92] that authentication and key
-   exchanges must be combined for better security to include security
-   association exchanges.  The security services required for
-
-
-
-Maughan, et. al.            Standards Track                     [Page 5]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   communications depends on the individual network configurations and
-   environments.  Organizations are setting up Virtual Private Networks
-   (VPN), also known as Intranets, that will require one set of security
-   functions for communications within the VPN and possibly many
-   different security functions for communications outside the VPN to
-   support geographically separate organizational components, customers,
-   suppliers, sub-contractors (with their own VPNs), government, and
-   others.  Departments within large organizations may require a number
-   of security associations to separate and protect data (e.g.
-   personnel data, company proprietary data, medical) on internal
-   networks and other security associations to communicate within the
-   same department.  Nomadic users wanting to "phone home" represent
-   another set of security requirements.  These requirements must be
-   tempered with bandwidth challenges.  Smaller groups of people may
-   meet their security requirements by setting up "Webs of Trust".
-   ISAKMP exchanges provide these assorted networking communities the
-   ability to present peers with the security functionality that the
-   user supports in an authenticated and protected manner for agreement
-   upon a common set of security attributes, i.e.  an interoperable
-   security association.
-
-1.3 What can be Negotiated?
-
-   Security associations must support different encryption algorithms,
-   authentication mechanisms, and key establishment algorithms for other
-   security protocols, as well as IP Security.  Security associations
-   must also support host-oriented certificates for lower layer
-   protocols and user- oriented certificates for higher level protocols.
-   Algorithm and mechanism independence is required in applications such
-   as e-mail, remote login, and file transfer, as well as in session
-   oriented protocols, routing protocols, and link layer protocols.
-   ISAKMP provides a common security association and key establishment
-   protocol for this wide range of security protocols, applications,
-   security requirements, and network environments.
-
-   ISAKMP is not bound to any specific cryptographic algorithm, key
-   generation technique, or security mechanism.  This flexibility is
-   beneficial for a number of reasons.  First, it supports the dynamic
-   communications environment described above.  Second, the independence
-   from specific security mechanisms and algorithms provides a forward
-   migration path to better mechanisms and algorithms.  When improved
-   security mechanisms are developed or new attacks against current
-   encryption algorithms, authentication mechanisms and key exchanges
-   are discovered, ISAKMP will allow the updating of the algorithms and
-   mechanisms without having to develop a completely new KMP or patch
-   the current one.
-
-
-
-
-
-Maughan, et. al.            Standards Track                     [Page 6]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   ISAKMP has basic requirements for its authentication and key exchange
-   components.  These requirements guard against denial of service,
-   replay / reflection, man-in-the-middle, and connection hijacking
-   attacks.  This is important because these are the types of attacks
-   that are targeted against protocols.  Complete Security Association
-   (SA) support, which provides mechanism and algorithm independence,
-   and protection from protocol threats are the strengths of ISAKMP.
-
-1.4 Security Associations and Management
-
-   A Security Association (SA) is a relationship between two or more
-   entities that describes how the entities will utilize security
-   services to communicate securely.  This relationship is represented
-   by a set of information that can be considered a contract between the
-   entities.  The information must be agreed upon and shared between all
-   the entities.  Sometimes the information alone is referred to as an
-   SA, but this is just a physical instantiation of the existing
-   relationship.  The existence of this relationship, represented by the
-   information, is what provides the agreed upon security information
-   needed by entities to securely interoperate.  All entities must
-   adhere to the SA for secure communications to be possible.  When
-   accessing SA attributes, entities use a pointer or identifier refered
-   to as the Security Parameter Index (SPI). [SEC-ARCH] provides details
-   on IP Security Associations (SA) and Security Parameter Index (SPI)
-   definitions.
-
-1.4.1 Security Associations and Registration
-
-   The SA attributes required and recommended for the IP Security (AH,
-   ESP) are defined in [SEC-ARCH].  The attributes specified for an IP
-   Security SA include, but are not limited to, authentication
-   mechanism, cryptographic algorithm, algorithm mode, key length, and
-   Initialization Vector (IV).  Other protocols that provide algorithm
-   and mechanism independent security MUST define their requirements for
-   SA attributes.  The separation of ISAKMP from a specific SA
-   definition is important to ensure ISAKMP can es tablish SAs for all
-   possible security protocols and applications.
-
-   NOTE: See [IPDOI] for a discussion of SA attributes that should be
-   considered when defining a security protocol or application.
-
-   In order to facilitate easy identification of specific attributes
-   (e.g.  a specific encryption algorithm) among different network
-   entites the attributes must be assigned identifiers and these
-   identifiers must be registered by a central authority.  The Internet
-   Assigned Numbers Authority (IANA) provides this function for the
-   Internet.
-
-
-
-
-Maughan, et. al.            Standards Track                     [Page 7]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-1.4.2 ISAKMP Requirements
-
-   Security Association (SA) establishment MUST be part of the key
-   management protocol defined for IP based networks.  The SA concept is
-   required to support security protocols in a diverse and dynamic
-   networking environment.  Just as authentication and key exchange must
-   be linked to provide assurance that the key is established with the
-   authenticated party [DOW92], SA establishment must be linked with the
-   authentication and the key exchange protocol.
-
-   ISAKMP provides the protocol exchanges to establish a security
-   association between negotiating entities followed by the
-   establishment of a security association by these negotiating entities
-   in behalf of some protocol (e.g.  ESP/AH). First, an initial protocol
-   exchange allows a basic set of security attributes to be agreed upon.
-   This basic set provides protection for subsequent ISAKMP exchanges.
-   It also indicates the authentication method and key exchange that
-   will be performed as part of the ISAKMP protocol.  If a basic set of
-   security attributes is already in place between the negotiating
-   server entities, the initial ISAKMP exchange may be skipped and the
-   establishment of a security association can be done directly.  After
-   the basic set of security attributes has been agreed upon, initial
-   identity authenticated, and required keys generated, the established
-   SA can be used for subsequent communications by the entity that
-   invoked ISAKMP.  The basic set of SA attributes that MUST be
-   implemented to provide ISAKMP interoperability are defined in
-   Appendix A.
-
-1.5 Authentication
-
-   A very important step in establishing secure network communications
-   is authentication of the entity at the other end of the
-   communication.  Many authentication mechanisms are available.
-   Authentication mechanisms fall into two catagories of strength - weak
-   and strong.  Sending cleartext keys or other unprotected
-   authenticating information over a network is weak, due to the threat
-   of reading them with a network sniffer.  Additionally, sending one-
-   way hashed poorly-chosen keys with low entropy is also weak, due to
-   the threat of brute-force guessing attacks on the sniffed messages.
-   While passwords can be used for establishing identity, they are not
-   considered in this context because of recent statements from the
-   Internet Architecture Board [IAB].  Digital signatures, such as the
-   Digital Signature Standard (DSS) and the Rivest-Shamir-Adleman (RSA)
-   signature, are public key based strong authentication mechanisms.
-   When using public key digital signatures each entity requires a
-   public key and a private key.  Certificates are an essential part of
-   a digital signature authentication mechanism.  Certificates bind a
-   specific entity's identity (be it host, network, user, or
-
-
-
-Maughan, et. al.            Standards Track                     [Page 8]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   application) to its public keys and possibly other security-related
-   information such as privileges, clearances, and compartments.
-   Authentication based on digital signatures requires a trusted third
-   party or certificate authority to create, sign and properly
-   distribute certificates.  For more detailed information on digital
-   signatures, such as DSS and RSA, and certificates see [Schneier].
-
-1.5.1 Certificate Authorities
-
-   Certificates require an infrastructure for generation, verification,
-   revocation, management and distribution.  The Internet Policy
-   Registration Authority (IPRA) [RFC-1422] has been established to
-   direct this infrastructure for the IETF. The IPRA certifies Policy
-   Certification Authorities (PCA). PCAs control Certificate Authorities
-   (CA) which certify users and subordinate entities.  Current
-   certificate related work includes the Domain Name System (DNS)
-   Security Extensions [DNSSEC] which will provide signed entity keys in
-   the DNS. The Public Key Infrastucture (PKIX) working group is
-   specifying an Internet profile for X.509 certificates.  There is also
-   work going on in industry to develop X.500 Directory Services which
-   would provide X.509 certificates to users.  The U.S. Post Office is
-   developing a (CA) hierarchy.  The NIST Public Key Infrastructure
-   Working Group has also been doing work in this area.  The DOD Multi
-   Level Information System Security Initiative (MISSI) program has
-   begun deploying a certificate infrastructure for the U.S. Government.
-   Alternatively, if no infrastructure exists, the PGP Web of Trust
-   certificates can be used to provide user authentication and privacy
-   in a community of users who know and trust each other.
-
-1.5.2 Entity Naming
-
-   An entity's name is its identity and is bound to its public keys in
-   certificates.  The CA MUST define the naming semantics for the
-   certificates it issues.  See the UNINETT PCA Policy Statements
-   [Berge] for an example of how a CA defines its naming policy.  When
-   the certificate is verified, the name is verified and that name will
-   have meaning within the realm of that CA. An example is the DNS
-   security extensions which make DNS servers CAs for the zones and
-   nodes they serve.  Resource records are provided for public keys and
-   signatures on those keys.  The names associated with the keys are IP
-   addresses and domain names which have meaning to entities accessing
-   the DNS for this information.  A Web of Trust is another example.
-   When webs of trust are set up, names are bound with the public keys.
-   In PGP the name is usually the entity's e-mail address which has
-   meaning to those, and only those, who understand e-mail.  Another web
-   of trust could use an entirely different naming scheme.
-
-
-
-
-
-Maughan, et. al.            Standards Track                     [Page 9]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-1.5.3 ISAKMP Requirements
-
-   Strong authentication MUST be provided on ISAKMP exchanges.  Without
-   being able to authenticate the entity at the other end, the Security
-   Association (SA) and session key established are suspect.  Without
-   authentication you are unable to trust an entity's identification,
-   which makes access control questionable.  While encryption (e.g.
-   ESP) and integrity (e.g.  AH) will protect subsequent communications
-   from passive eavesdroppers, without authentication it is possible
-   that the SA and key may have been established with an adversary who
-   performed an active man-in-the-middle attack and is now stealing all
-   your personal data.
-
-   A digital signature algorithm MUST be used within ISAKMP's
-   authentication component.  However, ISAKMP does not mandate a
-   specific signature algorithm or certificate authority (CA). ISAKMP
-   allows an entity initiating communications to indicate which CAs it
-   supports.  After selection of a CA, the protocol provides the
-   messages required to support the actual authentication exchange.  The
-   protocol provides a facility for identification of different
-   certificate authorities, certificate types (e.g.  X.509, PKCS #7,
-   PGP, DNS SIG and KEY records), and the exchange of the certificates
-   identified.
-
-   ISAKMP utilizes digital signatures, based on public key cryptography,
-   for authentication.  There are other strong authentication systems
-   available, which could be specified as additional optional
-   authentication mechanisms for ISAKMP. Some of these authentication
-   systems rely on a trusted third party called a key distribution
-   center (KDC) to distribute secret session keys.  An example is
-   Kerberos, where the trusted third party is the Kerberos server, which
-   holds secret keys for all clients and servers within its network
-   domain.  A client's proof that it holds its secret key provides
-   authenticaton to a server.
-
-   The ISAKMP specification does not specify the protocol for
-   communicating with the trusted third parties (TTP) or certificate
-   directory services.  These protocols are defined by the TTP and
-   directory service themselves and are outside the scope of this
-   specification.  The use of these additional services and protocols
-   will be described in a Key Exchange specific document.
-
-1.6 Public Key Cryptography
-
-   Public key cryptography is the most flexible, scalable, and efficient
-   way for users to obtain the shared secrets and session keys needed to
-   support the large number of ways Internet users will interoperate.
-   Many key generation algorithms, that have different properties, are
-
-
-
-Maughan, et. al.            Standards Track                    [Page 10]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   available to users (see [DOW92], [ANSI], and [Oakley]).  Properties
-   of key exchange protocols include the key establishment method,
-   authentication, symmetry, perfect forward secrecy, and back traffic
-   protection.
-
-   NOTE: Cryptographic keys can protect information for a considerable
-   length of time.  However, this is based on the assumption that keys
-   used for protection of communications are destroyed after use and not
-   kept for any reason.
-
-1.6.1 Key Exchange Properties
-
-   Key Establishment (Key Generation / Key Transport): The two common
-   methods of using public key cryptography for key establishment are
-   key transport and key generation.  An example of key transport is the
-   use of the RSA algorithm to encrypt a randomly generated session key
-   (for encrypting subsequent communications) with the recipient's
-   public key.  The encrypted random key is then sent to the recipient,
-   who decrypts it using his private key.  At this point both sides have
-   the same session key, however it was created based on input from only
-   one side of the communications.  The benefit of the key transport
-   method is that it has less computational overhead than the following
-   method.  The Diffie-Hellman (D-H) algorithm illustrates key
-   generation using public key cryptography.  The D-H algorithm is begun
-   by two users exchanging public information.  Each user then
-   mathematically combines the other's public information along with
-   their own secret information to compute a shared secret value.  This
-   secret value can be used as a session key or as a key encryption key
-   for encrypting a randomly generated session key.  This method
-   generates a session key based on public and secret information held
-   by both users.  The benefit of the D-H algorithm is that the key used
-   for encrypting messages is based on information held by both users
-   and the independence of keys from one key exchange to another
-   provides perfect forward secrecy.  Detailed descriptions of these
-   algorithms can be found in [Schneier].  There are a number of
-   variations on these two key generation schemes and these variations
-   do not necessarily interoperate.
-
-   Key Exchange Authentication: Key exchanges may be authenticated
-   during the protocol or after protocol completion.  Authentication of
-   the key exchange during the protocol is provided when each party
-   provides proof it has the secret session key before the end of the
-   protocol.  Proof can be provided by encrypting known data in the
-   secret session key during the protocol echange.  Authentication after
-   the protocol must occur in subsequent commu nications.
-   Authentication during the protocol is preferred so subsequent
-   communications are not initiated if the secret session key is not
-   established with the desired party.
-
-
-
-Maughan, et. al.            Standards Track                    [Page 11]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   Key Exchange Symmetry: A key exchange provides symmetry if either
-   party can initiate the exchange and exchanged messages can cross in
-   transit without affecting the key that is generated.  This is
-   desirable so that computation of the keys does not require either
-   party to know who initated the exchange.  While key exchange symmetry
-   is desirable, symmetry in the entire key management protocol may
-   provide a vulnerablity to reflection attacks.
-
-   Perfect Forward Secrecy: As described in [DOW92], an authenticated
-   key exchange protocol provides perfect forward secrecy if disclosure
-   of longterm secret keying material does not compromise the secrecy of
-   the exchanged keys from previous communications.  The property of
-   perfect forward secrecy does not apply to key exchange without
-   authentication.
-
-1.6.2 ISAKMP Requirements
-
-   An authenticated key exchange MUST be supported by ISAKMP. Users
-   SHOULD choose additional key establishment algorithms based on their
-   requirements.  ISAKMP does not specify a specific key exchange.
-   However, [IKE] describes a proposal for using the Oakley key exchange
-   [Oakley] in conjunction with ISAKMP. Requirements that should be
-   evaluated when choosing a key establishment algorithm include
-   establishment method (generation vs.  transport), perfect forward
-   secrecy, computational overhead, key escrow, and key strength.  Based
-   on user requirements, ISAKMP allows an entity initiating
-   communications to indicate which key exchanges it supports.  After
-   selection of a key exchange, the protocol provides the messages
-   required to support the actual key establishment.
-
-1.7 ISAKMP Protection
-
-1.7.1 Anti-Clogging (Denial of Service)
-
-   Of the numerous security services available, protection against
-   denial of service always seems to be one of the most difficult to
-   address.  A "cookie" or anti-clogging token (ACT) is aimed at
-   protecting the computing resources from attack without spending
-   excessive CPU resources to determine its authenticity.  An exchange
-   prior to CPU-intensive public key operations can thwart some denial
-   of service attempts (e.g.  simple flooding with bogus IP source
-   addresses).  Absolute protection against denial of service is
-   impossible, but this anti-clogging token provides a technique for
-   making it easier to handle.  The use of an anti-clogging token was
-   introduced by Karn and Simpson in [Karn].
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 12]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   It should be noted that in the exchanges shown in section 4, the
-   anticlogging mechanism should be used in conjuction with a garbage-
-   state collection mechanism; an attacker can still flood a server
-   using packets with bogus IP addresses and cause state to be created.
-   Such aggressive memory management techniques SHOULD be employed by
-   protocols using ISAKMP that do not go through an initial, anti-
-   clogging only phase, as was done in [Karn].
-
-1.7.2 Connection Hijacking
-
-   ISAKMP prevents connection hijacking by linking the authentication,
-   key exchange and security association exchanges.  This linking
-   prevents an attacker from allowing the authentication to complete and
-   then jumping in and impersonating one entity to the other during the
-   key and security association exchanges.
-
-1.7.3 Man-in-the-Middle Attacks
-
-   Man-in-the-Middle attacks include interception, insertion, deletion,
-   and modification of messages, reflecting messages back at the sender,
-   replaying old messages and redirecting messages.  ISAKMP features
-   prevent these types of attacks from being successful.  The linking of
-   the ISAKMP exchanges prevents the insertion of messages in the
-   protocol exchange.  The ISAKMP protocol state machine is defined so
-   deleted messages will not cause a partial SA to be created, the state
-   machine will clear all state and return to idle.  The state machine
-   also prevents reflection of a message from causing harm.  The
-   requirement for a new cookie with time variant material for each new
-   SA establishment prevents attacks that involve replaying old
-   messages.  The ISAKMP strong authentication requirement prevents an
-   SA from being established with anyone other than the intended party.
-   Messages may be redirected to a different destination or modified but
-   this will be detected and an SA will not be established.  The ISAKMP
-   specification defines where abnormal processing has occurred and
-   recommends notifying the appropriate party of this abnormality.
-
-1.8 Multicast Communications
-
-   It is expected that multicast communications will require the same
-   security services as unicast communications and may introduce the
-   need for additional security services.  The issues of distributing
-   SPIs for multicast traffic are presented in [SEC-ARCH].  Multicast
-   security issues are also discussed in [RFC-1949] and [BC].  A future
-   extension to ISAKMP will support multicast key distribution.  For an
-   introduction to the issues related to multicast security, consult the
-   Internet Drafts, [RFC-2094] and [RFC-2093], describing Sparta's
-   research in this area.
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 13]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-2 Terminology and Concepts
-
-2.1 ISAKMP Terminology
-
-   Security Protocol: A Security Protocol consists of an entity at a
-   single point in the network stack, performing a security service for
-   network communication.  For example, IPSEC ESP and IPSEC AH are two
-   different security protocols.  TLS is another example.  Security
-   Protocols may perform more than one service, for example providing
-   integrity and confidentiality in one module.
-
-   Protection Suite: A protection suite is a list of the security
-   services that must be applied by various security protocols.  For
-   example, a protection suite may consist of DES encryption in IP ESP,
-   and keyed MD5 in IP AH. All of the protections in a suite must be
-   treated as a single unit.  This is necessary because security
-   services in different security protocols can have subtle
-   interactions, and the effects of a suite must be analyzed and
-   verified as a whole.
-
-   Security Association (SA): A Security Association is a security-
-   protocol- specific set of parameters that completely defines the
-   services and mechanisms necessary to protect traffic at that security
-   protocol location.  These parameters can include algorithm
-   identifiers, modes, cryptographic keys, etc.  The SA is referred to
-   by its associated security protocol (for example, "ISAKMP SA", "ESP
-   SA", "TLS SA").
-
-   ISAKMP SA: An SA used by the ISAKMP servers to protect their own
-   traffic.  Sections 2.3 and 2.4 provide more details about ISAKMP SAs.
-
-   Security Parameter Index (SPI): An identifier for a Security
-   Assocation, relative to some security protocol.  Each security
-   protocol has its own "SPI-space".  A (security protocol, SPI) pair
-   may uniquely identify an SA. The uniqueness of the SPI is
-   implementation dependent, but could be based per system, per
-   protocol, or other options.  Depending on the DOI, additional
-   information (e.g.  host address) may be necessary to identify an SA.
-   The DOI will also determine which SPIs (i.e.  initiator's or
-   responder's) are sent during communication.
-
-   Domain of Interpretation: A Domain of Interpretation (DOI) defines
-   payload formats, exchange types, and conventions for naming
-   security-relevant information such as security policies or
-   cryptographic algorithms and modes.  A Domain of Interpretation (DOI)
-   identifier is used to interpret the payloads of ISAKMP payloads.  A
-   system SHOULD support multiple Domains of Interpretation
-   simultaneously.  The concept of a DOI is based on previous work by
-
-
-
-Maughan, et. al.            Standards Track                    [Page 14]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   the TSIG CIPSO Working Group, but extends beyond security label
-   interpretation to include naming and interpretation of security
-   services.  A DOI defines:
-
-    o  A "situation":  the set of information that will be used to
-       determine the required security services.
-
-    o  The set of security policies that must, and may, be supported.
-
-    o  A syntax for the specification of proposed security services.
-
-    o  A scheme for naming security-relevant information, including
-       encryption algorithms, key exchange algorithms, security policy
-       attributes, and certificate authorities.
-
-    o  The specific formats of the various payload contents.
-
-    o  Additional exchange types, if required.
-
-   The rules for the IETF IP Security DOI are presented in [IPDOI].
-   Specifications of the rules for customized DOIs will be presented in
-   separate documents.
-
-   Situation: A situation contains all of the security-relevant
-   information that a system considers necessary to decide the security
-   services required to protect the session being negotiated.  The
-   situation may include addresses, security classifications, modes of
-   operation (normal vs.  emergency), etc.
-
-   Proposal: A proposal is a list, in decreasing order of preference, of
-   the protection suites that a system considers acceptable to protect
-   traffic under a given situation.
-
-   Payload: ISAKMP defines several types of payloads, which are used to
-   transfer information such as security association data, or key
-   exchange data, in DOI-defined formats.  A payload consists of a
-   generic payload header and a string of octects that is opaque to
-   ISAKMP. ISAKMP uses DOI- specific functionality to synthesize and
-   interpret these payloads.  Multiple payloads can be sent in a single
-   ISAKMP message.  See section 3 for more details on the payload types,
-   and [IPDOI] for the formats of the IETF IP Security DOI payloads.
-
-   Exchange Type: An exchange type is a specification of the number of
-   messages in an ISAKMP exchange, and the payload types that are
-   contained in each of those messages.  Each exchange type is designed
-   to provide a particular set of security services, such as anonymity
-   of the participants, perfect forward secrecy of the keying material,
-   authentication of the participants, etc.  Section 4.1 defines the
-
-
-
-Maughan, et. al.            Standards Track                    [Page 15]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   default set of ISAKMP exchange types.  Other exchange types can be
-   added to support additional key exchanges, if required.
-
-2.2 ISAKMP Placement
-
-   Figure 1 is a high level view of the placement of ISAKMP within a
-   system context in a network architecture.  An important part of
-   negotiating security services is to consider the entire "stack" of
-   individual SAs as a unit.  This is referred to as a "protection
-   suite".
-
-     +------------+        +--------+                +--------------+
-     !     DOI    !        !        !                !  Application !
-     ! Definition ! <----> ! ISAKMP !                !    Process   !
-     +------------+    --> !        !                !--------------!
-    +--------------+   !   +--------+                ! Appl Protocol!
-    ! Key Exchange !   !     ^  ^                    +--------------+
-    !  Definition  !<--      !  !                           ^
-    +--------------+         !  !                           !
-                             !  !                           !
-            !----------------!  !                           !
-            v                   !                           !
-        +-------+               v                           v
-        !  API  !        +---------------------------------------------+
-        +-------+        !                Socket Layer                 !
-            !            !---------------------------------------------!
-            v            !        Transport Protocol (TCP / UDP)       !
-     +----------+        !---------------------------------------------!
-     ! Security ! <----> !                     IP                      !
-     ! Protocol !        !---------------------------------------------!
-     +----------+        !             Link Layer Protocol             !
-                         +---------------------------------------------+
-
-
-                     Figure 1:  ISAKMP Relationships
-
-2.3 Negotiation Phases
-
-   ISAKMP offers two "phases" of negotiation.  In the first phase, two
-   entities (e.g.  ISAKMP servers) agree on how to protect further
-   negotiation traffic between themselves, establishing an ISAKMP SA.
-   This ISAKMP SA is then used to protect the negotiations for the
-   Protocol SA being requested.  Two entities (e.g.  ISAKMP servers) can
-   negotiate (and have active) multiple ISAKMP SAs.
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 16]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   The second phase of negotiation is used to establish security
-   associations for other security protocols.  This second phase can be
-   used to establish many security associations.  The security
-   associations established by ISAKMP during this phase can be used by a
-   security protocol to protect many message/data exchanges.
-
-   While the two-phased approach has a higher start-up cost for most
-   simple scenarios, there are several reasons that it is beneficial for
-   most cases.
-
-   First, entities (e.g.  ISAKMP servers) can amortize the cost of the
-   first phase across several second phase negotiations.  This allows
-   multiple SAs to be established between peers over time without having
-   to start over for each communication.
-
-   Second, security services negotiated during the first phase provide
-   security properties for the second phase.  For example, after the
-   first phase of negotiation, the encryption provided by the ISAKMP SA
-   can provide identity protection, potentially allowing the use of
-   simpler second-phase exchanges.  On the other hand, if the channel
-   established during the first phase is not adequate to protect
-   identities, then the second phase must negotiate adequate security
-   mechanisms.
-
-   Third, having an ISAKMP SA in place considerably reduces the cost of
-   ISAKMP management activity - without the "trusted path" that an
-   ISAKMP SA gives you, the entities (e.g.  ISAKMP servers) would have
-   to go through a complete re-authentication for each error
-   notification or deletion of an SA.
-
-   Negotiation during each phase is accomplished using ISAKMP-defined
-   exchanges (see section 4) or exchanges defined for a key exchange
-   within a DOI.
-
-   Note that security services may be applied differently in each
-   negotiation phase.  For example, different parties are being
-   authenticated during each of the phases of negotiation.  During the
-   first phase, the parties being authenticated may be the ISAKMP
-   servers/hosts, while during the second phase, users or application
-   level programs are being authenticated.
-
-2.4 Identifying Security Associations
-
-   While bootstrapping secure channels between systems, ISAKMP cannot
-   assume the existence of security services, and must provide some
-   protections for itself.  Therefore, ISAKMP considers an ISAKMP
-   Security Association to be different than other types, and manages
-   ISAKMP SAs itself, in their own name space.  ISAKMP uses the two
-
-
-
-Maughan, et. al.            Standards Track                    [Page 17]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   cookie fields in the ISAKMP header to identify ISAKMP SAs.  The
-   Message ID in the ISAKMP Header and the SPI field in the Proposal
-   payload are used during SA establishment to identify the SA for other
-   security protocols.  The interpretation of these four fields is
-   dependent on the operation taking place.
-
-   The following table shows the presence or absence of several fields
-   during SA establishment.  The following fields are necessary for
-   various operations associated with SA establishment: cookies in the
-   ISAKMP header, the ISAKMP Header Message ID field, and the SPI field
-   in the Proposal payload.  An 'X' in the column means the value MUST
-   be present.  An 'NA' in the column means a value in the column is Not
-   Applicable to the operation.
-
-  #             Operation            I-Cookie  R-Cookie  Message ID  SPI
- (1)  Start ISAKMP SA negotiation    X         0         0           0
- (2)  Respond ISAKMP SA negotiation  X         X         0           0
- (3)  Init other SA negotiation      X         X         X           X
- (4)  Respond other SA negotiation   X         X         X           X
- (5)  Other (KE, ID, etc.)           X         X         X/0         NA
- (6)  Security Protocol (ESP, AH)    NA        NA        NA          X
-
-   In the first line (1) of the table, the initiator includes the
-   Initiator Cookie field in the ISAKMP Header, using the procedures
-   outlined in sections 2.5.3 and 3.1.
-
-   In the second line (2) of the table, the responder includes the
-   Initiator and Responder Cookie fields in the ISAKMP Header, using the
-   procedures outlined in sections 2.5.3 and 3.1.  Additional messages
-   may be exchanged between ISAKMP peers, depending on the ISAKMP
-   exchange type used during the phase 1 negotiation.  Once the phase 1
-   exchange is completed, the Initiator and Responder cookies are
-   included in the ISAKMP Header of all subsequent communications
-   between the ISAKMP peers.
-
-   During phase 1 negotiations, the initiator and responder cookies
-   determine the ISAKMP SA. Therefore, the SPI field in the Proposal
-   payload is redundant and MAY be set to 0 or it MAY contain the
-   transmitting entity's cookie.
-
-   In the third line (3) of the table, the initiator associates a
-   Message ID with the Protocols contained in the SA Proposal.  This
-   Message ID and the initiator's SPI(s) to be associated with each
-   protocol in the Proposal are sent to the responder.  The SPI(s) will
-   be used by the security protocols once the phase 2 negotiation is
-   completed.
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 18]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   In the fourth line (4) of the table, the responder includes the same
-   Message ID and the responder's SPI(s) to be associated with each
-   protocol in the accepted Proposal.  This information is returned to
-   the initiator.
-
-   In the fifth line (5) of the table, the initiator and responder use
-   the Message ID field in the ISAKMP Header to keep track of the in-
-   progress protocol negotiation.  This is only applicable for a phase 2
-   exchange and the value MUST be 0 for a phase 1 exchange because the
-   combined cookies identify the ISAKMP SA. The SPI field in the
-   Proposal payload is not applicable because the Proposal payload is
-   only used during the SA negotiation message exchange (steps 3 and 4).
-
-   In the sixth line (6) of the table, the phase 2 negotiation is
-   complete.  The security protocols use the SPI(s) to determine which
-   security services and mechanisms to apply to the communication
-   between them.  The SPI value shown in the sixth line (6) is not the
-   SPI field in the Proposal payload, but the SPI field contained within
-   the security protocol header.
-
-   During the SA establishment, a SPI MUST be generated.  ISAKMP is
-   designed to handle variable sized SPIs.  This is accomplished by
-   using the SPI Size field within the Proposal payload during SA
-   establishment.  Handling of SPIs will be outlined by the DOI
-   specification (e.g.  [IPDOI]).
-
-   When a security association (SA) is initially established, one side
-   assumes the role of initiator and the other the role of responder.
-   Once the SA is established, both the original initiator and responder
-   can initiate a phase 2 negotiation with the peer entity.  Thus,
-   ISAKMP SAs are bidirectional in nature.
-
-   Additionally, ISAKMP allows both initiator and responder to have some
-   control during the negotiation process.  While ISAKMP is designed to
-   allow an SA negotiation that includes multiple proposals, the
-   initiator can maintain some control by only making one proposal in
-   accordance with the initiator's local security policy.  Once the
-   initiator sends a proposal containing more than one proposal (which
-   are sent in decreasing preference order), the initiator relinquishes
-   control to the responder.  Once the responder is controlling the SA
-   establishment, the responder can make its policy take precedence over
-   the initiator within the context of the multiple options offered by
-   the initiator.  This is accomplished by selecting the proposal best
-   suited for the responder's local security policy and returning this
-   selection to the initiator.
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 19]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-2.5 Miscellaneous
-
-2.5.1 Transport Protocol
-
-   ISAKMP can be implemented over any transport protocol or over IP
-   itself.  Implementations MUST include send and receive capability for
-   ISAKMP using the User Datagram Protocol (UDP) on port 500.  UDP Port
-   500 has been assigned to ISAKMP by the Internet Assigned Numbers
-   Authority (IANA). Implementations MAY additionally support ISAKMP
-   over other transport protocols or over IP itself.
-
-2.5.2 RESERVED Fields
-
-   The existence of RESERVED fields within ISAKMP payloads are used
-   strictly to preserve byte alignment.  All RESERVED fields in the
-   ISAKMP protocol MUST be set to zero (0) when a packet is issued.  The
-   receiver SHOULD check the RESERVED fields for a zero (0) value and
-   discard the packet if other values are found.
-
-2.5.3 Anti-Clogging Token ("Cookie") Creation
-
-   The details of cookie generation are implementation dependent, but
-   MUST satisfy these basic requirements (originally stated by Phil Karn
-   in [Karn]):
-
-      1.    The cookie must depend on the specific parties.  This
-            prevents an attacker from obtaining a cookie using a real IP
-            address and UDP port, and then using it to swamp the victim
-            with Diffie-Hellman requests from randomly chosen IP
-            addresses or ports.
-
-      2.    It must not be possible for anyone other than the issuing
-            entity to generate cookies that will be accepted by that
-            entity.  This implies that the issuing entity must use local
-            secret information in the generation and subsequent
-            verification of a cookie.  It must not be possible to deduce
-            this secret information from any particular cookie.
-
-      3.    The cookie generation function must be fast to thwart
-            attacks intended to sabotage CPU resources.
-
-   Karn's suggested method for creating the cookie is to perform a fast
-   hash (e.g.  MD5) over the IP Source and Destination Address, the UDP
-   Source and Destination Ports and a locally generated secret random
-   value.  ISAKMP requires that the cookie be unique for each SA
-   establishment to help prevent replay attacks, therefore, the date and
-   time MUST be added to the information hashed.  The generated cookies
-   are placed in the ISAKMP Header (described in section 3.1) Initiator
-
-
-
-Maughan, et. al.            Standards Track                    [Page 20]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   and Responder cookie fields.  These fields are 8 octets in length,
-   thus, requiring a generated cookie to be 8 octets.  Notify and Delete
-   messages (see sections 3.14, 3.15, and 4.8) are uni-directional
-   transmissions and are done under the protection of an existing ISAKMP
-   SA, thus, not requiring the generation of a new cookie.  One
-   exception to this is the transmission of a Notify message during a
-   Phase 1 exchange, prior to completing the establishment of an SA.
-   Sections 3.14 and 4.8 provide additional details.
-
-3 ISAKMP Payloads
-
-   ISAKMP payloads provide modular building blocks for constructing
-   ISAKMP messages.  The presence and ordering of payloads in ISAKMP is
-   defined by and dependent upon the Exchange Type Field located in the
-   ISAKMP Header (see Figure 2).  The ISAKMP payload types are discussed
-   in sections 3.4 through 3.15.  The descriptions of the ISAKMP
-   payloads, messages, and exchanges (see Section 4) are shown using
-   network octet ordering.
-
-3.1 ISAKMP Header Format
-
-   An ISAKMP message has a fixed header format, shown in Figure 2,
-   followed by a variable number of payloads.  A fixed header simplifies
-   parsing, providing the benefit of protocol parsing software that is
-   less complex and easier to implement.  The fixed header contains the
-   information required by the protocol to maintain state, process
-   payloads and possibly prevent denial of service or replay attacks.
-
-   The ISAKMP Header fields are defined as follows:
-
-    o  Initiator Cookie (8 octets) - Cookie of entity that initiated SA
-       establishment, SA notification, or SA deletion.
-
-    o  Responder Cookie (8 octets) - Cookie of entity that is responding
-       to an SA establishment request, SA notification, or SA deletion.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 21]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-                         1                   2                   3
-     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-    !                          Initiator                            !
-    !                            Cookie                             !
-    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-    !                          Responder                            !
-    !                            Cookie                             !
-    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-    !  Next Payload ! MjVer ! MnVer ! Exchange Type !     Flags     !
-    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-    !                          Message ID                           !
-    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-    !                            Length                             !
-    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-                 Figure 2:  ISAKMP Header Format
-
-    o  Next Payload (1 octet) - Indicates the type of the first payload
-       in the message.  The format for each payload is defined in
-       sections 3.4 through 3.16.  The processing for the payloads is
-       defined in section 5.
-
-
-                        Next Payload Type       Value
-                    NONE                           0
-                    Security Association (SA)      1
-                    Proposal (P)                   2
-                    Transform (T)                  3
-                    Key Exchange (KE)              4
-                    Identification (ID)            5
-                    Certificate (CERT)             6
-                    Certificate Request (CR)       7
-                    Hash (HASH)                    8
-                    Signature (SIG)                9
-                    Nonce (NONCE)                 10
-                    Notification (N)              11
-                    Delete (D)                    12
-                    Vendor ID (VID)               13
-                    RESERVED                   14 - 127
-                    Private USE               128 - 255
-
-    o  Major Version (4 bits) - indicates the major version of the ISAKMP
-       protocol in use.  Implementations based on this version of the
-       ISAKMP Internet-Draft MUST set the Major Version to 1.
-       Implementations based on previous versions of ISAKMP Internet-
-       Drafts MUST set the Major Version to 0.  Implementations SHOULD
-
-
-
-Maughan, et. al.            Standards Track                    [Page 22]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-       never accept packets with a major version number larger than its
-       own.
-
-    o  Minor Version (4 bits) - indicates the minor version of the
-       ISAKMP protocol in use.  Implementations based on this version of
-       the ISAKMP Internet-Draft MUST set the Minor Version to 0.
-       Implementations based on previous versions of ISAKMP Internet-
-       Drafts MUST set the Minor Version to 1.  Implementations SHOULD
-       never accept packets with a minor version number larger than its
-       own, given the major version numbers are identical.
-
-    o  Exchange Type (1 octet) - indicates the type of exchange being
-       used.  This dictates the message and payload orderings in the
-       ISAKMP exchanges.
-
-
-                            Exchange Type      Value
-                         NONE                    0
-                         Base                    1
-                         Identity Protection     2
-                         Authentication Only     3
-                         Aggressive              4
-                         Informational           5
-                         ISAKMP Future Use     6 - 31
-                         DOI Specific Use     32 - 239
-                         Private Use         240 - 255
-
-    o  Flags (1 octet) - indicates specific options that are set for the
-       ISAKMP exchange.  The flags listed below are specified in the
-       Flags field beginning with the least significant bit, i.e the
-       Encryption bit is bit 0 of the Flags field, the Commit bit is bit
-       1 of the Flags field, and the Authentication Only bit is bit 2 of
-       the Flags field.  The remaining bits of the Flags field MUST be
-       set to 0 prior to transmission.
-
-      --  E(ncryption Bit) (1 bit) - If set (1), all payloads following
-          the header are encrypted using the encryption algorithm
-          identified in the ISAKMP SA. The ISAKMP SA Identifier is the
-          combination of the initiator and responder cookie.  It is
-          RECOMMENDED that encryption of communications be done as soon
-          as possible between the peers.  For all ISAKMP exchanges
-          described in section 4.1, the encryption SHOULD begin after
-          both parties have exchanged Key Exchange payloads.  If the
-          E(ncryption Bit) is not set (0), the payloads are not
-          encrypted.
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 23]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-      -- C(ommit Bit) (1 bit) - This bit is used to signal key exchange
-          synchronization.  It is used to ensure that encrypted material
-          is not received prior to completion of the SA establishment.
-          The Commit Bit can be set (at anytime) by either party
-          participating in the SA establishment, and can be used during
-          both phases of an ISAKMP SA establishment.  However, the value
-          MUST be reset after the Phase 1 negotiation.  If set(1), the
-          entity which did not set the Commit Bit MUST wait for an
-          Informational Exchange containing a Notify payload (with the
-          CONNECTED Notify Message) from the entity which set the Commit
-          Bit.  In this instance, the Message ID field of the
-          Informational Exchange MUST contain the Message ID of the
-          original ISAKMP Phase 2 SA negotiation.  This is done to
-          ensure that the Informational Exchange with the CONNECTED
-          Notify Message can be associated with the correct Phase 2 SA.
-          The receipt and processing of the Informational Exchange
-          indicates that the SA establishment was successful and either
-          entity can now proceed with encrypted traffic communication.
-          In addition to synchronizing key exchange, the Commit Bit can
-          be used to protect against loss of transmissions over
-          unreliable networks and guard against the need for multiple
-          re-transmissions.
-
-          NOTE: It is always possible that the final message of an
-          exchange can be lost.  In this case, the entity expecting to
-          receive the final message of an exchange would receive the
-          Phase 2 SA negotiation message following a Phase 1 exchange or
-          encrypted traffic following a Phase 2 exchange.  Handling of
-          this situation is not standardized, but we propose the
-          following possibilities.  If the entity awaiting the
-          Informational Exchange can verify the received message (i.e.
-          Phase 2 SA negotiation message or encrypted traffic), then
-          they MAY consider the SA was established and continue
-          processing.  The other option is to retransmit the last ISAKMP
-          message to force the other entity to retransmit the final
-          message.  This suggests that implementations may consider
-          retaining the last message (locally) until they are sure the
-          SA is established.
-
-      --  A(uthentication Only Bit) (1 bit) - This bit is intended for
-          use with the Informational Exchange with a Notify payload and
-          will allow the transmission of information with integrity
-          checking, but no encryption (e.g.  "emergency mode").  Section
-          4.8 states that a Phase 2 Informational Exchange MUST be sent
-          under the protection of an ISAKMP SA. This is the only
-          exception to that policy.  If the Authentication Only bit is
-          set (1), only authentication security services will be applied
-          to the entire Notify payload of the Informational Exchange and
-
-
-
-Maughan, et. al.            Standards Track                    [Page 24]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-          the payload will not be encrypted.
-
-    o  Message ID (4 octets) - Unique Message Identifier used to
-       identify protocol state during Phase 2 negotiations.  This value
-       is randomly generated by the initiator of the Phase 2
-       negotiation.  In the event of simultaneous SA establishments
-       (i.e.  collisions), the value of this field will likely be
-       different because they are independently generated and, thus, two
-       security associations will progress toward establishment.
-       However, it is unlikely there will be absolute simultaneous
-       establishments.  During Phase 1 negotiations, the value MUST be
-       set to 0.
-
-    o  Length (4 octets) - Length of total message (header + payloads)
-       in octets.  Encryption can expand the size of an ISAKMP message.
-
-3.2 Generic Payload Header
-
-   Each ISAKMP payload defined in sections 3.4 through 3.16 begins with
-   a generic header, shown in Figure 3, which provides a payload
-   "chaining" capability and clearly defines the boundaries of a
-   payload.
-
-                            1                   2                   3
-        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-       ! Next Payload  !   RESERVED    !         Payload Length        !
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                   Figure 3:  Generic Payload Header
-
-   The Generic Payload Header fields are defined as follows:
-
-    o  Next Payload (1 octet) - Identifier for the payload type of the
-       next payload in the message.  If the current payload is the last
-       in the message, then this field will be 0.  This field provides
-       the "chaining" capability.
-
-    o  RESERVED (1 octet) - Unused, set to 0.
-
-    o  Payload Length (2 octets) - Length in octets of the current
-       payload, including the generic payload header.
-
-3.3 Data Attributes
-
-   There are several instances within ISAKMP where it is necessary to
-   represent Data Attributes.  An example of this is the Security
-   Association (SA) Attributes contained in the Transform payload
-
-
-
-Maughan, et. al.            Standards Track                    [Page 25]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   (described in section 3.6).  These Data Attributes are not an ISAKMP
-   payload, but are contained within ISAKMP payloads.  The format of the
-   Data Attributes provides the flexibility for representation of many
-   different types of information.  There can be multiple Data
-   Attributes within a payload.  The length of the Data Attributes will
-   either be 4 octets or defined by the Attribute Length field.  This is
-   done using the Attribute Format bit described below.  Specific
-   information about the attributes for each domain will be described in
-   a DOI document, e.g.  IPSEC DOI [IPDOI].
-
-                          1                   2                   3
-      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !A!       Attribute Type        !    AF=0  Attribute Length     !
-     !F!                             !    AF=1  Attribute Value      !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     .                   AF=0  Attribute Value                       .
-     .                   AF=1  Not Transmitted                       .
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-                     Figure 4:  Data Attributes
-
-   The Data Attributes fields are defined as follows:
-
-    o  Attribute Type (2 octets) - Unique identifier for each type of
-       attribute.  These attributes are defined as part of the DOI-
-       specific information.
-
-       The most significant bit, or Attribute Format (AF), indicates
-       whether the data attributes follow the Type/Length/Value (TLV)
-       format or a shortened Type/Value (TV) format.  If the AF bit is a
-       zero (0), then the Data Attributes are of the Type/Length/Value
-       (TLV) form.  If the AF bit is a one (1), then the Data Attributes
-       are of the Type/Value form.
-
-    o  Attribute Length (2 octets) - Length in octets of the Attribute
-       Value.  When the AF bit is a one (1), the Attribute Value is only
-       2 octets and the Attribute Length field is not present.
-
-    o  Attribute Value (variable length) - Value of the attribute
-       associated with the DOI-specific Attribute Type.  If the AF bit
-       is a zero (0), this field has a variable length defined by the
-       Attribute Length field.  If the AF bit is a one (1), the
-       Attribute Value has a length of 2 octets.
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 26]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-3.4 Security Association Payload
-
-   The Security Association Payload is used to negotiate security
-   attributes and to indicate the Domain of Interpretation (DOI) and
-   Situation under which the negotiation is taking place.  Figure 5
-   shows the format of the Security Association payload.
-
-                          1                   2                   3
-      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     ! Next Payload  !   RESERVED    !         Payload Length        !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !              Domain of Interpretation  (DOI)                  !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !                                                               !
-     ~                           Situation                           ~
-     !                                                               !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-              Figure 5:  Security Association Payload
-
-    o  Next Payload (1 octet) - Identifier for the payload type of the
-       next payload in the message.  If the current payload is the last
-       in the message, then this field will be 0.  This field MUST NOT
-       contain the values for the Proposal or Transform payloads as they
-       are considered part of the security association negotiation.  For
-       example, this field would contain the value "10" (Nonce payload)
-       in the first message of a Base Exchange (see Section 4.4) and the
-       value "0" in the first message of an Identity Protect Exchange
-       (see Section 4.5).
-
-    o  RESERVED (1 octet) - Unused, set to 0.
-
-    o  Payload Length (2 octets) - Length in octets of the entire
-       Security Association payload, including the SA payload, all
-       Proposal payloads, and all Transform payloads associated with the
-       proposed Security Association.
-
-    o  Domain of Interpretation (4 octets) - Identifies the DOI (as
-       described in Section 2.1) under which this negotiation is taking
-       place.  The DOI is a 32-bit unsigned integer.  A DOI value of 0
-       during a Phase 1 exchange specifies a Generic ISAKMP SA which can
-       be used for any protocol during the Phase 2 exchange.  The
-       necessary SA Attributes are defined in A.4.  A DOI value of 1 is
-       assigned to the IPsec DOI [IPDOI].  All other DOI values are
-       reserved to IANA for future use.  IANA will not normally assign a
-       DOI value without referencing some public specification, such as
-
-
-
-Maughan, et. al.            Standards Track                    [Page 27]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-       an Internet RFC. Other DOI's can be defined using the description
-       in appendix B.  This field MUST be present within the Security
-       Association payload.
-
-    o  Situation (variable length) - A DOI-specific field that
-       identifies the situation under which this negotiation is taking
-       place.  The Situation is used to make policy decisions regarding
-       the security attributes being negotiated.  Specifics for the IETF
-       IP Security DOI Situation are detailed in [IPDOI].  This field
-       MUST be present within the Security Association payload.
-
-3.5 Proposal Payload
-
-   The Proposal Payload contains information used during Security
-   Association negotiation.  The proposal consists of security
-   mechanisms, or transforms, to be used to secure the communications
-   channel.  Figure 6 shows the format of the Proposal Payload.  A
-   description of its use can be found in section 4.2.
-
-                          1                   2                   3
-      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     ! Next Payload  !   RESERVED    !         Payload Length        !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !  Proposal #   !  Protocol-Id  !    SPI Size   !# of Transforms!
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !                        SPI (variable)                         !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-                 Figure 6:  Proposal Payload Format
-
-   The Proposal Payload fields are defined as follows:
-
-    o  Next Payload (1 octet) - Identifier for the payload type of the
-       next payload in the message.  This field MUST only contain the
-       value "2" or "0".  If there are additional Proposal payloads in
-       the message, then this field will be 2.  If the current Proposal
-       payload is the last within the security association proposal,
-       then this field will be 0.
-
-    o  RESERVED (1 octet) - Unused, set to 0.
-
-    o  Payload Length (2 octets) - Length in octets of the entire
-       Proposal payload, including generic payload header, the Proposal
-       payload, and all Transform payloads associated with this
-       proposal.  In the event there are multiple proposals with the
-       same proposal number (see section 4.2), the Payload Length field
-
-
-
-Maughan, et. al.            Standards Track                    [Page 28]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-       only applies to the current Proposal payload and not to all
-       Proposal payloads.
-
-    o  Proposal # (1 octet) - Identifies the Proposal number for the
-       current payload.  A description of the use of this field is found
-       in section 4.2.
-
-    o  Protocol-Id (1 octet) - Specifies the protocol identifier for the
-       current negotiation.  Examples might include IPSEC ESP, IPSEC AH,
-       OSPF, TLS, etc.
-
-    o  SPI Size (1 octet) - Length in octets of the SPI as defined by
-       the Protocol-Id.  In the case of ISAKMP, the Initiator and
-       Responder cookie pair from the ISAKMP Header is the ISAKMP SPI,
-       therefore, the SPI Size is irrelevant and MAY be from zero (0) to
-       sixteen (16).  If the SPI Size is non-zero, the content of the
-       SPI field MUST be ignored.  If the SPI Size is not a multiple of
-       4 octets it will have some impact on the SPI field and the
-       alignment of all payloads in the message.  The Domain of
-       Interpretation (DOI) will dictate the SPI Size for other
-       protocols.
-
-    o  # of Transforms (1 octet) - Specifies the number of transforms
-       for the Proposal.  Each of these is contained in a Transform
-       payload.
-
-    o  SPI (variable) - The sending entity's SPI. In the event the SPI
-       Size is not a multiple of 4 octets, there is no padding applied
-       to the payload, however, it can be applied at the end of the
-       message.
-
-   The payload type for the Proposal Payload is two (2).
-
-3.6 Transform Payload
-
-   The Transform Payload contains information used during Security
-   Association negotiation.  The Transform payload consists of a
-   specific security mechanism, or transforms, to be used to secure the
-   communications channel.  The Transform payload also contains the
-   security association attributes associated with the specific
-   transform.  These SA attributes are DOI-specific.  Figure 7 shows the
-   format of the Transform Payload.  A description of its use can be
-   found in section 4.2.
-
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 29]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-                          1                   2                   3
-      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     ! Next Payload  !   RESERVED    !         Payload Length        !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !  Transform #  !  Transform-Id !           RESERVED2           !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !                                                               !
-     ~                        SA Attributes                          ~
-     !                                                               !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-                Figure 7:  Transform Payload Format
-
-   The Transform Payload fields are defined as follows:
-
-    o  Next Payload (1 octet) - Identifier for the payload type of the
-       next payload in the message.  This field MUST only contain the
-       value "3" or "0".  If there are additional Transform payloads in
-       the proposal, then this field will be 3.  If the current
-       Transform payload is the last within the proposal, then this
-       field will be 0.
-
-    o  RESERVED (1 octet) - Unused, set to 0.
-
-    o  Payload Length (2 octets) - Length in octets of the current
-       payload, including the generic payload header, Transform values,
-       and all SA Attributes.
-
-    o  Transform # (1 octet) - Identifies the Transform number for the
-       current payload.  If there is more than one transform proposed
-       for a specific protocol within the Proposal payload, then each
-       Transform payload has a unique Transform number.  A description
-       of the use of this field is found in section 4.2.
-
-    o  Transform-Id (1 octet) - Specifies the Transform identifier for
-       the protocol within the current proposal.  These transforms are
-       defined by the DOI and are dependent on the protocol being
-       negotiated.
-
-    o  RESERVED2 (2 octets) - Unused, set to 0.
-
-    o  SA Attributes (variable length) - This field contains the
-       security association attributes as defined for the transform
-       given in the Transform-Id field.  The SA Attributes SHOULD be
-       represented using the Data Attributes format described in section
-       3.3.  If the SA Attributes are not aligned on 4-byte boundaries,
-
-
-
-Maughan, et. al.            Standards Track                    [Page 30]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-       then subsequent payloads will not be aligned and any padding will
-       be added at the end of the message to make the message 4-octet
-       aligned.
-
-   The payload type for the Transform Payload is three (3).
-
-3.7 Key Exchange Payload
-
-   The Key Exchange Payload supports a variety of key exchange
-   techniques.  Example key exchanges are Oakley [Oakley], Diffie-
-   Hellman, the enhanced Diffie-Hellman key exchange described in X9.42
-   [ANSI], and the RSA-based key exchange used by PGP. Figure 8 shows
-   the format of the Key Exchange payload.
-
-   The Key Exchange Payload fields are defined as follows:
-
-    o  Next Payload (1 octet) - Identifier for the payload type of the
-       nextpayload in the message.  If the current payload is the last
-       in the message, then this field will be 0.
-
-                          1                   2                   3
-      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     ! Next Payload  !   RESERVED    !         Payload Length        !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !                                                               !
-     ~                       Key Exchange Data                       ~
-     !                                                               !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-               Figure 8:  Key Exchange Payload Format
-
-    o  RESERVED (1 octet) - Unused, set to 0.
-
-    o  Payload Length (2 octets) - Length in octets of the current
-       payload, including the generic payload header.
-
-    o  Key Exchange Data (variable length) - Data required to generate a
-       session key.  The interpretation of this data is specified by the
-       DOI and the associated Key Exchange algorithm.  This field may
-       also contain pre-placed key indicators.
-
-   The payload type for the Key Exchange Payload is four (4).
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 31]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-3.8 Identification Payload
-
-   The Identification Payload contains DOI-specific data used to
-   exchange identification information.  This information is used for
-   determining the identities of communicating peers and may be used for
-   determining authenticity of information.  Figure 9 shows the format
-   of the Identification Payload.
-
-   The Identification Payload fields are defined as follows:
-
-    o  Next Payload (1 octet) - Identifier for the payload type of the
-       next payload in the message.  If the current payload is the last
-       in the message, then this field will be 0.
-
-    o  RESERVED (1 octet) - Unused, set to 0.
-
-    o  Payload Length (2 octets) - Length in octets of the current
-       payload, including the generic payload header.
-
-    o  ID Type (1 octet) - Specifies the type of Identification being
-       used.
-
-                          1                   2                   3
-      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     ! Next Payload  !   RESERVED    !         Payload Length        !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !   ID Type     !             DOI Specific ID Data              !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !                                                               !
-     ~                   Identification Data                         ~
-     !                                                               !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-              Figure 9:  Identification Payload Format
-
-       This field is DOI-dependent.
-
-    o  DOI Specific ID Data (3 octets) - Contains DOI specific
-       Identification data.  If unused, then this field MUST be set to
-       0.
-
-    o  Identification Data (variable length) - Contains identity
-       information.  The values for this field are DOI-specific and the
-       format is specified by the ID Type field.  Specific details for
-       the IETF IP Security DOI Identification Data are detailed in
-       [IPDOI].
-
-
-
-Maughan, et. al.            Standards Track                    [Page 32]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   The payload type for the Identification Payload is five (5).
-
-3.9 Certificate Payload
-
-   The Certificate Payload provides a means to transport certificates or
-   other certificate-related information via ISAKMP and can appear in
-   any ISAKMP message.  Certificate payloads SHOULD be included in an
-   exchange whenever an appropriate directory service (e.g.  Secure DNS
-   [DNSSEC]) is not available to distribute certificates.  The
-   Certificate payload MUST be accepted at any point during an exchange.
-   Figure 10 shows the format of the Certificate Payload.
-
-   NOTE: Certificate types and formats are not generally bound to a DOI
-   - it is expected that there will only be a few certificate types, and
-   that most DOIs will accept all of these types.
-
-   The Certificate Payload fields are defined as follows:
-
-    o  Next Payload (1 octet) - Identifier for the payload type of the
-       next payload in the message.  If the current payload is the last
-       in the message, then this field will be 0.
-
-                          1                   2                   3
-      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     ! Next Payload  !   RESERVED    !         Payload Length        !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     ! Cert Encoding !                                               !
-     +-+-+-+-+-+-+-+-+                                               !
-     ~                       Certificate Data                        ~
-     !                                                               !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-               Figure 10:  Certificate Payload Format
-
-    o  RESERVED (1 octet) - Unused, set to 0.
-
-    o  Payload Length (2 octets) - Length in octets of the current
-       payload, including the generic payload header.
-
-    o  Certificate Encoding (1 octet) - This field indicates the type of
-       certificate or certificate-related information contained in the
-       Certificate Data field.
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 33]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-                          Certificate Type            Value
-                  NONE                                   0
-                  PKCS #7 wrapped X.509 certificate      1
-                  PGP Certificate                        2
-                  DNS Signed Key                         3
-                  X.509 Certificate - Signature          4
-                  X.509 Certificate - Key Exchange       5
-                  Kerberos Tokens                        6
-                  Certificate Revocation List (CRL)      7
-                  Authority Revocation List (ARL)        8
-                  SPKI Certificate                       9
-                  X.509 Certificate - Attribute         10
-                  RESERVED                           11 - 255
-
-    o  Certificate Data (variable length) - Actual encoding of
-       certificate data.  The type of certificate is indicated by the
-       Certificate Encoding field.
-
-   The payload type for the Certificate Payload is six (6).
-
-3.10 Certificate Request Payload
-
-   The Certificate Request Payload provides a means to request
-   certificates via ISAKMP and can appear in any message.  Certificate
-   Request payloads SHOULD be included in an exchange whenever an
-   appropriate directory service (e.g.  Secure DNS [DNSSEC]) is not
-   available to distribute certificates.  The Certificate Request
-   payload MUST be accepted at any point during the exchange.  The
-   responder to the Certificate Request payload MUST send its
-   certificate, if certificates are supported, based on the values
-   contained in the payload.  If multiple certificates are required,
-   then multiple Certificate Request payloads SHOULD be transmitted.
-   Figure 11 shows the format of the Certificate Request Payload.
-
-                          1                   2                   3
-      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     ! Next Payload  !   RESERVED    !         Payload Length        !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !  Cert. Type   !                                               !
-     +-+-+-+-+-+-+-+-+                                               !
-     ~                    Certificate Authority                      ~
-     !                                                               !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-           Figure 11:  Certificate Request Payload Format
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 34]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   The Certificate Payload fields are defined as follows:
-
-    o  Next Payload (1 octet) - Identifier for the payload type of the
-       next payload in the message.  If the current payload is the last
-       in the message, then this field will be 0.
-
-    o  RESERVED (1 octet) - Unused, set to 0.
-
-    o  Payload Length (2 octets) - Length in octets of the current
-       payload, including the generic payload header.
-
-    o  Certificate Type (1 octet) - Contains an encoding of the type of
-       certificate requested.  Acceptable values are listed in section
-       3.9.
-
-    o  Certificate Authority (variable length) - Contains an encoding of
-       an acceptable certificate authority for the type of certificate
-       requested.  As an example, for an X.509 certificate this field
-       would contain the Distinguished Name encoding of the Issuer Name
-       of an X.509 certificate authority acceptable to the sender of
-       this payload.  This would be included to assist the responder in
-       determining how much of the certificate chain would need to be
-       sent in response to this request.  If there is no specific
-       certificate authority requested, this field SHOULD not be
-       included.
-
-   The payload type for the Certificate Request Payload is seven (7).
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 35]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-3.11 Hash Payload
-
-   The Hash Payload contains data generated by the hash function
-   (selected during the SA establishment exchange), over some part of
-   the message and/or ISAKMP state.  This payload may be used to verify
-   the integrity of the data in an ISAKMP message or for authentication
-   of the negotiating entities.  Figure 12 shows the format of the Hash
-   Payload.
-
-                          1                   2                   3
-      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     ! Next Payload  !   RESERVED    !         Payload Length        !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !                                                               !
-     ~                           Hash Data                           ~
-     !                                                               !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-                  Figure 12:  Hash Payload Format
-
-   The Hash Payload fields are defined as follows:
-
-    o  Next Payload (1 octet) - Identifier for the payload type of the
-       next payload in the message.  If the current payload is the last
-       in the message, then this field will be 0.
-
-    o  RESERVED (1 octet) - Unused, set to 0.
-
-    o  Payload Length (2 octets) - Length in octets of the current
-       payload, including the generic payload header.
-
-    o  Hash Data (variable length) - Data that results from applying the
-       hash routine to the ISAKMP message and/or state.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 36]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-3.12 Signature Payload
-
-   The Signature Payload contains data generated by the digital
-   signature function (selected during the SA establishment exchange),
-   over some part of the message and/or ISAKMP state.  This payload is
-   used to verify the integrity of the data in the ISAKMP message, and
-   may be of use for non-repudiation services.  Figure 13 shows the
-   format of the Signature Payload.
-
-                          1                   2                   3
-      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     ! Next Payload  !   RESERVED    !         Payload Length        !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !                                                               !
-     ~                         Signature Data                        ~
-     !                                                               !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-                Figure 13:  Signature Payload Format
-
-   The Signature Payload fields are defined as follows:
-
-    o  Next Payload (1 octet) - Identifier for the payload type of the
-       next payload in the message.  If the current payload is the last
-       in the message, then this field will be 0.
-
-    o  RESERVED (1 octet) - Unused, set to 0.
-
-    o  Payload Length (2 octets) - Length in octets of the current
-       payload, including the generic payload header.
-
-    o  Signature Data (variable length) - Data that results from
-       applying the digital signature function to the ISAKMP message
-       and/or state.
-
-   The payload type for the Signature Payload is nine (9).
-
-3.13 Nonce Payload
-
-   The Nonce Payload contains random data used to guarantee liveness
-   during an exchange and protect against replay attacks.  Figure 14
-   shows the format of the Nonce Payload.  If nonces are used by a
-   particular key exchange, the use of the Nonce payload will be
-   dictated by the key exchange.  The nonces may be transmitted as part
-   of the key exchange data, or as a separate payload.  However, this is
-   defined by the key exchange, not by ISAKMP.
-
-
-
-Maughan, et. al.            Standards Track                    [Page 37]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-                          1                   2                   3
-      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     ! Next Payload  !   RESERVED    !         Payload Length        !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !                                                               !
-     ~                            Nonce Data                         ~
-     !                                                               !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-                  Figure 14:  Nonce Payload Format
-
-   The Nonce Payload fields are defined as follows:
-
-    o  Next Payload (1 octet) - Identifier for the payload type of the
-       next payload in the message.  If the current payload is the last
-       in the message, then this field will be 0.
-
-    o  RESERVED (1 octet) - Unused, set to 0.
-
-    o  Payload Length (2 octets) - Length in octets of the current
-       payload, including the generic payload header.
-
-    o  Nonce Data (variable length) - Contains the random data generated
-       by the transmitting entity.
-
-   The payload type for the Nonce Payload is ten (10).
-
-3.14 Notification Payload
-
-   The Notification Payload can contain both ISAKMP and DOI-specific
-   data and is used to transmit informational data, such as error
-   conditions, to an ISAKMP peer.  It is possible to send multiple
-   Notification payloads in a single ISAKMP message.  Figure 15 shows
-   the format of the Notification Payload.
-
-   Notification which occurs during, or is concerned with, a Phase 1
-   negotiation is identified by the Initiator and Responder cookie pair
-   in the ISAKMP Header.  The Protocol Identifier, in this case, is
-   ISAKMP and the SPI value is 0 because the cookie pair in the ISAKMP
-   Header identifies the ISAKMP SA. If the notification takes place
-   prior to the completed exchange of keying information, then the
-   notification will be unprotected.
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 38]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   Notification which occurs during, or is concerned with, a Phase 2
-   negotiation is identified by the Initiator and Responder cookie pair
-   in the ISAKMP Header and the Message ID and SPI associated with the
-   current negotiation.  One example for this type of notification is to
-   indicate why a proposal was rejected.
-
-                          1                   2                   3
-      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     ! Next Payload  !   RESERVED    !         Payload Length        !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !              Domain of Interpretation  (DOI)                  !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !  Protocol-ID  !   SPI Size    !      Notify Message Type      !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !                                                               !
-     ~                Security Parameter Index (SPI)                 ~
-     !                                                               !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !                                                               !
-     ~                       Notification Data                       ~
-     !                                                               !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-              Figure 15:  Notification Payload Format
-
-   The Notification Payload fields are defined as follows:
-
-    o  Next Payload (1 octet) - Identifier for the payload type of the
-       next payload in the message.  If the current payload is the last
-       in the message, then this field will be 0.
-
-    o  RESERVED (1 octet) - Unused, set to 0.
-
-    o  Payload Length (2 octets) - Length in octets of the current
-       payload, including the generic payload header.
-
-    o  Domain of Interpretation (4 octets) - Identifies the DOI (as
-       described in Section 2.1) under which this notification is taking
-       place.  For ISAKMP this value is zero (0) and for the IPSEC DOI
-       it is one (1).  Other DOI's can be defined using the description
-       in appendix B.
-
-    o  Protocol-Id (1 octet) - Specifies the protocol identifier for the
-       current notification.  Examples might include ISAKMP, IPSEC ESP,
-       IPSEC AH, OSPF, TLS, etc.
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 39]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-    o  SPI Size (1 octet) - Length in octets of the SPI as defined by
-       the Protocol-Id.  In the case of ISAKMP, the Initiator and
-       Responder cookie pair from the ISAKMP Header is the ISAKMP SPI,
-       therefore, the SPI Size is irrelevant and MAY be from zero (0) to
-       sixteen (16).  If the SPI Size is non-zero, the content of the
-       SPI field MUST be ignored.  The Domain of Interpretation (DOI)
-       will dictate the SPI Size for other protocols.
-
-    o  Notify Message Type (2 octets) - Specifies the type of
-       notification message (see section 3.14.1).  Additional text, if
-       specified by the DOI, is placed in the Notification Data field.
-
-    o  SPI (variable length) - Security Parameter Index.  The receiving
-       entity's SPI. The use of the SPI field is described in section
-       2.4.  The length of this field is determined by the SPI Size
-       field and is not necessarily aligned to a 4 octet boundary.
-
-    o  Notification Data (variable length) - Informational or error data
-       transmitted in addition to the Notify Message Type.  Values for
-       this field are DOI-specific.
-
-   The payload type for the Notification Payload is eleven (11).
-
-3.14.1 Notify Message Types
-
-   Notification information can be error messages specifying why an SA
-   could not be established.  It can also be status data that a process
-   managing an SA database wishes to communicate with a peer process.
-   For example, a secure front end or security gateway may use the
-   Notify message to synchronize SA communication.  The table below
-   lists the Nofitication messages and their corresponding values.
-   Values in the Private Use range are expected to be DOI-specific
-   values.
-
-                      NOTIFY MESSAGES - ERROR TYPES
-
-                           Errors               Value
-                 INVALID-PAYLOAD-TYPE             1
-                 DOI-NOT-SUPPORTED                2
-                 SITUATION-NOT-SUPPORTED          3
-                 INVALID-COOKIE                   4
-                 INVALID-MAJOR-VERSION            5
-                 INVALID-MINOR-VERSION            6
-                 INVALID-EXCHANGE-TYPE            7
-                 INVALID-FLAGS                    8
-                 INVALID-MESSAGE-ID               9
-                 INVALID-PROTOCOL-ID             10
-                 INVALID-SPI                     11
-
-
-
-Maughan, et. al.            Standards Track                    [Page 40]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-                 INVALID-TRANSFORM-ID            12
-                 ATTRIBUTES-NOT-SUPPORTED        13
-                 NO-PROPOSAL-CHOSEN              14
-                 BAD-PROPOSAL-SYNTAX             15
-                 PAYLOAD-MALFORMED               16
-                 INVALID-KEY-INFORMATION         17
-                 INVALID-ID-INFORMATION          18
-                 INVALID-CERT-ENCODING           19
-                 INVALID-CERTIFICATE             20
-                 CERT-TYPE-UNSUPPORTED           21
-                 INVALID-CERT-AUTHORITY          22
-                 INVALID-HASH-INFORMATION        23
-                 AUTHENTICATION-FAILED           24
-                 INVALID-SIGNATURE               25
-                 ADDRESS-NOTIFICATION            26
-                 NOTIFY-SA-LIFETIME              27
-                 CERTIFICATE-UNAVAILABLE         28
-                 UNSUPPORTED-EXCHANGE-TYPE       29
-                 UNEQUAL-PAYLOAD-LENGTHS         30
-                 RESERVED (Future Use)        31 - 8191
-                 Private Use                8192 - 16383
-
-
-
-                      NOTIFY MESSAGES - STATUS TYPES
-                          Status              Value
-                  CONNECTED                   16384
-                  RESERVED (Future Use)   16385 - 24575
-                  DOI-specific codes     24576 - 32767
-                  Private Use            32768 - 40959
-                  RESERVED (Future Use)  40960 - 65535
-
-3.15 Delete Payload
-
-   The Delete Payload contains a protocol-specific security association
-   identifier that the sender has removed from its security association
-   database and is, therefore, no longer valid.  Figure 16 shows the
-   format of the Delete Payload.  It is possible to send multiple SPIs
-   in a Delete payload, however, each SPI MUST be for the same protocol.
-   Mixing of Protocol Identifiers MUST NOT be performed with the Delete
-   payload.
-
-   Deletion which is concerned with an ISAKMP SA will contain a
-   Protocol-Id of ISAKMP and the SPIs are the initiator and responder
-   cookies from the ISAKMP Header.  Deletion which is concerned with a
-   Protocol SA, such as ESP or AH, will contain the Protocol-Id of that
-   protocol (e.g.  ESP, AH) and the SPI is the sending entity's SPI(s).
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 41]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   NOTE: The Delete Payload is not a request for the responder to delete
-   an SA, but an advisory from the initiator to the responder.  If the
-   responder chooses to ignore the message, the next communication from
-   the responder to the initiator, using that security association, will
-   fail.  A responder is not expected to acknowledge receipt of a Delete
-   payload.
-
-                          1                   2                   3
-      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     ! Next Payload  !   RESERVED    !         Payload Length        !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !              Domain of Interpretation  (DOI)                  !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !  Protocol-Id  !   SPI Size    !           # of SPIs           !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !                                                               !
-     ~               Security Parameter Index(es) (SPI)              ~
-     !                                                               !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-                 Figure 16:  Delete Payload Format
-
-   The Delete Payload fields are defined as follows:
-
-    o  Next Payload (1 octet) - Identifier for the payload type of the
-       next payload in the message.  If the current payload is the last
-       in the message, then this field will be 0.
-
-    o  RESERVED (1 octet) - Unused, set to 0.
-
-    o  Payload Length (2 octets) - Length in octets of the current
-       payload, including the generic payload header.
-
-    o  Domain of Interpretation (4 octets) - Identifies the DOI (as
-       described in Section 2.1) under which this deletion is taking
-       place.  For ISAKMP this value is zero (0) and for the IPSEC DOI
-       it is one (1).  Other DOI's can be defined using the description
-       in appendix B.
-
-    o  Protocol-Id (1 octet) - ISAKMP can establish security
-       associations for various protocols, including ISAKMP and IPSEC.
-       This field identifies which security association database to
-       apply the delete request.
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 42]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-    o  SPI Size (1 octet) - Length in octets of the SPI as defined by
-       the Protocol-Id.  In the case of ISAKMP, the Initiator and
-       Responder cookie pair is the ISAKMP SPI. In this case, the SPI
-       Size would be 16 octets for each SPI being deleted.
-
-    o  # of SPIs (2 octets) - The number of SPIs contained in the Delete
-       payload.  The size of each SPI is defined by the SPI Size field.
-
-    o  Security Parameter Index(es) (variable length) - Identifies the
-       specific security association(s) to delete.  Values for this
-       field are DOI and protocol specific.  The length of this field is
-       determined by the SPI Size and # of SPIs fields.
-
-   The payload type for the Delete Payload is twelve (12).
-
-3.16 Vendor ID Payload
-
-   The Vendor ID Payload contains a vendor defined constant.  The
-   constant is used by vendors to identify and recognize remote
-   instances of their implementations.  This mechanism allows a vendor
-   to experiment with new features while maintaining backwards
-   compatibility.  This is not a general extension facility of ISAKMP.
-   Figure 17 shows the format of the Vendor ID Payload.
-
-   The Vendor ID payload is not an announcement from the sender that it
-   will send private payload types.  A vendor sending the Vendor ID MUST
-   not make any assumptions about private payloads that it may send
-   unless a Vendor ID is received as well.  Multiple Vendor ID payloads
-   MAY be sent.  An implementation is NOT REQUIRED to understand any
-   Vendor ID payloads.  An implementation is NOT REQUIRED to send any
-   Vendor ID payload at all.  If a private payload was sent without
-   prior agreement to send it, a compliant implementation may reject a
-   proposal with a notify message of type INVALID-PAYLOAD-TYPE.
-
-   If a Vendor ID payload is sent, it MUST be sent during the Phase 1
-   negotiation.  Reception of a familiar Vendor ID payload in the Phase
-   1 negotiation allows an implementation to make use of Private USE
-   payload numbers (128-255), described in section 3.1 for vendor
-   specific extensions during Phase 2 negotiations.  The definition of
-   "familiar" is left to implementations to determine.  Some vendors may
-   wish to implement another vendor's extension prior to
-   standardization.  However, this practice SHOULD not be widespread and
-   vendors should work towards standardization instead.
-
-   The vendor defined constant MUST be unique.  The choice of hash and
-   text to hash is left to the vendor to decide.  As an example, vendors
-   could generate their vendor id by taking a plain (non-keyed) hash of
-   a string containing the product name, and the version of the product.
-
-
-
-Maughan, et. al.            Standards Track                    [Page 43]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   A hash is used instead of a vendor registry to avoid local
-   cryptographic policy problems with having a list of "approved"
-   products, to keep away from maintaining a list of vendors, and to
-   allow classified products to avoid having to appear on any list.  For
-   instance:
-
-   "Example Company IPsec.  Version 97.1"
-
-   (not including the quotes) has MD5 hash:
-   48544f9b1fe662af98b9b39e50c01a5a, when using MD5file.  Vendors may
-   include all of the hash, or just a portion of it, as the payload
-   length will bound the data.  There are no security implications of
-   this hash, so its choice is arbitrary.
-
-                          1                   2                   3
-      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     ! Next Payload  !   RESERVED    !         Payload Length        !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     !                                                               !
-     ~                        Vendor ID (VID)                        ~
-     !                                                               !
-     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-                Figure 17:  Vendor ID Payload Format
-
-   The Vendor ID Payload fields are defined as follows:
-
-    o  Next Payload (1 octet) - Identifier for the payload type of the
-       next payload in the message.  If the current payload is the last
-       in the message, then this field will be 0.
-
-    o  RESERVED (1 octet) - Unused, set to 0.
-
-    o  Payload Length (2 octets) - Length in octets of the current
-       payload, including the generic payload header.
-
-    o  Vendor ID (variable length) - Hash of the vendor string plus
-       version (as described above).
-
-   The payload type for the Vendor ID Payload is thirteen (13).
-
-4 ISAKMP Exchanges
-
-   ISAKMP supplies the basic syntax of a message exchange.  The basic
-   building blocks for ISAKMP messages are the payload types described
-   in section 3.  This section describes the procedures for SA
-
-
-
-Maughan, et. al.            Standards Track                    [Page 44]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   establishment and SA modification, followed by a default set of
-   exchanges that MAY be used for initial interoperability.  Other
-   exchanges will be defined depending on the DOI and key exchange.
-   [IPDOI] and [IKE] are examples of how this is achieved.  Appendix B
-   explains the procedures for accomplishing these additions.
-
-4.1 ISAKMP Exchange Types
-
-   ISAKMP allows the creation of exchanges for the establishment of
-   Security Associations and keying material.  There are currently five
-   default Exchange Types defined for ISAKMP. Sections 4.4 through 4.8
-   describe these exchanges.  Exchanges define the content and ordering
-   of ISAKMP messages during communications between peers.  Most
-   exchanges will include all the basic payload types - SA, KE, ID, SIG
-   - and may include others.  The primary difference between exchange
-   types is the ordering of the messages and the payload ordering within
-   each message.  While the ordering of payloads within messages is not
-   mandated, for processing efficiency it is RECOMMENDED that the
-   Security Association payload be the first payload within an exchange.
-   Processing of each payload within an exchange is described in section
-   5.
-
-   Sections 4.4 through 4.8 provide a default set of ISAKMP exchanges.
-   These exchanges provide different security protection for the
-   exchange itself and information exchanged.  The diagrams in each of
-   the following sections show the message ordering for each exchange
-   type as well as the payloads included in each message, and provide
-   basic notes describing what has happened after each message exchange.
-   None of the examples include any "optional payloads", like
-   certificate and certificate request.  Additionally, none of the
-   examples include an initial exchange of ISAKMP Headers (containing
-   initiator and responder cookies) which would provide protection
-   against clogging (see section 2.5.3).
-
-   The defined exchanges are not meant to satisfy all DOI and key
-   exchange protocol requirements.  If the defined exchanges meet the
-   DOI requirements, then they can be used as outlined.  If the defined
-   exchanges do not meet the security requirements defined by the DOI,
-   then the DOI MUST specify new exchange type(s) and the valid
-   sequences of payloads that make up a successful exchange, and how to
-   build and interpret those payloads.  All ISAKMP implementations MUST
-   implement the Informational Exchange and SHOULD implement the other
-   four exchanges.  However, this is dependent on the definition of the
-   DOI and associated key exchange protocols.
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 45]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   As discussed above, these exchange types can be used in either phase
-   of negotiation.  However, they may provide different security
-   properties in each of the phases.  With each of these exchanges, the
-   combination of cookies and SPI fields identifies whether this
-   exchange is being used in the first or second phase of a negotiation.
-
-4.1.1 Notation
-
-   The following notation is used to describe the ISAKMP exchange types,
-   shown in the next section, with the message formats and associated
-   payloads:
-
-     HDR is an ISAKMP header whose exchange type defines the payload
-          orderings
-     SA is an SA negotiation payload with one or more Proposal and
-          Transform payloads. An initiator MAY provide multiple proposals
-          for negotiation; a responder MUST reply with only one.
-     KE is the key exchange payload.
-     IDx is the identity payload for "x". x can be: "ii" or "ir"
-          for the ISAKMP initiator and responder, respectively, or x can
-          be: "ui", "ur" (when the ISAKMP daemon is a proxy negotiator),
-          for the user initiator and responder, respectively.
-     HASH is the hash payload.
-     SIG is the signature payload. The data to sign is exchange-specific.
-     AUTH is a generic authentication mechanism, such as HASH or SIG.
-     NONCE is the nonce payload.
-     '*' signifies payload encryption after the ISAKMP header. This
-          encryption MUST begin immediately after the ISAKMP header and
-          all payloads following the ISAKMP header MUST be encrypted.
-
-     => signifies "initiator to responder" communication
-     <= signifies "responder to initiator" communication
-
-4.2 Security Association Establishment
-
-   The Security Association, Proposal, and Transform payloads are used
-   to build ISAKMP messages for the negotiation and establishment of
-   SAs.  An SA establishment message consists of a single SA payload
-   followed by at least one, and possibly many, Proposal payloads and at
-   least one, and possibly many, Transform payloads associated with each
-   Proposal payload.  Because these payloads are considered together,
-   the SA payload will point to any following payloads and not to the
-   Proposal payload included with the SA payload.  The SA Payload
-   contains the DOI and Situation for the proposed SA. Each Proposal
-   payload contains a Security Parameter Index (SPI) and ensures that
-   the SPI is associated with the Protocol-Id in accordance with the
-   Internet Security Architecture [SEC-ARCH].  Proposal payloads may or
-   may not have the same SPI, as this is implementation dependent.  Each
-
-
-
-Maughan, et. al.            Standards Track                    [Page 46]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   Transform Payload contains the specific security mechanisms to be
-   used for the designated protocol.  It is expected that the Proposal
-   and Transform payloads will be used only during SA establishment
-   negotiation.  The creation of payloads for security association
-   negotiation and establishment described here in this section are
-   applicable for all ISAKMP exchanges described later in sections 4.4
-   through 4.8.  The examples shown in 4.2.1 contain only the SA,
-   Proposal, and Transform payloads and do not contain other payloads
-   that might exist for a given ISAKMP exchange.
-
-   The Proposal payload provides the initiating entity with the
-   capability to present to the responding entity the security protocols
-   and associated security mechanisms for use with the security
-   association being negotiated.  If the SA establishment negotiation is
-   for a combined protection suite consisting of multiple protocols,
-   then there MUST be multiple Proposal payloads each with the same
-   Proposal number.  These proposals MUST be considered as a unit and
-   MUST NOT be separated by a proposal with a different proposal number.
-   The use of the same Proposal number in multiple Proposal payloads
-   provides a logical AND operation, i.e.  Protocol 1 AND Protocol 2.
-   The first example below shows an ESP AND AH protection suite.  If the
-   SA establishment negotiation is for different protection suites, then
-   there MUST be multiple Proposal payloads each with a monotonically
-   increasing Proposal number.  The different proposals MUST be
-   presented in the initiator's preference order.  The use of different
-   Proposal numbers in multiple Proposal payloads provides a logical OR
-   operation, i.e.  Proposal 1 OR Proposal 2, where each proposal may
-   have more than one protocol.  The second example below shows either
-   an AH AND ESP protection suite OR just an ESP protection suite.  Note
-   that the Next Payload field of the Proposal payload points to another
-   Proposal payload (if it exists).  The existence of a Proposal payload
-   implies the existence of one or more Transform payloads.
-
-   The Transform payload provides the initiating entity with the
-   capability to present to the responding entity multiple mechanisms,
-   or transforms, for a given protocol.  The Proposal payload identifies
-   a Protocol for which services and mechanisms are being negotiated.
-   The Transform payload allows the initiating entity to present several
-   possible supported transforms for that proposed protocol.  There may
-   be several transforms associated with a specific Proposal payload
-   each identified in a separate Transform payload.  The multiple
-   transforms MUST be presented with monotonically increasing numbers in
-   the initiator's preference order.  The receiving entity MUST select a
-   single transform for each protocol in a proposal or reject the entire
-   proposal.  The use of the Transform number in multiple Transform
-   payloads provides a second level OR operation, i.e.  Transform 1 OR
-   Transform 2 OR Transform 3.  Example 1 below shows two possible
-   transforms for ESP and a single transform for AH. Example 2 below
-
-
-
-Maughan, et. al.            Standards Track                    [Page 47]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   shows one transform for AH AND one transform for ESP OR two
-   transforms for ESP alone.  Note that the Next Payload field of the
-   Transform payload points to another Transform payload or 0.  The
-   Proposal payload delineates the different proposals.
-
-   When responding to a Security Association payload, the responder MUST
-   send a Security Association payload with the selected proposal, which
-   may consist of multiple Proposal payloads and their associated
-   Transform payloads.  Each of the Proposal payloads MUST contain a
-   single Transform payload associated with the Protocol.  The responder
-   SHOULD retain the Proposal # field in the Proposal payload and the
-   Transform # field in each Transform payload of the selected Proposal.
-   Retention of Proposal and Transform numbers should speed the
-   initiator's protocol processing by negating the need to compare the
-   respondor's selection with every offered option.  These values enable
-   the initiator to perform the comparison directly and quickly.  The
-   initiator MUST verify that the Security Association payload received
-   from the responder matches one of the proposals sent initially.
-
-4.2.1 Security Association Establishment Examples
-
-   This example shows a Proposal for a combined protection suite with
-   two different protocols.  The first protocol is presented with two
-   transforms supported by the proposer.  The second protocol is
-   presented with a single transform.  An example for this proposal
-   might be: Protocol 1 is ESP with Transform 1 as 3DES and Transform 2
-   as DES AND Protocol 2 is AH with Transform 1 as SHA. The responder
-   MUST select from the two transforms proposed for ESP. The resulting
-   protection suite will be either (1) 3DES AND SHA OR (2) DES AND SHA,
-   depending on which ESP transform was selected by the responder.  Note
-   this example is shown using the Base Exchange.
-
-                            1                   2                   3
-        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      /+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     / ! NP = Nonce    !   RESERVED    !         Payload Length        !
-    /  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-SA Pay !                 Domain of Interpretation (DOI)                !
-    \  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     \ !                           Situation                           !
-      >+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     / ! NP = Proposal !   RESERVED    !         Payload Length        !
-    /  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-Prop 1 ! Proposal # = 1!  Protocol-Id  !    SPI Size   !# of Trans. = 2!
-Prot 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     \ !                         SPI (variable)                        !
-      >+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     / ! NP = Transform!   RESERVED    !         Payload Length        !
-
-
-
-Maughan, et. al.            Standards Track                    [Page 48]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-    /  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-Tran 1 ! Transform # 1 ! Transform ID  !           RESERVED2           !
-    \  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     \ !                         SA Attributes                         !
-      >+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     / ! NP = 0        !   RESERVED    !         Payload Length        !
-    /  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-Tran 2 ! Transform # 2 ! Transform ID  !           RESERVED2           !
-    \  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     \ !                         SA Attributes                         !
-      >+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     / ! NP = 0        !   RESERVED    !         Payload Length        !
-    /  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-Prop 1 ! Proposal # = 1!  Protocol ID  !    SPI Size   !# of Trans. = 1!
-Prot 2 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     \ !                         SPI (variable)                        !
-      >+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     / ! NP = 0        !   RESERVED    !         Payload Length        !
-    /  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-Tran 1 ! Transform # 1 ! Transform ID  !           RESERVED2           !
-    \  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     \ !                         SA Attributes                         !
-      \+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-   This second example shows a Proposal for two different protection
-   suites.  The SA Payload was omitted for space reasons.  The first
-   protection suite is presented with one transform for the first
-   protocol and one transform for the second protocol.  The second
-   protection suite is presented with two transforms for a single
-   protocol.  An example for this proposal might be:  Proposal 1 with
-   Protocol 1 as AH with Transform 1 as MD5 AND Protocol 2 as ESP with
-   Transform 1 as 3DES. This is followed by Proposal 2 with Protocol 1
-   as ESP with Transform 1 as DES and Transform 2 as 3DES. The responder
-   MUST select from the two different proposals.  If the second Proposal
-   is selected, the responder MUST select from the two transforms for
-   ESP. The resulting protection suite will be either (1) MD5 AND 3DES
-   OR the selection between (2) DES OR (3) 3DES.
-
-                            1                   2                   3
-        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      /+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     / ! NP = Proposal !   RESERVED    !         Payload Length        !
-    /  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-Prop 1 ! Proposal # = 1!  Protocol ID  !    SPI Size   !# of Trans. = 1!
-Prot 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     \ !                         SPI (variable)                        !
-      >+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     / ! NP = 0        !   RESERVED    !         Payload Length        !
-
-
-
-Maughan, et. al.            Standards Track                    [Page 49]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-    /  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-Tran 1 ! Transform # 1 ! Transform ID  !           RESERVED2           !
-    \  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     \ !                         SA Attributes                         !
-      >+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     / ! NP = Proposal !   RESERVED    !         Payload Length        !
-    /  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-Prop 1 ! Proposal # = 1! Protocol ID   !    SPI Size   !# of Trans. = 1!
-Prot 2 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     \ !                         SPI (variable)                        !
-      >+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     / ! NP = 0        !   RESERVED    !         Payload Length        !
-    /  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-Tran 1 ! Transform # 1 ! Transform ID  !           RESERVED2           !
-    \  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     \ !                         SA Attributes                         !
-      >+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     / ! NP = 0        !   RESERVED    !         Payload Length        !
-    /  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-Prop 2 ! Proposal # = 2! Protocol ID   !    SPI Size   !# of Trans. = 2!
-Prot 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     \ !                         SPI (variable)                        !
-      >+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     / ! NP = Transform!   RESERVED    !         Payload Length        !
-    /  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-Tran 1 ! Transform # 1 ! Transform ID  !           RESERVED2           !
-    \  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     \ !                         SA Attributes                         !
-      >+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     / ! NP = 0        !   RESERVED    !         Payload Length        !
-    /  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-Tran 2 ! Transform # 2 ! Transform ID  !           RESERVED2           !
-    \  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-     \ !                         SA Attributes                         !
-      \+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-4.3 Security Association Modification
-
-   Security Association modification within ISAKMP is accomplished by
-   creating a new SA and initiating communications using that new SA.
-   Deletion of the old SA can be done anytime after the new SA is
-   established.  Deletion of the old SA is dependent on local security
-   policy.  Modification of SAs by using a "Create New SA followed by
-   Delete Old SA" method is done to avoid potential vulnerabilities in
-   synchronizing modification of existing SA attributes.  The procedure
-   for creating new SAs is outlined in section 4.2.  The procedure for
-   deleting SAs is outlined in section 5.15.
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 50]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   Modification of an ISAKMP SA (phase 1 negotiation) follows the same
-   procedure as creation of an ISAKMP SA. There is no relationship
-   between the two SAs and the initiator and responder cookie pairs
-   SHOULD be different, as outlined in section 2.5.3.
-
-   Modification of a Protocol SA (phase 2 negotiation) follows the same
-   procedure as creation of a Protocol SA. The creation of a new SA is
-   protected by the existing ISAKMP SA. There is no relationship between
-   the two Protocol SAs.  A protocol implementation SHOULD begin using
-   the newly created SA for outbound traffic and SHOULD continue to
-   support incoming traffic on the old SA until it is deleted or until
-   traffic is received under the protection of the newly created SA. As
-   stated previously in this section, deletion of an old SA is then
-   dependent on local security policy.
-
-4.4 Base Exchange
-
-   The Base Exchange is designed to allow the Key Exchange and
-   Authentication related information to be transmitted together.
-   Combining the Key Exchange and Authentication-related information
-   into one message reduces the number of round-trips at the expense of
-   not providing identity protection.  Identity protection is not
-   provided because identities are exchanged before a common shared
-   secret has been established and, therefore, encryption of the
-   identities is not possible.  The following diagram shows the messages
-   with the possible payloads sent in each message and notes for an
-   example of the Base Exchange.
-
-                         BASE EXCHANGE
-
- #  Initiator Direction  Responder            NOTE
-(1)  HDR; SA; NONCE  =>           Begin ISAKMP-SA or Proxy negotiation
-
-(2)                  <=  HDR; SA; NONCE
-                                  Basic SA agreed upon
-(3)  HDR; KE;        =>
-     IDii; AUTH                   Key Generated (by responder)
-                                  Initiator Identity Verified by
-                                  Responder
-(4)                  <=  HDR; KE;
-                         IDir; AUTH
-                                  Responder Identity Verified by
-                                  Initiator Key Generated (by
-                                  initiator) SA established
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 51]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   In the first message (1), the initiator generates a proposal it
-   considers adequate to protect traffic for the given situation.  The
-   Security Association, Proposal, and Transform payloads are included
-   in the Security Association payload (for notation purposes).  Random
-   information which is used to guarantee liveness and protect against
-   replay attacks is also transmitted.  Random information provided by
-   both parties SHOULD be used by the authentication mechanism to
-   provide shared proof of participation in the exchange.
-
-   In the second message (2), the responder indicates the protection
-   suite it has accepted with the Security Association, Proposal, and
-   Transform payloads.  Again, random information which is used to
-   guarantee liveness and protect against replay attacks is also
-   transmitted.  Random information provided by both parties SHOULD be
-   used by the authentication mechanism to provide shared proof of
-   participation in the exchange.  Local security policy dictates the
-   action of the responder if no proposed protection suite is accepted.
-   One possible action is the transmission of a Notify payload as part
-   of an Informational Exchange.
-
-   In the third (3) and fourth (4) messages, the initiator and
-   responder, respectively, exchange keying material used to arrive at a
-   common shared secret and identification information.  This
-   information is transmitted under the protection of the agreed upon
-   authentication function.  Local security policy dictates the action
-   if an error occurs during these messages.  One possible action is the
-   transmission of a Notify payload as part of an Informational
-   Exchange.
-
-4.5 Identity Protection Exchange
-
-   The Identity Protection Exchange is designed to separate the Key
-   Exchange information from the Identity and Authentication related
-   information.  Separating the Key Exchange from the Identity and
-   Authentication related information provides protection of the
-   communicating identities at the expense of two additional messages.
-   Identities are exchanged under the protection of a previously
-   established common shared secret.  The following diagram shows the
-   messages with the possible payloads sent in each message and notes
-   for an example of the Identity Protection Exchange.
-
-
-
-
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 52]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-                    IDENTITY PROTECTION EXCHANGE
-
- #      Initiator       Direction    Responder      NOTE
-(1)  HDR; SA               =>                       Begin ISAKMP-SA or
-                                                    Proxy negotiation
-(2)                        <=     HDR; SA
-                                                    Basic SA agreed upon
-(3)  HDR; KE; NONCE        =>
-(4)                        <=     HDR; KE; NONCE
-                                                    Key Generated (by
-                                                    Initiator and
-                                                    Responder)
-(5)  HDR*; IDii; AUTH      =>
-                                                    Initiator Identity
-                                                    Verified by
-                                                    Responder
-(6)                        <=     HDR*; IDir; AUTH
-                                                    Responder Identity
-                                                    Verified by
-                                                    Initiator
-                                                    SA established
-
-   In the first message (1), the initiator generates a proposal it
-   considers adequate to protect traffic for the given situation.  The
-   Security Association, Proposal, and Transform payloads are included
-   in the Security Association payload (for notation purposes).
-
-   In the second message (2), the responder indicates the protection
-   suite it has accepted with the Security Association, Proposal, and
-   Transform payloads.  Local security policy dictates the action of the
-   responder if no proposed protection suite is accepted.  One possible
-   action is the transmission of a Notify payload as part of an
-   Informational Exchange.
-
-   In the third (3) and fourth (4) messages, the initiator and
-   responder, respectively, exchange keying material used to arrive at a
-   common shared secret and random information which is used to
-   guarantee liveness and protect against replay attacks.  Random
-   information provided by both parties SHOULD be used by the
-   authentication mechanism to provide shared proof of participation in
-   the exchange.  Local security policy dictates the action if an error
-   occurs during these messages.  One possible action is the
-   transmission of a Notify payload as part of an Informational
-   Exchange.
-
-   In the fifth (5) and sixth (6) messages, the initiator and responder,
-   respectively, exchange identification information and the results of
-   the agreed upon authentication function.  This information is
-
-
-
-Maughan, et. al.            Standards Track                    [Page 53]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   transmitted under the protection of the common shared secret.  Local
-   security policy dictates the action if an error occurs during these
-   messages.  One possible action is the transmission of a Notify
-   payload as part of an Informational Exchange.
-
-4.6 Authentication Only Exchange
-
-   The Authentication Only Exchange is designed to allow only
-   Authentication related information to be transmitted.  The benefit of
-   this exchange is the ability to perform only authentication without
-   the computational expense of computing keys.  Using this exchange
-   during negotiation, none of the transmitted information will be
-   encrypted.  However, the information may be encrypted in other
-   places.  For example, if encryption is negotiated during the first
-   phase of a negotiation and the authentication only exchange is used
-   in the second phase of a negotiation, then the authentication only
-   exchange will be encrypted by the ISAKMP SAs negotiated in the first
-   phase.  The following diagram shows the messages with possible
-   payloads sent in each message and notes for an example of the
-   Authentication Only Exchange.
-
-                     AUTHENTICATION ONLY EXCHANGE
-
- #      Initiator     Direction     Responder     NOTE
-(1)  HDR; SA; NONCE      =>                       Begin ISAKMP-SA or
-                                                  Proxy negotiation
-(2)                       <=     HDR; SA; NONCE;
-                                 IDir; AUTH
-                                                  Basic SA agreed upon
-                                                  Responder Identity
-                                                  Verified by Initiator
-(3)  HDR; IDii; AUTH      =>
-                                                  Initiator Identity
-                                                  Verified by Responder
-                                                  SA established
-
-   In the first message (1), the initiator generates a proposal it
-   considers adequate to protect traffic for the given situation.  The
-   Security Association, Proposal, and Transform payloads are included
-   in the Security Association payload (for notation purposes).  Random
-   information which is used to guarantee liveness and protect against
-   replay attacks is also transmitted.  Random information provided by
-   both parties SHOULD be used by the authentication mechanism to
-   provide shared proof of participation in the exchange.
-
-   In the second message (2), the responder indicates the protection
-   suite it has accepted with the Security Association, Proposal, and
-   Transform payloads.  Again, random information which is used to
-
-
-
-Maughan, et. al.            Standards Track                    [Page 54]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   guarantee liveness and protect against replay attacks is also
-   transmitted.  Random information provided by both parties SHOULD be
-   used by the authentication mechanism to provide shared proof of
-   participation in the exchange.  Additionally, the responder transmits
-   identification information.  All of this information is transmitted
-   under the protection of the agreed upon authentication function.
-   Local security policy dictates the action of the responder if no
-   proposed protection suite is accepted.  One possible action is the
-   transmission of a Notify payload as part of an Informational
-   Exchange.
-
-   In the third message (3), the initiator transmits identification
-   information.  This information is transmitted under the protection of
-   the agreed upon authentication function.  Local security policy
-   dictates the action if an error occurs during these messages.  One
-   possible action is the transmission of a Notify payload as part of an
-   Informational Exchange.
-
-4.7 Aggressive Exchange
-
-   The Aggressive Exchange is designed to allow the Security
-   Association, Key Exchange and Authentication related payloads to be
-   transmitted together.  Combining the Security Association, Key
-   Exchange, and Authentication-related information into one message
-   reduces the number of round-trips at the expense of not providing
-   identity protection.  Identity protection is not provided because
-   identities are exchanged before a common shared secret has been
-   established and, therefore, encryption of the identities is not
-   possible.  Additionally, the Aggressive Exchange is attempting to
-   establish all security relevant information in a single exchange.
-   The following diagram shows the messages with possible payloads sent
-   in each message and notes for an example of the Aggressive Exchange.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 55]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-                        AGGRESSIVE EXCHANGE
-
- #     Initiator   Direction      Responder      NOTE
-(1)  HDR; SA; KE;      =>                        Begin ISAKMP-SA or
-                                                 Proxy negotiation
-     NONCE; IDii                                 and Key Exchange
-
-(2)                    <=     HDR; SA; KE;
-                              NONCE; IDir; AUTH
-                                                 Initiator Identity
-                                                 Verified by Responder
-                                                 Key Generated
-                                                 Basic SA agreed upon
-(3)  HDR*; AUTH        =>
-                                                 Responder Identity
-                                                 Verified by Initiator
-                                                 SA established
-
-   In the first message (1), the initiator generates a proposal it
-   considers adequate to protect traffic for the given situation.  The
-   Security Association, Proposal, and Transform payloads are included
-   in the Security Association payload (for notation purposes).  There
-   can be only one Proposal and one Transform offered (i.e.  no choices)
-   in order for the aggressive exchange to work.  Keying material used
-   to arrive at a common shared secret and random information which is
-   used to guarantee liveness and protect against replay attacks are
-   also transmitted.  Random information provided by both parties SHOULD
-   be used by the authentication mechanism to provide shared proof of
-   participation in the exchange.  Additionally, the initiator transmits
-   identification information.
-
-   In the second message (2), the responder indicates the protection
-   suite it has accepted with the Security Association, Proposal, and
-   Transform payloads.  Keying material used to arrive at a common
-   shared secret and random information which is used to guarantee
-   liveness and protect against replay attacks is also transmitted.
-   Random information provided by both parties SHOULD be used by the
-   authentication mechanism to provide shared proof of participation in
-   the exchange.  Additionally, the responder transmits identification
-   information.  All of this information is transmitted under the
-   protection of the agreed upon authentication function.  Local
-   security policy dictates the action of the responder if no proposed
-   protection suite is accepted.  One possible action is the
-   transmission of a Notify payload as part of an Informational
-   Exchange.
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 56]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   In the third (3) message, the initiator transmits the results of the
-   agreed upon authentication function.  This information is transmitted
-   under the protection of the common shared secret.  Local security
-   policy dictates the action if an error occurs during these messages.
-   One possible action is the transmission of a Notify payload as part
-   of an Informational Exchange.
-
-4.8 Informational Exchange
-
-   The Informational Exchange is designed as a one-way transmittal of
-   information that can be used for security association management.
-   The following diagram shows the messages with possible payloads sent
-   in each message and notes for an example of the Informational
-   Exchange.
-
-                      INFORMATIONAL EXCHANGE
-
-    #   Initiator  Direction Responder  NOTE
-   (1)  HDR*; N/D     =>                Error Notification or Deletion
-
-   In the first message (1), the initiator or responder transmits an
-   ISAKMP Notify or Delete payload.
-
-   If the Informational Exchange occurs prior to the exchange of keying
-   meterial during an ISAKMP Phase 1 negotiation, there will be no
-   protection provided for the Informational Exchange.  Once keying
-   material has been exchanged or an ISAKMP SA has been established, the
-   Informational Exchange MUST be transmitted under the protection
-   provided by the keying material or the ISAKMP SA.
-
-   All exchanges are similar in that with the beginning of any exchange,
-   cryptographic synchronization MUST occur.  The Informational Exchange
-   is an exchange and not an ISAKMP message.  Thus, the generation of an
-   Message ID (MID) for an Informational Exchange SHOULD be independent
-   of IVs of other on-going communication.  This will ensure
-   cryptographic synchronization is maintained for existing
-   communications and the Informational Exchange will be processed
-   correctly.  The only exception to this is when the Commit Bit of the
-   ISAKMP Header is set.  When the Commit Bit is set, the Message ID
-   field of the Informational Exchange MUST contain the Message ID of
-   the original ISAKMP Phase 2 SA negotiation, rather than a new Message
-   ID (MID). This is done to ensure that the Informational Exchange with
-   the CONNECTED Notify Message can be associated with the correct Phase
-   2 SA. For a description of the Commit Bit, see section 3.1.
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 57]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-5 ISAKMP Payload Processing
-
-   Section 3 describes the ISAKMP payloads.  These payloads are used in
-   the exchanges described in section 4 and can be used in exchanges
-   defined for a specific DOI. This section describes the processing for
-   each of the payloads.  This section suggests the logging of events to
-   a system audit file.  This action is controlled by a system security
-   policy and is, therefore, only a suggested action.
-
-5.1 General Message Processing
-
-   Every ISAKMP message has basic processing applied to insure protocol
-   reliability, and to minimize threats, such as denial of service and
-   replay attacks.  All processing SHOULD include packet length checks
-   to insure the packet received is at least as long as the length given
-   in the ISAKMP Header.  If the ISAKMP message length and the value in
-   the Payload Length field of the ISAKMP Header are not the same, then
-   the ISAKMP message MUST be rejected.  The receiving entity (initiator
-   or responder) MUST do the following:
-
-   1.  The event, UNEQUAL PAYLOAD LENGTHS, MAY be logged in the
-       appropriate system audit file.
-
-   2.  An Informational Exchange with a Notification payload containing
-       the UNEQUAL-PAYLOAD-LENGTHS message type MAY be sent to the
-       transmitting entity.  This action is dictated by a system
-       security policy.
-
-   When transmitting an ISAKMP message, the transmitting entity
-   (initiator or responder) MUST do the following:
-
-   1.  Set a timer and initialize a retry counter.
-
-       NOTE: Implementations MUST NOT use a fixed timer.  Instead,
-       transmission timer values should be adjusted dynamically based on
-       measured round trip times.  In addition, successive
-       retransmissions of the same packet should be separated by
-       increasingly longer time intervals (e.g., exponential backoff).
-
-   2.  If the timer expires, the ISAKMP message is resent and the retry
-       counter is decremented.
-
-   3.  If the retry counter reaches zero (0), the event, RETRY LIMIT
-       REACHED, MAY be logged in the appropriate system audit file.
-
-   4.  The ISAKMP protocol machine clears all states and returns to
-       IDLE.
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 58]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-5.2 ISAKMP Header Processing
-
-   When creating an ISAKMP message, the transmitting entity (initiator
-   or responder) MUST do the following:
-
-   1.  Create the respective cookie.  See section 2.5.3 for details.
-
-   2.  Determine the relevant security characteristics of the session
-       (i.e. DOI and situation).
-
-   3.  Construct an ISAKMP Header with fields as described in section
-       3.1.
-
-   4.  Construct other ISAKMP payloads, depending on the exchange type.
-
-   5.  Transmit the message to the destination host as described in
-       section5.1.
-
-   When an ISAKMP message is received, the receiving entity (initiator
-   or responder) MUST do the following:
-
-   1.  Verify the Initiator and Responder "cookies".  If the cookie
-       validation fails, the message is discarded and the following
-       actions are taken:
-
-       (a)  The event, INVALID COOKIE, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-COOKIE message type MAY be sent to
-            the transmitting entity.  This action is dictated by a
-            system security policy.
-
-   2.  Check the Next Payload field to confirm it is valid.  If the Next
-       Payload field validation fails, the message is discarded and the
-       following actions are taken:
-
-       (a)  The event, INVALID NEXT PAYLOAD, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-PAYLOAD-TYPE message type MAY be sent
-            to the transmitting entity.  This action is dictated by a
-            system security policy.
-
-   3.  Check the Major and Minor Version fields to confirm they are
-       correct (see section 3.1).  If the Version field validation
-       fails, the message is discarded and the following actions are
-
-
-
-Maughan, et. al.            Standards Track                    [Page 59]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-       taken:
-
-       (a)  The event, INVALID ISAKMP VERSION, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-MAJOR-VERSION or INVALID-MINOR-
-            VERSION message type MAY be sent to the transmitting entity.
-            This action is dictated by a system security policy.
-
-   4.  Check the Exchange Type field to confirm it is valid.  If the
-       Exchange Type field validation fails, the message is discarded
-       and the following actions are taken:
-
-       (a)  The event, INVALID EXCHANGE TYPE, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-EXCHANGE-TYPE message type MAY be
-            sent to the transmitting entity.  This action is dictated by
-            a system security policy.
-
-   5.  Check the Flags field to ensure it contains correct values.  If
-       the Flags field validation fails, the message is discarded and
-       the following actions are taken:
-
-       (a)  The event, INVALID FLAGS, MAY be logged in the appropriate
-            systemaudit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-FLAGS message type MAY be sent to the
-            transmitting entity.  This action is dictated by a system
-            security policy.
-
-   6.  Check the Message ID field to ensure it contains correct values.
-       If the Message ID validation fails, the message is discarded and
-       the following actions are taken:
-
-       (a)  The event, INVALID MESSAGE ID, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-MESSAGE-ID message type MAY be sent
-            to the transmitting entity.  This action is dictated by a
-            system security policy.
-
-   7.  Processing of the ISAKMP message continues using the value in the
-       Next Payload field.
-
-
-
-Maughan, et. al.            Standards Track                    [Page 60]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-5.3 Generic Payload Header Processing
-
-   When creating any of the ISAKMP Payloads described in sections 3.4
-   through 3.15 a Generic Payload Header is placed at the beginning of
-   these payloads.  When creating the Generic Payload Header, the
-   transmitting entity (initiator or responder) MUST do the following:
-
-   1.  Place the value of the Next Payload in the Next Payload field.
-       These values are described in section 3.1.
-
-   2.  Place the value zero (0) in the RESERVED field.
-
-   3.  Place the length (in octets) of the payload in the Payload Length
-       field.
-
-   4.  Construct the payloads as defined in the remainder of this
-       section.
-
-   When any of the ISAKMP Payloads are received, the receiving entity
-   (initiator or responder) MUST do the following:
-
-   1.  Check the Next Payload field to confirm it is valid.  If the Next
-       Payload field validation fails, the message is discarded and the
-       following actions are taken:
-
-       (a)  The event, INVALID NEXT PAYLOAD, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-PAYLOAD-TYPE message type MAY be sent
-            to the transmitting entity.  This action is dictated by a
-            system security policy.
-
-   2.  Verify the RESERVED field contains the value zero.  If the value
-       in the RESERVED field is not zero, the message is discarded and
-       the following actions are taken:
-
-       (a)  The event, INVALID RESERVED FIELD, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the BAD-PROPOSAL-SYNTAX or PAYLOAD-MALFORMED
-            message type MAY be sent to the transmitting entity.  This
-            action is dictated by a system security policy.
-
-   3.  Process the remaining payloads as defined by the Next Payload
-       field.
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 61]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-5.4 Security Association Payload Processing
-
-   When creating a Security Association Payload, the transmitting entity
-   (initiator or responder) MUST do the following:
-
-   1.  Determine the Domain of Interpretation for which this negotiation
-       is being performed.
-
-   2.  Determine the situation within the determined DOI for which this
-       negotiation is being performed.
-
-   3.  Determine the proposal(s) and transform(s) within the situation.
-       These are described, respectively, in sections 3.5 and 3.6.
-
-   4.  Construct a Security Association payload.
-
-   5.  Transmit the message to the receiving entity as described in
-       section 5.1.
-
-   When a Security Association payload is received, the receiving entity
-   (initiator or responder) MUST do the following:
-
-   1.  Determine if the Domain of Interpretation (DOI) is supported.  If
-       the DOI determination fails, the message is discarded and the
-       following actions are taken:
-
-       (a)  The event, INVALID DOI, MAY be logged in the appropriate
-            system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the DOI-NOT-SUPPORTED message type MAY be sent to
-            the transmitting entity.  This action is dictated by a
-            system security policy.
-
-   2.  Determine if the given situation can be protected.  If the
-       Situation determination fails, the message is discarded and the
-       following actions are taken:
-
-       (a)  The event, INVALID SITUATION, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the SITUATION-NOT-SUPPORTED message type MAY be
-            sent to the transmitting entity.  This action is dictated by
-            a system security policy.
-
-   3.  Process the remaining payloads (i.e.  Proposal, Transform) of the
-       Security Association Payload.  If the Security Association
-
-
-
-Maughan, et. al.            Standards Track                    [Page 62]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-       Proposal (as described in sections 5.5 and 5.6) is not accepted,
-       then the following actions are taken:
-
-       (a)  The event, INVALID PROPOSAL, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the NO-PROPOSAL-CHOSEN message type MAY be sent
-            to the transmitting entity.  This action is dictated by a
-            system security policy.
-
-5.5 Proposal Payload Processing
-
-   When creating a Proposal Payload, the transmitting entity (initiator
-   or responder) MUST do the following:
-
-   1.  Determine the Protocol for this proposal.
-
-   2.  Determine the number of proposals to be offered for this protocol
-       and the number of transforms for each proposal.  Transforms are
-       described in section 3.6.
-
-   3.  Generate a unique pseudo-random SPI.
-
-   4.  Construct a Proposal payload.
-
-   When a Proposal payload is received, the receiving entity (initiator
-   or responder) MUST do the following:
-
-   1.  Determine if the Protocol is supported.  If the Protocol-ID field
-       is invalid, the payload is discarded and the following actions
-       are taken:
-
-       (a)  The event, INVALID PROTOCOL, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-PROTOCOL-ID message type MAY be sent
-            to the transmitting entity.  This action is dictated by a
-            system security policy.
-
-   2.  Determine if the SPI is valid.  If the SPI is invalid, the
-       payload is discarded and the following actions are taken:
-
-       (a)  The event, INVALID SPI, MAY be logged in the appropriate
-            system audit file.
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 63]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-SPI message type MAY be sent to the
-            transmitting entity.  This action is dictated by a system
-            security policy.
-
-   3.  Ensure the Proposals are presented according to the details given
-       in section 3.5 and 4.2.  If the proposals are not formed
-       correctly, the following actions are taken:
-
-       (a)  Possible events, BAD PROPOSAL SYNTAX, INVALID PROPOSAL, are
-            logged in the appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the BAD-PROPOSAL-SYNTAX or PAYLOAD-MALFORMED
-            message type MAY be sent to the transmitting entity.  This
-            action is dictated by a system security policy.
-
-   4.  Process the Proposal and Transform payloads as defined by the
-       Next Payload field.  Examples of processing these payloads are
-       given in section 4.2.1.
-
-5.6 Transform Payload Processing
-
-   When creating a Transform Payload, the transmitting entity (initiator
-   or responder) MUST do the following:
-
-   1.  Determine the Transform # for this transform.
-
-   2.  Determine the number of transforms to be offered for this
-       proposal.  Transforms are described in sections 3.6.
-
-   3.  Construct a Transform payload.
-
-   When a Transform payload is received, the receiving entity (initiator
-   or responder) MUST do the following:
-
-   1.  Determine if the Transform is supported.  If the Transform-ID
-       field contains an unknown or unsupported value, then that
-       Transform payload MUST be ignored and MUST NOT cause the
-       generation of an INVALID TRANSFORM event.  If the Transform-ID
-       field is invalid, the payload is discarded and the following
-       actions are taken:
-
-       (a)  The event, INVALID TRANSFORM, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-TRANSFORM-ID message type MAY be sent
-
-
-
-Maughan, et. al.            Standards Track                    [Page 64]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-            to the transmitting entity.  This action is dictated by a
-            system security policy.
-
-   2.  Ensure the Transforms are presented according to the details
-       given in section 3.6 and 4.2.  If the transforms are not formed
-       correctly, the following actions are taken:
-
-       (a)  Possible events, BAD PROPOSAL SYNTAX, INVALID TRANSFORM,
-            INVALID ATTRIBUTES, are logged in the appropriate system
-            audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the BAD-PROPOSAL-SYNTAX, PAYLOAD-MALFORMED or
-            ATTRIBUTES-NOT-SUPPORTED message type MAY be sent to the
-            transmitting entity.  This action is dictated by a system
-            security policy.
-
-   3.  Process the subsequent Transform and Proposal payloads as defined
-       by the Next Payload field.  Examples of processing these payloads
-       are given in section 4.2.1.
-
-5.7 Key Exchange Payload Processing
-
-   When creating a Key Exchange Payload, the transmitting entity
-   (initiator or responder) MUST do the following:
-
-   1.  Determine the Key Exchange to be used as defined by the DOI.
-
-   2.  Determine the usage of the Key Exchange Data field as defined by
-       the DOI.
-
-   3.  Construct a Key Exchange payload.
-
-   4.  Transmit the message to the receiving entity as described in
-       section 5.1.
-
-   When a Key Exchange payload is received, the receiving entity
-   (initiator or responder) MUST do the following:
-
-   1.  Determine if the Key Exchange is supported.  If the Key Exchange
-       determination fails, the message is discarded and the following
-       actions are taken:
-
-       (a)  The event, INVALID KEY INFORMATION, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-KEY-INFORMATION message type MAY be
-
-
-
-Maughan, et. al.            Standards Track                    [Page 65]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-            sent to the transmitting entity.  This action is dictated by
-            a system security policy.
-
-5.8 Identification Payload Processing
-
-   When creating an Identification Payload, the transmitting entity
-   (initiator or responder) MUST do the following:
-
-   1.  Determine the Identification information to be used as defined by
-       the DOI (and possibly the situation).
-
-   2.  Determine the usage of the Identification Data field as defined
-       by the DOI.
-
-   3.  Construct an Identification payload.
-
-   4.  Transmit the message to the receiving entity as described in
-       section 5.1.
-
-   When an Identification payload is received, the receiving entity
-   (initiator or responder) MUST do the following:
-
-   1.  Determine if the Identification Type is supported.  This may be
-       based on the DOI and Situation.  If the Identification
-       determination fails, the message is discarded and the following
-       actions are taken:
-
-       (a)  The event, INVALID ID INFORMATION, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-ID-INFORMATION message type MAY be
-            sent to the transmitting entity.  This action is dictated by
-            a system security policy.
-
-5.9 Certificate Payload Processing
-
-   When creating a Certificate Payload, the transmitting entity
-   (initiator or responder) MUST do the following:
-
-   1.  Determine the Certificate Encoding to be used.  This may be
-       specified by the DOI.
-
-   2.  Ensure the existence of a certificate formatted as defined by the
-       Certificate Encoding.
-
-   3.  Construct a Certificate payload.
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 66]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   4.  Transmit the message to the receiving entity as described in
-       section 5.1.
-
-   When a Certificate payload is received, the receiving entity
-   (initiator or responder) MUST do the following:
-
-   1.  Determine if the Certificate Encoding is supported.  If the
-       Certificate Encoding is not supported, the payload is discarded
-       and the following actions are taken:
-
-       (a)  The event, INVALID CERTIFICATE TYPE, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-CERT-ENCODING message type MAY be
-            sent to the transmitting entity.  This action is dictated by
-            a system security policy.
-
-   2.  Process the Certificate Data field.  If the Certificate Data is
-       invalid or improperly formatted, the payload is discarded and the
-       following actions are taken:
-
-       (a)  The event, INVALID CERTIFICATE, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-CERTIFICATE message type MAY be sent
-            to the transmitting entity.  This action is dictated by a
-            system security policy.
-
-5.10 Certificate Request Payload Processing
-
-   When creating a Certificate Request Payload, the transmitting entity
-   (initiator or responder) MUST do the following:
-
-   1.  Determine the type of Certificate Encoding to be requested.  This
-       may be specified by the DOI.
-
-   2.  Determine the name of an acceptable Certificate Authority which
-       is to be requested (if applicable).
-
-   3.  Construct a Certificate Request payload.
-
-   4.  Transmit the message to the receiving entity as described in
-       section 5.1.
-
-   When a Certificate Request payload is received, the receiving entity
-   (initiator or responder) MUST do the following:
-
-
-
-Maughan, et. al.            Standards Track                    [Page 67]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   1.  Determine if the Certificate Encoding is supported.  If the
-       Certificate Encoding is invalid, the payload is discarded and the
-       following actions are taken:
-
-       (a)  The event, INVALID CERTIFICATE TYPE, MAY be logged in
-            the appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-CERT-ENCODING message type MAY be
-            sent to the transmitting entity.  This action is dictated by
-            a system security policy.
-
-       If the Certificate Encoding is not supported, the payload is
-       discarded and the following actions are taken:
-
-       (a)  The event, CERTIFICATE TYPE UNSUPPORTED, MAY be logged in
-            the appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the CERT-TYPE-UNSUPPORTED message type MAY be
-            sent to the transmitting entity.  This action is dictated by
-            a system security policy.
-
-   2.  Determine if the Certificate Authority is supported for the
-       specified Certificate Encoding.  If the Certificate Authority is
-       invalid or improperly formatted, the payload is discarded and the
-       following actions are taken:
-
-       (a)  The event, INVALID CERTIFICATE AUTHORITY, MAY be logged in
-            the appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-CERT-AUTHORITY message type MAY be
-            sent to the transmitting entity.  This action is dictated by
-            a system security policy.
-
-   3.  Process the Certificate Request.  If a requested Certificate Type
-       with the specified Certificate Authority is not available, then
-       the payload is discarded and the following actions are taken:
-
-       (a)  The event, CERTIFICATE-UNAVAILABLE, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the CERTIFICATE-UNAVAILABLE message type MAY be
-            sent to the transmitting entity.  This action is dictated by
-            a system security policy.
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 68]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-5.11 Hash Payload Processing
-
-   When creating a Hash Payload, the transmitting entity (initiator or
-   responder) MUST do the following:
-
-   1.  Determine the Hash function to be used as defined by the SA
-       negotiation.
-
-   2.  Determine the usage of the Hash Data field as defined by the DOI.
-
-   3.  Construct a Hash payload.
-
-   4.  Transmit the message to the receiving entity as described in
-       section 5.1.
-
-   When a Hash payload is received, the receiving entity (initiator or
-   responder) MUST do the following:
-
-   1.  Determine if the Hash is supported.  If the Hash determination
-       fails, the message is discarded and the following actions are
-       taken:
-
-       (a)  The event, INVALID HASH INFORMATION, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-HASH-INFORMATION message type MAY be
-            sent to the transmitting entity.  This action is dictated by
-            a system security policy.
-
-   2.  Perform the Hash function as outlined in the DOI and/or Key
-       Exchange protocol documents.  If the Hash function fails, the
-       message is discarded and the following actions are taken:
-
-       (a)  The event, INVALID HASH VALUE, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the AUTHENTICATION-FAILED message type MAY be
-            sent to the transmitting entity.  This action is dictated by
-            a system security policy.
-
-5.12 Signature Payload Processing
-
-   When creating a Signature Payload, the transmitting entity (initiator
-   or responder) MUST do the following:
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 69]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   1.  Determine the Signature function to be used as defined by the SA
-       negotiation.
-
-   2.  Determine the usage of the Signature Data field as defined by the
-       DOI.
-
-   3.  Construct a Signature payload.
-
-   4.  Transmit the message to the receiving entity as described in
-       section 5.1.
-
-   When a Signature payload is received, the receiving entity (initiator
-   or responder) MUST do the following:
-
-   1.  Determine if the Signature is supported.  If the Signature
-       determination fails, the message is discarded and the following
-       actions are taken:
-
-       (a)  The event, INVALID SIGNATURE INFORMATION, MAY be logged in
-            the appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the INVALID-SIGNATURE message type MAY be sent to
-            the transmitting entity.  This action is dictated by a
-            system security policy.
-
-   2.  Perform the Signature function as outlined in the DOI and/or Key
-       Exchange protocol documents.  If the Signature function fails,
-       the message is discarded and the following actions are taken:
-
-       (a)  The event, INVALID SIGNATURE VALUE, MAY be logged in the
-            appropriate system audit file.
-
-       (b)  An Informational Exchange with a Notification payload
-            containing the AUTHENTICATION-FAILED message type MAY be
-            sent to the transmitting entity.  This action is dictated by
-            a system security policy.
-
-5.13 Nonce Payload Processing
-
-   When creating a Nonce Payload, the transmitting entity (initiator or
-   responder) MUST do the following:
-
-   1.  Create a unique random value to be used as a nonce.
-
-   2.  Construct a Nonce payload.
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 70]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   3.  Transmit the message to the receiving entity as described in
-       section 5.1.
-
-   When a Nonce payload is received, the receiving entity (initiator or
-   responder) MUST do the following:
-
-   1.  There are no specific procedures for handling Nonce payloads.
-       The procedures are defined by the exchange types (and possibly
-       the DOI and Key Exchange descriptions).
-
-5.14 Notification Payload Processing
-
-   During communications it is possible that errors may occur.  The
-   Informational Exchange with a Notify Payload provides a controlled
-   method of informing a peer entity that errors have occurred during
-   protocol processing.  It is RECOMMENDED that Notify Payloads be sent
-   in a separate Informational Exchange rather than appending a Notify
-   Payload to an existing exchange.
-
-   When creating a Notification Payload, the transmitting entity
-   (initiator or responder) MUST do the following:
-
-   1.  Determine the DOI for this Notification.
-
-   2.  Determine the Protocol-ID for this Notification.
-
-   3.  Determine the SPI size based on the Protocol-ID field.  This
-       field is necessary because different security protocols have
-       different SPI sizes.  For example, ISAKMP combines the Initiator
-       and Responder cookie pair (16 octets) as a SPI, while ESP and AH
-       have 4 octet SPIs.
-
-   4.  Determine the Notify Message Type based on the error or status
-       message desired.
-
-   5.  Determine the SPI which is associated with this notification.
-
-   6.  Determine if additional Notification Data is to be included.
-       This is additional information specified by the DOI.
-
-   7.  Construct a Notification payload.
-
-   8.  Transmit the message to the receiving entity as described in
-       section 5.1.
-
-   Because the Informational Exchange with a Notification payload is a
-   unidirectional message a retransmission will not be performed.  The
-   local security policy will dictate the procedures for continuing.
-
-
-
-Maughan, et. al.            Standards Track                    [Page 71]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   However, we RECOMMEND that a NOTIFICATION PAYLOAD ERROR event be
-   logged in the appropriate system audit file by the receiving entity.
-
-   If the Informational Exchange occurs prior to the exchange of keying
-   material during an ISAKMP Phase 1 negotiation there will be no
-   protection provided for the Informational Exchange.  Once the keying
-   material has been exchanged or the ISAKMP SA has been established,
-   the Informational Exchange MUST be transmitted under the protection
-   provided by the keying material or the ISAKMP SA.
-
-   When a Notification payload is received, the receiving entity
-   (initiator or responder) MUST do the following:
-
-   1.  Determine if the Informational Exchange has any protection
-       applied to it by checking the Encryption Bit and the
-       Authentication Only Bit in the ISAKMP Header.  If the Encryption
-       Bit is set, i.e.  the Informational Exchange is encrypted, then
-       the message MUST be decrypted using the (in-progress or
-       completed) ISAKMP SA. Once the decryption is complete the
-       processing can continue as described below.  If the
-       Authentication Only Bit is set, then the message MUST be
-       authenticated using the (in-progress or completed) ISAKMP SA.
-       Once the authentication is completed, the processing can continue
-       as described below.  If the Informational Exchange is not
-       encrypted or authentication, the payload processing can continue
-       as described below.
-
-   2.  Determine if the Domain of Interpretation (DOI) is supported.  If
-       the DOI determination fails, the payload is discarded and the
-       following action is taken:
-
-       (a)  The event, INVALID DOI, MAY be logged in the appropriate
-            system audit file.
-
-   3.  Determine if the Protocol-Id is supported.  If the Protocol-Id
-       determination fails, the payload is discarded and the following
-       action is taken:
-
-       (a)  The event, INVALID PROTOCOL-ID, MAY be logged in the
-            appropriate system audit file.
-
-   4.  Determine if the SPI is valid.  If the SPI is invalid, the
-       payload is discarded and the following action is taken:
-
-       (a)  The event, INVALID SPI, MAY be logged in the appropriate
-            system audit file.
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 72]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   5.  Determine if the Notify Message Type is valid.  If the Notify
-       Message Type is invalid, the payload is discarded and the
-       following action is taken:
-
-       (a)  The event, INVALID MESSAGE TYPE, MAY be logged in the
-            appropriate system audit file.
-
-   6.  Process the Notification payload, including additional
-       Notification Data, and take appropriate action, according to
-       local security policy.
-
-5.15 Delete Payload Processing
-
-   During communications it is possible that hosts may be compromised or
-   that information may be intercepted during transmission.  Determining
-   whether this has occurred is not an easy task and is outside the
-   scope of this memo.  However, if it is discovered that transmissions
-   are being compromised, then it is necessary to establish a new SA and
-   delete the current SA.
-
-   The Informational Exchange with a Delete Payload provides a
-   controlled method of informing a peer entity that the transmitting
-   entity has deleted the SA(s).  Deletion of Security Associations MUST
-   always be performed under the protection of an ISAKMP SA. The
-   receiving entity SHOULD clean up its local SA database.  However,
-   upon receipt of a Delete message the SAs listed in the Security
-   Parameter Index (SPI) field of the Delete payload cannot be used with
-   the transmitting entity.  The SA Establishment procedure must be
-   invoked to re-establish secure communications.
-
-   When creating a Delete Payload, the transmitting entity (initiator or
-   responder) MUST do the following:
-
-   1.  Determine the DOI for this Deletion.
-
-   2.  Determine the Protocol-ID for this Deletion.
-
-   3.  Determine the SPI size based on the Protocol-ID field.  This
-       field is necessary because different security protocols have
-       different SPI sizes.  For example, ISAKMP combines the Initiator
-       and Responder cookie pair (16 octets) as a SPI, while ESP and AH
-       have 4 octet SPIs.
-
-   4.  Determine the # of SPIs to be deleted for this protocol.
-
-   5.  Determine the SPI(s) which is (are) associated with this
-       deletion.
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 73]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   6.  Construct a Delete payload.
-
-   7.  Transmit the message to the receiving entity as described in
-       section 5.1.
-
-   Because the Informational Exchange with a Delete payload is a
-   unidirectional message a retransmission will not be performed.  The
-   local security policy will dictate the procedures for continuing.
-   However, we RECOMMEND that a DELETE PAYLOAD ERROR event be logged in
-   the appropriate system audit file by the receiving entity.
-
-   As described above, the Informational Exchange with a Delete payload
-   MUST be transmitted under the protection provided by an ISAKMP SA.
-
-   When a Delete payload is received, the receiving entity (initiator or
-   responder) MUST do the following:
-
-   1.  Because the Informational Exchange is protected by some security
-       service (e.g.  authentication for an Auth-Only SA, encryption for
-       other exchanges), the message MUST have these security services
-       applied using the ISAKMP SA. Once the security service processing
-       is complete the processing can continue as described below.  Any
-       errors that occur during the security service processing will be
-       evident when checking information in the Delete payload.  The
-       local security policy SHOULD dictate any action to be taken as a
-       result of security service processing errors.
-
-   2.  Determine if the Domain of Interpretation (DOI) is supported.  If
-       the DOI determination fails, the payload is discarded and the
-       following action is taken:
-
-       (a)  The event, INVALID DOI, MAY be logged in the appropriate
-            system audit file.
-
-   3.  Determine if the Protocol-Id is supported.  If the Protocol-Id
-       determination fails, the payload is discarded and the following
-       action is taken:
-
-       (a)  The event, INVALID PROTOCOL-ID, MAY be logged in the
-            appropriate system audit file.
-
-   4.  Determine if the SPI is valid for each SPI included in the Delete
-       payload.  For each SPI that is invalid, the following action is
-       taken:
-
-       (a)  The event, INVALID SPI, MAY be logged in the appropriate
-            system audit file.
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 74]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   5.  Process the Delete payload and take appropriate action, according
-       to local security policy.  As described above, one appropriate
-       action SHOULD include cleaning up the local SA database.
-
-6 Conclusions
-
-   The Internet Security Association and Key Management Protocol
-   (ISAKMP) is a well designed protocol aimed at the Internet of the
-   future.  The massive growth of the Internet will lead to great
-   diversity in network utilization, communications, security
-   requirements, and security mechanisms.  ISAKMP contains all the
-   features that will be needed for this dynamic and expanding
-   communications environment.
-
-   ISAKMP's Security Association (SA) feature coupled with
-   authentication and key establishment provides the security and
-   flexibility that will be needed for future growth and diversity.
-   This security diversity of multiple key exchange techniques,
-   encryption algorithms, authentication mechanisms, security services,
-   and security attributes will allow users to select the appropriate
-   security for their network, communications, and security needs.  The
-   SA feature allows users to specify and negotiate security
-   requirements with other users.  An additional benefit of supporting
-   multiple techniques in a single protocol is that as new techniques
-   are developed they can easily be added to the protocol.  This
-   provides a path for the growth of Internet security services.  ISAKMP
-   supports both publicly or privately defined SAs, making it ideal for
-   government, commercial, and private communications.
-
-   ISAKMP provides the ability to establish SAs for multiple security
-   protocols and applications.  These protocols and applications may be
-   session-oriented or sessionless.  Having one SA establishment
-   protocol that supports multiple security protocols eliminates the
-   need for multiple, nearly identical authentication, key exchange and
-   SA establishment protocols when more than one security protocol is in
-   use or desired.  Just as IP has provided the common networking layer
-   for the Internet, a common security establishment protocol is needed
-   if security is to become a reality on the Internet.  ISAKMP provides
-   the common base that allows all other security protocols to
-   interoperate.
-
-   ISAKMP follows good security design principles.  It is not coupled to
-   other insecure transport protocols, therefore it is not vulnerable or
-   weakened by attacks on other protocols.  Also, when more secure
-   transport protocols are developed, ISAKMP can be easily migrated to
-   them.  ISAKMP also provides protection against protocol related
-   attacks.  This protection provides the assurance that the SAs and
-   keys established are with the desired party and not with an attacker.
-
-
-
-Maughan, et. al.            Standards Track                    [Page 75]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   ISAKMP also follows good protocol design principles.  Protocol
-   specific information only is in the protocol header, following the
-   design principles of IPv6.  The data transported by the protocol is
-   separated into functional payloads.  As the Internet grows and
-   evolves, new payloads to support new security functionality can be
-   added without modifying the entire protocol.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 76]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-A ISAKMP Security Association Attributes
-
-A.1 Background/Rationale
-
-   As detailed in previous sections, ISAKMP is designed to provide a
-   flexible and extensible framework for establishing and managing
-   Security Associations and cryptographic keys.  The framework provided
-   by ISAKMP consists of header and payload definitions, exchange types
-   for guiding message and payload exchanges, and general processing
-   guidelines.  ISAKMP does not define the mechanisms that will be used
-   to establish and manage Security Associations and cryptographic keys
-   in an authenticated and confidential manner.  The definition of
-   mechanisms and their application is the purview of individual Domains
-   of Interpretation (DOIs).
-
-   This section describes the ISAKMP values for the Internet IP Security
-   DOI, supported security protocols, and identification values for
-   ISAKMP Phase 1 negotiations.  The Internet IP Security DOI is
-   MANDATORY to implement for IP Security.  [Oakley] and [IKE] describe,
-   in detail, the mechanisms and their application for establishing and
-   managing Security Associations and cryptographic keys for IP
-   Security.
-
-A.2 Internet IP Security DOI Assigned Value
-
-   As described in [IPDOI], the Internet IP Security DOI Assigned Number
-   is one (1).
-
-A.3 Supported Security Protocols
-
-   Values for supported security protocols are specified in the most
-   recent "Assigned Numbers" RFC [STD-2].  Presented in the following
-   table are the values for the security protocols supported by ISAKMP
-   for the Internet IP Security DOI.
-
-
-                       Protocol Assigned Value
-                       RESERVED        0
-                       ISAKMP          1
-
-   All DOIs MUST reserve ISAKMP with a Protocol-ID of 1.  All other
-   security protocols within that DOI will be numbered accordingly.
-
-   Security protocol values 2-15359 are reserved to IANA for future use.
-   Values 15360-16383 are permanently reserved for private use amongst
-   mutually consenting implementations.  Such private use values are
-   unlikely to be interoperable across different implementations.
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 77]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-A.4 ISAKMP Identification Type Values
-
-   The following table lists the assigned values for the Identification
-   Type field found in the Identification payload during a generic Phase
-   1 exchange, which is not for a specific protocol.
-
-
-                              ID Type       Value
-                        ID_IPV4_ADDR          0
-                        ID_IPV4_ADDR_SUBNET   1
-                        ID_IPV6_ADDR          2
-                        ID_IPV6_ADDR_SUBNET   3
-
-A.4.1 ID_IPV4_ADDR
-
-   The ID_IPV4_ADDR type specifies a single four (4) octet IPv4 address.
-
-A.4.2 ID_IPV4_ADDR_SUBNET
-
-   The ID_IPV4_ADDR_SUBNET type specifies a range of IPv4 addresses,
-   represented by two four (4) octet values.  The first value is an IPv4
-   address.  The second is an IPv4 network mask.  Note that ones (1s) in
-   the network mask indicate that the corresponding bit in the address
-   is fixed, while zeros (0s) indicate a "wildcard" bit.
-
-A.4.3 ID_IPV6_ADDR
-
-   The ID_IPV6_ADDR type specifies a single sixteen (16) octet IPv6
-   address.
-
-A.4.4 ID_IPV6_ADDR_SUBNET
-
-   The ID_IPV6_ADDR_SUBNET type specifies a range of IPv6 addresses,
-   represented by two sixteen (16) octet values.  The first value is an
-   IPv6 address.  The second is an IPv6 network mask.  Note that ones
-   (1s) in the network mask indicate that the corresponding bit in the
-   address is fixed, while zeros (0s) indicate a "wildcard" bit.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 78]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-B Defining a new Domain of Interpretation
-
-   The Internet DOI may be sufficient to meet the security requirements
-   of a large portion of the internet community.  However, some groups
-   may have a need to customize some aspect of a DOI, perhaps to add a
-   different set of cryptographic algorithms, or perhaps because they
-   want to make their security-relevant decisions based on something
-   other than a host id or user id.  Also, a particular group may have a
-   need for a new exchange type, for example to support key management
-   for multicast groups.
-
-   This section discusses guidelines for defining a new DOI. The full
-   specification for the Internet DOI can be found in [IPDOI].
-
-   Defining a new DOI is likely to be a time-consuming process.  If at
-   all possible, it is recommended that the designer begin with an
-   existing DOI and customize only the parts that are unacceptable.
-
-   If a designer chooses to start from scratch, the following MUST be
-   defined:
-
-    o  A "situation":  the set of information that will be used to
-       determine the required security services.
-
-    o  The set of security policies that must be supported.
-
-    o  A scheme for naming security-relevant information, including
-       encryption algorithms, key exchange algorithms, etc.
-
-    o  A syntax for the specification of proposed security services,
-       attributes, and certificate authorities.
-
-    o  The specific formats of the various payload contents.
-
-    o  Additional exchange types, if required.
-
-B.1 Situation
-
-   The situation is the basis for deciding how to protect a
-   communications channel.  It must contain all of the data that will be
-   used to determine the types and strengths of protections applied in
-   an SA. For example, a US Department of Defense DOI would probably use
-   unpublished algorithms and have additional special attributes to
-   negotiate.  These additional security attributes would be included in
-   the situation.
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 79]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-B.2 Security Policies
-
-   Security policies define how various types of information must be
-   categorized and protected.  The DOI must define the set of security
-   policies supported, because both parties in a negotiation must trust
-   that the other party understands a situation, and will protect
-   information appropriately, both in transit and in storage.  In a
-   corporate setting, for example, both parties in a negotiation must
-   agree to the meaning of the term "proprietary information" before
-   they can negotiate how to protect it.
-
-   Note that including the required security policies in the DOI only
-   specifies that the participating hosts understand and implement those
-   policies in a full system context.
-
-B.3 Naming Schemes
-
-   Any DOI must define a consistent way to name cryptographic
-   algorithms, certificate authorities, etc.  This can usually be done
-   by using IANA naming conventions, perhaps with some private
-   extensions.
-
-B.4 Syntax for Specifying Security Services
-
-   In addition to simply specifying how to name entities, the DOI must
-   also specify the format for complete proposals of how to protect
-   traffic under a given situation.
-
-B.5 Payload Specification
-
-   The DOI must specify the format of each of the payload types.  For
-   several of the payload types, ISAKMP has included fields that would
-   have to be present across all DOI (such as a certificate authority in
-   the certificate payload, or a key exchange identifier in the key
-   exchange payload).
-
-B.6 Defining new Exchange Types
-
-   If the basic exchange types are inadequate to meet the requirements
-   within a DOI, a designer can define up to thirteen extra exchange
-   types per DOI.  The designer creates a new exchange type by choosing
-   an unused exchange type value, and defining a sequence of messages
-   composed of strings of the ISAKMP payload types.
-
-   Note that any new exchange types must be rigorously analyzed for
-   vulnerabilities.  Since this is an expensive and imprecise
-   undertaking, a new exchange type should only be created when
-   absolutely necessary.
-
-
-
-Maughan, et. al.            Standards Track                    [Page 80]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-Security Considerations
-
-   Cryptographic analysis techniques are improving at a steady pace.
-   The continuing improvement in processing power makes once
-   computationally prohibitive cryptographic attacks more realistic.
-   New cryptographic algorithms and public key generation techniques are
-   also being developed at a steady pace.  New security services and
-   mechanisms are being developed at an accelerated pace.  A consistent
-   method of choosing from a variety of security services and mechanisms
-   and to exchange attributes required by the mechanisms is important to
-   security in the complex structure of the Internet.  However, a system
-   that locks itself into a single cryptographic algorithm, key exchange
-   technique, or security mechanism will become increasingly vulnerable
-   as time passes.
-
-   UDP is an unreliable datagram protocol and therefore its use in
-   ISAKMP introduces a number of security considerations.  Since UDP is
-   unreliable, but a key management protocol must be reliable, the
-   reliability is built into ISAKMP. While ISAKMP utilizes UDP as its
-   transport mechanism, it doesn't rely on any UDP information (e.g.
-   checksum, length) for its processing.
-
-   Another issue that must be considered in the development of ISAKMP is
-   the effect of firewalls on the protocol.  Many firewalls filter out
-   all UDP packets, making reliance on UDP questionable in certain
-   environments.
-
-   A number of very important security considerations are presented in
-   [SEC-ARCH].  One bears repeating.  Once a private session key is
-   created, it must be safely stored.  Failure to properly protect the
-   private key from access both internal and external to the system
-   completely nullifies any protection provided by the IP Security
-   services.
-
-IANA Considerations
-
-   This document contains many "magic" numbers to be maintained by the
-   IANA.  This section explains the criteria to be used by the IANA to
-   assign additional numbers in each of these lists.
-
-Domain of Interpretation
-
-   The Domain of Interpretation (DOI) is a 32-bit field which identifies
-   the domain under which the security association negotiation is taking
-   place.  Requests for assignments of new DOIs must be accompanied by a
-   standards-track RFC which describes the specific domain.
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 81]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-Supported Security Protocols
-
-   ISAKMP is designed to provide security association negotiation and
-   key management for many security protocols.  Requests for identifiers
-   for additional security protocols must be accompanied by a
-   standards-track RFC which describes the security protocol and its
-   relationship to ISAKMP.
-
-Acknowledgements
-
-   Dan Harkins, Dave Carrel, and Derrell Piper of Cisco Systems provided
-   design assistance with the protocol and coordination for the [IKE]
-   and [IPDOI] documents.
-
-   Hilarie Orman, via the Oakley key exchange protocol, has
-   significantly influenced the design of ISAKMP.
-
-   Marsha Gross, Bill Kutz, Mike Oehler, Pete Sell, and Ruth Taylor
-   provided significant input and review to this document.
-
-   Scott Carlson ported the TIS DNSSEC prototype to FreeBSD for use with
-   the ISAKMP prototype.
-
-   Jeff Turner and Steve Smalley contributed to the prototype
-   development and integration with ESP and AH.
-
-   Mike Oehler and Pete Sell performed interoperability testing with
-   other ISAKMP implementors.
-
-   Thanks to Carl Muckenhirn of SPARTA, Inc.  for his assistance with
-   LaTeX.
-
-References
-
-   [ANSI]     ANSI, X9.42:  Public Key Cryptography for the Financial
-              Services Industry -- Establishment of Symmetric Algorithm
-              Keys Using Diffie-Hellman, Working Draft, April 19, 1996.
-
-   [BC]       Ballardie, A., and J. Crowcroft, Multicast-specific
-              Security Threats and Countermeasures, Proceedings of 1995
-              ISOC Symposium on Networks & Distributed Systems Security,
-              pp. 17-30, Internet Society, San Diego, CA, February 1995.
-
-   [Berge]    Berge, N., "UNINETT PCA Policy Statements", RFC 1875,
-              December 1995.
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 82]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   [CW87]     Clark, D.D. and D.R. Wilson, A Comparison of Commercial
-              and Military Computer Security Policies, Proceedings of
-              the IEEE Symposium on Security & Privacy, Oakland, CA,
-              1987, pp. 184-193.
-
-   [DNSSEC]   D. Eastlake III, Domain Name System Protocol Security
-              Extensions, Work in Progress.
-
-   [DOW92]    Diffie, W., M.Wiener, P. Van Oorschot, Authentication and
-              Authenticated Key Exchanges, Designs, Codes, and
-              Cryptography, 2, 107-125, Kluwer Academic Publishers,
-              1992.
-
-   [IAB]      Bellovin, S., "Report of the IAB Security Architecture
-              Workshop", RFC 2316, April 1998.
-
-   [IKE]      Harkins, D., and D. Carrel, "The Internet Key Exchange
-              (IKE)", RFC 2409, November 1998.
-
-   [IPDOI]    Piper, D., "The Internet IP Security Domain of
-              Interpretation for ISAKMP", RFC 2407, November 1998.
-
-   [Karn]     Karn, P., and B. Simpson, Photuris:  Session Key
-              Management Protocol, Work in Progress.
-
-   [Kent94]   Steve Kent, IPSEC SMIB, e-mail to ipsec@ans.net, August
-              10, 1994.
-
-   [Oakley]   Orman, H., "The Oakley Key Determination Protocol",  RFC
-              2412, November 1998.
-
-   [RFC-1422] Kent, S., "Privacy Enhancement for Internet Electronic
-              Mail:  Part II: Certificate-Based Key Management", RFC
-              1422, February 1993.
-
-   [RFC-1949] Ballardie, A., "Scalable Multicast Key Distribution", RFC
-              1949, May 1996.
-
-   [RFC-2093] Harney, H., and C. Muckenhirn, "Group Key Management
-              Protocol (GKMP) Specification", RFC 2093, July 1997.
-
-   [RFC-2094] Harney, H., and C. Muckenhirn, "Group Key Management
-              Protocol (GKMP) Architecture", RFC 2094, July 1997.
-
-   [RFC-2119] Bradner, S., "Key Words for use in RFCs to Indicate
-              Requirement Levels", BCP 14, RFC 2119, March 1997.
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 83]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-   [Schneier] Bruce Schneier, Applied Cryptography - Protocols,
-              Algorithms, and Source Code in C (Second Edition), John
-              Wiley & Sons, Inc., 1996.
-
-   [SEC-ARCH] Atkinson, R., and S. Kent, "Security Architecture for the
-              Internet Protocol", RFC 2401, November 1998.
-
-   [STD-2]   Reynolds, J., and J. Postel, "Assigned Numbers", STD 2, RFC
-              1700, October 1994.  See also:
-              http://www.iana.org/numbers.html
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 84]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-Authors' Addresses
-
-   Douglas Maughan
-   National Security Agency
-   ATTN: R23
-   9800 Savage Road
-   Ft.  Meade, MD. 20755-6000
-
-   Phone:  301-688-0847
-   EMail:wdm@tycho.ncsc.mil
-
-
-   Mark Schneider
-   National Security Agency
-   ATTN: R23
-   9800 Savage Road
-   Ft.  Meade, MD. 20755-6000
-
-   Phone:  301-688-0851
-   EMail:mss@tycho.ncsc.mil
-
-
-   Mark Schertler
-   Securify, Inc.
-   2415-B Charleston Road
-   Mountain View, CA 94043
-
-   Phone:  650-934-9303
-   EMail:mjs@securify.com
-
-
-   Jeff Turner
-   RABA Technologies, Inc.
-   10500 Little Patuxent Parkway
-   Columbia, MD. 21044
-
-   Phone:  410-715-9399
-   EMail:jeff.turner@raba.com
-
-
-
-
-
-
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 85]
-
-RFC 2408                         ISAKMP                    November 1998
-
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society (1998).  All Rights Reserved.
-
-   This document and translations of it may be copied and furnished to
-   others, and derivative works that comment on or otherwise explain it
-   or assist in its implementation may be prepared, copied, published
-   and distributed, in whole or in part, without restriction of any
-   kind, provided that the above copyright notice and this paragraph are
-   included on all such copies and derivative works.  However, this
-   document itself may not be modified in any way, such as by removing
-   the copyright notice or references to the Internet Society or other
-   Internet organizations, except as needed for the purpose of
-   developing Internet standards in which case the procedures for
-   copyrights defined in the Internet Standards process must be
-   followed, or as required to translate it into languages other than
-   English.
-
-   The limited permissions granted above are perpetual and will not be
-   revoked by the Internet Society or its successors or assigns.
-
-   This document and the information contained herein is provided on an
-   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
-   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
-   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
-   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Maughan, et. al.            Standards Track                    [Page 86]
-
diff --git a/doc/ikev2/[RFC2409] - The Internet Key Exchange (IKE).txt b/doc/ikev2/[RFC2409] - The Internet Key Exchange (IKE).txt
deleted file mode 100644
index 9d3e6f80e..000000000
--- a/doc/ikev2/[RFC2409] - The Internet Key Exchange (IKE).txt
+++ /dev/null
@@ -1,2299 +0,0 @@
-
-
-
-
-
-
-Network Working Group                                         D. Harkins
-Request for Comments: 2409                                     D. Carrel
-Category: Standards Track                                  cisco Systems
-                                                           November 1998
-
-
-                    The Internet Key Exchange (IKE)
-
-Status of this Memo
-
-   This document specifies an Internet standards track protocol for the
-   Internet community, and requests discussion and suggestions for
-   improvements.  Please refer to the current edition of the "Internet
-   Official Protocol Standards" (STD 1) for the standardization state
-   and status of this protocol.  Distribution of this memo is unlimited.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (1998).  All Rights Reserved.
-
-Table Of Contents
-
-   1 Abstract........................................................  2
-   2 Discussion......................................................  2
-   3 Terms and Definitions...........................................  3
-   3.1 Requirements Terminology......................................  3
-   3.2 Notation......................................................  3
-   3.3 Perfect Forward Secrecty......................................  5
-   3.4 Security Association..........................................  5
-   4 Introduction....................................................  5
-   5 Exchanges.......................................................  8
-   5.1 Authentication with Digital Signatures........................ 10
-   5.2 Authentication with Public Key Encryption..................... 12
-   5.3 A Revised method of Authentication with Public Key Encryption. 13
-   5.4 Authentication with a Pre-Shared Key.......................... 16
-   5.5 Quick Mode.................................................... 16
-   5.6 New Group Mode................................................ 20
-   5.7 ISAKMP Informational Exchanges................................ 20
-   6 Oakley Groups................................................... 21
-   6.1 First Oakley Group............................................ 21
-   6.2 Second Oakley Group........................................... 22
-   6.3 Third Oakley Group............................................ 22
-   6.4 Fourth Oakley Group........................................... 23
-   7 Payload Explosion of Complete Exchange.......................... 23
-   7.1 Phase 1 with Main Mode........................................ 23
-   7.2 Phase 2 with Quick Mode....................................... 25
-   8 Perfect Forward Secrecy Example................................. 27
-   9 Implementation Hints............................................ 27
-
-
-
-Harkins & Carrel            Standards Track                     [Page 1]
-
-RFC 2409                          IKE                      November 1998
-
-
-   10 Security Considerations........................................ 28
-   11 IANA Considerations............................................ 30
-   12 Acknowledgments................................................ 31
-   13 References..................................................... 31
-   Appendix A........................................................ 33
-   Appendix B........................................................ 37
-   Authors' Addresses................................................ 40
-   Authors' Note..................................................... 40
-   Full Copyright Statement.......................................... 41
-
-1. Abstract
-
-   ISAKMP ([MSST98]) provides a framework for authentication and key
-   exchange but does not define them.  ISAKMP is designed to be key
-   exchange independant; that is, it is designed to support many
-   different key exchanges.
-
-   Oakley ([Orm96]) describes a series of key exchanges-- called
-   "modes"-- and details the services provided by each (e.g. perfect
-   forward secrecy for keys, identity protection, and authentication).
-
-   SKEME ([SKEME]) describes a versatile key exchange technique which
-   provides anonymity, repudiability, and quick key refreshment.
-
-   This document describes a protocol using part of Oakley and part of
-   SKEME in conjunction with ISAKMP to obtain authenticated keying
-   material for use with ISAKMP, and for other security associations
-   such as AH and ESP for the IETF IPsec DOI.
-
-2. Discussion
-
-   This memo describes a hybrid protocol. The purpose is to negotiate,
-   and provide authenticated keying material for, security associations
-   in a protected manner.
-
-   Processes which implement this memo can be used for negotiating
-   virtual private networks (VPNs) and also for providing a remote user
-   from a remote site (whose IP address need not be known beforehand)
-   access to a secure host or network.
-
-   Client negotiation is supported.  Client mode is where the
-   negotiating parties are not the endpoints for which security
-   association negotiation is taking place.  When used in client mode,
-   the identities of the end parties remain hidden.
-
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                     [Page 2]
-
-RFC 2409                          IKE                      November 1998
-
-
-   This does not implement the entire Oakley protocol, but only a subset
-   necessary to satisfy its goals. It does not claim conformance or
-   compliance with the entire Oakley protocol nor is it dependant in any
-   way on the Oakley protocol.
-
-   Likewise, this does not implement the entire SKEME protocol, but only
-   the method of public key encryption for authentication and its
-   concept of fast re-keying using an exchange of nonces. This protocol
-   is not dependant in any way on the SKEME protocol.
-
-3. Terms and Definitions
-
-3.1 Requirements Terminology
-
-   Keywords "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT" and
-   "MAY" that appear in this document are to be interpreted as described
-   in [Bra97].
-
-3.2 Notation
-
-   The following notation is used throughout this memo.
-
-     HDR is an ISAKMP header whose exchange type is the mode.  When
-     writen as HDR* it indicates payload encryption.
-
-     SA is an SA negotiation payload with one or more proposals. An
-     initiator MAY provide multiple proposals for negotiation; a
-     responder MUST reply with only one.
-
-     <P>_b indicates the body of payload <P>-- the ISAKMP generic
-     vpayload is not included.
-
-     SAi_b is the entire body of the SA payload (minus the ISAKMP
-     generic header)-- i.e. the DOI, situation, all proposals and all
-     transforms offered by the Initiator.
-
-     CKY-I and CKY-R are the Initiator's cookie and the Responder's
-     cookie, respectively, from the ISAKMP header.
-
-     g^xi and g^xr are the Diffie-Hellman ([DH]) public values of the
-     initiator and responder respectively.
-
-     g^xy is the Diffie-Hellman shared secret.
-
-     KE is the key exchange payload which contains the public
-     information exchanged in a Diffie-Hellman exchange. There is no
-     particular encoding (e.g. a TLV) used for the data of a KE payload.
-
-
-
-
-Harkins & Carrel            Standards Track                     [Page 3]
-
-RFC 2409                          IKE                      November 1998
-
-
-     Nx is the nonce payload; x can be: i or r for the ISAKMP initiator
-     and responder respectively.
-
-     IDx is the identification payload for "x".  x can be: "ii" or "ir"
-     for the ISAKMP initiator and responder respectively during phase
-     one negotiation; or "ui" or "ur" for the user initiator and
-     responder respectively during phase two.  The ID payload format for
-     the Internet DOI is defined in [Pip97].
-
-     SIG is the signature payload. The data to sign is exchange-
-     specific.
-
-     CERT is the certificate payload.
-
-     HASH (and any derivitive such as HASH(2) or HASH_I) is the hash
-     payload. The contents of the hash are specific to the
-     authentication method.
-
-     prf(key, msg) is the keyed pseudo-random function-- often a keyed
-     hash function-- used to generate a deterministic output that
-     appears pseudo-random.  prf's are used both for key derivations and
-     for authentication (i.e. as a keyed MAC). (See [KBC96]).
-
-     SKEYID is a string derived from secret material known only to the
-     active players in the exchange.
-
-     SKEYID_e is the keying material used by the ISAKMP SA to protect
-     the confidentiality of its messages.
-
-     SKEYID_a is the keying material used by the ISAKMP SA to
-     authenticate its messages.
-
-     SKEYID_d is the keying material used to derive keys for non-ISAKMP
-     security associations.
-
-     <x>y indicates that "x" is encrypted with the key "y".
-
-     --> signifies "initiator to responder" communication (requests).
-
-     <-- signifies "responder to initiator" communication (replies).
-
-      |  signifies concatenation of information-- e.g. X | Y is the
-     concatentation of X with Y.
-
-     [x] indicates that x is optional.
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                     [Page 4]
-
-RFC 2409                          IKE                      November 1998
-
-
-   Message encryption (when noted by a '*' after the ISAKMP header) MUST
-   begin immediately after the ISAKMP header. When communication is
-   protected, all payloads following the ISAKMP header MUST be
-   encrypted.  Encryption keys are generated from SKEYID_e in a manner
-   that is defined for each algorithm.
-
-3.3 Perfect Forward Secrecy
-
-   When used in the memo Perfect Forward Secrecy (PFS) refers to the
-   notion that compromise of a single key will permit access to only
-   data protected by a single key. For PFS to exist the key used to
-   protect transmission of data MUST NOT be used to derive any
-   additional keys, and if the key used to protect transmission of data
-   was derived from some other keying material, that material MUST NOT
-   be used to derive any more keys.
-
-   Perfect Forward Secrecy for both keys and identities is provided in
-   this protocol. (Sections 5.5 and 8).
-
-3.4 Security Association
-
-   A security association (SA) is a set of policy and key(s) used to
-   protect information. The ISAKMP SA is the shared policy and key(s)
-   used by the negotiating peers in this protocol to protect their
-   communication.
-
-4. Introduction
-
-   Oakley and SKEME each define a method to establish an authenticated
-   key exchange. This includes payloads construction, the information
-   payloads carry, the order in which they are processed and how they
-   are used.
-
-   While Oakley defines "modes", ISAKMP defines "phases".  The
-   relationship between the two is very straightforward and IKE presents
-   different exchanges as modes which operate in one of two phases.
-
-   Phase 1 is where the two ISAKMP peers establish a secure,
-   authenticated channel with which to communicate.  This is called the
-   ISAKMP Security Association (SA). "Main Mode" and "Aggressive Mode"
-   each accomplish a phase 1 exchange. "Main Mode" and "Aggressive Mode"
-   MUST ONLY be used in phase 1.
-
-   Phase 2 is where Security Associations are negotiated on behalf of
-   services such as IPsec or any other service which needs key material
-   and/or parameter negotiation. "Quick Mode" accomplishes a phase 2
-   exchange. "Quick Mode" MUST ONLY be used in phase 2.
-
-
-
-
-Harkins & Carrel            Standards Track                     [Page 5]
-
-RFC 2409                          IKE                      November 1998
-
-
-   "New Group Mode" is not really a phase 1 or phase 2.  It follows
-   phase 1, but serves to establish a new group which can be used in
-   future negotiations. "New Group Mode" MUST ONLY be used after phase
-   1.
-
-   The ISAKMP SA is bi-directional. That is, once established, either
-   party may initiate Quick Mode, Informational, and New Group Mode
-   Exchanges.  Per the base ISAKMP document, the ISAKMP SA is identified
-   by the Initiator's cookie followed by the Responder's cookie-- the
-   role of each party in the phase 1 exchange dictates which cookie is
-   the Initiator's. The cookie order established by the phase 1 exchange
-   continues to identify the ISAKMP SA regardless of the direction the
-   Quick Mode, Informational, or New Group exchange. In other words, the
-   cookies MUST NOT swap places when the direction of the ISAKMP SA
-   changes.
-
-   With the use of ISAKMP phases, an implementation can accomplish very
-   fast keying when necessary.  A single phase 1 negotiation may be used
-   for more than one phase 2 negotiation.  Additionally a single phase 2
-   negotiation can request multiple Security Associations.  With these
-   optimizations, an implementation can see less than one round trip per
-   SA as well as less than one DH exponentiation per SA.  "Main Mode"
-   for phase 1 provides identity protection.  When identity protection
-   is not needed, "Aggressive Mode" can be used to reduce round trips
-   even further.  Developer hints for doing these optimizations are
-   included below. It should also be noted that using public key
-   encryption to authenticate an Aggressive Mode exchange will still
-   provide identity protection.
-
-   This protocol does not define its own DOI per se. The ISAKMP SA,
-   established in phase 1, MAY use the DOI and situation from a non-
-   ISAKMP service (such as the IETF IPSec DOI [Pip97]). In this case an
-   implementation MAY choose to restrict use of the ISAKMP SA for
-   establishment of SAs for services of the same DOI. Alternately, an
-   ISAKMP SA MAY be established with the value zero in both the DOI and
-   situation (see [MSST98] for a description of these fields) and in
-   this case implementations will be free to establish security services
-   for any defined DOI using this ISAKMP SA. If a DOI of zero is used
-   for establishment of a phase 1 SA, the syntax of the identity
-   payloads used in phase 1 is that defined in [MSST98] and not from any
-   DOI-- e.g. [Pip97]-- which may further expand the syntax and
-   semantics of identities.
-
-   The following attributes are used by IKE and are negotiated as part
-   of the ISAKMP Security Association.  (These attributes pertain only
-   to the ISAKMP Security Association and not to any Security
-   Associations that ISAKMP may be negotiating on behalf of other
-   services.)
-
-
-
-Harkins & Carrel            Standards Track                     [Page 6]
-
-RFC 2409                          IKE                      November 1998
-
-
-      - encryption algorithm
-
-      - hash algorithm
-
-      - authentication method
-
-      - information about a group over which to do Diffie-Hellman.
-
-   All of these attributes are mandatory and MUST be negotiated. In
-   addition, it is possible to optionally negotiate a psuedo-random
-   function ("prf").  (There are currently no negotiable pseudo-random
-   functions defined in this document. Private use attribute values can
-   be used for prf negotiation between consenting parties). If a "prf"
-   is not negotiation, the HMAC (see [KBC96]) version of the negotiated
-   hash algorithm is used as a pseudo-random function. Other non-
-   mandatory attributes are described in Appendix A. The selected hash
-   algorithm MUST support both native and HMAC modes.
-
-   The Diffie-Hellman group MUST be either specified using a defined
-   group description (section 6) or by defining all attributes of a
-   group (section 5.6). Group attributes (such as group type or prime--
-   see Appendix A) MUST NOT be offered in conjunction with a previously
-   defined group (either a reserved group description or a private use
-   description that is established after conclusion of a New Group Mode
-   exchange).
-
-   IKE implementations MUST support the following attribute values:
-
-      - DES [DES] in CBC mode with a weak, and semi-weak, key check
-      (weak and semi-weak keys are referenced in [Sch96] and listed in
-      Appendix A). The key is derived according to Appendix B.
-
-      - MD5 [MD5] and SHA [SHA}.
-
-      - Authentication via pre-shared keys.
-
-      - MODP over default group number one (see below).
-
-   In addition, IKE implementations SHOULD support: 3DES for encryption;
-   Tiger ([TIGER]) for hash; the Digital Signature Standard, RSA [RSA]
-   signatures and authentication with RSA public key encryption; and
-   MODP group number 2.  IKE implementations MAY support any additional
-   encryption algorithms defined in Appendix A and MAY support ECP and
-   EC2N groups.
-
-   The IKE modes described here MUST be implemented whenever the IETF
-   IPsec DOI [Pip97] is implemented. Other DOIs MAY use the modes
-   described here.
-
-
-
-Harkins & Carrel            Standards Track                     [Page 7]
-
-RFC 2409                          IKE                      November 1998
-
-
-5. Exchanges
-
-   There are two basic methods used to establish an authenticated key
-   exchange: Main Mode and Aggressive Mode. Each generates authenticated
-   keying material from an ephemeral Diffie-Hellman exchange. Main Mode
-   MUST be implemented; Aggressive Mode SHOULD be implemented. In
-   addition, Quick Mode MUST be implemented as a mechanism to generate
-   fresh keying material and negotiate non-ISAKMP security services. In
-   addition, New Group Mode SHOULD be implemented as a mechanism to
-   define private groups for Diffie-Hellman exchanges. Implementations
-   MUST NOT switch exchange types in the middle of an exchange.
-
-   Exchanges conform to standard ISAKMP payload syntax, attribute
-   encoding, timeouts and retransmits of messages, and informational
-   messages-- e.g a notify response is sent when, for example, a
-   proposal is unacceptable, or a signature verification or decryption
-   was unsuccessful, etc.
-
-   The SA payload MUST precede all other payloads in a phase 1 exchange.
-   Except where otherwise noted, there are no requirements for ISAKMP
-   payloads in any message to be in any particular order.
-
-   The Diffie-Hellman public value passed in a KE payload, in either a
-   phase 1 or phase 2 exchange, MUST be the length of the negotiated
-   Diffie-Hellman group enforced, if necessary, by pre-pending the value
-   with zeros.
-
-   The length of nonce payload MUST be between 8 and 256 bytes
-   inclusive.
-
-   Main Mode is an instantiation of the ISAKMP Identity Protect
-   Exchange: The first two messages negotiate policy; the next two
-   exchange Diffie-Hellman public values and ancillary data (e.g.
-   nonces) necessary for the exchange; and the last two messages
-   authenticate the Diffie-Hellman Exchange. The authentication method
-   negotiated as part of the initial ISAKMP exchange influences the
-   composition of the payloads but not their purpose. The XCHG for Main
-   Mode is ISAKMP Identity Protect.
-
-   Similarly, Aggressive Mode is an instantiation of the ISAKMP
-   Aggressive Exchange. The first two messages negotiate policy,
-   exchange Diffie-Hellman public values and ancillary data necessary
-   for the exchange, and identities.  In addition the second message
-   authenticates the responder. The third message authenticates the
-   initiator and provides a proof of participation in the exchange. The
-   XCHG for Aggressive Mode is ISAKMP Aggressive.  The final message MAY
-   NOT be sent under protection of the ISAKMP SA allowing each party to
-
-
-
-
-Harkins & Carrel            Standards Track                     [Page 8]
-
-RFC 2409                          IKE                      November 1998
-
-
-   postpone exponentiation, if desired, until negotiation of this
-   exchange is complete. The graphic depictions of Aggressive Mode show
-   the final payload in the clear; it need not be.
-
-   Exchanges in IKE are not open ended and have a fixed number of
-   messages.  Receipt of a Certificate Request payload MUST NOT extend
-   the number of messages transmitted or expected.
-
-   Security Association negotiation is limited with Aggressive Mode. Due
-   to message construction requirements the group in which the Diffie-
-   Hellman exchange is performed cannot be negotiated. In addition,
-   different authentication methods may further constrain attribute
-   negotiation. For example, authentication with public key encryption
-   cannot be negotiated and when using the revised method of public key
-   encryption for authentication the cipher and hash cannot be
-   negotiated. For situations where the rich attribute negotiation
-   capabilities of IKE are required Main Mode may be required.
-
-   Quick Mode and New Group Mode have no analog in ISAKMP. The XCHG
-   values for Quick Mode and New Group Mode are defined in Appendix A.
-
-   Main Mode, Aggressive Mode, and Quick Mode do security association
-   negotiation. Security Association offers take the form of Tranform
-   Payload(s) encapsulated in Proposal Payload(s) encapsulated in
-   Security Association (SA) payload(s). If multiple offers are being
-   made for phase 1 exchanges (Main Mode and Aggressive Mode) they MUST
-   take the form of multiple Transform Payloads for a single Proposal
-   Payload in a single SA payload. To put it another way, for phase 1
-   exchanges there MUST NOT be multiple Proposal Payloads for a single
-   SA payload and there MUST NOT be multiple SA payloads. This document
-   does not proscribe such behavior on offers in phase 2 exchanges.
-
-   There is no limit on the number of offers the initiator may send to
-   the responder but conformant implementations MAY choose to limit the
-   number of offers it will inspect for performance reasons.
-
-   During security association negotiation, initiators present offers
-   for potential security associations to responders. Responders MUST
-   NOT modify attributes of any offer, attribute encoding excepted (see
-   Appendix A).  If the initiator of an exchange notices that attribute
-   values have changed or attributes have been added or deleted from an
-   offer made, that response MUST be rejected.
-
-   Four different authentication methods are allowed with either Main
-   Mode or Aggressive Mode-- digital signature, two forms of
-   authentication with public key encryption, or pre-shared key. The
-   value SKEYID is computed seperately for each authentication method.
-
-
-
-
-Harkins & Carrel            Standards Track                     [Page 9]
-
-RFC 2409                          IKE                      November 1998
-
-
-     For signatures:            SKEYID = prf(Ni_b | Nr_b, g^xy)
-     For public key encryption: SKEYID = prf(hash(Ni_b | Nr_b), CKY-I |
-   CKY-R)
-     For pre-shared keys:       SKEYID = prf(pre-shared-key, Ni_b |
-   Nr_b)
-
-   The result of either Main Mode or Aggressive Mode is three groups of
-   authenticated keying material:
-
-      SKEYID_d = prf(SKEYID, g^xy | CKY-I | CKY-R | 0)
-      SKEYID_a = prf(SKEYID, SKEYID_d | g^xy | CKY-I | CKY-R | 1)
-      SKEYID_e = prf(SKEYID, SKEYID_a | g^xy | CKY-I | CKY-R | 2)
-
-   and agreed upon policy to protect further communications. The values
-   of 0, 1, and 2 above are represented by a single octet. The key used
-   for encryption is derived from SKEYID_e in an algorithm-specific
-   manner (see appendix B).
-
-   To authenticate either exchange the initiator of the protocol
-   generates HASH_I and the responder generates HASH_R where:
-
-    HASH_I = prf(SKEYID, g^xi | g^xr | CKY-I | CKY-R | SAi_b | IDii_b )
-    HASH_R = prf(SKEYID, g^xr | g^xi | CKY-R | CKY-I | SAi_b | IDir_b )
-
-   For authentication with digital signatures, HASH_I and HASH_R are
-   signed and verified; for authentication with either public key
-   encryption or pre-shared keys, HASH_I and HASH_R directly
-   authenticate the exchange.  The entire ID payload (including ID type,
-   port, and protocol but excluding the generic header) is hashed into
-   both HASH_I and HASH_R.
-
-   As mentioned above, the negotiated authentication method influences
-   the content and use of messages for Phase 1 Modes, but not their
-   intent.  When using public keys for authentication, the Phase 1
-   exchange can be accomplished either by using signatures or by using
-   public key encryption (if the algorithm supports it). Following are
-   Phase 1 exchanges with different authentication options.
-
-5.1 IKE Phase 1 Authenticated With Signatures
-
-   Using signatures, the ancillary information exchanged during the
-   second roundtrip are nonces; the exchange is authenticated by signing
-   a mutually obtainable hash. Main Mode with signature authentication
-   is described as follows:
-
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 10]
-
-RFC 2409                          IKE                      November 1998
-
-
-        Initiator                          Responder
-       -----------                        -----------
-        HDR, SA                     -->
-                                    <--    HDR, SA
-        HDR, KE, Ni                 -->
-                                    <--    HDR, KE, Nr
-        HDR*, IDii, [ CERT, ] SIG_I -->
-                                    <--    HDR*, IDir, [ CERT, ] SIG_R
-
-   Aggressive mode with signatures in conjunction with ISAKMP is
-   described as follows:
-
-        Initiator                          Responder
-       -----------                        -----------
-        HDR, SA, KE, Ni, IDii       -->
-                                    <--    HDR, SA, KE, Nr, IDir,
-                                                [ CERT, ] SIG_R
-        HDR, [ CERT, ] SIG_I        -->
-
-   In both modes, the signed data, SIG_I or SIG_R, is the result of the
-   negotiated digital signature algorithm applied to HASH_I or HASH_R
-   respectively.
-
-   In general the signature will be over HASH_I and HASH_R as above
-   using the negotiated prf, or the HMAC version of the negotiated hash
-   function (if no prf is negotiated). However, this can be overridden
-   for construction of the signature if the signature algorithm is tied
-   to a particular hash algorithm (e.g. DSS is only defined with SHA's
-   160 bit output). In this case, the signature will be over HASH_I and
-   HASH_R as above, except using the HMAC version of the hash algorithm
-   associated with the signature method.  The negotiated prf and hash
-   function would continue to be used for all other prescribed pseudo-
-   random functions.
-
-   Since the hash algorithm used is already known there is no need to
-   encode its OID into the signature. In addition, there is no binding
-   between the OIDs used for RSA signatures in PKCS #1 and those used in
-   this document. Therefore, RSA signatures MUST be encoded as a private
-   key encryption in PKCS #1 format and not as a signature in PKCS #1
-   format (which includes the OID of the hash algorithm). DSS signatures
-   MUST be encoded as r followed by s.
-
-   One or more certificate payloads MAY be optionally passed.
-
-
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 11]
-
-RFC 2409                          IKE                      November 1998
-
-
-5.2 Phase 1 Authenticated With Public Key Encryption
-
-   Using public key encryption to authenticate the exchange, the
-   ancillary information exchanged is encrypted nonces. Each party's
-   ability to reconstruct a hash (proving that the other party decrypted
-   the nonce) authenticates the exchange.
-
-   In order to perform the public key encryption, the initiator must
-   already have the responder's public key. In the case where the
-   responder has multiple public keys, a hash of the certificate the
-   initiator is using to encrypt the ancillary information is passed as
-   part of the third message. In this way the responder can determine
-   which corresponding private key to use to decrypt the encrypted
-   payloads and identity protection is retained.
-
-   In addition to the nonce, the identities of the parties (IDii and
-   IDir) are also encrypted with the other party's public key. If the
-   authentication method is public key encryption, the nonce and
-   identity payloads MUST be encrypted with the public key of the other
-   party. Only the body of the payloads are encrypted, the payload
-   headers are left in the clear.
-
-   When using encryption for authentication, Main Mode is defined as
-   follows.
-
-        Initiator                        Responder
-       -----------                      -----------
-        HDR, SA                   -->
-                                  <--    HDR, SA
-        HDR, KE, [ HASH(1), ]
-          <IDii_b>PubKey_r,
-            <Ni_b>PubKey_r        -->
-                                         HDR, KE, <IDir_b>PubKey_i,
-                                  <--            <Nr_b>PubKey_i
-        HDR*, HASH_I              -->
-                                  <--    HDR*, HASH_R
-
-   Aggressive Mode authenticated with encryption is described as
-   follows:
-
-        Initiator                        Responder
-       -----------                      -----------
-        HDR, SA, [ HASH(1),] KE,
-          <IDii_b>Pubkey_r,
-           <Ni_b>Pubkey_r         -->
-                                         HDR, SA, KE, <IDir_b>PubKey_i,
-                                  <--         <Nr_b>PubKey_i, HASH_R
-        HDR, HASH_I               -->
-
-
-
-Harkins & Carrel            Standards Track                    [Page 12]
-
-RFC 2409                          IKE                      November 1998
-
-
-   Where HASH(1) is a hash (using the negotiated hash function) of the
-   certificate which the initiator is using to encrypt the nonce and
-   identity.
-
-   RSA encryption MUST be encoded in PKCS #1 format. While only the body
-   of the ID and nonce payloads is encrypted, the encrypted data must be
-   preceded by a valid ISAKMP generic header. The payload length is the
-   length of the entire encrypted payload plus header. The PKCS #1
-   encoding allows for determination of the actual length of the
-   cleartext payload upon decryption.
-
-   Using encryption for authentication provides for a plausably deniable
-   exchange. There is no proof (as with a digital signature) that the
-   conversation ever took place since each party can completely
-   reconstruct both sides of the exchange. In addition, security is
-   added to secret generation since an attacker would have to
-   successfully break not only the Diffie-Hellman exchange but also both
-   RSA encryptions. This exchange was motivated by [SKEME].
-
-   Note that, unlike other authentication methods, authentication with
-   public key encryption allows for identity protection with Aggressive
-   Mode.
-
-5.3 Phase 1 Authenticated With a Revised Mode of Public Key Encryption
-
-   Authentication with Public Key Encryption has significant advantages
-   over authentication with signatures (see section 5.2 above).
-   Unfortunately, this is at the cost of 4 public key operations-- two
-   public key encryptions and two private key decryptions. This
-   authentication mode retains the advantages of authentication using
-   public key encryption but does so with half the public key
-   operations.
-
-   In this mode, the nonce is still encrypted using the public key of
-   the peer, however the peer's identity (and the certificate if it is
-   sent) is encrypted using the negotiated symmetric encryption
-   algorithm (from the SA payload) with a key derived from the nonce.
-   This solution adds minimal complexity and state yet saves two costly
-   public key operations on each side. In addition, the Key Exchange
-   payload is also encrypted using the same derived key. This provides
-   additional protection against cryptanalysis of the Diffie-Hellman
-   exchange.
-
-   As with the public key encryption method of authentication (section
-   5.2), a HASH payload may be sent to identify a certificate if the
-   responder has multiple certificates which contain useable public keys
-   (e.g. if the certificate is not for signatures only, either due to
-   certificate restrictions or algorithmic restrictions). If the HASH
-
-
-
-Harkins & Carrel            Standards Track                    [Page 13]
-
-RFC 2409                          IKE                      November 1998
-
-
-   payload is sent it MUST be the first payload of the second message
-   exchange and MUST be followed by the encrypted nonce. If the HASH
-   payload is not sent, the first payload of the second message exchange
-   MUST be the encrypted nonce. In addition, the initiator my optionally
-   send a certificate payload to provide the responder with a public key
-   with which to respond.
-
-   When using the revised encryption mode for authentication, Main Mode
-   is defined as follows.
-
-        Initiator                        Responder
-       -----------                      -----------
-        HDR, SA                   -->
-                                  <--    HDR, SA
-        HDR, [ HASH(1), ]
-          <Ni_b>Pubkey_r,
-          <KE_b>Ke_i,
-          <IDii_b>Ke_i,
-          [<<Cert-I_b>Ke_i]       -->
-                                         HDR, <Nr_b>PubKey_i,
-                                              <KE_b>Ke_r,
-                                  <--         <IDir_b>Ke_r,
-        HDR*, HASH_I              -->
-                                  <--    HDR*, HASH_R
-
-   Aggressive Mode authenticated with the revised encryption method is
-   described as follows:
-
-        Initiator                        Responder
-       -----------                      -----------
-        HDR, SA, [ HASH(1),]
-          <Ni_b>Pubkey_r,
-          <KE_b>Ke_i, <IDii_b>Ke_i
-          [, <Cert-I_b>Ke_i ]     -->
-                                         HDR, SA, <Nr_b>PubKey_i,
-                                              <KE_b>Ke_r, <IDir_b>Ke_r,
-                                  <--         HASH_R
-        HDR, HASH_I               -->
-
-   where HASH(1) is identical to section 5.2. Ke_i and Ke_r are keys to
-   the symmetric encryption algorithm negotiated in the SA payload
-   exchange. Only the body of the payloads are encrypted (in both public
-   key and symmetric operations), the generic payload headers are left
-   in the clear. The payload length includes that added to perform
-   encryption.
-
-   The symmetric cipher keys are derived from the decrypted nonces as
-   follows.  First the values Ne_i and Ne_r are computed:
-
-
-
-Harkins & Carrel            Standards Track                    [Page 14]
-
-RFC 2409                          IKE                      November 1998
-
-
-      Ne_i = prf(Ni_b, CKY-I)
-      Ne_r = prf(Nr_b, CKY-R)
-
-   The keys Ke_i and Ke_r are then taken from Ne_i and Ne_r respectively
-   in the manner described in Appendix B used to derive symmetric keys
-   for use with the negotiated encryption algorithm. If the length of
-   the output of the negotiated prf is greater than or equal to the key
-   length requirements of the cipher, Ke_i and Ke_r are derived from the
-   most significant bits of Ne_i and Ne_r respectively. If the desired
-   length of Ke_i and Ke_r exceed the length of the output of the prf
-   the necessary number of bits is obtained by repeatedly feeding the
-   results of the prf back into itself and concatenating the result
-   until the necessary number has been achieved. For example, if the
-   negotiated encryption algorithm requires 320 bits of key and the
-   output of the prf is only 128 bits, Ke_i is the most significant 320
-   bits of K, where
-
-      K = K1 | K2 | K3 and
-      K1 = prf(Ne_i, 0)
-      K2 = prf(Ne_i, K1)
-      K3 = prf(Ne_i, K2)
-
-   For brevity, only derivation of Ke_i is shown; Ke_r is identical. The
-   length of the value 0 in the computation of K1 is a single octet.
-   Note that Ne_i, Ne_r, Ke_i, and Ke_r are all ephemeral and MUST be
-   discarded after use.
-
-   Save the requirements on the location of the optional HASH payload
-   and the mandatory nonce payload there are no further payload
-   requirements. All payloads-- in whatever order-- following the
-   encrypted nonce MUST be encrypted with Ke_i or Ke_r depending on the
-   direction.
-
-   If CBC mode is used for the symmetric encryption then the
-   initialization vectors (IVs) are set as follows. The IV for
-   encrypting the first payload following the nonce is set to 0 (zero).
-   The IV for subsequent payloads encrypted with the ephemeral symmetric
-   cipher key, Ke_i, is the last ciphertext block of the previous
-   payload. Encrypted payloads are padded up to the nearest block size.
-   All padding bytes, except for the last one, contain 0x00. The last
-   byte of the padding contains the number of the padding bytes used,
-   excluding the last one. Note that this means there will always be
-   padding.
-
-
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 15]
-
-RFC 2409                          IKE                      November 1998
-
-
-5.4 Phase 1 Authenticated With a Pre-Shared Key
-
-   A key derived by some out-of-band mechanism may also be used to
-   authenticate the exchange. The actual establishment of this key is
-   out of the scope of this document.
-
-   When doing a pre-shared key authentication, Main Mode is defined as
-   follows:
-
-              Initiator                        Responder
-             ----------                       -----------
-              HDR, SA             -->
-                                  <--    HDR, SA
-              HDR, KE, Ni         -->
-                                  <--    HDR, KE, Nr
-              HDR*, IDii, HASH_I  -->
-                                  <--    HDR*, IDir, HASH_R
-
-   Aggressive mode with a pre-shared key is described as follows:
-
-            Initiator                        Responder
-           -----------                      -----------
-            HDR, SA, KE, Ni, IDii -->
-                                  <--    HDR, SA, KE, Nr, IDir, HASH_R
-            HDR, HASH_I           -->
-
-   When using pre-shared key authentication with Main Mode the key can
-   only be identified by the IP address of the peers since HASH_I must
-   be computed before the initiator has processed IDir. Aggressive Mode
-   allows for a wider range of identifiers of the pre-shared secret to
-   be used. In addition, Aggressive Mode allows two parties to maintain
-   multiple, different pre-shared keys and identify the correct one for
-   a particular exchange.
-
-5.5 Phase 2 - Quick Mode
-
-   Quick Mode is not a complete exchange itself (in that it is bound to
-   a phase 1 exchange), but is used as part of the SA negotiation
-   process (phase 2) to derive keying material and negotiate shared
-   policy for non-ISAKMP SAs. The information exchanged along with Quick
-   Mode MUST be protected by the ISAKMP SA-- i.e. all payloads except
-   the ISAKMP header are encrypted. In Quick Mode, a HASH payload MUST
-   immediately follow the ISAKMP header and a SA payload MUST
-   immediately follow the HASH. This HASH authenticates the message and
-   also provides liveliness proofs.
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 16]
-
-RFC 2409                          IKE                      November 1998
-
-
-   The message ID in the ISAKMP header identifies a Quick Mode in
-   progress for a particular ISAKMP SA which itself is identified by the
-   cookies in the ISAKMP header. Since each instance of a Quick Mode
-   uses a unique initialization vector (see Appendix B) it is possible
-   to have multiple simultaneous Quick Modes, based off a single ISAKMP
-   SA, in progress at any one time.
-
-   Quick Mode is essentially a SA negotiation and an exchange of nonces
-   that provides replay protection. The nonces are used to generate
-   fresh key material and prevent replay attacks from generating bogus
-   security associations.  An optional Key Exchange payload can be
-   exchanged to allow for an additional Diffie-Hellman exchange and
-   exponentiation per Quick Mode. While use of the key exchange payload
-   with Quick Mode is optional it MUST be supported.
-
-   Base Quick Mode (without the KE payload) refreshes the keying
-   material derived from the exponentiation in phase 1. This does not
-   provide PFS.  Using the optional KE payload, an additional
-   exponentiation is performed and PFS is provided for the keying
-   material.
-
-   The identities of the SAs negotiated in Quick Mode are implicitly
-   assumed to be the IP addresses of the ISAKMP peers, without any
-   implied constraints on the protocol or port numbers allowed, unless
-   client identifiers are specified in Quick Mode.  If ISAKMP is acting
-   as a client negotiator on behalf of another party, the identities of
-   the parties MUST be passed as IDci and then IDcr.  Local policy will
-   dictate whether the proposals are acceptable for the identities
-   specified.  If the client identities are not acceptable to the Quick
-   Mode responder (due to policy or other reasons), a Notify payload
-   with Notify Message Type INVALID-ID-INFORMATION (18) SHOULD be sent.
-
-   The client identities are used to identify and direct traffic to the
-   appropriate tunnel in cases where multiple tunnels exist between two
-   peers and also to allow for unique and shared SAs with different
-   granularities.
-
-   All offers made during a Quick Mode are logically related and must be
-   consistant. For example, if a KE payload is sent, the attribute
-   describing the Diffie-Hellman group (see section 6.1 and [Pip97])
-   MUST be included in every transform of every proposal of every SA
-   being negotiated. Similarly, if client identities are used, they MUST
-   apply to every SA in the negotiation.
-
-   Quick Mode is defined as follows:
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 17]
-
-RFC 2409                          IKE                      November 1998
-
-
-        Initiator                        Responder
-       -----------                      -----------
-        HDR*, HASH(1), SA, Ni
-          [, KE ] [, IDci, IDcr ] -->
-                                  <--    HDR*, HASH(2), SA, Nr
-                                               [, KE ] [, IDci, IDcr ]
-        HDR*, HASH(3)             -->
-
-   Where:
-   HASH(1) is the prf over the message id (M-ID) from the ISAKMP header
-   concatenated with the entire message that follows the hash including
-   all payload headers, but excluding any padding added for encryption.
-   HASH(2) is identical to HASH(1) except the initiator's nonce-- Ni,
-   minus the payload header-- is added after M-ID but before the
-   complete message.  The addition of the nonce to HASH(2) is for a
-   liveliness proof. HASH(3)-- for liveliness-- is the prf over the
-   value zero represented as a single octet, followed by a concatenation
-   of the message id and the two nonces-- the initiator's followed by
-   the responder's-- minus the payload header. In other words, the
-   hashes for the above exchange are:
-
-   HASH(1) = prf(SKEYID_a, M-ID | SA | Ni [ | KE ] [ | IDci | IDcr )
-   HASH(2) = prf(SKEYID_a, M-ID | Ni_b | SA | Nr [ | KE ] [ | IDci |
-   IDcr )
-   HASH(3) = prf(SKEYID_a, 0 | M-ID | Ni_b | Nr_b)
-
-   With the exception of the HASH, SA, and the optional ID payloads,
-   there are no payload ordering restrictions on Quick Mode. HASH(1) and
-   HASH(2) may differ from the illustration above if the order of
-   payloads in the message differs from the illustrative example or if
-   any optional payloads, for example a notify payload, have been
-   chained to the message.
-
-   If PFS is not needed, and KE payloads are not exchanged, the new
-   keying material is defined as
-
-       KEYMAT = prf(SKEYID_d, protocol | SPI | Ni_b | Nr_b).
-
-   If PFS is desired and KE payloads were exchanged, the new keying
-   material is defined as
-
-       KEYMAT = prf(SKEYID_d, g(qm)^xy | protocol | SPI | Ni_b | Nr_b)
-
-   where g(qm)^xy is the shared secret from the ephemeral Diffie-Hellman
-   exchange of this Quick Mode.
-
-   In either case, "protocol" and "SPI" are from the ISAKMP Proposal
-   Payload that contained the negotiated Transform.
-
-
-
-Harkins & Carrel            Standards Track                    [Page 18]
-
-RFC 2409                          IKE                      November 1998
-
-
-   A single SA negotiation results in two security assocations-- one
-   inbound and one outbound. Different SPIs for each SA (one chosen by
-   the initiator, the other by the responder) guarantee a different key
-   for each direction.  The SPI chosen by the destination of the SA is
-   used to derive KEYMAT for that SA.
-
-   For situations where the amount of keying material desired is greater
-   than that supplied by the prf, KEYMAT is expanded by feeding the
-   results of the prf back into itself and concatenating results until
-   the required keying material has been reached. In other words,
-
-      KEYMAT = K1 | K2 | K3 | ...
-      where
-        K1 = prf(SKEYID_d, [ g(qm)^xy | ] protocol | SPI | Ni_b | Nr_b)
-        K2 = prf(SKEYID_d, K1 | [ g(qm)^xy | ] protocol | SPI | Ni_b |
-        Nr_b)
-        K3 = prf(SKEYID_d, K2 | [ g(qm)^xy | ] protocol | SPI | Ni_b |
-        Nr_b)
-        etc.
-
-   This keying material (whether with PFS or without, and whether
-   derived directly or through concatenation) MUST be used with the
-   negotiated SA. It is up to the service to define how keys are derived
-   from the keying material.
-
-   In the case of an ephemeral Diffie-Hellman exchange in Quick Mode,
-   the exponential (g(qm)^xy) is irretreivably removed from the current
-   state and SKEYID_e and SKEYID_a (derived from phase 1 negotiation)
-   continue to protect and authenticate the ISAKMP SA and SKEYID_d
-   continues to be used to derive keys.
-
-   Using Quick Mode, multiple SA's and keys can be negotiated with one
-   exchange as follows:
-
-        Initiator                        Responder
-       -----------                      -----------
-        HDR*, HASH(1), SA0, SA1, Ni,
-          [, KE ] [, IDci, IDcr ] -->
-                                  <--    HDR*, HASH(2), SA0, SA1, Nr,
-                                            [, KE ] [, IDci, IDcr ]
-        HDR*, HASH(3)             -->
-
-   The keying material is derived identically as in the case of a single
-   SA. In this case (negotiation of two SA payloads) the result would be
-   four security associations-- two each way for both SAs.
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 19]
-
-RFC 2409                          IKE                      November 1998
-
-
-5.6 New Group Mode
-
-   New Group Mode MUST NOT be used prior to establishment of an ISAKMP
-   SA. The description of a new group MUST only follow phase 1
-   negotiation.  (It is not a phase 2 exchange, though).
-
-        Initiator                        Responder
-       -----------                      -----------
-        HDR*, HASH(1), SA        -->
-                                 <--     HDR*, HASH(2), SA
-
-   where HASH(1) is the prf output, using SKEYID_a as the key, and the
-   message-ID from the ISAKMP header concatenated with the entire SA
-   proposal, body and header, as the data; HASH(2) is the prf output,
-   using SKEYID_a as the key, and the message-ID from the ISAKMP header
-   concatenated with the reply as the data. In other words the hashes
-   for the above exchange are:
-
-      HASH(1) = prf(SKEYID_a, M-ID | SA)
-      HASH(2) = prf(SKEYID_a, M-ID | SA)
-
-   The proposal will specify the characteristics of the group (see
-   appendix A, "Attribute Assigned Numbers"). Group descriptions for
-   private Groups MUST be greater than or equal to 2^15.  If the group
-   is not acceptable, the responder MUST reply with a Notify payload
-   with the message type set to ATTRIBUTES-NOT-SUPPORTED (13).
-
-   ISAKMP implementations MAY require private groups to expire with the
-   SA under which they were established.
-
-   Groups may be directly negotiated in the SA proposal with Main Mode.
-   To do this the component parts-- for a MODP group, the type, prime
-   and generator; for a EC2N group the type, the Irreducible Polynomial,
-   Group Generator One, Group Generator Two, Group Curve A, Group Curve
-   B and Group Order-- are passed as SA attributes (see Appendix A).
-   Alternately, the nature of the group can be hidden using New Group
-   Mode and only the group identifier is passed in the clear during
-   phase 1 negotiation.
-
-5.7 ISAKMP Informational Exchanges
-
-   This protocol protects ISAKMP Informational Exchanges when possible.
-   Once the ISAKMP security association has been established (and
-   SKEYID_e and SKEYID_a have been generated) ISAKMP Information
-   Exchanges, when used with this protocol, are as follows:
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 20]
-
-RFC 2409                          IKE                      November 1998
-
-
-        Initiator                        Responder
-       -----------                      -----------
-        HDR*, HASH(1), N/D      -->
-
-   where N/D is either an ISAKMP Notify Payload or an ISAKMP Delete
-   Payload and HASH(1) is the prf output, using SKEYID_a as the key, and
-   a M-ID unique to this exchange concatenated with the entire
-   informational payload (either a Notify or Delete) as the data. In
-   other words, the hash for the above exchange is:
-
-      HASH(1) = prf(SKEYID_a, M-ID | N/D)
-
-   As noted the message ID in the ISAKMP header-- and used in the prf
-   computation-- is unique to this exchange and MUST NOT be the same as
-   the message ID of another phase 2 exchange which generated this
-   informational exchange. The derivation of the initialization vector,
-   used with SKEYID_e to encrypt this message, is described in Appendix
-   B.
-
-   If the ISAKMP security association has not yet been established at
-   the time of the Informational Exchange, the exchange is done in the
-   clear without an accompanying HASH payload.
-
-6 Oakley Groups
-
-   With IKE, the group in which to do the Diffie-Hellman exchange is
-   negotiated. Four groups-- values 1 through 4-- are defined below.
-   These groups originated with the Oakley protocol and are therefore
-   called "Oakley Groups". The attribute class for "Group" is defined in
-   Appendix A. All values 2^15 and higher are used for private group
-   identifiers. For a discussion on the strength of the default Oakley
-   groups please see the Security Considerations section below.
-
-   These groups were all generated by Richard Schroeppel at the
-   University of Arizona. Properties of these groups are described in
-   [Orm96].
-
-6.1 First Oakley Default Group
-
-   Oakley implementations MUST support a MODP group with the following
-   prime and generator. This group is assigned id 1 (one).
-
-      The prime is: 2^768 - 2 ^704 - 1 + 2^64 * { [2^638 pi] + 149686 }
-      Its hexadecimal value is
-
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 21]
-
-RFC 2409                          IKE                      November 1998
-
-
-         FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
-         29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
-         EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
-         E485B576 625E7EC6 F44C42E9 A63A3620 FFFFFFFF FFFFFFFF
-
-      The generator is: 2.
-
-6.2 Second Oakley Group
-
-   IKE implementations SHOULD support a MODP group with the following
-   prime and generator. This group is assigned id 2 (two).
-
-   The prime is 2^1024 - 2^960 - 1 + 2^64 * { [2^894 pi] + 129093 }.
-   Its hexadecimal value is
-
-         FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
-         29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
-         EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
-         E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
-         EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE65381
-         FFFFFFFF FFFFFFFF
-
-   The generator is 2 (decimal)
-
-6.3 Third Oakley Group
-
-   IKE implementations SHOULD support a EC2N group with the following
-   characteristics. This group is assigned id 3 (three). The curve is
-   based on the Galois Field GF[2^155]. The field size is 155. The
-   irreducible polynomial for the field is:
-          u^155 + u^62 + 1.
-   The equation for the elliptic curve is:
-           y^2 + xy = x^3 + ax^2 + b.
-
-   Field Size:                         155
-   Group Prime/Irreducible Polynomial:
-                    0x0800000000000000000000004000000000000001
-   Group Generator One:                0x7b
-   Group Curve A:                      0x0
-   Group Curve B:                      0x07338f
-
-   Group Order: 0X0800000000000000000057db5698537193aef944
-
-   The data in the KE payload when using this group is the value x from
-   the solution (x,y), the point on the curve chosen by taking the
-   randomly chosen secret Ka and computing Ka*P, where * is the
-   repetition of the group addition and double operations, P is the
-   curve point with x coordinate equal to generator 1 and the y
-
-
-
-Harkins & Carrel            Standards Track                    [Page 22]
-
-RFC 2409                          IKE                      November 1998
-
-
-   coordinate determined from the defining equation. The equation of
-   curve is implicitly known by the Group Type and the A and B
-   coefficients. There are two possible values for the y coordinate;
-   either one can be used successfully (the two parties need not agree
-   on the selection).
-
-6.4 Fourth Oakley Group
-
-   IKE implementations SHOULD support a EC2N group with the following
-   characteristics. This group is assigned id 4 (four). The curve is
-   based on the Galois Field GF[2^185]. The field size is 185. The
-   irreducible polynomial for the field is:
-           u^185 + u^69 + 1. The
-   equation for the elliptic curve is:
-           y^2 + xy = x^3 + ax^2 + b.
-
-   Field Size:                         185
-   Group Prime/Irreducible Polynomial:
-                    0x020000000000000000000000000000200000000000000001
-   Group Generator One:                0x18
-   Group Curve A:                      0x0
-   Group Curve B:                      0x1ee9
-
-   Group Order: 0X01ffffffffffffffffffffffdbf2f889b73e484175f94ebc
-
-   The data in the KE payload when using this group will be identical to
-   that as when using Oakley Group 3 (three).
-
-   Other groups can be defined using New Group Mode. These default
-   groups were generated by Richard Schroeppel at the University of
-   Arizona.  Properties of these primes are described in [Orm96].
-
-7. Payload Explosion for a Complete IKE Exchange
-
-   This section illustrates how the IKE protocol is used to:
-
-      - establish a secure and authenticated channel between ISAKMP
-      processes (phase 1); and
-
-      - generate key material for, and negotiate, an IPsec SA (phase 2).
-
-7.1 Phase 1 using Main Mode
-
-   The following diagram illustrates the payloads exchanged between the
-   two parties in the first round trip exchange. The initiator MAY
-   propose several proposals; the responder MUST reply with one.
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 23]
-
-RFC 2409                          IKE                      November 1998
-
-
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~             ISAKMP Header with XCHG of Main Mode,             ~
-      ~                  and Next Payload of ISA_SA                   ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !       0       !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                  Domain of Interpretation                     !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                          Situation                            !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !       0       !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !  Proposal #1  ! PROTO_ISAKMP  ! SPI size = 0  | # Transforms  !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !    ISA_TRANS  !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !  Transform #1 !  KEY_OAKLEY   |          RESERVED2            !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~                   prefered SA attributes                      ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !       0       !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !  Transform #2 !  KEY_OAKLEY   |          RESERVED2            !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~                   alternate SA attributes                     ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-   The responder replies in kind but selects, and returns, one transform
-   proposal (the ISAKMP SA attributes).
-
-   The second exchange consists of the following payloads:
-
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~             ISAKMP Header with XCHG of Main Mode,             ~
-      ~                  and Next Payload of ISA_KE                   ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !    ISA_NONCE  !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~   D-H Public Value  (g^xi from initiator g^xr from responder) ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !       0       !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~         Ni (from initiator) or  Nr (from responder)           ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 24]
-
-RFC 2409                          IKE                      November 1998
-
-
-   The shared keys, SKEYID_e and SKEYID_a, are now used to protect and
-   authenticate all further communication. Note that both SKEYID_e and
-   SKEYID_a are unauthenticated.
-
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~            ISAKMP Header with XCHG of Main Mode,              ~
-      ~     and Next Payload of ISA_ID and the encryption bit set     ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !    ISA_SIG    !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~        Identification Data of the ISAKMP negotiator           ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !       0       !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~       signature verified by the public key of the ID above    ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-   The key exchange is authenticated over a signed hash as described in
-   section 5.1. Once the signature has been verified using the
-   authentication algorithm negotiated as part of the ISAKMP SA, the
-   shared keys, SKEYID_e and SKEYID_a can be marked as authenticated.
-   (For brevity, certificate payloads were not exchanged).
-
-7.2 Phase 2 using Quick Mode
-
-   The following payloads are exchanged in the first round of Quick Mode
-   with ISAKMP SA negotiation. In this hypothetical exchange, the ISAKMP
-   negotiators are proxies for other parties which have requested
-   authentication.
-
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~            ISAKMP Header with XCHG of Quick Mode,             ~
-      ~   Next Payload of ISA_HASH and the encryption bit set         ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !     ISA_SA    !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~                 keyed hash of message                         ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !   ISA_NONCE   !    RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                 Domain Of Interpretation                      !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                          Situation                            !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !       0       !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-
-Harkins & Carrel            Standards Track                    [Page 25]
-
-RFC 2409                          IKE                      November 1998
-
-
-      !  Proposal #1  ! PROTO_IPSEC_AH! SPI size = 4  | # Transforms  !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~                        SPI (4 octets)                         ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !    ISA_TRANS  !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !  Transform #1 !     AH_SHA    |          RESERVED2            !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                       other SA attributes                     !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !       0       !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !  Transform #2 !     AH_MD5    |          RESERVED2            !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                       other SA attributes                     !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !    ISA_ID     !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~                            nonce                              ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !    ISA_ID     !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~              ID of source for which ISAKMP is a client        ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !      0        !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~           ID of destination for which ISAKMP is a client      ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-   where the contents of the hash are described in 5.5 above. The
-   responder replies with a similar message which only contains one
-   transform-- the selected AH transform. Upon receipt, the initiator
-   can provide the key engine with the negotiated security association
-   and the keying material.  As a check against replay attacks, the
-   responder waits until receipt of the next message.
-
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~          ISAKMP Header with XCHG of Quick Mode,               ~
-      ~   Next Payload of ISA_HASH and the encryption bit set         ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !       0       !    RESERVED   !        Payload Length         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~                         hash data                             ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-   where the contents of the hash are described in 5.5 above.
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 26]
-
-RFC 2409                          IKE                      November 1998
-
-
-8. Perfect Forward Secrecy Example
-
-   This protocol can provide PFS of both keys and identities. The
-   identies of both the ISAKMP negotiating peer and, if applicable, the
-   identities for whom the peers are negotiating can be protected with
-   PFS.
-
-   To provide Perfect Forward Secrecy of both keys and all identities,
-   two parties would perform the following:
-
-      o A Main Mode Exchange to protect the identities of the ISAKMP
-        peers.
-        This establishes an ISAKMP SA.
-      o A Quick Mode Exchange to negotiate other security protocol
-        protection.
-        This establishes a SA on each end for this protocol.
-      o Delete the ISAKMP SA and its associated state.
-
-   Since the key for use in the non-ISAKMP SA was derived from the
-   single ephemeral Diffie-Hellman exchange PFS is preserved.
-
-   To provide Perfect Forward Secrecy of merely the keys of a non-ISAKMP
-   security association, it in not necessary to do a phase 1 exchange if
-   an ISAKMP SA exists between the two peers. A single Quick Mode in
-   which the optional KE payload is passed, and an additional Diffie-
-   Hellman exchange is performed, is all that is required. At this point
-   the state derived from this Quick Mode must be deleted from the
-   ISAKMP SA as described in section 5.5.
-
-9. Implementation Hints
-
-   Using a single ISAKMP Phase 1 negotiation makes subsequent Phase 2
-   negotiations extremely quick.  As long as the Phase 1 state remains
-   cached, and PFS is not needed, Phase 2 can proceed without any
-   exponentiation. How many Phase 2 negotiations can be performed for a
-   single Phase 1 is a local policy issue. The decision will depend on
-   the strength of the algorithms being used and level of trust in the
-   peer system.
-
-   An implementation may wish to negotiate a range of SAs when
-   performing Quick Mode.  By doing this they can speed up the "re-
-   keying". Quick Mode defines how KEYMAT is defined for a range of SAs.
-   When one peer feels it is time to change SAs they simply use the next
-   one within the stated range. A range of SAs can be established by
-   negotiating multiple SAs (identical attributes, different SPIs) with
-   one Quick Mode.
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 27]
-
-RFC 2409                          IKE                      November 1998
-
-
-   An optimization that is often useful is to establish Security
-   Associations with peers before they are needed so that when they
-   become needed they are already in place. This ensures there would be
-   no delays due to key management before initial data transmission.
-   This optimization is easily implemented by setting up more than one
-   Security Association with a peer for each requested Security
-   Association and caching those not immediately used.
-
-   Also, if an ISAKMP implementation is alerted that a SA will soon be
-   needed (e.g. to replace an existing SA that will expire in the near
-   future), then it can establish the new SA before that new SA is
-   needed.
-
-   The base ISAKMP specification describes conditions in which one party
-   of the protocol may inform the other party of some activity-- either
-   deletion of a security association or in response to some error in
-   the protocol such as a signature verification failed or a payload
-   failed to decrypt. It is strongly suggested that these Informational
-   exchanges not be responded to under any circumstances. Such a
-   condition may result in a "notify war" in which failure to understand
-   a message results in a notify to the peer who cannot understand it
-   and sends his own notify back which is also not understood.
-
-10. Security Considerations
-
-   This entire memo discusses a hybrid protocol, combining parts of
-   Oakley and parts of SKEME with ISAKMP, to negotiate, and derive
-   keying material for, security associations in a secure and
-   authenticated manner.
-
-   Confidentiality is assured by the use of a negotiated encryption
-   algorithm.  Authentication is assured by the use of a negotiated
-   method: a digital signature algorithm; a public key algorithm which
-   supports encryption; or, a pre-shared key. The confidentiality and
-   authentication of this exchange is only as good as the attributes
-   negotiated as part of the ISAKMP security association.
-
-   Repeated re-keying using Quick Mode can consume the entropy of the
-   Diffie-Hellman shared secret. Implementors should take note of this
-   fact and set a limit on Quick Mode Exchanges between exponentiations.
-   This memo does not prescribe such a limit.
-
-   Perfect Forward Secrecy (PFS) of both keying material and identities
-   is possible with this protocol. By specifying a Diffie-Hellman group,
-   and passing public values in KE payloads, ISAKMP peers can establish
-   PFS of keys-- the identities would be protected by SKEYID_e from the
-   ISAKMP SA and would therefore not be protected by PFS. If PFS of both
-   keying material and identities is desired, an ISAKMP peer MUST
-
-
-
-Harkins & Carrel            Standards Track                    [Page 28]
-
-RFC 2409                          IKE                      November 1998
-
-
-   establish only one non-ISAKMP security association (e.g. IPsec
-   Security Association) per ISAKMP SA. PFS for keys and identities is
-   accomplished by deleting the ISAKMP SA (and optionally issuing a
-   DELETE message) upon establishment of the single non-ISAKMP SA. In
-   this way a phase one negotiation is uniquely tied to a single phase
-   two negotiation, and the ISAKMP SA established during phase one
-   negotiation is never used again.
-
-   The strength of a key derived from a Diffie-Hellman exchange using
-   any of the groups defined here depends on the inherent strength of
-   the group, the size of the exponent used, and the entropy provided by
-   the random number generator used. Due to these inputs it is difficult
-   to determine the strength of a key for any of the defined groups. The
-   default Diffie-Hellman group (number one) when used with a strong
-   random number generator and an exponent no less than 160 bits is
-   sufficient to use for DES.  Groups two through four provide greater
-   security. Implementations should make note of these conservative
-   estimates when establishing policy and negotiating security
-   parameters.
-
-   Note that these limitations are on the Diffie-Hellman groups
-   themselves.  There is nothing in IKE which prohibits using stronger
-   groups nor is there anything which will dilute the strength obtained
-   from stronger groups. In fact, the extensible framework of IKE
-   encourages the definition of more groups; use of elliptical curve
-   groups will greatly increase strength using much smaller numbers.
-
-   For situations where defined groups provide insufficient strength New
-   Group Mode can be used to exchange a Diffie-Hellman group which
-   provides the necessary strength. In is incumbent upon implementations
-   to check the primality in groups being offered and independently
-   arrive at strength estimates.
-
-   It is assumed that the Diffie-Hellman exponents in this exchange are
-   erased from memory after use. In particular, these exponents must not
-   be derived from long-lived secrets like the seed to a pseudo-random
-   generator.
-
-   IKE exchanges maintain running initialization vectors (IV) where the
-   last ciphertext block of the last message is the IV for the next
-   message. To prevent retransmissions (or forged messages with valid
-   cookies) from causing exchanges to get out of sync IKE
-   implementations SHOULD NOT update their running IV until the
-   decrypted message has passed a basic sanity check and has been
-   determined to actually advance the IKE state machine-- i.e. it is not
-   a retransmission.
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 29]
-
-RFC 2409                          IKE                      November 1998
-
-
-   While the last roundtrip of Main Mode (and optionally the last
-   message of Aggressive Mode) is encrypted it is not, strictly
-   speaking, authenticated.  An active substitution attack on the
-   ciphertext could result in payload corruption. If such an attack
-   corrupts mandatory payloads it would be detected by an authentication
-   failure, but if it corrupts any optional payloads (e.g. notify
-   payloads chained onto the last message of a Main Mode exchange) it
-   might not be detectable.
-
-11. IANA Considerations
-
-   This document contains many "magic numbers" to be maintained by the
-   IANA.  This section explains the criteria to be used by the IANA to
-   assign additional numbers in each of these lists.
-
-11.1 Attribute Classes
-
-   Attributes negotiated in this protocol are identified by their class.
-   Requests for assignment of new classes must be accompanied by a
-   standards-track RFC which describes the use of this attribute.
-
-11.2 Encryption Algorithm Class
-
-   Values of the Encryption Algorithm Class define an encryption
-   algorithm to use when called for in this document. Requests for
-   assignment of new encryption algorithm values must be accompanied by
-   a reference to a standards-track or Informational RFC or a reference
-   to published cryptographic literature which describes this algorithm.
-
-11.3 Hash Algorithm
-
-   Values of the Hash Algorithm Class define a hash algorithm to use
-   when called for in this document. Requests for assignment of new hash
-   algorithm values must be accompanied by a reference to a standards-
-   track or Informational RFC or a reference to published cryptographic
-   literature which describes this algorithm. Due to the key derivation
-   and key expansion uses of HMAC forms of hash algorithms in IKE,
-   requests for assignment of new hash algorithm values must take into
-   account the cryptographic properties-- e.g it's resistance to
-   collision-- of the hash algorithm itself.
-
-11.4 Group Description and Group Type
-
-   Values of the Group Description Class identify a group to use in a
-   Diffie-Hellman exchange. Values of the Group Type Class define the
-   type of group. Requests for assignment of new groups must be
-   accompanied by a reference to a standards-track or Informational RFC
-   which describes this group. Requests for assignment of new group
-
-
-
-Harkins & Carrel            Standards Track                    [Page 30]
-
-RFC 2409                          IKE                      November 1998
-
-
-   types must be accompanied by a reference to a standards-track or
-   Informational RFC or by a reference to published cryptographic or
-   mathmatical literature which describes the new type.
-
-11.5 Life Type
-
-   Values of the Life Type Class define a type of lifetime to which the
-   ISAKMP Security Association applies. Requests for assignment of new
-   life types must be accompanied by a detailed description of the units
-   of this type and its expiry.
-
-12. Acknowledgements
-
-   This document is the result of close consultation with Hugo Krawczyk,
-   Douglas Maughan, Hilarie Orman, Mark Schertler, Mark Schneider, and
-   Jeff Turner. It relies on protocols which were written by them.
-   Without their interest and dedication, this would not have been
-   written.
-
-   Special thanks Rob Adams, Cheryl Madson, Derrell Piper, Harry Varnis,
-   and Elfed Weaver for technical input, encouragement, and various
-   sanity checks along the way.
-
-   We would also like to thank the many members of the IPSec working
-   group that contributed to the development of this protocol over the
-   past year.
-
-13. References
-
-   [CAST]   Adams, C., "The CAST-128 Encryption Algorithm", RFC 2144,
-            May 1997.
-
-   [BLOW]   Schneier, B., "The Blowfish Encryption Algorithm", Dr.
-            Dobb's Journal, v. 19, n. 4, April 1994.
-
-   [Bra97]  Bradner, S., "Key Words for use in RFCs to indicate
-            Requirement Levels", BCP 14, RFC 2119, March 1997.
-
-   [DES]    ANSI X3.106, "American National Standard for Information
-            Systems-Data Link Encryption", American National Standards
-            Institute, 1983.
-
-   [DH]     Diffie, W., and Hellman M., "New Directions in
-            Cryptography", IEEE Transactions on Information Theory, V.
-            IT-22, n. 6, June 1977.
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 31]
-
-RFC 2409                          IKE                      November 1998
-
-
-   [DSS]    NIST, "Digital Signature Standard", FIPS 186, National
-            Institute of Standards and Technology, U.S. Department of
-            Commerce, May, 1994.
-
-   [IDEA]   Lai, X., "On the Design and Security of Block Ciphers," ETH
-            Series in Information Processing, v. 1, Konstanz: Hartung-
-            Gorre Verlag, 1992
-
-   [KBC96]  Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
-            Hashing for Message Authentication", RFC 2104, February
-            1997.
-
-   [SKEME]  Krawczyk, H., "SKEME: A Versatile Secure Key Exchange
-            Mechanism for Internet", from IEEE Proceedings of the 1996
-            Symposium on Network and Distributed Systems Security.
-
-   [MD5]    Rivest, R., "The MD5 Message Digest Algorithm", RFC 1321,
-            April 1992.
-
-   [MSST98] Maughhan, D., Schertler, M., Schneider, M., and J. Turner,
-            "Internet Security Association and Key Management Protocol
-            (ISAKMP)", RFC 2408, November 1998.
-
-   [Orm96]  Orman, H., "The Oakley Key Determination Protocol", RFC
-            2412, November 1998.
-
-   [PKCS1]  RSA Laboratories, "PKCS #1: RSA Encryption Standard",
-            November 1993.
-
-   [Pip98]  Piper, D., "The Internet IP Security Domain Of
-            Interpretation for ISAKMP", RFC 2407, November 1998.
-
-   [RC5]    Rivest, R., "The RC5 Encryption Algorithm", Dr. Dobb's
-            Journal, v. 20, n. 1, January 1995.
-
-   [RSA]    Rivest, R., Shamir, A., and Adleman, L., "A Method for
-            Obtaining Digital Signatures and Public-Key Cryptosystems",
-            Communications of the ACM, v. 21, n. 2, February 1978.
-
-   [Sch96]  Schneier, B., "Applied Cryptography, Protocols, Algorithms,
-            and Source Code in C", 2nd edition.
-
-   [SHA]    NIST, "Secure Hash Standard", FIPS 180-1, National Institue
-            of Standards and Technology, U.S. Department of Commerce,
-            May 1994.
-
-   [TIGER]  Anderson, R., and Biham, E., "Fast Software Encryption",
-            Springer LNCS v. 1039, 1996.
-
-
-
-Harkins & Carrel            Standards Track                    [Page 32]
-
-RFC 2409                          IKE                      November 1998
-
-
-Appendix A
-
-   This is a list of DES Weak and Semi-Weak keys.  The keys come from
-   [Sch96].  All keys are listed in hexidecimal.
-
-       DES Weak Keys
-       0101 0101 0101 0101
-       1F1F 1F1F E0E0 E0E0
-       E0E0 E0E0 1F1F 1F1F
-       FEFE FEFE FEFE FEFE
-
-       DES Semi-Weak Keys
-       01FE 01FE 01FE 01FE
-       1FE0 1FE0 0EF1 0EF1
-       01E0 01E0 01F1 01F1
-       1FFE 1FFE 0EFE 0EFE
-       011F 011F 010E 010E
-       E0FE E0FE F1FE F1FE
-
-       FE01 FE01 FE01 FE01
-       E01F E01F F10E F10E
-       E001 E001 F101 F101
-       FE1F FE1F FE0E FE0E
-       1F01 1F01 0E01 0E01
-       FEE0 FEE0 FEF1 FEF1
-
-   Attribute Assigned Numbers
-
-   Attributes negotiated during phase one use the following definitions.
-   Phase two attributes are defined in the applicable DOI specification
-   (for example, IPsec attributes are defined in the IPsec DOI), with
-   the exception of a group description when Quick Mode includes an
-   ephemeral Diffie-Hellman exchange.  Attribute types can be either
-   Basic (B) or Variable-length (V). Encoding of these attributes is
-   defined in the base ISAKMP specification as Type/Value (Basic) and
-   Type/Length/Value (Variable).
-
-   Attributes described as basic MUST NOT be encoded as variable.
-   Variable length  attributes MAY be encoded as basic attributes if
-   their value can fit into two octets. If this is the case, an
-   attribute offered as variable (or basic) by the initiator of this
-   protocol MAY be returned to the initiator as a basic (or variable).
-
-
-
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 33]
-
-RFC 2409                          IKE                      November 1998
-
-
-   Attribute Classes
-
-          class                         value              type
-     -------------------------------------------------------------------
-      Encryption Algorithm                1                 B
-      Hash Algorithm                      2                 B
-      Authentication Method               3                 B
-      Group Description                   4                 B
-      Group Type                          5                 B
-      Group Prime/Irreducible Polynomial  6                 V
-      Group Generator One                 7                 V
-      Group Generator Two                 8                 V
-      Group Curve A                       9                 V
-      Group Curve B                      10                 V
-      Life Type                          11                 B
-      Life Duration                      12                 V
-      PRF                                13                 B
-      Key Length                         14                 B
-      Field Size                         15                 B
-      Group Order                        16                 V
-
-   values 17-16383 are reserved to IANA. Values 16384-32767 are for
-   private use among mutually consenting parties.
-
-   Class Values
-
-   - Encryption Algorithm                       Defined In
-      DES-CBC                             1     RFC 2405
-      IDEA-CBC                            2
-      Blowfish-CBC                        3
-      RC5-R16-B64-CBC                     4
-      3DES-CBC                            5
-      CAST-CBC                            6
-
-     values 7-65000 are reserved to IANA. Values 65001-65535 are for
-     private use among mutually consenting parties.
-
-   - Hash Algorithm                             Defined In
-      MD5                                 1     RFC 1321
-      SHA                                 2     FIPS 180-1
-      Tiger                               3     See Reference [TIGER]
-
-     values 4-65000 are reserved to IANA. Values 65001-65535 are for
-     private use among mutually consenting parties.
-
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 34]
-
-RFC 2409                          IKE                      November 1998
-
-
-   - Authentication Method
-      pre-shared key                      1
-      DSS signatures                      2
-      RSA signatures                      3
-      Encryption with RSA                 4
-      Revised encryption with RSA         5
-
-     values 6-65000 are reserved to IANA. Values 65001-65535 are for
-     private use among mutually consenting parties.
-
-   - Group Description
-      default 768-bit MODP group (section 6.1)      1
-
-      alternate 1024-bit MODP group (section 6.2)   2
-
-      EC2N group on GP[2^155] (section 6.3)         3
-
-      EC2N group on GP[2^185] (section 6.4)         4
-
-     values 5-32767 are reserved to IANA. Values 32768-65535 are for
-     private use among mutually consenting parties.
-
-   - Group Type
-      MODP (modular exponentiation group)            1
-      ECP  (elliptic curve group over GF[P])         2
-      EC2N (elliptic curve group over GF[2^N])       3
-
-     values 4-65000 are reserved to IANA. Values 65001-65535 are for
-     private use among mutually consenting parties.
-
-   - Life Type
-      seconds                             1
-      kilobytes                           2
-
-     values 3-65000 are reserved to IANA. Values 65001-65535 are for
-     private use among mutually consenting parties. For a given "Life
-     Type" the value of the "Life Duration" attribute defines the actual
-     length of the SA life-- either a number of seconds, or a number of
-     kbytes protected.
-
-   - PRF
-     There are currently no pseudo-random functions defined.
-
-     values 1-65000 are reserved to IANA. Values 65001-65535 are for
-     private use among mutually consenting parties.
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 35]
-
-RFC 2409                          IKE                      November 1998
-
-
-   - Key Length
-
-     When using an Encryption Algorithm that has a variable length key,
-     this attribute specifies the key length in bits. (MUST use network
-     byte order). This attribute MUST NOT be used when the specified
-     Encryption Algorithm uses a fixed length key.
-
-   - Field Size
-
-     The field size, in bits, of a Diffie-Hellman group.
-
-   - Group Order
-
-     The group order of an elliptical curve group. Note the length of
-     this attribute depends on the field size.
-
-   Additional Exchanges Defined-- XCHG values
-     Quick Mode                         32
-     New Group Mode                     33
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 36]
-
-RFC 2409                          IKE                      November 1998
-
-
-Appendix B
-
-   This appendix describes encryption details to be used ONLY when
-   encrypting ISAKMP messages.  When a service (such as an IPSEC
-   transform) utilizes ISAKMP to generate keying material, all
-   encryption algorithm specific details (such as key and IV generation,
-   padding, etc...) MUST be defined by that service.  ISAKMP does not
-   purport to ever produce keys that are suitable for any encryption
-   algorithm.  ISAKMP produces the requested amount of keying material
-   from which the service MUST generate a suitable key.  Details, such
-   as weak key checks, are the responsibility of the service.
-
-   Use of negotiated PRFs may require the PRF output to be expanded due
-   to the PRF feedback mechanism employed by this document. For example,
-   if the (ficticious) DOORAK-MAC requires 24 bytes of key but produces
-   only 8 bytes of output, the output must be expanded three times
-   before being used as the key for another instance of itself. The
-   output of a PRF is expanded by feeding back the results of the PRF
-   into itself to generate successive blocks. These blocks are
-   concatenated until the requisite number of bytes has been acheived.
-   For example, for pre-shared key authentication with DOORAK-MAC as the
-   negotiated PRF:
-
-     BLOCK1-8 = prf(pre-shared-key, Ni_b | Nr_b)
-     BLOCK9-16 = prf(pre-shared-key, BLOCK1-8 | Ni_b | Nr_b)
-     BLOCK17-24 = prf(pre-shared-key, BLOCK9-16 | Ni_b | Nr_b)
-   and
-     SKEYID = BLOCK1-8 | BLOCK9-16 | BLOCK17-24
-
-   so therefore to derive SKEYID_d:
-
-     BLOCK1-8 = prf(SKEYID, g^xy | CKY-I | CKY-R | 0)
-     BLOCK9-16 = prf(SKEYID, BLOCK1-8 | g^xy | CKY-I | CKY-R | 0)
-     BLOCK17-24 = prf(SKEYID, BLOCK9-16 | g^xy | CKY-I | CKY-R | 0)
-   and
-     SKEYID_d = BLOCK1-8 | BLOCK9-16 | BLOCK17-24
-
-   Subsequent PRF derivations are done similarly.
-
-   Encryption keys used to protect the ISAKMP SA are derived from
-   SKEYID_e in an algorithm-specific manner. When SKEYID_e is not long
-   enough to supply all the necessary keying material an algorithm
-   requires, the key is derived from feeding the results of a pseudo-
-   random function into itself, concatenating the results, and taking
-   the highest necessary bits.
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 37]
-
-RFC 2409                          IKE                      November 1998
-
-
-   For example, if (ficticious) algorithm AKULA requires 320-bits of key
-   (and has no weak key check) and the prf used to generate SKEYID_e
-   only generates 120 bits of material, the key for AKULA, would be the
-   first 320-bits of Ka, where:
-
-       Ka = K1 | K2 | K3
-   and
-       K1 = prf(SKEYID_e, 0)
-       K2 = prf(SKEYID_e, K1)
-       K3 = prf(SKEYID_e, K2)
-
-   where prf is the negotiated prf or the HMAC version of the negotiated
-   hash function (if no prf was negotiated) and 0 is represented by a
-   single octet. Each result of the prf provides 120 bits of material
-   for a total of 360 bits. AKULA would use the first 320 bits of that
-   360 bit string.
-
-   In phase 1, material for the initialization vector (IV material) for
-   CBC mode encryption algorithms is derived from a hash of a
-   concatenation of the initiator's public Diffie-Hellman value and the
-   responder's public Diffie-Hellman value using the negotiated hash
-   algorithm. This is used for the first message only. Each message
-   should be padded up to the nearest block size using bytes containing
-   0x00. The message length in the header MUST include the length of the
-   pad since this reflects the size of the ciphertext. Subsequent
-   messages MUST use the last CBC encryption block from the previous
-   message as their initialization vector.
-
-   In phase 2, material for the initialization vector for CBC mode
-   encryption of the first message of a Quick Mode exchange is derived
-   from a hash of a concatenation of the last phase 1 CBC output block
-   and the phase 2 message id using the negotiated hash algorithm. The
-   IV for subsequent messages within a Quick Mode exchange is the CBC
-   output block from the previous message. Padding and IVs for
-   subsequent messages are done as in phase 1.
-
-   After the ISAKMP SA has been authenticated all Informational
-   Exchanges are encrypted using SKEYID_e. The initiaization vector for
-   these exchanges is derived in exactly the same fashion as that for a
-   Quick Mode-- i.e. it is derived from a hash of a concatenation of the
-   last phase 1 CBC output block and the message id from the ISAKMP
-   header of the Informational Exchange (not the message id from the
-   message that may have prompted the Informational Exchange).
-
-   Note that the final phase 1 CBC output block, the result of
-   encryption/decryption of the last phase 1 message, must be retained
-   in the ISAKMP SA state to allow for generation of unique IVs for each
-   Quick Mode. Each post- phase 1 exchange (Quick Modes and
-
-
-
-Harkins & Carrel            Standards Track                    [Page 38]
-
-RFC 2409                          IKE                      November 1998
-
-
-   Informational Exchanges) generates IVs independantly to prevent IVs
-   from getting out of sync when two different exchanges are started
-   simultaneously.
-
-   In all cases, there is a single bidirectional cipher/IV context.
-   Having each Quick Mode and Informational Exchange maintain a unique
-   context prevents IVs from getting out of sync.
-
-   The key for DES-CBC is derived from the first eight (8) non-weak and
-   non-semi-weak (see Appendix A) bytes of SKEYID_e. The IV is the first
-   8 bytes of the IV material derived above.
-
-   The key for IDEA-CBC is derived from the first sixteen (16) bytes of
-   SKEYID_e.  The IV is the first eight (8) bytes of the IV material
-   derived above.
-
-   The key for Blowfish-CBC is either the negotiated key size, or the
-   first fifty-six (56) bytes of a key (if no key size is negotiated)
-   derived in the aforementioned pseudo-random function feedback method.
-   The IV is the first eight (8) bytes of the IV material derived above.
-
-   The key for RC5-R16-B64-CBC is the negotiated key size, or the first
-   sixteen (16) bytes of a key (if no key size is negotiated) derived
-   from the aforementioned pseudo-random function feedback method if
-   necessary. The IV is the first eight (8) bytes of the IV material
-   derived above. The number of rounds MUST be 16 and the block size
-   MUST be 64.
-
-   The key for 3DES-CBC is the first twenty-four (24) bytes of a key
-   derived in the aforementioned pseudo-random function feedback method.
-   3DES-CBC is an encrypt-decrypt-encrypt operation using the first,
-   middle, and last eight (8) bytes of the entire 3DES-CBC key.  The IV
-   is the first eight (8) bytes of the IV material derived above.
-
-   The key for CAST-CBC is either the negotiated key size, or the first
-   sixteen (16) bytes of a key derived in the aforementioned pseudo-
-   random function feedback method.  The IV is the first eight (8) bytes
-   of the IV material derived above.
-
-   Support for algorithms other than DES-CBC is purely optional. Some
-   optional algorithms may be subject to intellectual property claims.
-
-
-
-
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 39]
-
-RFC 2409                          IKE                      November 1998
-
-
-Authors' Addresses
-
-   Dan Harkins
-   cisco Systems
-   170 W. Tasman Dr.
-   San Jose, California, 95134-1706
-   United States of America
-
-   Phone: +1 408 526 4000
-   EMail: dharkins@cisco.com
-
-
-   Dave Carrel
-   76 Lippard Ave.
-   San Francisco, CA 94131-2947
-   United States of America
-
-   Phone: +1 415 337 8469
-   EMail: carrel@ipsec.org
-
-Authors' Note
-
-   The authors encourage independent implementation, and
-   interoperability testing, of this hybrid protocol.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 40]
-
-RFC 2409                          IKE                      November 1998
-
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society (1998).  All Rights Reserved.
-
-   This document and translations of it may be copied and furnished to
-   others, and derivative works that comment on or otherwise explain it
-   or assist in its implementation may be prepared, copied, published
-   and distributed, in whole or in part, without restriction of any
-   kind, provided that the above copyright notice and this paragraph are
-   included on all such copies and derivative works.  However, this
-   document itself may not be modified in any way, such as by removing
-   the copyright notice or references to the Internet Society or other
-   Internet organizations, except as needed for the purpose of
-   developing Internet standards in which case the procedures for
-   copyrights defined in the Internet Standards process must be
-   followed, or as required to translate it into languages other than
-   English.
-
-   The limited permissions granted above are perpetual and will not be
-   revoked by the Internet Society or its successors or assigns.
-
-   This document and the information contained herein is provided on an
-   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
-   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
-   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
-   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Harkins & Carrel            Standards Track                    [Page 41]
-
diff --git a/doc/ikev2/[RFC2412] - The OAKLEY Key Determination Protocol.txt b/doc/ikev2/[RFC2412] - The OAKLEY Key Determination Protocol.txt
deleted file mode 100644
index 9169d78be..000000000
--- a/doc/ikev2/[RFC2412] - The OAKLEY Key Determination Protocol.txt
+++ /dev/null
@@ -1,3083 +0,0 @@
-
-
-
-
-
-
-Network Working Group                                           H. Orman
-Request for Comments: 2412                Department of Computer Science
-Category: Informational                            University of Arizona
-                                                           November 1998
-
-
-                 The OAKLEY Key Determination Protocol
-
-Status of this Memo
-
-   This memo provides information for the Internet community.  It does
-   not specify an Internet standard of any kind.  Distribution of this
-   memo is unlimited.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (1998).  All Rights Reserved.
-
-Abstract
-
-   This document describes a protocol, named OAKLEY, by which two
-   authenticated parties can agree on secure and secret keying material.
-   The basic mechanism is the Diffie-Hellman key exchange algorithm.
-
-   The OAKLEY protocol supports Perfect Forward Secrecy, compatibility
-   with the ISAKMP protocol for managing security associations, user-
-   defined abstract group structures for use with the Diffie-Hellman
-   algorithm, key updates, and incorporation of keys distributed via
-   out-of-band mechanisms.
-
-1. INTRODUCTION
-
-   Key establishment is the heart of data protection that relies on
-   cryptography, and it is an essential component of the packet
-   protection mechanisms described in [RFC2401], for example.  A
-   scalable and secure key distribution mechanism for the Internet is a
-   necessity.  The goal of this protocol is to provide that mechanism,
-   coupled with a great deal of cryptographic strength.
-
-   The Diffie-Hellman key exchange algorithm provides such a mechanism.
-   It allows two parties to agree on a shared value without requiring
-   encryption.  The shared value is immediately available for use in
-   encrypting subsequent conversation, e.g. data transmission and/or
-   authentication.  The STS protocol [STS] provides a demonstration of
-   how to embed the algorithm in a secure protocol, one that ensures
-   that in addition to securely sharing a secret, the two parties can be
-   sure of each other's identities, even when an active attacker exists.
-
-
-
-
-Orman                        Informational                      [Page 1]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   Because OAKLEY is a generic key exchange protocol, and because the
-   keys that it generates might be used for encrypting data with a long
-   privacy lifetime, 20 years or more, it is important that the
-   algorithms underlying the protocol be able to ensure the security of
-   the keys for that period of time, based on the best prediction
-   capabilities available for seeing into the mathematical future.  The
-   protocol therefore has two options for adding to the difficulties
-   faced by an attacker who has a large amount of recorded key exchange
-   traffic at his disposal (a passive attacker).  These options are
-   useful for deriving keys which will be used for encryption.
-
-   The OAKLEY protocol is related to STS, sharing the similarity of
-   authenticating the Diffie-Hellman exponentials and using them for
-   determining a shared key, and also of achieving Perfect Forward
-   Secrecy for the shared key, but it differs from the STS protocol in
-   several ways.
-
-      The first is the addition of a weak address validation mechanism
-      ("cookies", described by Phil Karn in the Photuris key exchange
-      protocol work in progress) to help avoid denial of service
-      attacks.
-
-      The second extension is to allow the two parties to select
-      mutually agreeable supporting algorithms for the protocol: the
-      encryption method, the key derivation method, and the
-      authentication method.
-
-      Thirdly, the authentication does not depend on encryption using
-      the Diffie-Hellman exponentials; instead, the authentication
-      validates the binding of the exponentials to the identities of the
-      parties.
-
-      The protocol does not require the two parties compute the shared
-      exponentials prior to authentication.
-
-      This protocol adds additional security to the derivation of keys
-      meant for use with encryption (as opposed to authentication) by
-      including a dependence on an additional algorithm.  The derivation
-      of keys for encryption is made to depend not only on the Diffie-
-      Hellman algorithm, but also on the cryptographic method used to
-      securely authenticate the communicating parties to each other.
-
-      Finally, this protocol explicitly defines how the two parties can
-      select the mathematical structures (group representation and
-      operation) for performing the Diffie-Hellman algorithm; they can
-      use standard groups or define their own.  User-defined groups
-      provide an additional degree of long-term security.
-
-
-
-
-Orman                        Informational                      [Page 2]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   OAKLEY has several options for distributing keys.  In addition to the
-   classic Diffie-Hellman exchange, this protocol can be used to derive
-   a new key from an existing key and to distribute an externally
-   derived key by encrypting it.
-
-   The protocol allows two parties to use all or some of the anti-
-   clogging and perfect forward secrecy features.  It also permits the
-   use of authentication based on symmetric encryption or non-encryption
-   algorithms.  This flexibility is included in order to allow the
-   parties to use the features that are best suited to their security
-   and performance requirements.
-
-   This document draws extensively in spirit and approach from the
-   Photuris work in progress by Karn and Simpson (and from discussions
-   with the authors), specifics of the ISAKMP document by Schertler et
-   al. the ISAKMP protocol document, and it was also influenced by
-   papers by Paul van Oorschot and Hugo Krawcyzk.
-
-2. The Protocol Outline
-
-2.1  General Remarks
-
-   The OAKLEY protocol is used to establish a shared key with an
-   assigned identifier and associated authenticated identities for the
-   two parties.  The name of the key can be used later to derive
-   security associations for the RFC 2402 and RFC 2406 protocols (AH and
-   ESP) or to achieve other network security goals.
-
-   Each key is associated with algorithms that are used for
-   authentication, privacy, and one-way functions.  These are ancillary
-   algorithms for OAKLEY; their appearance in subsequent security
-   association definitions derived with other protocols is neither
-   required nor prohibited.
-
-   The specification of the details of how to apply an algorithm to data
-   is called a transform.  This document does not supply the transform
-   definitions; they will be in separate RFC's.
-
-   The anti-clogging tokens, or "cookies", provide a weak form of source
-   address identification for both parties; the cookie exchange can be
-   completed before they perform the computationally expensive part of
-   the protocol (large integer exponentiations).
-
-   It is important to note that OAKLEY uses the cookies for two
-   purposes:  anti-clogging and key naming.  The two parties to the
-   protocol each contribute one cookie at the initiation of key
-   establishment; the pair of cookies becomes the key identifier
-   (KEYID), a reusable name for the keying material.  Because of this
-
-
-
-Orman                        Informational                      [Page 3]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   dual role, we will use the notation for the concatenation of the
-   cookies ("COOKIE-I, COOKIE-R") interchangeably with the symbol
-   "KEYID".
-
-   OAKLEY is designed to be a compatible component of the ISAKMP
-   protocol [ISAKMP], which runs over the UDP protocol using a well-
-   known port (see the RFC on port assignments, STD02-RFC-1700).  The
-   only technical requirement for the protocol environment is that the
-   underlying protocol stack must be able to supply the Internet address
-   of the remote party for each message.  Thus, OAKLEY could, in theory,
-   be used directly over the IP protocol or over UDP, if suitable
-   protocol or port number assignments were available.
-
-   The machine running OAKLEY must provide a good random number
-   generator, as described in [RANDOM], as the source of random numbers
-   required in this protocol description.  Any mention of a "nonce"
-   implies that the nonce value is generated by such a generator.  The
-   same is true for "pseudorandom" values.
-
-2.2  Notation
-
-   The section describes the notation used in this document for message
-   sequences and content.
-
-2.2.1  Message descriptions
-
-   The protocol exchanges below are written in an abbreviated notation
-   that is intended to convey the essential elements of the exchange in
-   a clear manner.  A brief guide to the notation follows.  The detailed
-   formats and assigned values are given in the appendices.
-
-   In order to represent message exchanges succinctly, this document
-   uses an abbreviated notation that describes each message in terms of
-   its source and destination and relevant fields.
-
-   Arrows ("->") indicate whether the message is sent from the initiator
-   to the responder, or vice versa ("<-").
-
-   The fields in the message are named and comma separated.  The
-   protocol uses the convention that the first several fields constitute
-   a fixed header format for all messages.
-
-   For example, consider a HYPOTHETICAL exchange of messages involving a
-   fixed format message, the four fixed fields being two "cookies", the
-   third field being a message type name, the fourth field being a
-   multi-precision integer representing a power of a number:
-
-
-
-
-
-Orman                        Informational                      [Page 4]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-        Initiator                                       Responder
-            ->    Cookie-I, 0, OK_KEYX, g^x                    ->
-            <-    Cookie-R, Cookie-I, OK_KEYX, g^y            <-
-
-   The notation describes a two message sequence.  The initiator begins
-   by sending a message with 4 fields to the responder; the first field
-   has the unspecified value "Cookie-I", second field has the numeric
-   value 0, the third field indicates the message type is OK_KEYX, the
-   fourth value is an abstract group element g to the x'th power.
-
-   The second line indicates that the responder replies with value
-   "Cookie-R" in the first field, a copy of the "Cookie-I" value in the
-   second field, message type OK_KEYX, and the number g raised to the
-   y'th power.
-
-   The value OK_KEYX is in capitals to indicate that it is a unique
-   constant (constants are defined in the appendices).
-
-   Variable precision integers with length zero are null values for the
-   protocol.
-
-   Sometimes the protocol will indicate that an entire payload (usually
-   the Key Exchange Payload) has null values.  The payload is still
-   present in the message, for the purpose of simplifying parsing.
-
-2.2.2 Guide to symbols
-
-   Cookie-I and Cookie-R (or CKY-I and CKY-R) are 64-bit pseudo-random
-   numbers.  The generation method must ensure with high probability
-   that the numbers used for each IP remote address are unique over some
-   time period, such as one hour.
-
-   KEYID is the concatenation of the initiator and responder cookies and
-   the domain of interpretation; it is the name of keying material.
-
-   sKEYID is used to denote the keying material named by the KEYID.  It
-   is never transmitted, but it is used in various calculations
-   performed by the two parties.
-
-   OK_KEYX and OK_NEWGRP are distinct message types.
-
-   IDP is a bit indicating whether or not material after the encryption
-   boundary (see appendix B), is encrypted.  NIDP means not encrypted.
-
-   g^x and g^y are encodings of group elements, where g is a special
-   group element indicated in the group description (see Appendix A) and
-   g^x indicates that element raised to the x'th power.  The type of the
-   encoding is either a variable precision integer or a pair of such
-
-
-
-Orman                        Informational                      [Page 5]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   integers, as indicated in the group operation in the group
-   description.  Note that we will write g^xy as a short-hand for
-   g^(xy).  See Appendix F for references that describe implementing
-   large integer computations and the relationship between various group
-   definitions and basic arithmetic operations.
-
-   EHAO is a list of encryption/hash/authentication choices.  Each item
-   is a pair of values: a class name and an algorithm name.
-
-   EHAS is a set of three items selected from the EHAO list, one from
-   each of the classes for encryption, hash, authentication.
-
-   GRP is a name (32-bit value) for the group and its relevant
-   parameters: the size of the integers, the arithmetic operation, and
-   the generator element.  There are a few pre-defined GRP's (for 768
-   bit modular exponentiation groups, 1024 bit modexp, 2048 bit modexp,
-   155-bit and 210-bit elliptic curves, see Appendix E), but
-   participants can share other group descriptions in a later protocol
-   stage (see the section NEW GROUP).  It is important to separate
-   notion of the GRP from the group descriptor (Appendix A); the former
-   is a name for the latter.
-
-   The symbol vertical bar "|" is used to denote concatenation of bit
-   strings.  Fields are concatenated using their encoded form as they
-   appear in their payload.
-
-   Ni and Nr are nonces selected by the initiator and responder,
-   respectively.
-
-   ID(I) and ID(R) are the identities to be used in authenticating the
-   initiator and responder respectively.
-
-   E{x}Ki indicates the encryption of x using the public key of the
-   initiator.  Encryption is done using the algorithm associated with
-   the authentication method; usually this will be RSA.
-
-   S{x}Ki indicates the signature over x using the private key (signing
-   key) of the initiator.  Signing is done using the algorithm
-   associated with the authentication method; usually this will be RSA
-   or DSS.
-
-   prf(a, b) denotes the result of applying pseudo-random function "a"
-   to data "b".  One may think of "a" as a key or as a value that
-   characterizes the function prf; in the latter case it is the index
-   into a family of functions.  Each function in the family provides a
-   "hash" or one-way mixing of the input.
-
-   prf(0, b) denotes the application of a one-way function to data "b".
-
-
-
-Orman                        Informational                      [Page 6]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   The similarity with the previous notation is deliberate and indicates
-   that a single algorithm, e.g. MD5, might will used for both purposes.
-   In the first case a "keyed" MD5 transform would be used with key "a";
-   in the second case the transform would have the fixed key value zero,
-   resulting in a one-way function.
-
-   The term "transform" is used to refer to functions defined in
-   auxiliary RFC's.  The transform RFC's will be drawn from those
-   defined for IPSEC AH and ESP (see RFC 2401 for the overall
-   architecture encompassing these protocols).
-
-2.3 The Key Exchange Message Overview
-
-   The goal of key exchange processing is the secure establishment of
-   common keying information state in the two parties.  This state
-   information is a key name, secret keying material, the identification
-   of the two parties, and three algorithms for use during
-   authentication: encryption (for privacy of the identities of the two
-   parties), hashing (a pseudorandom function for protecting the
-   integrity of the messages and for authenticating message fields), and
-   authentication (the algorithm on which the mutual authentication of
-   the two parties is based).  The encodings and meanings for these
-   choices are presented in Appendix B.
-
-   The main mode exchange has five optional features: stateless cookie
-   exchange, perfect forward secrecy for the keying material, secrecy
-   for the identities, perfect forward secrecy for identity secrecy, use
-   of signatures (for non-repudiation).  The two parties can use any
-   combination of these features.
-
-   The general outline of processing is that the Initiator of the
-   exchange begins by specifying as much information as he wishes in his
-   first message.  The Responder replies, supplying as much information
-   as he wishes.  The two sides exchange messages, supplying more
-   information each time, until their requirements are satisfied.
-
-   The choice of how much information to include in each message depends
-   on which options are desirable.  For example, if stateless cookies
-   are not a requirement, and identity secrecy and perfect forward
-   secrecy for the keying material are not requirements, and if non-
-   repudiatable signatures are acceptable, then the exchange can be
-   completed in three messages.
-
-   Additional features may increase the number of roundtrips needed for
-   the keying material determination.
-
-   ISAKMP provides fields for specifying the security association
-   parameters for use with the AH and ESP protocols.  These security
-
-
-
-Orman                        Informational                      [Page 7]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   association payload types are specified in the ISAKMP memo; the
-   payload types can be protected with OAKLEY keying material and
-   algorithms, but this document does not discuss their use.
-
-2.3.1 The Essential Key Exchange Message Fields
-
-   There are 12 fields in an OAKLEY key exchange message.  Not all the
-   fields are relevant in every message; if a field is not relevant it
-   can have a null value or not be present (no payload).
-
-      CKY-I            originator cookie.
-      CKY-R            responder cookie.
-      MSGTYPE          for key exchange, will be ISA_KE&AUTH_REQ or
-                       ISA_KE&AUTH_REP; for new group definitions,
-                       will be ISA_NEW_GROUP_REQ or ISA_NEW_GROUP_REP
-      GRP              the name of the Diffie-Hellman group used for
-                       the exchange
-      g^x (or g^y)     variable length integer representing a power of
-                       group generator
-      EHAO or EHAS     encryption, hash, authentication functions,
-                       offered and selectedj, respectively
-      IDP              an indicator as to whether or not encryption with
-                       g^xy follows (perfect forward secrecy for ID's)
-      ID(I)            the identity for the Initiator
-      ID(R)            the identity for the Responder
-      Ni               nonce supplied by the Initiator
-      Nr               nonce supplied by the Responder
-
-   The construction of the cookies is implementation dependent.  Phil
-   Karn has recommended making them the result of a one-way function
-   applied to a secret value (changed periodically), the local and
-   remote IP address, and the local and remote UDP port.  In this way,
-   the cookies remain stateless and expire periodically.  Note that with
-   OAKLEY, this would cause the KEYID's derived from the secret value to
-   also expire, necessitating the removal of any state information
-   associated with it.
-
-   In order to support pre-distributed keys, we recommend that
-   implementations reserve some portion of their cookie space to
-   permanent keys.  The encoding of these depends only on the local
-   implementation.
-
-   The encryption functions used with OAKLEY must be cryptographic
-   transforms which guarantee privacy and integrity for the message
-   data.  Merely using DES in CBC mode is not permissible.  The
-   MANDATORY and OPTIONAL transforms will include any that satisfy this
-   criteria and are defined for use with RFC 2406 (ESP).
-
-
-
-
-Orman                        Informational                      [Page 8]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   The one-way (hash) functions used with OAKLEY must be cryptographic
-   transforms which can be used as either keyed hash (pseudo-random) or
-   non-keyed transforms.  The MANDATORY and OPTIONAL transforms will
-   include any that are defined for use with RFC 2406 (AH).
-
-   Where nonces are indicated, they will be variable precision integers
-   with an entropy value that matches the "strength" attribute of the
-   GRP used with the exchange.  If no GRP is indicated, the nonces must
-   be at least 90 bits long.  The pseudo-random generator for the nonce
-   material should start with initial data that has at least 90 bits of
-   entropy; see RFC 1750.
-
-2.3.1.1 Exponent Advice
-
-   Ideally, the exponents will have at least 180 bits of entropy for
-   every key exchange.  This ensures complete independence of keying
-   material between two exchanges (note that this applies if only one of
-   the parties chooses a random exponent).  In practice, implementors
-   may wish to base several key exchanges on a single base value with
-   180 bits of entropy and use one-way hash functions to guarantee that
-   exposure of one key will not compromise others.  In this case, a good
-   recommendation is to keep the base values for nonces and cookies
-   separate from the base value for exponents, and to replace the base
-   value with a full 180 bits of entropy as frequently as possible.
-
-   The values 0 and p-1 should not be used as exponent values;
-   implementors should be sure to check for these values, and they
-   should also refuse to accept the values 1 and p-1 from remote parties
-   (where p is the prime used to define a modular exponentiation group).
-
-2.3.2 Mapping to ISAKMP Message Structures
-
-   All the OAKLEY message fields correspond to ISAKMP message payloads
-   or payload components.  The relevant payload fields are the SA
-   payload, the AUTH payload, the Certificate Payload, the Key Exchange
-   Payload.  The ISAKMP protocol framwork is a work in progress at this
-   time, and the exact mapping of Oakley message fields to ISAKMP
-   payloads is also in progress (to be known as the Resolution
-   document).
-
-   Some of the ISAKMP header and payload fields will have constant
-   values when used with OAKLEY.  The exact values to be used will be
-   published in a Domain of Interpretation document accompanying the
-   Resolution document.
-
-   In the following we indicate where each OAKLEY field appears in the
-   ISAKMP message structure.  These are recommended only; the Resolution
-   document will be the final authority on this mapping.
-
-
-
-Orman                        Informational                      [Page 9]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-      CKY-I            ISAKMP header
-      CKY-R            ISAKMP header
-      MSGTYPE          Message Type in ISAKMP header
-      GRP              SA payload, Proposal section
-      g^x (or g^y)     Key Exchange Payload, encoded as a variable
-                       precision integer
-      EHAO and EHAS    SA payload, Proposal section
-      IDP              A bit in the RESERVED field in the AUTH header
-      ID(I)            AUTH payload, Identity field
-      ID(R)            AUTH payload, Identity field
-      Ni               AUTH payload, Nonce Field
-      Nr               AUTH payload, Nonce Field
-      S{...}Kx         AUTH payload, Data Field
-      prf{K,...}       AUTH payload, Data Field
-
-2.4 The Key Exchange Protocol
-
-   The exact number and content of messages exchanged during an OAKLEY
-   key exchange depends on which options the Initiator and Responder
-   want to use.  A key exchange can be completed with three or more
-   messages, depending on those options.
-
-   The three components of the key determination protocol are the
-
-      1. cookie exchange (optionally stateless)
-      2. Diffie-Hellman half-key exchange (optional, but essential for
-         perfect forward secrecy)
-      3. authentication (options: privacy for ID's, privacy for ID's
-         with PFS, non-repudiatable)
-
-   The initiator can supply as little information as a bare exchange
-   request, carrying no additional information.  On the other hand the
-   initiator can begin by supplying all of the information necessary for
-   the responder to authenticate the request and complete the key
-   determination quickly, if the responder chooses to accept this
-   method.  If not, the responder can reply with a minimal amount of
-   information (at the minimum, a cookie).
-
-   The method of authentication can be digital signatures, public key
-   encryption, or an out-of-band symmetric key.  The three different
-   methods lead to slight variations in the messages, and the variations
-   are illustrated by examples in this section.
-
-   The Initiator is responsible for retransmitting messages if the
-   protocol does not terminate in a timely fashion.  The Responder must
-   therefore avoid discarding reply information until it is acknowledged
-   by Initiator in the course of continuing the protocol.
-
-
-
-
-Orman                        Informational                     [Page 10]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   The remainder of this section contains examples demonstrating how to
-   use OAKLEY options.
-
-2.4.1 An Aggressive Example
-
-   The following example indicates how two parties can complete a key
-   exchange in three messages.  The identities are not secret, the
-   derived keying material is protected by PFS.
-
-   By using digital signatures, the two parties will have a proof of
-   communication that can be recorded and presented later to a third
-   party.
-
-   The keying material implied by the group exponentials is not needed
-   for completing the exchange.  If it is desirable to defer the
-   computation, the implementation can save the "x" and "g^y" values and
-   mark the keying material as "uncomputed".  It can be computed from
-   this information later.
-
-   Initiator                                                   Responder
-   ---------                                                   ---------
-     -> CKY-I, 0,     OK_KEYX, GRP, g^x, EHAO, NIDP,               ->
-        ID(I), ID(R), Ni, 0,
-        S{ID(I) | ID(R) | Ni | 0 | GRP | g^x | 0 | EHAO}Ki
-    <-  CKY-R, CKY-I, OK_KEYX, GRP, g^y, EHAS, NIDP,
-        ID(R), ID(I), Nr, Ni,
-        S{ID(R) | ID(I) | Nr | Ni | GRP | g^y | g^x | EHAS}Kr      <-
-     -> CKY-I, CKY-R, OK_KEYX, GRP, g^x, EHAS, NIDP,               ->
-        ID(I), ID(R), Ni, Nr,
-        S{ID(I) | ID(R) | Ni | Nr | GRP | g^x | g^y | EHAS}Ki
-
-   NB "NIDP" means that the PFS option for hiding identities is not used.
-      i.e., the identities are not encrypted using a key based on g^xy
-
-   NB Fields are shown separated by commas in this document; they are
-   concatenated in the actual protocol messages using their encoded
-   forms as specified in the ISAKMP/Oakley Resolution document.
-
-   The result of this exchange is a key with KEYID = CKY-I|CKY-R and
-   value
-
-   sKEYID = prf(Ni | Nr, g^xy | CKY-I | CKY-R).
-
-   The processing outline for this exchange is as follows:
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 11]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   Initiation
-
-      The Initiator generates a unique cookie and associates it with the
-      expected IP address of the responder, and its chosen state
-      information: GRP (the group identifier), a pseudo-randomly
-      selected exponent x, g^x, EHAO list, nonce, identities.  The first
-      authentication choice in the EHAO list is an algorithm that
-      supports digital signatures, and this is used to sign the ID's and
-      the nonce and group id.  The Initiator further
-
-      notes that the key is in the initial state of "unauthenticated",
-      and
-
-      sets a timer for possible retransmission and/or termination of the
-      request.
-
-   When the Responder receives the message, he may choose to ignore all
-   the information and treat it as merely a request for a cookie,
-   creating no state.  If CKY-I is not already in use by the source
-   address in the IP header, the responder generates a unique cookie,
-   CKY-R.  The next steps depend on the Responder's preferences.  The
-   minimal required response is to reply with the first cookie field set
-   to zero and CKY-R in the second field.  For this example we will
-   assume that the responder is more aggressive (for the alternatives,
-   see section 6) and accepts the following:
-
-      group with identifier GRP,
-      first authentication choice (which must be the digital signature
-      method used to sign the Initiator message),
-      lack of perfect forward secrecy for protecting the identities,
-      identity ID(I) and identity ID(R)
-
-   In this example the Responder decides to accept all the information
-   offered by the initiator.  It validates the signature over the signed
-   portion of the message, and associate the pair (CKY-I, CKY-R) with
-   the following state information:
-
-      the source and destination network addresses of the message
-
-      key state of "unauthenticated"
-
-      the first algorithm from the authentication offer
-
-      group GRP, a "y" exponent value in group GRP, and g^x from the
-      message
-
-      the nonce Ni and a pseudorandomly selected value Nr
-
-
-
-
-Orman                        Informational                     [Page 12]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-      a timer for possible destruction of the state.
-
-   The Responder computes g^y, forms the reply message, and then signs
-   the ID and nonce information with the private key of ID(R) and sends
-   it to the Initiator.  In all exchanges, each party should make sure
-   that he neither offers nor accepts 1 or g^(p-1) as an exponential.
-
-   In this example, to expedite the protocol, the Responder implicitly
-   accepts the first algorithm in the Authentication class of the EHAO
-   list.  This because he cannot validate the Initiator signature
-   without accepting the algorithm for doing the signature.  The
-   Responder's EHAS list will also reflect his acceptance.
-
-   The Initiator receives the reply message and
-      validates that CKY-I is a valid association for the network
-      address of the incoming message,
-
-      adds the CKY-R value to the state for the pair (CKY-I, network
-      address), and associates all state information with the pair
-      (CKY-I, CKY-R),
-
-      validates the signature of the responder over the state
-      information (should validation fail, the message is discarded)
-
-      adds g^y to its state information,
-
-      saves the EHA selections in the state,
-
-      optionally computes (g^y)^x (= g^xy) (this can be deferred until
-      after sending the reply message),
-
-      sends the reply message, signed with the public key of ID(I),
-
-      marks the KEYID (CKY-I|CKY-R) as authenticated,
-
-      and composes the reply message and signature.
-
-   When the Responder receives the Initiator message, and if the
-   signature is valid, it marks the key as being in the authenticated
-   state.  It should compute g^xy and associate it with the KEYID.
-
-   Note that although PFS for identity protection is not used, PFS for
-   the derived keying material is still present because the Diffie-
-   Hellman half-keys g^x and g^y are exchanged.
-
-   Even if the Responder only accepts some of the Initiator information,
-   the Initiator will consider the protocol to be progressing.  The
-   Initiator should assume that fields that were not accepted by the
-
-
-
-Orman                        Informational                     [Page 13]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   Responder were not recorded by the Responder.
-
-   If the Responder does not accept the aggressive exchange and selects
-   another algorithm for the A function, then the protocol will not
-   continue using the signature algorithm or the signature value from
-   the first message.
-
-2.4.1.1 Fields Not Present
-
-   If the Responder does not accept all the fields offered by the
-   Initiator, he should include null values for those fields in his
-   response.  Section 6 has guidelines on how to select fields in a
-   "left-to-right" manner.  If a field is not accepted, then it and all
-   following fields must have null values.
-
-   The Responder should not record any information that it does not
-   accept.  If the ID's and nonces have null values, there will not be a
-   signature over these null values.
-
-2.4.1.2 Signature via Pseudo-Random Functions
-
-   The aggressive example is written to suggest that public key
-   technology is used for the signatures.  However, a pseudorandom
-   function can be used, if the parties have previously agreed to such a
-   scheme and have a shared key.
-
-   If the first proposal in the EHAO list is an "existing key" method,
-   then the KEYID named in that proposal will supply the keying material
-   for the "signature" which is computed using the "H" algorithm
-   associated with the KEYID.
-
-   Suppose the first proposal in EHAO is
-      EXISTING-KEY, 32
-   and the "H" algorithm for KEYID 32 is MD5-HMAC, by prior negotiation.
-   The keying material is some string of bits, call it sK32.  Then in
-   the first message in the aggressive exchange, where the signature
-
-           S{ID(I), ID(R), Ni, 0, GRP, g^x, EHAO}Ki
-
-   is indicated, the signature computation would be performed by
-       MD5-HMAC_func(KEY=sK32, DATA = ID(I) | ID(R) | Ni | 0 | GRP | g^x
-      | g^y | EHAO) (The exact definition of the algorithm corresponding
-   to "MD5-HMAC- func" will appear in the RFC defining that transform).
-
-   The result of this computation appears in the Authentication payload.
-
-
-
-
-
-
-Orman                        Informational                     [Page 14]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-2.4.2 An Aggressive Example With Hidden Identities
-
-   The following example indicates how two parties can complete a key
-   exchange without using digital signatures.  Public key cryptography
-   hides the identities during authentication.  The group exponentials
-   are exchanged and authenticated, but the implied keying material
-   (g^xy) is not needed during the exchange.
-
-   This exchange has an important difference from the previous signature
-   scheme --- in the first message, an identity for the responder is
-   indicated as cleartext: ID(R').  However, the identity hidden with
-   the public key cryptography is different: ID(R).  This happens
-   because the Initiator must somehow tell the Responder which
-   public/private key pair to use for the decryption, but at the same
-   time, the identity is hidden by encryption with that public key.
-
-   The Initiator might elect to forgo secrecy of the Responder identity,
-   but this is undesirable.  Instead, if there is a well-known identity
-   for the Responder node, the public key for that identity can be used
-   to encrypt the actual Responder identity.
-
-   Initiator                                                   Responder
-   ---------                                                   ---------
-     -> CKY-I, 0,     OK_KEYX, GRP, g^x, EHAO, NIDP,                ->
-        ID(R'), E{ID(I), ID(R), E{Ni}Kr}Kr'
-    <-  CKY-R, CKY-I, OK_KEYX, GRP, g^y, EHAS, NIDP,
-        E{ID(R), ID(I), Nr}Ki,
-        prf(Kir, ID(R) | ID(I) | GRP | g^y | g^x | EHAS) <-
-     -> CKY-I, CKY-R, OK_KEYX, GRP, 0, 0, NIDP,
-        prf(Kir, ID(I) | ID(R) | GRP | g^x | g^y | EHAS)    ->
-
-   Kir = prf(0, Ni | Nr)
-
-   NB "NIDP" means that the PFS option for hiding identities is not used.
-
-   NB  The ID(R') value is included in the Authentication payload as
-       described in Appendix B.
-
-   The result of this exchange is a key with KEYID = CKY-I|CKY-R and
-   value sKEYID = prf(Ni | Nr, g^xy | CKY-I | CKY-R).
-
-   The processing outline for this exchange is as follows:
-
-   Initiation
-      The Initiator generates a unique cookie and associates it with the
-      expected IP address of the responder, and its chosen state
-      information: GRP, g^x, EHAO list.  The first authentication choice
-      in the EHAO list is an algorithm that supports public key
-
-
-
-Orman                        Informational                     [Page 15]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-      encryption.  The Initiator also names the two identities to be
-      used for the connection and enters these into the state.  A well-
-      known identity for the responder machine is also chosen, and the
-      public key for this identity is used to encrypt the nonce Ni and
-      the two connection identities.  The Initiator further
-
-      notes that the key is in the initial state of "unauthenticated",
-      and
-
-      sets a timer for possible retransmission and/or termination of the
-      request.
-
-   When the Responder receives the message, he may choose to ignore all
-   the information and treat it as merely a request for a cookie,
-   creating no state.
-
-   If CKY-I is not already in use by the source address in the IP
-   header, the Responder generates a unique cookie, CKY-R.  As before,
-   the next steps depend on the responder's preferences.  The minimal
-   required response is a message with the first cookie field set to
-   zero and CKY-R in the second field.  For this example we will assume
-   that responder is more aggressive and accepts the following:
-
-      group GRP, first authentication choice (which must be the public
-      key encryption algorithm used to encrypt the payload), lack of
-      perfect forward secrecy for protecting the identities, identity
-      ID(I), identity ID(R)
-
-   The Responder must decrypt the ID and nonce information, using the
-   private key for the R' ID.  After this, the private key for the R ID
-   will be used to decrypt the nonce field.
-
-   The Responder now associates the pair (CKY-I, CKY-R) with the
-   following state information:
-
-      the source and destination network addresses of the message
-
-      key state of "unauthenticated"
-
-      the first algorithm from each class in the EHAO (encryption-hash-
-      authentication algorithm offers) list
-
-      group GRP and a y and g^y value in group GRP
-
-      the nonce Ni and a pseudorandomly selected value Nr
-
-      a timer for possible destruction of the state.
-
-
-
-
-Orman                        Informational                     [Page 16]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   The Responder then encrypts the state information with the public key
-   of ID(I), forms the prf value, and sends it to the Initiator.
-
-   The Initiator receives the reply message and
-      validates that CKY-I is a valid association for the network
-      address of the incoming message,
-
-      adds the CKY-R value to the state for the pair (CKY-I, network
-      address), and associates all state information with the pair
-      (CKY-I, CKY-R),
-
-      decrypts the ID and nonce information
-
-      checks the prf calculation (should this fail, the message is
-      discarded)
-
-      adds g^y to its state information,
-
-      saves the EHA selections in the state,
-
-      optionally computes (g^x)^y (= g^xy) (this may be deferred), and
-
-      sends the reply message, encrypted with the public key of ID(R),
-
-      and marks the KEYID (CKY-I|CKY-R) as authenticated.
-
-   When the Responder receives this message, it marks the key as being
-   in the authenticated state.  If it has not already done so, it should
-   compute g^xy and associate it with the KEYID.
-
-   The secret keying material sKEYID = prf(Ni | Nr,  g^xy | CKY-I |
-   CKY-R)
-
-   Note that although PFS for identity protection is not used, PFS for
-   the derived keying material is still present because the Diffie-
-   Hellman half-keys g^x and g^y are exchanged.
-
-2.4.3 An Aggressive Example With Private Identities and Without Diffie-
-      Hellman
-
-   Considerable computational expense can be avoided if perfect forward
-   secrecy is not a requirement for the session key derivation.  The two
-   parties can exchange nonces and secret key parts to achieve the
-   authentication and derive keying material.  The long-term privacy of
-   data protected with derived keying material is dependent on the
-   private keys of each of the parties.
-
-
-
-
-
-Orman                        Informational                     [Page 17]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   In this exchange, the GRP has the value 0 and the field for the group
-   exponential is used to hold a nonce value instead.
-
-   As in the previous section, the first proposed algorithm must be a
-   public key encryption system; by responding with a cookie and a non-
-   zero exponential field, the Responder implicitly accepts the first
-   proposal and the lack of perfect forward secrecy for the identities
-   and derived keying material.
-
-   Initiator                                                   Responder
-   ---------                                                   ---------
-     -> CKY-I, 0,     OK_KEYX, 0, 0, EHAO, NIDP,                  ->
-        ID(R'), E{ID(I), ID(R), sKi}Kr', Ni
-    <-  CKY-R, CKY-I, OK_KEYX, 0, 0, EHAS, NIDP,
-        E{ID(R), ID(I), sKr}Ki, Nr,
-        prf(Kir, ID(R) | ID(I) | Nr | Ni | EHAS)                 <-
-     -> CKY-I, CKY-R, OK_KEYX, EHAS, NIDP,
-        prf(Kir, ID(I) | ID(R) | Ni | Nr | EHAS)                  ->
-
-   Kir = prf(0, sKi | sKr)
-
-   NB  The sKi and sKr values go into the nonce fields.  The change in
-   notation is meant to emphasize that their entropy is critical to
-   setting the keying material.
-
-   NB "NIDP" means that the PFS option for hiding identities is not
-   used.
-
-   The result of this exchange is a key with KEYID = CKY-I|CKY-R and
-   value sKEYID = prf(Kir, CKY-I | CKY-R).
-
-2.4.3 A Conservative Example
-
-   In this example the two parties are minimally aggressive; they use
-   the cookie exchange to delay creation of state, and they use perfect
-   forward secrecy to protect the identities.  For this example, they
-   use public key encryption for authentication; digital signatures or
-   pre-shared keys can also be used, as illustrated previously.  The
-   conservative example here does not change the use of nonces, prf's,
-   etc., but it does change how much information is transmitted in each
-   message.
-
-   The responder considers the ability of the initiator to repeat CKY-R
-   as weak evidence that the message originates from a "live"
-   correspondent on the network and the correspondent is associated with
-   the initiator's network address.  The initiator makes similar
-   assumptions when CKY-I is repeated to the initiator.
-
-
-
-
-Orman                        Informational                     [Page 18]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   All messages must have either valid cookies or at least one zero
-   cookie. If both cookies are zero, this indicates a request for a
-   cookie; if only the initiator cookie is zero, it is a response to a
-   cookie request.
-
-   Information in messages violating the cookie rules cannot be used for
-   any OAKLEY operations.
-
-   Note that the Initiator and Responder must agree on one set of EHA
-   algorithms; there is not one set for the Responder and one for the
-   Initiator.  The Initiator must include at least MD5 and DES in the
-   initial offer.
-
-   Fields not indicated have null values.
-
-   Initiator                                                   Responder
-   ---------                                                   ---------
-     ->     0, 0, OK_KEYX                                          ->
-    <-      0, CKY-R, OK_KEYX                                     <-
-     ->     CKY-I, CKY-R, OK_KEYX, GRP, g^x, EHAO                  ->
-    <-      CKY-R, CKY-I, OK_KEYX, GRP, g^y, EHAS                 <-
-     ->     CKY-I, CKY-R, OK_KEYX, GRP, g^x, IDP*,
-            ID(I), ID(R), E{Ni}Kr,                                 ->
-    <-      CKY-R, CKY-I, OK_KEYX, GRP, 0  , 0, IDP,              <-
-            E{Nr, Ni}Ki, ID(R), ID(I),
-            prf(Kir, ID(R) | ID(I) | GRP | g^y | g^x | EHAS )
-     ->     CKY-I, CKY-R, OK_KEYX, GRP, 0  , 0, IDP,
-            prf(Kir, ID(I) | ID(R) | GRP | g^x | g^y | EHAS ) ->
-
-   Kir = prf(0, Ni | Nr)
-
-   * when IDP is in effect, authentication payloads are encrypted with
-     the selected encryption algorithm using the keying material prf(0,
-     g^xy).  (The transform defining the encryption algorithm will
-     define how to select key bits from the keying material.) This
-     encryption is in addition to and after any  public key encryption.
-     See Appendix B.
-
-     Note that in the first messages, several fields are omitted from
-     the description.  These fields are present as null values.
-
-   The first exchange allows the Responder to use stateless cookies; if
-   the responder generates cookies in a manner that allows him to
-   validate them without saving them, as in Photuris, then this is
-   possible.  Even if the Initiator includes a cookie in his initial
-   request, the responder can still use stateless cookies by merely
-   omitting the CKY-I from his reply and by declining to record the
-   Initiator cookie until it appears in a later message.
-
-
-
-Orman                        Informational                     [Page 19]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   After the exchange is complete, both parties compute the shared key
-   material sKEYID as prf(Ni | Nr, g^xy | CKY-I | CKY-R) where "prf" is
-   the pseudo-random function in class "hash" selected in the EHA list.
-
-   As with the cookies, each party considers the ability of the remote
-   side to repeat the Ni or Nr value as a proof that Ka, the public key
-   of party a, speaks for the remote party and establishes its identity.
-
-   In analyzing this exchange, it is important to note that although the
-   IDP option ensures that the identities are protected with an
-   ephemeral key g^xy, the authentication itself does not depend on
-   g^xy.  It is essential that the authentication steps validate the g^x
-   and g^y values, and it is thus imperative that the authentication not
-   involve a circular dependency on them.  A third party could intervene
-   with a "man-in-middle" scheme to convince the initiator and responder
-   to use different g^xy values; although such an attack might result in
-   revealing the identities to the eavesdropper, the authentication
-   would fail.
-
-2.4.4 Extra Strength for Protection of Encryption Keys
-
-   The nonces Ni and Nr are used to provide an extra dimension of
-   secrecy in deriving session keys.  This makes the secrecy of the key
-   depend on two different problems: the discrete logarithm problem in
-   the group G, and the problem of breaking the nonce encryption scheme.
-   If RSA encryption is used, then this second problem is roughly
-   equivalent to factoring the RSA public keys of both the initiator and
-   responder.
-
-   For authentication, the key type, the validation method, and the
-   certification requirement must be indicated.
-
-2.5 Identity and Authentication
-
-2.5.1 Identity
-
-   In OAKLEY exchanges the Initiator offers Initiator and Responder ID's
-   -- the former is the claimed identity for the Initiator, and the
-   latter is the requested ID for the Responder.
-
-   If neither ID is specified, the ID's are taken from the IP header
-   source and destination addresses.
-
-   If the Initiator doesn't supply a responder ID, the Responder can
-   reply by naming any identity that the local policy allows.  The
-   Initiator can refuse acceptance by terminating the exchange.
-
-
-
-
-
-Orman                        Informational                     [Page 20]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   The Responder can also reply with a different ID than the Initiator
-   suggested; the Initiator can accept this implicitly by continuing the
-   exchange or refuse it by terminating (not replying).
-
-2.5.2 Authentication
-
-   The authentication of principals to one another is at the heart of
-   any key exchange scheme.  The Internet community must decide on a
-   scalable standard for solving this problem, and OAKLEY must make use
-   of that standard.  At the time of this writing, there is no such
-   standard, though several are emerging.  This document attempts to
-   describe how a handful of standards could be incorporated into
-   OAKLEY, without attempting to pick and choose among them.
-
-   The following methods can appear in OAKLEY offers:
-
-   a. Pre-shared Keys
-      When two parties have arranged for a trusted method of
-      distributing secret keys for their mutual authentication, they can
-      be used for authentication.  This has obvious scaling problems for
-      large systems, but it is an acceptable interim solution for some
-      situations.  Support for pre-shared keys is REQUIRED.
-
-      The encryption, hash, and authentication algorithm for use with a
-      pre-shared key must be part of the state information distributed
-      with the key itself.
-
-      The pre-shared keys have a KEYID and keying material sKEYID; the
-      KEYID is used in a pre-shared key authentication option offer.
-      There can be more than one pre-shared key offer in a list.
-
-      Because the KEYID persists over different invocations of OAKLEY
-      (after a crash, etc.), it must occupy a reserved part of the KEYID
-      space for the two parties.  A few bits can be set aside in each
-      party's "cookie space" to accommodate this.
-
-      There is no certification authority for pre-shared keys.  When a
-      pre-shared key is used to generate an authentication payload, the
-      certification authority is "None", the Authentication Type is
-      "Preshared", and the payload contains
-
-         the KEYID, encoded as two 64-bit quantities, and the result of
-         applying the pseudorandom hash function to the message body
-         with the sKEYID forming the key for the function
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 21]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   b. DNS public keys
-      Security extensions to the DNS protocol [DNSSEC] provide a
-      convenient way to access public key information, especially for
-      public keys associated with hosts.  RSA keys are a requirement for
-      secure DNS implementations; extensions to allow optional DSS keys
-      are a near-term possibility.
-
-      DNS KEY records have associated SIG records that are signed by a
-      zone authority, and a hierarchy of signatures back to the root
-      server establishes a foundation for trust.  The SIG records
-      indicate the algorithm used for forming the signature.
-
-      OAKLEY implementations must support the use of DNS KEY and SIG
-      records for authenticating with respect to IPv4 and IPv6 addresses
-      and fully qualified domain names.  However, implementations are
-      not required to support any particular algorithm (RSA, DSS, etc.).
-
-   c. RSA public keys w/o certification authority signature PGP
-      [Zimmerman] uses public keys with an informal method for
-      establishing trust.  The format of PGP public keys and naming
-      methods will be described in a separate RFC.  The RSA algorithm
-      can be used with PGP keys for either signing or encryption; the
-      authentication option should indicate either RSA-SIG or RSA-ENC,
-      respectively.  Support for this is OPTIONAL.
-
-   d.1 RSA public keys w/ certificates There are various formats and
-      naming conventions for public keys that are signed by one or more
-      certification authorities.  The Public Key Interchange Protocol
-      discusses X.509 encodings and validation.  Support for this is
-      OPTIONAL.
-
-   d.2 DSS keys w/ certificates Encoding for the Digital Signature
-      Standard with X.509 is described in draft-ietf-ipsec-dss-cert-
-      00.txt.  Support for this is OPTIONAL; an ISAKMP Authentication
-      Type will be assigned.
-
-2.5.3 Validating Authentication Keys
-
-   The combination of the Authentication algorithm, the Authentication
-   Authority, the Authentication Type, and a key (usually public) define
-   how to validate the messages with respect to the claimed identity.
-   The key information will be available either from a pre-shared key,
-   or from some kind of certification authority.
-
-   Generally the certification authority produces a certificate binding
-   the entity name to a public key.  OAKLEY implementations must be
-   prepared to fetch and validate certificates before using the public
-   key for OAKLEY authentication purposes.
-
-
-
-Orman                        Informational                     [Page 22]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   The ISAKMP Authentication Payload defines the Authentication
-   Authority field for specifying the authority that must be apparent in
-   the trust hierarchy for authentication.
-
-   Once an appropriate certificate is obtained (see 2.4.3), the
-   validation method will depend on the Authentication Type; if it is
-   PGP then the PGP signature validation routines can be called to
-   satisfy the local web-of-trust predicates; if it is RSA with X.509
-   certificates, the certificate must be examined to see if the
-   certification authority signature can be validated, and if the
-   hierarchy is recognized by the local policy.
-
-2.5.4 Fetching Identity Objects
-
-   In addition to interpreting the certificate or other data structure
-   that contains an identity, users of OAKLEY must face the task of
-   retrieving certificates that bind a public key to an identifier and
-   also retrieving auxiliary certificates for certifying authorities or
-   co-signers (as in the PGP web of trust).
-
-   The ISAKMP Credentials Payload can be used to attach useful
-   certificates to OAKLEY messages.  The Credentials Payload is defined
-   in Appendix B.
-
-   Support for accessing and revoking public key certificates via the
-   Secure DNS protocol [SECDNS] is MANDATORY for OAKLEY implementations.
-   Other retrieval methods can be used when the AUTH class indicates a
-   preference.
-
-   The Public Key Interchange Protocol discusses a full protocol that
-   might be used with X.509 encoded certificates.
-
-2.6 Interface to Cryptographic Transforms
-
-   The keying material computed by the key exchange should have at least
-   90 bits of entropy, which means that it must be at least 90 bits in
-   length.  This may be more or less than is required for keying the
-   encryption and/or pseudorandom function transforms.
-
-   The transforms used with OAKLEY should have auxiliary algorithms
-   which take a variable precision integer and turn it into keying
-   material of the appropriate length.  For example, a DES algorithm
-   could take the low order 56 bits, a triple DES algorithm might use
-   the following:
-
-              K1 = low 56 bits of md5(0|sKEYID)
-              K2 = low 56 bits of md5(1|sKEYID)
-              K3 = low 56 bits of md5(2|sKEYID)
-
-
-
-Orman                        Informational                     [Page 23]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   The transforms will be called with the keying material encoded as a
-   variable precision integer, the length of the data, and the block of
-   memory with the data.  Conversion of the keying material to a
-   transform key is the responsibility of the transform.
-
-2.7 Retransmission, Timeouts, and Error Messages
-
-   If a response from the Responder is not elicited in an appropriate
-   amount of time, the message should be retransmitted by the Initiator.
-   These retransmissions must be handled gracefully by both parties; the
-   Responder must retain information for retransmitting until the
-   Initiator moves to the next message in the protocol or completes the
-   exchange.
-
-   Informational error messages present a problem because they cannot be
-   authenticated using only the information present in an incomplete
-   exchange; for this reason, the parties may wish to establish a
-   default key for OAKLEY error messages.  A possible method for
-   establishing such a key is described in Appendix B, under the use of
-   ISA_INIT message types.
-
-   In the following the message type is OAKLEY Error, the KEYID supplies
-   the H algorithm and key for authenticating the message contents; this
-   value is carried in the Sig/Prf payload.
-
-   The Error payload contains the error code and the contents of the
-   rejected message.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 24]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-                             1                   2                   3
-         0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        !                                                               !
-        ~                       Initiator-Cookie                        ~
-     /  !                                                               !
-KEYID   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-    \  !                                                               !
-        ~                       Responder-Cookie                        ~
-        !                                                               !
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        !                  Domain of Interpretation                     !
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        ! Message Type  ! Exch  ! Vers  !          Length               !
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        !                 SPI (unused)                                  !
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        !                 SPI (unused)                                  !
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        !                 Error Payload                                 !
-        ~                                                               ~
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        !                 Sig/prf Payload
-        ~                                                               ~
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-   The error message will contain the cookies as presented in the
-   offending message, the message type OAKLEY_ERROR, and the reason for
-   the error, followed by the rejected message.
-
-   Error messages are informational only, and the correctness of the
-   protocol does not depend on them.
-
-   Error reasons:
-
-   TIMEOUT                   exchange has taken too long, state destroyed
-   AEH_ERROR                 an unknown algorithm appears in an offer
-   GROUP_NOT_SUPPORTED       GRP named is not supported
-   EXPONENTIAL_UNACCEPTABLE  exponential too large/small or is +-1
-   SELECTION_NOT_OFFERED     selection does not occur in offer
-   NO_ACCEPTABLE_OFFERS      no offer meets host requirements
-   AUTHENTICATION_FAILURE    signature or hash function fails
-   RESOURCE_EXCEEDED         too many exchanges or too much state info
-   NO_EXCHANGE_IN_PROGRESS   a reply received with no request in progress
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 25]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-2.8 Additional Security for Privacy Keys: Private Groups
-
-   If the two parties have need to use a Diffie-Hellman key
-   determination scheme that does not depend on the standard group
-   definitions, they have the option of establishing a private group.
-   The authentication need not be repeated, because this stage of the
-   protocol will be protected by a pre-existing authentication key.  As
-   an extra security measure, the two parties will establish a private
-   name for the shared keying material, so even if they use exactly the
-   same group to communicate with other parties, the re-use will not be
-   apparent to passive attackers.
-
-   Private groups have the advantage of making a widespread passive
-   attack much harder by increasing the number of groups that would have
-   to be exhaustively analyzed in order to recover a large number of
-   session keys.  This contrasts with the case when only one or two
-   groups are ever used; in that case, one would expect that years and
-   years of session keys would be compromised.
-
-   There are two technical challenges to face: how can a particular user
-   create a unique and appropriate group, and how can a second party
-   assure himself that the proposed group is reasonably secure?
-
-   The security of a modular exponentiation group depends on the largest
-   prime factor of the group size.  In order to maximize this, one can
-   choose "strong" or Sophie Germaine primes, P = 2Q + 1, where P and Q
-   are prime.  However, if P = kQ + 1, where k is small, then the
-   strength of the group is still considerable.  These groups are known
-   as Schnorr subgroups, and they can be found with much less
-   computational effort than Sophie-Germaine primes.
-
-   Schnorr subgroups can also be validated efficiently by using probable
-   prime tests.
-
-   It is also fairly easy to find P, k, and Q such that the largest
-   prime factor can be easily proven to be Q.
-
-   We estimate that it would take about 10 minutes to find a new group
-   of about 2^1024 elements, and this could be done once a day by a
-   scheduled process; validating a group proposed by a remote party
-   would take perhaps a minute on a 25 MHz RISC machine or a 66 MHz CISC
-   machine.
-
-   We note that validation is done only between previously mutually
-   authenticated parties, and that a new group definition always follows
-   and is protected by a key established using a well-known group.
-   There are five points to keep in mind:
-
-
-
-
-Orman                        Informational                     [Page 26]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-      a. The description and public identifier for the new group are
-      protected by the well-known group.
-
-      b. The responder can reject the attempt to establish the new
-      group, either because he is too busy or because he cannot validate
-      the largest prime factor as being sufficiently large.
-
-      c. The new modulus and generator can be cached for long periods of
-      time; they are not security critical and need not be associated
-      with ongoing activity.
-
-      d. Generating a new g^x value periodically will be more expensive
-      if there are many groups cached; however, the importance of
-      frequently generating new g^x values is reduced, so the time
-      period can be lengthened correspondingly.
-
-      e. All modular exponentiation groups have subgroups that are
-      weaker than the main group.  For Sophie Germain primes, if the
-      generator is a square, then there are only two elements in the
-      subgroup: 1 and g^(-1) (same as g^(p-1)) which we have already
-      recommended avoiding.  For Schnorr subgroups with k not equal to
-      2, the subgroup can be avoided by checking that the exponential is
-      not a kth root of 1 (e^k != 1 mod p).
-
-2.8.1 Defining a New Group
-
-   This section describes how to define a new group.  The description of
-   the group is hidden from eavesdroppers, and the identifier assigned
-   to the group is unique to the two parties.  Use of the new group for
-   Diffie-Hellman key exchanges is described in the next section.
-
-   The secrecy of the description and the identifier increases the
-   difficulty of a passive attack, because if the group descriptor is
-   not known to the attacker, there is no straightforward and efficient
-   way to gain information about keys calculated using the group.
-
-   Only the description of the new group need be encrypted in this
-   exchange.  The hash algorithm is implied by the OAKLEY session named
-   by the group.  The encryption is the encryption function of the
-   OAKLEY session.
-
-   The descriptor of the new group is encoded in the new group payload.
-   The nonces are encoded in the Authentication Payload.
-
-   Data beyond the encryption boundary is encrypted using the transform
-   named by the KEYID.
-
-
-
-
-
-Orman                        Informational                     [Page 27]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   The following messages use the ISAKMP Key Exchange Identifier OAKLEY
-   New Group.
-
-   To define a new modular exponentiation group:
-
-     Initiator                                        Responder
-     ---------                                       ----------
-      ->   KEYID,                                        ->
-           INEWGRP,
-           Desc(New Group), Na
-           prf(sKEYID, Desc(New Group) | Na)
-
-      <-   KEYID,
-           INEWGRPRS,
-           Na, Nb
-           prf(sKEYID, Na | Nb | Desc(New Group))       <-
-
-       ->  KEYID,
-           INEWGRPACK
-           prf(sKEYID, Nb | Na | Desc(New Group))        ->
-
-   These messages are encrypted at the encryption boundary using the key
-   indicated.  The hash value is placed in the "digital signature" field
-   (see Appendix B).
-
-      New GRP identifier = trunc16(Na) | trunc16(Nb)
-
-      (trunc16 indicates truncation to 16 bits; the initiator and
-      responder must use nonces that have distinct upper bits from any
-      used for current GRPID's)
-
-      Desc(G) is the encoding of the descriptor for the group descriptor
-      (see Appendix A for the format of a group descriptor)
-
-   The two parties must store the mapping between the new group
-   identifier GRP and the group descriptor Desc(New Group).  They must
-   also note the identities used for the KEYID and copy these to the
-   state for the new group.
-
-   Note that one could have the same group descriptor associated with
-   several KEYID's.   Pre-calculation of g^x values may be done based
-   only on the group descriptor, not the private group name.
-
-2.8.2 Deriving a Key Using a Private Group
-
-   Once a private group has been established, its group id can be used
-   in the key exchange messages in the GRP position.  No changes to the
-   protocol are required.
-
-
-
-Orman                        Informational                     [Page 28]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-2.9 Quick Mode: New Keys From Old,
-
-   When an authenticated KEYID and associated keying material sKEYID
-   already exist, it is easy to derive additional KEYID's and keys
-   sharing similar attributes (GRP, EHA, etc.)  using only hashing
-   functions.  The KEYID might be one that was derived in Main Mode, for
-   example.
-
-   On the other hand, the authenticated key may be a manually
-   distributed key, one that is shared by the initiator and responder
-   via some means external to OAKLEY.  If the distribution method has
-   formed the KEYID using appropriately unique values for the two halves
-   (CKY-I and CKY-R), then this method is applicable.
-
-   In the following, the Key Exchange Identifier is OAKLEY Quick Mode.
-   The nonces are carried in the Authentication Payload, and the prf
-   value is carried in the Authentication Payload; the Authentication
-   Authority is "None" and the type is "Pre-Shared".
-
-   The protocol is:
-
-     Initiator                                           Responder
-     ---------                                           ---------
-     -> KEYID, INEWKRQ, Ni, prf(sKEYID, Ni)                ->
-    <-  KEYID, INEWKRS, Nr, prf(sKEYID, 1 | Nr | Ni)      <-
-     -> KEYID, INEWKRP, 0, prf(sKEYID,  0 | Ni | Nr)       ->
-
-   The New KEYID, NKEYID, is Ni | Nr
-
-   sNKEYID = prf(sKEYID, Ni | Nr )
-
-   The identities and EHA values associated with NKEYID are the same as
-   those associated with KEYID.
-
-   Each party must validate the hash values before using the new key for
-   any purpose.
-
-2.10 Defining and Using Pre-Distributed Keys
-
-   If a key and an associated key identifier and state information have
-   been distributed manually, then the key can be used for any OAKLEY
-   purpose.  The key must be associated with the usual state
-   information:  ID's and EHA algorithms.
-
-   Local policy dictates when a manual key can be included in the OAKLEY
-   database.  For example, only privileged users would be permitted to
-   introduce keys associated with privileged ID's, an unprivileged user
-   could only introduce keys associated with her own ID.
-
-
-
-Orman                        Informational                     [Page 29]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-2.11 Distribution of an External Key
-
-   Once an OAKLEY session key and ancillary algorithms are established,
-   the keying material and the "H" algorithm can be used to distribute
-   an externally generated key and to assign a KEYID to it.
-
-   In the following, KEYID represents an existing, authenticated OAKLEY
-   session key, and sNEWKEYID represents the externally generated keying
-   material.
-
-   In the following, the Key Exchange Identifier is OAKLEY External
-   Mode.  The Key Exchange Payload contains the new key, which is
-   protected
-
-  Initiator                                                     Responder
-  ---------                                                     ---------
-  -> KEYID, IEXTKEY, Ni, prf(sKEYID, Ni)                               ->
- <-  KEYID, IEXTKEY, Nr, prf(sKEYID, 1 | Nr | Ni)                     <-
-  -> KEYID, IEXTKEY, Kir xor sNEWKEYID*, prf(Kir, sNEWKEYID | Ni | Nr) ->
-
-   Kir = prf(sKEYID, Ni | Nr)
-
-   * this field is carried in the Key Exchange Payload.
-
-   Each party must validate the hash values using the "H" function in
-   the KEYID state before changing any key state information.
-
-   The new key is recovered by the Responder by calculating the xor of
-   the field in the Authentication Payload with the Kir value.
-
-   The new key identifier, naming the keying material sNEWKEYID, is
-   prf(sKEYID, 1 | Ni | Nr).
-
-   Note that this exchange does not require encryption.  Hugo Krawcyzk
-   suggested the method and noted its advantage.
-
-2.11.1 Cryptographic Strength Considerations
-
-   The strength of the key used to distribute the external key must be
-   at least equal to the strength of the external key.  Generally, this
-   means that the length of the sKEYID material must be greater than or
-   equal to the length of the sNEWKEYID material.
-
-   The derivation of the external key, its strength or intended use are
-   not addressed by this protocol; the parties using the key must have
-   some other method for determining these properties.
-
-
-
-
-
-Orman                        Informational                     [Page 30]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   As of early 1996, it appears that for 90 bits of cryptographic
-   strength, one should use a modular exponentiation group modulus of
-   2000 bits.  For 128 bits of strength, a 3000 bit modulus is required.
-
-3. Specifying and Deriving Security Associations
-
-   When a security association is defined, only the KEYID need be given.
-   The responder should be able to look up the state associated with the
-   KEYID value and find the appropriate keying material, sKEYID.
-
-   Deriving keys for use with IPSEC protocols such as ESP or AH is a
-   subject covered in the ISAKMP/Oakley Resolution document.  That
-   document also describes how to negotiate acceptable parameter sets
-   and identifiers for ESP and AH, and how to exactly calculate the
-   keying material for each instance of the protocols.  Because the
-   basic keying material defined here (g^xy) may be used to derive keys
-   for several instances of ESP and AH, the exact mechanics of using
-   one-way functions to turn g^xy into several unique keys is essential
-   to correct usage.
-
-4. ISAKMP Compatibility
-
-   OAKLEY uses ISAKMP header and payload formats, as described in the
-   text and in Appendix B.  There are particular noteworthy extensions
-   beyond the version 4 draft.
-
-4.1 Authentication with Existing Keys
-
-   In the case that two parties do not have suitable public key
-   mechanisms in place for authenticating each other, they can use keys
-   that were distributed manually.  After establishment of these keys
-   and their associated state in OAKLEY, they can be used for
-   authentication modes that depend on signatures, e.g. Aggressive Mode.
-
-   When an existing key is to appear in an offer list, it should be
-   indicated with an Authentication Algorithm of ISAKMP_EXISTING.  This
-   value will be assigned in the ISAKMP RFC.
-
-   When the authentication method is ISAKMP_EXISTING, the authentication
-   authority will have the value ISAKMP_AUTH_EXISTING; the value for
-   this field must not conflict with any authentication authority
-   registered with IANA and is defined in the ISAKMP RFC.
-
-
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 31]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   The authentication payload will have two parts:
-
-       the KEYID for the pre-existing key
-
-       the identifier for the party to be authenticated by the pre-
-       existing key.
-
-   The pseudo-random function "H" in the state information for that
-   KEYID will be the signature algorithm, and it will use the keying
-   material for that key (sKEYID) when generating or checking the
-   validity of message data.
-
-   E.g. if the existing key has an KEYID denoted by KID and 128 bits of
-   keying material denoted by sKID and "H" algorithm a transform named
-   HMAC, then to generate a "signature" for a data block, the output of
-   HMAC(sKID, data) will be the corresponding signature payload.
-
-   The KEYID state will have the identities of the local and remote
-   parties for which the KEYID was assigned; it is up to the local
-   policy implementation to decide when it is appropriate to use such a
-   key for authenticating other parties.  For example, a key distributed
-   for use between two Internet hosts A and B may be suitable for
-   authenticating all identities of the form "alice@A" and "bob@B".
-
-4.2 Third Party Authentication
-
-   A local security policy might restrict key negotiation to trusted
-   parties.  For example, two OAKLEY daemons running with equal
-   sensitivity labels on two machines might wish to be the sole arbiters
-   of key exchanges between users with that same sensitivity label.  In
-   this case, some way of authenticating the provenance of key exchange
-   requests is needed.  I.e., the identities of the two daemons should
-   be bound to a key, and that key will be used to form a "signature"
-   for the key exchange messages.
-
-   The Signature Payload, in Appendix B, is for this purpose.  This
-   payload names a KEYID that is in existence before the start of the
-   current exchange.  The "H" transform for that KEYID is used to
-   calculate an integrity/authentication value for all payloads
-   preceding the signature.
-
-   Local policy can dictate which KEYID's are appropriate for signing
-   further exchanges.
-
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 32]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-4.3 New Group Mode
-
-   OAKLEY uses a new KEI for the exchange that defines a new group.
-
-5. Security Implementation Notes
-
-   Timing attacks that are capable of recovering the exponent value used
-   in Diffie-Hellman calculations have been described by Paul Kocher
-   [Kocher].  In order to nullify the attack, implementors must take
-   pains to obscure the sequence of operations involved in carrying out
-   modular exponentiations.
-
-   A "blinding factor" can accomplish this goal.  A group element, r, is
-   chosen at random.  When an exponent x is chosen, the value r^(-x) is
-   also calculated.  Then, when calculating (g^y)^x, the implementation
-   will calculate this sequence:
-
-           A = (rg^y)
-           B = A^x = (rg^y)^x = (r^x)(g^(xy))
-           C = B*r^(-x) = (r^x)(r^-(x))(g^(xy)) = g^(xy)
-
-   The blinding factor is only necessary if the exponent x is used more
-   than 100 times (estimate by Richard Schroeppel).
-
-6. OAKLEY Parsing and State Machine
-
-   There are many pathways through OAKLEY, but they follow a left-to-
-   right parsing pattern of the message fields.
-
-   The initiator decides on an initial message in the following order:
-
-      1. Offer a cookie.  This is not necessary but it helps with
-      aggressive exchanges.
-
-      2. Pick a group.  The choices are the well-known groups or any
-      private groups that may have been negotiated.  The very first
-      exchange between two Oakley daemons with no common state must
-      involve a well-known group (0, meaning no group, is a well-known
-      group).  Note that the group identifier, not the group descriptor,
-      is used in the message.
-
-      If a non-null group will be used, it must be included with the
-      first message specifying EHAO.  It need not be specified until
-      then.
-
-      3. If PFS will be used, pick an exponent x and present g^x.
-
-      4. Offer Encryption, Hash, and Authentication lists.
-
-
-
-Orman                        Informational                     [Page 33]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-      5. Use PFS for hiding the identities
-
-      If identity hiding is not used, then the initiator has this
-      option:
-
-      6. Name the identities and include authentication information
-
-   The information in the authentication section depends on the first
-   authentication offer.  In this aggressive exchange, the Initiator
-   hopes that the Responder will accept all the offered information and
-   the first authentication method.  The authentication method
-   determines the authentication payload as follows:
-
-      1. Signing method.  The signature will be applied to all the
-      offered information.
-
-      2. A public key encryption method.  The algorithm will be used to
-      encrypt a nonce in the public key of the requested Responder
-      identity.  There are two cases possible, depending on whether or
-      not identity hiding is used:
-
-         a. No identity hiding.  The ID's will appear as plaintext.
-         b. Identity hiding.  A well-known ID, call it R', will appear
-         as plaintext in the authentication payload.  It will be
-         followed by two ID's and a nonce; these will be encrypted using
-         the public key for R'.
-
-      3. A pre-existing key method.  The pre-existing key will be used
-      to encrypt a nonce.  If identity hiding is used, the ID's will be
-      encrypted in place in the payload, using the "E" algorithm
-      associated with the pre-existing key.
-
-   The Responder can accept all, part or none of the initial message.
-
-   The Responder accepts as many of the fields as he wishes, using the
-   same decision order as the initiator.  At any step he can stop,
-   implicitly rejecting further fields (which will have null values in
-   his response message).  The minimum response is a cookie and the GRP.
-
-      1. Accept cookie.  The Responder may elect to record no state
-      information until the Initiator successfully replies with a cookie
-      chosen by the responder.  If so, the Responder replies with a
-      cookie, the GRP, and no other information.
-
-      2. Accept GRP.  If the group is not acceptable, the Responder will
-      not reply.  The Responder may send an error message indicating the
-      the group is not acceptable (modulus too small, unknown
-      identifier, etc.)  Note that "no group" has two meanings during
-
-
-
-Orman                        Informational                     [Page 34]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-      the protocol: it may mean the group is not yet specified, or it
-      may mean that no group will be used (and thus PFS is not
-      possible).
-
-      3. Accept the g^x value.  The Responder indicates his acceptance
-      of the g^x value by including his own g^y value in his reply.  He
-      can postpone this by ignoring g^x and putting a zero length g^y
-      value in his reply.  He can also reject the g^x value with an
-      error message.
-
-      4. Accept one element from each of the EHA lists.  The acceptance
-      is indicated by a non-zero proposal.
-
-      5. If PFS for identity hiding is requested, then no further data
-      will follow.
-
-      6. If the authentication payload is present, and if the first item
-      in the offered authentication class is acceptable, then the
-      Responder must validate/decrypt the information in the
-      authentication payload and signature payload, if present. The
-      Responder should choose a nonce and reply using the same
-      authentication/hash algorithm as the Initiator used.
-
-   The Initiator notes which information the Responder has accepted,
-   validates/decrypts any signed, hashed, or encrypted fields, and if
-   the data is acceptable, replies in accordance to the EHA methods
-   selected by the Responder.  The Initiator replies are distinguished
-   from his initial message by the presence of the non-zero value for
-   the Responder cookie.
-
-   The output of the signature or prf function will be encoded as a
-   variable precision integer as described in Appendix C.  The KEYID
-   will indicate KEYID that names keying material and the Hash or
-   Signature function.
-
-7. The Credential Payload
-
-   Useful certificates with public key information can be attached to
-   OAKLEY messages using Credential Payloads as defined in the ISAKMP
-   document.  It should be noted that the identity protection option
-   applies to the credentials as well as the identities.
-
-Security Considerations
-
-   The focus of this document is security; hence security considerations
-   permeate this memo.
-
-
-
-
-
-Orman                        Informational                     [Page 35]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-Author's Address
-
-   Hilarie K. Orman
-   Department of Computer Science
-   University of Arizona
-
-   EMail: ho@darpa.mil
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 36]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-APPENDIX A Group Descriptors
-
-   Three distinct group representations can be used with OAKLEY.  Each
-   group is defined by its group operation and the kind of underlying
-   field used to represent group elements.  The three types are modular
-   exponentiation groups (named MODP herein), elliptic curve groups over
-   the field GF[2^N] (named EC2N herein), and elliptic curve groups over
-   GF[P] (named ECP herein) For each representation, many distinct
-   realizations are possible, depending on parameter selection.
-
-   With a few exceptions, all the parameters are transmitted as if they
-   were non-negative multi-precision integers, using the format defined
-   in this appendix (note, this is distinct from the encoding in
-   Appendix C).  Every multi-precision integer has a prefixed length
-   field, even where this information is redundant.
-
-   For the group type EC2N, the parameters are more properly thought of
-   as very long bit fields, but they are represented as multi-precision
-   integers, (with length fields, and right-justified).  This is the
-   natural encoding.
-
-   MODP means the classical modular exponentiation group, where the
-   operation is to calculate G^X (mod P).  The group is defined by the
-   numeric parameters P and G.  P must be a prime.  G is often 2, but
-   may be a larger number.  2 <= G <= P-2.
-
-   ECP is an elliptic curve group, modulo a prime number P.  The
-   defining equation for this kind of group is
-    Y^2 = X^3 + AX + B The group operation is taking a multiple of an
-   elliptic-curve point.  The group is defined by 5 numeric parameters:
-   The prime P, two curve parameters A and B, and a generator (X,Y).
-   A,B,X,Y are all interpreted mod P, and must be (non-negative)
-   integers less than P.  They must satisfy the defining equation,
-   modulo P.
-
-   EC2N is an elliptic curve group, over the finite field F[2^N].  The
-   defining equation for this kind of group is
-    Y^2 + XY = X^3 + AX^2 + B (This equation differs slightly from the
-   mod P case:  it has an XY term, and an AX^2 term instead of an AX
-   term.)
-
-   We must specify the field representation, and then the elliptic
-   curve.  The field is specified by giving an irreducible polynomial
-   (mod 2) of degree N.  This polynomial is represented as an integer of
-   size between 2^N and 2^(N+1), as if the defining polynomial were
-   evaluated at the value U=2.
-
-
-
-
-
-Orman                        Informational                     [Page 37]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   For example, the field defined by the polynomial U^155 + U^62 + 1 is
-   represented by the integer 2^155 + 2^62 + 1.  The group is defined by
-   4 more parameters, A,B,X,Y.  These parameters are elements of the
-   field GF[2^N], and can be thought of as polynomials of degree < N,
-   with (mod 2) coefficients.  They fit in N-bit fields, and are
-   represented as integers < 2^N, as if the polynomial were evaluated at
-   U=2.  For example, the field element U^2 + 1 would be represented by
-   the integer 2^2+1, which is 5.  The two parameters A and B define the
-   curve.  A is frequently 0.  B must not be 0.  The parameters X and Y
-   select a point on the curve.  The parameters A,B,X,Y must satisfy the
-   defining equation, modulo the defining polynomial, and mod 2.
-
-   Group descriptor formats:
-
-   Type of group: A two-byte field,
-           assigned values for the types "MODP", "ECP", "EC2N"
-           will be defined (see ISAKMP-04).
-   Size of a field element, in bits.  This is either Ceiling(log2 P)
-      or the degree of the irreducible polynomial: a 32-bit integer.
-   The prime P or the irreducible field polynomial: a multi-precision
-      integer.
-   The generator: 1 or 2 values, multi-precision integers.
-   EC only:  The parameters of the curve:  2 values, multi-precision
-      integers.
-
-   The following parameters are Optional (each of these may appear
-   independently):
-     a value of 0 may be used as a place-holder to represent an unspecified
-     parameter; any number of the parameters may be sent, from 0 to 3.
-
-   The largest prime factor: the encoded value that is the LPF of the
-     group size, a multi-precision integer.
-
-   EC only:  The order of the group: multi-precision integer.
-     (The group size for MODP is always P-1.)
-
-   Strength of group: 32-bit integer.
-     The strength of the group is approximately the number of key-bits
-     protected.
-        It is determined by the log2 of the effort to attack the group.
-        It may change as we learn more about cryptography.
-
-   This is a generic example for a "classic" modular exponentiation group:
-     Group type: "MODP"
-     Size of a field element in bits:  Log2 (P) rounded *up*.  A 32bit
-        integer.
-     Defining prime P: a multi-precision integer.
-     Generator G: a multi-precision integer.  2 <= G <= P-2.
-
-
-
-Orman                        Informational                     [Page 38]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-     <optional>
-     Largest prime factor of P-1: the multi-precision integer Q
-     Strength of group: a 32-bit integer.  We will specify a formula
-       for calculating this number (TBD).
-
-   This is a generic example for an elliptic curve group, mod P:
-      Group type: "ECP"
-      Size of a field element in bits:  Log2 (P) rounded *up*,
-          a 32 bit integer.
-      Defining prime P: a multi-precision integer.
-      Generator (X,Y): 2 multi-precision integers, each < P.
-      Parameters of the curve A,B: 2 multi-precision integers, each < P.
-      <optional>
-      Largest prime factor of the group order: a multi-precision integer.
-      Order of the group: a multi-precision integer.
-      Strength of group:  a 32-bit integer.  Formula TBD.
-
-   This is a specific example for an elliptic curve group:
-      Group type: "EC2N"
-      Degree of the irreducible polynomial: 155
-      Irreducible polynomial:  U^155 + U^62 + 1, represented as the
-        multi-precision integer 2^155 + 2^62 + 1.
-      Generator (X,Y) : represented as 2 multi-precision integers, each
-        < 2^155.
-      For our present curve, these are (decimal) 123 and 456.  Each is
-        represented as a multi-precision integer.
-      Parameters of the curve A,B: represented as 2 multi-precision
-        integers,  each < 2^155.
-      For our present curve these are 0 and (decimal) 471951, represented
-        as two multi-precision integers.
-
-      <optional>
-      Largest prime factor of the group order:
-
-       3805993847215893016155463826195386266397436443,
-
-      represented as a multi-precision integer.
-      The order of the group:
-
-        45671926166590716193865565914344635196769237316
-
-      represented as a multi-precision integer.
-
-      Strength of group: 76, represented as a 32-bit integer.
-
-   The variable precision integer encoding for group descriptor fields
-   is the following.  This is a slight variation on the format defined
-   in Appendix C in that a fixed 16-bit value is used first, and the
-
-
-
-Orman                        Informational                     [Page 39]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   length is limited to 16 bits.  However, the interpretation is
-   otherwise identical.
-
-                             1                   2                   3
-     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-    !   Fixed value (TBD)           !             Length            !
-    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-    .                                                               .
-    .                  Integer                                      .
-    .                                                               .
-    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-   The format of a group descriptor is:
-                             1                   2                   3
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !1!1!     Group Description     !             MODP              !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !1!0!        Field Size         !            Length             !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                              MPI                              !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !1!0!          Prime            !            Length             !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                              MPI                              !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !1!0!       Generator1          !            Length             !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                              MPI                              !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !1!0!       Generator2          !            Length             !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                              MPI                              !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !1!0!         Curve-p1          !            Length             !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                              MPI                              !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !1!0!         Curve-p2          !            Length             !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                              MPI                              !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !1!0!   Largest Prime Factor    !            Length             !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                              MPI                              !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-
-Orman                        Informational                     [Page 40]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   !1!0!      Order of Group       !            Length             !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                              MPI                              !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !0!0!    Strength of Group      !            Length             !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   !                              MPI                              !
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 41]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-APPENDIX B  Message formats
-
-   The encodings of Oakley messages into ISAKMP payloads is deferred to
-   the ISAKMP/Oakley Resolution document.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 42]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-APPENDIX C Encoding a variable precision integer.
-
-   Variable precision integers will be encoded as a 32-bit length field
-   followed by one or more 32-bit quantities containing the
-   representation of the integer, aligned with the most significant bit
-   in the first 32-bit item.
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !    length                                                     !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !    first value word (most significant bits)                   !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~     additional value words                                    ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-   An example of such an encoding is given below, for a number with 51
-   bits of significance.  The length field indicates that 2 32-bit
-   quantities follow.  The most significant non-zero bit of the number
-   is in bit 13 of the first 32-bit quantity, the low order bits are in
-   the second 32-bit quantity.
-
-                            1                   2                   3
-        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-       !                                                            1 0!
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-       !0 0 0 0 0 0 0 0 0 0 0 0 0 1 x x x x x x x x x x x x x x x x x x!
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-       !x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x!
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 43]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-APPENDIX D Cryptographic strengths
-
-   The Diffie-Hellman algorithm is used to compute keys that will be
-   used with symmetric algorithms.  It should be no easier to break the
-   Diffie-Hellman computation than it is to do an exhaustive search over
-   the symmetric key space.  A recent recommendation by an group of
-   cryptographers [Blaze] has recommended a symmetric key size of 75
-   bits for a practical level of security.  For 20 year security, they
-   recommend 90 bits.
-
-   Based on that report, a conservative strategy for OAKLEY users would
-   be to ensure that their Diffie-Hellman computations were as secure as
-   at least a 90-bit key space.  In order to accomplish this for modular
-   exponentiation groups, the size of the largest prime factor of the
-   modulus should be at least 180 bits, and the size of the modulus
-   should be at least 1400 bits.  For elliptic curve groups, the LPF
-   should be at least 180 bits.
-
-   If long-term secrecy of the encryption key is not an issue, then the
-   following parameters may be used for the modular exponentiation
-   group: 150 bits for the LPF, 980 bits for the modulus size.
-
-   The modulus size alone does not determine the strength of the
-   Diffie-Hellman calculation; the size of the exponent used in
-   computing powers within the group is also important.  The size of the
-   exponent in bits should be at least twice the size of any symmetric
-   key that will be derived from it.  We recommend that ISAKMP
-   implementors use at least 180 bits of exponent (twice the size of a
-   20-year symmetric key).
-
-   The mathematical justification for these estimates can be found in
-   texts that estimate the effort for solving the discrete log problem,
-   a task that is strongly related to the efficiency of using the Number
-   Field Sieve for factoring large integers.  Readers are referred to
-   [Stinson] and [Schneier].
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 44]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-APPENDIX E The Well-Known Groups
-
-   The group identifiers:
-
-      0   No group (used as a placeholder and for non-DH exchanges)
-      1   A modular exponentiation group with a 768 bit modulus
-      2   A modular exponentiation group with a 1024 bit modulus
-      3   A modular exponentiation group with a 1536 bit modulus (TBD)
-      4   An elliptic curve group over GF[2^155]
-      5   An elliptic curve group over GF[2^185]
-
-      values 2^31 and higher are used for private group identifiers
-
-   Richard Schroeppel performed all the mathematical and computational
-   work for this appendix.
-
-   Classical Diffie-Hellman Modular Exponentiation Groups
-
-   The primes for groups 1 and 2 were selected to have certain
-   properties.  The high order 64 bits are forced to 1.  This helps the
-   classical remainder algorithm, because the trial quotient digit can
-   always be taken as the high order word of the dividend, possibly +1.
-   The low order 64 bits are forced to 1.  This helps the Montgomery-
-   style remainder algorithms, because the multiplier digit can always
-   be taken to be the low order word of the dividend.  The middle bits
-   are taken from the binary expansion of pi.  This guarantees that they
-   are effectively random, while avoiding any suspicion that the primes
-   have secretly been selected to be weak.
-
-   Because both primes are based on pi, there is a large section of
-   overlap in the hexadecimal representations of the two primes.  The
-   primes are chosen to be Sophie Germain primes (i.e., (P-1)/2 is also
-   prime), to have the maximum strength against the square-root attack
-   on the discrete logarithm problem.
-
-   The starting trial numbers were repeatedly incremented by 2^64 until
-   suitable primes were located.
-
-   Because these two primes are congruent to 7 (mod 8), 2 is a quadratic
-   residue of each prime.  All powers of 2 will also be quadratic
-   residues.  This prevents an opponent from learning the low order bit
-   of the Diffie-Hellman exponent (AKA the subgroup confinement
-   problem).  Using 2 as a generator is efficient for some modular
-   exponentiation algorithms.  [Note that 2 is technically not a
-   generator in the number theory sense, because it omits half of the
-   possible residues mod P.  From a cryptographic viewpoint, this is a
-   virtue.]
-
-
-
-
-Orman                        Informational                     [Page 45]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-E.1. Well-Known Group 1:  A 768 bit prime
-
-   The prime is 2^768 - 2^704 - 1 + 2^64 * { [2^638 pi] + 149686 }.  Its
-   decimal value is
-          155251809230070893513091813125848175563133404943451431320235
-          119490296623994910210725866945387659164244291000768028886422
-          915080371891804634263272761303128298374438082089019628850917
-          0691316593175367469551763119843371637221007210577919
-
-   This has been rigorously verified as a prime.
-
-   The representation of the group in OAKLEY is
-
-      Type of group:                    "MODP"
-      Size of field element (bits):      768
-      Prime modulus:                     21 (decimal)
-         Length (32 bit words):          24
-         Data (hex):
-            FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
-            29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
-            EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
-            E485B576 625E7EC6 F44C42E9 A63A3620 FFFFFFFF FFFFFFFF
-      Generator:                         22 (decimal)
-         Length (32 bit words):          1
-         Data (hex):                     2
-
-      Optional Parameters:
-      Group order largest prime factor:  24 (decimal)
-         Length (32 bit words):          24
-         Data (hex):
-            7FFFFFFF FFFFFFFF E487ED51 10B4611A 62633145 C06E0E68
-            94812704 4533E63A 0105DF53 1D89CD91 28A5043C C71A026E
-            F7CA8CD9 E69D218D 98158536 F92F8A1B A7F09AB6 B6A8E122
-            F242DABB 312F3F63 7A262174 D31D1B10 7FFFFFFF FFFFFFFF
-      Strength of group:                 26 (decimal)
-         Length (32 bit words)            1
-         Data (hex):
-            00000042
-
-E.2. Well-Known Group 2:  A 1024 bit prime
-
-   The prime is 2^1024 - 2^960 - 1 + 2^64 * { [2^894 pi] + 129093 }.
-   Its decimal value is
-         179769313486231590770839156793787453197860296048756011706444
-         423684197180216158519368947833795864925541502180565485980503
-         646440548199239100050792877003355816639229553136239076508735
-         759914822574862575007425302077447712589550957937778424442426
-         617334727629299387668709205606050270810842907692932019128194
-
-
-
-Orman                        Informational                     [Page 46]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-         467627007
-
-   The primality of the number has been rigorously proven.
-
-   The representation of the group in OAKLEY is
-      Type of group:                    "MODP"
-      Size of field element (bits):      1024
-      Prime modulus:                     21 (decimal)
-         Length (32 bit words):          32
-         Data (hex):
-            FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
-            29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
-            EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
-            E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
-            EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE65381
-            FFFFFFFF FFFFFFFF
-      Generator:                         22 (decimal)
-         Length (32 bit words):          1
-         Data (hex):                     2
-
-      Optional Parameters:
-      Group order largest prime factor:  24 (decimal)
-         Length (32 bit words):          32
-         Data (hex):
-            7FFFFFFF FFFFFFFF E487ED51 10B4611A 62633145 C06E0E68
-            94812704 4533E63A 0105DF53 1D89CD91 28A5043C C71A026E
-            F7CA8CD9 E69D218D 98158536 F92F8A1B A7F09AB6 B6A8E122
-            F242DABB 312F3F63 7A262174 D31BF6B5 85FFAE5B 7A035BF6
-            F71C35FD AD44CFD2 D74F9208 BE258FF3 24943328 F67329C0
-            FFFFFFFF FFFFFFFF
-      Strength of group:                 26 (decimal)
-         Length (32 bit words)            1
-         Data (hex):
-            0000004D
-
-E.3. Well-Known Group 3:  An Elliptic Curve Group Definition
-
-   The curve is based on the Galois field GF[2^155] with 2^155 field
-   elements.  The irreducible polynomial for the field is u^155 + u^62 +
-   1.  The equation for the elliptic curve is
-
-   Y^2 + X Y = X^3 + A X + B
-
-   X, Y, A, B are elements of the field.
-
-   For the curve specified, A = 0 and
-
-    B = u^18 + u^17 + u^16 + u^13 + u^12 + u^9 + u^8 + u^7 + u^3 + u^2 +
-
-
-
-Orman                        Informational                     [Page 47]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   u + 1.
-
-   B is represented in binary as the bit string 1110011001110001111; in
-   decimal this is 471951, and in hex 7338F.
-
-   The generator is a point (X,Y) on the curve (satisfying the curve
-   equation, mod 2 and modulo the field polynomial).
-
-   X = u^6 + u^5 + u^4 + u^3 + u + 1
-
-   and
-
-   Y = u^8 + u^7 + u^6 + u^3.
-
-   The binary bit strings for X and Y are 1111011 and 111001000; in
-   decimal they are 123 and 456.
-
-   The group order (the number of curve points) is
-        45671926166590716193865565914344635196769237316
-   which is 12 times the prime
-
-         3805993847215893016155463826195386266397436443.
-   (This prime has been rigorously proven.)  The generating point (X,Y)
-   has order 4 times the prime; the generator is the triple of some
-   curve point.
-
-   OAKLEY representation of this group:
-      Type of group:                    "EC2N"
-      Size of field element (bits):      155
-      Irreducible field polynomial:      21 (decimal)
-         Length (32 bit words):          5
-         Data (hex):
-            08000000 00000000 00000000 40000000 00000001
-      Generator:
-         X coordinate:                   22 (decimal)
-             Length (32 bit words):      1
-             Data (hex):                 7B
-         Y coordinate:                   22 (decimal)
-             Length (32 bit words):      1
-             Data (hex):                 1C8
-      Elliptic curve parameters:
-         A parameter:                    23 (decimal)
-             Length (32 bit words):      1
-             Data (hex):                 0
-         B parameter:                    23 (decimal)
-             Length (32 bit words):      1
-             Data (hex):                 7338F
-
-
-
-
-Orman                        Informational                     [Page 48]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-      Optional Parameters:
-      Group order largest prime factor:  24 (decimal)
-         Length (32 bit words):          5
-         Data (hex):
-            00AAAAAA AAAAAAAA AAAAB1FC F1E206F4 21A3EA1B
-      Group order:                       25 (decimal)
-         Length (32 bit words):          5
-         Data (hex):
-            08000000 00000000 000057DB 56985371 93AEF944
-      Strength of group:                 26 (decimal)
-         Length (32 bit words)            1
-         Data (hex):
-            0000004C
-
-E.4. Well-Known Group 4:  A Large Elliptic Curve Group Definition
-
-   This curve is based on the Galois field GF[2^185] with 2^185 field
-   elements.  The irreducible polynomial for the field is
-
-   u^185 + u^69 + 1.
-
-   The equation for the elliptic curve is
-
-   Y^2 + X Y = X^3 + A X + B.
-
-   X, Y, A, B are elements of the field.  For the curve specified, A = 0
-   and
-
-   B = u^12 + u^11 + u^10 + u^9 + u^7 + u^6 + u^5 + u^3 + 1.
-
-   B is represented in binary as the bit string 1111011101001; in
-   decimal this is 7913, and in hex 1EE9.
-
-   The generator is a point (X,Y) on the curve (satisfying the curve
-   equation, mod 2 and modulo the field polynomial);
-
-   X = u^4 + u^3 and Y = u^3 + u^2 + 1.
-
-   The binary bit strings for X and Y are 11000 and 1101; in decimal
-   they are 24 and 13.  The group order (the number of curve points) is
-
-        49039857307708443467467104857652682248052385001045053116,
-
-   which is 4 times the prime
-
-        12259964326927110866866776214413170562013096250261263279.
-
-   (This prime has been rigorously proven.)
-
-
-
-Orman                        Informational                     [Page 49]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   The generating point (X,Y) has order 2 times the prime; the generator
-   is the double of some curve point.
-
-   OAKLEY representation of this group:
-
-      Type of group:                    "EC2N"
-      Size of field element (bits):      185
-      Irreducible field polynomial:      21 (decimal)
-         Length (32 bit words):          6
-         Data (hex):
-            02000000 00000000 00000000 00000020 00000000 00000001
-      Generator:
-         X coordinate:                   22 (decimal)
-             Length (32 bit words):      1
-             Data (hex):                 18
-         Y coordinate:                   22 (decimal)
-             Length (32 bit words):      1
-             Data (hex):                 D
-      Elliptic curve parameters:
-         A parameter:                    23 (decimal)
-             Length (32 bit words):      1
-             Data (hex):                 0
-         B parameter:                    23 (decimal)
-             Length (32 bit words):      1
-             Data (hex):                 1EE9
-
-      Optional parameters:
-      Group order largest prime factor:  24 (decimal)
-         Length (32 bit words):          6
-         Data (hex):
-            007FFFFF FFFFFFFF FFFFFFFF F6FCBE22 6DCF9210 5D7E53AF
-      Group order:                       25 (decimal)
-         Length (32 bit words):          6
-         Data (hex):
-            01FFFFFF FFFFFFFF FFFFFFFF DBF2F889 B73E4841 75F94EBC
-      Strength of group:                 26 (decimal)
-         Length (32 bit words)            1
-         Data (hex):
-            0000005B
-
-E.5. Well-Known Group 5:  A 1536 bit prime
-
-      The prime is 2^1536 - 2^1472 - 1 + 2^64 * { [2^1406 pi] +  741804
-   }.
-      Its decimal value is
-            241031242692103258855207602219756607485695054850245994265411
-            694195810883168261222889009385826134161467322714147790401219
-            650364895705058263194273070680500922306273474534107340669624
-
-
-
-Orman                        Informational                     [Page 50]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-            601458936165977404102716924945320037872943417032584377865919
-            814376319377685986952408894019557734611984354530154704374720
-            774996976375008430892633929555996888245787241299381012913029
-            459299994792636526405928464720973038494721168143446471443848
-            8520940127459844288859336526896320919633919
-
-      The primality of the number has been rigorously proven.
-
-      The representation of the group in OAKLEY is
-         Type of group:                    "MODP"
-         Size of field element (bits):      1536
-         Prime modulus:                     21 (decimal)
-            Length (32 bit words):          48
-            Data (hex):
-               FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
-               29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
-               EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
-               E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
-               EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D
-               C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F
-               83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
-               670C354E 4ABC9804 F1746C08 CA237327 FFFFFFFF FFFFFFFF
-         Generator:                         22 (decimal)
-            Length (32 bit words):          1
-            Data (hex):                     2
-
-         Optional Parameters:
-         Group order largest prime factor:  24 (decimal)
-            Length (32 bit words):          48
-            Data (hex):
-               7FFFFFFF FFFFFFFF E487ED51 10B4611A 62633145 C06E0E68
-               94812704 4533E63A 0105DF53 1D89CD91 28A5043C C71A026E
-               F7CA8CD9 E69D218D 98158536 F92F8A1B A7F09AB6 B6A8E122
-               F242DABB 312F3F63 7A262174 D31BF6B5 85FFAE5B 7A035BF6
-               F71C35FD AD44CFD2 D74F9208 BE258FF3 24943328 F6722D9E
-               E1003E5C 50B1DF82 CC6D241B 0E2AE9CD 348B1FD4 7E9267AF
-               C1B2AE91 EE51D6CB 0E3179AB 1042A95D CF6A9483 B84B4B36
-               B3861AA7 255E4C02 78BA3604 6511B993 FFFFFFFF FFFFFFFF
-         Strength of group:                 26 (decimal)
-            Length (32 bit words)            1
-            Data (hex):
-               0000005B
-
-
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 51]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-Appendix F  Implementing Group Operations
-
-   The group operation must be implemented as a sequence of arithmetic
-   operations; the exact operations depend on the type of group.  For
-   modular exponentiation groups, the operation is multi-precision
-   integer multiplication and remainders by the group modulus.  See
-   Knuth Vol. 2 [Knuth] for a discussion of how to implement these for
-   large integers.  Implementation recommendations for elliptic curve
-   group operations over GF[2^N] are described in [Schroeppel].
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 52]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-BIBLIOGRAPHY
-
-   [RFC2401]    Atkinson, R., "Security Architecture for the
-                Internet Protocol", RFC 2401, November 1998.
-
-   [RFC2406]    Atkinson, R., "IP Encapsulating Security Payload (ESP)",
-                RFC 2406, November 1998.
-
-   [RFC2402]    Atkinson, R., "IP Authentication Header", RFC 2402,
-                November 1998.
-
-   [Blaze]      Blaze, Matt et al., MINIMAL KEY LENGTHS FOR SYMMETRIC
-                CIPHERS TO PROVIDE ADEQUATE COMMERCIAL SECURITY. A
-                REPORT BY AN AD HOC GROUP OF CRYPTOGRAPHERS AND COMPUTER
-                SCIENTISTS...  --
-                http://www.bsa.org/policy/encryption/cryptographers.html
-
-   [STS]        W. Diffie, P.C. Van Oorschot, and M.J. Wiener,
-                "Authentication and Authenticated Key Exchanges," in
-                Designs, Codes and Cryptography, Kluwer Academic
-                Publishers, 1992, pp. 107
-
-   [SECDNS]     Eastlake, D. and C. Kaufman, "Domain Name System
-                Security Extensions", RFC 2065, January 1997.
-
-   [Random]     Eastlake, D., Crocker, S. and J. Schiller, "Randomness
-                Recommendations for Security", RFC 1750, December 1994.
-
-   [Kocher]     Kocher, Paul, Timing Attack,
-                http://www.cryptography.com/timingattack.old/timingattack.html
-
-   [Knuth]      Knuth, Donald E., The Art of Computer Programming, Vol.
-                2, Seminumerical Algorithms, Addison Wesley, 1969.
-
-   [Krawcyzk]   Krawcyzk, Hugo, SKEME: A Versatile Secure Key Exchange
-                Mechanism for Internet, ISOC Secure Networks and
-                Distributed Systems Symposium, San Diego, 1996
-
-   [Schneier]   Schneier, Bruce, Applied cryptography: protocols,
-                algorithms, and source code in C, Second edition, John
-                Wiley & Sons, Inc. 1995, ISBN 0-471-12845-7, hardcover.
-                ISBN 0-471-11709-9, softcover.
-
-   [Schroeppel] Schroeppel, Richard, et al.; Fast Key Exchange with
-                Elliptic Curve Systems, Crypto '95, Santa Barbara, 1995.
-                Available on-line as
-                ftp://ftp.cs.arizona.edu/reports/1995/TR95-03.ps (and
-                .Z).
-
-
-
-Orman                        Informational                     [Page 53]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-   [Stinson]    Stinson, Douglas, Cryptography Theory and Practice. CRC
-                Press, Inc., 2000, Corporate Blvd., Boca Raton, FL,
-                33431-9868, ISBN 0-8493-8521-0, 1995
-
-   [Zimmerman]  Philip Zimmermann, The Official Pgp User's Guide,
-                Published by MIT Press Trade, Publication date: June
-                1995, ISBN: 0262740176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 54]
-
-RFC 2412         The OAKLEY Key Determination Protocol     November 1998
-
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society (1998).  All Rights Reserved.
-
-   This document and translations of it may be copied and furnished to
-   others, and derivative works that comment on or otherwise explain it
-   or assist in its implementation may be prepared, copied, published
-   and distributed, in whole or in part, without restriction of any
-   kind, provided that the above copyright notice and this paragraph are
-   included on all such copies and derivative works.  However, this
-   document itself may not be modified in any way, such as by removing
-   the copyright notice or references to the Internet Society or other
-   Internet organizations, except as needed for the purpose of
-   developing Internet standards in which case the procedures for
-   copyrights defined in the Internet Standards process must be
-   followed, or as required to translate it into languages other than
-   English.
-
-   The limited permissions granted above are perpetual and will not be
-   revoked by the Internet Society or its successors or assigns.
-
-   This document and the information contained herein is provided on an
-   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
-   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
-   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
-   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Orman                        Informational                     [Page 55]
-
diff --git a/doc/ikev2/[RFC2437] - PKCS #1 RSA Cryptography Specifications Version 2.0.txt b/doc/ikev2/[RFC2437] - PKCS #1 RSA Cryptography Specifications Version 2.0.txt
deleted file mode 100644
index 54f6d5db5..000000000
--- a/doc/ikev2/[RFC2437] - PKCS #1 RSA Cryptography Specifications Version 2.0.txt
+++ /dev/null
@@ -1,2187 +0,0 @@
-
-
-
-
-
-
-Network Working Group                                         B. Kaliski
-Request for Comments: 2437                                    J. Staddon
-Obsoletes: 2313                                         RSA Laboratories
-Category: Informational                                     October 1998
-
-
-                PKCS #1: RSA Cryptography Specifications
-                              Version 2.0
-
-Status of this Memo
-
-   This memo provides information for the Internet community.  It does
-   not specify an Internet standard of any kind.  Distribution of this
-   memo is unlimited.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (1998).  All Rights Reserved.
-
-Table of Contents
-
-   1.       Introduction.....................................2
-   1.1      Overview.........................................3
-   2.       Notation.........................................3
-   3.       Key types........................................5
-   3.1      RSA public key...................................5
-   3.2      RSA private key..................................5
-   4.       Data conversion primitives.......................6
-   4.1      I2OSP............................................6
-   4.2      OS2IP............................................7
-   5.       Cryptographic primitives.........................8
-   5.1      Encryption and decryption primitives.............8
-   5.1.1    RSAEP............................................8
-   5.1.2    RSADP............................................9
-   5.2      Signature and verification primitives...........10
-   5.2.1    RSASP1..........................................10
-   5.2.2    RSAVP1..........................................11
-   6.       Overview of schemes.............................11
-   7.       Encryption schemes..............................12
-   7.1      RSAES-OAEP......................................13
-   7.1.1    Encryption operation............................13
-   7.1.2    Decryption operation............................14
-   7.2      RSAES-PKCS1-v1_5................................15
-   7.2.1    Encryption operation............................17
-   7.2.2    Decryption operation............................17
-   8.       Signature schemes with appendix.................18
-   8.1      RSASSA-PKCS1-v1_5...............................19
-   8.1.1    Signature generation operation..................20
-
-
-
-Kaliski & Staddon            Informational                      [Page 1]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   8.1.2    Signature verification operation................21
-   9.       Encoding methods................................22
-   9.1      Encoding methods for encryption.................22
-   9.1.1    EME-OAEP........................................22
-   9.1.2    EME-PKCS1-v1_5..................................24
-   9.2      Encoding methods for signatures with appendix...26
-   9.2.1    EMSA-PKCS1-v1_5.................................26
-   10.      Auxiliary Functions.............................27
-   10.1     Hash Functions..................................27
-   10.2     Mask Generation Functions.......................28
-   10.2.1   MGF1............................................28
-   11.      ASN.1 syntax....................................29
-   11.1     Key representation..............................29
-   11.1.1   Public-key syntax...............................30
-   11.1.2   Private-key syntax..............................30
-   11.2     Scheme identification...........................31
-   11.2.1   Syntax for RSAES-OAEP...........................31
-   11.2.2   Syntax for RSAES-PKCS1-v1_5.....................32
-   11.2.3   Syntax for RSASSA-PKCS1-v1_5....................33
-   12       Patent Statement................................33
-   12.1     Patent statement for the RSA algorithm..........34
-   13.      Revision history................................35
-   14.      References......................................35
-            Security Considerations.........................37
-            Acknowledgements................................37
-            Authors' Addresses..............................38
-            Full Copyright Statement........................39
-
-1. Introduction
-
-   This memo is the successor to RFC 2313. This document provides
-   recommendations for the implementation of public-key cryptography
-   based on the RSA algorithm [18], covering the following aspects:
-
-      -cryptographic primitives
-      -encryption schemes
-      -signature schemes with appendix
-      -ASN.1 syntax for representing keys and for identifying the
-       schemes
-
-   The recommendations are intended for general application within
-   computer and communications systems, and as such include a fair
-   amount of flexibility. It is expected that application standards
-   based on these specifications may include additional constraints. The
-   recommendations are intended to be compatible with draft standards
-   currently being developed by the ANSI X9F1 [1] and IEEE P1363 working
-   groups [14].  This document supersedes PKCS #1 version 1.5 [20].
-
-
-
-
-Kaliski & Staddon            Informational                      [Page 2]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   Editor's note. It is expected that subsequent versions of PKCS #1 may
-   cover other aspects of the RSA algorithm such as key size, key
-   generation, key validation, and signature schemes with message
-   recovery.
-
-1.1 Overview
-
-   The organization of this document is as follows:
-
-      -Section 1 is an introduction.
-      -Section 2 defines some notation used in this document.
-      -Section 3 defines the RSA public and private key types.
-      -Sections 4 and 5 define several primitives, or basic mathematical
-       operations. Data conversion primitives are in Section 4, and
-       cryptographic primitives (encryption-decryption,
-       signature-verification) are in Section 5.
-      -Section 6, 7 and 8 deal with the encryption and signature schemes
-       in this document. Section 6 gives an overview. Section 7 defines
-       an OAEP-based [2] encryption scheme along with the method found
-       in PKCS #1 v1.5.  Section 8 defines a signature scheme with
-       appendix; the method is identical to that of PKCS #1 v1.5.
-      -Section 9 defines the encoding methods for the encryption and
-       signature schemes in Sections 7 and 8.
-      -Section 10 defines the hash functions and the mask generation
-       function used in this document.
-      -Section 11 defines the ASN.1 syntax for the keys defined in
-       Section 3 and the schemes gives in Sections 7 and 8.
-      -Section 12 outlines the revision history of PKCS #1.
-      -Section 13 contains references to other publications and
-       standards.
-
-2. Notation
-
-   (n, e)        RSA public key
-
-   c             ciphertext representative, an integer between 0 and n-1
-
-   C             ciphertext, an octet string
-
-   d             private exponent
-
-   dP            p's exponent, a positive integer such that:
-                  e(dP)\equiv 1 (mod(p-1))
-
-   dQ            q's exponent, a positive integer such that:
-                  e(dQ)\equiv 1 (mod(q-1))
-
-   e             public exponent
-
-
-
-Kaliski & Staddon            Informational                      [Page 3]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   EM            encoded message, an octet string
-
-   emLen         intended length in octets of an encoded message
-
-   H             hash value, an output of Hash
-
-   Hash          hash function
-
-   hLen          output length in octets of hash function Hash
-
-   K             RSA private key
-
-   k             length in octets of the modulus
-
-   l             intended length of octet string
-
-   lcm(.,.)      least common multiple of two
-                 nonnegative integers
-
-   m             message representative, an integer between
-                 0 and n-1
-
-   M             message, an octet string
-
-   MGF           mask generation function
-
-   n             modulus
-
-   P             encoding parameters, an octet string
-
-   p,q           prime factors of the modulus
-
-   qInv          CRT coefficient, a positive integer less
-                 than p such: q(qInv)\equiv 1 (mod p)
-
-   s             signature representative, an integer
-                 between 0 and n-1
-
-   S             signature, an octet string
-
-   x             a nonnegative integer
-
-   X             an octet string corresponding to x
-
-   \xor          bitwise exclusive-or of two octet strings
-
-   \lambda(n)    lcm(p-1, q-1), where n = pq
-
-
-
-
-Kaliski & Staddon            Informational                      [Page 4]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   ||            concatenation operator
-
-   ||.||         octet length operator
-
-3. Key types
-
-   Two key types are employed in the primitives and schemes defined in
-   this document: RSA public key and RSA private key. Together, an RSA
-   public key and an RSA private key form an RSA key pair.
-
-3.1 RSA public key
-
-   For the purposes of this document, an RSA public key consists of two
-   components:
-
-   n, the modulus, a nonnegative integer
-   e, the public exponent, a nonnegative integer
-
-   In a valid RSA public key, the modulus n is a product of two odd
-   primes p and q, and the public exponent e is an integer between 3 and
-   n-1 satisfying gcd (e, \lambda(n)) = 1, where \lambda(n) = lcm (p-
-   1,q-1).  A recommended syntax for interchanging RSA public keys
-   between implementations is given in Section 11.1.1; an
-   implementation's internal representation may differ.
-
-3.2 RSA private key
-
-   For the purposes of this document, an RSA private key may have either
-   of two representations.
-
-   1. The first representation consists of the pair (n, d), where the
-   components have the following meanings:
-
-   n, the modulus, a nonnegative integer
-   d, the private exponent, a nonnegative integer
-
-   2. The second representation consists of a quintuple (p, q, dP, dQ,
-   qInv), where the components have the following meanings:
-
-   p, the first factor, a nonnegative integer
-   q, the second factor, a nonnegative integer
-   dP, the first factor's exponent, a nonnegative integer
-   dQ, the second factor's exponent, a nonnegative integer
-   qInv, the CRT coefficient, a nonnegative integer
-
-   In a valid RSA private key with the first representation, the modulus
-   n is the same as in the corresponding public key and is the product
-   of two odd primes p and q, and the private exponent d is a positive
-
-
-
-Kaliski & Staddon            Informational                      [Page 5]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   integer less than n satisfying:
-
-   ed \equiv 1 (mod \lambda(n))
-
-   where e is the corresponding public exponent and \lambda(n) is as
-   defined above.
-
-   In a valid RSA private key with the second representation, the two
-   factors p and q are the prime factors of the modulus n, the exponents
-   dP and dQ are positive integers less than p and q respectively
-   satisfying
-
-   e(dP)\equiv 1(mod(p-1))
-   e(dQ)\equiv 1(mod(q-1)),
-
-   and the CRT coefficient qInv is a positive integer less than p
-   satisfying:
-
-   q(qInv)\equiv 1 (mod p).
-
-   A recommended syntax for interchanging RSA private keys between
-   implementations, which includes components from both representations,
-   is given in Section 11.1.2; an implementation's internal
-   representation may differ.
-
-4. Data conversion primitives
-
-   Two data conversion primitives are employed in the schemes defined in
-   this document:
-
-   I2OSP: Integer-to-Octet-String primitive
-   OS2IP: Octet-String-to-Integer primitive
-
-   For the purposes of this document, and consistent with ASN.1 syntax, an
-   octet string is an ordered sequence of octets (eight-bit bytes). The
-   sequence is indexed from first (conventionally, leftmost) to last
-   (rightmost). For purposes of conversion to and from integers, the first
-   octet is considered the most significant in the following conversion
-   primitives
-
-4.1 I2OSP
-
-   I2OSP converts a nonnegative integer to an octet string of a specified
-   length.
-
-   I2OSP (x, l)
-
-
-
-
-
-Kaliski & Staddon            Informational                      [Page 6]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   Input:
-   x         nonnegative integer to be converted
-   l         intended length of the resulting octet string
-
-   Output:
-   X         corresponding octet string of length l; or
-             "integer too large"
-
-   Steps:
-
-   1. If x>=256^l, output "integer too large" and stop.
-
-   2. Write the integer x in its unique l-digit representation base 256:
-
-   x = x_{l-1}256^{l-1} + x_{l-2}256^{l-2} +... + x_1 256 + x_0
-
-   where 0 <= x_i < 256 (note that one or more leading digits will be
-   zero if x < 256^{l-1}).
-
-   3. Let the octet X_i have the value x_{l-i} for 1 <= i <= l.  Output
-   the octet string:
-
-   X = X_1 X_2 ... X_l.
-
-4.2 OS2IP
-
-   OS2IP converts an octet string to a nonnegative integer.
-
-   OS2IP (X)
-
-   Input:
-   X         octet string to be converted
-
-   Output:
-   x         corresponding nonnegative integer
-
-   Steps:
-
-   1. Let X_1 X_2 ... X_l  be the octets of X from first to last, and
-   let x{l-i} have value X_i for 1<= i <= l.
-
-   2. Let x = x{l-1} 256^{l-1} + x_{l-2} 256^{l-2} +...+ x_1 256 + x_0.
-
-   3. Output x.
-
-
-
-
-
-
-
-Kaliski & Staddon            Informational                      [Page 7]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-5. Cryptographic primitives
-
-   Cryptographic primitives are basic mathematical operations on which
-   cryptographic schemes can be built. They are intended for
-   implementation in hardware or as software modules, and are not
-   intended to provide security apart from a scheme.
-
-   Four types of primitive are specified in this document, organized in
-   pairs: encryption and decryption; and signature and verification.
-
-   The specifications of the primitives assume that certain conditions
-   are met by the inputs, in particular that public and private keys are
-   valid.
-
-5.1 Encryption and decryption primitives
-
-   An encryption primitive produces a ciphertext representative from a
-   message representative under the control of a public key, and a
-   decryption primitive recovers the message representative from the
-   ciphertext representative under the control of the corresponding
-   private key.
-
-   One pair of encryption and decryption primitives is employed in the
-   encryption schemes defined in this document and is specified here:
-   RSAEP/RSADP. RSAEP and RSADP involve the same mathematical operation,
-   with different keys as input.
-
-   The primitives defined here are the same as in the draft IEEE P1363
-   and are compatible with PKCS #1 v1.5.
-
-   The main mathematical operation in each primitive is exponentiation.
-
-5.1.1 RSAEP
-
-   RSAEP((n, e), m)
-
-   Input:
-   (n, e)    RSA public key
-   m         message representative, an integer between 0 and n-1
-
-   Output:
-   c         ciphertext representative, an integer between 0 and n-1;
-             or "message representative out of range"
-
-   Assumptions: public key (n, e) is valid
-
-   Steps:
-
-
-
-
-Kaliski & Staddon            Informational                      [Page 8]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   1. If the message representative m is not between 0 and n-1, output
-   message representative out of range and stop.
-
-   2. Let c = m^e mod n.
-
-   3. Output c.
-
-5.1.2 RSADP
-
-   RSADP (K, c)
-
-   Input:
-
-   K         RSA private key, where K has one of the following forms
-                 -a pair (n, d)
-                 -a quintuple (p, q, dP, dQ, qInv)
-   c         ciphertext representative, an integer between 0 and n-1
-
-   Output:
-   m         message representative, an integer between 0 and n-1; or
-             "ciphertext representative out of range"
-
-   Assumptions: private key K is valid
-
-   Steps:
-
-   1. If the ciphertext representative c is not between 0 and n-1,
-   output "ciphertext representative out of range" and stop.
-
-   2. If the first form (n, d) of K is used:
-
-   2.1 Let m = c^d mod n.          Else, if the second form (p, q, dP,
-   dQ, qInv) of K is used:
-
-   2.2 Let m_1 = c^dP mod p.
-
-   2.3 Let m_2 = c^dQ mod q.
-
-   2.4 Let h = qInv ( m_1 - m_2 ) mod p.
-
-   2.5 Let m = m_2 + hq.
-
-   3. Output m.
-
-
-
-
-
-
-
-
-Kaliski & Staddon            Informational                      [Page 9]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-5.2 Signature and verification primitives
-
-   A signature primitive produces a signature representative from a
-   message representative under the control of a private key, and a
-   verification primitive recovers the message representative from the
-   signature representative under the control of the corresponding
-   public key. One pair of signature and verification primitives is
-   employed in the signature schemes defined in this document and is
-   specified here: RSASP1/RSAVP1.
-
-   The primitives defined here are the same as in the draft IEEE P1363
-   and are compatible with PKCS #1 v1.5.
-
-   The main mathematical operation in each primitive is exponentiation,
-   as in the encryption and decryption primitives of Section 5.1. RSASP1
-   and RSAVP1 are the same as RSADP and RSAEP except for the names of
-   their input and output arguments; they are distinguished as they are
-   intended for different purposes.
-
-5.2.1 RSASP1
-
-   RSASP1 (K, m)
-
-   Input:
-   K             RSA private key, where K has one of the following
-                 forms:
-                    -a pair (n, d)
-                    -a quintuple (p, q, dP, dQ, qInv)
-
-   m             message representative, an integer between 0 and n-1
-
-   Output:
-   s             signature representative, an integer between  0 and
-                 n-1, or "message representative out of range"
-
-   Assumptions:
-   private key K is valid
-
-   Steps:
-
-   1. If the message representative m is not between 0 and n-1, output
-   "message representative out of range" and stop.
-
-   2. If the first form (n, d) of K is used:
-
-   2.1 Let s = m^d mod n.          Else, if the second form (p, q, dP,
-   dQ, qInv) of K is used:
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 10]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   2.2 Let s_1 = m^dP mod p.
-
-   2.3 Let s_2 = m^dQ mod q.
-
-   2.4 Let h = qInv ( s_1 - s_2 ) mod p.
-
-   2.5 Let s = s_2 + hq.
-
-   3. Output S.
-
-5.2.2 RSAVP1
-
-   RSAVP1 ((n, e), s)
-
-   Input:
-   (n, e)  RSA public key
-   s       signature representative, an integer between 0 and n-1
-
-   Output:
-   m       message representative, an integer between 0 and n-1;
-           or "invalid"
-
-   Assumptions:
-   public key (n, e) is valid
-
-   Steps:
-
-   1. If the signature representative s is not between 0 and n-1, output
-   "invalid" and stop.
-
-   2. Let m = s^e mod n.
-
-   3. Output m.
-
-6. Overview of schemes
-
-   A scheme combines cryptographic primitives and other techniques to
-   achieve a particular security goal. Two types of scheme are specified
-   in this document: encryption schemes and signature schemes with
-   appendix.
-
-   The schemes specified in this document are limited in scope in that
-   their operations consist only of steps to process data with a key,
-   and do not include steps for obtaining or validating the key. Thus,
-   in addition to the scheme operations, an application will typically
-   include key management operations by which parties may select public
-   and private keys for a scheme operation. The specific additional
-   operations and other details are outside the scope of this document.
-
-
-
-Kaliski & Staddon            Informational                     [Page 11]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   As was the case for the cryptographic primitives (Section 5), the
-   specifications of scheme operations assume that certain conditions
-   are met by the inputs, in particular that public and private keys are
-   valid. The behavior of an implementation is thus unspecified when a
-   key is invalid. The impact of such unspecified behavior depends on
-   the application. Possible means of addressing key validation include
-   explicit key validation by the application; key validation within the
-   public-key infrastructure; and assignment of liability for operations
-   performed with an invalid key to the party who generated the key.
-
-7. Encryption schemes
-
-   An encryption scheme consists of an encryption operation and a
-   decryption operation, where the encryption operation produces a
-   ciphertext from a message with a recipient's public key, and the
-   decryption operation recovers the message from the ciphertext with
-   the recipient's corresponding private key.
-
-   An encryption scheme can be employed in a variety of applications. A
-   typical application is a key establishment protocol, where the
-   message contains key material to be delivered confidentially from one
-   party to another. For instance, PKCS #7 [21] employs such a protocol
-   to deliver a content-encryption key from a sender to a recipient; the
-   encryption schemes defined here would be suitable key-encryption
-   algorithms in that context.
-
-   Two encryption schemes are specified in this document: RSAES-OAEP and
-   RSAES-PKCS1-v1_5. RSAES-OAEP is recommended for new applications;
-   RSAES-PKCS1-v1_5 is included only for compatibility with existing
-   applications, and is not recommended for new applications.
-
-   The encryption schemes given here follow a general model similar to
-   that employed in IEEE P1363, by combining encryption and decryption
-   primitives with an encoding method for encryption. The encryption
-   operations apply a message encoding operation to a message to produce
-   an encoded message, which is then converted to an integer message
-   representative. An encryption primitive is applied to the message
-   representative to produce the ciphertext. Reversing this, the
-   decryption operations apply a decryption primitive to the ciphertext
-   to recover a message representative, which is then converted to an
-   octet string encoded message. A message decoding operation is applied
-   to the encoded message to recover the message and verify the
-   correctness of the decryption.
-
-
-
-
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 12]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-7.1 RSAES-OAEP
-
-   RSAES-OAEP combines the RSAEP and RSADP primitives (Sections 5.1.1
-   and 5.1.2) with the EME-OAEP encoding method (Section 9.1.1) EME-OAEP
-   is based on the method found in [2]. It is compatible with the IFES
-   scheme defined in the draft P1363 where the encryption and decryption
-   primitives are IFEP-RSA and IFDP-RSA and the message encoding method
-   is EME-OAEP. RSAES-OAEP can operate on messages of length up to k-2-
-   2hLen octets, where hLen is the length of the hash function output
-   for EME-OAEP and k is the length in octets of the recipient's RSA
-   modulus.  Assuming that the hash function in EME-OAEP has appropriate
-   properties, and the key size is sufficiently large, RSAEP-OAEP
-   provides "plaintext-aware encryption," meaning that it is
-   computationally infeasible to obtain full or partial information
-   about a message from a ciphertext, and computationally infeasible to
-   generate a valid ciphertext without knowing the corresponding
-   message.  Therefore, a chosen-ciphertext attack is ineffective
-   against a plaintext-aware encryption scheme such as RSAES-OAEP.
-
-   Both the encryption and the decryption operations of RSAES-OAEP take
-   the value of the parameter string P as input. In this version of PKCS
-   #1, P is an octet string that is specified explicitly. See Section
-   11.2.1 for the relevant ASN.1 syntax. We briefly note that to receive
-   the full security benefit of RSAES-OAEP, it should not be used in a
-   protocol involving RSAES-PKCS1-v1_5. It is possible that in a
-   protocol on which both encryption schemes are present, an adaptive
-   chosen ciphertext attack such as [4] would be useful.
-
-   Both the encryption and the decryption operations of RSAES-OAEP take
-   the value of the parameter string P as input. In this version of PKCS
-   #1, P is an octet string that is specified explicitly. See Section
-   11.2.1 for the relevant ASN.1 syntax.
-
-7.1.1 Encryption operation
-
-   RSAES-OAEP-ENCRYPT ((n, e), M, P)
-
-   Input:
-   (n, e)    recipient's RSA public key
-
-   M         message to be encrypted, an octet string of length at
-             most k-2-2hLen, where k is the length in octets of the
-             modulus n and hLen is the length in octets of the hash
-             function output for EME-OAEP
-
-   P         encoding parameters, an octet string that may be empty
-
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 13]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   Output:
-   C         ciphertext, an octet string of length k; or "message too
-             long"
-
-   Assumptions: public key (n, e) is valid
-
-   Steps:
-
-   1. Apply the EME-OAEP encoding operation (Section 9.1.1.2) to the
-   message M and the encoding parameters P to produce an encoded message
-   EM of length k-1 octets:
-
-   EM = EME-OAEP-ENCODE (M, P, k-1)
-
-   If the encoding operation outputs "message too long," then output
-   "message too long" and stop.
-
-   2. Convert the encoded message EM to an integer message
-   representative m: m = OS2IP (EM)
-
-   3. Apply the RSAEP encryption primitive (Section 5.1.1) to the public
-   key (n, e) and the message representative m to produce an integer
-   ciphertext representative c:
-
-   c = RSAEP ((n, e), m)
-
-   4. Convert the ciphertext representative c to a ciphertext C of
-   length k octets: C = I2OSP (c, k)
-
-   5. Output the ciphertext C.
-
-7.1.2 Decryption operation
-
-   RSAES-OAEP-DECRYPT (K, C, P)
-
-   Input:
-   K          recipient's RSA private key
-   C          ciphertext to be decrypted, an octet string of length
-              k, where k is the length in octets of the modulus n
-   P          encoding parameters, an octet string that may be empty
-
-   Output:
-   M          message, an octet string of length at most k-2-2hLen,
-              where hLen is the length in octets of the hash
-              function output for EME-OAEP; or "decryption error"
-
-
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 14]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   Steps:
-
-   1. If the length of the ciphertext C is not k octets, output
-   "decryption error" and stop.
-
-   2. Convert the ciphertext C to an integer ciphertext representative
-   c: c = OS2IP (C).
-
-   3. Apply the RSADP decryption primitive (Section 5.1.2) to the
-   private key K and the ciphertext representative c to produce an
-   integer message representative m:
-
-   m = RSADP (K, c)
-
-   If RSADP outputs "ciphertext out of range," then output "decryption
-   error" and stop.
-
-   4. Convert the message representative m to an encoded message EM of
-   length k-1 octets: EM = I2OSP (m, k-1)
-
-   If I2OSP outputs "integer too large," then output "decryption error"
-   and stop.
-
-   5. Apply the EME-OAEP decoding operation to the encoded message EM
-   and the encoding parameters P to recover a message M:
-
-   M = EME-OAEP-DECODE (EM, P)
-
-   If the decoding operation outputs "decoding error," then output
-   "decryption error" and stop.
-
-   6. Output the message M.
-
-   Note. It is important that the error messages output in steps 4 and 5
-   be the same, otherwise an adversary may be able to extract useful
-   information from the type of error message received. Error message
-   information is used to mount a chosen-ciphertext attack on PKCS #1
-   v1.5 encrypted messages in [4].
-
-7.2 RSAES-PKCS1-v1_5
-
-   RSAES-PKCS1-v1_5 combines the RSAEP and RSADP primitives with the
-   EME-PKCS1-v1_5 encoding method. It is the same as the encryption
-   scheme in PKCS #1 v1.5. RSAES-PKCS1-v1_5 can operate on messages of
-   length up to k-11 octets, although care should be taken to avoid
-   certain attacks on low-exponent RSA due to Coppersmith, et al. when
-   long messages are encrypted (see the third bullet in the notes below
-   and [7]).
-
-
-
-Kaliski & Staddon            Informational                     [Page 15]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   RSAES-PKCS1-v1_5 does not provide "plaintext aware" encryption. In
-   particular, it is possible to generate valid ciphertexts without
-   knowing the corresponding plaintexts, with a reasonable probability
-   of success. This ability can be exploited in a chosen ciphertext
-   attack as shown in [4]. Therefore, if RSAES-PKCS1-v1_5 is to be used,
-   certain easily implemented countermeasures should be taken to thwart
-   the attack found in [4]. The addition of structure to the data to be
-   encoded, rigorous checking of PKCS #1 v1.5 conformance and other
-   redundancy in decrypted messages, and the consolidation of error
-   messages in a client-server protocol based on PKCS #1 v1.5 can all be
-   effective countermeasures and don't involve changes to a PKCS #1
-   v1.5-based protocol. These and other countermeasures are discussed in
-   [5].
-
-   Notes. The following passages describe some security recommendations
-   pertaining to the use of RSAES-PKCS1-v1_5. Recommendations from
-   version 1.5 of this document are included as well as new
-   recommendations motivated by cryptanalytic advances made in the
-   intervening years.
-
-   -It is recommended that the pseudorandom octets in EME-PKCS1-v1_5 be
-   generated independently for each encryption process, especially if
-   the same data is input to more than one encryption process. Hastad's
-   results [13] are one motivation for this recommendation.
-
-   -The padding string PS in EME-PKCS1-v1_5 is at least eight octets
-   long, which is a security condition for public-key operations that
-   prevents an attacker from recovering data by trying all possible
-   encryption blocks.
-
-   -The pseudorandom octets can also help thwart an attack due to
-   Coppersmith et al. [7] when the size of the message to be encrypted
-   is kept small. The attack works on low-exponent RSA when similar
-   messages are encrypted with the same public key. More specifically,
-   in one flavor of the attack, when two inputs to RSAEP agree on a
-   large fraction of bits (8/9) and low-exponent RSA (e = 3) is used to
-   encrypt both of them, it may be possible to recover both inputs with
-   the attack. Another flavor of the attack is successful in decrypting
-   a single ciphertext when a large fraction (2/3) of the input to RSAEP
-   is already known. For typical applications, the message to be
-   encrypted is short (e.g., a 128-bit symmetric key) so not enough
-   information will be known or common between two messages to enable
-   the attack.  However, if a long message is encrypted, or if part of a
-   message is known, then the attack may be a concern. In any case, the
-   RSAEP-OAEP scheme overcomes the attack.
-
-
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 16]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-7.2.1 Encryption operation
-
-   RSAES-PKCS1-V1_5-ENCRYPT ((n, e), M)
-
-   Input:
-   (n, e)  recipient's RSA public key
-   M       message to be encrypted, an octet string of length at
-           most k-11 octets, where k is the length in octets of the
-           modulus n
-
-   Output:
-   C       ciphertext, an octet string of length k; or "message too
-           long"
-
-   Steps:
-
-   1. Apply the EME-PKCS1-v1_5 encoding operation (Section 9.1.2.1) to
-   the message M to produce an encoded message EM of length k-1 octets:
-
-   EM = EME-PKCS1-V1_5-ENCODE (M, k-1)
-
-   If the encoding operation outputs "message too long," then output
-   "message too long" and stop.
-
-   2. Convert the encoded message EM to an integer message
-   representative m: m = OS2IP (EM)
-
-   3. Apply the RSAEP encryption primitive (Section 5.1.1) to the public
-   key (n, e) and the message representative m to produce an integer
-   ciphertext representative c: c = RSAEP ((n, e), m)
-
-   4. Convert the ciphertext representative c to a ciphertext C of
-   length k octets: C = I2OSP (c, k)
-
-   5. Output the ciphertext C.
-
-7.2.2 Decryption operation
-
-   RSAES-PKCS1-V1_5-DECRYPT (K, C)
-
-   Input:
-   K       recipient's RSA private key
-   C       ciphertext to be decrypted, an octet string of length k,
-           where k is the length in octets of the modulus n
-
-   Output:
-   M       message, an octet string of length at most k-11; or
-           "decryption error"
-
-
-
-Kaliski & Staddon            Informational                     [Page 17]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   Steps:
-
-   1. If the length of the ciphertext C is not k octets, output
-   "decryption error" and stop.
-
-   2. Convert the ciphertext C to an integer ciphertext representative
-   c: c = OS2IP (C).
-
-   3. Apply the RSADP decryption primitive to the private key (n, d) and
-   the ciphertext representative c to produce an integer message
-   representative m: m = RSADP ((n, d), c).
-
-   If RSADP outputs "ciphertext out of range," then output "decryption
-   error" and stop.
-
-   4. Convert the message representative m to an encoded message EM of
-   length k-1 octets: EM = I2OSP (m, k-1)
-
-   If I2OSP outputs "integer too large," then output "decryption error"
-   and stop.
-
-   5. Apply the EME-PKCS1-v1_5 decoding operation to the encoded message
-   EM to recover a message M: M = EME-PKCS1-V1_5-DECODE (EM).
-
-   If the decoding operation outputs "decoding error," then output
-   "decryption error" and stop.
-
-   6. Output the message M.
-
-   Note. It is important that only one type of error message is output
-   by EME-PKCS1-v1_5, as ensured by steps 4 and 5. If this is not done,
-   then an adversary may be able to use information extracted form the
-   type of error message received to mount a chosen-ciphertext attack
-   such as the one found in [4].
-
-8. Signature schemes with appendix
-
-   A signature scheme with appendix consists of a signature generation
-   operation and a signature verification operation, where the signature
-   generation operation produces a signature from a message with a
-   signer's private key, and the signature verification operation
-   verifies the signature on the message with the signer's corresponding
-   public key.  To verify a signature constructed with this type of
-   scheme it is necessary to have the message itself. In this way,
-   signature schemes with appendix are distinguished from signature
-   schemes with message recovery, which are not supported in this
-   document.
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 18]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   A signature scheme with appendix can be employed in a variety of
-   applications. For instance, X.509 [6] employs such a scheme to
-   authenticate the content of a certificate; the signature scheme with
-   appendix defined here would be a suitable signature algorithm in that
-   context. A related signature scheme could be employed in PKCS #7
-   [21], although for technical reasons, the current version of PKCS #7
-   separates a hash function from a signature scheme, which is different
-   than what is done here.
-
-   One signature scheme with appendix is specified in this document:
-   RSASSA-PKCS1-v1_5.
-
-   The signature scheme with appendix given here follows a general model
-   similar to that employed in IEEE P1363, by combining signature and
-   verification primitives with an encoding method for signatures. The
-   signature generation operations apply a message encoding operation to
-   a message to produce an encoded message, which is then converted to
-   an integer message representative. A signature primitive is then
-   applied to the message representative to produce the signature. The
-   signature verification operations apply a signature verification
-   primitive to the signature to recover a message representative, which
-   is then converted to an octet string. The message encoding operation
-   is again applied to the message, and the result is compared to the
-   recovered octet string. If there is a match, the signature is
-   considered valid. (Note that this approach assumes that the signature
-   and verification primitives have the message-recovery form and the
-   encoding method is deterministic, as is the case for RSASP1/RSAVP1
-   and EMSA-PKCS1-v1_5. The signature generation and verification
-   operations have a different form in P1363 for other primitives and
-   encoding methods.)
-
-   Editor's note. RSA Laboratories is investigating the possibility of
-   including a scheme based on the PSS encoding methods specified in
-   [3], which would be recommended for new applications.
-
-8.1 RSASSA-PKCS1-v1_5
-
-   RSASSA-PKCS1-v1_5 combines the RSASP1 and RSAVP1 primitives with the
-   EME-PKCS1-v1_5 encoding method. It is compatible with the IFSSA
-   scheme defined in the draft P1363 where the signature and
-   verification primitives are IFSP-RSA1 and IFVP-RSA1 and the message
-   encoding method is EMSA-PKCS1-v1_5 (which is not defined in P1363).
-   The length of messages on which RSASSA-PKCS1-v1_5 can operate is
-   either unrestricted or constrained by a very large number, depending
-   on the hash function underlying the message encoding method.
-
-
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 19]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   Assuming that the hash function in EMSA-PKCS1-v1_5 has appropriate
-   properties and the key size is sufficiently large, RSASSA-PKCS1-v1_5
-   provides secure signatures, meaning that it is computationally
-   infeasible to generate a signature without knowing the private key,
-   and computationally infeasible to find a message with a given
-   signature or two messages with the same signature. Also, in the
-   encoding method EMSA-PKCS1-v1_5, a hash function identifier is
-   embedded in the encoding.  Because of this feature, an adversary must
-   invert or find collisions of the particular hash function being used;
-   attacking a different hash function than the one selected by the
-   signer is not useful to the adversary.
-
-8.1.1 Signature generation operation
-
-   RSASSA-PKCS1-V1_5-SIGN (K, M)
-   Input:
-   K         signer's RSA private ke
-   M         message to be signed, an octet string
-
-   Output:
-   S         signature, an octet string of length k, where k is the
-             length in octets of the modulus n; "message too long" or
-             "modulus too short"
-   Steps:
-
-   1. Apply the EMSA-PKCS1-v1_5 encoding operation (Section 9.2.1) to
-   the message M to produce an encoded message EM of length k-1 octets:
-
-   EM = EMSA-PKCS1-V1_5-ENCODE (M, k-1)
-
-   If the encoding operation outputs "message too long," then output
-   "message too long" and stop. If the encoding operation outputs
-   "intended encoded message length too short" then output "modulus too
-   short".
-
-   2. Convert the encoded message EM to an integer message
-   representative m: m = OS2IP (EM)
-
-   3. Apply the RSASP1 signature primitive (Section 5.2.1) to the
-   private key K and the message representative m to produce an integer
-   signature representative s: s = RSASP1 (K, m)
-
-   4. Convert the signature representative s to a signature S of length
-   k octets: S = I2OSP (s, k)
-
-   5. Output the signature S.
-
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 20]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-8.1.2 Signature verification operation
-
-   RSASSA-PKCS1-V1_5-VERIFY ((n, e), M, S)
-
-   Input:
-   (n, e)    signer's RSA public key
-   M         message whose signature is to be verified, an octet string
-   S         signature to be verified, an octet string of length k,
-             where k is the length in octets of the modulus n
-
-   Output: "valid signature," "invalid signature," or "message too
-   long", or "modulus too short"
-
-   Steps:
-
-   1. If the length of the signature S is not k octets, output "invalid
-   signature" and stop.
-
-   2. Convert the signature S to an integer signature representative s:
-
-   s = OS2IP (S)
-
-   3. Apply the RSAVP1 verification primitive (Section 5.2.2) to the
-   public key (n, e) and the signature representative s to produce an
-   integer message representative m:
-
-   m = RSAVP1 ((n, e), s)                  If RSAVP1 outputs "invalid"
-   then output "invalid signature" and stop.
-
-   4. Convert the message representative m to an encoded message EM of
-   length k-1 octets: EM = I2OSP (m, k-1)
-
-   If I2OSP outputs "integer too large," then output "invalid signature"
-   and stop.
-
-   5. Apply the EMSA-PKCS1-v1_5 encoding operation (Section 9.2.1) to
-   the message M to produce a second encoded message EM' of length k-1
-   octets:
-
-   EM' = EMSA-PKCS1-V1_5-ENCODE (M, k-1)
-
-   If the encoding operation outputs "message too long," then output
-   "message too long" and stop. If the encoding operation outputs
-   "intended encoded message length too short" then output "modulus too
-   short".
-
-
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 21]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   6. Compare the encoded message EM and the second encoded message EM'.
-   If they are the same, output "valid signature"; otherwise, output
-   "invalid signature."
-
-9. Encoding methods
-
-   Encoding methods consist of operations that map between octet string
-   messages and integer message representatives.
-
-   Two types of encoding method are considered in this document:
-   encoding methods for encryption, encoding methods for signatures with
-   appendix.
-
-9.1 Encoding methods for encryption
-
-   An encoding method for encryption consists of an encoding operation
-   and a decoding operation. An encoding operation maps a message M to a
-   message representative EM of a specified length; the decoding
-   operation maps a message representative EM back to a message. The
-   encoding and decoding operations are inverses.
-
-   The message representative EM will typically have some structure that
-   can be verified by the decoding operation; the decoding operation
-   will output "decoding error" if the structure is not present. The
-   encoding operation may also introduce some randomness, so that
-   different applications of the encoding operation to the same message
-   will produce different representatives.
-
-   Two encoding methods for encryption are employed in the encryption
-   schemes and are specified here: EME-OAEP and EME-PKCS1-v1_5.
-
-9.1.1 EME-OAEP
-
-   This encoding method is parameterized by the choice of hash function
-   and mask generation function. Suggested hash and mask generation
-   functions are given in Section 10. This encoding method is based on
-   the method found in [2].
-
-9.1.1.1 Encoding operation
-
-   EME-OAEP-ENCODE (M, P, emLen)
-
-   Options:
-   Hash      hash function (hLen denotes the length in octet of the
-             hash function output)
-   MGF       mask generation function
-
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 22]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   Input:
-   M         message to be encoded, an octet string of length at most
-             emLen-1-2hLen
-   P         encoding parameters, an octet string
-   emLen     intended length in octets of the encoded message, at least
-             2hLen+1
-
-   Output:
-   EM        encoded message, an octet string of length emLen;
-             "message too long" or "parameter string too long"
-
-   Steps:
-
-   1. If the length of P is greater than the input limitation for the
-   hash function (2^61-1 octets for SHA-1) then output "parameter string
-   too long" and stop.
-
-   2. If ||M|| > emLen-2hLen-1 then output "message too long" and stop.
-
-   3. Generate an octet string PS consisting of emLen-||M||-2hLen-1 zero
-   octets. The length of PS may be 0.
-
-   4. Let pHash = Hash(P), an octet string of length hLen.
-
-   5. Concatenate pHash, PS, the message M, and other padding to form a
-   data block DB as: DB = pHash || PS || 01 || M
-
-   6. Generate a random octet string seed of length hLen.
-
-   7. Let dbMask = MGF(seed, emLen-hLen).
-
-   8. Let maskedDB = DB \xor dbMask.
-
-   9. Let seedMask = MGF(maskedDB, hLen).
-
-   10. Let maskedSeed = seed \xor seedMask.
-
-   11. Let EM = maskedSeed || maskedDB.
-
-   12. Output EM.
-
-9.1.1.2 Decoding operation EME-OAEP-DECODE (EM, P)
-
-   Options:
-   Hash      hash function (hLen denotes the length in octet of the hash
-             function output)
-
-   MGF       mask generation function
-
-
-
-Kaliski & Staddon            Informational                     [Page 23]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   Input:
-
-   EM        encoded message, an octet string of length at least 2hLen+1
-   P         encoding parameters, an octet string
-
-   Output:
-   M         recovered message, an octet string of length at most
-             ||EM||-1-2hLen; or "decoding error"
-
-   Steps:
-
-   1. If the length of P is greater than the input limitation for the
-   hash function (2^61-1 octets for SHA-1) then output "parameter string
-   too long" and stop.
-
-   2. If ||EM|| < 2hLen+1, then output "decoding error" and stop.
-
-   3. Let maskedSeed be the first hLen octets of EM and let maskedDB be
-   the remaining ||EM|| - hLen octets.
-
-   4. Let seedMask = MGF(maskedDB, hLen).
-
-   5. Let seed = maskedSeed \xor seedMask.
-
-   6. Let dbMask = MGF(seed, ||EM|| - hLen).
-
-   7. Let DB = maskedDB \xor dbMask.
-
-   8. Let pHash = Hash(P), an octet string of length hLen.
-
-   9. Separate DB into an octet string pHash' consisting of the first
-   hLen octets of DB, a (possibly empty) octet string PS consisting of
-   consecutive zero octets following pHash', and a message M as:
-
-   DB = pHash' || PS || 01 || M
-
-   If there is no 01 octet to separate PS from M, output "decoding
-   error" and stop.
-
-   10. If pHash' does not equal pHash, output "decoding error" and stop.
-
-   11. Output M.
-
-9.1.2 EME-PKCS1-v1_5
-
-   This encoding method is the same as in PKCS #1 v1.5, Section 8:
-   Encryption Process.
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 24]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-9.1.2.1 Encoding operation
-
-   EME-PKCS1-V1_5-ENCODE (M, emLen)
-
-   Input:
-   M         message to be encoded, an octet string of length at most
-             emLen-10
-   emLen     intended length in octets of the encoded message
-
-   Output:
-   EM        encoded message, an octet string of length emLen; or
-             "message too long"
-
-   Steps:
-
-   1. If the length of the message M is greater than emLen - 10 octets,
-   output "message too long" and stop.
-
-   2. Generate an octet string PS of length emLen-||M||-2 consisting of
-   pseudorandomly generated nonzero octets. The length of PS will be at
-   least 8 octets.
-
-   3. Concatenate PS, the message M, and other padding to form the
-   encoded message EM as:
-
-   EM = 02 || PS || 00 || M
-
-   4. Output EM.
-
-9.1.2.2 Decoding operation
-
-   EME-PKCS1-V1_5-DECODE (EM)
-
-   Input:
-   EM      encoded message, an octet string of length at least 10
-
-   Output:
-   M       recovered message, an octet string of length at most
-           ||EM||-10; or "decoding error"
-
-   Steps:
-
-   1. If the length of the encoded message EM is less than 10, output
-   "decoding error" and stop.
-
-   2. Separate the encoded message EM into an octet string PS consisting
-   of nonzero octets and a message M as: EM = 02 || PS || 00 || M.
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 25]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   If the first octet of EM is not 02, or if there is no 00 octet to
-   separate PS from M, output "decoding error" and stop.
-
-   3. If the length of PS is less than 8 octets, output "decoding error"
-   and stop.
-
-   4. Output M.
-
-9.2 Encoding methods for signatures with appendix
-
-   An encoding method for signatures with appendix, for the purposes of
-   this document, consists of an encoding operation. An encoding
-   operation maps a message M to a message representative EM of a
-   specified length. (In future versions of this document, encoding
-   methods may be added that also include a decoding operation.)
-
-   One encoding method for signatures with appendix is employed in the
-   encryption schemes and is specified here: EMSA-PKCS1-v1_5.
-
-9.2.1 EMSA-PKCS1-v1_5
-
-   This encoding method only has an encoding operation.
-
-   EMSA-PKCS1-v1_5-ENCODE (M, emLen)
-
-   Option:
-   Hash      hash function (hLen denotes the length in octet of the hash
-             function output)
-
-   Input:
-   M         message to be encoded
-   emLen     intended length in octets of the encoded message, at least
-             ||T|| + 10, where T is the DER encoding of a certain value
-             computed during the encoding operation
-
-   Output:
-   EM        encoded message, an octet string of length emLen; or "message
-             too long" or "intended encoded message length too short"
-
-   Steps:
-
-   1. Apply the hash function to the message M to produce a hash value
-   H:
-
-   H = Hash(M).
-
-   If the hash function outputs "message too long," then output "message
-   too long".
-
-
-
-Kaliski & Staddon            Informational                     [Page 26]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   2. Encode the algorithm ID for the hash function and the hash value
-   into an ASN.1 value of type DigestInfo (see Section 11) with the
-   Distinguished Encoding Rules (DER), where the type DigestInfo has the
-   syntax
-
-   DigestInfo::=SEQUENCE{
-     digestAlgorithm  AlgorithmIdentifier,
-     digest OCTET STRING }
-
-   The first field identifies the hash function and the second contains
-   the hash value. Let T be the DER encoding.
-
-   3. If emLen is less than ||T|| + 10 then output "intended encoded
-   message length too short".
-
-   4. Generate an octet string PS consisting of emLen-||T||-2 octets
-   with value FF (hexadecimal). The length of PS will be at least 8
-   octets.
-
-   5. Concatenate PS, the DER encoding T, and other padding to form the
-   encoded message EM as: EM = 01 || PS || 00 || T
-
-   6. Output EM.
-
-10. Auxiliary Functions
-
-   This section specifies the hash functions and the mask generation
-   functions that are mentioned in the encoding methods (Section 9).
-
-10.1 Hash Functions
-
-   Hash functions are used in the operations contained in Sections 7, 8
-   and 9. Hash functions are deterministic, meaning that the output is
-   completely determined by the input. Hash functions take octet strings
-   of variable length, and generate fixed length octet strings. The hash
-   functions used in the operations contained in Sections 7, 8 and 9
-   should be collision resistant. This means that it is infeasible to
-   find two distinct inputs to the hash function that produce the same
-   output. A collision resistant hash function also has the desirable
-   property of being one-way; this means that given an output, it is
-   infeasible to find an input whose hash is the specified output. The
-   property of collision resistance is especially desirable for RSASSA-
-   PKCS1-v1_5, as it makes it infeasible to forge signatures. In
-   addition to the requirements, the hash function should yield a mask
-   generation function  (Section 10.2) with pseudorandom output.
-
-
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 27]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   Three hash functions are recommended for the encoding methods in this
-   document: MD2 [15], MD5 [17], and SHA-1 [16]. For the EME-OAEP
-   encoding method, only SHA-1 is recommended. For the EMSA-PKCS1-v1_5
-   encoding method, SHA-1 is recommended for new applications. MD2 and
-   MD5 are recommended only for compatibility with existing applications
-   based on PKCS #1 v1.5.
-
-   The hash functions themselves are not defined here; readers are
-   referred to the appropriate references ([15], [17] and [16]).
-
-   Note. Version 1.5 of this document also allowed for the use of MD4 in
-   signature schemes. The cryptanalysis of MD4 has progressed
-   significantly in the intervening years. For example, Dobbertin [10]
-   demonstrated how to find collisions for MD4 and that the first two
-   rounds of MD4 are not one-way [11]. Because of these results and
-   others (e.g. [9]), MD4 is no longer recommended. There have also been
-   advances in the cryptanalysis of MD2 and MD5, although not enough to
-   warrant removal from existing applications. Rogier and Chauvaud [19]
-   demonstrated how to find collisions in a modified version of MD2. No
-   one has demonstrated how to find collisions for the full MD5
-   algorithm, although partial results have been found (e.g. [8]). For
-   new applications, to address these concerns, SHA-1 is preferred.
-
-10.2 Mask Generation Functions
-
-   A mask generation function takes an octet string of variable length
-   and a desired output length as input, and outputs an octet string of
-   the desired length. There may be restrictions on the length of the
-   input and output octet strings, but such bounds are generally very
-   large. Mask generation functions are deterministic; the octet string
-   output is completely determined by the input octet string. The output
-   of a mask generation function should be pseudorandom, that is, if the
-   seed to the function is unknown, it should be infeasible to
-   distinguish the output from a truly random string. The plaintext-
-   awareness of RSAES-OAEP relies on the random nature of the output of
-   the mask generation function, which in turn relies on the random
-   nature of the underlying hash.
-
-   One mask generation function is recommended for the encoding methods
-   in this document, and is defined here: MGF1, which is based on a hash
-   function. Future versions of this document may define other mask
-   generation functions.
-
-10.2.1 MGF1
-
-   MGF1 is a Mask Generation Function based on a hash function.
-
-   MGF1 (Z, l)
-
-
-
-Kaliski & Staddon            Informational                     [Page 28]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   Options:
-   Hash    hash function (hLen denotes the length in octets of the hash
-           function output)
-
-   Input:
-   Z       seed from which mask is generated, an octet string
-   l       intended length in octets of the mask, at most 2^32(hLen)
-
-   Output:
-   mask    mask, an octet string of length l; or "mask too long"
-
-   Steps:
-
-   1.If l > 2^32(hLen), output "mask too long" and stop.
-
-   2.Let T  be the empty octet string.
-
-   3.For counter from 0 to \lceil{l / hLen}\rceil-1, do the following:
-
-   a.Convert counter to an octet string C of length 4 with the primitive
-   I2OSP: C = I2OSP (counter, 4)
-
-   b.Concatenate the hash of the seed Z and C to the octet string T: T =
-   T || Hash (Z || C)
-
-   4.Output the leading l octets of T as the octet string mask.
-
-11. ASN.1 syntax
-
-11.1 Key representation
-
-   This section defines ASN.1 object identifiers for RSA public and
-   private keys, and defines the types RSAPublicKey and RSAPrivateKey.
-   The intended application of these definitions includes X.509
-   certificates, PKCS #8 [22], and PKCS #12 [23].
-
-   The object identifier rsaEncryption identifies RSA public and private
-   keys as defined in Sections 11.1.1 and 11.1.2. The parameters field
-   associated with this OID in an AlgorithmIdentifier shall have type
-   NULL.
-
-   rsaEncryption OBJECT IDENTIFIER ::= {pkcs-1 1}
-
-   All of the definitions in this section are the same as in PKCS #1
-   v1.5.
-
-
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 29]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-11.1.1 Public-key syntax
-
-   An RSA public key should be represented with the ASN.1 type
-   RSAPublicKey:
-
-   RSAPublicKey::=SEQUENCE{
-     modulus INTEGER, -- n
-     publicExponent INTEGER -- e }
-
-   (This type is specified in X.509 and is retained here for
-   compatibility.)
-
-   The fields of type RSAPublicKey have the following meanings:
-   -modulus is the modulus n.
-   -publicExponent is the public exponent e.
-
-11.1.2 Private-key syntax
-
-   An RSA private key should be represented with ASN.1 type
-   RSAPrivateKey:
-
-   RSAPrivateKey ::= SEQUENCE {
-     version Version,
-     modulus INTEGER, -- n
-     publicExponent INTEGER, -- e
-     privateExponent INTEGER, -- d
-     prime1 INTEGER, -- p
-     prime2 INTEGER, -- q
-     exponent1 INTEGER, -- d mod (p-1)
-     exponent2 INTEGER, -- d mod (q-1)
-     coefficient INTEGER -- (inverse of q) mod p }
-
-   Version ::= INTEGER
-
-   The fields of type RSAPrivateKey have the following meanings:
-
-   -version is the version number, for compatibility with future
-   revisions of this document. It shall be 0 for this version of the
-   document.
-   -modulus is the modulus n.
-   -publicExponent is the public exponent e.
-   -privateExponent is the private exponent d.
-   -prime1 is the prime factor p of n.
-   -prime2 is the prime factor q of n.
-   -exponent1 is d mod (p-1).
-   -exponent2 is d mod (q-1).
-   -coefficient is the Chinese Remainder Theorem coefficient q-1 mod p.
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 30]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-11.2 Scheme identification
-
-   This section defines object identifiers for the encryption and
-   signature schemes. The schemes compatible with PKCS #1 v1.5 have the
-   same definitions as in PKCS #1 v1.5. The intended application of
-   these definitions includes X.509 certificates and PKCS #7.
-
-11.2.1 Syntax for RSAES-OAEP
-
-   The object identifier id-RSAES-OAEP identifies the RSAES-OAEP
-   encryption scheme.
-
-   id-RSAES-OAEP OBJECT IDENTIFIER ::= {pkcs-1 7}
-
-   The parameters field associated with this OID in an
-   AlgorithmIdentifier shall have type RSAEP-OAEP-params:
-
-   RSAES-OAEP-params ::=  SEQUENCE {
-     hashFunc [0] AlgorithmIdentifier {{oaepDigestAlgorithms}}
-       DEFAULT sha1Identifier,
-     maskGenFunc [1] AlgorithmIdentifier {{pkcs1MGFAlgorithms}}
-       DEFAULT mgf1SHA1Identifier,
-     pSourceFunc [2] AlgorithmIdentifier
-       {{pkcs1pSourceAlgorithms}}
-       DEFAULT pSpecifiedEmptyIdentifier }
-
-   The fields of type RSAES-OAEP-params have the following meanings:
-
-   -hashFunc identifies the hash function. It shall be an algorithm ID
-   with an OID in the set oaepDigestAlgorithms, which for this version
-   shall consist of id-sha1, identifying the SHA-1 hash function. The
-   parameters field for id-sha1 shall have type NULL.
-
-   oaepDigestAlgorithms ALGORITHM-IDENTIFIER ::= {
-     {NULL IDENTIFIED BY id-sha1} }
-
-   id-sha1 OBJECT IDENTIFIER ::=
-     {iso(1) identified-organization(3) oiw(14) secsig(3)
-       algorithms(2) 26}
-
-
-   The default hash function is SHA-1:
-   sha1Identifier ::= AlgorithmIdentifier {id-sha1, NULL}
-
-   -maskGenFunc identifies the mask generation function. It shall be an
-   algorithm ID with an OID in the set pkcs1MGFAlgorithms, which for
-   this version shall consist of id-mgf1, identifying the MGF1 mask
-   generation function (see Section 10.2.1). The parameters field for
-
-
-
-Kaliski & Staddon            Informational                     [Page 31]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   id-mgf1 shall have type AlgorithmIdentifier, identifying the hash
-   function on which MGF1 is based, where the OID for the hash function
-   shall be in the set oaepDigestAlgorithms.
-
-   pkcs1MGFAlgorithms ALGORITHM-IDENTIFIER ::= {
-     {AlgorithmIdentifier {{oaepDigestAlgorithms}} IDENTIFIED
-       BY id-mgf1} }
-
-   id-mgf1 OBJECT IDENTIFIER ::= {pkcs-1 8}
-
-   The default mask generation function is MGF1 with SHA-1:
-
-   mgf1SHA1Identifier ::= AlgorithmIdentifier {
-     id-mgf1, sha1Identifier }
-
-   -pSourceFunc identifies the source (and possibly the value) of the
-   encoding parameters P. It shall be an algorithm ID with an OID in the
-   set pkcs1pSourceAlgorithms, which for this version shall consist of
-   id-pSpecified, indicating that the encoding parameters are specified
-   explicitly. The parameters field for id-pSpecified shall have type
-   OCTET STRING, containing the encoding parameters.
-
-   pkcs1pSourceAlgorithms ALGORITHM-IDENTIFIER ::= {
-     {OCTET STRING IDENTIFIED BY id-pSpecified} }
-
-   id-pSpecified OBJECT IDENTIFIER ::= {pkcs-1 9}
-
-   The default encoding parameters is an empty string (so that pHash in
-   EME-OAEP will contain the hash of the empty string):
-
-   pSpecifiedEmptyIdentifier ::= AlgorithmIdentifier {
-     id-pSpecified, OCTET STRING SIZE (0) }
-
-   If all of the default values of the fields in RSAES-OAEP-params are
-   used, then the algorithm identifier will have the following value:
-
-   RSAES-OAEP-Default-Identifier ::= AlgorithmIdentifier {
-     id-RSAES-OAEP,
-     {sha1Identifier,
-      mgf1SHA1Identifier,
-      pSpecifiedEmptyIdentifier } }
-
-11.2.2 Syntax for RSAES-PKCS1-v1_5
-
-   The object identifier rsaEncryption (Section 11.1) identifies the
-   RSAES-PKCS1-v1_5 encryption scheme. The parameters field associated
-   with this OID in an AlgorithmIdentifier shall have type NULL. This is
-   the same as in PKCS #1 v1.5.
-
-
-
-Kaliski & Staddon            Informational                     [Page 32]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   RsaEncryption   OBJECT IDENTIFIER ::= {PKCS-1 1}
-
-11.2.3 Syntax for RSASSA-PKCS1-v1_5
-
-   The object identifier for RSASSA-PKCS1-v1_5 shall be one of the
-   following. The choice of OID depends on the choice of hash algorithm:
-   MD2, MD5 or SHA-1. Note that if either MD2 or MD5 is used then the
-   OID is just as in PKCS #1 v1.5. For each OID, the parameters field
-   associated with this OID in an AlgorithmIdentifier shall have type
-   NULL.
-
-   If the hash function to be used is MD2, then the OID should be:
-
-   md2WithRSAEncryption ::= {PKCS-1 2}
-
-   If the hash function to be used is MD5, then the OID should be:
-
-   md5WithRSAEncryption ::= {PKCS-1 4}
-
-   If the hash function to be used is SHA-1, then the OID should be:
-
-   sha1WithRSAEncryption ::= {pkcs-1 5}
-
-   In the digestInfo type mentioned in Section 9.2.1 the OIDS for the
-   digest algorithm are the following:
-
-   id-SHA1 OBJECT IDENTIFIER ::=
-           {iso(1) identified-organization(3) oiw(14) secsig(3)
-            algorithms(2) 26 }
-
-   md2 OBJECT IDENTIFIER ::=
-           {iso(1) member-body(2) US(840) rsadsi(113549)
-            digestAlgorithm(2) 2}
-
-   md5 OBJECT IDENTIFIER ::=
-           {iso(1) member-body(2) US(840) rsadsi(113549)
-            digestAlgorithm(2) 5}
-
-   The parameters field of the digest algorithm has ASN.1 type NULL for
-   these OIDs.
-
-12. Patent statement
-
-   The Internet Standards Process as defined in RFC 1310 requires a
-   written statement from the Patent holder that a license will be made
-   available to applicants under reasonable terms and conditions prior
-   to approving a specification as a Proposed, Draft or Internet
-   Standard.
-
-
-
-Kaliski & Staddon            Informational                     [Page 33]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   The Internet Society, Internet Architecture Board, Internet
-   Engineering Steering Group and the Corporation for National Research
-   Initiatives take no position on the validity or scope of the
-   following patents and patent applications, nor on the appropriateness
-   of the terms of the assurance. The Internet Society and other groups
-   mentioned above have not made any determination as to any other
-   intellectual property rights which may apply to the practice of this
-   standard.  Any further consideration of these matters is the user's
-   responsibility.
-
-12.1 Patent statement for the RSA algorithm
-
-   The Massachusetts Institute of Technology has granted RSA Data
-   Security, Inc., exclusive sub-licensing rights to the following
-   patent issued in the United States:
-
-   Cryptographic Communications System and Method ("RSA"), No. 4,405,829
-
-   RSA Data Security, Inc. has provided the following statement with
-   regard to this patent:
-
-   It is RSA's business practice to make licenses to its patents
-   available on reasonable and nondiscriminatory terms. Accordingly, RSA
-   is willing, upon request, to grant non-exclusive licenses to such
-   patent on reasonable and non-discriminatory terms and conditions to
-   those who respect RSA's intellectual property rights and subject to
-   RSA's then current royalty rate for the patent licensed. The royalty
-   rate for the RSA patent is presently set at 2% of the licensee's
-   selling price for each product covered by the patent.  Any requests
-   for license information may be directed to:
-
-            Director of Licensing
-            RSA Data Security, Inc.
-            2955 Campus Drive
-            Suite 400
-            San Mateo, CA 94403
-
-   A license under RSA's patent(s) does not include any rights to know-
-   how or other technical information or license under other
-   intellectual property rights.  Such license does not extend to any
-   activities which constitute infringement or inducement thereto. A
-   licensee must make his own determination as to whether a license is
-   necessary under patents of others.
-
-
-
-
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 34]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-13. Revision history
-
-   Versions 1.0-1.3
-
-   Versions 1.0-1.3 were distributed to participants in RSA Data
-   Security, Inc.'s Public-Key Cryptography Standards meetings in
-   February and March 1991.
-
-
-   Version 1.4
-
-   Version 1.4 was part of the June 3, 1991 initial public release of
-   PKCS. Version 1.4 was published as NIST/OSI Implementors' Workshop
-   document SEC-SIG-91-18.
-
-
-   Version 1.5
-
-   Version 1.5 incorporates several editorial changes, including updates
-   to the references and the addition of a revision history. The
-   following substantive changes were made: -Section 10: "MD4 with RSA"
-   signature and verification processes were added.
-
-   -Section 11: md4WithRSAEncryption object identifier was added.
-
-   Version 2.0 [DRAFT]
-
-   Version 2.0 incorporates major editorial changes in terms of the
-   document structure, and introduces the RSAEP-OAEP encryption scheme.
-   This version continues to support the encryption and signature
-   processes in version 1.5, although the hash algorithm MD4 is no
-   longer allowed due to cryptanalytic advances in the intervening
-   years.
-
-14. References
-
-   [1] ANSI, ANSI X9.44: Key Management Using Reversible Public Key
-       Cryptography for the Financial Services Industry. Work in
-       Progress.
-
-   [2] M. Bellare and P. Rogaway. Optimal Asymmetric Encryption - How to
-       Encrypt with RSA. In Advances in Cryptology-Eurocrypt '94, pp.
-       92-111, Springer-Verlag, 1994.
-
-   [3] M. Bellare and P. Rogaway. The Exact Security of Digital
-       Signatures - How to Sign with RSA and Rabin. In Advances in
-       Cryptology-Eurocrypt '96, pp. 399-416, Springer-Verlag, 1996.
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 35]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   [4] D. Bleichenbacher. Chosen Ciphertext Attacks against Protocols
-       Based on the RSA Encryption Standard PKCS #1. To appear in
-       Advances in Cryptology-Crypto '98.
-
-   [5] D. Bleichenbacher, B. Kaliski and J. Staddon. Recent Results on
-       PKCS #1: RSA Encryption Standard. RSA Laboratories' Bulletin,
-       Number 7, June 24, 1998.
-
-   [6] CCITT. Recommendation X.509: The Directory-Authentication
-       Framework. 1988.
-
-   [7] D. Coppersmith, M. Franklin, J. Patarin and M. Reiter. Low-
-       Exponent RSA with Related Messages. In Advances in Cryptology-
-       Eurocrypt '96, pp. 1-9, Springer-Verlag, 1996
-
-   [8] B. Den Boer and Bosselaers. Collisions for the Compression
-       Function of MD5. In Advances in Cryptology-Eurocrypt '93, pp
-       293-304, Springer-Verlag, 1994.
-
-   [9] B. den Boer, and A. Bosselaers. An Attack on the Last Two Rounds
-       of MD4. In Advances in Cryptology-Crypto '91, pp.194-203,
-       Springer-Verlag, 1992.
-
-   [10] H. Dobbertin. Cryptanalysis of MD4. Fast Software Encryption.
-        Lecture Notes in Computer Science, Springer-Verlag 1996, pp.
-        55-72.
-
-   [11] H. Dobbertin. Cryptanalysis of MD5 Compress. Presented at the
-        rump session of Eurocrypt `96, May 14, 1996
-
-   [12] H. Dobbertin.The First Two Rounds of MD4 are Not One-Way. Fast
-        Software Encryption. Lecture Notes in Computer Science,
-        Springer-Verlag 1998, pp. 284-292.
-
-   [13] J. Hastad. Solving Simultaneous Modular Equations of Low Degree.
-        SIAM Journal of Computing, 17, 1988, pp. 336-341.
-
-   [14] IEEE. IEEE P1363: Standard Specifications for Public Key
-        Cryptography. Draft Version 4.
-
-   [15] Kaliski, B., "The MD2 Message-Digest Algorithm", RFC 1319, April
-        1992.
-
-   [16] National Institute of Standards and Technology (NIST). FIPS
-        Publication 180-1: Secure Hash Standard. April 1994.
-
-   [17] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, April
-        1992.
-
-
-
-Kaliski & Staddon            Informational                     [Page 36]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-   [18] R. Rivest, A. Shamir and L. Adleman. A Method for Obtaining
-        Digital Signatures and Public-Key Cryptosystems. Communications
-        of the ACM, 21(2), pp. 120-126, February 1978.
-
-   [19] N. Rogier and P. Chauvaud. The Compression Function of MD2 is
-        not Collision Free. Presented at Selected Areas of Cryptography
-        `95. Carleton University, Ottawa, Canada. May 18-19, 1995.
-
-   [20] RSA Laboratories. PKCS #1: RSA Encryption Standard. Version 1.5,
-        November 1993.
-
-   [21] RSA Laboratories. PKCS #7: Cryptographic Message Syntax
-        Standard. Version 1.5, November 1993.
-
-   [22] RSA  Laboratories. PKCS #8: Private-Key Information Syntax
-        Standard. Version 1.2, November 1993.
-
-   [23] RSA Laboratories. PKCS #12: Personal Information Exchange Syntax
-        Standard. Version 1.0, Work in Progress, April 1997.
-
-Security Considerations
-
-   Security issues are discussed throughout this memo.
-
-Acknowledgements
-
-   This document is based on a contribution of RSA Laboratories, a
-   division of RSA Data Security, Inc.  Any substantial use of the text
-   from this document must acknowledge RSA Data Security, Inc. RSA Data
-   Security, Inc. requests that all material mentioning or referencing
-   this document identify this as "RSA Data Security, Inc. PKCS #1
-   v2.0".
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 37]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-Authors' Addresses
-
-   Burt Kaliski
-   RSA Laboratories East
-   20 Crosby Drive
-   Bedford, MA  01730
-
-   Phone: (617) 687-7000
-   EMail: burt@rsa.com
-
-
-   Jessica Staddon
-   RSA Laboratories West
-   2955 Campus Drive
-   Suite 400
-   San Mateo, CA 94403
-
-   Phone: (650) 295-7600
-   EMail: jstaddon@rsa.com
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 38]
-
-RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998
-
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society (1998).  All Rights Reserved.
-
-   This document and translations of it may be copied and furnished to
-   others, and derivative works that comment on or otherwise explain it
-   or assist in its implementation may be prepared, copied, published
-   and distributed, in whole or in part, without restriction of any
-   kind, provided that the above copyright notice and this paragraph are
-   included on all such copies and derivative works.  However, this
-   document itself may not be modified in any way, such as by removing
-   the copyright notice or references to the Internet Society or other
-   Internet organizations, except as needed for the purpose of
-   developing Internet standards in which case the procedures for
-   copyrights defined in the Internet Standards process must be
-   followed, or as required to translate it into languages other than
-   English.
-
-   The limited permissions granted above are perpetual and will not be
-   revoked by the Internet Society or its successors or assigns.
-
-   This document and the information contained herein is provided on an
-   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
-   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
-   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
-   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaliski & Staddon            Informational                     [Page 39]
-
diff --git a/doc/ikev2/[RFC3280] - x509 Certificates.txt b/doc/ikev2/[RFC3280] - x509 Certificates.txt
deleted file mode 100644
index 433908bb7..000000000
--- a/doc/ikev2/[RFC3280] - x509 Certificates.txt
+++ /dev/null
@@ -1,7227 +0,0 @@
-
-
-
-
-
-
-Network Working Group                                         R. Housley
-Request for Comments: 3280                              RSA Laboratories
-Obsoletes: 2459                                                  W. Polk
-Category: Standards Track                                           NIST
-                                                                 W. Ford
-                                                                VeriSign
-                                                                 D. Solo
-                                                               Citigroup
-                                                              April 2002
-
-                Internet X.509 Public Key Infrastructure
-       Certificate and Certificate Revocation List (CRL) Profile
-
-Status of this Memo
-
-   This document specifies an Internet standards track protocol for the
-   Internet community, and requests discussion and suggestions for
-   improvements.  Please refer to the current edition of the "Internet
-   Official Protocol Standards" (STD 1) for the standardization state
-   and status of this protocol.  Distribution of this memo is unlimited.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (2002).  All Rights Reserved.
-
-Abstract
-
-   This memo profiles the X.509 v3 certificate and X.509 v2 Certificate
-   Revocation List (CRL) for use in the Internet.  An overview of this
-   approach and model are provided as an introduction.  The X.509 v3
-   certificate format is described in detail, with additional
-   information regarding the format and semantics of Internet name
-   forms.  Standard certificate extensions are described and two
-   Internet-specific extensions are defined.  A set of required
-   certificate extensions is specified.  The X.509 v2 CRL format is
-   described in detail, and required extensions are defined.  An
-   algorithm for X.509 certification path validation is described.  An
-   ASN.1 module and examples are provided in the appendices.
-
-Table of Contents
-
-   1  Introduction  . . . . . . . . . . . . . . . . . . . . . .   4
-   2  Requirements and Assumptions  . . . . . . . . . . . . . .   5
-   2.1  Communication and Topology  . . . . . . . . . . . . . .   6
-   2.2  Acceptability Criteria  . . . . . . . . . . . . . . . .   6
-   2.3  User Expectations . . . . . . . . . . . . . . . . . . .   7
-   2.4  Administrator Expectations  . . . . . . . . . . . . . .   7
-   3  Overview of Approach  . . . . . . . . . . . . . . . . . .   7
-
-
-
-Housley, et. al.            Standards Track                     [Page 1]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   3.1  X.509 Version 3 Certificate . . . . . . . . . . . . . .   8
-   3.2  Certification Paths and Trust . . . . . . . . . . . . .   9
-   3.3  Revocation  . . . . . . . . . . . . . . . . . . . . . .  11
-   3.4  Operational Protocols . . . . . . . . . . . . . . . . .  13
-   3.5  Management Protocols  . . . . . . . . . . . . . . . . .  13
-   4  Certificate and Certificate Extensions Profile  . . . . .  14
-   4.1  Basic Certificate Fields  . . . . . . . . . . . . . . .  15
-   4.1.1  Certificate Fields  . . . . . . . . . . . . . . . . .  16
-   4.1.1.1  tbsCertificate  . . . . . . . . . . . . . . . . . .  16
-   4.1.1.2  signatureAlgorithm  . . . . . . . . . . . . . . . .  16
-   4.1.1.3  signatureValue  . . . . . . . . . . . . . . . . . .  16
-   4.1.2  TBSCertificate  . . . . . . . . . . . . . . . . . . .  17
-   4.1.2.1  Version . . . . . . . . . . . . . . . . . . . . . .  17
-   4.1.2.2  Serial number . . . . . . . . . . . . . . . . . . .  17
-   4.1.2.3  Signature . . . . . . . . . . . . . . . . . . . . .  18
-   4.1.2.4  Issuer  . . . . . . . . . . . . . . . . . . . . . .  18
-   4.1.2.5  Validity  . . . . . . . . . . . . . . . . . . . . .  22
-   4.1.2.5.1  UTCTime . . . . . . . . . . . . . . . . . . . . .  22
-   4.1.2.5.2  GeneralizedTime . . . . . . . . . . . . . . . . .  22
-   4.1.2.6  Subject . . . . . . . . . . . . . . . . . . . . . .  23
-   4.1.2.7  Subject Public Key Info . . . . . . . . . . . . . .  24
-   4.1.2.8  Unique Identifiers  . . . . . . . . . . . . . . . .  24
-   4.1.2.9 Extensions . . . . . . . . . . . . . . . . . . . . .  24
-   4.2  Certificate Extensions  . . . . . . . . . . . . . . . .  24
-   4.2.1  Standard Extensions . . . . . . . . . . . . . . . . .  25
-   4.2.1.1  Authority Key Identifier  . . . . . . . . . . . . .  26
-   4.2.1.2  Subject Key Identifier  . . . . . . . . . . . . . .  27
-   4.2.1.3  Key Usage . . . . . . . . . . . . . . . . . . . . .  28
-   4.2.1.4  Private Key Usage Period  . . . . . . . . . . . . .  29
-   4.2.1.5  Certificate Policies  . . . . . . . . . . . . . . .  30
-   4.2.1.6  Policy Mappings . . . . . . . . . . . . . . . . . .  33
-   4.2.1.7  Subject Alternative Name  . . . . . . . . . . . . .  33
-   4.2.1.8  Issuer Alternative Name . . . . . . . . . . . . . .  36
-   4.2.1.9  Subject Directory Attributes  . . . . . . . . . . .  36
-   4.2.1.10  Basic Constraints  . . . . . . . . . . . . . . . .  36
-   4.2.1.11  Name Constraints . . . . . . . . . . . . . . . . .  37
-   4.2.1.12  Policy Constraints . . . . . . . . . . . . . . . .  40
-   4.2.1.13  Extended Key Usage . . . . . . . . . . . . . . . .  40
-   4.2.1.14  CRL Distribution Points  . . . . . . . . . . . . .  42
-   4.2.1.15  Inhibit Any-Policy . . . . . . . . . . . . . . . .  44
-   4.2.1.16  Freshest CRL . . . . . . . . . . . . . . . . . . .  44
-   4.2.2  Internet Certificate Extensions . . . . . . . . . . .  45
-   4.2.2.1  Authority Information Access  . . . . . . . . . . .  45
-   4.2.2.2  Subject Information Access  . . . . . . . . . . . .  46
-   5  CRL and CRL Extensions Profile  . . . . . . . . . . . . .  48
-   5.1  CRL Fields  . . . . . . . . . . . . . . . . . . . . . .  49
-   5.1.1  CertificateList Fields  . . . . . . . . . . . . . . .  50
-   5.1.1.1  tbsCertList . . . . . . . . . . . . . . . . . . . .  50
-
-
-
-Housley, et. al.            Standards Track                     [Page 2]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   5.1.1.2  signatureAlgorithm  . . . . . . . . . . . . . . . .  50
-   5.1.1.3  signatureValue  . . . . . . . . . . . . . . . . . .  51
-   5.1.2  Certificate List "To Be Signed" . . . . . . . . . . .  51
-   5.1.2.1  Version . . . . . . . . . . . . . . . . . . . . . .  52
-   5.1.2.2  Signature . . . . . . . . . . . . . . . . . . . . .  52
-   5.1.2.3  Issuer Name . . . . . . . . . . . . . . . . . . . .  52
-   5.1.2.4  This Update . . . . . . . . . . . . . . . . . . . .  52
-   5.1.2.5  Next Update . . . . . . . . . . . . . . . . . . . .  53
-   5.1.2.6  Revoked Certificates  . . . . . . . . . . . . . . .  53
-   5.1.2.7  Extensions  . . . . . . . . . . . . . . . . . . . .  53
-   5.2  CRL Extensions  . . . . . . . . . . . . . . . . . . . .  53
-   5.2.1  Authority Key Identifier  . . . . . . . . . . . . . .  54
-   5.2.2  Issuer Alternative Name . . . . . . . . . . . . . . .  54
-   5.2.3  CRL Number  . . . . . . . . . . . . . . . . . . . . .  55
-   5.2.4  Delta CRL Indicator . . . . . . . . . . . . . . . . .  55
-   5.2.5  Issuing Distribution Point  . . . . . . . . . . . . .  58
-   5.2.6  Freshest CRL  . . . . . . . . . . . . . . . . . . . .  59
-   5.3  CRL Entry Extensions  . . . . . . . . . . . . . . . . .  60
-   5.3.1  Reason Code . . . . . . . . . . . . . . . . . . . . .  60
-   5.3.2  Hold Instruction Code . . . . . . . . . . . . . . . .  61
-   5.3.3  Invalidity Date . . . . . . . . . . . . . . . . . . .  62
-   5.3.4  Certificate Issuer  . . . . . . . . . . . . . . . . .  62
-   6  Certificate Path Validation . . . . . . . . . . . . . . .  62
-   6.1  Basic Path Validation . . . . . . . . . . . . . . . . .  63
-   6.1.1  Inputs  . . . . . . . . . . . . . . . . . . . . . . .  66
-   6.1.2  Initialization  . . . . . . . . . . . . . . . . . . .  67
-   6.1.3  Basic Certificate Processing  . . . . . . . . . . . .  70
-   6.1.4  Preparation for Certificate i+1 . . . . . . . . . . .  75
-   6.1.5  Wrap-up procedure . . . . . . . . . . . . . . . . . .  78
-   6.1.6  Outputs . . . . . . . . . . . . . . . . . . . . . . .  80
-   6.2  Extending Path Validation . . . . . . . . . . . . . . .  80
-   6.3  CRL Validation  . . . . . . . . . . . . . . . . . . . .  81
-   6.3.1  Revocation Inputs . . . . . . . . . . . . . . . . . .  82
-   6.3.2  Initialization and Revocation State Variables . . . .  82
-   6.3.3  CRL Processing  . . . . . . . . . . . . . . . . . . .  83
-   7  References  . . . . . . . . . . . . . . . . . . . . . . .  86
-   8  Intellectual Property Rights  . . . . . . . . . . . . . .  88
-   9  Security Considerations . . . . . . . . . . . . . . . . .  89
-   Appendix A.  ASN.1 Structures and OIDs . . . . . . . . . . .  92
-   A.1 Explicitly Tagged Module, 1988 Syntax  . . . . . . . . .  92
-   A.2 Implicitly Tagged Module, 1988 Syntax  . . . . . . . . . 105
-   Appendix B.  ASN.1 Notes . . . . . . . . . . . . . . . . . . 112
-   Appendix C.  Examples  . . . . . . . . . . . . . . . . . . . 115
-   C.1  DSA Self-Signed Certificate . . . . . . . . . . . . . . 115
-   C.2  End Entity Certificate Using DSA  . . . . . . . . . . . 119
-   C.3  End Entity Certificate Using RSA  . . . . . . . . . . . 122
-   C.4  Certificate Revocation List . . . . . . . . . . . . . . 126
-   Author Addresses . . . . . . . . . . . . . . . . . . . . . . 128
-
-
-
-Housley, et. al.            Standards Track                     [Page 3]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   Full Copyright Statement . . . . . . . . . . . . . . . . . . 129
-
-1  Introduction
-
-   This specification is one part of a family of standards for the X.509
-   Public Key Infrastructure (PKI) for the Internet.
-
-   This specification profiles the format and semantics of certificates
-   and certificate revocation lists (CRLs) for the Internet PKI.
-   Procedures are described for processing of certification paths in the
-   Internet environment.  Finally, ASN.1 modules are provided in the
-   appendices for all data structures defined or referenced.
-
-   Section 2 describes Internet PKI requirements, and the assumptions
-   which affect the scope of this document.  Section 3 presents an
-   architectural model and describes its relationship to previous IETF
-   and ISO/IEC/ITU-T standards.  In particular, this document's
-   relationship with the IETF PEM specifications and the ISO/IEC/ITU-T
-   X.509 documents are described.
-
-   Section 4 profiles the X.509 version 3 certificate, and section 5
-   profiles the X.509 version 2 CRL.  The profiles include the
-   identification of ISO/IEC/ITU-T and ANSI extensions which may be
-   useful in the Internet PKI.  The profiles are presented in the 1988
-   Abstract Syntax Notation One (ASN.1) rather than the 1997 ASN.1
-   syntax used in the most recent ISO/IEC/ITU-T standards.
-
-   Section 6 includes certification path validation procedures.  These
-   procedures are based upon the ISO/IEC/ITU-T definition.
-   Implementations are REQUIRED to derive the same results but are not
-   required to use the specified procedures.
-
-   Procedures for identification and encoding of public key materials
-   and digital signatures are defined in [PKIXALGS].  Implementations of
-   this specification are not required to use any particular
-   cryptographic algorithms.  However, conforming implementations which
-   use the algorithms identified in [PKIXALGS] MUST identify and encode
-   the public key materials and digital signatures as described in that
-   specification.
-
-   Finally, three appendices are provided to aid implementers.  Appendix
-   A contains all ASN.1 structures defined or referenced within this
-   specification.  As above, the material is presented in the 1988
-   ASN.1.  Appendix B contains notes on less familiar features of the
-   ASN.1 notation used within this specification.  Appendix C contains
-   examples of a conforming certificate and a conforming CRL.
-
-
-
-
-
-Housley, et. al.            Standards Track                     [Page 4]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   This specification obsoletes RFC 2459.  This specification differs
-   from RFC 2459 in five basic areas:
-
-      * To promote interoperable implementations, a detailed algorithm
-      for certification path validation is included in section 6.1 of
-      this specification; RFC 2459 provided only a high-level
-      description of path validation.
-
-      * An algorithm for determining the status of a certificate using
-      CRLs is provided in section 6.3 of this specification.  This
-      material was not present in RFC 2459.
-
-      * To accommodate new usage models, detailed information describing
-      the use of delta CRLs is provided in Section 5 of this
-      specification.
-
-      * Identification and encoding of public key materials and digital
-      signatures are not included in this specification, but are now
-      described in a companion specification [PKIXALGS].
-
-      * Four additional extensions are specified: three certificate
-      extensions and one CRL extension.  The certificate extensions are
-      subject info access, inhibit any-policy, and freshest CRL.  The
-      freshest CRL extension is also defined as a CRL extension.
-
-      * Throughout the specification, clarifications have been
-      introduced to enhance consistency with the ITU-T X.509
-      specification.  X.509 defines the certificate and CRL format as
-      well as many of the extensions that appear in this specification.
-      These changes were introduced to improve the likelihood of
-      interoperability between implementations based on this
-      specification with implementations based on the ITU-T
-      specification.
-
-   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
-   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
-   document are to be interpreted as described in RFC 2119.
-
-2  Requirements and Assumptions
-
-   The goal of this specification is to develop a profile to facilitate
-   the use of X.509 certificates within Internet applications for those
-   communities wishing to make use of X.509 technology.  Such
-   applications may include WWW, electronic mail, user authentication,
-   and IPsec.  In order to relieve some of the obstacles to using X.509
-
-
-
-
-
-
-Housley, et. al.            Standards Track                     [Page 5]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   certificates, this document defines a profile to promote the
-   development of certificate management systems; development of
-   application tools; and interoperability determined by policy.
-
-   Some communities will need to supplement, or possibly replace, this
-   profile in order to meet the requirements of specialized application
-   domains or environments with additional authorization, assurance, or
-   operational requirements.  However, for basic applications, common
-   representations of frequently used attributes are defined so that
-   application developers can obtain necessary information without
-   regard to the issuer of a particular certificate or certificate
-   revocation list (CRL).
-
-   A certificate user should review the certificate policy generated by
-   the certification authority (CA) before relying on the authentication
-   or non-repudiation services associated with the public key in a
-   particular certificate.  To this end, this standard does not
-   prescribe legally binding rules or duties.
-
-   As supplemental authorization and attribute management tools emerge,
-   such as attribute certificates, it may be appropriate to limit the
-   authenticated attributes that are included in a certificate.  These
-   other management tools may provide more appropriate methods of
-   conveying many authenticated attributes.
-
-2.1  Communication and Topology
-
-   The users of certificates will operate in a wide range of
-   environments with respect to their communication topology, especially
-   users of secure electronic mail.  This profile supports users without
-   high bandwidth, real-time IP connectivity, or high connection
-   availability.  In addition, the profile allows for the presence of
-   firewall or other filtered communication.
-
-   This profile does not assume the deployment of an X.500 Directory
-   system or a LDAP directory system.  The profile does not prohibit the
-   use of an X.500 Directory or a LDAP directory; however, any means of
-   distributing certificates and certificate revocation lists (CRLs) may
-   be used.
-
-2.2  Acceptability Criteria
-
-   The goal of the Internet Public Key Infrastructure (PKI) is to meet
-   the needs of deterministic, automated identification, authentication,
-   access control, and authorization functions.  Support for these
-   services determines the attributes contained in the certificate as
-   well as the ancillary control information in the certificate such as
-   policy data and certification path constraints.
-
-
-
-Housley, et. al.            Standards Track                     [Page 6]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-2.3  User Expectations
-
-   Users of the Internet PKI are people and processes who use client
-   software and are the subjects named in certificates.  These uses
-   include readers and writers of electronic mail, the clients for WWW
-   browsers, WWW servers, and the key manager for IPsec within a router.
-   This profile recognizes the limitations of the platforms these users
-   employ and the limitations in sophistication and attentiveness of the
-   users themselves.  This manifests itself in minimal user
-   configuration responsibility (e.g., trusted CA keys, rules), explicit
-   platform usage constraints within the certificate, certification path
-   constraints which shield the user from many malicious actions, and
-   applications which sensibly automate validation functions.
-
-2.4  Administrator Expectations
-
-   As with user expectations, the Internet PKI profile is structured to
-   support the individuals who generally operate CAs.  Providing
-   administrators with unbounded choices increases the chances that a
-   subtle CA administrator mistake will result in broad compromise.
-   Also, unbounded choices greatly complicate the software that process
-   and validate the certificates created by the CA.
-
-3  Overview of Approach
-
-   Following is a simplified view of the architectural model assumed by
-   the PKIX specifications.
-
-   The components in this model are:
-
-   end entity: user of PKI certificates and/or end user system that is
-               the subject of a certificate;
-   CA:         certification authority;
-   RA:         registration authority, i.e., an optional system to which
-               a CA delegates certain management functions;
-   CRL issuer: an optional system to which a CA delegates the
-               publication of certificate revocation lists;
-   repository: a system or collection of distributed systems that stores
-               certificates and CRLs and serves as a means of
-               distributing these certificates and CRLs to end entities.
-
-   Note that an Attribute Authority (AA) might also choose to delegate
-   the publication of CRLs to a CRL issuer.
-
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                     [Page 7]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   +---+
-   | C |                       +------------+
-   | e | <-------------------->| End entity |
-   | r |       Operational     +------------+
-   | t |       transactions          ^
-   | i |      and management         |  Management
-   | f |       transactions          |  transactions        PKI
-   | i |                             |                     users
-   | c |                             v
-   | a | =======================  +--+------------+  ==============
-   | t |                          ^               ^
-   | e |                          |               |         PKI
-   |   |                          v               |      management
-   | & |                       +------+           |       entities
-   |   | <---------------------|  RA  |<----+     |
-   | C |  Publish certificate  +------+     |     |
-   | R |                                    |     |
-   | L |                                    |     |
-   |   |                                    v     v
-   | R |                                +------------+
-   | e | <------------------------------|     CA     |
-   | p |   Publish certificate          +------------+
-   | o |   Publish CRL                     ^      ^
-   | s |                                   |      |  Management
-   | i |                +------------+     |      |  transactions
-   | t | <--------------| CRL Issuer |<----+      |
-   | o |   Publish CRL  +------------+            v
-   | r |                                      +------+
-   | y |                                      |  CA  |
-   +---+                                      +------+
-
-                      Figure 1 - PKI Entities
-
-3.1  X.509 Version 3 Certificate
-
-   Users of a public key require confidence that the associated private
-   key is owned by the correct remote subject (person or system) with
-   which an encryption or digital signature mechanism will be used.
-   This confidence is obtained through the use of public key
-   certificates, which are data structures that bind public key values
-   to subjects.  The binding is asserted by having a trusted CA
-   digitally sign each certificate.  The CA may base this assertion upon
-   technical means (a.k.a., proof of possession through a challenge-
-   response protocol), presentation of the private key, or on an
-   assertion by the subject.  A certificate has a limited valid lifetime
-   which is indicated in its signed contents.  Because a certificate's
-   signature and timeliness can be independently checked by a
-   certificate-using client, certificates can be distributed via
-
-
-
-Housley, et. al.            Standards Track                     [Page 8]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   untrusted communications and server systems, and can be cached in
-   unsecured storage in certificate-using systems.
-
-   ITU-T X.509 (formerly CCITT X.509) or ISO/IEC 9594-8, which was first
-   published in 1988 as part of the X.500 Directory recommendations,
-   defines a standard certificate format [X.509].  The certificate
-   format in the 1988 standard is called the version 1 (v1) format.
-   When X.500 was revised in 1993, two more fields were added, resulting
-   in the version 2 (v2) format.
-
-   The Internet Privacy Enhanced Mail (PEM) RFCs, published in 1993,
-   include specifications for a public key infrastructure based on X.509
-   v1 certificates [RFC 1422].  The experience gained in attempts to
-   deploy RFC 1422 made it clear that the v1 and v2 certificate formats
-   are deficient in several respects.  Most importantly, more fields
-   were needed to carry information which PEM design and implementation
-   experience had proven necessary.  In response to these new
-   requirements, ISO/IEC, ITU-T and ANSI X9 developed the X.509 version
-   3 (v3) certificate format.  The v3 format extends the v2 format by
-   adding provision for additional extension fields.  Particular
-   extension field types may be specified in standards or may be defined
-   and registered by any organization or community.  In June 1996,
-   standardization of the basic v3 format was completed [X.509].
-
-   ISO/IEC, ITU-T, and ANSI X9 have also developed standard extensions
-   for use in the v3 extensions field [X.509][X9.55].  These extensions
-   can convey such data as additional subject identification
-   information, key attribute information, policy information, and
-   certification path constraints.
-
-   However, the ISO/IEC, ITU-T, and ANSI X9 standard extensions are very
-   broad in their applicability.  In order to develop interoperable
-   implementations of X.509 v3 systems for Internet use, it is necessary
-   to specify a profile for use of the X.509 v3 extensions tailored for
-   the Internet.  It is one goal of this document to specify a profile
-   for Internet WWW, electronic mail, and IPsec applications.
-   Environments with additional requirements may build on this profile
-   or may replace it.
-
-3.2  Certification Paths and Trust
-
-   A user of a security service requiring knowledge of a public key
-   generally needs to obtain and validate a certificate containing the
-   required public key.  If the public key user does not already hold an
-   assured copy of the public key of the CA that signed the certificate,
-   the CA's name, and related information (such as the validity period
-   or name constraints), then it might need an additional certificate to
-   obtain that public key.  In general, a chain of multiple certificates
-
-
-
-Housley, et. al.            Standards Track                     [Page 9]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   may be needed, comprising a certificate of the public key owner (the
-   end entity) signed by one CA, and zero or more additional
-   certificates of CAs signed by other CAs.  Such chains, called
-   certification paths, are required because a public key user is only
-   initialized with a limited number of assured CA public keys.
-
-   There are different ways in which CAs might be configured in order
-   for public key users to be able to find certification paths.  For
-   PEM, RFC 1422 defined a rigid hierarchical structure of CAs.  There
-   are three types of PEM certification authority:
-
-      (a)  Internet Policy Registration Authority (IPRA):  This
-      authority, operated under the auspices of the Internet Society,
-      acts as the root of the PEM certification hierarchy at level 1.
-      It issues certificates only for the next level of authorities,
-      PCAs.  All certification paths start with the IPRA.
-
-      (b)  Policy Certification Authorities (PCAs):  PCAs are at level 2
-      of the hierarchy, each PCA being certified by the IPRA.  A PCA
-      shall establish and publish a statement of its policy with respect
-      to certifying users or subordinate certification authorities.
-      Distinct PCAs aim to satisfy different user needs.  For example,
-      one PCA (an organizational PCA) might support the general
-      electronic mail needs of commercial organizations, and another PCA
-      (a high-assurance PCA) might have a more stringent policy designed
-      for satisfying legally binding digital signature requirements.
-
-      (c)  Certification Authorities (CAs):  CAs are at level 3 of the
-      hierarchy and can also be at lower levels.  Those at level 3 are
-      certified by PCAs.  CAs represent, for example, particular
-      organizations, particular organizational units (e.g., departments,
-      groups, sections), or particular geographical areas.
-
-   RFC 1422 furthermore has a name subordination rule which requires
-   that a CA can only issue certificates for entities whose names are
-   subordinate (in the X.500 naming tree) to the name of the CA itself.
-   The trust associated with a PEM certification path is implied by the
-   PCA name.  The name subordination rule ensures that CAs below the PCA
-   are sensibly constrained as to the set of subordinate entities they
-   can certify (e.g., a CA for an organization can only certify entities
-   in that organization's name tree).  Certificate user systems are able
-   to mechanically check that the name subordination rule has been
-   followed.
-
-   The RFC 1422 uses the X.509 v1 certificate formats.  The limitations
-   of X.509 v1 required imposition of several structural restrictions to
-   clearly associate policy information or restrict the utility of
-   certificates.  These restrictions included:
-
-
-
-Housley, et. al.            Standards Track                    [Page 10]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-      (a)  a pure top-down hierarchy, with all certification paths
-      starting from IPRA;
-
-      (b)  a naming subordination rule restricting the names of a CA's
-      subjects; and
-
-      (c)  use of the PCA concept, which requires knowledge of
-      individual PCAs to be built into certificate chain verification
-      logic.  Knowledge of individual PCAs was required to determine if
-      a chain could be accepted.
-
-   With X.509 v3, most of the requirements addressed by RFC 1422 can be
-   addressed using certificate extensions, without a need to restrict
-   the CA structures used.  In particular, the certificate extensions
-   relating to certificate policies obviate the need for PCAs and the
-   constraint extensions obviate the need for the name subordination
-   rule.  As a result, this document supports a more flexible
-   architecture, including:
-
-      (a)  Certification paths start with a public key of a CA in a
-      user's own domain, or with the public key of the top of a
-      hierarchy.  Starting with the public key of a CA in a user's own
-      domain has certain advantages.  In some environments, the local
-      domain is the most trusted.
-
-      (b)  Name constraints may be imposed through explicit inclusion of
-      a name constraints extension in a certificate, but are not
-      required.
-
-      (c)  Policy extensions and policy mappings replace the PCA
-      concept, which permits a greater degree of automation.  The
-      application can determine if the certification path is acceptable
-      based on the contents of the certificates instead of a priori
-      knowledge of PCAs.  This permits automation of certification path
-      processing.
-
-3.3  Revocation
-
-   When a certificate is issued, it is expected to be in use for its
-   entire validity period.  However, various circumstances may cause a
-   certificate to become invalid prior to the expiration of the validity
-   period.  Such circumstances include change of name, change of
-   association between subject and CA (e.g., an employee terminates
-   employment with an organization), and compromise or suspected
-   compromise of the corresponding private key.  Under such
-   circumstances, the CA needs to revoke the certificate.
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 11]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   X.509 defines one method of certificate revocation.  This method
-   involves each CA periodically issuing a signed data structure called
-   a certificate revocation list (CRL).  A CRL is a time stamped list
-   identifying revoked certificates which is signed by a CA or CRL
-   issuer and made freely available in a public repository.  Each
-   revoked certificate is identified in a CRL by its certificate serial
-   number.  When a certificate-using system uses a certificate (e.g.,
-   for verifying a remote user's digital signature), that system not
-   only checks the certificate signature and validity but also acquires
-   a suitably-recent CRL and checks that the certificate serial number
-   is not on that CRL.  The meaning of "suitably-recent" may vary with
-   local policy, but it usually means the most recently-issued CRL.  A
-   new CRL is issued on a regular periodic basis (e.g., hourly, daily,
-   or weekly).  An entry is added to the CRL as part of the next update
-   following notification of revocation.  An entry MUST NOT be removed
-   from the CRL until it appears on one regularly scheduled CRL issued
-   beyond the revoked certificate's validity period.
-
-   An advantage of this revocation method is that CRLs may be
-   distributed by exactly the same means as certificates themselves,
-   namely, via untrusted servers and untrusted communications.
-
-   One limitation of the CRL revocation method, using untrusted
-   communications and servers, is that the time granularity of
-   revocation is limited to the CRL issue period.  For example, if a
-   revocation is reported now, that revocation will not be reliably
-   notified to certificate-using systems until all currently issued CRLs
-   are updated -- this may be up to one hour, one day, or one week
-   depending on the frequency that CRLs are issued.
-
-   As with the X.509 v3 certificate format, in order to facilitate
-   interoperable implementations from multiple vendors, the X.509 v2 CRL
-   format needs to be profiled for Internet use.  It is one goal of this
-   document to specify that profile.  However, this profile does not
-   require the issuance of CRLs.  Message formats and protocols
-   supporting on-line revocation notification are defined in other PKIX
-   specifications.  On-line methods of revocation notification may be
-   applicable in some environments as an alternative to the X.509 CRL.
-   On-line revocation checking may significantly reduce the latency
-   between a revocation report and the distribution of the information
-   to relying parties.  Once the CA accepts a revocation report as
-   authentic and valid, any query to the on-line service will correctly
-   reflect the certificate validation impacts of the revocation.
-   However, these methods impose new security requirements: the
-   certificate validator needs to trust the on-line validation service
-   while the repository does not need to be trusted.
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 12]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-3.4  Operational Protocols
-
-   Operational protocols are required to deliver certificates and CRLs
-   (or status information) to certificate using client systems.
-   Provisions are needed for a variety of different means of certificate
-   and CRL delivery, including distribution procedures based on LDAP,
-   HTTP, FTP, and X.500.  Operational protocols supporting these
-   functions are defined in other PKIX specifications.  These
-   specifications may include definitions of message formats and
-   procedures for supporting all of the above operational environments,
-   including definitions of or references to appropriate MIME content
-   types.
-
-3.5  Management Protocols
-
-   Management protocols are required to support on-line interactions
-   between PKI user and management entities.  For example, a management
-   protocol might be used between a CA and a client system with which a
-   key pair is associated, or between two CAs which cross-certify each
-   other.  The set of functions which potentially need to be supported
-   by management protocols include:
-
-      (a)  registration:  This is the process whereby a user first makes
-      itself known to a CA (directly, or through an RA), prior to that
-      CA issuing  a certificate or certificates for that user.
-
-      (b)  initialization:  Before a client system can operate securely
-      it is necessary to install key materials which have the
-      appropriate relationship with keys stored elsewhere in the
-      infrastructure.  For example, the client needs to be securely
-      initialized with the public key and other assured information of
-      the trusted CA(s), to be used in validating certificate paths.
-
-      Furthermore, a client typically needs to be initialized with its
-      own key pair(s).
-
-      (c)  certification:  This is the process in which a CA issues a
-      certificate for a user's public key, and returns that certificate
-      to the user's client system and/or posts that certificate in a
-      repository.
-
-      (d)  key pair recovery:  As an option, user client key materials
-      (e.g., a user's private key used for encryption purposes) may be
-      backed up by a CA or a key backup system.  If a user needs to
-      recover these backed up key materials (e.g., as a result of a
-      forgotten password or a lost key chain file), an on-line protocol
-      exchange may be needed to support such recovery.
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 13]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-      (e)  key pair update:  All key pairs need to be updated regularly,
-      i.e., replaced with a new key pair, and new certificates issued.
-
-      (f)  revocation request:  An authorized person advises a CA of an
-      abnormal situation requiring certificate revocation.
-
-      (g)  cross-certification:  Two CAs exchange information used in
-      establishing a cross-certificate.  A cross-certificate is a
-      certificate issued by one CA to another CA which contains a CA
-      signature key used for issuing certificates.
-
-   Note that on-line protocols are not the only way of implementing the
-   above functions.  For all functions there are off-line methods of
-   achieving the same result, and this specification does not mandate
-   use of on-line protocols.  For example, when hardware tokens are
-   used, many of the functions may be achieved as part of the physical
-   token delivery.  Furthermore, some of the above functions may be
-   combined into one protocol exchange.  In particular, two or more of
-   the registration, initialization, and certification functions can be
-   combined into one protocol exchange.
-
-   The PKIX series of specifications defines a set of standard message
-   formats supporting the above functions.  The protocols for conveying
-   these messages in different environments (e.g., e-mail, file
-   transfer, and WWW) are described in those specifications.
-
-4  Certificate and Certificate Extensions Profile
-
-   This section presents a profile for public key certificates that will
-   foster interoperability and a reusable PKI.  This section is based
-   upon the X.509 v3 certificate format and the standard certificate
-   extensions defined in [X.509].  The ISO/IEC and ITU-T documents use
-   the 1997 version of ASN.1; while this document uses the 1988 ASN.1
-   syntax, the encoded certificate and standard extensions are
-   equivalent.  This section also defines private extensions required to
-   support a PKI for the Internet community.
-
-   Certificates may be used in a wide range of applications and
-   environments covering a broad spectrum of interoperability goals and
-   a broader spectrum of operational and assurance requirements.  The
-   goal of this document is to establish a common baseline for generic
-   applications requiring broad interoperability and limited special
-   purpose requirements.  In particular, the emphasis will be on
-   supporting the use of X.509 v3 certificates for informal Internet
-   electronic mail, IPsec, and WWW applications.
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 14]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-4.1  Basic Certificate Fields
-
-   The X.509 v3 certificate basic syntax is as follows.  For signature
-   calculation, the data that is to be signed is encoded using the ASN.1
-   distinguished encoding rules (DER) [X.690].  ASN.1 DER encoding is a
-   tag, length, value encoding system for each element.
-
-   Certificate  ::=  SEQUENCE  {
-        tbsCertificate       TBSCertificate,
-        signatureAlgorithm   AlgorithmIdentifier,
-        signatureValue       BIT STRING  }
-
-   TBSCertificate  ::=  SEQUENCE  {
-        version         [0]  EXPLICIT Version DEFAULT v1,
-        serialNumber         CertificateSerialNumber,
-        signature            AlgorithmIdentifier,
-        issuer               Name,
-        validity             Validity,
-        subject              Name,
-        subjectPublicKeyInfo SubjectPublicKeyInfo,
-        issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
-                             -- If present, version MUST be v2 or v3
-        subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
-                             -- If present, version MUST be v2 or v3
-        extensions      [3]  EXPLICIT Extensions OPTIONAL
-                             -- If present, version MUST be v3
-        }
-
-   Version  ::=  INTEGER  {  v1(0), v2(1), v3(2)  }
-
-   CertificateSerialNumber  ::=  INTEGER
-
-   Validity ::= SEQUENCE {
-        notBefore      Time,
-        notAfter       Time }
-
-   Time ::= CHOICE {
-        utcTime        UTCTime,
-        generalTime    GeneralizedTime }
-
-   UniqueIdentifier  ::=  BIT STRING
-
-   SubjectPublicKeyInfo  ::=  SEQUENCE  {
-        algorithm            AlgorithmIdentifier,
-        subjectPublicKey     BIT STRING  }
-
-   Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 15]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   Extension  ::=  SEQUENCE  {
-        extnID      OBJECT IDENTIFIER,
-        critical    BOOLEAN DEFAULT FALSE,
-        extnValue   OCTET STRING  }
-
-   The following items describe the X.509 v3 certificate for use in the
-   Internet.
-
-4.1.1  Certificate Fields
-
-   The Certificate is a SEQUENCE of three required fields.  The fields
-   are described in detail in the following subsections.
-
-4.1.1.1  tbsCertificate
-
-   The field contains the names of the subject and issuer, a public key
-   associated with the subject, a validity period, and other associated
-   information.  The fields are described in detail in section 4.1.2;
-   the tbsCertificate usually includes extensions which are described in
-   section 4.2.
-
-4.1.1.2  signatureAlgorithm
-
-   The signatureAlgorithm field contains the identifier for the
-   cryptographic algorithm used by the CA to sign this certificate.
-   [PKIXALGS] lists supported signature algorithms, but other signature
-   algorithms MAY also be supported.
-
-   An algorithm identifier is defined by the following ASN.1 structure:
-
-   AlgorithmIdentifier  ::=  SEQUENCE  {
-        algorithm               OBJECT IDENTIFIER,
-        parameters              ANY DEFINED BY algorithm OPTIONAL  }
-
-   The algorithm identifier is used to identify a cryptographic
-   algorithm.  The OBJECT IDENTIFIER component identifies the algorithm
-   (such as DSA with SHA-1).  The contents of the optional parameters
-   field will vary according to the algorithm identified.
-
-   This field MUST contain the same algorithm identifier as the
-   signature field in the sequence tbsCertificate (section 4.1.2.3).
-
-4.1.1.3  signatureValue
-
-   The signatureValue field contains a digital signature computed upon
-   the ASN.1 DER encoded tbsCertificate.  The ASN.1 DER encoded
-   tbsCertificate is used as the input to the signature function.  This
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 16]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   signature value is encoded as a BIT STRING and included in the
-   signature field.  The details of this process are specified for each
-   of algorithms listed in [PKIXALGS].
-
-   By generating this signature, a CA certifies the validity of the
-   information in the tbsCertificate field.  In particular, the CA
-   certifies the binding between the public key material and the subject
-   of the certificate.
-
-4.1.2  TBSCertificate
-
-   The sequence TBSCertificate contains information associated with the
-   subject of the certificate and the CA who issued it.  Every
-   TBSCertificate contains the names of the subject and issuer, a public
-   key associated with the subject, a validity period, a version number,
-   and a serial number; some MAY contain optional unique identifier
-   fields.  The remainder of this section describes the syntax and
-   semantics of these fields.  A TBSCertificate usually includes
-   extensions.  Extensions for the Internet PKI are described in Section
-   4.2.
-
-4.1.2.1  Version
-
-   This field describes the version of the encoded certificate.  When
-   extensions are used, as expected in this profile, version MUST be 3
-   (value is 2).  If no extensions are present, but a UniqueIdentifier
-   is present, the version SHOULD be 2 (value is 1); however version MAY
-   be 3.  If only basic fields are present, the version SHOULD be 1 (the
-   value is omitted from the certificate as the default value); however
-   the version MAY be 2 or 3.
-
-   Implementations SHOULD be prepared to accept any version certificate.
-   At a minimum, conforming implementations MUST recognize version 3
-   certificates.
-
-   Generation of version 2 certificates is not expected by
-   implementations based on this profile.
-
-4.1.2.2  Serial number
-
-   The serial number MUST be a positive integer assigned by the CA to
-   each certificate.  It MUST be unique for each certificate issued by a
-   given CA (i.e., the issuer name and serial number identify a unique
-   certificate).  CAs MUST force the serialNumber to be a non-negative
-   integer.
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 17]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   Given the uniqueness requirements above, serial numbers can be
-   expected to contain long integers.  Certificate users MUST be able to
-   handle serialNumber values up to 20 octets.  Conformant CAs MUST NOT
-   use serialNumber values longer than 20 octets.
-
-   Note: Non-conforming CAs may issue certificates with serial numbers
-   that are negative, or zero.  Certificate users SHOULD be prepared to
-   gracefully handle such certificates.
-
-4.1.2.3  Signature
-
-   This field contains the algorithm identifier for the algorithm used
-   by the CA to sign the certificate.
-
-   This field MUST contain the same algorithm identifier as the
-   signatureAlgorithm field in the sequence Certificate (section
-   4.1.1.2).  The contents of the optional parameters field will vary
-   according to the algorithm identified.  [PKIXALGS] lists the
-   supported signature algorithms, but other signature algorithms MAY
-   also be supported.
-
-4.1.2.4  Issuer
-
-   The issuer field identifies the entity who has signed and issued the
-   certificate.  The issuer field MUST contain a non-empty distinguished
-   name (DN).  The issuer field is defined as the X.501 type Name
-   [X.501].  Name is defined by the following ASN.1 structures:
-
-   Name ::= CHOICE {
-     RDNSequence }
-
-   RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
-
-   RelativeDistinguishedName ::=
-     SET OF AttributeTypeAndValue
-
-   AttributeTypeAndValue ::= SEQUENCE {
-     type     AttributeType,
-     value    AttributeValue }
-
-   AttributeType ::= OBJECT IDENTIFIER
-
-   AttributeValue ::= ANY DEFINED BY AttributeType
-
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 18]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   DirectoryString ::= CHOICE {
-         teletexString           TeletexString (SIZE (1..MAX)),
-         printableString         PrintableString (SIZE (1..MAX)),
-         universalString         UniversalString (SIZE (1..MAX)),
-         utf8String              UTF8String (SIZE (1..MAX)),
-         bmpString               BMPString (SIZE (1..MAX)) }
-
-   The Name describes a hierarchical name composed of attributes, such
-   as country name, and corresponding values, such as US.  The type of
-   the component AttributeValue is determined by the AttributeType; in
-   general it will be a DirectoryString.
-
-   The DirectoryString type is defined as a choice of PrintableString,
-   TeletexString, BMPString, UTF8String, and UniversalString.  The
-   UTF8String encoding [RFC 2279] is the preferred encoding, and all
-   certificates issued after December 31, 2003 MUST use the UTF8String
-   encoding of DirectoryString (except as noted below).  Until that
-   date, conforming CAs MUST choose from the following options when
-   creating a distinguished name, including their own:
-
-      (a)  if the character set is sufficient, the string MAY be
-      represented as a PrintableString;
-
-      (b)  failing (a), if the BMPString character set is sufficient the
-      string MAY be represented as a BMPString; and
-
-      (c)  failing (a) and (b), the string MUST be represented as a
-      UTF8String.  If (a) or (b) is satisfied, the CA MAY still choose
-      to represent the string as a UTF8String.
-
-   Exceptions to the December 31, 2003 UTF8 encoding requirements are as
-   follows:
-
-      (a)  CAs MAY issue "name rollover" certificates to support an
-      orderly migration to UTF8String encoding.  Such certificates would
-      include the CA's UTF8String encoded name as issuer and and the old
-      name encoding as subject, or vice-versa.
-
-      (b)  As stated in section 4.1.2.6, the subject field MUST be
-      populated with a non-empty distinguished name matching the
-      contents of the issuer field in all certificates issued by the
-      subject CA regardless of encoding.
-
-   The TeletexString and UniversalString are included for backward
-   compatibility, and SHOULD NOT be used for certificates for new
-   subjects.  However, these types MAY be used in certificates where the
-   name was previously established.  Certificate users SHOULD be
-   prepared to receive certificates with these types.
-
-
-
-Housley, et. al.            Standards Track                    [Page 19]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   In addition, many legacy implementations support names encoded in the
-   ISO 8859-1 character set (Latin1String) [ISO 8859-1] but tag them as
-   TeletexString.  TeletexString encodes a larger character set than ISO
-   8859-1, but it encodes some characters differently.  Implementations
-   SHOULD be prepared to handle both encodings.
-
-   As noted above, distinguished names are composed of attributes.  This
-   specification does not restrict the set of attribute types that may
-   appear in names.  However, conforming implementations MUST be
-   prepared to receive certificates with issuer names containing the set
-   of attribute types defined below.  This specification RECOMMENDS
-   support for additional attribute types.
-
-   Standard sets of attributes have been defined in the X.500 series of
-   specifications [X.520].  Implementations of this specification MUST
-   be prepared to receive the following standard attribute types in
-   issuer and subject (section 4.1.2.6) names:
-
-      * country,
-      * organization,
-      * organizational-unit,
-      * distinguished name qualifier,
-      * state or province name,
-      * common name (e.g., "Susan Housley"), and
-      * serial number.
-
-   In addition, implementations of this specification SHOULD be prepared
-   to receive the following standard attribute types in issuer and
-   subject names:
-
-      * locality,
-      * title,
-      * surname,
-      * given name,
-      * initials,
-      * pseudonym, and
-      * generation qualifier (e.g., "Jr.", "3rd", or "IV").
-
-   The syntax and associated object identifiers (OIDs) for these
-   attribute types are provided in the ASN.1 modules in Appendix A.
-
-   In addition, implementations of this specification MUST be prepared
-   to receive the domainComponent attribute, as defined in [RFC 2247].
-   The Domain Name System (DNS) provides a hierarchical resource
-   labeling system.  This attribute provides a convenient mechanism for
-   organizations that wish to use DNs that parallel their DNS names.
-   This is not a replacement for the dNSName component of the
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 20]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   alternative name field.  Implementations are not required to convert
-   such names into DNS names.  The syntax and associated OID for this
-   attribute type is provided in the ASN.1 modules in Appendix A.
-
-   Certificate users MUST be prepared to process the issuer
-   distinguished name and subject distinguished name (section 4.1.2.6)
-   fields to perform name chaining for certification path validation
-   (section 6).  Name chaining is performed by matching the issuer
-   distinguished name in one certificate with the subject name in a CA
-   certificate.
-
-   This specification requires only a subset of the name comparison
-   functionality specified in the X.500 series of specifications.
-   Conforming implementations are REQUIRED to implement the following
-   name comparison rules:
-
-      (a)  attribute values encoded in different types (e.g.,
-      PrintableString and BMPString) MAY be assumed to represent
-      different strings;
-
-      (b) attribute values in types other than PrintableString are case
-      sensitive (this permits matching of attribute values as binary
-      objects);
-
-      (c)  attribute values in PrintableString are not case sensitive
-      (e.g., "Marianne Swanson" is the same as "MARIANNE SWANSON"); and
-
-      (d)  attribute values in PrintableString are compared after
-      removing leading and trailing white space and converting internal
-      substrings of one or more consecutive white space characters to a
-      single space.
-
-   These name comparison rules permit a certificate user to validate
-   certificates issued using languages or encodings unfamiliar to the
-   certificate user.
-
-   In addition, implementations of this specification MAY use these
-   comparison rules to process unfamiliar attribute types for name
-   chaining.  This allows implementations to process certificates with
-   unfamiliar attributes in the issuer name.
-
-   Note that the comparison rules defined in the X.500 series of
-   specifications indicate that the character sets used to encode data
-   in distinguished names are irrelevant.  The characters themselves are
-   compared without regard to encoding.  Implementations of this profile
-   are permitted to use the comparison algorithm defined in the X.500
-   series.  Such an implementation will recognize a superset of name
-   matches recognized by the algorithm specified above.
-
-
-
-Housley, et. al.            Standards Track                    [Page 21]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-4.1.2.5  Validity
-
-   The certificate validity period is the time interval during which the
-   CA warrants that it will maintain information about the status of the
-   certificate.  The field is represented as a SEQUENCE of two dates:
-   the date on which the certificate validity period begins (notBefore)
-   and the date on which the certificate validity period ends
-   (notAfter).  Both notBefore and notAfter may be encoded as UTCTime or
-   GeneralizedTime.
-
-   CAs conforming to this profile MUST always encode certificate
-   validity dates through the year 2049 as UTCTime; certificate validity
-   dates in 2050 or later MUST be encoded as GeneralizedTime.
-
-   The validity period for a certificate is the period of time from
-   notBefore through notAfter, inclusive.
-
-4.1.2.5.1  UTCTime
-
-   The universal time type, UTCTime, is a standard ASN.1 type intended
-   for representation of dates and time.  UTCTime specifies the year
-   through the two low order digits and time is specified to the
-   precision of one minute or one second.  UTCTime includes either Z
-   (for Zulu, or Greenwich Mean Time) or a time differential.
-
-   For the purposes of this profile, UTCTime values MUST be expressed
-   Greenwich Mean Time (Zulu) and MUST include seconds (i.e., times are
-   YYMMDDHHMMSSZ), even where the number of seconds is zero.  Conforming
-   systems MUST interpret the year field (YY) as follows:
-
-      Where YY is greater than or equal to 50, the year SHALL be
-      interpreted as 19YY; and
-
-      Where YY is less than 50, the year SHALL be interpreted as 20YY.
-
-4.1.2.5.2  GeneralizedTime
-
-   The generalized time type, GeneralizedTime, is a standard ASN.1 type
-   for variable precision representation of time.  Optionally, the
-   GeneralizedTime field can include a representation of the time
-   differential between local and Greenwich Mean Time.
-
-   For the purposes of this profile, GeneralizedTime values MUST be
-   expressed Greenwich Mean Time (Zulu) and MUST include seconds (i.e.,
-   times are YYYYMMDDHHMMSSZ), even where the number of seconds is zero.
-   GeneralizedTime values MUST NOT include fractional seconds.
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 22]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-4.1.2.6  Subject
-
-   The subject field identifies the entity associated with the public
-   key stored in the subject public key field.  The subject name MAY be
-   carried in the subject field and/or the subjectAltName extension.  If
-   the subject is a CA (e.g., the basic constraints extension, as
-   discussed in 4.2.1.10, is present and the value of cA is TRUE), then
-   the subject field MUST be populated with a non-empty distinguished
-   name matching the contents of the issuer field (section 4.1.2.4) in
-   all certificates issued by the subject CA.  If the subject is a CRL
-   issuer (e.g., the key usage extension, as discussed in 4.2.1.3, is
-   present and the value of cRLSign is TRUE) then the subject field MUST
-   be populated with a non-empty distinguished name matching the
-   contents of the issuer field (section 4.1.2.4) in all CRLs issued by
-   the subject CRL issuer.  If subject naming information is present
-   only in the subjectAltName extension (e.g., a key bound only to an
-   email address or URI), then the subject name MUST be an empty
-   sequence and the subjectAltName extension MUST be critical.
-
-   Where it is non-empty, the subject field MUST contain an X.500
-   distinguished name (DN).  The DN MUST be unique for each subject
-   entity certified by the one CA as defined by the issuer name field.
-   A CA MAY issue more than one certificate with the same DN to the same
-   subject entity.
-
-   The subject name field is defined as the X.501 type Name.
-   Implementation requirements for this field are those defined for the
-   issuer field (section 4.1.2.4).  When encoding attribute values of
-   type DirectoryString, the encoding rules for the issuer field MUST be
-   implemented.  Implementations of this specification MUST be prepared
-   to receive subject names containing the attribute types required for
-   the issuer field.  Implementations of this specification SHOULD be
-   prepared to receive subject names containing the recommended
-   attribute types for the issuer field.  The syntax and associated
-   object identifiers (OIDs) for these attribute types are provided in
-   the ASN.1 modules in Appendix A.  Implementations of this
-   specification MAY use these comparison rules to process unfamiliar
-   attribute types (i.e., for name chaining).  This allows
-   implementations to process certificates with unfamiliar attributes in
-   the subject name.
-
-   In addition, legacy implementations exist where an RFC 822 name is
-   embedded in the subject distinguished name as an EmailAddress
-   attribute.  The attribute value for EmailAddress is of type IA5String
-   to permit inclusion of the character '@', which is not part of the
-   PrintableString character set.  EmailAddress attribute values are not
-   case sensitive (e.g., "fanfeedback@redsox.com" is the same as
-   "FANFEEDBACK@REDSOX.COM").
-
-
-
-Housley, et. al.            Standards Track                    [Page 23]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   Conforming implementations generating new certificates with
-   electronic mail addresses MUST use the rfc822Name in the subject
-   alternative name field (section 4.2.1.7) to describe such identities.
-   Simultaneous inclusion of the EmailAddress attribute in the subject
-   distinguished name to support legacy implementations is deprecated
-   but permitted.
-
-4.1.2.7  Subject Public Key Info
-
-   This field is used to carry the public key and identify the algorithm
-   with which the key is used (e.g., RSA, DSA, or Diffie-Hellman).  The
-   algorithm is identified using the AlgorithmIdentifier structure
-   specified in section 4.1.1.2.  The object identifiers for the
-   supported algorithms and the methods for encoding the public key
-   materials (public key and parameters) are specified in [PKIXALGS].
-
-4.1.2.8  Unique Identifiers
-
-   These fields MUST only appear if the version is 2 or 3 (section
-   4.1.2.1).  These fields MUST NOT appear if the version is 1.  The
-   subject and issuer unique identifiers are present in the certificate
-   to handle the possibility of reuse of subject and/or issuer names
-   over time.  This profile RECOMMENDS that names not be reused for
-   different entities and that Internet certificates not make use of
-   unique identifiers.  CAs conforming to this profile SHOULD NOT
-   generate certificates with unique identifiers.  Applications
-   conforming to this profile SHOULD be capable of parsing unique
-   identifiers.
-
-4.1.2.9  Extensions
-
-   This field MUST only appear if the version is 3 (section 4.1.2.1).
-   If present, this field is a SEQUENCE of one or more certificate
-   extensions.  The format and content of certificate extensions in the
-   Internet PKI is defined in section 4.2.
-
-4.2  Certificate Extensions
-
-   The extensions defined for X.509 v3 certificates provide methods for
-   associating additional attributes with users or public keys and for
-   managing a certification hierarchy.  The X.509 v3 certificate format
-   also allows communities to define private extensions to carry
-   information unique to those communities.  Each extension in a
-   certificate is designated as either critical or non-critical.  A
-   certificate using system MUST reject the certificate if it encounters
-   a critical extension it does not recognize; however, a non-critical
-   extension MAY be ignored if it is not recognized.  The following
-   sections present recommended extensions used within Internet
-
-
-
-Housley, et. al.            Standards Track                    [Page 24]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   certificates and standard locations for information.  Communities may
-   elect to use additional extensions; however, caution ought to be
-   exercised in adopting any critical extensions in certificates which
-   might prevent use in a general context.
-
-   Each extension includes an OID and an ASN.1 structure.  When an
-   extension appears in a certificate, the OID appears as the field
-   extnID and the corresponding ASN.1 encoded structure is the value of
-   the octet string extnValue.  A certificate MUST NOT include more than
-   one instance of a particular extension.  For example, a certificate
-   may contain only one authority key identifier extension (section
-   4.2.1.1).  An extension includes the boolean critical, with a default
-   value of FALSE.  The text for each extension specifies the acceptable
-   values for the critical field.
-
-   Conforming CAs MUST support key identifiers (sections 4.2.1.1 and
-   4.2.1.2), basic constraints (section 4.2.1.10), key usage (section
-   4.2.1.3), and certificate policies (section 4.2.1.5) extensions.  If
-   the CA issues certificates with an empty sequence for the subject
-   field, the CA MUST support the subject alternative name extension
-   (section 4.2.1.7).  Support for the remaining extensions is OPTIONAL.
-   Conforming CAs MAY support extensions that are not identified within
-   this specification; certificate issuers are cautioned that marking
-   such extensions as critical may inhibit interoperability.
-
-   At a minimum, applications conforming to this profile MUST recognize
-   the following extensions: key usage (section 4.2.1.3), certificate
-   policies (section 4.2.1.5), the subject alternative name (section
-   4.2.1.7), basic constraints (section 4.2.1.10), name constraints
-   (section 4.2.1.11), policy constraints (section 4.2.1.12), extended
-   key usage (section 4.2.1.13), and inhibit any-policy (section
-   4.2.1.15).
-
-   In addition, applications conforming to this profile SHOULD recognize
-   the authority and subject key identifier (sections 4.2.1.1 and
-   4.2.1.2), and policy mapping (section 4.2.1.6) extensions.
-
-4.2.1  Standard Extensions
-
-   This section identifies standard certificate extensions defined in
-   [X.509] for use in the Internet PKI.  Each extension is associated
-   with an OID defined in [X.509].  These OIDs are members of the id-ce
-   arc, which is defined by the following:
-
-   id-ce   OBJECT IDENTIFIER ::=  { joint-iso-ccitt(2) ds(5) 29 }
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 25]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-4.2.1.1  Authority Key Identifier
-
-   The authority key identifier extension provides a means of
-   identifying the public key corresponding to the private key used to
-   sign a certificate.  This extension is used where an issuer has
-   multiple signing keys (either due to multiple concurrent key pairs or
-   due to changeover).  The identification MAY be based on either the
-   key identifier (the subject key identifier in the issuer's
-   certificate) or on the issuer name and serial number.
-
-   The keyIdentifier field of the authorityKeyIdentifier extension MUST
-   be included in all certificates generated by conforming CAs to
-   facilitate certification path construction.  There is one exception;
-   where a CA distributes its public key in the form of a "self-signed"
-   certificate, the authority key identifier MAY be omitted.  The
-   signature on a self-signed certificate is generated with the private
-   key associated with the certificate's subject public key.  (This
-   proves that the issuer possesses both the public and private keys.)
-   In this case, the subject and authority key identifiers would be
-   identical, but only the subject key identifier is needed for
-   certification path building.
-
-   The value of the keyIdentifier field SHOULD be derived from the
-   public key used to verify the certificate's signature or a method
-   that generates unique values.  Two common methods for generating key
-   identifiers from the public key, and one common method for generating
-   unique values, are described in section 4.2.1.2.  Where a key
-   identifier has not been previously established, this specification
-   RECOMMENDS use of one of these methods for generating keyIdentifiers.
-   Where a key identifier has been previously established, the CA SHOULD
-   use the previously established identifier.
-
-   This profile RECOMMENDS support for the key identifier method by all
-   certificate users.
-
-   This extension MUST NOT be marked critical.
-
-   id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::=  { id-ce 35 }
-
-   AuthorityKeyIdentifier ::= SEQUENCE {
-      keyIdentifier             [0] KeyIdentifier           OPTIONAL,
-      authorityCertIssuer       [1] GeneralNames            OPTIONAL,
-      authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL  }
-
-   KeyIdentifier ::= OCTET STRING
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 26]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-4.2.1.2  Subject Key Identifier
-
-   The subject key identifier extension provides a means of identifying
-   certificates that contain a particular public key.
-
-   To facilitate certification path construction, this extension MUST
-   appear in all conforming CA certificates, that is, all certificates
-   including the basic constraints extension (section 4.2.1.10) where
-   the value of cA is TRUE.  The value of the subject key identifier
-   MUST be the value placed in the key identifier field of the Authority
-   Key Identifier extension (section 4.2.1.1) of certificates issued by
-   the subject of this certificate.
-
-   For CA certificates, subject key identifiers SHOULD be derived from
-   the public key or a method that generates unique values.  Two common
-   methods for generating key identifiers from the public key are:
-
-      (1) The keyIdentifier is composed of the 160-bit SHA-1 hash of the
-      value of the BIT STRING subjectPublicKey (excluding the tag,
-      length, and number of unused bits).
-
-      (2) The keyIdentifier is composed of a four bit type field with
-      the value 0100 followed by the least significant 60 bits of the
-      SHA-1 hash of the value of the BIT STRING subjectPublicKey
-      (excluding the tag, length, and number of unused bit string bits).
-
-   One common method for generating unique values is a monotonically
-   increasing sequence of integers.
-
-   For end entity certificates, the subject key identifier extension
-   provides a means for identifying certificates containing the
-   particular public key used in an application.  Where an end entity
-   has obtained multiple certificates, especially from multiple CAs, the
-   subject key identifier provides a means to quickly identify the set
-   of certificates containing a particular public key.  To assist
-   applications in identifying the appropriate end entity certificate,
-   this extension SHOULD be included in all end entity certificates.
-
-   For end entity certificates, subject key identifiers SHOULD be
-   derived from the public key.  Two common methods for generating key
-   identifiers from the public key are identified above.
-
-   Where a key identifier has not been previously established, this
-   specification RECOMMENDS use of one of these methods for generating
-   keyIdentifiers.  Where a key identifier has been previously
-   established, the CA SHOULD use the previously established identifier.
-
-   This extension MUST NOT be marked critical.
-
-
-
-Housley, et. al.            Standards Track                    [Page 27]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::=  { id-ce 14 }
-
-   SubjectKeyIdentifier ::= KeyIdentifier
-
-4.2.1.3  Key Usage
-
-   The key usage extension defines the purpose (e.g., encipherment,
-   signature, certificate signing) of the key contained in the
-   certificate.  The usage restriction might be employed when a key that
-   could be used for more than one operation is to be restricted.  For
-   example, when an RSA key should be used only to verify signatures on
-   objects other than public key certificates and CRLs, the
-   digitalSignature and/or nonRepudiation bits would be asserted.
-   Likewise, when an RSA key should be used only for key management, the
-   keyEncipherment bit would be asserted.
-
-   This extension MUST appear in certificates that contain public keys
-   that are used to validate digital signatures on other public key
-   certificates or CRLs.  When this extension appears, it SHOULD be
-   marked critical.
-
-      id-ce-keyUsage OBJECT IDENTIFIER ::=  { id-ce 15 }
-
-      KeyUsage ::= BIT STRING {
-           digitalSignature        (0),
-           nonRepudiation          (1),
-           keyEncipherment         (2),
-           dataEncipherment        (3),
-           keyAgreement            (4),
-           keyCertSign             (5),
-           cRLSign                 (6),
-           encipherOnly            (7),
-           decipherOnly            (8) }
-
-   Bits in the KeyUsage type are used as follows:
-
-      The digitalSignature bit is asserted when the subject public key
-      is used with a digital signature mechanism to support security
-      services other than certificate signing (bit 5), or CRL signing
-      (bit 6).  Digital signature mechanisms are often used for entity
-      authentication and data origin authentication with integrity.
-
-      The nonRepudiation bit is asserted when the subject public key is
-      used to verify digital signatures used to provide a non-
-      repudiation service which protects against the signing entity
-      falsely denying some action, excluding certificate or CRL signing.
-      In the case of later conflict, a reliable third party may
-      determine the authenticity of the signed data.
-
-
-
-Housley, et. al.            Standards Track                    [Page 28]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-      Further distinctions between the digitalSignature and
-      nonRepudiation bits may be provided in specific certificate
-      policies.
-
-      The keyEncipherment bit is asserted when the subject public key is
-      used for key transport.  For example, when an RSA key is to be
-      used for key management, then this bit is set.
-
-      The dataEncipherment bit is asserted when the subject public key
-      is used for enciphering user data, other than cryptographic keys.
-
-      The keyAgreement bit is asserted when the subject public key is
-      used for key agreement.  For example, when a Diffie-Hellman key is
-      to be used for key management, then this bit is set.
-
-      The keyCertSign bit is asserted when the subject public key is
-      used for verifying a signature on public key certificates.  If the
-      keyCertSign bit is asserted, then the cA bit in the basic
-      constraints extension (section 4.2.1.10) MUST also be asserted.
-
-      The cRLSign bit is asserted when the subject public key is used
-      for verifying a signature on certificate revocation list (e.g., a
-      CRL, delta CRL, or an ARL).  This bit MUST be asserted in
-      certificates that are used to verify signatures on CRLs.
-
-      The meaning of the encipherOnly bit is undefined in the absence of
-      the keyAgreement bit.  When the encipherOnly bit is asserted and
-      the keyAgreement bit is also set, the subject public key may be
-      used only for enciphering data while performing key agreement.
-
-      The meaning of the decipherOnly bit is undefined in the absence of
-      the keyAgreement bit.  When the decipherOnly bit is asserted and
-      the keyAgreement bit is also set, the subject public key may be
-      used only for deciphering data while performing key agreement.
-
-   This profile does not restrict the combinations of bits that may be
-   set in an instantiation of the keyUsage extension.  However,
-   appropriate values for keyUsage extensions for particular algorithms
-   are specified in [PKIXALGS].
-
-4.2.1.4  Private Key Usage Period
-
-   This extension SHOULD NOT be used within the Internet PKI.  CAs
-   conforming to this profile MUST NOT generate certificates that
-   include a critical private key usage period extension.
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 29]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   The private key usage period extension allows the certificate issuer
-   to specify a different validity period for the private key than the
-   certificate.  This extension is intended for use with digital
-   signature keys.  This extension consists of two optional components,
-   notBefore and notAfter.  The private key associated with the
-   certificate SHOULD NOT be used to sign objects before or after the
-   times specified by the two components, respectively.  CAs conforming
-   to this profile MUST NOT generate certificates with private key usage
-   period extensions unless at least one of the two components is
-   present and the extension is non-critical.
-
-   Where used, notBefore and notAfter are represented as GeneralizedTime
-   and MUST be specified and interpreted as defined in section
-   4.1.2.5.2.
-
-   id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::=  { id-ce 16 }
-
-   PrivateKeyUsagePeriod ::= SEQUENCE {
-        notBefore       [0]     GeneralizedTime OPTIONAL,
-        notAfter        [1]     GeneralizedTime OPTIONAL }
-
-4.2.1.5  Certificate Policies
-
-   The certificate policies extension contains a sequence of one or more
-   policy information terms, each of which consists of an object
-   identifier (OID) and optional qualifiers.  Optional qualifiers, which
-   MAY be present, are not expected to change the definition of the
-   policy.
-
-   In an end entity certificate, these policy information terms indicate
-   the policy under which the certificate has been issued and the
-   purposes for which the certificate may be used.  In a CA certificate,
-   these policy information terms limit the set of policies for
-   certification paths which include this certificate.  When a CA does
-   not wish to limit the set of policies for certification paths which
-   include this certificate, it MAY assert the special policy anyPolicy,
-   with a value of { 2 5 29 32 0 }.
-
-   Applications with specific policy requirements are expected to have a
-   list of those policies which they will accept and to compare the
-   policy OIDs in the certificate to that list.  If this extension is
-   critical, the path validation software MUST be able to interpret this
-   extension (including the optional qualifier), or MUST reject the
-   certificate.
-
-   To promote interoperability, this profile RECOMMENDS that policy
-   information terms consist of only an OID.  Where an OID alone is
-   insufficient, this profile strongly recommends that use of qualifiers
-
-
-
-Housley, et. al.            Standards Track                    [Page 30]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   be limited to those identified in this section.  When qualifiers are
-   used with the special policy anyPolicy, they MUST be limited to the
-   qualifiers identified in this section.
-
-   This specification defines two policy qualifier types for use by
-   certificate policy writers and certificate issuers.  The qualifier
-   types are the CPS Pointer and User Notice qualifiers.
-
-   The CPS Pointer qualifier contains a pointer to a Certification
-   Practice Statement (CPS) published by the CA.  The pointer is in the
-   form of a URI.  Processing requirements for this qualifier are a
-   local matter.  No action is mandated by this specification regardless
-   of the criticality value asserted for the extension.
-
-   User notice is intended for display to a relying party when a
-   certificate is used.  The application software SHOULD display all
-   user notices in all certificates of the certification path used,
-   except that if a notice is duplicated only one copy need be
-   displayed.  To prevent such duplication, this qualifier SHOULD only
-   be present in end entity certificates and CA certificates issued to
-   other organizations.
-
-   The user notice has two optional fields: the noticeRef field and the
-   explicitText field.
-
-      The noticeRef field, if used, names an organization and
-      identifies, by number, a particular textual statement prepared by
-      that organization.  For example, it might identify the
-      organization "CertsRUs" and notice number 1.  In a typical
-      implementation, the application software will have a notice file
-      containing the current set of notices for CertsRUs; the
-      application will extract the notice text from the file and display
-      it.  Messages MAY be multilingual, allowing the software to select
-      the particular language message for its own environment.
-
-      An explicitText field includes the textual statement directly in
-      the certificate.  The explicitText field is a string with a
-      maximum size of 200 characters.
-
-   If both the noticeRef and explicitText options are included in the
-   one qualifier and if the application software can locate the notice
-   text indicated by the noticeRef option, then that text SHOULD be
-   displayed; otherwise, the explicitText string SHOULD be displayed.
-
-   Note: While the explicitText has a maximum size of 200 characters,
-   some non-conforming CAs exceed this limit.  Therefore, certificate
-   users SHOULD gracefully handle explicitText with more than 200
-   characters.
-
-
-
-Housley, et. al.            Standards Track                    [Page 31]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   id-ce-certificatePolicies OBJECT IDENTIFIER ::=  { id-ce 32 }
-
-   anyPolicy OBJECT IDENTIFIER ::= { id-ce-certificate-policies 0 }
-
-   certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
-
-   PolicyInformation ::= SEQUENCE {
-        policyIdentifier   CertPolicyId,
-        policyQualifiers   SEQUENCE SIZE (1..MAX) OF
-                                PolicyQualifierInfo OPTIONAL }
-
-   CertPolicyId ::= OBJECT IDENTIFIER
-
-   PolicyQualifierInfo ::= SEQUENCE {
-        policyQualifierId  PolicyQualifierId,
-        qualifier          ANY DEFINED BY policyQualifierId }
-
-   -- policyQualifierIds for Internet policy qualifiers
-
-   id-qt          OBJECT IDENTIFIER ::=  { id-pkix 2 }
-   id-qt-cps      OBJECT IDENTIFIER ::=  { id-qt 1 }
-   id-qt-unotice  OBJECT IDENTIFIER ::=  { id-qt 2 }
-
-   PolicyQualifierId ::=
-        OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )
-
-   Qualifier ::= CHOICE {
-        cPSuri           CPSuri,
-        userNotice       UserNotice }
-
-   CPSuri ::= IA5String
-
-   UserNotice ::= SEQUENCE {
-        noticeRef        NoticeReference OPTIONAL,
-        explicitText     DisplayText OPTIONAL}
-
-   NoticeReference ::= SEQUENCE {
-        organization     DisplayText,
-        noticeNumbers    SEQUENCE OF INTEGER }
-
-   DisplayText ::= CHOICE {
-        ia5String        IA5String      (SIZE (1..200)),
-        visibleString    VisibleString  (SIZE (1..200)),
-        bmpString        BMPString      (SIZE (1..200)),
-        utf8String       UTF8String     (SIZE (1..200)) }
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 32]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-4.2.1.6  Policy Mappings
-
-   This extension is used in CA certificates.  It lists one or more
-   pairs of OIDs; each pair includes an issuerDomainPolicy and a
-   subjectDomainPolicy.  The pairing indicates the issuing CA considers
-   its issuerDomainPolicy equivalent to the subject CA's
-   subjectDomainPolicy.
-
-   The issuing CA's users might accept an issuerDomainPolicy for certain
-   applications.  The policy mapping defines the list of policies
-   associated with the subject CA that may be accepted as comparable to
-   the issuerDomainPolicy.
-
-   Each issuerDomainPolicy named in the policy mapping extension SHOULD
-   also be asserted in a certificate policies extension in the same
-   certificate.  Policies SHOULD NOT be mapped either to or from the
-   special value anyPolicy (section 4.2.1.5).
-
-   This extension MAY be supported by CAs and/or applications, and it
-   MUST be non-critical.
-
-   id-ce-policyMappings OBJECT IDENTIFIER ::=  { id-ce 33 }
-
-   PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
-        issuerDomainPolicy      CertPolicyId,
-        subjectDomainPolicy     CertPolicyId }
-
-4.2.1.7  Subject Alternative Name
-
-   The subject alternative names extension allows additional identities
-   to be bound to the subject of the certificate.  Defined options
-   include an Internet electronic mail address, a DNS name, an IP
-   address, and a uniform resource identifier (URI).  Other options
-   exist, including completely local definitions.  Multiple name forms,
-   and multiple instances of each name form, MAY be included.  Whenever
-   such identities are to be bound into a certificate, the subject
-   alternative name (or issuer alternative name) extension MUST be used;
-   however, a DNS name MAY be represented in the subject field using the
-   domainComponent attribute as described in section 4.1.2.4.
-
-   Because the subject alternative name is considered to be definitively
-   bound to the public key, all parts of the subject alternative name
-   MUST be verified by the CA.
-
-   Further, if the only subject identity included in the certificate is
-   an alternative name form (e.g., an electronic mail address), then the
-   subject distinguished name MUST be empty (an empty sequence), and the
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 33]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   subjectAltName extension MUST be present.  If the subject field
-   contains an empty sequence, the subjectAltName extension MUST be
-   marked critical.
-
-   When the subjectAltName extension contains an Internet mail address,
-   the address MUST be included as an rfc822Name.  The format of an
-   rfc822Name is an "addr-spec" as defined in RFC 822 [RFC 822].  An
-   addr-spec has the form "local-part@domain".  Note that an addr-spec
-   has no phrase (such as a common name) before it, has no comment (text
-   surrounded in parentheses) after it, and is not surrounded by "<" and
-   ">".  Note that while upper and lower case letters are allowed in an
-   RFC 822 addr-spec, no significance is attached to the case.
-
-   When the subjectAltName extension contains a iPAddress, the address
-   MUST be stored in the octet string in "network byte order," as
-   specified in RFC 791 [RFC 791].  The least significant bit (LSB) of
-   each octet is the LSB of the corresponding byte in the network
-   address.  For IP Version 4, as specified in RFC 791, the octet string
-   MUST contain exactly four octets.  For IP Version 6, as specified in
-   RFC 1883, the octet string MUST contain exactly sixteen octets [RFC
-   1883].
-
-   When the subjectAltName extension contains a domain name system
-   label, the domain name MUST be stored in the dNSName (an IA5String).
-   The name MUST be in the "preferred name syntax," as specified by RFC
-   1034 [RFC 1034].  Note that while upper and lower case letters are
-   allowed in domain names, no signifigance is attached to the case.  In
-   addition, while the string " " is a legal domain name, subjectAltName
-   extensions with a dNSName of " " MUST NOT be used.  Finally, the use
-   of the DNS representation for Internet mail addresses (wpolk.nist.gov
-   instead of wpolk@nist.gov) MUST NOT be used; such identities are to
-   be encoded as rfc822Name.
-
-   Note: work is currently underway to specify domain names in
-   international character sets.  Such names will likely not be
-   accommodated by IA5String.  Once this work is complete, this profile
-   will be revisited and the appropriate functionality will be added.
-
-   When the subjectAltName extension contains a URI, the name MUST be
-   stored in the uniformResourceIdentifier (an IA5String).  The name
-   MUST NOT be a relative URL, and it MUST follow the URL syntax and
-   encoding rules specified in [RFC 1738].  The name MUST include both a
-   scheme (e.g., "http" or "ftp") and a scheme-specific-part.  The
-   scheme-specific-part MUST include a fully qualified domain name or IP
-   address as the host.
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 34]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   As specified in [RFC 1738], the scheme name is not case-sensitive
-   (e.g., "http" is equivalent to "HTTP").  The host part is also not
-   case-sensitive, but other components of the scheme-specific-part may
-   be case-sensitive.  When comparing URIs, conforming implementations
-   MUST compare the scheme and host without regard to case, but assume
-   the remainder of the scheme-specific-part is case sensitive.
-
-   When the subjectAltName extension contains a DN in the directoryName,
-   the DN MUST be unique for each subject entity certified by the one CA
-   as defined by the issuer name field.  A CA MAY issue more than one
-   certificate with the same DN to the same subject entity.
-
-   The subjectAltName MAY carry additional name types through the use of
-   the otherName field.  The format and semantics of the name are
-   indicated through the OBJECT IDENTIFIER in the type-id field.  The
-   name itself is conveyed as value field in otherName.  For example,
-   Kerberos [RFC 1510] format names can be encoded into the otherName,
-   using using a Kerberos 5 principal name OID and a SEQUENCE of the
-   Realm and the PrincipalName.
-
-   Subject alternative names MAY be constrained in the same manner as
-   subject distinguished names using the name constraints extension as
-   described in section 4.2.1.11.
-
-   If the subjectAltName extension is present, the sequence MUST contain
-   at least one entry.  Unlike the subject field, conforming CAs MUST
-   NOT issue certificates with subjectAltNames containing empty
-   GeneralName fields.  For example, an rfc822Name is represented as an
-   IA5String.  While an empty string is a valid IA5String, such an
-   rfc822Name is not permitted by this profile.  The behavior of clients
-   that encounter such a certificate when processing a certificication
-   path is not defined by this profile.
-
-   Finally, the semantics of subject alternative names that include
-   wildcard characters (e.g., as a placeholder for a set of names) are
-   not addressed by this specification.  Applications with specific
-   requirements MAY use such names, but they must define the semantics.
-
-   id-ce-subjectAltName OBJECT IDENTIFIER ::=  { id-ce 17 }
-
-   SubjectAltName ::= GeneralNames
-
-   GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
-
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 35]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   GeneralName ::= CHOICE {
-        otherName                       [0]     OtherName,
-        rfc822Name                      [1]     IA5String,
-        dNSName                         [2]     IA5String,
-        x400Address                     [3]     ORAddress,
-        directoryName                   [4]     Name,
-        ediPartyName                    [5]     EDIPartyName,
-        uniformResourceIdentifier       [6]     IA5String,
-        iPAddress                       [7]     OCTET STRING,
-        registeredID                    [8]     OBJECT IDENTIFIER }
-
-   OtherName ::= SEQUENCE {
-        type-id    OBJECT IDENTIFIER,
-        value      [0] EXPLICIT ANY DEFINED BY type-id }
-
-   EDIPartyName ::= SEQUENCE {
-        nameAssigner            [0]     DirectoryString OPTIONAL,
-        partyName               [1]     DirectoryString }
-
-4.2.1.8  Issuer Alternative Names
-
-   As with 4.2.1.7, this extension is used to associate Internet style
-   identities with the certificate issuer.  Issuer alternative names
-   MUST be encoded as in 4.2.1.7.
-
-   Where present, this extension SHOULD NOT be marked critical.
-
-   id-ce-issuerAltName OBJECT IDENTIFIER ::=  { id-ce 18 }
-
-   IssuerAltName ::= GeneralNames
-
-4.2.1.9  Subject Directory Attributes
-
-   The subject directory attributes extension is used to convey
-   identification attributes (e.g., nationality) of the subject.  The
-   extension is defined as a sequence of one or more attributes.  This
-   extension MUST be non-critical.
-
-   id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::=  { id-ce 9 }
-
-   SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF Attribute
-
-4.2.1.10  Basic Constraints
-
-   The basic constraints extension identifies whether the subject of the
-   certificate is a CA and the maximum depth of valid certification
-   paths that include this certificate.
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 36]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   The cA boolean indicates whether the certified public key belongs to
-   a CA.  If the cA boolean is not asserted, then the keyCertSign bit in
-   the key usage extension MUST NOT be asserted.
-
-   The pathLenConstraint field is meaningful only if the cA boolean is
-   asserted and the key usage extension asserts the keyCertSign bit
-   (section 4.2.1.3).  In this case, it gives the maximum number of non-
-   self-issued intermediate certificates that may follow this
-   certificate in a valid certification path.  A certificate is self-
-   issued if the DNs that appear in the subject and issuer fields are
-   identical and are not empty.  (Note: The last certificate in the
-   certification path is not an intermediate certificate, and is not
-   included in this limit.  Usually, the last certificate is an end
-   entity certificate, but it can be a CA certificate.)  A
-   pathLenConstraint of zero indicates that only one more certificate
-   may follow in a valid certification path.  Where it appears, the
-   pathLenConstraint field MUST be greater than or equal to zero.  Where
-   pathLenConstraint does not appear, no limit is imposed.
-
-   This extension MUST appear as a critical extension in all CA
-   certificates that contain public keys used to validate digital
-   signatures on certificates.  This extension MAY appear as a critical
-   or non-critical extension in CA certificates that contain public keys
-   used exclusively for purposes other than validating digital
-   signatures on certificates.  Such CA certificates include ones that
-   contain public keys used exclusively for validating digital
-   signatures on CRLs and ones that contain key management public keys
-   used with certificate enrollment protocols.  This extension MAY
-   appear as a critical or non-critical extension in end entity
-   certificates.
-
-   CAs MUST NOT include the pathLenConstraint field unless the cA
-   boolean is asserted and the key usage extension asserts the
-   keyCertSign bit.
-
-   id-ce-basicConstraints OBJECT IDENTIFIER ::=  { id-ce 19 }
-
-   BasicConstraints ::= SEQUENCE {
-        cA                      BOOLEAN DEFAULT FALSE,
-        pathLenConstraint       INTEGER (0..MAX) OPTIONAL }
-
-4.2.1.11  Name Constraints
-
-   The name constraints extension, which MUST be used only in a CA
-   certificate, indicates a name space within which all subject names in
-   subsequent certificates in a certification path MUST be located.
-   Restrictions apply to the subject distinguished name and apply to
-   subject alternative names.  Restrictions apply only when the
-
-
-
-Housley, et. al.            Standards Track                    [Page 37]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   specified name form is present.  If no name of the type is in the
-   certificate, the certificate is acceptable.
-
-   Name constraints are not applied to certificates whose issuer and
-   subject are identical (unless the certificate is the final
-   certificate in the path).  (This could prevent CAs that use name
-   constraints from employing self-issued certificates to implement key
-   rollover.)
-
-   Restrictions are defined in terms of permitted or excluded name
-   subtrees.  Any name matching a restriction in the excludedSubtrees
-   field is invalid regardless of information appearing in the
-   permittedSubtrees.  This extension MUST be critical.
-
-   Within this profile, the minimum and maximum fields are not used with
-   any name forms, thus minimum MUST be zero, and maximum MUST be
-   absent.
-
-   For URIs, the constraint applies to the host part of the name.  The
-   constraint MAY specify a host or a domain.  Examples would be
-   "foo.bar.com";  and ".xyz.com".  When the the constraint begins with
-   a period, it MAY be expanded with one or more subdomains.  That is,
-   the constraint ".xyz.com" is satisfied by both abc.xyz.com and
-   abc.def.xyz.com.  However, the constraint ".xyz.com" is not satisfied
-   by "xyz.com".  When the constraint does not begin with a period, it
-   specifies a host.
-
-   A name constraint for Internet mail addresses MAY specify a
-   particular mailbox, all addresses at a particular host, or all
-   mailboxes in a domain.  To indicate a particular mailbox, the
-   constraint is the complete mail address.  For example, "root@xyz.com"
-   indicates the root mailbox on the host "xyz.com".  To indicate all
-   Internet mail addresses on a particular host, the constraint is
-   specified as the host name.  For example, the constraint "xyz.com" is
-   satisfied by any mail address at the host "xyz.com".  To specify any
-   address within a domain, the constraint is specified with a leading
-   period (as with URIs).  For example, ".xyz.com" indicates all the
-   Internet mail addresses in the domain "xyz.com", but not Internet
-   mail addresses on the host "xyz.com".
-
-   DNS name restrictions are expressed as foo.bar.com.  Any DNS name
-   that can be constructed by simply adding to the left hand side of the
-   name satisfies the name constraint.  For example, www.foo.bar.com
-   would satisfy the constraint but foo1.bar.com would not.
-
-   Legacy implementations exist where an RFC 822 name is embedded in the
-   subject distinguished name in an attribute of type EmailAddress
-   (section 4.1.2.6).  When rfc822 names are constrained, but the
-
-
-
-Housley, et. al.            Standards Track                    [Page 38]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   certificate does not include a subject alternative name, the rfc822
-   name constraint MUST be applied to the attribute of type EmailAddress
-   in the subject distinguished name.  The ASN.1 syntax for EmailAddress
-   and the corresponding OID are supplied in Appendix A.
-
-   Restrictions of the form directoryName MUST be applied to the subject
-   field in the certificate and to the subjectAltName extensions of type
-   directoryName.  Restrictions of the form x400Address MUST be applied
-   to subjectAltName extensions of type x400Address.
-
-   When applying restrictions of the form directoryName, an
-   implementation MUST compare DN attributes.  At a minimum,
-   implementations MUST perform the DN comparison rules specified in
-   Section 4.1.2.4.  CAs issuing certificates with a restriction of the
-   form directoryName SHOULD NOT rely on implementation of the full ISO
-   DN name comparison algorithm.  This implies name restrictions MUST be
-   stated identically to the encoding used in the subject field or
-   subjectAltName extension.
-
-   The syntax of iPAddress MUST be as described in section 4.2.1.7 with
-   the following additions specifically for Name Constraints.  For IPv4
-   addresses, the ipAddress field of generalName MUST contain eight (8)
-   octets, encoded in the style of RFC 1519 (CIDR) to represent an
-   address range [RFC 1519].  For IPv6 addresses, the ipAddress field
-   MUST contain 32 octets similarly encoded.  For example, a name
-   constraint for "class C" subnet 10.9.8.0 is represented as the octets
-   0A 09 08 00 FF FF FF 00, representing the CIDR notation
-   10.9.8.0/255.255.255.0.
-
-   The syntax and semantics for name constraints for otherName,
-   ediPartyName, and registeredID are not defined by this specification.
-
-      id-ce-nameConstraints OBJECT IDENTIFIER ::=  { id-ce 30 }
-
-      NameConstraints ::= SEQUENCE {
-           permittedSubtrees       [0]     GeneralSubtrees OPTIONAL,
-           excludedSubtrees        [1]     GeneralSubtrees OPTIONAL }
-
-      GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
-
-      GeneralSubtree ::= SEQUENCE {
-           base                    GeneralName,
-           minimum         [0]     BaseDistance DEFAULT 0,
-           maximum         [1]     BaseDistance OPTIONAL }
-
-      BaseDistance ::= INTEGER (0..MAX)
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 39]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-4.2.1.12  Policy Constraints
-
-   The policy constraints extension can be used in certificates issued
-   to CAs.  The policy constraints extension constrains path validation
-   in two ways.  It can be used to prohibit policy mapping or require
-   that each certificate in a path contain an acceptable policy
-   identifier.
-
-   If the inhibitPolicyMapping field is present, the value indicates the
-   number of additional certificates that may appear in the path before
-   policy mapping is no longer permitted.  For example, a value of one
-   indicates that policy mapping may be processed in certificates issued
-   by the subject of this certificate, but not in additional
-   certificates in the path.
-
-   If the requireExplicitPolicy field is present, the value of
-   requireExplicitPolicy indicates the number of additional certificates
-   that may appear in the path before an explicit policy is required for
-   the entire path.  When an explicit policy is required, it is
-   necessary for all certificates in the path to contain an acceptable
-   policy identifier in the certificate policies extension.  An
-   acceptable policy identifier is the identifier of a policy required
-   by the user of the certification path or the identifier of a policy
-   which has been declared equivalent through policy mapping.
-
-   Conforming CAs MUST NOT issue certificates where policy constraints
-   is a empty sequence.  That is, at least one of the
-   inhibitPolicyMapping field or the requireExplicitPolicy field MUST be
-   present.  The behavior of clients that encounter a empty policy
-   constraints field is not addressed in this profile.
-
-   This extension MAY be critical or non-critical.
-
-   id-ce-policyConstraints OBJECT IDENTIFIER ::=  { id-ce 36 }
-
-   PolicyConstraints ::= SEQUENCE {
-        requireExplicitPolicy           [0] SkipCerts OPTIONAL,
-        inhibitPolicyMapping            [1] SkipCerts OPTIONAL }
-
-   SkipCerts ::= INTEGER (0..MAX)
-
-4.2.1.13  Extended Key Usage
-
-   This extension indicates one or more purposes for which the certified
-   public key may be used, in addition to or in place of the basic
-   purposes indicated in the key usage extension.  In general, this
-   extension will appear only in end entity certificates.  This
-   extension is defined as follows:
-
-
-
-Housley, et. al.            Standards Track                    [Page 40]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   id-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-ce 37 }
-
-   ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
-
-   KeyPurposeId ::= OBJECT IDENTIFIER
-
-   Key purposes may be defined by any organization with a need.  Object
-   identifiers used to identify key purposes MUST be assigned in
-   accordance with IANA or ITU-T Recommendation X.660 [X.660].
-
-   This extension MAY, at the option of the certificate issuer, be
-   either critical or non-critical.
-
-   If the extension is present, then the certificate MUST only be used
-   for one of the purposes indicated.  If multiple purposes are
-   indicated the application need not recognize all purposes indicated,
-   as long as the intended purpose is present.  Certificate using
-   applications MAY require that a particular purpose be indicated in
-   order for the certificate to be acceptable to that application.
-
-   If a CA includes extended key usages to satisfy such applications,
-   but does not wish to restrict usages of the key, the CA can include
-   the special keyPurposeID anyExtendedKeyUsage.  If the
-   anyExtendedKeyUsage keyPurposeID is present, the extension SHOULD NOT
-   be critical.
-
-   If a certificate contains both a key usage extension and an extended
-   key usage extension, then both extensions MUST be processed
-   independently and the certificate MUST only be used for a purpose
-   consistent with both extensions.  If there is no purpose consistent
-   with both extensions, then the certificate MUST NOT be used for any
-   purpose.
-
-   The following key usage purposes are defined:
-
-   anyExtendedKeyUsage OBJECT IDENTIFIER ::= { id-ce-extKeyUsage 0 }
-
-   id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
-
-   id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
-   -- TLS WWW server authentication
-   -- Key usage bits that may be consistent: digitalSignature,
-   -- keyEncipherment or keyAgreement
-
-   id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
-   -- TLS WWW client authentication
-   -- Key usage bits that may be consistent: digitalSignature
-   -- and/or keyAgreement
-
-
-
-Housley, et. al.            Standards Track                    [Page 41]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   id-kp-codeSigning             OBJECT IDENTIFIER ::= { id-kp 3 }
-   -- Signing of downloadable executable code
-   -- Key usage bits that may be consistent: digitalSignature
-
-   id-kp-emailProtection         OBJECT IDENTIFIER ::= { id-kp 4 }
-   -- E-mail protection
-   -- Key usage bits that may be consistent: digitalSignature,
-   -- nonRepudiation, and/or (keyEncipherment or keyAgreement)
-
-   id-kp-timeStamping            OBJECT IDENTIFIER ::= { id-kp 8 }
-   -- Binding the hash of an object to a time
-   -- Key usage bits that may be consistent: digitalSignature
-   -- and/or nonRepudiation
-
-   id-kp-OCSPSigning            OBJECT IDENTIFIER ::= { id-kp 9 }
-   -- Signing OCSP responses
-   -- Key usage bits that may be consistent: digitalSignature
-   -- and/or nonRepudiation
-
-4.2.1.14  CRL Distribution Points
-
-   The CRL distribution points extension identifies how CRL information
-   is obtained.  The extension SHOULD be non-critical, but this profile
-   RECOMMENDS support for this extension by CAs and applications.
-   Further discussion of CRL management is contained in section 5.
-
-   The cRLDistributionPoints extension is a SEQUENCE of
-   DistributionPoint.  A DistributionPoint consists of three fields,
-   each of which is optional: distributionPoint, reasons, and cRLIssuer.
-   While each of these fields is optional, a DistributionPoint MUST NOT
-   consist of only the reasons field; either distributionPoint or
-   cRLIssuer MUST be present.  If the certificate issuer is not the CRL
-   issuer, then the cRLIssuer field MUST be present and contain the Name
-   of the CRL issuer.  If the certificate issuer is also the CRL issuer,
-   then the cRLIssuer field MUST be omitted and the distributionPoint
-   field MUST be present.  If the distributionPoint field is omitted,
-   cRLIssuer MUST be present and include a Name corresponding to an
-   X.500 or LDAP directory entry where the CRL is located.
-
-   When the distributionPoint field is present, it contains either a
-   SEQUENCE of general names or a single value, nameRelativeToCRLIssuer.
-   If the cRLDistributionPoints extension contains a general name of
-   type URI, the following semantics MUST be assumed: the URI is a
-   pointer to the current CRL for the associated reasons and will be
-   issued by the associated cRLIssuer.  The expected values for the URI
-   are those defined in 4.2.1.7.  Processing rules for other values are
-   not defined by this specification.
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 42]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   If the DistributionPointName contains multiple values, each name
-   describes a different mechanism to obtain the same CRL.  For example,
-   the same CRL could be available for retrieval through both LDAP and
-   HTTP.
-
-   If the DistributionPointName contains the single value
-   nameRelativeToCRLIssuer, the value provides a distinguished name
-   fragment.  The fragment is appended to the X.500 distinguished name
-   of the CRL issuer to obtain the distribution point name.  If the
-   cRLIssuer field in the DistributionPoint is present, then the name
-   fragment is appended to the distinguished name that it contains;
-   otherwise, the name fragment is appended to the certificate issuer
-   distinguished name.  The DistributionPointName MUST NOT use the
-   nameRealtiveToCRLIssuer alternative when cRLIssuer contains more than
-   one distinguished name.
-
-   If the DistributionPoint omits the reasons field, the CRL MUST
-   include revocation information for all reasons.
-
-   The cRLIssuer identifies the entity who signs and issues the CRL.  If
-   present, the cRLIssuer MUST contain at least one an X.500
-   distinguished name (DN), and MAY also contain other name forms.
-   Since the cRLIssuer is compared to the CRL issuer name, the X.501
-   type Name MUST follow the encoding rules for the issuer name field in
-   the certificate (section 4.1.2.4).
-
-   id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::=  { id-ce 31 }
-
-   CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
-
-   DistributionPoint ::= SEQUENCE {
-        distributionPoint       [0]     DistributionPointName OPTIONAL,
-        reasons                 [1]     ReasonFlags OPTIONAL,
-        cRLIssuer               [2]     GeneralNames OPTIONAL }
-
-   DistributionPointName ::= CHOICE {
-        fullName                [0]     GeneralNames,
-        nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }
-
-
-
-
-
-
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 43]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   ReasonFlags ::= BIT STRING {
-        unused                  (0),
-        keyCompromise           (1),
-        cACompromise            (2),
-        affiliationChanged      (3),
-        superseded              (4),
-        cessationOfOperation    (5),
-        certificateHold         (6),
-        privilegeWithdrawn      (7),
-        aACompromise            (8) }
-
-4.2.1.15  Inhibit Any-Policy
-
-   The inhibit any-policy extension can be used in certificates issued
-   to CAs.  The inhibit any-policy indicates that the special anyPolicy
-   OID, with the value { 2 5 29 32 0 }, is not considered an explicit
-   match for other certificate policies.  The value indicates the number
-   of additional certificates that may appear in the path before
-   anyPolicy is no longer permitted.  For example, a value of one
-   indicates that anyPolicy may be processed in certificates issued by
-   the subject of this certificate, but not in additional certificates
-   in the path.
-
-   This extension MUST be critical.
-
-   id-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::=  { id-ce 54 }
-
-   InhibitAnyPolicy ::= SkipCerts
-
-   SkipCerts ::= INTEGER (0..MAX)
-
-4.2.1.16  Freshest CRL (a.k.a. Delta CRL Distribution Point)
-
-   The freshest CRL extension identifies how delta CRL information is
-   obtained.  The extension MUST be non-critical.  Further discussion of
-   CRL management is contained in section 5.
-
-   The same syntax is used for this extension and the
-   cRLDistributionPoints extension, and is described in section
-   4.2.1.14.  The same conventions apply to both extensions.
-
-   id-ce-freshestCRL OBJECT IDENTIFIER ::=  { id-ce 46 }
-
-   FreshestCRL ::= CRLDistributionPoints
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 44]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-4.2.2  Private Internet Extensions
-
-   This section defines two extensions for use in the Internet Public
-   Key Infrastructure.  These extensions may be used to direct
-   applications to on-line information about the issuing CA or the
-   subject.  As the information may be available in multiple forms, each
-   extension is a sequence of IA5String values, each of which represents
-   a URI.  The URI implicitly specifies the location and format of the
-   information and the method for obtaining the information.
-
-   An object identifier is defined for the private extension.  The
-   object identifier associated with the private extension is defined
-   under the arc id-pe within the arc id-pkix.  Any future extensions
-   defined for the Internet PKI are also expected to be defined under
-   the arc id-pe.
-
-      id-pkix  OBJECT IDENTIFIER  ::=
-               { iso(1) identified-organization(3) dod(6) internet(1)
-                       security(5) mechanisms(5) pkix(7) }
-
-      id-pe  OBJECT IDENTIFIER  ::=  { id-pkix 1 }
-
-4.2.2.1  Authority Information Access
-
-   The authority information access extension indicates how to access CA
-   information and services for the issuer of the certificate in which
-   the extension appears.  Information and services may include on-line
-   validation services and CA policy data.  (The location of CRLs is not
-   specified in this extension; that information is provided by the
-   cRLDistributionPoints extension.)  This extension may be included in
-   end entity or CA certificates, and it MUST be non-critical.
-
-   id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
-
-   AuthorityInfoAccessSyntax  ::=
-           SEQUENCE SIZE (1..MAX) OF AccessDescription
-
-   AccessDescription  ::=  SEQUENCE {
-           accessMethod          OBJECT IDENTIFIER,
-           accessLocation        GeneralName  }
-
-   id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
-
-   id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
-
-   id-ad-ocsp OBJECT IDENTIFIER ::= { id-ad 1 }
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 45]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   Each entry in the sequence AuthorityInfoAccessSyntax describes the
-   format and location of additional information provided by the CA that
-   issued the certificate in which this extension appears.  The type and
-   format of the information is specified by the accessMethod field; the
-   accessLocation field specifies the location of the information.  The
-   retrieval mechanism may be implied by the accessMethod or specified
-   by accessLocation.
-
-   This profile defines two accessMethod OIDs: id-ad-caIssuers and
-   id-ad-ocsp.
-
-   The id-ad-caIssuers OID is used when the additional information lists
-   CAs that have issued certificates superior to the CA that issued the
-   certificate containing this extension.  The referenced CA issuers
-   description is intended to aid certificate users in the selection of
-   a certification path that terminates at a point trusted by the
-   certificate user.
-
-   When id-ad-caIssuers appears as accessMethod, the accessLocation
-   field describes the referenced description server and the access
-   protocol to obtain the referenced description.  The accessLocation
-   field is defined as a GeneralName, which can take several forms.
-   Where the information is available via http, ftp, or ldap,
-   accessLocation MUST be a uniformResourceIdentifier.  Where the
-   information is available via the Directory Access Protocol (DAP),
-   accessLocation MUST be a directoryName.  The entry for that
-   directoryName contains CA certificates in the crossCertificatePair
-   attribute.  When the information is available via electronic mail,
-   accessLocation MUST be an rfc822Name.  The semantics of other
-   id-ad-caIssuers accessLocation name forms are not defined.
-
-   The id-ad-ocsp OID is used when revocation information for the
-   certificate containing this extension is available using the Online
-   Certificate Status Protocol (OCSP) [RFC 2560].
-
-   When id-ad-ocsp appears as accessMethod, the accessLocation field is
-   the location of the OCSP responder, using the conventions defined in
-   [RFC 2560].
-
-   Additional access descriptors may be defined in other PKIX
-   specifications.
-
-4.2.2.2  Subject Information Access
-
-   The subject information access extension indicates how to access
-   information and services for the subject of the certificate in which
-   the extension appears.  When the subject is a CA, information and
-   services may include certificate validation services and CA policy
-
-
-
-Housley, et. al.            Standards Track                    [Page 46]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   data.  When the subject is an end entity, the information describes
-   the type of services offered and how to access them.  In this case,
-   the contents of this extension are defined in the protocol
-   specifications for the suported services.  This extension may be
-   included in subject or CA certificates, and it MUST be non-critical.
-
-   id-pe-subjectInfoAccess OBJECT IDENTIFIER ::= { id-pe 11 }
-
-   SubjectInfoAccessSyntax  ::=
-           SEQUENCE SIZE (1..MAX) OF AccessDescription
-
-   AccessDescription  ::=  SEQUENCE {
-           accessMethod          OBJECT IDENTIFIER,
-           accessLocation        GeneralName  }
-
-   Each entry in the sequence SubjectInfoAccessSyntax describes the
-   format and location of additional information provided by the subject
-   of the certificate in which this extension appears.  The type and
-   format of the information is specified by the accessMethod field; the
-   accessLocation field specifies the location of the information.  The
-   retrieval mechanism may be implied by the accessMethod or specified
-   by accessLocation.
-
-   This profile defines one access method to be used when the subject is
-   a CA, and one access method to be used when the subject is an end
-   entity.  Additional access methods may be defined in the future in
-   the protocol specifications for other services.
-
-   The id-ad-caRepository OID is used when the subject is a CA, and
-   publishes its certificates and CRLs (if issued) in a repository.  The
-   accessLocation field is defined as a GeneralName, which can take
-   several forms.  Where the information is available via http, ftp, or
-   ldap, accessLocation MUST be a uniformResourceIdentifier.  Where the
-   information is available via the directory access protocol (dap),
-   accessLocation MUST be a directoryName.  When the information is
-   available via electronic mail, accessLocation MUST be an rfc822Name.
-   The semantics of other name forms of of accessLocation (when
-   accessMethod is id-ad-caRepository) are not defined by this
-   specification.
-
-   The id-ad-timeStamping OID is used when the subject offers
-   timestamping services using the Time Stamp Protocol defined in
-   [PKIXTSA].  Where the timestamping services are available via http or
-   ftp, accessLocation MUST be a uniformResourceIdentifier.  Where the
-   timestamping services are available via electronic mail,
-   accessLocation MUST be an rfc822Name.  Where timestamping services
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 47]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   are available using TCP/IP, the dNSName or ipAddress name forms may
-   be used.  The semantics of other name forms of accessLocation (when
-   accessMethod is id-ad-timeStamping) are not defined by this
-   specification.
-
-   Additional access descriptors may be defined in other PKIX
-   specifications.
-
-   id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
-
-   id-ad-caRepository OBJECT IDENTIFIER ::= { id-ad 5 }
-
-   id-ad-timeStamping OBJECT IDENTIFIER ::= { id-ad 3 }
-
-5  CRL and CRL Extensions Profile
-
-   As discussed above, one goal of this X.509 v2 CRL profile is to
-   foster the creation of an interoperable and reusable Internet PKI.
-   To achieve this goal, guidelines for the use of extensions are
-   specified, and some assumptions are made about the nature of
-   information included in the CRL.
-
-   CRLs may be used in a wide range of applications and environments
-   covering a broad spectrum of interoperability goals and an even
-   broader spectrum of operational and assurance requirements.  This
-   profile establishes a common baseline for generic applications
-   requiring broad interoperability.  The profile defines a set of
-   information that can be expected in every CRL.  Also, the profile
-   defines common locations within the CRL for frequently used
-   attributes as well as common representations for these attributes.
-
-   CRL issuers issue CRLs.  In general, the CRL issuer is the CA.  CAs
-   publish CRLs to provide status information about the certificates
-   they issued.  However, a CA may delegate this responsibility to
-   another trusted authority.  Whenever the CRL issuer is not the CA
-   that issued the certificates, the CRL is referred to as an indirect
-   CRL.
-
-   Each CRL has a particular scope.  The CRL scope is the set of
-   certificates that could appear on a given CRL.  For example, the
-   scope could be "all certificates issued by CA X", "all CA
-   certificates issued by CA X", "all certificates issued by CA X that
-   have been revoked for reasons of key compromise and CA compromise",
-   or could be a set of certificates based on arbitrary local
-   information, such as "all certificates issued to the NIST employees
-   located in Boulder".
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 48]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   A complete CRL lists all unexpired certificates, within its scope,
-   that have been revoked for one of the revocation reasons covered by
-   the CRL scope.  The CRL issuer MAY also generate delta CRLs.  A delta
-   CRL only lists those certificates, within its scope, whose revocation
-   status has changed since the issuance of a referenced complete CRL.
-   The referenced complete CRL is referred to as a base CRL.  The scope
-   of a delta CRL MUST be the same as the base CRL that it references.
-
-   This profile does not define any private Internet CRL extensions or
-   CRL entry extensions.
-
-   Environments with additional or special purpose requirements may
-   build on this profile or may replace it.
-
-   Conforming CAs are not required to issue CRLs if other revocation or
-   certificate status mechanisms are provided.  When CRLs are issued,
-   the CRLs MUST be version 2 CRLs, include the date by which the next
-   CRL will be issued in the nextUpdate field (section 5.1.2.5), include
-   the CRL number extension (section 5.2.3), and include the authority
-   key identifier extension (section 5.2.1).  Conforming applications
-   that support CRLs are REQUIRED to process both version 1 and version
-   2 complete CRLs that provide revocation information for all
-   certificates issued by one CA.  Conforming applications are NOT
-   REQUIRED to support processing of delta CRLs, indirect CRLs, or CRLs
-   with a scope other than all certificates issued by one CA.
-
-5.1  CRL Fields
-
-   The X.509 v2 CRL syntax is as follows.  For signature calculation,
-   the data that is to be signed is ASN.1 DER encoded.  ASN.1 DER
-   encoding is a tag, length, value encoding system for each element.
-
-   CertificateList  ::=  SEQUENCE  {
-        tbsCertList          TBSCertList,
-        signatureAlgorithm   AlgorithmIdentifier,
-        signatureValue       BIT STRING  }
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 49]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   TBSCertList  ::=  SEQUENCE  {
-        version                 Version OPTIONAL,
-                                     -- if present, MUST be v2
-        signature               AlgorithmIdentifier,
-        issuer                  Name,
-        thisUpdate              Time,
-        nextUpdate              Time OPTIONAL,
-        revokedCertificates     SEQUENCE OF SEQUENCE  {
-             userCertificate         CertificateSerialNumber,
-             revocationDate          Time,
-             crlEntryExtensions      Extensions OPTIONAL
-                                           -- if present, MUST be v2
-                                  }  OPTIONAL,
-        crlExtensions           [0]  EXPLICIT Extensions OPTIONAL
-                                           -- if present, MUST be v2
-                                  }
-
-   -- Version, Time, CertificateSerialNumber, and Extensions
-   -- are all defined in the ASN.1 in section 4.1
-
-   -- AlgorithmIdentifier is defined in section 4.1.1.2
-
-   The following items describe the use of the X.509 v2 CRL in the
-   Internet PKI.
-
-5.1.1  CertificateList Fields
-
-   The CertificateList is a SEQUENCE of three required fields.  The
-   fields are described in detail in the following subsections.
-
-5.1.1.1  tbsCertList
-
-   The first field in the sequence is the tbsCertList.  This field is
-   itself a sequence containing the name of the issuer, issue date,
-   issue date of the next list, the optional list of revoked
-   certificates, and optional CRL extensions.  When there are no revoked
-   certificates, the revoked certificates list is absent.  When one or
-   more certificates are revoked, each entry on the revoked certificate
-   list is defined by a sequence of user certificate serial number,
-   revocation date, and optional CRL entry extensions.
-
-5.1.1.2  signatureAlgorithm
-
-   The signatureAlgorithm field contains the algorithm identifier for
-   the algorithm used by the CRL issuer to sign the CertificateList.
-   The field is of type AlgorithmIdentifier, which is defined in section
-   4.1.1.2.  [PKIXALGS] lists the supported algorithms for this
-   specification, but other signature algorithms MAY also be supported.
-
-
-
-Housley, et. al.            Standards Track                    [Page 50]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   This field MUST contain the same algorithm identifier as the
-   signature field in the sequence tbsCertList (section 5.1.2.2).
-
-5.1.1.3  signatureValue
-
-   The signatureValue field contains a digital signature computed upon
-   the ASN.1 DER encoded tbsCertList.  The ASN.1 DER encoded tbsCertList
-   is used as the input to the signature function.  This signature value
-   is encoded as a BIT STRING and included in the CRL signatureValue
-   field.  The details of this process are specified for each of the
-   supported algorithms in [PKIXALGS].
-
-   CAs that are also CRL issuers MAY use one private key to digitally
-   sign certificates and CRLs, or MAY use separate private keys to
-   digitally sign certificates and CRLs.  When separate private keys are
-   employed, each of the public keys associated with these private keys
-   is placed in a separate certificate, one with the keyCertSign bit set
-   in the key usage extension, and one with the cRLSign bit set in the
-   key usage extension (section 4.2.1.3).  When separate private keys
-   are employed, certificates issued by the CA contain one authority key
-   identifier, and the corresponding CRLs contain a different authority
-   key identifier.  The use of separate CA certificates for validation
-   of certificate signatures and CRL signatures can offer improved
-   security characteristics; however, it imposes a burden on
-   applications, and it might limit interoperability.  Many applications
-   construct a certification path, and then validate the certification
-   path (section 6).  CRL checking in turn requires a separate
-   certification path to be constructed and validated for the CA's CRL
-   signature validation certificate.  Applications that perform CRL
-   checking MUST support certification path validation when certificates
-   and CRLs are digitally signed with the same CA private key.  These
-   applications SHOULD support certification path validation when
-   certificates and CRLs are digitally signed with different CA private
-   keys.
-
-5.1.2  Certificate List "To Be Signed"
-
-   The certificate list to be signed, or TBSCertList, is a sequence of
-   required and optional fields.  The required fields identify the CRL
-   issuer, the algorithm used to sign the CRL, the date and time the CRL
-   was issued, and the date and time by which the CRL issuer will issue
-   the next CRL.
-
-   Optional fields include lists of revoked certificates and CRL
-   extensions.  The revoked certificate list is optional to support the
-   case where a CA has not revoked any unexpired certificates that it
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 51]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   has issued.  The profile requires conforming CRL issuers to use the
-   CRL number and authority key identifier CRL extensions in all CRLs
-   issued.
-
-5.1.2.1  Version
-
-   This optional field describes the version of the encoded CRL.  When
-   extensions are used, as required by this profile, this field MUST be
-   present and MUST specify version 2 (the integer value is 1).
-
-5.1.2.2  Signature
-
-   This field contains the algorithm identifier for the algorithm used
-   to sign the CRL.  [PKIXALGS] lists OIDs for the most popular
-   signature algorithms used in the Internet PKI.
-
-   This field MUST contain the same algorithm identifier as the
-   signatureAlgorithm field in the sequence CertificateList (section
-   5.1.1.2).
-
-5.1.2.3  Issuer Name
-
-   The issuer name identifies the entity who has signed and issued the
-   CRL.  The issuer identity is carried in the issuer name field.
-   Alternative name forms may also appear in the issuerAltName extension
-   (section 5.2.2).  The issuer name field MUST contain an X.500
-   distinguished name (DN).  The issuer name field is defined as the
-   X.501 type Name, and MUST follow the encoding rules for the issuer
-   name field in the certificate (section 4.1.2.4).
-
-5.1.2.4  This Update
-
-   This field indicates the issue date of this CRL.  ThisUpdate may be
-   encoded as UTCTime or GeneralizedTime.
-
-   CRL issuers conforming to this profile MUST encode thisUpdate as
-   UTCTime for dates through the year 2049.  CRL issuers conforming to
-   this profile MUST encode thisUpdate as GeneralizedTime for dates in
-   the year 2050 or later.
-
-   Where encoded as UTCTime, thisUpdate MUST be specified and
-   interpreted as defined in section 4.1.2.5.1.  Where encoded as
-   GeneralizedTime, thisUpdate MUST be specified and interpreted as
-   defined in section 4.1.2.5.2.
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 52]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-5.1.2.5  Next Update
-
-   This field indicates the date by which the next CRL will be issued.
-   The next CRL could be issued before the indicated date, but it will
-   not be issued any later than the indicated date.  CRL issuers SHOULD
-   issue CRLs with a nextUpdate time equal to or later than all previous
-   CRLs.  nextUpdate may be encoded as UTCTime or GeneralizedTime.
-
-   This profile requires inclusion of nextUpdate in all CRLs issued by
-   conforming CRL issuers.  Note that the ASN.1 syntax of TBSCertList
-   describes this field as OPTIONAL, which is consistent with the ASN.1
-   structure defined in [X.509].  The behavior of clients processing
-   CRLs which omit nextUpdate is not specified by this profile.
-
-   CRL issuers conforming to this profile MUST encode nextUpdate as
-   UTCTime for dates through the year 2049.  CRL issuers conforming to
-   this profile MUST encode nextUpdate as GeneralizedTime for dates in
-   the year 2050 or later.
-
-   Where encoded as UTCTime, nextUpdate MUST be specified and
-   interpreted as defined in section 4.1.2.5.1.  Where encoded as
-   GeneralizedTime, nextUpdate MUST be specified and interpreted as
-   defined in section 4.1.2.5.2.
-
-5.1.2.6  Revoked Certificates
-
-   When there are no revoked certificates, the revoked certificates list
-   MUST be absent.  Otherwise, revoked certificates are listed by their
-   serial numbers.  Certificates revoked by the CA are uniquely
-   identified by the certificate serial number.  The date on which the
-   revocation occurred is specified.  The time for revocationDate MUST
-   be expressed as described in section 5.1.2.4. Additional information
-   may be supplied in CRL entry extensions; CRL entry extensions are
-   discussed in section 5.3.
-
-5.1.2.7  Extensions
-
-   This field may only appear if the version is 2 (section 5.1.2.1).  If
-   present, this field is a sequence of one or more CRL extensions.  CRL
-   extensions are discussed in section 5.2.
-
-5.2  CRL Extensions
-
-   The extensions defined by ANSI X9, ISO/IEC, and ITU-T for X.509 v2
-   CRLs [X.509] [X9.55] provide methods for associating additional
-   attributes with CRLs.  The X.509 v2 CRL format also allows
-   communities to define private extensions to carry information unique
-   to those communities.  Each extension in a CRL may be designated as
-
-
-
-Housley, et. al.            Standards Track                    [Page 53]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   critical or non-critical.  A CRL validation MUST fail if it
-   encounters a critical extension which it does not know how to
-   process.  However, an unrecognized non-critical extension may be
-   ignored.  The following subsections present those extensions used
-   within Internet CRLs.  Communities may elect to include extensions in
-   CRLs which are not defined in this specification.  However, caution
-   should be exercised in adopting any critical extensions in CRLs which
-   might be used in a general context.
-
-   Conforming CRL issuers are REQUIRED to include the authority key
-   identifier (section 5.2.1) and the CRL number (section 5.2.3)
-   extensions in all CRLs issued.
-
-5.2.1  Authority Key Identifier
-
-   The authority key identifier extension provides a means of
-   identifying the public key corresponding to the private key used to
-   sign a CRL.  The identification can be based on either the key
-   identifier (the subject key identifier in the CRL signer's
-   certificate) or on the issuer name and serial number.  This extension
-   is especially useful where an issuer has more than one signing key,
-   either due to multiple concurrent key pairs or due to changeover.
-
-   Conforming CRL issuers MUST use the key identifier method, and MUST
-   include this extension in all CRLs issued.
-
-   The syntax for this CRL extension is defined in section 4.2.1.1.
-
-5.2.2  Issuer Alternative Name
-
-   The issuer alternative names extension allows additional identities
-   to be associated with the issuer of the CRL.  Defined options include
-   an rfc822 name (electronic mail address), a DNS name, an IP address,
-   and a URI.  Multiple instances of a name and multiple name forms may
-   be included.  Whenever such identities are used, the issuer
-   alternative name extension MUST be used; however, a DNS name MAY be
-   represented in the issuer field using the domainComponent attribute
-   as described in section 4.1.2.4.
-
-   The issuerAltName extension SHOULD NOT be marked critical.
-
-   The OID and syntax for this CRL extension are defined in section
-   4.2.1.8.
-
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 54]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-5.2.3  CRL Number
-
-   The CRL number is a non-critical CRL extension which conveys a
-   monotonically increasing sequence number for a given CRL scope and
-   CRL issuer.  This extension allows users to easily determine when a
-   particular CRL supersedes another CRL.  CRL numbers also support the
-   identification of complementary complete CRLs and delta CRLs.  CRL
-   issuers conforming to this profile MUST include this extension in all
-   CRLs.
-
-   If a CRL issuer generates delta CRLs in addition to complete CRLs for
-   a given scope, the complete CRLs and delta CRLs MUST share one
-   numbering sequence.  If a delta CRL and a complete CRL that cover the
-   same scope are issued at the same time, they MUST have the same CRL
-   number and provide the same revocation information.  That is, the
-   combination of the delta CRL and an acceptable complete CRL MUST
-   provide the same revocation information as the simultaneously issued
-   complete CRL.
-
-   If a CRL issuer generates two CRLs (two complete CRLs, two delta
-   CRLs, or a complete CRL and a delta CRL) for the same scope at
-   different times, the two CRLs MUST NOT have the same CRL number.
-   That is, if the this update field (section 5.1.2.4) in the two CRLs
-   are not identical, the CRL numbers MUST be different.
-
-   Given the requirements above, CRL numbers can be expected to contain
-   long integers.  CRL verifiers MUST be able to handle CRLNumber values
-   up to 20 octets.  Conformant CRL issuers MUST NOT use CRLNumber
-   values longer than 20 octets.
-
-   id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
-
-   CRLNumber ::= INTEGER (0..MAX)
-
-5.2.4  Delta CRL Indicator
-
-   The delta CRL indicator is a critical CRL extension that identifies a
-   CRL as being a delta CRL.  Delta CRLs contain updates to revocation
-   information previously distributed, rather than all the information
-   that would appear in a complete CRL.  The use of delta CRLs can
-   significantly reduce network load and processing time in some
-   environments.  Delta CRLs are generally smaller than the CRLs they
-   update, so applications that obtain delta CRLs consume less network
-   bandwidth than applications that obtain the corresponding complete
-   CRLs.  Applications which store revocation information in a format
-   other than the CRL structure can add new revocation information to
-   the local database without reprocessing information.
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 55]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   The delta CRL indicator extension contains the single value of type
-   BaseCRLNumber.  The CRL number identifies the CRL, complete for a
-   given scope, that was used as the starting point in the generation of
-   this delta CRL.  A conforming CRL issuer MUST publish the referenced
-   base CRL as a complete CRL.  The delta CRL contains all updates to
-   the revocation status for that same scope.  The combination of a
-   delta CRL plus the referenced base CRL is equivalent to a complete
-   CRL, for the applicable scope, at the time of publication of the
-   delta CRL.
-
-   When a conforming CRL issuer generates a delta CRL, the delta CRL
-   MUST include a critical delta CRL indicator extension.
-
-   When a delta CRL is issued, it MUST cover the same set of reasons and
-   the same set of certificates that were covered by the base CRL it
-   references.  That is, the scope of the delta CRL MUST be the same as
-   the scope of the complete CRL referenced as the base.  The referenced
-   base CRL and the delta CRL MUST omit the issuing distribution point
-   extension or contain identical issuing distribution point extensions.
-   Further, the CRL issuer MUST use the same private key to sign the
-   delta CRL and any complete CRL that it can be used to update.
-
-   An application that supports delta CRLs can construct a CRL that is
-   complete for a given scope by combining a delta CRL for that scope
-   with either an issued CRL that is complete for that scope or a
-   locally constructed CRL that is complete for that scope.
-
-   When a delta CRL is combined with a complete CRL or a locally
-   constructed CRL, the resulting locally constructed CRL has the CRL
-   number specified in the CRL number extension found in the delta CRL
-   used in its construction.  In addition, the resulting locally
-   constructed CRL has the thisUpdate and nextUpdate times specified in
-   the corresponding fields of the delta CRL used in its construction.
-   In addition, the locally constructed CRL inherits the issuing
-   distribution point from the delta CRL.
-
-   A complete CRL and a delta CRL MAY be combined if the following four
-   conditions are satisfied:
-
-      (a)  The complete CRL and delta CRL have the same issuer.
-
-      (b)  The complete CRL and delta CRL have the same scope.  The two
-      CRLs have the same scope if either of the following conditions are
-      met:
-
-         (1)  The issuingDistributionPoint extension is omitted from
-         both the complete CRL and the delta CRL.
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 56]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-         (2)  The issuingDistributionPoint extension is present in both
-         the complete CRL and the delta CRL, and the values for each of
-         the fields in the extensions are the same in both CRLs.
-
-      (c)  The CRL number of the complete CRL is equal to or greater
-      than the BaseCRLNumber specified in the delta CRL.  That is, the
-      complete CRL contains (at a minimum) all the revocation
-      information held by the referenced base CRL.
-
-      (d)  The CRL number of the complete CRL is less than the CRL
-      number of the delta CRL.  That is, the delta CRL follows the
-      complete CRL in the numbering sequence.
-
-   CRL issuers MUST ensure that the combination of a delta CRL and any
-   appropriate complete CRL accurately reflects the current revocation
-   status.  The CRL issuer MUST include an entry in the delta CRL for
-   each certificate within the scope of the delta CRL whose status has
-   changed since the generation of the referenced base CRL:
-
-      (a)  If the certificate is revoked for a reason included in the
-      scope of the CRL, list the certificate as revoked.
-
-      (b)  If the certificate is valid and was listed on the referenced
-      base CRL or any subsequent CRL with reason code certificateHold,
-      and the reason code certificateHold is included in the scope of
-      the CRL, list the certificate with the reason code removeFromCRL.
-
-      (c)  If the certificate is revoked for a reason outside the scope
-      of the CRL, but the certificate was listed on the referenced base
-      CRL or any subsequent CRL with a reason code included in the scope
-      of this CRL, list the certificate as revoked but omit the reason
-      code.
-
-      (d)  If the certificate is revoked for a reason outside the scope
-      of the CRL and the certificate was neither listed on the
-      referenced base CRL nor any subsequent CRL with a reason code
-      included in the scope of this CRL, do not list the certificate on
-      this CRL.
-
-   The status of a certificate is considered to have changed if it is
-   revoked, placed on hold, released from hold, or if its revocation
-   reason changes.
-
-   It is appropriate to list a certificate with reason code
-   removeFromCRL on a delta CRL even if the certificate was not on hold
-   in the referenced base CRL.  If the certificate was placed on hold in
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 57]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   any CRL issued after the base but before this delta CRL and then
-   released from hold, it MUST be listed on the delta CRL with
-   revocation reason removeFromCRL.
-
-   A CRL issuer MAY optionally list a certificate on a delta CRL with
-   reason code removeFromCRL if the notAfter time specified in the
-   certificate precedes the thisUpdate time specified in the delta CRL
-   and the certificate was listed on the referenced base CRL or in any
-   CRL issued after the base but before this delta CRL.
-
-   If a certificate revocation notice first appears on a delta CRL, then
-   it is possible for the certificate validity period to expire before
-   the next complete CRL for the same scope is issued.  In this case,
-   the revocation notice MUST be included in all subsequent delta CRLs
-   until the revocation notice is included on at least one explicitly
-   issued complete CRL for this scope.
-
-   An application that supports delta CRLs MUST be able to construct a
-   current complete CRL by combining a previously issued complete CRL
-   and the most current delta CRL.  An application that supports delta
-   CRLs MAY also be able to construct a current complete CRL by
-   combining a previously locally constructed complete CRL and the
-   current delta CRL.  A delta CRL is considered to be the current one
-   if the current time is between the times contained in the thisUpdate
-   and nextUpdate fields.  Under some circumstances, the CRL issuer may
-   publish one or more delta CRLs before indicated by the nextUpdate
-   field.  If more than one current delta CRL for a given scope is
-   encountered, the application SHOULD consider the one with the latest
-   value in thisUpdate to be the most current one.
-
-   id-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= { id-ce 27 }
-
-   BaseCRLNumber ::= CRLNumber
-
-5.2.5  Issuing Distribution Point
-
-   The issuing distribution point is a critical CRL extension that
-   identifies the CRL distribution point and scope for a particular CRL,
-   and it indicates whether the CRL covers revocation for end entity
-   certificates only, CA certificates only, attribute certificates only,
-
-   or a limited set of reason codes.  Although the extension is
-   critical, conforming implementations are not required to support this
-   extension.
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 58]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   The CRL is signed using the CRL issuer's private key.  CRL
-   Distribution Points do not have their own key pairs.  If the CRL is
-   stored in the X.500 Directory, it is stored in the Directory entry
-   corresponding to the CRL distribution point, which may be different
-   than the Directory entry of the CRL issuer.
-
-   The reason codes associated with a distribution point MUST be
-   specified in onlySomeReasons.  If onlySomeReasons does not appear,
-   the distribution point MUST contain revocations for all reason codes.
-   CAs may use CRL distribution points to partition the CRL on the basis
-   of compromise and routine revocation.  In this case, the revocations
-   with reason code keyCompromise (1), cACompromise (2), and
-   aACompromise (8) appear in one distribution point, and the
-   revocations with other reason codes appear in another distribution
-   point.
-
-   If the distributionPoint field is present and contains a URI, the
-   following semantics MUST be assumed: the object is a pointer to the
-   most current CRL issued by this CRL issuer.  The URI schemes ftp,
-   http, mailto [RFC1738] and ldap [RFC1778] are defined for this
-   purpose.  The URI MUST be an absolute pathname, not a relative
-   pathname, and MUST specify the host.
-
-   If the distributionPoint field is absent, the CRL MUST contain
-   entries for all revoked unexpired certificates issued by the CRL
-   issuer, if any, within the scope of the CRL.
-
-   The CRL issuer MUST assert the indirectCRL boolean, if the scope of
-   the CRL includes certificates issued by authorities other than the
-   CRL issuer.  The authority responsible for each entry is indicated by
-   the certificate issuer CRL entry extension (section 5.3.4).
-
-   id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-ce 28 }
-
-   issuingDistributionPoint ::= SEQUENCE {
-        distributionPoint          [0] DistributionPointName OPTIONAL,
-        onlyContainsUserCerts      [1] BOOLEAN DEFAULT FALSE,
-        onlyContainsCACerts        [2] BOOLEAN DEFAULT FALSE,
-        onlySomeReasons            [3] ReasonFlags OPTIONAL,
-        indirectCRL                [4] BOOLEAN DEFAULT FALSE,
-        onlyContainsAttributeCerts [5] BOOLEAN DEFAULT FALSE }
-
-5.2.6  Freshest CRL (a.k.a. Delta CRL Distribution Point)
-
-   The freshest CRL extension identifies how delta CRL information for
-   this complete CRL is obtained.  The extension MUST be non-critical.
-   This extension MUST NOT appear in delta CRLs.
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 59]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   The same syntax is used for this extension as the
-   cRLDistributionPoints certificate extension, and is described in
-   section 4.2.1.14.  However, only the distribution point field is
-   meaningful in this context.  The reasons and CRLIssuer fields MUST be
-   omitted from this CRL extension.
-
-   Each distribution point name provides the location at which a delta
-   CRL for this complete CRL can be found.  The scope of these delta
-   CRLs MUST be the same as the scope of this complete CRL.  The
-   contents of this CRL extension are only used to locate delta CRLs;
-   the contents are not used to validate the CRL or the referenced delta
-   CRLs.  The encoding conventions defined for distribution points in
-   section 4.2.1.14 apply to this extension.
-
-   id-ce-freshestCRL OBJECT IDENTIFIER ::=  { id-ce 46 }
-
-   FreshestCRL ::= CRLDistributionPoints
-
-5.3  CRL Entry Extensions
-
-   The CRL entry extensions defined by ISO/IEC, ITU-T, and ANSI X9 for
-   X.509 v2 CRLs provide methods for associating additional attributes
-   with CRL entries [X.509] [X9.55].  The X.509 v2 CRL format also
-   allows communities to define private CRL entry extensions to carry
-   information unique to those communities.  Each extension in a CRL
-   entry may be designated as critical or non-critical.  A CRL
-   validation MUST fail if it encounters a critical CRL entry extension
-   which it does not know how to process.  However, an unrecognized non-
-   critical CRL entry extension may be ignored.  The following
-   subsections present recommended extensions used within Internet CRL
-   entries and standard locations for information.  Communities may
-   elect to use additional CRL entry extensions; however, caution should
-   be exercised in adopting any critical extensions in CRL entries which
-   might be used in a general context.
-
-   All CRL entry extensions used in this specification are non-critical.
-   Support for these extensions is optional for conforming CRL issuers
-   and applications.  However, CRL issuers SHOULD include reason codes
-   (section 5.3.1) and invalidity dates (section 5.3.3) whenever this
-   information is available.
-
-5.3.1  Reason Code
-
-   The reasonCode is a non-critical CRL entry extension that identifies
-   the reason for the certificate revocation.  CRL issuers are strongly
-   encouraged to include meaningful reason codes in CRL entries;
-   however, the reason code CRL entry extension SHOULD be absent instead
-   of using the unspecified (0) reasonCode value.
-
-
-
-Housley, et. al.            Standards Track                    [Page 60]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   id-ce-cRLReason OBJECT IDENTIFIER ::= { id-ce 21 }
-
-   -- reasonCode ::= { CRLReason }
-
-   CRLReason ::= ENUMERATED {
-        unspecified             (0),
-        keyCompromise           (1),
-        cACompromise            (2),
-        affiliationChanged      (3),
-        superseded              (4),
-        cessationOfOperation    (5),
-        certificateHold         (6),
-        removeFromCRL           (8),
-        privilegeWithdrawn      (9),
-        aACompromise           (10) }
-
-5.3.2  Hold Instruction Code
-
-   The hold instruction code is a non-critical CRL entry extension that
-   provides a registered instruction identifier which indicates the
-   action to be taken after encountering a certificate that has been
-   placed on hold.
-
-   id-ce-holdInstructionCode OBJECT IDENTIFIER ::= { id-ce 23 }
-
-   holdInstructionCode ::= OBJECT IDENTIFIER
-
-   The following instruction codes have been defined.  Conforming
-   applications that process this extension MUST recognize the following
-   instruction codes.
-
-   holdInstruction    OBJECT IDENTIFIER ::=
-                    { iso(1) member-body(2) us(840) x9-57(10040) 2 }
-
-   id-holdinstruction-none   OBJECT IDENTIFIER ::= {holdInstruction 1}
-   id-holdinstruction-callissuer
-                             OBJECT IDENTIFIER ::= {holdInstruction 2}
-   id-holdinstruction-reject OBJECT IDENTIFIER ::= {holdInstruction 3}
-
-   Conforming applications which encounter an id-holdinstruction-
-   callissuer MUST call the certificate issuer or reject the
-   certificate.  Conforming applications which encounter an id-
-   holdinstruction-reject MUST reject the certificate.  The hold
-   instruction id-holdinstruction-none is semantically equivalent to the
-   absence of a holdInstructionCode, and its use is strongly deprecated
-   for the Internet PKI.
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 61]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-5.3.3  Invalidity Date
-
-   The invalidity date is a non-critical CRL entry extension that
-   provides the date on which it is known or suspected that the private
-   key was compromised or that the certificate otherwise became invalid.
-   This date may be earlier than the revocation date in the CRL entry,
-   which is the date at which the CA processed the revocation.  When a
-   revocation is first posted by a CRL issuer in a CRL, the invalidity
-   date may precede the date of issue of earlier CRLs, but the
-   revocation date SHOULD NOT precede the date of issue of earlier CRLs.
-   Whenever this information is available, CRL issuers are strongly
-   encouraged to share it with CRL users.
-
-   The GeneralizedTime values included in this field MUST be expressed
-   in Greenwich Mean Time (Zulu), and MUST be specified and interpreted
-   as defined in section 4.1.2.5.2.
-
-   id-ce-invalidityDate OBJECT IDENTIFIER ::= { id-ce 24 }
-
-   invalidityDate ::=  GeneralizedTime
-
-5.3.4  Certificate Issuer
-
-   This CRL entry extension identifies the certificate issuer associated
-   with an entry in an indirect CRL, that is, a CRL that has the
-   indirectCRL indicator set in its issuing distribution point
-   extension.  If this extension is not present on the first entry in an
-   indirect CRL, the certificate issuer defaults to the CRL issuer.  On
-   subsequent entries in an indirect CRL, if this extension is not
-   present, the certificate issuer for the entry is the same as that for
-   the preceding entry.  This field is defined as follows:
-
-   id-ce-certificateIssuer   OBJECT IDENTIFIER ::= { id-ce 29 }
-
-   certificateIssuer ::=     GeneralNames
-
-   If used by conforming CRL issuers, this extension MUST always be
-   critical.  If an implementation ignored this extension it could not
-   correctly attribute CRL entries to certificates.  This specification
-   RECOMMENDS that implementations recognize this extension.
-
-6  Certification Path Validation
-
-   Certification path validation procedures for the Internet PKI are
-   based on the algorithm supplied in [X.509].  Certification path
-   processing verifies the binding between the subject distinguished
-   name and/or subject alternative name and subject public key.  The
-   binding is limited by constraints which are specified in the
-
-
-
-Housley, et. al.            Standards Track                    [Page 62]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   certificates which comprise the path and inputs which are specified
-   by the relying party.  The basic constraints and policy constraints
-   extensions allow the certification path processing logic to automate
-   the decision making process.
-
-   This section describes an algorithm for validating certification
-   paths.  Conforming implementations of this specification are not
-   required to implement this algorithm, but MUST provide functionality
-   equivalent to the external behavior resulting from this procedure.
-   Any algorithm may be used by a particular implementation so long as
-   it derives the correct result.
-
-   In section 6.1, the text describes basic path validation.  Valid
-   paths begin with certificates issued by a trust anchor.  The
-   algorithm requires the public key of the CA, the CA's name, and any
-   constraints upon the set of paths which may be validated using this
-   key.
-
-   The selection of a trust anchor is a matter of policy: it could be
-   the top CA in a hierarchical PKI; the CA that issued the verifier's
-   own certificate(s); or any other CA in a network PKI.  The path
-   validation procedure is the same regardless of the choice of trust
-   anchor.  In addition, different applications may rely on different
-   trust anchor, or may accept paths that begin with any of a set of
-   trust anchor.
-
-   Section 6.2 describes methods for using the path validation algorithm
-   in specific implementations.  Two specific cases are discussed: the
-   case where paths may begin with one of several trusted CAs; and where
-   compatibility with the PEM architecture is required.
-
-   Section 6.3 describes the steps necessary to determine if a
-   certificate is revoked or on hold status when CRLs are the revocation
-   mechanism used by the certificate issuer.
-
-6.1  Basic Path Validation
-
-   This text describes an algorithm for X.509 path processing.  A
-   conformant implementation MUST include an X.509 path processing
-   procedure that is functionally equivalent to the external behavior of
-   this algorithm.  However, support for some of the certificate
-   extensions processed in this algorithm are OPTIONAL for compliant
-   implementations.  Clients that do not support these extensions MAY
-   omit the corresponding steps in the path validation algorithm.
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 63]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   For example, clients are NOT REQUIRED to support the policy mapping
-   extension.  Clients that do not support this extension MAY omit the
-   path validation steps where policy mappings are processed.  Note that
-   clients MUST reject the certificate if it contains an unsupported
-   critical extension.
-
-   The algorithm presented in this section validates the certificate
-   with respect to the current date and time.  A conformant
-   implementation MAY also support validation with respect to some point
-   in the past.  Note that mechanisms are not available for validating a
-   certificate with respect to a time outside the certificate validity
-   period.
-
-   The trust anchor is an input to the algorithm.  There is no
-   requirement that the same trust anchor be used to validate all
-   certification paths.  Different trust anchors MAY be used to validate
-   different paths, as discussed further in Section 6.2.
-
-   The primary goal of path validation is to verify the binding between
-   a subject distinguished name or a subject alternative name and
-   subject public key, as represented in the end entity certificate,
-   based on the public key of the trust anchor.  This requires obtaining
-   a sequence of certificates that support that binding.  The procedure
-   performed to obtain this sequence of certificates is outside the
-   scope of this specification.
-
-   To meet this goal, the path validation process verifies, among other
-   things, that a prospective certification path (a sequence of n
-   certificates) satisfies the following conditions:
-
-      (a)  for all x in {1, ..., n-1}, the subject of certificate x is
-      the issuer of certificate x+1;
-
-      (b)  certificate 1 is issued by the trust anchor;
-
-      (c)  certificate n is the certificate to be validated; and
-
-      (d)  for all x in {1, ..., n}, the certificate was valid at the
-      time in question.
-
-   When the trust anchor is provided in the form of a self-signed
-   certificate, this self-signed certificate is not included as part of
-   the prospective certification path.  Information about trust anchors
-   are provided as inputs to the certification path validation algorithm
-   (section 6.1.1).
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 64]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   A particular certification path may not, however, be appropriate for
-   all applications.  Therefore, an application MAY augment this
-   algorithm to further limit the set of valid paths.  The path
-   validation process also determines the set of certificate policies
-   that are valid for this path, based on the certificate policies
-   extension, policy mapping extension, policy constraints extension,
-   and inhibit any-policy extension.  To achieve this, the path
-   validation algorithm constructs a valid policy tree.  If the set of
-   certificate policies that are valid for this path is not empty, then
-   the result will be a valid policy tree of depth n, otherwise the
-   result will be a null valid policy tree.
-
-   A certificate is self-issued if the DNs that appear in the subject
-   and issuer fields are identical and are not empty.  In general, the
-   issuer and subject of the certificates that make up a path are
-   different for each certificate.  However, a CA may issue a
-   certificate to itself to support key rollover or changes in
-   certificate policies.  These self-issued certificates are not counted
-   when evaluating path length or name constraints.
-
-   This section presents the algorithm in four basic steps: (1)
-   initialization, (2) basic certificate processing, (3) preparation for
-   the next certificate, and (4) wrap-up.  Steps (1) and (4) are
-   performed exactly once.  Step (2) is performed for all certificates
-   in the path.  Step (3) is performed for all certificates in the path
-   except the final certificate.  Figure 2 provides a high-level
-   flowchart of this algorithm.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 65]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-                           +-------+
-                           | START |
-                           +-------+
-                               |
-                               V
-                       +----------------+
-                       | Initialization |
-                       +----------------+
-                               |
-                               +<--------------------+
-                               |                     |
-                               V                     |
-                       +----------------+            |
-                       |  Process Cert  |            |
-                       +----------------+            |
-                               |                     |
-                               V                     |
-                       +================+            |
-                       |  IF Last Cert  |            |
-                       |    in Path     |            |
-                       +================+            |
-                         |            |              |
-                    THEN |            | ELSE         |
-                         V            V              |
-              +----------------+ +----------------+  |
-              |    Wrap up     | |  Prepare for   |  |
-              +----------------+ |   Next Cert    |  |
-                      |          +----------------+  |
-                      V               |              |
-                  +-------+           +--------------+
-                  | STOP  |
-                  +-------+
-
-
-         Figure 2.  Certification Path Processing Flowchart
-
-6.1.1  Inputs
-
-   This algorithm assumes the following seven inputs are provided to the
-   path processing logic:
-
-      (a)  a prospective certification path of length n.
-
-      (b)  the current date/time.
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 66]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-      (c)  user-initial-policy-set:  A set of certificate policy
-      identifiers naming the policies that are acceptable to the
-      certificate user.  The user-initial-policy-set contains the
-      special value any-policy if the user is not concerned about
-      certificate policy.
-
-      (d)  trust anchor information, describing a CA that serves as a
-      trust anchor for the certification path.  The trust anchor
-      information includes:
-
-         (1)  the trusted issuer name,
-
-         (2)  the trusted public key algorithm,
-
-         (3)  the trusted public key, and
-
-         (4)  optionally, the trusted public key parameters associated
-         with the public key.
-
-      The trust anchor information may be provided to the path
-      processing procedure in the form of a self-signed certificate.
-      The trusted anchor information is trusted because it was delivered
-      to the path processing procedure by some trustworthy out-of-band
-      procedure.  If the trusted public key algorithm requires
-      parameters, then the parameters are provided along with the
-      trusted public key.
-
-      (e) initial-policy-mapping-inhibit, which indicates if policy
-      mapping is allowed in the certification path.
-
-      (f) initial-explicit-policy, which indicates if the path must be
-      valid for at least one of the certificate policies in the user-
-      initial-policy-set.
-
-      (g) initial-any-policy-inhibit, which indicates whether the
-      anyPolicy OID should be processed if it is included in a
-      certificate.
-
-6.1.2  Initialization
-
-   This initialization phase establishes eleven state variables based
-   upon the seven inputs:
-
-      (a)  valid_policy_tree:  A tree of certificate policies with their
-      optional qualifiers; each of the leaves of the tree represents a
-      valid policy at this stage in the certification path validation.
-      If valid policies exist at this stage in the certification path
-      validation, the depth of the tree is equal to the number of
-
-
-
-Housley, et. al.            Standards Track                    [Page 67]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-      certificates in the chain that have been processed.  If valid
-      policies do not exist at this stage in the certification path
-      validation, the tree is set to NULL.  Once the tree is set to
-      NULL, policy processing ceases.
-
-      Each node in the valid_policy_tree includes four data objects: the
-      valid policy, a set of associated policy qualifiers, a set of one
-      or more expected policy values, and a criticality indicator.  If
-      the node is at depth x, the components of the node have the
-      following semantics:
-
-         (1)  The valid_policy is a single policy OID representing a
-         valid policy for the path of length x.
-
-         (2)  The qualifier_set is a set of policy qualifiers associated
-         with the valid policy in certificate x.
-
-         (3)  The criticality_indicator indicates whether the
-         certificate policy extension in certificate x was marked as
-         critical.
-
-         (4)  The expected_policy_set contains one or more policy OIDs
-         that would satisfy this policy in the certificate x+1.
-
-      The initial value of the valid_policy_tree is a single node with
-      valid_policy anyPolicy, an empty qualifier_set, an
-      expected_policy_set with the single value anyPolicy, and a
-      criticality_indicator of FALSE.  This node is considered to be at
-      depth zero.
-
-      Figure 3 is a graphic representation of the initial state of the
-      valid_policy_tree.  Additional figures will use this format to
-      describe changes in the valid_policy_tree during path processing.
-
-              +----------------+
-              |   anyPolicy    |   <---- valid_policy
-              +----------------+
-              |       {}       |   <---- qualifier_set
-              +----------------+
-              |     FALSE      |   <---- criticality_indicator
-              +----------------+
-              |  {anyPolicy}   |   <---- expected_policy_set
-              +----------------+
-
-      Figure 3.  Initial value of the valid_policy_tree state variable
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 68]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-      (b) permitted_subtrees:  A set of root names for each name type
-      (e.g., X.500 distinguished names, email addresses, or ip
-      addresses) defining a set of subtrees within which all subject
-      names in subsequent certificates in the certification path MUST
-      fall.  This variable includes a set for each name type: the
-      initial value for the set for Distinguished Names is the set of
-      all Distinguished names; the initial value for the set of RFC822
-      names is the set of all RFC822 names, etc.
-
-      (c) excluded_subtrees:  A set of root names for each name type
-      (e.g., X.500 distinguished names, email addresses, or ip
-      addresses) defining a set of subtrees within which no subject name
-      in subsequent certificates in the certification path may fall.
-      This variable includes a set for each name type, and the initial
-      value for each set is empty.
-
-      (d) explicit_policy: an integer which indicates if a non-NULL
-      valid_policy_tree is required. The integer indicates the number of
-      non-self-issued certificates to be processed before this
-      requirement is imposed.  Once set, this variable may be decreased,
-      but may not be increased. That is, if a certificate in the path
-      requires a non-NULL valid_policy_tree, a later certificate can not
-      remove this requirement. If initial-explicit-policy is set, then
-      the initial value is 0, otherwise the initial value is n+1.
-
-      (e) inhibit_any-policy: an integer which indicates whether the
-      anyPolicy policy identifier is considered a match. The integer
-      indicates the number of non-self-issued certificates to be
-      processed before the anyPolicy OID, if asserted in a certificate,
-      is ignored. Once set, this variable may be decreased, but may not
-      be increased. That is, if a certificate in the path inhibits
-      processing of anyPolicy, a later certificate can not permit it.
-      If initial-any-policy-inhibit is set, then the initial value is 0,
-      otherwise the initial value is n+1.
-
-      (f) policy_mapping: an integer which indicates if policy mapping
-      is permitted.  The integer indicates the number of non-self-issued
-      certificates to be processed before policy mapping is inhibited.
-      Once set, this variable may be decreased, but may not be
-      increased. That is, if a certificate in the path specifies policy
-      mapping is not permitted, it can not be overridden by a later
-      certificate. If initial-policy-mapping-inhibit is set, then the
-      initial value is 0, otherwise the initial value is n+1.
-
-      (g) working_public_key_algorithm: the digital signature algorithm
-      used to verify the signature of a certificate.  The
-      working_public_key_algorithm is initialized from the trusted
-      public key algorithm provided in the trust anchor information.
-
-
-
-Housley, et. al.            Standards Track                    [Page 69]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-      (h) working_public_key: the public key used to verify the
-      signature of a certificate.  The working_public_key is initialized
-      from the trusted public key provided in the trust anchor
-      information.
-
-      (i) working_public_key_parameters:  parameters associated with the
-      current public key, that may be required to verify a signature
-      (depending upon the algorithm).  The working_public_key_parameters
-      variable is initialized from the trusted public key parameters
-      provided in the trust anchor information.
-
-      (j) working_issuer_name:  the issuer distinguished name expected
-      in the next certificate in the chain.  The working_issuer_name is
-      initialized to the trusted issuer provided in the trust anchor
-      information.
-
-      (k) max_path_length:  this integer is initialized to n, is
-      decremented for each non-self-issued certificate in the path, and
-      may be reduced to the value in the path length constraint field
-      within the basic constraints extension of a CA certificate.
-
-   Upon completion of the initialization steps, perform the basic
-   certificate processing steps specified in 6.1.3.
-
-6.1.3  Basic Certificate Processing
-
-   The basic path processing actions to be performed for certificate i
-   (for all i in [1..n]) are listed below.
-
-      (a)  Verify the basic certificate information.  The certificate
-      MUST satisfy each of the following:
-
-         (1)  The certificate was signed with the
-         working_public_key_algorithm using the working_public_key and
-         the working_public_key_parameters.
-
-         (2)  The certificate validity period includes the current time.
-
-         (3)  At the current time, the certificate is not revoked and is
-         not on hold status.  This may be determined by obtaining the
-         appropriate CRL (section 6.3), status information, or by out-
-         of-band mechanisms.
-
-         (4)  The certificate issuer name is the working_issuer_name.
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 70]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-      (b)  If certificate i is self-issued and it is not the final
-      certificate in the path, skip this step for certificate i.
-      Otherwise, verify that the subject name is within one of the
-      permitted_subtrees for X.500 distinguished names, and verify that
-      each of the alternative names in the subjectAltName extension
-      (critical or non-critical) is within one of the permitted_subtrees
-      for that name type.
-
-      (c)  If certificate i is self-issued and it is not the final
-      certificate in the path, skip this step for certificate i.
-      Otherwise, verify that the subject name is not within one of the
-      excluded_subtrees for X.500 distinguished names, and verify that
-      each of the alternative names in the subjectAltName extension
-      (critical or non-critical) is not within one of the
-      excluded_subtrees for that name type.
-
-      (d)  If the certificate policies extension is present in the
-      certificate and the valid_policy_tree is not NULL, process the
-      policy information by performing the following steps in order:
-
-         (1)  For each policy P not equal to anyPolicy in the
-         certificate policies extension, let P-OID denote the OID in
-         policy P and P-Q denote the qualifier set for policy P.
-         Perform the following steps in order:
-
-            (i)  If the valid_policy_tree includes a node of depth i-1
-            where P-OID is in the expected_policy_set, create a child
-            node as follows: set the valid_policy to OID-P; set the
-            qualifier_set to P-Q, and set the expected_policy_set to
-            {P-OID}.
-
-            For example, consider a valid_policy_tree with a node of
-            depth i-1 where the expected_policy_set is {Gold, White}.
-            Assume the certificate policies Gold and Silver appear in
-            the certificate policies extension of certificate i.  The
-            Gold policy is matched but the Silver policy is not.  This
-            rule will generate a child node of depth i for the Gold
-            policy. The result is shown as Figure 4.
-
-
-
-
-
-
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 71]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-                             +-----------------+
-                             |       Red       |
-                             +-----------------+
-                             |       {}        |
-                             +-----------------+   node of depth i-1
-                             |      FALSE      |
-                             +-----------------+
-                             |  {Gold, White}  |
-                             +-----------------+
-                                      |
-                                      |
-                                      |
-                                      V
-                             +-----------------+
-                             |      Gold       |
-                             +-----------------+
-                             |       {}        |
-                             +-----------------+ node of depth i
-                             |  uninitialized  |
-                             +-----------------+
-                             |     {Gold}      |
-                             +-----------------+
-
-                    Figure 4.  Processing an exact match
-
-            (ii)  If there was no match in step (i) and the
-            valid_policy_tree includes a node of depth i-1 with the
-            valid policy anyPolicy, generate a child node with the
-            following values: set the valid_policy to P-OID; set the
-            qualifier_set to P-Q, and set the expected_policy_set to
-            {P-OID}.
-
-            For example, consider a valid_policy_tree with a node of
-            depth i-1 where the valid_policy is anyPolicy.  Assume the
-            certificate policies Gold and Silver appear in the
-            certificate policies extension of certificate i.  The Gold
-            policy does not have a qualifier, but the Silver policy has
-            the qualifier Q-Silver.  If Gold and Silver were not matched
-            in (i) above, this rule will generate two child nodes of
-            depth i, one for each policy.  The result is shown as Figure
-            5.
-
-
-
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 72]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-                             +-----------------+
-                             |    anyPolicy    |
-                             +-----------------+
-                             |       {}        |
-                             +-----------------+ node of depth i-1
-                             |      FALSE      |
-                             +-----------------+
-                             |   {anyPolicy}   |
-                             +-----------------+
-                                /           \
-                               /             \
-                              /               \
-                             /                 \
-               +-----------------+          +-----------------+
-               |      Gold       |          |     Silver      |
-               +-----------------+          +-----------------+
-               |       {}        |          |   {Q-Silver}    |
-               +-----------------+ nodes of +-----------------+
-               | uninitialized   | depth i  | uninitialized   |
-               +-----------------+          +-----------------+
-               |     {Gold}      |          |    {Silver}     |
-               +-----------------+          +-----------------+
-
-               Figure 5.  Processing unmatched policies when a leaf node
-               specifies anyPolicy
-
-         (2)  If the certificate policies extension includes the policy
-         anyPolicy with the qualifier set AP-Q and either (a)
-         inhibit_any-policy is greater than 0 or (b) i<n and the
-         certificate is self-issued, then:
-
-         For each node in the valid_policy_tree of depth i-1, for each
-         value in the expected_policy_set (including anyPolicy) that
-         does not appear in a child node, create a child node with the
-         following values: set the valid_policy to the value from the
-         expected_policy_set in the parent node; set the qualifier_set
-         to AP-Q, and set the expected_policy_set to the value in the
-         valid_policy from this node.
-
-         For example, consider a valid_policy_tree with a node of depth
-         i-1 where the expected_policy_set is {Gold, Silver}.  Assume
-         anyPolicy appears in the certificate policies extension of
-         certificate i, but Gold and Silver do not.  This rule will
-         generate two child nodes of depth i, one for each policy.  The
-         result is shown below as Figure 6.
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 73]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-                          +-----------------+
-                          |      Red        |
-                          +-----------------+
-                          |       {}        |
-                          +-----------------+ node of depth i-1
-                          |      FALSE      |
-                          +-----------------+
-                          |  {Gold, Silver} |
-                          +-----------------+
-                             /           \
-                            /             \
-                           /               \
-                          /                 \
-            +-----------------+          +-----------------+
-            |      Gold       |          |     Silver      |
-            +-----------------+          +-----------------+
-            |       {}        |          |       {}        |
-            +-----------------+ nodes of +-----------------+
-            |  uninitialized  | depth i  |  uninitialized  |
-            +-----------------+          +-----------------+
-            |     {Gold}      |          |    {Silver}     |
-            +-----------------+          +-----------------+
-
-         Figure 6.  Processing unmatched policies when the certificate
-         policies extension specifies anyPolicy
-
-         (3)  If there is a node in the valid_policy_tree of depth i-1
-         or less without any child nodes, delete that node.  Repeat this
-         step until there are no nodes of depth i-1 or less without
-         children.
-
-         For example, consider the valid_policy_tree shown in Figure 7
-         below.  The two nodes at depth i-1 that are marked with an 'X'
-         have no children, and are deleted.  Applying this rule to the
-         resulting tree will cause the node at depth i-2 that is marked
-         with an 'Y' to be deleted.  The following application of the
-         rule does not cause any nodes to be deleted, and this step is
-         complete.
-
-
-
-
-
-
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 74]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-                              +-----------+
-                              |           | node of depth i-3
-                              +-----------+
-                              /     |     \
-                             /      |      \
-                            /       |       \
-                +-----------+ +-----------+ +-----------+
-                |           | |           | |     Y     | nodes of
-                +-----------+ +-----------+ +-----------+ depth i-2
-                /   \               |             |
-               /     \              |             |
-              /       \             |             |
-   +-----------+ +-----------+ +-----------+ +-----------+ nodes of
-   |           | |     X     | |           | |    X      |  depth
-   +-----------+ +-----------+ +-----------+ +-----------+   i-1
-         |                      /    |    \
-         |                     /     |     \
-         |                    /      |      \
-   +-----------+ +-----------+ +-----------+ +-----------+ nodes of
-   |           | |           | |           | |           |  depth
-   +-----------+ +-----------+ +-----------+ +-----------+   i
-
-          Figure 7.  Pruning the valid_policy_tree
-
-         (4)  If the certificate policies extension was marked as
-         critical, set the criticality_indicator in all nodes of depth i
-         to TRUE.  If the certificate policies extension was not marked
-         critical, set the criticality_indicator in all nodes of depth i
-         to FALSE.
-
-      (e)  If the certificate policies extension is not present, set the
-      valid_policy_tree to NULL.
-
-      (f)  Verify that either explicit_policy is greater than 0 or the
-      valid_policy_tree is not equal to NULL;
-
-   If any of steps (a), (b), (c), or (f) fails, the procedure
-   terminates, returning a failure indication and an appropriate reason.
-
-   If i is not equal to n, continue by performing the preparatory steps
-   listed in 6.1.4.  If i is equal to n, perform the wrap-up steps
-   listed in 6.1.5.
-
-6.1.4  Preparation for Certificate i+1
-
-   To prepare for processing of certificate i+1, perform the following
-   steps for certificate i:
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 75]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-      (a)  If a policy mapping extension is present, verify that the
-      special value anyPolicy does not appear as an issuerDomainPolicy
-      or a subjectDomainPolicy.
-
-      (b)  If a policy mapping extension is present, then for each
-      issuerDomainPolicy ID-P in the policy mapping extension:
-
-         (1)  If the policy_mapping variable is greater than 0, for each
-         node in the valid_policy_tree of depth i where ID-P is the
-         valid_policy, set expected_policy_set to the set of
-         subjectDomainPolicy values that are specified as equivalent to
-         ID-P by the policy mapping extension.
-
-         If no node of depth i in the valid_policy_tree has a
-         valid_policy of ID-P but there is a node of depth i with a
-         valid_policy of anyPolicy, then generate a child node of the
-         node of depth i-1 that has a valid_policy of anyPolicy as
-         follows:
-
-            (i)  set the valid_policy to ID-P;
-
-            (ii)  set the qualifier_set to the qualifier set of the
-            policy anyPolicy in the certificate policies extension of
-            certificate i;
-
-            (iii)  set the criticality_indicator to the criticality of
-            the certificate policies extension of certificate i;
-
-            (iv)  and set the expected_policy_set to the set of
-            subjectDomainPolicy values that are specified as equivalent
-            to ID-P by the policy mappings extension.
-
-         (2)  If the policy_mapping variable is equal to 0:
-
-            (i)  delete each node of depth i in the valid_policy_tree
-            where ID-P is the valid_policy.
-
-            (ii)  If there is a node in the valid_policy_tree of depth
-            i-1 or less without any child nodes, delete that node.
-            Repeat this step until there are no nodes of depth i-1 or
-            less without children.
-
-      (c)  Assign the certificate subject name to working_issuer_name.
-
-      (d)  Assign the certificate subjectPublicKey to
-      working_public_key.
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 76]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-      (e)  If the subjectPublicKeyInfo field of the certificate contains
-      an algorithm field with non-null parameters, assign the parameters
-      to the working_public_key_parameters variable.
-
-      If the subjectPublicKeyInfo field of the certificate contains an
-      algorithm field with null parameters or parameters are omitted,
-      compare the certificate subjectPublicKey algorithm to the
-      working_public_key_algorithm.  If the certificate subjectPublicKey
-      algorithm and the working_public_key_algorithm are different, set
-      the working_public_key_parameters to null.
-
-      (f)  Assign the certificate subjectPublicKey algorithm to the
-      working_public_key_algorithm variable.
-
-      (g)  If a name constraints extension is included in the
-      certificate, modify the permitted_subtrees and excluded_subtrees
-      state variables as follows:
-
-         (1)  If permittedSubtrees is present in the certificate, set
-         the permitted_subtrees state variable to the intersection of
-         its previous value and the value indicated in the extension
-         field.  If permittedSubtrees does not include a particular name
-         type, the permitted_subtrees state variable is unchanged for
-         that name type.  For example, the intersection of nist.gov and
-         csrc.nist.gov is csrc.nist.gov.  And, the intersection of
-         nist.gov and rsasecurity.com is the empty set.
-
-         (2)  If excludedSubtrees is present in the certificate, set the
-         excluded_subtrees state variable to the union of its previous
-         value and the value indicated in the extension field.  If
-         excludedSubtrees does not include a particular name type, the
-         excluded_subtrees state variable is unchanged for that name
-         type.  For example, the union of the name spaces nist.gov and
-         csrc.nist.gov is nist.gov.  And, the union of nist.gov and
-         rsasecurity.com is both name spaces.
-
-      (h)  If the issuer and subject names are not identical:
-
-         (1)  If explicit_policy is not 0, decrement explicit_policy by
-         1.
-
-         (2)  If policy_mapping is not 0, decrement policy_mapping by 1.
-
-         (3)  If inhibit_any-policy is not 0, decrement inhibit_any-
-         policy by 1.
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 77]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-      (i)  If a policy constraints extension is included in the
-      certificate, modify the explicit_policy and policy_mapping state
-      variables as follows:
-
-         (1)  If requireExplicitPolicy is present and is less than
-         explicit_policy, set explicit_policy to the value of
-         requireExplicitPolicy.
-
-         (2)  If inhibitPolicyMapping is present and is less than
-         policy_mapping, set policy_mapping to the value of
-         inhibitPolicyMapping.
-
-      (j)  If the inhibitAnyPolicy extension is included in the
-      certificate and is less than inhibit_any-policy, set inhibit_any-
-      policy to the value of inhibitAnyPolicy.
-
-      (k)  Verify that the certificate is a CA certificate (as specified
-      in a basicConstraints extension or as verified out-of-band).
-
-      (l)  If the certificate was not self-issued, verify that
-      max_path_length is greater than zero and decrement max_path_length
-      by 1.
-
-      (m)  If pathLengthConstraint is present in the certificate and is
-      less than max_path_length, set max_path_length to the value of
-      pathLengthConstraint.
-
-      (n)  If a key usage extension is present, verify that the
-      keyCertSign bit is set.
-
-      (o)  Recognize and process any other critical extension present in
-      the certificate.  Process any other recognized non-critical
-      extension present in the certificate.
-
-   If check (a), (k), (l), (n) or (o) fails, the procedure terminates,
-   returning a failure indication and an appropriate reason.
-
-   If (a), (k), (l), (n) and (o) have completed successfully, increment
-   i and perform the basic certificate processing specified in 6.1.3.
-
-6.1.5  Wrap-up procedure
-
-   To complete the processing of the end entity certificate, perform the
-   following steps for certificate n:
-
-      (a)  If certificate n was not self-issued and explicit_policy is
-      not 0, decrement explicit_policy by 1.
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 78]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-      (b)  If a policy constraints extension is included in the
-      certificate and requireExplicitPolicy is present and has a value
-      of 0, set the explicit_policy state variable to 0.
-
-      (c)  Assign the certificate subjectPublicKey to
-      working_public_key.
-
-      (d)  If the subjectPublicKeyInfo field of the certificate contains
-      an algorithm field with non-null parameters, assign the parameters
-      to the working_public_key_parameters variable.
-
-      If the subjectPublicKeyInfo field of the certificate contains an
-      algorithm field with null parameters or parameters are omitted,
-      compare the certificate subjectPublicKey algorithm to the
-      working_public_key_algorithm.  If the certificate subjectPublicKey
-      algorithm and the working_public_key_algorithm are different, set
-      the working_public_key_parameters to null.
-
-      (e)  Assign the certificate subjectPublicKey algorithm to the
-      working_public_key_algorithm variable.
-
-      (f)  Recognize and process any other critical extension present in
-      the certificate n.  Process any other recognized non-critical
-      extension present in certificate n.
-
-      (g)  Calculate the intersection of the valid_policy_tree and the
-      user-initial-policy-set, as follows:
-
-         (i)  If the valid_policy_tree is NULL, the intersection is
-         NULL.
-
-         (ii)  If the valid_policy_tree is not NULL and the user-
-         initial-policy-set is any-policy, the intersection is the
-         entire valid_policy_tree.
-
-         (iii)  If the valid_policy_tree is not NULL and the user-
-         initial-policy-set is not any-policy, calculate the
-         intersection of the valid_policy_tree and the user-initial-
-         policy-set as follows:
-
-            1.  Determine the set of policy nodes whose parent nodes
-            have a valid_policy of anyPolicy.  This is the
-            valid_policy_node_set.
-
-            2.  If the valid_policy of any node in the
-            valid_policy_node_set is not in the user-initial-policy-set
-            and is not anyPolicy, delete this node and all its children.
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 79]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-            3.  If the valid_policy_tree includes a node of depth n with
-            the valid_policy anyPolicy and the user-initial-policy-set
-            is not any-policy perform the following steps:
-
-               a. Set P-Q to the qualifier_set in the node of depth n
-               with valid_policy anyPolicy.
-
-               b. For each P-OID in the user-initial-policy-set that is
-               not the valid_policy of a node in the
-               valid_policy_node_set, create a child node whose parent
-               is the node of depth n-1 with the valid_policy anyPolicy.
-               Set the values in the child node as follows: set the
-               valid_policy to P-OID; set the qualifier_set to P-Q; copy
-               the criticality_indicator from the node of depth n with
-               the valid_policy anyPolicy; and set the
-               expected_policy_set to {P-OID}.
-
-               c.  Delete the node of depth n with the valid_policy
-               anyPolicy.
-
-            4.  If there is a node in the valid_policy_tree of depth n-1
-            or less without any child nodes, delete that node.  Repeat
-            this step until there are no nodes of depth n-1 or less
-            without children.
-
-   If either (1) the value of explicit_policy variable is greater than
-   zero, or (2) the valid_policy_tree is not NULL, then path processing
-   has succeeded.
-
-6.1.6  Outputs
-
-   If path processing succeeds, the procedure terminates, returning a
-   success indication together with final value of the
-   valid_policy_tree, the working_public_key, the
-   working_public_key_algorithm, and the working_public_key_parameters.
-
-6.2  Using the Path Validation Algorithm
-
-   The path validation algorithm describes the process of validating a
-   single certification path.  While each certification path begins with
-   a specific trust anchor, there is no requirement that all
-   certification paths validated by a particular system share a single
-   trust anchor.  An implementation that supports multiple trust anchors
-   MAY augment the algorithm presented in section 6.1 to further limit
-   the set of valid certification paths which begin with a particular
-   trust anchor.  For example, an implementation MAY modify the
-   algorithm to apply name constraints to a specific trust anchor during
-   the initialization phase, or the application MAY require the presence
-
-
-
-Housley, et. al.            Standards Track                    [Page 80]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   of a particular alternative name form in the end entity certificate,
-   or the application MAY impose requirements on application-specific
-   extensions.  Thus, the path validation algorithm presented in section
-   6.1 defines the minimum conditions for a path to be considered valid.
-
-   The selection of one or more trusted CAs is a local decision.  A
-   system may provide any one of its trusted CAs as the trust anchor for
-   a particular path.  The inputs to the path validation algorithm may
-   be different for each path.  The inputs used to process a path may
-   reflect application-specific requirements or limitations in the trust
-   accorded a particular trust anchor.  For example, a trusted CA may
-   only be trusted for a particular certificate policy.  This
-   restriction can be expressed through the inputs to the path
-   validation procedure.
-
-   It is also possible to specify an extended version of the above
-   certification path processing procedure which results in default
-   behavior identical to the rules of PEM [RFC 1422].  In this extended
-   version, additional inputs to the procedure are a list of one or more
-   Policy Certification Authority (PCA) names and an indicator of the
-   position in the certification path where the PCA is expected.  At the
-   nominated PCA position, the CA name is compared against this list.
-   If a recognized PCA name is found, then a constraint of
-   SubordinateToCA is implicitly assumed for the remainder of the
-   certification path and processing continues.  If no valid PCA name is
-   found, and if the certification path cannot be validated on the basis
-   of identified policies, then the certification path is considered
-   invalid.
-
-6.3  CRL Validation
-
-   This section describes the steps necessary to determine if a
-   certificate is revoked or on hold status when CRLs are the revocation
-   mechanism used by the certificate issuer.  Conforming implementations
-   that support CRLs are not required to implement this algorithm, but
-   they MUST be functionally equivalent to the external behavior
-   resulting from this procedure.  Any algorithm may be used by a
-   particular implementation so long as it derives the correct result.
-
-   This algorithm assumes that all of the needed CRLs are available in a
-   local cache.  Further, if the next update time of a CRL has passed,
-   the algorithm assumes a mechanism to fetch a current CRL and place it
-   in the local CRL cache.
-
-   This algorithm defines a set of inputs, a set of state variables, and
-   processing steps that are performed for each certificate in the path.
-   The algorithm output is the revocation status of the certificate.
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 81]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-6.3.1  Revocation Inputs
-
-   To support revocation processing, the algorithm requires two inputs:
-
-      (a)  certificate:  The algorithm requires the certificate serial
-      number and issuer name to determine whether a certificate is on a
-      particular CRL.  The basicConstraints extension is used to
-      determine whether the supplied certificate is associated with a CA
-      or an end entity.  If present, the algorithm uses the
-      cRLDistributionsPoint and freshestCRL extensions to determine
-      revocation status.
-
-      (b)  use-deltas:  This boolean input determines whether delta CRLs
-      are applied to CRLs.
-
-      Note that implementations supporting legacy PKIs, such as RFC 1422
-      and X.509 version 1, will need an additional input indicating
-      whether the supplied certificate is associated with a CA or an end
-      entity.
-
-6.3.2  Initialization and Revocation State Variables
-
-   To support CRL processing, the algorithm requires the following state
-   variables:
-
-      (a)  reasons_mask:  This variable contains the set of revocation
-      reasons supported by the CRLs and delta CRLs processed so far.
-      The legal members of the set are the possible revocation reason
-      values: unspecified, keyCompromise, caCompromise,
-      affiliationChanged, superseded, cessationOfOperation,
-      certificateHold, privilegeWithdrawn, and aACompromise.  The
-      special value all-reasons is used to denote the set of all legal
-      members.  This variable is initialized to the empty set.
-
-      (b)  cert_status:  This variable contains the status of the
-      certificate.  This variable may be assigned one of the following
-      values: unspecified, keyCompromise, caCompromise,
-      affiliationChanged, superseded, cessationOfOperation,
-      certificateHold, removeFromCRL, privilegeWithdrawn, aACompromise,
-      the special value UNREVOKED, or the special value UNDETERMINED.
-      This variable is initialized to the special value UNREVOKED.
-
-      (c)  interim_reasons_mask:  This contains the set of revocation
-      reasons supported by the CRL or delta CRL currently being
-      processed.
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 82]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   Note: In some environments, it is not necessary to check all reason
-   codes.  For example, some environments are only concerned with
-   caCompromise and keyCompromise for CA certificates.  This algorithm
-   checks all reason codes.  Additional processing and state variables
-   may be necessary to limit the checking to a subset of the reason
-   codes.
-
-6.3.3  CRL Processing
-
-   This algorithm begins by assuming the certificate is not revoked.
-   The algorithm checks one or more CRLs until either the certificate
-   status is determined to be revoked or sufficient CRLs have been
-   checked to cover all reason codes.
-
-   For each distribution point (DP) in the certificate CRL distribution
-   points extension, for each corresponding CRL in the local CRL cache,
-   while ((reasons_mask is not all-reasons) and (cert_status is
-   UNREVOKED)) perform the following:
-
-      (a)  Update the local CRL cache by obtaining a complete CRL, a
-      delta CRL, or both, as required:
-
-         (1)  If the current time is after the value of the CRL next
-         update field, then do one of the following:
-
-            (i)  If use-deltas is set and either the certificate or the
-            CRL contains the freshest CRL extension, obtain a delta CRL
-            with the a next update value that is after the current time
-            and can be used to update the locally cached CRL as
-            specified in section 5.2.4.
-
-            (ii)  Update the local CRL cache with a current complete
-            CRL, verify that the current time is before the next update
-            value in the new CRL, and continue processing with the new
-            CRL.  If use-deltas is set, then obtain the current delta
-            CRL that can be used to update the new locally cached
-            complete CRL as specified in section 5.2.4.
-
-         (2)  If the current time is before the value of the next update
-         field and use-deltas is set, then obtain the current delta CRL
-         that can be used to update the locally cached complete CRL as
-         specified in section 5.2.4.
-
-      (b)  Verify the issuer and scope of the complete CRL as follows:
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 83]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-         (1)  If the DP includes cRLIssuer, then verify that the issuer
-         field in the complete CRL matches cRLIssuer in the DP and that
-         the complete CRL contains an issuing distribution point
-         extension with the indrectCRL boolean asserted.  Otherwise,
-         verify that the CRL issuer matches the certificate issuer.
-
-         (2)  If the complete CRL includes an issuing distribution point
-         (IDP) CRL extension check the following:
-
-            (i)  If the distribution point name is present in the IDP
-            CRL extension and the distribution field is present in the
-            DP, then verify that one of the names in the IDP matches one
-            of the names in the DP.  If the distribution point name is
-            present in the IDP CRL extension and the distribution field
-            is omitted from the DP, then verify that one of the names in
-            the IDP matches one of the names in the cRLIssuer field of
-            the DP.
-
-            (ii)  If the onlyContainsUserCerts boolean is asserted in
-            the IDP CRL extension, verify that the certificate does not
-            include the basic constraints extension with the cA boolean
-            asserted.
-
-            (iii)  If the onlyContainsCACerts boolean is asserted in the
-            IDP CRL extension, verify that the certificate includes the
-            basic constraints extension with the cA boolean asserted.
-
-            (iv)  Verify that the onlyContainsAttributeCerts boolean is
-            not asserted.
-
-      (c)  If use-deltas is set, verify the issuer and scope of the
-      delta CRL as follows:
-
-         (1)  Verify that the delta CRL issuer matches complete CRL
-         issuer.
-
-         (2)  If the complete CRL includes an issuing distribution point
-         (IDP) CRL extension, verify that the delta CRL contains a
-         matching IDP CRL extension.  If the complete CRL omits an IDP
-         CRL extension, verify that the delta CRL also omits an IDP CRL
-         extension.
-
-         (3)  Verify that the delta CRL authority key identifier
-         extension matches complete CRL authority key identifier
-         extension.
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 84]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   (d)  Compute the interim_reasons_mask for this CRL as follows:
-
-         (1)  If the issuing distribution point (IDP) CRL extension is
-         present and includes onlySomeReasons and the DP includes
-         reasons, then set interim_reasons_mask to the intersection of
-         reasons in the DP and onlySomeReasons in IDP CRL extension.
-
-         (2)  If the IDP CRL extension includes onlySomeReasons but the
-         DP omits reasons, then set interim_reasons_mask to the value of
-         onlySomeReasons in IDP CRL extension.
-
-         (3)  If the IDP CRL extension is not present or omits
-         onlySomeReasons but the DP includes reasons, then set
-         interim_reasons_mask to the value of DP reasons.
-
-         (4)  If the IDP CRL extension is not present or omits
-         onlySomeReasons and the DP omits reasons, then set
-         interim_reasons_mask to the special value all-reasons.
-
-   (e)  Verify that interim_reasons_mask includes one or more reasons
-   that is not included in the reasons_mask.
-
-   (f)  Obtain and validate the certification path for the complete CRL
-   issuer.  If a key usage extension is present in the CRL issuer's
-   certificate, verify that the cRLSign bit is set.
-
-   (g)  Validate the signature on the complete CRL using the public key
-   validated in step (f).
-
-   (h)  If use-deltas is set, then validate the signature on the delta
-   CRL using the public key validated in step (f).
-
-   (i)  If use-deltas is set, then search for the certificate on the
-   delta CRL.  If an entry is found that matches the certificate issuer
-   and serial number as described in section 5.3.4, then set the
-   cert_status variable to the indicated reason as follows:
-
-         (1)  If the reason code CRL entry extension is present, set the
-         cert_status variable to the value of the reason code CRL entry
-         extension.
-
-         (2)  If the reason code CRL entry extension is not present, set
-         the cert_status variable to the value unspecified.
-
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 85]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-      (j)  If (cert_status is UNREVOKED), then search for the
-      certificate on the complete CRL.  If an entry is found that
-      matches the certificate issuer and serial number as described in
-      section 5.3.4, then set the cert_status variable to the indicated
-      reason as described in step (i).
-
-      (k)  If (cert_status is removeFromCRL), then set cert_status to
-      UNREVOKED.
-
-   If ((reasons_mask is all-reasons) OR (cert_status is not UNREVOKED)),
-   then the revocation status has been determined, so return
-   cert_status.
-
-   If the revocation status has not been determined, repeat the process
-   above with any available CRLs not specified in a distribution point
-   but issued by the certificate issuer.  For the processing of such a
-   CRL, assume a DP with both the reasons and the cRLIssuer fields
-   omitted and a distribution point name of the certificate issuer.
-   That is, the sequence of names in fullName is generated from the
-   certificate issuer field as well as the certificate issuerAltName
-   extension.  If the revocation status remains undetermined, then
-   return the cert_status UNDETERMINED.
-
-7  References
-
-   [ISO 10646] ISO/IEC 10646-1:1993.  International Standard --
-               Information technology -- Universal Multiple-Octet Coded
-               Character Set (UCS) -- Part 1: Architecture and Basic
-               Multilingual Plane.
-
-   [RFC 791]   Postel, J.,  "Internet Protocol", STD 5, RFC 791,
-               September 1981.
-
-   [RFC 822]   Crocker, D., "Standard for the format of ARPA Internet
-               text messages", STD 11, RFC 822, August 1982.
-
-   [RFC 1034]  Mockapetris, P., "Domain Names - Concepts and
-               Facilities", STD 13, RFC 1034, November 1987.
-
-   [RFC 1422]  Kent, S., "Privacy Enhancement for Internet Electronic
-               Mail: Part II: Certificate-Based Key Management," RFC
-               1422, February 1993.
-
-   [RFC 1423]  Balenson, D., "Privacy Enhancement for Internet
-               Electronic Mail: Part III: Algorithms, Modes, and
-               Identifiers," RFC 1423, February 1993.
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 86]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   [RFC 1510]  Kohl, J. and C. Neuman, "The Kerberos Network
-               Authentication Service (V5)," RFC 1510, September 1993.
-
-   [RFC 1519]  Fuller, V., T. Li, J. Yu and K. Varadhan, "Classless
-               Inter-Domain Routing (CIDR): An Address Assignment and
-               Aggregation Strategy", RFC 1519, September 1993.
-
-   [RFC 1738]  Berners-Lee, T., L. Masinter and M. McCahill, "Uniform
-               Resource Locators (URL)", RFC 1738, December 1994.
-
-   [RFC 1778]  Howes, T., S. Kille, W. Yeong and C. Robbins, "The String
-               Representation of Standard Attribute Syntaxes," RFC 1778,
-               March 1995.
-
-   [RFC 1883]  Deering, S. and R. Hinden.  "Internet Protocol, Version 6
-               (IPv6) Specification", RFC 1883, December 1995.
-
-   [RFC 2044]  F. Yergeau, F., "UTF-8, a transformation format of
-               Unicode and ISO 10646", RFC 2044, October 1996.
-
-   [RFC 2119]  Bradner, S., "Key words for use in RFCs to Indicate
-               Requirement Levels", BCP 14, RFC 2119, March 1997.
-
-   [RFC 2247]  Kille, S., M. Wahl, A. Grimstad, R. Huber and S.
-               Sataluri, "Using Domains in LDAP/X.500 Distinguished
-               Names", RFC 2247, January 1998.
-
-   [RFC 2252]  Wahl, M., A. Coulbeck, T. Howes and S. Kille,
-               "Lightweight Directory Access Protocol (v3):  Attribute
-               Syntax Definitions", RFC 2252, December 1997.
-
-   [RFC 2277]  Alvestrand, H., "IETF Policy on Character Sets and
-               Languages", BCP 18, RFC 2277, January 1998.
-
-   [RFC 2279]  Yergeau, F., "UTF-8, a transformation format of ISO
-               10646", RFC 2279, January 1998.
-
-   [RFC 2459]  Housley, R., W. Ford, W. Polk and D. Solo, "Internet
-               X.509 Public Key Infrastructure: Certificate and CRL
-               Profile", RFC 2459, January 1999.
-
-   [RFC 2560]  Myers, M., R. Ankney, A. Malpani, S. Galperin and C.
-               Adams, "Online Certificate Status Protocal - OCSP", June
-               1999.
-
-   [SDN.701]   SDN.701, "Message Security Protocol 4.0", Revision A,
-               1997-02-06.
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 87]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   [X.501]     ITU-T Recommendation X.501: Information Technology - Open
-               Systems Interconnection - The Directory: Models, 1993.
-
-   [X.509]     ITU-T Recommendation X.509 (1997 E): Information
-               Technology - Open Systems Interconnection - The
-               Directory: Authentication Framework, June 1997.
-
-   [X.520]     ITU-T Recommendation X.520: Information Technology - Open
-               Systems Interconnection - The Directory: Selected
-               Attribute Types, 1993.
-
-   [X.660]     ITU-T Recommendation X.660 Information Technology - ASN.1
-               encoding rules: Specification of Basic Encoding Rules
-               (BER), Canonical Encoding Rules (CER) and Distinguished
-               Encoding Rules (DER), 1997.
-
-   [X.690]     ITU-T Recommendation X.690 Information Technology - Open
-               Systems Interconnection - Procedures for the operation of
-               OSI Registration Authorities: General procedures, 1992.
-
-   [X9.55]     ANSI X9.55-1995, Public Key Cryptography For The
-               Financial Services Industry: Extensions To Public Key
-               Certificates And Certificate Revocation Lists, 8
-               December, 1995.
-
-   [PKIXALGS]  Bassham, L., Polk, W. and R. Housley, "Algorithms and
-               Identifiers for the Internet X.509 Public Key
-               Infrastructure Certificate and Certificate Revocation
-               Lists (CRL) Profile", RFC 3279, April 2002.
-
-   [PKIXTSA]   Adams, C., Cain, P., Pinkas, D. and R. Zuccherato,
-               "Internet X.509 Public Key Infrastructure Time-Stamp
-               Protocol (TSP)", RFC 3161, August 2001.
-
-8  Intellectual Property Rights
-
-   The IETF has been notified of intellectual property rights claimed in
-   regard to some or all of the specification contained in this
-   document.  For more information consult the online list of claimed
-   rights (see http://www.ietf.org/ipr.html).
-
-   The IETF takes no position regarding the validity or scope of any
-   intellectual property or other rights that might be claimed to
-   pertain to the implementation or use of the technology described in
-   this document or the extent to which any license under such rights
-   might or might not be available; neither does it represent that it
-   has made any effort to identify any such rights.  Information on the
-   IETF's procedures with respect to rights in standards-track and
-
-
-
-Housley, et. al.            Standards Track                    [Page 88]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   standards-related documentation can be found in BCP 11.  Copies of
-   claims of rights made available for publication and any assurances of
-   licenses to be made available, or the result of an attempt made to
-   obtain a general license or permission for the use of such
-   proprietary rights by implementors or users of this specification can
-   be obtained from the IETF Secretariat.
-
-9  Security Considerations
-
-   The majority of this specification is devoted to the format and
-   content of certificates and CRLs.  Since certificates and CRLs are
-   digitally signed, no additional integrity service is necessary.
-   Neither certificates nor CRLs need be kept secret, and unrestricted
-   and anonymous access to certificates and CRLs has no security
-   implications.
-
-   However, security factors outside the scope of this specification
-   will affect the assurance provided to certificate users.  This
-   section highlights critical issues to be considered by implementers,
-   administrators, and users.
-
-   The procedures performed by CAs and RAs to validate the binding of
-   the subject's identity to their public key greatly affect the
-   assurance that ought to be placed in the certificate.  Relying
-   parties might wish to review the CA's certificate practice statement.
-   This is particularly important when issuing certificates to other
-   CAs.
-
-   The use of a single key pair for both signature and other purposes is
-   strongly discouraged.  Use of separate key pairs for signature and
-   key management provides several benefits to the users.  The
-   ramifications associated with loss or disclosure of a signature key
-   are different from loss or disclosure of a key management key.  Using
-   separate key pairs permits a balanced and flexible response.
-   Similarly, different validity periods or key lengths for each key
-   pair may be appropriate in some application environments.
-   Unfortunately, some legacy applications (e.g., SSL) use a single key
-   pair for signature and key management.
-
-   The protection afforded private keys is a critical security factor.
-   On a small scale, failure of users to protect their private keys will
-   permit an attacker to masquerade as them, or decrypt their personal
-   information.  On a larger scale, compromise of a CA's private signing
-   key may have a catastrophic effect.  If an attacker obtains the
-   private key unnoticed, the attacker may issue bogus certificates and
-   CRLs.  Existence of bogus certificates and CRLs will undermine
-   confidence in the system.  If such a compromise is detected, all
-   certificates issued to the compromised CA MUST be revoked, preventing
-
-
-
-Housley, et. al.            Standards Track                    [Page 89]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   services between its users and users of other CAs.  Rebuilding after
-   such a compromise will be problematic, so CAs are advised to
-   implement a combination of strong technical measures (e.g., tamper-
-   resistant cryptographic modules) and appropriate management
-   procedures (e.g., separation of duties) to avoid such an incident.
-
-   Loss of a CA's private signing key may also be problematic.  The CA
-   would not be able to produce CRLs or perform normal key rollover.
-   CAs SHOULD maintain secure backup for signing keys.  The security of
-   the key backup procedures is a critical factor in avoiding key
-   compromise.
-
-   The availability and freshness of revocation information affects the
-   degree of assurance that ought to be placed in a certificate.  While
-   certificates expire naturally, events may occur during its natural
-   lifetime which negate the binding between the subject and public key.
-   If revocation information is untimely or unavailable, the assurance
-   associated with the binding is clearly reduced.  Relying parties
-   might not be able to process every critical extension that can appear
-   in a CRL.  CAs SHOULD take extra care when making revocation
-   information available only through CRLs that contain critical
-   extensions, particularly if support for those extensions is not
-   mandated by this profile.  For example, if revocation information is
-   supplied using a combination of delta CRLs and full CRLs, and the
-   delta CRLs are issued more frequently than the full CRLs, then
-   relying parties that cannot handle the critical extensions related to
-   delta CRL processing will not be able to obtain the most recent
-   revocation information.  Alternatively, if a full CRL is issued
-   whenever a delta CRL is issued, then timely revocation information
-   will be available to all relying parties.  Similarly, implementations
-   of the certification path validation mechanism described in section 6
-   that omit revocation checking provide less assurance than those that
-   support it.
-
-   The certification path validation algorithm depends on the certain
-   knowledge of the public keys (and other information) about one or
-   more trusted CAs.  The decision to trust a CA is an important
-   decision as it ultimately determines the trust afforded a
-   certificate.  The authenticated distribution of trusted CA public
-   keys (usually in the form of a "self-signed" certificate) is a
-   security critical out-of-band process that is beyond the scope of
-   this specification.
-
-   In addition, where a key compromise or CA failure occurs for a
-   trusted CA, the user will need to modify the information provided to
-   the path validation routine.  Selection of too many trusted CAs makes
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 90]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   the trusted CA information difficult to maintain.  On the other hand,
-   selection of only one trusted CA could limit users to a closed
-   community of users.
-
-   The quality of implementations that process certificates also affects
-   the degree of assurance provided.  The path validation algorithm
-   described in section 6 relies upon the integrity of the trusted CA
-   information, and especially the integrity of the public keys
-   associated with the trusted CAs.  By substituting public keys for
-   which an attacker has the private key, an attacker could trick the
-   user into accepting false certificates.
-
-   The binding between a key and certificate subject cannot be stronger
-   than the cryptographic module implementation and algorithms used to
-   generate the signature.  Short key lengths or weak hash algorithms
-   will limit the utility of a certificate.  CAs are encouraged to note
-   advances in cryptology so they can employ strong cryptographic
-   techniques.  In addition, CAs SHOULD decline to issue certificates to
-   CAs or end entities that generate weak signatures.
-
-   Inconsistent application of name comparison rules can result in
-   acceptance of invalid X.509 certification paths, or rejection of
-   valid ones.  The X.500 series of specifications defines rules for
-   comparing distinguished names that require comparison of strings
-   without regard to case, character set, multi-character white space
-   substring, or leading and trailing white space.  This specification
-   relaxes these requirements, requiring support for binary comparison
-   at a minimum.
-
-   CAs MUST encode the distinguished name in the subject field of a CA
-   certificate identically to the distinguished name in the issuer field
-   in certificates issued by that CA.  If CAs use different encodings,
-   implementations might fail to recognize name chains for paths that
-   include this certificate.  As a consequence, valid paths could be
-   rejected.
-
-   In addition, name constraints for distinguished names MUST be stated
-   identically to the encoding used in the subject field or
-   subjectAltName extension.  If not, then name constraints stated as
-   excludedSubTrees will not match and invalid paths will be accepted
-   and name constraints expressed as permittedSubtrees will not match
-   and valid paths will be rejected.  To avoid acceptance of invalid
-   paths, CAs SHOULD state name constraints for distinguished names as
-   permittedSubtrees wherever possible.
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 91]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-Appendix A.  Psuedo-ASN.1 Structures and OIDs
-
-   This section describes data objects used by conforming PKI components
-   in an "ASN.1-like" syntax.  This syntax is a hybrid of the 1988 and
-   1993 ASN.1 syntaxes.  The 1988 ASN.1 syntax is augmented with 1993
-   UNIVERSAL Types UniversalString, BMPString and UTF8String.
-
-   The ASN.1 syntax does not permit the inclusion of type statements in
-   the ASN.1 module, and the 1993 ASN.1 standard does not permit use of
-   the new UNIVERSAL types in modules using the 1988 syntax.  As a
-   result, this module does not conform to either version of the ASN.1
-   standard.
-
-   This appendix may be converted into 1988 ASN.1 by replacing the
-   definitions for the UNIVERSAL Types with the 1988 catch-all "ANY".
-
-A.1 Explicitly Tagged Module, 1988 Syntax
-
-PKIX1Explicit88 { iso(1) identified-organization(3) dod(6) internet(1)
-  security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-explicit(18) }
-
-DEFINITIONS EXPLICIT TAGS ::=
-
-BEGIN
-
--- EXPORTS ALL --
-
--- IMPORTS NONE --
-
--- UNIVERSAL Types defined in 1993 and 1998 ASN.1
--- and required by this specification
-
-UniversalString ::= [UNIVERSAL 28] IMPLICIT OCTET STRING
-        -- UniversalString is defined in ASN.1:1993
-
-BMPString ::= [UNIVERSAL 30] IMPLICIT OCTET STRING
-      -- BMPString is the subtype of UniversalString and models
-      -- the Basic Multilingual Plane of ISO/IEC/ITU 10646-1
-
-UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING
-      -- The content of this type conforms to RFC 2279.
-
--- PKIX specific OIDs
-
-id-pkix  OBJECT IDENTIFIER  ::=
-         { iso(1) identified-organization(3) dod(6) internet(1)
-                    security(5) mechanisms(5) pkix(7) }
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 92]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
--- PKIX arcs
-
-id-pe OBJECT IDENTIFIER  ::=  { id-pkix 1 }
-        -- arc for private certificate extensions
-id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
-        -- arc for policy qualifier types
-id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
-        -- arc for extended key purpose OIDS
-id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
-        -- arc for access descriptors
-
--- policyQualifierIds for Internet policy qualifiers
-
-id-qt-cps      OBJECT IDENTIFIER ::=  { id-qt 1 }
-      -- OID for CPS qualifier
-id-qt-unotice  OBJECT IDENTIFIER ::=  { id-qt 2 }
-      -- OID for user notice qualifier
-
--- access descriptor definitions
-
-id-ad-ocsp         OBJECT IDENTIFIER ::= { id-ad 1 }
-id-ad-caIssuers    OBJECT IDENTIFIER ::= { id-ad 2 }
-id-ad-timeStamping OBJECT IDENTIFIER ::= { id-ad 3 }
-id-ad-caRepository OBJECT IDENTIFIER ::= { id-ad 5 }
-
--- attribute data types
-
-Attribute       ::=     SEQUENCE {
-      type              AttributeType,
-      values    SET OF AttributeValue }
-            -- at least one value is required
-
-AttributeType           ::=  OBJECT IDENTIFIER
-
-AttributeValue          ::=  ANY
-
-AttributeTypeAndValue           ::=     SEQUENCE {
-        type    AttributeType,
-        value   AttributeValue }
-
--- suggested naming attributes: Definition of the following
---   information object set may be augmented to meet local
---   requirements.  Note that deleting members of the set may
---   prevent interoperability with conforming implementations.
--- presented in pairs: the AttributeType followed by the
---   type definition for the corresponding AttributeValue
---Arc for standard naming attributes
-id-at OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) ds(5) 4 }
-
-
-
-Housley, et. al.            Standards Track                    [Page 93]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
--- Naming attributes of type X520name
-
-id-at-name              AttributeType ::= { id-at 41 }
-id-at-surname           AttributeType ::= { id-at 4 }
-id-at-givenName         AttributeType ::= { id-at 42 }
-id-at-initials          AttributeType ::= { id-at 43 }
-id-at-generationQualifier AttributeType ::= { id-at 44 }
-
-X520name ::= CHOICE {
-      teletexString     TeletexString   (SIZE (1..ub-name)),
-      printableString   PrintableString (SIZE (1..ub-name)),
-      universalString   UniversalString (SIZE (1..ub-name)),
-      utf8String        UTF8String      (SIZE (1..ub-name)),
-      bmpString         BMPString       (SIZE (1..ub-name)) }
-
--- Naming attributes of type X520CommonName
-
-id-at-commonName        AttributeType ::= { id-at 3 }
-
-X520CommonName ::= CHOICE {
-      teletexString     TeletexString   (SIZE (1..ub-common-name)),
-      printableString   PrintableString (SIZE (1..ub-common-name)),
-      universalString   UniversalString (SIZE (1..ub-common-name)),
-      utf8String        UTF8String      (SIZE (1..ub-common-name)),
-      bmpString         BMPString       (SIZE (1..ub-common-name)) }
-
--- Naming attributes of type X520LocalityName
-
-id-at-localityName      AttributeType ::= { id-at 7 }
-
-X520LocalityName ::= CHOICE {
-      teletexString     TeletexString   (SIZE (1..ub-locality-name)),
-      printableString   PrintableString (SIZE (1..ub-locality-name)),
-      universalString   UniversalString (SIZE (1..ub-locality-name)),
-      utf8String        UTF8String      (SIZE (1..ub-locality-name)),
-      bmpString         BMPString       (SIZE (1..ub-locality-name)) }
-
--- Naming attributes of type X520StateOrProvinceName
-
-id-at-stateOrProvinceName AttributeType ::= { id-at 8 }
-
-X520StateOrProvinceName ::= CHOICE {
-      teletexString     TeletexString   (SIZE (1..ub-state-name)),
-      printableString   PrintableString (SIZE (1..ub-state-name)),
-      universalString   UniversalString (SIZE (1..ub-state-name)),
-      utf8String        UTF8String      (SIZE (1..ub-state-name)),
-      bmpString         BMPString       (SIZE(1..ub-state-name)) }
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 94]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
--- Naming attributes of type X520OrganizationName
-
-id-at-organizationName  AttributeType ::= { id-at 10 }
-
-X520OrganizationName ::= CHOICE {
-      teletexString     TeletexString
-                          (SIZE (1..ub-organization-name)),
-      printableString   PrintableString
-                          (SIZE (1..ub-organization-name)),
-      universalString   UniversalString
-                          (SIZE (1..ub-organization-name)),
-      utf8String        UTF8String
-                          (SIZE (1..ub-organization-name)),
-      bmpString         BMPString
-                          (SIZE (1..ub-organization-name))  }
-
--- Naming attributes of type X520OrganizationalUnitName
-
-id-at-organizationalUnitName AttributeType ::= { id-at 11 }
-
-X520OrganizationalUnitName ::= CHOICE {
-      teletexString     TeletexString
-                          (SIZE (1..ub-organizational-unit-name)),
-      printableString   PrintableString
-                          (SIZE (1..ub-organizational-unit-name)),
-      universalString   UniversalString
-                          (SIZE (1..ub-organizational-unit-name)),
-      utf8String        UTF8String
-                          (SIZE (1..ub-organizational-unit-name)),
-      bmpString         BMPString
-                          (SIZE (1..ub-organizational-unit-name)) }
-
--- Naming attributes of type X520Title
-
-id-at-title             AttributeType ::= { id-at 12 }
-
-X520Title ::= CHOICE {
-      teletexString     TeletexString   (SIZE (1..ub-title)),
-      printableString   PrintableString (SIZE (1..ub-title)),
-      universalString   UniversalString (SIZE (1..ub-title)),
-      utf8String        UTF8String      (SIZE (1..ub-title)),
-      bmpString         BMPString       (SIZE (1..ub-title)) }
-
--- Naming attributes of type X520dnQualifier
-
-id-at-dnQualifier       AttributeType ::= { id-at 46 }
-
-X520dnQualifier ::=     PrintableString
-
-
-
-Housley, et. al.            Standards Track                    [Page 95]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
--- Naming attributes of type X520countryName (digraph from IS 3166)
-
-id-at-countryName       AttributeType ::= { id-at 6 }
-
-X520countryName ::=     PrintableString (SIZE (2))
-
--- Naming attributes of type X520SerialNumber
-
-id-at-serialNumber      AttributeType ::= { id-at 5 }
-
-X520SerialNumber ::=    PrintableString (SIZE (1..ub-serial-number))
-
--- Naming attributes of type X520Pseudonym
-
-id-at-pseudonym         AttributeType ::= { id-at 65 }
-
-X520Pseudonym ::= CHOICE {
-   teletexString     TeletexString   (SIZE (1..ub-pseudonym)),
-   printableString   PrintableString (SIZE (1..ub-pseudonym)),
-   universalString   UniversalString (SIZE (1..ub-pseudonym)),
-   utf8String        UTF8String      (SIZE (1..ub-pseudonym)),
-   bmpString         BMPString       (SIZE (1..ub-pseudonym)) }
-
--- Naming attributes of type DomainComponent (from RFC 2247)
-
-id-domainComponent      AttributeType ::=
-                          { 0 9 2342 19200300 100 1 25 }
-
-DomainComponent ::=     IA5String
-
--- Legacy attributes
-
-pkcs-9 OBJECT IDENTIFIER ::=
-       { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 }
-
-id-emailAddress          AttributeType ::= { pkcs-9 1 }
-
-EmailAddress ::=         IA5String (SIZE (1..ub-emailaddress-length))
-
--- naming data types --
-
-Name ::= CHOICE { -- only one possibility for now --
-      rdnSequence  RDNSequence }
-
-RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
-
-DistinguishedName ::=   RDNSequence
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 96]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-RelativeDistinguishedName  ::=
-                    SET SIZE (1 .. MAX) OF AttributeTypeAndValue
-
--- Directory string type --
-
-DirectoryString ::= CHOICE {
-      teletexString             TeletexString   (SIZE (1..MAX)),
-      printableString           PrintableString (SIZE (1..MAX)),
-      universalString           UniversalString (SIZE (1..MAX)),
-      utf8String              UTF8String      (SIZE (1..MAX)),
-      bmpString               BMPString       (SIZE (1..MAX)) }
-
--- certificate and CRL specific structures begin here
-
-Certificate  ::=  SEQUENCE  {
-     tbsCertificate       TBSCertificate,
-     signatureAlgorithm   AlgorithmIdentifier,
-     signature            BIT STRING  }
-
-TBSCertificate  ::=  SEQUENCE  {
-     version         [0]  Version DEFAULT v1,
-     serialNumber         CertificateSerialNumber,
-     signature            AlgorithmIdentifier,
-     issuer               Name,
-     validity             Validity,
-     subject              Name,
-     subjectPublicKeyInfo SubjectPublicKeyInfo,
-     issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
-                          -- If present, version MUST be v2 or v3
-     subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
-                          -- If present, version MUST be v2 or v3
-     extensions      [3]  Extensions OPTIONAL
-                          -- If present, version MUST be v3 --  }
-
-Version  ::=  INTEGER  {  v1(0), v2(1), v3(2)  }
-
-CertificateSerialNumber  ::=  INTEGER
-
-Validity ::= SEQUENCE {
-     notBefore      Time,
-     notAfter       Time  }
-
-Time ::= CHOICE {
-     utcTime        UTCTime,
-     generalTime    GeneralizedTime }
-
-UniqueIdentifier  ::=  BIT STRING
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 97]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-SubjectPublicKeyInfo  ::=  SEQUENCE  {
-     algorithm            AlgorithmIdentifier,
-     subjectPublicKey     BIT STRING  }
-
-Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension
-
-Extension  ::=  SEQUENCE  {
-     extnID      OBJECT IDENTIFIER,
-     critical    BOOLEAN DEFAULT FALSE,
-     extnValue   OCTET STRING  }
-
--- CRL structures
-
-CertificateList  ::=  SEQUENCE  {
-     tbsCertList          TBSCertList,
-     signatureAlgorithm   AlgorithmIdentifier,
-     signature            BIT STRING  }
-
-TBSCertList  ::=  SEQUENCE  {
-     version                 Version OPTIONAL,
-                                  -- if present, MUST be v2
-     signature               AlgorithmIdentifier,
-     issuer                  Name,
-     thisUpdate              Time,
-     nextUpdate              Time OPTIONAL,
-     revokedCertificates     SEQUENCE OF SEQUENCE  {
-          userCertificate         CertificateSerialNumber,
-          revocationDate          Time,
-          crlEntryExtensions      Extensions OPTIONAL
-                                         -- if present, MUST be v2
-                               }  OPTIONAL,
-     crlExtensions           [0] Extensions OPTIONAL }
-                                         -- if present, MUST be v2
-
--- Version, Time, CertificateSerialNumber, and Extensions were
--- defined earlier for use in the certificate structure
-
-AlgorithmIdentifier  ::=  SEQUENCE  {
-     algorithm               OBJECT IDENTIFIER,
-     parameters              ANY DEFINED BY algorithm OPTIONAL  }
-                                -- contains a value of the type
-                                -- registered for use with the
-                                -- algorithm object identifier value
-
--- X.400 address syntax starts here
-
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 98]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-ORAddress ::= SEQUENCE {
-   built-in-standard-attributes BuiltInStandardAttributes,
-   built-in-domain-defined-attributes
-                   BuiltInDomainDefinedAttributes OPTIONAL,
-   -- see also teletex-domain-defined-attributes
-   extension-attributes ExtensionAttributes OPTIONAL }
-
--- Built-in Standard Attributes
-
-BuiltInStandardAttributes ::= SEQUENCE {
-   country-name                  CountryName OPTIONAL,
-   administration-domain-name    AdministrationDomainName OPTIONAL,
-   network-address           [0] IMPLICIT NetworkAddress OPTIONAL,
-     -- see also extended-network-address
-   terminal-identifier       [1] IMPLICIT TerminalIdentifier OPTIONAL,
-   private-domain-name       [2] PrivateDomainName OPTIONAL,
-   organization-name         [3] IMPLICIT OrganizationName OPTIONAL,
-     -- see also teletex-organization-name
-   numeric-user-identifier   [4] IMPLICIT NumericUserIdentifier
-                                 OPTIONAL,
-   personal-name             [5] IMPLICIT PersonalName OPTIONAL,
-     -- see also teletex-personal-name
-   organizational-unit-names [6] IMPLICIT OrganizationalUnitNames
-                                 OPTIONAL }
-     -- see also teletex-organizational-unit-names
-
-CountryName ::= [APPLICATION 1] CHOICE {
-   x121-dcc-code         NumericString
-                           (SIZE (ub-country-name-numeric-length)),
-   iso-3166-alpha2-code  PrintableString
-                           (SIZE (ub-country-name-alpha-length)) }
-
-AdministrationDomainName ::= [APPLICATION 2] CHOICE {
-   numeric   NumericString   (SIZE (0..ub-domain-name-length)),
-   printable PrintableString (SIZE (0..ub-domain-name-length)) }
-
-NetworkAddress ::= X121Address  -- see also extended-network-address
-
-X121Address ::= NumericString (SIZE (1..ub-x121-address-length))
-
-TerminalIdentifier ::= PrintableString (SIZE
-(1..ub-terminal-id-length))
-
-PrivateDomainName ::= CHOICE {
-   numeric   NumericString   (SIZE (1..ub-domain-name-length)),
-   printable PrintableString (SIZE (1..ub-domain-name-length)) }
-
-
-
-
-
-Housley, et. al.            Standards Track                    [Page 99]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-OrganizationName ::= PrintableString
-                            (SIZE (1..ub-organization-name-length))
-  -- see also teletex-organization-name
-
-NumericUserIdentifier ::= NumericString
-                            (SIZE (1..ub-numeric-user-id-length))
-
-PersonalName ::= SET {
-   surname     [0] IMPLICIT PrintableString
-                    (SIZE (1..ub-surname-length)),
-   given-name  [1] IMPLICIT PrintableString
-                    (SIZE (1..ub-given-name-length)) OPTIONAL,
-   initials    [2] IMPLICIT PrintableString
-                    (SIZE (1..ub-initials-length)) OPTIONAL,
-   generation-qualifier [3] IMPLICIT PrintableString
-                    (SIZE (1..ub-generation-qualifier-length))
-                    OPTIONAL }
-  -- see also teletex-personal-name
-
-OrganizationalUnitNames ::= SEQUENCE SIZE (1..ub-organizational-units)
-                             OF OrganizationalUnitName
-  -- see also teletex-organizational-unit-names
-
-OrganizationalUnitName ::= PrintableString (SIZE
-                    (1..ub-organizational-unit-name-length))
-
--- Built-in Domain-defined Attributes
-
-BuiltInDomainDefinedAttributes ::= SEQUENCE SIZE
-                    (1..ub-domain-defined-attributes) OF
-                    BuiltInDomainDefinedAttribute
-
-BuiltInDomainDefinedAttribute ::= SEQUENCE {
-   type PrintableString (SIZE
-                   (1..ub-domain-defined-attribute-type-length)),
-   value PrintableString (SIZE
-                   (1..ub-domain-defined-attribute-value-length)) }
-
--- Extension Attributes
-
-ExtensionAttributes ::= SET SIZE (1..ub-extension-attributes) OF
-               ExtensionAttribute
-
-ExtensionAttribute ::=  SEQUENCE {
-   extension-attribute-type [0] IMPLICIT INTEGER
-                   (0..ub-extension-attributes),
-   extension-attribute-value [1]
-                   ANY DEFINED BY extension-attribute-type }
-
-
-
-Housley, et. al.            Standards Track                   [Page 100]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
--- Extension types and attribute values
-
-common-name INTEGER ::= 1
-
-CommonName ::= PrintableString (SIZE (1..ub-common-name-length))
-
-teletex-common-name INTEGER ::= 2
-
-TeletexCommonName ::= TeletexString (SIZE (1..ub-common-name-length))
-
-teletex-organization-name INTEGER ::= 3
-
-TeletexOrganizationName ::=
-                TeletexString (SIZE (1..ub-organization-name-length))
-
-teletex-personal-name INTEGER ::= 4
-
-TeletexPersonalName ::= SET {
-   surname     [0] IMPLICIT TeletexString
-                    (SIZE (1..ub-surname-length)),
-   given-name  [1] IMPLICIT TeletexString
-                    (SIZE (1..ub-given-name-length)) OPTIONAL,
-   initials    [2] IMPLICIT TeletexString
-                    (SIZE (1..ub-initials-length)) OPTIONAL,
-   generation-qualifier [3] IMPLICIT TeletexString
-                    (SIZE (1..ub-generation-qualifier-length))
-                    OPTIONAL }
-
-teletex-organizational-unit-names INTEGER ::= 5
-
-TeletexOrganizationalUnitNames ::= SEQUENCE SIZE
-      (1..ub-organizational-units) OF TeletexOrganizationalUnitName
-
-TeletexOrganizationalUnitName ::= TeletexString
-                  (SIZE (1..ub-organizational-unit-name-length))
-
-pds-name INTEGER ::= 7
-
-PDSName ::= PrintableString (SIZE (1..ub-pds-name-length))
-
-physical-delivery-country-name INTEGER ::= 8
-
-PhysicalDeliveryCountryName ::= CHOICE {
-   x121-dcc-code NumericString (SIZE
-(ub-country-name-numeric-length)),
-   iso-3166-alpha2-code PrintableString
-                  (SIZE (ub-country-name-alpha-length)) }
-
-
-
-
-Housley, et. al.            Standards Track                   [Page 101]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-postal-code INTEGER ::= 9
-
-PostalCode ::= CHOICE {
-   numeric-code NumericString (SIZE (1..ub-postal-code-length)),
-   printable-code PrintableString (SIZE (1..ub-postal-code-length)) }
-
-physical-delivery-office-name INTEGER ::= 10
-
-PhysicalDeliveryOfficeName ::= PDSParameter
-
-physical-delivery-office-number INTEGER ::= 11
-
-PhysicalDeliveryOfficeNumber ::= PDSParameter
-
-extension-OR-address-components INTEGER ::= 12
-
-ExtensionORAddressComponents ::= PDSParameter
-
-physical-delivery-personal-name INTEGER ::= 13
-
-PhysicalDeliveryPersonalName ::= PDSParameter
-
-physical-delivery-organization-name INTEGER ::= 14
-
-PhysicalDeliveryOrganizationName ::= PDSParameter
-
-extension-physical-delivery-address-components INTEGER ::= 15
-
-ExtensionPhysicalDeliveryAddressComponents ::= PDSParameter
-
-unformatted-postal-address INTEGER ::= 16
-
-UnformattedPostalAddress ::= SET {
-   printable-address SEQUENCE SIZE (1..ub-pds-physical-address-lines)
-         OF PrintableString (SIZE (1..ub-pds-parameter-length))
-         OPTIONAL,
-   teletex-string TeletexString
-         (SIZE (1..ub-unformatted-address-length)) OPTIONAL }
-
-street-address INTEGER ::= 17
-
-StreetAddress ::= PDSParameter
-
-post-office-box-address INTEGER ::= 18
-
-PostOfficeBoxAddress ::= PDSParameter
-
-poste-restante-address INTEGER ::= 19
-
-
-
-Housley, et. al.            Standards Track                   [Page 102]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-PosteRestanteAddress ::= PDSParameter
-
-unique-postal-name INTEGER ::= 20
-
-UniquePostalName ::= PDSParameter
-
-local-postal-attributes INTEGER ::= 21
-
-LocalPostalAttributes ::= PDSParameter
-
-PDSParameter ::= SET {
-   printable-string PrintableString
-                (SIZE(1..ub-pds-parameter-length)) OPTIONAL,
-   teletex-string TeletexString
-                (SIZE(1..ub-pds-parameter-length)) OPTIONAL }
-
-extended-network-address INTEGER ::= 22
-
-ExtendedNetworkAddress ::= CHOICE {
-   e163-4-address SEQUENCE {
-      number      [0] IMPLICIT NumericString
-                       (SIZE (1..ub-e163-4-number-length)),
-      sub-address [1] IMPLICIT NumericString
-                       (SIZE (1..ub-e163-4-sub-address-length))
-                       OPTIONAL },
-   psap-address [0] IMPLICIT PresentationAddress }
-
-PresentationAddress ::= SEQUENCE {
-    pSelector     [0] EXPLICIT OCTET STRING OPTIONAL,
-    sSelector     [1] EXPLICIT OCTET STRING OPTIONAL,
-    tSelector     [2] EXPLICIT OCTET STRING OPTIONAL,
-    nAddresses    [3] EXPLICIT SET SIZE (1..MAX) OF OCTET STRING }
-
-terminal-type  INTEGER ::= 23
-
-TerminalType ::= INTEGER {
-   telex (3),
-   teletex (4),
-   g3-facsimile (5),
-   g4-facsimile (6),
-   ia5-terminal (7),
-   videotex (8) } (0..ub-integer-options)
-
--- Extension Domain-defined Attributes
-
-teletex-domain-defined-attributes INTEGER ::= 6
-
-
-
-
-
-Housley, et. al.            Standards Track                   [Page 103]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-TeletexDomainDefinedAttributes ::= SEQUENCE SIZE
-   (1..ub-domain-defined-attributes) OF TeletexDomainDefinedAttribute
-
-TeletexDomainDefinedAttribute ::= SEQUENCE {
-        type TeletexString
-               (SIZE (1..ub-domain-defined-attribute-type-length)),
-        value TeletexString
-               (SIZE (1..ub-domain-defined-attribute-value-length)) }
-
---  specifications of Upper Bounds MUST be regarded as mandatory
---  from Annex B of ITU-T X.411 Reference Definition of MTS Parameter
---  Upper Bounds
-
--- Upper Bounds
-ub-name INTEGER ::= 32768
-ub-common-name INTEGER ::= 64
-ub-locality-name INTEGER ::= 128
-ub-state-name INTEGER ::= 128
-ub-organization-name INTEGER ::= 64
-ub-organizational-unit-name INTEGER ::= 64
-ub-title INTEGER ::= 64
-ub-serial-number INTEGER ::= 64
-ub-match INTEGER ::= 128
-ub-emailaddress-length INTEGER ::= 128
-ub-common-name-length INTEGER ::= 64
-ub-country-name-alpha-length INTEGER ::= 2
-ub-country-name-numeric-length INTEGER ::= 3
-ub-domain-defined-attributes INTEGER ::= 4
-ub-domain-defined-attribute-type-length INTEGER ::= 8
-ub-domain-defined-attribute-value-length INTEGER ::= 128
-ub-domain-name-length INTEGER ::= 16
-ub-extension-attributes INTEGER ::= 256
-ub-e163-4-number-length INTEGER ::= 15
-ub-e163-4-sub-address-length INTEGER ::= 40
-ub-generation-qualifier-length INTEGER ::= 3
-ub-given-name-length INTEGER ::= 16
-ub-initials-length INTEGER ::= 5
-ub-integer-options INTEGER ::= 256
-ub-numeric-user-id-length INTEGER ::= 32
-ub-organization-name-length INTEGER ::= 64
-ub-organizational-unit-name-length INTEGER ::= 32
-ub-organizational-units INTEGER ::= 4
-ub-pds-name-length INTEGER ::= 16
-ub-pds-parameter-length INTEGER ::= 30
-ub-pds-physical-address-lines INTEGER ::= 6
-ub-postal-code-length INTEGER ::= 16
-ub-pseudonym INTEGER ::= 128
-ub-surname-length INTEGER ::= 40
-
-
-
-Housley, et. al.            Standards Track                   [Page 104]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-ub-terminal-id-length INTEGER ::= 24
-ub-unformatted-address-length INTEGER ::= 180
-ub-x121-address-length INTEGER ::= 16
-
--- Note - upper bounds on string types, such as TeletexString, are
--- measured in characters.  Excepting PrintableString or IA5String, a
--- significantly greater number of octets will be required to hold
--- such a value.  As a minimum, 16 octets, or twice the specified
--- upper bound, whichever is the larger, should be allowed for
--- TeletexString.  For UTF8String or UniversalString at least four
--- times the upper bound should be allowed.
-
-END
-
-A.2 Implicitly Tagged Module, 1988 Syntax
-
-PKIX1Implicit88 { iso(1) identified-organization(3) dod(6) internet(1)
-  security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-implicit(19) }
-
-DEFINITIONS IMPLICIT TAGS ::=
-
-BEGIN
-
--- EXPORTS ALL --
-
-IMPORTS
-      id-pe, id-kp, id-qt-unotice, id-qt-cps,
-      -- delete following line if "new" types are supported --
-      BMPString, UTF8String,  -- end "new" types --
-      ORAddress, Name, RelativeDistinguishedName,
-      CertificateSerialNumber, Attribute, DirectoryString
-      FROM PKIX1Explicit88 { iso(1) identified-organization(3)
-            dod(6) internet(1) security(5) mechanisms(5) pkix(7)
-            id-mod(0) id-pkix1-explicit(18) };
-
-
--- ISO arc for standard certificate and CRL extensions
-
-id-ce OBJECT IDENTIFIER  ::=  {joint-iso-ccitt(2) ds(5) 29}
-
--- authority key identifier OID and syntax
-
-id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::=  { id-ce 35 }
-
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                   [Page 105]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-AuthorityKeyIdentifier ::= SEQUENCE {
-    keyIdentifier             [0] KeyIdentifier            OPTIONAL,
-    authorityCertIssuer       [1] GeneralNames             OPTIONAL,
-    authorityCertSerialNumber [2] CertificateSerialNumber  OPTIONAL }
-    -- authorityCertIssuer and authorityCertSerialNumber MUST both
-    -- be present or both be absent
-
-KeyIdentifier ::= OCTET STRING
-
--- subject key identifier OID and syntax
-
-id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::=  { id-ce 14 }
-
-SubjectKeyIdentifier ::= KeyIdentifier
-
--- key usage extension OID and syntax
-
-id-ce-keyUsage OBJECT IDENTIFIER ::=  { id-ce 15 }
-
-KeyUsage ::= BIT STRING {
-     digitalSignature        (0),
-     nonRepudiation          (1),
-     keyEncipherment         (2),
-     dataEncipherment        (3),
-     keyAgreement            (4),
-     keyCertSign             (5),
-     cRLSign                 (6),
-     encipherOnly            (7),
-     decipherOnly            (8) }
-
--- private key usage period extension OID and syntax
-
-id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::=  { id-ce 16 }
-
-PrivateKeyUsagePeriod ::= SEQUENCE {
-     notBefore       [0]     GeneralizedTime OPTIONAL,
-     notAfter        [1]     GeneralizedTime OPTIONAL }
-     -- either notBefore or notAfter MUST be present
-
--- certificate policies extension OID and syntax
-
-id-ce-certificatePolicies OBJECT IDENTIFIER ::=  { id-ce 32 }
-
-anyPolicy OBJECT IDENTIFIER ::= { id-ce-certificatePolicies 0 }
-
-CertificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
-
-PolicyInformation ::= SEQUENCE {
-
-
-
-Housley, et. al.            Standards Track                   [Page 106]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-     policyIdentifier   CertPolicyId,
-     policyQualifiers   SEQUENCE SIZE (1..MAX) OF
-             PolicyQualifierInfo OPTIONAL }
-
-CertPolicyId ::= OBJECT IDENTIFIER
-
-PolicyQualifierInfo ::= SEQUENCE {
-       policyQualifierId  PolicyQualifierId,
-       qualifier        ANY DEFINED BY policyQualifierId }
-
--- Implementations that recognize additional policy qualifiers MUST
--- augment the following definition for PolicyQualifierId
-
-PolicyQualifierId ::=
-    OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )
-
--- CPS pointer qualifier
-
-CPSuri ::= IA5String
-
--- user notice qualifier
-
-UserNotice ::= SEQUENCE {
-     noticeRef        NoticeReference OPTIONAL,
-     explicitText     DisplayText OPTIONAL}
-
-NoticeReference ::= SEQUENCE {
-     organization     DisplayText,
-     noticeNumbers    SEQUENCE OF INTEGER }
-
-DisplayText ::= CHOICE {
-     ia5String        IA5String      (SIZE (1..200)),
-     visibleString    VisibleString  (SIZE (1..200)),
-     bmpString        BMPString      (SIZE (1..200)),
-     utf8String       UTF8String     (SIZE (1..200)) }
-
--- policy mapping extension OID and syntax
-
-id-ce-policyMappings OBJECT IDENTIFIER ::=  { id-ce 33 }
-
-PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
-     issuerDomainPolicy      CertPolicyId,
-     subjectDomainPolicy     CertPolicyId }
-
--- subject alternative name extension OID and syntax
-
-id-ce-subjectAltName OBJECT IDENTIFIER ::=  { id-ce 17 }
-
-
-
-
-Housley, et. al.            Standards Track                   [Page 107]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-SubjectAltName ::= GeneralNames
-
-GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
-
-GeneralName ::= CHOICE {
-     otherName                       [0]     AnotherName,
-     rfc822Name                      [1]     IA5String,
-     dNSName                         [2]     IA5String,
-     x400Address                     [3]     ORAddress,
-     directoryName                   [4]     Name,
-     ediPartyName                    [5]     EDIPartyName,
-     uniformResourceIdentifier       [6]     IA5String,
-     iPAddress                       [7]     OCTET STRING,
-     registeredID                    [8]     OBJECT IDENTIFIER }
-
--- AnotherName replaces OTHER-NAME ::= TYPE-IDENTIFIER, as
--- TYPE-IDENTIFIER is not supported in the '88 ASN.1 syntax
-
-AnotherName ::= SEQUENCE {
-     type-id    OBJECT IDENTIFIER,
-     value      [0] EXPLICIT ANY DEFINED BY type-id }
-
-EDIPartyName ::= SEQUENCE {
-     nameAssigner            [0]     DirectoryString OPTIONAL,
-     partyName               [1]     DirectoryString }
-
--- issuer alternative name extension OID and syntax
-
-id-ce-issuerAltName OBJECT IDENTIFIER ::=  { id-ce 18 }
-
-IssuerAltName ::= GeneralNames
-
-id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::=  { id-ce 9 }
-
-SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF Attribute
-
--- basic constraints extension OID and syntax
-
-id-ce-basicConstraints OBJECT IDENTIFIER ::=  { id-ce 19 }
-
-BasicConstraints ::= SEQUENCE {
-     cA                      BOOLEAN DEFAULT FALSE,
-     pathLenConstraint       INTEGER (0..MAX) OPTIONAL }
-
--- name constraints extension OID and syntax
-
-id-ce-nameConstraints OBJECT IDENTIFIER ::=  { id-ce 30 }
-
-
-
-
-Housley, et. al.            Standards Track                   [Page 108]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-NameConstraints ::= SEQUENCE {
-     permittedSubtrees       [0]     GeneralSubtrees OPTIONAL,
-     excludedSubtrees        [1]     GeneralSubtrees OPTIONAL }
-
-GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
-
-GeneralSubtree ::= SEQUENCE {
-     base                    GeneralName,
-     minimum         [0]     BaseDistance DEFAULT 0,
-     maximum         [1]     BaseDistance OPTIONAL }
-
-BaseDistance ::= INTEGER (0..MAX)
-
--- policy constraints extension OID and syntax
-
-id-ce-policyConstraints OBJECT IDENTIFIER ::=  { id-ce 36 }
-
-PolicyConstraints ::= SEQUENCE {
-     requireExplicitPolicy           [0] SkipCerts OPTIONAL,
-     inhibitPolicyMapping            [1] SkipCerts OPTIONAL }
-
-SkipCerts ::= INTEGER (0..MAX)
-
--- CRL distribution points extension OID and syntax
-
-id-ce-cRLDistributionPoints     OBJECT IDENTIFIER  ::=  {id-ce 31}
-
-CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
-
-DistributionPoint ::= SEQUENCE {
-     distributionPoint       [0]     DistributionPointName OPTIONAL,
-     reasons                 [1]     ReasonFlags OPTIONAL,
-     cRLIssuer               [2]     GeneralNames OPTIONAL }
-
-DistributionPointName ::= CHOICE {
-     fullName                [0]     GeneralNames,
-     nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }
-
-ReasonFlags ::= BIT STRING {
-     unused                  (0),
-     keyCompromise           (1),
-     cACompromise            (2),
-     affiliationChanged      (3),
-     superseded              (4),
-     cessationOfOperation    (5),
-     certificateHold         (6),
-     privilegeWithdrawn      (7),
-     aACompromise            (8) }
-
-
-
-Housley, et. al.            Standards Track                   [Page 109]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
--- extended key usage extension OID and syntax
-
-id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}
-
-ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
-
-
-KeyPurposeId ::= OBJECT IDENTIFIER
-
--- permit unspecified key uses
-
-anyExtendedKeyUsage OBJECT IDENTIFIER ::= { id-ce-extKeyUsage 0 }
-
--- extended key purpose OIDs
-
-id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
-id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
-id-kp-codeSigning            OBJECT IDENTIFIER ::= { id-kp 3 }
-id-kp-emailProtection        OBJECT IDENTIFIER ::= { id-kp 4 }
-id-kp-timeStamping           OBJECT IDENTIFIER ::= { id-kp 8 }
-id-kp-OCSPSigning            OBJECT IDENTIFIER ::= { id-kp 9 }
-
--- inhibit any policy OID and syntax
-
-id-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::=  { id-ce 54 }
-
-InhibitAnyPolicy ::= SkipCerts
-
--- freshest (delta)CRL extension OID and syntax
-
-id-ce-freshestCRL OBJECT IDENTIFIER ::=  { id-ce 46 }
-
-FreshestCRL ::= CRLDistributionPoints
-
--- authority info access
-
-id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
-
-AuthorityInfoAccessSyntax  ::=
-        SEQUENCE SIZE (1..MAX) OF AccessDescription
-
-AccessDescription  ::=  SEQUENCE {
-        accessMethod          OBJECT IDENTIFIER,
-        accessLocation        GeneralName  }
-
--- subject info access
-
-id-pe-subjectInfoAccess OBJECT IDENTIFIER ::= { id-pe 11 }
-
-
-
-Housley, et. al.            Standards Track                   [Page 110]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-SubjectInfoAccessSyntax  ::=
-        SEQUENCE SIZE (1..MAX) OF AccessDescription
-
--- CRL number extension OID and syntax
-
-id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
-
-CRLNumber ::= INTEGER (0..MAX)
-
--- issuing distribution point extension OID and syntax
-
-id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-ce 28 }
-
-IssuingDistributionPoint ::= SEQUENCE {
-     distributionPoint          [0] DistributionPointName OPTIONAL,
-     onlyContainsUserCerts      [1] BOOLEAN DEFAULT FALSE,
-     onlyContainsCACerts        [2] BOOLEAN DEFAULT FALSE,
-     onlySomeReasons            [3] ReasonFlags OPTIONAL,
-     indirectCRL                [4] BOOLEAN DEFAULT FALSE,
-     onlyContainsAttributeCerts [5] BOOLEAN DEFAULT FALSE }
-
-id-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= { id-ce 27 }
-
-BaseCRLNumber ::= CRLNumber
-
--- CRL reasons extension OID and syntax
-
-id-ce-cRLReasons OBJECT IDENTIFIER ::= { id-ce 21 }
-
-CRLReason ::= ENUMERATED {
-     unspecified             (0),
-     keyCompromise           (1),
-     cACompromise            (2),
-     affiliationChanged      (3),
-     superseded              (4),
-     cessationOfOperation    (5),
-     certificateHold         (6),
-     removeFromCRL           (8),
-     privilegeWithdrawn      (9),
-     aACompromise           (10) }
-
--- certificate issuer CRL entry extension OID and syntax
-
-id-ce-certificateIssuer OBJECT IDENTIFIER ::= { id-ce 29 }
-
-CertificateIssuer ::= GeneralNames
-
--- hold instruction extension OID and syntax
-
-
-
-Housley, et. al.            Standards Track                   [Page 111]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-id-ce-holdInstructionCode OBJECT IDENTIFIER ::= { id-ce 23 }
-
-HoldInstructionCode ::= OBJECT IDENTIFIER
-
--- ANSI x9 holdinstructions
-
--- ANSI x9 arc holdinstruction arc
-
-holdInstruction OBJECT IDENTIFIER ::=
-          {joint-iso-itu-t(2) member-body(2) us(840) x9cm(10040) 2}
-
--- ANSI X9 holdinstructions referenced by this standard
-
-id-holdinstruction-none OBJECT IDENTIFIER  ::=
-                {holdInstruction 1} -- deprecated
-
-id-holdinstruction-callissuer OBJECT IDENTIFIER ::=
-                {holdInstruction 2}
-
-id-holdinstruction-reject OBJECT IDENTIFIER ::=
-                {holdInstruction 3}
-
--- invalidity date CRL entry extension OID and syntax
-
-id-ce-invalidityDate OBJECT IDENTIFIER ::= { id-ce 24 }
-
-InvalidityDate ::=  GeneralizedTime
-
-END
-
-Appendix B.  ASN.1 Notes
-
-   CAs MUST force the serialNumber to be a non-negative integer, that
-   is, the sign bit in the DER encoding of the INTEGER value MUST be
-   zero - this can be done by adding a leading (leftmost) `00'H octet if
-   necessary.  This removes a potential ambiguity in mapping between a
-   string of octets and an integer value.
-
-   As noted in section 4.1.2.2, serial numbers can be expected to
-   contain long integers.  Certificate users MUST be able to handle
-   serialNumber values up to 20 octets in length.  Conformant CAs MUST
-   NOT use serialNumber values longer than 20 octets.
-
-   As noted in section 5.2.3, CRL numbers can be expected to contain
-   long integers.  CRL validators MUST be able to handle cRLNumber
-   values up to 20 octets in length.  Conformant CRL issuers MUST NOT
-   use cRLNumber values longer than 20 octets.
-
-
-
-
-Housley, et. al.            Standards Track                   [Page 112]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   The construct "SEQUENCE SIZE (1..MAX) OF" appears in several ASN.1
-   constructs.  A valid ASN.1 sequence will have zero or more entries.
-   The SIZE (1..MAX) construct constrains the sequence to have at least
-   one entry.  MAX indicates the upper bound is unspecified.
-   Implementations are free to choose an upper bound that suits their
-   environment.
-
-   The construct "positiveInt ::= INTEGER (0..MAX)" defines positiveInt
-   as a subtype of INTEGER containing integers greater than or equal to
-   zero.  The upper bound is unspecified.  Implementations are free to
-   select an upper bound that suits their environment.
-
-   The character string type PrintableString supports a very basic Latin
-   character set: the lower case letters 'a' through 'z', upper case
-   letters 'A' through 'Z', the digits '0' through '9', eleven special
-   characters ' = ( ) + , - . / : ? and space.
-
-   Implementers should note that the at sign ('@') and underscore ('_')
-   characters are not supported by the ASN.1 type PrintableString.
-   These characters often appear in internet addresses.  Such addresses
-   MUST be encoded using an ASN.1 type that supports them.  They are
-   usually encoded as IA5String in either the emailAddress attribute
-   within a distinguished name or the rfc822Name field of GeneralName.
-   Conforming implementations MUST NOT encode strings which include
-   either the at sign or underscore character as PrintableString.
-
-   The character string type TeletexString is a superset of
-   PrintableString.  TeletexString supports a fairly standard (ASCII-
-   like) Latin character set, Latin characters with non-spacing accents
-   and Japanese characters.
-
-   Named bit lists are BIT STRINGs where the values have been assigned
-   names.  This specification makes use of named bit lists in the
-   definitions for the key usage, CRL distribution points and freshest
-   CRL certificate extensions, as well as the freshest CRL and issuing
-   distribution point CRL extensions.  When DER encoding a named bit
-   list, trailing zeroes MUST be omitted.  That is, the encoded value
-   ends with the last named bit that is set to one.
-
-   The character string type UniversalString supports any of the
-   characters allowed by ISO 10646-1 [ISO 10646].  ISO 10646-1 is the
-   Universal multiple-octet coded Character Set (UCS).  ISO 10646-1
-   specifies the architecture and the "basic multilingual plane" -- a
-   large standard character set which includes all major world character
-   standards.
-
-
-
-
-
-
-Housley, et. al.            Standards Track                   [Page 113]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   The character string type UTF8String was introduced in the 1997
-   version of ASN.1, and UTF8String was added to the list of choices for
-   DirectoryString in the 2001 version of X.520 [X.520].  UTF8String is
-   a universal type and has been assigned tag number 12.  The content of
-   UTF8String was defined by RFC 2044 [RFC 2044] and updated in RFC 2279
-   [RFC 2279].
-
-   In anticipation of these changes, and in conformance with IETF Best
-   Practices codified in RFC 2277 [RFC 2277], IETF Policy on Character
-   Sets and Languages, this document includes UTF8String as a choice in
-   DirectoryString and the CPS qualifier extensions.
-
-   Implementers should note that the DER encoding of the SET OF values
-   requires ordering of the encodings of the values.  In particular,
-   this issue arises with respect to distinguished names.
-
-   Implementers should note that the DER encoding of SET or SEQUENCE
-   components whose value is the DEFAULT omit the component from the
-   encoded certificate or CRL.  For example, a BasicConstraints
-   extension whose cA value is FALSE would omit the cA boolean from the
-   encoded certificate.
-
-   Object Identifiers (OIDs) are used throughout this specification to
-   identify certificate policies, public key and signature algorithms,
-   certificate extensions, etc.  There is no maximum size for OIDs.
-   This specification mandates support for OIDs which have arc elements
-   with values that are less than 2^28, that is, they MUST be between 0
-   and 268,435,455, inclusive.  This allows each arc element to be
-   represented within a single 32 bit word.  Implementations MUST also
-   support OIDs where the length of the dotted decimal (see [RFC 2252],
-   section 4.1) string representation can be up to 100 bytes
-   (inclusive).  Implementations MUST be able to handle OIDs with up to
-   20 elements (inclusive).  CAs SHOULD NOT issue certificates which
-   contain OIDs that exceed these requirements.  Likewise, CRL issuers
-   SHOULD NOT issue CRLs which contain OIDs that exceed these
-   requirements.
-
-   Implementors are warned that the X.500 standards community has
-   developed a series of extensibility rules.  These rules determine
-   when an ASN.1 definition can be changed without assigning a new
-   object identifier (OID).  For example, at least two extension
-   definitions included in RFC 2459 [RFC 2459], the predecessor to this
-   profile document, have different ASN.1 definitions in this
-   specification, but the same OID is used.  If unknown elements appear
-   within an extension, and the extension is not marked critical, those
-   unknown elements ought to be ignored, as follows:
-
-      (a)  ignore all unknown bit name assignments within a bit string;
-
-
-
-Housley, et. al.            Standards Track                   [Page 114]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-      (b)  ignore all unknown named numbers in an ENUMERATED type or
-      INTEGER type that is being used in the enumerated style, provided
-      the number occurs as an optional element of a SET or SEQUENCE; and
-
-      (c)  ignore all unknown elements in SETs, at the end of SEQUENCEs,
-      or in CHOICEs where the CHOICE is itself an optional element of a
-      SET or SEQUENCE.
-
-   If an extension containing unexpected values is marked critical, the
-   implementation MUST reject the certificate or CRL containing the
-   unrecognized extension.
-
-Appendix C.  Examples
-
-   This section contains four examples: three certificates and a CRL.
-   The first two certificates and the CRL comprise a minimal
-   certification path.
-
-   Section C.1 contains an annotated hex dump of a "self-signed"
-   certificate issued by a CA whose distinguished name is
-   cn=us,o=gov,ou=nist.  The certificate contains a DSA public key with
-   parameters, and is signed by the corresponding DSA private key.
-
-   Section C.2 contains an annotated hex dump of an end entity
-   certificate.  The end entity certificate contains a DSA public key,
-   and is signed by the private key corresponding to the "self-signed"
-   certificate in section C.1.
-
-   Section C.3 contains a dump of an end entity certificate which
-   contains an RSA public key and is signed with RSA and MD5.  This
-   certificate is not part of the minimal certification path.
-
-   Section C.4 contains an annotated hex dump of a CRL.  The CRL is
-   issued by the CA whose distinguished name is cn=us,o=gov,ou=nist and
-   the list of revoked certificates includes the end entity certificate
-   presented in C.2.
-
-   The certificates were processed using Peter Gutman's dumpasn1 utility
-   to generate the output.  The source for the dumpasn1 utility is
-   available at <http://www.cs.auckland.ac.nz/~pgut001/dumpasn1.c>.  The
-   binaries for the certificates and CRLs are available at
-   <http://csrc.nist.gov/pki/pkixtools>.
-
-C.1  Certificate
-
-   This section contains an annotated hex dump of a 699 byte version 3
-   certificate.  The certificate contains the following information:
-   (a)  the serial number is 23 (17 hex);
-
-
-
-Housley, et. al.            Standards Track                   [Page 115]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   (b)  the certificate is signed with DSA and the SHA-1 hash algorithm;
-   (c)  the issuer's distinguished name is OU=NIST; O=gov; C=US
-   (d)  and the subject's distinguished name is OU=NIST; O=gov; C=US
-   (e)  the certificate was issued on June 30, 1997 and will expire on
-   December 31, 1997;
-   (f)  the certificate contains a 1024 bit DSA public key with
-   parameters;
-   (g)  the certificate contains a subject key identifier extension
-   generated using method (1) of section 4.2.1.2; and
-   (h)  the certificate is a CA certificate (as indicated through the
-   basic constraints extension.)
-
-  0 30  699: SEQUENCE {
-  4 30  635:   SEQUENCE {
-  8 A0    3:     [0] {
- 10 02    1:       INTEGER 2
-          :       }
- 13 02    1:     INTEGER 17
- 16 30    9:     SEQUENCE {
- 18 06    7:       OBJECT IDENTIFIER dsaWithSha1 (1 2 840 10040 4 3)
-          :       }
- 27 30   42:     SEQUENCE {
- 29 31   11:       SET {
- 31 30    9:         SEQUENCE {
- 33 06    3:           OBJECT IDENTIFIER countryName (2 5 4 6)
- 38 13    2:           PrintableString 'US'
-          :           }
-          :         }
- 42 31   12:       SET {
- 44 30   10:         SEQUENCE {
- 46 06    3:           OBJECT IDENTIFIER organizationName (2 5 4 10)
- 51 13    3:           PrintableString 'gov'
-          :           }
-          :         }
- 56 31   13:       SET {
- 58 30   11:         SEQUENCE {
- 60 06    3:           OBJECT IDENTIFIER
-          :             organizationalUnitName (2 5 4 11)
- 65 13    4:           PrintableString 'NIST'
-           :           }
-           :         }
-           :       }
- 71 30   30:     SEQUENCE {
- 73 17   13:       UTCTime '970630000000Z'
- 88 17   13:       UTCTime '971231000000Z'
-           :       }
-103 30   42:     SEQUENCE {
-105 31   11:       SET {
-
-
-
-Housley, et. al.            Standards Track                   [Page 116]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-107 30    9:         SEQUENCE {
-109 06    3:           OBJECT IDENTIFIER countryName (2 5 4 6)
-114 13    2:           PrintableString 'US'
-           :           }
-           :         }
-118 31   12:       SET {
-120 30   10:         SEQUENCE {
-122 06    3:           OBJECT IDENTIFIER organizationName (2 5 4 10)
-127 13    3:           PrintableString 'gov'
-           :           }
-           :         }
-132 31   13:       SET {
-134 30   11:         SEQUENCE {
-136 06    3:           OBJECT IDENTIFIER
-           :             organizationalUnitName (2 5 4 11)
-141 13    4:           PrintableString 'NIST'
-           :           }
-           :         }
-           :       }
-147 30  440:     SEQUENCE {
-151 30  300:       SEQUENCE {
-155 06    7:         OBJECT IDENTIFIER dsa (1 2 840 10040 4 1)
-164 30  287:         SEQUENCE {
-168 02  129:           INTEGER
-           :             00 B6 8B 0F 94 2B 9A CE A5 25 C6 F2 ED FC
-           :             FB 95 32 AC 01 12 33 B9 E0 1C AD 90 9B BC
-           :             48 54 9E F3 94 77 3C 2C 71 35 55 E6 FE 4F
-           :             22 CB D5 D8 3E 89 93 33 4D FC BD 4F 41 64
-           :             3E A2 98 70 EC 31 B4 50 DE EB F1 98 28 0A
-           :             C9 3E 44 B3 FD 22 97 96 83 D0 18 A3 E3 BD
-           :             35 5B FF EE A3 21 72 6A 7B 96 DA B9 3F 1E
-           :             5A 90 AF 24 D6 20 F0 0D 21 A7 D4 02 B9 1A
-           :             FC AC 21 FB 9E 94 9E 4B 42 45 9E 6A B2 48
-           :             63 FE 43
-300 02   21:           INTEGER
-           :             00 B2 0D B0 B1 01 DF 0C 66 24 FC 13 92 BA
-           :             55 F7 7D 57 74 81 E5
-323 02  129:           INTEGER
-           :             00 9A BF 46 B1 F5 3F 44 3D C9 A5 65 FB 91
-           :             C0 8E 47 F1 0A C3 01 47 C2 44 42 36 A9 92
-           :             81 DE 57 C5 E0 68 86 58 00 7B 1F F9 9B 77
-           :             A1 C5 10 A5 80 91 78 51 51 3C F6 FC FC CC
-           :             46 C6 81 78 92 84 3D F4 93 3D 0C 38 7E 1A
-           :             5B 99 4E AB 14 64 F6 0C 21 22 4E 28 08 9C
-           :             92 B9 66 9F 40 E8 95 F6 D5 31 2A EF 39 A2
-           :             62 C7 B2 6D 9E 58 C4 3A A8 11 81 84 6D AF
-           :             F8 B4 19 B4 C2 11 AE D0 22 3B AA 20 7F EE
-           :             1E 57 18
-
-
-
-Housley, et. al.            Standards Track                   [Page 117]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-           :           }
-           :         }
-455 03  133:       BIT STRING 0 unused bits, encapsulates {
-459 02  129:           INTEGER
-           :             00 B5 9E 1F 49 04 47 D1 DB F5 3A DD CA 04
-           :             75 E8 DD 75 F6 9B 8A B1 97 D6 59 69 82 D3
-           :             03 4D FD 3B 36 5F 4A F2 D1 4E C1 07 F5 D1
-           :             2A D3 78 77 63 56 EA 96 61 4D 42 0B 7A 1D
-           :             FB AB 91 A4 CE DE EF 77 C8 E5 EF 20 AE A6
-           :             28 48 AF BE 69 C3 6A A5 30 F2 C2 B9 D9 82
-           :             2B 7D D9 C4 84 1F DE 0D E8 54 D7 1B 99 2E
-           :             B3 D0 88 F6 D6 63 9B A7 E2 0E 82 D4 3B 8A
-           :             68 1B 06 56 31 59 0B 49 EB 99 A5 D5 81 41
-           :             7B C9 55
-           :           }
-           :       }
-591 A3   50:     [3] {
-593 30   48:       SEQUENCE {
-595 30   29:         SEQUENCE {
-597 06    3:           OBJECT IDENTIFIER
-           :             subjectKeyIdentifier (2 5 29 14)
-602 04   22:           OCTET STRING, encapsulates {
-604 04   20:               OCTET STRING
-           :                 86 CA A5 22 81 62 EF AD 0A 89 BC AD 72 41
-           :                 2C 29 49 F4 86 56
-           :               }
-           :           }
-626 30   15:         SEQUENCE {
-628 06    3:           OBJECT IDENTIFIER basicConstraints (2 5 29 19)
-633 01    1:           BOOLEAN TRUE
-636 04    5:           OCTET STRING, encapsulates {
-638 30    3:               SEQUENCE {
-640 01    1:                 BOOLEAN TRUE
-           :                 }
-           :               }
-           :           }
-           :         }
-           :       }
-           :     }
-643 30    9:   SEQUENCE {
-645 06    7:     OBJECT IDENTIFIER dsaWithSha1 (1 2 840 10040 4 3)
-           :     }
-654 03   47:   BIT STRING 0 unused bits, encapsulates {
-657 30   44:       SEQUENCE {
-659 02   20:         INTEGER
-           :           43 1B CF 29 25 45 C0 4E 52 E7 7D D6 FC B1
-           :           66 4C 83 CF 2D 77
-681 02   20:         INTEGER
-
-
-
-Housley, et. al.            Standards Track                   [Page 118]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-           :           0B 5B 9A 24 11 98 E8 F3 86 90 04 F6 08 A9
-           :           E1 8D A5 CC 3A D4
-           :         }
-           :       }
-           :   }
-
-C.2  Certificate
-
-   This section contains an annotated hex dump of a 730 byte version 3
-   certificate.  The certificate contains the following information:
-   (a)  the serial number is 18 (12 hex);
-   (b)  the certificate is signed with DSA and the SHA-1 hash algorithm;
-   (c)  the issuer's distinguished name is OU=nist; O=gov; C=US
-   (d)  and the subject's distinguished name is CN=Tim Polk; OU=nist;
-   O=gov; C=US
-   (e)  the certificate was valid from July 30, 1997 through December 1,
-   1997;
-   (f)  the certificate contains a 1024 bit DSA public key;
-   (g)  the certificate is an end entity certificate, as the basic
-   constraints extension is not present;
-   (h)  the certificate contains an authority key identifier extension
-   matching the subject key identifier of the certificate in Appendix
-   C.1; and
-   (i)  the certificate includes one alternative name - an RFC 822
-   address of "wpolk@nist.gov".
-
-     0 30  730: SEQUENCE {
-     4 30  665:   SEQUENCE {
-     8 A0    3:     [0] {
-    10 02    1:       INTEGER 2
-              :       }
-    13 02    1:     INTEGER 18
-    16 30    9:     SEQUENCE {
-    18 06    7:       OBJECT IDENTIFIER dsaWithSha1 (1 2 840 10040 4 3)
-              :       }
-    27 30   42:     SEQUENCE {
-    29 31   11:       SET {
-    31 30    9:         SEQUENCE {
-    33 06    3:           OBJECT IDENTIFIER countryName (2 5 4 6)
-    38 13    2:           PrintableString 'US'
-              :           }
-              :         }
-    42 31   12:       SET {
-    44 30   10:         SEQUENCE {
-    46 06    3:           OBJECT IDENTIFIER organizationName (2 5 4 10)
-    51 13    3:           PrintableString 'gov'
-              :           }
-              :         }
-
-
-
-Housley, et. al.            Standards Track                   [Page 119]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-    56 31   13:       SET {
-    58 30   11:         SEQUENCE {
-    60 06    3:           OBJECT IDENTIFIER
-              :             organizationalUnitName (2 5 4 11)
-    65 13    4:           PrintableString 'NIST'
-              :           }
-              :         }
-              :       }
-    71 30   30:     SEQUENCE {
-    73 17   13:       UTCTime '970730000000Z'
-    88 17   13:       UTCTime '971201000000Z'
-              :       }
-   103 30   61:     SEQUENCE {
-   105 31   11:       SET {
-   107 30    9:         SEQUENCE {
-   109 06    3:           OBJECT IDENTIFIER countryName (2 5 4 6)
-   114 13    2:           PrintableString 'US'
-              :           }
-              :         }
-   118 31   12:       SET {
-   120 30   10:         SEQUENCE {
-   122 06    3:           OBJECT IDENTIFIER organizationName (2 5 4 10)
-   127 13    3:           PrintableString 'gov'
-              :           }
-              :         }
-   132 31   13:       SET {
-   134 30   11:         SEQUENCE {
-   136 06    3:           OBJECT IDENTIFIER
-              :             organizationalUnitName (2 5 4 11)
-   141 13    4:           PrintableString 'NIST'
-              :           }
-              :         }
-   147 31   17:       SET {
-   149 30   15:         SEQUENCE {
-   151 06    3:           OBJECT IDENTIFIER commonName (2 5 4 3)
-   156 13    8:           PrintableString 'Tim Polk'
-              :           }
-              :         }
-              :       }
-   166 30  439:     SEQUENCE {
-   170 30  300:       SEQUENCE {
-   174 06    7:         OBJECT IDENTIFIER dsa (1 2 840 10040 4 1)
-   183 30  287:         SEQUENCE {
-   187 02  129:           INTEGER
-              :             00 B6 8B 0F 94 2B 9A CE A5 25 C6 F2 ED FC
-              :             FB 95 32 AC 01 12 33 B9 E0 1C AD 90 9B BC
-              :             48 54 9E F3 94 77 3C 2C 71 35 55 E6 FE 4F
-              :             22 CB D5 D8 3E 89 93 33 4D FC BD 4F 41 64
-
-
-
-Housley, et. al.            Standards Track                   [Page 120]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-              :             3E A2 98 70 EC 31 B4 50 DE EB F1 98 28 0A
-              :             C9 3E 44 B3 FD 22 97 96 83 D0 18 A3 E3 BD
-              :             35 5B FF EE A3 21 72 6A 7B 96 DA B9 3F 1E
-              :             5A 90 AF 24 D6 20 F0 0D 21 A7 D4 02 B9 1A
-              :             FC AC 21 FB 9E 94 9E 4B 42 45 9E 6A B2 48
-              :             63 FE 43
-   319 02   21:           INTEGER
-              :             00 B2 0D B0 B1 01 DF 0C 66 24 FC 13 92 BA
-              :             55 F7 7D 57 74 81 E5
-   342 02  129:           INTEGER
-              :             00 9A BF 46 B1 F5 3F 44 3D C9 A5 65 FB 91
-              :             C0 8E 47 F1 0A C3 01 47 C2 44 42 36 A9 92
-              :             81 DE 57 C5 E0 68 86 58 00 7B 1F F9 9B 77
-              :             A1 C5 10 A5 80 91 78 51 51 3C F6 FC FC CC
-              :             46 C6 81 78 92 84 3D F4 93 3D 0C 38 7E 1A
-              :             5B 99 4E AB 14 64 F6 0C 21 22 4E 28 08 9C
-              :             92 B9 66 9F 40 E8 95 F6 D5 31 2A EF 39 A2
-              :             62 C7 B2 6D 9E 58 C4 3A A8 11 81 84 6D AF
-              :             F8 B4 19 B4 C2 11 AE D0 22 3B AA 20 7F EE
-              :             1E 57 18
-              :           }
-              :         }
-   474 03  132:       BIT STRING 0 unused bits, encapsulates {
-   478 02  128:           INTEGER
-              :             30 B6 75 F7 7C 20 31 AE 38 BB 7E 0D 2B AB
-              :             A0 9C 4B DF 20 D5 24 13 3C CD 98 E5 5F 6C
-              :             B7 C1 BA 4A BA A9 95 80 53 F0 0D 72 DC 33
-              :             37 F4 01 0B F5 04 1F 9D 2E 1F 62 D8 84 3A
-              :             9B 25 09 5A 2D C8 46 8E 2B D4 F5 0D 3B C7
-              :             2D C6 6C B9 98 C1 25 3A 44 4E 8E CA 95 61
-              :             35 7C CE 15 31 5C 23 13 1E A2 05 D1 7A 24
-              :             1C CB D3 72 09 90 FF 9B 9D 28 C0 A1 0A EC
-              :             46 9F 0D B8 D0 DC D0 18 A6 2B 5E F9 8F B5
-              :             95 BE
-              :           }
-              :       }
-   609 A3   62:     [3] {
-   611 30   60:       SEQUENCE {
-   613 30   25:         SEQUENCE {
-   615 06    3:           OBJECT IDENTIFIER subjectAltName (2 5 29 17)
-   620 04   18:           OCTET STRING, encapsulates {
-   622 30   16:               SEQUENCE {
-   624 81   14:                 [1] 'wpolk@nist.gov'
-              :                 }
-              :               }
-              :           }
-   640 30   31:         SEQUENCE {
-   642 06    3:           OBJECT IDENTIFIER
-
-
-
-Housley, et. al.            Standards Track                   [Page 121]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-              :             authorityKeyIdentifier (2 5 29 35)
-   647 04   24:           OCTET STRING, encapsulates {
-   649 30   22:               SEQUENCE {
-   651 80   20:                 [0]
-              :                   86 CA A5 22 81 62 EF AD 0A 89 BC AD 72
-              :                   41 2C 29 49 F4 86 56
-              :                 }
-              :               }
-              :           }
-              :         }
-              :       }
-              :     }
-   673 30    9:   SEQUENCE {
-   675 06    7:     OBJECT IDENTIFIER dsaWithSha1 (1 2 840 10040 4 3)
-              :     }
-   684 03   48:   BIT STRING 0 unused bits, encapsulates {
-   687 30   45:       SEQUENCE {
-   689 02   20:         INTEGER
-              :           36 97 CB E3 B4 2C E1 BB 61 A9 D3 CC 24 CC
-              :           22 92 9F F4 F5 87
-   711 02   21:         INTEGER
-              :           00 AB C9 79 AF D2 16 1C A9 E3 68 A9 14 10
-              :           B4 A0 2E FF 22 5A 73
-              :         }
-              :       }
-              :   }
-
-C.3  End Entity Certificate Using RSA
-
-   This section contains an annotated hex dump of a 654 byte version 3
-   certificate.  The certificate contains the following information:
-   (a)  the serial number is 256;
-   (b)  the certificate is signed with RSA and the SHA-1 hash algorithm;
-   (c)  the issuer's distinguished name is OU=NIST; O=gov; C=US
-   (d)  and the subject's distinguished name is CN=Tim Polk; OU=NIST;
-   O=gov; C=US
-   (e)  the certificate was issued on May 21, 1996 at 09:58:26 and
-   expired on May 21, 1997 at 09:58:26;
-   (f)  the certificate contains a 1024 bit RSA public key;
-   (g)  the certificate is an end entity certificate (not a CA
-   certificate);
-   (h)  the certificate includes an alternative subject name of
-   "<http://www.itl.nist.gov/div893/staff/polk/index.html>" and an
-   alternative issuer name of "<http://www.nist.gov/>" - both are URLs;
-   (i)  the certificate include an authority key identifier extension
-   and a certificate policies extension specifying the policy OID
-   2.16.840.1.101.3.2.1.48.9; and
-
-
-
-
-Housley, et. al.            Standards Track                   [Page 122]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-   (j)  the certificate includes a critical key usage extension
-   specifying that the public key is intended for verification of
-   digital signatures.
-
-  0 30  654: SEQUENCE {
-  4 30  503:   SEQUENCE {
-  8 A0    3:     [0] {
- 10 02    1:       INTEGER 2
-           :       }
- 13 02    2:     INTEGER 256
- 17 30   13:     SEQUENCE {
- 19 06    9:       OBJECT IDENTIFIER
-           :         sha1withRSAEncryption (1 2 840 113549 1 1 5)
- 30 05    0:       NULL
-           :       }
- 32 30   42:     SEQUENCE {
- 34 31   11:       SET {
- 36 30    9:         SEQUENCE {
- 38 06    3:           OBJECT IDENTIFIER countryName (2 5 4 6)
- 43 13    2:           PrintableString 'US'
-           :           }
-           :         }
- 47 31   12:       SET {
- 49 30   10:         SEQUENCE {
- 51 06    3:           OBJECT IDENTIFIER organizationName (2 5 4 10)
- 56 13    3:           PrintableString 'gov'
-           :           }
-           :         }
- 61 31   13:       SET {
- 63 30   11:         SEQUENCE {
- 65 06    3:           OBJECT IDENTIFIER
-           :             organizationalUnitName (2 5 4 11)
- 70 13    4:           PrintableString 'NIST'
-           :           }
-           :         }
-           :       }
- 76 30   30:     SEQUENCE {
- 78 17   13:       UTCTime '960521095826Z'
- 93 17   13:       UTCTime '970521095826Z'
-           :       }
-108 30   61:     SEQUENCE {
-110 31   11:       SET {
-112 30    9:         SEQUENCE {
-114 06    3:           OBJECT IDENTIFIER countryName (2 5 4 6)
-119 13    2:           PrintableString 'US'
-           :           }
-           :         }
-123 31   12:       SET {
-
-
-
-Housley, et. al.            Standards Track                   [Page 123]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-125 30   10:         SEQUENCE {
-127 06    3:           OBJECT IDENTIFIER organizationName (2 5 4 10)
-132 13    3:           PrintableString 'gov'
-           :           }
-           :         }
-137 31   13:       SET {
-139 30   11:         SEQUENCE {
-141 06    3:           OBJECT IDENTIFIER
-           :             organizationalUnitName (2 5 4 11)
-146 13    4:           PrintableString 'NIST'
-           :           }
-           :         }
-152 31   17:       SET {
-154 30   15:         SEQUENCE {
-156 06    3:           OBJECT IDENTIFIER commonName (2 5 4 3)
-161 13    8:           PrintableString 'Tim Polk'
-           :           }
-           :         }
-           :       }
-171 30  159:     SEQUENCE {
-174 30   13:       SEQUENCE {
-176 06    9:         OBJECT IDENTIFIER
-           :           rsaEncryption (1 2 840 113549 1 1 1)
-187 05    0:         NULL
-           :         }
-189 03  141:       BIT STRING 0 unused bits, encapsulates {
-193 30  137:           SEQUENCE {
-196 02  129:             INTEGER
-           :               00 E1 6A E4 03 30 97 02 3C F4 10 F3 B5 1E
-           :               4D 7F 14 7B F6 F5 D0 78 E9 A4 8A F0 A3 75
-           :               EC ED B6 56 96 7F 88 99 85 9A F2 3E 68 77
-           :               87 EB 9E D1 9F C0 B4 17 DC AB 89 23 A4 1D
-           :               7E 16 23 4C 4F A8 4D F5 31 B8 7C AA E3 1A
-           :               49 09 F4 4B 26 DB 27 67 30 82 12 01 4A E9
-           :               1A B6 C1 0C 53 8B 6C FC 2F 7A 43 EC 33 36
-           :               7E 32 B2 7B D5 AA CF 01 14 C6 12 EC 13 F2
-           :               2D 14 7A 8B 21 58 14 13 4C 46 A3 9A F2 16
-           :               95 FF 23
-328 02    3:             INTEGER 65537
-           :             }
-           :           }
-           :       }
-333 A3  175:     [3] {
-336 30  172:       SEQUENCE {
-339 30   63:         SEQUENCE {
-341 06    3:           OBJECT IDENTIFIER subjectAltName (2 5 29 17)
-346 04   56:           OCTET STRING, encapsulates {
-348 30   54:               SEQUENCE {
-
-
-
-Housley, et. al.            Standards Track                   [Page 124]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-350 86   52:                 [6]
-           :                   'http://www.itl.nist.gov/div893/staff/'
-           :                   'polk/index.html'
-           :                 }
-           :               }
-           :           }
-404 30   31:         SEQUENCE {
-406 06    3:           OBJECT IDENTIFIER issuerAltName (2 5 29 18)
-411 04   24:           OCTET STRING, encapsulates {
-413 30   22:               SEQUENCE {
-415 86   20:                 [6] 'http://www.nist.gov/'
-           :                 }
-           :               }
-           :           }
-437 30   31:         SEQUENCE {
-439 06    3:           OBJECT IDENTIFIER
-           :             authorityKeyIdentifier (2 5 29 35)
-444 04   24:           OCTET STRING, encapsulates {
-446 30   22:               SEQUENCE {
-448 80   20:                 [0]
-           :                   08 68 AF 85 33 C8 39 4A 7A F8 82 93 8E
-           :                   70 6A 4A 20 84 2C 32
-           :                 }
-           :               }
-           :           }
-470 30   23:         SEQUENCE {
-472 06    3:           OBJECT IDENTIFIER
-           :             certificatePolicies (2 5 29 32)
-477 04   16:           OCTET STRING, encapsulates {
-479 30   14:               SEQUENCE {
-481 30   12:                 SEQUENCE {
-483 06   10:                   OBJECT IDENTIFIER
-           :                            '2 16 840 1 101 3 2 1 48 9'
-           :                   }
-           :                 }
-           :               }
-           :           }
-495 30   14:         SEQUENCE {
-497 06    3:           OBJECT IDENTIFIER keyUsage (2 5 29 15)
-502 01    1:           BOOLEAN TRUE
-505 04    4:           OCTET STRING, encapsulates {
-507 03    2:               BIT STRING 7 unused bits
-           :                 '1'B (bit 0)
-           :               }
-           :           }
-           :         }
-           :       }
-           :     }
-
-
-
-Housley, et. al.            Standards Track                   [Page 125]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-511 30   13:   SEQUENCE {
-513 06    9:     OBJECT IDENTIFIER
-           :       sha1withRSAEncryption (1 2 840 113549 1 1 5)
-524 05    0:     NULL
-           :     }
-526 03  129:   BIT STRING 0 unused bits
-           :     1E 07 77 6E 66 B5 B6 B8 57 F0 03 DC 6F 77
-           :     6D AF 55 1D 74 E5 CE 36 81 FC 4B C5 F4 47
-           :     82 C4 0A 25 AA 8D D6 7D 3A 89 AB 44 34 39
-           :     F6 BD 61 1A 78 85 7A B8 1E 92 A2 22 2F CE
-           :     07 1A 08 8E F1 46 03 59 36 4A CB 60 E6 03
-           :     40 01 5B 2A 44 D6 E4 7F EB 43 5E 74 0A E6
-           :     E4 F9 3E E1 44 BE 1F E7 5F 5B 2C 41 8D 08
-           :     BD 26 FE 6A A6 C3 2F B2 3B 41 12 6B C1 06
-           :     8A B8 4C 91 59 EB 2F 38 20 2A 67 74 20 0B
-           :     77 F3
-           :   }
-
-C.4  Certificate Revocation List
-
-   This section contains an annotated hex dump of a version 2 CRL with
-   one extension (cRLNumber).  The CRL was issued by OU=NIST; O=gov;
-   C=US on August 7, 1997; the next scheduled issuance was September 7,
-   1997.  The CRL includes one revoked certificates: serial number 18
-   (12 hex), which was revoked on July 31, 1997 due to keyCompromise.
-   The CRL itself is number 18, and it was signed with DSA and SHA-1.
-
-  0 30  203: SEQUENCE {
-  3 30  140:   SEQUENCE {
-  6 02    1:     INTEGER 1
-  9 30    9:     SEQUENCE {
- 11 06    7:       OBJECT IDENTIFIER dsaWithSha1 (1 2 840 10040 4 3)
-           :       }
- 20 30   42:     SEQUENCE {
- 22 31   11:       SET {
- 24 30    9:         SEQUENCE {
- 26 06    3:           OBJECT IDENTIFIER countryName (2 5 4 6)
- 31 13    2:           PrintableString 'US'
-           :           }
-           :         }
- 35 31   12:       SET {
- 37 30   10:         SEQUENCE {
- 39 06    3:           OBJECT IDENTIFIER organizationName (2 5 4 10)
- 44 13    3:           PrintableString 'gov'
-           :           }
-           :         }
- 49 31   13:       SET {
- 51 30   11:         SEQUENCE {
-
-
-
-Housley, et. al.            Standards Track                   [Page 126]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
- 53 06    3:           OBJECT IDENTIFIER
-           :             organizationalUnitName (2 5 4 11)
- 58 13    4:           PrintableString 'NIST'
-           :           }
-           :         }
-           :       }
- 64 17   13:     UTCTime '970807000000Z'
- 79 17   13:     UTCTime '970907000000Z'
- 94 30   34:     SEQUENCE {
- 96 30   32:       SEQUENCE {
- 98 02    1:         INTEGER 18
-101 17   13:         UTCTime '970731000000Z'
-116 30   12:         SEQUENCE {
-118 30   10:           SEQUENCE {
-120 06    3:             OBJECT IDENTIFIER cRLReason (2 5 29 21)
-125 04    3:             OCTET STRING, encapsulates {
-127 0A    1:                 ENUMERATED 1
-           :                 }
-           :             }
-           :           }
-           :         }
-           :       }
-130 A0   14:     [0] {
-132 30   12:       SEQUENCE {
-134 30   10:         SEQUENCE {
-136 06    3:           OBJECT IDENTIFIER cRLNumber (2 5 29 20)
-141 04    3:           OCTET STRING, encapsulates {
-143 02    1:               INTEGER 12
-           :               }
-           :           }
-           :         }
-           :       }
-           :     }
-146 30    9:   SEQUENCE {
-148 06    7:     OBJECT IDENTIFIER dsaWithSha1 (1 2 840 10040 4 3)
-           :     }
-157 03   47:   BIT STRING 0 unused bits, encapsulates {
-160 30   44:       SEQUENCE {
-162 02   20:         INTEGER
-           :           22 4E 9F 43 BA 95 06 34 F2 BB 5E 65 DB A6
-           :           80 05 C0 3A 29 47
-184 02   20:         INTEGER
-           :           59 1A 57 C9 82 D7 02 21 14 C3 D4 0B 32 1B
-           :           96 16 B1 1F 46 5A
-           :         }
-           :       }
-           :   }
-
-
-
-
-Housley, et. al.            Standards Track                   [Page 127]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-Author Addresses
-
-   Russell Housley
-   RSA Laboratories
-   918 Spring Knoll Drive
-   Herndon, VA 20170
-   USA
-
-   EMail:  rhousley@rsasecurity.com
-
-   Warwick Ford
-   VeriSign, Inc.
-   401 Edgewater Place
-   Wakefield, MA 01880
-   USA
-
-   EMail:  wford@verisign.com
-
-   Tim Polk
-   NIST
-   Building 820, Room 426
-   Gaithersburg, MD 20899
-   USA
-
-   EMail:  wpolk@nist.gov
-
-   David Solo
-   Citigroup
-   909 Third Ave, 16th Floor
-   New York, NY 10043
-   USA
-
-   EMail:  dsolo@alum.mit.edu
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                   [Page 128]
-
-RFC 3280        Internet X.509 Public Key Infrastructure      April 2002
-
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society (2002).  All Rights Reserved.
-
-   This document and translations of it may be copied and furnished to
-   others, and derivative works that comment on or otherwise explain it
-   or assist in its implementation may be prepared, copied, published
-   and distributed, in whole or in part, without restriction of any
-   kind, provided that the above copyright notice and this paragraph are
-   included on all such copies and derivative works.  However, this
-   document itself may not be modified in any way, such as by removing
-   the copyright notice or references to the Internet Society or other
-   Internet organizations, except as needed for the purpose of
-   developing Internet standards in which case the procedures for
-   copyrights defined in the Internet Standards process must be
-   followed, or as required to translate it into languages other than
-   English.
-
-   The limited permissions granted above are perpetual and will not be
-   revoked by the Internet Society or its successors or assigns.
-
-   This document and the information contained herein is provided on an
-   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
-   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
-   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
-   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-Acknowledgement
-
-   Funding for the RFC Editor function is currently provided by the
-   Internet Society.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Housley, et. al.            Standards Track                   [Page 129]
-
diff --git a/doc/ikev2/[RFC3526] - More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE).txt b/doc/ikev2/[RFC3526] - More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE).txt
deleted file mode 100644
index 7b688a33f..000000000
--- a/doc/ikev2/[RFC3526] - More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE).txt
+++ /dev/null
@@ -1,563 +0,0 @@
-
-
-
-
-
-
-Network Working Group                                         T. Kivinen
-Request for Comments: 3526                                       M. Kojo
-Category: Standards Track                    SSH Communications Security
-                                                                May 2003
-
-
-         More Modular Exponential (MODP) Diffie-Hellman groups
-                    for Internet Key Exchange (IKE)
-
-Status of this Memo
-
-   This document specifies an Internet standards track protocol for the
-   Internet community, and requests discussion and suggestions for
-   improvements.  Please refer to the current edition of the "Internet
-   Official Protocol Standards" (STD 1) for the standardization state
-   and status of this protocol.  Distribution of this memo is unlimited.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (2003).  All Rights Reserved.
-
-Abstract
-
-   This document defines new Modular Exponential (MODP) Groups for the
-   Internet Key Exchange (IKE) protocol.  It documents the well known
-   and used 1536 bit group 5, and also defines new 2048, 3072, 4096,
-   6144, and 8192 bit Diffie-Hellman groups numbered starting at 14.
-   The selection of the primes for theses groups follows the criteria
-   established by Richard Schroeppel.
-
-Table of Contents
-
-   1.   Introduction. . . . . . . . . . . . . . . . . . . . . . .  2
-   2.   1536-bit MODP Group . . . . . . . . . . . . . . . . . . .  3
-   3.   2048-bit MODP Group . . . . . . . . . . . . . . . . . . .  3
-   4.   3072-bit MODP Group . . . . . . . . . . . . . . . . . . .  4
-   5.   4096-bit MODP Group . . . . . . . . . . . . . . . . . . .  5
-   6.   6144-bit MODP Group . . . . . . . . . . . . . . . . . . .  6
-   7.   8192-bit MODP Group . . . . . . . . . . . . . . . . . . .  6
-   8.   Security Considerations . . . . . . . . . . . . . . . . .  8
-   9.   IANA Considerations . . . . . . . . . . . . . . . . . . .  8
-   10.  Normative References. . . . . . . . . . . . . . . . . . .  8
-   11.  Non-Normative References. . . . . . . . . . . . . . . . .  8
-   12.  Authors' Addresses  . . . . . . . . . . . . . . . . . . .  9
-   13.  Full Copyright Statement. . . . . . . . . . . . . . . . . 10
-
-
-
-
-
-
-Kivinen & Kojo              Standards Track                     [Page 1]
-
-RFC 3526           MODP Diffie-Hellman groups for IKE           May 2003
-
-
-1.  Introduction
-
-   One of the important protocol parameters negotiated by Internet Key
-   Exchange (IKE) [RFC-2409] is the Diffie-Hellman "group" that will be
-   used for certain cryptographic operations.  IKE currently defines 4
-   groups.  These groups are approximately as strong as a symmetric key
-   of 70-80 bits.
-
-   The new Advanced Encryption Standard (AES) cipher [AES], which has
-   more strength, needs stronger groups.  For the 128-bit AES we need
-   about a 3200-bit group [Orman01].  The 192 and 256-bit keys would
-   need groups that are about 8000 and 15400 bits respectively.  Another
-   source [RSA13] [Rousseau00] estimates that the security equivalent
-   key size for the 192-bit symmetric cipher is 2500 bits instead of
-   8000 bits, and the equivalent key size 256-bit symmetric cipher is
-   4200 bits instead of 15400 bits.
-
-   Because of this disagreement, we just specify different groups
-   without specifying which group should be used with 128, 192 or 256-
-   bit AES.  With current hardware groups bigger than 8192-bits being
-   too slow for practical use, this document does not provide any groups
-   bigger than 8192-bits.
-
-   The exponent size used in the Diffie-Hellman must be selected so that
-   it matches other parts of the system.  It should not be the weakest
-   link in the security system.  It should have double the entropy of
-   the strength of the entire system, i.e., if you use a group whose
-   strength is 128 bits, you must use more than 256 bits of randomness
-   in the exponent used in the Diffie-Hellman calculation.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kivinen & Kojo              Standards Track                     [Page 2]
-
-RFC 3526           MODP Diffie-Hellman groups for IKE           May 2003
-
-
-2.  1536-bit MODP Group
-
-   The 1536 bit MODP group has been used for the implementations for
-   quite a long time, but was not defined in RFC 2409 (IKE).
-   Implementations have been using group 5 to designate this group, we
-   standardize that practice here.
-
-   The prime is: 2^1536 - 2^1472 - 1 + 2^64 * { [2^1406 pi] + 741804 }
-
-   Its hexadecimal value is:
-
-      FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
-      29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
-      EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
-      E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
-      EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D
-      C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F
-      83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
-      670C354E 4ABC9804 F1746C08 CA237327 FFFFFFFF FFFFFFFF
-
-   The generator is: 2.
-
-3.  2048-bit MODP Group
-
-   This group is assigned id 14.
-
-   This prime is: 2^2048 - 2^1984 - 1 + 2^64 * { [2^1918 pi] + 124476 }
-
-   Its hexadecimal value is:
-
-      FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
-      29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
-      EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
-      E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
-      EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D
-      C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F
-      83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
-      670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B
-      E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9
-      DE2BCBF6 95581718 3995497C EA956AE5 15D22618 98FA0510
-      15728E5A 8AACAA68 FFFFFFFF FFFFFFFF
-
-   The generator is: 2.
-
-
-
-
-
-
-
-
-Kivinen & Kojo              Standards Track                     [Page 3]
-
-RFC 3526           MODP Diffie-Hellman groups for IKE           May 2003
-
-
-4.  3072-bit MODP Group
-
-   This group is assigned id 15.
-
-   This prime is: 2^3072 - 2^3008 - 1 + 2^64 * { [2^2942 pi] + 1690314 }
-
-   Its hexadecimal value is:
-
-      FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
-      29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
-      EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
-      E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
-      EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D
-      C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F
-      83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
-      670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B
-      E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9
-      DE2BCBF6 95581718 3995497C EA956AE5 15D22618 98FA0510
-      15728E5A 8AAAC42D AD33170D 04507A33 A85521AB DF1CBA64
-      ECFB8504 58DBEF0A 8AEA7157 5D060C7D B3970F85 A6E1E4C7
-      ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226 1AD2EE6B
-      F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C
-      BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31
-      43DB5BFC E0FD108E 4B82D120 A93AD2CA FFFFFFFF FFFFFFFF
-
-   The generator is: 2.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kivinen & Kojo              Standards Track                     [Page 4]
-
-RFC 3526           MODP Diffie-Hellman groups for IKE           May 2003
-
-
-5.  4096-bit MODP Group
-
-   This group is assigned id 16.
-
-   This prime is: 2^4096 - 2^4032 - 1 + 2^64 * { [2^3966 pi] + 240904 }
-
-   Its hexadecimal value is:
-
-      FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
-      29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
-      EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
-      E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
-      EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D
-      C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F
-      83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
-      670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B
-      E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9
-      DE2BCBF6 95581718 3995497C EA956AE5 15D22618 98FA0510
-      15728E5A 8AAAC42D AD33170D 04507A33 A85521AB DF1CBA64
-      ECFB8504 58DBEF0A 8AEA7157 5D060C7D B3970F85 A6E1E4C7
-      ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226 1AD2EE6B
-      F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C
-      BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31
-      43DB5BFC E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7
-      88719A10 BDBA5B26 99C32718 6AF4E23C 1A946834 B6150BDA
-      2583E9CA 2AD44CE8 DBBBC2DB 04DE8EF9 2E8EFC14 1FBECAA6
-      287C5947 4E6BC05D 99B2964F A090C3A2 233BA186 515BE7ED
-      1F612970 CEE2D7AF B81BDD76 2170481C D0069127 D5B05AA9
-      93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34063199
-      FFFFFFFF FFFFFFFF
-
-   The generator is: 2.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kivinen & Kojo              Standards Track                     [Page 5]
-
-RFC 3526           MODP Diffie-Hellman groups for IKE           May 2003
-
-
-6.  6144-bit MODP Group
-
-   This group is assigned id 17.
-
-   This prime is: 2^6144 - 2^6080 - 1 + 2^64 * { [2^6014 pi] + 929484 }
-
-   Its hexadecimal value is:
-
-   FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08
-   8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B
-   302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9
-   A637ED6B 0BFF5CB6 F406B7ED EE386BFB 5A899FA5 AE9F2411 7C4B1FE6
-   49286651 ECE45B3D C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8
-   FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
-   670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B E39E772C
-   180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9 DE2BCBF6 95581718
-   3995497C EA956AE5 15D22618 98FA0510 15728E5A 8AAAC42D AD33170D
-   04507A33 A85521AB DF1CBA64 ECFB8504 58DBEF0A 8AEA7157 5D060C7D
-   B3970F85 A6E1E4C7 ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226
-   1AD2EE6B F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C
-   BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31 43DB5BFC
-   E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7 88719A10 BDBA5B26
-   99C32718 6AF4E23C 1A946834 B6150BDA 2583E9CA 2AD44CE8 DBBBC2DB
-   04DE8EF9 2E8EFC14 1FBECAA6 287C5947 4E6BC05D 99B2964F A090C3A2
-   233BA186 515BE7ED 1F612970 CEE2D7AF B81BDD76 2170481C D0069127
-   D5B05AA9 93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34028492
-   36C3FAB4 D27C7026 C1D4DCB2 602646DE C9751E76 3DBA37BD F8FF9406
-   AD9E530E E5DB382F 413001AE B06A53ED 9027D831 179727B0 865A8918
-   DA3EDBEB CF9B14ED 44CE6CBA CED4BB1B DB7F1447 E6CC254B 33205151
-   2BD7AF42 6FB8F401 378CD2BF 5983CA01 C64B92EC F032EA15 D1721D03
-   F482D7CE 6E74FEF6 D55E702F 46980C82 B5A84031 900B1C9E 59E7C97F
-   BEC7E8F3 23A97A7E 36CC88BE 0F1D45B7 FF585AC5 4BD407B2 2B4154AA
-   CC8F6D7E BF48E1D8 14CC5ED2 0F8037E0 A79715EE F29BE328 06A1D58B
-   B7C5DA76 F550AA3D 8A1FBFF0 EB19CCB1 A313D55C DA56C9EC 2EF29632
-   387FE8D7 6E3C0468 043E8F66 3F4860EE 12BF2D5B 0B7474D6 E694F91E
-   6DCC4024 FFFFFFFF FFFFFFFF
-
-   The generator is: 2.
-
-7.  8192-bit MODP Group
-
-   This group is assigned id 18.
-
-   This prime is: 2^8192 - 2^8128 - 1 + 2^64 * { [2^8062 pi] + 4743158 }
-
-
-
-
-
-
-
-Kivinen & Kojo              Standards Track                     [Page 6]
-
-RFC 3526           MODP Diffie-Hellman groups for IKE           May 2003
-
-
-   Its hexadecimal value is:
-
-      FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
-      29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
-      EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
-      E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
-      EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D
-      C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F
-      83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
-      670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B
-      E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9
-      DE2BCBF6 95581718 3995497C EA956AE5 15D22618 98FA0510
-      15728E5A 8AAAC42D AD33170D 04507A33 A85521AB DF1CBA64
-      ECFB8504 58DBEF0A 8AEA7157 5D060C7D B3970F85 A6E1E4C7
-      ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226 1AD2EE6B
-      F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C
-      BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31
-      43DB5BFC E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7
-      88719A10 BDBA5B26 99C32718 6AF4E23C 1A946834 B6150BDA
-      2583E9CA 2AD44CE8 DBBBC2DB 04DE8EF9 2E8EFC14 1FBECAA6
-      287C5947 4E6BC05D 99B2964F A090C3A2 233BA186 515BE7ED
-      1F612970 CEE2D7AF B81BDD76 2170481C D0069127 D5B05AA9
-      93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34028492
-      36C3FAB4 D27C7026 C1D4DCB2 602646DE C9751E76 3DBA37BD
-      F8FF9406 AD9E530E E5DB382F 413001AE B06A53ED 9027D831
-      179727B0 865A8918 DA3EDBEB CF9B14ED 44CE6CBA CED4BB1B
-      DB7F1447 E6CC254B 33205151 2BD7AF42 6FB8F401 378CD2BF
-      5983CA01 C64B92EC F032EA15 D1721D03 F482D7CE 6E74FEF6
-      D55E702F 46980C82 B5A84031 900B1C9E 59E7C97F BEC7E8F3
-      23A97A7E 36CC88BE 0F1D45B7 FF585AC5 4BD407B2 2B4154AA
-      CC8F6D7E BF48E1D8 14CC5ED2 0F8037E0 A79715EE F29BE328
-      06A1D58B B7C5DA76 F550AA3D 8A1FBFF0 EB19CCB1 A313D55C
-      DA56C9EC 2EF29632 387FE8D7 6E3C0468 043E8F66 3F4860EE
-      12BF2D5B 0B7474D6 E694F91E 6DBE1159 74A3926F 12FEE5E4
-      38777CB6 A932DF8C D8BEC4D0 73B931BA 3BC832B6 8D9DD300
-      741FA7BF 8AFC47ED 2576F693 6BA42466 3AAB639C 5AE4F568
-      3423B474 2BF1C978 238F16CB E39D652D E3FDB8BE FC848AD9
-      22222E04 A4037C07 13EB57A8 1A23F0C7 3473FC64 6CEA306B
-      4BCBC886 2F8385DD FA9D4B7F A2C087E8 79683303 ED5BDD3A
-      062B3CF5 B3A278A6 6D2A13F8 3F44F82D DF310EE0 74AB6A36
-      4597E899 A0255DC1 64F31CC5 0846851D F9AB4819 5DED7EA1
-      B1D510BD 7EE74D73 FAF36BC3 1ECFA268 359046F4 EB879F92
-      4009438B 481C6CD7 889A002E D5EE382B C9190DA6 FC026E47
-      9558E447 5677E9AA 9E3050E2 765694DF C81F56E8 80B96E71
-      60C980DD 98EDD3DF FFFFFFFF FFFFFFFF
-
-   The generator is: 2.
-
-
-
-
-Kivinen & Kojo              Standards Track                     [Page 7]
-
-RFC 3526           MODP Diffie-Hellman groups for IKE           May 2003
-
-
-8.  Security Considerations
-
-   This document describes new stronger groups to be used in IKE.  The
-   strengths of the groups defined here are always estimates and there
-   are as many methods to estimate them as there are cryptographers.
-   For the strength estimates below we took the both ends of the scale
-   so the actual strength estimate is likely between the two numbers
-   given here.
-
-   +--------+----------+---------------------+---------------------+
-   | Group  | Modulus  | Strength Estimate 1 | Strength Estimate 2 |
-   |        |          +----------+----------+----------+----------+
-   |        |          |          | exponent |          | exponent |
-   |        |          | in bits  | size     | in bits  | size     |
-   +--------+----------+----------+----------+----------+----------+
-   |   5    | 1536-bit |       90 |     180- |      120 |     240- |
-   |  14    | 2048-bit |      110 |     220- |      160 |     320- |
-   |  15    | 3072-bit |      130 |     260- |      210 |     420- |
-   |  16    | 4096-bit |      150 |     300- |      240 |     480- |
-   |  17    | 6144-bit |      170 |     340- |      270 |     540- |
-   |  18    | 8192-bit |      190 |     380- |      310 |     620- |
-   +--------+----------+---------------------+---------------------+
-
-9.  IANA Considerations
-
-   IKE [RFC-2409] defines 4 Diffie-Hellman Groups, numbered 1 through 4.
-
-   This document defines a new group 5, and new groups from 14 to 18.
-   Requests for additional assignment are via "IETF Consensus" as
-   defined in RFC 2434 [RFC-2434].  Specifically, new groups are
-   expected to be documented in a Standards Track RFC.
-
-10.  Normative References
-
-   [RFC-2409]   Harkins, D. and D. Carrel, "The Internet Key Exchange
-                (IKE)", RFC 2409, November 1998.
-
-   [RFC-2434]   Narten, T. and H. Alvestrand, "Guidelines for Writing an
-                IANA Considerations Section in RFCs", BCP 26, RFC 2434,
-                October 1998.
-
-11.  Non-Normative References
-
-   [AES]        NIST, FIPS PUB 197, "Advanced Encryption Standard
-                (AES)," November 2001.
-                http://csrc.nist.gov/publications/fips/fips197/fips-
-                197.{ps,pdf}
-
-
-
-
-Kivinen & Kojo              Standards Track                     [Page 8]
-
-RFC 3526           MODP Diffie-Hellman groups for IKE           May 2003
-
-
-   [RFC-2412]   Orman, H., "The OAKLEY Key Determination Protocol", RFC
-                2412, November 1998.
-
-   [Orman01]    Orman, H. and P. Hoffman, "Determining Strengths For
-                Public Keys Used For Exchanging Symmetric Keys", Work in
-                progress.
-
-   [RSA13]      Silverman, R. "RSA Bulleting #13: A Cost-Based Security
-                Analysis of Symmetric and Asymmetric Key Lengths", April
-                2000, http://www.rsasecurity.com/rsalabs/bulletins/
-                bulletin13.html
-
-   [Rousseau00] Rousseau, F. "New Time and Space Based Key Size
-                Equivalents for RSA and Diffie-Hellman", December 2000,
-                http://www.sandelman.ottawa.on.ca/ipsec/2000/12/
-                msg00045.html
-
-12.  Authors' Addresses
-
-   Tero Kivinen
-   SSH Communications Security Corp
-   Fredrikinkatu 42
-   FIN-00100 HELSINKI
-   Finland
-
-   EMail: kivinen@ssh.fi
-
-
-   Mika Kojo
-   HELSINKI
-   Finland
-
-   EMail: mika.kojo@helsinki.fi
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kivinen & Kojo              Standards Track                     [Page 9]
-
-RFC 3526           MODP Diffie-Hellman groups for IKE           May 2003
-
-
-13.  Full Copyright Statement
-
-   Copyright (C) The Internet Society (2003).  All Rights Reserved.
-
-   This document and translations of it may be copied and furnished to
-   others, and derivative works that comment on or otherwise explain it
-   or assist in its implementation may be prepared, copied, published
-   and distributed, in whole or in part, without restriction of any
-   kind, provided that the above copyright notice and this paragraph are
-   included on all such copies and derivative works.  However, this
-   document itself may not be modified in any way, such as by removing
-   the copyright notice or references to the Internet Society or other
-   Internet organizations, except as needed for the purpose of
-   developing Internet standards in which case the procedures for
-   copyrights defined in the Internet Standards process must be
-   followed, or as required to translate it into languages other than
-   English.
-
-   The limited permissions granted above are perpetual and will not be
-   revoked by the Internet Society or its successors or assigns.
-
-   This document and the information contained herein is provided on an
-   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
-   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
-   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
-   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-Acknowledgement
-
-   Funding for the RFC Editor function is currently provided by the
-   Internet Society.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kivinen & Kojo              Standards Track                    [Page 10]
-
diff --git a/doc/ikev2/[RFC4301] - Security Architecture for the Internet Protocol.txt b/doc/ikev2/[RFC4301] - Security Architecture for the Internet Protocol.txt
deleted file mode 100644
index 4a8eba975..000000000
--- a/doc/ikev2/[RFC4301] - Security Architecture for the Internet Protocol.txt
+++ /dev/null
@@ -1,5659 +0,0 @@
-
-
-
-
-
-
-Network Working Group                                            S. Kent
-Request for Comments: 4301                                        K. Seo
-Obsoletes: 2401                                         BBN Technologies
-Category: Standards Track                                  December 2005
-
-
-            Security Architecture for the Internet Protocol
-
-Status of This Memo
-
-   This document specifies an Internet standards track protocol for the
-   Internet community, and requests discussion and suggestions for
-   improvements.  Please refer to the current edition of the "Internet
-   Official Protocol Standards" (STD 1) for the standardization state
-   and status of this protocol.  Distribution of this memo is unlimited.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (2005).
-
-Abstract
-
-   This document describes an updated version of the "Security
-   Architecture for IP", which is designed to provide security services
-   for traffic at the IP layer.  This document obsoletes RFC 2401
-   (November 1998).
-
-Dedication
-
-   This document is dedicated to the memory of Charlie Lynn, a long-time
-   senior colleague at BBN, who made very significant contributions to
-   the IPsec documents.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                     [Page 1]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-Table of Contents
-
-   1. Introduction ....................................................4
-      1.1. Summary of Contents of Document ............................4
-      1.2. Audience ...................................................4
-      1.3. Related Documents ..........................................5
-   2. Design Objectives ...............................................5
-      2.1. Goals/Objectives/Requirements/Problem Description ..........5
-      2.2. Caveats and Assumptions ....................................6
-   3. System Overview .................................................7
-      3.1. What IPsec Does ............................................7
-      3.2. How IPsec Works ............................................9
-      3.3. Where IPsec Can Be Implemented ............................10
-   4. Security Associations ..........................................11
-      4.1. Definition and Scope ......................................12
-      4.2. SA Functionality ..........................................16
-      4.3. Combining SAs .............................................17
-      4.4. Major IPsec Databases .....................................18
-           4.4.1. The Security Policy Database (SPD) .................19
-                  4.4.1.1. Selectors .................................26
-                  4.4.1.2. Structure of an SPD Entry .................30
-                  4.4.1.3. More Regarding Fields Associated
-                           with Next Layer Protocols .................32
-           4.4.2. Security Association Database (SAD) ................34
-                  4.4.2.1. Data Items in the SAD .....................36
-                  4.4.2.2. Relationship between SPD, PFP
-                           flag, packet, and SAD .....................38
-           4.4.3. Peer Authorization Database (PAD) ..................43
-                  4.4.3.1. PAD Entry IDs and Matching Rules ..........44
-                  4.4.3.2. IKE Peer Authentication Data ..............45
-                  4.4.3.3. Child SA Authorization Data ...............46
-                  4.4.3.4. How the PAD Is Used .......................46
-      4.5. SA and Key Management .....................................47
-           4.5.1. Manual Techniques ..................................48
-           4.5.2. Automated SA and Key Management ....................48
-           4.5.3. Locating a Security Gateway ........................49
-      4.6. SAs and Multicast .........................................50
-   5. IP Traffic Processing ..........................................50
-      5.1. Outbound IP Traffic Processing
-           (protected-to-unprotected) ................................52
-           5.1.1. Handling an Outbound Packet That Must Be
-                  Discarded ..........................................54
-           5.1.2. Header Construction for Tunnel Mode ................55
-                  5.1.2.1. IPv4: Header Construction for
-                           Tunnel Mode ...............................57
-                  5.1.2.2. IPv6: Header Construction for
-                           Tunnel Mode ...............................59
-      5.2. Processing Inbound IP Traffic (unprotected-to-protected) ..59
-
-
-
-Kent & Seo                  Standards Track                     [Page 2]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   6. ICMP Processing ................................................63
-      6.1. Processing ICMP Error Messages Directed to an
-           IPsec Implementation ......................................63
-           6.1.1. ICMP Error Messages Received on the
-                  Unprotected Side of the Boundary ...................63
-           6.1.2. ICMP Error Messages Received on the
-                  Protected Side of the Boundary .....................64
-      6.2. Processing Protected, Transit ICMP Error Messages .........64
-   7. Handling Fragments (on the protected side of the IPsec
-      boundary) ......................................................66
-      7.1. Tunnel Mode SAs that Carry Initial and Non-Initial
-           Fragments .................................................67
-      7.2. Separate Tunnel Mode SAs for Non-Initial Fragments ........67
-      7.3. Stateful Fragment Checking ................................68
-      7.4. BYPASS/DISCARD Traffic ....................................69
-   8. Path MTU/DF Processing .........................................69
-      8.1. DF Bit ....................................................69
-      8.2. Path MTU (PMTU) Discovery .................................70
-           8.2.1. Propagation of PMTU ................................70
-           8.2.2. PMTU Aging .........................................71
-   9. Auditing .......................................................71
-   10. Conformance Requirements ......................................71
-   11. Security Considerations .......................................72
-   12. IANA Considerations ...........................................72
-   13. Differences from RFC 2401 .....................................72
-   14. Acknowledgements ..............................................75
-   Appendix A: Glossary ..............................................76
-   Appendix B: Decorrelation .........................................79
-      B.1. Decorrelation Algorithm ...................................79
-   Appendix C: ASN.1 for an SPD Entry ................................82
-   Appendix D: Fragment Handling Rationale ...........................88
-      D.1. Transport Mode and Fragments ..............................88
-      D.2. Tunnel Mode and Fragments .................................89
-      D.3. The Problem of Non-Initial Fragments ......................90
-      D.4. BYPASS/DISCARD Traffic ....................................93
-      D.5. Just say no to ports? .....................................94
-      D.6. Other Suggested Solutions..................................94
-      D.7. Consistency................................................95
-      D.8. Conclusions................................................95
-   Appendix E: Example of Supporting Nested SAs via SPD and
-               Forwarding Table Entries...............................96
-   References.........................................................98
-      Normative References............................................98
-      Informative References..........................................99
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                     [Page 3]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-1.  Introduction
-
-1.1.  Summary of Contents of Document
-
-   This document specifies the base architecture for IPsec-compliant
-   systems.  It describes how to provide a set of security services for
-   traffic at the IP layer, in both the IPv4 [Pos81a] and IPv6 [DH98]
-   environments.  This document describes the requirements for systems
-   that implement IPsec, the fundamental elements of such systems, and
-   how the elements fit together and fit into the IP environment.  It
-   also describes the security services offered by the IPsec protocols,
-   and how these services can be employed in the IP environment.  This
-   document does not address all aspects of the IPsec architecture.
-   Other documents address additional architectural details in
-   specialized environments, e.g., use of IPsec in Network Address
-   Translation (NAT) environments and more comprehensive support for IP
-   multicast.  The fundamental components of the IPsec security
-   architecture are discussed in terms of their underlying, required
-   functionality.  Additional RFCs (see Section 1.3 for pointers to
-   other documents) define the protocols in (a), (c), and (d).
-
-        a. Security Protocols -- Authentication Header (AH) and
-           Encapsulating Security Payload (ESP)
-        b. Security Associations -- what they are and how they work,
-           how they are managed, associated processing
-        c. Key Management -- manual and automated (The Internet Key
-           Exchange (IKE))
-        d. Cryptographic algorithms for authentication and encryption
-
-   This document is not a Security Architecture for the Internet; it
-   addresses security only at the IP layer, provided through the use of
-   a combination of cryptographic and protocol security mechanisms.
-
-   The spelling "IPsec" is preferred and used throughout this and all
-   related IPsec standards.  All other capitalizations of IPsec (e.g.,
-   IPSEC, IPSec, ipsec) are deprecated.  However, any capitalization of
-   the sequence of letters "IPsec" should be understood to refer to the
-   IPsec protocols.
-
-   The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,
-   SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this
-   document, are to be interpreted as described in RFC 2119 [Bra97].
-
-1.2.  Audience
-
-   The target audience for this document is primarily individuals who
-   implement this IP security technology or who architect systems that
-   will use this technology.  Technically adept users of this technology
-
-
-
-Kent & Seo                  Standards Track                     [Page 4]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   (end users or system administrators) also are part of the target
-   audience.  A glossary is provided in Appendix A to help fill in gaps
-   in background/vocabulary.  This document assumes that the reader is
-   familiar with the Internet Protocol (IP), related networking
-   technology, and general information system security terms and
-   concepts.
-
-1.3.  Related Documents
-
-   As mentioned above, other documents provide detailed definitions of
-   some of the components of IPsec and of their interrelationship.  They
-   include RFCs on the following topics:
-
-        a. security protocols -- RFCs describing the Authentication
-           Header (AH) [Ken05b] and Encapsulating Security Payload
-           (ESP) [Ken05a] protocols.
-        b. cryptographic algorithms for integrity and encryption -- one
-           RFC that defines the mandatory, default algorithms for use
-           with AH and ESP [Eas05], a similar RFC that defines the
-           mandatory algorithms for use with IKEv2 [Sch05] plus a
-           separate RFC for each cryptographic algorithm.
-        c. automatic key management -- RFCs on "The Internet Key
-           Exchange (IKEv2) Protocol" [Kau05] and "Cryptographic
-           Algorithms for Use in the Internet Key Exchange Version 2
-           (IKEv2)" [Sch05].
-
-2.  Design Objectives
-
-2.1.  Goals/Objectives/Requirements/Problem Description
-
-   IPsec is designed to provide interoperable, high quality,
-   cryptographically-based security for IPv4 and IPv6.  The set of
-   security services offered includes access control, connectionless
-   integrity, data origin authentication, detection and rejection of
-   replays (a form of partial sequence integrity), confidentiality (via
-   encryption), and limited traffic flow confidentiality.  These
-   services are provided at the IP layer, offering protection in a
-   standard fashion for all protocols that may be carried over IP
-   (including IP itself).
-
-   IPsec includes a specification for minimal firewall functionality,
-   since that is an essential aspect of access control at the IP layer.
-   Implementations are free to provide more sophisticated firewall
-   mechanisms, and to implement the IPsec-mandated functionality using
-   those more sophisticated mechanisms. (Note that interoperability may
-   suffer if additional firewall constraints on traffic flows are
-   imposed by an IPsec implementation but cannot be negotiated based on
-   the traffic selector features defined in this document and negotiated
-
-
-
-Kent & Seo                  Standards Track                     [Page 5]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   via IKEv2.)  The IPsec firewall function makes use of the
-   cryptographically-enforced authentication and integrity provided for
-   all IPsec traffic to offer better access control than could be
-   obtained through use of a firewall (one not privy to IPsec internal
-   parameters) plus separate cryptographic protection.
-
-   Most of the security services are provided through use of two traffic
-   security protocols, the Authentication Header (AH) and the
-   Encapsulating Security Payload (ESP), and through the use of
-   cryptographic key management procedures and protocols.  The set of
-   IPsec protocols employed in a context, and the ways in which they are
-   employed, will be determined by the users/administrators in that
-   context.  It is the goal of the IPsec architecture to ensure that
-   compliant implementations include the services and management
-   interfaces needed to meet the security requirements of a broad user
-   population.
-
-   When IPsec is correctly implemented and deployed, it ought not
-   adversely affect users, hosts, and other Internet components that do
-   not employ IPsec for traffic protection.  IPsec security protocols
-   (AH and ESP, and to a lesser extent, IKE) are designed to be
-   cryptographic algorithm independent.  This modularity permits
-   selection of different sets of cryptographic algorithms as
-   appropriate, without affecting the other parts of the implementation.
-   For example, different user communities may select different sets of
-   cryptographic algorithms (creating cryptographically-enforced
-   cliques) if required.
-
-   To facilitate interoperability in the global Internet, a set of
-   default cryptographic algorithms for use with AH and ESP is specified
-   in [Eas05] and a set of mandatory-to-implement algorithms for IKEv2
-   is specified in [Sch05].  [Eas05] and [Sch05] will be periodically
-   updated to keep pace with computational and cryptologic advances.  By
-   specifying these algorithms in documents that are separate from the
-   AH, ESP, and IKEv2 specifications, these algorithms can be updated or
-   replaced without affecting the standardization progress of the rest
-   of the IPsec document suite.  The use of these cryptographic
-   algorithms, in conjunction with IPsec traffic protection and key
-   management protocols, is intended to permit system and application
-   developers to deploy high quality, Internet-layer, cryptographic
-   security technology.
-
-2.2.  Caveats and Assumptions
-
-   The suite of IPsec protocols and associated default cryptographic
-   algorithms are designed to provide high quality security for Internet
-   traffic.  However, the security offered by use of these protocols
-   ultimately depends on the quality of their implementation, which is
-
-
-
-Kent & Seo                  Standards Track                     [Page 6]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   outside the scope of this set of standards.  Moreover, the security
-   of a computer system or network is a function of many factors,
-   including personnel, physical, procedural, compromising emanations,
-   and computer security practices.  Thus, IPsec is only one part of an
-   overall system security architecture.
-
-   Finally, the security afforded by the use of IPsec is critically
-   dependent on many aspects of the operating environment in which the
-   IPsec implementation executes.  For example, defects in OS security,
-   poor quality of random number sources, sloppy system management
-   protocols and practices, etc., can all degrade the security provided
-   by IPsec.  As above, none of these environmental attributes are
-   within the scope of this or other IPsec standards.
-
-3.  System Overview
-
-   This section provides a high level description of how IPsec works,
-   the components of the system, and how they fit together to provide
-   the security services noted above.  The goal of this description is
-   to enable the reader to "picture" the overall process/system, see how
-   it fits into the IP environment, and to provide context for later
-   sections of this document, which describe each of the components in
-   more detail.
-
-   An IPsec implementation operates in a host, as a security gateway
-   (SG), or as an independent device, affording protection to IP
-   traffic. (A security gateway is an intermediate system implementing
-   IPsec, e.g., a firewall or router that has been IPsec-enabled.) More
-   detail on these classes of implementations is provided later, in
-   Section 3.3. The protection offered by IPsec is based on requirements
-   defined by a Security Policy Database (SPD) established and
-   maintained by a user or system administrator, or by an application
-   operating within constraints established by either of the above.  In
-   general, packets are selected for one of three processing actions
-   based on IP and next layer header information ("Selectors", Section
-   4.4.1.1) matched against entries in the SPD.  Each packet is either
-   PROTECTed using IPsec security services, DISCARDed, or allowed to
-   BYPASS IPsec protection, based on the applicable SPD policies
-   identified by the Selectors.
-
-3.1.  What IPsec Does
-
-   IPsec creates a boundary between unprotected and protected
-   interfaces, for a host or a network (see Figure 1 below).  Traffic
-   traversing the boundary is subject to the access controls specified
-   by the user or administrator responsible for the IPsec configuration.
-   These controls indicate whether packets cross the boundary unimpeded,
-   are afforded security services via AH or ESP, or are discarded.
-
-
-
-Kent & Seo                  Standards Track                     [Page 7]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   IPsec security services are offered at the IP layer through selection
-   of appropriate security protocols, cryptographic algorithms, and
-   cryptographic keys.  IPsec can be used to protect one or more "paths"
-   (a) between a pair of hosts, (b) between a pair of security gateways,
-   or (c) between a security gateway and a host.  A compliant host
-   implementation MUST support (a) and (c) and a compliant security
-   gateway must support all three of these forms of connectivity, since
-   under certain circumstances a security gateway acts as a host.
-
-                        Unprotected
-                         ^       ^
-                         |       |
-           +-------------|-------|-------+
-           | +-------+   |       |       |
-           | |Discard|<--|       V       |
-           | +-------+   |B  +--------+  |
-         ................|y..| AH/ESP |..... IPsec Boundary
-           |   +---+     |p  +--------+  |
-           |   |IKE|<----|a      ^       |
-           |   +---+     |s      |       |
-           | +-------+   |s      |       |
-           | |Discard|<--|       |       |
-           | +-------+   |       |       |
-           +-------------|-------|-------+
-                         |       |
-                         V       V
-                         Protected
-
-            Figure 1.  Top Level IPsec Processing Model
-
-   In this diagram, "unprotected" refers to an interface that might also
-   be described as "black" or "ciphertext".  Here, "protected" refers to
-   an interface that might also be described as "red" or "plaintext".
-   The protected interface noted above may be internal, e.g., in a host
-   implementation of IPsec, the protected interface may link to a socket
-   layer interface presented by the OS.  In this document, the term
-   "inbound" refers to traffic entering an IPsec implementation via the
-   unprotected interface or emitted by the implementation on the
-   unprotected side of the boundary and directed towards the protected
-   interface.  The term "outbound" refers to traffic entering the
-   implementation via the protected interface, or emitted by the
-   implementation on the protected side of the boundary and directed
-   toward the unprotected interface.  An IPsec implementation may
-   support more than one interface on either or both sides of the
-   boundary.
-
-
-
-
-
-
-Kent & Seo                  Standards Track                     [Page 8]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   Note the facilities for discarding traffic on either side of the
-   IPsec boundary, the BYPASS facility that allows traffic to transit
-   the boundary without cryptographic protection, and the reference to
-   IKE as a protected-side key and security management function.
-
-   IPsec optionally supports negotiation of IP compression [SMPT01],
-   motivated in part by the observation that when encryption is employed
-   within IPsec, it prevents effective compression by lower protocol
-   layers.
-
-3.2.  How IPsec Works
-
-   IPsec uses two protocols to provide traffic security services --
-   Authentication Header (AH) and Encapsulating Security Payload (ESP).
-   Both protocols are described in detail in their respective RFCs
-   [Ken05b, Ken05a].  IPsec implementations MUST support ESP and MAY
-   support AH. (Support for AH has been downgraded to MAY because
-   experience has shown that there are very few contexts in which ESP
-   cannot provide the requisite security services.  Note that ESP can be
-   used to provide only integrity, without confidentiality, making it
-   comparable to AH in most contexts.)
-
-    o The IP Authentication Header (AH) [Ken05b] offers integrity and
-      data origin authentication, with optional (at the discretion of
-      the receiver) anti-replay features.
-
-    o The Encapsulating Security Payload (ESP) protocol [Ken05a] offers
-      the same set of services, and also offers confidentiality.  Use of
-      ESP to provide confidentiality without integrity is NOT
-      RECOMMENDED.  When ESP is used with confidentiality enabled, there
-      are provisions for limited traffic flow confidentiality, i.e.,
-      provisions for concealing packet length, and for facilitating
-      efficient generation and discard of dummy packets.  This
-      capability is likely to be effective primarily in virtual private
-      network (VPN) and overlay network contexts.
-
-    o Both AH and ESP offer access control, enforced through the
-      distribution of cryptographic keys and the management of traffic
-      flows as dictated by the Security Policy Database (SPD, Section
-      4.4.1).
-
-   These protocols may be applied individually or in combination with
-   each other to provide IPv4 and IPv6 security services.  However, most
-   security requirements can be met through the use of ESP by itself.
-   Each protocol supports two modes of use: transport mode and tunnel
-   mode.  In transport mode, AH and ESP provide protection primarily for
-
-
-
-
-
-Kent & Seo                  Standards Track                     [Page 9]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   next layer protocols; in tunnel mode, AH and ESP are applied to
-   tunneled IP packets.  The differences between the two modes are
-   discussed in Section 4.1.
-
-   IPsec allows the user (or system administrator) to control the
-   granularity at which a security service is offered.  For example, one
-   can create a single encrypted tunnel to carry all the traffic between
-   two security gateways, or a separate encrypted tunnel can be created
-   for each TCP connection between each pair of hosts communicating
-   across these gateways.  IPsec, through the SPD management paradigm,
-   incorporates facilities for specifying:
-
-    o which security protocol (AH or ESP) to employ, the mode (transport
-      or tunnel), security service options, what cryptographic
-      algorithms to use, and in what combinations to use the specified
-      protocols and services, and
-
-    o the granularity at which protection should be applied.
-
-   Because most of the security services provided by IPsec require the
-   use of cryptographic keys, IPsec relies on a separate set of
-   mechanisms for putting these keys in place.  This document requires
-   support for both manual and automated distribution of keys.  It
-   specifies a specific public-key based approach (IKEv2 [Kau05]) for
-   automated key management, but other automated key distribution
-   techniques MAY be used.
-
-   Note: This document mandates support for several features for which
-   support is available in IKEv2 but not in IKEv1, e.g., negotiation of
-   an SA representing ranges of local and remote ports or negotiation of
-   multiple SAs with the same selectors.  Therefore, this document
-   assumes use of IKEv2 or a key and security association management
-   system with comparable features.
-
-3.3.  Where IPsec Can Be Implemented
-
-   There are many ways in which IPsec may be implemented in a host, or
-   in conjunction with a router or firewall to create a security
-   gateway, or as an independent security device.
-
-   a. IPsec may be integrated into the native IP stack.  This requires
-      access to the IP source code and is applicable to both hosts and
-      security gateways, although native host implementations benefit
-      the most from this strategy, as explained later (Section 4.4.1,
-      paragraph 6; Section 4.4.1.1, last paragraph).
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 10]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   b. In a "bump-in-the-stack" (BITS) implementation, IPsec is
-      implemented "underneath" an existing implementation of an IP
-      protocol stack, between the native IP and the local network
-      drivers.  Source code access for the IP stack is not required in
-      this context, making this implementation approach appropriate for
-      use with legacy systems.  This approach, when it is adopted, is
-      usually employed in hosts.
-
-   c. The use of a dedicated, inline security protocol processor is a
-      common design feature of systems used by the military, and of some
-      commercial systems as well.  It is sometimes referred to as a
-      "bump-in-the-wire" (BITW) implementation.  Such implementations
-      may be designed to serve either a host or a gateway.  Usually, the
-      BITW device is itself IP addressable.  When supporting a single
-      host, it may be quite analogous to a BITS implementation, but in
-      supporting a router or firewall, it must operate like a security
-      gateway.
-
-   This document often talks in terms of use of IPsec by a host or a
-   security gateway, without regard to whether the implementation is
-   native, BITS, or BITW.  When the distinctions among these
-   implementation options are significant, the document makes reference
-   to specific implementation approaches.
-
-   A host implementation of IPsec may appear in devices that might not
-   be viewed as "hosts".  For example, a router might employ IPsec to
-   protect routing protocols (e.g., BGP) and management functions (e.g.,
-   Telnet), without affecting subscriber traffic traversing the router.
-   A security gateway might employ separate IPsec implementations to
-   protect its management traffic and subscriber traffic.  The
-   architecture described in this document is very flexible.  For
-   example, a computer with a full-featured, compliant, native OS IPsec
-   implementation should be capable of being configured to protect
-   resident (host) applications and to provide security gateway
-   protection for traffic traversing the computer.  Such configuration
-   would make use of the forwarding tables and the SPD selection
-   function described in Sections 5.1 and 5.2.
-
-4.  Security Associations
-
-   This section defines Security Association management requirements for
-   all IPv6 implementations and for those IPv4 implementations that
-   implement AH, ESP, or both AH and ESP.  The concept of a "Security
-   Association" (SA) is fundamental to IPsec.  Both AH and ESP make use
-   of SAs, and a major function of IKE is the establishment and
-   maintenance of SAs.  All implementations of AH or ESP MUST support
-   the concept of an SA as described below.  The remainder of this
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 11]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   section describes various aspects of SA management, defining required
-   characteristics for SA policy management and SA management
-   techniques.
-
-4.1.  Definition and Scope
-
-   An SA is a simplex "connection" that affords security services to the
-   traffic carried by it.  Security services are afforded to an SA by
-   the use of AH, or ESP, but not both.  If both AH and ESP protection
-   are applied to a traffic stream, then two SAs must be created and
-   coordinated to effect protection through iterated application of the
-   security protocols.  To secure typical, bi-directional communication
-   between two IPsec-enabled systems, a pair of SAs (one in each
-   direction) is required.  IKE explicitly creates SA pairs in
-   recognition of this common usage requirement.
-
-   For an SA used to carry unicast traffic, the Security Parameters
-   Index (SPI) by itself suffices to specify an SA.  (For information on
-   the SPI, see Appendix A and the AH and ESP specifications [Ken05b,
-   Ken05a].)  However, as a local matter, an implementation may choose
-   to use the SPI in conjunction with the IPsec protocol type (AH or
-   ESP) for SA identification.  If an IPsec implementation supports
-   multicast, then it MUST support multicast SAs using the algorithm
-   below for mapping inbound IPsec datagrams to SAs.  Implementations
-   that support only unicast traffic need not implement this de-
-   multiplexing algorithm.
-
-   In many secure multicast architectures, e.g., [RFC3740], a central
-   Group Controller/Key Server unilaterally assigns the Group Security
-   Association's (GSA's) SPI.  This SPI assignment is not negotiated or
-   coordinated with the key management (e.g., IKE) subsystems that
-   reside in the individual end systems that constitute the group.
-   Consequently, it is possible that a GSA and a unicast SA can
-   simultaneously use the same SPI.  A multicast-capable IPsec
-   implementation MUST correctly de-multiplex inbound traffic even in
-   the context of SPI collisions.
-
-   Each entry in the SA Database (SAD) (Section 4.4.2) must indicate
-   whether the SA lookup makes use of the destination IP address, or the
-   destination and source IP addresses, in addition to the SPI.  For
-   multicast SAs, the protocol field is not employed for SA lookups.
-   For each inbound, IPsec-protected packet, an implementation must
-   conduct its search of the SAD such that it finds the entry that
-   matches the "longest" SA identifier.  In this context, if two or more
-   SAD entries match based on the SPI value, then the entry that also
-   matches based on destination address, or destination and source
-   address (as indicated in the SAD entry) is the "longest" match.  This
-   implies a logical ordering of the SAD search as follows:
-
-
-
-Kent & Seo                  Standards Track                    [Page 12]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      1. Search the SAD for a match on the combination of SPI,
-         destination address, and source address.  If an SAD entry
-         matches, then process the inbound packet with that
-         matching SAD entry.  Otherwise, proceed to step 2.
-
-      2. Search the SAD for a match on both SPI and destination address.
-         If the SAD entry matches, then process the inbound packet
-         with that matching SAD entry.  Otherwise, proceed to step 3.
-
-      3. Search the SAD for a match on only SPI if the receiver has
-         chosen to maintain a single SPI space for AH and ESP, and on
-         both SPI and protocol, otherwise.  If an SAD entry matches,
-         then process the inbound packet with that matching SAD entry.
-         Otherwise, discard the packet and log an auditable event.
-
-   In practice, an implementation may choose any method (or none at all)
-   to accelerate this search, although its externally visible behavior
-   MUST be functionally equivalent to having searched the SAD in the
-   above order.  For example, a software-based implementation could
-   index into a hash table by the SPI.  The SAD entries in each hash
-   table bucket's linked list could be kept sorted to have those SAD
-   entries with the longest SA identifiers first in that linked list.
-   Those SAD entries having the shortest SA identifiers could be sorted
-   so that they are the last entries in the linked list.  A
-   hardware-based implementation may be able to effect the longest match
-   search intrinsically, using commonly available Ternary
-   Content-Addressable Memory (TCAM) features.
-
-   The indication of whether source and destination address matching is
-   required to map inbound IPsec traffic to SAs MUST be set either as a
-   side effect of manual SA configuration or via negotiation using an SA
-   management protocol, e.g., IKE or Group Domain of Interpretation
-   (GDOI) [RFC3547].  Typically, Source-Specific Multicast (SSM) [HC03]
-   groups use a 3-tuple SA identifier composed of an SPI, a destination
-   multicast address, and source address.  An Any-Source Multicast group
-   SA requires only an SPI and a destination multicast address as an
-   identifier.
-
-   If different classes of traffic (distinguished by Differentiated
-   Services Code Point (DSCP) bits [NiBlBaBL98], [Gro02]) are sent on
-   the same SA, and if the receiver is employing the optional
-   anti-replay feature available in both AH and ESP, this could result
-   in inappropriate discarding of lower priority packets due to the
-   windowing mechanism used by this feature.  Therefore, a sender SHOULD
-   put traffic of different classes, but with the same selector values,
-   on different SAs to support Quality of Service (QoS) appropriately.
-   To permit this, the IPsec implementation MUST permit establishment
-   and maintenance of multiple SAs between a given sender and receiver,
-
-
-
-Kent & Seo                  Standards Track                    [Page 13]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   with the same selectors.  Distribution of traffic among these
-   parallel SAs to support QoS is locally determined by the sender and
-   is not negotiated by IKE.  The receiver MUST process the packets from
-   the different SAs without prejudice.  These requirements apply to
-   both transport and tunnel mode SAs.  In the case of tunnel mode SAs,
-   the DSCP values in question appear in the inner IP header.  In
-   transport mode, the DSCP value might change en route, but this should
-   not cause problems with respect to IPsec processing since the value
-   is not employed for SA selection and MUST NOT be checked as part of
-   SA/packet validation.  However, if significant re-ordering of packets
-   occurs in an SA, e.g., as a result of changes to DSCP values en
-   route, this may trigger packet discarding by a receiver due to
-   application of the anti-replay mechanism.
-
-   DISCUSSION: Although the DSCP [NiBlBaBL98, Gro02] and Explicit
-   Congestion Notification (ECN) [RaFlBl01] fields are not "selectors",
-   as that term in used in this architecture, the sender will need a
-   mechanism to direct packets with a given (set of) DSCP values to the
-   appropriate SA.  This mechanism might be termed a "classifier".
-
-   As noted above, two types of SAs are defined: transport mode and
-   tunnel mode.  IKE creates pairs of SAs, so for simplicity, we choose
-   to require that both SAs in a pair be of the same mode, transport or
-   tunnel.
-
-   A transport mode SA is an SA typically employed between a pair of
-   hosts to provide end-to-end security services.  When security is
-   desired between two intermediate systems along a path (vs. end-to-end
-   use of IPsec), transport mode MAY be used between security gateways
-   or between a security gateway and a host.  In the case where
-   transport mode is used between security gateways or between a
-   security gateway and a host, transport mode may be used to support
-   in-IP tunneling (e.g., IP-in-IP [Per96] or Generic Routing
-   Encapsulation (GRE) tunneling [FaLiHaMeTr00] or dynamic routing
-   [ToEgWa04]) over transport mode SAs.  To clarify, the use of
-   transport mode by an intermediate system (e.g., a security gateway)
-   is permitted only when applied to packets whose source address (for
-   outbound packets) or destination address (for inbound packets) is an
-   address belonging to the intermediate system itself.  The access
-   control functions that are an important part of IPsec are
-   significantly limited in this context, as they cannot be applied to
-   the end-to-end headers of the packets that traverse a transport mode
-   SA used in this fashion.  Thus, this way of using transport mode
-   should be evaluated carefully before being employed in a specific
-   context.
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 14]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   In IPv4, a transport mode security protocol header appears
-   immediately after the IP header and any options, and before any next
-   layer protocols (e.g., TCP or UDP).  In IPv6, the security protocol
-   header appears after the base IP header and selected extension
-   headers, but may appear before or after destination options; it MUST
-   appear before next layer protocols (e.g., TCP, UDP, Stream Control
-   Transmission Protocol (SCTP)).  In the case of ESP, a transport mode
-   SA provides security services only for these next layer protocols,
-   not for the IP header or any extension headers preceding the ESP
-   header.  In the case of AH, the protection is also extended to
-   selected portions of the IP header preceding it, selected portions of
-   extension headers, and selected options (contained in the IPv4
-   header, IPv6 Hop-by-Hop extension header, or IPv6 Destination
-   extension headers).  For more details on the coverage afforded by AH,
-   see the AH specification [Ken05b].
-
-   A tunnel mode SA is essentially an SA applied to an IP tunnel, with
-   the access controls applied to the headers of the traffic inside the
-   tunnel.  Two hosts MAY establish a tunnel mode SA between themselves.
-   Aside from the two exceptions below, whenever either end of a
-   security association is a security gateway, the SA MUST be tunnel
-   mode.  Thus, an SA between two security gateways is typically a
-   tunnel mode SA, as is an SA between a host and a security gateway.
-   The two exceptions are as follows.
-
-    o Where traffic is destined for a security gateway, e.g., Simple
-      Network Management Protocol (SNMP) commands, the security gateway
-      is acting as a host and transport mode is allowed.  In this case,
-      the SA terminates at a host (management) function within a
-      security gateway and thus merits different treatment.
-
-    o As noted above, security gateways MAY support a transport mode SA
-      to provide security for IP traffic between two intermediate
-      systems along a path, e.g., between a host and a security gateway
-      or between two security gateways.
-
-   Several concerns motivate the use of tunnel mode for an SA involving
-   a security gateway.  For example, if there are multiple paths (e.g.,
-   via different security gateways) to the same destination behind a
-   security gateway, it is important that an IPsec packet be sent to the
-   security gateway with which the SA was negotiated.  Similarly, a
-   packet that might be fragmented en route must have all the fragments
-   delivered to the same IPsec instance for reassembly prior to
-   cryptographic processing.  Also, when a fragment is processed by
-   IPsec and transmitted, then fragmented en route, it is critical that
-   there be inner and outer headers to retain the fragmentation state
-   data for the pre- and post-IPsec packet formats.  Hence there are
-   several reasons for employing tunnel mode when either end of an SA is
-
-
-
-Kent & Seo                  Standards Track                    [Page 15]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   a security gateway. (Use of an IP-in-IP tunnel in conjunction with
-   transport mode can also address these fragmentation issues.  However,
-   this configuration limits the ability of IPsec to enforce access
-   control policies on traffic.)
-
-   Note: AH and ESP cannot be applied using transport mode to IPv4
-   packets that are fragments.  Only tunnel mode can be employed in such
-   cases.  For IPv6, it would be feasible to carry a plaintext fragment
-   on a transport mode SA; however, for simplicity, this restriction
-   also applies to IPv6 packets.  See Section 7 for more details on
-   handling plaintext fragments on the protected side of the IPsec
-   barrier.
-
-   For a tunnel mode SA, there is an "outer" IP header that specifies
-   the IPsec processing source and destination, plus an "inner" IP
-   header that specifies the (apparently) ultimate source and
-   destination for the packet.  The security protocol header appears
-   after the outer IP header, and before the inner IP header.  If AH is
-   employed in tunnel mode, portions of the outer IP header are afforded
-   protection (as above), as well as all of the tunneled IP packet
-   (i.e., all of the inner IP header is protected, as well as next layer
-   protocols).  If ESP is employed, the protection is afforded only to
-   the tunneled packet, not to the outer header.
-
-   In summary,
-
-   a) A host implementation of IPsec MUST support both transport and
-      tunnel mode.  This is true for native, BITS, and BITW
-      implementations for hosts.
-
-   b) A security gateway MUST support tunnel mode and MAY support
-      transport mode.  If it supports transport mode, that should be
-      used only when the security gateway is acting as a host, e.g., for
-      network management, or to provide security between two
-      intermediate systems along a path.
-
-4.2.  SA Functionality
-
-   The set of security services offered by an SA depends on the security
-   protocol selected, the SA mode, the endpoints of the SA, and the
-   election of optional services within the protocol.
-
-   For example, both AH and ESP offer integrity and authentication
-   services, but the coverage differs for each protocol and differs for
-   transport vs. tunnel mode.  If the integrity of an IPv4 option or
-   IPv6 extension header must be protected en route between sender and
-   receiver, AH can provide this service, except for IP or extension
-   headers that may change in a fashion not predictable by the sender.
-
-
-
-Kent & Seo                  Standards Track                    [Page 16]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   However, the same security may be achieved in some contexts by
-   applying ESP to a tunnel carrying a packet.
-
-   The granularity of access control provided is determined by the
-   choice of the selectors that define each SA.  Moreover, the
-   authentication means employed by IPsec peers, e.g., during creation
-   of an IKE (vs. child) SA also affects the granularity of the access
-   control afforded.
-
-   If confidentiality is selected, then an ESP (tunnel mode) SA between
-   two security gateways can offer partial traffic flow confidentiality.
-   The use of tunnel mode allows the inner IP headers to be encrypted,
-   concealing the identities of the (ultimate) traffic source and
-   destination.  Moreover, ESP payload padding also can be invoked to
-   hide the size of the packets, further concealing the external
-   characteristics of the traffic.  Similar traffic flow confidentiality
-   services may be offered when a mobile user is assigned a dynamic IP
-   address in a dialup context, and establishes a (tunnel mode) ESP SA
-   to a corporate firewall (acting as a security gateway).  Note that
-   fine-granularity SAs generally are more vulnerable to traffic
-   analysis than coarse-granularity ones that are carrying traffic from
-   many subscribers.
-
-   Note: A compliant implementation MUST NOT allow instantiation of an
-   ESP SA that employs both NULL encryption and no integrity algorithm.
-   An attempt to negotiate such an SA is an auditable event by both
-   initiator and responder.  The audit log entry for this event SHOULD
-   include the current date/time, local IKE IP address, and remote IKE
-   IP address.  The initiator SHOULD record the relevant SPD entry.
-
-4.3.  Combining SAs
-
-   This document does not require support for nested security
-   associations or for what RFC 2401 [RFC2401] called "SA bundles".
-   These features still can be effected by appropriate configuration of
-   both the SPD and the local forwarding functions (for inbound and
-   outbound traffic), but this capability is outside of the IPsec module
-   and thus the scope of this specification.  As a result, management of
-   nested/bundled SAs is potentially more complex and less assured than
-   under the model implied by RFC 2401 [RFC2401].  An implementation
-   that provides support for nested SAs SHOULD provide a management
-   interface that enables a user or administrator to express the nesting
-   requirement, and then create the appropriate SPD entries and
-   forwarding table entries to effect the requisite processing. (See
-   Appendix E for an example of how to configure nested SAs.)
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 17]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-4.4.  Major IPsec Databases
-
-   Many of the details associated with processing IP traffic in an IPsec
-   implementation are largely a local matter, not subject to
-   standardization.  However, some external aspects of the processing
-   must be standardized to ensure interoperability and to provide a
-   minimum management capability that is essential for productive use of
-   IPsec.  This section describes a general model for processing IP
-   traffic relative to IPsec functionality, in support of these
-   interoperability and functionality goals.  The model described below
-   is nominal; implementations need not match details of this model as
-   presented, but the external behavior of implementations MUST
-   correspond to the externally observable characteristics of this model
-   in order to be compliant.
-
-   There are three nominal databases in this model: the Security Policy
-   Database (SPD), the Security Association Database (SAD), and the Peer
-   Authorization Database (PAD).  The first specifies the policies that
-   determine the disposition of all IP traffic inbound or outbound from
-   a host or security gateway (Section 4.4.1).  The second database
-   contains parameters that are associated with each established (keyed)
-   SA (Section 4.4.2).  The third database, the PAD, provides a link
-   between an SA management protocol (such as IKE) and the SPD (Section
-   4.4.3).
-
-   Multiple Separate IPsec Contexts
-
-      If an IPsec implementation acts as a security gateway for multiple
-      subscribers, it MAY implement multiple separate IPsec contexts.
-      Each context MAY have and MAY use completely independent
-      identities, policies, key management SAs, and/or IPsec SAs.  This
-      is for the most part a local implementation matter.  However, a
-      means for associating inbound (SA) proposals with local contexts
-      is required.  To this end, if supported by the key management
-      protocol in use, context identifiers MAY be conveyed from
-      initiator to responder in the signaling messages, with the result
-      that IPsec SAs are created with a binding to a particular context.
-      For example, a security gateway that provides VPN service to
-      multiple customers will be able to associate each customer's
-      traffic with the correct VPN.
-
-   Forwarding vs Security Decisions
-
-      The IPsec model described here embodies a clear separation between
-      forwarding (routing) and security decisions, to accommodate a wide
-      range of contexts where IPsec may be employed.  Forwarding may be
-      trivial, in the case where there are only two interfaces, or it
-      may be complex, e.g., if the context in which IPsec is implemented
-
-
-
-Kent & Seo                  Standards Track                    [Page 18]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      employs a sophisticated forwarding function.  IPsec assumes only
-      that outbound and inbound traffic that has passed through IPsec
-      processing is forwarded in a fashion consistent with the context
-      in which IPsec is implemented.  Support for nested SAs is
-      optional; if required, it requires coordination between forwarding
-      tables and SPD entries to cause a packet to traverse the IPsec
-      boundary more than once.
-
-   "Local" vs "Remote"
-
-      In this document, with respect to IP addresses and ports, the
-      terms "Local" and "Remote" are used for policy rules.  "Local"
-      refers to the entity being protected by an IPsec implementation,
-      i.e., the "source" address/port of outbound packets or the
-      "destination" address/port of inbound packets. "Remote" refers to
-      a peer entity or peer entities.  The terms "source" and
-      "destination" are used for packet header fields.
-
-   "Non-initial" vs "Initial" Fragments
-
-      Throughout this document, the phrase "non-initial fragments" is
-      used to mean fragments that do not contain all of the selector
-      values that may be needed for access control (e.g., they might not
-      contain Next Layer Protocol, source and destination ports, ICMP
-      message type/code, Mobility Header type).  And the phrase "initial
-      fragment" is used to mean a fragment that contains all the
-      selector values needed for access control.  However, it should be
-      noted that for IPv6, which fragment contains the Next Layer
-      Protocol and ports (or ICMP message type/code or Mobility Header
-      type [Mobip]) will depend on the kind and number of extension
-      headers present.  The "initial fragment" might not be the first
-      fragment, in this context.
-
-4.4.1.  The Security Policy Database (SPD)
-
-   An SA is a management construct used to enforce security policy for
-   traffic crossing the IPsec boundary.  Thus, an essential element of
-   SA processing is an underlying Security Policy Database (SPD) that
-   specifies what services are to be offered to IP datagrams and in what
-   fashion.  The form of the database and its interface are outside the
-   scope of this specification.  However, this section specifies minimum
-   management functionality that must be provided, to allow a user or
-   system administrator to control whether and how IPsec is applied to
-   traffic transmitted or received by a host or transiting a security
-   gateway.  The SPD, or relevant caches, must be consulted during the
-   processing of all traffic (inbound and outbound), including traffic
-   not protected by IPsec, that traverses the IPsec boundary.  This
-   includes IPsec management traffic such as IKE.  An IPsec
-
-
-
-Kent & Seo                  Standards Track                    [Page 19]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   implementation MUST have at least one SPD, and it MAY support
-   multiple SPDs, if appropriate for the context in which the IPsec
-   implementation operates.  There is no requirement to maintain SPDs on
-   a per-interface basis, as was specified in RFC 2401 [RFC2401].
-   However, if an implementation supports multiple SPDs, then it MUST
-   include an explicit SPD selection function that is invoked to select
-   the appropriate SPD for outbound traffic processing.  The inputs to
-   this function are the outbound packet and any local metadata (e.g.,
-   the interface via which the packet arrived) required to effect the
-   SPD selection function.  The output of the function is an SPD
-   identifier (SPD-ID).
-
-   The SPD is an ordered database, consistent with the use of Access
-   Control Lists (ACLs) or packet filters in firewalls, routers, etc.
-   The ordering requirement arises because entries often will overlap
-   due to the presence of (non-trivial) ranges as values for selectors.
-   Thus, a user or administrator MUST be able to order the entries to
-   express a desired access control policy.  There is no way to impose a
-   general, canonical order on SPD entries, because of the allowed use
-   of wildcards for selector values and because the different types of
-   selectors are not hierarchically related.
-
-   Processing Choices:  DISCARD, BYPASS, PROTECT
-
-      An SPD must discriminate among traffic that is afforded IPsec
-      protection and traffic that is allowed to bypass IPsec.  This
-      applies to the IPsec protection to be applied by a sender and to
-      the IPsec protection that must be present at the receiver.  For
-      any outbound or inbound datagram, three processing choices are
-      possible: DISCARD, BYPASS IPsec, or PROTECT using IPsec.  The
-      first choice refers to traffic that is not allowed to traverse the
-      IPsec boundary (in the specified direction).  The second choice
-      refers to traffic that is allowed to cross the IPsec boundary
-      without IPsec protection.  The third choice refers to traffic that
-      is afforded IPsec protection, and for such traffic the SPD must
-      specify the security protocols to be employed, their mode,
-      security service options, and the cryptographic algorithms to be
-      used.
-
-   SPD-S, SPD-I, SPD-O
-
-      An SPD is logically divided into three pieces.  The SPD-S (secure
-      traffic) contains entries for all traffic subject to IPsec
-      protection.  SPD-O (outbound) contains entries for all outbound
-      traffic that is to be bypassed or discarded.  SPD-I (inbound) is
-      applied to inbound traffic that will be bypassed or discarded.
-      All three of these can be decorrelated (with the exception noted
-      above for native host implementations) to facilitate caching.  If
-
-
-
-Kent & Seo                  Standards Track                    [Page 20]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      an IPsec implementation supports only one SPD, then the SPD
-      consists of all three parts.  If multiple SPDs are supported, some
-      of them may be partial, e.g., some SPDs might contain only SPD-I
-      entries, to control inbound bypassed traffic on a per-interface
-      basis.  The split allows SPD-I to be consulted without having to
-      consult SPD-S, for such traffic.  Since the SPD-I is just a part
-      of the SPD, if a packet that is looked up in the SPD-I cannot be
-      matched to an entry there, then the packet MUST be discarded.
-      Note that for outbound traffic, if a match is not found in SPD-S,
-      then SPD-O must be checked to see if the traffic should be
-      bypassed.  Similarly, if SPD-O is checked first and no match is
-      found, then SPD-S must be checked.  In an ordered,
-      non-decorrelated SPD, the entries for the SPD-S, SPD-I, and SPD-O
-      are interleaved.  So there is one lookup in the SPD.
-
-   SPD Entries
-
-      Each SPD entry specifies packet disposition as BYPASS, DISCARD, or
-      PROTECT.  The entry is keyed by a list of one or more selectors.
-      The SPD contains an ordered list of these entries.  The required
-      selector types are defined in Section 4.4.1.1. These selectors are
-      used to define the granularity of the SAs that are created in
-      response to an outbound packet or in response to a proposal from a
-      peer.  The detailed structure of an SPD entry is described in
-      Section 4.4.1.2. Every SPD SHOULD have a nominal, final entry that
-      matches anything that is otherwise unmatched, and discards it.
-
-      The SPD MUST permit a user or administrator to specify policy
-      entries as follows:
-
-       - SPD-I: For inbound traffic that is to be bypassed or discarded,
-         the entry consists of the values of the selectors that apply to
-         the traffic to be bypassed or discarded.
-
-       - SPD-O: For outbound traffic that is to be bypassed or
-         discarded, the entry consists of the values of the selectors
-         that apply to the traffic to be bypassed or discarded.
-
-       - SPD-S: For traffic that is to be protected using IPsec, the
-         entry consists of the values of the selectors that apply to the
-         traffic to be protected via AH or ESP, controls on how to
-         create SAs based on these selectors, and the parameters needed
-         to effect this protection (e.g., algorithms, modes, etc.). Note
-         that an SPD-S entry also contains information such as "populate
-         from packet" (PFP) flag (see paragraphs below on "How To Derive
-         the Values for an SAD entry") and bits indicating whether the
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 21]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-         SA lookup makes use of the local and remote IP addresses in
-         addition to the SPI (see AH [Ken05b] or ESP [Ken05a]
-         specifications).
-
-   Representing Directionality in an SPD Entry
-
-      For traffic protected by IPsec, the Local and Remote address and
-      ports in an SPD entry are swapped to represent directionality,
-      consistent with IKE conventions.  In general, the protocols that
-      IPsec deals with have the property of requiring symmetric SAs with
-      flipped Local/Remote IP addresses.  However, for ICMP, there is
-      often no such bi-directional authorization requirement.
-      Nonetheless, for the sake of uniformity and simplicity, SPD
-      entries for ICMP are specified in the same way as for other
-      protocols.  Note also that for ICMP, Mobility Header, and
-      non-initial fragments, there are no port fields in these packets.
-      ICMP has message type and code and Mobility Header has mobility
-      header type.  Thus, SPD entries have provisions for expressing
-      access controls appropriate for these protocols, in lieu of the
-      normal port field controls.  For bypassed or discarded traffic,
-      separate inbound and outbound entries are supported, e.g., to
-      permit unidirectional flows if required.
-
-   OPAQUE and ANY
-
-      For each selector in an SPD entry, in addition to the literal
-      values that define a match, there are two special values: ANY and
-      OPAQUE.  ANY is a wildcard that matches any value in the
-      corresponding field of the packet, or that matches packets where
-      that field is not present or is obscured.  OPAQUE indicates that
-      the corresponding selector field is not available for examination
-      because it may not be present in a fragment, it does not exist for
-      the given Next Layer Protocol, or prior application of IPsec may
-      have encrypted the value.  The ANY value encompasses the OPAQUE
-      value.  Thus, OPAQUE need be used only when it is necessary to
-      distinguish between the case of any allowed value for a field, vs.
-      the absence or unavailability (e.g., due to encryption) of the
-      field.
-
-   How to Derive the Values for an SAD Entry
-
-      For each selector in an SPD entry, the entry specifies how to
-      derive the corresponding values for a new SA Database (SAD, see
-      Section 4.4.2) entry from those in the SPD and the packet.  The
-      goal is to allow an SAD entry and an SPD cache entry to be created
-      based on specific selector values from the packet, or from the
-      matching SPD entry.  For outbound traffic, there are SPD-S cache
-      entries and SPD-O cache entries.  For inbound traffic not
-
-
-
-Kent & Seo                  Standards Track                    [Page 22]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      protected by IPsec, there are SPD-I cache entries and there is the
-      SAD, which represents the cache for inbound IPsec-protected
-      traffic (see Section 4.4.2).  If IPsec processing is specified for
-      an entry, a "populate from packet" (PFP) flag may be asserted for
-      one or more of the selectors in the SPD entry (Local IP address;
-      Remote IP address; Next Layer Protocol; and, depending on Next
-      Layer Protocol, Local port and Remote port, or ICMP type/code, or
-      Mobility Header type).  If asserted for a given selector X, the
-      flag indicates that the SA to be created should take its value for
-      X from the value in the packet.  Otherwise, the SA should take its
-      value(s) for X from the value(s) in the SPD entry.  Note: In the
-      non-PFP case, the selector values negotiated by the SA management
-      protocol (e.g., IKEv2) may be a subset of those in the SPD entry,
-      depending on the SPD policy of the peer.  Also, whether a single
-      flag is used for, e.g., source port, ICMP type/code, and Mobility
-      Header (MH) type, or a separate flag is used for each, is a local
-      matter.
-
-      The following example illustrates the use of the PFP flag in the
-      context of a security gateway or a BITS/BITW implementation.
-      Consider an SPD entry where the allowed value for Remote address
-      is a range of IPv4 addresses: 192.0.2.1 to 192.0.2.10.  Suppose an
-      outbound packet arrives with a destination address of 192.0.2.3,
-      and there is no extant SA to carry this packet.  The value used
-      for the SA created to transmit this packet could be either of the
-      two values shown below, depending on what the SPD entry for this
-      selector says is the source of the selector value:
-
-          PFP flag value  example of new
-          for the Remote  SAD dest. address
-          addr. selector  selector value
-          --------------- ------------
-          a. PFP TRUE     192.0.2.3 (one host)
-          b. PFP FALSE    192.0.2.1 to 192.0.2.10 (range of hosts)
-
-      Note that if the SPD entry above had a value of ANY for the Remote
-      address, then the SAD selector value would have to be ANY for case
-      (b), but would still be as illustrated for case (a).  Thus, the
-      PFP flag can be used to prohibit sharing of an SA, even among
-      packets that match the same SPD entry.
-
-   Management Interface
-
-      For every IPsec implementation, there MUST be a management
-      interface that allows a user or system administrator to manage the
-      SPD.  The interface must allow the user (or administrator) to
-      specify the security processing to be applied to every packet that
-      traverses the IPsec boundary. (In a native host IPsec
-
-
-
-Kent & Seo                  Standards Track                    [Page 23]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      implementation making use of a socket interface, the SPD may not
-      need to be consulted on a per-packet basis, as noted at the end of
-      Section 4.4.1.1 and in Section 5.)  The management interface for
-      the SPD MUST allow creation of entries consistent with the
-      selectors defined in Section 4.4.1.1, and MUST support (total)
-      ordering of these entries, as seen via this interface.  The SPD
-      entries' selectors are analogous to the ACL or packet filters
-      commonly found in a stateless firewall or packet filtering router
-      and which are currently managed this way.
-
-      In host systems, applications MAY be allowed to create SPD
-      entries.  (The means of signaling such requests to the IPsec
-      implementation are outside the scope of this standard.)  However,
-      the system administrator MUST be able to specify whether or not a
-      user or application can override (default) system policies.  The
-      form of the management interface is not specified by this document
-      and may differ for hosts vs. security gateways, and within hosts
-      the interface may differ for socket-based vs. BITS
-      implementations.  However, this document does specify a standard
-      set of SPD elements that all IPsec implementations MUST support.
-
-   Decorrelation
-
-      The processing model described in this document assumes the
-      ability to decorrelate overlapping SPD entries to permit caching,
-      which enables more efficient processing of outbound traffic in
-      security gateways and BITS/BITW implementations.  Decorrelation
-      [CoSa04] is only a means of improving performance and simplifying
-      the processing description.  This RFC does not require a compliant
-      implementation to make use of decorrelation.  For example, native
-      host implementations typically make use of caching implicitly
-      because they bind SAs to socket interfaces, and thus there is no
-      requirement to be able to decorrelate SPD entries in these
-      implementations.
-
-      Note:  Unless otherwise qualified, the use of "SPD" refers to the
-      body of policy information in both ordered or decorrelated
-      (unordered) state.  Appendix B provides an algorithm that can be
-      used to decorrelate SPD entries, but any algorithm that produces
-      equivalent output may be used.  Note that when an SPD entry is
-      decorrelated all the resulting entries MUST be linked together, so
-      that all members of the group derived from an individual, SPD
-      entry (prior to decorrelation) can all be placed into caches and
-      into the SAD at the same time.  For example, suppose one starts
-      with an entry A (from an ordered SPD) that when decorrelated,
-      yields entries A1, A2, and A3.  When a packet comes along that
-      matches, say A2, and triggers the creation of an SA, the SA
-      management protocol (e.g., IKEv2) negotiates A.  And all 3
-
-
-
-Kent & Seo                  Standards Track                    [Page 24]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      decorrelated entries, A1, A2, and A3, are placed in the
-      appropriate SPD-S cache and linked to the SA.  The intent is that
-      use of a decorrelated SPD ought not to create more SAs than would
-      have resulted from use of a not-decorrelated SPD.
-
-      If a decorrelated SPD is employed, there are three options for
-      what an initiator sends to a peer via an SA management protocol
-      (e.g., IKE).  By sending the complete set of linked, decorrelated
-      entries that were selected from the SPD, a peer is given the best
-      possible information to enable selection of the appropriate SPD
-      entry at its end, especially if the peer has also decorrelated its
-      SPD.  However, if a large number of decorrelated entries are
-      linked, this may create large packets for SA negotiation, and
-      hence fragmentation problems for the SA management protocol.
-
-      Alternatively, the original entry from the (correlated) SPD may be
-      retained and passed to the SA management protocol.  Passing the
-      correlated SPD entry keeps the use of a decorrelated SPD a local
-      matter, not visible to peers, and avoids possible fragmentation
-      concerns, although it provides less precise information to a
-      responder for matching against the responder's SPD.
-
-      An intermediate approach is to send a subset of the complete set
-      of linked, decorrelated SPD entries.  This approach can avoid the
-      fragmentation problems cited above yet provide better information
-      than the original, correlated entry.  The major shortcoming of
-      this approach is that it may cause additional SAs to be created
-      later, since only a subset of the linked, decorrelated entries are
-      sent to a peer.  Implementers are free to employ any of the
-      approaches cited above.
-
-      A responder uses the traffic selector proposals it receives via an
-      SA management protocol to select an appropriate entry in its SPD.
-      The intent of the matching is to select an SPD entry and create an
-      SA that most closely matches the intent of the initiator, so that
-      traffic traversing the resulting SA will be accepted at both ends.
-      If the responder employs a decorrelated SPD, it SHOULD use the
-      decorrelated SPD entries for matching, as this will generally
-      result in creation of SAs that are more likely to match the intent
-      of both peers.  If the responder has a correlated SPD, then it
-      SHOULD match the proposals against the correlated entries.  For
-      IKEv2, use of a decorrelated SPD offers the best opportunity for a
-      responder to generate a "narrowed" response.
-
-      In all cases, when a decorrelated SPD is available, the
-      decorrelated entries are used to populate the SPD-S cache.  If the
-      SPD is not decorrelated, caching is not allowed and an ordered
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 25]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      search of SPD MUST be performed to verify that inbound traffic
-      arriving on an SA is consistent with the access control policy
-      expressed in the SPD.
-
-   Handling Changes to the SPD While the System Is Running
-
-      If a change is made to the SPD while the system is running, a
-      check SHOULD be made of the effect of this change on extant SAs.
-      An implementation SHOULD check the impact of an SPD change on
-      extant SAs and SHOULD provide a user/administrator with a
-      mechanism for configuring what actions to take, e.g., delete an
-      affected SA, allow an affected SA to continue unchanged, etc.
-
-4.4.1.1.   Selectors
-
-   An SA may be fine-grained or coarse-grained, depending on the
-   selectors used to define the set of traffic for the SA.  For example,
-   all traffic between two hosts may be carried via a single SA, and
-   afforded a uniform set of security services.  Alternatively, traffic
-   between a pair of hosts might be spread over multiple SAs, depending
-   on the applications being used (as defined by the Next Layer Protocol
-   and related fields, e.g., ports), with different security services
-   offered by different SAs.  Similarly, all traffic between a pair of
-   security gateways could be carried on a single SA, or one SA could be
-   assigned for each communicating host pair.  The following selector
-   parameters MUST be supported by all IPsec implementations to
-   facilitate control of SA granularity.  Note that both Local and
-   Remote addresses should either be IPv4 or IPv6, but not a mix of
-   address types.  Also, note that the Local/Remote port selectors (and
-   ICMP message type and code, and Mobility Header type) may be labeled
-   as OPAQUE to accommodate situations where these fields are
-   inaccessible due to packet fragmentation.
-
-      - Remote IP Address(es) (IPv4 or IPv6): This is a list of ranges
-        of IP addresses (unicast, broadcast (IPv4 only)).  This
-        structure allows expression of a single IP address (via a
-        trivial range), or a list of addresses (each a trivial range),
-        or a range of addresses (low and high values, inclusive), as
-        well as the most generic form of a list of ranges.  Address
-        ranges are used to support more than one remote system sharing
-        the same SA, e.g., behind a security gateway.
-
-      - Local IP Address(es) (IPv4 or IPv6): This is a list of ranges of
-        IP addresses (unicast, broadcast (IPv4 only)).  This structure
-        allows expression of a single IP address (via a trivial range),
-        or a list of addresses (each a trivial range), or a range of
-        addresses (low and high values, inclusive), as well as the most
-        generic form of a list of ranges.  Address ranges are used to
-
-
-
-Kent & Seo                  Standards Track                    [Page 26]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-        support more than one source system sharing the same SA, e.g.,
-        behind a security gateway.  Local refers to the address(es)
-        being protected by this implementation (or policy entry).
-
-        Note: The SPD does not include support for multicast address
-        entries.  To support multicast SAs, an implementation should
-        make use of a Group SPD (GSPD) as defined in [RFC3740].  GSPD
-        entries require a different structure, i.e., one cannot use the
-        symmetric relationship associated with local and remote address
-        values for unicast SAs in a multicast context.  Specifically,
-        outbound traffic directed to a multicast address on an SA would
-        not be received on a companion, inbound SA with the multicast
-        address as the source.
-
-      - Next Layer Protocol: Obtained from the IPv4 "Protocol" or the
-        IPv6 "Next Header" fields.  This is an individual protocol
-        number, ANY, or for IPv6 only, OPAQUE.  The Next Layer Protocol
-        is whatever comes after any IP extension headers that are
-        present.  To simplify locating the Next Layer Protocol, there
-        SHOULD be a mechanism for configuring which IPv6 extension
-        headers to skip.  The default configuration for which protocols
-        to skip SHOULD include the following protocols: 0 (Hop-by-hop
-        options), 43 (Routing Header), 44 (Fragmentation Header), and 60
-        (Destination Options).  Note: The default list does NOT include
-        51 (AH) or 50 (ESP).  From a selector lookup point of view,
-        IPsec treats AH and ESP as Next Layer Protocols.
-
-        Several additional selectors depend on the Next Layer Protocol
-        value:
-
-         * If the Next Layer Protocol uses two ports (as do TCP, UDP,
-           SCTP, and others), then there are selectors for Local and
-           Remote Ports.  Each of these selectors has a list of ranges
-           of values.  Note that the Local and Remote ports may not be
-           available in the case of receipt of a fragmented packet or if
-           the port fields have been protected by IPsec (encrypted);
-           thus, a value of OPAQUE also MUST be supported.  Note: In a
-           non-initial fragment, port values will not be available.  If
-           a port selector specifies a value other than ANY or OPAQUE,
-           it cannot match packets that are non-initial fragments.  If
-           the SA requires a port value other than ANY or OPAQUE, an
-           arriving fragment without ports MUST be discarded. (See
-           Section 7, "Handling Fragments".)
-
-         * If the Next Layer Protocol is a Mobility Header, then there
-           is a selector for IPv6 Mobility Header message type (MH type)
-           [Mobip].  This is an 8-bit value that identifies a particular
-           mobility message.  Note that the MH type may not be available
-
-
-
-Kent & Seo                  Standards Track                    [Page 27]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-           in the case of receipt of a fragmented packet. (See Section
-           7, "Handling Fragments".) For IKE, the IPv6 Mobility Header
-           message type (MH type) is placed in the most significant
-           eight bits of the 16-bit local "port" selector.
-
-         * If the Next Layer Protocol value is ICMP, then there is a
-           16-bit selector for the ICMP message type and code.  The
-           message type is a single 8-bit value, which defines the type
-           of an ICMP message, or ANY.  The ICMP code is a single 8-bit
-           value that defines a specific subtype for an ICMP message.
-           For IKE, the message type is placed in the most significant 8
-           bits of the 16-bit selector and the code is placed in the
-           least significant 8 bits.  This 16-bit selector can contain a
-           single type and a range of codes, a single type and ANY code,
-           and ANY type and ANY code.  Given a policy entry with a range
-           of Types (T-start to T-end) and a range of Codes (C-start to
-           C-end), and an ICMP packet with Type t and Code c, an
-           implementation MUST test for a match using
-
-               (T-start*256) + C-start <= (t*256) + c <= (T-end*256) +
-               C-end
-
-           Note that the ICMP message type and code may not be available
-           in the case of receipt of a fragmented packet. (See Section
-           7, "Handling Fragments".)
-
-      - Name:  This is not a selector like the others above.  It is not
-        acquired from a packet.  A name may be used as a symbolic
-        identifier for an IPsec Local or Remote address.  Named SPD
-        entries are used in two ways:
-
-         1. A named SPD entry is used by a responder (not an initiator)
-            in support of access control when an IP address would not be
-            appropriate for the Remote IP address selector, e.g., for
-            "road warriors".  The name used to match this field is
-            communicated during the IKE negotiation in the ID payload.
-            In this context, the initiator's Source IP address (inner IP
-            header in tunnel mode) is bound to the Remote IP address in
-            the SAD entry created by the IKE negotiation.  This address
-            overrides the Remote IP address value in the SPD, when the
-            SPD entry is selected in this fashion.  All IPsec
-            implementations MUST support this use of names.
-
-         2. A named SPD entry may be used by an initiator to identify a
-            user for whom an IPsec SA will be created (or for whom
-            traffic may be bypassed).  The initiator's IP source address
-            (from inner IP header in tunnel mode) is used to replace the
-            following if and when they are created:
-
-
-
-Kent & Seo                  Standards Track                    [Page 28]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-                    - local address in the SPD cache entry
-                    - local address in the outbound SAD entry
-                    - remote address in the inbound SAD entry
-
-            Support for this use is optional for multi-user, native host
-            implementations and not applicable to other implementations.
-            Note that this name is used only locally; it is not
-            communicated by the key management protocol.  Also, name
-            forms other than those used for case 1 above (responder) are
-            applicable in the initiator context (see below).
-
-         An SPD entry can contain both a name (or a list of names) and
-         also values for the Local or Remote IP address.
-
-         For case 1, responder, the identifiers employed in named SPD
-         entries are one of the following four types:
-
-                 a. a fully qualified user name string (email), e.g.,
-                    mozart@foo.example.com
-                    (this corresponds to ID_RFC822_ADDR in IKEv2)
-
-                 b. a fully qualified DNS name, e.g.,
-                    foo.example.com
-                    (this corresponds to ID_FQDN in IKEv2)
-
-                 c. X.500 distinguished name, e.g., [WaKiHo97],
-                    CN = Stephen T. Kent, O = BBN Technologies,
-                    SP = MA, C = US
-                    (this corresponds to ID_DER_ASN1_DN in IKEv2, after
-                    decoding)
-
-                 d. a byte string
-                    (this corresponds to Key_ID in IKEv2)
-
-         For case 2, initiator, the identifiers employed in named SPD
-         entries are of type byte string.  They are likely to be Unix
-         UIDs, Windows security IDs, or something similar, but could
-         also be a user name or account name.  In all cases, this
-         identifier is only of local concern and is not transmitted.
-
-   The IPsec implementation context determines how selectors are used.
-   For example, a native host implementation typically makes use of a
-   socket interface.  When a new connection is established, the SPD can
-   be consulted and an SA bound to the socket.  Thus, traffic sent via
-   that socket need not result in additional lookups to the SPD (SPD-O
-   and SPD-S) cache.  In contrast, a BITS, BITW, or security gateway
-   implementation needs to look at each packet and perform an
-   SPD-O/SPD-S cache lookup based on the selectors.
-
-
-
-Kent & Seo                  Standards Track                    [Page 29]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-4.4.1.2.  Structure of an SPD Entry
-
-   This section contains a prose description of an SPD entry.  Also,
-   Appendix C provides an example of an ASN.1 definition of an SPD
-   entry.
-
-   This text describes the SPD in a fashion that is intended to map
-   directly into IKE payloads to ensure that the policy required by SPD
-   entries can be negotiated through IKE.  Unfortunately, the semantics
-   of the version of IKEv2 published concurrently with this document
-   [Kau05] do not align precisely with those defined for the SPD.
-   Specifically, IKEv2 does not enable negotiation of a single SA that
-   binds multiple pairs of local and remote addresses and ports to a
-   single SA.  Instead, when multiple local and remote addresses and
-   ports are negotiated for an SA, IKEv2 treats these not as pairs, but
-   as (unordered) sets of local and remote values that can be
-   arbitrarily paired.  Until IKE provides a facility that conveys the
-   semantics that are expressed in the SPD via selector sets (as
-   described below), users MUST NOT include multiple selector sets in a
-   single SPD entry unless the access control intent aligns with the IKE
-   "mix and match" semantics.  An implementation MAY warn users, to
-   alert them to this problem if users create SPD entries with multiple
-   selector sets, the syntax of which indicates possible conflicts with
-   current IKE semantics.
-
-   The management GUI can offer the user other forms of data entry and
-   display, e.g., the option of using address prefixes as well as
-   ranges, and symbolic names for protocols, ports, etc. (Do not confuse
-   the use of symbolic names in a management interface with the SPD
-   selector "Name".) Note that Remote/Local apply only to IP addresses
-   and ports, not to ICMP message type/code or Mobility Header type.
-   Also, if the reserved, symbolic selector value OPAQUE or ANY is
-   employed for a given selector type, only that value may appear in the
-   list for that selector, and it must appear only once in the list for
-   that selector.  Note that ANY and OPAQUE are local syntax conventions
-   -- IKEv2 negotiates these values via the ranges indicated below:
-
-          ANY:     start = 0        end = <max>
-          OPAQUE:  start = <max>    end = 0
-
-   An SPD is an ordered list of entries each of which contains the
-   following fields.
-
-           o Name -- a list of IDs.  This quasi-selector is optional.
-             The forms that MUST be supported are described above in
-             Section 4.4.1.1 under "Name".
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 30]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-           o PFP flags -- one per traffic selector.  A given flag, e.g.,
-             for Next Layer Protocol, applies to the relevant selector
-             across all "selector sets" (see below) contained in an SPD
-             entry.  When creating an SA, each flag specifies for the
-             corresponding traffic selector whether to instantiate the
-             selector from the corresponding field in the packet that
-             triggered the creation of the SA or from the value(s) in
-             the corresponding SPD entry (see Section 4.4.1, "How to
-             Derive the Values for an SAD Entry").  Whether a single
-             flag is used for, e.g., source port, ICMP type/code, and
-             MH type, or a separate flag is used for each, is a local
-             matter.  There are PFP flags for:
-                - Local Address
-                - Remote Address
-                - Next Layer Protocol
-                - Local Port, or ICMP message type/code or Mobility
-                  Header type (depending on the next layer protocol)
-                - Remote Port, or ICMP message type/code or Mobility
-                  Header type (depending on the next layer protocol)
-
-           o One to N selector sets that correspond to the "condition"
-             for applying a particular IPsec action.  Each selector set
-             contains:
-                - Local Address
-                - Remote Address
-                - Next Layer Protocol
-                - Local Port, or ICMP message type/code or Mobility
-                  Header type (depending on the next layer protocol)
-                - Remote Port, or ICMP message type/code or Mobility
-                  Header type (depending on the next layer protocol)
-
-             Note: The "next protocol" selector is an individual value
-             (unlike the local and remote IP addresses) in a selector
-             set entry.  This is consistent with how IKEv2 negotiates
-             the Traffic Selector (TS) values for an SA.  It also makes
-             sense because one may need to associate different port
-             fields with different protocols.  It is possible to
-             associate multiple protocols (and ports) with a single SA
-             by specifying multiple selector sets for that SA.
-
-           o Processing info -- which action is required -- PROTECT,
-             BYPASS, or DISCARD.  There is just one action that goes
-             with all the selector sets, not a separate action for each
-             set.  If the required processing is PROTECT, the entry
-             contains the following information.
-                - IPsec mode -- tunnel or transport
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 31]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-                - (if tunnel mode) local tunnel address -- For a
-                  non-mobile host, if there is just one interface, this
-                  is straightforward; if there are multiple
-                  interfaces, this must be statically configured.  For a
-                  mobile host, the specification of the local address
-                  is handled externally to IPsec.
-                - (if tunnel mode) remote tunnel address -- There is no
-                  standard way to determine this.  See 4.5.3, "Locating
-                  a Security Gateway".
-                - Extended Sequence Number -- Is this SA using extended
-                  sequence numbers?
-                - stateful fragment checking -- Is this SA using
-                  stateful fragment checking?  (See Section 7 for more
-                  details.)
-                - Bypass DF bit (T/F) -- applicable to tunnel mode SAs
-                - Bypass DSCP (T/F) or map to unprotected DSCP values
-                  (array) if needed to restrict bypass of DSCP values --
-                  applicable to tunnel mode SAs
-                - IPsec protocol -- AH or ESP
-                - algorithms -- which ones to use for AH, which ones to
-                  use for ESP, which ones to use for combined mode,
-                  ordered by decreasing priority
-
-   It is a local matter as to what information is kept with regard to
-   handling extant SAs when the SPD is changed.
-
-4.4.1.3.  More Regarding Fields Associated with Next Layer Protocols
-
-   Additional selectors are often associated with fields in the Next
-   Layer Protocol header.  A particular Next Layer Protocol can have
-   zero, one, or two selectors.  There may be situations where there
-   aren't both local and remote selectors for the fields that are
-   dependent on the Next Layer Protocol.  The IPv6 Mobility Header has
-   only a Mobility Header message type.  AH and ESP have no further
-   selector fields.  A system may be willing to send an ICMP message
-   type and code that it does not want to receive.  In the descriptions
-   below, "port" is used to mean a field that is dependent on the Next
-   Layer Protocol.
-
-        A. If a Next Layer Protocol has no "port" selectors, then
-           the Local and Remote "port" selectors are set to OPAQUE in
-           the relevant SPD entry, e.g.,
-
-           Local's
-             next layer protocol = AH
-             "port" selector     = OPAQUE
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 32]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-           Remote's
-             next layer protocol = AH
-             "port" selector     = OPAQUE
-
-        B. Even if a Next Layer Protocol has only one selector, e.g.,
-           Mobility Header type, then the Local and Remote "port"
-           selectors are used to indicate whether a system is
-           willing to send and/or receive traffic with the specified
-          "port" values. For example, if Mobility Headers of a
-           specified type are allowed to be sent and received via an
-           SA, then the relevant SPD entry would be set as follows:
-
-           Local's
-             next layer protocol = Mobility Header
-             "port" selector     = Mobility Header message type
-
-           Remote's
-             next layer protocol = Mobility Header
-             "port" selector     = Mobility Header message type
-
-           If Mobility Headers of a specified type are allowed to be
-           sent but NOT received via an SA, then the relevant SPD
-           entry would be set as follows:
-
-           Local's
-             next layer protocol = Mobility Header
-             "port" selector     = Mobility Header message type
-
-           Remote's
-             next layer protocol = Mobility Header
-             "port" selector     = OPAQUE
-
-           If Mobility Headers of a specified type are allowed to be
-           received but NOT sent via an SA, then the relevant SPD
-           entry would be set as follows:
-
-           Local's
-             next layer protocol = Mobility Header
-             "port" selector     = OPAQUE
-
-           Remote's
-             next layer protocol = Mobility Header
-             "port" selector     = Mobility Header message type
-
-        C. If a system is willing to send traffic with a particular
-           "port" value but NOT receive traffic with that kind of
-           port value, the system's traffic selectors are set as
-           follows in the relevant SPD entry:
-
-
-
-Kent & Seo                  Standards Track                    [Page 33]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-           Local's
-             next layer protocol = ICMP
-             "port" selector     = <specific ICMP type & code>
-
-           Remote's
-             next layer protocol = ICMP
-             "port" selector     = OPAQUE
-
-        D. To indicate that a system is willing to receive traffic
-           with a particular "port" value but NOT send that kind of
-           traffic, the system's traffic selectors are set as follows
-           in the relevant SPD entry:
-
-           Local's
-             next layer protocol = ICMP
-             "port" selector     = OPAQUE
-
-           Remote's
-             next layer protocol = ICMP
-             "port" selector     = <specific ICMP type & code>
-
-           For example, if a security gateway is willing to allow
-           systems behind it to send ICMP traceroutes, but is not
-           willing to let outside systems run ICMP traceroutes to
-           systems behind it, then the security gateway's traffic
-           selectors are set as follows in the relevant SPD entry:
-
-           Local's
-             next layer protocol = 1 (ICMPv4)
-             "port" selector     = 30 (traceroute)
-
-           Remote's
-             next layer protocol = 1 (ICMPv4)
-             "port" selector     = OPAQUE
-
-4.4.2.  Security Association Database (SAD)
-
-   In each IPsec implementation, there is a nominal Security Association
-   Database (SAD), in which each entry defines the parameters associated
-   with one SA.  Each SA has an entry in the SAD.  For outbound
-   processing, each SAD entry is pointed to by entries in the SPD-S part
-   of the SPD cache.  For inbound processing, for unicast SAs, the SPI
-   is used either alone to look up an SA or in conjunction with the
-   IPsec protocol type.  If an IPsec implementation supports multicast,
-   the SPI plus destination address, or SPI plus destination and source
-   addresses are used to look up the SA. (See Section 4.1 for details on
-   the algorithm that MUST be used for mapping inbound IPsec datagrams
-   to SAs.) The following parameters are associated with each entry in
-
-
-
-Kent & Seo                  Standards Track                    [Page 34]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   the SAD.  They should all be present except where otherwise noted,
-   e.g., AH Authentication algorithm.  This description does not purport
-   to be a MIB, only a specification of the minimal data items required
-   to support an SA in an IPsec implementation.
-
-   For each of the selectors defined in Section 4.4.1.1, the entry for
-   an inbound SA in the SAD MUST be initially populated with the value
-   or values negotiated at the time the SA was created. (See the
-   paragraph in Section 4.4.1 under "Handling Changes to the SPD while
-   the System is Running" for guidance on the effect of SPD changes on
-   extant SAs.) For a receiver, these values are used to check that the
-   header fields of an inbound packet (after IPsec processing) match the
-   selector values negotiated for the SA.  Thus, the SAD acts as a cache
-   for checking the selectors of inbound traffic arriving on SAs.  For
-   the receiver, this is part of verifying that a packet arriving on an
-   SA is consistent with the policy for the SA. (See Section 6 for rules
-   for ICMP messages.)  These fields can have the form of specific
-   values, ranges, ANY, or OPAQUE, as described in Section 4.4.1.1,
-   "Selectors".  Note also that there are a couple of situations in
-   which the SAD can have entries for SAs that do not have corresponding
-   entries in the SPD.  Since this document does not mandate that the
-   SAD be selectively cleared when the SPD is changed, SAD entries can
-   remain when the SPD entries that created them are changed or deleted.
-   Also, if a manually keyed SA is created, there could be an SAD entry
-   for this SA that does not correspond to any SPD entry.
-
-   Note: The SAD can support multicast SAs, if manually configured.  An
-   outbound multicast SA has the same structure as a unicast SA.  The
-   source address is that of the sender, and the destination address is
-   the multicast group address.  An inbound, multicast SA must be
-   configured with the source addresses of each peer authorized to
-   transmit to the multicast SA in question.  The SPI value for a
-   multicast SA is provided by a multicast group controller, not by the
-   receiver, as for a unicast SA.  Because an SAD entry may be required
-   to accommodate multiple, individual IP source addresses that were
-   part of an SPD entry (for unicast SAs), the required facility for
-   inbound, multicast SAs is a feature already present in an IPsec
-   implementation.  However, because the SPD has no provisions for
-   accommodating multicast entries, this document does not specify an
-   automated way to create an SAD entry for a multicast, inbound SA.
-   Only manually configured SAD entries can be created to accommodate
-   inbound, multicast traffic.
-
-   Implementation Guidance: This document does not specify how an SPD-S
-   entry refers to the corresponding SAD entry, as this is an
-   implementation-specific detail.  However, some implementations (based
-   on experience from RFC 2401) are known to have problems in this
-   regard.  In particular, simply storing the (remote tunnel header IP
-
-
-
-Kent & Seo                  Standards Track                    [Page 35]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   address, remote SPI) pair in the SPD cache is not sufficient, since
-   the pair does not always uniquely identify a single SAD entry.  For
-   instance, two hosts behind the same NAT could choose the same SPI
-   value.  The situation also may arise if a host is assigned an IP
-   address (e.g., via DHCP) previously used by some other host, and the
-   SAs associated with the old host have not yet been deleted via dead
-   peer detection mechanisms.  This may lead to packets being sent over
-   the wrong SA or, if key management ensures the pair is unique,
-   denying the creation of otherwise valid SAs.  Thus, implementors
-   should implement links between the SPD cache and the SAD in a way
-   that does not engender such problems.
-
-4.4.2.1.  Data Items in the SAD
-
-   The following data items MUST be in the SAD:
-
-    o Security Parameter Index (SPI): a 32-bit value selected by the
-      receiving end of an SA to uniquely identify the SA.  In an SAD
-      entry for an outbound SA, the SPI is used to construct the
-      packet's AH or ESP header.  In an SAD entry for an inbound SA, the
-      SPI is used to map traffic to the appropriate SA (see text on
-      unicast/multicast in Section 4.1).
-
-    o Sequence Number Counter: a 64-bit counter used to generate the
-      Sequence Number field in AH or ESP headers. 64-bit sequence
-      numbers are the default, but 32-bit sequence numbers are also
-      supported if negotiated.
-
-    o Sequence Counter Overflow: a flag indicating whether overflow of
-      the sequence number counter should generate an auditable event and
-      prevent transmission of additional packets on the SA, or whether
-      rollover is permitted.  The audit log entry for this event SHOULD
-      include the SPI value, current date/time, Local Address, Remote
-      Address, and the selectors from the relevant SAD entry.
-
-    o Anti-Replay Window: a 64-bit counter and a bit-map (or equivalent)
-      used to determine whether an inbound AH or ESP packet is a replay.
-
-      Note: If anti-replay has been disabled by the receiver for an SA,
-      e.g., in the case of a manually keyed SA, then the Anti-Replay
-      Window is ignored for the SA in question. 64-bit sequence numbers
-      are the default, but this counter size accommodates 32-bit
-      sequence numbers as well.
-
-    o AH Authentication algorithm, key, etc.  This is required only if
-      AH is supported.
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 36]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-    o ESP Encryption algorithm, key, mode, IV, etc.  If a combined mode
-      algorithm is used, these fields will not be applicable.
-
-    o ESP integrity algorithm, keys, etc.  If the integrity service is
-      not selected, these fields will not be applicable.  If a combined
-      mode algorithm is used, these fields will not be applicable.
-
-    o ESP combined mode algorithms, key(s), etc.  This data is used when
-      a combined mode (encryption and integrity) algorithm is used with
-      ESP.  If a combined mode algorithm is not used, these fields are
-      not applicable.
-
-    o Lifetime of this SA: a time interval after which an SA must be
-      replaced with a new SA (and new SPI) or terminated, plus an
-      indication of which of these actions should occur.  This may be
-      expressed as a time or byte count, or a simultaneous use of both
-      with the first lifetime to expire taking precedence.  A compliant
-      implementation MUST support both types of lifetimes, and MUST
-      support a simultaneous use of both.  If time is employed, and if
-      IKE employs X.509 certificates for SA establishment, the SA
-      lifetime must be constrained by the validity intervals of the
-      certificates, and the NextIssueDate of the Certificate Revocation
-      Lists (CRLs) used in the IKE exchange for the SA.  Both initiator
-      and responder are responsible for constraining the SA lifetime in
-      this fashion.  Note: The details of how to handle the refreshing
-      of keys when SAs expire is a local matter.  However, one
-      reasonable approach is:
-
-     (a) If byte count is used, then the implementation SHOULD count the
-         number of bytes to which the IPsec cryptographic algorithm is
-         applied.  For ESP, this is the encryption algorithm (including
-         Null encryption) and for AH, this is the authentication
-         algorithm.  This includes pad bytes, etc.  Note that
-         implementations MUST be able to handle having the counters at
-         the ends of an SA get out of synch, e.g., because of packet
-         loss or because the implementations at each end of the SA
-         aren't doing things the same way.
-
-     (b) There SHOULD be two kinds of lifetime -- a soft lifetime that
-         warns the implementation to initiate action such as setting up
-         a replacement SA, and a hard lifetime when the current SA ends
-         and is destroyed.
-
-     (c) If the entire packet does not get delivered during the SA's
-         lifetime, the packet SHOULD be discarded.
-
-    o IPsec protocol mode: tunnel or transport.  Indicates which mode of
-      AH or ESP is applied to traffic on this SA.
-
-
-
-Kent & Seo                  Standards Track                    [Page 37]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-    o Stateful fragment checking flag.  Indicates whether or not
-      stateful fragment checking applies to this SA.
-
-    o Bypass DF bit (T/F) -- applicable to tunnel mode SAs where both
-      inner and outer headers are IPv4.
-
-    o DSCP values -- the set of DSCP values allowed for packets carried
-      over this SA.  If no values are specified, no DSCP-specific
-      filtering is applied.  If one or more values are specified, these
-      are used to select one SA among several that match the traffic
-      selectors for an outbound packet.  Note that these values are NOT
-      checked against inbound traffic arriving on the SA.
-
-    o Bypass DSCP (T/F) or map to unprotected DSCP values (array) if
-      needed to restrict bypass of DSCP values -- applicable to tunnel
-      mode SAs.  This feature maps DSCP values from an inner header to
-      values in an outer header, e.g., to address covert channel
-      signaling concerns.
-
-    o Path MTU: any observed path MTU and aging variables.
-
-    o Tunnel header IP source and destination address -- both addresses
-      must be either IPv4 or IPv6 addresses.  The version implies the
-      type of IP header to be used.  Only used when the IPsec protocol
-      mode is tunnel.
-
-4.4.2.2.  Relationship between SPD, PFP flag, packet, and SAD
-
-      For each selector, the following tables show the relationship
-      between the value in the SPD, the PFP flag, the value in the
-      triggering packet, and the resulting value in the SAD.  Note that
-      the administrative interface for IPsec can use various syntactic
-      options to make it easier for the administrator to enter rules.
-      For example, although a list of ranges is what IKEv2 sends, it
-      might be clearer and less error prone for the user to enter a
-      single IP address or IP address prefix.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 38]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-                                        Value in
-                                        Triggering   Resulting SAD
-         Selector  SPD Entry        PFP Packet       Entry
-         --------  ---------------- --- ------------ --------------
-         loc addr  list of ranges    0  IP addr "S"  list of ranges
-                   ANY               0  IP addr "S"  ANY
-                   list of ranges    1  IP addr "S"  "S"
-                   ANY               1  IP addr "S"  "S"
-
-         rem addr  list of ranges    0  IP addr "D"  list of ranges
-                   ANY               0  IP addr "D"  ANY
-                   list of ranges    1  IP addr "D"  "D"
-                   ANY               1  IP addr "D"  "D"
-
-         protocol  list of prot's*   0  prot. "P"    list of prot's*
-                   ANY**             0  prot. "P"    ANY
-                   OPAQUE****        0  prot. "P"    OPAQUE
-
-                   list of prot's*   0  not avail.   discard packet
-                   ANY**             0  not avail.   ANY
-                   OPAQUE****        0  not avail.   OPAQUE
-
-                   list of prot's*   1  prot. "P"    "P"
-                   ANY**             1  prot. "P"    "P"
-                   OPAQUE****        1  prot. "P"    ***
-
-                   list of prot's*   1  not avail.   discard packet
-                   ANY**             1  not avail.   discard packet
-                   OPAQUE****        1  not avail.   ***
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 39]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      If the protocol is one that has two ports, then there will be
-      selectors for both Local and Remote ports.
-
-                                        Value in
-                                        Triggering   Resulting SAD
-         Selector  SPD Entry        PFP Packet       Entry
-         --------  ---------------- --- ------------ --------------
-         loc port  list of ranges    0  src port "s" list of ranges
-                   ANY               0  src port "s" ANY
-                   OPAQUE            0  src port "s" OPAQUE
-
-                   list of ranges    0  not avail.   discard packet
-                   ANY               0  not avail.   ANY
-                   OPAQUE            0  not avail.   OPAQUE
-
-                   list of ranges    1  src port "s" "s"
-                   ANY               1  src port "s" "s"
-                   OPAQUE            1  src port "s" ***
-
-                   list of ranges    1  not avail.   discard packet
-                   ANY               1  not avail.   discard packet
-                   OPAQUE            1  not avail.   ***
-
-
-         rem port  list of ranges    0  dst port "d" list of ranges
-                   ANY               0  dst port "d" ANY
-                   OPAQUE            0  dst port "d" OPAQUE
-
-                   list of ranges    0  not avail.   discard packet
-                   ANY               0  not avail.   ANY
-                   OPAQUE            0  not avail.   OPAQUE
-
-                   list of ranges    1  dst port "d" "d"
-                   ANY               1  dst port "d" "d"
-                   OPAQUE            1  dst port "d" ***
-
-                   list of ranges    1  not avail.   discard packet
-                   ANY               1  not avail.   discard packet
-                   OPAQUE            1  not avail.   ***
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 40]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      If the protocol is mobility header, then there will be a selector
-      for mh type.
-
-                                        Value in
-                                        Triggering   Resulting SAD
-         Selector  SPD Entry        PFP Packet       Entry
-         --------  ---------------- --- ------------ --------------
-         mh type   list of ranges    0  mh type "T"  list of ranges
-                   ANY               0  mh type "T"  ANY
-                   OPAQUE            0  mh type "T"  OPAQUE
-
-                   list of ranges    0  not avail.   discard packet
-                   ANY               0  not avail.   ANY
-                   OPAQUE            0  not avail.   OPAQUE
-
-                   list of ranges    1  mh type "T"  "T"
-                   ANY               1  mh type "T"  "T"
-                   OPAQUE            1  mh type "T"  ***
-
-                   list of ranges    1  not avail.   discard packet
-                   ANY               1  not avail.   discard packet
-                   OPAQUE            1  not avail.   ***
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 41]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      If the protocol is ICMP, then there will be a 16-bit selector for
-      ICMP type and ICMP code.  Note that the type and code are bound to
-      each other, i.e., the codes apply to the particular type.  This
-      16-bit selector can contain a single type and a range of codes, a
-      single type and ANY code, and ANY type and ANY code.
-
-                                         Value in
-                                         Triggering   Resulting SAD
-         Selector   SPD Entry        PFP Packet       Entry
-         ---------  ---------------- --- ------------ --------------
-         ICMP type  a single type &   0  type "t" &   single type &
-         and code    range of codes        code "c"    range of codes
-                    a single type &   0  type "t" &   single type &
-                     ANY code              code "c"    ANY code
-                    ANY type & ANY    0  type "t" &   ANY type &
-                     code                  code "c"    ANY code
-                    OPAQUE            0  type "t" &   OPAQUE
-                                           code "c"
-
-                    a single type &   0  not avail.   discard packet
-                     range of codes
-                    a single type &   0  not avail.   discard packet
-                     ANY code
-                    ANY type &        0  not avail.   ANY type &
-                     ANY code                          ANY code
-                    OPAQUE            0  not avail.   OPAQUE
-
-                    a single type &   1  type "t" &   "t" and "c"
-                     range of codes        code "c"
-                    a single type &   1  type "t" &   "t" and "c"
-                     ANY code              code "c"
-                    ANY type &        1  type "t" &   "t" and "c"
-                     ANY code              code "c"
-                    OPAQUE            1  type "t" &   ***
-                                           code "c"
-
-                    a single type &   1  not avail.   discard packet
-                     range of codes
-                    a single type &   1  not avail.   discard packet
-                     ANY code
-                    ANY type &        1  not avail.   discard packet
-                     ANY code
-                    OPAQUE            1  not avail.   ***
-
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 42]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      If the name selector is used:
-
-                                         Value in
-                                         Triggering   Resulting SAD
-         Selector   SPD Entry        PFP Packet       Entry
-         ---------  ---------------- --- ------------ --------------
-         name       list of user or  N/A     N/A           N/A
-                    system names
-
-            * "List of protocols" is the information, not the way
-              that the SPD or SAD or IKEv2 have to represent this
-              information.
-           ** 0 (zero) is used by IKE to indicate ANY for
-              protocol.
-          *** Use of PFP=1 with an OPAQUE value is an error and
-              SHOULD be prohibited by an IPsec implementation.
-         **** The protocol field cannot be OPAQUE in IPv4.  This
-              table entry applies only to IPv6.
-
-4.4.3.  Peer Authorization Database (PAD)
-
-   The Peer Authorization Database (PAD) provides the link between the
-   SPD and a security association management protocol such as IKE.  It
-   embodies several critical functions:
-
-        o identifies the peers or groups of peers that are authorized
-          to communicate with this IPsec entity
-        o specifies the protocol and method used to authenticate each
-          peer
-        o provides the authentication data for each peer
-        o constrains the types and values of IDs that can be asserted
-          by a peer with regard to child SA creation, to ensure that the
-          peer does not assert identities for lookup in the SPD that it
-          is not authorized to represent, when child SAs are created
-        o peer gateway location info, e.g., IP address(es) or DNS names,
-          MAY be included for peers that are known to be "behind" a
-          security gateway
-
-   The PAD provides these functions for an IKE peer when the peer acts
-   as either the initiator or the responder.
-
-   To perform these functions, the PAD contains an entry for each peer
-   or group of peers with which the IPsec entity will communicate.  An
-   entry names an individual peer (a user, end system or security
-   gateway) or specifies a group of peers (using ID matching rules
-   defined below).  The entry specifies the authentication protocol
-   (e.g., IKEv1, IKEv2, KINK) method used (e.g., certificates or pre-
-   shared secrets) and the authentication data (e.g., the pre-shared
-
-
-
-Kent & Seo                  Standards Track                    [Page 43]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   secret or the trust anchor relative to which the peer's certificate
-   will be validated).  For certificate-based authentication, the entry
-   also may provide information to assist in verifying the revocation
-   status of the peer, e.g., a pointer to a CRL repository or the name
-   of an Online Certificate Status Protocol (OCSP) server associated
-   with the peer or with the trust anchor associated with the peer.
-
-   Each entry also specifies whether the IKE ID payload will be used as
-   a symbolic name for SPD lookup, or whether the remote IP address
-   provided in traffic selector payloads will be used for SPD lookups
-   when child SAs are created.
-
-   Note that the PAD information MAY be used to support creation of more
-   than one tunnel mode SA at a time between two peers, e.g., two
-   tunnels to protect the same addresses/hosts, but with different
-   tunnel endpoints.
-
-4.4.3.1.  PAD Entry IDs and Matching Rules
-
-   The PAD is an ordered database, where the order is defined by an
-   administrator (or a user in the case of a single-user end system).
-   Usually, the same administrator will be responsible for both the PAD
-   and SPD, since the two databases must be coordinated.  The ordering
-   requirement for the PAD arises for the same reason as for the SPD,
-   i.e., because use of "star name" entries allows for overlaps in the
-   set of IKE IDs that could match a specific entry.
-
-   Six types of IDs are supported for entries in the PAD, consistent
-   with the symbolic name types and IP addresses used to identify SPD
-   entries.  The ID for each entry acts as the index for the PAD, i.e.,
-   it is the value used to select an entry.  All of these ID types can
-   be used to match IKE ID payload types.  The six types are:
-
-           o DNS name (specific or partial)
-           o Distinguished Name (complete or sub-tree constrained)
-           o RFC 822 email address (complete or partially qualified)
-           o IPv4 address (range)
-           o IPv6 address (range)
-           o Key ID (exact match only)
-
-   The first three name types can accommodate sub-tree matching as well
-   as exact matches.  A DNS name may be fully qualified and thus match
-   exactly one name, e.g., foo.example.com.  Alternatively, the name may
-   encompass a group of peers by being partially specified, e.g., the
-   string ".example.com" could be used to match any DNS name ending in
-   these two domain name components.
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 44]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   Similarly, a Distinguished Name may specify a complete Distinguished
-   Name to match exactly one entry, e.g., CN = Stephen, O = BBN
-   Technologies, SP = MA, C = US.  Alternatively, an entry may encompass
-   a group of peers by specifying a sub-tree, e.g., an entry of the form
-   "C = US, SP = MA" might be used to match all DNs that contain these
-   two attributes as the top two Relative Distinguished Names (RDNs).
-
-   For an RFC 822 e-mail addresses, the same options exist.  A complete
-   address such as foo@example.com matches one entity, but a sub-tree
-   name such as "@example.com" could be used to match all the entities
-   with names ending in those two domain names to the right of the @.
-
-   The specific syntax used by an implementation to accommodate sub-tree
-   matching for distinguished names, domain names or RFC 822 e-mail
-   addresses is a local matter.  But, at a minimum, sub-tree matching of
-   the sort described above MUST be supported. (Substring matching
-   within a DN, DNS name, or RFC 822 address MAY be supported, but is
-   not required.)
-
-   For IPv4 and IPv6 addresses, the same address range syntax used for
-   SPD entries MUST be supported.  This allows specification of an
-   individual address (via a trivial range), an address prefix (by
-   choosing a range that adheres to Classless Inter-Domain Routing
-   (CIDR)-style prefixes), or an arbitrary address range.
-
-   The Key ID field is defined as an OCTET string in IKE.  For this name
-   type, only exact-match syntax MUST be supported (since there is no
-   explicit structure for this ID type).  Additional matching functions
-   MAY be supported for this ID type.
-
-4.4.3.2.  IKE Peer Authentication Data
-
-   Once an entry is located based on an ordered search of the PAD based
-   on ID field matching, it is necessary to verify the asserted
-   identity, i.e., to authenticate the asserted ID.  For each PAD entry,
-   there is an indication of the type of authentication to be performed.
-   This document requires support for two required authentication data
-   types:
-
-        - X.509 certificate
-        - pre-shared secret
-
-   For authentication based on an X.509 certificate, the PAD entry
-   contains a trust anchor via which the end entity (EE) certificate for
-   the peer must be verifiable, either directly or via a certificate
-   path.  See RFC 3280 for the definition of a trust anchor.  An entry
-   used with certificate-based authentication MAY include additional
-   data to facilitate certificate revocation status, e.g., a list of
-
-
-
-Kent & Seo                  Standards Track                    [Page 45]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   appropriate OCSP responders or CRL repositories, and associated
-   authentication data.  For authentication based on a pre-shared
-   secret, the PAD contains the pre-shared secret to be used by IKE.
-
-   This document does not require that the IKE ID asserted by a peer be
-   syntactically related to a specific field in an end entity
-   certificate that is employed to authenticate the identity of that
-   peer.  However, it often will be appropriate to impose such a
-   requirement, e.g., when a single entry represents a set of peers each
-   of whom may have a distinct SPD entry.  Thus, implementations MUST
-   provide a means for an administrator to require a match between an
-   asserted IKE ID and the subject name or subject alt name in a
-   certificate.  The former is applicable to IKE IDs expressed as
-   distinguished names; the latter is appropriate for DNS names, RFC 822
-   e-mail addresses, and IP addresses.  Since KEY ID is intended for
-   identifying a peer authenticated via a pre-shared secret, there is no
-   requirement to match this ID type to a certificate field.
-
-   See IKEv1 [HarCar98] and IKEv2 [Kau05] for details of how IKE
-   performs peer authentication using certificates or pre-shared
-   secrets.
-
-   This document does not mandate support for any other authentication
-   methods, although such methods MAY be employed.
-
-4.4.3.3.  Child SA Authorization Data
-
-   Once an IKE peer is authenticated, child SAs may be created.  Each
-   PAD entry contains data to constrain the set of IDs that can be
-   asserted by an IKE peer, for matching against the SPD.  Each PAD
-   entry indicates whether the IKE ID is to be used as a symbolic name
-   for SPD matching, or whether an IP address asserted in a traffic
-   selector payload is to be used.
-
-   If the entry indicates that the IKE ID is to be used, then the PAD
-   entry ID field defines the authorized set of IDs.  If the entry
-   indicates that child SAs traffic selectors are to be used, then an
-   additional data element is required, in the form of IPv4 and/or IPv6
-   address ranges. (A peer may be authorized for both address types, so
-   there MUST be provision for both a v4 and a v6 address range.)
-
-4.4.3.4.  How the PAD Is Used
-
-   During the initial IKE exchange, the initiator and responder each
-   assert their identity via the IKE ID payload and send an AUTH payload
-   to verify the asserted identity.  One or more CERT payloads may be
-   transmitted to facilitate the verification of each asserted identity.
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 46]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   When an IKE entity receives an IKE ID payload, it uses the asserted
-   ID to locate an entry in the PAD, using the matching rules described
-   above.  The PAD entry specifies the authentication method to be
-   employed for the identified peer.  This ensures that the right method
-   is used for each peer and that different methods can be used for
-   different peers.  The entry also specifies the authentication data
-   that will be used to verify the asserted identity.  This data is
-   employed in conjunction with the specified method to authenticate the
-   peer, before any CHILD SAs are created.
-
-   Child SAs are created based on the exchange of traffic selector
-   payloads, either at the end of the initial IKE exchange or in
-   subsequent CREATE_CHILD_SA exchanges.  The PAD entry for the (now
-   authenticated) IKE peer is used to constrain creation of child SAs;
-   specifically, the PAD entry specifies how the SPD is searched using a
-   traffic selector proposal from a peer.  There are two choices: either
-   the IKE ID asserted by the peer is used to find an SPD entry via its
-   symbolic name, or peer IP addresses asserted in traffic selector
-   payloads are used for SPD lookups based on the remote IP address
-   field portion of an SPD entry.  It is necessary to impose these
-   constraints on creation of child SAs to prevent an authenticated peer
-   from spoofing IDs associated with other, legitimate peers.
-
-   Note that because the PAD is checked before searching for an SPD
-   entry, this safeguard protects an initiator against spoofing attacks.
-   For example, assume that IKE A receives an outbound packet destined
-   for IP address X, a host served by a security gateway.  RFC 2401
-   [RFC2401] and this document do not specify how A determines the
-   address of the IKE peer serving X.  However, any peer contacted by A
-   as the presumed representative for X must be registered in the PAD in
-   order to allow the IKE exchange to be authenticated.  Moreover, when
-   the authenticated peer asserts that it represents X in its traffic
-   selector exchange, the PAD will be consulted to determine if the peer
-   in question is authorized to represent X.  Thus, the PAD provides a
-   binding of address ranges (or name sub-spaces) to peers, to counter
-   such attacks.
-
-4.5.  SA and Key Management
-
-   All IPsec implementations MUST support both manual and automated SA
-   and cryptographic key management.  The IPsec protocols, AH and ESP,
-   are largely independent of the associated SA management techniques,
-   although the techniques involved do affect some of the security
-   services offered by the protocols.  For example, the optional
-   anti-replay service available for AH and ESP requires automated SA
-   management.  Moreover, the granularity of key distribution employed
-   with IPsec determines the granularity of authentication provided.  In
-   general, data origin authentication in AH and ESP is limited by the
-
-
-
-Kent & Seo                  Standards Track                    [Page 47]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   extent to which secrets used with the integrity algorithm (or with a
-   key management protocol that creates such secrets) are shared among
-   multiple possible sources.
-
-   The following text describes the minimum requirements for both types
-   of SA management.
-
-4.5.1.  Manual Techniques
-
-   The simplest form of management is manual management, in which a
-   person manually configures each system with keying material and SA
-   management data relevant to secure communication with other systems.
-   Manual techniques are practical in small, static environments but
-   they do not scale well.  For example, a company could create a
-   virtual private network (VPN) using IPsec in security gateways at
-   several sites.  If the number of sites is small, and since all the
-   sites come under the purview of a single administrative domain, this
-   might be a feasible context for manual management techniques.  In
-   this case, the security gateway might selectively protect traffic to
-   and from other sites within the organization using a manually
-   configured key, while not protecting traffic for other destinations.
-   It also might be appropriate when only selected communications need
-   to be secured.  A similar argument might apply to use of IPsec
-   entirely within an organization for a small number of hosts and/or
-   gateways.  Manual management techniques often employ statically
-   configured, symmetric keys, though other options also exist.
-
-4.5.2.  Automated SA and Key Management
-
-   Widespread deployment and use of IPsec requires an Internet-standard,
-   scalable, automated, SA management protocol.  Such support is
-   required to facilitate use of the anti-replay features of AH and ESP,
-   and to accommodate on-demand creation of SAs, e.g., for user- and
-   session-oriented keying.  (Note that the notion of "rekeying" an SA
-   actually implies creation of a new SA with a new SPI, a process that
-   generally implies use of an automated SA/key management protocol.)
-
-   The default automated key management protocol selected for use with
-   IPsec is IKEv2 [Kau05].  This document assumes the availability of
-   certain functions from the key management protocol that are not
-   supported by IKEv1.  Other automated SA management protocols MAY be
-   employed.
-
-   When an automated SA/key management protocol is employed, the output
-   from this protocol is used to generate multiple keys for a single SA.
-   This also occurs because distinct keys are used for each of the two
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 48]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   SAs created by IKE.  If both integrity and confidentiality are
-   employed, then a minimum of four keys are required.  Additionally,
-   some cryptographic algorithms may require multiple keys, e.g., 3DES.
-
-   The Key Management System may provide a separate string of bits for
-   each key or it may generate one string of bits from which all keys
-   are extracted.  If a single string of bits is provided, care needs to
-   be taken to ensure that the parts of the system that map the string
-   of bits to the required keys do so in the same fashion at both ends
-   of the SA.  To ensure that the IPsec implementations at each end of
-   the SA use the same bits for the same keys, and irrespective of which
-   part of the system divides the string of bits into individual keys,
-   the encryption keys MUST be taken from the first (left-most,
-   high-order) bits and the integrity keys MUST be taken from the
-   remaining bits.  The number of bits for each key is defined in the
-   relevant cryptographic algorithm specification RFC.  In the case of
-   multiple encryption keys or multiple integrity keys, the
-   specification for the cryptographic algorithm must specify the order
-   in which they are to be selected from a single string of bits
-   provided to the cryptographic algorithm.
-
-4.5.3.  Locating a Security Gateway
-
-   This section discusses issues relating to how a host learns about the
-   existence of relevant security gateways and, once a host has
-   contacted these security gateways, how it knows that these are the
-   correct security gateways.  The details of where the required
-   information is stored is a local matter, but the Peer Authorization
-   Database (PAD) described in Section 4.4 is the most likely candidate.
-   (Note: S* indicates a system that is running IPsec, e.g., SH1 and SG2
-   below.)
-
-   Consider a situation in which a remote host (SH1) is using the
-   Internet to gain access to a server or other machine (H2) and there
-   is a security gateway (SG2), e.g., a firewall, through which H1's
-   traffic must pass.  An example of this situation would be a mobile
-   host crossing the Internet to his home organization's firewall (SG2).
-   This situation raises several issues:
-
-   1. How does SH1 know/learn about the existence of the security
-      gateway SG2?
-
-   2. How does it authenticate SG2, and once it has authenticated SG2,
-      how does it confirm that SG2 has been authorized to represent H2?
-
-   3. How does SG2 authenticate SH1 and verify that SH1 is authorized to
-      contact H2?
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 49]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   4. How does SH1 know/learn about any additional gateways that provide
-      alternate paths to H2?
-
-   To address these problems, an IPsec-supporting host or security
-   gateway MUST have an administrative interface that allows the
-   user/administrator to configure the address of one or more security
-   gateways for ranges of destination addresses that require its use.
-   This includes the ability to configure information for locating and
-   authenticating one or more security gateways and verifying the
-   authorization of these gateways to represent the destination host.
-   (The authorization function is implied in the PAD.) This document
-   does not address the issue of how to automate the
-   discovery/verification of security gateways.
-
-4.6.  SAs and Multicast
-
-   The receiver-orientation of the SA implies that, in the case of
-   unicast traffic, the destination system will select the SPI value.
-   By having the destination select the SPI value, there is no potential
-   for manually configured SAs to conflict with automatically configured
-   (e.g., via a key management protocol) SAs or for SAs from multiple
-   sources to conflict with each other.  For multicast traffic, there
-   are multiple destination systems associated with a single SA.  So
-   some system or person will need to coordinate among all multicast
-   groups to select an SPI or SPIs on behalf of each multicast group and
-   then communicate the group's IPsec information to all of the
-   legitimate members of that multicast group via mechanisms not defined
-   here.
-
-   Multiple senders to a multicast group SHOULD use a single Security
-   Association (and hence SPI) for all traffic to that group when a
-   symmetric key encryption or integrity algorithm is employed.  In such
-   circumstances, the receiver knows only that the message came from a
-   system possessing the key for that multicast group.  In such
-   circumstances, a receiver generally will not be able to authenticate
-   which system sent the multicast traffic.  Specifications for other,
-   more general multicast approaches are deferred to the IETF Multicast
-   Security Working Group.
-
-5.  IP Traffic Processing
-
-   As mentioned in Section 4.4.1, "The Security Policy Database (SPD)",
-   the SPD (or associated caches) MUST be consulted during the
-   processing of all traffic that crosses the IPsec protection boundary,
-   including IPsec management traffic.  If no policy is found in the SPD
-   that matches a packet (for either inbound or outbound traffic), the
-   packet MUST be discarded.  To simplify processing, and to allow for
-   very fast SA lookups (for SG/BITS/BITW), this document introduces the
-
-
-
-Kent & Seo                  Standards Track                    [Page 50]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   notion of an SPD cache for all outbound traffic (SPD-O plus SPD-S),
-   and a cache for inbound, non-IPsec-protected traffic (SPD-I).  (As
-   mentioned earlier, the SAD acts as a cache for checking the selectors
-   of inbound IPsec-protected traffic arriving on SAs.) There is
-   nominally one cache per SPD.  For the purposes of this specification,
-   it is assumed that each cached entry will map to exactly one SA.
-   Note, however, exceptions arise when one uses multiple SAs to carry
-   traffic of different priorities (e.g., as indicated by distinct DSCP
-   values) but the same selectors.  Note also, that there are a couple
-   of situations in which the SAD can have entries for SAs that do not
-   have corresponding entries in the SPD.  Since this document does not
-   mandate that the SAD be selectively cleared when the SPD is changed,
-   SAD entries can remain when the SPD entries that created them are
-   changed or deleted.  Also, if a manually keyed SA is created, there
-   could be an SAD entry for this SA that does not correspond to any SPD
-   entry.
-
-   Since SPD entries may overlap, one cannot safely cache these entries
-   in general.  Simple caching might result in a match against a cache
-   entry, whereas an ordered search of the SPD would have resulted in a
-   match against a different entry.  But, if the SPD entries are first
-   decorrelated, then the resulting entries can safely be cached.  Each
-   cached entry will indicate that matching traffic should be bypassed
-   or discarded, appropriately. (Note: The original SPD entry might
-   result in multiple SAs, e.g., because of PFP.) Unless otherwise
-   noted, all references below to the "SPD" or "SPD cache" or "cache"
-   are to a decorrelated SPD (SPD-I, SPD-O, SPD-S) or the SPD cache
-   containing entries from the decorrelated SPD.
-
-   Note: In a host IPsec implementation based on sockets, the SPD will
-   be consulted whenever a new socket is created to determine what, if
-   any, IPsec processing will be applied to the traffic that will flow
-   on that socket.  This provides an implicit caching mechanism, and the
-   portions of the preceding discussion that address caching can be
-   ignored in such implementations.
-
-   Note: It is assumed that one starts with a correlated SPD because
-   that is how users and administrators are accustomed to managing these
-   sorts of access control lists or firewall filter rules.  Then the
-   decorrelation algorithm is applied to build a list of cache-able SPD
-   entries.  The decorrelation is invisible at the management interface.
-
-   For inbound IPsec traffic, the SAD entry selected by the SPI serves
-   as the cache for the selectors to be matched against arriving IPsec
-   packets, after AH or ESP processing has been performed.
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 51]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-5.1.  Outbound IP Traffic Processing (protected-to-unprotected)
-
-   First consider the path for traffic entering the implementation via a
-   protected interface and exiting via an unprotected interface.
-
-                          Unprotected Interface
-                                   ^
-                                   |
-            (nested SAs)      +----------+
-           -------------------|Forwarding|<-----+
-           |                  +----------+      |
-           |                        ^           |
-           |                        | BYPASS    |
-           V                     +-----+        |
-       +-------+                 | SPD |     +--------+
-    ...| SPD-I |.................|Cache|.....|PROCESS |...IPsec
-       |  (*)  |                 | (*) |---->|(AH/ESP)|   boundary
-       +-------+                 +-----+     +--------+
-           |        +-------+     /  ^
-           |        |DISCARD| <--/   |
-           |        +-------+        |
-           |                         |
-           |                 +-------------+
-           |---------------->|SPD Selection|
-                             +-------------+
-                                    ^
-                                    |     +------+
-                                    |  -->| ICMP |
-                                    | /   +------+
-                                    |/
-                                    |
-                                    |
-                            Protected Interface
-
-
-         Figure 2.  Processing Model for Outbound Traffic
-                    (*) = The SPD caches are shown here.  If there
-                          is a cache miss, then the SPD is checked.
-                          There is no requirement that an
-                          implementation buffer the packet if
-                          there is a cache miss.
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 52]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   IPsec MUST perform the following steps when processing outbound
-   packets:
-
-   1.  When a packet arrives from the subscriber (protected) interface,
-       invoke the SPD selection function to obtain the SPD-ID needed to
-       choose the appropriate SPD. (If the implementation uses only one
-       SPD, this step is a no-op.)
-
-   2.  Match the packet headers against the cache for the SPD specified
-       by the SPD-ID from step 1.  Note that this cache contains entries
-       from SPD-O and SPD-S.
-
-   3a. If there is a match, then process the packet as specified by the
-       matching cache entry, i.e., BYPASS, DISCARD, or PROTECT using AH
-       or ESP.  If IPsec processing is applied, there is a link from the
-       SPD cache entry to the relevant SAD entry (specifying the mode,
-       cryptographic algorithms, keys, SPI, PMTU, etc.).  IPsec
-       processing is as previously defined, for tunnel or transport
-       modes and for AH or ESP, as specified in their respective RFCs
-       [Ken05b, Ken05a].  Note that the SA PMTU value, plus the value of
-       the stateful fragment checking flag (and the DF bit in the IP
-       header of the outbound packet) determine whether the packet can
-       (must) be fragmented prior to or after IPsec processing, or if it
-       must be discarded and an ICMP PMTU message is sent.
-
-   3b. If no match is found in the cache, search the SPD (SPD-S and
-       SPD-O parts) specified by SPD-ID.  If the SPD entry calls for
-       BYPASS or DISCARD, create one or more new outbound SPD cache
-       entries and if BYPASS, create one or more new inbound SPD cache
-       entries. (More than one cache entry may be created since a
-       decorrelated SPD entry may be linked to other such entries that
-       were created as a side effect of the decorrelation process.) If
-       the SPD entry calls for PROTECT, i.e., creation of an SA, the key
-       management mechanism (e.g., IKEv2) is invoked to create the SA.
-       If SA creation succeeds, a new outbound (SPD-S) cache entry is
-       created, along with outbound and inbound SAD entries, otherwise
-       the packet is discarded. (A packet that triggers an SPD lookup
-       MAY be discarded by the implementation, or it MAY be processed
-       against the newly created cache entry, if one is created.)  Since
-       SAs are created in pairs, an SAD entry for the corresponding
-       inbound SA also is created, and it contains the selector values
-       derived from the SPD entry (and packet, if any PFP flags were
-       "true") used to create the inbound SA, for use in checking
-       inbound traffic delivered via the SA.
-
-   4.  The packet is passed to the outbound forwarding function
-       (operating outside of the IPsec implementation), to select the
-       interface to which the packet will be directed.  This function
-
-
-
-Kent & Seo                  Standards Track                    [Page 53]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-       may cause the packet to be passed back across the IPsec boundary,
-       for additional IPsec processing, e.g., in support of nested SAs.
-       If so, there MUST be an entry in SPD-I database that permits
-       inbound bypassing of the packet, otherwise the packet will be
-       discarded.  If necessary, i.e., if there is more than one SPD-I,
-       the traffic being looped back MAY be tagged as coming from this
-       internal interface.  This would allow the use of a different
-       SPD-I for "real" external traffic vs. looped traffic, if needed.
-
-   Note: With the exception of IPv4 and IPv6 transport mode, an SG,
-   BITS, or BITW implementation MAY fragment packets before applying
-   IPsec. (This applies only to IPv4.  For IPv6 packets, only the
-   originator is allowed to fragment them.) The device SHOULD have a
-   configuration setting to disable this.  The resulting fragments are
-   evaluated against the SPD in the normal manner.  Thus, fragments not
-   containing port numbers (or ICMP message type and code, or Mobility
-   Header type) will only match rules having port (or ICMP message type
-   and code, or MH type) selectors of OPAQUE or ANY. (See Section 7 for
-   more details.)
-
-   Note: With regard to determining and enforcing the PMTU of an SA, the
-   IPsec system MUST follow the steps described in Section 8.2.
-
-5.1.1.  Handling an Outbound Packet That Must Be Discarded
-
-   If an IPsec system receives an outbound packet that it finds it must
-   discard, it SHOULD be capable of generating and sending an ICMP
-   message to indicate to the sender of the outbound packet that the
-   packet was discarded.  The type and code of the ICMP message will
-   depend on the reason for discarding the packet, as specified below.
-   The reason SHOULD be recorded in the audit log.  The audit log entry
-   for this event SHOULD include the reason, current date/time, and the
-   selector values from the packet.
-
-   a.  The selectors of the packet matched an SPD entry requiring the
-       packet to be discarded.
-
-           IPv4 Type = 3 (destination unreachable) Code = 13
-                (Communication Administratively Prohibited)
-
-           IPv6 Type = 1 (destination unreachable) Code = 1
-                (Communication with destination administratively
-                prohibited)
-
-   b1. The IPsec system successfully reached the remote peer but was
-       unable to negotiate the SA required by the SPD entry matching the
-       packet because, for example, the remote peer is administratively
-       prohibited from communicating with the initiator, the initiating
-
-
-
-Kent & Seo                  Standards Track                    [Page 54]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-       peer was unable to authenticate itself to the remote peer, the
-       remote peer was unable to authenticate itself to the initiating
-       peer, or the SPD at the remote peer did not have a suitable
-       entry.
-
-           IPv4 Type = 3 (destination unreachable) Code = 13
-                (Communication Administratively Prohibited)
-
-           IPv6 Type = 1 (destination unreachable) Code = 1
-                (Communication with destination administratively
-                prohibited)
-
-   b2. The IPsec system was unable to set up the SA required by the SPD
-       entry matching the packet because the IPsec peer at the other end
-       of the exchange could not be contacted.
-
-           IPv4 Type = 3 (destination unreachable) Code = 1 (host
-                unreachable)
-
-           IPv6 Type = 1 (destination unreachable) Code = 3 (address
-                unreachable)
-
-   Note that an attacker behind a security gateway could send packets
-   with a spoofed source address, W.X.Y.Z, to an IPsec entity causing it
-   to send ICMP messages to W.X.Y.Z.  This creates an opportunity for a
-   denial of service (DoS) attack among hosts behind a security gateway.
-   To address this, a security gateway SHOULD include a management
-   control to allow an administrator to configure an IPsec
-   implementation to send or not send the ICMP messages under these
-   circumstances, and if this facility is selected, to rate limit the
-   transmission of such ICMP responses.
-
-5.1.2.  Header Construction for Tunnel Mode
-
-   This section describes the handling of the inner and outer IP
-   headers, extension headers, and options for AH and ESP tunnels, with
-   regard to outbound traffic processing.  This includes how to
-   construct the encapsulating (outer) IP header, how to process fields
-   in the inner IP header, and what other actions should be taken for
-   outbound, tunnel mode traffic.  The general processing described here
-   is modeled after RFC 2003, "IP Encapsulation within IP" [Per96]:
-
-    o The outer IP header Source Address and Destination Address
-      identify the "endpoints" of the tunnel (the encapsulator and
-      decapsulator).  The inner IP header Source Address and Destination
-      Addresses identify the original sender and recipient of the
-      datagram (from the perspective of this tunnel), respectively.
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 55]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      (See footnote 3 after the table in 5.1.2.1 for more details on the
-      encapsulating source IP address.)
-
-    o The inner IP header is not changed except as noted below for TTL
-      (or Hop Limit) and the DS/ECN Fields.  The inner IP header
-      otherwise remains unchanged during its delivery to the tunnel exit
-      point.
-
-    o No change to IP options or extension headers in the inner header
-      occurs during delivery of the encapsulated datagram through the
-      tunnel.
-
-   Note: IPsec tunnel mode is different from IP-in-IP tunneling (RFC
-   2003 [Per96]) in several ways:
-
-    o IPsec offers certain controls to a security administrator to
-      manage covert channels (which would not normally be a concern for
-      tunneling) and to ensure that the receiver examines the right
-      portions of the received packet with respect to application of
-      access controls.  An IPsec implementation MAY be configurable with
-      regard to how it processes the outer DS field for tunnel mode for
-      transmitted packets.  For outbound traffic, one configuration
-      setting for the outer DS field will operate as described in the
-      following sections on IPv4 and IPv6 header processing for IPsec
-      tunnels.  Another will allow the outer DS field to be mapped to a
-      fixed value, which MAY be configured on a per-SA basis. (The value
-      might really be fixed for all traffic outbound from a device, but
-      per-SA granularity allows that as well.) This configuration option
-      allows a local administrator to decide whether the covert channel
-      provided by copying these bits outweighs the benefits of copying.
-
-    o IPsec describes how to handle ECN or DS and provides the ability
-      to control propagation of changes in these fields between
-      unprotected and protected domains.  In general, propagation from a
-      protected to an unprotected domain is a covert channel and thus
-      controls are provided to manage the bandwidth of this channel.
-      Propagation of ECN values in the other direction are controlled so
-      that only legitimate ECN changes (indicating occurrence of
-      congestion between the tunnel endpoints) are propagated.  By
-      default, DS propagation from an unprotected domain to a protected
-      domain is not permitted.  However, if the sender and receiver do
-      not share the same DS code space, and the receiver has no way of
-      learning how to map between the two spaces, then it may be
-      appropriate to deviate from the default.  Specifically, an IPsec
-      implementation MAY be configurable in terms of how it processes
-      the outer DS field for tunnel mode for received packets.  It may
-      be configured to either discard the outer DS value (the default)
-      OR to overwrite the inner DS field with the outer DS field.  If
-
-
-
-Kent & Seo                  Standards Track                    [Page 56]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      offered, the discard vs. overwrite behavior MAY be configured on a
-      per-SA basis.  This configuration option allows a local
-      administrator to decide whether the vulnerabilities created by
-      copying these bits outweigh the benefits of copying.  See
-      [RFC2983] for further information on when each of these behaviors
-      may be useful, and also for the possible need for diffserv traffic
-      conditioning prior or subsequent to IPsec processing (including
-      tunnel decapsulation).
-
-    o IPsec allows the IP version of the encapsulating header to be
-      different from that of the inner header.
-
-   The tables in the following sub-sections show the handling for the
-   different header/option fields ("constructed" means that the value in
-   the outer field is constructed independently of the value in the
-   inner).
-
-5.1.2.1.  IPv4: Header Construction for Tunnel Mode
-
-                         <-- How Outer Hdr Relates to Inner Hdr -->
-                         Outer Hdr at                 Inner Hdr at
-    IPv4                 Encapsulator                 Decapsulator
-      Header fields:     --------------------         ------------
-        version          4 (1)                        no change
-        header length    constructed                  no change
-        DS Field         copied from inner hdr (5)    no change
-        ECN Field        copied from inner hdr        constructed (6)
-        total length     constructed                  no change
-        ID               constructed                  no change
-        flags (DF,MF)    constructed, DF (4)          no change
-        fragment offset  constructed                  no change
-        TTL              constructed (2)              decrement (2)
-        protocol         AH, ESP                      no change
-        checksum         constructed                  constructed (2)(6)
-        src address      constructed (3)              no change
-        dest address     constructed (3)              no change
-      Options            never copied                 no change
-
-    Notes:
-
-      (1) The IP version in the encapsulating header can be different
-          from the value in the inner header.
-
-      (2) The TTL in the inner header is decremented by the encapsulator
-          prior to forwarding and by the decapsulator if it forwards the
-          packet.  (The IPv4 checksum changes when the TTL changes.)
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 57]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-          Note: Decrementing the TTL value is a normal part of
-          forwarding a packet.  Thus, a packet originating from the same
-          node as the encapsulator does not have its TTL decremented,
-          since the sending node is originating the packet rather than
-          forwarding it.  This applies to BITS and native IPsec
-          implementations in hosts and routers.  However, the IPsec
-          processing model includes an external forwarding capability.
-          TTL processing can be used to prevent looping of packets,
-          e.g., due to configuration errors, within the context of this
-          processing model.
-
-      (3) Local and Remote addresses depend on the SA, which is used to
-          determine the Remote address, which in turn determines which
-          Local address (net interface) is used to forward the packet.
-
-          Note: For multicast traffic, the destination address, or
-          source and destination addresses, may be required for
-          demuxing.  In that case, it is important to ensure consistency
-          over the lifetime of the SA by ensuring that the source
-          address that appears in the encapsulating tunnel header is the
-          same as the one that was negotiated during the SA
-          establishment process.  There is an exception to this general
-          rule, i.e., a mobile IPsec implementation will update its
-          source address as it moves.
-
-      (4) Configuration determines whether to copy from the inner header
-          (IPv4 only), clear, or set the DF.
-
-      (5) If the packet will immediately enter a domain for which the
-          DSCP value in the outer header is not appropriate, that value
-          MUST be mapped to an appropriate value for the domain
-          [NiBlBaBL98].  See RFC 2475 [BBCDWW98] for further
-          information.
-
-      (6) If the ECN field in the inner header is set to ECT(0) or
-          ECT(1), where ECT is ECN-Capable Transport (ECT), and if the
-          ECN field in the outer header is set to Congestion Experienced
-          (CE), then set the ECN field in the inner header to CE;
-          otherwise, make no change to the ECN field in the inner
-          header.  (The IPv4 checksum changes when the ECN changes.)
-
-   Note: IPsec does not copy the options from the inner header into the
-   outer header, nor does IPsec construct the options in the outer
-   header.  However, post-IPsec code MAY insert/construct options for
-   the outer header.
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 58]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-5.1.2.2.  IPv6: Header Construction for Tunnel Mode
-
-                         <-- How Outer Hdr  Relates Inner Hdr --->
-                         Outer Hdr at                 Inner Hdr at
-    IPv6                 Encapsulator                 Decapsulator
-      Header fields:     --------------------         ------------
-        version          6 (1)                        no change
-        DS Field         copied from inner hdr (5)    no change (9)
-        ECN Field        copied from inner hdr        constructed (6)
-        flow label       copied or configured (8)     no change
-        payload length   constructed                  no change
-        next header      AH,ESP,routing hdr           no change
-        hop limit        constructed (2)              decrement (2)
-        src address      constructed (3)              no change
-        dest address     constructed (3)              no change
-      Extension headers  never copied (7)             no change
-
-    Notes:
-
-      (1) - (6) See Section 5.1.2.1.
-
-      (7) IPsec does not copy the extension headers from the inner
-          packet into outer headers, nor does IPsec construct extension
-          headers in the outer header.  However, post-IPsec code MAY
-          insert/construct extension headers for the outer header.
-
-      (8) See [RaCoCaDe04].  Copying is acceptable only for end systems,
-          not SGs.  If an SG copied flow labels from the inner header to
-          the outer header, collisions might result.
-
-      (9) An implementation MAY choose to provide a facility to pass the
-          DS value from the outer header to the inner header, on a per-
-          SA basis, for received tunnel mode packets.  The motivation
-          for providing this feature is to accommodate situations in
-          which the DS code space at the receiver is different from that
-          of the sender and the receiver has no way of knowing how to
-          translate from the sender's space.  There is a danger in
-          copying this value from the outer header to the inner header,
-          since it enables an attacker to modify the outer DSCP value in
-          a fashion that may adversely affect other traffic at the
-          receiver.  Hence the default behavior for IPsec
-          implementations is NOT to permit such copying.
-
-5.2.  Processing Inbound IP Traffic (unprotected-to-protected)
-
-   Inbound processing is somewhat different from outbound processing,
-   because of the use of SPIs to map IPsec-protected traffic to SAs.
-   The inbound SPD cache (SPD-I) is applied only to bypassed or
-
-
-
-Kent & Seo                  Standards Track                    [Page 59]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   discarded traffic.  If an arriving packet appears to be an IPsec
-   fragment from an unprotected interface, reassembly is performed prior
-   to IPsec processing.  The intent for any SPD cache is that a packet
-   that fails to match any entry is then referred to the corresponding
-   SPD.  Every SPD SHOULD have a nominal, final entry that catches
-   anything that is otherwise unmatched, and discards it.  This ensures
-   that non-IPsec-protected traffic that arrives and does not match any
-   SPD-I entry will be discarded.
-
-                      Unprotected Interface
-                                |
-                                V
-                             +-----+   IPsec protected
-         ------------------->|Demux|-------------------+
-         |                   +-----+                   |
-         |                      |                      |
-         |            Not IPsec |                      |
-         |                      |                      |
-         |                      V                      |
-         |     +-------+    +---------+                |
-         |     |DISCARD|<---|SPD-I (*)|                |
-         |     +-------+    +---------+                |
-         |                   |                         |
-         |                   |-----+                   |
-         |                   |     |                   |
-         |                   |     V                   |
-         |                   |  +------+               |
-         |                   |  | ICMP |               |
-         |                   |  +------+               |
-         |                   |                         V
-      +---------+            |                   +-----------+
-  ....|SPD-O (*)|............|...................|PROCESS(**)|...IPsec
-      +---------+            |                   | (AH/ESP)  | Boundary
-         ^                   |                   +-----------+
-         |                   |       +---+             |
-         |            BYPASS |   +-->|IKE|             |
-         |                   |   |   +---+             |
-         |                   V   |                     V
-         |               +----------+          +---------+   +----+
-         |--------<------|Forwarding|<---------|SAD Check|-->|ICMP|
-           nested SAs    +----------+          | (***)   |   +----+
-                               |               +---------+
-                               V
-                       Protected Interface
-
-            Figure 3.  Processing Model for Inbound Traffic
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 60]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-                       (*) = The caches are shown here.  If there is
-                             a cache miss, then the SPD is checked.
-                             There is no requirement that an
-                             implementation buffer the packet if
-                             there is a cache miss.
-                      (**) = This processing includes using the
-                             packet's SPI, etc., to look up the SA
-                             in the SAD, which forms a cache of the
-                             SPD for inbound packets (except for
-                             cases noted in Sections 4.4.2 and 5).
-                             See step 3a below.
-                     (***) = This SAD check refers to step 4 below.
-
-   Prior to performing AH or ESP processing, any IP fragments that
-   arrive via the unprotected interface are reassembled (by IP).  Each
-   inbound IP datagram to which IPsec processing will be applied is
-   identified by the appearance of the AH or ESP values in the IP Next
-   Protocol field (or of AH or ESP as a next layer protocol in the IPv6
-   context).
-
-   IPsec MUST perform the following steps:
-
-   1.  When a packet arrives, it may be tagged with the ID of the
-       interface (physical or virtual) via which it arrived, if
-       necessary, to support multiple SPDs and associated SPD-I caches.
-       (The interface ID is mapped to a corresponding SPD-ID.)
-
-   2.  The packet is examined and demuxed into one of two categories:
-       - If the packet appears to be IPsec protected and it is addressed
-         to this device, an attempt is made to map it to an active SA
-         via the SAD.  Note that the device may have multiple IP
-         addresses that may be used in the SAD lookup, e.g., in the case
-         of protocols such as SCTP.
-       - Traffic not addressed to this device, or addressed to this
-         device and not AH or ESP, is directed to SPD-I lookup. (This
-         implies that IKE traffic MUST have an explicit BYPASS entry in
-         the SPD.) If multiple SPDs are employed, the tag assigned to
-         the packet in step 1 is used to select the appropriate SPD-I
-         (and cache) to search.  SPD-I lookup determines whether the
-         action is DISCARD or BYPASS.
-
-   3a. If the packet is addressed to the IPsec device and AH or ESP is
-       specified as the protocol, the packet is looked up in the SAD.
-       For unicast traffic, use only the SPI (or SPI plus protocol).
-       For multicast traffic, use the SPI plus the destination or SPI
-       plus destination and source addresses, as specified in Section
-       4.1. In either case (unicast or multicast), if there is no match,
-       discard the traffic.  This is an auditable event.  The audit log
-
-
-
-Kent & Seo                  Standards Track                    [Page 61]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-       entry for this event SHOULD include the current date/time, SPI,
-       source and destination of the packet, IPsec protocol, and any
-       other selector values of the packet that are available.  If the
-       packet is found in the SAD, process it accordingly (see step 4).
-
-   3b. If the packet is not addressed to the device or is addressed to
-       this device and is not AH or ESP, look up the packet header in
-       the (appropriate) SPD-I cache.  If there is a match and the
-       packet is to be discarded or bypassed, do so.  If there is no
-       cache match, look up the packet in the corresponding SPD-I and
-       create a cache entry as appropriate. (No SAs are created in
-       response to receipt of a packet that requires IPsec protection;
-       only BYPASS or DISCARD cache entries can be created this way.) If
-       there is no match, discard the traffic.  This is an auditable
-       event.  The audit log entry for this event SHOULD include the
-       current date/time, SPI if available, IPsec protocol if available,
-       source and destination of the packet, and any other selector
-       values of the packet that are available.
-
-   3c. Processing of ICMP messages is assumed to take place on the
-       unprotected side of the IPsec boundary.  Unprotected ICMP
-       messages are examined and local policy is applied to determine
-       whether to accept or reject these messages and, if accepted, what
-       action to take as a result.  For example, if an ICMP unreachable
-       message is received, the implementation must decide whether to
-       act on it, reject it, or act on it with constraints. (See Section
-       6.)
-
-   4.  Apply AH or ESP processing as specified, using the SAD entry
-       selected in step 3a above.  Then match the packet against the
-       inbound selectors identified by the SAD entry to verify that the
-       received packet is appropriate for the SA via which it was
-       received.
-
-   5.  If an IPsec system receives an inbound packet on an SA and the
-       packet's header fields are not consistent with the selectors for
-       the SA, it MUST discard the packet.  This is an auditable event.
-       The audit log entry for this event SHOULD include the current
-       date/time, SPI, IPsec protocol(s), source and destination of the
-       packet, any other selector values of the packet that are
-       available, and the selector values from the relevant SAD entry.
-       The system SHOULD also be capable of generating and sending an
-       IKE notification of INVALID_SELECTORS to the sender (IPsec peer),
-       indicating that the received packet was discarded because of
-       failure to pass selector checks.
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 62]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   To minimize the impact of a DoS attack, or a mis-configured peer, the
-   IPsec system SHOULD include a management control to allow an
-   administrator to configure the IPsec implementation to send or not
-   send this IKE notification, and if this facility is selected, to rate
-   limit the transmission of such notifications.
-
-   After traffic is bypassed or processed through IPsec, it is handed to
-   the inbound forwarding function for disposition.  This function may
-   cause the packet to be sent (outbound) across the IPsec boundary for
-   additional inbound IPsec processing, e.g., in support of nested SAs.
-   If so, then as with ALL outbound traffic that is to be bypassed, the
-   packet MUST be matched against an SPD-O entry.  Ultimately, the
-   packet should be forwarded to the destination host or process for
-   disposition.
-
-6.  ICMP Processing
-
-   This section describes IPsec handling of ICMP traffic.  There are two
-   categories of ICMP traffic: error messages (e.g., type = destination
-   unreachable) and non-error messages (e.g., type = echo).  This
-   section applies exclusively to error messages.  Disposition of
-   non-error, ICMP messages (that are not addressed to the IPsec
-   implementation itself) MUST be explicitly accounted for using SPD
-   entries.
-
-   The discussion in this section applies to ICMPv6 as well as to
-   ICMPv4.  Also, a mechanism SHOULD be provided to allow an
-   administrator to cause ICMP error messages (selected, all, or none)
-   to be logged as an aid to problem diagnosis.
-
-6.1.  Processing ICMP Error Messages Directed to an IPsec Implementation
-
-6.1.1.  ICMP Error Messages Received on the Unprotected Side of the
-        Boundary
-
-   Figure 3 in Section 5.2 shows a distinct ICMP processing module on
-   the unprotected side of the IPsec boundary, for processing ICMP
-   messages (error or otherwise) that are addressed to the IPsec device
-   and that are not protected via AH or ESP.  An ICMP message of this
-   sort is unauthenticated, and its processing may result in denial or
-   degradation of service.  This suggests that, in general, it would be
-   desirable to ignore such messages.  However, many ICMP messages will
-   be received by hosts or security gateways from unauthenticated
-   sources, e.g., routers in the public Internet.  Ignoring these ICMP
-   messages can degrade service, e.g., because of a failure to process
-   PMTU message and redirection messages.  Thus, there is also a
-   motivation for accepting and acting upon unauthenticated ICMP
-   messages.
-
-
-
-Kent & Seo                  Standards Track                    [Page 63]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   To accommodate both ends of this spectrum, a compliant IPsec
-   implementation MUST permit a local administrator to configure an
-   IPsec implementation to accept or reject unauthenticated ICMP
-   traffic.  This control MUST be at the granularity of ICMP type and
-   MAY be at the granularity of ICMP type and code.  Additionally, an
-   implementation SHOULD incorporate mechanisms and parameters for
-   dealing with such traffic.  For example, there could be the ability
-   to establish a minimum PMTU for traffic (on a per destination basis),
-   to prevent receipt of an unauthenticated ICMP from setting the PMTU
-   to a trivial size.
-
-   If an ICMP PMTU message passes the checks above and the system is
-   configured to accept it, then there are two possibilities.  If the
-   implementation applies fragmentation on the ciphertext side of the
-   boundary, then the accepted PMTU information is passed to the
-   forwarding module (outside of the IPsec implementation), which uses
-   it to manage outbound packet fragmentation.  If the implementation is
-   configured to effect plaintext side fragmentation, then the PMTU
-   information is passed to the plaintext side and processed as
-   described in Section 8.2.
-
-6.1.2.  ICMP Error Messages Received on the Protected Side of the
-        Boundary
-
-   These ICMP messages are not authenticated, but they do come from
-   sources on the protected side of the IPsec boundary.  Thus, these
-   messages generally are viewed as more "trustworthy" than their
-   counterparts arriving from sources on the unprotected side of the
-   boundary.  The major security concern here is that a compromised host
-   or router might emit erroneous ICMP error messages that could degrade
-   service for other devices "behind" the security gateway, or that
-   could even result in violations of confidentiality.  For example, if
-   a bogus ICMP redirect were consumed by a security gateway, it could
-   cause the forwarding table on the protected side of the boundary to
-   be modified so as to deliver traffic to an inappropriate destination
-   "behind" the gateway.  Thus, implementers MUST provide controls to
-   allow local administrators to constrain the processing of ICMP error
-   messages received on the protected side of the boundary, and directed
-   to the IPsec implementation.  These controls are of the same type as
-   those employed on the unprotected side, described above in Section
-   6.1.1.
-
-6.2.  Processing Protected, Transit ICMP Error Messages
-
-   When an ICMP error message is transmitted via an SA to a device
-   "behind" an IPsec implementation, both the payload and the header of
-   the ICMP message require checking from an access control perspective.
-   If one of these messages is forwarded to a host behind a security
-
-
-
-Kent & Seo                  Standards Track                    [Page 64]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   gateway, the receiving host IP implementation will make decisions
-   based on the payload, i.e., the header of the packet that purportedly
-   triggered the error response.  Thus, an IPsec implementation MUST be
-   configurable to check that this payload header information is
-   consistent with the SA via which it arrives. (This means that the
-   payload header, with source and destination address and port fields
-   reversed, matches the traffic selectors for the SA.) If this sort of
-   check is not performed, then, for example, anyone with whom the
-   receiving IPsec system (A) has an active SA could send an ICMP
-   Destination Unreachable message that refers to any host/net with
-   which A is currently communicating, and thus effect a highly
-   efficient DoS attack regarding communication with other peers of A.
-   Normal IPsec receiver processing of traffic is not sufficient to
-   protect against such attacks.  However, not all contexts may require
-   such checks, so it is also necessary to allow a local administrator
-   to configure an implementation to NOT perform such checks.
-
-   To accommodate both policies, the following convention is adopted.
-   If an administrator wants to allow ICMP error messages to be carried
-   by an SA without inspection of the payload, then configure an SPD
-   entry that explicitly allows for carriage of such traffic.  If an
-   administrator wants IPsec to check the payload of ICMP error messages
-   for consistency, then do not create any SPD entries that accommodate
-   carriage of such traffic based on the ICMP packet header.  This
-   convention motivates the following processing description.
-
-   IPsec senders and receivers MUST support the following processing for
-   ICMP error messages that are sent and received via SAs.
-
-   If an SA exists that accommodates an outbound ICMP error message,
-   then the message is mapped to the SA and only the IP and ICMP headers
-   are checked upon receipt, just as would be the case for other
-   traffic.  If no SA exists that matches the traffic selectors
-   associated with an ICMP error message, then the SPD is searched to
-   determine if such an SA can be created.  If so, the SA is created and
-   the ICMP error message is transmitted via that SA.  Upon receipt,
-   this message is subject to the usual traffic selector checks at the
-   receiver.  This processing is exactly what would happen for traffic
-   in general, and thus does not represent any special processing for
-   ICMP error messages.
-
-   If no SA exists that would carry the outbound ICMP message in
-   question, and if no SPD entry would allow carriage of this outbound
-   ICMP error message, then an IPsec implementation MUST map the message
-   to the SA that would carry the return traffic associated with the
-   packet that triggered the ICMP error message.  This requires an IPsec
-   implementation to detect outbound ICMP error messages that map to no
-   extant SA or SPD entry, and treat them specially with regard to SA
-
-
-
-Kent & Seo                  Standards Track                    [Page 65]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   creation and lookup.  The implementation extracts the header for the
-   packet that triggered the error (from the ICMP message payload),
-   reverses the source and destination IP address fields, extracts the
-   protocol field, and reverses the port fields (if accessible).  It
-   then uses this extracted information to locate an appropriate, active
-   outbound SA, and transmits the error message via this SA.  If no such
-   SA exists, no SA will be created, and this is an auditable event.
-
-   If an IPsec implementation receives an inbound ICMP error message on
-   an SA, and the IP and ICMP headers of the message do not match the
-   traffic selectors for the SA, the receiver MUST process the received
-   message in a special fashion.  Specifically, the receiver must
-   extract the header of the triggering packet from the ICMP payload,
-   and reverse fields as described above to determine if the packet is
-   consistent with the selectors for the SA via which the ICMP error
-   message was received.  If the packet fails this check, the IPsec
-   implementation MUST NOT forwarded the ICMP message to the
-   destination.  This is an auditable event.
-
-7.  Handling Fragments (on the protected side of the IPsec boundary)
-
-   Earlier sections of this document describe mechanisms for (a)
-   fragmenting an outbound packet after IPsec processing has been
-   applied and reassembling it at the receiver before IPsec processing
-   and (b) handling inbound fragments received from the unprotected side
-   of the IPsec boundary.  This section describes how an implementation
-   should handle the processing of outbound plaintext fragments on the
-   protected side of the IPsec boundary. (See Appendix D, "Fragment
-   Handling Rationale".) In particular, it addresses:
-
-        o mapping an outbound non-initial fragment to the right SA
-          (or finding the right SPD entry)
-        o verifying that a received non-initial fragment is
-          authorized for the SA via which it was received
-        o mapping outbound and inbound non-initial fragments to the
-          right SPD-O/SPD-I entry or the relevant cache entry, for
-          BYPASS/DISCARD traffic
-
-   Note: In Section 4.1, transport mode SAs have been defined to not
-   carry fragments (IPv4 or IPv6).  Note also that in Section 4.4.1, two
-   special values, ANY and OPAQUE, were defined for selectors and that
-   ANY includes OPAQUE.  The term "non-trivial" is used to mean that the
-   selector has a value other than OPAQUE or ANY.
-
-   Note: The term "non-initial fragment" is used here to indicate a
-   fragment that does not contain all the selector values that may be
-   needed for access control.  As observed in Section 4.4.1, depending
-   on the Next Layer Protocol, in addition to Ports, the ICMP message
-
-
-
-Kent & Seo                  Standards Track                    [Page 66]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   type/code or Mobility Header type could be missing from non-initial
-   fragments.  Also, for IPv6, even the first fragment might NOT contain
-   the Next Layer Protocol or Ports (or ICMP message type/code, or
-   Mobility Header type) depending on the kind and number of extension
-   headers present.  If a non-initial fragment contains the Port (or
-   ICMP type and code or Mobility Header type) but not the Next Layer
-   Protocol, then unless there is an SPD entry for the relevant
-   Local/Remote addresses with ANY for Next Layer Protocol and Port (or
-   ICMP type and code or Mobility Header type), the fragment would not
-   contain all the selector information needed for access control.
-
-   To address the above issues, three approaches have been defined:
-
-       o Tunnel mode SAs that carry initial and non-initial fragments
-         (See Section 7.1.)
-       o Separate tunnel mode SAs for non-initial fragments (See
-         Section 7.2.)
-       o Stateful fragment checking (See Section 7.3.)
-
-7.1.  Tunnel Mode SAs that Carry Initial and Non-Initial Fragments
-
-   All implementations MUST support tunnel mode SAs that are configured
-   to pass traffic without regard to port field (or ICMP type/code or
-   Mobility Header type) values.  If the SA will carry traffic for
-   specified protocols, the selector set for the SA MUST specify the
-   port fields (or ICMP type/code or Mobility Header type) as ANY.  An
-   SA defined in this fashion will carry all traffic including initial
-   and non-initial fragments for the indicated Local/Remote addresses
-   and specified Next Layer protocol(s).  If the SA will carry traffic
-   without regard to a specific protocol value (i.e., ANY is specified
-   as the (Next Layer) protocol selector value), then the port field
-   values are undefined and MUST be set to ANY as well. (As noted in
-   4.4.1, ANY includes OPAQUE as well as all specific values.)
-
-7.2.  Separate Tunnel Mode SAs for Non-Initial Fragments
-
-   An implementation MAY support tunnel mode SAs that will carry only
-   non-initial fragments, separate from non-fragmented packets and
-   initial fragments.  The OPAQUE value will be used to specify port (or
-   ICMP type/code or Mobility Header type) field selectors for an SA to
-   carry such fragments.  Receivers MUST perform a minimum offset check
-   on IPv4 (non-initial) fragments to protect against overlapping
-   fragment attacks when SAs of this type are employed.  Because such
-   checks cannot be performed on IPv6 non-initial fragments, users and
-   administrators are advised that carriage of such fragments may be
-   dangerous, and implementers may choose to NOT support such SAs for
-   IPv6 traffic.  Also, an SA of this sort will carry all non-initial
-   fragments that match a specified Local/Remote address pair and
-
-
-
-Kent & Seo                  Standards Track                    [Page 67]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   protocol value, i.e., the fragments carried on this SA belong to
-   packets that if not fragmented, might have gone on separate SAs of
-   differing security.  Therefore, users and administrators are advised
-   to protect such traffic using ESP (with integrity) and the
-   "strongest" integrity and encryption algorithms in use between both
-   peers.  (Determination of the "strongest" algorithms requires
-   imposing an ordering of the available algorithms, a local
-   determination at the discretion of the initiator of the SA.)
-
-   Specific port (or ICMP type/code or Mobility Header type) selector
-   values will be used to define SAs to carry initial fragments and
-   non-fragmented packets.  This approach can be used if a user or
-   administrator wants to create one or more tunnel mode SAs between the
-   same Local/Remote addresses that discriminate based on port (or ICMP
-   type/code or Mobility Header type) fields.  These SAs MUST have
-   non-trivial protocol selector values, otherwise approach #1 above
-   MUST be used.
-
-   Note: In general, for the approach described in this section, one
-   needs only a single SA between two implementations to carry all
-   non-initial fragments.  However, if one chooses to have multiple SAs
-   between the two implementations for QoS differentiation, then one
-   might also want multiple SAs to carry fragments-without-ports, one
-   for each supported QoS class.  Since support for QoS via distinct SAs
-   is a local matter, not mandated by this document, the choice to have
-   multiple SAs to carry non-initial fragments should also be local.
-
-7.3.  Stateful Fragment Checking
-
-   An implementation MAY support some form of stateful fragment checking
-   for a tunnel mode SA with non-trivial port (or ICMP type/code or MH
-   type) field values (not ANY or OPAQUE).  Implementations that will
-   transmit non-initial fragments on a tunnel mode SA that makes use of
-   non-trivial port (or ICMP type/code or MH type) selectors MUST notify
-   a peer via the IKE NOTIFY NON_FIRST_FRAGMENTS_ALSO payload.
-
-   The peer MUST reject this proposal if it will not accept non-initial
-   fragments in this context.  If an implementation does not
-   successfully negotiate transmission of non-initial fragments for such
-   an SA, it MUST NOT send such fragments over the SA.  This standard
-   does not specify how peers will deal with such fragments, e.g., via
-   reassembly or other means, at either sender or receiver.  However, a
-   receiver MUST discard non-initial fragments that arrive on an SA with
-   non-trivial port (or ICMP type/code or MH type) selector values
-   unless this feature has been negotiated.  Also, the receiver MUST
-   discard non-initial fragments that do not comply with the security
-   policy applied to the overall packet.  Discarding such packets is an
-   auditable event.  Note that in network configurations where fragments
-
-
-
-Kent & Seo                  Standards Track                    [Page 68]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   of a packet might be sent or received via different security gateways
-   or BITW implementations, stateful strategies for tracking fragments
-   may fail.
-
-7.4.  BYPASS/DISCARD Traffic
-
-   All implementations MUST support DISCARDing of fragments using the
-   normal SPD packet classification mechanisms.  All implementations
-   MUST support stateful fragment checking to accommodate BYPASS traffic
-   for which a non-trivial port range is specified.  The concern is that
-   BYPASS of a cleartext, non-initial fragment arriving at an IPsec
-   implementation could undermine the security afforded IPsec-protected
-   traffic directed to the same destination.  For example, consider an
-   IPsec implementation configured with an SPD entry that calls for
-   IPsec protection of traffic between a specific source/destination
-   address pair, and for a specific protocol and destination port, e.g.,
-   TCP traffic on port 23 (Telnet).  Assume that the implementation also
-   allows BYPASS of traffic from the same source/destination address
-   pair and protocol, but for a different destination port, e.g., port
-   119 (NNTP).  An attacker could send a non-initial fragment (with a
-   forged source address) that, if bypassed, could overlap with
-   IPsec-protected traffic from the same source and thus violate the
-   integrity of the IPsec-protected traffic.  Requiring stateful
-   fragment checking for BYPASS entries with non-trivial port ranges
-   prevents attacks of this sort.  As noted above, in network
-   configurations where fragments of a packet might be sent or received
-   via different security gateways or BITW implementations, stateful
-   strategies for tracking fragments may fail.
-
-8.  Path MTU/DF Processing
-
-   The application of AH or ESP to an outbound packet increases the size
-   of a packet and thus may cause a packet to exceed the PMTU for the SA
-   via which the packet will travel.  An IPsec implementation also may
-   receive an unprotected ICMP PMTU message and, if it chooses to act
-   upon the message, the result will affect outbound traffic processing.
-   This section describes the processing required of an IPsec
-   implementation to deal with these two PMTU issues.
-
-8.1.  DF Bit
-
-   All IPsec implementations MUST support the option of copying the DF
-   bit from an outbound packet to the tunnel mode header that it emits,
-   when traffic is carried via a tunnel mode SA.  This means that it
-   MUST be possible to configure the implementation's treatment of the
-   DF bit (set, clear, copy from inner header) for each SA.  This
-   applies to SAs where both inner and outer headers are IPv4.
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 69]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-8.2.  Path MTU (PMTU) Discovery
-
-   This section discusses IPsec handling for unprotected Path MTU
-   Discovery messages.  ICMP PMTU is used here to refer to an ICMP
-   message for:
-
-           IPv4 (RFC 792 [Pos81b]):
-                   - Type = 3 (Destination Unreachable)
-                   - Code = 4 (Fragmentation needed and DF set)
-                   - Next-Hop MTU in the low-order 16 bits of the
-                     second word of the ICMP header (labeled "unused"
-                     in RFC 792), with high-order 16 bits set to zero)
-
-           IPv6 (RFC 2463 [CD98]):
-                   - Type = 2 (Packet Too Big)
-                   - Code = 0 (Fragmentation needed)
-                   - Next-Hop MTU in the 32-bit MTU field of the ICMP6
-                     message
-
-8.2.1.  Propagation of PMTU
-
-   When an IPsec implementation receives an unauthenticated PMTU
-   message, and it is configured to process (vs. ignore) such messages,
-   it maps the message to the SA to which it corresponds.  This mapping
-   is effected by extracting the header information from the payload of
-   the PMTU message and applying the procedure described in Section 5.2.
-   The PMTU determined by this message is used to update the SAD PMTU
-   field, taking into account the size of the AH or ESP header that will
-   be applied, any crypto synchronization data, and the overhead imposed
-   by an additional IP header, in the case of a tunnel mode SA.
-
-   In a native host implementation, it is possible to maintain PMTU data
-   at the same granularity as for unprotected communication, so there is
-   no loss of functionality.  Signaling of the PMTU information is
-   internal to the host.  For all other IPsec implementation options,
-   the PMTU data must be propagated via a synthesized ICMP PMTU.  In
-   these cases, the IPsec implementation SHOULD wait for outbound
-   traffic to be mapped to the SAD entry.  When such traffic arrives, if
-   the traffic would exceed the updated PMTU value the traffic MUST be
-   handled as follows:
-
-       Case 1: Original (cleartext) packet is IPv4 and has the DF
-               bit set.  The implementation SHOULD discard the packet
-               and send a PMTU ICMP message.
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 70]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-       Case 2: Original (cleartext) packet is IPv4 and has the DF
-               bit clear.  The implementation SHOULD fragment (before or
-               after encryption per its configuration) and then forward
-               the fragments.  It SHOULD NOT send a PMTU ICMP message.
-
-       Case 3: Original (cleartext) packet is IPv6.  The implementation
-               SHOULD discard the packet and send a PMTU ICMP message.
-
-8.2.2.  PMTU Aging
-
-   In all IPsec implementations, the PMTU associated with an SA MUST be
-   "aged" and some mechanism is required to update the PMTU in a timely
-   manner, especially for discovering if the PMTU is smaller than
-   required by current network conditions.  A given PMTU has to remain
-   in place long enough for a packet to get from the source of the SA to
-   the peer, and to propagate an ICMP error message if the current PMTU
-   is too big.
-
-   Implementations SHOULD use the approach described in the Path MTU
-   Discovery document (RFC 1191 [MD90], Section 6.3), which suggests
-   periodically resetting the PMTU to the first-hop data-link MTU and
-   then letting the normal PMTU Discovery processes update the PMTU as
-   necessary.  The period SHOULD be configurable.
-
-9.  Auditing
-
-   IPsec implementations are not required to support auditing.  For the
-   most part, the granularity of auditing is a local matter.  However,
-   several auditable events are identified in this document, and for
-   each of these events a minimum set of information that SHOULD be
-   included in an audit log is defined.  Additional information also MAY
-   be included in the audit log for each of these events, and additional
-   events, not explicitly called out in this specification, also MAY
-   result in audit log entries.  There is no requirement for the
-   receiver to transmit any message to the purported transmitter in
-   response to the detection of an auditable event, because of the
-   potential to induce denial of service via such action.
-
-10.  Conformance Requirements
-
-   All IPv4 IPsec implementations MUST comply with all requirements of
-   this document.  All IPv6 implementations MUST comply with all
-   requirements of this document.
-
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 71]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-11.  Security Considerations
-
-   The focus of this document is security; hence security considerations
-   permeate this specification.
-
-   IPsec imposes stringent constraints on bypass of IP header data in
-   both directions, across the IPsec barrier, especially when tunnel
-   mode SAs are employed.  Some constraints are absolute, while others
-   are subject to local administrative controls, often on a per-SA
-   basis.  For outbound traffic, these constraints are designed to limit
-   covert channel bandwidth.  For inbound traffic, the constraints are
-   designed to prevent an adversary who has the ability to tamper with
-   one data stream (on the unprotected side of the IPsec barrier) from
-   adversely affecting other data streams (on the protected side of the
-   barrier).  The discussion in Section 5 dealing with processing DSCP
-   values for tunnel mode SAs illustrates this concern.
-
-   If an IPsec implementation is configured to pass ICMP error messages
-   over SAs based on the ICMP header values, without checking the header
-   information from the ICMP message payload, serious vulnerabilities
-   may arise.  Consider a scenario in which several sites (A, B, and C)
-   are connected to one another via ESP-protected tunnels: A-B, A-C, and
-   B-C.  Also assume that the traffic selectors for each tunnel specify
-   ANY for protocol and port fields and IP source/destination address
-   ranges that encompass the address range for the systems behind the
-   security gateways serving each site.  This would allow a host at site
-   B to send an ICMP Destination Unreachable message to any host at site
-   A, that declares all hosts on the net at site C to be unreachable.
-   This is a very efficient DoS attack that could have been prevented if
-   the ICMP error messages were subjected to the checks that IPsec
-   provides, if the SPD is suitably configured, as described in Section
-   6.2.
-
-12.  IANA Considerations
-
-   The IANA has assigned the value (3) for the asn1-modules registry and
-   has assigned the object identifier 1.3.6.1.5.8.3.1 for the SPD
-   module.  See Appendix C, "ASN.1 for an SPD Entry".
-
-13.  Differences from RFC 2401
-
-   This architecture document differs substantially from RFC 2401
-   [RFC2401] in detail and in organization, but the fundamental notions
-   are unchanged.
-
-   o The processing model has been revised to address new IPsec
-     scenarios, improve performance, and simplify implementation.  This
-     includes a separation between forwarding (routing) and SPD
-
-
-
-Kent & Seo                  Standards Track                    [Page 72]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-     selection, several SPD changes, and the addition of an outbound SPD
-     cache and an inbound SPD cache for bypassed or discarded traffic.
-     There is also a new database, the Peer Authorization Database
-     (PAD).  This provides a link between an SA management protocol
-     (such as IKE) and the SPD.
-
-   o There is no longer a requirement to support nested SAs or "SA
-     bundles".  Instead this functionality can be achieved through SPD
-     and forwarding table configuration.  An example of a configuration
-     has been added in Appendix E.
-
-   o SPD entries were redefined to provide more flexibility.  Each SPD
-     entry now consists of 1 to N sets of selectors, where each selector
-     set contains one protocol and a "list of ranges" can now be
-     specified for the Local IP address, Remote IP address, and whatever
-     fields (if any) are associated with the Next Layer Protocol (Local
-     Port, Remote Port, ICMP message type and code, and Mobility Header
-     type).  An individual value for a selector is represented via a
-     trivial range and ANY is represented via a range than spans all
-     values for the selector.  An example of an ASN.1 description is
-     included in Appendix C.
-
-   o TOS (IPv4) and Traffic Class (IPv6) have been replaced by DSCP and
-     ECN.  The tunnel section has been updated to explain how to handle
-     DSCP and ECN bits.
-
-   o For tunnel mode SAs, an SG, BITS, or BITW implementation is now
-     allowed to fragment packets before applying IPsec.  This applies
-     only to IPv4.  For IPv6 packets, only the originator is allowed to
-     fragment them.
-
-   o When security is desired between two intermediate systems along a
-     path or between an intermediate system and an end system, transport
-     mode may now be used between security gateways and between a
-     security gateway and a host.
-
-   o This document clarifies that for all traffic that crosses the IPsec
-     boundary, including IPsec management traffic, the SPD or associated
-     caches must be consulted.
-
-   o This document defines how to handle the situation of a security
-     gateway with multiple subscribers requiring separate IPsec
-     contexts.
-
-   o A definition of reserved SPIs has been added.
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 73]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   o Text has been added explaining why ALL IP packets must be checked
-     -- IPsec includes minimal firewall functionality to support access
-     control at the IP layer.
-
-   o The tunnel section has been updated to clarify how to handle the IP
-     options field and IPv6 extension headers when constructing the
-     outer header.
-
-   o SA mapping for inbound traffic has been updated to be consistent
-     with the changes made in AH and ESP for support of unicast and
-     multicast SAs.
-
-   o Guidance has been added regarding how to handle the covert channel
-     created in tunnel mode by copying the DSCP value to outer header.
-
-   o Support for AH in both IPv4 and IPv6 is no longer required.
-
-   o PMTU handling has been updated.  The appendix on
-     PMTU/DF/Fragmentation has been deleted.
-
-   o Three approaches have been added for handling plaintext fragments
-     on the protected side of the IPsec boundary.  Appendix D documents
-     the rationale behind them.
-
-   o Added revised text describing how to derive selector values for SAs
-     (from the SPD entry or from the packet, etc.)
-
-   o Added a new table describing the relationship between selector
-     values in an SPD entry, the PFP flag, and resulting selector values
-     in the corresponding SAD entry.
-
-   o Added Appendix B to describe decorrelation.
-
-   o Added text describing how to handle an outbound packet that must be
-     discarded.
-
-   o Added text describing how to handle a DISCARDED inbound packet,
-     i.e., one that does not match the SA upon which it arrived.
-
-   o IPv6 mobility header has been added as a possible Next Layer
-     Protocol.  IPv6 Mobility Header message type has been added as a
-     selector.
-
-   o ICMP message type and code have been added as selectors.
-
-   o The selector "data sensitivity level" has been removed to simplify
-     things.
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 74]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   o Updated text describing handling ICMP error messages.  The appendix
-     on "Categorization of ICMP Messages" has been deleted.
-
-   o The text for the selector name has been updated and clarified.
-
-   o The "Next Layer Protocol" has been further explained and a default
-     list of protocols to skip when looking for the Next Layer Protocol
-     has been added.
-
-   o The text has been amended to say that this document assumes use of
-     IKEv2 or an SA management protocol with comparable features.
-
-   o Text has been added clarifying the algorithm for mapping inbound
-     IPsec datagrams to SAs in the presence of multicast SAs.
-
-   o The appendix "Sequence Space Window Code Example" has been removed.
-
-   o With respect to IP addresses and ports, the terms "Local" and
-     "Remote" are used for policy rules (replacing source and
-     destination).  "Local" refers to the entity being protected by an
-     IPsec implementation, i.e., the "source" address/port of outbound
-     packets or the "destination" address/port of inbound packets.
-     "Remote" refers to a peer entity or peer entities.  The terms
-     "source" and "destination" are still used for packet header fields.
-
-14.  Acknowledgements
-
-   The authors would like to acknowledge the contributions of Ran
-   Atkinson, who played a critical role in initial IPsec activities, and
-   who authored the first series of IPsec standards: RFCs 1825-1827; and
-   Charlie Lynn, who made significant contributions to the second series
-   of IPsec standards (RFCs 2401, 2402, and 2406) and to the current
-   versions, especially with regard to IPv6 issues.  The authors also
-   would like to thank the members of the IPsec and MSEC working groups
-   who have contributed to the development of this protocol
-   specification.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 75]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-Appendix A: Glossary
-
-   This section provides definitions for several key terms that are
-   employed in this document.  Other documents provide additional
-   definitions and background information relevant to this technology,
-   e.g., [Shi00], [VK83], and [HA94].  Included in this glossary are
-   generic security service and security mechanism terms, plus
-   IPsec-specific terms.
-
-   Access Control
-      A security service that prevents unauthorized use of a resource,
-      including the prevention of use of a resource in an unauthorized
-      manner.  In the IPsec context, the resource to which access is
-      being controlled is often:
-
-               o for a host, computing cycles or data
-               o for a security gateway, a network behind the gateway
-                 or bandwidth on that network.
-
-   Anti-replay
-      See "Integrity" below.
-
-   Authentication
-      Used informally to refer to the combination of two nominally
-      distinct security services, data origin authentication and
-      connectionless integrity.  See the definitions below for each of
-      these services.
-
-   Availability
-      When viewed as a security service, addresses the security concerns
-      engendered by attacks against networks that deny or degrade
-      service.  For example, in the IPsec context, the use of
-      anti-replay mechanisms in AH and ESP support availability.
-
-   Confidentiality
-      The security service that protects data from unauthorized
-      disclosure.  The primary confidentiality concern in most instances
-      is unauthorized disclosure of application-level data, but
-      disclosure of the external characteristics of communication also
-      can be a concern in some circumstances.  Traffic flow
-      confidentiality is the service that addresses this latter concern
-      by concealing source and destination addresses, message length, or
-      frequency of communication.  In the IPsec context, using ESP in
-      tunnel mode, especially at a security gateway, can provide some
-      level of traffic flow confidentiality. (See also "Traffic
-      Analysis" below.)
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 76]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   Data Origin Authentication
-      A security service that verifies the identity of the claimed
-      source of data.  This service is usually bundled with
-      connectionless integrity service.
-
-   Encryption
-      A security mechanism used to transform data from an intelligible
-      form (plaintext) into an unintelligible form (ciphertext), to
-      provide confidentiality.  The inverse transformation process is
-      designated "decryption".  Often the term "encryption" is used to
-      generically refer to both processes.
-
-   Integrity
-      A security service that ensures that modifications to data are
-      detectable.  Integrity comes in various flavors to match
-      application requirements.  IPsec supports two forms of integrity:
-      connectionless and a form of partial sequence integrity.
-      Connectionless integrity is a service that detects modification of
-      an individual IP datagram, without regard to the ordering of the
-      datagram in a stream of traffic.  The form of partial sequence
-      integrity offered in IPsec is referred to as anti-replay
-      integrity, and it detects arrival of duplicate IP datagrams
-      (within a constrained window).  This is in contrast to
-      connection-oriented integrity, which imposes more stringent
-      sequencing requirements on traffic, e.g., to be able to detect
-      lost or re-ordered messages.  Although authentication and
-      integrity services often are cited separately, in practice they
-      are intimately connected and almost always offered in tandem.
-
-   Protected vs. Unprotected
-      "Protected" refers to the systems or interfaces that are inside
-      the IPsec protection boundary, and "unprotected" refers to the
-      systems or interfaces that are outside the IPsec protection
-      boundary.  IPsec provides a boundary through which traffic passes.
-      There is an asymmetry to this barrier, which is reflected in the
-      processing model.  Outbound data, if not discarded or bypassed, is
-      protected via the application of AH or ESP and the addition of the
-      corresponding headers.  Inbound data, if not discarded or
-      bypassed, is processed via the removal of AH or ESP headers.  In
-      this document, inbound traffic enters an IPsec implementation from
-      the "unprotected" interface.  Outbound traffic enters the
-      implementation via the "protected" interface, or is internally
-      generated by the implementation on the "protected" side of the
-      boundary and directed toward the "unprotected" interface.  An
-      IPsec implementation may support more than one interface on either
-      or both sides of the boundary.  The protected interface may be
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 77]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      internal, e.g., in a host implementation of IPsec.  The protected
-      interface may link to a socket layer interface presented by the
-      OS.
-
-   Security Association (SA)
-      A simplex (uni-directional) logical connection, created for
-      security purposes.  All traffic traversing an SA is provided the
-      same security processing.  In IPsec, an SA is an Internet-layer
-      abstraction implemented through the use of AH or ESP.  State data
-      associated with an SA is represented in the SA Database (SAD).
-
-   Security Gateway
-      An intermediate system that acts as the communications interface
-      between two networks.  The set of hosts (and networks) on the
-      external side of the security gateway is termed unprotected (they
-      are generally at least less protected than those "behind" the SG),
-      while the networks and hosts on the internal side are viewed as
-      protected.  The internal subnets and hosts served by a security
-      gateway are presumed to be trusted by virtue of sharing a common,
-      local, security administration.  In the IPsec context, a security
-      gateway is a point at which AH and/or ESP is implemented in order
-      to serve a set of internal hosts, providing security services for
-      these hosts when they communicate with external hosts also
-      employing IPsec (either directly or via another security gateway).
-
-   Security Parameters Index (SPI)
-      An arbitrary 32-bit value that is used by a receiver to identify
-      the SA to which an incoming packet should be bound.  For a unicast
-      SA, the SPI can be used by itself to specify an SA, or it may be
-      used in conjunction with the IPsec protocol type.  Additional IP
-      address information is used to identify multicast SAs.  The SPI is
-      carried in AH and ESP protocols to enable the receiving system to
-      select the SA under which a received packet will be processed.  An
-      SPI has only local significance, as defined by the creator of the
-      SA (usually the receiver of the packet carrying the SPI); thus an
-      SPI is generally viewed as an opaque bit string.  However, the
-      creator of an SA may choose to interpret the bits in an SPI to
-      facilitate local processing.
-
-   Traffic Analysis
-      The analysis of network traffic flow for the purpose of deducing
-      information that is useful to an adversary.  Examples of such
-      information are frequency of transmission, the identities of the
-      conversing parties, sizes of packets, and flow identifiers
-      [Sch94].
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 78]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-Appendix B: Decorrelation
-
-   This appendix is based on work done for caching of policies in the IP
-   Security Policy Working Group by Luis Sanchez, Matt Condell, and John
-   Zao.
-
-   Two SPD entries are correlated if there is a non-null intersection
-   between the values of corresponding selectors in each entry.  Caching
-   correlated SPD entries can lead to incorrect policy enforcement.  A
-   solution to this problem, which still allows for caching, is to
-   remove the ambiguities by decorrelating the entries.  That is, the
-   SPD entries must be rewritten so that for every pair of entries there
-   exists a selector for which there is a null intersection between the
-   values in both of the entries.  Once the entries are decorrelated,
-   there is no longer any ordering requirement on them, since only one
-   entry will match any lookup.  The next section describes
-   decorrelation in more detail and presents an algorithm that may be
-   used to implement decorrelation.
-
-B.1.  Decorrelation Algorithm
-
-   The basic decorrelation algorithm takes each entry in a correlated
-   SPD and divides it into a set of entries using a tree structure.
-   The nodes of the tree are the selectors that may overlap between the
-   policies.  At each node, the algorithm creates a branch for each of
-   the values of the selector.  It also creates one branch for the
-   complement of the union of all selector values.  Policies are then
-   formed by traversing the tree from the root to each leaf.  The
-   policies at the leaves are compared to the set of already
-   decorrelated policy rules.  Each policy at a leaf is either
-   completely overridden by a policy in the already decorrelated set and
-   is discarded or is decorrelated with all the policies in the
-   decorrelated set and is added to it.
-
-   The basic algorithm does not guarantee an optimal set of decorrelated
-   entries.  That is, the entries may be broken up into smaller sets
-   than is necessary, though they will still provide all the necessary
-   policy information.  Some extensions to the basic algorithm are
-   described later to improve this and improve the performance of the
-   algorithm.
-
-           C   A set of ordered, correlated entries (a correlated SPD).
-           Ci  The ith entry in C.
-           U   The set of decorrelated entries being built from C.
-           Ui  The ith entry in U.
-           Sik The kth selection for policy Ci.
-           Ai  The action for policy Ci.
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 79]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   A policy (SPD entry) P may be expressed as a sequence of selector
-   values and an action (BYPASS, DISCARD, or PROTECT):
-
-           Ci = Si1 x Si2 x ... x Sik -> Ai
-
-   1) Put C1 in set U as U1
-
-   For each policy Cj (j > 1) in C
-
-   2) If Cj is decorrelated with every entry in U, then add it to U.
-
-   3) If Cj is correlated with one or more entries in U, create a tree
-   rooted at the policy Cj that partitions Cj into a set of decorrelated
-   entries.  The algorithm starts with a root node where no selectors
-   have yet been chosen.
-
-     A) Choose a selector in Cj, Sjn, that has not yet been chosen when
-        traversing the tree from the root to this node.  If there are no
-        selectors not yet used, continue to the next unfinished branch
-        until all branches have been completed.  When the tree is
-        completed, go to step D.
-
-        T is the set of entries in U that are correlated with the entry
-        at this node.
-
-        The entry at this node is the entry formed by the selector
-        values of each of the branches between the root and this node.
-        Any selector values that are not yet represented by branches
-        assume the corresponding selector value in Cj, since the values
-        in Cj represent the maximum value for each selector.
-
-     B) Add a branch to the tree for each value of the selector Sjn that
-        appears in any of the entries in T.  (If the value is a superset
-        of the value of Sjn in Cj, then use the value in Cj, since that
-        value represents the universal set.)  Also add a branch for the
-        complement of the union of all the values of the selector Sjn
-        in T.  When taking the complement, remember that the universal
-        set is the value of Sjn in Cj.  A branch need not be created
-        for the null set.
-
-     C) Repeat A and B until the tree is completed.
-
-     D) The entry to each leaf now represents an entry that is a subset
-        of Cj.  The entries at the leaves completely partition Cj in
-        such a way that each entry is either completely overridden by
-        an entry in U, or is decorrelated with the entries in U.
-
-        Add all the decorrelated entries at the leaves of the tree to U.
-
-
-
-Kent & Seo                  Standards Track                    [Page 80]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   4) Get next Cj and go to 2.
-
-   5) When all entries in C have been processed, then U will contain an
-   decorrelated version of C.
-
-   There are several optimizations that can be made to this algorithm.
-   A few of them are presented here.
-
-   It is possible to optimize, or at least improve, the amount of
-   branching that occurs by carefully choosing the order of the
-   selectors used for the next branch.  For example, if a selector Sjn
-   can be chosen so that all the values for that selector in T are equal
-   to or a superset of the value of Sjn in Cj, then only a single branch
-   needs to be created (since the complement will be null).
-
-   Branches of the tree do not have to proceed with the entire
-   decorrelation algorithm.  For example, if a node represents an entry
-   that is decorrelated with all the entries in U, then there is no
-   reason to continue decorrelating that branch.  Also, if a branch is
-   completely overridden by an entry in U, then there is no reason to
-   continue decorrelating the branch.
-
-   An additional optimization is to check to see if a branch is
-   overridden by one of the CORRELATED entries in set C that has already
-   been decorrelated.  That is, if the branch is part of decorrelating
-   Cj, then check to see if it was overridden by an entry Cm, m < j.
-   This is a valid check, since all the entries Cm are already expressed
-   in U.
-
-   Along with checking if an entry is already decorrelated in step 2,
-   check if Cj is overridden by any entry in U.  If it is, skip it since
-   it is not relevant.  An entry x is overridden by another entry y if
-   every selector in x is equal to or a subset of the corresponding
-   selector in entry y.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 81]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-Appendix C: ASN.1 for an SPD Entry
-
-   This appendix is included as an additional way to describe SPD
-   entries, as defined in Section 4.4.1.  It uses ASN.1 syntax that has
-   been successfully compiled.  This syntax is merely illustrative and
-   need not be employed in an implementation to achieve compliance.  The
-   SPD description in Section 4.4.1 is normative.
-
-   SPDModule
-
-    {iso(1) org (3) dod (6) internet (1) security (5) mechanisms (5)
-     ipsec (8) asn1-modules (3) spd-module (1) }
-
-       DEFINITIONS IMPLICIT TAGS ::=
-
-       BEGIN
-
-       IMPORTS
-           RDNSequence FROM PKIX1Explicit88
-             { iso(1) identified-organization(3)
-               dod(6) internet(1) security(5) mechanisms(5) pkix(7)
-               id-mod(0) id-pkix1-explicit(18) } ;
-
-       -- An SPD is a list of policies in decreasing order of preference
-       SPD ::= SEQUENCE OF SPDEntry
-
-       SPDEntry ::= CHOICE {
-           iPsecEntry       IPsecEntry,               -- PROTECT traffic
-           bypassOrDiscard  [0] BypassOrDiscardEntry } -- DISCARD/BYPASS
-
-       IPsecEntry ::= SEQUENCE {       -- Each entry consists of
-           name        NameSets OPTIONAL,
-           pFPs        PacketFlags,    -- Populate from packet flags
-                              -- Applies to ALL of the corresponding
-                              -- traffic selectors in the SelectorLists
-           condition   SelectorLists,  -- Policy "condition"
-           processing  Processing      -- Policy "action"
-           }
-
-       BypassOrDiscardEntry ::= SEQUENCE {
-           bypass      BOOLEAN,        -- TRUE BYPASS, FALSE DISCARD
-           condition   InOutBound }
-
-       InOutBound ::= CHOICE {
-           outbound    [0] SelectorLists,
-           inbound     [1] SelectorLists,
-           bothways    [2] BothWays }
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 82]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-       BothWays ::= SEQUENCE {
-           inbound     SelectorLists,
-           outbound    SelectorLists }
-
-       NameSets ::= SEQUENCE {
-           passed      SET OF Names-R,  -- Matched to IKE ID by
-                                        -- responder
-           local       SET OF Names-I } -- Used internally by IKE
-                                        -- initiator
-
-       Names-R ::= CHOICE {                   -- IKEv2 IDs
-           dName       RDNSequence,           -- ID_DER_ASN1_DN
-           fqdn        FQDN,                  -- ID_FQDN
-           rfc822      [0] RFC822Name,        -- ID_RFC822_ADDR
-           keyID       OCTET STRING }         -- KEY_ID
-
-       Names-I ::= OCTET STRING       -- Used internally by IKE
-                                      -- initiator
-
-       FQDN ::= IA5String
-
-       RFC822Name ::= IA5String
-
-       PacketFlags ::= BIT STRING {
-                   -- if set, take selector value from packet
-                   -- establishing SA
-                   -- else use value in SPD entry
-           localAddr  (0),
-           remoteAddr (1),
-           protocol   (2),
-           localPort  (3),
-           remotePort (4)  }
-
-       SelectorLists ::= SET OF SelectorList
-
-       SelectorList ::= SEQUENCE {
-           localAddr   AddrList,
-           remoteAddr  AddrList,
-           protocol    ProtocolChoice }
-
-       Processing ::= SEQUENCE {
-           extSeqNum   BOOLEAN, -- TRUE 64 bit counter, FALSE 32 bit
-           seqOverflow BOOLEAN, -- TRUE rekey, FALSE terminate & audit
-           fragCheck   BOOLEAN, -- TRUE stateful fragment checking,
-                                -- FALSE no stateful fragment checking
-           lifetime    SALifetime,
-           spi         ManualSPI,
-           algorithms  ProcessingAlgs,
-
-
-
-Kent & Seo                  Standards Track                    [Page 83]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-           tunnel      TunnelOptions OPTIONAL } -- if absent, use
-                                                -- transport mode
-
-       SALifetime ::= SEQUENCE {
-           seconds   [0] INTEGER OPTIONAL,
-           bytes     [1] INTEGER OPTIONAL }
-
-       ManualSPI ::= SEQUENCE {
-           spi     INTEGER,
-           keys    KeyIDs }
-
-       KeyIDs ::= SEQUENCE OF OCTET STRING
-
-       ProcessingAlgs ::= CHOICE {
-           ah          [0] IntegrityAlgs,  -- AH
-           esp         [1] ESPAlgs}        -- ESP
-
-       ESPAlgs ::= CHOICE {
-           integrity       [0] IntegrityAlgs,       -- integrity only
-           confidentiality [1] ConfidentialityAlgs, -- confidentiality
-                                                    -- only
-           both            [2] IntegrityConfidentialityAlgs,
-           combined        [3] CombinedModeAlgs }
-
-       IntegrityConfidentialityAlgs ::= SEQUENCE {
-           integrity       IntegrityAlgs,
-           confidentiality ConfidentialityAlgs }
-
-       -- Integrity Algorithms, ordered by decreasing preference
-       IntegrityAlgs ::= SEQUENCE OF IntegrityAlg
-
-       -- Confidentiality Algorithms, ordered by decreasing preference
-       ConfidentialityAlgs ::= SEQUENCE OF ConfidentialityAlg
-
-       -- Integrity Algorithms
-       IntegrityAlg ::= SEQUENCE {
-           algorithm   IntegrityAlgType,
-           parameters  ANY -- DEFINED BY algorithm -- OPTIONAL }
-
-       IntegrityAlgType ::= INTEGER {
-           none              (0),
-           auth-HMAC-MD5-96  (1),
-           auth-HMAC-SHA1-96 (2),
-           auth-DES-MAC      (3),
-           auth-KPDK-MD5     (4),
-           auth-AES-XCBC-96  (5)
-       --  tbd (6..65535)
-           }
-
-
-
-Kent & Seo                  Standards Track                    [Page 84]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-       -- Confidentiality Algorithms
-       ConfidentialityAlg ::= SEQUENCE {
-           algorithm   ConfidentialityAlgType,
-           parameters  ANY -- DEFINED BY algorithm -- OPTIONAL }
-
-       ConfidentialityAlgType ::= INTEGER {
-           encr-DES-IV64   (1),
-           encr-DES        (2),
-           encr-3DES       (3),
-           encr-RC5        (4),
-           encr-IDEA       (5),
-           encr-CAST       (6),
-           encr-BLOWFISH   (7),
-           encr-3IDEA      (8),
-           encr-DES-IV32   (9),
-           encr-RC4       (10),
-           encr-NULL      (11),
-           encr-AES-CBC   (12),
-           encr-AES-CTR   (13)
-       --  tbd (14..65535)
-           }
-
-       CombinedModeAlgs ::= SEQUENCE OF CombinedModeAlg
-
-       CombinedModeAlg ::= SEQUENCE {
-           algorithm   CombinedModeType,
-           parameters  ANY -- DEFINED BY algorithm} -- defined outside
-                                    -- of this document for AES modes.
-
-       CombinedModeType ::= INTEGER {
-           comb-AES-CCM    (1),
-           comb-AES-GCM    (2)
-       --  tbd (3..65535)
-           }
-
-       TunnelOptions ::= SEQUENCE {
-           dscp        DSCP,
-           ecn         BOOLEAN,    -- TRUE Copy CE to inner header
-           df          DF,
-           addresses   TunnelAddresses }
-
-       TunnelAddresses ::= CHOICE {
-           ipv4        IPv4Pair,
-           ipv6        [0] IPv6Pair }
-
-       IPv4Pair ::= SEQUENCE {
-           local       OCTET STRING (SIZE(4)),
-           remote      OCTET STRING (SIZE(4)) }
-
-
-
-Kent & Seo                  Standards Track                    [Page 85]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-       IPv6Pair ::= SEQUENCE {
-           local       OCTET STRING (SIZE(16)),
-           remote      OCTET STRING (SIZE(16)) }
-
-       DSCP ::= SEQUENCE {
-           copy      BOOLEAN, -- TRUE copy from inner header
-                              -- FALSE do not copy
-           mapping   OCTET STRING OPTIONAL} -- points to table
-                                            -- if no copy
-
-       DF ::= INTEGER {
-           clear   (0),
-           set     (1),
-           copy    (2) }
-
-       ProtocolChoice::= CHOICE {
-           anyProt  AnyProtocol,              -- for ANY protocol
-           noNext   [0] NoNextLayerProtocol,  -- has no next layer
-                                              -- items
-           oneNext  [1] OneNextLayerProtocol, -- has one next layer
-                                              -- item
-           twoNext  [2] TwoNextLayerProtocol, -- has two next layer
-                                              -- items
-           fragment FragmentNoNext }          -- has no next layer
-                                              -- info
-
-       AnyProtocol ::= SEQUENCE {
-           id          INTEGER (0),    -- ANY protocol
-           nextLayer   AnyNextLayers }
-
-       AnyNextLayers ::= SEQUENCE {      -- with either
-           first       AnyNextLayer,     -- ANY next layer selector
-           second      AnyNextLayer }    -- ANY next layer selector
-
-       NoNextLayerProtocol ::= INTEGER (2..254)
-
-       FragmentNoNext ::= INTEGER (44)   -- Fragment identifier
-
-       OneNextLayerProtocol ::= SEQUENCE {
-           id          INTEGER (1..254),   -- ICMP, MH, ICMPv6
-           nextLayer   NextLayerChoice }   -- ICMP Type*256+Code
-                                           -- MH   Type*256
-
-       TwoNextLayerProtocol ::= SEQUENCE {
-           id          INTEGER (2..254),   -- Protocol
-           local       NextLayerChoice,    -- Local and
-           remote      NextLayerChoice }   -- Remote ports
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 86]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-       NextLayerChoice ::= CHOICE {
-           any         AnyNextLayer,
-           opaque      [0] OpaqueNextLayer,
-           range       [1] NextLayerRange }
-
-       -- Representation of ANY in next layer field
-       AnyNextLayer ::= SEQUENCE {
-           start       INTEGER (0),
-           end         INTEGER (65535) }
-
-       -- Representation of OPAQUE in next layer field.
-       -- Matches IKE convention
-       OpaqueNextLayer ::= SEQUENCE {
-           start       INTEGER (65535),
-           end         INTEGER (0) }
-
-       -- Range for a next layer field
-       NextLayerRange ::= SEQUENCE {
-           start       INTEGER (0..65535),
-           end         INTEGER (0..65535) }
-
-       -- List of IP addresses
-       AddrList ::= SEQUENCE {
-           v4List      IPv4List OPTIONAL,
-           v6List      [0] IPv6List OPTIONAL }
-
-       -- IPv4 address representations
-       IPv4List ::= SEQUENCE OF IPv4Range
-
-       IPv4Range ::= SEQUENCE {    -- close, but not quite right ...
-           ipv4Start   OCTET STRING (SIZE (4)),
-           ipv4End     OCTET STRING (SIZE (4)) }
-
-       -- IPv6 address representations
-       IPv6List ::= SEQUENCE OF IPv6Range
-
-       IPv6Range ::= SEQUENCE {    -- close, but not quite right ...
-           ipv6Start   OCTET STRING (SIZE (16)),
-           ipv6End     OCTET STRING (SIZE (16)) }
-
-       END
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 87]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-Appendix D: Fragment Handling Rationale
-
-   There are three issues that must be resolved regarding processing of
-   (plaintext) fragments in IPsec:
-
-        - mapping a non-initial, outbound fragment to the right SA
-          (or finding the right SPD entry)
-        - verifying that a received, non-initial fragment is authorized
-          for the SA via which it is received
-        - mapping outbound and inbound non-initial fragments to the
-          right SPD/cache entry, for BYPASS/DISCARD traffic
-
-   The first and third issues arise because we need a deterministic
-   algorithm for mapping traffic to SAs (and SPD/cache entries).  All
-   three issues are important because we want to make sure that
-   non-initial fragments that cross the IPsec boundary do not cause the
-   access control policies in place at the receiver (or transmitter) to
-   be violated.
-
-D.1.  Transport Mode and Fragments
-
-   First, we note that transport mode SAs have been defined to not carry
-   fragments.  This is a carryover from RFC 2401, where transport mode
-   SAs always terminated at endpoints.  This is a fundamental
-   requirement because, in the worst case, an IPv4 fragment to which
-   IPsec was applied might then be fragmented (as a ciphertext packet),
-   en route to the destination.  IP fragment reassembly procedures at
-   the IPsec receiver would not be able to distinguish between pre-IPsec
-   fragments and fragments created after IPsec processing.
-
-   For IPv6, only the sender is allowed to fragment a packet.  As for
-   IPv4, an IPsec implementation is allowed to fragment tunnel mode
-   packets after IPsec processing, because it is the sender relative to
-   the (outer) tunnel header.  However, unlike IPv4, it would be
-   feasible to carry a plaintext fragment on a transport mode SA,
-   because the fragment header in IPv6 would appear after the AH or ESP
-   header, and thus would not cause confusion at the receiver with
-   respect to reassembly.  Specifically, the receiver would not attempt
-   reassembly for the fragment until after IPsec processing.  To keep
-   things simple, this specification prohibits carriage of fragments on
-   transport mode SAs for IPv6 traffic.
-
-   When only end systems used transport mode SAs, the prohibition on
-   carriage of fragments was not a problem, since we assumed that the
-   end system could be configured to not offer a fragment to IPsec.  For
-   a native host implementation, this seems reasonable, and, as someone
-   already noted, RFC 2401 warned that a BITS implementation might have
-   to reassemble fragments before performing an SA lookup.  (It would
-
-
-
-Kent & Seo                  Standards Track                    [Page 88]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   then apply AH or ESP and could re-fragment the packet after IPsec
-   processing.) Because a BITS implementation is assumed to be able to
-   have access to all traffic emanating from its host, even if the host
-   has multiple interfaces, this was deemed a reasonable mandate.
-
-   In this specification, it is acceptable to use transport mode in
-   cases where the IPsec implementation is not the ultimate destination,
-   e.g., between two SGs.  In principle, this creates a new opportunity
-   for outbound, plaintext fragments to be mapped to a transport mode SA
-   for IPsec processing.  However, in these new contexts in which a
-   transport mode SA is now approved for use, it seems likely that we
-   can continue to prohibit transmission of fragments, as seen by IPsec,
-   i.e., packets that have an "outer header" with a non-zero fragment
-   offset field.  For example, in an IP overlay network, packets being
-   sent over transport mode SAs are IP-in-IP tunneled and thus have the
-   necessary inner header to accommodate fragmentation prior to IPsec
-   processing.  When carried via a transport mode SA, IPsec would not
-   examine the inner IP header for such traffic, and thus would not
-   consider the packet to be a fragment.
-
-D.2.  Tunnel Mode and Fragments
-
-   For tunnel mode SAs, it has always been the case that outbound
-   fragments might arrive for processing at an IPsec implementation.
-   The need to accommodate fragmented outbound packets can pose a
-   problem because a non-initial fragment generally will not contain the
-   port fields associated with a next layer protocol such as TCP, UDP,
-   or SCTP.  Thus, depending on the SPD configuration for a given IPsec
-   implementation, plaintext fragments might or might not pose a
-   problem.
-
-   For example, if the SPD requires that all traffic between two address
-   ranges is offered IPsec protection (no BYPASS or DISCARD SPD entries
-   apply to this address range), then it should be easy to carry
-   non-initial fragments on the SA defined for this address range, since
-   the SPD entry implies an intent to carry ALL traffic between the
-   address ranges.  But, if there are multiple SPD entries that could
-   match a fragment, and if these entries reference different subsets of
-   port fields (vs. ANY), then it is not possible to map an outbound
-   non-initial fragment to the right entry, unambiguously. (If we choose
-   to allow carriage of fragments on transport mode SAs for IPv6, the
-   problems arises in that context as well.)
-
-   This problem largely, though not exclusively, motivated the
-   definition of OPAQUE as a selector value for port fields in RFC 2401.
-   The other motivation for OPAQUE is the observation that port fields
-   might not be accessible due to the prior application of IPsec.  For
-   example, if a host applied IPsec to its traffic and that traffic
-
-
-
-Kent & Seo                  Standards Track                    [Page 89]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   arrived at an SG, these fields would be encrypted.  The algorithm
-   specified for locating the "next layer protocol" described in RFC
-   2401 also motivated use of OPAQUE to accommodate an encrypted next
-   layer protocol field in such circumstances.  Nonetheless, the primary
-   use of the OPAQUE value was to match traffic selector fields in
-   packets that did not contain port fields (non-initial fragments), or
-   packets in which the port fields were already encrypted (as a result
-   of nested application of IPsec).  RFC 2401 was ambiguous in
-   discussing the use of OPAQUE vs. ANY, suggesting in some places that
-   ANY might be an alternative to OPAQUE.
-
-   We gain additional access control capability by defining both ANY and
-   OPAQUE values.  OPAQUE can be defined to match only fields that are
-   not accessible.  We could define ANY as the complement of OPAQUE,
-   i.e., it would match all values but only for accessible port fields.
-   We have therefore simplified the procedure employed to locate the
-   next layer protocol in this document, so that we treat ESP and AH as
-   next layer protocols.  As a result, the notion of an encrypted next
-   layer protocol field has vanished, and there is also no need to worry
-   about encrypted port fields either.  And accordingly, OPAQUE will be
-   applicable only to non-initial fragments.
-
-   Since we have adopted the definitions above for ANY and OPAQUE, we
-   need to clarify how these values work when the specified protocol
-   does not have port fields, and when ANY is used for the protocol
-   selector.  Accordingly, if a specific protocol value is used as a
-   selector, and if that protocol has no port fields, then the port
-   field selectors are to be ignored and ANY MUST be specified as the
-   value for the port fields. (In this context, ICMP TYPE and CODE
-   values are lumped together as a single port field (for IKEv2
-   negotiation), as is the IPv6 Mobility Header TYPE value.) If the
-   protocol selector is ANY, then this should be treated as equivalent
-   to specifying a protocol for which no port fields are defined, and
-   thus the port selectors should be ignored, and MUST be set to ANY.
-
-D.3.  The Problem of Non-Initial Fragments
-
-   For an SG implementation, it is obvious that fragments might arrive
-   from end systems behind the SG.  A BITW implementation also may
-   encounter fragments from a host or gateway behind it. (As noted
-   earlier, native host implementations and BITS implementations
-   probably can avoid the problems described below.) In the worst case,
-   fragments from a packet might arrive at distinct BITW or SG
-   instantiations and thus preclude reassembly as a solution option.
-   Hence, in RFC 2401 we adopted a general requirement that fragments
-   must be accommodated in tunnel mode for all implementations. However,
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 90]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   RFC 2401 did not provide a perfect solution.  The use of OPAQUE as a
-   selector value for port fields (a SHOULD in RFC 2401) allowed an SA
-   to carry non-initial fragments.
-
-   Using the features defined in RFC 2401, if one defined an SA between
-   two IPsec (SG or BITW) implementations using the OPAQUE value for
-   both port fields, then all non-initial fragments matching the
-   source/destination (S/D) address and protocol values for the SA would
-   be mapped to that SA.  Initial fragments would NOT map to this SA, if
-   we adopt a strict definition of OPAQUE.  However, RFC 2401 did not
-   provide detailed guidance on this and thus it may not have been
-   apparent that use of this feature would essentially create a
-   "non-initial fragment only" SA.
-
-   In the course of discussing the "fragment-only" SA approach, it was
-   noted that some subtle problems, problems not considered in RFC 2401,
-   would have to be avoided.  For example, an SA of this sort must be
-   configured to offer the "highest quality" security services for any
-   traffic between the indicated S/D addresses (for the specified
-   protocol).  This is necessary to ensure that any traffic captured by
-   the fragment-only SA is not offered degraded security relative to
-   what it would have been offered if the packet were not fragmented.  A
-   possible problem here is that we may not be able to identify the
-   "highest quality" security services defined for use between two IPsec
-   implementation, since the choice of security protocols, options, and
-   algorithms is a lattice, not a totally ordered set. (We might safely
-   say that BYPASS < AH < ESP w/integrity, but it gets complicated if we
-   have multiple ESP encryption or integrity algorithm options.) So, one
-   has to impose a total ordering on these security parameters to make
-   this work, but this can be done locally.
-
-   However, this conservative strategy has a possible performance
-   downside.  If most traffic traversing an IPsec implementation for a
-   given S/D address pair (and specified protocol) is bypassed, then a
-   fragment-only SA for that address pair might cause a dramatic
-   increase in the volume of traffic afforded crypto processing.  If the
-   crypto implementation cannot support high traffic rates, this could
-   cause problems. (An IPsec implementation that is capable of line rate
-   or near line rate crypto performance would not be adversely affected
-   by this SA configuration approach.  Nonetheless, the performance
-   impact is a potential concern, specific to implementation
-   capabilities.)
-
-   Another concern is that non-initial fragments sent over a dedicated
-   SA might be used to effect overlapping reassembly attacks, when
-   combined with an apparently acceptable initial fragment. (This sort
-   of attack assumes creation of bogus fragments and is not a side
-   effect of normal fragmentation.) This concern is easily addressed in
-
-
-
-Kent & Seo                  Standards Track                    [Page 91]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   IPv4, by checking the fragment offset value to ensure that no
-   non-initial fragments have a small enough offset to overlap port
-   fields that should be contained in the initial fragment.  Recall that
-   the IPv4 MTU minimum is 576 bytes, and the max IP header length is 60
-   bytes, so any ports should be present in the initial fragment.  If we
-   require all non-initial fragments to have an offset of, say, 128 or
-   greater, just to be on the safe side, this should prevent successful
-   attacks of this sort.  If the intent is only to protect against this
-   sort of reassembly attack, this check need be implemented only by a
-   receiver.
-
-   IPv6 also has a fragment offset, carried in the fragmentation
-   extension header.  However, IPv6 extension headers are variable in
-   length and there is no analogous max header length value that we can
-   use to check non-initial fragments, to reject ones that might be used
-   for an attack of the sort noted above.  A receiver would need to
-   maintain state analogous to reassembly state, to provide equivalent
-   protection.  So, only for IPv4 is it feasible to impose a fragment
-   offset check that would reject attacks designed to circumvent port
-   field checks by IPsec (or firewalls) when passing non-initial
-   fragments.
-
-   Another possible concern is that in some topologies and SPD
-   configurations this approach might result in an access control
-   surprise.  The notion is that if we create an SA to carry ALL
-   (non-initial) fragments, then that SA would carry some traffic that
-   might otherwise arrive as plaintext via a separate path, e.g., a path
-   monitored by a proxy firewall.  But, this concern arises only if the
-   other path allows initial fragments to traverse it without requiring
-   reassembly, presumably a bad idea for a proxy firewall.  Nonetheless,
-   this does represent a potential problem in some topologies and under
-   certain assumptions with respect to SPD and (other) firewall rule
-   sets, and administrators need to be warned of this possibility.
-
-   A less serious concern is that non-initial fragments sent over a
-   non-initial fragment-only SA might represent a DoS opportunity, in
-   that they could be sent when no valid, initial fragment will ever
-   arrive.  This might be used to attack hosts behind an SG or BITW
-   device.  However, the incremental risk posed by this sort of attack,
-   which can be mounted only by hosts behind an SG or BITW device, seems
-   small.
-
-   If we interpret the ANY selector value as encompassing OPAQUE, then a
-   single SA with ANY values for both port fields would be able to
-   accommodate all traffic matching the S/D address and protocol traffic
-   selectors, an alternative to using the OPAQUE value.  But, using ANY
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 92]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   here precludes multiple, distinct SAs between the same IPsec
-   implementations for the same address pairs and protocol.  So, it is
-   not an exactly equivalent alternative.
-
-   Fundamentally, fragment handling problems arise only when more than
-   one SA is defined with the same S/D address and protocol selector
-   values, but with different port field selector values.
-
-D.4.  BYPASS/DISCARD Traffic
-
-   We also have to address the non-initial fragment processing issue for
-   BYPASS/DISCARD entries, independent of SA processing.  This is
-   largely a local matter for two reasons:
-
-           1) We have no means for coordinating SPD entries for such
-              traffic between IPsec implementations since IKE is not
-              invoked.
-           2) Many of these entries refer to traffic that is NOT
-              directed to or received from a location that is using
-              IPsec.  So there is no peer IPsec implementation with
-              which to coordinate via any means.
-
-   However, this document should provide guidance here, consistent with
-   our goal of offering a well-defined, access control function for all
-   traffic, relative to the IPsec boundary.  To that end, this document
-   says that implementations MUST support fragment reassembly for
-   BYPASS/DISCARD traffic when port fields are specified.  An
-   implementation also MUST permit a user or administrator to accept
-   such traffic or reject such traffic using the SPD conventions
-   described in Section 4.4.1.  The concern is that BYPASS of a
-   cleartext, non-initial fragment arriving at an IPsec implementation
-   could undermine the security afforded IPsec-protected traffic
-   directed to the same destination.  For example, consider an IPsec
-   implementation configured with an SPD entry that calls for
-   IPsec-protection of traffic between a specific source/destination
-   address pair, and for a specific protocol and destination port, e.g.,
-   TCP traffic on port 23 (Telnet).  Assume that the implementation also
-   allows BYPASS of traffic from the same source/destination address
-   pair and protocol, but for a different destination port, e.g., port
-   119 (NNTP).  An attacker could send a non-initial fragment (with a
-   forged source address) that, if bypassed, could overlap with
-   IPsec-protected traffic from the same source and thus violate the
-   integrity of the IPsec-protected traffic.  Requiring stateful
-   fragment checking for BYPASS entries with non-trivial port ranges
-   prevents attacks of this sort.
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 93]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-D.5.  Just say no to ports?
-
-   It has been suggested that we could avoid the problems described
-   above by not allowing port field selectors to be used in tunnel mode.
-   But the discussion above shows this to be an unnecessarily stringent
-   approach, i.e., since no problems arise for the native OS and BITS
-   implementations.  Moreover, some WG members have described scenarios
-   where use of tunnel mode SAs with (non-trivial) port field selectors
-   is appropriate.  So the challenge is defining a strategy that can
-   deal with this problem in BITW and SG contexts.  Also note that
-   BYPASS/DISCARD entries in the SPD that make use of ports pose the
-   same problems, irrespective of tunnel vs. transport mode notions.
-
-   Some folks have suggested that a firewall behind an SG or BITW should
-   be left to enforce port-level access controls and the effects of
-   fragmentation.  However, this seems to be an incongruous suggestion
-   in that elsewhere in IPsec (e.g., in IKE payloads) we are concerned
-   about firewalls that always discard fragments.  If many firewalls
-   don't pass fragments in general, why should we expect them to deal
-   with fragments in this case? So, this analysis rejects the suggestion
-   of disallowing use of port field selectors with tunnel mode SAs.
-
-D.6.  Other Suggested Solutions
-
-   One suggestion is to reassemble fragments at the sending IPsec
-   implementation, and thus avoid the problem entirely.  This approach
-   is invisible to a receiver and thus could be adopted as a purely
-   local implementation option.
-
-   A more sophisticated version of this suggestion calls for
-   establishing and maintaining minimal state from each initial fragment
-   encountered, to allow non-initial fragments to be matched to the
-   right SAs or SPD/cache entries.  This implies an extension to the
-   current processing model (and the old one).  The IPsec implementation
-   would intercept all fragments; capture Source/Destination IP
-   addresses, protocol, packet ID, and port fields from initial
-   fragments; and then use this data to map non-initial fragments to SAs
-   that require port fields.  If this approach is employed, the receiver
-   needs to employ an equivalent scheme, as it too must verify that
-   received fragments are consistent with SA selector values.  A
-   non-initial fragment that arrives prior to an initial fragment could
-   be cached or discarded, awaiting arrival of the corresponding initial
-   fragment.
-
-   A downside of both approaches noted above is that they will not
-   always work.  When a BITW device or SG is configured in a topology
-   that might allow some fragments for a packet to be processed at
-   different SGs or BITW devices, then there is no guarantee that all
-
-
-
-Kent & Seo                  Standards Track                    [Page 94]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   fragments will ever arrive at the same IPsec device.  This approach
-   also raises possible processing problems.  If the sender caches
-   non-initial fragments until the corresponding initial fragment
-   arrives, buffering problems might arise, especially at high speeds.
-   If the non-initial fragments are discarded rather than cached, there
-   is no guarantee that traffic will ever pass, e.g., retransmission
-   will result in different packet IDs that cannot be matched with prior
-   transmissions.  In any case, housekeeping procedures will be needed
-   to decide when to delete the fragment state data, adding some
-   complexity to the system.  Nonetheless, this is a viable solution in
-   some topologies, and these are likely to be common topologies.
-
-   The Working Group rejected an earlier version of the convention of
-   creating an SA to carry only non-initial fragments, something that
-   was supported implicitly under the RFC 2401 model via use of OPAQUE
-   port fields, but never clearly articulated in RFC 2401.  The
-   (rejected) text called for each non-initial fragment to be treated as
-   protocol 44 (the IPv6 fragment header protocol ID) by the sender and
-   receiver.  This approach has the potential to make IPv4 and IPv6
-   fragment handling more uniform, but it does not fundamentally change
-   the problem, nor does it address the issue of fragment handling for
-   BYPASS/DISCARD traffic.  Given the fragment overlap attack problem
-   that IPv6 poses, it does not seem that it is worth the effort to
-   adopt this strategy.
-
-D.7.  Consistency
-
-   Earlier, the WG agreed to allow an IPsec BITS, BITW, or SG to perform
-   fragmentation prior to IPsec processing.  If this fragmentation is
-   performed after SA lookup at the sender, there is no "mapping to the
-   right SA" problem.  But, the receiver still needs to be able to
-   verify that the non-initial fragments are consistent with the SA via
-   which they are received.  Since the initial fragment might be lost en
-   route, the receiver encounters all of the potential problems noted
-   above.  Thus, if we are to be consistent in our decisions, we need to
-   say how a receiver will deal with the non-initial fragments that
-   arrive.
-
-D.8.  Conclusions
-
-   There is no simple, uniform way to handle fragments in all contexts.
-   Different approaches work better in different contexts.  Thus, this
-   document offers 3 choices -- one MUST and two MAYs.  At some point in
-   the future, if the community gains experience with the two MAYs, they
-   may become SHOULDs or MUSTs or other approaches may be proposed.
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 95]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-Appendix E: Example of Supporting Nested SAs via SPD and Forwarding
-            Table Entries
-
-   This appendix provides an example of how to configure the SPD and
-   forwarding tables to support a nested pair of SAs, consistent with
-   the new processing model.  For simplicity, this example assumes just
-   one SPD-I.
-
-   The goal in this example is to support a transport mode SA from A to
-   C, carried over a tunnel mode SA from A to B.  For example, A might
-   be a laptop connected to the public Internet, B might be a firewall
-   that protects a corporate network, and C might be a server on the
-   corporate network that demands end-to-end authentication of A's
-   traffic.
-
-         +---+     +---+  +---+
-         | A |=====| B |  | C |
-         |   |------------|   |
-         |   |=====|   |  |   |
-         +---+     +---+  +---+
-
-   A's SPD contains entries of the form:
-
-                        Next Layer
-      Rule Local Remote Protocol   Action
-      ---- ----- ------ ---------- -----------------------
-       1     C     A     ESP       BYPASS
-       2     A     C     ICMP,ESP  PROTECT(ESP,tunnel,integr+conf)
-       3     A     C     ANY       PROTECT(ESP,transport,integr-only)
-       4     A     B     ICMP,IKE  BYPASS
-
-   A's unprotected-side forwarding table is set so that outbound packets
-   destined for C are looped back to the protected side.  A's
-   protected-side forwarding table is set so that inbound ESP packets
-   are looped back to the unprotected side.  A's forwarding tables
-   contain entries of the form:
-
-      Unprotected-side forwarding table
-
-        Rule Local Remote Protocol Action
-        ---- ----- ------ -------- ---------------------------
-         1     A     C       ANY   loop back to protected side
-         2     A     B       ANY   forward to B
-
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 96]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-      Protected-side forwarding table
-
-        Rule Local Remote Protocol Action
-        ---- ----- ------ -------- -----------------------------
-         1     A     C       ESP   loop back to unprotected side
-
-   An outbound TCP packet from A to C would match SPD rule 3 and have
-   transport mode ESP applied to it.  The unprotected-side forwarding
-   table would then loop back the packet.  The packet is compared
-   against SPD-I (see Figure 2), matches SPD rule 1, and so it is
-   BYPASSed.  The packet is treated as an outbound packet and compared
-   against the SPD for a third time.  This time it matches SPD rule 2,
-   so ESP is applied in tunnel mode.  This time the forwarding table
-   doesn't loop back the packet, because the outer destination address
-   is B, so the packet goes out onto the wire.
-
-   An inbound TCP packet from C to A is wrapped in two ESP headers; the
-   outer header (ESP in tunnel mode) shows B as the source, whereas the
-   inner header (ESP transport mode) shows C as the source.  Upon
-   arrival at A, the packet would be mapped to an SA based on the SPI,
-   have the outer header removed, and be decrypted and
-   integrity-checked.  Then it would be matched against the SAD
-   selectors for this SA, which would specify C as the source and A as
-   the destination, derived from SPD rule 2.  The protected-side
-   forwarding function would then send it back to the unprotected side
-   based on the addresses and the next layer protocol (ESP), indicative
-   of nesting.  It is compared against SPD-O (see Figure 3) and found to
-   match SPD rule 1, so it is BYPASSed.  The packet is mapped to an SA
-   based on the SPI, integrity-checked, and compared against the SAD
-   selectors derived from SPD rule 3.  The forwarding function then
-   passes it up to the next layer, because it isn't an ESP packet.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 97]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-References
-
-Normative References
-
-   [BBCDWW98]     Blake, S., Black, D., Carlson, M., Davies, E., Wang,
-                  Z., and W. Weiss, "An Architecture for Differentiated
-                  Service", RFC 2475, December 1998.
-
-   [Bra97]        Bradner, S., "Key words for use in RFCs to Indicate
-                  Requirement Level", BCP 14, RFC 2119, March 1997.
-
-   [CD98]         Conta, A. and S. Deering, "Internet Control Message
-                  Protocol (ICMPv6) for the Internet Protocol Version 6
-                  (IPv6) Specification", RFC 2463, December 1998.
-
-   [DH98]         Deering, S., and R. Hinden, "Internet Protocol,
-                  Version 6 (IPv6) Specification", RFC 2460, December
-                  1998.
-
-   [Eas05]        3rd Eastlake, D., "Cryptographic Algorithm
-                  Implementation Requirements For Encapsulating Security
-                  Payload (ESP) and Authentication Header (AH)", RFC
-                  4305, December 2005.
-
-   [HarCar98]     Harkins, D. and D. Carrel, "The Internet Key Exchange
-                  (IKE)", RFC 2409, November 1998.
-
-   [Kau05]        Kaufman, C., Ed., "The Internet Key Exchange (IKEv2)
-                  Protocol", RFC 4306, December 2005.
-
-   [Ken05a]       Kent, S., "IP Encapsulating Security Payload (ESP)",
-                  RFC 4303, December 2005.
-
-   [Ken05b]       Kent, S., "IP Authentication Header", RFC 4302,
-                  December 2005.
-
-   [MD90]         Mogul, J. and S. Deering, "Path MTU discovery", RFC
-                  1191, November 1990.
-
-   [Mobip]        Johnson, D., Perkins, C., and J. Arkko, "Mobility
-                  Support in IPv6", RFC 3775, June 2004.
-
-   [Pos81a]       Postel, J., "Internet Protocol", STD 5, RFC 791,
-                  September 1981.
-
-   [Pos81b]       Postel, J., "Internet Control Message Protocol", RFC
-                  792, September 1981.
-
-
-
-
-Kent & Seo                  Standards Track                    [Page 98]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   [Sch05]        Schiller, J., "Cryptographic Algorithms for use in the
-                  Internet Key Exchange Version 2 (IKEv2)", RFC 4307,
-                  December 2005.
-
-   [WaKiHo97]     Wahl, M., Kille, S., and T. Howes, "Lightweight
-                  Directory Access Protocol (v3): UTF-8 String
-                  Representation of Distinguished Names", RFC 2253,
-                  December 1997.
-
-Informative References
-
-   [CoSa04]       Condell, M., and L. Sanchez, "On the Deterministic
-                  Enforcement of Un-ordered Security Policies", BBN
-                  Technical Memo 1346, March 2004.
-
-   [FaLiHaMeTr00] Farinacci, D., Li, T., Hanks, S., Meyer, D., and P.
-                  Traina, "Generic Routing Encapsulation (GRE)", RFC
-                  2784, March 2000.
-
-   [Gro02]        Grossman, D., "New Terminology and Clarifications for
-                  Diffserv", RFC 3260, April 2002.
-   [HC03]         Holbrook, H. and B. Cain, "Source Specific Multicast
-                  for IP", Work in Progress, November 3, 2002.
-
-   [HA94]         Haller, N. and R. Atkinson, "On Internet
-                  Authentication", RFC 1704, October 1994.
-
-   [NiBlBaBL98]   Nichols, K., Blake, S., Baker, F., and D. Black,
-                  "Definition of the Differentiated Services Field (DS
-                  Field) in the IPv4 and IPv6 Headers", RFC 2474,
-                  December 1998.
-
-   [Per96]        Perkins, C., "IP Encapsulation within IP", RFC 2003,
-                  October 1996.
-
-   [RaFlBl01]     Ramakrishnan, K., Floyd, S., and D. Black, "The
-                  Addition of Explicit Congestion Notification (ECN) to
-                  IP", RFC 3168, September 2001.
-
-   [RFC2401]      Kent, S. and R. Atkinson, "Security Architecture for
-                  the Internet Protocol", RFC 2401, November 1998.
-
-   [RFC2983]      Black, D., "Differentiated Services and Tunnels", RFC
-                  2983, October 2000.
-
-   [RFC3547]      Baugher, M., Weis, B., Hardjono, T., and H. Harney,
-                  "The Group Domain of Interpretation", RFC 3547, July
-                  2003.
-
-
-
-Kent & Seo                  Standards Track                    [Page 99]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-   [RFC3740]      Hardjono, T. and B.  Weis, "The Multicast Group
-                  Security Architecture", RFC 3740, March 2004.
-
-   [RaCoCaDe04]   Rajahalme, J., Conta, A., Carpenter, B., and S.
-                  Deering, "IPv6 Flow Label Specification", RFC 3697,
-                  March 2004.
-
-   [Sch94]        Schneier, B.,  Applied Cryptography, Section 8.6, John
-                  Wiley & Sons, New York, NY, 1994.
-
-   [Shi00]        Shirey, R., "Internet Security Glossary", RFC 2828,
-                  May 2000.
-
-   [SMPT01]       Shacham, A., Monsour, B., Pereira, R., and M. Thomas,
-                  "IP Payload Compression Protocol (IPComp)", RFC 3173,
-                  September 2001.
-
-   [ToEgWa04]     Touch, J., Eggert, L., and Y. Wang, "Use of IPsec
-                  Transport Mode for Dynamic Routing", RFC 3884,
-                  September 2004.
-
-   [VK83]         V.L. Voydock & S.T. Kent, "Security Mechanisms in
-                  High-level Networks", ACM Computing Surveys, Vol. 15,
-                  No. 2, June 1983.
-
-Authors' Addresses
-
-   Stephen Kent
-   BBN Technologies
-   10 Moulton Street
-   Cambridge, MA  02138
-   USA
-
-   Phone: +1 (617) 873-3988
-   EMail: kent@bbn.com
-
-
-   Karen Seo
-   BBN Technologies
-   10 Moulton Street
-   Cambridge, MA  02138
-   USA
-
-   Phone: +1 (617) 873-3152
-   EMail: kseo@bbn.com
-
-
-
-
-
-
-Kent & Seo                  Standards Track                   [Page 100]
-
-RFC 4301              Security Architecture for IP         December 2005
-
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society (2005).
-
-   This document is subject to the rights, licenses and restrictions
-   contained in BCP 78, and except as set forth therein, the authors
-   retain all their rights.
-
-   This document and the information contained herein are provided on an
-   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
-   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
-   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
-   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
-   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
-   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-Intellectual Property
-
-   The IETF takes no position regarding the validity or scope of any
-   Intellectual Property Rights or other rights that might be claimed to
-   pertain to the implementation or use of the technology described in
-   this document or the extent to which any license under such rights
-   might or might not be available; nor does it represent that it has
-   made any independent effort to identify any such rights.  Information
-   on the procedures with respect to rights in RFC documents can be
-   found in BCP 78 and BCP 79.
-
-   Copies of IPR disclosures made to the IETF Secretariat and any
-   assurances of licenses to be made available, or the result of an
-   attempt made to obtain a general license or permission for the use of
-   such proprietary rights by implementers or users of this
-   specification can be obtained from the IETF on-line IPR repository at
-   http://www.ietf.org/ipr.
-
-   The IETF invites any interested party to bring to its attention any
-   copyrights, patents or patent applications, or other proprietary
-   rights that may cover technology that may be required to implement
-   this standard.  Please address the information to the IETF at ietf-
-   ipr@ietf.org.
-
-Acknowledgement
-
-   Funding for the RFC Editor function is currently provided by the
-   Internet Society.
-
-
-
-
-
-
-
-Kent & Seo                  Standards Track                   [Page 101]
-
diff --git a/doc/ikev2/[RFC4306] - Internet Key Exchange (IKEv2) Protocol.txt b/doc/ikev2/[RFC4306] - Internet Key Exchange (IKEv2) Protocol.txt
deleted file mode 100644
index fad6cea0e..000000000
--- a/doc/ikev2/[RFC4306] - Internet Key Exchange (IKEv2) Protocol.txt
+++ /dev/null
@@ -1,5547 +0,0 @@
-
-
-
-
-
-
-Network Working Group                                    C. Kaufman, Ed.
-Request for Comments: 4306                                     Microsoft
-Obsoletes: 2407, 2408, 2409                                December 2005
-Category: Standards Track
-
-
-                 Internet Key Exchange (IKEv2) Protocol
-
-Status of This Memo
-
-   This document specifies an Internet standards track protocol for the
-   Internet community, and requests discussion and suggestions for
-   improvements.  Please refer to the current edition of the "Internet
-   Official Protocol Standards" (STD 1) for the standardization state
-   and status of this protocol.  Distribution of this memo is unlimited.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (2005).
-
-Abstract
-
-   This document describes version 2 of the Internet Key Exchange (IKE)
-   protocol.  IKE is a component of IPsec used for performing mutual
-   authentication and establishing and maintaining security associations
-   (SAs).
-
-   This version of the IKE specification combines the contents of what
-   were previously separate documents, including Internet Security
-   Association and Key Management Protocol (ISAKMP, RFC 2408), IKE (RFC
-   2409), the Internet Domain of Interpretation (DOI, RFC 2407), Network
-   Address Translation (NAT) Traversal, Legacy authentication, and
-   remote address acquisition.
-
-   Version 2 of IKE does not interoperate with version 1, but it has
-   enough of the header format in common that both versions can
-   unambiguously run over the same UDP port.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                     [Page 1]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-Table of Contents
-
-   1. Introduction ....................................................3
-      1.1. Usage Scenarios ............................................5
-      1.2. The Initial Exchanges ......................................7
-      1.3. The CREATE_CHILD_SA Exchange ...............................9
-      1.4. The INFORMATIONAL Exchange ................................11
-      1.5. Informational Messages outside of an IKE_SA ...............12
-   2. IKE Protocol Details and Variations ............................12
-      2.1. Use of Retransmission Timers ..............................13
-      2.2. Use of Sequence Numbers for Message ID ....................14
-      2.3. Window Size for Overlapping Requests ......................14
-      2.4. State Synchronization and Connection Timeouts .............15
-      2.5. Version Numbers and Forward Compatibility .................17
-      2.6. Cookies ...................................................18
-      2.7. Cryptographic Algorithm Negotiation .......................21
-      2.8. Rekeying ..................................................22
-      2.9. Traffic Selector Negotiation ..............................24
-      2.10. Nonces ...................................................26
-      2.11. Address and Port Agility .................................26
-      2.12. Reuse of Diffie-Hellman Exponentials .....................27
-      2.13. Generating Keying Material ...............................27
-      2.14. Generating Keying Material for the IKE_SA ................28
-      2.15. Authentication of the IKE_SA .............................29
-      2.16. Extensible Authentication Protocol Methods ...............31
-      2.17. Generating Keying Material for CHILD_SAs .................33
-      2.18. Rekeying IKE_SAs Using a CREATE_CHILD_SA exchange ........34
-      2.19. Requesting an Internal Address on a Remote Network .......34
-      2.20. Requesting the Peer's Version ............................35
-      2.21. Error Handling ...........................................36
-      2.22. IPComp ...................................................37
-      2.23. NAT Traversal ............................................38
-      2.24. Explicit Congestion Notification (ECN) ...................40
-   3. Header and Payload Formats .....................................41
-      3.1. The IKE Header ............................................41
-      3.2. Generic Payload Header ....................................44
-      3.3. Security Association Payload ..............................46
-      3.4. Key Exchange Payload ......................................56
-      3.5. Identification Payloads ...................................56
-      3.6. Certificate Payload .......................................59
-      3.7. Certificate Request Payload ...............................61
-      3.8. Authentication Payload ....................................63
-      3.9. Nonce Payload .............................................64
-      3.10. Notify Payload ...........................................64
-      3.11. Delete Payload ...........................................72
-      3.12. Vendor ID Payload ........................................73
-      3.13. Traffic Selector Payload .................................74
-      3.14. Encrypted Payload ........................................77
-
-
-
-Kaufman                     Standards Track                     [Page 2]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-      3.15. Configuration Payload ....................................79
-      3.16. Extensible Authentication Protocol (EAP) Payload .........84
-   4. Conformance Requirements .......................................85
-   5. Security Considerations ........................................88
-   6. IANA Considerations ............................................90
-   7. Acknowledgements ...............................................91
-   8. References .....................................................91
-      8.1. Normative References ......................................91
-      8.2. Informative References ....................................92
-   Appendix A: Summary of Changes from IKEv1 .........................96
-   Appendix B: Diffie-Hellman Groups .................................97
-      B.1. Group 1 - 768 Bit MODP ....................................97
-      B.2. Group 2 - 1024 Bit MODP ...................................97
-
-1.  Introduction
-
-   IP Security (IPsec) provides confidentiality, data integrity, access
-   control, and data source authentication to IP datagrams.  These
-   services are provided by maintaining shared state between the source
-   and the sink of an IP datagram.  This state defines, among other
-   things, the specific services provided to the datagram, which
-   cryptographic algorithms will be used to provide the services, and
-   the keys used as input to the cryptographic algorithms.
-
-   Establishing this shared state in a manual fashion does not scale
-   well.  Therefore, a protocol to establish this state dynamically is
-   needed.  This memo describes such a protocol -- the Internet Key
-   Exchange (IKE).  This is version 2 of IKE.  Version 1 of IKE was
-   defined in RFCs 2407, 2408, and 2409 [Pip98, MSST98, HC98].  This
-   single document is intended to replace all three of those RFCs.
-
-   Definitions of the primitive terms in this document (such as Security
-   Association or SA) can be found in [RFC4301].
-
-   Keywords "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT" and
-   "MAY" that appear in this document are to be interpreted as described
-   in [Bra97].
-
-   The term "Expert Review" is to be interpreted as defined in
-   [RFC2434].
-
-   IKE performs mutual authentication between two parties and
-   establishes an IKE security association (SA) that includes shared
-   secret information that can be used to efficiently establish SAs for
-   Encapsulating Security Payload (ESP) [RFC4303] and/or Authentication
-   Header (AH) [RFC4302] and a set of cryptographic algorithms to be
-   used by the SAs to protect the traffic that they carry.  In this
-   document, the term "suite" or "cryptographic suite" refers to a
-
-
-
-Kaufman                     Standards Track                     [Page 3]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   complete set of algorithms used to protect an SA.  An initiator
-   proposes one or more suites by listing supported algorithms that can
-   be combined into suites in a mix-and-match fashion.  IKE can also
-   negotiate use of IP Compression (IPComp) [IPCOMP] in connection with
-   an ESP and/or AH SA.  We call the IKE SA an "IKE_SA".  The SAs for
-   ESP and/or AH that get set up through that IKE_SA we call
-   "CHILD_SAs".
-
-   All IKE communications consist of pairs of messages: a request and a
-   response.  The pair is called an "exchange".  We call the first
-   messages establishing an IKE_SA IKE_SA_INIT and IKE_AUTH exchanges
-   and subsequent IKE exchanges CREATE_CHILD_SA or INFORMATIONAL
-   exchanges.  In the common case, there is a single IKE_SA_INIT
-   exchange and a single IKE_AUTH exchange (a total of four messages) to
-   establish the IKE_SA and the first CHILD_SA.  In exceptional cases,
-   there may be more than one of each of these exchanges.  In all cases,
-   all IKE_SA_INIT exchanges MUST complete before any other exchange
-   type, then all IKE_AUTH exchanges MUST complete, and following that
-   any number of CREATE_CHILD_SA and INFORMATIONAL exchanges may occur
-   in any order.  In some scenarios, only a single CHILD_SA is needed
-   between the IPsec endpoints, and therefore there would be no
-   additional exchanges.  Subsequent exchanges MAY be used to establish
-   additional CHILD_SAs between the same authenticated pair of endpoints
-   and to perform housekeeping functions.
-
-   IKE message flow always consists of a request followed by a response.
-   It is the responsibility of the requester to ensure reliability.  If
-   the response is not received within a timeout interval, the requester
-   needs to retransmit the request (or abandon the connection).
-
-   The first request/response of an IKE session (IKE_SA_INIT) negotiates
-   security parameters for the IKE_SA, sends nonces, and sends Diffie-
-   Hellman values.
-
-   The second request/response (IKE_AUTH) transmits identities, proves
-   knowledge of the secrets corresponding to the two identities, and
-   sets up an SA for the first (and often only) AH and/or ESP CHILD_SA.
-
-   The types of subsequent exchanges are CREATE_CHILD_SA (which creates
-   a CHILD_SA) and INFORMATIONAL (which deletes an SA, reports error
-   conditions, or does other housekeeping).  Every request requires a
-   response.  An INFORMATIONAL request with no payloads (other than the
-   empty Encrypted payload required by the syntax) is commonly used as a
-   check for liveness.  These subsequent exchanges cannot be used until
-   the initial exchanges have completed.
-
-
-
-
-
-
-Kaufman                     Standards Track                     [Page 4]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   In the description that follows, we assume that no errors occur.
-   Modifications to the flow should errors occur are described in
-   section 2.21.
-
-1.1.  Usage Scenarios
-
-   IKE is expected to be used to negotiate ESP and/or AH SAs in a number
-   of different scenarios, each with its own special requirements.
-
-1.1.1.  Security Gateway to Security Gateway Tunnel
-
-                    +-+-+-+-+-+            +-+-+-+-+-+
-                    !         ! IPsec      !         !
-       Protected    !Tunnel   ! tunnel     !Tunnel   !     Protected
-       Subnet   <-->!Endpoint !<---------->!Endpoint !<--> Subnet
-                    !         !            !         !
-                    +-+-+-+-+-+            +-+-+-+-+-+
-
-             Figure 1:  Security Gateway to Security Gateway Tunnel
-
-   In this scenario, neither endpoint of the IP connection implements
-   IPsec, but network nodes between them protect traffic for part of the
-   way.  Protection is transparent to the endpoints, and depends on
-   ordinary routing to send packets through the tunnel endpoints for
-   processing.  Each endpoint would announce the set of addresses
-   "behind" it, and packets would be sent in tunnel mode where the inner
-   IP header would contain the IP addresses of the actual endpoints.
-
-1.1.2.  Endpoint-to-Endpoint Transport
-
-       +-+-+-+-+-+                                          +-+-+-+-+-+
-       !         !                 IPsec transport          !         !
-       !Protected!                or tunnel mode SA         !Protected!
-       !Endpoint !<---------------------------------------->!Endpoint !
-       !         !                                          !         !
-       +-+-+-+-+-+                                          +-+-+-+-+-+
-
-                       Figure 2:  Endpoint to Endpoint
-
-   In this scenario, both endpoints of the IP connection implement
-   IPsec, as required of hosts in [RFC4301].  Transport mode will
-   commonly be used with no inner IP header.  If there is an inner IP
-   header, the inner addresses will be the same as the outer addresses.
-   A single pair of addresses will be negotiated for packets to be
-   protected by this SA.  These endpoints MAY implement application
-   layer access controls based on the IPsec authenticated identities of
-   the participants.  This scenario enables the end-to-end security that
-   has been a guiding principle for the Internet since [RFC1958],
-
-
-
-Kaufman                     Standards Track                     [Page 5]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   [RFC2775], and a method of limiting the inherent problems with
-   complexity in networks noted by [RFC3439].  Although this scenario
-   may not be fully applicable to the IPv4 Internet, it has been
-   deployed successfully in specific scenarios within intranets using
-   IKEv1.  It should be more broadly enabled during the transition to
-   IPv6 and with the adoption of IKEv2.
-
-   It is possible in this scenario that one or both of the protected
-   endpoints will be behind a network address translation (NAT) node, in
-   which case the tunneled packets will have to be UDP encapsulated so
-   that port numbers in the UDP headers can be used to identify
-   individual endpoints "behind" the NAT (see section 2.23).
-
-1.1.3.  Endpoint to Security Gateway Tunnel
-
-       +-+-+-+-+-+                          +-+-+-+-+-+
-       !         !         IPsec            !         !     Protected
-       !Protected!         tunnel           !Tunnel   !     Subnet
-       !Endpoint !<------------------------>!Endpoint !<--- and/or
-       !         !                          !         !     Internet
-       +-+-+-+-+-+                          +-+-+-+-+-+
-
-                 Figure 3:  Endpoint to Security Gateway Tunnel
-
-   In this scenario, a protected endpoint (typically a portable roaming
-   computer) connects back to its corporate network through an IPsec-
-   protected tunnel.  It might use this tunnel only to access
-   information on the corporate network, or it might tunnel all of its
-   traffic back through the corporate network in order to take advantage
-   of protection provided by a corporate firewall against Internet-based
-   attacks.  In either case, the protected endpoint will want an IP
-   address associated with the security gateway so that packets returned
-   to it will go to the security gateway and be tunneled back.  This IP
-   address may be static or may be dynamically allocated by the security
-   gateway.  In support of the latter case, IKEv2 includes a mechanism
-   for the initiator to request an IP address owned by the security
-   gateway for use for the duration of its SA.
-
-   In this scenario, packets will use tunnel mode.  On each packet from
-   the protected endpoint, the outer IP header will contain the source
-   IP address associated with its current location (i.e., the address
-   that will get traffic routed to the endpoint directly), while the
-   inner IP header will contain the source IP address assigned by the
-   security gateway (i.e., the address that will get traffic routed to
-   the security gateway for forwarding to the endpoint).  The outer
-   destination address will always be that of the security gateway,
-   while the inner destination address will be the ultimate destination
-   for the packet.
-
-
-
-Kaufman                     Standards Track                     [Page 6]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   In this scenario, it is possible that the protected endpoint will be
-   behind a NAT.  In that case, the IP address as seen by the security
-   gateway will not be the same as the IP address sent by the protected
-   endpoint, and packets will have to be UDP encapsulated in order to be
-   routed properly.
-
-1.1.4.  Other Scenarios
-
-   Other scenarios are possible, as are nested combinations of the
-   above.  One notable example combines aspects of 1.1.1 and 1.1.3. A
-   subnet may make all external accesses through a remote security
-   gateway using an IPsec tunnel, where the addresses on the subnet are
-   routed to the security gateway by the rest of the Internet.  An
-   example would be someone's home network being virtually on the
-   Internet with static IP addresses even though connectivity is
-   provided by an ISP that assigns a single dynamically assigned IP
-   address to the user's security gateway (where the static IP addresses
-   and an IPsec relay are provided by a third party located elsewhere).
-
-1.2.  The Initial Exchanges
-
-   Communication using IKE always begins with IKE_SA_INIT and IKE_AUTH
-   exchanges (known in IKEv1 as Phase 1).  These initial exchanges
-   normally consist of four messages, though in some scenarios that
-   number can grow.  All communications using IKE consist of
-   request/response pairs.  We'll describe the base exchange first,
-   followed by variations.  The first pair of messages (IKE_SA_INIT)
-   negotiate cryptographic algorithms, exchange nonces, and do a
-   Diffie-Hellman exchange [DH].
-
-   The second pair of messages (IKE_AUTH) authenticate the previous
-   messages, exchange identities and certificates, and establish the
-   first CHILD_SA.  Parts of these messages are encrypted and integrity
-   protected with keys established through the IKE_SA_INIT exchange, so
-   the identities are hidden from eavesdroppers and all fields in all
-   the messages are authenticated.
-
-   In the following descriptions, the payloads contained in the message
-   are indicated by names as listed below.
-
-   Notation    Payload
-
-   AUTH      Authentication
-   CERT      Certificate
-   CERTREQ   Certificate Request
-   CP        Configuration
-   D         Delete
-   E         Encrypted
-
-
-
-Kaufman                     Standards Track                     [Page 7]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   EAP       Extensible Authentication
-   HDR       IKE Header
-   IDi       Identification - Initiator
-   IDr       Identification - Responder
-   KE        Key Exchange
-   Ni, Nr    Nonce
-   N         Notify
-   SA        Security Association
-   TSi       Traffic Selector - Initiator
-   TSr       Traffic Selector - Responder
-   V         Vendor ID
-
-   The details of the contents of each payload are described in section
-   3.  Payloads that may optionally appear will be shown in brackets,
-   such as [CERTREQ], indicate that optionally a certificate request
-   payload can be included.
-
-   The initial exchanges are as follows:
-
-       Initiator                          Responder
-      -----------                        -----------
-       HDR, SAi1, KEi, Ni   -->
-
-   HDR contains the Security Parameter Indexes (SPIs), version numbers,
-   and flags of various sorts.  The SAi1 payload states the
-   cryptographic algorithms the initiator supports for the IKE_SA.  The
-   KE payload sends the initiator's Diffie-Hellman value.  Ni is the
-   initiator's nonce.
-
-                            <--    HDR, SAr1, KEr, Nr, [CERTREQ]
-
-   The responder chooses a cryptographic suite from the initiator's
-   offered choices and expresses that choice in the SAr1 payload,
-   completes the Diffie-Hellman exchange with the KEr payload, and sends
-   its nonce in the Nr payload.
-
-   At this point in the negotiation, each party can generate SKEYSEED,
-   from which all keys are derived for that IKE_SA.  All but the headers
-   of all the messages that follow are encrypted and integrity
-   protected.  The keys used for the encryption and integrity protection
-   are derived from SKEYSEED and are known as SK_e (encryption) and SK_a
-   (authentication, a.k.a.  integrity protection).  A separate SK_e and
-   SK_a is computed for each direction.  In addition to the keys SK_e
-   and SK_a derived from the DH value for protection of the IKE_SA,
-   another quantity SK_d is derived and used for derivation of further
-   keying material for CHILD_SAs.  The notation SK { ... } indicates
-   that these payloads are encrypted and integrity protected using that
-   direction's SK_e and SK_a.
-
-
-
-Kaufman                     Standards Track                     [Page 8]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-       HDR, SK {IDi, [CERT,] [CERTREQ,] [IDr,]
-                  AUTH, SAi2, TSi, TSr}     -->
-
-   The initiator asserts its identity with the IDi payload, proves
-   knowledge of the secret corresponding to IDi and integrity protects
-   the contents of the first message using the AUTH payload (see section
-   2.15).  It might also send its certificate(s) in CERT payload(s) and
-   a list of its trust anchors in CERTREQ payload(s).  If any CERT
-   payloads are included, the first certificate provided MUST contain
-   the public key used to verify the AUTH field.  The optional payload
-   IDr enables the initiator to specify which of the responder's
-   identities it wants to talk to.  This is useful when the machine on
-   which the responder is running is hosting multiple identities at the
-   same IP address.  The initiator begins negotiation of a CHILD_SA
-   using the SAi2 payload.  The final fields (starting with SAi2) are
-   described in the description of the CREATE_CHILD_SA exchange.
-
-                                   <--    HDR, SK {IDr, [CERT,] AUTH,
-                                                SAr2, TSi, TSr}
-
-   The responder asserts its identity with the IDr payload, optionally
-   sends one or more certificates (again with the certificate containing
-   the public key used to verify AUTH listed first), authenticates its
-   identity and protects the integrity of the second message with the
-   AUTH payload, and completes negotiation of a CHILD_SA with the
-   additional fields described below in the CREATE_CHILD_SA exchange.
-
-   The recipients of messages 3 and 4 MUST verify that all signatures
-   and MACs are computed correctly and that the names in the ID payloads
-   correspond to the keys used to generate the AUTH payload.
-
-1.3.  The CREATE_CHILD_SA Exchange
-
-   This exchange consists of a single request/response pair, and was
-   referred to as a phase 2 exchange in IKEv1.  It MAY be initiated by
-   either end of the IKE_SA after the initial exchanges are completed.
-
-   All messages following the initial exchange are cryptographically
-   protected using the cryptographic algorithms and keys negotiated in
-   the first two messages of the IKE exchange.  These subsequent
-   messages use the syntax of the Encrypted Payload described in section
-   3.14.  All subsequent messages included an Encrypted Payload, even if
-   they are referred to in the text as "empty".
-
-   Either endpoint may initiate a CREATE_CHILD_SA exchange, so in this
-   section the term "initiator" refers to the endpoint initiating this
-   exchange.
-
-
-
-
-Kaufman                     Standards Track                     [Page 9]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   A CHILD_SA is created by sending a CREATE_CHILD_SA request.  The
-   CREATE_CHILD_SA request MAY optionally contain a KE payload for an
-   additional Diffie-Hellman exchange to enable stronger guarantees of
-   forward secrecy for the CHILD_SA.  The keying material for the
-   CHILD_SA is a function of SK_d established during the establishment
-   of the IKE_SA, the nonces exchanged during the CREATE_CHILD_SA
-   exchange, and the Diffie-Hellman value (if KE payloads are included
-   in the CREATE_CHILD_SA exchange).
-
-   In the CHILD_SA created as part of the initial exchange, a second KE
-   payload and nonce MUST NOT be sent.  The nonces from the initial
-   exchange are used in computing the keys for the CHILD_SA.
-
-   The CREATE_CHILD_SA request contains:
-
-       Initiator                                 Responder
-      -----------                               -----------
-       HDR, SK {[N], SA, Ni, [KEi],
-           [TSi, TSr]}             -->
-
-   The initiator sends SA offer(s) in the SA payload, a nonce in the Ni
-   payload, optionally a Diffie-Hellman value in the KEi payload, and
-   the proposed traffic selectors in the TSi and TSr payloads.  If this
-   CREATE_CHILD_SA exchange is rekeying an existing SA other than the
-   IKE_SA, the leading N payload of type REKEY_SA MUST identify the SA
-   being rekeyed.  If this CREATE_CHILD_SA exchange is not rekeying an
-   existing SA, the N payload MUST be omitted.  If the SA offers include
-   different Diffie-Hellman groups, KEi MUST be an element of the group
-   the initiator expects the responder to accept.  If it guesses wrong,
-   the CREATE_CHILD_SA exchange will fail, and it will have to retry
-   with a different KEi.
-
-   The message following the header is encrypted and the message
-   including the header is integrity protected using the cryptographic
-   algorithms negotiated for the IKE_SA.
-
-   The CREATE_CHILD_SA response contains:
-
-                                  <--    HDR, SK {SA, Nr, [KEr],
-                                               [TSi, TSr]}
-
-   The responder replies (using the same Message ID to respond) with the
-   accepted offer in an SA payload, and a Diffie-Hellman value in the
-   KEr payload if KEi was included in the request and the selected
-   cryptographic suite includes that group.  If the responder chooses a
-   cryptographic suite with a different group, it MUST reject the
-   request.  The initiator SHOULD repeat the request, but now with a KEi
-   payload from the group the responder selected.
-
-
-
-Kaufman                     Standards Track                    [Page 10]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   The traffic selectors for traffic to be sent on that SA are specified
-   in the TS payloads, which may be a subset of what the initiator of
-   the CHILD_SA proposed.  Traffic selectors are omitted if this
-   CREATE_CHILD_SA request is being used to change the key of the
-   IKE_SA.
-
-1.4.  The INFORMATIONAL Exchange
-
-   At various points during the operation of an IKE_SA, peers may desire
-   to convey control messages to each other regarding errors or
-   notifications of certain events.  To accomplish this, IKE defines an
-   INFORMATIONAL exchange.  INFORMATIONAL exchanges MUST ONLY occur
-   after the initial exchanges and are cryptographically protected with
-   the negotiated keys.
-
-   Control messages that pertain to an IKE_SA MUST be sent under that
-   IKE_SA.  Control messages that pertain to CHILD_SAs MUST be sent
-   under the protection of the IKE_SA which generated them (or its
-   successor if the IKE_SA was replaced for the purpose of rekeying).
-
-   Messages in an INFORMATIONAL exchange contain zero or more
-   Notification, Delete, and Configuration payloads.  The Recipient of
-   an INFORMATIONAL exchange request MUST send some response (else the
-   Sender will assume the message was lost in the network and will
-   retransmit it).  That response MAY be a message with no payloads.
-   The request message in an INFORMATIONAL exchange MAY also contain no
-   payloads.  This is the expected way an endpoint can ask the other
-   endpoint to verify that it is alive.
-
-   ESP and AH SAs always exist in pairs, with one SA in each direction.
-   When an SA is closed, both members of the pair MUST be closed.  When
-   SAs are nested, as when data (and IP headers if in tunnel mode) are
-   encapsulated first with IPComp, then with ESP, and finally with AH
-   between the same pair of endpoints, all of the SAs MUST be deleted
-   together.  Each endpoint MUST close its incoming SAs and allow the
-   other endpoint to close the other SA in each pair.  To delete an SA,
-   an INFORMATIONAL exchange with one or more delete payloads is sent
-   listing the SPIs (as they would be expected in the headers of inbound
-   packets) of the SAs to be deleted.  The recipient MUST close the
-   designated SAs.  Normally, the reply in the INFORMATIONAL exchange
-   will contain delete payloads for the paired SAs going in the other
-   direction.  There is one exception.  If by chance both ends of a set
-   of SAs independently decide to close them, each may send a delete
-   payload and the two requests may cross in the network.  If a node
-   receives a delete request for SAs for which it has already issued a
-   delete request, it MUST delete the outgoing SAs while processing the
-   request and the incoming SAs while processing the response.  In that
-
-
-
-
-Kaufman                     Standards Track                    [Page 11]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   case, the responses MUST NOT include delete payloads for the deleted
-   SAs, since that would result in duplicate deletion and could in
-   theory delete the wrong SA.
-
-   A node SHOULD regard half-closed connections as anomalous and audit
-   their existence should they persist.  Note that this specification
-   nowhere specifies time periods, so it is up to individual endpoints
-   to decide how long to wait.  A node MAY refuse to accept incoming
-   data on half-closed connections but MUST NOT unilaterally close them
-   and reuse the SPIs.  If connection state becomes sufficiently messed
-   up, a node MAY close the IKE_SA; doing so will implicitly close all
-   SAs negotiated under it.  It can then rebuild the SAs it needs on a
-   clean base under a new IKE_SA.
-
-   The INFORMATIONAL exchange is defined as:
-
-       Initiator                        Responder
-      -----------                      -----------
-       HDR, SK {[N,] [D,] [CP,] ...} -->
-                                   <-- HDR, SK {[N,] [D,] [CP], ...}
-
-   The processing of an INFORMATIONAL exchange is determined by its
-   component payloads.
-
-1.5.  Informational Messages outside of an IKE_SA
-
-   If an encrypted IKE packet arrives on port 500 or 4500 with an
-   unrecognized SPI, it could be because the receiving node has recently
-   crashed and lost state or because of some other system malfunction or
-   attack.  If the receiving node has an active IKE_SA to the IP address
-   from whence the packet came, it MAY send a notification of the
-   wayward packet over that IKE_SA in an INFORMATIONAL exchange.  If it
-   does not have such an IKE_SA, it MAY send an Informational message
-   without cryptographic protection to the source IP address.  Such a
-   message is not part of an informational exchange, and the receiving
-   node MUST NOT respond to it.  Doing so could cause a message loop.
-
-2.  IKE Protocol Details and Variations
-
-   IKE normally listens and sends on UDP port 500, though IKE messages
-   may also be received on UDP port 4500 with a slightly different
-   format (see section 2.23).  Since UDP is a datagram (unreliable)
-   protocol, IKE includes in its definition recovery from transmission
-   errors, including packet loss, packet replay, and packet forgery.
-   IKE is designed to function so long as (1) at least one of a series
-   of retransmitted packets reaches its destination before timing out;
-   and (2) the channel is not so full of forged and replayed packets so
-
-
-
-
-Kaufman                     Standards Track                    [Page 12]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   as to exhaust the network or CPU capacities of either endpoint.  Even
-   in the absence of those minimum performance requirements, IKE is
-   designed to fail cleanly (as though the network were broken).
-
-   Although IKEv2 messages are intended to be short, they contain
-   structures with no hard upper bound on size (in particular, X.509
-   certificates), and IKEv2 itself does not have a mechanism for
-   fragmenting large messages.  IP defines a mechanism for fragmentation
-   of oversize UDP messages, but implementations vary in the maximum
-   message size supported.  Furthermore, use of IP fragmentation opens
-   an implementation to denial of service attacks [KPS03].  Finally,
-   some NAT and/or firewall implementations may block IP fragments.
-
-   All IKEv2 implementations MUST be able to send, receive, and process
-   IKE messages that are up to 1280 bytes long, and they SHOULD be able
-   to send, receive, and process messages that are up to 3000 bytes
-   long.  IKEv2 implementations SHOULD be aware of the maximum UDP
-   message size supported and MAY shorten messages by leaving out some
-   certificates or cryptographic suite proposals if that will keep
-   messages below the maximum.  Use of the "Hash and URL" formats rather
-   than including certificates in exchanges where possible can avoid
-   most problems.  Implementations and configuration should keep in
-   mind, however, that if the URL lookups are possible only after the
-   IPsec SA is established, recursion issues could prevent this
-   technique from working.
-
-2.1.  Use of Retransmission Timers
-
-   All messages in IKE exist in pairs: a request and a response.  The
-   setup of an IKE_SA normally consists of two request/response pairs.
-   Once the IKE_SA is set up, either end of the security association may
-   initiate requests at any time, and there can be many requests and
-   responses "in flight" at any given moment.  But each message is
-   labeled as either a request or a response, and for each
-   request/response pair one end of the security association is the
-   initiator and the other is the responder.
-
-   For every pair of IKE messages, the initiator is responsible for
-   retransmission in the event of a timeout.  The responder MUST never
-   retransmit a response unless it receives a retransmission of the
-   request.  In that event, the responder MUST ignore the retransmitted
-   request except insofar as it triggers a retransmission of the
-   response.  The initiator MUST remember each request until it receives
-   the corresponding response.  The responder MUST remember each
-   response until it receives a request whose sequence number is larger
-   than the sequence number in the response plus its window size (see
-   section 2.3).
-
-
-
-
-Kaufman                     Standards Track                    [Page 13]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   IKE is a reliable protocol, in the sense that the initiator MUST
-   retransmit a request until either it receives a corresponding reply
-   OR it deems the IKE security association to have failed and it
-   discards all state associated with the IKE_SA and any CHILD_SAs
-   negotiated using that IKE_SA.
-
-2.2.  Use of Sequence Numbers for Message ID
-
-   Every IKE message contains a Message ID as part of its fixed header.
-   This Message ID is used to match up requests and responses, and to
-   identify retransmissions of messages.
-
-   The Message ID is a 32-bit quantity, which is zero for the first IKE
-   request in each direction.  The IKE_SA initial setup messages will
-   always be numbered 0 and 1.  Each endpoint in the IKE Security
-   Association maintains two "current" Message IDs: the next one to be
-   used for a request it initiates and the next one it expects to see in
-   a request from the other end.  These counters increment as requests
-   are generated and received.  Responses always contain the same
-   message ID as the corresponding request.  That means that after the
-   initial exchange, each integer n may appear as the message ID in four
-   distinct messages: the nth request from the original IKE initiator,
-   the corresponding response, the nth request from the original IKE
-   responder, and the corresponding response.  If the two ends make very
-   different numbers of requests, the Message IDs in the two directions
-   can be very different.  There is no ambiguity in the messages,
-   however, because the (I)nitiator and (R)esponse bits in the message
-   header specify which of the four messages a particular one is.
-
-   Note that Message IDs are cryptographically protected and provide
-   protection against message replays.  In the unlikely event that
-   Message IDs grow too large to fit in 32 bits, the IKE_SA MUST be
-   closed.  Rekeying an IKE_SA resets the sequence numbers.
-
-2.3.  Window Size for Overlapping Requests
-
-   In order to maximize IKE throughput, an IKE endpoint MAY issue
-   multiple requests before getting a response to any of them if the
-   other endpoint has indicated its ability to handle such requests.
-   For simplicity, an IKE implementation MAY choose to process requests
-   strictly in order and/or wait for a response to one request before
-   issuing another.  Certain rules must be followed to ensure
-   interoperability between implementations using different strategies.
-
-   After an IKE_SA is set up, either end can initiate one or more
-   requests.  These requests may pass one another over the network.  An
-   IKE endpoint MUST be prepared to accept and process a request while
-
-
-
-
-Kaufman                     Standards Track                    [Page 14]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   it has a request outstanding in order to avoid a deadlock in this
-   situation.  An IKE endpoint SHOULD be prepared to accept and process
-   multiple requests while it has a request outstanding.
-
-   An IKE endpoint MUST wait for a response to each of its messages
-   before sending a subsequent message unless it has received a
-   SET_WINDOW_SIZE Notify message from its peer informing it that the
-   peer is prepared to maintain state for multiple outstanding messages
-   in order to allow greater throughput.
-
-   An IKE endpoint MUST NOT exceed the peer's stated window size for
-   transmitted IKE requests.  In other words, if the responder stated
-   its window size is N, then when the initiator needs to make a request
-   X, it MUST wait until it has received responses to all requests up
-   through request X-N.  An IKE endpoint MUST keep a copy of (or be able
-   to regenerate exactly) each request it has sent until it receives the
-   corresponding response.  An IKE endpoint MUST keep a copy of (or be
-   able to regenerate exactly) the number of previous responses equal to
-   its declared window size in case its response was lost and the
-   initiator requests its retransmission by retransmitting the request.
-
-   An IKE endpoint supporting a window size greater than one SHOULD be
-   capable of processing incoming requests out of order to maximize
-   performance in the event of network failures or packet reordering.
-
-2.4.  State Synchronization and Connection Timeouts
-
-   An IKE endpoint is allowed to forget all of its state associated with
-   an IKE_SA and the collection of corresponding CHILD_SAs at any time.
-   This is the anticipated behavior in the event of an endpoint crash
-   and restart.  It is important when an endpoint either fails or
-   reinitializes its state that the other endpoint detect those
-   conditions and not continue to waste network bandwidth by sending
-   packets over discarded SAs and having them fall into a black hole.
-
-   Since IKE is designed to operate in spite of Denial of Service (DoS)
-   attacks from the network, an endpoint MUST NOT conclude that the
-   other endpoint has failed based on any routing information (e.g.,
-   ICMP messages) or IKE messages that arrive without cryptographic
-   protection (e.g., Notify messages complaining about unknown SPIs).
-   An endpoint MUST conclude that the other endpoint has failed only
-   when repeated attempts to contact it have gone unanswered for a
-   timeout period or when a cryptographically protected INITIAL_CONTACT
-   notification is received on a different IKE_SA to the same
-   authenticated identity.  An endpoint SHOULD suspect that the other
-   endpoint has failed based on routing information and initiate a
-   request to see whether the other endpoint is alive.  To check whether
-   the other side is alive, IKE specifies an empty INFORMATIONAL message
-
-
-
-Kaufman                     Standards Track                    [Page 15]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   that (like all IKE requests) requires an acknowledgement (note that
-   within the context of an IKE_SA, an "empty" message consists of an
-   IKE header followed by an Encrypted payload that contains no
-   payloads).  If a cryptographically protected message has been
-   received from the other side recently, unprotected notifications MAY
-   be ignored.  Implementations MUST limit the rate at which they take
-   actions based on unprotected messages.
-
-   Numbers of retries and lengths of timeouts are not covered in this
-   specification because they do not affect interoperability.  It is
-   suggested that messages be retransmitted at least a dozen times over
-   a period of at least several minutes before giving up on an SA, but
-   different environments may require different rules.  To be a good
-   network citizen, retranmission times MUST increase exponentially to
-   avoid flooding the network and making an existing congestion
-   situation worse.  If there has only been outgoing traffic on all of
-   the SAs associated with an IKE_SA, it is essential to confirm
-   liveness of the other endpoint to avoid black holes.  If no
-   cryptographically protected messages have been received on an IKE_SA
-   or any of its CHILD_SAs recently, the system needs to perform a
-   liveness check in order to prevent sending messages to a dead peer.
-   Receipt of a fresh cryptographically protected message on an IKE_SA
-   or any of its CHILD_SAs ensures liveness of the IKE_SA and all of its
-   CHILD_SAs.  Note that this places requirements on the failure modes
-   of an IKE endpoint.  An implementation MUST NOT continue sending on
-   any SA if some failure prevents it from receiving on all of the
-   associated SAs.  If CHILD_SAs can fail independently from one another
-   without the associated IKE_SA being able to send a delete message,
-   then they MUST be negotiated by separate IKE_SAs.
-
-   There is a Denial of Service attack on the initiator of an IKE_SA
-   that can be avoided if the initiator takes the proper care.  Since
-   the first two messages of an SA setup are not cryptographically
-   protected, an attacker could respond to the initiator's message
-   before the genuine responder and poison the connection setup attempt.
-   To prevent this, the initiator MAY be willing to accept multiple
-   responses to its first message, treat each as potentially legitimate,
-   respond to it, and then discard all the invalid half-open connections
-   when it receives a valid cryptographically protected response to any
-   one of its requests.  Once a cryptographically valid response is
-   received, all subsequent responses should be ignored whether or not
-   they are cryptographically valid.
-
-   Note that with these rules, there is no reason to negotiate and agree
-   upon an SA lifetime.  If IKE presumes the partner is dead, based on
-   repeated lack of acknowledgement to an IKE message, then the IKE SA
-   and all CHILD_SAs set up through that IKE_SA are deleted.
-
-
-
-
-Kaufman                     Standards Track                    [Page 16]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   An IKE endpoint may at any time delete inactive CHILD_SAs to recover
-   resources used to hold their state.  If an IKE endpoint chooses to
-   delete CHILD_SAs, it MUST send Delete payloads to the other end
-   notifying it of the deletion.  It MAY similarly time out the IKE_SA.
-   Closing the IKE_SA implicitly closes all associated CHILD_SAs.  In
-   this case, an IKE endpoint SHOULD send a Delete payload indicating
-   that it has closed the IKE_SA.
-
-2.5.  Version Numbers and Forward Compatibility
-
-   This document describes version 2.0 of IKE, meaning the major version
-   number is 2 and the minor version number is zero.  It is likely that
-   some implementations will want to support both version 1.0 and
-   version 2.0, and in the future, other versions.
-
-   The major version number should be incremented only if the packet
-   formats or required actions have changed so dramatically that an
-   older version node would not be able to interoperate with a newer
-   version node if it simply ignored the fields it did not understand
-   and took the actions specified in the older specification.  The minor
-   version number indicates new capabilities, and MUST be ignored by a
-   node with a smaller minor version number, but used for informational
-   purposes by the node with the larger minor version number.  For
-   example, it might indicate the ability to process a newly defined
-   notification message.  The node with the larger minor version number
-   would simply note that its correspondent would not be able to
-   understand that message and therefore would not send it.
-
-   If an endpoint receives a message with a higher major version number,
-   it MUST drop the message and SHOULD send an unauthenticated
-   notification message containing the highest version number it
-   supports.  If an endpoint supports major version n, and major version
-   m, it MUST support all versions between n and m.  If it receives a
-   message with a major version that it supports, it MUST respond with
-   that version number.  In order to prevent two nodes from being
-   tricked into corresponding with a lower major version number than the
-   maximum that they both support, IKE has a flag that indicates that
-   the node is capable of speaking a higher major version number.
-
-   Thus, the major version number in the IKE header indicates the
-   version number of the message, not the highest version number that
-   the transmitter supports.  If the initiator is capable of speaking
-   versions n, n+1, and n+2, and the responder is capable of speaking
-   versions n and n+1, then they will negotiate speaking n+1, where the
-   initiator will set the flag indicating its ability to speak a higher
-   version.  If they mistakenly (perhaps through an active attacker
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 17]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   sending error messages) negotiate to version n, then both will notice
-   that the other side can support a higher version number, and they
-   MUST break the connection and reconnect using version n+1.
-
-   Note that IKEv1 does not follow these rules, because there is no way
-   in v1 of noting that you are capable of speaking a higher version
-   number.  So an active attacker can trick two v2-capable nodes into
-   speaking v1.  When a v2-capable node negotiates down to v1, it SHOULD
-   note that fact in its logs.
-
-   Also for forward compatibility, all fields marked RESERVED MUST be
-   set to zero by a version 2.0 implementation and their content MUST be
-   ignored by a version 2.0 implementation ("Be conservative in what you
-   send and liberal in what you receive").  In this way, future versions
-   of the protocol can use those fields in a way that is guaranteed to
-   be ignored by implementations that do not understand them.
-   Similarly, payload types that are not defined are reserved for future
-   use; implementations of version 2.0 MUST skip over those payloads and
-   ignore their contents.
-
-   IKEv2 adds a "critical" flag to each payload header for further
-   flexibility for forward compatibility.  If the critical flag is set
-   and the payload type is unrecognized, the message MUST be rejected
-   and the response to the IKE request containing that payload MUST
-   include a Notify payload UNSUPPORTED_CRITICAL_PAYLOAD, indicating an
-   unsupported critical payload was included.  If the critical flag is
-   not set and the payload type is unsupported, that payload MUST be
-   ignored.
-
-   Although new payload types may be added in the future and may appear
-   interleaved with the fields defined in this specification,
-   implementations MUST send the payloads defined in this specification
-   in the order shown in the figures in section 2 and implementations
-   SHOULD reject as invalid a message with those payloads in any other
-   order.
-
-2.6.  Cookies
-
-   The term "cookies" originates with Karn and Simpson [RFC2522] in
-   Photuris, an early proposal for key management with IPsec, and it has
-   persisted.  The Internet Security Association and Key Management
-   Protocol (ISAKMP) [MSST98] fixed message header includes two eight-
-   octet fields titled "cookies", and that syntax is used by both IKEv1
-   and IKEv2 though in IKEv2 they are referred to as the IKE SPI and
-   there is a new separate field in a Notify payload holding the cookie.
-   The initial two eight-octet fields in the header are used as a
-   connection identifier at the beginning of IKE packets.  Each endpoint
-
-
-
-
-Kaufman                     Standards Track                    [Page 18]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   chooses one of the two SPIs and SHOULD choose them so as to be unique
-   identifiers of an IKE_SA.  An SPI value of zero is special and
-   indicates that the remote SPI value is not yet known by the sender.
-
-   Unlike ESP and AH where only the recipient's SPI appears in the
-   header of a message, in IKE the sender's SPI is also sent in every
-   message.  Since the SPI chosen by the original initiator of the
-   IKE_SA is always sent first, an endpoint with multiple IKE_SAs open
-   that wants to find the appropriate IKE_SA using the SPI it assigned
-   must look at the I(nitiator) Flag bit in the header to determine
-   whether it assigned the first or the second eight octets.
-
-   In the first message of an initial IKE exchange, the initiator will
-   not know the responder's SPI value and will therefore set that field
-   to zero.
-
-   An expected attack against IKE is state and CPU exhaustion, where the
-   target is flooded with session initiation requests from forged IP
-   addresses.  This attack can be made less effective if an
-   implementation of a responder uses minimal CPU and commits no state
-   to an SA until it knows the initiator can receive packets at the
-   address from which it claims to be sending them.  To accomplish this,
-   a responder SHOULD -- when it detects a large number of half-open
-   IKE_SAs -- reject initial IKE messages unless they contain a Notify
-   payload of type COOKIE.  It SHOULD instead send an unprotected IKE
-   message as a response and include COOKIE Notify payload with the
-   cookie data to be returned.  Initiators who receive such responses
-   MUST retry the IKE_SA_INIT with a Notify payload of type COOKIE
-   containing the responder supplied cookie data as the first payload
-   and all other payloads unchanged.  The initial exchange will then be
-   as follows:
-
-       Initiator                          Responder
-       -----------                        -----------
-       HDR(A,0), SAi1, KEi, Ni   -->
-
-                                 <-- HDR(A,0), N(COOKIE)
-
-       HDR(A,0), N(COOKIE), SAi1, KEi, Ni   -->
-
-                                 <-- HDR(A,B), SAr1, KEr, Nr, [CERTREQ]
-
-       HDR(A,B), SK {IDi, [CERT,] [CERTREQ,] [IDr,]
-           AUTH, SAi2, TSi, TSr} -->
-
-                                 <-- HDR(A,B), SK {IDr, [CERT,] AUTH,
-                                                SAr2, TSi, TSr}
-
-
-
-
-Kaufman                     Standards Track                    [Page 19]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   The first two messages do not affect any initiator or responder state
-   except for communicating the cookie.  In particular, the message
-   sequence numbers in the first four messages will all be zero and the
-   message sequence numbers in the last two messages will be one. 'A' is
-   the SPI assigned by the initiator, while 'B' is the SPI assigned by
-   the responder.
-
-   An IKE implementation SHOULD implement its responder cookie
-   generation in such a way as to not require any saved state to
-   recognize its valid cookie when the second IKE_SA_INIT message
-   arrives.  The exact algorithms and syntax they use to generate
-   cookies do not affect interoperability and hence are not specified
-   here.  The following is an example of how an endpoint could use
-   cookies to implement limited DOS protection.
-
-   A good way to do this is to set the responder cookie to be:
-
-      Cookie = <VersionIDofSecret> | Hash(Ni | IPi | SPIi | <secret>)
-
-   where <secret> is a randomly generated secret known only to the
-   responder and periodically changed and | indicates concatenation.
-   <VersionIDofSecret> should be changed whenever <secret> is
-   regenerated.  The cookie can be recomputed when the IKE_SA_INIT
-   arrives the second time and compared to the cookie in the received
-   message.  If it matches, the responder knows that the cookie was
-   generated since the last change to <secret> and that IPi must be the
-   same as the source address it saw the first time.  Incorporating SPIi
-   into the calculation ensures that if multiple IKE_SAs are being set
-   up in parallel they will all get different cookies (assuming the
-   initiator chooses unique SPIi's).  Incorporating Ni into the hash
-   ensures that an attacker who sees only message 2 can't successfully
-   forge a message 3.
-
-   If a new value for <secret> is chosen while there are connections in
-   the process of being initialized, an IKE_SA_INIT might be returned
-   with other than the current <VersionIDofSecret>.  The responder in
-   that case MAY reject the message by sending another response with a
-   new cookie or it MAY keep the old value of <secret> around for a
-   short time and accept cookies computed from either one.  The
-   responder SHOULD NOT accept cookies indefinitely after <secret> is
-   changed, since that would defeat part of the denial of service
-   protection.  The responder SHOULD change the value of <secret>
-   frequently, especially if under attack.
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 20]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-2.7.  Cryptographic Algorithm Negotiation
-
-   The payload type known as "SA" indicates a proposal for a set of
-   choices of IPsec protocols (IKE, ESP, and/or AH) for the SA as well
-   as cryptographic algorithms associated with each protocol.
-
-   An SA payload consists of one or more proposals.  Each proposal
-   includes one or more protocols (usually one).  Each protocol contains
-   one or more transforms -- each specifying a cryptographic algorithm.
-   Each transform contains zero or more attributes (attributes are
-   needed only if the transform identifier does not completely specify
-   the cryptographic algorithm).
-
-   This hierarchical structure was designed to efficiently encode
-   proposals for cryptographic suites when the number of supported
-   suites is large because multiple values are acceptable for multiple
-   transforms.  The responder MUST choose a single suite, which MAY be
-   any subset of the SA proposal following the rules below:
-
-      Each proposal contains one or more protocols.  If a proposal is
-      accepted, the SA response MUST contain the same protocols in the
-      same order as the proposal.  The responder MUST accept a single
-      proposal or reject them all and return an error. (Example: if a
-      single proposal contains ESP and AH and that proposal is accepted,
-      both ESP and AH MUST be accepted.  If ESP and AH are included in
-      separate proposals, the responder MUST accept only one of them).
-
-      Each IPsec protocol proposal contains one or more transforms.
-      Each transform contains a transform type.  The accepted
-      cryptographic suite MUST contain exactly one transform of each
-      type included in the proposal.  For example: if an ESP proposal
-      includes transforms ENCR_3DES, ENCR_AES w/keysize 128, ENCR_AES
-      w/keysize 256, AUTH_HMAC_MD5, and AUTH_HMAC_SHA, the accepted
-      suite MUST contain one of the ENCR_ transforms and one of the
-      AUTH_ transforms.  Thus, six combinations are acceptable.
-
-   Since the initiator sends its Diffie-Hellman value in the
-   IKE_SA_INIT, it must guess the Diffie-Hellman group that the
-   responder will select from its list of supported groups.  If the
-   initiator guesses wrong, the responder will respond with a Notify
-   payload of type INVALID_KE_PAYLOAD indicating the selected group.  In
-   this case, the initiator MUST retry the IKE_SA_INIT with the
-   corrected Diffie-Hellman group.  The initiator MUST again propose its
-   full set of acceptable cryptographic suites because the rejection
-   message was unauthenticated and otherwise an active attacker could
-   trick the endpoints into negotiating a weaker suite than a stronger
-   one that they both prefer.
-
-
-
-
-Kaufman                     Standards Track                    [Page 21]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-2.8.  Rekeying
-
-   IKE, ESP, and AH security associations use secret keys that SHOULD be
-   used only for a limited amount of time and to protect a limited
-   amount of data.  This limits the lifetime of the entire security
-   association.  When the lifetime of a security association expires,
-   the security association MUST NOT be used.  If there is demand, new
-   security associations MAY be established.  Reestablishment of
-   security associations to take the place of ones that expire is
-   referred to as "rekeying".
-
-   To allow for minimal IPsec implementations, the ability to rekey SAs
-   without restarting the entire IKE_SA is optional.  An implementation
-   MAY refuse all CREATE_CHILD_SA requests within an IKE_SA.  If an SA
-   has expired or is about to expire and rekeying attempts using the
-   mechanisms described here fail, an implementation MUST close the
-   IKE_SA and any associated CHILD_SAs and then MAY start new ones.
-   Implementations SHOULD support in-place rekeying of SAs, since doing
-   so offers better performance and is likely to reduce the number of
-   packets lost during the transition.
-
-   To rekey a CHILD_SA within an existing IKE_SA, create a new,
-   equivalent SA (see section 2.17 below), and when the new one is
-   established, delete the old one.  To rekey an IKE_SA, establish a new
-   equivalent IKE_SA (see section 2.18 below) with the peer to whom the
-   old IKE_SA is shared using a CREATE_CHILD_SA within the existing
-   IKE_SA.  An IKE_SA so created inherits all of the original IKE_SA's
-   CHILD_SAs.  Use the new IKE_SA for all control messages needed to
-   maintain the CHILD_SAs created by the old IKE_SA, and delete the old
-   IKE_SA.  The Delete payload to delete itself MUST be the last request
-   sent over an IKE_SA.
-
-   SAs SHOULD be rekeyed proactively, i.e., the new SA should be
-   established before the old one expires and becomes unusable.  Enough
-   time should elapse between the time the new SA is established and the
-   old one becomes unusable so that traffic can be switched over to the
-   new SA.
-
-   A difference between IKEv1 and IKEv2 is that in IKEv1 SA lifetimes
-   were negotiated.  In IKEv2, each end of the SA is responsible for
-   enforcing its own lifetime policy on the SA and rekeying the SA when
-   necessary.  If the two ends have different lifetime policies, the end
-   with the shorter lifetime will end up always being the one to request
-   the rekeying.  If an SA bundle has been inactive for a long time and
-   if an endpoint would not initiate the SA in the absence of traffic,
-   the endpoint MAY choose to close the SA instead of rekeying it when
-   its lifetime expires.  It SHOULD do so if there has been no traffic
-   since the last time the SA was rekeyed.
-
-
-
-Kaufman                     Standards Track                    [Page 22]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   If the two ends have the same lifetime policies, it is possible that
-   both will initiate a rekeying at the same time (which will result in
-   redundant SAs).  To reduce the probability of this happening, the
-   timing of rekeying requests SHOULD be jittered (delayed by a random
-   amount of time after the need for rekeying is noticed).
-
-   This form of rekeying may temporarily result in multiple similar SAs
-   between the same pairs of nodes.  When there are two SAs eligible to
-   receive packets, a node MUST accept incoming packets through either
-   SA.  If redundant SAs are created though such a collision, the SA
-   created with the lowest of the four nonces used in the two exchanges
-   SHOULD be closed by the endpoint that created it.
-
-   Note that IKEv2 deliberately allows parallel SAs with the same
-   traffic selectors between common endpoints.  One of the purposes of
-   this is to support traffic quality of service (QoS) differences among
-   the SAs (see [RFC2474], [RFC2475], and section 4.1 of [RFC2983]).
-   Hence unlike IKEv1, the combination of the endpoints and the traffic
-   selectors may not uniquely identify an SA between those endpoints, so
-   the IKEv1 rekeying heuristic of deleting SAs on the basis of
-   duplicate traffic selectors SHOULD NOT be used.
-
-   The node that initiated the surviving rekeyed SA SHOULD delete the
-   replaced SA after the new one is established.
-
-   There are timing windows -- particularly in the presence of lost
-   packets -- where endpoints may not agree on the state of an SA.  The
-   responder to a CREATE_CHILD_SA MUST be prepared to accept messages on
-   an SA before sending its response to the creation request, so there
-   is no ambiguity for the initiator.  The initiator MAY begin sending
-   on an SA as soon as it processes the response.  The initiator,
-   however, cannot receive on a newly created SA until it receives and
-   processes the response to its CREATE_CHILD_SA request.  How, then, is
-   the responder to know when it is OK to send on the newly created SA?
-
-   From a technical correctness and interoperability perspective, the
-   responder MAY begin sending on an SA as soon as it sends its response
-   to the CREATE_CHILD_SA request.  In some situations, however, this
-   could result in packets unnecessarily being dropped, so an
-   implementation MAY want to defer such sending.
-
-   The responder can be assured that the initiator is prepared to
-   receive messages on an SA if either (1) it has received a
-   cryptographically valid message on the new SA, or (2) the new SA
-   rekeys an existing SA and it receives an IKE request to close the
-   replaced SA.  When rekeying an SA, the responder SHOULD continue to
-   send messages on the old SA until one of those events occurs.  When
-   establishing a new SA, the responder MAY defer sending messages on a
-
-
-
-Kaufman                     Standards Track                    [Page 23]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   new SA until either it receives one or a timeout has occurred.  If an
-   initiator receives a message on an SA for which it has not received a
-   response to its CREATE_CHILD_SA request, it SHOULD interpret that as
-   a likely packet loss and retransmit the CREATE_CHILD_SA request.  An
-   initiator MAY send a dummy message on a newly created SA if it has no
-   messages queued in order to assure the responder that the initiator
-   is ready to receive messages.
-
-2.9.  Traffic Selector Negotiation
-
-   When an IP packet is received by an RFC4301-compliant IPsec subsystem
-   and matches a "protect" selector in its Security Policy Database
-   (SPD), the subsystem MUST protect that packet with IPsec.  When no SA
-   exists yet, it is the task of IKE to create it.  Maintenance of a
-   system's SPD is outside the scope of IKE (see [PFKEY] for an example
-   protocol), though some implementations might update their SPD in
-   connection with the running of IKE (for an example scenario, see
-   section 1.1.3).
-
-   Traffic Selector (TS) payloads allow endpoints to communicate some of
-   the information from their SPD to their peers.  TS payloads specify
-   the selection criteria for packets that will be forwarded over the
-   newly set up SA.  This can serve as a consistency check in some
-   scenarios to assure that the SPDs are consistent.  In others, it
-   guides the dynamic update of the SPD.
-
-   Two TS payloads appear in each of the messages in the exchange that
-   creates a CHILD_SA pair.  Each TS payload contains one or more
-   Traffic Selectors.  Each Traffic Selector consists of an address
-   range (IPv4 or IPv6), a port range, and an IP protocol ID.  In
-   support of the scenario described in section 1.1.3, an initiator may
-   request that the responder assign an IP address and tell the
-   initiator what it is.
-
-   IKEv2 allows the responder to choose a subset of the traffic proposed
-   by the initiator.  This could happen when the configurations of the
-   two endpoints are being updated but only one end has received the new
-   information.  Since the two endpoints may be configured by different
-   people, the incompatibility may persist for an extended period even
-   in the absence of errors.  It also allows for intentionally different
-   configurations, as when one end is configured to tunnel all addresses
-   and depends on the other end to have the up-to-date list.
-
-   The first of the two TS payloads is known as TSi (Traffic Selector-
-   initiator).  The second is known as TSr (Traffic Selector-responder).
-   TSi specifies the source address of traffic forwarded from (or the
-   destination address of traffic forwarded to) the initiator of the
-   CHILD_SA pair.  TSr specifies the destination address of the traffic
-
-
-
-Kaufman                     Standards Track                    [Page 24]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   forwarded to (or the source address of the traffic forwarded from)
-   the responder of the CHILD_SA pair.  For example, if the original
-   initiator request the creation of a CHILD_SA pair, and wishes to
-   tunnel all traffic from subnet 192.0.1.* on the initiator's side to
-   subnet 192.0.2.* on the responder's side, the initiator would include
-   a single traffic selector in each TS payload.  TSi would specify the
-   address range (192.0.1.0 - 192.0.1.255) and TSr would specify the
-   address range (192.0.2.0 - 192.0.2.255).  Assuming that proposal was
-   acceptable to the responder, it would send identical TS payloads
-   back.  (Note: The IP address range 192.0.2.* has been reserved for
-   use in examples in RFCs and similar documents.  This document needed
-   two such ranges, and so also used 192.0.1.*. This should not be
-   confused with any actual address.)
-
-   The responder is allowed to narrow the choices by selecting a subset
-   of the traffic, for instance by eliminating or narrowing the range of
-   one or more members of the set of traffic selectors, provided the set
-   does not become the NULL set.
-
-   It is possible for the responder's policy to contain multiple smaller
-   ranges, all encompassed by the initiator's traffic selector, and with
-   the responder's policy being that each of those ranges should be sent
-   over a different SA.  Continuing the example above, the responder
-   might have a policy of being willing to tunnel those addresses to and
-   from the initiator, but might require that each address pair be on a
-   separately negotiated CHILD_SA.  If the initiator generated its
-   request in response to an incoming packet from 192.0.1.43 to
-   192.0.2.123, there would be no way for the responder to determine
-   which pair of addresses should be included in this tunnel, and it
-   would have to make a guess or reject the request with a status of
-   SINGLE_PAIR_REQUIRED.
-
-   To enable the responder to choose the appropriate range in this case,
-   if the initiator has requested the SA due to a data packet, the
-   initiator SHOULD include as the first traffic selector in each of TSi
-   and TSr a very specific traffic selector including the addresses in
-   the packet triggering the request.  In the example, the initiator
-   would include in TSi two traffic selectors: the first containing the
-   address range (192.0.1.43 - 192.0.1.43) and the source port and IP
-   protocol from the packet and the second containing (192.0.1.0 -
-   192.0.1.255) with all ports and IP protocols.  The initiator would
-   similarly include two traffic selectors in TSr.
-
-   If the responder's policy does not allow it to accept the entire set
-   of traffic selectors in the initiator's request, but does allow him
-   to accept the first selector of TSi and TSr, then the responder MUST
-   narrow the traffic selectors to a subset that includes the
-
-
-
-
-Kaufman                     Standards Track                    [Page 25]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   initiator's first choices.  In this example, the responder might
-   respond with TSi being (192.0.1.43 - 192.0.1.43) with all ports and
-   IP protocols.
-
-   If the initiator creates the CHILD_SA pair not in response to an
-   arriving packet, but rather, say, upon startup, then there may be no
-   specific addresses the initiator prefers for the initial tunnel over
-   any other.  In that case, the first values in TSi and TSr MAY be
-   ranges rather than specific values, and the responder chooses a
-   subset of the initiator's TSi and TSr that are acceptable.  If more
-   than one subset is acceptable but their union is not, the responder
-   MUST accept some subset and MAY include a Notify payload of type
-   ADDITIONAL_TS_POSSIBLE to indicate that the initiator might want to
-   try again.  This case will occur only when the initiator and
-   responder are configured differently from one another.  If the
-   initiator and responder agree on the granularity of tunnels, the
-   initiator will never request a tunnel wider than the responder will
-   accept.  Such misconfigurations SHOULD be recorded in error logs.
-
-2.10.  Nonces
-
-   The IKE_SA_INIT messages each contain a nonce.  These nonces are used
-   as inputs to cryptographic functions.  The CREATE_CHILD_SA request
-   and the CREATE_CHILD_SA response also contain nonces.  These nonces
-   are used to add freshness to the key derivation technique used to
-   obtain keys for CHILD_SA, and to ensure creation of strong pseudo-
-   random bits from the Diffie-Hellman key.  Nonces used in IKEv2 MUST
-   be randomly chosen, MUST be at least 128 bits in size, and MUST be at
-   least half the key size of the negotiated prf. ("prf" refers to
-   "pseudo-random function", one of the cryptographic algorithms
-   negotiated in the IKE exchange.)  If the same random number source is
-   used for both keys and nonces, care must be taken to ensure that the
-   latter use does not compromise the former.
-
-2.11.  Address and Port Agility
-
-   IKE runs over UDP ports 500 and 4500, and implicitly sets up ESP and
-   AH associations for the same IP addresses it runs over.  The IP
-   addresses and ports in the outer header are, however, not themselves
-   cryptographically protected, and IKE is designed to work even through
-   Network Address Translation (NAT) boxes.  An implementation MUST
-   accept incoming requests even if the source port is not 500 or 4500,
-   and MUST respond to the address and port from which the request was
-   received.  It MUST specify the address and port at which the request
-   was received as the source address and port in the response.  IKE
-   functions identically over IPv4 or IPv6.
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 26]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-2.12.  Reuse of Diffie-Hellman Exponentials
-
-   IKE generates keying material using an ephemeral Diffie-Hellman
-   exchange in order to gain the property of "perfect forward secrecy".
-   This means that once a connection is closed and its corresponding
-   keys are forgotten, even someone who has recorded all of the data
-   from the connection and gets access to all of the long-term keys of
-   the two endpoints cannot reconstruct the keys used to protect the
-   conversation without doing a brute force search of the session key
-   space.
-
-   Achieving perfect forward secrecy requires that when a connection is
-   closed, each endpoint MUST forget not only the keys used by the
-   connection but also any information that could be used to recompute
-   those keys.  In particular, it MUST forget the secrets used in the
-   Diffie-Hellman calculation and any state that may persist in the
-   state of a pseudo-random number generator that could be used to
-   recompute the Diffie-Hellman secrets.
-
-   Since the computing of Diffie-Hellman exponentials is computationally
-   expensive, an endpoint may find it advantageous to reuse those
-   exponentials for multiple connection setups.  There are several
-   reasonable strategies for doing this.  An endpoint could choose a new
-   exponential only periodically though this could result in less-than-
-   perfect forward secrecy if some connection lasts for less than the
-   lifetime of the exponential.  Or it could keep track of which
-   exponential was used for each connection and delete the information
-   associated with the exponential only when some corresponding
-   connection was closed.  This would allow the exponential to be reused
-   without losing perfect forward secrecy at the cost of maintaining
-   more state.
-
-   Decisions as to whether and when to reuse Diffie-Hellman exponentials
-   is a private decision in the sense that it will not affect
-   interoperability.  An implementation that reuses exponentials MAY
-   choose to remember the exponential used by the other endpoint on past
-   exchanges and if one is reused to avoid the second half of the
-   calculation.
-
-2.13.  Generating Keying Material
-
-   In the context of the IKE_SA, four cryptographic algorithms are
-   negotiated: an encryption algorithm, an integrity protection
-   algorithm, a Diffie-Hellman group, and a pseudo-random function
-   (prf).  The pseudo-random function is used for the construction of
-   keying material for all of the cryptographic algorithms used in both
-   the IKE_SA and the CHILD_SAs.
-
-
-
-
-Kaufman                     Standards Track                    [Page 27]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   We assume that each encryption algorithm and integrity protection
-   algorithm uses a fixed-size key and that any randomly chosen value of
-   that fixed size can serve as an appropriate key.  For algorithms that
-   accept a variable length key, a fixed key size MUST be specified as
-   part of the cryptographic transform negotiated.  For algorithms for
-   which not all values are valid keys (such as DES or 3DES with key
-   parity), the algorithm by which keys are derived from arbitrary
-   values MUST be specified by the cryptographic transform.  For
-   integrity protection functions based on Hashed Message Authentication
-   Code (HMAC), the fixed key size is the size of the output of the
-   underlying hash function.  When the prf function takes a variable
-   length key, variable length data, and produces a fixed-length output
-   (e.g., when using HMAC), the formulas in this document apply.  When
-   the key for the prf function has fixed length, the data provided as a
-   key is truncated or padded with zeros as necessary unless exceptional
-   processing is explained following the formula.
-
-   Keying material will always be derived as the output of the
-   negotiated prf algorithm.  Since the amount of keying material needed
-   may be greater than the size of the output of the prf algorithm, we
-   will use the prf iteratively.  We will use the terminology prf+ to
-   describe the function that outputs a pseudo-random stream based on
-   the inputs to a prf as follows: (where | indicates concatenation)
-
-   prf+ (K,S) = T1 | T2 | T3 | T4 | ...
-
-   where:
-   T1 = prf (K, S | 0x01)
-   T2 = prf (K, T1 | S | 0x02)
-   T3 = prf (K, T2 | S | 0x03)
-   T4 = prf (K, T3 | S | 0x04)
-
-   continuing as needed to compute all required keys.  The keys are
-   taken from the output string without regard to boundaries (e.g., if
-   the required keys are a 256-bit Advanced Encryption Standard (AES)
-   key and a 160-bit HMAC key, and the prf function generates 160 bits,
-   the AES key will come from T1 and the beginning of T2, while the HMAC
-   key will come from the rest of T2 and the beginning of T3).
-
-   The constant concatenated to the end of each string feeding the prf
-   is a single octet. prf+ in this document is not defined beyond 255
-   times the size of the prf output.
-
-2.14.  Generating Keying Material for the IKE_SA
-
-   The shared keys are computed as follows.  A quantity called SKEYSEED
-   is calculated from the nonces exchanged during the IKE_SA_INIT
-   exchange and the Diffie-Hellman shared secret established during that
-
-
-
-Kaufman                     Standards Track                    [Page 28]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   exchange.  SKEYSEED is used to calculate seven other secrets: SK_d
-   used for deriving new keys for the CHILD_SAs established with this
-   IKE_SA; SK_ai and SK_ar used as a key to the integrity protection
-   algorithm for authenticating the component messages of subsequent
-   exchanges; SK_ei and SK_er used for encrypting (and of course
-   decrypting) all subsequent exchanges; and SK_pi and SK_pr, which are
-   used when generating an AUTH payload.
-
-   SKEYSEED and its derivatives are computed as follows:
-
-       SKEYSEED = prf(Ni | Nr, g^ir)
-
-       {SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr } = prf+
-                 (SKEYSEED, Ni | Nr | SPIi | SPIr )
-
-   (indicating that the quantities SK_d, SK_ai, SK_ar, SK_ei, SK_er,
-   SK_pi, and SK_pr are taken in order from the generated bits of the
-   prf+).  g^ir is the shared secret from the ephemeral Diffie-Hellman
-   exchange.  g^ir is represented as a string of octets in big endian
-   order padded with zeros if necessary to make it the length of the
-   modulus.  Ni and Nr are the nonces, stripped of any headers.  If the
-   negotiated prf takes a fixed-length key and the lengths of Ni and Nr
-   do not add up to that length, half the bits must come from Ni and
-   half from Nr, taking the first bits of each.
-
-   The two directions of traffic flow use different keys.  The keys used
-   to protect messages from the original initiator are SK_ai and SK_ei.
-   The keys used to protect messages in the other direction are SK_ar
-   and SK_er.  Each algorithm takes a fixed number of bits of keying
-   material, which is specified as part of the algorithm.  For integrity
-   algorithms based on a keyed hash, the key size is always equal to the
-   length of the output of the underlying hash function.
-
-2.15.  Authentication of the IKE_SA
-
-   When not using extensible authentication (see section 2.16), the
-   peers are authenticated by having each sign (or MAC using a shared
-   secret as the key) a block of data.  For the responder, the octets to
-   be signed start with the first octet of the first SPI in the header
-   of the second message and end with the last octet of the last payload
-   in the second message.  Appended to this (for purposes of computing
-   the signature) are the initiator's nonce Ni (just the value, not the
-   payload containing it), and the value prf(SK_pr,IDr') where IDr' is
-   the responder's ID payload excluding the fixed header.  Note that
-   neither the nonce Ni nor the value prf(SK_pr,IDr') are transmitted.
-   Similarly, the initiator signs the first message, starting with the
-   first octet of the first SPI in the header and ending with the last
-   octet of the last payload.  Appended to this (for purposes of
-
-
-
-Kaufman                     Standards Track                    [Page 29]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   computing the signature) are the responder's nonce Nr, and the value
-   prf(SK_pi,IDi').  In the above calculation, IDi' and IDr' are the
-   entire ID payloads excluding the fixed header.  It is critical to the
-   security of the exchange that each side sign the other side's nonce.
-
-   Note that all of the payloads are included under the signature,
-   including any payload types not defined in this document.  If the
-   first message of the exchange is sent twice (the second time with a
-   responder cookie and/or a different Diffie-Hellman group), it is the
-   second version of the message that is signed.
-
-   Optionally, messages 3 and 4 MAY include a certificate, or
-   certificate chain providing evidence that the key used to compute a
-   digital signature belongs to the name in the ID payload.  The
-   signature or MAC will be computed using algorithms dictated by the
-   type of key used by the signer, and specified by the Auth Method
-   field in the Authentication payload.  There is no requirement that
-   the initiator and responder sign with the same cryptographic
-   algorithms.  The choice of cryptographic algorithms depends on the
-   type of key each has.  In particular, the initiator may be using a
-   shared key while the responder may have a public signature key and
-   certificate.  It will commonly be the case (but it is not required)
-   that if a shared secret is used for authentication that the same key
-   is used in both directions.  Note that it is a common but typically
-   insecure practice to have a shared key derived solely from a user-
-   chosen password without incorporating another source of randomness.
-
-   This is typically insecure because user-chosen passwords are unlikely
-   to have sufficient unpredictability to resist dictionary attacks and
-   these attacks are not prevented in this authentication method.
-   (Applications using password-based authentication for bootstrapping
-   and IKE_SA should use the authentication method in section 2.16,
-   which is designed to prevent off-line dictionary attacks.)  The pre-
-   shared key SHOULD contain as much unpredictability as the strongest
-   key being negotiated.  In the case of a pre-shared key, the AUTH
-   value is computed as:
-
-      AUTH = prf(prf(Shared Secret,"Key Pad for IKEv2"), <msg octets>)
-
-   where the string "Key Pad for IKEv2" is 17 ASCII characters without
-   null termination.  The shared secret can be variable length.  The pad
-   string is added so that if the shared secret is derived from a
-   password, the IKE implementation need not store the password in
-   cleartext, but rather can store the value prf(Shared Secret,"Key Pad
-   for IKEv2"), which could not be used as a password equivalent for
-   protocols other than IKEv2.  As noted above, deriving the shared
-   secret from a password is not secure.  This construction is used
-   because it is anticipated that people will do it anyway.  The
-
-
-
-Kaufman                     Standards Track                    [Page 30]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   management interface by which the Shared Secret is provided MUST
-   accept ASCII strings of at least 64 octets and MUST NOT add a null
-   terminator before using them as shared secrets.  It MUST also accept
-   a HEX encoding of the Shared Secret.  The management interface MAY
-   accept other encodings if the algorithm for translating the encoding
-   to a binary string is specified.  If the negotiated prf takes a
-   fixed-size key, the shared secret MUST be of that fixed size.
-
-2.16.  Extensible Authentication Protocol Methods
-
-   In addition to authentication using public key signatures and shared
-   secrets, IKE supports authentication using methods defined in RFC
-   3748 [EAP].  Typically, these methods are asymmetric (designed for a
-   user authenticating to a server), and they may not be mutual.  For
-   this reason, these protocols are typically used to authenticate the
-   initiator to the responder and MUST be used in conjunction with a
-   public key signature based authentication of the responder to the
-   initiator.  These methods are often associated with mechanisms
-   referred to as "Legacy Authentication" mechanisms.
-
-   While this memo references [EAP] with the intent that new methods can
-   be added in the future without updating this specification, some
-   simpler variations are documented here and in section 3.16.  [EAP]
-   defines an authentication protocol requiring a variable number of
-   messages.  Extensible Authentication is implemented in IKE as
-   additional IKE_AUTH exchanges that MUST be completed in order to
-   initialize the IKE_SA.
-
-   An initiator indicates a desire to use extensible authentication by
-   leaving out the AUTH payload from message 3.  By including an IDi
-   payload but not an AUTH payload, the initiator has declared an
-   identity but has not proven it.  If the responder is willing to use
-   an extensible authentication method, it will place an Extensible
-   Authentication Protocol (EAP) payload in message 4 and defer sending
-   SAr2, TSi, and TSr until initiator authentication is complete in a
-   subsequent IKE_AUTH exchange.  In the case of a minimal extensible
-   authentication, the initial SA establishment will appear as follows:
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 31]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-       Initiator                          Responder
-      -----------                        -----------
-       HDR, SAi1, KEi, Ni         -->
-
-                                  <--    HDR, SAr1, KEr, Nr, [CERTREQ]
-
-       HDR, SK {IDi, [CERTREQ,] [IDr,]
-                SAi2, TSi, TSr}   -->
-
-                                  <--    HDR, SK {IDr, [CERT,] AUTH,
-                                                EAP }
-
-       HDR, SK {EAP}              -->
-
-                                  <--    HDR, SK {EAP (success)}
-
-       HDR, SK {AUTH}             -->
-
-                                  <--    HDR, SK {AUTH, SAr2, TSi, TSr }
-
-   For EAP methods that create a shared key as a side effect of
-   authentication, that shared key MUST be used by both the initiator
-   and responder to generate AUTH payloads in messages 7 and 8 using the
-   syntax for shared secrets specified in section 2.15.  The shared key
-   from EAP is the field from the EAP specification named MSK.  The
-   shared key generated during an IKE exchange MUST NOT be used for any
-   other purpose.
-
-   EAP methods that do not establish a shared key SHOULD NOT be used, as
-   they are subject to a number of man-in-the-middle attacks [EAPMITM]
-   if these EAP methods are used in other protocols that do not use a
-   server-authenticated tunnel.  Please see the Security Considerations
-   section for more details.  If EAP methods that do not generate a
-   shared key are used, the AUTH payloads in messages 7 and 8 MUST be
-   generated using SK_pi and SK_pr, respectively.
-
-   The initiator of an IKE_SA using EAP SHOULD be capable of extending
-   the initial protocol exchange to at least ten IKE_AUTH exchanges in
-   the event the responder sends notification messages and/or retries
-   the authentication prompt.  Once the protocol exchange defined by the
-   chosen EAP authentication method has successfully terminated, the
-   responder MUST send an EAP payload containing the Success message.
-   Similarly, if the authentication method has failed, the responder
-   MUST send an EAP payload containing the Failure message.  The
-   responder MAY at any time terminate the IKE exchange by sending an
-   EAP payload containing the Failure message.
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 32]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   Following such an extended exchange, the EAP AUTH payloads MUST be
-   included in the two messages following the one containing the EAP
-   Success message.
-
-2.17.  Generating Keying Material for CHILD_SAs
-
-   A single CHILD_SA is created by the IKE_AUTH exchange, and additional
-   CHILD_SAs can optionally be created in CREATE_CHILD_SA exchanges.
-   Keying material for them is generated as follows:
-
-      KEYMAT = prf+(SK_d, Ni | Nr)
-
-   Where Ni and Nr are the nonces from the IKE_SA_INIT exchange if this
-   request is the first CHILD_SA created or the fresh Ni and Nr from the
-   CREATE_CHILD_SA exchange if this is a subsequent creation.
-
-   For CREATE_CHILD_SA exchanges including an optional Diffie-Hellman
-   exchange, the keying material is defined as:
-
-      KEYMAT = prf+(SK_d, g^ir (new) | Ni | Nr )
-
-   where g^ir (new) is the shared secret from the ephemeral Diffie-
-   Hellman exchange of this CREATE_CHILD_SA exchange (represented as an
-   octet string in big endian order padded with zeros in the high-order
-   bits if necessary to make it the length of the modulus).
-
-   A single CHILD_SA negotiation may result in multiple security
-   associations.  ESP and AH SAs exist in pairs (one in each direction),
-   and four SAs could be created in a single CHILD_SA negotiation if a
-   combination of ESP and AH is being negotiated.
-
-   Keying material MUST be taken from the expanded KEYMAT in the
-   following order:
-
-      All keys for SAs carrying data from the initiator to the responder
-      are taken before SAs going in the reverse direction.
-
-      If multiple IPsec protocols are negotiated, keying material is
-      taken in the order in which the protocol headers will appear in
-      the encapsulated packet.
-
-      If a single protocol has both encryption and authentication keys,
-      the encryption key is taken from the first octets of KEYMAT and
-      the authentication key is taken from the next octets.
-
-   Each cryptographic algorithm takes a fixed number of bits of keying
-   material specified as part of the algorithm.
-
-
-
-
-Kaufman                     Standards Track                    [Page 33]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-2.18.  Rekeying IKE_SAs Using a CREATE_CHILD_SA exchange
-
-   The CREATE_CHILD_SA exchange can be used to rekey an existing IKE_SA
-   (see section 2.8).  New initiator and responder SPIs are supplied in
-   the SPI fields.  The TS payloads are omitted when rekeying an IKE_SA.
-   SKEYSEED for the new IKE_SA is computed using SK_d from the existing
-   IKE_SA as follows:
-
-       SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)
-
-   where g^ir (new) is the shared secret from the ephemeral Diffie-
-   Hellman exchange of this CREATE_CHILD_SA exchange (represented as an
-   octet string in big endian order padded with zeros if necessary to
-   make it the length of the modulus) and Ni and Nr are the two nonces
-   stripped of any headers.
-
-   The new IKE_SA MUST reset its message counters to 0.
-
-   SK_d, SK_ai, SK_ar, SK_ei, and SK_er are computed from SKEYSEED as
-   specified in section 2.14.
-
-2.19.  Requesting an Internal Address on a Remote Network
-
-   Most commonly occurring in the endpoint-to-security-gateway scenario,
-   an endpoint may need an IP address in the network protected by the
-   security gateway and may need to have that address dynamically
-   assigned.  A request for such a temporary address can be included in
-   any request to create a CHILD_SA (including the implicit request in
-   message 3) by including a CP payload.
-
-   This function provides address allocation to an IPsec Remote Access
-   Client (IRAC) trying to tunnel into a network protected by an IPsec
-   Remote Access Server (IRAS).  Since the IKE_AUTH exchange creates an
-   IKE_SA and a CHILD_SA, the IRAC MUST request the IRAS-controlled
-   address (and optionally other information concerning the protected
-   network) in the IKE_AUTH exchange.  The IRAS may procure an address
-   for the IRAC from any number of sources such as a DHCP/BOOTP server
-   or its own address pool.
-
-       Initiator                           Responder
-      -----------------------------       ---------------------------
-       HDR, SK {IDi, [CERT,] [CERTREQ,]
-        [IDr,] AUTH, CP(CFG_REQUEST),
-        SAi2, TSi, TSr}              -->
-
-                                     <--   HDR, SK {IDr, [CERT,] AUTH,
-                                            CP(CFG_REPLY), SAr2,
-                                            TSi, TSr}
-
-
-
-Kaufman                     Standards Track                    [Page 34]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   In all cases, the CP payload MUST be inserted before the SA payload.
-   In variations of the protocol where there are multiple IKE_AUTH
-   exchanges, the CP payloads MUST be inserted in the messages
-   containing the SA payloads.
-
-   CP(CFG_REQUEST) MUST contain at least an INTERNAL_ADDRESS attribute
-   (either IPv4 or IPv6) but MAY contain any number of additional
-   attributes the initiator wants returned in the response.
-
-   For example, message from initiator to responder:
-      CP(CFG_REQUEST)=
-        INTERNAL_ADDRESS(0.0.0.0)
-        INTERNAL_NETMASK(0.0.0.0)
-        INTERNAL_DNS(0.0.0.0)
-      TSi = (0, 0-65535,0.0.0.0-255.255.255.255)
-      TSr = (0, 0-65535,0.0.0.0-255.255.255.255)
-
-   NOTE: Traffic Selectors contain (protocol, port range, address
-   range).
-
-   Message from responder to initiator:
-
-      CP(CFG_REPLY)=
-        INTERNAL_ADDRESS(192.0.2.202)
-        INTERNAL_NETMASK(255.255.255.0)
-        INTERNAL_SUBNET(192.0.2.0/255.255.255.0)
-      TSi = (0, 0-65535,192.0.2.202-192.0.2.202)
-      TSr = (0, 0-65535,192.0.2.0-192.0.2.255)
-
-   All returned values will be implementation dependent.  As can be seen
-   in the above example, the IRAS MAY also send other attributes that
-   were not included in CP(CFG_REQUEST) and MAY ignore the non-mandatory
-   attributes that it does not support.
-
-   The responder MUST NOT send a CFG_REPLY without having first received
-   a CP(CFG_REQUEST) from the initiator, because we do not want the IRAS
-   to perform an unnecessary configuration lookup if the IRAC cannot
-   process the REPLY.  In the case where the IRAS's configuration
-   requires that CP be used for a given identity IDi, but IRAC has
-   failed to send a CP(CFG_REQUEST), IRAS MUST fail the request, and
-   terminate the IKE exchange with a FAILED_CP_REQUIRED error.
-
-2.20.  Requesting the Peer's Version
-
-   An IKE peer wishing to inquire about the other peer's IKE software
-   version information MAY use the method below.  This is an example of
-   a configuration request within an INFORMATIONAL exchange, after the
-   IKE_SA and first CHILD_SA have been created.
-
-
-
-Kaufman                     Standards Track                    [Page 35]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   An IKE implementation MAY decline to give out version information
-   prior to authentication or even after authentication to prevent
-   trolling in case some implementation is known to have some security
-   weakness.  In that case, it MUST either return an empty string or no
-   CP payload if CP is not supported.
-
-       Initiator                           Responder
-      -----------------------------       --------------------------
-      HDR, SK{CP(CFG_REQUEST)}      -->
-                                    <--    HDR, SK{CP(CFG_REPLY)}
-
-      CP(CFG_REQUEST)=
-        APPLICATION_VERSION("")
-
-      CP(CFG_REPLY) APPLICATION_VERSION("foobar v1.3beta, (c) Foo Bar
-        Inc.")
-
-2.21.  Error Handling
-
-   There are many kinds of errors that can occur during IKE processing.
-   If a request is received that is badly formatted or unacceptable for
-   reasons of policy (e.g., no matching cryptographic algorithms), the
-   response MUST contain a Notify payload indicating the error.  If an
-   error occurs outside the context of an IKE request (e.g., the node is
-   getting ESP messages on a nonexistent SPI), the node SHOULD initiate
-   an INFORMATIONAL exchange with a Notify payload describing the
-   problem.
-
-   Errors that occur before a cryptographically protected IKE_SA is
-   established must be handled very carefully.  There is a trade-off
-   between wanting to be helpful in diagnosing a problem and responding
-   to it and wanting to avoid being a dupe in a denial of service attack
-   based on forged messages.
-
-   If a node receives a message on UDP port 500 or 4500 outside the
-   context of an IKE_SA known to it (and not a request to start one), it
-   may be the result of a recent crash of the node.  If the message is
-   marked as a response, the node MAY audit the suspicious event but
-   MUST NOT respond.  If the message is marked as a request, the node
-   MAY audit the suspicious event and MAY send a response.  If a
-   response is sent, the response MUST be sent to the IP address and
-   port from whence it came with the same IKE SPIs and the Message ID
-   copied.  The response MUST NOT be cryptographically protected and
-   MUST contain a Notify payload indicating INVALID_IKE_SPI.
-
-   A node receiving such an unprotected Notify payload MUST NOT respond
-   and MUST NOT change the state of any existing SAs.  The message might
-   be a forgery or might be a response the genuine correspondent was
-
-
-
-Kaufman                     Standards Track                    [Page 36]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   tricked into sending.  A node SHOULD treat such a message (and also a
-   network message like ICMP destination unreachable) as a hint that
-   there might be problems with SAs to that IP address and SHOULD
-   initiate a liveness test for any such IKE_SA.  An implementation
-   SHOULD limit the frequency of such tests to avoid being tricked into
-   participating in a denial of service attack.
-
-   A node receiving a suspicious message from an IP address with which
-   it has an IKE_SA MAY send an IKE Notify payload in an IKE
-   INFORMATIONAL exchange over that SA.  The recipient MUST NOT change
-   the state of any SA's as a result but SHOULD audit the event to aid
-   in diagnosing malfunctions.  A node MUST limit the rate at which it
-   will send messages in response to unprotected messages.
-
-2.22.  IPComp
-
-   Use of IP compression [IPCOMP] can be negotiated as part of the setup
-   of a CHILD_SA.  While IP compression involves an extra header in each
-   packet and a compression parameter index (CPI), the virtual
-   "compression association" has no life outside the ESP or AH SA that
-   contains it.  Compression associations disappear when the
-   corresponding ESP or AH SA goes away.  It is not explicitly mentioned
-   in any DELETE payload.
-
-   Negotiation of IP compression is separate from the negotiation of
-   cryptographic parameters associated with a CHILD_SA.  A node
-   requesting a CHILD_SA MAY advertise its support for one or more
-   compression algorithms through one or more Notify payloads of type
-   IPCOMP_SUPPORTED.  The response MAY indicate acceptance of a single
-   compression algorithm with a Notify payload of type IPCOMP_SUPPORTED.
-   These payloads MUST NOT occur in messages that do not contain SA
-   payloads.
-
-   Although there has been discussion of allowing multiple compression
-   algorithms to be accepted and to have different compression
-   algorithms available for the two directions of a CHILD_SA,
-   implementations of this specification MUST NOT accept an IPComp
-   algorithm that was not proposed, MUST NOT accept more than one, and
-   MUST NOT compress using an algorithm other than one proposed and
-   accepted in the setup of the CHILD_SA.
-
-   A side effect of separating the negotiation of IPComp from
-   cryptographic parameters is that it is not possible to propose
-   multiple cryptographic suites and propose IP compression with some of
-   them but not others.
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 37]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-2.23.  NAT Traversal
-
-   Network Address Translation (NAT) gateways are a controversial
-   subject.  This section briefly describes what they are and how they
-   are likely to act on IKE traffic.  Many people believe that NATs are
-   evil and that we should not design our protocols so as to make them
-   work better.  IKEv2 does specify some unintuitive processing rules in
-   order that NATs are more likely to work.
-
-   NATs exist primarily because of the shortage of IPv4 addresses,
-   though there are other rationales.  IP nodes that are "behind" a NAT
-   have IP addresses that are not globally unique, but rather are
-   assigned from some space that is unique within the network behind the
-   NAT but that are likely to be reused by nodes behind other NATs.
-   Generally, nodes behind NATs can communicate with other nodes behind
-   the same NAT and with nodes with globally unique addresses, but not
-   with nodes behind other NATs.  There are exceptions to that rule.
-   When those nodes make connections to nodes on the real Internet, the
-   NAT gateway "translates" the IP source address to an address that
-   will be routed back to the gateway.  Messages to the gateway from the
-   Internet have their destination addresses "translated" to the
-   internal address that will route the packet to the correct endnode.
-
-   NATs are designed to be "transparent" to endnodes.  Neither software
-   on the node behind the NAT nor the node on the Internet requires
-   modification to communicate through the NAT.  Achieving this
-   transparency is more difficult with some protocols than with others.
-   Protocols that include IP addresses of the endpoints within the
-   payloads of the packet will fail unless the NAT gateway understands
-   the protocol and modifies the internal references as well as those in
-   the headers.  Such knowledge is inherently unreliable, is a network
-   layer violation, and often results in subtle problems.
-
-   Opening an IPsec connection through a NAT introduces special
-   problems.  If the connection runs in transport mode, changing the IP
-   addresses on packets will cause the checksums to fail and the NAT
-   cannot correct the checksums because they are cryptographically
-   protected.  Even in tunnel mode, there are routing problems because
-   transparently translating the addresses of AH and ESP packets
-   requires special logic in the NAT and that logic is heuristic and
-   unreliable in nature.  For that reason, IKEv2 can negotiate UDP
-   encapsulation of IKE and ESP packets.  This encoding is slightly less
-   efficient but is easier for NATs to process.  In addition, firewalls
-   may be configured to pass IPsec traffic over UDP but not ESP/AH or
-   vice versa.
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 38]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   It is a common practice of NATs to translate TCP and UDP port numbers
-   as well as addresses and use the port numbers of inbound packets to
-   decide which internal node should get a given packet.  For this
-   reason, even though IKE packets MUST be sent from and to UDP port
-   500, they MUST be accepted coming from any port and responses MUST be
-   sent to the port from whence they came.  This is because the ports
-   may be modified as the packets pass through NATs.  Similarly, IP
-   addresses of the IKE endpoints are generally not included in the IKE
-   payloads because the payloads are cryptographically protected and
-   could not be transparently modified by NATs.
-
-   Port 4500 is reserved for UDP-encapsulated ESP and IKE.  When working
-   through a NAT, it is generally better to pass IKE packets over port
-   4500 because some older NATs handle IKE traffic on port 500 cleverly
-   in an attempt to transparently establish IPsec connections between
-   endpoints that don't handle NAT traversal themselves.  Such NATs may
-   interfere with the straightforward NAT traversal envisioned by this
-   document, so an IPsec endpoint that discovers a NAT between it and
-   its correspondent MUST send all subsequent traffic to and from port
-   4500, which NATs should not treat specially (as they might with port
-   500).
-
-   The specific requirements for supporting NAT traversal [RFC3715] are
-   listed below.  Support for NAT traversal is optional.  In this
-   section only, requirements listed as MUST apply only to
-   implementations supporting NAT traversal.
-
-      IKE MUST listen on port 4500 as well as port 500.  IKE MUST
-      respond to the IP address and port from which packets arrived.
-
-      Both IKE initiator and responder MUST include in their IKE_SA_INIT
-      packets Notify payloads of type NAT_DETECTION_SOURCE_IP and
-      NAT_DETECTION_DESTINATION_IP.  Those payloads can be used to
-      detect if there is NAT between the hosts, and which end is behind
-      the NAT.  The location of the payloads in the IKE_SA_INIT packets
-      are just after the Ni and Nr payloads (before the optional CERTREQ
-      payload).
-
-      If none of the NAT_DETECTION_SOURCE_IP payload(s) received matches
-      the hash of the source IP and port found from the IP header of the
-      packet containing the payload, it means that the other end is
-      behind NAT (i.e., someone along the route changed the source
-      address of the original packet to match the address of the NAT
-      box).  In this case, this end should allow dynamic update of the
-      other ends IP address, as described later.
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 39]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-      If the NAT_DETECTION_DESTINATION_IP payload received does not
-      match the hash of the destination IP and port found from the IP
-      header of the packet containing the payload, it means that this
-      end is behind a NAT.  In this case, this end SHOULD start sending
-      keepalive packets as explained in [Hutt05].
-
-      The IKE initiator MUST check these payloads if present and if they
-      do not match the addresses in the outer packet MUST tunnel all
-      future IKE and ESP packets associated with this IKE_SA over UDP
-      port 4500.
-
-      To tunnel IKE packets over UDP port 4500, the IKE header has four
-      octets of zero prepended and the result immediately follows the
-      UDP header.  To tunnel ESP packets over UDP port 4500, the ESP
-      header immediately follows the UDP header.  Since the first four
-      bytes of the ESP header contain the SPI, and the SPI cannot
-      validly be zero, it is always possible to distinguish ESP and IKE
-      messages.
-
-      The original source and destination IP address required for the
-      transport mode TCP and UDP packet checksum fixup (see [Hutt05])
-      are obtained from the Traffic Selectors associated with the
-      exchange.  In the case of NAT traversal, the Traffic Selectors
-      MUST contain exactly one IP address, which is then used as the
-      original IP address.
-
-      There are cases where a NAT box decides to remove mappings that
-      are still alive (for example, the keepalive interval is too long,
-      or the NAT box is rebooted).  To recover in these cases, hosts
-      that are not behind a NAT SHOULD send all packets (including
-      retransmission packets) to the IP address and port from the last
-      valid authenticated packet from the other end (i.e., dynamically
-      update the address).  A host behind a NAT SHOULD NOT do this
-      because it opens a DoS attack possibility.  Any authenticated IKE
-      packet or any authenticated UDP-encapsulated ESP packet can be
-      used to detect that the IP address or the port has changed.
-
-      Note that similar but probably not identical actions will likely
-      be needed to make IKE work with Mobile IP, but such processing is
-      not addressed by this document.
-
-2.24.  Explicit Congestion Notification (ECN)
-
-   When IPsec tunnels behave as originally specified in [RFC2401], ECN
-   usage is not appropriate for the outer IP headers because tunnel
-   decapsulation processing discards ECN congestion indications to the
-   detriment of the network.  ECN support for IPsec tunnels for IKEv1-
-   based IPsec requires multiple operating modes and negotiation (see
-
-
-
-Kaufman                     Standards Track                    [Page 40]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   [RFC3168]).  IKEv2 simplifies this situation by requiring that ECN be
-   usable in the outer IP headers of all tunnel-mode IPsec SAs created
-   by IKEv2.  Specifically, tunnel encapsulators and decapsulators for
-   all tunnel-mode SAs created by IKEv2 MUST support the ECN full-
-   functionality option for tunnels specified in [RFC3168] and MUST
-   implement the tunnel encapsulation and decapsulation processing
-   specified in [RFC4301] to prevent discarding of ECN congestion
-   indications.
-
-3.  Header and Payload Formats
-
-3.1.  The IKE Header
-
-   IKE messages use UDP ports 500 and/or 4500, with one IKE message per
-   UDP datagram.  Information from the beginning of the packet through
-   the UDP header is largely ignored except that the IP addresses and
-   UDP ports from the headers are reversed and used for return packets.
-   When sent on UDP port 500, IKE messages begin immediately following
-   the UDP header.  When sent on UDP port 4500, IKE messages have
-   prepended four octets of zero.  These four octets of zero are not
-   part of the IKE message and are not included in any of the length
-   fields or checksums defined by IKE.  Each IKE message begins with the
-   IKE header, denoted HDR in this memo.  Following the header are one
-   or more IKE payloads each identified by a "Next Payload" field in the
-   preceding payload.  Payloads are processed in the order in which they
-   appear in an IKE message by invoking the appropriate processing
-   routine according to the "Next Payload" field in the IKE header and
-   subsequently according to the "Next Payload" field in the IKE payload
-   itself until a "Next Payload" field of zero indicates that no
-   payloads follow.  If a payload of type "Encrypted" is found, that
-   payload is decrypted and its contents parsed as additional payloads.
-   An Encrypted payload MUST be the last payload in a packet and an
-   Encrypted payload MUST NOT contain another Encrypted payload.
-
-   The Recipient SPI in the header identifies an instance of an IKE
-   security association.  It is therefore possible for a single instance
-   of IKE to multiplex distinct sessions with multiple peers.
-
-   All multi-octet fields representing integers are laid out in big
-   endian order (aka most significant byte first, or network byte
-   order).
-
-   The format of the IKE header is shown in Figure 4.
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 41]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                       IKE_SA Initiator's SPI                  !
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                       IKE_SA Responder's SPI                  !
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !  Next Payload ! MjVer ! MnVer ! Exchange Type !     Flags     !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                          Message ID                           !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                            Length                             !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                       Figure 4:  IKE Header Format
-
-      o  Initiator's SPI (8 octets) - A value chosen by the
-         initiator to identify a unique IKE security association.  This
-         value MUST NOT be zero.
-
-      o  Responder's SPI (8 octets) - A value chosen by the
-         responder to identify a unique IKE security association.  This
-         value MUST be zero in the first message of an IKE Initial
-         Exchange (including repeats of that message including a
-         cookie) and MUST NOT be zero in any other message.
-
-      o  Next Payload (1 octet) - Indicates the type of payload that
-         immediately follows the header.  The format and value of each
-         payload are defined below.
-
-      o  Major Version (4 bits) - Indicates the major version of the IKE
-         protocol in use.  Implementations based on this version of IKE
-         MUST set the Major Version to 2.  Implementations based on
-         previous versions of IKE and ISAKMP MUST set the Major Version
-         to 1.  Implementations based on this version of IKE MUST reject
-         or ignore messages containing a version number greater than
-         2.
-
-      o  Minor Version (4 bits) - Indicates the minor version of the
-         IKE protocol in use.  Implementations based on this version of
-         IKE MUST set the Minor Version to 0.  They MUST ignore the
-         minor version number of received messages.
-
-      o  Exchange Type (1 octet) - Indicates the type of exchange being
-         used.  This constrains the payloads sent in each message and
-         orderings of messages in an exchange.
-
-
-
-Kaufman                     Standards Track                    [Page 42]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-                       Exchange Type            Value
-
-                       RESERVED                 0-33
-                       IKE_SA_INIT              34
-                       IKE_AUTH                 35
-                       CREATE_CHILD_SA          36
-                       INFORMATIONAL            37
-                       RESERVED TO IANA         38-239
-                       Reserved for private use 240-255
-
-      o  Flags (1 octet) - Indicates specific options that are set
-         for the message.  Presence of options are indicated by the
-         appropriate bit in the flags field being set.  The bits are
-         defined LSB first, so bit 0 would be the least significant
-         bit of the Flags octet.  In the description below, a bit
-         being 'set' means its value is '1', while 'cleared' means
-         its value is '0'.
-
-       --  X(reserved) (bits 0-2) - These bits MUST be cleared
-           when sending and MUST be ignored on receipt.
-
-       --  I(nitiator) (bit 3 of Flags) - This bit MUST be set in
-           messages sent by the original initiator of the IKE_SA
-           and MUST be cleared in messages sent by the original
-           responder.  It is used by the recipient to determine
-           which eight octets of the SPI were generated by the
-           recipient.
-
-       --  V(ersion) (bit 4 of Flags) - This bit indicates that
-           the transmitter is capable of speaking a higher major
-           version number of the protocol than the one indicated
-           in the major version number field.  Implementations of
-           IKEv2 must clear this bit when sending and MUST ignore
-           it in incoming messages.
-
-       --  R(esponse) (bit 5 of Flags) - This bit indicates that
-           this message is a response to a message containing
-           the same message ID.  This bit MUST be cleared in all
-           request messages and MUST be set in all responses.
-           An IKE endpoint MUST NOT generate a response to a
-           message that is marked as being a response.
-
-       --  X(reserved) (bits 6-7 of Flags) - These bits MUST be
-           cleared when sending and MUST be ignored on receipt.
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 43]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-      o  Message ID (4 octets) - Message identifier used to control
-      retransmission of lost packets and matching of requests and
-      responses.  It is essential to the security of the protocol
-      because it is used to prevent message replay attacks.
-      See sections 2.1 and 2.2.
-
-      o  Length (4 octets) - Length of total message (header + payloads)
-      in octets.
-
-3.2.  Generic Payload Header
-
-   Each IKE payload defined in sections 3.3 through 3.16 begins with a
-   generic payload header, shown in Figure 5.  Figures for each payload
-   below will include the generic payload header, but for brevity the
-   description of each field will be omitted.
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                         Figure 5:  Generic Payload Header
-
-   The Generic Payload Header fields are defined as follows:
-
-   o  Next Payload (1 octet) - Identifier for the payload type of the
-      next payload in the message.  If the current payload is the last
-      in the message, then this field will be 0.  This field provides a
-      "chaining" capability whereby additional payloads can be added to
-      a message by appending it to the end of the message and setting
-      the "Next Payload" field of the preceding payload to indicate the
-      new payload's type.  An Encrypted payload, which must always be
-      the last payload of a message, is an exception.  It contains data
-      structures in the format of additional payloads.  In the header of
-      an Encrypted payload, the Next Payload field is set to the payload
-      type of the first contained payload (instead of 0).
-
-      Payload Type Values
-
-          Next Payload Type               Notation  Value
-
-          No Next Payload                              0
-
-          RESERVED                                   1-32
-          Security Association             SA         33
-          Key Exchange                     KE         34
-          Identification - Initiator       IDi        35
-
-
-
-Kaufman                     Standards Track                    [Page 44]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-          Identification - Responder       IDr        36
-          Certificate                      CERT       37
-          Certificate Request              CERTREQ    38
-          Authentication                   AUTH       39
-          Nonce                            Ni, Nr     40
-          Notify                           N          41
-          Delete                           D          42
-          Vendor ID                        V          43
-          Traffic Selector - Initiator     TSi        44
-          Traffic Selector - Responder     TSr        45
-          Encrypted                        E          46
-          Configuration                    CP         47
-          Extensible Authentication        EAP        48
-          RESERVED TO IANA                          49-127
-          PRIVATE USE                              128-255
-
-      Payload type values 1-32 should not be used so that there is no
-      overlap with the code assignments for IKEv1.  Payload type values
-      49-127 are reserved to IANA for future assignment in IKEv2 (see
-      section 6).  Payload type values 128-255 are for private use among
-      mutually consenting parties.
-
-   o  Critical (1 bit) - MUST be set to zero if the sender wants the
-      recipient to skip this payload if it does not understand the
-      payload type code in the Next Payload field of the previous
-      payload.  MUST be set to one if the sender wants the recipient to
-      reject this entire message if it does not understand the payload
-      type.  MUST be ignored by the recipient if the recipient
-      understands the payload type code.  MUST be set to zero for
-      payload types defined in this document.  Note that the critical
-      bit applies to the current payload rather than the "next" payload
-      whose type code appears in the first octet.  The reasoning behind
-      not setting the critical bit for payloads defined in this document
-      is that all implementations MUST understand all payload types
-      defined in this document and therefore must ignore the Critical
-      bit's value.  Skipped payloads are expected to have valid Next
-      Payload and Payload Length fields.
-
-   o  RESERVED (7 bits) - MUST be sent as zero; MUST be ignored on
-      receipt.
-
-   o  Payload Length (2 octets) - Length in octets of the current
-      payload, including the generic payload header.
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 45]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-3.3.  Security Association Payload
-
-   The Security Association Payload, denoted SA in this memo, is used to
-   negotiate attributes of a security association.  Assembly of Security
-   Association Payloads requires great peace of mind.  An SA payload MAY
-   contain multiple proposals.  If there is more than one, they MUST be
-   ordered from most preferred to least preferred.  Each proposal may
-   contain multiple IPsec protocols (where a protocol is IKE, ESP, or
-   AH), each protocol MAY contain multiple transforms, and each
-   transform MAY contain multiple attributes.  When parsing an SA, an
-   implementation MUST check that the total Payload Length is consistent
-   with the payload's internal lengths and counts.  Proposals,
-   Transforms, and Attributes each have their own variable length
-   encodings.  They are nested such that the Payload Length of an SA
-   includes the combined contents of the SA, Proposal, Transform, and
-   Attribute information.  The length of a Proposal includes the lengths
-   of all Transforms and Attributes it contains.  The length of a
-   Transform includes the lengths of all Attributes it contains.
-
-   The syntax of Security Associations, Proposals, Transforms, and
-   Attributes is based on ISAKMP; however, the semantics are somewhat
-   different.  The reason for the complexity and the hierarchy is to
-   allow for multiple possible combinations of algorithms to be encoded
-   in a single SA.  Sometimes there is a choice of multiple algorithms,
-   whereas other times there is a combination of algorithms.  For
-   example, an initiator might want to propose using (AH w/MD5 and ESP
-   w/3DES) OR (ESP w/MD5 and 3DES).
-
-   One of the reasons the semantics of the SA payload has changed from
-   ISAKMP and IKEv1 is to make the encodings more compact in common
-   cases.
-
-   The Proposal structure contains within it a Proposal # and an IPsec
-   protocol ID.  Each structure MUST have the same Proposal # as the
-   previous one or be one (1) greater.  The first Proposal MUST have a
-   Proposal # of one (1).  If two successive structures have the same
-   Proposal number, it means that the proposal consists of the first
-   structure AND the second.  So a proposal of AH AND ESP would have two
-   proposal structures, one for AH and one for ESP and both would have
-   Proposal #1.  A proposal of AH OR ESP would have two proposal
-   structures, one for AH with Proposal #1 and one for ESP with Proposal
-   #2.
-
-   Each Proposal/Protocol structure is followed by one or more transform
-   structures.  The number of different transforms is generally
-   determined by the Protocol.  AH generally has a single transform: an
-   integrity check algorithm.  ESP generally has two: an encryption
-   algorithm and an integrity check algorithm.  IKE generally has four
-
-
-
-Kaufman                     Standards Track                    [Page 46]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   transforms: a Diffie-Hellman group, an integrity check algorithm, a
-   prf algorithm, and an encryption algorithm.  If an algorithm that
-   combines encryption and integrity protection is proposed, it MUST be
-   proposed as an encryption algorithm and an integrity protection
-   algorithm MUST NOT be proposed.  For each Protocol, the set of
-   permissible transforms is assigned transform ID numbers, which appear
-   in the header of each transform.
-
-   If there are multiple transforms with the same Transform Type, the
-   proposal is an OR of those transforms.  If there are multiple
-   Transforms with different Transform Types, the proposal is an AND of
-   the different groups.  For example, to propose ESP with (3DES or
-   IDEA) and (HMAC_MD5 or HMAC_SHA), the ESP proposal would contain two
-   Transform Type 1 candidates (one for 3DES and one for IDEA) and two
-   Transform Type 2 candidates (one for HMAC_MD5 and one for HMAC_SHA).
-   This effectively proposes four combinations of algorithms.  If the
-   initiator wanted to propose only a subset of those, for example (3DES
-   and HMAC_MD5) or (IDEA and HMAC_SHA), there is no way to encode that
-   as multiple transforms within a single Proposal.  Instead, the
-   initiator would have to construct two different Proposals, each with
-   two transforms.
-
-   A given transform MAY have one or more Attributes.  Attributes are
-   necessary when the transform can be used in more than one way, as
-   when an encryption algorithm has a variable key size.  The transform
-   would specify the algorithm and the attribute would specify the key
-   size.  Most transforms do not have attributes.  A transform MUST NOT
-   have multiple attributes of the same type.  To propose alternate
-   values for an attribute (for example, multiple key sizes for the AES
-   encryption algorithm), and implementation MUST include multiple
-   Transforms with the same Transform Type each with a single Attribute.
-
-   Note that the semantics of Transforms and Attributes are quite
-   different from those in IKEv1.  In IKEv1, a single Transform carried
-   multiple algorithms for a protocol with one carried in the Transform
-   and the others carried in the Attributes.
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                          <Proposals>                          ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 6:  Security Association Payload
-
-
-
-Kaufman                     Standards Track                    [Page 47]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-      o  Proposals (variable) - One or more proposal substructures.
-
-      The payload type for the Security Association Payload is thirty
-      three (33).
-
-3.3.1.  Proposal Substructure
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! 0 (last) or 2 !   RESERVED    !         Proposal Length       !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Proposal #    !  Protocol ID  !    SPI Size   !# of Transforms!
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~                        SPI (variable)                         ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                        <Transforms>                           ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 7:  Proposal Substructure
-
-      o  0 (last) or 2 (more) (1 octet) - Specifies whether this is the
-         last Proposal Substructure in the SA.  This syntax is inherited
-         from ISAKMP, but is unnecessary because the last Proposal could
-         be identified from the length of the SA.  The value (2)
-         corresponds to a Payload Type of Proposal in IKEv1, and the
-         first 4 octets of the Proposal structure are designed to look
-         somewhat like the header of a Payload.
-
-      o  RESERVED (1 octet) - MUST be sent as zero; MUST be ignored on
-         receipt.
-
-      o  Proposal Length (2 octets) - Length of this proposal, including
-         all transforms and attributes that follow.
-
-      o  Proposal # (1 octet) - When a proposal is made, the first
-         proposal in an SA payload MUST be #1, and subsequent proposals
-         MUST either be the same as the previous proposal (indicating an
-         AND of the two proposals) or one more than the previous
-         proposal (indicating an OR of the two proposals).  When a
-         proposal is accepted, all of the proposal numbers in the SA
-         payload MUST be the same and MUST match the number on the
-         proposal sent that was accepted.
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 48]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-      o  Protocol ID (1 octet) - Specifies the IPsec protocol identifier
-         for the current negotiation.  The defined values are:
-
-          Protocol               Protocol ID
-          RESERVED                0
-          IKE                     1
-          AH                      2
-          ESP                     3
-          RESERVED TO IANA        4-200
-          PRIVATE USE             201-255
-
-      o  SPI Size (1 octet) - For an initial IKE_SA negotiation, this
-         field MUST be zero; the SPI is obtained from the outer header.
-         During subsequent negotiations, it is equal to the size, in
-         octets, of the SPI of the corresponding protocol (8 for IKE, 4
-         for ESP and AH).
-
-      o  # of Transforms (1 octet) - Specifies the number of transforms
-         in this proposal.
-
-      o  SPI (variable) - The sending entity's SPI. Even if the SPI Size
-         is not a multiple of 4 octets, there is no padding applied to
-         the payload.  When the SPI Size field is zero, this field is
-         not present in the Security Association payload.
-
-      o  Transforms (variable) - One or more transform substructures.
-
-3.3.2.  Transform Substructure
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! 0 (last) or 3 !   RESERVED    !        Transform Length       !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !Transform Type !   RESERVED    !          Transform ID         !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                      Transform Attributes                     ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 8:  Transform Substructure
-
-      o  0 (last) or 3 (more) (1 octet) - Specifies whether this is the
-         last Transform Substructure in the Proposal.  This syntax is
-         inherited from ISAKMP, but is unnecessary because the last
-         Proposal could be identified from the length of the SA.  The
-
-
-
-
-Kaufman                     Standards Track                    [Page 49]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-         value (3) corresponds to a Payload Type of Transform in IKEv1,
-         and the first 4 octets of the Transform structure are designed
-         to look somewhat like the header of a Payload.
-
-      o  RESERVED - MUST be sent as zero; MUST be ignored on receipt.
-
-      o  Transform Length - The length (in octets) of the Transform
-         Substructure including Header and Attributes.
-
-      o  Transform Type (1 octet) - The type of transform being
-         specified in this transform.  Different protocols support
-         different transform types.  For some protocols, some of the
-         transforms may be optional.  If a transform is optional and the
-         initiator wishes to propose that the transform be omitted, no
-         transform of the given type is included in the proposal.  If
-         the initiator wishes to make use of the transform optional to
-         the responder, it includes a transform substructure with
-         transform ID = 0 as one of the options.
-
-      o  Transform ID (2 octets) - The specific instance of the
-         transform type being proposed.
-
-   Transform Type Values
-
-                                     Transform    Used In
-                                        Type
-          RESERVED                        0
-          Encryption Algorithm (ENCR)     1  (IKE and ESP)
-          Pseudo-random Function (PRF)    2  (IKE)
-          Integrity Algorithm (INTEG)     3  (IKE, AH, optional in ESP)
-          Diffie-Hellman Group (D-H)      4  (IKE, optional in AH & ESP)
-          Extended Sequence Numbers (ESN) 5  (AH and ESP)
-          RESERVED TO IANA                6-240
-          PRIVATE USE                     241-255
-
-   For Transform Type 1 (Encryption Algorithm), defined Transform IDs
-   are:
-
-          Name                     Number           Defined In
-          RESERVED                    0
-          ENCR_DES_IV64               1              (RFC1827)
-          ENCR_DES                    2              (RFC2405), [DES]
-          ENCR_3DES                   3              (RFC2451)
-          ENCR_RC5                    4              (RFC2451)
-          ENCR_IDEA                   5              (RFC2451), [IDEA]
-          ENCR_CAST                   6              (RFC2451)
-          ENCR_BLOWFISH               7              (RFC2451)
-          ENCR_3IDEA                  8              (RFC2451)
-
-
-
-Kaufman                     Standards Track                    [Page 50]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-          ENCR_DES_IV32               9
-          RESERVED                   10
-          ENCR_NULL                  11              (RFC2410)
-          ENCR_AES_CBC               12              (RFC3602)
-          ENCR_AES_CTR               13              (RFC3664)
-
-          values 14-1023 are reserved to IANA.  Values 1024-65535 are
-          for private use among mutually consenting parties.
-
-   For Transform Type 2 (Pseudo-random Function), defined Transform IDs
-   are:
-
-          Name                     Number               Defined In
-          RESERVED                    0
-          PRF_HMAC_MD5                1                 (RFC2104), [MD5]
-          PRF_HMAC_SHA1               2                 (RFC2104), [SHA]
-          PRF_HMAC_TIGER              3                 (RFC2104)
-          PRF_AES128_XCBC             4                 (RFC3664)
-
-          values 5-1023 are reserved to IANA.  Values 1024-65535 are for
-          private use among mutually consenting parties.
-
-   For Transform Type 3 (Integrity Algorithm), defined Transform IDs
-   are:
-
-          Name                     Number                 Defined In
-          NONE                       0
-          AUTH_HMAC_MD5_96           1                     (RFC2403)
-          AUTH_HMAC_SHA1_96          2                     (RFC2404)
-          AUTH_DES_MAC               3
-          AUTH_KPDK_MD5              4                     (RFC1826)
-          AUTH_AES_XCBC_96           5                     (RFC3566)
-
-          values 6-1023 are reserved to IANA.  Values 1024-65535 are for
-          private use among mutually consenting parties.
-
-   For Transform Type 4 (Diffie-Hellman Group), defined Transform IDs
-   are:
-
-          Name                                Number
-          NONE                               0
-          Defined in Appendix B              1 - 2
-          RESERVED                           3 - 4
-          Defined in [ADDGROUP]              5
-          RESERVED TO IANA                   6 - 13
-          Defined in [ADDGROUP]              14 - 18
-          RESERVED TO IANA                   19 - 1023
-          PRIVATE USE                        1024-65535
-
-
-
-Kaufman                     Standards Track                    [Page 51]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   For Transform Type 5 (Extended Sequence Numbers), defined Transform
-   IDs are:
-
-          Name                                Number
-          No Extended Sequence Numbers       0
-          Extended Sequence Numbers          1
-          RESERVED                           2 - 65535
-
-3.3.3.  Valid Transform Types by Protocol
-
-   The number and type of transforms that accompany an SA payload are
-   dependent on the protocol in the SA itself.  An SA payload proposing
-   the establishment of an SA has the following mandatory and optional
-   transform types.  A compliant implementation MUST understand all
-   mandatory and optional types for each protocol it supports (though it
-   need not accept proposals with unacceptable suites).  A proposal MAY
-   omit the optional types if the only value for them it will accept is
-   NONE.
-
-          Protocol  Mandatory Types        Optional Types
-            IKE     ENCR, PRF, INTEG, D-H
-            ESP     ENCR, ESN              INTEG, D-H
-            AH      INTEG, ESN             D-H
-
-3.3.4.  Mandatory Transform IDs
-
-   The specification of suites that MUST and SHOULD be supported for
-   interoperability has been removed from this document because they are
-   likely to change more rapidly than this document evolves.
-
-   An important lesson learned from IKEv1 is that no system should only
-   implement the mandatory algorithms and expect them to be the best
-   choice for all customers.  For example, at the time that this
-   document was written, many IKEv1 implementers were starting to
-   migrate to AES in Cipher Block Chaining (CBC) mode for Virtual
-   Private Network (VPN) applications.  Many IPsec systems based on
-   IKEv2 will implement AES, additional Diffie-Hellman groups, and
-   additional hash algorithms, and some IPsec customers already require
-   these algorithms in addition to the ones listed above.
-
-   It is likely that IANA will add additional transforms in the future,
-   and some users may want to use private suites, especially for IKE
-   where implementations should be capable of supporting different
-   parameters, up to certain size limits.  In support of this goal, all
-   implementations of IKEv2 SHOULD include a management facility that
-   allows specification (by a user or system administrator) of Diffie-
-   Hellman (DH) parameters (the generator, modulus, and exponent lengths
-   and values) for new DH groups.  Implementations SHOULD provide a
-
-
-
-Kaufman                     Standards Track                    [Page 52]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   management interface via which these parameters and the associated
-   transform IDs may be entered (by a user or system administrator), to
-   enable negotiating such groups.
-
-   All implementations of IKEv2 MUST include a management facility that
-   enables a user or system administrator to specify the suites that are
-   acceptable for use with IKE.  Upon receipt of a payload with a set of
-   transform IDs, the implementation MUST compare the transmitted
-   transform IDs against those locally configured via the management
-   controls, to verify that the proposed suite is acceptable based on
-   local policy.  The implementation MUST reject SA proposals that are
-   not authorized by these IKE suite controls.  Note that cryptographic
-   suites that MUST be implemented need not be configured as acceptable
-   to local policy.
-
-3.3.5.  Transform Attributes
-
-   Each transform in a Security Association payload may include
-   attributes that modify or complete the specification of the
-   transform.  These attributes are type/value pairs and are defined
-   below.  For example, if an encryption algorithm has a variable-length
-   key, the key length to be used may be specified as an attribute.
-   Attributes can have a value with a fixed two octet length or a
-   variable-length value.  For the latter, the attribute is encoded as
-   type/length/value.
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !A!       Attribute Type        !    AF=0  Attribute Length     !
-      !F!                             !    AF=1  Attribute Value      !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                   AF=0  Attribute Value                       !
-      !                   AF=1  Not Transmitted                       !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                      Figure 9:  Data Attributes
-
-      o  Attribute Type (2 octets) - Unique identifier for each type of
-         attribute (see below).
-
-         The most significant bit of this field is the Attribute Format
-         bit (AF).  It indicates whether the data attributes follow the
-         Type/Length/Value (TLV) format or a shortened Type/Value (TV)
-         format.  If the AF bit is zero (0), then the Data Attributes
-         are of the Type/Length/Value (TLV) form.  If the AF bit is a
-         one (1), then the Data Attributes are of the Type/Value form.
-
-
-
-
-Kaufman                     Standards Track                    [Page 53]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-      o  Attribute Length (2 octets) - Length in octets of the Attribute
-         Value.  When the AF bit is a one (1), the Attribute Value is
-         only 2 octets and the Attribute Length field is not present.
-
-      o  Attribute Value (variable length) - Value of the Attribute
-         associated with the Attribute Type.  If the AF bit is a zero
-         (0), this field has a variable length defined by the Attribute
-         Length field.  If the AF bit is a one (1), the Attribute Value
-         has a length of 2 octets.
-
-   Note that only a single attribute type (Key Length) is defined, and
-   it is fixed length.  The variable-length encoding specification is
-   included only for future extensions.  The only algorithms defined in
-   this document that accept attributes are the AES-based encryption,
-   integrity, and pseudo-random functions, which require a single
-   attribute specifying key width.
-
-   Attributes described as basic MUST NOT be encoded using the
-   variable-length encoding.  Variable-length attributes MUST NOT be
-   encoded as basic even if their value can fit into two octets.  NOTE:
-   This is a change from IKEv1, where increased flexibility may have
-   simplified the composer of messages but certainly complicated the
-   parser.
-
-         Attribute Type                 Value        Attribute Format
-      --------------------------------------------------------------
-      RESERVED                           0-13 Key Length (in bits)
-      14                 TV RESERVED                           15-17
-      RESERVED TO IANA                   18-16383 PRIVATE USE
-      16384-32767
-
-   Values 0-13 and 15-17 were used in a similar context in IKEv1 and
-   should not be assigned except to matching values.  Values 18-16383
-   are reserved to IANA.  Values 16384-32767 are for private use among
-   mutually consenting parties.
-
-   - Key Length
-
-      When using an Encryption Algorithm that has a variable-length key,
-      this attribute specifies the key length in bits (MUST use network
-      byte order).  This attribute MUST NOT be used when the specified
-      Encryption Algorithm uses a fixed-length key.
-
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 54]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-3.3.6.  Attribute Negotiation
-
-   During security association negotiation, initiators present offers to
-   responders.  Responders MUST select a single complete set of
-   parameters from the offers (or reject all offers if none are
-   acceptable).  If there are multiple proposals, the responder MUST
-   choose a single proposal number and return all of the Proposal
-   substructures with that Proposal number.  If there are multiple
-   Transforms with the same type, the responder MUST choose a single
-   one.  Any attributes of a selected transform MUST be returned
-   unmodified.  The initiator of an exchange MUST check that the
-   accepted offer is consistent with one of its proposals, and if not
-   that response MUST be rejected.
-
-   Negotiating Diffie-Hellman groups presents some special challenges.
-   SA offers include proposed attributes and a Diffie-Hellman public
-   number (KE) in the same message.  If in the initial exchange the
-   initiator offers to use one of several Diffie-Hellman groups, it
-   SHOULD pick the one the responder is most likely to accept and
-   include a KE corresponding to that group.  If the guess turns out to
-   be wrong, the responder will indicate the correct group in the
-   response and the initiator SHOULD pick an element of that group for
-   its KE value when retrying the first message.  It SHOULD, however,
-   continue to propose its full supported set of groups in order to
-   prevent a man-in-the-middle downgrade attack.
-
-   Implementation Note:
-
-      Certain negotiable attributes can have ranges or could have
-      multiple acceptable values.  These include the key length of a
-      variable key length symmetric cipher.  To further interoperability
-      and to support upgrading endpoints independently, implementers of
-      this protocol SHOULD accept values that they deem to supply
-      greater security.  For instance, if a peer is configured to accept
-      a variable-length cipher with a key length of X bits and is
-      offered that cipher with a larger key length, the implementation
-      SHOULD accept the offer if it supports use of the longer key.
-
-   Support of this capability allows an implementation to express a
-   concept of "at least" a certain level of security -- "a key length of
-   _at least_ X bits for cipher Y".
-
-
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 55]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-3.4.  Key Exchange Payload
-
-   The Key Exchange Payload, denoted KE in this memo, is used to
-   exchange Diffie-Hellman public numbers as part of a Diffie-Hellman
-   key exchange.  The Key Exchange Payload consists of the IKE generic
-   payload header followed by the Diffie-Hellman public value itself.
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !          DH Group #           !           RESERVED            !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                       Key Exchange Data                       ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                Figure 10:  Key Exchange Payload Format
-
-   A key exchange payload is constructed by copying one's Diffie-Hellman
-   public value into the "Key Exchange Data" portion of the payload.
-   The length of the Diffie-Hellman public value MUST be equal to the
-   length of the prime modulus over which the exponentiation was
-   performed, prepending zero bits to the value if necessary.
-
-   The DH Group # identifies the Diffie-Hellman group in which the Key
-   Exchange Data was computed (see section 3.3.2).  If the selected
-   proposal uses a different Diffie-Hellman group, the message MUST be
-   rejected with a Notify payload of type INVALID_KE_PAYLOAD.
-
-   The payload type for the Key Exchange payload is thirty four (34).
-
-3.5.  Identification Payloads
-
-   The Identification Payloads, denoted IDi and IDr in this memo, allow
-   peers to assert an identity to one another.  This identity may be
-   used for policy lookup, but does not necessarily have to match
-   anything in the CERT payload; both fields may be used by an
-   implementation to perform access control decisions.
-
-   NOTE: In IKEv1, two ID payloads were used in each direction to hold
-   Traffic Selector (TS) information for data passing over the SA.  In
-   IKEv2, this information is carried in TS payloads (see section 3.13).
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 56]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   The Identification Payload consists of the IKE generic payload header
-   followed by identification fields as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !   ID Type     !                 RESERVED                      |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                   Identification Data                         ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 11:  Identification Payload Format
-
-   o  ID Type (1 octet) - Specifies the type of Identification being
-      used.
-
-   o  RESERVED - MUST be sent as zero; MUST be ignored on receipt.
-
-   o  Identification Data (variable length) - Value, as indicated by the
-      Identification Type.  The length of the Identification Data is
-      computed from the size in the ID payload header.
-
-   The payload types for the Identification Payload are thirty five (35)
-   for IDi and thirty six (36) for IDr.
-
-   The following table lists the assigned values for the Identification
-   Type field, followed by a description of the Identification Data
-   which follows:
-
-      ID Type                           Value
-      -------                           -----
-      RESERVED                            0
-
-      ID_IPV4_ADDR                        1
-
-            A single four (4) octet IPv4 address.
-
-      ID_FQDN                             2
-
-            A fully-qualified domain name string.  An example of a
-            ID_FQDN is, "example.com".  The string MUST not contain any
-            terminators (e.g., NULL, CR, etc.).
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 57]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-      ID_RFC822_ADDR                      3
-
-            A fully-qualified RFC822 email address string, An example of
-            a ID_RFC822_ADDR is, "jsmith@example.com".  The string MUST
-            not contain any terminators.
-
-      Reserved to IANA                    4
-
-      ID_IPV6_ADDR                        5
-
-            A single sixteen (16) octet IPv6 address.
-
-      Reserved to IANA                    6 - 8
-
-      ID_DER_ASN1_DN                      9
-
-            The binary Distinguished Encoding Rules (DER) encoding of an
-            ASN.1 X.500 Distinguished Name [X.501].
-
-      ID_DER_ASN1_GN                      10
-
-            The binary DER encoding of an ASN.1 X.500 GeneralName
-            [X.509].
-
-      ID_KEY_ID                           11
-
-            An opaque octet stream which may be used to pass vendor-
-            specific information necessary to do certain proprietary
-            types of identification.
-
-      Reserved to IANA                    12-200
-
-      Reserved for private use            201-255
-
-   Two implementations will interoperate only if each can generate a
-   type of ID acceptable to the other.  To assure maximum
-   interoperability, implementations MUST be configurable to send at
-   least one of ID_IPV4_ADDR, ID_FQDN, ID_RFC822_ADDR, or ID_KEY_ID, and
-   MUST be configurable to accept all of these types.  Implementations
-   SHOULD be capable of generating and accepting all of these types.
-   IPv6-capable implementations MUST additionally be configurable to
-   accept ID_IPV6_ADDR.  IPv6-only implementations MAY be configurable
-   to send only ID_IPV6_ADDR.
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 58]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-3.6.  Certificate Payload
-
-   The Certificate Payload, denoted CERT in this memo, provides a means
-   to transport certificates or other authentication-related information
-   via IKE.  Certificate payloads SHOULD be included in an exchange if
-   certificates are available to the sender unless the peer has
-   indicated an ability to retrieve this information from elsewhere
-   using an HTTP_CERT_LOOKUP_SUPPORTED Notify payload.  Note that the
-   term "Certificate Payload" is somewhat misleading, because not all
-   authentication mechanisms use certificates and data other than
-   certificates may be passed in this payload.
-
-   The Certificate Payload is defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Cert Encoding !                                               !
-      +-+-+-+-+-+-+-+-+                                               !
-      ~                       Certificate Data                        ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                Figure 12:  Certificate Payload Format
-
-      o  Certificate Encoding (1 octet) - This field indicates the type
-         of certificate or certificate-related information contained in
-         the Certificate Data field.
-
-           Certificate Encoding               Value
-           --------------------               -----
-           RESERVED                             0
-           PKCS #7 wrapped X.509 certificate    1
-           PGP Certificate                      2
-           DNS Signed Key                       3
-           X.509 Certificate - Signature        4
-           Kerberos Token                       6
-           Certificate Revocation List (CRL)    7
-           Authority Revocation List (ARL)      8
-           SPKI Certificate                     9
-           X.509 Certificate - Attribute       10
-           Raw RSA Key                         11
-           Hash and URL of X.509 certificate   12
-           Hash and URL of X.509 bundle        13
-           RESERVED to IANA                  14 - 200
-           PRIVATE USE                      201 - 255
-
-
-
-Kaufman                     Standards Track                    [Page 59]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-      o  Certificate Data (variable length) - Actual encoding of
-         certificate data.  The type of certificate is indicated by the
-         Certificate Encoding field.
-
-   The payload type for the Certificate Payload is thirty seven (37).
-
-   Specific syntax is for some of the certificate type codes above is
-   not defined in this document.  The types whose syntax is defined in
-   this document are:
-
-      X.509 Certificate - Signature (4) contains a DER encoded X.509
-      certificate whose public key is used to validate the sender's AUTH
-      payload.
-
-      Certificate Revocation List (7) contains a DER encoded X.509
-      certificate revocation list.
-
-      Raw RSA Key (11) contains a PKCS #1 encoded RSA key (see [RSA] and
-      [PKCS1]).
-
-      Hash and URL encodings (12-13) allow IKE messages to remain short
-      by replacing long data structures with a 20 octet SHA-1 hash (see
-      [SHA]) of the replaced value followed by a variable-length URL
-      that resolves to the DER encoded data structure itself.  This
-      improves efficiency when the endpoints have certificate data
-      cached and makes IKE less subject to denial of service attacks
-      that become easier to mount when IKE messages are large enough to
-      require IP fragmentation [KPS03].
-
-      Use the following ASN.1 definition for an X.509 bundle:
-
-            CertBundle
-              { iso(1) identified-organization(3) dod(6) internet(1)
-                security(5) mechanisms(5) pkix(7) id-mod(0)
-                id-mod-cert-bundle(34) }
-
-            DEFINITIONS EXPLICIT TAGS ::=
-            BEGIN
-
-            IMPORTS
-              Certificate, CertificateList
-              FROM PKIX1Explicit88
-                 { iso(1) identified-organization(3) dod(6)
-                   internet(1) security(5) mechanisms(5) pkix(7)
-                   id-mod(0) id-pkix1-explicit(18) } ;
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 60]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-           CertificateOrCRL ::= CHOICE {
-             cert [0] Certificate,
-             crl  [1] CertificateList }
-
-           CertificateBundle ::= SEQUENCE OF CertificateOrCRL
-
-           END
-
-   Implementations MUST be capable of being configured to send and
-   accept up to four X.509 certificates in support of authentication,
-   and also MUST be capable of being configured to send and accept the
-   first two Hash and URL formats (with HTTP URLs).  Implementations
-   SHOULD be capable of being configured to send and accept Raw RSA
-   keys.  If multiple certificates are sent, the first certificate MUST
-   contain the public key used to sign the AUTH payload.  The other
-   certificates may be sent in any order.
-
-3.7.  Certificate Request Payload
-
-   The Certificate Request Payload, denoted CERTREQ in this memo,
-   provides a means to request preferred certificates via IKE and can
-   appear in the IKE_INIT_SA response and/or the IKE_AUTH request.
-   Certificate Request payloads MAY be included in an exchange when the
-   sender needs to get the certificate of the receiver.  If multiple CAs
-   are trusted and the cert encoding does not allow a list, then
-   multiple Certificate Request payloads SHOULD be transmitted.
-
-   The Certificate Request Payload is defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Cert Encoding !                                               !
-      +-+-+-+-+-+-+-+-+                                               !
-      ~                    Certification Authority                    ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-            Figure 13:  Certificate Request Payload Format
-
-   o  Certificate Encoding (1 octet) - Contains an encoding of the type
-      or format of certificate requested.  Values are listed in section
-      3.6.
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 61]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   o  Certification Authority (variable length) - Contains an encoding
-      of an acceptable certification authority for the type of
-      certificate requested.
-
-   The payload type for the Certificate Request Payload is thirty eight
-   (38).
-
-   The Certificate Encoding field has the same values as those defined
-   in section 3.6. The Certification Authority field contains an
-   indicator of trusted authorities for this certificate type.  The
-   Certification Authority value is a concatenated list of SHA-1 hashes
-   of the public keys of trusted Certification Authorities (CAs).  Each
-   is encoded as the SHA-1 hash of the Subject Public Key Info element
-   (see section 4.1.2.7 of [RFC3280]) from each Trust Anchor
-   certificate.  The twenty-octet hashes are concatenated and included
-   with no other formatting.
-
-   Note that the term "Certificate Request" is somewhat misleading, in
-   that values other than certificates are defined in a "Certificate"
-   payload and requests for those values can be present in a Certificate
-   Request Payload.  The syntax of the Certificate Request payload in
-   such cases is not defined in this document.
-
-   The Certificate Request Payload is processed by inspecting the "Cert
-   Encoding" field to determine whether the processor has any
-   certificates of this type.  If so, the "Certification Authority"
-   field is inspected to determine if the processor has any certificates
-   that can be validated up to one of the specified certification
-   authorities.  This can be a chain of certificates.
-
-   If an end-entity certificate exists that satisfies the criteria
-   specified in the CERTREQ, a certificate or certificate chain SHOULD
-   be sent back to the certificate requestor if the recipient of the
-   CERTREQ:
-
-   - is configured to use certificate authentication,
-
-   - is allowed to send a CERT payload,
-
-   - has matching CA trust policy governing the current negotiation, and
-
-   - has at least one time-wise and usage appropriate end-entity
-     certificate chaining to a CA provided in the CERTREQ.
-
-   Certificate revocation checking must be considered during the
-   chaining process used to select a certificate.  Note that even if two
-   peers are configured to use two different CAs, cross-certification
-   relationships should be supported by appropriate selection logic.
-
-
-
-Kaufman                     Standards Track                    [Page 62]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   The intent is not to prevent communication through the strict
-   adherence of selection of a certificate based on CERTREQ, when an
-   alternate certificate could be selected by the sender that would
-   still enable the recipient to successfully validate and trust it
-   through trust conveyed by cross-certification, CRLs, or other out-
-   of-band configured means.  Thus, the processing of a CERTREQ should
-   be seen as a suggestion for a certificate to select, not a mandated
-   one.  If no certificates exist, then the CERTREQ is ignored.  This is
-   not an error condition of the protocol.  There may be cases where
-   there is a preferred CA sent in the CERTREQ, but an alternate might
-   be acceptable (perhaps after prompting a human operator).
-
-3.8.  Authentication Payload
-
-   The Authentication Payload, denoted AUTH in this memo, contains data
-   used for authentication purposes.  The syntax of the Authentication
-   data varies according to the Auth Method as specified below.
-
-   The Authentication Payload is defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Auth Method   !                RESERVED                       !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                      Authentication Data                      ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                 Figure 14:  Authentication Payload Format
-
-   o  Auth Method (1 octet) - Specifies the method of authentication
-      used.  Values defined are:
-
-        RSA Digital Signature (1) - Computed as specified in section
-        2.15 using an RSA private key over a PKCS#1 padded hash (see
-        [RSA] and [PKCS1]).
-
-        Shared Key Message Integrity Code (2) - Computed as specified in
-        section 2.15 using the shared key associated with the identity
-        in the ID payload and the negotiated prf function
-
-        DSS Digital Signature (3) - Computed as specified in section
-        2.15 using a DSS private key (see [DSS]) over a SHA-1 hash.
-
-
-
-
-Kaufman                     Standards Track                    [Page 63]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-        The values 0 and 4-200 are reserved to IANA.  The values 201-255
-        are available for private use.
-
-   o  Authentication Data (variable length) - see section 2.15.
-
-   The payload type for the Authentication Payload is thirty nine (39).
-
-3.9.  Nonce Payload
-
-   The Nonce Payload, denoted Ni and Nr in this memo for the initiator's
-   and responder's nonce respectively, contains random data used to
-   guarantee liveness during an exchange and protect against replay
-   attacks.
-
-   The Nonce Payload is defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                            Nonce Data                         ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                   Figure 15:  Nonce Payload Format
-
-   o  Nonce Data (variable length) - Contains the random data generated
-      by the transmitting entity.
-
-   The payload type for the Nonce Payload is forty (40).
-
-   The size of a Nonce MUST be between 16 and 256 octets inclusive.
-   Nonce values MUST NOT be reused.
-
-3.10.  Notify Payload
-
-   The Notify Payload, denoted N in this document, is used to transmit
-   informational data, such as error conditions and state transitions,
-   to an IKE peer.  A Notify Payload may appear in a response message
-   (usually specifying why a request was rejected), in an INFORMATIONAL
-   Exchange (to report an error not in an IKE request), or in any other
-   message to indicate sender capabilities or to modify the meaning of
-   the request.
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 64]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   The Notify Payload is defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !  Protocol ID  !   SPI Size    !      Notify Message Type      !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                Security Parameter Index (SPI)                 ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                       Notification Data                       ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 16:  Notify Payload Format
-
-   o  Protocol ID (1 octet) - If this notification concerns an existing
-      SA, this field indicates the type of that SA.  For IKE_SA
-      notifications, this field MUST be one (1).  For notifications
-      concerning IPsec SAs this field MUST contain either (2) to
-      indicate AH or (3) to indicate ESP.  For notifications that do not
-      relate to an existing SA, this field MUST be sent as zero and MUST
-      be ignored on receipt.  All other values for this field are
-      reserved to IANA for future assignment.
-
-   o  SPI Size (1 octet) - Length in octets of the SPI as defined by the
-      IPsec protocol ID or zero if no SPI is applicable.  For a
-      notification concerning the IKE_SA, the SPI Size MUST be zero.
-
-   o  Notify Message Type (2 octets) - Specifies the type of
-      notification message.
-
-   o  SPI (variable length) - Security Parameter Index.
-
-   o  Notification Data (variable length) - Informational or error data
-      transmitted in addition to the Notify Message Type.  Values for
-      this field are type specific (see below).
-
-   The payload type for the Notify Payload is forty one (41).
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 65]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-3.10.1.  Notify Message Types
-
-   Notification information can be error messages specifying why an SA
-   could not be established.  It can also be status data that a process
-   managing an SA database wishes to communicate with a peer process.
-   The table below lists the Notification messages and their
-   corresponding values.  The number of different error statuses was
-   greatly reduced from IKEv1 both for simplification and to avoid
-   giving configuration information to probers.
-
-   Types in the range 0 - 16383 are intended for reporting errors.  An
-   implementation receiving a Notify payload with one of these types
-   that it does not recognize in a response MUST assume that the
-   corresponding request has failed entirely.  Unrecognized error types
-   in a request and status types in a request or response MUST be
-   ignored except that they SHOULD be logged.
-
-   Notify payloads with status types MAY be added to any message and
-   MUST be ignored if not recognized.  They are intended to indicate
-   capabilities, and as part of SA negotiation are used to negotiate
-   non-cryptographic parameters.
-
-        NOTIFY MESSAGES - ERROR TYPES           Value
-        -----------------------------           -----
-        RESERVED                                  0
-
-        UNSUPPORTED_CRITICAL_PAYLOAD              1
-
-            Sent if the payload has the "critical" bit set and the
-            payload type is not recognized.  Notification Data contains
-            the one-octet payload type.
-
-        INVALID_IKE_SPI                           4
-
-            Indicates an IKE message was received with an unrecognized
-            destination SPI.  This usually indicates that the recipient
-            has rebooted and forgotten the existence of an IKE_SA.
-
-        INVALID_MAJOR_VERSION                     5
-
-            Indicates the recipient cannot handle the version of IKE
-            specified in the header.  The closest version number that
-            the recipient can support will be in the reply header.
-
-        INVALID_SYNTAX                            7
-
-            Indicates the IKE message that was received was invalid
-            because some type, length, or value was out of range or
-
-
-
-Kaufman                     Standards Track                    [Page 66]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-            because the request was rejected for policy reasons.  To
-            avoid a denial of service attack using forged messages, this
-            status may only be returned for and in an encrypted packet
-            if the message ID and cryptographic checksum were valid.  To
-            avoid leaking information to someone probing a node, this
-            status MUST be sent in response to any error not covered by
-            one of the other status types.  To aid debugging, more
-            detailed error information SHOULD be written to a console or
-            log.
-
-        INVALID_MESSAGE_ID                        9
-
-            Sent when an IKE message ID outside the supported window is
-            received.  This Notify MUST NOT be sent in a response; the
-            invalid request MUST NOT be acknowledged.  Instead, inform
-            the other side by initiating an INFORMATIONAL exchange with
-            Notification data containing the four octet invalid message
-            ID.  Sending this notification is optional, and
-            notifications of this type MUST be rate limited.
-
-        INVALID_SPI                              11
-
-            MAY be sent in an IKE INFORMATIONAL exchange when a node
-            receives an ESP or AH packet with an invalid SPI.  The
-            Notification Data contains the SPI of the invalid packet.
-            This usually indicates a node has rebooted and forgotten an
-            SA.  If this Informational Message is sent outside the
-            context of an IKE_SA, it should be used by the recipient
-            only as a "hint" that something might be wrong (because it
-            could easily be forged).
-
-        NO_PROPOSAL_CHOSEN                       14
-
-            None of the proposed crypto suites was acceptable.
-
-        INVALID_KE_PAYLOAD                       17
-
-            The D-H Group # field in the KE payload is not the group #
-            selected by the responder for this exchange.  There are two
-            octets of data associated with this notification: the
-            accepted D-H Group # in big endian order.
-
-        AUTHENTICATION_FAILED                    24
-
-            Sent in the response to an IKE_AUTH message when for some
-            reason the authentication failed.  There is no associated
-            data.
-
-
-
-
-Kaufman                     Standards Track                    [Page 67]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-        SINGLE_PAIR_REQUIRED                     34
-
-        This error indicates that a CREATE_CHILD_SA request is
-        unacceptable because its sender is only willing to accept
-        traffic selectors specifying a single pair of addresses.  The
-        requestor is expected to respond by requesting an SA for only
-        the specific traffic it is trying to forward.
-
-        NO_ADDITIONAL_SAS                        35
-
-        This error indicates that a CREATE_CHILD_SA request is
-        unacceptable because the responder is unwilling to accept any
-        more CHILD_SAs on this IKE_SA.  Some minimal implementations may
-        only accept a single CHILD_SA setup in the context of an initial
-        IKE exchange and reject any subsequent attempts to add more.
-
-        INTERNAL_ADDRESS_FAILURE                 36
-
-        Indicates an error assigning an internal address (i.e.,
-        INTERNAL_IP4_ADDRESS or INTERNAL_IP6_ADDRESS) during the
-        processing of a Configuration Payload by a responder.  If this
-        error is generated within an IKE_AUTH exchange, no CHILD_SA will
-        be created.
-
-        FAILED_CP_REQUIRED                       37
-
-        Sent by responder in the case where CP(CFG_REQUEST) was expected
-        but not received, and so is a conflict with locally configured
-        policy.  There is no associated data.
-
-        TS_UNACCEPTABLE                          38
-
-        Indicates that none of the addresses/protocols/ports in the
-        supplied traffic selectors is acceptable.
-
-        INVALID_SELECTORS                        39
-
-            MAY be sent in an IKE INFORMATIONAL exchange when a node
-            receives an ESP or AH packet whose selectors do not match
-            those of the SA on which it was delivered (and that caused
-            the packet to be dropped).  The Notification Data contains
-            the start of the offending packet (as in ICMP messages) and
-            the SPI field of the notification is set to match the SPI of
-            the IPsec SA.
-
-        RESERVED TO IANA - Error types         40 - 8191
-
-        Private Use - Errors                8192 - 16383
-
-
-
-Kaufman                     Standards Track                    [Page 68]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-        NOTIFY MESSAGES - STATUS TYPES           Value
-        ------------------------------           -----
-
-        INITIAL_CONTACT                          16384
-
-            This notification asserts that this IKE_SA is the only
-            IKE_SA currently active between the authenticated
-            identities.  It MAY be sent when an IKE_SA is established
-            after a crash, and the recipient MAY use this information to
-            delete any other IKE_SAs it has to the same authenticated
-            identity without waiting for a timeout.  This notification
-            MUST NOT be sent by an entity that may be replicated (e.g.,
-            a roaming user's credentials where the user is allowed to
-            connect to the corporate firewall from two remote systems at
-            the same time).
-
-        SET_WINDOW_SIZE                          16385
-
-            This notification asserts that the sending endpoint is
-            capable of keeping state for multiple outstanding exchanges,
-            permitting the recipient to send multiple requests before
-            getting a response to the first.  The data associated with a
-            SET_WINDOW_SIZE notification MUST be 4 octets long and
-            contain the big endian representation of the number of
-            messages the sender promises to keep.  Window size is always
-            one until the initial exchanges complete.
-
-        ADDITIONAL_TS_POSSIBLE                   16386
-
-            This notification asserts that the sending endpoint narrowed
-            the proposed traffic selectors but that other traffic
-            selectors would also have been acceptable, though only in a
-            separate SA (see section 2.9).  There is no data associated
-            with this Notify type.  It may be sent only as an additional
-            payload in a message including accepted TSs.
-
-        IPCOMP_SUPPORTED                         16387
-
-            This notification may be included only in a message
-            containing an SA payload negotiating a CHILD_SA and
-            indicates a willingness by its sender to use IPComp on this
-            SA.  The data associated with this notification includes a
-            two-octet IPComp CPI followed by a one-octet transform ID
-            optionally followed by attributes whose length and format
-            are defined by that transform ID.  A message proposing an SA
-            may contain multiple IPCOMP_SUPPORTED notifications to
-            indicate multiple supported algorithms.  A message accepting
-            an SA may contain at most one.
-
-
-
-Kaufman                     Standards Track                    [Page 69]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-            The transform IDs currently defined are:
-
-                 NAME         NUMBER  DEFINED IN
-                 -----------  ------  -----------
-                 RESERVED       0
-                 IPCOMP_OUI     1
-                 IPCOMP_DEFLATE 2     RFC 2394
-                 IPCOMP_LZS     3     RFC 2395
-                 IPCOMP_LZJH    4     RFC 3051
-
-                 values 5-240 are reserved to IANA.  Values 241-255 are
-                 for private use among mutually consenting parties.
-
-        NAT_DETECTION_SOURCE_IP                  16388
-
-            This notification is used by its recipient to determine
-            whether the source is behind a NAT box.  The data associated
-            with this notification is a SHA-1 digest of the SPIs (in the
-            order they appear in the header), IP address, and port on
-            which this packet was sent.  There MAY be multiple Notify
-            payloads of this type in a message if the sender does not
-            know which of several network attachments will be used to
-            send the packet.  The recipient of this notification MAY
-            compare the supplied value to a SHA-1 hash of the SPIs,
-            source IP address, and port, and if they don't match it
-            SHOULD enable NAT traversal (see section 2.23).
-            Alternately, it MAY reject the connection attempt if NAT
-            traversal is not supported.
-
-        NAT_DETECTION_DESTINATION_IP             16389
-
-            This notification is used by its recipient to determine
-            whether it is behind a NAT box.  The data associated with
-            this notification is a SHA-1 digest of the SPIs (in the
-            order they appear in the header), IP address, and port to
-            which this packet was sent.  The recipient of this
-            notification MAY compare the supplied value to a hash of the
-            SPIs, destination IP address, and port, and if they don't
-            match it SHOULD invoke NAT traversal (see section 2.23).  If
-            they don't match, it means that this end is behind a NAT and
-            this end SHOULD start sending keepalive packets as defined
-            in [Hutt05].  Alternately, it MAY reject the connection
-            attempt if NAT traversal is not supported.
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 70]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-        COOKIE                                   16390
-
-            This notification MAY be included in an IKE_SA_INIT
-            response.  It indicates that the request should be retried
-            with a copy of this notification as the first payload.  This
-            notification MUST be included in an IKE_SA_INIT request
-            retry if a COOKIE notification was included in the initial
-            response.  The data associated with this notification MUST
-            be between 1 and 64 octets in length (inclusive).
-
-        USE_TRANSPORT_MODE                       16391
-
-            This notification MAY be included in a request message that
-            also includes an SA payload requesting a CHILD_SA.  It
-            requests that the CHILD_SA use transport mode rather than
-            tunnel mode for the SA created.  If the request is accepted,
-            the response MUST also include a notification of type
-            USE_TRANSPORT_MODE.  If the responder declines the request,
-            the CHILD_SA will be established in tunnel mode.  If this is
-            unacceptable to the initiator, the initiator MUST delete the
-            SA.  Note: Except when using this option to negotiate
-            transport mode, all CHILD_SAs will use tunnel mode.
-
-            Note: The ECN decapsulation modifications specified in
-            [RFC4301] MUST be performed for every tunnel mode SA created
-            by IKEv2.
-
-        HTTP_CERT_LOOKUP_SUPPORTED               16392
-
-            This notification MAY be included in any message that can
-            include a CERTREQ payload and indicates that the sender is
-            capable of looking up certificates based on an HTTP-based
-            URL (and hence presumably would prefer to receive
-            certificate specifications in that format).
-
-        REKEY_SA                                 16393
-
-            This notification MUST be included in a CREATE_CHILD_SA
-            exchange if the purpose of the exchange is to replace an
-            existing ESP or AH SA.  The SPI field identifies the SA
-            being rekeyed.  There is no data.
-
-        ESP_TFC_PADDING_NOT_SUPPORTED            16394
-
-            This notification asserts that the sending endpoint will NOT
-            accept packets that contain Flow Confidentiality (TFC)
-            padding.
-
-
-
-
-Kaufman                     Standards Track                    [Page 71]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-        NON_FIRST_FRAGMENTS_ALSO                 16395
-
-            Used for fragmentation control.  See [RFC4301] for
-            explanation.
-
-        RESERVED TO IANA - STATUS TYPES      16396 - 40959
-
-        Private Use - STATUS TYPES           40960 - 65535
-
-3.11.  Delete Payload
-
-   The Delete Payload, denoted D in this memo, contains a protocol-
-   specific security association identifier that the sender has removed
-   from its security association database and is, therefore, no longer
-   valid.  Figure 17 shows the format of the Delete Payload.  It is
-   possible to send multiple SPIs in a Delete payload; however, each SPI
-   MUST be for the same protocol.  Mixing of protocol identifiers MUST
-   NOT be performed in a Delete payload.  It is permitted, however, to
-   include multiple Delete payloads in a single INFORMATIONAL exchange
-   where each Delete payload lists SPIs for a different protocol.
-
-   Deletion of the IKE_SA is indicated by a protocol ID of 1 (IKE) but
-   no SPIs.  Deletion of a CHILD_SA, such as ESP or AH, will contain the
-   IPsec protocol ID of that protocol (2 for AH, 3 for ESP), and the SPI
-   is the SPI the sending endpoint would expect in inbound ESP or AH
-   packets.
-
-   The Delete Payload is defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Protocol ID   !   SPI Size    !           # of SPIs           !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~               Security Parameter Index(es) (SPI)              ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                  Figure 17:  Delete Payload Format
-
-   o  Protocol ID (1 octet) - Must be 1 for an IKE_SA, 2 for AH, or 3
-      for ESP.
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 72]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   o  SPI Size (1 octet) - Length in octets of the SPI as defined by the
-      protocol ID.  It MUST be zero for IKE (SPI is in message header)
-      or four for AH and ESP.
-
-   o  # of SPIs (2 octets) - The number of SPIs contained in the Delete
-      payload.  The size of each SPI is defined by the SPI Size field.
-
-   o  Security Parameter Index(es) (variable length) - Identifies the
-      specific security association(s) to delete.  The length of this
-      field is determined by the SPI Size and # of SPIs fields.
-
-   The payload type for the Delete Payload is forty two (42).
-
-3.12.  Vendor ID Payload
-
-   The Vendor ID Payload, denoted V in this memo, contains a vendor
-   defined constant.  The constant is used by vendors to identify and
-   recognize remote instances of their implementations.  This mechanism
-   allows a vendor to experiment with new features while maintaining
-   backward compatibility.
-
-   A Vendor ID payload MAY announce that the sender is capable to
-   accepting certain extensions to the protocol, or it MAY simply
-   identify the implementation as an aid in debugging.  A Vendor ID
-   payload MUST NOT change the interpretation of any information defined
-   in this specification (i.e., the critical bit MUST be set to 0).
-   Multiple Vendor ID payloads MAY be sent.  An implementation is NOT
-   REQUIRED to send any Vendor ID payload at all.
-
-   A Vendor ID payload may be sent as part of any message.  Reception of
-   a familiar Vendor ID payload allows an implementation to make use of
-   Private USE numbers described throughout this memo -- private
-   payloads, private exchanges, private notifications, etc.  Unfamiliar
-   Vendor IDs MUST be ignored.
-
-   Writers of Internet-Drafts who wish to extend this protocol MUST
-   define a Vendor ID payload to announce the ability to implement the
-   extension in the Internet-Draft.  It is expected that Internet-Drafts
-   that gain acceptance and are standardized will be given "magic
-   numbers" out of the Future Use range by IANA, and the requirement to
-   use a Vendor ID will go away.
-
-
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 73]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   The Vendor ID Payload fields are defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                        Vendor ID (VID)                        ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                 Figure 18:  Vendor ID Payload Format
-
-   o  Vendor ID (variable length) - It is the responsibility of the
-      person choosing the Vendor ID to assure its uniqueness in spite of
-      the absence of any central registry for IDs.  Good practice is to
-      include a company name, a person name, or some such.  If you want
-      to show off, you might include the latitude and longitude and time
-      where you were when you chose the ID and some random input.  A
-      message digest of a long unique string is preferable to the long
-      unique string itself.
-
-   The payload type for the Vendor ID Payload is forty three (43).
-
-3.13.  Traffic Selector Payload
-
-   The Traffic Selector Payload, denoted TS in this memo, allows peers
-   to identify packet flows for processing by IPsec security services.
-   The Traffic Selector Payload consists of the IKE generic payload
-   header followed by individual traffic selectors as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Number of TSs !                 RESERVED                      !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                       <Traffic Selectors>                     ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 19:  Traffic Selectors Payload Format
-
-   o  Number of TSs (1 octet) - Number of traffic selectors being
-      provided.
-
-
-
-Kaufman                     Standards Track                    [Page 74]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   o  RESERVED - This field MUST be sent as zero and MUST be ignored on
-      receipt.
-
-   o  Traffic Selectors (variable length) - One or more individual
-      traffic selectors.
-
-   The length of the Traffic Selector payload includes the TS header and
-   all the traffic selectors.
-
-   The payload type for the Traffic Selector payload is forty four (44)
-   for addresses at the initiator's end of the SA and forty five (45)
-   for addresses at the responder's end.
-
-3.13.1.  Traffic Selector
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !   TS Type     !IP Protocol ID*|       Selector Length         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |           Start Port*         |           End Port*           |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                         Starting Address*                     ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                         Ending Address*                       ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                  Figure 20: Traffic Selector
-
-   * Note: All fields other than TS Type and Selector Length depend on
-   the TS Type.  The fields shown are for TS Types 7 and 8, the only two
-   values currently defined.
-
-   o  TS Type (one octet) - Specifies the type of traffic selector.
-
-   o  IP protocol ID (1 octet) - Value specifying an associated IP
-      protocol ID (e.g., UDP/TCP/ICMP).  A value of zero means that the
-      protocol ID is not relevant to this traffic selector -- the SA can
-      carry all protocols.
-
-   o  Selector Length - Specifies the length of this Traffic Selector
-      Substructure including the header.
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 75]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   o  Start Port (2 octets) - Value specifying the smallest port number
-      allowed by this Traffic Selector.  For protocols for which port is
-      undefined, or if all ports are allowed, this field MUST be zero.
-      For the ICMP protocol, the two one-octet fields Type and Code are
-      treated as a single 16-bit integer (with Type in the most
-      significant eight bits and Code in the least significant eight
-      bits) port number for the purposes of filtering based on this
-      field.
-
-   o  End Port (2 octets) - Value specifying the largest port number
-      allowed by this Traffic Selector.  For protocols for which port is
-      undefined, or if all ports are allowed, this field MUST be 65535.
-      For the ICMP protocol, the two one-octet fields Type and Code are
-      treated as a single 16-bit integer (with Type in the most
-      significant eight bits and Code in the least significant eight
-      bits) port number for the purposed of filtering based on this
-      field.
-
-   o  Starting Address - The smallest address included in this Traffic
-      Selector (length determined by TS type).
-
-   o  Ending Address - The largest address included in this Traffic
-      Selector (length determined by TS type).
-
-   Systems that are complying with [RFC4301] that wish to indicate "ANY"
-   ports MUST set the start port to 0 and the end port to 65535; note
-   that according to [RFC4301], "ANY" includes "OPAQUE".  Systems
-   working with [RFC4301] that wish to indicate "OPAQUE" ports, but not
-   "ANY" ports, MUST set the start port to 65535 and the end port to 0.
-
-   The following table lists the assigned values for the Traffic
-   Selector Type field and the corresponding Address Selector Data.
-
-      TS Type                           Value
-      -------                           -----
-      RESERVED                           0-6
-
-      TS_IPV4_ADDR_RANGE                  7
-
-            A range of IPv4 addresses, represented by two four-octet
-            values.  The first value is the beginning IPv4 address
-            (inclusive) and the second value is the ending IPv4 address
-            (inclusive).  All addresses falling between the two
-            specified addresses are considered to be within the list.
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 76]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-      TS_IPV6_ADDR_RANGE                  8
-
-            A range of IPv6 addresses, represented by two sixteen-octet
-            values.  The first value is the beginning IPv6 address
-            (inclusive) and the second value is the ending IPv6 address
-            (inclusive).  All addresses falling between the two
-            specified addresses are considered to be within the list.
-
-      RESERVED TO IANA                    9-240
-      PRIVATE USE                         241-255
-
-3.14.  Encrypted Payload
-
-   The Encrypted Payload, denoted SK{...} or E in this memo, contains
-   other payloads in encrypted form.  The Encrypted Payload, if present
-   in a message, MUST be the last payload in the message.  Often, it is
-   the only payload in the message.
-
-   The algorithms for encryption and integrity protection are negotiated
-   during IKE_SA setup, and the keys are computed as specified in
-   sections 2.14 and 2.18.
-
-   The encryption and integrity protection algorithms are modeled after
-   the ESP algorithms described in RFCs 2104 [KBC96], 4303 [RFC4303],
-   and 2451 [ESPCBC].  This document completely specifies the
-   cryptographic processing of IKE data, but those documents should be
-   consulted for design rationale.  We require a block cipher with a
-   fixed block size and an integrity check algorithm that computes a
-   fixed-length checksum over a variable size message.
-
-   The payload type for an Encrypted payload is forty six (46).  The
-   Encrypted Payload consists of the IKE generic payload header followed
-   by individual fields as follows:
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 77]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C!  RESERVED   !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                     Initialization Vector                     !
-      !         (length is block size for encryption algorithm)       !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~                    Encrypted IKE Payloads                     ~
-      +               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !               !             Padding (0-255 octets)            !
-      +-+-+-+-+-+-+-+-+                               +-+-+-+-+-+-+-+-+
-      !                                               !  Pad Length   !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ~                    Integrity Checksum Data                    ~
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 21:  Encrypted Payload Format
-
-   o  Next Payload - The payload type of the first embedded payload.
-      Note that this is an exception in the standard header format,
-      since the Encrypted payload is the last payload in the message and
-      therefore the Next Payload field would normally be zero.  But
-      because the content of this payload is embedded payloads and there
-      was no natural place to put the type of the first one, that type
-      is placed here.
-
-   o  Payload Length - Includes the lengths of the header, IV, Encrypted
-      IKE Payloads, Padding, Pad Length, and Integrity Checksum Data.
-
-   o  Initialization Vector - A randomly chosen value whose length is
-      equal to the block length of the underlying encryption algorithm.
-      Recipients MUST accept any value.  Senders SHOULD either pick this
-      value pseudo-randomly and independently for each message or use
-      the final ciphertext block of the previous message sent.  Senders
-      MUST NOT use the same value for each message, use a sequence of
-      values with low hamming distance (e.g., a sequence number), or use
-      ciphertext from a received message.
-
-   o  IKE Payloads are as specified earlier in this section. This field
-      is encrypted with the negotiated cipher.
-
-   o  Padding MAY contain any value chosen by the sender, and MUST have
-      a length that makes the combination of the Payloads, the Padding,
-      and the Pad Length to be a multiple of the encryption block size.
-      This field is encrypted with the negotiated cipher.
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 78]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   o  Pad Length is the length of the Padding field. The sender SHOULD
-      set the Pad Length to the minimum value that makes the combination
-      of the Payloads, the Padding, and the Pad Length a multiple of the
-      block size, but the recipient MUST accept any length that results
-      in proper alignment.  This field is encrypted with the negotiated
-      cipher.
-
-   o  Integrity Checksum Data is the cryptographic checksum of the
-      entire message starting with the Fixed IKE Header through the Pad
-      Length.  The checksum MUST be computed over the encrypted message.
-      Its length is determined by the integrity algorithm negotiated.
-
-3.15.  Configuration Payload
-
-   The Configuration payload, denoted CP in this document, is used to
-   exchange configuration information between IKE peers.  The exchange
-   is for an IRAC to request an internal IP address from an IRAS and to
-   exchange other information of the sort that one would acquire with
-   Dynamic Host Configuration Protocol (DHCP) if the IRAC were directly
-   connected to a LAN.
-
-   Configuration payloads are of type CFG_REQUEST/CFG_REPLY or
-   CFG_SET/CFG_ACK (see CFG Type in the payload description below).
-   CFG_REQUEST and CFG_SET payloads may optionally be added to any IKE
-   request.  The IKE response MUST include either a corresponding
-   CFG_REPLY or CFG_ACK or a Notify payload with an error type
-   indicating why the request could not be honored.  An exception is
-   that a minimal implementation MAY ignore all CFG_REQUEST and CFG_SET
-   payloads, so a response message without a corresponding CFG_REPLY or
-   CFG_ACK MUST be accepted as an indication that the request was not
-   supported.
-
-   "CFG_REQUEST/CFG_REPLY" allows an IKE endpoint to request information
-   from its peer.  If an attribute in the CFG_REQUEST Configuration
-   Payload is not zero-length, it is taken as a suggestion for that
-   attribute.  The CFG_REPLY Configuration Payload MAY return that
-   value, or a new one.  It MAY also add new attributes and not include
-   some requested ones.  Requestors MUST ignore returned attributes that
-   they do not recognize.
-
-   Some attributes MAY be multi-valued, in which case multiple attribute
-   values of the same type are sent and/or returned.  Generally, all
-   values of an attribute are returned when the attribute is requested.
-   For some attributes (in this version of the specification only
-   internal addresses), multiple requests indicates a request that
-   multiple values be assigned.  For these attributes, the number of
-   values returned SHOULD NOT exceed the number requested.
-
-
-
-
-Kaufman                     Standards Track                    [Page 79]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   If the data type requested in a CFG_REQUEST is not recognized or not
-   supported, the responder MUST NOT return an error type but rather
-   MUST either send a CFG_REPLY that MAY be empty or a reply not
-   containing a CFG_REPLY payload at all.  Error returns are reserved
-   for cases where the request is recognized but cannot be performed as
-   requested or the request is badly formatted.
-
-   "CFG_SET/CFG_ACK" allows an IKE endpoint to push configuration data
-   to its peer.  In this case, the CFG_SET Configuration Payload
-   contains attributes the initiator wants its peer to alter.  The
-   responder MUST return a Configuration Payload if it accepted any of
-   the configuration data and it MUST contain the attributes that the
-   responder accepted with zero-length data.  Those attributes that it
-   did not accept MUST NOT be in the CFG_ACK Configuration Payload.  If
-   no attributes were accepted, the responder MUST return either an
-   empty CFG_ACK payload or a response message without a CFG_ACK
-   payload.  There are currently no defined uses for the CFG_SET/CFG_ACK
-   exchange, though they may be used in connection with extensions based
-   on Vendor IDs.  An minimal implementation of this specification MAY
-   ignore CFG_SET payloads.
-
-   Extensions via the CP payload SHOULD NOT be used for general purpose
-   management.  Its main intent is to provide a bootstrap mechanism to
-   exchange information within IPsec from IRAS to IRAC.  While it MAY be
-   useful to use such a method to exchange information between some
-   Security Gateways (SGW) or small networks, existing management
-   protocols such as DHCP [DHCP], RADIUS [RADIUS], SNMP, or LDAP [LDAP]
-   should be preferred for enterprise management as well as subsequent
-   information exchanges.
-
-   The Configuration Payload is defined as follows:
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      ! Next Payload  !C! RESERVED    !         Payload Length        !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !   CFG Type    !                    RESERVED                   !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !                                                               !
-      ~                   Configuration Attributes                    ~
-      !                                                               !
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 22:  Configuration Payload Format
-
-   The payload type for the Configuration Payload is forty seven (47).
-
-
-
-
-Kaufman                     Standards Track                    [Page 80]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   o  CFG Type (1 octet) - The type of exchange represented by the
-      Configuration Attributes.
-
-             CFG Type       Value
-             ===========    =====
-             RESERVED         0
-             CFG_REQUEST      1
-             CFG_REPLY        2
-             CFG_SET          3
-             CFG_ACK          4
-
-      values 5-127 are reserved to IANA.  Values 128-255 are for private
-      use among mutually consenting parties.
-
-   o  RESERVED (3 octets)  - MUST be sent as zero; MUST be ignored on
-      receipt.
-
-   o  Configuration Attributes (variable length) - These are type length
-      values specific to the Configuration Payload and are defined
-      below.  There may be zero or more Configuration Attributes in this
-      payload.
-
-3.15.1.  Configuration Attributes
-
-                           1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      !R|         Attribute Type      !            Length             |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                                                               |
-      ~                             Value                             ~
-      |                                                               |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-               Figure 23:  Configuration Attribute Format
-
-   o  Reserved (1 bit) - This bit MUST be set to zero and MUST be
-      ignored on receipt.
-
-   o  Attribute Type (15 bits) - A unique identifier for each of the
-      Configuration Attribute Types.
-
-   o  Length (2 octets) - Length in octets of Value.
-
-   o  Value (0 or more octets) - The variable-length value of this
-      Configuration Attribute.
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 81]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   The following attribute types have been defined:
-
-                                      Multi-
-        Attribute Type          Value Valued Length
-        ======================= ===== ====== ==================
-         RESERVED                 0
-         INTERNAL_IP4_ADDRESS     1    YES*  0 or 4 octets
-         INTERNAL_IP4_NETMASK     2    NO    0 or 4 octets
-         INTERNAL_IP4_DNS         3    YES   0 or 4 octets
-         INTERNAL_IP4_NBNS        4    YES   0 or 4 octets
-         INTERNAL_ADDRESS_EXPIRY  5    NO    0 or 4 octets
-         INTERNAL_IP4_DHCP        6    YES   0 or 4 octets
-         APPLICATION_VERSION      7    NO    0 or more
-         INTERNAL_IP6_ADDRESS     8    YES*  0 or 17 octets
-         RESERVED                 9
-         INTERNAL_IP6_DNS        10    YES   0 or 16 octets
-         INTERNAL_IP6_NBNS       11    YES   0 or 16 octets
-         INTERNAL_IP6_DHCP       12    YES   0 or 16 octets
-         INTERNAL_IP4_SUBNET     13    YES   0 or 8 octets
-         SUPPORTED_ATTRIBUTES    14    NO    Multiple of 2
-         INTERNAL_IP6_SUBNET     15    YES   17 octets
-
-      * These attributes may be multi-valued on return only if multiple
-      values were requested.
-
-      Types 16-16383 are reserved to IANA.  Values 16384-32767 are for
-      private use among mutually consenting parties.
-
-      o  INTERNAL_IP4_ADDRESS, INTERNAL_IP6_ADDRESS - An address on the
-         internal network, sometimes called a red node address or
-         private address and MAY be a private address on the Internet.
-         In a request message, the address specified is a requested
-         address (or zero if no specific address is requested).  If a
-         specific address is requested, it likely indicates that a
-         previous connection existed with this address and the requestor
-         would like to reuse that address.  With IPv6, a requestor MAY
-         supply the low-order address bytes it wants to use.  Multiple
-         internal addresses MAY be requested by requesting multiple
-         internal address attributes.  The responder MAY only send up to
-         the number of addresses requested.  The INTERNAL_IP6_ADDRESS is
-         made up of two fields: the first is a sixteen-octet IPv6
-         address and the second is a one-octet prefix-length as defined
-         in [ADDRIPV6].
-
-         The requested address is valid until the expiry time defined
-         with the INTERNAL_ADDRESS EXPIRY attribute or there are no
-         IKE_SAs between the peers.
-
-
-
-
-Kaufman                     Standards Track                    [Page 82]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-      o  INTERNAL_IP4_NETMASK - The internal network's netmask.  Only
-         one netmask is allowed in the request and reply messages (e.g.,
-         255.255.255.0), and it MUST be used only with an
-         INTERNAL_IP4_ADDRESS attribute.
-
-      o  INTERNAL_IP4_DNS, INTERNAL_IP6_DNS - Specifies an address of a
-         DNS server within the network.  Multiple DNS servers MAY be
-         requested.  The responder MAY respond with zero or more DNS
-         server attributes.
-
-      o  INTERNAL_IP4_NBNS, INTERNAL_IP6_NBNS - Specifies an address of
-         a NetBios Name Server (WINS) within the network.  Multiple NBNS
-         servers MAY be requested.  The responder MAY respond with zero
-         or more NBNS server attributes.
-
-      o  INTERNAL_ADDRESS_EXPIRY - Specifies the number of seconds that
-         the host can use the internal IP address.  The host MUST renew
-         the IP address before this expiry time.  Only one of these
-         attributes MAY be present in the reply.
-
-      o  INTERNAL_IP4_DHCP, INTERNAL_IP6_DHCP - Instructs the host to
-         send any internal DHCP requests to the address contained within
-         the attribute.  Multiple DHCP servers MAY be requested.  The
-         responder MAY respond with zero or more DHCP server attributes.
-
-      o  APPLICATION_VERSION - The version or application information of
-         the IPsec host.  This is a string of printable ASCII characters
-         that is NOT null terminated.
-
-      o  INTERNAL_IP4_SUBNET - The protected sub-networks that this
-         edge-device protects.  This attribute is made up of two fields:
-         the first is an IP address and the second is a netmask.
-         Multiple sub-networks MAY be requested.  The responder MAY
-         respond with zero or more sub-network attributes.
-
-      o  SUPPORTED_ATTRIBUTES - When used within a Request, this
-         attribute MUST be zero-length and specifies a query to the
-         responder to reply back with all of the attributes that it
-         supports.  The response contains an attribute that contains a
-         set of attribute identifiers each in 2 octets.  The length
-         divided by 2 (octets) would state the number of supported
-         attributes contained in the response.
-
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 83]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-      o  INTERNAL_IP6_SUBNET - The protected sub-networks that this
-         edge-device protects.  This attribute is made up of two fields:
-         the first is a sixteen-octet IPv6 address and the second is a
-         one-octet prefix-length as defined in [ADDRIPV6].  Multiple
-         sub-networks MAY be requested.  The responder MAY respond with
-         zero or more sub-network attributes.
-
-      Note that no recommendations are made in this document as to how
-      an implementation actually figures out what information to send in
-      a reply.  That is, we do not recommend any specific method of an
-      IRAS determining which DNS server should be returned to a
-      requesting IRAC.
-
-3.16.  Extensible Authentication Protocol (EAP) Payload
-
-   The Extensible Authentication Protocol Payload, denoted EAP in this
-   memo, allows IKE_SAs to be authenticated using the protocol defined
-   in RFC 3748 [EAP] and subsequent extensions to that protocol.  The
-   full set of acceptable values for the payload is defined elsewhere,
-   but a short summary of RFC 3748 is included here to make this
-   document stand alone in the common cases.
-
-                            1                   2                   3
-        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-       ! Next Payload  !C!  RESERVED   !         Payload Length        !
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-       !                                                               !
-       ~                       EAP Message                             ~
-       !                                                               !
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                      Figure 24:  EAP Payload Format
-
-      The payload type for an EAP Payload is forty eight (48).
-
-                            1                   2                   3
-        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-       !     Code      ! Identifier    !           Length              !
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-       !     Type      ! Type_Data...
-       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
-
-                      Figure 25:  EAP Message Format
-
-   o  Code (1 octet) indicates whether this message is a Request (1),
-      Response (2), Success (3), or Failure (4).
-
-
-
-Kaufman                     Standards Track                    [Page 84]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   o  Identifier (1 octet) is used in PPP to distinguish replayed
-      messages from repeated ones.  Since in IKE, EAP runs over a
-      reliable protocol, it serves no function here.  In a response
-      message, this octet MUST be set to match the identifier in the
-      corresponding request.  In other messages, this field MAY be set
-      to any value.
-
-   o  Length (2 octets) is the length of the EAP message and MUST be
-      four less than the Payload Length of the encapsulating payload.
-
-   o  Type (1 octet) is present only if the Code field is Request (1) or
-      Response (2).  For other codes, the EAP message length MUST be
-      four octets and the Type and Type_Data fields MUST NOT be present.
-      In a Request (1) message, Type indicates the data being requested.
-      In a Response (2) message, Type MUST either be Nak or match the
-      type of the data requested.  The following types are defined in
-      RFC 3748:
-
-      1  Identity
-      2  Notification
-      3  Nak (Response Only)
-      4  MD5-Challenge
-      5  One-Time Password (OTP)
-      6  Generic Token Card
-
-   o  Type_Data (Variable Length) varies with the Type of Request and
-      the associated Response.  For the documentation of the EAP
-      methods, see [EAP].
-
-   Note that since IKE passes an indication of initiator identity in
-   message 3 of the protocol, the responder SHOULD NOT send EAP Identity
-   requests.  The initiator SHOULD, however, respond to such requests if
-   it receives them.
-
-4.  Conformance Requirements
-
-   In order to assure that all implementations of IKEv2 can
-   interoperate, there are "MUST support" requirements in addition to
-   those listed elsewhere.  Of course, IKEv2 is a security protocol, and
-   one of its major functions is to allow only authorized parties to
-   successfully complete establishment of SAs.  So a particular
-   implementation may be configured with any of a number of restrictions
-   concerning algorithms and trusted authorities that will prevent
-   universal interoperability.
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 85]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   IKEv2 is designed to permit minimal implementations that can
-   interoperate with all compliant implementations.  There are a series
-   of optional features that can easily be ignored by a particular
-   implementation if it does not support that feature.  Those features
-   include:
-
-      Ability to negotiate SAs through a NAT and tunnel the resulting
-      ESP SA over UDP.
-
-      Ability to request (and respond to a request for) a temporary IP
-      address on the remote end of a tunnel.
-
-      Ability to support various types of legacy authentication.
-
-      Ability to support window sizes greater than one.
-
-      Ability to establish multiple ESP and/or AH SAs within a single
-      IKE_SA.
-
-      Ability to rekey SAs.
-
-   To assure interoperability, all implementations MUST be capable of
-   parsing all payload types (if only to skip over them) and to ignore
-   payload types that it does not support unless the critical bit is set
-   in the payload header.  If the critical bit is set in an unsupported
-   payload header, all implementations MUST reject the messages
-   containing those payloads.
-
-   Every implementation MUST be capable of doing four-message
-   IKE_SA_INIT and IKE_AUTH exchanges establishing two SAs (one for IKE,
-   one for ESP and/or AH).  Implementations MAY be initiate-only or
-   respond-only if appropriate for their platform.  Every implementation
-   MUST be capable of responding to an INFORMATIONAL exchange, but a
-   minimal implementation MAY respond to any INFORMATIONAL message with
-   an empty INFORMATIONAL reply (note that within the context of an
-   IKE_SA, an "empty" message consists of an IKE header followed by an
-   Encrypted payload with no payloads contained in it).  A minimal
-   implementation MAY support the CREATE_CHILD_SA exchange only in so
-   far as to recognize requests and reject them with a Notify payload of
-   type NO_ADDITIONAL_SAS.  A minimal implementation need not be able to
-   initiate CREATE_CHILD_SA or INFORMATIONAL exchanges.  When an SA
-   expires (based on locally configured values of either lifetime or
-   octets passed), and implementation MAY either try to renew it with a
-   CREATE_CHILD_SA exchange or it MAY delete (close) the old SA and
-   create a new one.  If the responder rejects the CREATE_CHILD_SA
-   request with a NO_ADDITIONAL_SAS notification, the implementation
-   MUST be capable of instead closing the old SA and creating a new one.
-
-
-
-
-Kaufman                     Standards Track                    [Page 86]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   Implementations are not required to support requesting temporary IP
-   addresses or responding to such requests.  If an implementation does
-   support issuing such requests, it MUST include a CP payload in
-   message 3 containing at least a field of type INTERNAL_IP4_ADDRESS or
-   INTERNAL_IP6_ADDRESS.  All other fields are optional.  If an
-   implementation supports responding to such requests, it MUST parse
-   the CP payload of type CFG_REQUEST in message 3 and recognize a field
-   of type INTERNAL_IP4_ADDRESS or INTERNAL_IP6_ADDRESS.  If it supports
-   leasing an address of the appropriate type, it MUST return a CP
-   payload of type CFG_REPLY containing an address of the requested
-   type.  The responder SHOULD include all of the other related
-   attributes if it has them.
-
-   A minimal IPv4 responder implementation will ignore the contents of
-   the CP payload except to determine that it includes an
-   INTERNAL_IP4_ADDRESS attribute and will respond with the address and
-   other related attributes regardless of whether the initiator
-   requested them.
-
-   A minimal IPv4 initiator will generate a CP payload containing only
-   an INTERNAL_IP4_ADDRESS attribute and will parse the response
-   ignoring attributes it does not know how to use.  The only attribute
-   it MUST be able to process is INTERNAL_ADDRESS_EXPIRY, which it must
-   use to bound the lifetime of the SA unless it successfully renews the
-   lease before it expires.  Minimal initiators need not be able to
-   request lease renewals and minimal responders need not respond to
-   them.
-
-   For an implementation to be called conforming to this specification,
-   it MUST be possible to configure it to accept the following:
-
-   PKIX Certificates containing and signed by RSA keys of size 1024 or
-   2048 bits, where the ID passed is any of ID_KEY_ID, ID_FQDN,
-   ID_RFC822_ADDR, or ID_DER_ASN1_DN.
-
-   Shared key authentication where the ID passes is any of ID_KEY_ID,
-   ID_FQDN, or ID_RFC822_ADDR.
-
-   Authentication where the responder is authenticated using PKIX
-   Certificates and the initiator is authenticated using shared key
-   authentication.
-
-
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 87]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-5.  Security Considerations
-
-   While this protocol is designed to minimize disclosure of
-   configuration information to unauthenticated peers, some such
-   disclosure is unavoidable.  One peer or the other must identify
-   itself first and prove its identity first.  To avoid probing, the
-   initiator of an exchange is required to identify itself first, and
-   usually is required to authenticate itself first.  The initiator can,
-   however, learn that the responder supports IKE and what cryptographic
-   protocols it supports.  The responder (or someone impersonating the
-   responder) can probe the initiator not only for its identity, but
-   using CERTREQ payloads may be able to determine what certificates the
-   initiator is willing to use.
-
-   Use of EAP authentication changes the probing possibilities somewhat.
-   When EAP authentication is used, the responder proves its identity
-   before the initiator does, so an initiator that knew the name of a
-   valid initiator could probe the responder for both its name and
-   certificates.
-
-   Repeated rekeying using CREATE_CHILD_SA without additional Diffie-
-   Hellman exchanges leaves all SAs vulnerable to cryptanalysis of a
-   single key or overrun of either endpoint.  Implementers should take
-   note of this fact and set a limit on CREATE_CHILD_SA exchanges
-   between exponentiations.  This memo does not prescribe such a limit.
-
-   The strength of a key derived from a Diffie-Hellman exchange using
-   any of the groups defined here depends on the inherent strength of
-   the group, the size of the exponent used, and the entropy provided by
-   the random number generator used.  Due to these inputs, it is
-   difficult to determine the strength of a key for any of the defined
-   groups.  Diffie-Hellman group number two, when used with a strong
-   random number generator and an exponent no less than 200 bits, is
-   common for use with 3DES.  Group five provides greater security than
-   group two.  Group one is for historic purposes only and does not
-   provide sufficient strength except for use with DES, which is also
-   for historic use only.  Implementations should make note of these
-   estimates when establishing policy and negotiating security
-   parameters.
-
-   Note that these limitations are on the Diffie-Hellman groups
-   themselves.  There is nothing in IKE that prohibits using stronger
-   groups nor is there anything that will dilute the strength obtained
-   from stronger groups (limited by the strength of the other algorithms
-   negotiated including the prf function).  In fact, the extensible
-   framework of IKE encourages the definition of more groups; use of
-   elliptical curve groups may greatly increase strength using much
-   smaller numbers.
-
-
-
-Kaufman                     Standards Track                    [Page 88]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   It is assumed that all Diffie-Hellman exponents are erased from
-   memory after use.  In particular, these exponents MUST NOT be derived
-   from long-lived secrets like the seed to a pseudo-random generator
-   that is not erased after use.
-
-   The strength of all keys is limited by the size of the output of the
-   negotiated prf function.  For this reason, a prf function whose
-   output is less than 128 bits (e.g., 3DES-CBC) MUST NOT be used with
-   this protocol.
-
-   The security of this protocol is critically dependent on the
-   randomness of the randomly chosen parameters.  These should be
-   generated by a strong random or properly seeded pseudo-random source
-   (see [RFC4086]).  Implementers should take care to ensure that use of
-   random numbers for both keys and nonces is engineered in a fashion
-   that does not undermine the security of the keys.
-
-   For information on the rationale of many of the cryptographic design
-   choices in this protocol, see [SIGMA] and [SKEME].  Though the
-   security of negotiated CHILD_SAs does not depend on the strength of
-   the encryption and integrity protection negotiated in the IKE_SA,
-   implementations MUST NOT negotiate NONE as the IKE integrity
-   protection algorithm or ENCR_NULL as the IKE encryption algorithm.
-
-   When using pre-shared keys, a critical consideration is how to assure
-   the randomness of these secrets.  The strongest practice is to ensure
-   that any pre-shared key contain as much randomness as the strongest
-   key being negotiated.  Deriving a shared secret from a password,
-   name, or other low-entropy source is not secure.  These sources are
-   subject to dictionary and social engineering attacks, among others.
-
-   The NAT_DETECTION_*_IP notifications contain a hash of the addresses
-   and ports in an attempt to hide internal IP addresses behind a NAT.
-   Since the IPv4 address space is only 32 bits, and it is usually very
-   sparse, it would be possible for an attacker to find out the internal
-   address used behind the NAT box by trying all possible IP addresses
-   and trying to find the matching hash.  The port numbers are normally
-   fixed to 500, and the SPIs can be extracted from the packet.  This
-   reduces the number of hash calculations to 2^32.  With an educated
-   guess of the use of private address space, the number of hash
-   calculations is much smaller.  Designers should therefore not assume
-   that use of IKE will not leak internal address information.
-
-   When using an EAP authentication method that does not generate a
-   shared key for protecting a subsequent AUTH payload, certain man-in-
-   the-middle and server impersonation attacks are possible [EAPMITM].
-   These vulnerabilities occur when EAP is also used in protocols that
-   are not protected with a secure tunnel.  Since EAP is a general-
-
-
-
-Kaufman                     Standards Track                    [Page 89]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   purpose authentication protocol, which is often used to provide
-   single-signon facilities, a deployed IPsec solution that relies on an
-   EAP authentication method that does not generate a shared key (also
-   known as a non-key-generating EAP method) can become compromised due
-   to the deployment of an entirely unrelated application that also
-   happens to use the same non-key-generating EAP method, but in an
-   unprotected fashion.  Note that this vulnerability is not limited to
-   just EAP, but can occur in other scenarios where an authentication
-   infrastructure is reused.  For example, if the EAP mechanism used by
-   IKEv2 utilizes a token authenticator, a man-in-the-middle attacker
-   could impersonate the web server, intercept the token authentication
-   exchange, and use it to initiate an IKEv2 connection.  For this
-   reason, use of non-key-generating EAP methods SHOULD be avoided where
-   possible.  Where they are used, it is extremely important that all
-   usages of these EAP methods SHOULD utilize a protected tunnel, where
-   the initiator validates the responder's certificate before initiating
-   the EAP exchange.  Implementers SHOULD describe the vulnerabilities
-   of using non-key-generating EAP methods in the documentation of their
-   implementations so that the administrators deploying IPsec solutions
-   are aware of these dangers.
-
-   An implementation using EAP MUST also use a public-key-based
-   authentication of the server to the client before the EAP exchange
-   begins, even if the EAP method offers mutual authentication.  This
-   avoids having additional IKEv2 protocol variations and protects the
-   EAP data from active attackers.
-
-   If the messages of IKEv2 are long enough that IP-level fragmentation
-   is necessary, it is possible that attackers could prevent the
-   exchange from completing by exhausting the reassembly buffers.  The
-   chances of this can be minimized by using the Hash and URL encodings
-   instead of sending certificates (see section 3.6).  Additional
-   mitigations are discussed in [KPS03].
-
-6.  IANA Considerations
-
-   This document defines a number of new field types and values where
-   future assignments will be managed by the IANA.
-
-   The following registries have been created by the IANA:
-
-      IKEv2 Exchange Types (section 3.1)
-      IKEv2 Payload Types (section 3.2)
-      IKEv2 Transform Types (section 3.3.2)
-          IKEv2 Transform Attribute Types (section 3.3.2)
-          IKEv2 Encryption Transform IDs (section 3.3.2)
-          IKEv2 Pseudo-random Function Transform IDs (section 3.3.2)
-          IKEv2 Integrity Algorithm Transform IDs (section 3.3.2)
-
-
-
-Kaufman                     Standards Track                    [Page 90]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-          IKEv2 Diffie-Hellman Transform IDs (section 3.3.2)
-      IKEv2 Identification Payload ID Types (section 3.5)
-      IKEv2 Certificate Encodings (section 3.6)
-      IKEv2 Authentication Method (section 3.8)
-      IKEv2 Notify Message Types (section 3.10.1)
-          IKEv2 Notification IPCOMP Transform IDs (section 3.10.1)
-      IKEv2 Security Protocol Identifiers (section 3.3.1)
-      IKEv2 Traffic Selector Types (section 3.13.1)
-      IKEv2 Configuration Payload CFG Types (section 3.15)
-      IKEv2 Configuration Payload Attribute Types (section 3.15.1)
-
-   Note: When creating a new Transform Type, a new registry for it must
-   be created.
-
-   Changes and additions to any of those registries are by expert
-   review.
-
-7.  Acknowledgements
-
-   This document is a collaborative effort of the entire IPsec WG.  If
-   there were no limit to the number of authors that could appear on an
-   RFC, the following, in alphabetical order, would have been listed:
-   Bill Aiello, Stephane Beaulieu, Steve Bellovin, Sara Bitan, Matt
-   Blaze, Ran Canetti, Darren Dukes, Dan Harkins, Paul Hoffman, John
-   Ioannidis, Charlie Kaufman, Steve Kent, Angelos Keromytis, Tero
-   Kivinen, Hugo Krawczyk, Andrew Krywaniuk, Radia Perlman, Omer
-   Reingold, and Michael Richardson.  Many other people contributed to
-   the design.  It is an evolution of IKEv1, ISAKMP, and the IPsec DOI,
-   each of which has its own list of authors.  Hugh Daniel suggested the
-   feature of having the initiator, in message 3, specify a name for the
-   responder, and gave the feature the cute name "You Tarzan, Me Jane".
-   David Faucher and Valery Smyzlov helped refine the design of the
-   traffic selector negotiation.
-
-8.  References
-
-8.1.  Normative References
-
-   [ADDGROUP] Kivinen, T. and M. Kojo, "More Modular Exponential (MODP)
-              Diffie-Hellman groups for Internet Key Exchange (IKE)",
-              RFC 3526, May 2003.
-
-   [ADDRIPV6] Hinden, R. and S. Deering, "Internet Protocol Version 6
-              (IPv6) Addressing Architecture", RFC 3513, April 2003.
-
-   [Bra97]    Bradner, S., "Key Words for use in RFCs to indicate
-              Requirement Levels", BCP 14, RFC 2119, March 1997.
-
-
-
-
-Kaufman                     Standards Track                    [Page 91]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   [EAP]      Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H.
-              Levkowetz, "Extensible Authentication Protocol (EAP)", RFC
-              3748, June 2004.
-
-   [ESPCBC]   Pereira, R. and R. Adams, "The ESP CBC-Mode Cipher
-              Algorithms", RFC 2451, November 1998.
-
-   [Hutt05]   Huttunen, A., Swander, B., Volpe, V., DiBurro, L., and M.
-              Stenberg, "UDP Encapsulation of IPsec ESP Packets", RFC
-              3948, January 2005.
-
-   [RFC2434]  Narten, T. and H. Alvestrand, "Guidelines for Writing an
-              IANA Considerations Section in RFCs", BCP 26, RFC 2434,
-              October 1998.
-
-   [RFC3168]  Ramakrishnan, K., Floyd, S., and D. Black, "The Addition
-              of Explicit Congestion Notification (ECN) to IP", RFC
-              3168, September 2001.
-
-   [RFC3280]  Housley, R., Polk, W., Ford, W., and D. Solo, "Internet
-              X.509 Public Key Infrastructure Certificate and
-              Certificate Revocation List (CRL) Profile", RFC 3280,
-              April 2002.
-
-   [RFC4301]  Kent, S. and K. Seo, "Security Architecture for the
-              Internet Protocol", RFC 4301, December 2005.
-
-8.2.  Informative References
-
-   [DES]      ANSI X3.106, "American National Standard for Information
-              Systems-Data Link Encryption", American National Standards
-              Institute, 1983.
-
-   [DH]       Diffie, W., and Hellman M., "New Directions in
-              Cryptography", IEEE Transactions on Information Theory, V.
-              IT-22, n. 6, June 1977.
-
-   [DHCP]     Droms, R., "Dynamic Host Configuration Protocol", RFC
-              2131, March 1997.
-
-   [DSS]      NIST, "Digital Signature Standard", FIPS 186, National
-              Institute of Standards and Technology, U.S. Department of
-              Commerce, May, 1994.
-
-   [EAPMITM]  Asokan, N., Nierni, V., and Nyberg, K., "Man-in-the-Middle
-              in Tunneled Authentication Protocols",
-              http://eprint.iacr.org/2002/163, November 2002.
-
-
-
-
-Kaufman                     Standards Track                    [Page 92]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   [HC98]     Harkins, D. and D. Carrel, "The Internet Key Exchange
-              (IKE)", RFC 2409, November 1998.
-
-   [IDEA]     Lai, X., "On the Design and Security of Block Ciphers,"
-              ETH Series in Information Processing, v. 1, Konstanz:
-              Hartung-Gorre Verlag, 1992.
-
-   [IPCOMP]   Shacham, A., Monsour, B., Pereira, R., and M.  Thomas, "IP
-              Payload Compression Protocol (IPComp)", RFC 3173,
-              September 2001.
-
-   [KPS03]    Kaufman, C., Perlman, R., and Sommerfeld, B., "DoS
-              protection for UDP-based protocols", ACM Conference on
-              Computer and Communications Security, October 2003.
-
-   [KBC96]    Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
-              Hashing for Message Authentication", RFC 2104, February
-              1997.
-
-   [LDAP]     Wahl, M., Howes, T., and S  Kille, "Lightweight Directory
-              Access Protocol (v3)", RFC 2251, December 1997.
-
-   [MD5]      Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321,
-              April 1992.
-
-   [MSST98]   Maughan, D., Schertler, M., Schneider, M., and J. Turner,
-              "Internet Security Association and Key Management Protocol
-              (ISAKMP)", RFC 2408, November 1998.
-
-   [Orm96]    Orman, H., "The OAKLEY Key Determination Protocol", RFC
-              2412, November 1998.
-
-   [PFKEY]    McDonald, D., Metz, C., and B. Phan, "PF_KEY Key
-              Management API, Version 2", RFC 2367, July 1998.
-
-   [PKCS1]    Jonsson, J. and B. Kaliski, "Public-Key Cryptography
-              Standards (PKCS) #1: RSA Cryptography Specifications
-              Version 2.1", RFC 3447, February 2003.
-
-   [PK01]     Perlman, R., and Kaufman, C., "Analysis of the IPsec key
-              exchange Standard", WET-ICE Security Conference, MIT,2001,
-              http://sec.femto.org/wetice-2001/papers/radia-paper.pdf.
-
-   [Pip98]    Piper, D., "The Internet IP Security Domain Of
-              Interpretation for ISAKMP", RFC 2407, November 1998.
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 93]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   [RADIUS]   Rigney, C., Willens, S., Rubens, A., and W. Simpson,
-              "Remote Authentication Dial In User Service (RADIUS)", RFC
-              2865, June 2000.
-
-   [RFC4086]  Eastlake, D., 3rd, Schiller, J., and S. Crocker,
-              "Randomness Requirements for Security", BCP 106, RFC 4086,
-              June 2005.
-
-   [RFC1958]  Carpenter, B., "Architectural Principles of the Internet",
-              RFC 1958, June 1996.
-
-   [RFC2401]  Kent, S. and R. Atkinson, "Security Architecture for the
-              Internet Protocol", RFC 2401, November 1998.
-
-   [RFC2474]  Nichols, K., Blake, S., Baker, F., and D. Black,
-              "Definition of the Differentiated Services Field (DS
-              Field) in the IPv4 and IPv6 Headers", RFC 2474, December
-              1998.
-
-   [RFC2475]  Blake, S., Black, D., Carlson, M., Davies, E., Wang, Z.,
-              and W. Weiss, "An Architecture for Differentiated
-              Service", RFC 2475, December 1998.
-
-   [RFC2522]  Karn, P. and W. Simpson, "Photuris: Session-Key Management
-              Protocol", RFC 2522, March 1999.
-
-   [RFC2775]  Carpenter, B., "Internet Transparency", RFC 2775, February
-              2000.
-
-   [RFC2983]  Black, D., "Differentiated Services and Tunnels", RFC
-              2983, October 2000.
-
-   [RFC3439]  Bush, R. and D. Meyer, "Some Internet Architectural
-              Guidelines and Philosophy", RFC 3439, December 2002.
-
-   [RFC3715]  Aboba, B. and W. Dixon, "IPsec-Network Address Translation
-              (NAT) Compatibility Requirements", RFC 3715, March 2004.
-
-   [RFC4302]  Kent, S., "IP Authentication Header", RFC 4302, December
-              2005.
-
-   [RFC4303]  Kent, S., "IP Encapsulating Security Payload (ESP)", RFC
-              4303, December 2005.
-
-   [RSA]      Rivest, R., Shamir, A., and Adleman, L., "A Method for
-              Obtaining Digital Signatures and Public-Key
-              Cryptosystems", Communications of the ACM, v. 21, n. 2,
-              February 1978.
-
-
-
-Kaufman                     Standards Track                    [Page 94]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   [SHA]      NIST, "Secure Hash Standard", FIPS 180-1, National
-              Institute of Standards and Technology, U.S. Department of
-              Commerce, May 1994.
-
-   [SIGMA]    Krawczyk, H., "SIGMA: the `SIGn-and-MAc' Approach to
-              Authenticated Diffie-Hellman and its Use in the IKE
-              Protocols", in Advances in Cryptography - CRYPTO 2003
-              Proceedings, LNCS 2729, Springer, 2003.  Available at:
-              http://www.informatik.uni-trier.de/~ley/db/conf/
-              crypto/crypto2003.html.
-
-   [SKEME]    Krawczyk, H., "SKEME: A Versatile Secure Key Exchange
-              Mechanism for Internet", from IEEE Proceedings of the 1996
-              Symposium on Network and Distributed Systems Security.
-
-   [X.501]    ITU-T Recommendation X.501: Information Technology - Open
-              Systems Interconnection - The Directory: Models, 1993.
-
-   [X.509]    ITU-T Recommendation X.509 (1997 E): Information
-              Technology - Open Systems Interconnection - The Directory:
-              Authentication Framework, June 1997.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 95]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-Appendix A: Summary of changes from IKEv1
-
-   The goals of this revision to IKE are:
-
-   1) To define the entire IKE protocol in a single document, replacing
-   RFCs 2407, 2408, and 2409 and incorporating subsequent changes to
-   support NAT Traversal, Extensible Authentication, and Remote Address
-   acquisition;
-
-   2) To simplify IKE by replacing the eight different initial exchanges
-   with a single four-message exchange (with changes in authentication
-   mechanisms affecting only a single AUTH payload rather than
-   restructuring the entire exchange) see [PK01];
-
-   3) To remove the Domain of Interpretation (DOI), Situation (SIT), and
-   Labeled Domain Identifier fields, and the Commit and Authentication
-   only bits;
-
-   4) To decrease IKE's latency in the common case by making the initial
-   exchange be 2 round trips (4 messages), and allowing the ability to
-   piggyback setup of a CHILD_SA on that exchange;
-
-   5) To replace the cryptographic syntax for protecting the IKE
-   messages themselves with one based closely on ESP to simplify
-   implementation and security analysis;
-
-   6) To reduce the number of possible error states by making the
-   protocol reliable (all messages are acknowledged) and sequenced.
-   This allows shortening CREATE_CHILD_SA exchanges from 3 messages to
-   2;
-
-   7) To increase robustness by allowing the responder to not do
-   significant processing until it receives a message proving that the
-   initiator can receive messages at its claimed IP address, and not
-   commit any state to an exchange until the initiator can be
-   cryptographically authenticated;
-
-   8) To fix cryptographic weaknesses such as the problem with
-   symmetries in hashes used for authentication documented by Tero
-   Kivinen;
-
-   9) To specify Traffic Selectors in their own payloads type rather
-   than overloading ID payloads, and making more flexible the Traffic
-   Selectors that may be specified;
-
-   10) To specify required behavior under certain error conditions or
-   when data that is not understood is received, to make it easier to
-   make future revisions that do not break backward compatibility;
-
-
-
-Kaufman                     Standards Track                    [Page 96]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-   11) To simplify and clarify how shared state is maintained in the
-   presence of network failures and Denial of Service attacks; and
-
-   12) To maintain existing syntax and magic numbers to the extent
-   possible to make it likely that implementations of IKEv1 can be
-   enhanced to support IKEv2 with minimum effort.
-
-Appendix B: Diffie-Hellman Groups
-
-   There are two Diffie-Hellman groups defined here for use in IKE.
-   These groups were generated by Richard Schroeppel at the University
-   of Arizona.  Properties of these primes are described in [Orm96].
-
-   The strength supplied by group one may not be sufficient for the
-   mandatory-to-implement encryption algorithm and is here for historic
-   reasons.
-
-   Additional Diffie-Hellman groups have been defined in [ADDGROUP].
-
-B.1.  Group 1 - 768 Bit MODP
-
-   This group is assigned id 1 (one).
-
-   The prime is: 2^768 - 2 ^704 - 1 + 2^64 * { [2^638 pi] + 149686 } Its
-   hexadecimal value is:
-
-        FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08
-        8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B
-        302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9
-        A63A3620 FFFFFFFF FFFFFFFF
-
-   The generator is 2.
-
-B.2.  Group 2 - 1024 Bit MODP
-
-   This group is assigned id 2 (two).
-
-   The prime is 2^1024 - 2^960 - 1 + 2^64 * { [2^894 pi] + 129093 }.
-   Its hexadecimal value is:
-
-        FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08
-        8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B
-        302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9
-        A637ED6B 0BFF5CB6 F406B7ED EE386BFB 5A899FA5 AE9F2411 7C4B1FE6
-        49286651 ECE65381 FFFFFFFF FFFFFFFF
-
-   The generator is 2.
-
-
-
-
-Kaufman                     Standards Track                    [Page 97]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-Editor's Address
-
-   Charlie Kaufman
-   Microsoft Corporation
-   1 Microsoft Way
-   Redmond, WA 98052
-
-   Phone: 1-425-707-3335
-   EMail: charliek@microsoft.com
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 98]
-
-RFC 4306                         IKEv2                     December 2005
-
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society (2005).
-
-   This document is subject to the rights, licenses and restrictions
-   contained in BCP 78, and except as set forth therein, the authors
-   retain all their rights.
-
-   This document and the information contained herein are provided on an
-   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
-   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
-   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
-   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
-   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
-   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-Intellectual Property
-
-   The IETF takes no position regarding the validity or scope of any
-   Intellectual Property Rights or other rights that might be claimed to
-   pertain to the implementation or use of the technology described in
-   this document or the extent to which any license under such rights
-   might or might not be available; nor does it represent that it has
-   made any independent effort to identify any such rights.  Information
-   on the procedures with respect to rights in RFC documents can be
-   found in BCP 78 and BCP 79.
-
-   Copies of IPR disclosures made to the IETF Secretariat and any
-   assurances of licenses to be made available, or the result of an
-   attempt made to obtain a general license or permission for the use of
-   such proprietary rights by implementers or users of this
-   specification can be obtained from the IETF on-line IPR repository at
-   http://www.ietf.org/ipr.
-
-   The IETF invites any interested party to bring to its attention any
-   copyrights, patents or patent applications, or other proprietary
-   rights that may cover technology that may be required to implement
-   this standard.  Please address the information to the IETF at ietf-
-   ipr@ietf.org.
-
-Acknowledgement
-
-   Funding for the RFC Editor function is currently provided by the
-   Internet Society.
-
-
-
-
-
-
-
-Kaufman                     Standards Track                    [Page 99]
-
diff --git a/doc/ikev2/[RFC4307] - Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2).txt b/doc/ikev2/[RFC4307] - Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2).txt
deleted file mode 100644
index 5617a2551..000000000
--- a/doc/ikev2/[RFC4307] - Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2).txt
+++ /dev/null
@@ -1,339 +0,0 @@
-
-
-
-
-
-
-Network Working Group                                        J. Schiller
-Request for Comments: 4307         Massachusetts Institute of Technology
-Category: Standards Track                                  December 2005
-
-
-                Cryptographic Algorithms for Use in the
-                Internet Key Exchange Version 2 (IKEv2)
-
-Status of This Memo
-
-   This document specifies an Internet standards track protocol for the
-   Internet community, and requests discussion and suggestions for
-   improvements.  Please refer to the current edition of the "Internet
-   Official Protocol Standards" (STD 1) for the standardization state
-   and status of this protocol.  Distribution of this memo is unlimited.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (2005).
-
-Abstract
-
-   The IPsec series of protocols makes use of various cryptographic
-   algorithms in order to provide security services.  The Internet Key
-   Exchange (IKE (RFC 2409) and IKEv2) provide a mechanism to negotiate
-   which algorithms should be used in any given association.  However,
-   to ensure interoperability between disparate implementations, it is
-   necessary to specify a set of mandatory-to-implement algorithms to
-   ensure that there is at least one algorithm that all implementations
-   will have available.  This document defines the current set of
-   algorithms that are mandatory to implement as part of IKEv2, as well
-   as algorithms that should be implemented because they may be promoted
-   to mandatory at some future time.
-
-1.  Introduction
-
-   The Internet Key Exchange protocol provides for the negotiation of
-   cryptographic algorithms between both endpoints of a cryptographic
-
-   association.  Different implementations of IPsec and IKE may provide
-   different algorithms.  However, the IETF desires that all
-   implementations should have some way to interoperate.  In particular,
-   this requires that IKE define a set of mandatory-to-implement
-   algorithms because IKE itself uses such algorithms as part of its own
-   negotiations.  This requires that some set of algorithms be specified
-   as "mandatory-to-implement" for IKE.
-
-
-
-
-
-Schiller                    Standards Track                     [Page 1]
-
-RFC 4307             IKEv2 Cryptographic Algorithms        December 2005
-
-
-   The nature of cryptography is that new algorithms surface
-   continuously and existing algorithms are continuously attacked.  An
-   algorithm believed to be strong today may be demonstrated to be weak
-   tomorrow.  Given this, the choice of mandatory-to-implement algorithm
-   should be conservative so as to minimize the likelihood of it being
-   compromised quickly.  Thought should also be given to performance
-   considerations as many uses of IPsec will be in environments where
-   performance is a concern.
-
-   Finally, we need to recognize that the mandatory-to-implement
-   algorithm(s) may need to change over time to adapt to the changing
-   world.  For this reason, the selection of mandatory-to-implement
-   algorithms was removed from the main IKEv2 specification and placed
-   in this document.  As the choice of algorithm changes, only this
-   document should need to be updated.
-
-   Ideally, the mandatory-to-implement algorithm of tomorrow should
-   already be available in most implementations of IPsec by the time it
-   is made mandatory.  To facilitate this, we will attempt to identify
-   those algorithms (that are known today) in this document.  There is
-   no guarantee that the algorithms we believe today may be mandatory in
-   the future will in fact become so.  All algorithms known today are
-   subject to cryptographic attack and may be broken in the future.
-
-2.  Requirements Terminology
-
-   Keywords "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT", and
-   "MAY" that appear in this document are to be interpreted as described
-   in [RFC2119].
-
-   We define some additional terms here:
-
-   SHOULD+    This term means the same as SHOULD.  However, it is likely
-              that an algorithm marked as SHOULD+ will be promoted at
-              some future time to be a MUST.
-
-   SHOULD-    This term means the same as SHOULD.  However, an algorithm
-              marked as SHOULD- may be deprecated to a MAY in a future
-              version of this document.
-
-   MUST-      This term means the same as MUST.  However, we expect at
-              some point that this algorithm will no longer be a MUST in
-              a future document.  Although its status will be determined
-              at a later time, it is reasonable to expect that if a
-              future revision of a document alters the status of a MUST-
-              algorithm, it will remain at least a SHOULD or a SHOULD-.
-
-
-
-
-
-Schiller                    Standards Track                     [Page 2]
-
-RFC 4307             IKEv2 Cryptographic Algorithms        December 2005
-
-
-3.  Algorithm Selection
-
-3.1.  IKEv2 Algorithm Selection
-
-3.1.1.  Encrypted Payload Algorithms
-
-   The IKEv2 Encrypted Payload requires both a confidentiality algorithm
-   and an integrity algorithm.  For confidentiality, implementations
-   MUST- implement 3DES-CBC and SHOULD+ implement AES-128-CBC.  For
-   integrity, HMAC-SHA1 MUST be implemented.
-
-3.1.2.  Diffie-Hellman Groups
-
-   There are several Modular Exponential (MODP) groups that are defined
-   for use in IKEv2.  They are defined in both the [IKEv2] base document
-   and in the MODP extensions document.  They are identified by group
-   number.  Any groups not listed here are considered as "MAY be
-   implemented".
-
-      Group Number        Bit Length            Status     Defined
-      2                   1024 MODP Group       MUST-      [RFC2409]
-      14                  2048 MODP Group       SHOULD+    [RFC3526]
-
-3.1.3.  IKEv2 Transform Type 1 Algorithms
-
-   IKEv2 defines several possible algorithms for Transfer Type 1
-   (encryption).  These are defined below with their implementation
-   status.
-
-      Name                     Number    Defined In      Status
-      RESERVED                 0
-      ENCR_3DES                3         [RFC2451]       MUST-
-      ENCR_NULL                11        [RFC2410]       MAY
-      ENCR_AES_CBC             12        [AES-CBC]       SHOULD+
-      ENCR_AES_CTR             13        [AES-CTR]       SHOULD
-
-3.1.4.  IKEv2 Transform Type 2 Algorithms
-
-   Transfer Type 2 Algorithms are pseudo-random functions used to
-   generate random values when needed.
-
-      Name                Number     Defined In   Status
-      RESERVED            0
-      PRF_HMAC_MD5        1          [RFC2104]    MAY
-      PRF_HMAC_SHA1       2          [RFC2104]    MUST
-      PRF_AES128_CBC      4          [AESPRF]     SHOULD+
-
-
-
-
-
-Schiller                    Standards Track                     [Page 3]
-
-RFC 4307             IKEv2 Cryptographic Algorithms        December 2005
-
-
-3.1.5.  IKEv2 Transform Type 3 Algorithms
-
-   Transfer Type 3 Algorithms are Integrity algorithms used to protect
-   data against tampering.
-
-      Name                     Number       Defined In           Status
-      NONE                     0
-      AUTH_HMAC_MD5_96         1            [RFC2403]            MAY
-      AUTH_HMAC_SHA1_96        2            [RFC2404]            MUST
-      AUTH_AES_XCBC_96         5            [AES-MAC]            SHOULD+
-
-4.  Security Considerations
-
-   The security of cryptographic-based systems depends on both the
-   strength of the cryptographic algorithms chosen and the strength of
-   the keys used with those algorithms.  The security also depends on
-   the engineering of the protocol used by the system to ensure that
-   there are no non-cryptographic ways to bypass the security of the
-   overall system.
-
-   This document concerns itself with the selection of cryptographic
-   algorithms for the use of IKEv2, specifically with the selection of
-   "mandatory-to-implement" algorithms.  The algorithms identified in
-   this document as "MUST implement" or "SHOULD implement" are not known
-   to be broken at the current time, and cryptographic research so far
-   leads us to believe that they will likely remain secure into the
-   foreseeable future.  However, this isn't necessarily forever.  We
-   would therefore expect that new revisions of this document will be
-   issued from time to time that reflect the current best practice in
-   this area.
-
-5.  Normative References
-
-   [RFC2409]    Harkins, D. and D. Carrel, "The Internet Key Exchange
-                (IKE)", RFC 2409, November 1998.
-
-   [IKEv2]      Kaufman, C., Ed., "Internet Key Exchange (IKEv2)
-                Protocol", RFC 4306, December 2005.
-
-   [RFC2119]    Bradner, S., "Key words for use in RFCs to Indicate
-                Requirement Levels", BCP 14, RFC 2119, March 1997.
-
-   [RFC3526]    Kivinen, T. and M. Kojo, "More Modular Exponential
-                (MODP) Diffie-Hellman groups for Internet Key Exchange
-                (IKE)", RFC 3526, May 2003.
-
-   [RFC2451]    Pereira, R. and R. Adams, "The ESP CBC-Mode Cipher
-                Algorithms", RFC 2451, November 1998.
-
-
-
-Schiller                    Standards Track                     [Page 4]
-
-RFC 4307             IKEv2 Cryptographic Algorithms        December 2005
-
-
-   [RFC2410]    Glenn, R. and S. Kent, "The NULL Encryption Algorithm
-                and Its Use With IPsec", RFC 2410, November 1998.
-
-   [AES-CBC]    Frankel, S., Glenn, R., and S. Kelly, "The AES-CBC
-                Cipher Algorithm and Its Use with IPsec", RFC 3602,
-                September 2003.
-
-   [AES-CTR]    Housley, R., "Using Advanced Encryption Standard (AES)
-                Counter Mode With IPsec Encapsulating Security Payload
-                (ESP)", RFC 3686, January 2004.
-
-   [RFC2104]    Krawczyk, H., Bellare, M., and R. Canetti, "HMAC:
-                Keyed-Hashing for Message Authentication", RFC 2104,
-                February 1997.
-
-   [AESPRF]     Hoffman, P., "The AES-XCBC-PRF-128 Algorithm for the
-                Internet Key Exchange Protocol (IKE)", RFC 3664, January
-                2004.
-
-   [RFC2403]    Madson, C. and R. Glenn, "The Use of HMAC-MD5-96 within
-                ESP and AH", RFC 2403, November 1998.
-
-   [RFC2404]    Madson, C. and R. Glenn, "The Use of HMAC-SHA-1-96
-                within ESP and AH", RFC 2404, November 1998.
-
-   [AES-MAC]    Frankel, S. and H. Herbert, "The AES-XCBC-MAC-96
-                Algorithm and Its Use With IPsec", RFC 3566, September
-                2003.
-
-Author's Address
-
-   Jeffrey I. Schiller
-   Massachusetts Institute of Technology
-   Room W92-190
-   77 Massachusetts Avenue
-   Cambridge, MA 02139-4307
-   USA
-
-   Phone: +1 (617) 253-0161
-   EMail: jis@mit.edu
-
-
-
-
-
-
-
-
-
-
-
-Schiller                    Standards Track                     [Page 5]
-
-RFC 4307             IKEv2 Cryptographic Algorithms        December 2005
-
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society (2005).
-
-   This document is subject to the rights, licenses and restrictions
-   contained in BCP 78, and except as set forth therein, the authors
-   retain all their rights.
-
-   This document and the information contained herein are provided on an
-   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
-   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
-   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
-   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
-   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
-   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-Intellectual Property
-
-   The IETF takes no position regarding the validity or scope of any
-   Intellectual Property Rights or other rights that might be claimed to
-   pertain to the implementation or use of the technology described in
-   this document or the extent to which any license under such rights
-   might or might not be available; nor does it represent that it has
-   made any independent effort to identify any such rights.  Information
-   on the procedures with respect to rights in RFC documents can be
-   found in BCP 78 and BCP 79.
-
-   Copies of IPR disclosures made to the IETF Secretariat and any
-   assurances of licenses to be made available, or the result of an
-   attempt made to obtain a general license or permission for the use of
-   such proprietary rights by implementers or users of this
-   specification can be obtained from the IETF on-line IPR repository at
-   http://www.ietf.org/ipr.
-
-   The IETF invites any interested party to bring to its attention any
-   copyrights, patents or patent applications, or other proprietary
-   rights that may cover technology that may be required to implement
-   this standard.  Please address the information to the IETF at ietf-
-   ipr@ietf.org.
-
-Acknowledgement
-
-   Funding for the RFC Editor function is currently provided by the
-   Internet Society.
-
-
-
-
-
-
-
-Schiller                    Standards Track                     [Page 6]
-
diff --git a/doc/ikev2/[Thomas03] - IPSec Architektur und Protokolle, Internet Key Exchange (IKE).pdf b/doc/ikev2/[Thomas03] - IPSec Architektur und Protokolle, Internet Key Exchange (IKE).pdf
deleted file mode 100644
index b8eb665e0..000000000
--- a/doc/ikev2/[Thomas03] - IPSec Architektur und Protokolle, Internet Key Exchange (IKE).pdf
+++ /dev/null
diff --git a/doc/impl.notes b/doc/impl.notes
deleted file mode 100644
index 6ea3678b6..000000000
--- a/doc/impl.notes
+++ /dev/null
@@ -1,127 +0,0 @@
-Introduction
-
-This document is some quick notes to sophisticated implementors, on topics
-which are a bit too arcane to be mentioned in the install instructions.
-Beware that it is not updated very often, and may be behind the times.
-This file is RCSID $Id: impl.notes,v 1.1 2004/03/15 20:35:21 as Exp $
-
-
-
-Where are things?
-
-If your kernel sources are not located in /usr/src/linux, or local manual
-pages are not in /usr/local/man/man[1-8], you've got a problem.  You may
-be able to get around it to some extent just by modifying the top-level
-Makefile, but we don't promise.  For a different manpage location, that
-will probably suffice; for a different kernel location, probably not. 
-We'd welcome reports of what needs to be fixed for this. 
-
-
-
-Cross-compiling
-
-At the moment, this distribution makes no attempt to support building
-the software on one machine for use on another.  That's hard, especially
-since the Linux kernel sources are not set up for it at all.
-
-
-
-One thing at a time
-
-(CAUTION:  This is somewhat outdated.  It's retained because it may be a
-useful guide for experts.  Consult the Makefile for current details.)
-
-If you want to do the build and install one step at a time, instead of
-using the prepackaged make commands like "make menugo", do the following
-instead.  (We do things in a slightly different order here, to avoid
-unnecessary directory changing.)
-
-To fit the kernel part of KLIPS into the kernel sources, do:
-
-	make insert
-
-(This makes a symbolic link /usr/src/linux/net/ipsec, pointing to the
-KLIPS source directory.  It patches some kernel files, where necessary, to
-know about KLIPS and/or to fix bugs.  It adds a default configuration to
-the kernel configuration file.  Finally, it makes the KLIPS communication
-file, /dev/ipsec, if it's not already there.)
-
-Build the libraries, Pluto, and various user-level utilities: 
-
-	make programs
-
-Install the Pluto daemon and user-level utilities, and set things up for
-boot-time startup:
-
-	make install
-
-Configure the kernel:
-
-	cd /usr/src/linux
-	make menuconfig          # (or xconfig, or whatever)
-
-See the configuration step of INSTALL for details of what to do within
-the configuration program.  Don't forget to save the results.
-
-Go through the usual kernel make process (still in /usr/src/linux):
-
-	make dep clean zImage
-
-Caution:  the Linux kernel Makefiles are not always careful about checking
-for errors.  We recommend capturing the output of this step and searching
-it for any occurrence of "error", "Error", etc.  The details of how to do
-so are unfortunately somewhat shell-dependent, although if you are using
-the standard shell (rather than csh, tcsh, etc.), this would do:
-
-	make dep clean zImage 2>&1 | tee junk
-	egrep -i error junk		# no output is good output
-
-(One glitch here is that the word "error" can sometimes occur legitimately
-in the make output.  For example, the kernel math emulation package has a
-source file "errors.c".  Some judgement is required to ignore such false
-alarms.)  The prepackaged make commands do all this for you.
-
-If your kernel is using loadable modules, you'll also need to do:
-
-	make modules
-
-Now you need to install the resulting kernel.  If you're not using the
-kernel's "make install" -- many people aren't -- then you need to do your
-usual install procedure.  You might want to read doc/kernel.notes, which
-recounts some of our experiences with RedHat 5.2 kernel installation in
-particular.
-
-If "make install" is good enough for you, then: 
-
-	make install
-
-(Same comments on error checking as in previous step.)  If your kernel is
-using loadable modules, you'll also need to do: 
-
-	make modules_install
-
-Finally, go back to INSTALL for the remaining steps.
-
-
-
-Klips as a module
-
-It is possible to run Klips as a kernel module, meaning that it does not
-have to be loaded until needed.  Formerly this was necessary, in fact,
-because Klips wouldn't run any other way.  Now it will, and we recommend
-static linking ("y", not "m", to the configuration question) for security.
-Klips is not terribly large (tens of KB, not hundreds) and should not
-cause size problems unless your kernel is already pushing the limits.
-
-However, Klips does still run as a module, if you want (although beware
-that we don't test this option very often).  "ipsec setup start" and
-"ipsec setup stop" load and unload it as appropriate, and you should not
-need to do anything about that yourself.
-
-
-
-Old Red Hats
-
-Our development is currently on a mix of Red Hat 6.2 and 7.1, with 6.2
-fading fast.  Our older Red Hats have been retired, and although FreeS/WAN
-should still work on them, we no longer make any attempt to ensure that. 
diff --git a/doc/index.html b/doc/index.html
deleted file mode 100644
index 427ed7ea7..000000000
--- a/doc/index.html
+++ /dev/null
@@ -1,55 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>FreeS/WAN index</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, encryption, cryptography, FreeS/WAN, FreeSWAN">
-  <!--
-
-  Written by Claudia Schmeing for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: index.html,v 1.1 2004/03/15 20:35:21 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:21 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1>FreeS/WAN documentation</h1>
-
-<ul>
-  <li><a href="intro.html">Introduction</a></li>
-  <li><a href="upgrading.html">Upgrading to 2.x</a></li>
-</ul>
-
-<ul> 
-  <li><a href="quickstart.html">Quickstart guide to Opportunistic Encryption</a></li>
-  <li><a href="install.html">Installing</a></li>
-  <li><a href="config.html">Configuring</a></li>
-  <li><a href="policygroups.html">Policy Groups</a> 
-                   </li>
-  <li><a href="interop.html">Interoperating</a> 
-<FONT COLOR="#FF0000">New and improved!</FONT></li>
-  <li><a href="faq.html">FAQ</a></li>
-  <li><a href="trouble.html">Troubleshooting and problem reporting</a></li>
-</ul>
-
-<ul>
-  <li><a href="toc.html">Full table of contents, with much more</a></li>
-  <li><a href="HowTo.html">All our docs as one big file</a></li>
-</ul>  
-
-<p>For technical support and other questions, use our <a
-href="mail.html">mailing lists</a>.</p>
-
-<pre>        This index last changed:    $Date: 2004/03/15 20:35:21 $</pre>
-
-</body>
-</html>
diff --git a/doc/install.html b/doc/install.html
deleted file mode 100644
index 6cd55535e..000000000
--- a/doc/install.html
+++ /dev/null
@@ -1,286 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="adv_config.html">Previous</A>
-<A HREF="config.html">Next</A>
-<HR>
-<H1><A name="install">Installing FreeS/WAN</A></H1>
-<P>This document will teach you how to install Linux FreeS/WAN. If your
- distribution comes with Linux FreeS/WAN, we offer tips to get you
- started.</P>
-<H2><A NAME="15_1">Requirements</A></H2>
-<P>To install FreeS/WAN you must:</P>
-<UL>
-<LI>be running Linux with the 2.4 or 2.2 kernel series. See this<A HREF="http://www.freeswan.ca/download.php#contact">
- kernel compatibility table</A>.
-<BR>We also have experimental support for 2.6 kernels. Here are two
- basic approaches:
-<UL>
-<LI> install FreeS/WAN, including its<A HREF="ipsec.html#parts"> KLIPS</A>
- kernel code. This will remove the native IPsec stack and replace it
- with KLIPS.</LI>
-<LI> install the FreeS/WAN<A HREF="ipsec.html#parts"> userland tools</A>
- (keying daemon and supporting scripts) for use with<A HREF="http://lartc.org/howto/lartc.ipsec.html">
- 2.6 kernel native IPsec</A>,</LI>
-</UL>
- See also these<A HREF="2.6.known-issues"> known issues with 2.6</A>.</LI>
-<LI>have root access to your Linux box</LI>
-<LI>choose the version of FreeS/WAN you wish to install based on<A HREF="http://www.freeswan.org/mail.html">
- mailing list reports</A>
-<!-- or 
-our updates page (coming soon)-->
-</LI>
-</UL>
-<H2><A NAME="15_2">Choose your install method</A></H2>
-<P>There are three basic ways to get FreeS/WAN onto your system:</P>
-<UL>
-<LI>activating and testing a FreeS/WAN that<A HREF="#distroinstall">
- shipped with your Linux distribution</A></LI>
-<LI><A HREF="#rpminstall">RPM install</A></LI>
-<LI><A HREF="#srcinstall">Install from source</A></LI>
-</UL>
-<A NAME="distroinstall"></A>
-<H2><A NAME="15_3">FreeS/WAN ships with some Linuxes</A></H2>
-<P>FreeS/WAN comes with<A HREF="intro.html#distwith"> these
- distributions</A>.</P>
-<P>If you're running one of these, include FreeS/WAN in the choices you
- make during installation, or add it later using the distribution's
- tools.</P>
-<H3><A NAME="15_3_1">FreeS/WAN may be altered...</A></H3>
-<P>Your distribution may have integrated extra features, such as Andreas
- Steffen's X.509 patch, into FreeS/WAN. It may also use custom startup
- script locations or directory names.</P>
-<H3><A NAME="15_3_2">You might need to create an authentication keypair</A>
-</H3>
-<P>If your FreeS/WAN came with your distribution, you may wish to
- generate a fresh RSA key pair. FreeS/WAN will use these keys for
- authentication.</P>
-<P> To do this, become root, and type:</P>
-<PRE>    ipsec newhostkey --output /etc/ipsec.secrets --hostname xy.example.com
-    chmod 600 /etc/ipsec.secrets</PRE>
-<P>where you replace xy.example.com with your machine's fully-qualified
- domain name. Generate some randomness, for example by wiggling your
- mouse, to speed the process.</P>
-<P>The resulting ipsec.secrets looks like:</P>
-<PRE>: RSA   {
-        # RSA 2192 bits   xy.example.com   Sun Jun 8 13:42:19 2003
-        # for signatures only, UNSAFE FOR ENCRYPTION
-        #pubkey=0sAQOFppfeE3cC7wqJi...
-        Modulus: 0x85a697de137702ef0...
-        # everything after this point is secret
-        PrivateExponent: 0x16466ea5033e807...
-        Prime1: 0xdfb5003c8947b7cc88759065...
-        Prime2: 0x98f199b9149fde11ec956c814...
-        Exponent1: 0x9523557db0da7a885af90aee...
-        Exponent2: 0x65f6667b63153eb69db8f300dbb...
-        Coefficient: 0x90ad00415d3ca17bebff123413fc518...
-        }
-# do not change the indenting of that &quot;}&quot;</PRE>
-<P>In the actual file, the strings are much longer.</P>
-<H3><A NAME="15_3_3">Start and test FreeS/WAN</A></H3>
-<P>You can now<A HREF="install.html#starttest"> start FreeS/WAN and test
- whether it's been successfully installed.</A>.</P>
-<A NAME="rpminstall"></A>
-<H2><A NAME="15_4">RPM install</A></H2>
-<P>These instructions are for a recent Red Hat with a stock Red Hat
- kernel. We know that Mandrake and SUSE also produce FreeS/WAN RPMs. If
- you're running either, install using your distribution's tools.</P>
-<H3><A NAME="15_4_1">Download RPMs</A></H3>
-<P>Decide which functionality you need:</P>
-<UL>
-<LI>standard FreeS/WAN RPMs. Use these shortcuts:
-<BR>
-<UL>
-<LI>(for 2.6 kernels: userland only)
-<BR> ncftpget
- ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs/\*userland*
-</LI>
-<LI>(for 2.4 kernels)
-<BR> ncftpget
- ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs/`uname -r
- | tr -d 'a-wy-z'`/\*</LI>
-<LI> or view all the offerings at our<A href="ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs">
- FTP site</A>.</LI>
-</UL>
-</LI>
-<LI>unofficial<A href="http://www.freeswan.ca/download.php"> Super
- FreeS/WAN</A> RPMs, which include Andreas Steffen's X.509 patch and
- more. Super FreeS/WAN RPMs do not currently include<A HREF="glossary.html#NAT.gloss">
- Network Address Translation</A> (NAT) traversal, but Super FreeS/WAN
- source does.</LI>
-</UL>
-<A NAME="2.6.rpm"></A>
-<P>For 2.6 kernels, get the latest FreeS/WAN userland RPM, for example:</P>
-<PRE>    freeswan-userland-2.04.9-0.i386.rpm</PRE>
-<P>Note: FreeS/WAN's support for 2.6 kernel IPsec is preliminary. Please
- see<A HREf="2.6.known-issues"> 2.6.known-issues</A>, and the latest<A HREF="http://www.freeswan.org/mail.html">
- mailing list reports</A>.</P>
-<P>Change to your new FreeS/WAN directory, and make and install the</P>
-<P>For 2.4 kernels, get both kernel and userland RPMs. Check your kernel
- version with</P>
-<PRE>    uname -r</PRE>
-<P>Get a kernel module which matches that version. For example:</P>
-<PRE>    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm</PRE>
-<P>Note: These modules<B> will only work on the Red Hat kernel they were
- built for</B>, since they are very sensitive to small changes in the
- kernel.</P>
-<P>Get FreeS/WAN utilities to match. For example:</P>
-<PRE>    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm</PRE>
-<H3><A NAME="15_4_2">For freeswan.org RPMs: check signatures</A></H3>
-<P>While you're at our ftp site, grab the RPM signing key</P>
-<PRE>    freeswan-rpmsign.asc</PRE>
-<P>If you're running RedHat 8.x or later, import this key into the RPM
- database:</P>
-<PRE>    rpm --import freeswan-rpmsign.asc</PRE>
-<P>For RedHat 7.x systems, you'll need to add it to your<A HREF="glossary.html#PGP">
- PGP</A> keyring:</P>
-<PRE>    pgp -ka freeswan-rpmsign.asc</PRE>
-<P>Check the digital signatures on both RPMs using:</P>
-<PRE>    rpm --checksig freeswan*.rpm </PRE>
-<P>You should see that these signatures are good:</P>
-<PRE>    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm: pgp md5 OK
-    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm: pgp md5 OK</PRE>
-<H3><A NAME="15_4_3">Install the RPMs</A></H3>
-<P>Become root:</P>
-<PRE>    su</PRE>
-<P>For a first time install, use:</P>
-<PRE>    rpm -ivh freeswan*.rpm</PRE>
-<P>To upgrade existing RPMs (and keep all .conf files in place), use:</P>
-<PRE>    rpm -Uvh freeswan*.rpm</PRE>
-<P>If you're upgrading from FreeS/WAN 1.x to 2.x RPMs, and encounter
- problems, see<A HREF="upgrading.html#upgrading.rpms"> this note</A>.</P>
-<H3><A NAME="15_4_4">Start and Test FreeS/WAN</A></H3>
-<P>Now,<A HREF="install.html#starttest"> start FreeS/WAN and test your
- install</A>.</P>
-<A NAME="srcinstall"></A>
-<H2><A NAME="15_5">Install from Source</A></H2>
-
-<!-- Most of this section, along with "Start and Test", can replace 
-INSTALL. -->
-<H3><A NAME="15_5_1">Decide what functionality you need</A></H3>
-<P>Your choices are:</P>
-<UL>
-<LI><A HREF="ftp://ftp.xs4all.nl/pub/crypto/freeswan">standard FreeS/WAN</A>
-,</LI>
-<LI>standard FreeS/WAN plus any of these<A HREF="web.html#patch">
- user-supported patches</A>, or</LI>
-<LI><A HREF="http://www.freeswan.ca/download">Super FreeS/WAN</A>, an
- unofficial FreeS/WAN pre-patched with many of the above. Provides
- additional algorithms, X.509, SA deletion, dead peer detection, and<A HREF="glossary.html#NAT.gloss">
- Network Address Translation</A> (NAT) traversal.</LI>
-</UL>
-<H3><A NAME="15_5_2">Download FreeS/WAN</A></H3>
-<P>Download the source tarball you've chosen, along with any patches.</P>
-<H3><A NAME="15_5_3">For freeswan.org source: check its signature</A></H3>
-<P>While you're at our ftp site, get our source signing key</P>
-<PRE>    freeswan-sigkey.asc</PRE>
-<P>Add it to your PGP keyring:</P>
-<PRE>    pgp -ka freeswan-sigkey.asc</PRE>
-<P>Check the signature using:</P>
-<PRE>    pgp freeswan-2.04.tar.gz.sig freeswan-2.04.tar.gz</PRE>
-<P>You should see something like:</P>
-<PRE>    Good signature from user &quot;Linux FreeS/WAN Software Team (build@freeswan.org)&quot;.
-    Signature made 2002/06/26 21:04 GMT using 2047-bit key, key ID 46EAFCE1</PRE>
-
-<!-- Note to self: build@freeswan.org has angled brackets in the original.
-     Changed because it conflicts with HTML tags. -->
-<H3><A NAME="15_5_4">Untar, unzip</A></H3>
-<P>As root, unpack your FreeS/WAN source into<VAR> /usr/src</VAR>.</P>
-<PRE>    su
-    mv freeswan-2.04.tar.gz /usr/src
-    cd /usr/src
-    tar -xzf freeswan-2.04.tar.gz
-</PRE>
-<H3><A NAME="15_5_5">Patch if desired</A></H3>
-<P>Now's the time to add any patches. The contributor may have special
- instructions, or you may simply use the patch command.</P>
-<H3><A NAME="15_5_6">... and Make</A></H3>
-<P>Choose one of the methods below.</P>
-<H4>Userland-only Install for 2.6 kernels</H4>
-<A NAME="2.6.src"></A>
-<P>Note: FreeS/WAN's support for 2.6 kernel IPsec is preliminary. Please
- see<A HREf="2.6.known-issues"> 2.6.known-issues</A>, and the latest<A HREF="http://www.freeswan.org/mail.html">
- mailing list reports</A>.</P>
-<P>Change to your new FreeS/WAN directory, and make and install the
- FreeS/WAN userland tools.</P>
-<PRE>    cd /usr/src/freeswan-2.04
-    make programs
-    make install</PRE>
-<P>Now,<A HREF="install.html#starttest"> start FreeS/WAN and test your
- install</A>.</P>
-<H4>KLIPS install for 2.2, 2.4, or 2.6 kernels</H4>
-<A NAME="modinstall"></A>
-<P>To make a modular version of KLIPS, along with other FreeS/WAN
- programs you'll need, use the command sequence below. This will change
- to your new FreeS/WAN directory, make the FreeS/WAN module (and other
- stuff), and install it all.</P>
-<PRE>    cd /usr/src/freeswan-2.04
-    make oldmod
-    make minstall</PRE>
-<P><A HREF="install.html#starttest">Start FreeS/WAN and test your
- install</A>.</P>
-<P>To link KLIPS statically into your kernel (using your old kernel
- settings), and install other FreeS/WAN components, do:</P>
-<PRE>    cd /usr/src/freeswan-2.04
-    make oldmod
-    make minstall</PRE>
-<P>Reboot your system and<A HREF="install.html#testonly"> test your
- install</A>.</P>
-<P>For other ways to compile KLIPS, see our Makefile.</P>
-<A name="starttest"></A>
-<H2><A NAME="15_6">Start FreeS/WAN and test your install</A></H2>
-<P>Bring FreeS/WAN up with:</P>
-<PRE>    service ipsec start</PRE>
-<P>This is not necessary if you've rebooted.</P>
-<A name="testonly"></A>
-<H2><A NAME="15_7">Test your install</A></H2>
-<P>To check that you have a successful install, run:</P>
-<PRE>    ipsec verify</PRE>
-<P>You should see at least:</P>
-<PRE>
-    Checking your system to see if IPsec got installed and started correctly
-    Version check and ipsec on-path                             [OK]
-    Checking for KLIPS support in kernel                        [OK]
-    Checking for RSA private key (/etc/ipsec.secrets)           [OK]
-    Checking that pluto is running                              [OK]
-</PRE>
-<P>If any of these first four checks fails, see our<A href="trouble.html#install.check">
- troubleshooting guide</A>.</P>
-<H2><A NAME="15_8">Making FreeS/WAN play well with others</A></H2>
-<P>There are at least a couple of things on your system that might
- interfere with FreeS/WAN, and now's a good time to check these:</P>
-<UL>
-<LI>Firewalling. You need to allow UDP 500 through your firewall, plus
- ESP (protocol 50) and AH (protocol 51). For more information, see our
- updated firewalls document (coming soon).</LI>
-<LI>Network address translation. Do not NAT the packets you will be
- tunneling.</LI>
-</UL>
-<H2><A NAME="15_9">Configure for your needs</A></H2>
-<P>You'll need to configure FreeS/WAN for your local site. Have a look
- at our<A HREF="quickstart.html"> opportunism quickstart guide</A> to
- see if that easy method is right for your needs. Or, see how to<A HREF="config.html">
- configure a network-to-network or Road Warrior style VPN</A>.</P>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="adv_config.html">Previous</A>
-<A HREF="config.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/interop.html b/doc/interop.html
deleted file mode 100644
index 1cd7b9e78..000000000
--- a/doc/interop.html
+++ /dev/null
@@ -1,983 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="compat.html">Previous</A>
-<A HREF="performance.html">Next</A>
-<HR>
-<A NAME="interop"></A>
-<H1><A NAME="10">Interoperating with FreeS/WAN</A></H1>
-<P>The FreeS/WAN project needs you! We rely on the user community to
- keep up to date. Mail users@lists.freeswan.org with your interop
- success stories.</P>
-<P><STRONG>Please note</STRONG>: Most of our interop examples feature
- Linux FreeS/WAN 1.x config files. You can convert them to 2.x files
- fairly easily with the patch in our<A HREF="upgrading.html#ipsec.conf_v2">
- Upgrading Guide</A>.</P>
-<H2><A NAME="10_1">Interop at a Glance</A></H2>
-<TABLE BORDER="1">
-<TR><TD>&nbsp;</TD><TD colspan="5">FreeS/WAN VPN</TD><TD>Road Warrior</TD><TD>
-OE</TD></TR>
-<TR><TD>&nbsp;</TD><TD>PSK</TD><TD>RSA Secret</TD><TD>X.509
-<BR><SMALL><A HREF="#interoprules">(requires patch)</A></SMALL></TD><TD>
-NAT-Traversal
-<BR><SMALL><A HREF="#interoprules">(requires patch)</A></SMALL></TD><TD>
-Manual
-<BR>Keying</TD><TD>&nbsp;</TD><TD>&nbsp;</TD></TR>
-<TR><TD colspan="8">More Compatible</TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="web.html#freeswan">FreeS/WAN</A><A NAME="freeswan.top">
- &nbsp;</A></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#isakmpd">isakmpd (OpenBSD)</A><A NAME="isakmpd.top"> &nbsp;</A>
-</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>
-<FONT color="#cc0000">No&nbsp;&nbsp;&nbsp;&nbsp;</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#kame">Kame (FreeBSD,
-<BR> NetBSD, MacOSX)
-<BR> <SMALL>aka racoon</SMALL></A><A NAME="kame.top"> &nbsp;</A></TD><TD><FONT
-color="#00cc00">Yes</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#mcafee">McAfee VPN
-<BR><SMALL>was PGPNet</SMALL></A><A NAME="mcafee.top"> &nbsp;</A></TD><TD><FONT
-color="#00cc00">Yes</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#microsoft">Microsoft
-<BR> Windows 2000/XP</A><A NAME="microsoft.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#cc0000">
-No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="glossary.html#ssh">SSH Sentinel</A><A NAME="ssh.top"> &nbsp;</A>
-</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#cccc00">Maybe</FONT></TD><TD>&nbsp;</TD><TD><FONT
-color="#00cc00">Yes</FONT></TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#safenet">Safenet SoftPK
-<BR>/SoftRemote</A><A NAME="safenet.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#cc0000">
-No</FONT></TD></TR>
-<TR><TD colspan="8">Other</TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#6wind">6Wind</A><A NAME="6wind.top"> &nbsp;</A></TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-<FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#alcatel">Alcatel Timestep</A><A NAME="alcatel.top"> &nbsp;</A>
-</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#apple">Apple Macintosh
-<BR>System 10+</A><A NAME="apple.top"> &nbsp;</A></TD><TD><FONT color="#cccc00">
-Maybe</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#cccc00">
-Maybe</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#cccc00">Maybe</FONT></TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#ashleylaurent">AshleyLaurent
-<BR> VPCom</A><A NAME="ashleylaurent.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT
-color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#borderware">Borderware</A><A NAME="borderware.top"> &nbsp;</A>
-</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD><TD><FONT color="#cc0000">
-No</FONT></TD></TR>
-
-<!--
-http://www.cequrux.com/vpn-guides.php3
-"coming soon" guide to connect with FreeS/WAN.
--->
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#checkpoint">Check Point FW-1/VPN-1</A><A NAME="checkpoint.top">
- &nbsp;</A></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>
-<FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#cisco">Cisco with 3DES</A><A NAME="cisco.top"> &nbsp;</A></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#cccc00">Maybe</FONT>
-</TD><TD>&nbsp;</TD><TD><FONT color="#cccc00">Maybe</FONT></TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#equinux">Equinux VPN Tracker
-<BR> (for Mac OS X)</A><A NAME="equinux.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#cccc00">Maybe</FONT></TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#fsecure">F-Secure</A><A NAME="fsecure.top"> &nbsp;</A></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cccc00">
-Maybe</FONT></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#gauntlet">Gauntlet GVPN</A><A NAME="gauntlet.top"> &nbsp;</A>
-</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">
-No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#aix">IBM AIX</A><A NAME="aix.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#cccc00">Maybe</FONT></TD><TD>
-&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#as400">IBM AS/400</A><A NAME="as400"> &nbsp;</A></TD><TD><FONT
-color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#intel">Intel Shiva
-<BR>LANRover/Net Structure</A><A NAME="intel.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT
-color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#lancom">LanCom (formerly ELSA)</A><A NAME="lancom.top">
- &nbsp;</A></TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#linksys">Linksys</A><A NAME="linksys.top"> &nbsp;</A></TD><TD>
-<FONT color="#cccc00">Maybe</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">
-No</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>
-<FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#lucent">Lucent</A><A NAME="lucent.top"> &nbsp;</A></TD><TD><FONT
-color="#cccc00">Partial</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#netasq">Netasq</A><A NAME="netasq.top"> &nbsp;</A></TD><TD>
-&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#netcelo">netcelo</A><A NAME="netcelo.top"> &nbsp;</A></TD><TD>
-&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#netgear">Netgear fvs318</A><A NAME="netgear.top"> &nbsp;</A>
-</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#netscreen">Netscreen 100
-<BR>or 5xp</A><A NAME="netscreen.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cccc00">
-Maybe</FONT></TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#nortel">Nortel Contivity</A><A NAME="nortel.top"> &nbsp;</A>
-</TD><TD><FONT color="#cccc00">Partial</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD><FONT color="#cccc00">Maybe</FONT></TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#radguard">RadGuard</A><A NAME="radguard.top"> &nbsp;</A></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#raptor">Raptor</A><A NAME="raptor"> &nbsp;</A></TD><TD><FONT
-color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#redcreek">Redcreek Ravlin</A><A NAME="redcreek.top"> &nbsp;</A>
-</TD><TD><FONT color="#00cc00">Yes</FONT><FONT color="#cccc00">/Partial</FONT>
-</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">
-No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#sonicwall">SonicWall</A><A NAME="sonicwall.top"> &nbsp;</A></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT
-color="#cccc00">Maybe</FONT></TD><TD><FONT color="#cc0000">No</FONT></TD><TD>
-<FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#sun">Sun Solaris</A><A NAME="sun.top"> &nbsp;</A></TD><TD><FONT
-color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT>
-</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT
-color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#symantec">Symantec</A><A NAME="symantec.top"> &nbsp;</A></TD><TD>
-<FONT color="#00cc00">Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>
-&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#watchguard">Watchguard
-<BR> Firebox</A><A NAME="watchguard.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD><FONT color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#xedia">Xedia Access Point
-<BR>/QVPN</A><A NAME="xedia.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT
-color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR><TD><A HREF="#zyxel">Zyxel Zywall
-<BR>/Prestige</A><A NAME="zyxel.top"> &nbsp;</A></TD><TD><FONT color="#00cc00">
-Yes</FONT></TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD>&nbsp;</TD><TD><FONT
-color="#cc0000">No</FONT></TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE
-
-
-<TR>
-<TD><A HREF="#sample">sample</A></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
--->
-<TR><TD>&nbsp;</TD><TD>PSK</TD><TD>RSA Secret</TD><TD>X.509
-<BR><SMALL><A HREF="#interoprules">(requires patch)</A></SMALL></TD><TD>
-NAT-Traversal
-<BR><SMALL><A HREF="#interoprules">(requires patch)</A></SMALL></TD><TD>
-Manual
-<BR>Keying</TD><TD>&nbsp;</TD><TD>&nbsp;</TD></TR>
-<TR><TD>&nbsp;</TD><TD colspan="5">FreeS/WAN VPN</TD><TD>Road Warrior</TD><TD>
-OE</TD></TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-</TABLE>
-<H3><A NAME="10_1_1">Key</A></H3>
-<TABLE BORDER="1">
-<TR><TD><FONT color="#00cc00">Yes</FONT></TD><TD>People report that this
- works for them.</TD></TR>
-<TR><TD>[Blank]</TD><TD>We don't know.</TD></TR>
-<TR><TD><FONT color="#cc0000">No</FONT></TD><TD>We have reason to
- believe it was, at some point, not possible to get this to work.</TD></TR>
-<TR><TD><FONT color="#cccc00">Partial</FONT></TD><TD>Partial success.
- For example, a connection can be created from one end only.</TD></TR>
-<TR><TD><FONT color="#00cc00">Yes</FONT><FONT color="#cccc00">/Partial</FONT>
-</TD><TD>Mixed reports.</TD></TR>
-<TR><TD><FONT color="#cccc00">Maybe</FONT></TD><TD>We think the answer
- is &quot;yes&quot;, but need confirmation.</TD></TR>
-</TABLE>
-<A NAME="interoprules"></A>
-<H2><A NAME="10_2">Basic Interop Rules</A></H2>
-<P>Vanilla FreeS/WAN implements<A HREF="compat.html#compat"> these parts</A>
- of the IPSec specifications. You can add more with<A HREF="http://www.freeswan.ca">
- Super FreeS/WAN</A>, but what we offer may be enough for many users.</P>
-<UL>
-<LI> To use X.509 certificates with FreeS/WAN, you will need the<A HREF="http://www.strongsec.org/freeswan">
- X.509 patch</A> or<A HREF="http://www.freeswan.ca"> Super FreeS/WAN</A>
-, which includes that patch.</LI>
-<LI> To use<A HREF="glossary.html#NAT.gloss"> Network Address
- Translation</A> (NAT) traversal with FreeS/WAN, you will need Arkoon
- Network Security's<A HREF="http://open-source.arkoon.net"> NAT
- traversal patch</A> or<A HREF="http://www.freeswan.ca"> Super FreeS/WAN</A>
-, which includes it.</LI>
-</UL>
-<P>We offer a set of proposals which is not user-adjustable, but covers
- all combinations that we can offer. FreeS/WAN always proposes triple
- DES encryption and Perfect Forward Secrecy (PFS). In addition, we
- propose Diffie Hellman groups 5 and 2 (in that order), and MD5 and
- SHA-1 hashes. We accept the same proposals, in the same order of
- preference.</P>
-<P>Other interop notes:</P>
-<UL>
-<LI> A<A HREF="http://lists.freeswan.org/archives/users/2003-September/msg00462.html">
- SHA-1 bug in FreeS/WAN 2.00, 2.01 and 2.02</A> may affect some interop
- scenarios. It does not affect 1.x versions, and is fixed in 2.03 and
- later.</LI>
-<LI> Some other implementations will close a connection with FreeS/WAN
- after some time. This may be a problem with rekey lifetimes. Please see<A
-HREF="http://lists.freeswan.org/archives/users/2003-October/msg00293.html">
- this tip</A> and<A HREF="http://lists.freeswan.org/pipermail/users/2001-December/005758.html">
- this workaround</A>.</LI>
-</UL>
-<H2><A NAME="10_3">Longer Stories</A></H2>
-<H3><A NAME="10_3_1">For<EM> More Compatible</EM> Implementations</A></H3>
-<H4><A NAME="freeswan">FreeS/WAN</A></H4>
-<P> See our documentation at<A HREF="http://www.freeswan.org">
- freeswan.org</A> and the Super FreeS/WAN docs at<A HREF="http://www.freeswan.ca">
- freeswan.ca</A>. Some user-written HOWTOs for FreeS/WAN-FreeS/WAN
- connections are listed in<A HREF="intro.html#howto"> our Introduction</A>
-.</P>
-<P>See also:</P>
-<UL>
-<LI><A HREF="http://lugbe.ch/action/reports/ipsec_htbe.phtml"> A German
- FreeS/WAN-FreeS/WAN page by Markus Wernig (X.509)</A></LI>
-</UL>
-<P><A HREF="#freeswan.top">Back to chart</A></P>
-<H4><A NAME="isakmpd">isakmpd (OpenBSD)</A></H4>
-<P><A HREF="http://www.openbsd.org/faq/faq13.html">OpenBSD FAQ: Using
- IPsec</A>
-<BR><A HREF="http://www.rommel.stw.uni-erlangen.de/~hshoexer/ipsec-howto/HOWTO.html">
- Hans-Joerg Hoexer's interop Linux-OpenBSD (PSK)</A>
-<BR><A HREF="http://www.segfault.net/ipsec/"> Skyper's configuration
- (PSK)</A>
-<BR><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
- French page with configs (X.509)</A></P>
-<P><A HREF="#isakmpd.top">Back to chart</A></P>
-<H4><A NAME="kame">Kame</A></H4>
-<UL>
-<LI>For FreeBSD and NetBSD. Ships with Mac OS X; see also our<A HREF="#apple">
- Mac</A> section.</LI>
-<LI>Also known as<EM> racoon</EM>, its keying daemon.</LI>
-</UL>
-<P><A HREF="http://www.kame.net">Kame homepage, with FAQ</A>
-<BR><A HREF="http://www.netbsd.org/Documentation/network/ipsec">
- NetBSD's IPSec FAQ</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/12/msg00560.html">
- Ghislaine's post explaining some interop peculiarities</A></P>
-<P><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/09/msg00511.html">
- Itojun's Kame-FreeS/WAN interop tips (PSK)</A>
-<BR><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2000"> Ghislaine
- Labouret's French page with links to matching FreeS/WAN and Kame
- configs (RSA)</A>
-<BR><A HREF="http://lugbe.ch/lostfound/contrib/freebsd_router/"> Markus
- Wernig's HOWTO (X.509, BSD gateway)</A>
-<BR><A HREF="http://web.morgul.net/~frodo/docs/kame+freeswan_interop.html">
- Frodo's Kame-FreeS/WAN interop (X.509)</A>
-<BR><A HREF="http://www.wavesec.org/kame.phtml"> Kame as a WAVEsec
- client.</A></P>
-<P><A HREF="#kame.top">Back to chart</A></P>
-<H4><A NAME="mcafee">PGPNet/McAfee</A></H4>
-<P></P>
-<UL>
-<LI>Now called McAfee VPN Client.</LI>
-<LI>PGPNet also came in a freeware version which did not support subnets</LI>
-<LI>To support dhcp-over-ipsec, you need the X.509 patch, which is
- included in<A HREF="http://www.freeswan.ca"> Super FreeS/WAN</A>.</LI>
-</UL>
-<P><A HREF="http://www.freeswan.ca/docs/WindowsInterop"> Tim Carr's
- Windows Interop Guide (X.509)</A>
-<BR><A HREF="http://www.rommel.stw.uni-erlangen.de/~hshoexer/ipsec-howto/HOWTO.html#Interop2">
- Hans-Joerg Hoexer's Guide for Linux-PGPNet (PSK)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/04/msg00339.html">
- Kai Martius' instructions using RSA Key-Extractor Tool (RSA)</A>
-<BR> &nbsp;&nbsp;&nbsp;&nbsp;<A HREF="http://www.zengl.net/freeswan/english.html">Christian
- Zeng's page (RSA)</A> based on Kai's work. English or German.
-<BR><A HREF="http://tirnanog.ls.fi.upm.es/CriptoLab/Biblioteca/InfTech/InfTech_CriptoLab.htm">
- Oscar Delgado's PDF (X.509, no configs)</A>
-<BR><A HREF="http://www-ec.njit.edu/~rxt1077/Howto.txt"> Ryan's HOWTO
- for FreeS/WAN-PGPNet (X.509)</A>. Through a Linksys Router with IPsec
- Passthru enabled.
-<BR><A HREF="http://jixen.tripod.com/#RW-PGP-to-Fwan"> Jean-Francois
- Nadeau's Practical Configuration (Road Warrior with PSK)</A>
-<BR><A HREF="http://www.evolvedatacom.nl/freeswan.html#toc"> Wouter
- Prins' HOWTO (Road Warrior with X.509)</A>
-<BR></P>
-<P><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/01/msg00271.html">
- Rekeying problem with FreeS/WAN and older PGPNets</A>
-<BR></P>
-<P><A HREF="http://www.strongsec.com/freeswan/dhcprelay/index.htm"> DHCP
- over IPSEC HOWTO for FreeS/WAN (requires X.509 and dhcprelay patches)</A>
-</P>
-<P><A HREF="#mcafee.top">Back to chart</A></P>
-<H4><A NAME="microsoft">Microsoft Windows 2000/XP</A></H4>
-<UL>
-<LI>IPsec comes with Win2k, and with XP Support Tools. May require<A HREF="http://www.microsoft.com/windows2000/downloads/recommended/encryption/default.asp">
- High Encryption Pack</A>. WinXP users have also reported better results
- with Service Pack 1.</LI>
-<LI>The Road Warrior setup works either way round. Windows (XP or 2K)
- IPsec can connect as a Road Warrior to FreeS/WAN. However, FreeS/WAN
- can also successfully connect as a Road Warrior to Windows IPsec (see
- Nate Carlson's configs below).</LI>
-<LI>FreeS/WAN version 1.92 or later is required to avoid an
- interoperation problem with Windows native IPsec. Earlier FreeS/WAN
- versions did not process the Commit Bit as Windows native IPsec
- expected.</LI>
-</UL>
-<P><A HREF="http://www.freeswan.ca/docs/WindowsInterop"> Tim Carr's
- Windows Interop Guide (X.509)</A>
-<BR><A HREF="http://ipsec.math.ucla.edu/services/ipsec.html"> James
- Carter's instructions (X.509, NAT-T)</A>
-<BR><A HREF="http://jixen.tripod.com/#Win2000-Fwan"> Jean-Francois
- Nadeau's Net-net Configuration (PSK)</A>
-<BR><A HREF="http://security.nta.no/freeswan-w2k.html"> Telenor's
- Node-node Config (Transport-mode PSK)</A>
-<BR><A HREF="http://vpn.ebootis.de"> Marcus Mueller's HOWTO using his
- VPN config tool (X.509).</A> Tool also works with PSK.
-<BR><A HREF="http://www.natecarlson.com/include/showpage.php?cat=linux&page=ipsec-x509">
- Nate Carlson's HOWTO using same tool (Road Warrior with X.509)</A>.
- Unusually, FreeS/WAN is the Road Warrior here.
-<BR><A HREF="http://tirnanog.ls.fi.upm.es/CriptoLab/Biblioteca/InfTech/InfTech_CriptoLab.htm">
- Oscar Delgado's PDF (X.509, no configs)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2003-July/022425.html">
- Tim Scannell's Windows XP Additional Checklist (X.509)</A>
-<BR></P>
-
-<!-- Note to self: Include L2TP references? -->
-<P><A HREF="http://www.microsoft.com/windows2000/en/server/help/default.asp?url=/windows2000/en/server/help/sag_TCPIP_ovr_secfeatures.htm">
- Microsoft's page on Win2k TCP/IP security features</A>
-<BR><A HREF="http://support.microsoft.com/support/kb/articles/Q257/2/25.ASP">
- Microsoft's Win2k IPsec debugging tips</A>
-<BR>
-<!-- Alt-URL http://support.microsoft.com/default.aspx?scid=kb;EN-US;q257225
-Perhaps newer? -->
-<A HREF="http://www.wired.com/news/technology/0,1282,36336,00.html">
- MS VPN may fall back to 1DES</A></P>
-<P><A HREF="#microsoft.top">Back to chart</A></P>
-<H4><A NAME="ssh">SSH Sentinel</A></H4>
-<UL>
-<LI>Popular and well tested.</LI>
-<LI>Also rebranded in<A HREF="http://www.zyxel.com"> Zyxel Zywall</A>.
- Our Zyxel interop notes are<A HREF="#zyxel"> here</A>.</LI>
-<LI> SSH supports IPsec-over-UDP NAT traversal.</LI>
-<LI>There is this<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/12/msg00370.html">
- potential problem</A> if you're not using the Legacy Proposal option.</LI>
-</UL>
-<P><A HREF="http://www.ssh.com/support/sentinel/documents.cfm"> SSH's
- Sentinel-FreeSWAN interop PDF (X.509)</A>
-<BR><A HREF="http://www.nadmm.com/show.php?story=articles/vpn.inc">
- Nadeem Hassan's SUSE-to-Sentinel article (Road warrior with X.509)</A>
-<BR><A HREF="http://www.zerozone.it/documents/Linux/HowTo/VPN-IPsec-Freeswan-HOWTO.html">
- O-Zone's Italian HOWTO (Road Warrior, X.509, DHCP)</A>
-<BR></P>
-<P><A HREF="#ssh.top">Back to chart</A></P>
-<H4><A NAME="safenet">Safenet SoftPK/SoftRemote</A></H4>
-<UL>
-<LI>People recommend SafeNet as a low cost Windows client.</LI>
-<LI>SoftRemote seems to be the newer name for SoftPK.</LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005061.html">
- Whit Blauvelt's SoftRemote tips</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-October/015591.html">
- Tim Wilson's tips (X.509)</A><A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00607.html">
- Workaround for a &quot;gotcha&quot;</A></P>
-<P><A HREF="http://jixen.tripod.com/#Rw-IRE-to-Fwan"> Jean-Francois
- Nadeau's Practical Configuration (Road Warrior with PSK)</A>
-<BR><A HREF="http://www.terradoncommunications.com/security/whitepapers/safe_net-to-free_swan.pdf">
- Terradon Communications' PDF (Road Warrior with PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-October/?????.html">
- Seaan.net's PDF (Road Warrior to Subnet, with PSK)</A>
-<BR><A HREF="http://www.redbaronconsulting.com/freeswan/fswansafenet.pdf">
- Red Baron Consulting's PDF (Road Warrior with X.509)</A></P>
-<P><A HREF="#safenet.top">Back to chart</A></P>
-<H3><A NAME="10_3_2">For<EM> Other Implementations</EM></A></H3>
-<H4><A NAME="6wind">6Wind</A></H4>
-<P><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
- French page with configs (X.509)</A></P>
-<P><A HREF="#6wind.top">Back to chart</A></P>
-<H4><A NAME="alcatel">Alcatel Timestep</A></H4>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-June/011878.html">
- Alain Sabban's settings (PSK or PSK road warrior; through static NAT)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/1999/06/msg00100.html">
- Derick Cassidy's configs (PSK)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/1999/08/msg00194.html">
- David Kerry's Timestep settings (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-August/013711.html">
- Kevin Gerbracht's ipsec.conf (X.509)</A></P>
-<P><A HREF="#alcatel.top">Back to chart</A></P>
-<H4><A NAME="apple">Apple Macintosh System 10+</A></H4>
-<UL>
-<LI>Since the system is based on FreeBSD, this should interoperate<A HREF="#kame">
- just like FreeBSD</A>.</LI>
-<LI> To use Appletalk over IPsec tunnels,<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005116.html">
- run it over TCP/IP</A>, or use Open Door Networks' Shareway IP tool,<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005426.html">
- described here.</A></LI>
-<LI>See also the<A HREF="#equinux"> Equinux VPN Tracker</A> for Mac OS
- X.</LI>
-</UL>
-<P><A HREF="http://ipsec.math.ucla.edu/services/ipsec.html"> James
- Carter's instructions (X.509, NAT-T)</A></P>
-<P><A HREF="#apple.top">Back to chart</A></P>
-<H4><A NAME="ashleylaurent">AshleyLaurent VPCom</A></H4>
-<P><A HREF="http://www.ashleylaurent.com/newsletter/01-28-00.htm">
- Successful interop report, no details</A></P>
-<P><A HREF="#ashleylaurent.top">Back to chart</A></P>
-<H4><A NAME="borderware">Borderware</A></H4>
-<UL>
-<LI>I suspect the Borderware client is a rebranded Safenet. If that's
- true, our<A HREF="#safenet"> Safenet section</A> will help.</LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-March/008288.html">
- Philip Reetz' configs (PSK)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/09/msg00217.html">
- Borderware server does not support FreeS/WAN road warriors</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-February/007733.html">
- Older Borderware may not support Diffie Hellman groups 2, 5</A>
-<BR></P>
-<P><A HREF="#borderware.top">Back to chart</A></P>
-<H4><A NAME="checkpoint">Check Point VPN-1 or FW-1</A></H4>
-<UL>
-<LI><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00099.html">
- Caveat about IP-range inclusion on Check Point.</A></LI>
-<LI> Some versions of Check Point may require an aggressive mode patch
- to interoperate with FreeS/WAN.
-<BR><A HREF="http://www.freeswan.ca/code/super-freeswan"> Super
- FreeS/WAN</A> now features this patch.
-<!--
-<A HREF="http://www.freeswan.ca/patches/aggressivemode">Steve Harvey's 
-aggressive mode patch for FreeS/WAN 1.5</A>
--->
-</LI>
-<LI></LI>
-<LI>A Linux FreeS/WAN-Checkpoint connection may close after some time.
- Try<A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00293.html">
- this tip</A> toward a workaround.</LI>
-</UL>
-<P><A HREF="http://www.fw-1.de/aerasec/ng/vpn-freeswan/CPNG+Linux-FreeSWAN.html">
- AERAsec's Firewall-1 NG site (PSK, X.509, Road Warrior with X.509,
- other algorithms)</A>
-<BR> &nbsp;&nbsp;&nbsp;&nbsp;<A HREF="http://www.fw-1.de/aerasec/ng/vpn-freeswan/CPNG+Linux-FreeSWAN.html#support-matrix">
- AERAsec's detailed Check Point-FreeS/WAN support matrix</A>
-<BR><A HREF="http://support.checkpoint.com/kb/docs/public/firewall1/4_1/pdf/fw-linuxvpn.pdf">
- Checkpoint.com PDF: Linux as a VPN Client to FW-1 (PSK)</A>
-<BR><A HREF="http://www.phoneboy.com"> PhoneBoy's Check Point FAQ (on
- Check Point only, not FreeS/WAN)</A>
-<BR></P>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2001-August/002351.html">
- Chris Harwell's tips FreeS/WAN configs (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-April/009362.html">
- Daniel Tombeil's configs (PSK)</A></P>
-<P><A HREF="#checkpoint.top">Back to chart</A></P>
-<H4><A NAME="cisco">Cisco</A></H4>
-<UL>
-<LI> Cisco supports IPsec-over-UDP NAT traversal.</LI>
-<LI>Cisco VPN Client appears to use nonstandard IPsec and does not work
- with FreeS/WAN.<A HREF="https://mj2.freeswan.org/archives/2003-August/maillist.html">
- This message</A> concerns Cisco VPN Client 4.01.
-<!-- fix link -->
-</LI>
-<LI>A Linux FreeS/WAN-Cisco connection may close after some time.<A HREF="http://lists.freeswan.org/pipermail/users/2001-December/005758.html">
- Here</A> is a workaround, and<A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00293.html">
- here</A> is another comment on the same subject.</LI>
-<LI><A HREF="http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120t/120t2/3desips.htm">
-Older Ciscos</A> purchased outside the United States may not have 3DES,
- which FreeS/WAN requires.</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2001-June/000406.html">
-RSA keying may not be possible between Cisco and FreeS/WAN.</A></LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2001-October/004357.html">
-In ipsec.conf, VPN3000 DN (distinguished name) must be in binary (X.509
- only)</A></LI>
-</UL>
-<P><A HREF="http://rr.sans.org/encryption/cisco_router.php"> SANS
- Institute HOWTO (PSK).</A> Detailed, with extensive references.
-<BR><A HREF="http://www.worldbank.ro/IPSEC/cisco-linux.txt"> Short HOWTO
- (PSK)</A>
-<BR><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
- French page with configs for Cisco IOS, PIX and VPN 3000 (X.509)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2001-August/002966.html">
- Dave McFerren's sample configs (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2001-September/003422.html">
- Wolfgang Tremmel's sample configs (PSK road warrior)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00578.html">
- Old doc from Pete Davis, with William Watson's updated Tips (PSK)</A>
-<BR></P>
-<P><STRONG>Some PIX specific information:</STRONG>
-<BR><A HREF="http://www.wlug.org.nz/FreeSwanToCiscoPix"> Waikato Linux
- Users' Group HOWTO. Nice detail (PSK)</A>
-<BR><A HREF="http://www.johnleach.co.uk/documents/freeswan-pix/freeswan-pix.html">
- John Leach's configs (PSK)</A>
-<BR><A HREF="http://www.diverdown.cc/vpn/freeswanpix.html"> Greg
- Robinson's settings (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-February/007901.html">
- Scott's ipsec.conf for PIX (PSK, FreeS/WAN side only)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2001-October/003949.html">
- Rick Trimble's PIX and FreeS/WAN settings (PSK)</A>
-<BR></P>
-<P><A href="http://www.cisco.com/public/support/tac"> Cisco VPN support
- page</A>
-<BR><A href="http://www.ieng.com/warp/public/707/index.shtml#ipsec">
- Cisco IPsec information page</A></P>
-<P><A HREF="#cisco.top">Back to chart</A></P>
-<H4><A NAME="equinux">Equinux VPN tracker (for Mac OS X)</A></H4>
-<UL>
-<LI>Graphical configurator for Mac OS X IPsec. May be an interface to
- the<A HREF="#apple"> native Mac OS X IPsec</A>, which is essentially<A HREF="#kame">
- KAME</A>.</LI>
-<LI>To use Appletalk over IPsec tunnels,<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005116.html">
- run it over TCP/IP</A>, or use Open Door Networks' Shareway IP tool,<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005426.html">
- described here.</A></LI>
-</UL>
-<P> Equinux provides<A HREF="http://www.equinux.com/download/HowTo_FreeSWAN.pdf">
- this excellent interop PDF</A> (PSK, RSA, X.509).</P>
-<P><A HREF="#equinux.top">Back to chart</A></P>
-<H4><A NAME="fsecure">F-Secure</A></H4>
-<UL>
-<LI>
-<!-- <A HREF="http://lists.freeswan.org/pipermail/users/2002-February/007596.html"> -->
- F-Secure supports IPsec-over-UDP NAT traversal.</LI>
-</UL>
-<P><A HREF="http://www.pingworks.de/tech/vpn/vpn.txt">pingworks.de's
- &quot;Connecting F-Secure's VPN+ to Linux FreeS/WAN&quot; (PSK road warrior)</A>
-<BR> &nbsp;&nbsp;&nbsp;&nbsp;<A HREF="http://www.pingworks.de/tech/vpn/vpn.pdf">Same thing
- as PDF</A>
-<BR><A HREF="http://www.exim.org/pipermail/linux-ipsec/Week-of-Mon-20010122/000061.html">
- Success report, no detail (PSK)</A>
-<BR><A HREF="http://www.exim.org/pipermail/linux-ipsec/Week-of-Mon-20010122/000041.html">
- Success report, no detail (Manual)</A></P>
-
-<!-- Other NAT traversers:
-http://lists.freeswan.org/pipermail/users/2002-April/009136.html
-and ssh sentinel:
-http://lists.freeswan.org/pipermail/users/2001-September/003108.html
--->
-<P><A HREF="#fsecure.top">Back to chart</A></P>
-<H4><A NAME="gauntlet">Gauntlet GVPN</A></H4>
-<P><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00535.html">
- Richard Reiner's ipsec.conf (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-June/011434.html">
- Might work without that pesky firewall... (PSK)</A>
-<BR>
-<!-- insert archive link -->
- In late July, 2003 Alexandar Antik reported success interoperating
- with Gauntlet 6.0 for Solaris (X.509). Unfortunately the message is not
- properly archived at this time.</P>
-<P><A HREF="#gauntlet.top">Back to chart</A></P>
-<H4><A NAME="aix">IBM AIX</A></H4>
-<P><A HREF="http://www-1.ibm.com/servers/esdd/articles/security.html">
- IBM's &quot;Built-In Network Security with AIX&quot; (PSK, X.509)</A>
-<BR><A HREF="http://www-1.ibm.com/servers/aix/products/ibmsw/security/vpn/faqandtips/#ques20">
- IBM's tip: importing Linux FreeS/WAN settings into AIX's<VAR> ikedb</VAR>
- (PSK)</A></P>
-<P><A HREF="#aix.top">Back to chart</A></P>
-<H4><A NAME="as400">IBM AS/400</A></H4>
-<UL>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-April/009106.html">
- Road Warriors may act flaky</A>.</LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-September/014264.html">
- Richard Welty's tips and tricks</A>
-<BR></P>
-<P><A HREF="#as400.top">Back to chart</A></P>
-<H4><A NAME="intel">Intel Shiva LANRover / Net Structure</A></H4>
-<UL>
-<LI>Intel Shiva LANRover is now known as Intel Net Structure.</LI>
-<LI><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/01/msg00298.html">
- Shiva seems to have two modes: IPsec or the proprietary &quot;Shiva Tunnel&quot;.</A>
- Of course, FreeS/WAN will only create IPsec tunnels.</LI>
-<LI><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00293.html">
- AH may not work for Shiva-FreeS/WAN.</A> That's OK, since FreeS/WAN has
- phased out the use of AH.</LI>
-</UL>
-<P><A HREF="http://snowcrash.tdyc.com/freeswan/"> Snowcrash's configs
- (PSK)</A>
-<BR><A HREF="http://www.opus1.com/vpn/index.html"> Old configs from an
- interop (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2001-October/003831.html">
- The day Shiva tickled a Pluto bug (PSK)</A>
-<BR> &nbsp;&nbsp;&nbsp;&nbsp;<A HREF="http://lists.freeswan.org/pipermail/users/2001-October/004270.html">
- Follow up: success!</A></P>
-<P><A HREF="#intel.top">Back to chart</A></P>
-<H4><A NAME="lancom">LanCom (formerly ELSA)</A></H4>
-<UL>
-<LI>This router is popular in Germany.</LI>
-</UL>
-<P> Jakob Curdes successfully created a PSK connection with the LanCom
- 1612 in August 2003.
-<!-- add ML link when it appears -->
-</P>
-<P><A HREF="#lancom.top">Back to chart</A></P>
-<H4><A NAME="linksys">Linksys</A></H4>
-<UL>
-<LI>Linksys may be used as an IPsec tunnel endpoint,<STRONG> OR</STRONG>
- as a router in &quot;IPsec passthrough&quot; mode, so that the IPsec tunnel
- passes through the Linksys.</LI>
-</UL>
-<H5>As tunnel endpoint</H5>
-<P><A HREF="http://www.freeswan.ca/docs/BEFVP41/"> Ken Bantoft's
- instructions (Road Warrior with PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-February/007814.html">
- Nate Carlson's caveats</A></P>
-<H5>In IPsec passthrough mode</H5>
-<P><A HREF="http://www-ec.njit.edu/~rxt1077/Howto.txt"> Sample HOWTO
- through a Linksys Router</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2002/02/msg00114.html">
- Nadeem Hasan's configs</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2002/02/msg00180.html">
- Brock Nanson's tips</A>
-<BR></P>
-<P><A HREF="#linksys.top">Back to chart</A></P>
-<H4><A NAME="lucent">Lucent</A></H4>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010976.html">
- Partial success report; see also the next message in thread</A></P>
-
-<!-- section done -->
-<P><A HREF="#lucent.top">Back to chart</A></P>
-<H4><A NAME="netasq">Netasq</A></H4>
-<P><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
- French page with configs (X.509)</A></P>
-
-<!-- section done -->
-<P><A HREF="#netasq.top">Back to chart</A></P>
-<H4><A NAME="netcelo">Netcelo</A></H4>
-<P><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
- French page with configs (X.509)</A>
-<!-- section done -->
-</P>
-<P><A HREF="#netcelo.top">Back to chart</A></P>
-<H4><A NAME="netgear">Netgear fvs318</A></H4>
-<UL>
-<LI>With a recent Linux FreeS/WAN, you will require the latest (12/2002)
- Netgear firmware, which supports Diffie-Hellman (DH) group 2. For
- security reasons, we phased out DH 1 after Linux FreeS/WAN 1.5.</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-June/011833.html">
- This message</A> reports the incompatibility between Linux FreeS/WAN
- 1.6+ and Netgear fvs318 without the firmware upgrade.</LI>
-<LI>We believe Linux FreeS/WAN 1.5 and earlier will interoperate with
- any NetGear firmware.</LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2003-February/017891.html">
- John Morris' setup (PSK)</A></P>
-<P><A HREF="#netgear.top">Back to chart</A></P>
-<H4><A NAME="netscreen">Netscreen 100 or 5xp</A></H4>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-August/013409.html">
- Errol Neal's settings (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-October/015265.html">
- Corey Rogers' configs (PSK, no PFS)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-August/013051.html">
- Jordan Share's configs (PSK, 2 subnets, through static NAT)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/08/msg00404.html">
- Set src proxy_id to your protected subnet/mask</A>
-<BR><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
- French page with ipsec.conf, Netscreen screen shots (X.509, may need to
- revert to PSK...)</A></P>
-<P><A HREF="http://archives.neohapsis.com/archives/sf/linux/2001-q2/0123.html">
- A report of a company using Netscreen with FreeS/WAN on a large scale
- (FreeS/WAN road warriors?)</A></P>
-<P><A HREF="#netscreen.top">Back to chart</A></P>
-<H4><A NAME="nortel">Nortel Contivity</A></H4>
-<UL>
-<LI> Nortel supports IPsec-over-UDP NAT traversal.</LI>
-<LI><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00417.html">
- Some older versions of Contivity and FreeS/WAN will not communicate.</A>
-</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010924.html">
- FreeS/WAN cannot be used as a &quot;client&quot; to a Nortel Contivity server,
- but can be used as a branch-office tunnel.</A></LI>
-
-<!--  Probably obsoleted by Ken's post
-<LI>
-(Matthias siebler from old interop)
-At one point you could not configure Nortel-FreeS/WAN tunnels as 
-"Client Tunnels" since FreeS/WAN does not support Aggressive Mode.
-Current status of this problem: unknown.
-<LI>
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/004612.html">
-How do we map group and user passwords onto the data that FreeS/WAN wants?
-</A>
-</LI>
--->
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-October/015455.html">
- Contivity does not send Distinguished Names in the order FS wants them
- (X.509).</A></LI>
-<LI><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/03/msg00137.html">
- Connections may time out after 30-40 minutes idle.</A></LI>
-</UL>
-<P><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/03/msg00137.html">
- JJ Streicher-Bremer's mini HOWTO for old new software. (PSK with two
- subnets)</A>
-<BR><A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
- French page with configs (X.509)</A>. This succeeds using the above
- X.509 tip.</P>
-
-<!-- I could do more searching but this is a solid start. -->
-<P><A HREF="#nortel.top">Back to chart</A></P>
-<H4><A NAME="radguard">Radguard</A></H4>
-<P><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/05/msg00009.html">
- Marko Hausalo's configs (PSK).</A> Note: These do create a connection,
- as you can see by &quot;IPsec SA established&quot;.
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-October/???.html">
- Claudia Schmeing's comments</A></P>
-<P><A HREF="#radguard.top">Back to chart</A></P>
-<H4><A NAME="raptor">Raptor (NT or Solaris)</A></H4>
-<P></P>
-<UL>
-<LI>Now known as Symantec Enterprise Firewall.</LI>
-<LI>The Raptor does not normally come with X.509, but this may be
- available as an add-on.</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010256.html">
- Raptor requires alphanumberic PSK values, whereas FreeS/WAN uses hex.</A>
-</LI>
-<LI>Raptor's tunnel endpoint may be a host, subnet or group of subnets
- (see<A HREF="http://lists.freeswan.org/pipermail/design/2001-November/001295.html">
- this message</A> ). FreeS/WAN cannot handle the group of subnets; you
- must create separate connections for each in order to interoperate.</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010113.html">
- Some versions of Raptor accept only single DES.</A> According to this
- German message,<A HREF="http://radawana.cg.tuwien.ac.at/mail-archives/lll/200012/msg00065.html">
- the Raptor Mobile Client demo offers single DES only.</A></LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-January/006935.html">
- Peter Mazinger's settings (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005522.html">
- Peter Gerland's configs (PSK)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/07/msg00597.html">
- Charles Griebel's configs (PSK).</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-July/012275.html">
- Lumir Srch's tips (PSK)</A></P>
-<P><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/05/msg00214.html">
- John Hardy's configs (Manual)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/01/msg00236.html">
- Older Raptors want 3DES keys in 3 parts (Manual).</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/06/msg00480.html">
- Different keys for each direction? (Manual)</A>
-<BR></P>
-<P><A HREF="#raptor.top">Back to chart</A></P>
-<H4><A NAME="redcreek">Redcreek Ravlin</A></H4>
-<UL>
-<LI>Known issue #1: The Ravlin expects a quick mode renegotiation right
- after every Main Mode negotiation.</LI>
-<LI> Known issue #2: The Ravlin tries to negotiate a zero connection
- lifetime, which it takes to mean &quot;infinite&quot;.<A HREF="http://www.bear-cave.org.uk/linux/ravlin/">
- Jim Hague's patch</A> addresses both issues.</LI>
-<LI><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/03/msg00191.html">
- Interop works with Ravlin Firmware &gt; 3.33. Includes tips (PSK).</A></LI>
-</UL>
-<P><A HREF="#redcreek.top">Back to chart</A></P>
-<H4><A NAME="sonicwall">SonicWall</A></H4>
-<UL>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2001-June/000998.html">
- Sonicwall cannot be used for Road Warrior setups</A></LI>
-<LI> At one point,<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/05/msg00217.html">
- only Sonicwall PRO supported triple DES</A>.</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-March/008600.html">
- Older Sonicwalls (before Nov 2001) feature Diffie Hellman group 1 only</A>
-.</LI>
-</UL>
-<P><A HREF="http://www.xinit.cx/docs/freeswan.html"> Paul Wouters'
- config (PSK)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00073.html">
- Dilan Arumainathan's configuration (PSK)</A>
-<BR><A HREF="http://www.gravitas.co.uk/vpndebug"> Dariush's setup...
- only opens one way (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2003-July/022302.html">
- Andreas Steffen's tips (X.509)</A>
-<BR></P>
-<P><A HREF="#sonicwall.top">Back to chart</A></P>
-<H4><A NAME="sun">Sun Solaris</A></H4>
-<UL>
-<LI> Solaris 8+ has a native (in kernel) IPsec implementation.</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010503.html">
- Solaris does not seem to support tunnel mode, but you can make IP-in-IP
- tunnels instead, like this.</A></LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2003-June/022216.html">
- Reports of some successful interops</A> from a fellow @sun.com. See
- also<A HREF="http://lists.freeswan.org/pipermail/users/2003-July/022247.html">
- these follow up posts</A>.
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/03/msg00332.html">
- Aleks Shenkman's configs (Manual in transport mode)</A>
-<BR>
-<!--sparc 64 stuff goes where?-->
-</P>
-<P><A HREF="#solaris.top">Back to chart</A></P>
-<H4><A NAME="symantec">Symantec</A></H4>
-<UL>
-<LI>The Raptor, covered<A HREF="#raptor"> above</A>, is now known as
- Symantec Enterprise Firewall.</LI>
-<LI>Symantec's &quot;distinguished name&quot; is a KEY_ID. See Andreas Steffen's
- post, below.</LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-April/009037.html">
- Andreas Steffen's configs for Symantec 200R (PSK)</A></P>
-<P><A HREF="#symantec.top">Back to chart</A></P>
-<H4><A NAME="watchguard">Watchguard Firebox</A></H4>
-<UL>
-<LI>Automatic keying works with WatchGuard 5.0+ only.</LI>
-<LI>Seen to interoperate with WatchGuard 1000, II, III; firmware v. 5,
- 6..</LI>
-<LI>For manual keying, Watchguard's Policy Manager expects SPI numbers
- and encryption and authentication keys in decimal (not hex).</LI>
-</UL>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-July/012595.html">
- WatchGuard's HOWTO (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-August/013342.html">
- Ronald C. Riviera's Settings (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00179.html">
- Walter Wickersham's Notes (PSK)</A>
-<BR><A HREF="http://lists.freeswan.org/pipermail/users/2002-October/015587.html">
- Max Enders' Configs (Manual)</A></P>
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-April/009404.html">
- Old known issue with auto keying</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00124.html">
- Tips on key generation and format (Manual)</A>
-<BR></P>
-<P><A HREF="#watchguard.top">Back to chart</A></P>
-<H4><A NAME="xedia">Xedia Access Point/QVPN</A></H4>
-<P><A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/12/msg00520.html">
- Hybrid IPsec/L2TP connection settings (X.509)</A>
-<BR><A HREF="http://www.sandelman.ottawa.on.ca/ipsec/1999/08/msg00140.html">
- Xedia's LAN-LAN links don't use multiple tunnels</A>
-<BR> &nbsp;&nbsp;&nbsp;&nbsp;<A HREF="http://www.sandelman.ottawa.on.ca/ipsec/1999/08/msg00140.html">
- That explanation, continued</A></P>
-<P><A HREF="#xedia.top">Back to chart</A></P>
-<H4><A NAME="zyxel">Zyxel</A></H4>
-<UL>
-<LI>The Zyxel Zywall is a rebranded SSH Sentinel box. See also our
- section on<A HREF="glossary.html#ssh"> SSH</A>.</LI>
-<LI>There seems to be a problem with keeping this connection alive. This
- is caused at the Zyxel end. See this brief<A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00141.html">
- discussion and solution.</A></LI>
-</UL>
-<P><A HREF="http://www.zyxel.com/support/supportnote/zywall/app/zw_freeswan.htm">
- Zyxel's Zywall to FreeS/WAN instructions (PSK)</A>
-<BR><A HREF="http://www.zyxel.com/support/supportnote/p652/app/zw_freeswan.htm">
- Zyxel's Prestige to FreeS/WAN instructions (PSK)</A>. Note: not all
- Prestige versions include VPN software.
-<BR><A HREF="http://www.lancry.net/techdocs/freeswan-zyxel.txt"> Fabrice
- Cahen's HOWTO (PSK)</A>
-<BR> &nbsp;&nbsp;&nbsp;&nbsp;</P>
-<P><A HREF="#zyxel.top">Back to chart</A></P>
-
-<!-- SAMPLE ENTRY
-
-<H4><A NAME="timestep">Timestep</A></H4>
-
-<P>Text goes here.
-</P>
-
--->
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="compat.html">Previous</A>
-<A HREF="performance.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/intro.html b/doc/intro.html
deleted file mode 100644
index 3afc3e324..000000000
--- a/doc/intro.html
+++ /dev/null
@@ -1,733 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="upgrading.html">Next</A>
-<HR>
-<H1><A name="intro">Introduction</A></H1>
-<P>This section gives an overview of:</P>
-<UL>
-<LI>what IP Security (IPsec) does</LI>
-<LI>how IPsec works</LI>
-<LI>why we are implementing it for Linux</LI>
-<LI>how this implementation works</LI>
-</UL>
-<P>This section is intended to cover only the essentials,<EM> things you
- should know before trying to use FreeS/WAN.</EM></P>
-<P>For more detailed background information, see the<A href="politics.html#politics">
- history and politics</A> and<A href="ipsec.html#ipsec.detail"> IPsec
- protocols</A> sections.</P>
-<H2><A name="ipsec.intro">IPsec, Security for the Internet Protocol</A></H2>
-<P>FreeS/WAN is a Linux implementation of the IPsec (IP security)
- protocols. IPsec provides<A href="glossary.html#encryption"> encryption</A>
- and<A href="glossary.html#authentication"> authentication</A> services
- at the IP (Internet Protocol) level of the network protocol stack.</P>
-<P>Working at this level, IPsec can protect any traffic carried over IP,
- unlike other encryption which generally protects only a particular
- higher-level protocol --<A href="glossary.html#PGP"> PGP</A> for mail,<A
-href="glossary.html#SSH"> SSH</A> for remote login,<A href="glossary.html#SSL">
- SSL</A> for web work, and so on. This approach has both considerable
- advantages and some limitations. For discussion, see our<A href="ipsec.html#others">
- IPsec section</A></P>
-<P>IPsec can be used on any machine which does IP networking. Dedicated
- IPsec gateway machines can be installed wherever required to protect
- traffic. IPsec can also run on routers, on firewall machines, on
- various application servers, and on end-user desktop or laptop
- machines.</P>
-<P>Three protocols are used</P>
-<UL>
-<LI><A href="glossary.html#AH">AH</A> (Authentication Header) provides a
- packet-level authentication service</LI>
-<LI><A href="glossary.html#ESP">ESP</A> (Encapsulating Security Payload)
- provides encryption plus authentication</LI>
-<LI><A href="glossary.html#IKE">IKE</A> (Internet Key Exchange)
- negotiates connection parameters, including keys, for the other two</LI>
-</UL>
-<P>Our implementation has three main parts:</P>
-<UL>
-<LI><A href="glossary.html#KLIPS">KLIPS</A> (kernel IPsec) implements
- AH, ESP, and packet handling within the kernel</LI>
-<LI><A href="glossary.html#Pluto">Pluto</A> (an IKE daemon) implements
- IKE, negotiating connections with other systems</LI>
-<LI>various scripts provide an adminstrator's interface to the machinery</LI>
-</UL>
-<P>IPsec is optional for the current (version 4) Internet Protocol.
- FreeS/WAN adds IPsec to the Linux IPv4 network stack. Implementations
- of<A href="glossary.html#ipv6.gloss"> IP version 6</A> are required to
- include IPsec. Work toward integrating FreeS/WAN into the Linux IPv6
- stack has<A href="compat.html#ipv6"> started</A>.</P>
-<P>For more information on IPsec, see our<A href="ipsec.html#ipsec.detail">
- IPsec protocols</A> section, our collection of<A href="web.html#ipsec.link">
- IPsec links</A> or the<A href="rfc.html#RFC"> RFCs</A> which are the
- official definitions of these protocols.</P>
-<H3><A name="intro.interop">Interoperating with other IPsec
- implementations</A></H3>
-<P>IPsec is designed to let different implementations work together. We
- provide:</P>
-<UL>
-<LI>a<A href="web.html#implement"> list</A> of some other
- implementations</LI>
-<LI>information on<A href="interop.html#interop"> using FreeS/WAN with
- other implementations</A></LI>
-</UL>
-<P>The VPN Consortium fosters cooperation among implementers and
- interoperability among implementations. Their<A href="http://www.vpnc.org/">
- web site</A> has much more information.</P>
-<H3><A name="advantages">Advantages of IPsec</A></H3>
-<P>IPsec has a number of security advantages. Here are some
- independently written articles which discuss these:</P>
-<P><A HREF="http://www.sans.org/rr/"> SANS institute papers</A>. See the
- section on Encryption &amp;VPNs.
-<BR><A HREF="http://www.cisco.com/en/US/netsol/ns110/ns170/ns171/ns128/networking_solutions_white_papers_list.html">
- Cisco's white papers on &quot;Networking Solutions&quot;</A>.
-<BR><A HREF="http://iscs.sourceforge.net/HowWhyBrief/HowWhyBrief.html">
- Advantages of ISCS (Linux Integrated Secure Communications System;
- includes FreeS/WAN and other software)</A>.</P>
-<H3><A name="applications">Applications of IPsec</A></H3>
-<P>Because IPsec operates at the network layer, it is remarkably
- flexible and can be used to secure nearly any type of Internet traffic.
- Two applications, however, are extremely widespread:</P>
-<UL>
-<LI>a<A href="glossary.html#VPN"> Virtual Private Network</A>, or VPN,
- allows multiple sites to communicate securely over an insecure Internet
- by encrypting all communication between the sites.</LI>
-<LI>&quot;Road Warriors&quot; connect to the office from home, or perhaps from a
- hotel somewhere</LI>
-</UL>
-<P>There is enough opportunity in these applications that vendors are
- flocking to them. IPsec is being built into routers, into firewall
- products, and into major operating systems, primarily to support these
- applications. See our<A href="web.html#implement"> list</A> of
- implementations for details.</P>
-<P>We support both of those applications, and various less common IPsec
- applications as well, but we also add one of our own:</P>
-<UL>
-<LI>opportunistic encryption, the ability to set up FreeS/WAN gateways
- so that any two of them can encrypt to each other, and will do so
- whenever packets pass between them.</LI>
-</UL>
-<P>This is an extension we are adding to the protocols. FreeS/WAN is the
- first prototype implementation, though we hope other IPsec
- implementations will adopt the technique once we demonstrate it. See<A href="#goals">
- project goals</A> below for why we think this is important.</P>
-<P>A somewhat more detailed description of each of these applications is
- below. Our<A href="quickstart.html#quick_guide"> quickstart</A> section
- will show you how to build each of them.</P>
-<H4><A name="makeVPN">Using secure tunnels to create a VPN</A></H4>
-<P>A VPN, or<STRONG> V</STRONG>irtual<STRONG> P</STRONG>rivate<STRONG> N</STRONG>
-etwork lets two networks communicate securely when the only connection
- between them is over a third network which they do not trust.</P>
-<P>The method is to put a security gateway machine between each of the
- communicating networks and the untrusted network. The gateway machines
- encrypt packets entering the untrusted net and decrypt packets leaving
- it, creating a secure tunnel through it.</P>
-<P>If the cryptography is strong, the implementation is careful, and the
- administration of the gateways is competent, then one can reasonably
- trust the security of the tunnel. The two networks then behave like a
- single large private network, some of whose links are encrypted tunnels
- through untrusted nets.</P>
-<P>Actual VPNs are often more complex. One organisation may have fifty
- branch offices, plus some suppliers and clients, with whom it needs to
- communicate securely. Another might have 5,000 stores, or 50,000
- point-of-sale devices. The untrusted network need not be the Internet.
- All the same issues arise on a corporate or institutional network
- whenever two departments want to communicate privately with each other.</P>
-<P>Administratively, the nice thing about many VPN setups is that large
- parts of them are static. You know the IP addresses of most of the
- machines involved. More important, you know they will not change on
- you. This simplifies some of the admin work. For cases where the
- addresses do change, see the next section.</P>
-<H4><A name="road.intro">Road Warriors</A></H4>
-<P>The prototypical &quot;Road Warrior&quot; is a traveller connecting to home
- base from a laptop machine. Administratively, most of the same problems
- arise for a telecommuter connecting from home to the office, especially
- if the telecommuter does not have a static IP address.</P>
-<P>For purposes of this document:</P>
-<UL>
-<LI>anyone with a dynamic IP address is a &quot;Road Warrior&quot;.</LI>
-<LI>any machine doing IPsec processing is a &quot;gateway&quot;. Think of the
- single-user road warrior machine as a gateway with a degenerate subnet
- (one machine, itself) behind it.</LI>
-</UL>
-<P>These require somewhat different setup than VPN gateways with static
- addresses and with client systems behind them, but are basically not
- problematic.</P>
-<P>There are some difficulties which appear for some road warrior
- connections:</P>
-<UL>
-<LI>Road Wariors who get their addresses via DHCP may have a problem.
- FreeS/WAN can quite happily build and use a tunnel to such an address,
- but when the DHCP lease expires, FreeS/WAN does not know that. The
- tunnel fails, and the only recovery method is to tear it down and
- re-build it.</LI>
-<LI>If<A href="glossary.html#NAT.gloss"> Network Address Translation</A>
- (NAT) is applied between the two IPsec Gateways, this breaks IPsec.
- IPsec authenticates packets on an end-to-end basis, to ensure they are
- not altered en route. NAT rewrites packets as they go by. See our<A href="firewall.html#NAT">
- firewalls</A> document for details.</LI>
-</UL>
-<P>In most situations, however, FreeS/WAN supports road warrior
- connections just fine.</P>
-<H4><A name="opp.intro">Opportunistic encryption</A></H4>
-<P>One of the reasons we are working on FreeS/WAN is that it gives us
- the opportunity to add what we call opportuntistic encryption. This
- means that any two FreeS/WAN gateways will be able to encrypt their
- traffic, even if the two gateway administrators have had no prior
- contact and neither system has any preset information about the other.</P>
-<P>Both systems pick up the authentication information they need from
- the<A href="glossary.html#DNS"> DNS</A> (domain name service), the
- service they already use to look up IP addresses. Of course the
- administrators must put that information in the DNS, and must set up
- their gateways with opportunistic encryption enabled. Once that is
- done, everything is automatic. The gateways look for opportunities to
- encrypt, and encrypt whatever they can. Whether they also accept
- unencrypted communication is a policy decision the administrator can
- make.</P>
-<P>This technique can give two large payoffs:</P>
-<UL>
-<LI>It reduces the administrative overhead for IPsec enormously. You
- configure your gateway and thereafter everything is automatic. The need
- to configure the system on a per-tunnel basis disappears. Of course,
- FreeS/WAN allows specifically configured tunnels to co-exist with
- opportunistic encryption, but we hope to make them unnecessary in most
- cases.</LI>
-<LI>It moves us toward a more secure Internet, allowing users to create
- an environment where message privacy is the default. All messages can
- be encrypted, provided the other end is willing to co-operate. See our<A
-href="politics.html#politics"> history and politics of cryptography</A>
- section for discussion of why we think this is needed.</LI>
-</UL>
-<P>Opportunistic encryption is not (yet?) a standard part of the IPsec
- protocols, but an extension we are proposing and demonstrating. For
- details of our design, see<A href="#applied"> links</A> below.</P>
-<P>Only one current product we know of implements a form of
- opportunistic encryption.<A href="web.html#ssmail"> Secure sendmail</A>
- will automatically encrypt server-to-server mail transfers whenever
- possible.</P>
-<H3><A name="types">The need to authenticate gateways</A></H3>
-<P>A complication, which applies to any type of connection -- VPN, Road
- Warrior or opportunistic -- is that a secure connection cannot be
- created magically.<EM> There must be some mechanism which enables the
- gateways to reliably identify each other.</EM> Without this, they
- cannot sensibly trust each other and cannot create a genuinely secure
- link.</P>
-<P>Any link they do create without some form of<A href="glossary.html#authentication">
- authentication</A> will be vulnerable to a<A href="glossary.html#middle">
- man-in-the-middle attack</A>. If<A href="glossary.html#alicebob"> Alice
- and Bob</A> are the people creating the connection, a villian who can
- re-route or intercept the packets can pose as Alice while talking to
- Bob and pose as Bob while talking to Alice. Alice and Bob then both
- talk to the man in the middle, thinking they are talking to each other,
- and the villain gets everything sent on the bogus &quot;secure&quot; connection.</P>
-<P>There are two ways to build links securely, both of which exclude the
- man-in-the middle:</P>
-<UL>
-<LI>with<STRONG> manual keying</STRONG>, Alice and Bob share a secret
- key (which must be transmitted securely, perhaps in a note or via PGP
- or SSH) to encrypt their messages. For FreeS/WAN, such keys are stored
- in the<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A> file. Of
- course, if an enemy gets the key, all is lost.</LI>
-<LI>with<STRONG> automatic keying</STRONG>, the two systems authenticate
- each other and negotiate their own secret keys. The keys are
- automatically changed periodically.</LI>
-</UL>
-<P>Automatic keying is much more secure, since if an enemy gets one key
- only messages between the previous re-keying and the next are exposed.
- It is therefore the usual mode of operation for most IPsec deployment,
- and the mode we use in our setup examples. FreeS/WAN does support
- manual keying for special circumstanes. See this<A href="adv_config.html#prodman">
- section</A>.</P>
-<P>For automatic keying, the two systems must authenticate each other
- during the negotiations. There is a choice of methods for this:</P>
-<UL>
-<LI>a<STRONG> shared secret</STRONG> provides authentication. If Alice
- and Bob are the only ones who know a secret and Alice recives a message
- which could not have been created without that secret, then Alice can
- safely believe the message came from Bob.</LI>
-<LI>a<A href="glossary.html#public"> public key</A> can also provide
- authentication. If Alice receives a message signed with Bob's private
- key (which of course only he should know) and she has a trustworthy
- copy of his public key (so that she can verify the signature), then she
- can safely believe the message came from Bob.</LI>
-</UL>
-<P>Public key techniques are much preferable, for reasons discussed<A href="config.html#choose">
- later</A>, and will be used in all our setup examples. FreeS/WAN does
- also support auto-keying with shared secret authentication. See this<A href="adv_config.html#prodsecrets">
- section</A>.</P>
-<H2><A name="project">The FreeS/WAN project</A></H2>
-<P>For complete information on the project, see our web site,<A href="http://liberty.freeswan.org">
- freeswan.org</A>.</P>
-<P>In summary, we are implementing the<A href="glossary.html#IPsec">
- IPsec</A> protocols for Linux and extending them to do<A href="glossary.html#carpediem">
- opportunistic encryption</A>.</P>
-<H3><A name="goals">Project goals</A></H3>
-<P>Our overall goal in FreeS/WAN is to make the Internet more secure and
- more private.</P>
-<P>Our IPsec implementation supports VPNs and Road Warriors of course.
- Those are important applications. Many users will want FreeS/WAN to
- build corporate VPNs or to provide secure remote access.</P>
-<P>However, our goals in building it go beyond that. We are trying to
- help<STRONG> build security into the fabric of the Internet</STRONG> so
- that anyone who choses to communicate securely can do so, as easily as
- they can do anything else on the net.</P>
-<P>More detailed objectives are:</P>
-<UL>
-<LI>extend IPsec to do<A href="glossary.html#carpediem"> opportunistic
- encryption</A> so that
-<UL>
-<LI>any two systems can secure their communications without a
- pre-arranged connection</LI>
-<LI><STRONG>secure connections can be the default</STRONG>, falling back
- to unencrypted connections only if:
-<UL>
-<LI><EM>both</EM> the partner is not set up to co-operate on securing
- the connection</LI>
-<LI><EM>and</EM> your policy allows insecure connections</LI>
-</UL>
-</LI>
-<LI>a significant fraction of all Internet traffic is encrypted</LI>
-<LI>wholesale monitoring of the net (<A href="politics.html#intro.poli">
-examples</A>) becomes difficult or impossible</LI>
-</UL>
-</LI>
-<LI>help make IPsec widespread by providing an implementation with no
- restrictions:
-<UL>
-<LI>freely available in source code under the<A href="glossary.html#GPL">
- GNU General Public License</A></LI>
-<LI>running on a range of readily available hardware</LI>
-<LI>not subject to US or other nations'<A href="politics.html#exlaw">
- export restrictions</A>.
-<BR> Note that in order to avoid<EM> even the appearance</EM> of being
- subject to those laws, the project cannot accept software contributions
- --<EM> not even one-line bug fixes</EM> -- from US residents or
- citizens.</LI>
-</UL>
-</LI>
-<LI>provide a high-quality IPsec implementation for Linux
-<UL>
-<LI>portable to all CPUs Linux supports:<A href="compat.html#CPUs">
- (current list)</A></LI>
-<LI>interoperable with other IPsec implementations:<A href="interop.html#interop">
- (current list)</A></LI>
-</UL>
-</LI>
-</UL>
-<P>If we can get opportunistic encryption implemented and widely
- deployed, then it becomes impossible for even huge well-funded agencies
- to monitor the net.</P>
-<P>See also our section on<A href="politics.html#politics"> history and
- politics</A> of cryptography, which includes our project leader's<A href="politics.html#gilmore">
- rationale</A> for starting the project.</P>
-<H3><A name="staff">Project team</A></H3>
-<P>Two of the team are from the US and can therefore contribute no code:</P>
-<UL>
-<LI>John Gilmore: founder and policy-maker (<A href="http://www.toad.com/gnu/">
-home page</A>)</LI>
-<LI>Hugh Daniel: project manager, Most Demented Tester, and occasionally
- Pointy-Haired Boss</LI>
-</UL>
-<P>The rest of the team are Canadians, working in Canada. (<A href="politics.html#status">
-Why Canada?</A>)</P>
-<UL>
-<LI>Hugh Redelmeier:<A href="glossary.html#Pluto"> Pluto daemon</A>
- programmer</LI>
-<LI>Richard Guy Briggs:<A href="glossary.html#KLIPS"> KLIPS</A>
- programmer</LI>
-<LI>Michael Richardson: hacker without portfolio</LI>
-<LI>Claudia Schmeing: documentation</LI>
-<LI>Sam Sgro: technical support via the<A href="mail.html#lists">
- mailing lists</A></LI>
-</UL>
-<P>The project is funded by civil libertarians who consider our goals
- worthwhile. Most of the team are paid for this work.</P>
-<P>People outside this core team have made substantial contributions.
- See</P>
-<UL>
-<LI>our<A href="../CREDITS"> CREDITS</A> file</LI>
-<LI>the<A href="web.html#patch"> patches and add-ons</A> section of our
- web references file</LI>
-<LI>lists below of user-written<A href="#howto"> HowTos</A> and<A href="#applied">
- other papers</A></LI>
-</UL>
-<P>Additional contributions are welcome. See the<A href="faq.html#contrib.faq">
- FAQ</A> for details.</P>
-<H2><A name="products">Products containing FreeS/WAN</A></H2>
-<P>Unfortunately the<A href="politics.html#exlaw"> export laws</A> of
- some countries restrict the distribution of strong cryptography.
- FreeS/WAN is therefore not in the standard Linux kernel and not in all
- CD or web distributions.</P>
-<P>FreeS/WAN is, however, quite widely used. Products we know of that
- use it are listed below. We would appreciate hearing, via the<A href="mail.html#lists">
- mailing lists</A>, of any we don't know of.</P>
-<H3><A name="distwith">Full Linux distributions</A></H3>
-<P>FreeS/WAN is included in various general-purpose Linux distributions,
- mostly from countries (shown in brackets) with more sensible laws:</P>
-<UL>
-<LI><A href="http://www.suse.com/">SuSE Linux</A> (Germany)</LI>
-<LI><A href="http://www.conectiva.com">Conectiva</A> (Brazil)</LI>
-<LI><A href="http://www.linux-mandrake.com/en/">Mandrake</A> (France)</LI>
-<LI><A href="http://www.debian.org">Debian</A></LI>
-<LI>the<A href="http://www.pld.org.pl/"> Polish(ed) Linux Distribution</A>
- (Poland)</LI>
-<LI><A>Best Linux</A> (Finland)</LI>
-</UL>
-<P>For distributions which do not include FreeS/WAN and are not Redhat
- (which we develop and test on), there is additional information in our<A
-href="compat.html#otherdist"> compatibility</A> section.</P>
-<P>The server edition of<A href="http://www.corel.com"> Corel</A> Linux
- (Canada) also had FreeS/WAN, but Corel have dropped that product line.</P>
-<H3><A name="kernel_dist">Linux kernel distributions</A></H3>
-<UL>
-<LI><A href="http://sourceforge.net/projects/wolk/">Working Overloaded
- Linux Kernel (WOLK)</A></LI>
-</UL>
-<H3><A name="office_dist">Office server distributions</A></H3>
-<P>FreeS/WAN is also included in several distributions aimed at the
- market for turnkey business servers:</P>
-<UL>
-<LI><A href="http://www.e-smith.com/">e-Smith</A> (Canada), which has
- recently been acquired and become the Network Server Solutions group of<A
-href="http://www.mitel.com/"> Mitel Networks</A> (Canada)</LI>
-<LI><A href="http://www.clarkconnect.org/">ClarkConnect</A> from Point
- Clark Networks (Canada)</LI>
-<LI><A href="http://www.trustix.net/">Trustix Secure Linux</A> (Norway)</LI>
-</UL>
-<H3><A name="fw_dist">Firewall distributions</A></H3>
-<P>Several distributions intended for firewall and router applications
- include FreeS/WAN:</P>
-<UL>
-<LI>The<A href="http://www.linuxrouter.org/"> Linux Router Project</A>
- produces a Linux distribution that will boot from a single floppy. The<A
-href="http://leaf.sourceforge.net"> LEAF</A> firewall project provides
- several different LRP-based firewall packages. At least one of them,
- Charles Steinkuehler's Dachstein, includes FreeS/WAN with X.509
- patches.</LI>
-<LI>there are several distributions bootable directly from CD-ROM,
- usable on a machine without hard disk.
-<UL>
-<LI>Dachstein (see above) can be used this way</LI>
-<LI><A href="http://www.gibraltar.at/">Gibraltar</A> is based on Debian
- GNU/Linux.</LI>
-<LI>at time of writing,<A href="www.xiloo.com"> Xiloo</A> is available
- only in Chinese. An English version is expected.</LI>
-</UL>
-</LI>
-<LI><A href="http://www.astaro.com/products/index.html">Astaro Security
- Linux</A> includes FreeS/WAN. It has some web-based tools for managing
- the firewall that include FreeS/WAN configuration management.</LI>
-<LI><A href="http://www.linuxwall.de">Linuxwall</A></LI>
-<LI><A href="http://www.smoothwall.org/">Smoothwall</A></LI>
-<LI><A href="http://www.devil-linux.org/">Devil Linux</A></LI>
-<LI>Coyote Linux has a<A href="http://embedded.coyotelinux.com/wolverine/index.php">
- Wolverine</A> firewall/VPN server</LI>
-</UL>
-<P>There are also several sets of scripts available for managing a
- firewall which is also acting as a FreeS/WAN IPsec gateway. See this<A href="firewall.html#rules.pub">
- list</A>.</P>
-<H3><A name="turnkey">Firewall and VPN products</A></H3>
-<P>Several vendors use FreeS/WAN as the IPsec component of a turnkey
- firewall or VPN product.</P>
-<P>Software-only products:</P>
-<UL>
-<LI><A href="http://www.linuxmagic.com/vpn/index.html">Linux Magic</A>
- offer a VPN/Firewall product using FreeS/WAN</LI>
-<LI>The Software Group's<A href="http://www.wanware.com/sentinet/">
- Sentinet</A> product uses FreeS/WAN</LI>
-<LI><A href="http://www.merilus.com">Merilus</A> use FreeS/WAN in their
- Gateway Guardian firewall product</LI>
-</UL>
-<P>Products that include the hardware:</P>
-<UL>
-<LI>The<A href="http://www.lasat.com"> LASAT SafePipe[tm]</A> series. is
- an IPsec box based on an embedded MIPS running Linux with FreeS/WAN and
- a web-config front end. This company also host our freeswan.org web
- site.</LI>
-<LI>Merilus<A href="http://www.merilus.com/products/fc/index.shtml">
- Firecard</A> is a Linux firewall on a PCI card.</LI>
-<LI><A href="http://www.kyzo.com/">Kyzo</A> have a &quot;pizza box&quot; product
- line with various types of server, all running from flash. One of them
- is an IPsec/PPTP VPN server</LI>
-<LI><A href="http://www.pfn.com">PFN</A> use FreeS/WAN in some of their
- products</LI>
-</UL>
-<P><A href="www.rebel.com">Rebel.com</A>, makers of the Netwinder Linux
- machines (ARM or Crusoe based), had a product that used FreeS/WAN. The
- company is in receivership so the future of the Netwinder is at best
- unclear.<A href="web.html#patch"> PKIX patches</A> for FreeS/WAN
- developed at Rebel are listed in our web links document.</P>
-<H2><A name="docs">Information sources</A></H2>
-<H3><A name="docformats">This HowTo, in multiple formats</A></H3>
-<P>FreeS/WAN documentation up to version 1.5 was available only in HTML.
- Now we ship two formats:</P>
-<UL>
-<LI>as HTML, one file for each doc section plus a global<A href="toc.html">
- Table of Contents</A></LI>
-<LI><A href="HowTo.html">one big HTML file</A> for easy searching</LI>
-</UL>
-<P>and provide a Makefile to generate other formats if required:</P>
-<UL>
-<LI><A href="HowTo.pdf">PDF</A></LI>
-<LI><A href="HowTo.ps">Postscript</A></LI>
-<LI><A href="HowTo.txt">ASCII text</A></LI>
-</UL>
-<P>The Makefile assumes the htmldoc tool is available. You can download
- it from<A href="http://www.easysw.com"> Easy Software</A>.</P>
-<P>All formats should be available at the following websites:</P>
-<UL>
-<LI><A href="http://www.freeswan.org/doc.html">FreeS/WAN project</A></LI>
-<LI><A href="http://www.linuxdoc.org">Linux Documentation Project</A></LI>
-</UL>
-<P>The distribution tarball has only the two HTML formats.</P>
-<P><STRONG>Note:</STRONG> If you need the latest doc version, for
- example to see if anyone has managed to set up interoperation between
- FreeS/WAN and whatever, then you should download the current snapshot.
- What is on the web is documentation as of the last release. Snapshots
- have all changes I've checked in to date.</P>
-<H3><A name="rtfm">RTFM (please Read The Fine Manuals)</A></H3>
-<P>As with most things on any Unix-like system, most parts of Linux
- FreeS/WAN are documented in online manual pages. We provide a list of<A href="/mnt/floppy/manpages.html">
- FreeS/WAN man pages</A>, with links to HTML versions of them.</P>
-<P>The man pages describing configuration files are:</P>
-<UL>
-<LI><A href="/mnt/floppy/manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A></LI>
-<LI><A href="/mnt/floppy/manpage.d/ipsec.secrets.5.html">
-ipsec.secrets(5)</A></LI>
-</UL>
-<P>Man pages for common commands include:</P>
-<UL>
-<LI><A href="/mnt/floppy/manpage.d/ipsec.8.html">ipsec(8)</A></LI>
-<LI><A href="/mnt/floppy/manpage.d/ipsec_pluto.8.html">ipsec_pluto(8)</A>
-</LI>
-<LI><A href="/mnt/floppy/manpage.d/ipsec_newhostkey.8.html">
-ipsec_newhostkey(8)</A></LI>
-<LI><A href="/mnt/floppy/manpage.d/ipsec_auto.8.html">ipsec_auto(8)</A></LI>
-</UL>
-<P>You can read these either in HTML using the links above or with the<VAR>
- man(1)</VAR> command.</P>
-<P>In the event of disagreement between this HTML documentation and the
- man pages, the man pages are more likely correct since they are written
- by the implementers. Please report any such inconsistency on the<A href="mail.html#lists">
- mailing list</A>.</P>
-<H3><A name="text">Other documents in the distribution</A></H3>
-<P>Text files in the main distribution directory are README, INSTALL,
- CREDITS, CHANGES, BUGS and COPYING.</P>
-<P>The Libdes encryption library we use has its own documentation. You
- can find it in the library directory..</P>
-<H3><A name="assumptions">Background material</A></H3>
-<P>Throughout this documentation, I write as if the reader had at least
- a general familiarity with Linux, with Internet Protocol networking,
- and with the basic ideas of system and network security. Of course that
- will certainly not be true for all readers, and quite likely not even
- for a majority.</P>
-<P>However, I must limit amount of detail on these topics in the main
- text. For one thing, I don't understand all the details of those topics
- myself. Even if I did, trying to explain everything here would produce
- extremely long and almost completely unreadable documentation.</P>
-<P>If one or more of those areas is unknown territory for you, there are
- plenty of other resources you could look at:</P>
-<DL>
-<DT>Linux</DT>
-<DD>the<A href="http://www.linuxdoc.org"> Linux Documentation Project</A>
- or a local<A href="http://www.linux.org/groups/"> Linux User Group</A>
- and these<A href="web.html#linux.link"> links</A></DD>
-<DT>IP networks</DT>
-<DD>Rusty Russell's<A href="http://netfilter.samba.org/unreliable-guides/networking-concepts-HOWTO/index.html">
- Networking Concepts HowTo</A> and these<A href="web.html#IP.background">
- links</A></DD>
-<DT>Security</DT>
-<DD>Schneier's book<A href="biblio.html#secrets"> Secrets and Lies</A>
- and these<A href="web.html#crypto.link"> links</A></DD>
-</DL>
-<P>Also, I do make an effort to provide some background material in
- these documents. All the basic ideas behind IPsec and FreeS/WAN are
- explained here. Explanations that do not fit in the main text, or that
- not everyone will need, are often in the<A href="glossary.html#ourgloss">
- glossary</A>, which is the largest single file in this document set.
- There is also a<A href="background.html#background"> background</A>
- file containing various explanations too long to fit in glossary
- definitions. All files are heavily sprinkled with links to each other
- and to the glossary.<STRONG> If some passage makes no sense to you, try
- the links</STRONG>.</P>
-<P>For other reference material, see the<A href="biblio.html#biblio">
- bibliography</A> and our collection of<A href="web.html#weblinks"> web
- links</A>.</P>
-<P>Of course, no doubt I get this (and other things) wrong sometimes.
- Feedback via the<A href="mail.html#lists"> mailing lists</A> is
- welcome.</P>
-<H3><A name="archives">Archives of the project mailing list</A></H3>
-<P>Until quite recently, there was only one FreeS/WAN mailing list, and
- archives of it were:</P>
-<UL>
-<LI><A href="http://www.sandelman.ottawa.on.ca/linux-ipsec">Canada</A></LI>
-<LI><A href="http://www.nexial.com">Holland</A></LI>
-</UL>
- The two archives use completely different search engines. You might
- want to try both.
-<P>More recently we have expanded to five lists, each with its own
- archive.</P>
-<P><A href="mail.html#lists">More information</A> on mailing lists.</P>
-<H3><A name="howto">User-written HowTo information</A></H3>
-<P>Various user-written HowTo documents are available. The ones covering
- FreeS/WAN-to-FreeS/WAN connections are:</P>
-<UL>
-<LI>Jean-Francois Nadeau's<A href="http://jixen.tripod.com/"> practical
- configurations</A> document</LI>
-<LI>Jens Zerbst's HowTo on<A href="http://dynipsec.tripod.com/"> Using
- FreeS/WAN with dynamic IP addresses</A>.</LI>
-<LI>an entry in Kurt Seifried's<A href="http://www.securityportal.com/lskb/kben00000013.html">
- Linux Security Knowledge Base</A>.</LI>
-<LI>a section of David Ranch's<A href="http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html#trinityos">
- Trinity OS Guide</A></LI>
-<LI>a section in David Bander's book<A href="biblio.html#bander"> Linux
- Security Toolkit</A></LI>
-</UL>
-<P>User-wriiten HowTo material may be<STRONG> especially helpful if you
- need to interoperate with another IPsec implementation</STRONG>. We
- have neither the equipment nor the manpower to test such
- configurations. Users seem to be doing an admirable job of filling the
- gaps.</P>
-<UL>
-<LI>list of user-written<A href="interop.html#otherpub"> interoperation
- HowTos</A> in our interop document</LI>
-</UL>
-<P>Check what version of FreeS/WAN user-written documents cover. The
- software is under active development and the current version may be
- significantly different from what an older document describes.</P>
-<H3><A name="applied">Papers on FreeS/WAN</A></H3>
-<P>Two design documents show team thinking on new developments:</P>
-<UL>
-<LI><A href="opportunism.spec">Opportunistic Encryption</A> by technical
- lead Henry Spencer and Pluto programmer Hugh Redelemeier</LI>
-<LI>discussion of<A href="http://www.sandelman.ottawa.on.ca/SSW/freeswan/klips2req/">
- KLIPS redesign</A></LI>
-</UL>
-<P>Both documents are works in progress and are frequently revised. For
- the latest version, see the<A href="mail.html#lists"> design mailing
- list</A>. Comments should go to that list.</P>
-<P>There is now an<A href="http://www.ietf.org/internet-drafts/draft-richardson-ipsec-opportunistic-06.txt">
- Internet Draft on Opportunistic Encryption</A> by Michael Richardson,
- Hugh Redelmeier and Henry Spencer. This is a first step toward getting
- the protocol standardised so there can be multiple implementations of
- it. Discussion of it takes place on the<A href="http://www.ietf.org/html.charters/ipsec-charter.html">
- IETF IPsec Working Group</A> mailing list.</P>
-<P>A number of papers giving further background on FreeS/WAN, or
- exploring its future or its applications, are also available:</P>
-<UL>
-<LI>Both Henry and Richard gave talks on FreeS/WAN at the 2000<A href="http://www.linuxsymposium.org">
- Ottawa Linux Symposium</A>.
-<UL>
-<LI>Richard's<A href="http://www.conscoop.ottawa.on.ca/rgb/freeswan/ols2k/">
- slides</A></LI>
-<LI>Henry's paper</LI>
-<LI>MP3 audio of their talks is available from the<A href="http://www.linuxsymposium.org/">
- conference page</A></LI>
-</UL>
-</LI>
-<LI><CITE>Moat: A Virtual Private Network Appliances and Services
- Platform</CITE> is a paper about large-scale (a few 100 links) use of
- FreeS/WAN in a production application at AT&amp;T Research. It is available
- in Postscript or PDF from co-author Steve Bellovin's<A href="http://www.research.att.com/~smb/papers/index.html">
- papers list page</A>.</LI>
-<LI>One of the Moat co-authors, John Denker, has also written
-<UL>
-<LI>a<A href="http://www.av8n.com/vpn/ipsec+routing.htm"> proposal</A>
- for how future versions of FreeS/WAN might interact with routing
- protocols</LI>
-<LI>a<A href="http://www.av8n.com/vpn/wishlist.htm"> wishlist</A> of
- possible new features</LI>
-</UL>
-</LI>
-<LI>Bart Trojanowski's web page has a draft design for<A href="http://www.jukie.net/~bart/linux-ipsec/">
- hardware acceleration</A> of FreeS/WAN</LI>
-</UL>
-<P>Several of these provoked interesting discussions on the mailing
- lists, worth searching for in the<A href="mail.html#archive"> archives</A>
-.</P>
-<P>There are also several papers in languages other than English, see
- our<A href="web.html#otherlang"> web links</A>.</P>
-<H3><A name="licensing">License and copyright information</A></H3>
-<P>All code and documentation written for this project is distributed
- under either the GNU General Public License (<A href="glossary.html#GPL">
-GPL</A>) or the GNU Library General Public License. For details see the
- COPYING file in the distribution.</P>
-<P>Not all code in the distribution is ours, however. See the CREDITS
- file for details. In particular, note that the<A href="glossary.html#LIBDES">
- Libdes</A> library and the version of<A href="glossary.html#MD5"> MD5</A>
- that we use each have their own license.</P>
-<H2><A name="sites">Distribution sites</A></H2>
-<P>FreeS/WAN is available from a number of sites.</P>
-<H3><A NAME="1_5_1">Primary site</A></H3>
-<P>Our primary site, is at xs4all (Thanks, folks!) in Holland:</P>
-<UL>
-<LI><A href="http://www.xs4all.nl/~freeswan">HTTP</A></LI>
-<LI><A href="ftp://ftp.xs4all.nl/pub/crypto/freeswan">FTP</A></LI>
-</UL>
-<H3><A name="mirrors">Mirrors</A></H3>
-<P>There are also mirror sites all over the world:</P>
-<UL>
-<LI><A href="http://www.flora.org/freeswan">Eastern Canada</A> (limited
- resouces)</LI>
-<LI><A href="ftp://ludwig.doculink.com/pub/freeswan/">Eastern Canada</A>
- (has older versions too)</LI>
-<LI><A href="ftp://ntsc.notBSD.org/pub/crypto/freeswan/">Eastern Canada</A>
- (has older versions too)</LI>
-<LI><A href="ftp://ftp.kame.net/pub/freeswan/">Japan</A></LI>
-<LI><A href="ftp://ftp.futuredynamics.com/freecrypto/FreeSWAN/">Hong
- Kong</A></LI>
-<LI><A href="ftp://ipsec.dk/pub/freeswan/">Denmark</A></LI>
-<LI><A href="ftp://ftp.net.lut.ac.uk/freeswan">the UK</A></LI>
-<LI><A href="http://storm.alert.sk/comp/mirrors/freeswan/">Slovak
- Republic</A></LI>
-<LI><A href="http://the.wiretapped.net/security/vpn-tunnelling/freeswan/">
-Australia</A></LI>
-<LI><A href="http://freeswan.technolust.cx/">technolust</A></LI>
-<LI><A href="http://freeswan.devguide.de/">Germany</A></LI>
-<LI>Ivan Moore's<A href="http://snowcrash.tdyc.com/freeswan/"> site</A></LI>
-<LI>the<A href="http://www.cryptoarchive.net/"> Crypto Archive</A> on
- the<A href="http://www.securityportal.com/"> Security Portal</A> site</LI>
-<LI><A href="http://www.wiretapped.net/">Wiretapped.net</A> in Australia</LI>
-</UL>
-<P>Thanks to those folks as well.</P>
-<H3><A name="munitions">The &quot;munitions&quot; archive of Linux crypto software</A>
-</H3>
-<P>There is also an archive of Linux crypto software called &quot;munitions&quot;,
- with its own mirrors in a number of countries. It includes FreeS/WAN,
- though not always the latest version. Some of its sites are:</P>
-<UL>
-<LI><A href="http://munitions.vipul.net/">Germany</A></LI>
-<LI><A href="http://munitions.iglu.cjb.net/">Italy</A></LI>
-<LI><A href="http://munitions2.xs4all.nl/">Netherlands</A></LI>
-</UL>
-<P>Any of those will have a list of other &quot;munitions&quot; mirrors. There is
- also a CD available.</P>
-<H2><A NAME="1_6">Links to other sections</A></H2>
-<P>For more detailed background information, see:</P>
-<UL>
-<LI><A href="politics.html#politics">history and politics</A> of
- cryptography</LI>
-<LI><A href="ipsec.html#ipsec.detail">IPsec protocols</A></LI>
-</UL>
-<P>To begin working with FreeS/WAN, go to our<A href="quickstart.html#quick.guide">
- quickstart</A> guide.</P>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="upgrading.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/ipsec.conf.2_to_1 b/doc/ipsec.conf.2_to_1
deleted file mode 100644
index 3100ed78d..000000000
--- a/doc/ipsec.conf.2_to_1
+++ /dev/null
@@ -1,22 +0,0 @@
-version 2
-# If you put the preceding line in front of a 1.x ipsec.conf, 
-# it should work within 2.x.
-
-
-# Merge the following sections with your existing config setup
-# and conn %default.
-# Allot these values to any you have not explictly defined.
-
-config setup
-        interfaces=%none     # new default is %defaultroute
-        plutoload=%none     # new default is %search
-        plutostart=%none     # new default is %search
-
-conn %default
-        uniqueids=no     # new default is yes
-        keyingtries=3     # new default is %forever
-        disablearrivalcheck=yes     # new default is no
-        authby=secret     # new default is rsasig
-        leftrsasigkey=%none     # new default %dnsondemand
-        rightrsasigkey=%none     # new default %dnsondemand
-
diff --git a/doc/ipsec.html b/doc/ipsec.html
deleted file mode 100644
index 4fb27b92b..000000000
--- a/doc/ipsec.html
+++ /dev/null
@@ -1,1040 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="politics.html">Previous</A>
-<A HREF="mail.html">Next</A>
-<HR>
-<H1><A name="ipsec.detail">The IPsec protocols</A></H1>
-<P>This section provides information on the IPsec protocols which
- FreeS/WAN implements. For more detail, see the<A href="rfc.html"> RFCs</A>
-.</P>
-<P>The basic idea of IPsec is to provide security functions,<A href="glossary.html#authentication">
- authentication</A> and<A href="glossary.html#encryption"> encryption</A>
-, at the IP (Internet Protocol) level. This requires a higher-level
- protocol (IKE) to set things up for the IP-level services (ESP and AH).</P>
-<H2><A NAME="27_1">Protocols and phases</A></H2>
-<P>Three protocols are used in an IPsec implementation:</P>
-<DL>
-<DT>ESP, Encapsulating Security Payload</DT>
-<DD>Encrypts and/or authenticates data</DD>
-<DT>AH, Authentication Header</DT>
-<DD>Provides a packet authentication service</DD>
-<DT>IKE, Internet Key Exchange</DT>
-<DD>Negotiates connection parameters, including keys, for the other two</DD>
-</DL>
-<P>The term &quot;IPsec&quot; (also written as IPSEC) is slightly ambiguous. In
- some contexts, it includes all three of the above but in other contexts
- it refers only to AH and ESP.</P>
-<P>There is more detail below, but a quick summary of how the whole
- thing works is:</P>
-<DL>
-<DT>Phase one IKE (main mode exchange)</DT>
-<DD>sets up a keying channel (ISAKMP SA) between the two gateways</DD>
-<DT>Phase two IKE (quick mode exchange)</DT>
-<DD>sets up data channels (IPsec SAs)</DD>
-<DT>IPsec proper</DT>
-<DD>exchanges data using AH or ESP</DD>
-</DL>
-<P>Both phases of IKE are repeated periodically to automate re-keying.</P>
-<H2><A name="others">Applying IPsec</A></H2>
-<P>Authentication and encryption functions for network data can, of
- course, be provided at other levels. Many security protocols work at
- levels above IP.</P>
-<UL>
-<LI><A href="glossary.html#PGP">PGP</A> encrypts and authenticates mail
- messages</LI>
-<LI><A href="glossary.html#SSH">SSH</A> authenticates remote logins and
- then encrypts the session</LI>
-<LI><A href="glossary.html#SSL">SSL</A> or<A href="glossary.html#TLS">
- TLS</A> provides security at the sockets layer, e.g. for secure web
- browsing</LI>
-</UL>
-<P>and so on. Other techniques work at levels below IP. For example,
- data on a communications circuit or an entire network can be encrypted
- by specialised hardware. This is common practice in high-security
- applications.</P>
-<H3><A name="advantages">Advantages of IPsec</A></H3>
-<P>There are, however, advantages to doing it at the IP level instead
- of, or as well as, at other levels.</P>
-<P>IPsec is the<STRONG> most general way to provide these services for
- the Internet</STRONG>.</P>
-<UL>
-<LI>Higher-level services protect a<EM> single protocol</EM>; for
- example PGP protects mail.</LI>
-<LI>Lower level services protect a<EM> single medium</EM>; for example a
- pair of encryption boxes on the ends of a line make wiretaps on that
- line useless unless the attacker is capable of breaking the encryption.</LI>
-</UL>
-<P>IPsec, however, can protect<EM> any protocol</EM> running above IP
- and<EM> any medium</EM> which IP runs over. More to the point, it can
- protect a mixture of application protocols running over a complex
- combination of media. This is the normal situation for Internet
- communication; IPsec is the only general solution.</P>
-<P>IPsec can also provide some security services &quot;in the background&quot;,
- with<STRONG> no visible impact on users</STRONG>. To use<A href="glossary.html#PGP">
- PGP</A> encryption and signatures on mail, for example, the user must
- at least:</P>
-<UL>
-<LI>remember his or her passphrase,</LI>
-<LI>keep it secure</LI>
-<LI>follow procedures to validate correspondents' keys</LI>
-</UL>
-<P>These systems can be designed so that the burden on users is not
- onerous, but any system will place some requirements on users. No such
- system can hope to be secure if users are sloppy about meeting those
- requirements. The author has seen username and password stuck on
- terminals with post-it notes in an allegedly secure environment, for
- example.</P>
-<H3><A name="limitations">Limitations of IPsec</A></H3>
-<P>IPsec is designed to secure IP links between machines. It does that
- well, but it is important to remember that there are many things it
- does not do. Some of the important limitations are:</P>
-<DL>
-<DT><A name="depends">IPsec cannot be secure if your system isn't</A></DT>
-<DD>System security on IPsec gateway machines is an essential
- requirement if IPsec is to function as designed. No system can be
- trusted if the underlying machine has been subverted. See books on Unix
- security such as<A href="biblio.html#practical"> Garfinkel and Spafford</A>
- or our web references for<A href="web.html#linsec"> Linux security</A>
- or more general<A href="web.html#compsec"> computer security</A>.
-<P>Of course, there is another side to this. IPsec can be a powerful
- tool for improving system and network security. For example, requiring
- packet authentication makes various spoofing attacks harder and IPsec
- tunnels can be extremely useful for secure remote administration of
- various things.</P>
-</DD>
-<DT><A name="not-end-to-end">IPsec is not end-to-end</A></DT>
-<DD>IPsec cannot provide the same end-to-end security as systems working
- at higher levels. IPsec encrypts an IP connection between two machines,
- which is quite a different thing than encrypting messages between users
- or between applications.
-<P>For example, if you need mail encrypted from the sender's desktop to
- the recipient's desktop and decryptable only by the recipient, use<A href="glossary.html#PGP">
- PGP</A> or another such system. IPsec can encrypt any or all of the
- links involved -- between the two mail servers, or between either
- server and its clients. It could even be used to secure a direct IP
- link from the sender's desktop machine to the recipient's, cutting out
- any sort of network snoop. What it cannot ensure is end-to-end
- user-to-user security. If only IPsec is used to secure mail, then
- anyone with appropriate privileges on any machine where that mail is
- stored (at either end or on any store-and-forward servers in the path)
- can read it.</P>
-<P>In another common setup, IPsec encrypts packets at a security gateway
- machine as they leave the sender's site and decrypts them on arrival at
- the gateway to the recipient's site. This does provide a useful
- security service -- only encrypted data is passed over the Internet --
- but it does not even come close to providing an end-to-end service. In
- particular, anyone with appropriate privileges on either site's LAN can
- intercept the message in unencrypted form.</P>
-</DD>
-<DT><A name="notpanacea">IPsec cannot do everything</A></DT>
-<DD>IPsec also cannot provide all the functions of systems working at
- higher levels of the protocol stack. If you need a document
- electronically signed by a particular person, then you need his or her<A
-href="glossary.html#signature"> digital signature</A> and a<A href="glossary.html#public">
- public key cryptosystem</A> to verify it with.
-<P>Note, however, that IPsec authentication of the underlying
- communication can make various attacks on higher-level protocols more
- difficult. In particular, authentication prevents<A href="glossary.html#middle">
- man-in-the-middle attacks</A>.</P>
-</DD>
-<DT><A name="no_user">IPsec authenticates machines, not users</A></DT>
-<DD>IPsec uses strong authentication mechanisms to control which
- messages go to which machines, but it does not have the concept of user
- ID, which is vital to many other security mechansims and policies. This
- means some care must be taken in fitting the various security
- mechansims on a network together. For example, if you need to control
- which users access your database server, you need some non-IPsec
- mechansim for that. IPsec can control which machines connect to the
- server, and can ensure that data transfer to those machines is done
- securely, but that is all. Either the machines themselves must control
- user access or there must be some form of user authentication to the
- database, independent of IPsec.</DD>
-<DT><A name="DoS">IPsec does not stop denial of service attacks</A></DT>
-<DD><A href="glossary.html#DOS">Denial of service</A> attacks aim at
- causing a system to crash, overload, or become confused so that
- legitimate users cannot get whatever services the system is supposed to
- provide. These are quite different from attacks in which the attacker
- seeks either to use the service himself or to subvert the service into
- delivering incorrect results.
-<P>IPsec shifts the ground for DoS attacks; the attacks possible against
- systems using IPsec are different than those that might be used against
- other systems. It does not, however, eliminate the possibility of such
- attacks.</P>
-</DD>
-<DT><A name="traffic">IPsec does not stop traffic analysis</A></DT>
-<DD><A href="glossary.html#traffic">Traffic analysis</A> is the attempt
- to derive intelligence from messages without regard for their contents.
- In the case of IPsec, it would mean analysis based on things visible in
- the unencrypted headers of encrypted packets -- source and destination
- gateway addresses, packet size, et cetera. Given the resources to
- acquire such data and some skill in analysing it (both of which any
- national intelligence agency should have), this can be a very powerful
- technique.
-<P>IPsec is not designed to defend against this. Partial defenses are
- certainly possible, and some are<A href="#traffic.resist"> described
- below</A>, but it is not clear that any complete defense can be
- provided.</P>
-</DD>
-</DL>
-<H3><A name="uses">IPsec is a general mechanism for securing IP</A></H3>
-<P>While IPsec does not provide all functions of a mail encryption
- package, it can encrypt your mail. In particular, it can ensure that
- all mail passing between a pair or a group of sites is encrypted. An
- attacker looking only at external traffic, without access to anything
- on or behind the IPsec gateway, cannot read your mail. He or she is
- stymied by IPsec just as he or she would be by<A href="glossary.html#PGP">
- PGP</A>.</P>
-<P>The advantage is that IPsec can provide the same protection for<STRONG>
- anything transmitted over IP</STRONG>. In a corporate network example,
- PGP lets the branch offices exchange secure mail with head office. SSL
- and SSH allow them to securely view web pages, connect as terminals to
- machines, and so on. IPsec can support all those applications, plus
- database queries, file sharing (NFS or Windows), other protocols
- encapsulated in IP (Netware, Appletalk, ...), phone-over-IP,
- video-over-IP, ... anything-over-IP. The only limitation is that IP
- Multicast is not yet supported, though there are Internet Draft
- documents for that.</P>
-<P>IPsec creates<STRONG> secure tunnels through untrusted networks</STRONG>
-. Sites connected by these tunnels form VPNs,<A href="glossary.html#VPN">
- Virtual Private Networks</A>.</P>
-<P>IPsec gateways can be installed wherever they are required.</P>
-<UL>
-<LI>One organisation might choose to install IPsec only on firewalls
- between their LANs and the Internet. This would allow them to create a
- VPN linking several offices. It would provide protection against anyone
- outside their sites.</LI>
-<LI>Another might install IPsec on departmental servers so everything on
- the corporate backbone net was encrypted. This would protect messages
- on that net from everyone except the sending and receiving department.</LI>
-<LI>Another might be less concerned with information secrecy and more
- with controlling access to certain resources. They might use IPsec
- packet authentication as part of an access control mechanism, with or
- without also using the IPsec encryption service.</LI>
-<LI>It is even possible (assuming adequate processing power and an IPsec
- implementation in each node) to make every machine its own IPsec
- gateway so that everything on a LAN is encrypted. This protects
- information from everyone outside the sending and receiving machine.</LI>
-<LI>These techniques can be combined in various ways. One might, for
- example, require authentication everywhere on a network while using
- encryption only for a few links.</LI>
-</UL>
-<P>Which of these, or of the many other possible variants, to use is up
- to you.<STRONG> IPsec provides mechanisms; you provide the policy</STRONG>
-.</P>
-<P><STRONG>No end user action is required</STRONG> for IPsec security to
- be used; they don't even have to know about it. The site
- administrators, of course, do have to know about it and to put some
- effort into making it work. Poor administration can compromise IPsec as
- badly as the post-it notes mentioned above. It seems reasonable,
- though, for organisations to hope their system administrators are
- generally both more security-conscious than end users and more able to
- follow computer security procedures. If not, at least there are fewer
- of them to educate or replace.</P>
-<P>IPsec can be, and often should be, used with along with security
- protocols at other levels. If two sites communicate with each other via
- the Internet, then IPsec is the obvious way to protect that
- communication. If two others have a direct link between them, either
- link encryption or IPsec would make sense. Choose one or use both.
- Whatever you use at and below the IP level, use other things as
- required above that level. Whatever you use above the IP level,
- consider what can be done with IPsec to make attacks on the higher
- levels harder. For example,<A href="glossary.html#middle">
- man-in-the-middle attacks</A> on various protocols become difficult if
- authentication at packet level is in use on the potential victims'
- communication channel.</P>
-<H3><A name="authonly">Using authentication without encryption</A></H3>
-<P>Where appropriate, IPsec can provide authentication without
- encryption. One might do this, for example:</P>
-<UL>
-<LI>where the data is public but one wants to be sure of getting the
- right data, for example on some web sites</LI>
-<LI>where encryption is judged unnecessary, for example on some company
- or department LANs</LI>
-<LI>where strong encryption is provided at link level, below IP</LI>
-<LI>where strong encryption is provided in other protocols, above IP
-<BR> Note that IPsec authentication may make some attacks on those
- protocols harder.</LI>
-</UL>
-<P>Authentication has lower overheads than encryption.</P>
-<P>The protocols provide four ways to build such connections, using
- either an AH-only connection or ESP using null encryption, and in
- either manually or automatically keyed mode. FreeS/WAN supports only
- one of these, manually keyed AH-only connections, and<STRONG> we do not
- recommend using that</STRONG>. Our reasons are discussed under<A href="#traffic.resist">
- Resisting traffic analysis</A> a few sections further along.</P>
-<H3><A name="encnoauth">Encryption without authentication is dangerous</A>
-</H3>
-<P>Originally, the IPsec encryption protocol<A href="glossary.html#ESP">
- ESP</A> didn't do integrity checking. It only did encryption. Steve
- Bellovin found many ways to attack ESP used without authentication. See
- his paper<A href="http://www.research.att.com/~smb/papers/badesp.ps">
- Problem areas for the IP Security Protocols</A>. To make a secure
- connection, you had to add an<A href="glossary.html#AH"> AH</A>
- Authentication Header as well as ESP. Rather than incur the overhead of
- several layers (and rather than provide an ESP layer that didn't
- actually protect the traffic), the IPsec working group built integrity
- and replay checking directly into ESP.</P>
-<P>Today, typical usage is one of:</P>
-<UL>
-<LI>ESP for encryption and authentication</LI>
-<LI>AH for authentication alone</LI>
-</UL>
-<P>Other variants are allowed by the standard, but not much used:</P>
-<DL>
-<DT>ESP encryption without authentication</DT>
-<DD><STRONG>Bellovin has demonstrated fatal flaws in this. Do not use.</STRONG>
-</DD>
-<DT>ESP encryption with AH authentication</DT>
-<DD>This has higher overheads than using the authentication in ESP, and
- no obvious benefit in most cases. The exception might be a network
- where AH authentication was widely or universally used. If you're going
- to do AH to conform with network policy, why authenticate again in the
- ESP layer?</DD>
-<DT>Authenticate twice, with AH and with ESP</DT>
-<DD>Why? Of course, some folk consider &quot;belt and suspenders&quot; the
- sensible approach to security. If you're among them, you might use both
- protocols here. You might also use both to satisfy different parts of a
- security policy. For example, an organisation might require AH
- authentication everywhere but two users within the organisation might
- use ESP as well.</DD>
-<DT>ESP authentication without encryption</DT>
-<DD>The standard allows this, calling it &quot;null encryption&quot;. FreeS/WAN
- does not support it. We recommend that you use AH instead if
- authentication is all you require. AH authenticates parts of the IP
- header, which ESP-null does not do.</DD>
-</DL>
-<P>Some of these variants cannot be used with FreeS/WAN because we do
- not support ESP-null and do not support automatic keying of AH-only
- connections.</P>
-<P>There are fairly frequent suggestions that AH be dropped entirely
- from the IPsec specifications since ESP and null encryption can handle
- that situation. It is not clear whether this will occur. My guess is
- that it is unlikely.</P>
-<H3><A name="multilayer">Multiple layers of IPsec processing are
- possible</A></H3>
-<P>The above describes combinations possible on a single IPsec
- connection. In a complex network you may have several layers of IPsec
- in play, with any of the above combinations at each layer.</P>
-<P>For example, a connection from a desktop machine to a database server
- might require AH authentication. Working with other host, network and
- database security measures, AH might be just the thing for access
- control. You might decide not to use ESP encryption on such packets,
- since it uses resources and might complicate network debugging. Within
- the site where the server is, then, only AH would be used on those
- packets.</P>
-<P>Users at another office, however, might have their whole connection
- (AH headers and all) passing over an IPsec tunnel connecting their
- office to the one with the database server. Such a tunnel should use
- ESP encryption and authentication. You need authentication in this
- layer because without authentication the encryption is vulnerable and
- the gateway cannot verify the AH authentication. The AH is between
- client and database server; the gateways aren't party to it.</P>
-<P>In this situation, some packets would get multiple layers of IPsec
- applied to them, AH on an end-to-end client-to-server basis and ESP
- from one office's security gateway to the other.</P>
-<H3><A name="traffic.resist">Resisting traffic analysis</A></H3>
-<P><A href="glossary.html#traffic">Traffic analysis</A> is the attempt
- to derive useful intelligence from encrypted traffic without breaking
- the encryption.</P>
-<P>Is your CEO exchanging email with a venture capital firm? With
- bankruptcy trustees? With an executive recruiting agency? With the
- holder of some important patents? If an eavesdropper learns about any
- of those, then he has interesting intelligence on your company, whether
- or not he can read the messages themselves.</P>
-<P>Even just knowing that there is network traffic between two sites may
- tell an analyst something useful, especially when combined with
- whatever other information he or she may have. For example, if you know
- Company A is having cashflow problems and Company B is looking for
- aquisitions, then knowing that packets are passing between the two is
- interesting. It is more interesting if you can tell it is email, and
- perhaps yet more if you know the sender and recipient.</P>
-<P>Except in the simplest cases, traffic analysis is hard to do well. It
- requires both considerable resources and considerable analytic skill.
- However, intelligence agencies of various nations have been doing it
- for centuries and many of them are likely quite good at it by now.
- Various commercial organisations, especially those working on &quot;targeted
- marketing&quot; may also be quite good at analysing certain types of
- traffic.</P>
-<P>In general, defending against traffic analysis is also difficult.
- Inventing a really good defense could get you a PhD and some
- interesting job offers.</P>
-<P>IPsec is not designed to stop traffic analysis and we know of no
- plausible method of extending it to do so. That said, there are ways to
- make traffic analysis harder. This section describes them.</P>
-<H4><A name="extra">Using &quot;unnecessary&quot; encryption</A></H4>
-<P>One might choose to use encryption even where it appears unnecessary
- in order to make analysis more difficult. Consider two offices which
- pass a small volume of business data between them using IPsec and also
- transfer large volumes of Usenet news. At first glance, it would seem
- silly to encrypt the newsfeed, except possibly for any newsgroups that
- are internal to the company. Why encrypt data that is all publicly
- available from many sites?</P>
-<P>However, if we encrypt a lot of news and send it down the same
- connection as our business data, we make<A href="glossary.html#traffic">
- traffic analysis</A> much harder. A snoop cannot now make inferences
- based on patterns in the volume, direction, sizes, sender, destination,
- or timing of our business messages. Those messages are hidden in a mass
- of news messages encapsulated in the same way.</P>
-<P>If we're going to do this we need to ensure that keys change often
- enough to remain secure even with high volumes and with the adversary
- able to get plaintext of much of the data. We also need to look at
- other attacks this might open up. For example, can the adversary use a
- chosen plaintext attack, deliberately posting news articles which, when
- we receive and encrypt them, will help break our encryption? Or can he
- block our business data transmission by flooding us with silly news
- articles? Or ...</P>
-<P>Also, note that this does not provide complete protection against
- traffic analysis. A clever adversary might still deduce useful
- intelligence from statistical analysis (perhaps comparing the input
- newsfeed to encrypted output, or comparing the streams we send to
- different branch offices), or by looking for small packets which might
- indicate establishment of TCP connections, or ...</P>
-<P>As a general rule, though, to improve resistance to traffic analysis,
- you should<STRONG> encrypt as much traffic as possible, not just as
- much as seems necessary.</STRONG></P>
-<H4><A name="multi-encrypt">Using multiple encryption</A></H4>
-<P>This also applies to using multiple layers of encryption. If you have
- an IPsec tunnel between two branch offices, it might appear silly to
- send<A href="glossary.html#PGP"> PGP</A>-encrypted email through that
- tunnel. However, if you suspect someone is snooping your traffic, then
- it does make sense:</P>
-<UL>
-<LI>it protects the mail headers; they cannot even see who is mailing
- who</LI>
-<LI>it protects against user bungles or software malfunctions that
- accidentally send messages in the clear</LI>
-<LI>it makes any attack on the mail encryption much harder; they have to
- break IPsec or break into your network before they can start on the
- mail encryption</LI>
-</UL>
-<P>Similar arguments apply for<A href="glossary.html#SSL"> SSL</A>
--encrypted web traffic or<A href="glossary.html#SSH"> SSH</A>-encrypted
- remote login sessions, even for end-to-end IPsec tunnels between
- systems in the two offices.</P>
-<H4><A name="fewer">Using fewer tunnels</A></H4>
-<P>It may also help to use fewer tunnels. For example, if all you
- actually need encrypted is connections between:</P>
-<UL>
-<LI>mail servers at branch and head offices</LI>
-<LI>a few branch office users and the head office database server</LI>
-</UL>
-<P>You might build one tunnel per mail server and one per remote
- database user, restricting traffic to those applications. This gives
- the traffic analyst some information, however. He or she can
- distinguish the tunnels by looking at information in the ESP header
- and, given that distinction and the patterns of tunnel usage, might be
- able to figure out something useful. Perhaps not, but why take the
- risk?</P>
-<P>We suggest instead that you build one tunnel per branch office,
- encrypting everything passing from head office to branches. This has a
- number of advantages:</P>
-<UL>
-<LI>it is easier to build and administer</LI>
-<LI>it resists traffic analysis somewhat better</LI>
-<LI>it provides security for whatever you forgot. For example, if some
- user at a remote office browses proprietary company data on some head
- office web page (that the security people may not even know about!),
- then that data is encrypted before it reaches the Internet.</LI>
-</UL>
-<P>Of course you might also want to add additional tunnels. For example,
- if some of the database data is confidential and should not be exposed
- even within the company, then you need protection from the user's
- desktop to the database server. We suggest you do that in whatever way
- seems appropriate -- IPsec, SSH or SSL might fit -- but, whatever you
- choose, pass it between locations via a gateway-to-gateway IPsec tunnel
- to provide some resistance to traffic analysis.</P>
-<H2><A name="primitives">Cryptographic components</A></H2>
-<P>IPsec combines a number of cryptographic techniques, all of them
- well-known and well-analyzed. The overall design approach was
- conservative; no new or poorly-understood components were included.</P>
-<P>This section gives a brief overview of each technique. It is intended
- only as an introduction. There is more information, and links to
- related topics, in our<A href="glossary.html"> glossary</A>. See also
- our<A href="biblio.html"> bibliography</A> and cryptography<A href="web.html#crypto.link">
- web links</A>.</P>
-<H3><A name="block.cipher">Block ciphers</A></H3>
-<P>The<A href="glossary.html#encryption"> encryption</A> in the<A href="glossary.html#ESP">
- ESP</A> encapsulation protocol is done with a<A href="glossary.html#block">
- block cipher</A>.</P>
-<P>We do not implement<A href="glossary.html#DES"> single DES</A>. It is<A
-href="politics.html#desnotsecure"> insecure</A>. Our default, and
- currently only, block cipher is<A href="glossary.html#3DES"> triple DES</A>
-.</P>
-<P>The<A href="glossary.html#rijndael"> Rijndael</A> block cipher has
- won the<A href="glossary.html#AES"> AES</A> competition to choose a
- relacement for DES. It will almost certainly be added to FreeS/WAN and
- to other IPsec implementations.<A href="web.html#patch"> Patches</A>
- are already available.</P>
-<H3><A name="hash.ipsec">Hash functions</A></H3>
-<H4><A name="hmac.ipsec">The HMAC construct</A></H4>
-<P>IPsec packet authentication is done with the<A href="glossary.html#HMAC">
- HMAC</A> construct. This is not just a hash of the packet data, but a
- more complex operation which uses both a hashing algorithm and a key.
- It therefore does more than a simple hash would. A simple hash would
- only tell you that the packet data was not changed in transit, or that
- whoever changed it also regenerated the hash. An HMAC also tells you
- that the sender knew the HMAC key.</P>
-<P>For IPsec HMAC, the output of the hash algorithm is truncated to 96
- bits. This saves some space in the packets. More important, it prevents
- an attacker from seeing all the hash output bits and perhaps creating
- some sort of attack based on that knowledge.</P>
-<H4>Choice of hash algorithm</H4>
-<P>The IPsec RFCs require two hash algorithms --<A href="glossary.html#MD5">
- MD5</A> and<A href="glossary.html#SHA"> SHA-1</A> -- both of which
- FreeS/WAN implements.</P>
-<P>Various other algorithms -- such as RIPEMD and Tiger -- are listed in
- the RFCs as optional. None of these are in the FreeS/WAN distribution,
- or are likely to be added, although user<A href="web.html#patch">
- patches</A> exist for several of them.</P>
-<P>Additional hash algorithms --<A href="glossary.html#SHA-256">
- SHA-256, SHA-384 and SHA-512</A> -- may be required to give hash
- strength matching the strength of<A href="glossary.html#AES"> AES</A>.
- These are likely to be added to FreeS/WAN along with AES.</P>
-<H3><A name="DH.keying">Diffie-Hellman key agreement</A></H3>
-<P>The<A href="glossary.html#DH"> Diffie-Hellman</A> key agreement
- protocol allows two parties (A and B or<A href="glossary.html#alicebob">
- Alice and Bob</A>) to agree on a key in such a way that an eavesdropper
- who intercepts the entire conversation cannot learn the key.</P>
-<P>The protocol is based on the<A href="glossary.html#dlog"> discrete
- logarithm</A> problem and is therefore thought to be secure.
- Mathematicians have been working on that problem for years and seem no
- closer to a solution, though there is no proof that an efficient
- solution is impossible.</P>
-<H3><A name="RSA.auth">RSA authentication</A></H3>
-<P>The<A href="glossary.html#RSA"> RSA</A> algorithm (named for its
- inventors -- Rivest, Shamir and Adleman) is a very widely used<A href="glossary.html#">
- public key</A> cryptographic technique. It is used in IPsec as one
- method of authenticating gateways for Diffie-Hellman key negotiation.</P>
-<H2><A name="structure">Structure of IPsec</A></H2>
-<P>There are three protocols used in an IPsec implementation:</P>
-<DL>
-<DT>ESP, Encapsulating Security Payload</DT>
-<DD>Encrypts and/or authenticates data</DD>
-<DT>AH, Authentication Header</DT>
-<DD>Provides a packet authentication service</DD>
-<DT>IKE, Internet Key Exchange</DT>
-<DD>Negotiates connection parameters, including keys, for the other two</DD>
-</DL>
-<P>The term &quot;IPsec&quot; is slightly ambiguous. In some contexts, it includes
- all three of the above but in other contexts it refers only to AH and
- ESP.</P>
-<H3><A name="IKE.ipsec">IKE (Internet Key Exchange)</A></H3>
-<P>The IKE protocol sets up IPsec (ESP or AH) connections after
- negotiating appropriate parameters (algorithms to be used, keys,
- connection lifetimes) for them. This is done by exchanging packets on
- UDP port 500 between the two gateways.</P>
-<P>IKE (RFC 2409) was the outcome of a long, complex process in which
- quite a number of protocols were proposed and debated. Oversimplifying
- mildly, IKE combines:</P>
-<DL>
-<DT>ISAKMP (RFC 2408)</DT>
-<DD>The<STRONG> I</STRONG>nternet<STRONG> S</STRONG>ecurity<STRONG> A</STRONG>
-ssociation and<STRONG> K</STRONG>ey<STRONG> M</STRONG>anagement<STRONG>
- P</STRONG>rotocol manages negotiation of connections and defines<A href="glossary.html#SA">
- SA</A>s (Security Associations) as a means of describing connection
- properties.</DD>
-<DT>IPsec DOI for ISAKMP (RFC 2407)</DT>
-<DD>A<STRONG> D</STRONG>omain<STRONG> O</STRONG>f<STRONG> I</STRONG>
-nterpretation fills in the details necessary to turn the rather abstract
- ISAKMP protocol into a more tightly specified protocol, so it becomes
- applicable in a particular domain.</DD>
-<DT>Oakley key determination protocol (RFC 2412)</DT>
-<DD>Oakley creates keys using the<A href="glossary.html#DH">
- Diffie-Hellman</A> key agreement protocol.</DD>
-</DL>
-<P>For all the details, you would need to read the four<A href="rfc.html">
- RFCs</A> just mentioned (over 200 pages) and a number of others. We
- give a summary below, but it is far from complete.</P>
-<H4><A name="phases">Phases of IKE</A></H4>
-<P>IKE negotiations have two phases.</P>
-<DL>
-<DT>Phase one</DT>
-<DD>The two gateways negotiate and set up a two-way ISAKMP SA which they
- can then use to handle phase two negotiations. One such SA between a
- pair of gateways can handle negotiations for multiple tunnels.</DD>
-<DT>Phase two</DT>
-<DD>Using the ISAKMP SA, the gateways negotiate IPsec (ESP and/or AH)
- SAs as required. IPsec SAs are unidirectional (a different key is used
- in each direction) and are always negotiated in pairs to handle two-way
- traffic. There may be more than one pair defined between two gateways.</DD>
-</DL>
-<P>Both of these phases use the UDP protocol and port 500 for their
- negotiations.</P>
-<P>After both IKE phases are complete, you have IPsec SAs to carry your
- encrypted data. These use the ESP or AH protocols. These protocols do
- not have ports. Ports apply only to UDP or TCP.</P>
-<P>The IKE protocol is designed to be extremely flexible. Among the
- things that can be negotiated (separately for each SA) are:</P>
-<UL>
-<LI>SA lifetime before rekeying</LI>
-<LI>encryption algorithm used. We currently support only<A href="glossary.html#3DES">
- triple DES</A>. Single DES is<A href="politics.html#desnotsecure">
- insecure</A>. The RFCs say you MUST do DES, SHOULD do 3DES and MAY do
- various others. We do not do any of the others.</LI>
-<LI>authentication algorithms. We support<A href="glossary.html#MD5">
- MD5</A> and<A href="glossary.html#SHA"> SHA</A>. These are the two the
- RFCs require.</LI>
-<LI>choice of group for<A href="glossary.html#DH"> Diffie-Hellman</A>
- key agreement. We currently support Groups 2 and 5 (which are defined
- modulo primes of various lengths) and do not support Group 1 (defined
- modulo a shorter prime, and therefore cryptographically weak) or groups
- 3 and 4 (defined using elliptic curves). The RFCs require only Group 1.</LI>
-</UL>
-<P>The protocol also allows implementations to add their own encryption
- algorithms, authentication algorithms or Diffie-Hellman groups. We do
- not support any such extensions, but there are some<A href="web.html#patch">
- patches</A> that do.</P>
-<P>There are a number of complications:</P>
-<UL>
-<LI>The gateways must be able to authenticate each other's identities
- before they can create a secure connection. This host authentication is
- part of phase one negotiations, and is a required prerequisite for
- packet authentication used later. Host authentication can be done in a
- variety of ways. Those supported by FreeS/WAN are discussed in our<A href="adv_config.html#auto-auth">
- advanced configuration</A> document.</LI>
-<LI>Phase one can be done in two ways.
-<UL>
-<LI>Main Mode is required by the RFCs and supported in FreeS/WAN. It
- uses a 6-packet exzchange.</LI>
-<LI>Aggressive Mode is somewhat faster (only 3 packets) but reveals more
- to an eavesdropper. This is optional in the RFCs, not currently
- supported by FreeS/WAN, and not likely to be.</LI>
-</UL>
-</LI>
-<LI>A new group exchange may take place after phase one but before phase
- two, defining an additional group for use in the<A href="glossary.html#DH">
- Diffie-Hellman</A> key agreement part of phase two. FreeS/WAN does not
- currently support this.</LI>
-<LI>Phase two always uses Quick Mode, but there are two variants of
- that:
-<UL>
-<LI>One variant provides<A href="glossary.html#PFS"> Perfect Forward
- Secrecy (PFS)</A>. An attacker that obtains your long-term host
- authentication key does not immediately get any of your short-term
- packet encryption of packet authentication keys. He must conduct
- another successful attack each time you rekey to get the short-term
- keys. Having some short-term keys does not help him learn others. In
- particular, breaking your system today does not let him read messages
- he archived yestarday, assuming you've changed short-term keys in the
- meanwhile. We enable PFS as the default.</LI>
-<LI>The other variant disables PFS and is therefore slightly faster. We
- do not recommend this since it is less secure, but FreeS/WAN does
- support it. You can enable it with a<VAR> pfs=no</VAR> statement in<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A>.</LI>
-<LI>The protocol provides no way to negotiate which variant will be
- used. If one gateway is set for PFS and the other is not, the
- negotiation fails. This has proved a fairly common source of
- interoperation problems.</LI>
-</UL>
-</LI>
-<LI>Several types of notification message may be sent by either side
- during either phase, or later. FreeS/WAN does not currently support
- these, but they are a likely addition in future releases.</LI>
-<LI>There is a commit flag which may optionally be set on some messages.
- The<A href="http://www.lounge.org/ike_doi_errata.html"> errata</A> page
- for the RFCs includes two changes related to this, one to clarify the
- description of its use and one to block a<A href="glossary.html#DOS">
- denial of service</A> attack which uses it. We currently do not
- implement this feature.</LI>
-</UL>
-<P>These complications can of course lead to problems, particularly when
- two different implementations attempt to interoperate. For example, we
- have seen problems such as:</P>
-<UL>
-<LI>Some implementations (often products crippled by<A href="politics.html#exlaw">
- export laws</A>) have the insecure DES algorithm as their only
- supported encryption method. Other parts of our documentation discuss
- the<A href="politics.html#desnotsecure"> reasons we do not implement
- single DES</A>, and<A href="interop.html#noDES"> how to cope with
- crippled products</A>.</LI>
-<LI>Windows 2000 IPsec tries to negotiate using Aggressive Mode, which
- we don't support. Later on, it uses the commit bit, which we also don't
- support.</LI>
-<LI>Various implementations disable PFS by default, and therefore will
- not talk to FreeS/WAN until you either turn on PFS on their end or turn
- it off in FreeS/WAN with a<VAR> pfs=no</VAR> entry in the connection
- description.</LI>
-<LI>FreeS/WAN's interaction with PGPnet is complicated by their use of
- notification messages we do not yet support.</LI>
-</UL>
-<P>Despite this, we do interoperate successfully with many
- implementations, including both Windows 2000 and PGPnet. Details are in
- our<A href="interop.html"> interoperability</A> document.</P>
-<H4><A name="sequence">Sequence of messages in IKE</A></H4>
-<P>Each phase (see<A href="#phases"> previous section</A>)of IKE
- involves a series of messages. In Pluto error messages, these are
- abbreviated using:</P>
-<DL>
-<DT>M</DT>
-<DD><STRONG>M</STRONG>ain mode, settting up the keying channel (ISAKMP
- SA)</DD>
-<DT>Q</DT>
-<DD><STRONG>Q</STRONG>uick mode, setting up the data channel (IPsec SA)</DD>
-<DT>I</DT>
-<DD><STRONG>I</STRONG>nitiator, the machine that starts the negotiation</DD>
-<DT>R</DT>
-<DD><STRONG>R</STRONG>esponder</DD>
-</DL>
-<P>For example, the six messages of a main mode negotiation, in
- sequence, are labelled:</P>
-<PRE>       MI1 ----------&gt;
-           &lt;---------- MR1
-       MI2 ----------&gt; 
-           &lt;---------- MR2
-       MI3 ----------&gt;
-           &lt;---------- MR3</PRE>
-<H4><A name="struct.exchange">Structure of IKE messages</A></H4>
-<P>Here is our Pluto developer explaining some of this on the mailing
- list:</P>
-<PRE>When one IKE system (for example, Pluto) is negotiating with another
-to create an SA, the Initiator proposes a bunch of choices and the
-Responder replies with one that it has selected.
-
-The structure of the choices is fairly complicated.  An SA payload
-contains a list of lists of &quot;Proposals&quot;.  The outer list is a set of
-choices: the selection must be from one element of this list.
-
-Each of these elements is a list of Proposals.  A selection must be
-made from each of the elements of the inner list.  In other words,
-*all* of them apply (that is how, for example, both AH and ESP can
-apply at once).
-
-Within each of these Proposals is a list of Transforms.  For each
-Proposal selected, one Transform must be selected (in other words,
-each Proposal provides a choice of Transforms).
-
-Each Transform is made up of a list of Attributes describing, well,
-attributes.  Such as lifetime of the SA.  Such as algorithm to be
-used.  All the Attributes apply to a Transform.
-
-You will have noticed a pattern here: layers alternate between being
-disjunctions (&quot;or&quot;) and conjunctions (&quot;and&quot;).
-
-For Phase 1 / Main Mode (negotiating an ISAKMP SA), this structure is
-cut back.  There must be exactly one Proposal.  So this degenerates to
-a list of Transforms, one of which must be chosen.</PRE>
-<H3><A name="services">IPsec Services, AH and ESP</A></H3>
-<P>IPsec offers two services,<A href="glossary.html#authentication">
- authentication</A> and<A href="glossary.html#encryption"> encryption</A>
-. These can be used separately but are often used together.</P>
-<DL>
-<DT>Authentication</DT>
-<DD>Packet-level authentication allows you to be confident that a packet
- came from a particular machine and that its contents were not altered
- en route to you. No attempt is made to conceal or protect the contents,
- only to assure their integrity. Packet authentication can be provided
- separately using an<A href="glossary.html#AH"> Authentication Header</A>
-, described just below, or it can be included as part of the<A href="glossary.html#ESP">
- ESP</A> (Encapsulated Security Payload) service, described in the
- following section. That service offers encryption as well as
- authentication. In either case, the<A href="glossary.html#HMAC"> HMAC</A>
- construct is used as the authentication mechanism.
-<P>There is a separate authentication operation at the IKE level, in
- which each gateway authenticates the other. This can be done in a
- variety of ways.</P>
-</DD>
-<DT>Encryption</DT>
-<DD>Encryption allows you to conceal the contents of a message from
- eavesdroppers.
-<P>In IPsec this is done using a<A href="glossary.html#block"> block
- cipher</A> (normally<A href="glossary.html#3DES"> Triple DES</A> for
- Linux). In the most used setup, keys are automatically negotiated, and
- periodically re-negotiated, using the<A href="glossary.html#IKE"> IKE</A>
- (Internet Key Exchange) protocol. In Linux FreeS/WAN this is handled by
- the Pluto Daemon.</P>
-<P>The IPsec protocol offering encryption is<A href="glossary.html#ESP">
- ESP</A>, Encapsulated Security Payload. It can also include a packet
- authentication service.</P>
-</DD>
-</DL>
-<P>Note that<STRONG> encryption should always be used with some packet
- authentication service</STRONG>. Unauthenticated encryption is
- vulnerable to<A href="glossary.html#middle"> man-in-the-middle attacks</A>
-. Also note that encryption does not prevent<A href="glossary.html#traffic">
- traffic analysis</A>.</P>
-<H3><A name="AH.ipsec">The Authentication Header (AH)</A></H3>
-<P>Packet authentication can be provided separately from encryption by
- adding an authentication header (AH) after the IP header but before the
- other headers on the packet. This is the subject of this section.
- Details are in RFC 2402.</P>
-<P>Each of the several headers on a packet header contains a &quot;next
- protocol&quot; field telling the system what header to look for next. IP
- headers generally have either TCP or UDP in this field. When IPsec
- authentication is used, the packet IP header has AH in this field,
- saying that an Authentication Header comes next. The AH header then has
- the next header type -- usually TCP, UDP or encapsulated IP.</P>
-<P>IPsec packet authentication can be added in transport mode, as a
- modification of standard IP transport. This is shown in this diagram
- from the RFC:</P>
-<PRE>                  BEFORE APPLYING AH
-            ----------------------------
-      IPv4  |orig IP hdr  |     |      |
-            |(any options)| TCP | Data |
-            ----------------------------
-
-                  AFTER APPLYING AH
-            ---------------------------------
-      IPv4  |orig IP hdr  |    |     |      |
-            |(any options)| AH | TCP | Data |
-            ---------------------------------
-            ||
-                 except for mutable fields</PRE>
-<P>Athentication can also be used in tunnel mode, encapsulating the
- underlying IP packet beneath AH and an additional IP header.</P>
-<PRE>                         ||
-IPv4  | new IP hdr* |    | orig IP hdr*  |    |      |
-      |(any options)| AH | (any options) |TCP | Data |
-      ------------------------------------------------
-      ||
-      |           in the new IP hdr                  |</PRE>
-<P>This would normally be used in a gateway-to-gateway tunnel. The
- receiving gateway then strips the outer IP header and the AH header and
- forwards the inner IP packet.</P>
-<P>The mutable fields referred to are things like the time-to-live field
- in the IP header. These cannot be included in authentication
- calculations because they change as the packet travels.</P>
-<H4><A name="keyed">Keyed MD5 and Keyed SHA</A></H4>
-<P>The actual authentication data in the header is typically 96 bits and
- depends both on a secret shared between sender and receiver and on
- every byte of the data being authenticated. The technique used is<A href="glossary.html#HMAC">
- HMAC</A>, defined in RFC 2104.</P>
-<P>The algorithms involved are the<A href="glossary.html#MD5"> MD5</A>
- Message Digest Algorithm or<A href="glossary.html#SHA"> SHA</A>, the
- Secure Hash Algorithm. For details on their use in this application,
- see RFCs 2403 and 2404 respectively.</P>
-<P>For descriptions of the algorithms themselves, see RFC 1321 for MD5
- and<A href="glossary.html#FIPS"> FIPS</A> (Federal Information
- Processing Standard) number 186 from<A href="glossary.html#NIST"> NIST</A>
-, the US National Institute of Standards and Technology for SHA.<A href="biblio.html#schneier">
-<CITE> Applied Cryptography</CITE></A> covers both in some detail, MD5
- starting on page 436 and SHA on 442.</P>
-<P>These algorithms are intended to make it nearly impossible for anyone
- to alter the authenticated data in transit. The sender calculates a
- digest or hash value from that data and includes the result in the
- authentication header. The recipient does the same calculation and
- compares results. For unchanged data, the results will be identical.
- The hash algorithms are designed to make it extremely difficult to
- change the data in any way and still get the correct hash.</P>
-<P>Since the shared secret key is also used in both calculations, an
- interceptor cannot simply alter the authenticated data and change the
- hash value to match. Without the key, he or she (or even the dreaded
- They) cannot produce a usable hash.</P>
-<H4><A name="sequence">Sequence numbers</A></H4>
-<P>The authentication header includes a sequence number field which the
- sender is required to increment for each packet. The receiver can
- ignore it or use it to check that packets are indeed arriving in the
- expected sequence.</P>
-<P>This provides partial protection against<A href="glossary.html#replay">
- replay attacks</A> in which an attacker resends intercepted packets in
- an effort to confuse or subvert the receiver. Complete protection is
- not possible since it is necessary to handle legitmate packets which
- are lost, duplicated, or delivered out of order, but use of sequence
- numbers makes the attack much more difficult.</P>
-<P>The RFCs require that sequence numbers never cycle, that a new key
- always be negotiated before the sequence number reaches 2^32-1. This
- protects both against replays attacks using packets from a previous
- cyclce and against<A href="glossary.html#birthday"> birthday attacks</A>
- on the the packet authentication algorithm.</P>
-<P>In Linux FreeS/WAN, the sequence number is ignored for manually keyed
- connections and checked for automatically keyed ones. In manual mode,
- there is no way to negotiate a new key, or to recover from a sequence
- number problem, so we don't use sequence numbers.</P>
-<H3><A name="ESP.ipsec">Encapsulated Security Payload (ESP)</A></H3>
-<P>The ESP protocol is defined in RFC 2406. It provides one or both of
- encryption and packet authentication. It may be used with or without AH
- packet authentication.</P>
-<P>Note that<STRONG> some form of packet authentication should<EM>
- always</EM> be used whenever data is encrypted</STRONG>. Without
- authentication, the encryption is vulnerable to active attacks which
- may allow an enemy to break the encryption. ESP should<STRONG> always</STRONG>
- either include its own authentication or be used with AH
- authentication.</P>
-<P>The RFCs require support for only two mandatory encryption algorithms
- --<A href="glossary.html#DES"> DES</A>, and null encryption -- and for
- two authentication methods -- keyed MD5 and keyed SHA. Implementers may
- choose to support additional algorithms in either category.</P>
-<P>The authentication algorithms are the same ones used in the IPsec<A href="glossary.html#AH">
- authentication header</A>.</P>
-<P>We do not implement single DES since<A href="politics.html#desnotsecure">
- DES is insecure</A>. Instead we provide<A href="glossary.html#3DES">
- triple DES or 3DES</A>. This is currently the only encryption algorithm
- supported.</P>
-<P>We do not implement null encryption since it is obviously insecure.</P>
-<H2><A name="modes">IPsec modes</A></H2>
-<P>IPsec can connect in two modes. Transport mode is a host-to-host
- connection involving only two machines. In tunnel mode, the IPsec
- machines act as gateways and trafiic for any number of client machines
- may be carried.</P>
-<H3><A name="tunnel.ipsec">Tunnel mode</A></H3>
-<P>Security gateways are required to support tunnel mode connections. In
- this mode the gateways provide tunnels for use by client machines
- behind the gateways. The client machines need not do any IPsec
- processing; all they have to do is route things to gateways.</P>
-<H3><A name="transport.ipsec">Transport mode</A></H3>
-<P>Host machines (as opposed to security gateways) with IPsec
- implementations must also support transport mode. In this mode, the
- host does its own IPsec processing and routes some packets via IPsec.</P>
-<H2><A name="parts">FreeS/WAN parts</A></H2>
-<H3><A name="KLIPS.ipsec">KLIPS: Kernel IPsec Support</A></H3>
-<P>KLIPS is<STRONG> K</STRONG>erne<STRONG>L</STRONG><STRONG> IP</STRONG>
-SEC<STRONG> S</STRONG>upport, the modifications necessary to support
- IPsec within the Linux kernel. KILPS does all the actual IPsec
- packet-handling, including</P>
-<UL>
-<LI>encryption</LI>
-<LI>packet authentication calculations</LI>
-<LI>creation of ESP and AH headers for outgoing packets</LI>
-<LI>interpretation of those headers on incoming packets</LI>
-</UL>
-<P>KLIPS also checks all non-IPsec packets to ensure they are not
- bypassing IPsec security policies.</P>
-<H3><A name="Pluto.ipsec">The Pluto daemon</A></H3>
-<P><A href="manpage.d/ipsec_pluto.8.html">Pluto(8)</A> is a daemon which
- implements the IKE protocol. It</P>
-<UL>
-<LI>handles all the Phase one ISAKMP SAs</LI>
-<LI>performs host authentication and negotiates with other gateways</LI>
-<LI>creates IPsec SAs and passes the data required to run them to KLIPS</LI>
-<LI>adjust routing and firewall setup to meet IPsec requirements. See
- our<A href="firewall.html"> IPsec and firewalling</A> document for
- details.</LI>
-</UL>
-<P>Pluto is controlled mainly by the<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> configuration file.</P>
-<H3><A name="command">The ipsec(8) command</A></H3>
-<P>The<A href="manpage.d/ipsec.8.html"> ipsec(8)</A> command is a front
- end shellscript that allows control over IPsec activity.</P>
-<H3><A name="ipsec.conf">Linux FreeS/WAN configuration file</A></H3>
-<P>The configuration file for Linux FreeS/WAN is</P>
-<PRE>        /etc/ipsec.conf</PRE>
-<P>For details see the<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A> manual page .</P>
-<H2><A name="key">Key management</A></H2>
-<P>There are several ways IPsec can manage keys. Not all are implemented
- in Linux FreeS/WAN.</P>
-<H3><A name="current">Currently Implemented Methods</A></H3>
-<H4><A name="manual">Manual keying</A></H4>
-<P>IPsec allows keys to be manually set. In Linux FreeS/WAN, such keys
- are stored with the connection definitions in /etc/ipsec.conf.</P>
-<P><A href="glossary.html#manual">Manual keying</A> is useful for
- debugging since it allows you to test the<A href="glossary.html#KLIPS">
- KLIPS</A> kernel IPsec code without the<A href="glossary.html#Pluto">
- Pluto</A> daemon doing key negotiation.</P>
-<P>In general, however, automatic keying is preferred because it is more
- secure.</P>
-<H4><A name="auto">Automatic keying</A></H4>
-<P>In automatic keying, the<A href="glossary.html#Pluto"> Pluto</A>
- daemon negotiates keys using the<A href="glossary.html#IKE"> IKE</A>
- Internet Key Exchange protocol. Connections are automatically re-keyed
- periodically.</P>
-<P>This is considerably more secure than manual keying. In either case
- an attacker who acquires a key can read every message encrypted with
- that key, but automatic keys can be changed every few hours or even
- every few minutes without breaking the connection or requiring
- intervention by the system administrators. Manual keys can only be
- changed manually; you need to shut down the connection and have the two
- admins make changes. Moreover, they have to communicate the new keys
- securely, perhaps with<A href="glossary.html#PGP"> PGP</A> or<A href="glossary.html#SSH">
- SSH</A>. This may be possible in some cases, but as a general solution
- it is expensive, bothersome and unreliable. Far better to let<A href="glossary.html#Pluto">
- Pluto</A> handle these chores; no doubt the administrators have enough
- to do.</P>
-<P>Also, automatic keying is inherently more secure against an attacker
- who manages to subvert your gateway system. If manual keying is in use
- and an adversary acquires root privilege on your gateway, he reads your
- keys from /etc/ipsec.conf and then reads all messages encrypted with
- those keys.</P>
-<P>If automatic keying is used, an adversary with the same privileges
- can read /etc/ipsec.secrets, but this does not contain any keys, only
- the secrets used to authenticate key exchanges. Having an adversary
- able to authenticate your key exchanges need not worry you overmuch.
- Just having the secrets does not give him any keys. You are still
- secure against<A href="glossary.html#passive"> passive</A> attacks.
- This property of automatic keying is called<A href="glossary.html#PFS">
- perfect forward secrecy</A>, abbreviated PFS.</P>
-<P>Unfortunately, having the secrets does allow an<A href="glossary.html#active">
- active attack</A>, specifically a<A href="glossary.html#middle">
- man-in-the-middle</A> attack. Losing these secrets to an attacker may
- not be quite as disastrous as losing the actual keys, but it is<EM>
- still a serious security breach</EM>. These secrets should be guarded
- as carefully as keys.</P>
-<H3><A name="notyet">Methods not yet implemented</A></H3>
-<H4><A name="noauth">Unauthenticated key exchange</A></H4>
-<P>It would be possible to exchange keys without authenticating the
- players. This would support<A href="glossary.html#carpediem">
- opportunistic encryption</A> -- allowing any two systems to encrypt
- their communications without requiring a shared PKI or a previously
- negotiated secret -- and would be secure against<A href="glossary.html#passive">
- passive attacks</A>. It would, however, be highly vulnerable to active<A
-href="glossary.html#middle"> man-in-the-middle</A> attacks. RFC 2408
- therefore specifies that all<A href="glossary.html#ISAKMP"> ISAKMP</A>
- key management interactions<EM> must</EM> be authenticated.</P>
-<P>There is room for debate here. Should we provide immediate security
- against<A href="glossary.html#passive"> passive attacks</A> and
- encourage widespread use of encryption, at the expense of risking the
- more difficult<A href="glossary.html#active"> active attacks</A>? Or
- should we wait until we can implement a solution that can both be
- widespread and offer security against active attacks?</P>
-<P>So far, we have chosen the second course, complying with the RFCs and
- waiting for secure DNS (see<A href="glossary.html#DNS"> below</A>) so
- that we can do<A href="glossary.html#carpediem"> opportunistic
- encryption</A> right.</P>
-<H4><A name="DNS">Key exchange using DNS</A></H4>
-<P>The IPsec RFCs allow key exchange based on authentication services
- provided by<A href="glossary.html#SDNS"> Secure DNS</A>. Once Secure
- DNS service becomes widely available, we expect to make this the<EM>
- primary key management method for Linux FreeS/WAN</EM>. It is the best
- way we know of to support<A href="glossary.html#carpediem">
- opportunistic encryption</A>, allowing two systems without a common PKI
- or previous negotiation to secure their communication.</P>
-<P>We currently have code to acquire RSA keys from DNS but do not yet
- have code to validate Secure DNS signatures.</P>
-<H4><A name="PKI">Key exchange using a PKI</A></H4>
-<P>The IPsec RFCs allow key exchange based on authentication services
- provided by a<A href="glossary.html#PKI"> PKI</A> or Public Key
- Infrastructure. With many vendors selling such products and many large
- organisations building these infrastructures, this will clearly be an
- important application of IPsec and one Linux FreeS/WAN will eventually
- support.</P>
-<P>On the other hand, this is not as high a priority for Linux FreeS/WAN
- as solutions based on<A href="glossary.html#SDNS"> secure DNS</A>. We
- do not expect any PKI to become as universal as DNS.</P>
-<P>Some<A href="web.html#patch"> patches</A> to handle authentication
- with X.509 certificates, which most PKIs use, are available.</P>
-<H4><A name="photuris">Photuris</A></H4>
-<P><A href="glossary.html#photuris">Photuris</A> is another key
- management protocol, an alternative to IKE and ISAKMP, described in
- RFCs 2522 and 2523 which are labelled &quot;experimental&quot;. Adding Photuris
- support to Linux FreeS/WAN might be a good project for a volunteer. The
- likely starting point would be the OpenBSD photurisd code.</P>
-<H4><A name="skip">SKIP</A></H4>
-<P><A href="glossary.html#SKIP">SKIP</A> is yet another key management
- protocol, developed by Sun. At one point it was fairly widely used, but
- it now seems moribund, displaced by IKE. Sun now (as of Solaris 8.0)
- ship an IPsec implementation using IKE. We have no plans to implement
- SKIP. If a user were to implement it, we would almost certainly not
- want to add the code to our distribution.</P>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="politics.html">Previous</A>
-<A HREF="mail.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/kernel.html b/doc/kernel.html
deleted file mode 100644
index de305683a..000000000
--- a/doc/kernel.html
+++ /dev/null
@@ -1,353 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="testing.html">Previous</A>
-<A HREF="adv_config.html">Next</A>
-<HR>
-<H1><A name="kernelconfig">Kernel configuration for FreeS/WAN</A></H1>
-<P> This section lists many of the options available when configuring a
- Linux kernel, and explains how they should be set on a FreeS/WAN IPsec
- gateway.</P>
-<H2><A name="notall">Not everyone needs to worry about kernel
- configuration</A></H2>
-<P>Note that in many cases you do not need to mess with these.</P>
-<P> You may have a Linux distribution which comes with FreeS/WAN
- installed (see this<A href="intro.html#products"> list</A>). In that
- case, you need not do a FreeS/WAN installation or a kernel
- configuration. Of course, you might still want to configure and rebuild
- your kernel to improve performance or security. This can be done with
- standard tools described in the<A href="http://www.linuxdoc.org/HOWTO/Kernel-HOWTO.html">
- Kernel HowTo</A>.</P>
-<P>If you need to install FreeS/WAN, then you do need to configure a
- kernel. However, you may choose to do that using the simplest
- procedure:</P>
-<UL>
-<LI>Configure, build and test a kernel for your system before adding
- FreeS/WAN. See the<A href="http://www.linuxdoc.org/HOWTO/Kernel-HOWTO.html">
- Kernel HowTo</A> for details.<STRONG> This step cannot be skipped</STRONG>
-. FreeS/WAN needs the results of your configuration.</LI>
-<LI>Then use FreeS/WAN's<VAR> make oldgo</VAR> command. This sets
- everything FreeS/WAN needs and retains your values everywhere else.</LI>
-</UL>
-<P> This document is for those who choose to configure their FreeS/WAN
- kernel themselves.</P>
-<H2><A name="assume">Assumptions and notation</A></H2>
-<P> Help text for most kernel options is included with the kernel files,
- and is accessible from within the configuration utilities. We assume
- you will refer to that, and to the<A href="http://www.linuxdoc.org/HOWTO/Kernel-HOWTO.html">
- Kernel HowTo</A>, as necessary. This document covers only the
- FreeS/WAN-specific aspects of the problem.</P>
-<P> To avoid duplication, this document section does not cover settings
- for the additional IPsec-related kernel options which become available
- after you have patched your kernel with FreeS/WAN patches. There is
- help text for those available from within the configuration utility.</P>
-<P> We assume a common configuration in which the FreeS/WAN IPsec
- gateway is also doing ipchains(8) firewalling for a local network, and
- possibly masquerading as well.</P>
-<P> Some suggestions below are labelled as appropriate for &quot;a true
- paranoid&quot;. By this we mean they may cause inconvenience and it is not
- entirely clear they are necessary, but they appear to be the safest
- choice. Not using them might entail some risk. Of course one suggested
- mantra for security administrators is: &quot;I know I'm paranoid. I wonder
- if I'm paranoid enough.&quot;</P>
-<H3><A name="labels">Labels used</A></H3>
-<P> Six labels are used to indicate how options should be set. We mark
- the labels with [square brackets]. For two of these labels, you have no
- choice:</P>
-<DL>
-<DT>[required]</DT>
-<DD>essential for FreeS/WAN operation.</DD>
-<DT>[incompatible]</DT>
-<DD>incompatible with FreeS/WAN.</DD>
-</DL>
-<P>those must be set correctly or FreeS/WAN will not work</P>
-<P>FreeS/WAN should work with any settings of the others, though of
- course not all combinations have been tested. We do label these in
- various ways, but<EM> these labels are only suggestions</EM>.</P>
-<DL>
-<DT>[recommended]</DT>
-<DD>useful on most FreeS/WAN gateways</DD>
-<DT>[disable]</DT>
-<DD>an unwelcome complication on a FreeS/WAN gateway.</DD>
-<DT>[optional]</DT>
-<DD>Your choice. We outline issues you might consider.</DD>
-<DT>[anything]</DT>
-<DD>This option has no direct effect on FreeS/WAN and related tools, so
- you should be able to set it as you please.</DD>
-</DL>
-<P> Of course complexity is an enemy in any effort to build secure
- systems.<STRONG> For maximum security, any feature that can reasonably
- be turned off should be</STRONG>. &quot;If in doubt, leave it out.&quot;</P>
-<H2><A name="kernelopt">Kernel options for FreeS/WAN</A></H2>
-<P> Indentation is based on the nesting shown by 'make menuconfig' with
- a 2.2.16 kernel for the i386 architecture.</P>
-<DL>
-<DT><A name="maturity">Code maturity and level options</A></DT>
-<DD>
-<DL>
-<DT><A name="devel">Prompt for development ... code/drivers</A></DT>
-<DD>[optional] If this is<VAR> no</VAR>, experimental drivers are not
- shown in later menus.
-<P>For most FreeS/WAN work,<VAR> no</VAR> is the preferred setting.
- Using new or untested components is too risky for a security gateway.</P>
-<P>However, for some hardware (such as the author's network cards) the
- only drivers available are marked<VAR> new/experimental</VAR>. In such
- cases, you must enable this option or your cards will not appear under
- &quot;network device support&quot;. A true paranoid would leave this option off
- and replace the cards.</P>
-</DD>
-<DT>Processor type and features</DT>
-<DD>[anything]</DD>
-<DT>Loadable module support</DT>
-<DD>
-<DL>
-<DT>Enable loadable module support</DT>
-<DD>[optional] A true paranoid would disable this. An attacker who has
- root access to your machine can fairly easily install a bogus module
- that does awful things, provided modules are enabled. A common tool for
- attackers is a &quot;rootkit&quot;, a set of tools the attacker uses once he or
- she has become root on your system. The kit introduces assorted
- additional compromises so that the attacker will continue to &quot;own&quot; your
- system despite most things you might do to recovery the situation. For
- Linux, there is a tool called<A href="http://www.sans.org/newlook/resources/IDFAQ/knark.htm">
- knark</A> which is basically a rootkit packaged as a kernel module.
-<P>With modules disabled, an attacker cannot install a bogus module. The
- only way he can achieve the same effects is to install a new kernel and
- reboot. This is considerably more likely to be noticed.</P>
-<P>Many FreeS/WAN gateways run with modules enabled. This simplifies
- some administrative tasks and some ipchains features are available only
- as modules. Once an enemy has root on your machine your security is
- nil, so arguably defenses which come into play only in that situation
- are pointless.</P>
-<P></P>
-</DD>
-<DT>Set version information ....</DT>
-<DD>[optional] This provides a check to prevent loading modules compiled
- for a different kernel.</DD>
-<DT>Kernel module loader</DT>
-<DD>[disable] It gives little benefit on a typical FreeS/WAN gate and
- entails some risk.</DD>
-</DL>
-</DD>
-<DT>General setup</DT>
-<DD>We list here only the options that matter for FreeS/WAN.
-<DL>
-<DT>Networking support</DT>
-<DD>[required]</DD>
-<DT>Sysctl interface</DT>
-<DD>[optional] If this option is turned on and the<VAR> /proc</VAR>
- filesystem installed, then you can control various system behaviours by
- writing to files under<VAR> /proc/sys</VAR>. For example:
-<PRE>        echo 1 &gt; /proc/sys/net/ipv4/ipforward</PRE>
- turns IP forwarding on.
-<P>Disabling this option breaks many firewall scripts. A true paranoid
- would disable it anyway since it might conceivably be of use to an
- attacker.</P>
-</DD>
-</DL>
-</DD>
-<DT>Plug and Play support</DT>
-<DD>[anything]</DD>
-<DT>Block devices</DT>
-<DD>[anything]</DD>
-<DT>Networking options</DT>
-<DD>
-<DL>
-<DT>Packet socket</DT>
-<DD>[optional] This kernel feature supports tools such as tcpdump(8)
- which communicate directly with network hardware, bypassing kernel
- protocols. This is very much a two-edged sword:
-<UL>
-<LI>such tools can be very useful to the firewall admin, especially
- during initial testing</LI>
-<LI>should an evildoer breach your firewall, such tools could give him
- or her a great deal of information about the rest of your network</LI>
-</UL>
- We recommend disabling this option on production gateways.</DD>
-<DT><A name="netlink">Kernel/User netlink socket</A></DT>
-<DD>[optional] Required if you want to use<A href="#adv"> advanced
- router</A> features.</DD>
-<DT>Routing messages</DT>
-<DD>[optional]</DD>
-<DT>Netlink device emulation</DT>
-<DD>[optional]</DD>
-<DT>Network firewalls</DT>
-<DD>[recommended] You need this if the IPsec gateway also functions as a
- firewall.
-<P>Even if the IPsec gateway is not your primary firewall, we suggest
- setting this so that you can protect the gateway with at least basic
- local packet filters.</P>
-</DD>
-<DT>Socket filtering</DT>
-<DD>[disable] This enables an older filtering interface. We suggest
- using ipchains(8) instead. To do that, set the &quot;Network firewalls&quot;
- option just above, and not this one.</DD>
-<DT>Unix domain sockets</DT>
-<DD>[required] These sockets are used for communication between the<A href="manpage.d/ipsec.8.html">
- ipsec(8)</A> commands and the<A href="manpage.d/ipsec_pluto.8.html">
- ipsec_pluto(8)</A> daemon.</DD>
-<DT>TCP/IP networking</DT>
-<DD>[required]
-<DL>
-<DT>IP: multicasting</DT>
-<DD>[anything]</DD>
-<DT><A name="adv">IP: advanced router</A></DT>
-<DD>[optional] This gives you policy routing, which some people have
- used to good advantage in their scripts for FreeS/WAN gateway
- management. It is not used in our distributed scripts, so not required
- unless you want it for custom scripts. It requires the<A href="#netlink">
- netlink</A> interface between kernel code and the iproute2(8) command.</DD>
-<DT>IP: kernel level autoconfiguration</DT>
-<DD>[disable] It gives little benefit on a typical FreeS/WAN gate and
- entails some risk.</DD>
-<DT>IP: firewall packet netlink device</DT>
-<DD>[disable]</DD>
-<DT>IP: transparent proxy support</DT>
-<DD>[optional] This is required in some firewall configurations, but
- should be disabled unless you have a definite need for it.</DD>
-<DT>IP: masquerading</DT>
-<DD>[optional] Required if you want to use<A href="glossary.html#non-routable">
- non-routable</A> private IP addresses for your local network.</DD>
-<DT>IP: Optimize as router not host</DT>
-<DD>[recommended]</DD>
-<DT>IP: tunneling</DT>
-<DD>[required]</DD>
-<DT>IP: GRE tunnels over IP</DT>
-<DD>[anything]</DD>
-<DT>IP: aliasing support</DT>
-<DD>[anything]</DD>
-<DT>IP: ARP daemon support (EXPERIMENTAL)</DT>
-<DD>Not required on most systems, but might prove useful on
- heavily-loaded gateways.</DD>
-<DT>IP: TCP syncookie support</DT>
-<DD>[recommended] It provides a defense against a<A href="glossary.html#DOS">
- denial of service attack</A> which uses bogus TCP connection requests
- to waste resources on the victim machine.</DD>
-<DT>IP: Reverse ARP</DT>
-<DD></DD>
-<DT>IP: large window support</DT>
-<DD>[recommended] unless you have less than 16 meg RAM</DD>
-</DL>
-</DD>
-<DT>IPv6</DT>
-<DD>[optional] FreeS/WAN does not currently support IPv6, though work on
- integrating FreeS/WAN with the Linux IPv6 stack has begun.<A href="compat.html#ipv6">
- Details</A>.
-<P> It should be possible to use IPv4 FreeS/WAN on a machine which also
- does IPv6. This combination is not yet well tested. We would be quite
- interested in hearing results from anyone expermenting with it, via the<A
-href="mail.html"> mailing list</A>.</P>
-<P> We do not recommend using IPv6 on production FreeS/WAN gateways
- until more testing has been done.</P>
-</DD>
-<DT>Novell IPX</DT>
-<DD>[disable]</DD>
-<DT>Appletalk</DT>
-<DD>[disable] Quite a few Linux installations use IP but also have some
- other protocol, such as Appletalk or IPX, for communication with local
- desktop machines. In theory it should be possible to configure IPsec
- for the IP side of things without interfering with the second protocol.
-<P>We do not recommend this. Keep the software on your gateway as simple
- as possible. If you need a Linux-based Appletalk or IPX server, use a
- separate machine.</P>
-</DD>
-</DL>
-</DD>
-<DT>Telephony support</DT>
-<DD>[anything]</DD>
-<DT>SCSI support</DT>
-<DD>[anything]</DD>
-<DT>I2O device support</DT>
-<DD>[anything]</DD>
-<DT>Network device support</DT>
-<DD>[anything] should work, but there are some points to note.
-<P>The development team test almost entirely on 10 or 100 megabit
- Ethernet and modems. In principle, any device that can do IP should be
- just fine for IPsec, but in the real world any device that has not been
- well-tested is somewhat risky. By all means try it, but don't bet your
- project on it until you have solid test results.</P>
-<P>If you disabled experimental drivers in the<A href="#maturity"> Code
- maturity</A> section above, then those drivers will not be shown here.
- Check that option before going off to hunt for missing drivers.</P>
-<P>If you want Linux to automatically find more than one ethernet
- interface at boot time, you need to:</P>
-<UL>
-<LI>compile the appropriate driver(s) into your kernel. Modules will not
- work for this</LI>
-<LI>add a line such as
-<PRE>
-   append=&quot;ether=0,0,eth0 ether=0,0,eth1&quot;
-</PRE>
- to your /etc/lilo.conf file. In some cases you may need to specify
- parameters such as IRQ or base address. The example uses &quot;0,0&quot; for
- these, which tells the system to search. If the search does not succeed
- on your hardware, then you should retry with explicit parameters. See
- the lilo.conf(5) man page for details.</LI>
-<LI>run lilo(8)</LI>
-</UL>
- Having Linux find the cards this way is not necessary, but is usually
- more convenient than loading modules in your boot scripts.</DD>
-<DT>Amateur radio support</DT>
-<DD>[anything]</DD>
-<DT>IrDA (infrared) support</DT>
-<DD>[anything]</DD>
-<DT>ISDN subsystem</DT>
-<DD>[anything]</DD>
-<DT>Old CDROM drivers</DT>
-<DD>[anything]</DD>
-<DT>Character devices</DT>
-<DD>The only required character device is:
-<DL>
-<DT>random(4)</DT>
-<DD>[required] This is a source of<A href="glossary.html#random"> random</A>
- numbers which are required for many cryptographic protocols, including
- several used in IPsec.
-<P>If you are comfortable with C source code, it is likely a good idea
- to go in and adjust the<VAR> #define</VAR> lines in<VAR>
- /usr/src/linux/drivers/char/random.c</VAR> to ensure that all sources
- of randomness are enabled. Relying solely on keyboard and mouse
- randomness is dubious procedure for a gateway machine. You could also
- increase the randomness pool size from the default 512 bytes (128
- 32-bit words).</P>
-</DD>
-</DL>
-</DD>
-<DT>Filesystems</DT>
-<DD>[anything] should work, but we suggest limiting a gateway machine to
- the standard Linux ext2 filesystem in most cases.</DD>
-<DT>Network filesystems</DT>
-<DD>[disable] These systems are an unnecessary risk on an IPsec gateway.</DD>
-<DT>Console drivers</DT>
-<DD>[anything]</DD>
-<DT>Sound</DT>
-<DD>[anything] should work, but we suggest enabling sound only if you
- plan to use audible alarms for firewall problems.</DD>
-<DT>Kernel hacking</DT>
-<DD>[disable] This might be enabled on test machines, but should not be
- on production gateways.</DD>
-</DL>
-</DD>
-</DL>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="testing.html">Previous</A>
-<A HREF="adv_config.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/kernel.notes b/doc/kernel.notes
deleted file mode 100644
index 675e80be3..000000000
--- a/doc/kernel.notes
+++ /dev/null
@@ -1,173 +0,0 @@
-Notes on Red Hat 5.2 kernel installation (See Addendum for RH6.1)
-=================================================================
-
-Warning: We (the FreeS/WAN Project http://www.xs4all.nl/~freeswan/)
-had nothing to do with designing the kernel installation process.  This
-document explains some tricky points that we wish we had been told.
-We don't know if these notes apply to systems other than Red Hat 5.2.
-This is meant as a supplement to other kernel install guides (such as
-the Red Hat 5.2 Installation Guide section 11.6).
-
-Goal: install a new kernel on RH5.2 in such a way that it doesn't
-interfere with any other kernels.  This should be repeatable: each new
-kernel should have this property.  Each should remain bootable.
-
-Problem: there are several components to a kernel, and each must be
-segregated.  How are the parts kept apart?  How are they found?
-
-All the parts live in the file system, so it all comes down to
-pathnames.  Well, except for the fiddly bits in /etc/lilo.conf.  What
-are the parts?
-
-	/lib/modules/VER/	directory for kernel modules
-	/boot/vmlinux-VER	the kernel
-	/boot/System.map-VER	the kernel symbol table
-	/boot/initrd-VER.img 	the initial ramdisk (for modules needed
-				at boot time -- usually not necessary)
-	/boot/boot.b		the second-stage loader
-	/boot/map		the map file, an index into system index for
-				all files used by boot loader (all kernels,
-				all initrds, perhaps /boot/boot.b, and itself)
-
-This list does not include /boot/module-info-VER.  That is supplied
-by RedHat, and it isn't clear to me how to build it or why.
-
-In each entry, I've used "VER" to signify a version number.  For
-RH-supplied kernels, these look like 2.0.36-0.7 (the original 5.2) or
-2.0.36-3 (the kernel updates).
-
-There are also symbolic links:
-	/lib/modules/preferred	created by /etc/rc.d/rc.sysinit
-	/boot/System.map	created by /etc/rc.d/rc.sysinit
-	/boot/module-info	created by /etc/rc.d/rc.sysinit
-	/vmlinuz		created by ???
-I don't know when the /vmlinuz symlink is set up and I don't know
-for what it is used.
-
-If you follow the RH procedures, documented in 11.6 of their Installation
-Guide, all your VERs will be 2.0.36.  This is very bad: all your builds
-will step on each other.  Worse, your new module directory will be half
-picked up when you boot a stock RH kernel binary! 
-
-It is important to know how the various parts of the built kernel are
-found at booting.
-
-- the kernel path is specified in the image= option in lilo.conf.
-  (Lilo.conf may specify several and one is selected at boot time
-  by default or user selection.)  The kernel is loaded by the
-  boot loader.
-
-- The initial ramdisk is a per-image option (initrd=) specified in
-  lilo.conf.  (It isn't described in the RH5.2 lilo.conf(5) manpage!).
-  The initial ramdisk is loaded into RAM by the boot loader.
-
-- Since the boot loader doesn't know about the file system, it needs a
-  map to figure out which absolute disk blocks to load, and where.
-  This is /boot/map.  It is built by the lilo command (also known as
-  the map installer).  It will have indices for the all the kernels
-  that can be booted, all their initial ram disks, perhaps
-  /boot/boot.b, and itself.  This is why moving the blocks of these
-  files throws off the boot loader -- lilo must be rerun after even a
-  cp command to one of them.
-
-- the modules directory is found two different ways.  Unfortunately,
-  they don't mesh properly:
-
-  + at boot time, /etc/rc.d/rc.sysinit tries to figure out the correct
-    subdirectory of /lib/modules, using the .rhkmvtag trick (see
-    later).  It then builds a symlink /lib/modules/preferred to
-    record this.  It also invokes depmod to build the module
-    dependency info.  At the same time, it creates the symlinks
-    /boot/System.map and /boot/module-info, using the inferred
-    value for VER!
-
-  + modprobe and friends stupidly look first in /lib/modules/2.0.36
-    (more precisely, /lib/modules/`uname -r`) and then in
-    /lib/modules/preferred.  So if there is a /lib/modules/2.0.36 and
-    it is the wrong one, you are in trouble.
-
-  If there is no /lib/modules/2.0.36, then both searches above will
-  agree (a very Good Thing).  So I recommend strongly that you not
-  have a /lib/boot/2.0.36 at boot time.  Unfortunately, you will get
-  one during the kernel install process.  Be sure to rename it.  I
-  suggest using 2.0.36-x (for some unique x) as VER.
-
-- Red Hat supplied /lib/modules/VER directories contain a hidden file
-  .rhkmvtag.  This file contains exactly one line.  This line is
-  exactly the same as the contents of /proc/version while the
-  corresponding kernel is running.  For the stock kernel, the line is:
-Linux version 2.0.36 (root@porky.redhat.com) (gcc version 2.7.2.3) #1 Tue Dec 29 13:11:13 EST 1998
-
-- At boot time, /etc/rc.d/rc.sysinit uses the .rhkmvtag files to
-  figure out which of the /lib/modules/* directories matches the
-  kernel.  If it could figure out the directory, it uses this
-  information to set the symlinks mentioned above.  It then runs
-  depmod to build the module dependency information (in
-  /lib/modules/preferred/modules.dep, if it created the
-  /lib/modules/preferred symlink).  I recommend looking at the code.
-
-- The documented kernel install procedures DO NOT fill in the
-  .rhkmvtag file for the new modules directory!  So you should do so
-  by hand.  You have to figure out what the contents should be.  Here
-  is is a command that will do the job, assuming that
-  /usr/src/linux/vmlinux is the kernel associated with
-  /lib/modules/2.0.36/:
-
-	strings /usr/src/linux/vmlinux \
-	| grep 'x version' >/lib/modules/2.0.36/.rhkmvtag
-
-I've recommended (above) that you use 2.0.36-x for VER when you install
-a kernel.  What should x be?  I have found that there is a hidden file
-/usr/src/linux/.version which contains a counter that gets incremented
-whenever you do a "make install" in the kernel (see target
-newversion).  There are some other times that it gets incremented, but
-I think that it all works out.  It also gets incorporated into the
-resulting kernel's /proc/version, prefixed with ``#''.  This makes it
-a natural.
-
-Here is a script to do the recommended renaming:
-
-   # VER will eventually need to be updated
-   VER=2.0.36
-   VERX=${VER}-`cat /usr/src/linux/.version`
-
-   strings /usr/src/linux/vmlinux | grep 'x version' >/lib/modules/$VER/.rhkmvtag
-   mv /lib/modules/$VER /lib/modules/$VERX
-   mv /boot/System.map-$VER /boot/System.map-$VERX
-   mv /boot/vmlinuz-$VER /boot/vmlinuz-$VERX
-
-And, if an initrd has been built (usually it is best to arrange not to
-use one -- see the Red Hat Installation Guide):
-
-   /sbin/mkinitrd /boot/initrd-$VERX.img $VERX
-
-Remember: a new lilo.conf entry is needed for the new kernel, and then
-the lilo command will need to be rerun.
-
-Now that kernel installs don't overwrite the results of previous ones,
-you will need to manually delete the components and their lilo entry
-to get rid of them.
-
-Please send comments, additions, and corrections to:
-
-Hugh Redelmeier
-hugh@mimosa.com  voice: +1 416 482-8253
-
-
-Addendum: Red Hat 6.1
-=====================
-
-The kernel supplied with RH6.1 kernel is out of date, so you might
-wish to use a newer one.
-
-Much of the description for 5.2 still applies, but the procedure is
-quite different because the .version file is no longer used.  Instead,
-the top-level Makefile contains a definition EXTRAVERSION which adds a
-qualifier to the version for most purposes.  No manual renaming is
-required.
-
-Before building the kernel, change EXTRAVERSION by editing
-/usr/src/linux/Makefile, and make an appropriate entry in /etc/lilo.conf.
-
-EXTRAVERSION is a feature of the standard kernel sources, not just the
-ones supplied by Red Hat.
diff --git a/doc/mail.html b/doc/mail.html
deleted file mode 100644
index 68b5d8cd8..000000000
--- a/doc/mail.html
+++ /dev/null
@@ -1,216 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="ipsec.html">Previous</A>
-<A HREF="web.html">Next</A>
-<HR>
-<H1><A name="lists">Mailing lists and newsgroups</A></H1>
-<H2><A name="list.fs">Mailing lists about FreeS/WAN</A></H2>
-<H3><A name="projlist">The project mailing lists</A></H3>
-<P>The Linux FreeS/WAN project has several email lists for user support,
- bug reports and software development discussions.</P>
-<P>We had a single list on clinet.fi for several years (Thanks, folks!),
- then one list on freeswan.org, but now we've split into several lists:</P>
-<DL>
-<DT><A href="mailto:users-request@lists.freeswan.org?body=subscribe">
-users</A></DT>
-<DD>
-<UL>
-<LI>The general list for discussing use of the software</LI>
-<LI>The place for seeking<STRONG> help with problems</STRONG> (but
- please check the<A href="faq.html"> FAQ</A> first).</LI>
-<LI>Anyone can post.</LI>
-</UL>
-</DD>
-<DT><A href="mailto:bugs-request@lists.freeswan.org?body=subscribe">bugs</A>
-</DT>
-<DD>
-<UL>
-<LI>For<STRONG> bug reports</STRONG>.</LI>
-<LI>If you are not certain what is going on -- could be a bug, a
- configuration error, a network problem, ... -- please post to the users
- list instead.</LI>
-<LI>Anyone can post.</LI>
-</UL>
-</DD>
-<DT><A href="mailto:design-request@lists.freeswan.org?body=subscribe">
-design</A></DT>
-<DD>
-<UL>
-<LI><STRONG>Design discussions</STRONG>, for people working on FreeS/WAN
- development or others with an interest in design and security issues.</LI>
-<LI>It would be a good idea to read the existing design papers (see this<A
-href="intro.html#applied"> list</A>) before posting.</LI>
-<LI>Anyone can post.</LI>
-</UL>
-</DD>
-<DT><A href="mailto:announce-request@lists.freeswan.org?body=subscribe">
-announce</A></DT>
-<DD>
-<UL>
-<LI>A<STRONG> low-traffic</STRONG> list.</LI>
-<LI><STRONG>Announcements</STRONG> about FreeS/WAN and related software.</LI>
-<LI>All posts here are also sent to the users list. You need not
- subscribe to both.</LI>
-<LI>Only the FreeS/WAN team can post.</LI>
-<LI>If you have something you feel should go on this list, send it to<VAR>
- announce-admin@lists.freeswan.org</VAR>. Unless it is obvious, please
- include a short note explaining why we should post it.</LI>
-</UL>
-</DD>
-<DT><A href="mailto:briefs-request@lists.freeswan.org?body=subscribe">
-briefs</A></DT>
-<DD>
-<UL>
-<LI>A<STRONG> low-traffic</STRONG> list.</LI>
-<LI><STRONG>Weekly summaries</STRONG> of activity on the users list.</LI>
-<LI>All posts here are also sent to the users list. You need not
- subscribe to both.</LI>
-<LI>Only the FreeS/WAN team can post.</LI>
-</UL>
-</DD>
-</DL>
-<P>To subscribe to any of these, you can:</P>
-<UL>
-<LI>just follow the links above</LI>
-<LI>use our<A href="http://www.freeswan.org/mail.html"> web interface</A>
-</LI>
-<LI>send mail to<VAR> listname</VAR>-request@lists.freeswan.org with a
- one-line message body &quot;subscribe&quot;</LI>
-</UL>
-<P>Archives of these lists are available via the<A href="http://www.freeswan.org/mail.html">
- web interface</A>.</P>
-<H4><A name="which.list">Which list should I use?</A></H4>
-<P>For most questions, please check the<A href="faq.html"> FAQ</A>
- first, and if that does not have an answer, ask on the users list. &quot;My
- configuration doesn't work.&quot; does not belong on the bugs list, and &quot;Can
- FreeS/WAN do such-and-such&quot; or &quot;How do I configure it to...&quot; do not
- belong in design discussions.</P>
-<P>Cross-posting the same message to two or more of these lists is
- discouraged. Quite a few people read more than one list and getting
- multiple copies is annoying.</P>
-<H4><A name="policy.list">List policies</A></H4>
-<P><STRONG>US citizens or residents are asked not to post code to the
- lists, not even one-line bug fixes</STRONG>. The project cannot accept
- code which might entangle it in US<A href="politics.html#exlaw"> export
- restrictions</A>.</P>
-<P>Non-subscribers can post to some of these lists. This is necessary;
- someone working on a gateway install who encounters a problem may not
- have access to a subscribed account.</P>
-<P>Some spam turns up on these lists from time to time. For discussion
- of why we do not attempt to filter it, see the<A href="faq.html#spam">
- FAQ</A>. Please do not clutter the lists with complaints about this.</P>
-<H3><A name="archive">Archives of the lists</A></H3>
-<P>Searchable archives of the old single list have existed for some
- time. At time of writing, it is not yet clear how they will change for
- the new multi-list structure.</P>
-<UL>
-<LI><A href="http://www.sandelman.ottawa.on.ca/linux-ipsec">Canada</A></LI>
-<LI><A href="http://www.nexial.com">Holland</A></LI>
-</UL>
-<P>Note that these use different search engines. Try both.</P>
-<P>Archives of the new lists are available via the<A href="http://www.freeswan.org/mail.html">
- web interface</A>.</P>
-<H2><A name="indexes">Indexes of mailing lists</A></H2>
-<P><A href="http://paml.net/">PAML</A> is the standard reference for<STRONG>
- P</STRONG>ublicly<STRONG> A</STRONG>ccessible<STRONG> M</STRONG>ailing<STRONG>
- L</STRONG>ists. When we last checked, it had over 7500 lists on an
- amazing variety of topics. It also has FAQ information and a search
- engine.</P>
-<P>There is an index of<A href="http://oslab.snu.ac.kr/~djshin/linux/mail-list/index.shtml">
- Linux mailing lists</A> available.</P>
-<P>A list of<A href="http://xforce.iss.net/maillists/otherlists.php">
- computer security mailing lists</A>, with descriptions.</P>
-<H2><A name="otherlists">Lists for related software and topics</A></H2>
-<P>Most links in this section point to subscription addresses for the
- various lists. Send the one-line message &quot;subscribe<VAR> list_name</VAR>
-&quot; to subscribe to any of them.</P>
-<H3><A NAME="28_3_1">Products that include FreeS/WAN</A></H3>
-<P>Our introduction document gives a<A href="intro.html#products"> list
- of products that include FreeS/WAN</A>. If you have, or are
- considering, one of those, check the supplier's web site for
- information on mailing lists for their users.</P>
-<H3><A name="linux.lists">Linux mailing lists</A></H3>
-<UL>
-<LI><A href="mailto:majordomo@vger.kernel.org">
-linux-admin@vger.kernel.org</A>, for Linux system administrators</LI>
-<LI><A href="mailto:netfilter-request@lists.samba.org">
-netfilter@lists.samba.org</A>, about Netfilter, which replaces IPchains
- in kernels 2.3.15 and later</LI>
-<LI><A href="mailto:security-audit-request@ferret.lmh.ox.ac.uk">
-security-audit@ferret.lmh.ox.ac.uk</A>, for people working on security
- audits of various Linux programs</LI>
-<LI><A href="mailto:securedistros-request@humbolt.geo.uu.nl">
-securedistros@humbolt.geo.uu.nl</A>, for discussion of issues common to
- all the half dozen projects working on secure Linux distributions.</LI>
-</UL>
-<P>Each of the scure distribution projects also has its own web site and
- mailing list. Some of the sites are:</P>
-<UL>
-<LI><A href="http://bastille-linux.org/">Bastille Linux</A> scripts to
- harden Redhat, e.g. by changing permissions and modifying inialisation
- scripts</LI>
-<LI><A href="http://immunix.org/">Immunix</A> take a different approach,
- using a modified compiler to build kernel and utilities with better
- resistance to various types of overflow and exploit</LI>
-<LI>the<A href="glossary.html#NSA"> NSA</A> have contractors working on
- a<A href="glossary.html#SElinux"> Security Enhanced Linux</A>,
- primarily adding stronger access control mechanisms. You can download
- the current version (which interestingly is under GPL and not export
- resrtricted) or subscribe to the mailing list from the<A href="http://www.nsa.gov/selinux">
- project web page</A>.</LI>
-</UL>
-<H3><A name="ietf">Lists for IETF working groups</A></H3>
-<P>Each<A href="glossary.html#IETF"> IETF</A> working group has an
- associated mailing list where much of the work takes place.</P>
-<UL>
-<LI><A href="mailto:majordomo@lists.tislabs.com">ipsec@lists.tislabs.com</A>
-, the IPsec<A href="http://www.ietf.org/html.charters/ipsec-charter.html">
- working group</A>. This is where the protocols are discussed, new
- drafts announced, and so on. By now, the IPsec working group is winding
- down since the work is essentially complete. A<A href="http://www.sandelman.ottawa.on.ca/ipsec/">
- list archive</A> is available.</LI>
-<LI><A href="mailto:ipsec-policy-request@vpnc.org">IPsec policy</A>
- list, and its<A href="http://www.vpnc.org/ipsec-policy/"> archive</A></LI>
-<LI><A href="mailto:ietf-ipsra-request@vpnc.org">IP secure remote access</A>
- list, and its<A href="http://www.vpnc.org/ietf-ipsra/mail-archive/">
- archive</A></LI>
-</UL>
-<H3><A name="other">Other mailing lists</A></H3>
-<UL>
-<LI><A href="mailto:ipc-announce-request@privacy.org">
-ipc-announce@privacy.org</A> a low-traffic list with announcements of
- developments in privacy, encryption and online civil rights</LI>
-<LI>a VPN mailing list's<A href="http://kubarb.phsx.ukans.edu/~tbird/vpn.html">
- home page</A></LI>
-</UL>
-<H2><A name="newsgroups">Usenet newsgroups</A></H2>
-<UL>
-<LI>sci.crypt</LI>
-<LI>sci.crypt.research</LI>
-<LI>comp.dcom.vpn</LI>
-<LI>talk.politics.crypto</LI>
-</UL>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="ipsec.html">Previous</A>
-<A HREF="web.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/makecheck.html b/doc/makecheck.html
deleted file mode 100644
index e77631782..000000000
--- a/doc/makecheck.html
+++ /dev/null
@@ -1,523 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="umltesting.html">Previous</A>
-<A HREF="nightly.html">Next</A>
-<HR>
-<H1><A name="makecheck">How to configure to use &quot;make check&quot;</A></H1>
-<H2><A NAME="38_1">What is &quot;make check&quot;</A></H2>
-<P> &quot;make check&quot; is a target in the top level makefile. It takes care of
- running a number of unit and system tests to confirm that FreeSWAN has
- been compiled correctly, and that no new bugs have been introduced.</P>
-<P> As FreeSWAN contains both kernel and userspace components, doing
- testing of FreeSWAN requires that the kernel be simulated. This is
- typically difficult to do as a kernel requires that it be run on bare
- hardware. A technology has emerged that makes this simpler. This is<A HREF="http://user-mode-linux.sourceforge.net">
- User Mode Linux</A>.</P>
-<P> User-Mode Linux is a way to build a Linux kernel such that it can
- run as a process under another Linux (or in the future other) kernel.
- Presently, this can only be done for 2.4 guest kernels. The host kernel
- can be 2.2 or 2.4.</P>
-<P> &quot;make check&quot; expects to be able to build User-Mode Linux kernels
- with FreeSWAN included. To do this it needs to have some files
- downloaded and extracted prior to running &quot;make check&quot;. This is
- described in the<A HREF="umltesting.html"> UML testing</A> document.</P>
-<P> After having run the example in the UML testing document and
- successfully brought up the four machine combination, you are ready to
- use &quot;make check&quot;</P>
-<H2><A NAME="38_2">Running &quot;make check&quot;</A></H2>
-<P> &quot;make check&quot; works by walking the FreeSWAN source tree invoking the
- &quot;check&quot; target at each node. At present there are tests defined only
- for the <CODE>klips</CODE> directory. These tests will use the UML
- infrastructure to test out pieces of the <CODE>klips</CODE> code.</P>
-<P> The results of the tests can be recorded. If the environment
- variable <CODE>$REGRESSRESULTS</CODE> is non-null, then the results of
- each test will be recorded. This can be used as part of a nightly
- regression testing system, see<A HREF="nightly.html"> Nightly testing</A>
- for more details.</P>
-<P> &quot;make check&quot; otherwise prints a minimal amount of output for each
- test, and indicates pass/fail status of each test as they are run.
- Failed tests do not cause failure of the target in the form of exit
- codes.</P>
-<H1><A NAME="39">How to write a &quot;make check&quot; test</A></H1>
-<H2><A NAME="39_1">Structure of a test</A></H2>
-<P> Each test consists of a set of directories under <CODE>testing/</CODE>
-. There are directories for <CODE>klips</CODE>, <CODE>pluto</CODE>, <CODE>
-packaging</CODE> and <CODE>libraries</CODE>. Each directory has a list
- of tests to run is stored in a file called <CODE>TESTLIST</CODE> in
- that directory. e.g. <CODE>testing/klips/TESTLIST</CODE>.</P>
-<H2 NAME="TESTLIST"><A NAME="39_2">The TESTLIST</A></H2>
-<P> This isn't actually a shell script. It just looks like one. Some
- tools other than /bin/sh process it. Lines that start with # are
- comments.</P>
-<PRE>
-# test-kind     directory-containing-test       expectation     [PR#]
-</PRE>
-<P>The first word provides the test type, detailed below.</P>
-<P> The second word is the name of the test to run. This the directory
- in which the test case is to be found..</P>
-<P>The third word may be one of:</P>
-<DL>
-<DT> blank/good</DT>
-<DD>the test is believed to function, report failure</DD>
-<DT> bad</DT>
-<DD> the test is known to fail, report unexpected success</DD>
-<DT> suspended</DT>
-<DD> the test should not be run</DD>
-</DL>
-<P> The fourth word may be a number, which is a PR# if the test is
- failing.</P>
-<H2><A NAME="39_3">Test kinds</A></H2>
- The test types are:
-<DL>
-<DT>skiptest</DT>
-<DD>means run no test.</DD>
-<DT>ctltest</DT>
-<DD>means run a single system without input/output.</DD>
-<DT>klipstest</DT>
-<DD>means run a single system with input/output networks</DD>
-<DT><A HREF="#umlplutotest">umlplutotest</A></DT>
-<DD>means run a pair of systems</DD>
-<DT><A HREF="#umlXhost">umlXhost</A></DT>
-<DD>run an arbitrary number of systems</DD>
-<DT>suntest (TBD)</DT>
-<DD>means run a quad of east/west/sunrise/sunset</DD>
-<DT>roadtest (TBD)</DT>
-<DD>means run a trio of east-sunrise + warrior</DD>
-<DT>extrudedtest (TBD)</DT>
-<DD>means run a quad of east-sunrise + warriorsouth + park</DD>
-<DT>mkinsttest</DT>
-<DD>a test of the &quot;make install&quot; machinery.</DD>
-<DT>kernel_test_patch</DT>
-<DD>a test of the &quot;make kernelpatch&quot; machinery.</DD>
-</DL>
- Tests marked (TBD) have yet to be fully defined.
-<P> Each test directory has a file in it called <CODE>testparams.sh</CODE>
-. This file sets a number of environment variables to define the
- parameters of the test.</P>
-<H2><A NAME="39_4">Common parameters</A></H2>
-<DL>
-<DT>TESTNAME</DT>
-<DD>the name of the test (repeated for checking purposes)</DD>
-<DT>TEST_TYPE</DT>
-<DD>the type of the test (repeat of type type above)</DD>
-<DT>TESTHOST</DT>
-<DD>the name of the UML machine to run for the test, typically &quot;east&quot; or
- &quot;west&quot;</DD>
-<DT>TEST_PURPOSE</DT>
-<DD>The purpose of the test is one of:
-<DL>
-<DT>goal</DT>
-<DD>The goal purpose is where a test is defined for code that is not yet
- finished. The test indicates when the goals have in fact been reached.</DD>
-<DT>regress</DT>
-<DD>This is a test to determine that a previously existing bug has been
- repaired. This test will initially be created to reproduce the bug in
- isolation, and then the bug will be fixed.</DD>
-<DT>exploit</DT>
-<DD>This is a set of packets/programs that causes a vulnerability to be
- exposed. It is a specific variation of the regress option.</DD>
-</DL>
-</DD>
-<DT>TEST_GOAL_ITEM</DT>
-<DT></DT>
-<DD>in the case of a goal test, this is a reference to the requirements
- document</DD>
-<DT>TEST_PROB_REPORT</DT>
-<DD>in the case of regression test, this the problem report number from
- GNATS</DD>
-<DT>TEST_EXPLOIT_URL</DT>
-<DD>in the case of an exploit, this is a URL referencing the paper
- explaining the origin of the test and the origin of exploit software</DD>
-<DT>REF_CONSOLE_OUTPUT</DT>
-<DD>a file in the test directory that contains the sanitized console
- output against which to compare the output of the actual test.</DD>
-<DT>REF_CONSOLE_FIXUPS</DT>
-<DD>a list of scripts (found in <CODE>klips/test/fixups</CODE>) to apply
- to sanitize the console output of the machine under test. These are
- typically perl, awk or sed scripts that remove things in the kernel
- output that change each time the test is run and/or compiled.</DD>
-<DT>INIT_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode prior to starting the tests. This file will usually
- set up any eroute's and SADB entries that are required for the test.</P>
-<P>Lines beginning with # are skipped. Blank lines are skipped.
- Otherwise, a shell prompted is waited for each time (consisting of <CODE>
-\n#</CODE>) and then the command is sent. Note that the prompt is waited
- for before the command and not after, so completion of the last command
- in the script is not required. This is often used to invoke a program
- to monitor the system, e.g. <CODE>ipsec pf_key</CODE>.</P>
-</DD>
-<DT>RUN_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode, before the packets are sent. On single machine tests,
- this script doesn't provide any more power than INIT_SCRIPT, but is
- implemented for consistency's sake.</P>
-</DD>
-<DT>FINAL_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode after the final packet is sent. Similar to
- INIT_SCRIPT, above. If not specified, then the single command &quot;halt&quot; is
- sent. If specified, then the script should end with a halt command to
- nicely shutdown the UML.</P>
-</DD>
-<DT>CONSOLEDIFFDEBUG</DT>
-<DD>If set to &quot;true&quot; then the series of console fixups (see
- REF_CONSOLE_FIXUPS) will be output after it is constructed. (It should
- be set to &quot;false&quot;, or unset otherwise)</DD>
-<DT>NETJIGDEBUG</DT>
-<DD>If set to &quot;true&quot; then the series of console fixups (see
- REF_CONSOLE_FIXUPS) will be output after it is constructed. (It should
- be set to &quot;false&quot;, or unset otherwise)</DD>
-<DT>NETJIGTESTDEBUG</DT>
-<DD> If set to &quot;netjig&quot;, then the results of talking to the <CODE>
-uml_netjig</CODE> will be printed to stderr during the test. In
- addition, the jig will be invoked with --debug, which causes it to log
- its process ID, and wait 60 seconds before continuing. This can be used
- if you are trying to debug the <CODE>uml_netjig</CODE> program itself.</DD>
-<DT>HOSTTESTDEBUG</DT>
-<DD> If set to &quot;hosttest&quot;, then the results of taling to the consoles of
- the UMLs will be printed to stderr during the test.</DD>
-<DT>NETJIGWAITUSER</DT>
-<DD> If set to &quot;waituser&quot;, then the scripts will wait forever for user
- input before they shut the tests down. Use this is if you are debugging
- through the kernel.</DD>
-<DT>PACKETRATE</DT>
-<DD> A number, in miliseconds (default is 500ms) at which packets will
- be replayed by the netjig.</DD>
-</DL>
-<H2><A NAME="39_5">KLIPStest paramaters</A></H2>
-<P> The klipstest function starts a program (<CODE>
-testing/utils/uml_netjig/uml_netjig</CODE>) to setup a bunch of I/O
- sockets (that simulate network interfaces). It then exports the
- references to these sockets to the environment and invokes (using
- system()) a given script. It waits for the script to finish.</P>
-
-<!-- <IMG SRC="single_netjig.png" ALT="block diagram of uml_netjig"> -->
-<P> The script invoked (<CODE>testing/utils/host-test.tcl</CODE>) is a
- TCL<A HREF="http://expect.nist.gov/"> expect</A> script that arranges
- to start the UML and configure it appropriately for the test. The
- configuration is done with the script given above for<VAR> INIT_SCRIPT</VAR>
-. The TCL script then forks, leaves the UML in the background and exits.
- uml_netjig continues. It then starts listening to the simulated network
- answering ARPs and inserting packets as appropriate.</P>
-<P> The klipstest function invokes <CODE>uml_netjig</CODE> with
- arguments to capture output from network interface(s) and insert
- packets as appropriate:</P>
-<DL>
-<DT>PUB_INPUT</DT>
-<DD>a<A HREF="http://www.tcpdump.org/"> pcap</A> file to feed in on the
- public (encrypted) interface. (typically, eth1)</DD>
-<DT>PRIV_INPUT</DT>
-<DD>a pcap file to feed in on the private (plain-text) interface
- (typically, eth0).</DD>
-<DT>REF_PUB_OUTPUT</DT>
-<DD>a text file containing tcpdump output. Packets on the public (eth1)
- interface are captured to a<A HREF="http://www.tcpdump.org/"> pcap</A>
- file by <CODE>uml_netjig</CODE>. The klipstest function then uses
- tcpdump on the file to produce text output, which is compared to the
- file given.</DD>
-<DT>REF_PUB_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further
- processing. Defaults to &quot;cat&quot;.</DD>
-<DT>REF_PRIV_OUTPUT</DT>
-<DD>a text file containing tcpdump output. Packets on the private (eth0)
- interface are captured and compared after conversion by tcpdump, as
- with<VAR> REFPUBOUTPUT</VAR>.</DD>
-<DT>REF_PRIV_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further
- processing. Defaults to &quot;cat&quot;.</DD>
-<DT>EXITONEMPTY</DT>
-<DD>a flag for <CODE>uml_netjig</CODE>. It should contain
- &quot;--exitonempty&quot; of uml_netjig should exit when all of the input (<VAR>
-PUBINPUT</VAR>,<VAR>PRIVINPUT</VAR>) packets have been injected.</DD>
-<DT>ARPREPLY</DT>
-<DD>a flag for <CODE>uml_netjig</CODE>. It should contain &quot;--arpreply&quot;
- if <CODE>uml_netjig</CODE> should reply to ARP requests. One will
- typically set this to avoid having to fudge the ARP cache manually.</DD>
-<DT>TCPDUMPFLAGS</DT>
-<DD>a set of flags for the tcpdump used when converting captured output.
- Typical values will include &quot;-n&quot; to turn off DNS, and often &quot;-E&quot; to set
- the decryption key (tcpdump 3.7.1 and higher only) for ESP packets. The
- &quot;-t&quot; flag (turn off timestamps) is provided automatically</DD>
-<DT>NETJIG_EXTRA</DT>
-<DD>additional comments to be sent to the netjig. This may arrange to
- record or create additional networks, or may toggle options.</DD>
-</DL>
-<H2><A NAME="39_6">mkinsttest paramaters</A></H2>
-<P> The basic concept of the <CODE>mkinsttest</CODE> test type is that
- it performs a &quot;make install&quot; to a temporary $DESTDIR. The resulting
- tree can then be examined to determine if it was done properly. The
- files can be uninstalled to determine if the file list was correct, or
- the contents of files can be examined more precisely.</P>
-<DL>
-<DT>INSTALL_FLAGS</DT>
-<DD>If set, then an install will be done. This provides the set of flags
- to provide for the install. The target to be used (usually &quot;install&quot;)
- must be among the flags.</DD>
-<DT>POSTINSTALL_SCRIPT</DT>
-<DD>If set, a script to run after initial &quot;make install&quot;. Two arguments
- are provided: an absolute path to the root of the FreeSWAN src tree,
- and an absolute path to the temporary installation area.</DD>
-<DT>INSTALL2_FLAGS</DT>
-<DD>If set, a second install will be done using these flags. Similarly
- to INSTALL_FLAGS, the target must be among the flags.</DD>
-<DT>UNINSTALL_FLAGS</DT>
-<DD>If set, an uninstall will be done using these flags. Similarly to
- INSTALL_FLAGS, the target (usually &quot;uninstall&quot;) must be among the
- flags.</DD>
-<DT>REF_FIND_f_l_OUTPUT</DT>
-<DD>If set, a <CODE>find $ROOT ( -type f -or -type -l )</CODE> will be
- done to get a list of a real files and symlinks. The resulting file
- will be compared to the file listed by this option.</DD>
-<DT>REF_FILE_CONTENTS</DT>
-<DD>If set, it should point to a file containing records for the form:
-<PRE>
-  
-<!--VARIABLE-->
-reffile</(null)>   
-<!--VARIABLE-->
-samplefile</(null)>
-</PRE>
- one record per line. A diff between the provided reference file, and
- the sample file (located in the temporary installation root) will be
- done for each record.</DD>
-</DL>
-<H2><A NAME="39_7">rpm_build_install_test paramaters</A></H2>
-<P> The <CODE>rpm_build_install_test</CODE> type is to verify that the
- proper packing list is produced by &quot;make rpm&quot;, and that the mechanisms
- for building the kernel modules produce consistent results.</P>
-<DL>
-<DT>RPM_KERNEL_SOURCE</DT>
-<DD>Point to an extracted copy of the RedHat kernel source code.
- Variables from the environment may be used.</DD>
-<DT>REF_RPM_CONTENTS</DT>
-<DD>This is a file containing one record per line. Each record consists
- of a RPM name (may contain wildcards) and a filename to compare the
- contents to. The RPM will be located and a file list will be produced
- with rpm2cpio.</DD>
-</DL>
-<H2><A NAME="39_8">libtest paramaters</A></H2>
-<P> The libtest test is for testing library routines. The library file
- is expected to provided an <CODE>#ifdef</CODE> by the name of<VAR>
- library</VAR>
-<!--CODE_MAIN</CODE-->
-. The libtest type invokes the C compiler to compile this
- file, links it against <CODE>libfreeswan.a</CODE> (to resolve any other
- dependancies) and runs the test with the <CODE>-r</CODE> argument to
- invoke a regression test.</(null)></P>
-<P>The library test case is expected to do a self-test, exiting with
- status code 0 if everything is okay, and with non-zero otherwise. A
- core dump (exit code greater than 128) is noted specifically.</P>
-<P> Unlike other tests, there are no subdirectories required, or other
- parameters to set.</P>
-<H2 NAME="umlplutotest"><A NAME="39_9">umlplutotest paramaters</A></H2>
-<P> The umlplutotest function starts a pair of user mode line processes.
- This is a 2-host version of umlXhost. The &quot;EAST&quot; and &quot;WEST&quot; slots are
- defined.</P>
-<H2 NAME="umlXhost"><A NAME="39_10">umlXhost parameters</A></H2>
-<P> The umlXtest function starts an arbitrary number of user mode line
- processes.</P>
-
-<!-- <IMG SRC="single_netjig.png" ALT="block diagram of uml_netjig"> -->
-<P> The script invoked (<CODE>testing/utils/Xhost-test.tcl</CODE>) is a
- TCL<A HREF="http://expect.nist.gov/"> expect</A> script that arranges
- to start each UML and configure it appropriately for the test. It then
- starts listening (using uml_netjig) to the simulated network answering
- ARPs and inserting packets as appropriate.</P>
-<P> umlXtest has a series of slots, each of which should be filled by a
- host. The list of slots is controlled by the variable, XHOST_LIST. This
- variable should be set to a space seperated list of slots. The former
- umlplutotest is now implemented as a variation of the umlXhost test,
- with XHOST_LIST=&quot;EAST WEST&quot;.</P>
-<P> For each host slot that is defined, a series of variables should be
- filled in, defining what configuration scripts to use for that host.</P>
-<P> The following are used to control the console input and output to
- the system. Where the string ${host} is present, the host slot should
- be filled in. I.e. for the two host system with XHOST_LIST=&quot;EAST WEST&quot;,
- then the variables: EAST_INIT_SCRIPT and WEST_INIT_SCRIPT will exist.</P>
-<DL>
-<DT>${host}HOST</DT>
-<DD>The name of the UML host which will fill this slot</DD>
-<DT>${host}_INIT_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode prior to starting the tests. This file will usually
- set up any eroute's and SADB entries that are required for the test.
- Similar to INIT_SCRIPT, above.</P>
-</DD>
-<DT>${host}_RUN_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode, before the packets are sent. This set of commands is
- run after all of the virtual machines are initialized. I.e. after
- EAST_INIT_SCRIPT<B> AND</B> WEST_INIT_SCRIPT. This script can therefore
- do things that require that all machines are properly configured.</P>
-</DD>
-<DT>${host}_RUN2_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode, after the packets are sent. This set of commands is
- run before any of the virtual machines have been shut down. (I.e.
- before EAST_FINAL_SCRIPT<B> AND</B> WEST_FINAL_SCRIPT.) This script can
- therefore catch post-activity status reports.</P>
-</DD>
-<DT>${host}_FINAL_SCRIPT</DT>
-<DD>
-<P>a file of commands that is fed into the virtual machine's console in
- single user mode after the final packet is sent. Similar to
- INIT_SCRIPT, above. If not specified, then the single command &quot;halt&quot; is
- sent. Note that when this script is run, the other virtual machines may
- already have been killed. If specified, then the script should end with
- a halt command to nicely shutdown the UML.</P>
-</DD>
-<DT>REF_${host}_CONSOLE_OUTPUT</DT>
-<DD>Similar to REF_CONSOLE_OUTPUT, above.</DD>
-</DL>
-<P>Some additional flags apply to all hosts:</P>
-<DL>
-<DT>REF_CONSOLE_FIXUPS</DT>
-<DD>a list of scripts (found in <CODE>klips/test/fixups</CODE>) to apply
- to sanitize the console output of the machine under test. These are
- typically perl, awk or sed scripts that remove things in the kernel
- output that change each time the test is run and/or compiled.</DD>
-</DL>
-<P> In addition to input to the console, the networks may have input fed
- to them:</P>
-<DL>
-<DT>EAST_INPUT/WEST_INPUT</DT>
-<DD>a<A HREF="http://www.tcpdump.org/"> pcap</A> file to feed in on the
- private network side of each network. The &quot;EAST&quot; and &quot;WEST&quot; here refer
- to the networks, not the hosts.</DD>
-<DT>REF_PUB_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further
- processing. Defaults to &quot;cat&quot;.</DD>
-<DT>REF_EAST_FILTER/REF_WEST_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further
- processing. Defaults to &quot;cat&quot;.</DD>
-&lt;
-<DT>TCPDUMPFLAGS</DT>
-<DD>a set of flags for the tcpdump used when converting captured output.
- Typical values will include &quot;-n&quot; to turn off DNS, and often &quot;-E&quot; to set
- the decryption key (tcpdump 3.7.1 and higher only) for ESP packets. The
- &quot;-t&quot; flag (turn off timestamps) is provided automatically</DD>
-<DT>REF_EAST_OUTPUT/REF_WEST_OUTPUT</DT>
-<DD>a text file containing tcpdump output. Packets on the private (eth0)
- interface are captured and compared after conversion by tcpdump, as
- with<VAR> REF_PUB_OUTPUT</VAR>.</DD>
-<P> There are two additional environment variables that may be set on
- the command line:</P>
-<DL>
-<DT> NETJIGVERBOSE=verbose export NETJIGVERBOSE</DT>
-<DD> If set, then the test output will be &quot;chatty&quot;, and let you know
- what commands it is running, and as packets are sent. Without it set,
- the output is limited to success/failure messages.</DD>
-<DT> NETJIGTESTDEBUG=netjig export NETJIGTESTDEBUG</DT>
-<DD> This will enable debugging of the communication with uml_netjig,
- and turn on debugging in this utility. This does not imply
- NETJIGVERBOSE.</DD>
-</DL>
-<DT> HOSTTESTDEBUG=hosttest export HOSTTESTDEBUG</DT>
-<DD> This will show all interactions with the user-mode-linux consoles</DD>
-</DL>
-<H2 NAME="kernelpatch"><A NAME="39_11">kernel_patch_test paramaters</A></H2>
-<P> The kernel_patch_test function takes some kernel source, copies it
- with lndir, and then applies the patch as produced by &quot;make
- kernelpatch&quot;.</P>
-<P> The following are used to control the input and output to the
- system:</P>
-<DL>
-<DT>KERNEL_NAME</DT>
-<DD>the kernel name, typically something like &quot;linus&quot; or &quot;rh&quot;</DD>
-<DT>KERNEL_VERSION</DT>
-<DD>the kernel version number, as in &quot;2.2&quot; or &quot;2.4&quot;.</DD>
-<DT>KERNEL_${KERNEL_NAME}${KERNEL_VERSION}_SRC</DT>
-<DD>This variable should set in the environment, probably in
- ~/freeswan-regress-env.sh. Examples of this variables would be
- KERNEL_LINUS2_0_SRC or KERNEL_RH7_3_SRC. This variable should point to
- an extracted copy of the kernel source in question.</DD>
-<DT>REF_PATCH_OUTPUT</DT>
-<DD>a copy of the patch output to compare against</DD>
-<DT>KERNEL_PATCH_LEAVE_SOURCE</DT>
-<DD>If set to a non-empty string, then the patched kernel source is not
- removed at the end of the test. This will typically be set in the
- environment while debugging.</DD>
-</DL>
-<H2 NAME="modtest"><A NAME="39_12">module_compile paramaters</A></H2>
-<P> The module_compile test attempts to build the KLIPS module against a
- given set of kernel source. This is also done by the RPM tests, but in
- a very specific manner.</P>
-<P> There are two variations of this test - one where the kernel either
- doesn't need to be configured, or is already done, and tests were there
- is a local configuration file.</P>
-<P> Where the kernel doesn't need to be configured, the kernel source
- that is found is simply used. It may be a RedHat-style kernel, where
- one can cause it to configure itself via rhconfig.h-style definitions.
- Or, it may just be a kernel tree that has been configured.</P>
-<P> If the variable KERNEL_CONFIG_FILE is set, then a new directory is
- created for the kernel source. It is populated with lndir(1). The
- referenced file is then copied in as .config, and &quot;make oldconfig&quot; is
- used to configure the kernel. This resulting kernel is then used as the
- reference source.</P>
-<P> In all cases, the kernel source is found the same was for the
- kernelpatch test, i.e. via KERNEL_VERSION/KERNEL_NAME and
- KERNEL_${KERNEL_NAME}${KERNEL_VERSION}_SRC.</P>
-<P> Once there is kernel source, the module is compiled using the
- top-level &quot;make module&quot; target.</P>
-<P> The test is considered successful if an executable is found in
- OUTPUT/module/ipsec.o at the end of the test.</P>
-<DL>
-<DT>KERNEL_NAME</DT>
-<DD>the kernel name, typically something like &quot;linus&quot; or &quot;rh&quot;</DD>
-<DT>KERNEL_VERSION</DT>
-<DD>the kernel version number, as in &quot;2.2&quot; or &quot;2.4&quot;.</DD>
-<DT>KERNEL_${KERNEL_NAME}${KERNEL_VERSION}_SRC</DT>
-<DD>This variable should set in the environment, probably in
- ~/freeswan-regress-env.sh. Examples of this variables would be
- KERNEL_LINUS2_0_SRC or KERNEL_RH7_3_SRC. This variable should point to
- an extracted copy of the kernel source in question.</DD>
-<DT>KERNEL_CONFIG_FILE</DT>
-<DD>The configuration file for the kernel.</DD>
-<DT>KERNEL_PATCH_LEAVE_SOURCE</DT>
-<DD>If set to a non-empty string, then the configured kernel source is
- not removed at the end of the test. This will typically be set in the
- environment while debugging.</DD>
-<DT>MODULE_DEF_INCLUDE</DT>
-<DD>The include file that will be used to configure the KLIPS module,
- and possibly the kernel source.</DD>
-</DL>
-<H1><A NAME="40">Current pitfalls</A></H1>
-<DL>
-<DT> &quot;tcpdump dissector&quot; not available.</DT>
-<DD> This is a non-fatal warning. If uml_netjig is invoked with the -t
- option, then it will attempt to use tcpdump's dissector to decode each
- packet that it processes. The dissector is presently not available, so
- this option it normally turned off at compile time. The dissector
- library will be released with tcpdump version 4.0.</DD>
-</DL>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="umltesting.html">Previous</A>
-<A HREF="nightly.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec.8.html b/doc/manpage.d/ipsec.8.html
deleted file mode 100644
index ff9b7ca39..000000000
--- a/doc/manpage.d/ipsec.8.html
+++ /dev/null
@@ -1,215 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC</TITLE>
-</HEAD><BODY>
-<H1>IPSEC</H1>
-Section: Maintenance Commands (8)<BR>Updated: 26 March 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec - invoke IPsec utilities
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-command [ argument ...]
-<P>
-<B>ipsec</B>
-
-<B>--help</B>
-
-<BR>
-
-<B>ipsec</B>
-
-<B>--version</B>
-
-<BR>
-
-<B>ipsec</B>
-
-<B>--versioncode</B>
-
-<BR>
-
-<B>ipsec</B>
-
-<B>--copyright</B>
-
-<BR>
-
-<B>ipsec</B>
-
-<B>--directory</B>
-
-<BR>
-
-<B>ipsec</B>
-
-<B>--confdir</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ipsec</I>
-
-invokes any of several utilities involved in controlling the IPsec
-encryption/authentication system,
-running the specified
-<I>command</I>
-
-with the specified
-<I>argument</I>s
-
-as if it had been invoked directly.
-This largely eliminates possible name collisions with other software,
-and also permits some centralized services.
-<P>
-
-In particular,
-<I>ipsec</I>
-
-supplies the invoked
-<I>command</I>
-
-with a suitable PATH environment variable,
-and also provides IPSEC_DIR,
-IPSEC_CONFS, and IPSEC_VERSION environment variables,
-containing respectively
-the full pathname of the directory where the IPsec utilities are stored,
-the full pathname of the directory where the configuration files live,
-and the IPsec version number.
-<P>
-
-<B>ipsec --help</B>
-
-lists the available commands.
-Most have their own manual pages, e.g.
-<I><A HREF="ipsec_auto.8.html">ipsec_auto</A></I>(8)
-
-for
-<I>auto</I>.
-
-<P>
-
-<B>ipsec --version</B>
-
-outputs version information about Linux FreeS/WAN.
-A version code of the form ``U<I>xxx</I>/K<I>yyy</I>''
-indicates that the user-level utilities are version <I>xxx</I>
-but the kernel portion appears to be version <I>yyy</I>
-(this form is used only if the two disagree).
-<P>
-
-<B>ipsec --versioncode</B>
-
-outputs <I>just</I> the version code,
-with none of
-<B>--version</B>'s
-
-supporting information,
-for use by scripts.
-<P>
-
-<B>ipsec --copyright</B>
-
-supplies boring copyright details.
-<P>
-
-<B>ipsec --directory</B>
-
-reports where
-<I>ipsec</I>
-
-thinks the IPsec utilities are stored.
-<P>
-
-<B>ipsec --confdir</B>
-
-reports where
-<I>ipsec</I>
-
-thinks the IPsec configuration files are stored.
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-/usr/local/lib/ipsec<TT>&nbsp;&nbsp;&nbsp;</TT>usual utilities directory<BR>
-<A NAME="lbAF">&nbsp;</A>
-<H2>ENVIRONMENT</H2>
-
-<P>
-
-The following environment variables control where FreeS/WAN finds its
-components.
-The
-<B>ipsec</B>
-
-command sets them if they are not already set.
-<PRE>
-IPSEC_EXECDIR   directory containing published commands
-IPSEC_LIBDIR    directory containing internal executables
-IPSEC_SBINDIR   directory containing <B>ipsec</B> command
-IPSEC_CONFS     directory containing configuration files
-</PRE>
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-
-
-<A HREF="ipsec.conf.5.html">ipsec.conf</A>(5), <A HREF="ipsec.secrets.5.html">ipsec.secrets</A>(5),
-<A HREF="ipsec_auto.8.html">ipsec_auto</A>(8),
-<A HREF="ipsec_barf.8.html">ipsec_barf</A>(8),
-<A HREF="ipsec_setup.8.html">ipsec_setup</A>(8),
-<A HREF="ipsec_showdefaults.8.html">ipsec_showdefaults</A>(8),
-<A HREF="ipsec_showhostkey.8.html">ipsec_showhostkey</A>(8)
-
-
-<P>
-
-HTML documentation shipped with the release, starting with
-<I>doc/index.html</I>.
-
-<I>&lt;<A HREF="http://www.freeswan.org/doc.html">http://www.freeswan.org/doc.html</A>&gt;</I>
-
-may also be of use.
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for Linux FreeS/WAN
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Henry Spencer.
-<A NAME="lbAI">&nbsp;</A>
-<H2>BUGS</H2>
-
-The provision of centralized services,
-while convenient,
-does compromise the original concept of making the utilities
-invocable directly as well as via
-<I>ipsec</I>.
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">ENVIRONMENT</A><DD>
-<DT><A HREF="#lbAG">SEE ALSO</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-<DT><A HREF="#lbAI">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec.conf.5.html b/doc/manpage.d/ipsec.conf.5.html
deleted file mode 100644
index 36e0452ef..000000000
--- a/doc/manpage.d/ipsec.conf.5.html
+++ /dev/null
@@ -1,1830 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC.CONF</TITLE>
-</HEAD><BODY>
-<H1>IPSEC.CONF</H1>
-Section: File Formats (5)<BR>Updated: 26 Nov 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec.conf - IPsec configuration and connections
-<A NAME="lbAC">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The optional
-<I>ipsec.conf</I>
-
-file
-specifies most configuration and control information for the
-FreeS/WAN IPsec subsystem.
-(The major exception is secrets for authentication;
-see
-<I><A HREF="ipsec.secrets.5.html">ipsec.secrets</A></I>(5).)
-
-Its contents are not security-sensitive
-<I>unless</I>
-
-manual keying is being done for more than just testing,
-in which case the encryption/authentication keys in the
-descriptions for the manually-keyed connections are very sensitive
-(and those connection descriptions
-are probably best kept in a separate file,
-via the include facility described below).
-<P>
-
-The file is a text file, consisting of one or more
-<I>sections</I>.
-
-White space followed by
-<B>#</B>
-
-followed by anything to the end of the line
-is a comment and is ignored,
-as are empty lines which are not within a section.
-<P>
-
-A line which contains
-<B>include</B>
-
-and a file name, separated by white space,
-is replaced by the contents of that file,
-preceded and followed by empty lines.
-If the file name is not a full pathname,
-it is considered to be relative to the directory containing the
-including file.
-Such inclusions can be nested.
-Only a single filename may be supplied, and it may not contain white space,
-but it may include shell wildcards (see
-<I><A HREF="sh.1.html">sh</A></I>(1));
-
-for example:
-<P>
-
-<B>include</B>
-
-<B>ipsec.*.conf</B>
-
-<P>
-
-The intention of the include facility is mostly to permit keeping
-information on connections, or sets of connections,
-separate from the main configuration file.
-This permits such connection descriptions to be changed,
-copied to the other security gateways involved, etc.,
-without having to constantly extract them from the configuration
-file and then insert them back into it.
-Note also the
-<B>also</B>
-
-and
-<B>alsoflip</B>
-
-parameters (described below) which permit splitting a single logical section
-(e.g. a connection description) into several actual sections.
-<P>
-
-The first significant line of the file must specify the version
-of this specification that it conforms to:
-<P>
-
-<B>version 2</B>
-<P>
-
-A section
-begins with a line of the form:
-<P>
-
-<I>type</I>
-
-<I>name</I>
-
-<P>
-
-where
-<I>type</I>
-
-indicates what type of section follows, and
-<I>name</I>
-
-is an arbitrary name which distinguishes the section from others
-of the same type.
-(Names must start with a letter and may contain only
-letters, digits, periods, underscores, and hyphens.)
-All subsequent non-empty lines
-which begin with white space are part of the section;
-comments within a section must begin with white space too.
-There may be only one section of a given type with a given name.
-<P>
-
-Lines within the section are generally of the form
-<P>
-
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<I>parameter</I><B>=</B><I>value</I>
-<P>
-
-(note the mandatory preceding white space).
-There can be white space on either side of the
-<B>=</B>.
-
-Parameter names follow the same syntax as section names,
-and are specific to a section type.
-Unless otherwise explicitly specified,
-no parameter name may appear more than once in a section.
-<P>
-
-An empty
-<I>value</I>
-
-stands for the system default value (if any) of the parameter,
-i.e. it is roughly equivalent to omitting the parameter line entirely.
-A
-<I>value</I>
-
-may contain white space only if the entire
-<I>value</I>
-
-is enclosed in double quotes (<B>&quot;</B>);
-a
-<I>value</I>
-
-cannot itself contain a double quote,
-nor may it be continued across more than one line.
-<P>
-
-Numeric values are specified to be either an ``integer''
-(a sequence of digits) or a ``decimal number''
-(sequence of digits optionally followed by `.' and another sequence of digits).
-<P>
-
-There is currently one parameter which is available in any type of
-section:
-<DL COMPACT>
-<DT><B>also</B>
-
-<DD>
-the value is a section name;
-the parameters of that section are appended to this section,
-as if they had been written as part of it.
-The specified section must exist, must follow the current one,
-and must have the same section type.
-(Nesting is permitted,
-and there may be more than one
-<B>also</B>
-
-in a single section,
-although it is forbidden to append the same section more than once.)
-This allows, for example, keeping the encryption keys
-for a connection in a separate file
-from the rest of the description, by using both an
-<B>also</B>
-
-parameter and an
-<B>include</B>
-
-line.
-(Caution, see BUGS below for some restrictions.)
-<DT><B>alsoflip</B>
-
-<DD>
-can be used in a
-<B>conn</B>
-
-section.
-It acts like an
-<B>also</B>
-
-that flips the referenced section's entries left-for-right.
-</DL>
-<P>
-
-Parameter names beginning with
-<B>x-</B>
-
-(or
-<B>X-</B>,
-
-or
-<B>x_</B>,
-
-or
-<B>X_</B>)
-
-are reserved for user extensions and will never be assigned meanings
-by IPsec.
-Parameters with such names must still observe the syntax rules
-(limits on characters used in the name;
-no white space in a non-quoted value;
-no newlines or double quotes within the value).
-All other as-yet-unused parameter names are reserved for future IPsec
-improvements.
-<P>
-
-A section with name
-<B>%default</B>
-
-specifies defaults for sections of the same type.
-For each parameter in it,
-any section of that type which does not have a parameter of the same name
-gets a copy of the one from the
-<B>%default</B>
-
-section.
-There may be multiple
-<B>%default</B>
-
-sections of a given type,
-but only one default may be supplied for any specific parameter name,
-and all
-<B>%default</B>
-
-sections of a given type must precede all non-<B>%default</B>
-
-sections of that type.
-<B>%default</B>
-
-sections may not contain
-<B>also</B>
-
-or
-<B>alsoflip</B>
-
-parameters.
-<P>
-
-Currently there are two types of section:
-a
-<B>config</B>
-
-section specifies general configuration information for IPsec,
-while a
-<B>conn</B>
-
-section specifies an IPsec connection.
-<A NAME="lbAD">&nbsp;</A>
-<H2>CONN SECTIONS</H2>
-
-A
-<B>conn</B>
-
-section contains a
-<I>connection specification</I>,
-
-defining a network connection to be made using IPsec.
-The name given is arbitrary, and is used to identify the connection to
-<I><A HREF="ipsec_auto.8.html">ipsec_auto</A></I>(8)
-
-and
-<I><A HREF="ipsec_manual.8.html">ipsec_manual</A></I>(8).
-
-Here's a simple example:
-<P>
-
-
-<PRE>
-<B>
-conn snt
- left=10.11.11.1
- leftsubnet=10.0.1.0/24
- leftnexthop=172.16.55.66
- right=192.168.22.1
- rightsubnet=10.0.2.0/24
- rightnexthop=172.16.88.99
- keyingtries=%forever
-</B></PRE>
-
-<P>
-
-A note on terminology...
-In automatic keying, there are two kinds of communications going on:
-transmission of user IP packets, and gateway-to-gateway negotiations for
-keying, rekeying, and general control.
-The data path (a set of ``IPsec SAs'') used for user packets is herein
-referred to as the ``connection'';
-the path used for negotiations (built with ``ISAKMP SAs'') is referred to as
-the ``keying channel''.
-<P>
-
-To avoid trivial editing of the configuration file to suit it to each system
-involved in a connection,
-connection specifications are written in terms of
-<I>left</I>
-
-and
-<I>right</I>
-
-participants,
-rather than in terms of local and remote.
-Which participant is considered
-<I>left</I>
-
-or
-<I>right</I>
-
-is arbitrary;
-IPsec figures out which one it is being run on based on internal information.
-This permits using identical connection specifications on both ends.
-There are cases where there is no symmetry; a good convention is to
-use
-<I>left</I>
-
-for the local side and
-<I>right</I>
-
-for the remote side (the first letters are a good mnemonic).
-<P>
-
-Many of the parameters relate to one participant or the other;
-only the ones for
-<I>left</I>
-
-are listed here, but every parameter whose name begins with
-<B>left</B>
-
-has a
-<B>right</B>
-
-counterpart,
-whose description is the same but with
-<B>left</B>
-
-and
-<B>right</B>
-
-reversed.
-<P>
-
-Parameters are optional unless marked ``(required)'';
-a parameter required for manual keying need not be included for
-a connection which will use only automatic keying, and vice versa.
-<A NAME="lbAE">&nbsp;</A>
-<H3>CONN PARAMETERS:  GENERAL</H3>
-
-The following parameters are relevant to both automatic and manual keying.
-Unless otherwise noted,
-for a connection to work,
-in general it is necessary for the two ends to agree exactly
-on the values of these parameters.
-<DL COMPACT>
-<DT><B>type</B>
-
-<DD>
-the type of the connection; currently the accepted values
-are
-<B>tunnel</B>
-
-(the default)
-signifying a host-to-host, host-to-subnet, or subnet-to-subnet tunnel;
-<B>transport</B>,
-
-signifying host-to-host transport mode;
-<B>passthrough</B>,
-
-signifying that no IPsec processing should be done at all;
-<B>drop</B>,
-
-signifying that packets should be discarded; and
-<B>reject</B>,
-
-signifying that packets should be discarded and a diagnostic ICMP returned.
-<DT><B>left</B>
-
-<DD>
-(required)
-the IP address of the left participant's public-network interface,
-in any form accepted by
-<I><A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A></I>(3)
-
-or one of several magic values.
-If it is
-<B>%defaultroute</B>,
-
-and
-the
-<B>config</B>
-
-<B>setup</B>
-
-section's,
-<B>interfaces</B>
-
-specification contains
-<B>%defaultroute,</B>
-
-<B>left</B>
-
-will be filled in automatically with the local address
-of the default-route interface (as determined at IPsec startup time);
-this also overrides any value supplied for
-<B>leftnexthop</B>.
-
-(Either
-<B>left</B>
-
-or
-<B>right</B>
-
-may be
-<B>%defaultroute</B>,
-
-but not both.)
-The value
-<B>%any</B>
-
-signifies an address to be filled in (by automatic keying) during
-negotiation.
-The value
-<B>%opportunistic</B>
-
-signifies that both
-<B>left</B>
-
-and
-<B>leftnexthop</B>
-
-are to be filled in (by automatic keying) from DNS data for
-<B>left</B>'s
-
-client.
-The values
-<B>%group</B>
-
-and
-<B>%opportunisticgroup</B>
-
-makes this a policy group conn: one that will be instantiated
-into a regular or opportunistic conn for each CIDR block listed in the
-policy group file with the same name as the conn.
-<DT><B>leftsubnet</B>
-
-<DD>
-private subnet behind the left participant, expressed as
-<I>network</I><B>/</B><I>netmask</I>
-(actually, any form acceptable to
-<I><A HREF="ipsec_ttosubnet.3.html">ipsec_ttosubnet</A></I>(3));
-
-if omitted, essentially assumed to be <I>left</I><B>/32</B>,
-signifying that the left end of the connection goes to the left participant only
-<DT><B>leftnexthop</B>
-
-<DD>
-next-hop gateway IP address for the left participant's connection
-to the public network;
-defaults to
-<B>%direct</B>
-
-(meaning
-<I>right</I>).
-
-If the value is to be overridden by the
-<B>left=%defaultroute</B>
-
-method (see above),
-an explicit value must
-<I>not</I>
-
-be given.
-If that method is not being used,
-but
-<B>leftnexthop</B>
-
-is
-<B>%defaultroute</B>,
-
-and
-<B>interfaces=%defaultroute</B>
-
-is used in the
-<B>config</B>
-
-<B>setup</B>
-
-section,
-the next-hop gateway address of the default-route interface
-will be used.
-The magic value
-<B>%direct</B>
-
-signifies a value to be filled in (by automatic keying)
-with the peer's address.
-Relevant only locally, other end need not agree on it.
-<DT><B>leftupdown</B>
-
-<DD>
-what ``updown'' script to run to adjust routing and/or firewalling
-when the status of the connection
-changes (default
-<B>ipsec _updown</B>).
-
-May include positional parameters separated by white space
-(although this requires enclosing the whole string in quotes);
-including shell metacharacters is unwise.
-See
-<I><A HREF="ipsec_pluto.8.html">ipsec_pluto</A></I>(8)
-
-for details.
-Relevant only locally, other end need not agree on it.
-<DT><B>leftfirewall</B>
-
-<DD>
-whether the left participant is doing forwarding-firewalling
-(including masquerading) for traffic from <I>leftsubnet</I>,
-which should be turned off (for traffic to the other subnet)
-once the connection is established;
-acceptable values are
-<B>yes</B>
-
-and (the default)
-<B>no</B>.
-
-May not be used in the same connection description with
-<B>leftupdown</B>.
-
-Implemented as a parameter to the default
-<I>updown</I>
-
-script.
-See notes below.
-Relevant only locally, other end need not agree on it.
-</DL>
-<P>
-
-If one or both security gateways are doing forwarding firewalling
-(possibly including masquerading),
-and this is specified using the firewall parameters,
-tunnels established with IPsec are exempted from it
-so that packets can flow unchanged through the tunnels.
-(This means that all subnets connected in this manner must have
-distinct, non-overlapping subnet address blocks.)
-This is done by the default
-<I>updown</I>
-
-script (see
-<I><A HREF="ipsec_pluto.8.html">ipsec_pluto</A></I>(8)).
-
-<P>
-
-The implementation of this makes certain assumptions about firewall setup,
-notably the use of the old
-<I>ipfwadm</I>
-
-interface to the firewall.
-In situations calling for more control,
-it may be preferable for the user to supply his own
-<I>updown</I>
-
-script,
-which makes the appropriate adjustments for his system.
-<A NAME="lbAF">&nbsp;</A>
-<H3>CONN PARAMETERS:  AUTOMATIC KEYING</H3>
-
-The following parameters are relevant only to automatic keying,
-and are ignored in manual keying.
-Unless otherwise noted,
-for a connection to work,
-in general it is necessary for the two ends to agree exactly
-on the values of these parameters.
-<DL COMPACT>
-<DT><B>keyexchange</B>
-
-<DD>
-method of key exchange;
-the default and currently the only accepted value is
-<B>ike</B>
-
-<DT><B>auto</B>
-
-<DD>
-what operation, if any, should be done automatically at IPsec startup;
-currently-accepted values are
-<B>add</B>
-
-(signifying an
-<B>ipsec auto</B>
-
-<B>--add</B>),
-
-<B>route</B>
-
-(signifying that plus an
-<B>ipsec auto</B>
-
-<B>--route</B>),
-
-<B>start</B>
-
-(signifying that plus an
-<B>ipsec auto</B>
-
-<B>--up</B>),
-
-<B>manual</B>
-
-(signifying an
-<B>ipsec</B>
-
-<B>manual</B>
-
-<B>--up</B>),
-
-and
-<B>ignore</B>
-
-(also the default) (signifying no automatic startup operation).
-See the
-<B>config</B>
-
-<B>setup</B>
-
-discussion below.
-Relevant only locally, other end need not agree on it
-(but in general, for an intended-to-be-permanent connection,
-both ends should use
-<B>auto=start</B>
-
-to ensure that any reboot causes immediate renegotiation).
-<DT><B>auth</B>
-
-<DD>
-whether authentication should be done as part of
-ESP encryption, or separately using the AH protocol;
-acceptable values are
-<B>esp</B>
-
-(the default) and
-<B>ah</B>.
-
-<DT><B>authby</B>
-
-<DD>
-how the two security gateways should authenticate each other;
-acceptable values are
-<B>secret</B>
-
-for shared secrets,
-<B>rsasig</B>
-
-for RSA digital signatures (the default),
-<B>secret|rsasig</B>
-
-for either, and
-<B>never</B>
-
-if negotiation is never to be attempted or accepted (useful for shunt-only conns).
-Digital signatures are superior in every way to shared secrets.
-<DT><B>leftid</B>
-
-<DD>
-how
-the left participant
-should be identified for authentication;
-defaults to
-<B>left</B>.
-
-Can be an IP address (in any
-<I><A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A></I>(3)
-
-syntax)
-or a fully-qualified domain name preceded by
-<B>@</B>
-
-(which is used as a literal string and not resolved).
-The magic value
-<B>%myid</B>
-
-stands for the current setting of <I>myid</I>.
-This is set in <B>config setup</B> or by <I><A HREF="ipsec_whack.8.html">ipsec_whack</A></I>(8)), or, if not set,
-it is the IP address in <B>%defaultroute</B> (if that is supported by a TXT record in its reverse domain), or otherwise
-it is the system's hostname (if that is supported by a TXT record in its forward domain), or otherwise it is undefined.
-<DT><B>leftrsasigkey</B>
-
-<DD>
-the left participant's
-public key for RSA signature authentication,
-in RFC 2537 format using
-<I><A HREF="ipsec_ttodata.3.html">ipsec_ttodata</A></I>(3)
-
-encoding.
-The magic value
-<B>%none</B>
-
-means the same as not specifying a value (useful to override a default).
-The value
-<B>%dnsondemand</B>
-
-(the default)
-means the key is to be fetched from DNS at the time it is needed.
-The value
-<B>%dnsonload</B>
-
-means the key is to be fetched from DNS at the time
-the connection description is read from
-<I>ipsec.conf</I>;
-
-currently this will be treated as
-<B>%none</B>
-
-if
-<B>right=%any</B>
-
-or
-<B>right=%opportunistic</B>.
-
-The value
-<B>%dns</B>
-
-is currently treated as
-<B>%dnsonload</B>
-
-but will change to
-<B>%dnsondemand</B>
-
-in the future.
-The identity used for the left participant
-must be a specific host, not
-<B>%any</B>
-
-or another magic value.
-<B>Caution:</B>
-
-if two connection descriptions
-specify different public keys for the same
-<B>leftid</B>,
-
-confusion and madness will ensue.
-<DT><B>leftrsasigkey2</B>
-
-<DD>
-if present, a second public key.
-Either key can authenticate the signature, allowing for key rollover.
-<DT><B>pfs</B>
-
-<DD>
-whether Perfect Forward Secrecy of keys is desired on the connection's
-keying channel
-(with PFS, penetration of the key-exchange protocol
-does not compromise keys negotiated earlier);
-acceptable values are
-<B>yes</B>
-
-(the default)
-and
-<B>no</B>.
-
-<DT><B>keylife</B>
-
-<DD>
-how long a particular instance of a connection
-(a set of encryption/authentication keys for user packets) should last,
-from successful negotiation to expiry;
-acceptable values are an integer optionally followed by
-<B>s</B>
-
-(a time in seconds)
-or a decimal number followed by
-<B>m</B>,
-
-<B>h</B>,
-
-or
-<B>d</B>
-
-(a time
-in minutes, hours, or days respectively)
-(default
-<B>8.0h</B>,
-
-maximum
-<B>24h</B>).
-
-Normally, the connection is renegotiated (via the keying channel)
-before it expires.
-The two ends need not exactly agree on
-<B>keylife</B>,
-
-although if they do not,
-there will be some clutter of superseded connections on the end
-which thinks the lifetime is longer.
-<DT><B>rekey</B>
-
-<DD>
-whether a connection should be renegotiated when it is about to expire;
-acceptable values are
-<B>yes</B>
-
-(the default)
-and
-<B>no</B>.
-
-The two ends need not agree,
-but while a value of
-<B>no</B>
-
-prevents Pluto from requesting renegotiation,
-it does not prevent responding to renegotiation requested from the other end,
-so
-<B>no</B>
-
-will be largely ineffective unless both ends agree on it.
-<DT><B>rekeymargin</B>
-
-<DD>
-how long before connection expiry or keying-channel expiry
-should attempts to
-negotiate a replacement
-begin; acceptable values as for
-<B>keylife</B>
-
-(default
-<B>9m</B>).
-
-Relevant only locally, other end need not agree on it.
-<DT><B>rekeyfuzz</B>
-
-<DD>
-maximum percentage by which
-<B>rekeymargin</B>
-
-should be randomly increased to randomize rekeying intervals
-(important for hosts with many connections);
-acceptable values are an integer,
-which may exceed 100,
-followed by a `%'
-(default set by
-<I><A HREF="ipsec_pluto.8.html">ipsec_pluto</A></I>(8),
-
-currently
-<B>100%</B>).
-
-The value of
-<B>rekeymargin</B>,
-
-after this random increase,
-must not exceed
-<B>keylife</B>.
-
-The value
-<B>0%</B>
-
-will suppress time randomization.
-Relevant only locally, other end need not agree on it.
-<DT><B>keyingtries</B>
-
-<DD>
-how many attempts (a whole number or <B>%forever</B>) should be made to
-negotiate a connection, or a replacement for one, before giving up
-(default
-<B>%forever</B>).
-
-The value <B>%forever</B>
-means ``never give up'' (obsolete: this can be written <B>0</B>).
-Relevant only locally, other end need not agree on it.
-<DT><B>ikelifetime</B>
-
-<DD>
-how long the keying channel of a connection (buzzphrase:  ``ISAKMP SA'')
-should last before being renegotiated;
-acceptable values as for
-<B>keylife</B>
-
-(default set by
-<I><A HREF="ipsec_pluto.8.html">ipsec_pluto</A></I>(8),
-
-currently
-<B>1h</B>,
-
-maximum
-<B>8h</B>).
-
-The two-ends-disagree case is similar to that of
-<B>keylife</B>.
-
-<DT><B>compress</B>
-
-<DD>
-whether IPComp compression of content is proposed on the connection
-(link-level compression does not work on encrypted data,
-so to be effective, compression must be done <I>before</I> encryption);
-acceptable values are
-<B>yes</B>
-
-and
-<B>no</B>
-
-(the default).
-The two ends need not agree.
-A value of
-<B>yes</B>
-
-causes IPsec to propose both compressed and uncompressed,
-and prefer compressed.
-A value of
-<B>no</B>
-
-prevents IPsec from proposing compression;
-a proposal to compress will still be accepted.
-<DT><B>disablearrivalcheck</B>
-
-<DD>
-whether KLIPS's normal tunnel-exit check
-(that a packet emerging from a tunnel has plausible addresses in its header)
-should be disabled;
-acceptable values are
-<B>yes</B>
-
-and
-<B>no</B>
-
-(the default).
-Tunnel-exit checks improve security and do not break any normal configuration.
-Relevant only locally, other end need not agree on it.
-<DT><B>failureshunt</B>
-
-<DD>
-what to do with packets when negotiation fails.
-The default is
-<B>none</B>:
-
-no shunt;
-<B>passthrough</B>,
-
-<B>drop</B>,
-
-and
-<B>reject</B>
-
-have the obvious meanings.
-</DL>
-<A NAME="lbAG">&nbsp;</A>
-<H3>CONN PARAMETERS:  MANUAL KEYING</H3>
-
-The following parameters are relevant only to manual keying,
-and are ignored in automatic keying.
-Unless otherwise noted,
-for a connection to work,
-in general it is necessary for the two ends to agree exactly
-on the values of these parameters.
-A manually-keyed
-connection must specify at least one of AH or ESP.
-<DL COMPACT>
-<DT><B>spi</B>
-
-<DD>
-(this or
-<B>spibase</B>
-
-required for manual keying)
-the SPI number to be used for the connection (see
-<I><A HREF="ipsec_manual.8.html">ipsec_manual</A></I>(8));
-
-must be of the form <B>0x</B><I>hex</I><B></B>,
-where
-<I>hex</I>
-
-is one or more hexadecimal digits
-(note, it will generally be necessary to make
-<I>spi</I>
-
-at least
-<B>0x100</B>
-
-to be acceptable to KLIPS,
-and use of SPIs in the range
-<B>0x100</B>-<B>0xfff</B>
-
-is recommended)
-<DT><B>spibase</B>
-
-<DD>
-(this or
-<B>spi</B>
-
-required for manual keying)
-the base number for the SPIs to be used for the connection (see
-<I><A HREF="ipsec_manual.8.html">ipsec_manual</A></I>(8));
-
-must be of the form <B>0x</B><I>hex</I><B>0</B>,
-where
-<I>hex</I>
-
-is one or more hexadecimal digits
-(note, it will generally be necessary to make
-<I>spibase</I>
-
-at least
-<B>0x100</B>
-
-for the resulting SPIs
-to be acceptable to KLIPS,
-and use of numbers in the range
-<B>0x100</B>-<B>0xff0</B>
-
-is recommended)
-<DT><B>esp</B>
-
-<DD>
-ESP encryption/authentication algorithm to be used
-for the connection, e.g.
-<B>3des-md5-96</B>
-
-(must be suitable as a value of
-<I><A HREF="ipsec_spi.8.html">ipsec_spi</A></I>(8)'s
-
-<B>--esp</B>
-
-option);
-default is not to use ESP
-<DT><B>espenckey</B>
-
-<DD>
-ESP encryption key
-(must be suitable as a value of
-<I><A HREF="ipsec_spi.8.html">ipsec_spi</A></I>(8)'s
-
-<B>--enckey</B>
-
-option)
-(may be specified separately for each direction using
-<B>leftespenckey</B>
-
-(leftward SA)
-and
-<B>rightespenckey</B>
-
-parameters)
-<DT><B>espauthkey</B>
-
-<DD>
-ESP authentication key
-(must be suitable as a value of
-<I><A HREF="ipsec_spi.8.html">ipsec_spi</A></I>(8)'s
-
-<B>--authkey</B>
-
-option)
-(may be specified separately for each direction using
-<B>leftespauthkey</B>
-
-(leftward SA)
-and
-<B>rightespauthkey</B>
-
-parameters)
-<DT><B>espreplay_window</B>
-
-<DD>
-ESP replay-window setting,
-an integer from
-<B>0</B>
-
-(the
-<I>ipsec_manual</I>
-
-default, which turns off replay protection) to
-<B>64</B>;
-
-relevant only if ESP authentication is being used
-<DT><B>leftespspi</B>
-
-<DD>
-SPI to be used for the leftward ESP SA, overriding
-automatic assignment using
-<B>spi</B>
-
-or
-<B>spibase</B>;
-
-typically a hexadecimal number beginning with
-<B>0x</B>
-
-<DT><B>ah</B>
-
-<DD>
-AH authentication algorithm to be used
-for the connection, e.g.
-<B>hmac-md5-96</B>
-
-(must be suitable as a value of
-<I><A HREF="ipsec_spi.8.html">ipsec_spi</A></I>(8)'s
-
-<B>--ah</B>
-
-option);
-default is not to use AH
-<DT><B>ahkey</B>
-
-<DD>
-(required if
-<B>ah</B>
-
-is present) AH authentication key
-(must be suitable as a value of
-<I><A HREF="ipsec_spi.8.html">ipsec_spi</A></I>(8)'s
-
-<B>--authkey</B>
-
-option)
-(may be specified separately for each direction using
-<B>leftahkey</B>
-
-(leftward SA)
-and
-<B>rightahkey</B>
-
-parameters)
-<DT><B>ahreplay_window</B>
-
-<DD>
-AH replay-window setting,
-an integer from
-<B>0</B>
-
-(the
-<I>ipsec_manual</I>
-
-default, which turns off replay protection) to
-<B>64</B>
-
-<DT><B>leftahspi</B>
-
-<DD>
-SPI to be used for the leftward AH SA, overriding
-automatic assignment using
-<B>spi</B>
-
-or
-<B>spibase</B>;
-
-typically a hexadecimal number beginning with
-<B>0x</B>
-
-</DL>
-<A NAME="lbAH">&nbsp;</A>
-<H2>CONFIG SECTIONS</H2>
-
-At present, the only
-<B>config</B>
-
-section known to the IPsec software is the one named
-<B>setup</B>,
-
-which contains information used when the software is being started
-(see
-<I><A HREF="ipsec_setup.8.html">ipsec_setup</A></I>(8)).
-
-Here's an example:
-<P>
-
-
-<PRE>
-<B>
-config setup
- interfaces=&quot;ipsec0=eth1 ipsec1=ppp0&quot;
- klipsdebug=none
- plutodebug=all
- manualstart=
-</B></PRE>
-
-<P>
-
-Parameters are optional unless marked ``(required)''.
-The currently-accepted
-<I>parameter</I>
-
-names in a
-<B>config</B>
-
-<B>setup</B>
-
-section are:
-<DL COMPACT>
-<DT><B>myid</B>
-
-<DD>
-the identity to be used for
-<B>%myid</B>.
-
-<B>%myid</B>
-
-is used in the implicit policy group conns and can be used as
-an identity in explicit conns.
-If unspecified,
-<B>%myid</B>
-
-is set to the IP address in <B>%defaultroute</B> (if that is supported by a TXT record in its reverse domain), or otherwise
-the system's hostname (if that is supported by a TXT record in its forward domain), or otherwise it is undefined.
-An explicit value generally starts with ``<B>@</B>''.
-<DT><B>interfaces</B>
-
-<DD>
-virtual and physical interfaces for IPsec to use:
-a single
-<I>virtual</I><B>=</B><I>physical</I> pair, a (quoted!) list of pairs separated
-by white space, or
-<B>%none</B>.
-
-One of the pairs may be written as
-<B>%defaultroute</B>,
-
-which means: find the interface <I>d</I> that the default route points to,
-and then act as if the value was ``<B>ipsec0=</B><I>d</I>''.
-<B>%defaultroute</B>
-
-is the default;
-<B>%none</B>
-
-must be used to denote no interfaces.
-If
-<B>%defaultroute</B>
-
-is used (implicitly or explicitly)
-information about the default route and its interface is noted for
-use by
-<I><A HREF="ipsec_manual.8.html">ipsec_manual</A></I>(8)
-
-and
-<I><A HREF="ipsec_auto.8.html">ipsec_auto</A></I>(8).)
-
-<DT><B>forwardcontrol</B>
-
-<DD>
-whether
-<I>setup</I>
-
-should turn IP forwarding on
-(if it's not already on) as IPsec is started,
-and turn it off again (if it was off) as IPsec is stopped;
-acceptable values are
-<B>yes</B>
-
-and (the default)
-<B>no</B>.
-
-For this to have full effect, forwarding must be
-disabled before the hardware interfaces are brought
-up (e.g.,
-<B>net.ipv4.ip_forward&nbsp;=&nbsp;0</B>
-
-in Red Hat 6.x
-<I>/etc/sysctl.conf</I>),
-
-because IPsec doesn't get control early enough to do that.
-<DT><B>rp_filter</B>
-
-<DD>
-whether and how
-<I>setup</I>
-
-should adjust the reverse path filtering mechanism for the
-physical devices to be used.
-Values are <B>%unchanged</B> (to leave it alone)
-or <B>0</B>, <B>1</B>, <B>2</B> (values to set it to).
-<I>/proc/sys/net/ipv4/conf/PHYS/rp_filter</I>
-is badly documented; it must be <B>0</B> in many cases
-for ipsec to function.
-The default value for the parameter is <B>0</B>.
-<DT><B>syslog</B>
-
-<DD>
-the
-<I><A HREF="syslog.2.html">syslog</A></I>(2)
-
-``facility'' name and priority to use for
-startup/shutdown log messages,
-default
-<B>daemon.error</B>.
-
-<DT><B>klipsdebug</B>
-
-<DD>
-how much KLIPS debugging output should be logged.
-An empty value,
-or the magic value
-<B>none</B>,
-
-means no debugging output (the default).
-The magic value
-<B>all</B>
-
-means full output.
-Otherwise only the specified types of output
-(a quoted list, names separated by white space) are enabled;
-for details on available debugging types, see
-<I><A HREF="ipsec_klipsdebug.8.html">ipsec_klipsdebug</A></I>(8).
-
-<DT><B>plutodebug</B>
-
-<DD>
-how much Pluto debugging output should be logged.
-An empty value,
-or the magic value
-<B>none</B>,
-
-means no debugging output (the default).
-The magic value
-<B>all</B>
-
-means full output.
-Otherwise only the specified types of output
-(a quoted list, names without the
-<B>--debug-</B>
-
-prefix,
-separated by white space) are enabled;
-for details on available debugging types, see
-<I><A HREF="ipsec_pluto.8.html">ipsec_pluto</A></I>(8).
-
-<DT><B>plutoopts</B>
-
-<DD>
-additional options to pass to pluto upon startup. See
-<I><A HREF="ipsec_pluto.8.html">ipsec_pluto</A></I>(8).
-
-<DT><B>plutostderrlog</B>
-
-<DD>
-do not use syslog, but rather log to stderr, and direct stderr to the
-argument file.
-<DT><B>dumpdir</B>
-
-<DD>
-in what directory should things started by
-<I>setup</I>
-
-(notably the Pluto daemon) be allowed to
-dump core?
-The empty value (the default) means they are not
-allowed to.
-<DT><B>manualstart</B>
-
-<DD>
-which manually-keyed connections to set up at startup
-(empty, a name, or a quoted list of names separated by white space);
-see
-<I><A HREF="ipsec_manual.8.html">ipsec_manual</A></I>(8).
-
-Default is none.
-<DT><B>pluto</B>
-
-<DD>
-whether to start Pluto or not;
-Values are
-<B>yes</B>
-
-(the default)
-or
-<B>no</B>
-
-(useful only in special circumstances).
-<DT><B>plutowait</B>
-
-<DD>
-should Pluto wait for each
-negotiation attempt that is part of startup to
-finish before proceeding with the next?
-Values are
-<B>yes</B>
-
-or
-<B>no</B>
-
-(the default).
-<DT><B>prepluto</B>
-
-<DD>
-shell command to run before starting Pluto
-(e.g., to decrypt an encrypted copy of the
-<I>ipsec.secrets</I>
-
-file).
-It's run in a very simple way;
-complexities like I/O redirection are best hidden within a script.
-Any output is redirected for logging,
-so running interactive commands is difficult unless they use
-<I>/dev/tty</I>
-
-or equivalent for their interaction.
-Default is none.
-<DT><B>postpluto</B>
-
-<DD>
-shell command to run after starting Pluto
-(e.g., to remove a decrypted copy of the
-<I>ipsec.secrets</I>
-
-file).
-It's run in a very simple way;
-complexities like I/O redirection are best hidden within a script.
-Any output is redirected for logging,
-so running interactive commands is difficult unless they use
-<I>/dev/tty</I>
-
-or equivalent for their interaction.
-Default is none.
-<DT><B>fragicmp</B>
-
-<DD>
-whether a tunnel's need to fragment a packet should be reported
-back with an ICMP message,
-in an attempt to make the sender lower his PMTU estimate;
-acceptable values are
-<B>yes</B>
-
-(the default)
-and
-<B>no</B>.
-
-<DT><B>hidetos</B>
-
-<DD>
-whether a tunnel packet's TOS field should be set to
-<B>0</B>
-
-rather than copied from the user packet inside;
-acceptable values are
-<B>yes</B>
-
-(the default)
-and
-<B>no</B>.
-
-<DT><B>uniqueids</B>
-
-<DD>
-whether a particular participant ID should be kept unique,
-with any new (automatically keyed)
-connection using an ID from a different IP address
-deemed to replace all old ones using that ID;
-acceptable values are
-<B>yes</B>
-
-(the default)
-and
-<B>no</B>.
-
-Participant IDs normally <I>are</I> unique,
-so a new (automatically-keyed) connection using the same ID is
-almost invariably intended to replace an old one.
-<DT><B>overridemtu</B>
-
-<DD>
-value that the MTU of the ipsec<I>n</I> interface(s) should be set to,
-overriding IPsec's (large) default.
-This parameter is needed only in special situations.
-</DL>
-<A NAME="lbAI">&nbsp;</A>
-<H2>IMPLICIT CONNS</H2>
-
-<P>
-
-The system automatically defines several conns to implement
-default policy groups.  Each can be overridden by explicitly
-defining a new conn with the same name.  If the new conn has <B>auto=ignore</B>,
-the definition is suppressed.
-<P>
-
-Here are the automatically supplied definitions.
-<P>
-
-
-<PRE>
-<B>
-conn clear
- type=passthrough
- authby=never
- left=%defaultroute
- right=%group
- auto=route
-
-conn clear-or-private
- type=passthrough
- left=%defaultroute
- leftid=%myid
- right=%opportunisticgroup
- failureshunt=passthrough
- keyingtries=3
- ikelifetime=1h
- keylife=1h
- rekey=no
- auto=route
-
-conn private-or-clear
- type=tunnel
- left=%defaultroute
- leftid=%myid
- right=%opportunisticgroup
- failureshunt=passthrough
- keyingtries=3
- ikelifetime=1h
- keylife=1h
- rekey=no
- auto=route
-
-conn private
- type=tunnel
- left=%defaultroute
- leftid=%myid
- right=%opportunisticgroup
- failureshunt=drop
- keyingtries=3
- ikelifetime=1h
- keylife=1h
- rekey=no
- auto=route
-
-conn block
- type=reject
- authby=never
- left=%defaultroute
- right=%group
- auto=route
-
-# default policy
-conn packetdefault
- type=tunnel
- left=%defaultroute
- leftid=%myid
- left=0.0.0.0/0
- right=%opportunistic
- failureshunt=passthrough
- keyingtries=3
- ikelifetime=1h
- keylife=1h
- rekey=no
- auto=route
-</B></PRE>
-
-<P>
-
-These conns are <I>not</I> affected by anything in <B>conn %default</B>.
-They will only work if <B>%defaultroute</B> works.
-The <B>leftid</B> will be the interfaces IP address; this
-requires that reverse DNS records be set up properly.
-<P>
-
-The implicit conns are defined after all others.  It is
-appropriate and reasonable to use <B>also=private-or-clear</B>
-(for example) in any other opportunistic conn.
-<A NAME="lbAJ">&nbsp;</A>
-<H2>POLICY GROUP FILES</H2>
-
-<P>
-
-The optional files under 
-<I>/etc/ipsec.d/policy</I>,
-
-including
-<PRE>
-
-/etc/ipsec.d/policies/clear
-/etc/ipsec.d/policies/clear-or-private
-/etc/ipsec.d/policies/private-or-clear
-/etc/ipsec.d/policies/private
-/etc/ipsec.d/policies/block
-
-</PRE>
-
-may contain policy group configuration information to 
-supplement 
-<I>ipsec.conf</I>.
-
-Their contents are not security-sensitive.
-<P>
-
-These files are text files.
-Each consists of a list of CIDR blocks, one per line.
-White space followed by # followed by anything to the end of the line
-is a comment and is ignored, as are empty lines.
-<P>
-
-A connection in
-<I>/etc/ipsec.conf</I>
-
-which has
-<B>right=%group</B>
-
-or 
-<B>right=%opportunisticgroup</B>
-
-is a policy group connection.
-When a policy group file of the same name is loaded, with
-<P>
-
-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<B>ipsec auto --rereadgroups</B> 
-<P>
-
-or at system start, the connection is instantiated such that each
-CIDR block serves as an instance's 
-<B>right</B>
-
-value. The system treats the
-resulting instances as normal connections.
-<P>
-
-For example, given a suitable connection definition 
-<B>private</B>,
-
-and the file
-<I>/etc/ipsec.d/policy/private </I>
-
-with an entry 192.0.2.3,
-the system creates a connection instance 
-<B>private#192.0.2.3.</B>
-
-This connection inherits all details from 
-<B>private</B>,
-
-except that its right client is 192.0.2.3.
-<A NAME="lbAK">&nbsp;</A>
-<H2>DEFAULT POLICY GROUPS</H2>
-
-<P>
-
-The standard FreeS/WAN install includes several policy groups
-which provide a way of classifying possible peers into IPsec security classes:
-<B>private</B>
-
-(talk encrypted only),
-<B>private-or-clear</B>
-
-(prefer encryption),
-<B>clear-or-private</B>
-
-(respond to requests for encryption), 
-<B>clear</B>
-
-and
-<B>block</B>.
-
-Implicit policy groups apply to the local host only,
-and are implemented by the
-<B>IMPLICIT CONNECTIONS </B>
-
-described above.
-<A NAME="lbAL">&nbsp;</A>
-<H2>CHOOSING A CONNECTION</H2>
-
-<P>
-
-When choosing a connection to apply to an outbound packet caught with a 
-<B>%trap,</B>
-
-the system prefers the one with the most specific eroute that
-includes the packet's source and destination IP addresses.
-Source subnets are examined before destination subnets.
-For initiating, only routed connections are considered. For responding,
-unrouted but added connections are considered.
-<P>
-
-When choosing a connection to use to respond to a negotiation which
-doesn't match an ordinary conn, an opportunistic connection
-may be instantiated. Eventually, its instance will be /32 -&gt; /32, but
-for earlier stages of the negotiation, there will not be enough
-information about the client subnets to complete the instantiation.
-<A NAME="lbAM">&nbsp;</A>
-<H2>FILES</H2>
-
-<PRE>
-/etc/ipsec.conf
-/etc/ipsec.d/policies/clear
-/etc/ipsec.d/policies/clear-or-private
-/etc/ipsec.d/policies/private-or-clear
-/etc/ipsec.d/policies/private
-/etc/ipsec.d/policies/block
-</PRE>
-
-<A NAME="lbAN">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_ttoaddr.8.html">ipsec_ttoaddr</A>(8), <A HREF="ipsec_auto.8.html">ipsec_auto</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_rsasigkey.8.html">ipsec_rsasigkey</A>(8)
-<A NAME="lbAO">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Designed for the FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Henry Spencer.
-<A NAME="lbAP">&nbsp;</A>
-<H2>BUGS</H2>
-
-<P>
-
-When
-<B>type</B>
-
-or 
-<B>failureshunt</B>
-
-is set to
-<B>drop</B>
-
-or
-<B>reject,</B>
-
-FreeS/WAN blocks outbound packets using eroutes, but assumes inbound
-blocking is handled by the firewall. FreeS/WAN offers firewall hooks 
-via an ``updown'' script.  However, the default 
-<B>ipsec _updown</B>
-
-provides no help in controlling a modern firewall.
-<P>
-
-Including attributes of the keying channel
-(authentication methods,
-<B>ikelifetime</B>,
-
-etc.)
-as an attribute of a connection,
-rather than of a participant pair, is dubious and incurs limitations.
-<P>
-
-<I>Ipsec_manual</I>
-
-is not nearly as generous about the syntax of subnets,
-addresses, etc. as the usual FreeS/WAN user interfaces.
-Four-component dotted-decimal must be used for all addresses.
-It
-<I>is</I>
-
-smart enough to translate bit-count netmasks to dotted-decimal form.
-<P>
-
-It would be good to have a line-continuation syntax,
-especially for the very long lines involved in
-RSA signature keys.
-<P>
-
-The ability to specify different identities,
-<B>authby</B>,
-
-and public keys for different automatic-keyed connections
-between the same participants is misleading;
-this doesn't work dependably because the identity of the participants
-is not known early enough.
-This is especially awkward for the ``Road Warrior'' case,
-where the remote IP address is specified as
-<B>0.0.0.0</B>,
-
-and that is considered to be the ``participant'' for such connections.
-<P>
-
-In principle it might be necessary to control MTU on an
-interface-by-interface basis,
-rather than with the single global override that
-<B>overridemtu</B>
-
-provides.
-<P>
-
-A number of features which <I>could</I> be implemented in
-both manual and automatic keying
-actually are not yet implemented for manual keying.
-This is unlikely to be fixed any time soon.
-<P>
-
-If conns are to be added before DNS is available,
-<B>left=</B><I>FQDN</I>,
-<B>leftnextop=</B><I>FQDN</I>,
-and
-<B>leftrsasigkey=%dnsonload</B>
-
-will fail.
-<I><A HREF="ipsec_pluto.8.html">ipsec_pluto</A></I>(8)
-
-does not actually use the public key for our side of a conn but it
-isn't generally known at a add-time which side is ours (Road Warrior
-and Opportunistic conns are currently exceptions).
-<P>
-
-The <B>myid</B> option does not affect explicit <B> ipsec auto --add</B> or <B>ipsec auto --replace</B> commands for implicit conns.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAD">CONN SECTIONS</A><DD>
-<DL>
-<DT><A HREF="#lbAE">CONN PARAMETERS:  GENERAL</A><DD>
-<DT><A HREF="#lbAF">CONN PARAMETERS:  AUTOMATIC KEYING</A><DD>
-<DT><A HREF="#lbAG">CONN PARAMETERS:  MANUAL KEYING</A><DD>
-</DL>
-<DT><A HREF="#lbAH">CONFIG SECTIONS</A><DD>
-<DT><A HREF="#lbAI">IMPLICIT CONNS</A><DD>
-<DT><A HREF="#lbAJ">POLICY GROUP FILES</A><DD>
-<DT><A HREF="#lbAK">DEFAULT POLICY GROUPS</A><DD>
-<DT><A HREF="#lbAL">CHOOSING A CONNECTION</A><DD>
-<DT><A HREF="#lbAM">FILES</A><DD>
-<DT><A HREF="#lbAN">SEE ALSO</A><DD>
-<DT><A HREF="#lbAO">HISTORY</A><DD>
-<DT><A HREF="#lbAP">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec.secrets.5.html b/doc/manpage.d/ipsec.secrets.5.html
deleted file mode 100644
index 8abc1f492..000000000
--- a/doc/manpage.d/ipsec.secrets.5.html
+++ /dev/null
@@ -1,227 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC.SECRETS</TITLE>
-</HEAD><BODY>
-<H1>IPSEC.SECRETS</H1>
-Section: File Formats (5)<BR>Updated: 28 March 1999<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec.secrets - secrets for IKE/IPsec authentication
-<A NAME="lbAC">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The file <I>ipsec.secrets</I> holds a table of secrets.
-These secrets are used by <I><A HREF="ipsec_pluto.8.html">ipsec_pluto</A></I>(8), the FreeS/WAN Internet Key
-Exchange daemon, to authenticate other hosts.
-Currently there are two kinds of secrets: preshared secrets and
-
-RSA private keys.
-<P>
-
-It is vital that these secrets be protected.  The file should be owned
-by the super-user,
-and its permissions should be set to block all access by others.
-<P>
-
-The file is a sequence of entries and include directives.
-Here is an example.  Each entry or directive must start at the
-left margin, but if it continues beyond a single line, each continuation
-line must be indented.
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-# sample /etc/ipsec.secrets file for 10.1.0.1
-10.1.0.1 10.2.0.1: PSK &quot;secret shared by two hosts&quot;
-
-# an entry may be split across lines,
-# but indentation matters
-<A HREF="http://www.xs4all.nl">www.xs4all.nl</A> @<A HREF="http://www.kremvax.ru">www.kremvax.ru</A>
-&nbsp;&nbsp;&nbsp;&nbsp;10.6.0.1 10.7.0.1 1.8.0.1: PSK &quot;secret shared by 5&quot;
-
-# an RSA private key.
-# note that the lines are too wide for a
-# man page, so ... has been substituted for
-# the truncated part
-@my.com: rsa {
-&nbsp;&nbsp;&nbsp;&nbsp;Modulus:&nbsp;0syXpo/6waam+ZhSs8Lt6jnBzu3C4grtt...
-&nbsp;&nbsp;&nbsp;&nbsp;PublicExponent:&nbsp;0sAw==
-&nbsp;&nbsp;&nbsp;&nbsp;PrivateExponent:&nbsp;0shlGbVR1m8Z+7rhzSyenCaBN...
-&nbsp;&nbsp;&nbsp;&nbsp;Prime1:&nbsp;0s8njV7WTxzVzRz7AP+0OraDxmEAt1BL5l...
-&nbsp;&nbsp;&nbsp;&nbsp;Prime2:&nbsp;0s1LgR7/oUMo9BvfU8yRFNos1s211KX5K0...
-&nbsp;&nbsp;&nbsp;&nbsp;Exponent1:&nbsp;0soaXj85ihM5M2inVf/NfHmtLutVz4r...
-&nbsp;&nbsp;&nbsp;&nbsp;Exponent2:&nbsp;0sjdAL9VFizF+BKU4ohguJFzOd55OG6...
-&nbsp;&nbsp;&nbsp;&nbsp;Coefficient:&nbsp;0sK1LWwgnNrNFGZsS/2GuMBg9nYVZ...
-&nbsp;&nbsp;&nbsp;&nbsp;}
-
-include ipsec.*.secrets # get secrets from other files
-</PRE>
-
-</DL>
-
-<P>
-
-Each entry in the file is a list of indices, followed by a secret.
-The two parts are separated by a colon (<B>:</B>) that is
-followed by whitespace or a newline.  For compatability
-with the previous form of this file, if the key part is just a
-double-quoted string the colon may be left out.
-<P>
-
-An index is an IP address, or a Fully Qualified Domain Name, <A HREF="mailto:user@FQDN">user@FQDN</A>,
-<B>%any</B> or <B>%any6</B> (other kinds may come).  An IP address may be written
-in the familiar dotted quad form or as a domain name to be looked up
-when the file is loaded
-(or in any of the forms supported by the FreeS/WAN <I><A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A></I>(3)
-routine).  In many cases it is a bad idea to use domain names because
-the name server may not be running or may be insecure.  To denote a
-Fully Qualified Domain Name (as opposed to an IP address denoted by
-its domain name), precede the name with an at sign (<B>@</B>).
-<P>
-
-Matching IDs with indices is fairly straightforward: they have to be
-equal.  In the case of a ``Road Warrior'' connection, if an equal
-match is not found for the Peer's ID, and it is in the form of an IP
-address, an index of <B>%any</B> will match the peer's IP address if IPV4
-and <B>%any6</B> will match a the peer's IP address if IPV6.
-Currently, the obsolete notation <B>0.0.0.0</B> may be used in place of
-<B>%any</B>.
-<P>
-
-An additional complexity
-arises in the case of authentication by preshared secret: the
-responder will need to look up the secret before the Peer's ID payload has
-been decoded, so the ID used will be the IP address.
-<P>
-
-To authenticate a connection between two hosts, the entry that most
-specifically matches the host and peer IDs is used.  An entry with no
-index will match any host and peer.  More specifically, an entry with one index will
-match a host and peer if the index matches the host's ID (the peer isn't
-considered).  Still more specifically, an entry with multiple indices will match a host and
-peer if the host ID and peer ID each match one of the indices.  If the key
-is for an asymmetric authentication technique (i.e. a public key
-system such as RSA), an entry with multiple indices will match a host
-and peer even if only the host ID matches an index (it is presumed that the
-multiple indices are all identities of the host).
-It is acceptable for two entries to be the best match as
-long as they agree about the secret or private key.
-<P>
-
-Authentication by preshared secret requires that both systems find the
-identical secret (the secret is not actually transmitted by the IKE
-protocol).  If both the host and peer appear in the index list, the
-same entry will be suitable for both systems so verbatim copying
-between systems can be used.  This naturally extends to larger groups
-sharing the same secret.  Thus multiple-index entries are best for PSK
-authentication.
-<P>
-
-Authentication by RSA Signatures requires that each host have its own private
-key.  A host could reasonably use a different private keys
-for different interfaces and for different peers.  But it would not
-be normal to share entries between systems.  Thus thus no-index and
-one-index forms of entry often make sense for RSA Signature authentication.
-<P>
-
-The key part of an entry may start with a token indicating the kind of
-key.  ``RSA'' signifies RSA private key and ``PSK'' signifies
-PreShared Key (case is ignored).  For compatability with previous
-forms of this file, PSK is the default.
-<P>
-
-A preshared secret is most conveniently represented as a sequence of
-characters, delimited by the double-quote
-character (<B>&quot;</B>).  The sequence cannot contain a newline or
-double-quote.  Strictly speaking, the secret is actually the sequence
-of bytes that is used in the file to represent the sequence of
-characters (excluding the delimiters).
-A preshared secret may also be represented, without quotes, in any form supported by
-<I><A HREF="ipsec_ttodata.3.html">ipsec_ttodata</A></I>(3).
-<P>
-
-An RSA private key is a composite of eight generally large numbers.  The notation
-used is a brace-enclosed list of field name and value pairs (see the example above).
-A suitable key, in a suitable format, may be generated by <I><A HREF="ipsec_rsasigkey.8.html">ipsec_rsasigkey</A></I>(8).
-The structure is very similar to that used by BIND 8.2.2 or later, but note that
-the numbers must have a ``0s'' prefix if they are in base 64.  The order of
-the fields is fixed.
-<P>
-
-The first token an entry must start in
-the first column of its line.  Subsequent tokens must be
-separated by whitespace,
-except for a colon token, which only needs to be followed by whitespace.
-A newline is taken as whitespace, but every
-line of an entry after the first must be indented.
-<P>
-
-Whitespace at the end of a line is ignored (except in the 0t
-notation for a key).  At the start of line or
-after whitespace, <B>#</B> and the following text up to the end of the
-line is treated as a comment.  Within entries, all lines must be
-indented (except for lines with no tokens).
-Outside entries, no line may be indented (this is to make sure that
-the file layout reflects its structure).
-<P>
-
-An include directive causes the contents of the named file to be processed
-before continuing with the current file.  The filename is subject to
-``globbing'' as in <I><A HREF="sh.1.html">sh</A></I>(1), so every file with a matching name
-is processed.  Includes may be nested to a modest
-depth (10, currently).  If the filename doesn't start with a <B>/</B>, the
-directory containing the current file is prepended to the name.  The
-include directive is a line that starts with the word <B>include</B>,
-followed by whitespace, followed by the filename (which must not contain
-whitespace).
-<A NAME="lbAD">&nbsp;</A>
-<H2>FILES</H2>
-
-/etc/ipsec.secrets
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-The rest of the FreeS/WAN distribution, in particular
-<I><A HREF="ipsec.conf.5.html">ipsec.conf</A></I>(5),
-<I><A HREF="ipsec.8.html">ipsec</A></I>(8),
-<I><A HREF="ipsec_newhostkey.8.html">ipsec_newhostkey</A></I>(8),
-<I><A HREF="ipsec_rsasigkey.8.html">ipsec_rsasigkey</A></I>(8),
-<I><A HREF="ipsec_showhostkey.8.html">ipsec_showhostkey</A></I>(8),
-<I><A HREF="ipsec_auto.8.html">ipsec_auto</A></I>(8) <B>--rereadsecrets</B>,
-and <I><A HREF="ipsec_pluto.8.html">ipsec_pluto</A></I>(8) <B>--listen</B>,.
-<BR>
-
-BIND 8.2.2 or later, <A HREF="ftp://ftp.isc.org/isc/bind/src/">ftp://ftp.isc.org/isc/bind/src/</A>
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Designed for the FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by D. Hugh Redelmeier.
-<A NAME="lbAG">&nbsp;</A>
-<H2>BUGS</H2>
-
-If an ID is <B>0.0.0.0</B>, it will match <B>%any</B>;
-if it is <B>0::0</B>, it will match <B>%any6</B>.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAD">FILES</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-<DT><A HREF="#lbAG">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec__confread.8.html b/doc/manpage.d/ipsec__confread.8.html
deleted file mode 100644
index ecc120c7e..000000000
--- a/doc/manpage.d/ipsec__confread.8.html
+++ /dev/null
@@ -1,58 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of _CONFREAD</TITLE>
-</HEAD><BODY>
-<H1>_CONFREAD</H1>
-Section: Maintenance Commands (8)<BR>Updated: 25 Apr 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec _confread - internal routing to parse config file
-<A NAME="lbAC">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>_confread </I>
-
-is an internal script used for parsing /etc/ipsec.conf into a canonical format.
-<A NAME="lbAD">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_conf.8.html">ipsec_conf</A>(8)
-<A NAME="lbAE">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Man page written for the Linux FreeS/WAN project &lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael Richardson. Program written by Henry Spencer.
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAD">SEE ALSO</A><DD>
-<DT><A HREF="#lbAE">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec__copyright.8.html b/doc/manpage.d/ipsec__copyright.8.html
deleted file mode 100644
index 7f78b3feb..000000000
--- a/doc/manpage.d/ipsec__copyright.8.html
+++ /dev/null
@@ -1,62 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of _COPYRIGHT</TITLE>
-</HEAD><BODY>
-<H1>_COPYRIGHT</H1>
-Section: Maintenance Commands (8)<BR>Updated: 25 Apr 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec _copyright - prints FreeSWAN copyright
-<A NAME="lbAC">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>_copyright</I>
-
-outputs the FreeSWAN copyright, and version numbers for &quot;ipsec --copyright&quot;
-<A NAME="lbAD">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8)
-<A NAME="lbAE">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Man page written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael Richardson. Program written by Henry Spencer.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAD">SEE ALSO</A><DD>
-<DT><A HREF="#lbAE">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec__include.8.html b/doc/manpage.d/ipsec__include.8.html
deleted file mode 100644
index d85ee7852..000000000
--- a/doc/manpage.d/ipsec__include.8.html
+++ /dev/null
@@ -1,67 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of _INCLUDE</TITLE>
-</HEAD><BODY>
-<H1>_INCLUDE</H1>
-Section: Maintenance Commands (8)<BR>Updated: 25 Apr 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec _include - internal script to process config files
-<A NAME="lbAC">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>_include</I>
-
-is used by 
-<I>_confread </I>
-
-to process 
-<B>include </B>
-
-directives in /etc/ipsec.conf.
-<A NAME="lbAD">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec__confread.8.html">ipsec__confread</A>(8)
-<A NAME="lbAE">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Man page written for the Linux FreeS/WAN project &lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael Richardson. Program written by Henry Spencer.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAD">SEE ALSO</A><DD>
-<DT><A HREF="#lbAE">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec__keycensor.8.html b/doc/manpage.d/ipsec__keycensor.8.html
deleted file mode 100644
index 22e574932..000000000
--- a/doc/manpage.d/ipsec__keycensor.8.html
+++ /dev/null
@@ -1,64 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of _KEYCENSOR</TITLE>
-</HEAD><BODY>
-<H1>_KEYCENSOR</H1>
-Section: Maintenance Commands (8)<BR>Updated: 25 Apr 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec _keycensor - internal routine to remove sensitive information
-<A NAME="lbAC">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>_keycensor</I>
-
-is used by 
-<B>ipsec barf</B>
-
-to process the /etc/ipsec.secrets file, removing private key info.
-<A NAME="lbAD">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_barf.8.html">ipsec_barf</A>(8)
-<A NAME="lbAE">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Man page written for the Linux FreeS/WAN project &lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael Richardson. Original program by Henry Spencer.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAD">SEE ALSO</A><DD>
-<DT><A HREF="#lbAE">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec__plutoload.8.html b/doc/manpage.d/ipsec__plutoload.8.html
deleted file mode 100644
index 2c4968300..000000000
--- a/doc/manpage.d/ipsec__plutoload.8.html
+++ /dev/null
@@ -1,64 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of _PLUTOLOAD</TITLE>
-</HEAD><BODY>
-<H1>_PLUTOLOAD</H1>
-Section: Maintenance Commands (8)<BR>Updated: 25 Apr 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec _plutoload - internal script to start pluto
-<A NAME="lbAC">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>_plutoload</I>
-
-is called by 
-<B>_plutorun</B>
-
-to actually start the pluto executable.
-<A NAME="lbAD">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_setup.8.html">ipsec_setup</A>(8), <A HREF="ipsec__realsetup.8.html">ipsec__realsetup</A>(8), <A HREF="ipsec__plutorun.8.html">ipsec__plutorun</A>(8)
-<A NAME="lbAE">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Man page written for the Linux FreeS/WAN project &lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael Richardson. Original program by Henry Spencer.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAD">SEE ALSO</A><DD>
-<DT><A HREF="#lbAE">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec__plutorun.8.html b/doc/manpage.d/ipsec__plutorun.8.html
deleted file mode 100644
index 1b5a1da11..000000000
--- a/doc/manpage.d/ipsec__plutorun.8.html
+++ /dev/null
@@ -1,70 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of _PLUTORUN</TITLE>
-</HEAD><BODY>
-<H1>_PLUTORUN</H1>
-Section: Maintenance Commands (8)<BR>Updated: 25 Apr 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec _plutorun - internal script to start pluto
-<A NAME="lbAC">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>_plutorun</I>
-
-is called by
-<B>_realsetup</B>
-
-to configure and bring up 
-<B><A HREF="ipsec_pluto.8.html">ipsec_pluto</A>(8).</B>
-
-It calls 
-<B>_plutoload</B>
-
-to invoke pluto, and watches to makes sure that pluto is restarted if it fails.
-<A NAME="lbAD">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_setup.8.html">ipsec_setup</A>(8), <A HREF="ipsec__realsetup.8.html">ipsec__realsetup</A>(8), <A HREF="ipsec__plutoload.8.html">ipsec__plutoload</A>(8), <A HREF="ipsec_pluto.8.html">ipsec_pluto</A>(8).
-<A NAME="lbAE">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Man page written for the Linux FreeS/WAN project &lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael Richardson. Original program written by Henry Spencer.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAD">SEE ALSO</A><DD>
-<DT><A HREF="#lbAE">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec__realsetup.8.html b/doc/manpage.d/ipsec__realsetup.8.html
deleted file mode 100644
index f45bec647..000000000
--- a/doc/manpage.d/ipsec__realsetup.8.html
+++ /dev/null
@@ -1,68 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of _REALSETUP</TITLE>
-</HEAD><BODY>
-<H1>_REALSETUP</H1>
-Section: Maintenance Commands (8)<BR>Updated: 25 Apr 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec _realsetup - internal routine to start FreeS/WAN.
-<A NAME="lbAC">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>_realsetup</I>
-
-is called by the system init scripts to start the FreeS/WAN 
-system. It starts 
-<B>KLIPS </B>
-
-(the kernel component) and 
-<B>pluto </B>
-
-(the userspace keying component).
-<A NAME="lbAD">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec__klipsstart.8.html">ipsec__klipsstart</A>(8), <A HREF="ipsec__plutorun.8.html">ipsec__plutorun</A>(8).
-<A NAME="lbAE">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Man page written for the Linux FreeS/WAN project &lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael Richardson. Original program by Henry Spencer.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAD">SEE ALSO</A><DD>
-<DT><A HREF="#lbAE">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec__secretcensor.8.html b/doc/manpage.d/ipsec__secretcensor.8.html
deleted file mode 100644
index 6c6ea312d..000000000
--- a/doc/manpage.d/ipsec__secretcensor.8.html
+++ /dev/null
@@ -1,65 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of _SECRETCENSOR</TITLE>
-</HEAD><BODY>
-<H1>_SECRETCENSOR</H1>
-Section: Maintenance Commands (8)<BR>Updated: 25 Apr 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec _secretcensor - internal routing to sanitize files
-<A NAME="lbAC">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>_secretcensor</I>
-
-is called by
-<B>ipsec barf</B>
-
-to process the /etc/ipsec.secrets file to remove the private key components
-from the file prior to revealing the contents.
-<A NAME="lbAD">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_barf.8.html">ipsec_barf</A>(8).
-<A NAME="lbAE">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Man page written for the Linux FreeS/WAN project &lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael Richardson. Original program by Henry Spencer.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAD">SEE ALSO</A><DD>
-<DT><A HREF="#lbAE">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec__startklips.8.html b/doc/manpage.d/ipsec__startklips.8.html
deleted file mode 100644
index 3ad565e57..000000000
--- a/doc/manpage.d/ipsec__startklips.8.html
+++ /dev/null
@@ -1,63 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of _STARTKLIPS</TITLE>
-</HEAD><BODY>
-<H1>_STARTKLIPS</H1>
-Section: Maintenance Commands (8)<BR>Updated: 25 Apr 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec _startklips - internal script to bring up kernel components
-<A NAME="lbAC">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>_startklips</I>
-
-brings up the FreeS/WAN kernel component. This involves loading any
-required modules, attaching and configuring the ipsecX pseudo-devices and
-attaching the pseudo-devices to the physical devices.
-<A NAME="lbAD">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A>(8).
-<A NAME="lbAE">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Man page written for the Linux FreeS/WAN project &lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael Richardson. Original program by Henry Spencer.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAD">SEE ALSO</A><DD>
-<DT><A HREF="#lbAE">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec__updown.8.html b/doc/manpage.d/ipsec__updown.8.html
deleted file mode 100644
index 73bf8a343..000000000
--- a/doc/manpage.d/ipsec__updown.8.html
+++ /dev/null
@@ -1,63 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of _UPDOWN</TITLE>
-</HEAD><BODY>
-<H1>_UPDOWN</H1>
-Section: Maintenance Commands (8)<BR>Updated: 25 Apr 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec _updown - klips manipulation script
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<I>_updown</I>
-
-is invoked by pluto when it has brought up a new connection. This script
-is used to insert the appropriate routing entries for IPsec operation.
-The interface to the script is documented in the pluto man page.
-<A NAME="lbAD">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_pluto.8.html">ipsec_pluto</A>(8).
-<A NAME="lbAE">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Man page written for the Linux FreeS/WAN project &lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael Richardson. Original program written by Henry Spencer.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">SEE ALSO</A><DD>
-<DT><A HREF="#lbAE">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_addrbytesof.3.html b/doc/manpage.d/ipsec_addrbytesof.3.html
deleted file mode 100644
index ca1f857e7..000000000
--- a/doc/manpage.d/ipsec_addrbytesof.3.html
+++ /dev/null
@@ -1,232 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_INITADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_INITADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 11 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec initaddr - initialize an ip_address
-<BR>
-
-ipsec addrtypeof - get address type of an ip_address
-<BR>
-
-ipsec addrlenof - get length of address within an ip_address
-<BR>
-
-ipsec addrbytesof - get copy of address within an ip_address
-<BR>
-
-ipsec addrbytesptr - get pointer to address within an ip_address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *initaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int addrtypeof(const ip_address *src);</B>
-
-<BR>
-
-<B>size_t addrlenof(const ip_address *src);</B>
-
-<BR>
-
-<B>size_t addrbytesof(const ip_address *src,</B>
-
-<BR>
-&nbsp;
-<B>unsigned char *dst, size_t dstlen);</B>
-
-<BR>
-
-<B>size_t addrbytesptr(const ip_address *src,</B>
-
-<BR>
-&nbsp;
-<B>const unsigned char **dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-library uses an internal type
-<I>ip_address</I>
-
-to contain one of the (currently two) types of IP address.
-These functions provide basic tools for creating and examining this type.
-<P>
-
-<I>Initaddr</I>
-
-initializes a variable
-<I>*dst</I>
-
-of type
-<I>ip_address</I>
-
-from an address
-(in network byte order,
-indicated by a pointer
-<I>src</I>
-
-and a length
-<I>srclen</I>)
-
-and an address family
-<I>af</I>
-
-(typically
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>).
-
-The length must be consistent with the address family.
-<P>
-
-<I>Addrtypeof</I>
-
-returns the address type of an address,
-normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-(The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file arranges to include the necessary headers for these
-names to be known.)
-<P>
-
-<I>Addrlenof</I>
-
-returns the size (in bytes) of the address within an
-<I>ip_address</I>,
-
-to permit storage allocation etc.
-<P>
-
-<I>Addrbytesof</I>
-
-copies the address within the
-<I>ip_address</I>
-
-<I>src</I>
-
-to the buffer indicated by the pointer
-<I>dst</I>
-
-and the length
-<I>dstlen</I>,
-
-and returns the address length (in bytes).
-If the address will not fit,
-as many bytes as will fit are copied;
-the returned length is still the full length.
-It is the caller's responsibility to check the
-returned value to ensure that there was enough room.
-<P>
-
-<I>Addrbytesptr</I>
-
-sets
-<I>*dst</I>
-
-to a pointer to the internal address within the
-<I>ip_address</I>,
-
-and returns the address length (in bytes).
-If
-<I>dst</I>
-
-is
-<B>NULL</B>,
-
-it just returns the address length.
-The pointer points to
-<B>const</B>
-
-to discourage misuse.
-<P>
-
-<I>Initaddr</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<P>
-
-The functions which return
-<I>size_t</I>
-
-return
-<B>0</B>
-
-for a failure.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-An unknown address family is a fatal error for any of these functions
-except
-<I>addrtypeof</I>.
-
-An address-size mismatch is a fatal error for
-<I>initaddr</I>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-<I>Addrtypeof</I>
-
-should probably have been named
-<I>addrfamilyof</I>.
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_addrbytesptr.3.html b/doc/manpage.d/ipsec_addrbytesptr.3.html
deleted file mode 100644
index ca1f857e7..000000000
--- a/doc/manpage.d/ipsec_addrbytesptr.3.html
+++ /dev/null
@@ -1,232 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_INITADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_INITADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 11 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec initaddr - initialize an ip_address
-<BR>
-
-ipsec addrtypeof - get address type of an ip_address
-<BR>
-
-ipsec addrlenof - get length of address within an ip_address
-<BR>
-
-ipsec addrbytesof - get copy of address within an ip_address
-<BR>
-
-ipsec addrbytesptr - get pointer to address within an ip_address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *initaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int addrtypeof(const ip_address *src);</B>
-
-<BR>
-
-<B>size_t addrlenof(const ip_address *src);</B>
-
-<BR>
-
-<B>size_t addrbytesof(const ip_address *src,</B>
-
-<BR>
-&nbsp;
-<B>unsigned char *dst, size_t dstlen);</B>
-
-<BR>
-
-<B>size_t addrbytesptr(const ip_address *src,</B>
-
-<BR>
-&nbsp;
-<B>const unsigned char **dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-library uses an internal type
-<I>ip_address</I>
-
-to contain one of the (currently two) types of IP address.
-These functions provide basic tools for creating and examining this type.
-<P>
-
-<I>Initaddr</I>
-
-initializes a variable
-<I>*dst</I>
-
-of type
-<I>ip_address</I>
-
-from an address
-(in network byte order,
-indicated by a pointer
-<I>src</I>
-
-and a length
-<I>srclen</I>)
-
-and an address family
-<I>af</I>
-
-(typically
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>).
-
-The length must be consistent with the address family.
-<P>
-
-<I>Addrtypeof</I>
-
-returns the address type of an address,
-normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-(The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file arranges to include the necessary headers for these
-names to be known.)
-<P>
-
-<I>Addrlenof</I>
-
-returns the size (in bytes) of the address within an
-<I>ip_address</I>,
-
-to permit storage allocation etc.
-<P>
-
-<I>Addrbytesof</I>
-
-copies the address within the
-<I>ip_address</I>
-
-<I>src</I>
-
-to the buffer indicated by the pointer
-<I>dst</I>
-
-and the length
-<I>dstlen</I>,
-
-and returns the address length (in bytes).
-If the address will not fit,
-as many bytes as will fit are copied;
-the returned length is still the full length.
-It is the caller's responsibility to check the
-returned value to ensure that there was enough room.
-<P>
-
-<I>Addrbytesptr</I>
-
-sets
-<I>*dst</I>
-
-to a pointer to the internal address within the
-<I>ip_address</I>,
-
-and returns the address length (in bytes).
-If
-<I>dst</I>
-
-is
-<B>NULL</B>,
-
-it just returns the address length.
-The pointer points to
-<B>const</B>
-
-to discourage misuse.
-<P>
-
-<I>Initaddr</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<P>
-
-The functions which return
-<I>size_t</I>
-
-return
-<B>0</B>
-
-for a failure.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-An unknown address family is a fatal error for any of these functions
-except
-<I>addrtypeof</I>.
-
-An address-size mismatch is a fatal error for
-<I>initaddr</I>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-<I>Addrtypeof</I>
-
-should probably have been named
-<I>addrfamilyof</I>.
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_addrcmp.3.html b/doc/manpage.d/ipsec_addrcmp.3.html
deleted file mode 100644
index 93ac522cd..000000000
--- a/doc/manpage.d/ipsec_addrcmp.3.html
+++ /dev/null
@@ -1,274 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 28 Nov 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec sameaddr - are two addresses the same?
-<BR>
-
-ipsec addrcmp - ordered comparison of addresses
-<BR>
-
-ipsec samesubnet - are two subnets the same?
-<BR>
-
-ipsec addrinsubnet - is an address within a subnet?
-<BR>
-
-ipsec subnetinsubnet - is a subnet within another subnet?
-<BR>
-
-ipsec subnetishost - is a subnet a single host?
-<BR>
-
-ipsec samesaid - are two SA IDs the same?
-<BR>
-
-ipsec sameaddrtype - are two addresses of the same address family?
-<BR>
-
-ipsec samesubnettype - are two subnets of the same address family?
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int sameaddr(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int addrcmp(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int addrinsubnet(const ip_address *a, const ip_subnet *s);</B>
-
-<BR>
-
-<B>int subnetinsubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int subnetishost(const ip_subnet *s);</B>
-
-<BR>
-
-<B>int samesaid(const ip_said *a, const ip_said *b);</B>
-
-<BR>
-
-<B>int sameaddrtype(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnettype(const ip_subnet *a, const ip_subnet *b);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions do various comparisons and tests on the
-<I>ip_address</I>
-
-type and
-<I>ip_subnet</I>
-
-types.
-<P>
-
-<I>Sameaddr</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Addresses of different families are never identical.
-<P>
-
-<I>Addrcmp</I>
-
-returns
-<B>-1</B>,
-
-<B>0</B>,
-
-or
-<B>1</B>
-
-respectively
-if address
-<I>a</I>
-
-is less than, equal to, or greater than
-<I>b</I>.
-
-If they are not of the same address family,
-they are never equal;
-the ordering reported in this case is arbitrary
-(and probably not useful) but consistent.
-<P>
-
-<I>Samesubnet</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Subnets of different address families are never identical.
-<P>
-
-<I>Addrinsubnet</I>
-
-returns
-non-zero
-if address
-<I>a</I>
-
-is within subnet
-<I>s</I>
-
-and
-<B>0</B>
-
-otherwise.
-An address is never within a
-subnet of a different address family.
-<P>
-
-<I>Subnetinsubnet</I>
-
-returns
-non-zero
-if subnet
-<I>a</I>
-
-is a subset of subnet
-<I>b</I>
-
-and
-<B>0</B>
-
-otherwise.
-A subnet is deemed to be a subset of itself.
-A subnet is never a subset of another
-subnet if their address families differ.
-<P>
-
-<I>Subnetishost</I>
-
-returns
-non-zero
-if subnet
-<I>s</I>
-
-is in fact only a single host,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesaid</I>
-
-returns
-non-zero
-if SA IDs
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Sameaddrtype</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesubnettype</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_initaddr.3.html">ipsec_initaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_addrinsubnet.3.html b/doc/manpage.d/ipsec_addrinsubnet.3.html
deleted file mode 100644
index 93ac522cd..000000000
--- a/doc/manpage.d/ipsec_addrinsubnet.3.html
+++ /dev/null
@@ -1,274 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 28 Nov 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec sameaddr - are two addresses the same?
-<BR>
-
-ipsec addrcmp - ordered comparison of addresses
-<BR>
-
-ipsec samesubnet - are two subnets the same?
-<BR>
-
-ipsec addrinsubnet - is an address within a subnet?
-<BR>
-
-ipsec subnetinsubnet - is a subnet within another subnet?
-<BR>
-
-ipsec subnetishost - is a subnet a single host?
-<BR>
-
-ipsec samesaid - are two SA IDs the same?
-<BR>
-
-ipsec sameaddrtype - are two addresses of the same address family?
-<BR>
-
-ipsec samesubnettype - are two subnets of the same address family?
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int sameaddr(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int addrcmp(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int addrinsubnet(const ip_address *a, const ip_subnet *s);</B>
-
-<BR>
-
-<B>int subnetinsubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int subnetishost(const ip_subnet *s);</B>
-
-<BR>
-
-<B>int samesaid(const ip_said *a, const ip_said *b);</B>
-
-<BR>
-
-<B>int sameaddrtype(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnettype(const ip_subnet *a, const ip_subnet *b);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions do various comparisons and tests on the
-<I>ip_address</I>
-
-type and
-<I>ip_subnet</I>
-
-types.
-<P>
-
-<I>Sameaddr</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Addresses of different families are never identical.
-<P>
-
-<I>Addrcmp</I>
-
-returns
-<B>-1</B>,
-
-<B>0</B>,
-
-or
-<B>1</B>
-
-respectively
-if address
-<I>a</I>
-
-is less than, equal to, or greater than
-<I>b</I>.
-
-If they are not of the same address family,
-they are never equal;
-the ordering reported in this case is arbitrary
-(and probably not useful) but consistent.
-<P>
-
-<I>Samesubnet</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Subnets of different address families are never identical.
-<P>
-
-<I>Addrinsubnet</I>
-
-returns
-non-zero
-if address
-<I>a</I>
-
-is within subnet
-<I>s</I>
-
-and
-<B>0</B>
-
-otherwise.
-An address is never within a
-subnet of a different address family.
-<P>
-
-<I>Subnetinsubnet</I>
-
-returns
-non-zero
-if subnet
-<I>a</I>
-
-is a subset of subnet
-<I>b</I>
-
-and
-<B>0</B>
-
-otherwise.
-A subnet is deemed to be a subset of itself.
-A subnet is never a subset of another
-subnet if their address families differ.
-<P>
-
-<I>Subnetishost</I>
-
-returns
-non-zero
-if subnet
-<I>s</I>
-
-is in fact only a single host,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesaid</I>
-
-returns
-non-zero
-if SA IDs
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Sameaddrtype</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesubnettype</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_initaddr.3.html">ipsec_initaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_addrlenof.3.html b/doc/manpage.d/ipsec_addrlenof.3.html
deleted file mode 100644
index ca1f857e7..000000000
--- a/doc/manpage.d/ipsec_addrlenof.3.html
+++ /dev/null
@@ -1,232 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_INITADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_INITADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 11 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec initaddr - initialize an ip_address
-<BR>
-
-ipsec addrtypeof - get address type of an ip_address
-<BR>
-
-ipsec addrlenof - get length of address within an ip_address
-<BR>
-
-ipsec addrbytesof - get copy of address within an ip_address
-<BR>
-
-ipsec addrbytesptr - get pointer to address within an ip_address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *initaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int addrtypeof(const ip_address *src);</B>
-
-<BR>
-
-<B>size_t addrlenof(const ip_address *src);</B>
-
-<BR>
-
-<B>size_t addrbytesof(const ip_address *src,</B>
-
-<BR>
-&nbsp;
-<B>unsigned char *dst, size_t dstlen);</B>
-
-<BR>
-
-<B>size_t addrbytesptr(const ip_address *src,</B>
-
-<BR>
-&nbsp;
-<B>const unsigned char **dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-library uses an internal type
-<I>ip_address</I>
-
-to contain one of the (currently two) types of IP address.
-These functions provide basic tools for creating and examining this type.
-<P>
-
-<I>Initaddr</I>
-
-initializes a variable
-<I>*dst</I>
-
-of type
-<I>ip_address</I>
-
-from an address
-(in network byte order,
-indicated by a pointer
-<I>src</I>
-
-and a length
-<I>srclen</I>)
-
-and an address family
-<I>af</I>
-
-(typically
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>).
-
-The length must be consistent with the address family.
-<P>
-
-<I>Addrtypeof</I>
-
-returns the address type of an address,
-normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-(The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file arranges to include the necessary headers for these
-names to be known.)
-<P>
-
-<I>Addrlenof</I>
-
-returns the size (in bytes) of the address within an
-<I>ip_address</I>,
-
-to permit storage allocation etc.
-<P>
-
-<I>Addrbytesof</I>
-
-copies the address within the
-<I>ip_address</I>
-
-<I>src</I>
-
-to the buffer indicated by the pointer
-<I>dst</I>
-
-and the length
-<I>dstlen</I>,
-
-and returns the address length (in bytes).
-If the address will not fit,
-as many bytes as will fit are copied;
-the returned length is still the full length.
-It is the caller's responsibility to check the
-returned value to ensure that there was enough room.
-<P>
-
-<I>Addrbytesptr</I>
-
-sets
-<I>*dst</I>
-
-to a pointer to the internal address within the
-<I>ip_address</I>,
-
-and returns the address length (in bytes).
-If
-<I>dst</I>
-
-is
-<B>NULL</B>,
-
-it just returns the address length.
-The pointer points to
-<B>const</B>
-
-to discourage misuse.
-<P>
-
-<I>Initaddr</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<P>
-
-The functions which return
-<I>size_t</I>
-
-return
-<B>0</B>
-
-for a failure.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-An unknown address family is a fatal error for any of these functions
-except
-<I>addrtypeof</I>.
-
-An address-size mismatch is a fatal error for
-<I>initaddr</I>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-<I>Addrtypeof</I>
-
-should probably have been named
-<I>addrfamilyof</I>.
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_addrtoa.3.html b/doc/manpage.d/ipsec_addrtoa.3.html
deleted file mode 100644
index 8f0d765e5..000000000
--- a/doc/manpage.d/ipsec_addrtoa.3.html
+++ /dev/null
@@ -1,448 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ATOADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ATOADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec atoaddr, addrtoa - convert Internet addresses to and from ASCII
-<BR>
-
-ipsec atosubnet, subnettoa - convert subnet/mask ASCII form to and from addresses
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *atoaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr *addr);</B>
-
-<BR>
-
-<B>size_t addrtoa(struct in_addr addr, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<P>
-<B>const char *atosubnet(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr *addr, struct in_addr *mask);</B>
-
-<BR>
-
-<B>size_t subnettoa(struct in_addr addr, struct in_addr mask,</B>
-
-<BR>
-&nbsp;
-<B>int format, char *dst, size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete; see
-<I><A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A></I>(3)
-
-for their replacements.
-<P>
-
-<I>Atoaddr</I>
-
-converts an ASCII name or dotted-decimal address into a binary address
-(in network byte order).
-<I>Addrtoa</I>
-
-does the reverse conversion, back to an ASCII dotted-decimal address.
-<I>Atosubnet</I>
-
-and
-<I>subnettoa</I>
-
-do likewise for the ``address/mask'' ASCII form used to write a
-specification of a subnet.
-<P>
-
-An address is specified in ASCII as a
-dotted-decimal address (e.g.
-<B>1.2.3.4</B>),
-
-an eight-digit network-order hexadecimal number with the usual C prefix (e.g.
-<B>0x01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>),
-
-an eight-digit host-order hexadecimal number with a
-<B>0h</B>
-
-prefix (e.g.
-<B>0h01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>
-
-on a big-endian host and
-<B>4.3.2.1</B>
-
-on a little-endian host),
-a DNS name to be looked up via
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3),
-
-or an old-style network name to be looked up via
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3).
-
-<P>
-
-A dotted-decimal address may be incomplete, in which case
-ASCII-to-binary conversion implicitly appends
-as many instances of
-<B>.0</B>
-
-as necessary to bring it up to four components.
-The components of a dotted-decimal address are always taken as
-decimal, and leading zeros are ignored.
-For example,
-<B>10</B>
-
-is synonymous with
-<B>10.0.0.0</B>,
-
-and
-<B>128.009.000.032</B>
-
-is synonymous with
-<B>128.9.0.32</B>
-
-(the latter example is verbatim from RFC 1166).
-The result of
-<I>addrtoa</I>
-
-is always complete and does not contain leading zeros.
-<P>
-
-The letters in
-a hexadecimal address may be uppercase or lowercase or any mixture thereof.
-Use of hexadecimal addresses is
-<B>strongly</B>
-
-<B>discouraged</B>;
-
-they are included only to save hassles when dealing with
-the handful of perverted programs which already print 
-network addresses in hexadecimal.
-<P>
-
-DNS names may be complete (optionally terminated with a ``.'')
-or incomplete, and are looked up as specified by local system configuration
-(see
-<I><A HREF="resolver.5.html">resolver</A></I>(5)).
-
-The
-<I>h_addr</I>
-
-value returned by
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3)
-
-is used,
-so with current DNS implementations,
-the result when the name corresponds to more than one address is
-difficult to predict.
-Name lookup resorts to
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3)
-
-only if
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3)
-
-fails.
-<P>
-
-A subnet specification is of the form <I>network</I><B>/</B><I>mask</I>.
-The
-<I>network</I>
-
-and
-<I>mask</I>
-
-can be any form acceptable to
-<I>atoaddr</I>.
-
-In addition, the
-<I>mask</I>
-
-can be a decimal integer (leading zeros ignored) giving a bit count,
-in which case
-it stands for a mask with that number of high bits on and all others off
-(e.g.,
-<B>24</B>
-
-means
-<B>255.255.255.0</B>).
-
-In any case, the mask must be contiguous
-(a sequence of high bits on and all remaining low bits off).
-As a special case, the subnet specification
-<B>%default</B>
-
-is a synonym for
-<B>0.0.0.0/0</B>.
-
-<P>
-
-<I>Atosubnet</I>
-
-ANDs the mask with the address before returning,
-so that any non-network bits in the address are turned off
-(e.g.,
-<B>10.1.2.3/24</B>
-
-is synonymous with
-<B>10.1.2.0/24</B>).
-
-<I>Subnettoa</I>
-
-generates the decimal-integer-bit-count
-form of the mask,
-with no leading zeros,
-unless the mask is non-contiguous.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>atoaddr</I>
-
-and
-<I>atosubnet</I>
-
-specifies the length of the ASCII string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>addrtoa</I>
-
-and
-<I>subnettoa</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines constants,
-<B>ADDRTOA_BUF</B>
-
-and
-<B>SUBNETTOA_BUF</B>,
-
-which are the sizes of buffers just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>addrtoa</I>
-
-and
-<I>subnettoa</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the ASCII character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default,
-and is in fact the only format currently available.
-This parameter is a hedge against future needs.
-<P>
-
-The ASCII-to-binary functions return NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-The binary-to-ASCII functions return
-<B>0</B>
-
-for a failure, and otherwise
-always return the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>atoaddr</I>
-
-are:
-empty input;
-attempt to allocate temporary storage for a very long name failed;
-name lookup failed;
-syntax error in dotted-decimal form;
-dotted-decimal component too large to fit in 8 bits.
-<P>
-
-Fatal errors in
-<I>atosubnet</I>
-
-are:
-no
-<B>/</B>
-
-in
-<I>src</I>;
-
-<I>atoaddr</I>
-
-error in conversion of
-<I>network</I>
-
-or
-<I>mask</I>;
-
-bit-count mask too big;
-mask non-contiguous.
-<P>
-
-Fatal errors in
-<I>addrtoa</I>
-
-and
-<I>subnettoa</I>
-
-are:
-unknown format.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The interpretation of incomplete dotted-decimal addresses
-(e.g.
-<B>10/24</B>
-
-means
-<B>10.0.0.0/24</B>)
-
-differs from that of some older conversion
-functions, e.g. those of
-<I><A HREF="inet.3.html">inet</A></I>(3).
-
-The behavior of the older functions has never been
-particularly consistent or particularly useful.
-<P>
-
-Ignoring leading zeros in dotted-decimal components and bit counts
-is arguably the most useful behavior in this application,
-but it might occasionally cause confusion with the historical use of leading 
-zeros to denote octal numbers.
-<P>
-
-It is barely possible that somebody, somewhere,
-might have a legitimate use for non-contiguous subnet masks.
-<P>
-
-<I><A HREF="Getnetbyname.3.html">Getnetbyname</A></I>(3)
-
-is a historical dreg.
-<P>
-
-The restriction of ASCII-to-binary error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The ASCII-to-binary error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = atoaddr( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_addrtosubnet.3.html b/doc/manpage.d/ipsec_addrtosubnet.3.html
deleted file mode 100644
index e442a9100..000000000
--- a/doc/manpage.d/ipsec_addrtosubnet.3.html
+++ /dev/null
@@ -1,238 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_INITSUBNET</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_INITSUBNET</H1>
-Section: C Library Functions (3)<BR>Updated: 12 March 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec initsubnet - initialize an ip_subnet
-<BR>
-
-ipsec addrtosubnet - initialize a singleton ip_subnet
-<BR>
-
-ipsec subnettypeof - get address type of an ip_subnet
-<BR>
-
-ipsec masktocount - convert subnet mask to bit count
-<BR>
-
-ipsec networkof - get base address of an ip_subnet
-<BR>
-
-ipsec maskof - get subnet mask of an ip_subnet
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *initsubnet(const ip_address *addr,</B>
-
-<BR>
-&nbsp;
-<B>int maskbits, int clash, ip_subnet *dst);</B>
-
-<BR>
-
-<B>const char *addrtosubnet(const ip_address *addr,</B>
-
-<BR>
-&nbsp;
-<B>ip_subnet *dst);</B>
-
-<P>
-<B>int subnettypeof(const ip_subnet *src);</B>
-
-<BR>
-
-<B>int masktocount(const ip_address *src);</B>
-
-<BR>
-
-<B>void networkof(const ip_subnet *src, ip_address *dst);</B>
-
-<BR>
-
-<B>void maskof(const ip_subnet *src, ip_address *dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-library uses an internal type
-<I>ip_subnet</I>
-
-to contain a description of an IP subnet
-(base address plus mask).
-These functions provide basic tools for creating and examining this type.
-<P>
-
-<I>Initsubnet</I>
-
-initializes a variable
-<I>*dst</I>
-
-of type
-<I>ip_subnet</I>
-
-from a base address and
-a count of mask bits.
-The
-<I>clash</I>
-
-parameter specifies what to do if the base address includes
-<B>1</B>
-
-bits outside the prefix specified by the mask
-(that is, in the ``host number'' part of the address):
-<DL COMPACT><DT><DD>
-<DL COMPACT>
-<DT>'0'<DD>
-zero out host-number bits
-<DT>'x'<DD>
-non-zero host-number bits are an error
-</DL>
-</DL>
-
-<P>
-
-<I>Initsubnet</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<P>
-
-<I>Addrtosubnet</I>
-
-initializes an
-<I>ip_subnet</I>
-
-variable
-<I>*dst</I>
-
-to a ``singleton subnet'' containing the single address
-<I>*addr</I>.
-
-It returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure.
-<P>
-
-<I>Subnettypeof</I>
-
-returns the address type of a subnet,
-normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-(The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file arranges to include the necessary headers for these
-names to be known.)
-<P>
-
-<I>Masktocount</I>
-
-converts a subnet mask, expressed as an address, to a bit count
-suitable for use with
-<I>initsubnet</I>.
-
-It returns
-<B>-1</B>
-
-for error; see DIAGNOSTICS.
-<P>
-
-<I>Networkof</I>
-
-fills in
-<I>*dst</I>
-
-with the base address of subnet
-<I>src</I>.
-
-<P>
-
-<I>Maskof</I>
-
-fills in
-<I>*dst</I>
-
-with the subnet mask of subnet
-<I>src</I>,
-
-expressed as an address.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_ttosubnet.3.html">ipsec_ttosubnet</A>(3), <A HREF="ipsec_rangetosubnet.3.html">ipsec_rangetosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>initsubnet</I>
-
-are:
-unknown address family;
-unknown
-<I>clash</I>
-
-value;
-impossible mask bit count;
-non-zero host-number bits and
-<I>clash</I>
-
-is
-<B>'x'</B>.
-
-Fatal errors in
-<I>addrtosubnet</I>
-
-are:
-unknown address family.
-Fatal errors in
-<I>masktocount</I>
-
-are:
-unknown address family;
-mask bits not contiguous.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_addrtot.3.html b/doc/manpage.d/ipsec_addrtot.3.html
deleted file mode 100644
index eccb946e6..000000000
--- a/doc/manpage.d/ipsec_addrtot.3.html
+++ /dev/null
@@ -1,569 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TTOADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TTOADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 28 Sept 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ttoaddr, tnatoaddr, addrtot - convert Internet addresses to and from text
-<BR>
-
-ipsec ttosubnet, subnettot - convert subnet/mask text form to and from addresses
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *ttoaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *addr);</B>
-
-<BR>
-
-<B>const char *tnatoaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *addr);</B>
-
-<BR>
-
-<B>size_t addrtot(const ip_address *addr, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<P>
-<B>const char *ttosubnet(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_subnet *dst);</B>
-
-<BR>
-
-<B>size_t subnettot(const ip_subnet *sub, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ttoaddr</I>
-
-converts a text-string name or numeric address into a binary address
-(in network byte order).
-<I>Tnatoaddr</I>
-
-does the same conversion,
-but the only text forms it accepts are
-the ``official'' forms of
-numeric address (dotted-decimal for IPv4, colon-hex for IPv6).
-<I>Addrtot</I>
-
-does the reverse conversion, from binary address back to a text form.
-<I>Ttosubnet</I>
-
-and
-<I>subnettot</I>
-
-do likewise for the ``address/mask'' form used to write a
-specification of a subnet.
-<P>
-
-An IPv4 address is specified in text as a
-dotted-decimal address (e.g.
-<B>1.2.3.4</B>),
-
-an eight-digit network-order hexadecimal number with the usual C prefix (e.g.
-<B>0x01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>),
-
-an eight-digit host-order hexadecimal number with a
-<B>0h</B>
-
-prefix (e.g.
-<B>0h01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>
-
-on a big-endian host and
-<B>4.3.2.1</B>
-
-on a little-endian host),
-a DNS name to be looked up via
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3),
-
-or an old-style network name to be looked up via
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3).
-
-<P>
-
-A dotted-decimal address may be incomplete, in which case
-text-to-binary conversion implicitly appends
-as many instances of
-<B>.0</B>
-
-as necessary to bring it up to four components.
-The components of a dotted-decimal address are always taken as
-decimal, and leading zeros are ignored.
-For example,
-<B>10</B>
-
-is synonymous with
-<B>10.0.0.0</B>,
-
-and
-<B>128.009.000.032</B>
-
-is synonymous with
-<B>128.9.0.32</B>
-
-(the latter example is verbatim from RFC 1166).
-The result of applying
-<I>addrtot</I>
-
-to an IPv4 address is always complete and does not contain leading zeros.
-<P>
-
-Use of hexadecimal addresses is
-<B>strongly</B>
-
-<B>discouraged</B>;
-
-they are included only to save hassles when dealing with
-the handful of perverted programs which already print 
-network addresses in hexadecimal.
-<P>
-
-An IPv6 address is specified in text with
-colon-hex notation (e.g.
-<B>0:56:78ab:22:33:44:55:66</B>),
-
-colon-hex with
-<B>::</B>
-
-abbreviating at most one subsequence of multiple zeros (e.g.
-<B>99:ab::54:068</B>,
-
-which is synonymous with
-<B>99:ab:0:0:0:0:54:68</B>),
-
-or a DNS name to be looked up via
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3).
-
-The result of applying
-<I>addrtot</I>
-
-to an IPv6 address will use
-<B>::</B>
-
-abbreviation if possible,
-and will not contain leading zeros.
-<P>
-
-The letters in hexadecimal
-may be uppercase or lowercase or any mixture thereof.
-<P>
-
-DNS names may be complete (optionally terminated with a ``.'')
-or incomplete, and are looked up as specified by local system configuration
-(see
-<I><A HREF="resolver.5.html">resolver</A></I>(5)).
-
-The
-<I>h_addr</I>
-
-value returned by
-<I><A HREF="gethostbyname2.3.html">gethostbyname2</A></I>(3)
-
-is used,
-so with current DNS implementations,
-the result when the name corresponds to more than one address is
-difficult to predict.
-IPv4 name lookup resorts to
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3)
-
-only if
-<I><A HREF="gethostbyname2.3.html">gethostbyname2</A></I>(3)
-
-fails.
-<P>
-
-A subnet specification is of the form <I>network</I><B>/</B><I>mask</I>.
-The
-<I>network</I>
-
-and
-<I>mask</I>
-
-can be any form acceptable to
-<I>ttoaddr</I>.
-
-In addition, and preferably, the
-<I>mask</I>
-
-can be a decimal integer (leading zeros ignored) giving a bit count,
-in which case
-it stands for a mask with that number of high bits on and all others off
-(e.g.,
-<B>24</B>
-
-in IPv4 means
-<B>255.255.255.0</B>).
-
-In any case, the mask must be contiguous
-(a sequence of high bits on and all remaining low bits off).
-As a special case, the subnet specification
-<B>%default</B>
-
-is a synonym for
-<B>0.0.0.0/0</B>
-
-or
-<B>::/0</B>
-
-in IPv4 or IPv6 respectively.
-<P>
-
-<I>Ttosubnet</I>
-
-ANDs the mask with the address before returning,
-so that any non-network bits in the address are turned off
-(e.g.,
-<B>10.1.2.3/24</B>
-
-is synonymous with
-<B>10.1.2.0/24</B>).
-
-<I>Subnettot</I>
-
-always generates the decimal-integer-bit-count
-form of the mask,
-with no leading zeros.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>ttoaddr</I>
-
-and
-<I>ttosubnet</I>
-
-specifies the length of the text string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>af</I>
-
-parameter of
-<I>ttoaddr</I>
-
-and
-<I>ttosubnet</I>
-
-specifies the address family of interest.
-It should be either
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines constants,
-<B>ADDRTOT_BUF</B>
-
-and
-<B>SUBNETTOT_BUF</B>,
-
-which are the sizes of buffers just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default,
-and is in fact the only format currently available in
-<I>subnettot</I>.
-
-<I>Addrtot</I>
-
-also accepts format values
-<B>'r'</B>
-
-(signifying a text form suitable for DNS reverse lookups,
-e.g.
-<B>4.3.2.1.IN-ADDR.ARPA.</B>
-
-for IPv4 and
-RFC 2874 format for IPv6),
-and
-<B>'R'</B>
-
-(signifying an alternate reverse-lookup form,
-an error for IPv4 and RFC 1886 format for IPv6).
-Reverse-lookup names always end with a ``.''.
-<P>
-
-The text-to-binary functions return NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-The binary-to-text functions return
-<B>0</B>
-
-for a failure, and otherwise
-always return the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>ttoaddr</I>
-
-are:
-empty input;
-unknown address family;
-attempt to allocate temporary storage for a very long name failed;
-name lookup failed;
-syntax error in dotted-decimal or colon-hex form;
-dotted-decimal or colon-hex component too large.
-<P>
-
-Fatal errors in
-<I>ttosubnet</I>
-
-are:
-no
-<B>/</B>
-
-in
-<I>src</I>;
-
-<I>ttoaddr</I>
-
-error in conversion of
-<I>network</I>
-
-or
-<I>mask</I>;
-
-bit-count mask too big;
-mask non-contiguous.
-<P>
-
-Fatal errors in
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-are:
-unknown format.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The interpretation of incomplete dotted-decimal addresses
-(e.g.
-<B>10/24</B>
-
-means
-<B>10.0.0.0/24</B>)
-
-differs from that of some older conversion
-functions, e.g. those of
-<I><A HREF="inet.3.html">inet</A></I>(3).
-
-The behavior of the older functions has never been
-particularly consistent or particularly useful.
-<P>
-
-Ignoring leading zeros in dotted-decimal components and bit counts
-is arguably the most useful behavior in this application,
-but it might occasionally cause confusion with the historical use of leading 
-zeros to denote octal numbers.
-<P>
-
-<I>Ttoaddr</I>
-
-does not support the mixed colon-hex-dotted-decimal
-convention used to embed an IPv4 address in an IPv6 address.
-<P>
-
-<I>Addrtot</I>
-
-always uses the
-<B>::</B>
-
-abbreviation (which can appear only once in an address) for the
-<I>first</I>
-
-sequence of multiple zeros in an IPv6 address.
-One can construct addresses (unlikely ones) in which this is suboptimal.
-<P>
-
-<I>Addrtot</I>
-
-<B>'r'</B>
-
-conversion of an IPv6 address uses lowercase hexadecimal,
-not the uppercase used in RFC 2874's examples.
-It takes careful reading of RFCs 2874, 2673, and 2234 to realize
-that lowercase is technically legitimate here,
-and there may be software which botches this
-and hence would have trouble with lowercase hex.
-<P>
-
-Possibly
-<I>subnettot</I>
-
-ought to recognize the
-<B>%default</B>
-
-case and generate that string as its output.
-Currently it doesn't.
-<P>
-
-It is barely possible that somebody, somewhere,
-might have a legitimate use for non-contiguous subnet masks.
-<P>
-
-<I><A HREF="Getnetbyname.3.html">Getnetbyname</A></I>(3)
-
-is a historical dreg.
-<P>
-
-<I>Tnatoaddr</I>
-
-probably should enforce completeness of dotted-decimal addresses.
-<P>
-
-The restriction of text-to-binary error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The text-to-binary error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = ttoaddr( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_addrtypeof.3.html b/doc/manpage.d/ipsec_addrtypeof.3.html
deleted file mode 100644
index ca1f857e7..000000000
--- a/doc/manpage.d/ipsec_addrtypeof.3.html
+++ /dev/null
@@ -1,232 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_INITADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_INITADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 11 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec initaddr - initialize an ip_address
-<BR>
-
-ipsec addrtypeof - get address type of an ip_address
-<BR>
-
-ipsec addrlenof - get length of address within an ip_address
-<BR>
-
-ipsec addrbytesof - get copy of address within an ip_address
-<BR>
-
-ipsec addrbytesptr - get pointer to address within an ip_address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *initaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int addrtypeof(const ip_address *src);</B>
-
-<BR>
-
-<B>size_t addrlenof(const ip_address *src);</B>
-
-<BR>
-
-<B>size_t addrbytesof(const ip_address *src,</B>
-
-<BR>
-&nbsp;
-<B>unsigned char *dst, size_t dstlen);</B>
-
-<BR>
-
-<B>size_t addrbytesptr(const ip_address *src,</B>
-
-<BR>
-&nbsp;
-<B>const unsigned char **dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-library uses an internal type
-<I>ip_address</I>
-
-to contain one of the (currently two) types of IP address.
-These functions provide basic tools for creating and examining this type.
-<P>
-
-<I>Initaddr</I>
-
-initializes a variable
-<I>*dst</I>
-
-of type
-<I>ip_address</I>
-
-from an address
-(in network byte order,
-indicated by a pointer
-<I>src</I>
-
-and a length
-<I>srclen</I>)
-
-and an address family
-<I>af</I>
-
-(typically
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>).
-
-The length must be consistent with the address family.
-<P>
-
-<I>Addrtypeof</I>
-
-returns the address type of an address,
-normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-(The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file arranges to include the necessary headers for these
-names to be known.)
-<P>
-
-<I>Addrlenof</I>
-
-returns the size (in bytes) of the address within an
-<I>ip_address</I>,
-
-to permit storage allocation etc.
-<P>
-
-<I>Addrbytesof</I>
-
-copies the address within the
-<I>ip_address</I>
-
-<I>src</I>
-
-to the buffer indicated by the pointer
-<I>dst</I>
-
-and the length
-<I>dstlen</I>,
-
-and returns the address length (in bytes).
-If the address will not fit,
-as many bytes as will fit are copied;
-the returned length is still the full length.
-It is the caller's responsibility to check the
-returned value to ensure that there was enough room.
-<P>
-
-<I>Addrbytesptr</I>
-
-sets
-<I>*dst</I>
-
-to a pointer to the internal address within the
-<I>ip_address</I>,
-
-and returns the address length (in bytes).
-If
-<I>dst</I>
-
-is
-<B>NULL</B>,
-
-it just returns the address length.
-The pointer points to
-<B>const</B>
-
-to discourage misuse.
-<P>
-
-<I>Initaddr</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<P>
-
-The functions which return
-<I>size_t</I>
-
-return
-<B>0</B>
-
-for a failure.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-An unknown address family is a fatal error for any of these functions
-except
-<I>addrtypeof</I>.
-
-An address-size mismatch is a fatal error for
-<I>initaddr</I>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-<I>Addrtypeof</I>
-
-should probably have been named
-<I>addrfamilyof</I>.
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_anyaddr.3.html b/doc/manpage.d/ipsec_anyaddr.3.html
deleted file mode 100644
index 974236005..000000000
--- a/doc/manpage.d/ipsec_anyaddr.3.html
+++ /dev/null
@@ -1,166 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 8 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec anyaddr - get &quot;any&quot; address
-<BR>
-
-ipsec isanyaddr - test address for equality to &quot;any&quot; address
-<BR>
-
-ipsec unspecaddr - get &quot;unspecified&quot; address
-<BR>
-
-ipsec isunspecaddr - test address for equality to &quot;unspecified&quot; address
-<BR>
-
-ipsec loopbackaddr - get loopback address
-<BR>
-
-ipsec isloopbackaddr - test address for equality to loopback address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *anyaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isanyaddr(const ip_address *src);</B>
-
-<BR>
-
-<B>const char *unspecaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isunspecaddr(const ip_address *src);</B>
-
-<BR>
-
-<B>const char *loopbackaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isloopbackaddr(const ip_address *src);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions fill in, and test for, special values of the
-<I>ip_address</I>
-
-type.
-<P>
-
-<I>Anyaddr</I>
-
-fills in the destination
-<I>*dst</I>
-
-with the ``any'' address of address family
-<I>af</I>
-
-(normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>).
-
-The IPv4 ``any'' address is the one embodied in the old
-<B>INADDR_ANY</B>
-
-macro.
-<P>
-
-<I>Isanyaddr</I>
-
-returns
-<B>1</B>
-
-if the
-<I>src</I>
-
-address equals the ``any'' address,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-Similarly,
-<I>unspecaddr</I>
-
-supplies, and
-<I>isunspecaddr</I>
-
-tests for,
-the ``unspecified'' address,
-which may be the same as the ``any'' address.
-<P>
-
-Similarly,
-<I>loopbackaddr</I>
-
-supplies, and
-<I>islookbackaddr</I>
-
-tests for,
-the loopback address.
-<P>
-
-<I>Anyaddr</I>,
-
-<I>unspecaddr</I>,
-
-and
-<I>loopbackaddr</I>
-
-return
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_addrtot.3.html">ipsec_addrtot</A>(3), <A HREF="ipsec_sameaddr.3.html">ipsec_sameaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in the address-supplying functions are:
-unknown address family.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_atoaddr.3.html b/doc/manpage.d/ipsec_atoaddr.3.html
deleted file mode 100644
index 8f0d765e5..000000000
--- a/doc/manpage.d/ipsec_atoaddr.3.html
+++ /dev/null
@@ -1,448 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ATOADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ATOADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec atoaddr, addrtoa - convert Internet addresses to and from ASCII
-<BR>
-
-ipsec atosubnet, subnettoa - convert subnet/mask ASCII form to and from addresses
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *atoaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr *addr);</B>
-
-<BR>
-
-<B>size_t addrtoa(struct in_addr addr, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<P>
-<B>const char *atosubnet(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr *addr, struct in_addr *mask);</B>
-
-<BR>
-
-<B>size_t subnettoa(struct in_addr addr, struct in_addr mask,</B>
-
-<BR>
-&nbsp;
-<B>int format, char *dst, size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete; see
-<I><A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A></I>(3)
-
-for their replacements.
-<P>
-
-<I>Atoaddr</I>
-
-converts an ASCII name or dotted-decimal address into a binary address
-(in network byte order).
-<I>Addrtoa</I>
-
-does the reverse conversion, back to an ASCII dotted-decimal address.
-<I>Atosubnet</I>
-
-and
-<I>subnettoa</I>
-
-do likewise for the ``address/mask'' ASCII form used to write a
-specification of a subnet.
-<P>
-
-An address is specified in ASCII as a
-dotted-decimal address (e.g.
-<B>1.2.3.4</B>),
-
-an eight-digit network-order hexadecimal number with the usual C prefix (e.g.
-<B>0x01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>),
-
-an eight-digit host-order hexadecimal number with a
-<B>0h</B>
-
-prefix (e.g.
-<B>0h01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>
-
-on a big-endian host and
-<B>4.3.2.1</B>
-
-on a little-endian host),
-a DNS name to be looked up via
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3),
-
-or an old-style network name to be looked up via
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3).
-
-<P>
-
-A dotted-decimal address may be incomplete, in which case
-ASCII-to-binary conversion implicitly appends
-as many instances of
-<B>.0</B>
-
-as necessary to bring it up to four components.
-The components of a dotted-decimal address are always taken as
-decimal, and leading zeros are ignored.
-For example,
-<B>10</B>
-
-is synonymous with
-<B>10.0.0.0</B>,
-
-and
-<B>128.009.000.032</B>
-
-is synonymous with
-<B>128.9.0.32</B>
-
-(the latter example is verbatim from RFC 1166).
-The result of
-<I>addrtoa</I>
-
-is always complete and does not contain leading zeros.
-<P>
-
-The letters in
-a hexadecimal address may be uppercase or lowercase or any mixture thereof.
-Use of hexadecimal addresses is
-<B>strongly</B>
-
-<B>discouraged</B>;
-
-they are included only to save hassles when dealing with
-the handful of perverted programs which already print 
-network addresses in hexadecimal.
-<P>
-
-DNS names may be complete (optionally terminated with a ``.'')
-or incomplete, and are looked up as specified by local system configuration
-(see
-<I><A HREF="resolver.5.html">resolver</A></I>(5)).
-
-The
-<I>h_addr</I>
-
-value returned by
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3)
-
-is used,
-so with current DNS implementations,
-the result when the name corresponds to more than one address is
-difficult to predict.
-Name lookup resorts to
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3)
-
-only if
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3)
-
-fails.
-<P>
-
-A subnet specification is of the form <I>network</I><B>/</B><I>mask</I>.
-The
-<I>network</I>
-
-and
-<I>mask</I>
-
-can be any form acceptable to
-<I>atoaddr</I>.
-
-In addition, the
-<I>mask</I>
-
-can be a decimal integer (leading zeros ignored) giving a bit count,
-in which case
-it stands for a mask with that number of high bits on and all others off
-(e.g.,
-<B>24</B>
-
-means
-<B>255.255.255.0</B>).
-
-In any case, the mask must be contiguous
-(a sequence of high bits on and all remaining low bits off).
-As a special case, the subnet specification
-<B>%default</B>
-
-is a synonym for
-<B>0.0.0.0/0</B>.
-
-<P>
-
-<I>Atosubnet</I>
-
-ANDs the mask with the address before returning,
-so that any non-network bits in the address are turned off
-(e.g.,
-<B>10.1.2.3/24</B>
-
-is synonymous with
-<B>10.1.2.0/24</B>).
-
-<I>Subnettoa</I>
-
-generates the decimal-integer-bit-count
-form of the mask,
-with no leading zeros,
-unless the mask is non-contiguous.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>atoaddr</I>
-
-and
-<I>atosubnet</I>
-
-specifies the length of the ASCII string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>addrtoa</I>
-
-and
-<I>subnettoa</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines constants,
-<B>ADDRTOA_BUF</B>
-
-and
-<B>SUBNETTOA_BUF</B>,
-
-which are the sizes of buffers just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>addrtoa</I>
-
-and
-<I>subnettoa</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the ASCII character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default,
-and is in fact the only format currently available.
-This parameter is a hedge against future needs.
-<P>
-
-The ASCII-to-binary functions return NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-The binary-to-ASCII functions return
-<B>0</B>
-
-for a failure, and otherwise
-always return the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>atoaddr</I>
-
-are:
-empty input;
-attempt to allocate temporary storage for a very long name failed;
-name lookup failed;
-syntax error in dotted-decimal form;
-dotted-decimal component too large to fit in 8 bits.
-<P>
-
-Fatal errors in
-<I>atosubnet</I>
-
-are:
-no
-<B>/</B>
-
-in
-<I>src</I>;
-
-<I>atoaddr</I>
-
-error in conversion of
-<I>network</I>
-
-or
-<I>mask</I>;
-
-bit-count mask too big;
-mask non-contiguous.
-<P>
-
-Fatal errors in
-<I>addrtoa</I>
-
-and
-<I>subnettoa</I>
-
-are:
-unknown format.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The interpretation of incomplete dotted-decimal addresses
-(e.g.
-<B>10/24</B>
-
-means
-<B>10.0.0.0/24</B>)
-
-differs from that of some older conversion
-functions, e.g. those of
-<I><A HREF="inet.3.html">inet</A></I>(3).
-
-The behavior of the older functions has never been
-particularly consistent or particularly useful.
-<P>
-
-Ignoring leading zeros in dotted-decimal components and bit counts
-is arguably the most useful behavior in this application,
-but it might occasionally cause confusion with the historical use of leading 
-zeros to denote octal numbers.
-<P>
-
-It is barely possible that somebody, somewhere,
-might have a legitimate use for non-contiguous subnet masks.
-<P>
-
-<I><A HREF="Getnetbyname.3.html">Getnetbyname</A></I>(3)
-
-is a historical dreg.
-<P>
-
-The restriction of ASCII-to-binary error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The ASCII-to-binary error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = atoaddr( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_atoasr.3.html b/doc/manpage.d/ipsec_atoasr.3.html
deleted file mode 100644
index 7c9e2c4aa..000000000
--- a/doc/manpage.d/ipsec_atoasr.3.html
+++ /dev/null
@@ -1,294 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ATOASR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ATOASR</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec atoasr - convert ASCII to Internet address, subnet, or range
-<BR>
-
-ipsec rangetoa - convert Internet address range to ASCII
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *atoasr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>char *type, struct in_addr *addrs);</B>
-
-<BR>
-
-<B>size_t rangetoa(struct in_addr *addrs, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete;
-there is no current equivalent,
-because so far they have not proved useful.
-<P>
-
-<I>Atoasr</I>
-
-converts an ASCII address, subnet, or address range
-into a suitable combination of binary addresses
-(in network byte order).
-<I>Rangetoa</I>
-
-converts an address range back into ASCII,
-using dotted-decimal form for the addresses
-(the other reverse conversions are handled by
-<I><A HREF="ipsec_addrtoa.3.html">ipsec_addrtoa</A></I>(3)
-
-and
-<I><A HREF="ipsec_subnettoa.3.html">ipsec_subnettoa</A></I>(3)).
-
-<P>
-
-A single address can be any form acceptable to
-<I><A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A></I>(3):
-
-dotted decimal, DNS name, or hexadecimal number.
-A subnet
-specification uses the form <I>network</I><B>/</B><I>mask</I>
-interpreted by
-<I><A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A></I>(3).
-
-<P>
-
-An address range is two
-<I><A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A></I>(3)
-
-addresses separated by a
-<B>...</B>
-
-delimiter.
-If there are four dots rather than three, the first is taken as
-part of the begin address,
-e.g. for a complete DNS name which ends with
-<B>.</B>
-
-to suppress completion attempts.
-The begin address of a range must be
-less than or equal to the end address.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>atoasr</I>
-
-specifies the length of the ASCII string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>type</I>
-
-parameter of
-<I>atoasr</I>
-
-must point to a
-<B>char</B>
-
-variable used to record which form was found.
-The
-<I>addrs</I>
-
-parameter must point to a two-element array of
-<B>struct in_addr</B>
-
-which receives the results.
-The values stored into
-<B>*type</B>,
-
-and the corresponding values in the array, are:
-<P>
-
-
-
-<TT>&nbsp;&nbsp;&nbsp;</TT>*typeaddrs[0]addrs[1]<BR>
-<P>
-address<B>'a'</B>address-<BR>
-<BR>
-
-subnet<TT>&nbsp;</TT><B>'s'</B>networkmask<BR>
-<BR>
-
-range<TT>&nbsp;&nbsp;</TT><B>'r'</B>beginend<BR>
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>rangetoa</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines a constant,
-<B>RANGETOA_BUF</B>,
-
-which is the size of a buffer just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>rangetoa</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the ASCII character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default,
-and is in fact the only format currently available.
-This parameter is a hedge against future needs.
-<P>
-
-<I>Atoasr</I>
-
-returns NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<I>Rangetoa</I>
-
-returns
-<B>0</B>
-
-for a failure, and otherwise
-always returns the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A>(3), <A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>atoasr</I>
-
-are:
-empty input;
-error in
-<I><A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A></I>(3)
-
-or
-<I><A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A></I>(3)
-
-during conversion;
-begin address of range exceeds end address.
-<P>
-
-Fatal errors in
-<I>rangetoa</I>
-
-are:
-unknown format.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The restriction of error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = atoasr( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_atosa.3.html b/doc/manpage.d/ipsec_atosa.3.html
deleted file mode 100644
index 9e2dc2f61..000000000
--- a/doc/manpage.d/ipsec_atosa.3.html
+++ /dev/null
@@ -1,347 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ATOSA</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ATOSA</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec atosa, satoa - convert IPsec Security Association IDs to and from ASCII
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *atosa(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>struct sa_id *sa);</B>
-
-<BR>
-
-<B>size_t satoa(struct sa_id sa, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<P>
-<B>struct sa_id {</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr dst;</B>
-
-<BR>
-&nbsp;
-<B>ipsec_spi_t spi;</B>
-
-<BR>
-&nbsp;
-<B>int proto;</B>
-
-<BR>
-
-<B>};</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete; see
-<I><A HREF="ipsec_ttosa.3.html">ipsec_ttosa</A></I>(3)
-
-for their replacements.
-<P>
-
-<I>Atosa</I>
-
-converts an ASCII Security Association (SA) specifier into an
-<B>sa_id</B>
-
-structure (containing
-a destination-host address
-in network byte order,
-an SPI number in network byte order, and
-a protocol code).
-<I>Satoa</I>
-
-does the reverse conversion, back to an ASCII SA specifier.
-<P>
-
-An SA is specified in ASCII with a mail-like syntax, e.g.
-<B><A HREF="mailto:esp507@1.2.3.4">esp507@1.2.3.4</A></B>.
-
-An SA specifier contains
-a protocol prefix (currently
-<B>ah</B>,
-
-<B>esp</B>,
-
-or
-<B>tun</B>),
-
-an unsigned integer SPI number,
-and an IP address.
-The SPI number can be decimal or hexadecimal
-(with
-<B>0x</B>
-
-prefix), as accepted by
-<I><A HREF="ipsec_atoul.3.html">ipsec_atoul</A></I>(3).
-
-The IP address can be any form accepted by
-<I><A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A></I>(3),
-
-e.g. dotted-decimal address or DNS name.
-<P>
-
-As a special case, the SA specifier
-<B>%passthrough</B>
-
-signifies the special SA used to indicate that packets should be
-passed through unaltered.
-(At present, this is a synonym for
-<B><A HREF="mailto:tun0x0@0.0.0.0">tun0x0@0.0.0.0</A></B>,
-
-but that is subject to change without notice.)
-This form is known to both
-<I>atosa</I>
-
-and
-<I>satoa</I>,
-
-so the internal form of
-<B>%passthrough</B>
-
-is never visible.
-<P>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file supplies the
-<B>sa_id</B>
-
-structure, as well as a data type
-<B>ipsec_spi_t</B>
-
-which is an unsigned 32-bit integer.
-(There is no consistency between kernel and user on what such a type
-is called, hence the header hides the differences.)
-<P>
-
-The protocol code uses the same numbers that IP does.
-For user convenience, given the difficulty in acquiring the exact set of
-protocol names used by the kernel,
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-defines the names
-<B>SA_ESP</B>,
-
-<B>SA_AH</B>,
-
-and
-<B>SA_IPIP</B>
-
-to have the same values as the kernel names
-<B>IPPROTO_ESP</B>,
-
-<B>IPPROTO_AH</B>,
-
-and
-<B>IPPROTO_IPIP</B>.
-
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>atosa</I>
-
-specifies the length of the ASCII string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>satoa</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines a constant,
-<B>SATOA_BUF</B>,
-
-which is the size of a buffer just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>satoa</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the ASCII character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default
-(currently
-lowercase protocol prefix, lowercase hexadecimal SPI, dotted-decimal address).
-The value
-<B>d</B>
-
-causes the SPI to be generated in decimal instead.
-<P>
-
-<I>Atosa</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<I>Satoa</I>
-
-returns
-<B>0</B>
-
-for a failure, and otherwise
-always returns the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec_atoul.3.html">ipsec_atoul</A>(3), <A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A>(3), <A HREF="inet.3.html">inet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>atosa</I>
-
-are:
-empty input;
-input too small to be a legal SA specifier;
-no
-<B>@</B>
-
-in input;
-unknown protocol prefix;
-conversion error in
-<I>atoul</I>
-
-or
-<I>atoaddr</I>.
-
-<P>
-
-Fatal errors in
-<I>satoa</I>
-
-are:
-unknown format; unknown protocol code.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The
-<B>tun</B>
-
-protocol code is a FreeS/WANism which may eventually disappear.
-<P>
-
-The restriction of ASCII-to-binary error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The ASCII-to-binary error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = atoaddr( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_atosubnet.3.html b/doc/manpage.d/ipsec_atosubnet.3.html
deleted file mode 100644
index 8f0d765e5..000000000
--- a/doc/manpage.d/ipsec_atosubnet.3.html
+++ /dev/null
@@ -1,448 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ATOADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ATOADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec atoaddr, addrtoa - convert Internet addresses to and from ASCII
-<BR>
-
-ipsec atosubnet, subnettoa - convert subnet/mask ASCII form to and from addresses
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *atoaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr *addr);</B>
-
-<BR>
-
-<B>size_t addrtoa(struct in_addr addr, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<P>
-<B>const char *atosubnet(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr *addr, struct in_addr *mask);</B>
-
-<BR>
-
-<B>size_t subnettoa(struct in_addr addr, struct in_addr mask,</B>
-
-<BR>
-&nbsp;
-<B>int format, char *dst, size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete; see
-<I><A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A></I>(3)
-
-for their replacements.
-<P>
-
-<I>Atoaddr</I>
-
-converts an ASCII name or dotted-decimal address into a binary address
-(in network byte order).
-<I>Addrtoa</I>
-
-does the reverse conversion, back to an ASCII dotted-decimal address.
-<I>Atosubnet</I>
-
-and
-<I>subnettoa</I>
-
-do likewise for the ``address/mask'' ASCII form used to write a
-specification of a subnet.
-<P>
-
-An address is specified in ASCII as a
-dotted-decimal address (e.g.
-<B>1.2.3.4</B>),
-
-an eight-digit network-order hexadecimal number with the usual C prefix (e.g.
-<B>0x01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>),
-
-an eight-digit host-order hexadecimal number with a
-<B>0h</B>
-
-prefix (e.g.
-<B>0h01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>
-
-on a big-endian host and
-<B>4.3.2.1</B>
-
-on a little-endian host),
-a DNS name to be looked up via
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3),
-
-or an old-style network name to be looked up via
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3).
-
-<P>
-
-A dotted-decimal address may be incomplete, in which case
-ASCII-to-binary conversion implicitly appends
-as many instances of
-<B>.0</B>
-
-as necessary to bring it up to four components.
-The components of a dotted-decimal address are always taken as
-decimal, and leading zeros are ignored.
-For example,
-<B>10</B>
-
-is synonymous with
-<B>10.0.0.0</B>,
-
-and
-<B>128.009.000.032</B>
-
-is synonymous with
-<B>128.9.0.32</B>
-
-(the latter example is verbatim from RFC 1166).
-The result of
-<I>addrtoa</I>
-
-is always complete and does not contain leading zeros.
-<P>
-
-The letters in
-a hexadecimal address may be uppercase or lowercase or any mixture thereof.
-Use of hexadecimal addresses is
-<B>strongly</B>
-
-<B>discouraged</B>;
-
-they are included only to save hassles when dealing with
-the handful of perverted programs which already print 
-network addresses in hexadecimal.
-<P>
-
-DNS names may be complete (optionally terminated with a ``.'')
-or incomplete, and are looked up as specified by local system configuration
-(see
-<I><A HREF="resolver.5.html">resolver</A></I>(5)).
-
-The
-<I>h_addr</I>
-
-value returned by
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3)
-
-is used,
-so with current DNS implementations,
-the result when the name corresponds to more than one address is
-difficult to predict.
-Name lookup resorts to
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3)
-
-only if
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3)
-
-fails.
-<P>
-
-A subnet specification is of the form <I>network</I><B>/</B><I>mask</I>.
-The
-<I>network</I>
-
-and
-<I>mask</I>
-
-can be any form acceptable to
-<I>atoaddr</I>.
-
-In addition, the
-<I>mask</I>
-
-can be a decimal integer (leading zeros ignored) giving a bit count,
-in which case
-it stands for a mask with that number of high bits on and all others off
-(e.g.,
-<B>24</B>
-
-means
-<B>255.255.255.0</B>).
-
-In any case, the mask must be contiguous
-(a sequence of high bits on and all remaining low bits off).
-As a special case, the subnet specification
-<B>%default</B>
-
-is a synonym for
-<B>0.0.0.0/0</B>.
-
-<P>
-
-<I>Atosubnet</I>
-
-ANDs the mask with the address before returning,
-so that any non-network bits in the address are turned off
-(e.g.,
-<B>10.1.2.3/24</B>
-
-is synonymous with
-<B>10.1.2.0/24</B>).
-
-<I>Subnettoa</I>
-
-generates the decimal-integer-bit-count
-form of the mask,
-with no leading zeros,
-unless the mask is non-contiguous.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>atoaddr</I>
-
-and
-<I>atosubnet</I>
-
-specifies the length of the ASCII string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>addrtoa</I>
-
-and
-<I>subnettoa</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines constants,
-<B>ADDRTOA_BUF</B>
-
-and
-<B>SUBNETTOA_BUF</B>,
-
-which are the sizes of buffers just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>addrtoa</I>
-
-and
-<I>subnettoa</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the ASCII character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default,
-and is in fact the only format currently available.
-This parameter is a hedge against future needs.
-<P>
-
-The ASCII-to-binary functions return NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-The binary-to-ASCII functions return
-<B>0</B>
-
-for a failure, and otherwise
-always return the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>atoaddr</I>
-
-are:
-empty input;
-attempt to allocate temporary storage for a very long name failed;
-name lookup failed;
-syntax error in dotted-decimal form;
-dotted-decimal component too large to fit in 8 bits.
-<P>
-
-Fatal errors in
-<I>atosubnet</I>
-
-are:
-no
-<B>/</B>
-
-in
-<I>src</I>;
-
-<I>atoaddr</I>
-
-error in conversion of
-<I>network</I>
-
-or
-<I>mask</I>;
-
-bit-count mask too big;
-mask non-contiguous.
-<P>
-
-Fatal errors in
-<I>addrtoa</I>
-
-and
-<I>subnettoa</I>
-
-are:
-unknown format.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The interpretation of incomplete dotted-decimal addresses
-(e.g.
-<B>10/24</B>
-
-means
-<B>10.0.0.0/24</B>)
-
-differs from that of some older conversion
-functions, e.g. those of
-<I><A HREF="inet.3.html">inet</A></I>(3).
-
-The behavior of the older functions has never been
-particularly consistent or particularly useful.
-<P>
-
-Ignoring leading zeros in dotted-decimal components and bit counts
-is arguably the most useful behavior in this application,
-but it might occasionally cause confusion with the historical use of leading 
-zeros to denote octal numbers.
-<P>
-
-It is barely possible that somebody, somewhere,
-might have a legitimate use for non-contiguous subnet masks.
-<P>
-
-<I><A HREF="Getnetbyname.3.html">Getnetbyname</A></I>(3)
-
-is a historical dreg.
-<P>
-
-The restriction of ASCII-to-binary error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The ASCII-to-binary error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = atoaddr( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_atoul.3.html b/doc/manpage.d/ipsec_atoul.3.html
deleted file mode 100644
index 923a16131..000000000
--- a/doc/manpage.d/ipsec_atoul.3.html
+++ /dev/null
@@ -1,266 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ATOUL</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ATOUL</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec atoul, ultoa - convert unsigned-long numbers to and from ASCII
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *atoul(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int base, unsigned long *n);</B>
-
-<BR>
-
-<B>size_t ultoa(unsigned long n, int base, char *dst,</B>
-
-<BR>
-&nbsp;
-<B>size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete; see
-<I><A HREF="ipsec_ttoul.3.html">ipsec_ttoul</A></I>(3)
-
-for their replacements.
-<P>
-
-<I>Atoul</I>
-
-converts an ASCII number into a binary
-<B>unsigned long</B>
-
-value.
-<I>Ultoa</I>
-
-does the reverse conversion, back to an ASCII version.
-<P>
-
-Numbers are specified in ASCII as
-decimal (e.g.
-<B>123</B>),
-
-octal with a leading zero (e.g.
-<B>012</B>,
-
-which has value 10),
-or hexadecimal with a leading
-<B>0x</B>
-
-(e.g.
-<B>0x1f</B>,
-
-which has value 31)
-in either upper or lower case.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>atoul</I>
-
-specifies the length of the ASCII string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>base</I>
-
-parameter of
-<I>atoul</I>
-
-can be
-<B>8</B>,
-
-<B>10</B>,
-
-or
-<B>16</B>,
-
-in which case the number supplied is assumed to be of that form
-(and in the case of
-<B>16</B>,
-
-to lack any
-<B>0x</B>
-
-prefix).
-It can also be
-<B>0</B>,
-
-in which case the number is examined for a leading zero
-or a leading
-<B>0x</B>
-
-to determine its base,
-or
-<B>13</B>
-
-(halfway between 10 and 16),
-which has the same effect as
-<B>0</B>
-
-except that a non-hexadecimal
-number is considered decimal regardless of any leading zero.
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>ultoa</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-<P>
-
-The
-<I>base</I>
-
-parameter of
-<I>ultoa</I>
-
-must be
-<B>8</B>,
-
-<B>10</B>,
-
-or
-<B>16</B>.
-
-<P>
-
-<I>Atoul</I>
-
-returns NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<I>Ultoa</I>
-
-returns the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="atol.3.html">atol</A>(3), <A HREF="strtoul.3.html">strtoul</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>atoul</I>
-
-are:
-empty input;
-unknown
-<I>base</I>;
-
-non-digit character found;
-number too large for an
-<B>unsigned long</B>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-There is no provision for reporting an invalid
-<I>base</I>
-
-parameter given to
-<I>ultoa</I>.
-
-<P>
-
-The restriction of error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The error-reporting convention lends itself to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = atoul( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_auto.8.html b/doc/manpage.d/ipsec_auto.8.html
deleted file mode 100644
index 68ca61bdc..000000000
--- a/doc/manpage.d/ipsec_auto.8.html
+++ /dev/null
@@ -1,416 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_AUTO</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_AUTO</H1>
-Section: Maintenance Commands (8)<BR>Updated: 31 Jan 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec auto - control automatically-keyed IPsec connections
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>auto</B>
-
-[
-<B>--show</B>
-
-] [
-<B>--showonly</B>
-
-] [
-<B>--asynchronous</B>
-
-]
-<BR>
-
-&nbsp;&nbsp;&nbsp;[
-<B>--config</B>
-
-configfile
-] [
-<B>--verbose</B>
-
-]
-<BR>
-
-&nbsp;&nbsp;&nbsp;operation
-connection
-<P>
-<B>ipsec</B>
-
-<B>auto</B>
-
-[
-<B>--show</B>
-
-] [
-<B>--showonly</B>
-
-] operation
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Auto</I>
-
-manipulates automatically-keyed FreeS/WAN IPsec connections,
-setting them up and shutting them down
-based on the information in the IPsec configuration file.
-In the normal usage,
-<I>connection</I>
-
-is the name of a connection specification in the configuration file;
-<I>operation</I>
-
-is
-<B>--add</B>,
-
-<B>--delete</B>,
-
-<B>--replace</B>,
-
-<B>--up</B>,
-
-<B>--down</B>,
-
-<B>--route</B>,
-
-or
-<B>--unroute</B>.
-
-The
-<B>--ready</B>,
-
-<B>--rereadsecrets</B>,
-
-<B>--rereadgroups</B>,
-
-and
-<B>--status</B>
-
-<I>operations</I>
-
-do not take a connection name.
-<I>Auto</I>
-
-generates suitable
-commands and feeds them to a shell for execution.
-<P>
-
-The
-<B>--add</B>
-
-operation adds a connection specification to the internal database
-within
-<I>pluto</I>;
-
-it will fail if
-<I>pluto</I>
-
-already has a specification by that name.
-The
-<B>--delete</B>
-
-operation deletes a connection specification from
-<I>pluto</I>'s
-
-internal database (also tearing down any connections based on it);
-it will fail if the specification does not exist.
-The
-<B>--replace</B>
-
-operation is equivalent to
-<B>--delete</B>
-
-(if there is already a specification by the given name)
-followed by
-<B>--add</B>,
-
-and is a convenience for updating
-<I>pluto</I>'s
-
-internal specification to match an external one.
-(Note that a
-<B>--rereadsecrets</B>
-
-may also be needed.)
-The
-<B>--rereadgroups</B>
-
-operation causes any changes to the policy group files to take effect
-(this is currently a synonym for
-<B>--ready</B>,
-
-but that may change).
-None of the other operations alters the internal database.
-<P>
-
-The
-<B>--up</B>
-
-operation asks
-<I>pluto</I>
-
-to establish a connection based on an entry in its internal database.
-The
-<B>--down</B>
-
-operation tells
-<I>pluto</I>
-
-to tear down such a connection.
-<P>
-
-Normally,
-<I>pluto</I>
-
-establishes a route to the destination specified for a connection as
-part of the
-<B>--up</B>
-
-operation.
-However, the route and only the route can be established with the
-<B>--route</B>
-
-operation.
-Until and unless an actual connection is established,
-this discards any packets sent there,
-which may be preferable to having them sent elsewhere based on a more
-general route (e.g., a default route).
-<P>
-
-Normally,
-<I>pluto</I>'s
-
-route to a destination remains in place when a
-<B>--down</B>
-
-operation is used to take the connection down
-(or if connection setup, or later automatic rekeying, fails).
-This permits establishing a new connection (perhaps using a
-different specification; the route is altered as necessary)
-without having a ``window'' in which packets might go elsewhere
-based on a more general route.
-Such a route can be removed using the
-<B>--unroute</B>
-
-operation
-(and is implicitly removed by
-<B>--delete</B>).
-
-<P>
-
-The
-<B>--ready</B>
-
-operation tells
-<I>pluto</I>
-
-to listen for connection-setup requests from other hosts.
-Doing an
-<B>--up</B>
-
-operation before doing
-<B>--ready</B>
-
-on both ends is futile and will not work,
-although this is now automated as part of IPsec startup and
-should not normally be an issue.
-<P>
-
-The
-<B>--status</B>
-
-operation asks
-<I>pluto</I>
-
-for current connection status.
-The output format is ad-hoc and likely to change.
-<P>
-
-The
-<B>--rereadsecrets</B>
-
-operation tells
-<I>pluto</I>
-
-to re-read the
-<I>/etc/ipsec.secrets</I>
-
-secret-keys file,
-which it normally reads only at startup time.
-(This is currently a synonym for
-<B>--ready</B>,
-
-but that may change.)
-<P>
-
-The
-<B>--show</B>
-
-option turns on the
-<B>-x</B>
-
-option of the shell used to execute the commands,
-so each command is shown as it is executed.
-<P>
-
-The
-<B>--showonly</B>
-
-option causes
-<I>auto</I>
-
-to show the commands it would run, on standard output,
-and not run them.
-<P>
-
-The
-<B>--asynchronous</B>
-
-option, applicable only to the
-<B>up</B>
-
-operation,
-tells
-<I>pluto</I>
-
-to attempt to establish the connection,
-but does not delay to report results.
-This is especially useful to start multiple connections in parallel
-when network links are slow.
-<P>
-
-The
-<B>--verbose</B>
-
-option instructs
-<I>auto</I>
-
-to pass through all output from
-<I><A HREF="ipsec_whack.8.html">ipsec_whack</A></I>(8),
-
-including log output that is normally filtered out as uninteresting.
-<P>
-
-The
-<B>--config</B>
-
-option specifies a non-standard location for the IPsec
-configuration file (default
-<I>/etc/ipsec.conf</I>).
-
-<P>
-
-See
-<I><A HREF="ipsec.conf.5.html">ipsec.conf</A></I>(5)
-
-for details of the configuration file.
-Apart from the basic parameters which specify the endpoints and routing
-of a connection (<B>left</B>
-and
-<B>right</B>,
-
-plus possibly
-<B>leftsubnet</B>,
-
-<B>leftnexthop</B>,
-
-<B>leftfirewall</B>,
-
-their
-<B>right</B>
-
-equivalents,
-and perhaps
-<B>type</B>),
-
-an
-<I>auto</I>
-
-connection almost certainly needs a
-<B>keyingtries</B>
-
-parameter (since the
-<B>keyingtries</B>
-
-default is poorly chosen).
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-
-
-/etc/ipsec.conf<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>default IPSEC configuration file<BR>
-<BR>
-
-/var/run/ipsec.info<TT>&nbsp;&nbsp;&nbsp;</TT><B>%defaultroute</B> information<BR>
-<A NAME="lbAF">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.conf.5.html">ipsec.conf</A>(5), <A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_pluto.8.html">ipsec_pluto</A>(8), <A HREF="ipsec_whack.8.html">ipsec_whack</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8)
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-Although an
-<B>--up</B>
-
-operation does connection setup on both ends,
-<B>--down</B>
-
-tears only one end of the connection down
-(although the orphaned end will eventually time out).
-<P>
-
-There is no support for
-<B>passthrough</B>
-
-connections.
-<P>
-
-A connection description which uses
-<B>%defaultroute</B>
-
-for one of its
-<B>nexthop</B>
-
-parameters but not the other may be falsely
-rejected as erroneous in some circumstances.
-<P>
-
-The exit status of
-<B>--showonly</B>
-
-does not always reflect errors discovered during processing of the request.
-(This is fine for human inspection, but not so good for use in scripts.)
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">SEE ALSO</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_barf.8.html b/doc/manpage.d/ipsec_barf.8.html
deleted file mode 100644
index e7b7200e0..000000000
--- a/doc/manpage.d/ipsec_barf.8.html
+++ /dev/null
@@ -1,150 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_BARF</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_BARF</H1>
-Section: Maintenance Commands (8)<BR>Updated: 17 March 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec barf - spew out collected IPsec debugging information
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>barf</B>
-
-[
-<B>--short</B>
-
-]
-<P>
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Barf</I>
-
-outputs (on standard output) a collection of debugging information
-(contents of files, selections from logs, etc.)
-related to the IPsec encryption/authentication system.
-It is primarily a convenience for remote debugging,
-a single command which packages up (and labels) all information
-that might be relevant to diagnosing a problem in IPsec.
-<P>
-
-<P>
-
-The
-<B>--short</B>
-
-option limits the length of
-the log portion of
-<I>barf</I>'s
-
-output, which can otherwise be extremely voluminous
-if debug logging is turned on.
-<P>
-
-<I>Barf</I>
-
-censors its output,
-replacing keys
-and secrets with brief checksums to avoid revealing sensitive information.
-<P>
-
-Beware that the output of both commands is aimed at humans,
-not programs,
-and the output format is subject to change without warning.
-<P>
-
-<I>Barf</I>
-
-has to figure out which files in
-<I>/var/log</I>
-
-contain the IPsec log messages.
-It looks for KLIPS and general log messages first in
-<I>messages</I>
-
-and
-<I>syslog</I>,
-
-and for Pluto messages first in
-<I>secure</I>,
-
-<I>auth.log</I>,
-
-and
-<I>debug</I>.
-
-In both cases,
-if it does not find what it is looking for in one of those ``likely'' places,
-it will resort to a brute-force search of most (non-compressed) files in
-<I>/var/log</I>.
-
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-<PRE>
-/proc/net/*
-/var/log/*
-/etc/ipsec.conf
-/etc/ipsec.secrets
-</PRE>
-
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Henry Spencer.
-<A NAME="lbAG">&nbsp;</A>
-<H2>BUGS</H2>
-
-<I>Barf</I>
-
-uses heuristics to try to pick relevant material out of the logs,
-and relevant messages
-which are not labelled with any of the tags that
-<I>barf</I>
-
-looks for will be lost.
-We think we've eliminated the last such case, but one never knows...
-<P>
-
-Finding
-<I>updown</I>
-
-scripts (so they can be included in output) is, in general, difficult.
-<I>Barf</I>
-
-uses a very simple heuristic that is easily fooled.
-<P>
-
-The brute-force search for the right log files can get expensive on
-systems with a lot of clutter in
-<I>/var/log</I>.
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-<DT><A HREF="#lbAG">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_bitstomask.3.html b/doc/manpage.d/ipsec_bitstomask.3.html
deleted file mode 100644
index a67a08d83..000000000
--- a/doc/manpage.d/ipsec_bitstomask.3.html
+++ /dev/null
@@ -1,122 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_GOODMASK</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_GOODMASK</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec goodmask - is this Internet subnet mask a valid one?
-<BR>
-
-ipsec masktobits - convert Internet subnet mask to bit count
-<BR>
-
-ipsec bitstomask - convert bit count to Internet subnet mask
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int goodmask(struct in_addr mask);</B>
-
-<BR>
-
-<B>int masktobits(struct in_addr mask);</B>
-
-<BR>
-
-<B>struct in_addr bitstomask(int n);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete;
-see
-<I><A HREF="ipsec_masktocount.3.html">ipsec_masktocount</A></I>(3)
-
-for a partial replacement.
-<P>
-
-<I>Goodmask</I>
-
-reports whether the subnet
-<I>mask</I>
-
-is a valid one,
-i.e. consists of a (possibly empty) sequence of
-<B>1</B>s
-
-followed by a (possibly empty) sequence of
-<B>0</B>s.
-
-<I>Masktobits</I>
-
-takes a (valid) subnet mask and returns the number of
-<B>1</B>
-
-bits in it.
-<I>Bitstomask</I>
-
-reverses this,
-returning the subnet mask corresponding to bit count
-<I>n</I>.
-
-<P>
-
-All masks are in network byte order.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-<I>Masktobits</I>
-
-returns
-<B>-1</B>
-
-for an invalid mask.
-<I>Bitstomask</I>
-
-returns an all-zeros mask for a negative or out-of-range
-<I>n</I>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The error-reporting convention of
-<I>bitstomask</I>
-
-is less than ideal;
-zero is sometimes a legitimate mask.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_broadcastof.3.html b/doc/manpage.d/ipsec_broadcastof.3.html
deleted file mode 100644
index 57d4a5648..000000000
--- a/doc/manpage.d/ipsec_broadcastof.3.html
+++ /dev/null
@@ -1,107 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_SUBNETOF</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_SUBNETOF</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec subnetof - given Internet address and subnet mask, return subnet number
-<BR>
-
-ipsec hostof - given Internet address and subnet mask, return host part
-<BR>
-
-ipsec broadcastof - given Internet address and subnet mask, return broadcast address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>struct in_addr subnetof(struct in_addr addr,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr mask);</B>
-
-<BR>
-
-<B>struct in_addr hostof(struct in_addr addr,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr mask);</B>
-
-<BR>
-
-<B>struct in_addr broadcastof(struct in_addr addr,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr mask);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete; see
-<I><A HREF="ipsec_networkof.3.html">ipsec_networkof</A></I>(3)
-
-for their replacements.
-<P>
-
-<I>Subnetof</I>
-
-takes an Internet
-<I>address</I>
-
-and a subnet
-<I>mask</I>
-
-and returns the network part of the address
-(all in network byte order).
-<I>Hostof</I>
-
-similarly returns the host part, and
-<I>broadcastof</I>
-
-returns the broadcast address (all-1s convention) for the network.
-<P>
-
-These functions are provided to hide the Internet bit-munging inside
-an API, in hopes of easing the eventual transition to IPv6.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAG">&nbsp;</A>
-<H2>BUGS</H2>
-
-Calling functions for this is more costly than doing it yourself.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-<DT><A HREF="#lbAG">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_calcgoo.8.html b/doc/manpage.d/ipsec_calcgoo.8.html
deleted file mode 100644
index 8379ac6a4..000000000
--- a/doc/manpage.d/ipsec_calcgoo.8.html
+++ /dev/null
@@ -1,78 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_CALCGOO</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_CALCGOO</H1>
-Section: Maintenance Commands (8)<BR>Updated: 8 June 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec calcgoo - calculate hex value for matching modules and kernels
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>calcgoo</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>calcgoo</I>
-
-accepts the output of 
-<B>nm -ao</B>
-
-or 
-<B>/proc/ksyms</B>
-
-and extracts a release dependant list of symbols from it. The symbols
-are processed to extract the values assigned during the MODVERSIONS 
-process. This process makes sure that Linux modules are only loaded
-on matching kernels.
-
-This routine is used to find an appropriate module to match the currently
-running kernel by _startklips.
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-<PRE>
-/proc/ksyms
-</PRE>
-
-<A NAME="lbAF">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec__startklips.8.html">ipsec__startklips</A>(8), <A HREF="genksyms.8.html">genksyms</A>(8)
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Michael Richardson.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">SEE ALSO</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_copyright_notice.3.html b/doc/manpage.d/ipsec_copyright_notice.3.html
deleted file mode 100644
index c832e01f7..000000000
--- a/doc/manpage.d/ipsec_copyright_notice.3.html
+++ /dev/null
@@ -1,94 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_VERSION</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_VERSION</H1>
-Section: C Library Functions (3)<BR>Updated: 21 Nov 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ipsec_version_code - get IPsec version code
-<BR>
-
-ipsec ipsec_version_string - get full IPsec version string
-<BR>
-
-ipsec ipsec_copyright_notice - get IPsec copyright notice
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *ipsec_version_code(void);</B>
-
-<BR>
-
-<B>const char *ipsec_version_string(void);</B>
-
-<BR>
-
-<B>const char **ipsec_copyright_notice(void);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions provide information on version numbering and copyright
-of the Linux FreeS/WAN IPsec implementation.
-<P>
-
-<I>Ipsec_version_code</I>
-
-returns a pointer to a string constant
-containing the current IPsec version code,
-such as ``1.92'' or ``snap2001Nov19b''.
-<P>
-
-<I>Ipsec_version_string</I>
-
-returns a pointer to a string constant giving a full version identification,
-consisting of the version code preceded by a prefix identifying the software,
-e.g. ``Linux FreeS/WAN 1.92''.
-<P>
-
-<I>Ipsec_copyright_notice</I>
-
-returns a pointer to a vector of pointers,
-terminated by a
-<B>NULL</B>,
-
-which is the text of a suitable copyright notice.
-Each pointer points to a string constant (possibly empty) which is one line
-of the somewhat-verbose copyright notice.
-The strings are NUL-terminated and do not contain a newline;
-supplying suitable line termination for the output device is
-the caller's responsibility.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_datatot.3.html b/doc/manpage.d/ipsec_datatot.3.html
deleted file mode 100644
index 628558001..000000000
--- a/doc/manpage.d/ipsec_datatot.3.html
+++ /dev/null
@@ -1,439 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TTODATA</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TTODATA</H1>
-Section: C Library Functions (3)<BR>Updated: 16 August 2003<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ttodata, datatot - convert binary data bytes from and to text formats
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *ttodata(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int base, char *dst, size_t dstlen, size_t *lenp);</B>
-
-<BR>
-
-<B>const char *ttodatav(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int base, char *dst, size_t dstlen, size_t *lenp,</B>
-
-<BR>
-&nbsp;
-<B>char *errp, size_t errlen, int flags);</B>
-
-<BR>
-
-<B>size_t datatot(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int format, char *dst, size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ttodata</I>,
-
-<I>ttodatav</I>,
-
-and
-<I>datatot</I>
-
-convert arbitrary binary data (e.g. encryption or authentication keys)
-from and to more-or-less human-readable text formats.
-<P>
-
-Currently supported formats are hexadecimal, base64, and characters.
-<P>
-
-A hexadecimal text value begins with a
-<B>0x</B>
-
-(or
-<B>0X</B>)
-
-prefix and continues with two-digit groups
-of hexadecimal digits (0-9, and a-f or A-F),
-each group encoding the value of one binary byte, high-order digit first.
-A single
-<B>_</B>
-
-(underscore)
-between consecutive groups is ignored, permitting punctuation to improve 
-readability; doing this every eight digits seems about right.
-<P>
-
-A base64 text value begins with a
-<B>0s</B>
-
-(or
-<B>0S</B>)
-
-prefix 
-and continues with four-digit groups of base64 digits (A-Z, a-z, 0-9, +, and /),
-each group encoding the value of three binary bytes as described in
-section 6.8 of RFC 2045.
-If
-<B>flags</B>
-
-has the
-<B>TTODATAV_IGNORESPACE</B>
-
-bit on, blanks are ignore (after the prefix).
-Note that the last one or two digits of a base64 group can be
-<B>=</B>
-
-to indicate that fewer than three binary bytes are encoded.
-<P>
-
-A character text value begins with a
-<B>0t</B>
-
-(or
-<B>0T</B>)
-
-prefix
-and continues with text characters, each being the value of one binary byte. 
-<P>
-
-All these functions basically copy data from
-<I>src</I>
-
-(whose size is specified by
-<I>srclen</I>)
-
-to
-<I>dst</I>
-
-(whose size is specified by
-<I>dstlen</I>),
-
-doing the conversion en route.
-If the result will not fit in
-<I>dst</I>,
-
-it is truncated;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes of result written to
-<I>dst</I>.
-
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result bytes are written at all.
-<P>
-
-The
-<I>base</I>
-
-parameter of
-<I>ttodata</I>
-
-and
-<I>ttodatav</I>
-
-specifies what format the input is in;
-normally it should be
-<B>0</B>
-
-to signify that this gets figured out from the prefix.
-Values of
-<B>16</B>,
-
-<B>64</B>,
-
-and
-<B>256</B>
-
-respectively signify hexadecimal, base64, and character-text formats
-without prefixes.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>datatot</I>,
-
-a single character used as a type code,
-specifies which text format is wanted.
-The value
-<B>0</B>
-
-(not ASCII
-<B>'0'</B>,
-
-but a zero value) specifies a reasonable default.
-Other currently-supported values are:
-<DL COMPACT><DT><DD>
-<DL COMPACT>
-<DT><B>'x'</B>
-
-<DD>
-continuous lower-case hexadecimal with a
-<B>0x</B>
-
-prefix
-<DT><B>'h'</B>
-
-<DD>
-lower-case hexadecimal with a
-<B>0x</B>
-
-prefix and a
-<B>_</B>
-
-every eight digits
-<DT><B>':'</B>
-
-<DD>
-lower-case hexadecimal with no prefix and a
-<B>:</B>
-
-(colon) every two digits
-<DT><B>16</B>
-
-<DD>
-lower-case hexadecimal with no prefix or
-<B>_</B>
-
-<DT><B>'s'</B>
-
-<DD>
-continuous base64 with a
-<B>0s</B>
-
-prefix
-<DT><B>64</B>
-
-<DD>
-continuous base64 with no prefix
-</DL>
-</DL>
-
-<P>
-
-The default format is currently
-<B>'h'</B>.
-
-<P>
-
-<I>Ttodata</I>
-
-returns NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-On success,
-if and only if
-<I>lenp</I>
-
-is non-NULL,
-<B>*lenp</B>
-
-is set to the number of bytes required to contain the full untruncated result.
-It is the caller's responsibility to check this against
-<I>dstlen</I>
-
-to determine whether he has obtained a complete result.
-The
-<B>*lenp</B>
-
-value is correct even if
-<I>dstlen</I>
-
-is zero, which offers a way to determine how much space would be needed
-before having to allocate any.
-<P>
-
-<I>Ttodatav</I>
-
-is just like
-<I>ttodata</I>
-
-except that in certain cases,
-if
-<I>errp</I>
-
-is non-NULL,
-the buffer pointed to by
-<I>errp</I>
-
-(whose length is given by
-<I>errlen</I>)
-
-is used to hold a more detailed error message.
-The return value is NULL for success,
-and is either
-<I>errp</I>
-
-or a pointer to a string literal for failure.
-If the size of the error-message buffer is
-inadequate for the desired message,
-<I>ttodatav</I>
-
-will fall back on returning a pointer to a literal string instead.
-The
-<I>freeswan.h</I>
-
-header file defines a constant
-<B>TTODATAV_BUF</B>
-
-which is the size of a buffer large enough for worst-case results.
-<P>
-
-The normal return value of
-<I>datatot</I>
-
-is the number of bytes required
-to contain the full untruncated result.
-It is the caller's responsibility to check this against
-<I>dstlen</I>
-
-to determine whether he has obtained a complete result.
-The return value is correct even if
-<I>dstlen</I>
-
-is zero, which offers a way to determine how much space would be needed
-before having to allocate any.
-A return value of
-<B>0</B>
-
-signals a fatal error of some kind
-(see DIAGNOSTICS).
-<P>
-
-A zero value for
-<I>srclen</I>
-
-in
-<I>ttodata</I>
-
-(but not
-<I>datatot</I>!)
-
-is synonymous with
-<B>strlen(src)</B>.
-
-A non-zero
-<I>srclen</I>
-
-in
-<I>ttodata</I>
-
-must not include the terminating NUL.
-<P>
-
-Unless
-<I>dstlen</I>
-
-is zero,
-the result supplied by
-<I>datatot</I>
-
-is always NUL-terminated,
-and its needed-size return value includes space for the terminating NUL.
-<P>
-
-Several obsolete variants of these functions
-(<I>atodata</I>,
-
-<I>datatoa</I>,
-
-<I>atobytes</I>,
-
-and
-<I>bytestoa</I>)
-
-are temporarily also supported.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="sprintf.3.html">sprintf</A>(3), <A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>ttodata</I>
-
-and
-<I>ttodatav</I>
-
-are:
-unknown characters in the input;
-unknown or missing prefix;
-unknown base;
-incomplete digit group;
-non-zero padding in a base64 less-than-three-bytes digit group;
-zero-length input.
-<P>
-
-Fatal errors in
-<I>datatot</I>
-
-are:
-unknown format code;
-zero-length input.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-<I>Datatot</I>
-
-should have a format code to produce character-text output.
-<P>
-
-The
-<B>0s</B>
-
-and
-<B>0t</B>
-
-prefixes are the author's inventions and are not a standard
-of any kind.
-They have been chosen to avoid collisions with existing practice
-(some C implementations use
-<B>0b</B>
-
-for binary)
-and possible confusion with unprefixed hexadecimal.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_eroute.5.html b/doc/manpage.d/ipsec_eroute.5.html
deleted file mode 100644
index 158b57015..000000000
--- a/doc/manpage.d/ipsec_eroute.5.html
+++ /dev/null
@@ -1,370 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_EROUTE</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_EROUTE</H1>
-Section: File Formats (5)<BR>Updated: 20 Sep 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec_eroute - list of existing eroutes
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>eroute</B>
-
-<P>
-
-<B>cat</B>
-
-<B>/proc/net/ipsec_eroute</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>/proc/net/ipsec_eroute</I>
-
-lists the IPSEC extended routing tables,
-which control what (if any) processing is applied
-to non-encrypted packets arriving for IPSEC processing and forwarding.
-At this point it is a read-only file.
-<P>
-
-A table entry consists of:
-<DL COMPACT>
-<DT>+<DD>
-packet count,
-<DT>+<DD>
-source address with mask,
-<DT>+<DD>
-a '-&gt;' separator for visual and automated parsing between src and dst
-<DT>+<DD>
-destination address with mask
-<DT>+<DD>
-a '=&gt;' separator for visual and automated parsing between selection
-criteria and SAID to use
-<DT>+<DD>
-SAID (Security Association IDentifier), comprised of:
-<DT>+<DD>
-protocol
-(<I>proto</I>),
-<DT>+<DD>
-address family
-(<I>af</I>),
-where '.' stands for IPv4 and ':' for IPv6
-<DT>+<DD>
-Security Parameters Index
-(<I>SPI</I>),
-<DT>+<DD>
-effective destination
-(<I>edst</I>),
-where the packet should be forwarded after processing
-(normally the other security gateway)
-together indicate which Security Association should be used to process
-the packet,
-<DT>+<DD>
-source identity text string with no whitespace, in parens,
-<DT>+<DD>
-destination identity text string with no whitespace, in parens
-</DL>
-<P>
-
-Addresses are written as IPv4 dotted quads or IPv6 coloned hex,
-protocol is one of &quot;ah&quot;, &quot;esp&quot;, &quot;comp&quot; or &quot;tun&quot;
-and
-SPIs are prefixed hexadecimal numbers where the prefix '.' is for IPv4 and the prefix ':' is for IPv6
-<P>
-
-SAIDs are written as &quot;<A HREF="mailto:protoafSPI@edst">protoafSPI@edst</A>&quot;.  There are also 5
-&quot;magic&quot; SAIDs which have special meaning:
-<DL COMPACT>
-<DT>+<DD>
-<B>%drop</B>
-
-means that matches are to be dropped
-<DT>+<DD>
-<B>%reject</B>
-
-means that matches are to be dropped and an ICMP returned, if
-possible to inform
-<DT>+<DD>
-<B>%trap</B>
-
-means that matches are to trigger an ACQUIRE message to the Key
-Management daemon(s) and a hold eroute will be put in place to
-prevent subsequent packets also triggering ACQUIRE messages.
-<DT>+<DD>
-<B>%hold</B>
-
-means that matches are to stored until the eroute is replaced or
-until that eroute gets reaped
-<DT>+<DD>
-<B>%pass</B>
-
-means that matches are to allowed to pass without IPSEC processing
-<BR>
-
-
-</DL>
-<A NAME="lbAE">&nbsp;</A>
-<H2>EXAMPLES</H2>
-
-<P>
-
-<B>1867     172.31.252.0/24    -&gt; 0.0.0.0/0          =&gt; <A HREF="mailto:tun.130@192.168.43.1">tun.130@192.168.43.1</A> </B>
-
-<BR>
-
-<B>        ()<TT>&nbsp;&nbsp;&nbsp;&nbsp;</TT>()</B>
-
-<P>
-
-means that 1,867 packets have been sent to an<BR>
-<B>eroute</B>
-
-that has been set up to protect traffic between the subnet
-<B>172.31.252.0</B>
-
-with a subnet mask of
-<B>24</B>
-
-bits and the default address/mask represented by an address of
-<B>0.0.0.0</B>
-
-with a subnet mask of
-<B>0</B>
-
-bits using the local machine as a security gateway on this end of the
-tunnel and the machine
-<B>192.168.43.1</B>
-
-on the other end of the tunnel with a Security Association IDentifier of
-<B><A HREF="mailto:tun0x130@192.168.43.1">tun0x130@192.168.43.1</A></B>
-
-which means that it is a tunnel mode connection (4, IPPROTO_IPIP) with a
-Security Parameters Index of
-<B>130</B>
-
-in hexadecimal with no identies defined for either end.
-<P>
-
-<B>125      3049:1::/64    -&gt; 0:0/0          =&gt; tun:<A HREF="mailto:130@3058">130@3058</A>:4::5<TT>&nbsp;</TT>()<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>()</B>
-
-<P>
-
-means that 125 packets have been sent to an<BR>
-<B>eroute</B>
-
-that has been set up to protect traffic between the subnet
-<B>3049:1::</B>
-
-with a subnet mask of
-<B>64</B>
-
-bits and the default address/mask represented by an address of
-<B>0:0</B>
-
-with a subnet mask of
-<B>0</B>
-
-bits using the local machine as a security gateway on this end of the
-tunnel and the machine
-<B>3058:4::5</B>
-
-on the other end of the tunnel with a Security Association IDentifier of
-<B>tun:<A HREF="mailto:130@3058">130@3058</A>:4::5</B>
-
-which means that it is a tunnel mode connection with a
-Security Parameters Index of
-<B>130</B>
-
-in hexadecimal with no identies defined for either end.
-<P>
-
-<B>42         192.168.6.0/24     -&gt; 192.168.7.0/24     =&gt; %passthrough</B>
-
-<P>
-
-means that 42 packets have been sent to an
-<B>eroute</B>
-
-that has been set up to pass the traffic from the subnet
-<B>192.168.6.0</B>
-
-with a subnet mask of
-<B>24</B>
-
-bits and to subnet
-<B>192.168.7.0</B>
-
-with a subnet mask of
-<B>24</B>
-
-bits without any IPSEC processing with no identies defined for either end.
-<P>
-
-<B>2112     192.168.8.55/32    -&gt; 192.168.9.47/24    =&gt; %hold<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>(east)<TT>&nbsp;&nbsp;</TT>()</B>
-
-<P>
-
-means that 2112 packets have been sent to an<BR>
-<B>eroute</B>
-
-that has been set up to hold the traffic from the host
-<B>192.168.8.55</B>
-
-and to host
-<B>192.168.9.47</B>
-
-until a key exchange from a Key Management daemon
-succeeds and puts in an SA or fails and puts in a pass
-or drop eroute depending on the default configuration with the local client
-defined as &quot;east&quot; and no identy defined for the remote end.
-<P>
-
-<B>2001     192.168.2.110/32   -&gt; 192.168.2.120/32   =&gt; </B>
-
-<BR>
-
-<B>        <A HREF="mailto:esp.e6de@192.168.2.120">esp.e6de@192.168.2.120</A><TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>()<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>()</B>
-
-<P>
-
-means that 2001 packets have been sent to an<BR>
-<B>eroute</B>
-
-that has been set up to protect traffic between the host
-<B>192.168.2.110</B>
-
-and the host
-<B>192.168.2.120</B>
-
-using
-<B>192.168.2.110</B>
-
-as a security gateway on this end of the
-connection and the machine
-<B>192.168.2.120</B>
-
-on the other end of the connection with a Security Association IDentifier of
-<B><A HREF="mailto:esp.e6de@192.168.2.120">esp.e6de@192.168.2.120</A></B>
-
-which means that it is a transport mode connection with a Security
-Parameters Index of
-<B>e6de</B>
-
-in hexadecimal using Encapsuation Security Payload protocol (50,
-IPPROTO_ESP) with no identies defined for either end.
-<P>
-
-<B>1984     3049:1::110/128   -&gt; 3049:1::120/128   =&gt; </B>
-
-<BR>
-
-<B>        ah:<A HREF="mailto:f5ed@3049">f5ed@3049</A>:1::120<TT>&nbsp;&nbsp;&nbsp;</TT>()<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>()</B>
-
-<P>
-
-means that 1984 packets have been sent to an<BR>
-<B>eroute</B>
-
-that has been set up to authenticate traffic between the host
-<B>3049:1::110</B>
-
-and the host
-<B>3049:1::120</B>
-
-using
-<B>3049:1::110</B>
-
-as a security gateway on this end of the
-connection and the machine
-<B>3049:1::120</B>
-
-on the other end of the connection with a Security Association IDentifier of
-<B>ah:<A HREF="mailto:f5ed@3049">f5ed@3049</A>:1::120</B>
-
-which means that it is a transport mode connection with a Security
-Parameters Index of
-<B>f5ed</B>
-
-in hexadecimal using Authentication Header protocol (51,
-IPPROTO_AH) with no identies defined for either end.
-<A NAME="lbAF">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/ipsec_eroute, /usr/local/bin/ipsec
-<A NAME="lbAG">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_tncfg.5.html">ipsec_tncfg</A>(5), <A HREF="ipsec_spi.5.html">ipsec_spi</A>(5),
-<A HREF="ipsec_spigrp.5.html">ipsec_spigrp</A>(5), <A HREF="ipsec_klipsdebug.5.html">ipsec_klipsdebug</A>(5), <A HREF="ipsec_eroute.8.html">ipsec_eroute</A>(8), <A HREF="ipsec_version.5.html">ipsec_version</A>(5),
-<A HREF="ipsec_pf_key.5.html">ipsec_pf_key</A>(5)
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Richard Guy Briggs.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">EXAMPLES</A><DD>
-<DT><A HREF="#lbAF">FILES</A><DD>
-<DT><A HREF="#lbAG">SEE ALSO</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_eroute.8.html b/doc/manpage.d/ipsec_eroute.8.html
deleted file mode 100644
index 7489462d7..000000000
--- a/doc/manpage.d/ipsec_eroute.8.html
+++ /dev/null
@@ -1,421 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_EROUTE</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_EROUTE</H1>
-Section: Maintenance Commands (8)<BR>Updated: 21 Jun 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec eroute - manipulate IPSEC extended routing tables
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>eroute</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>eroute</B>
-
-<B>--add</B>
-
-<B>--eraf (inet | inet6)</B>
-
-<B>--src</B>
-
-src/srcmaskbits|srcmask
-<B>--dst</B>
-
-dst/dstmaskbits|dstmask
-&lt;SAID&gt;
-<P>
-
-<B>ipsec</B>
-
-<B>eroute</B>
-
-<B>--replace</B>
-
-<B>--eraf (inet | inet6)</B>
-
-<B>--src</B>
-
-src/srcmaskbits|srcmask
-<B>--dst</B>
-
-dst/dstmaskbits|dstmask
-&lt;SAID&gt;
-<P>
-
-<B>ipsec</B>
-
-<B>eroute</B>
-
-<B>--del</B>
-
-<B>--eraf (inet | inet6)</B>
-
-<B>--src</B>
-
-src/srcmaskbits|srcmask
-<B>--dst</B>
-
-dst/dstmaskbits|dstmask
-<P>
-
-<B>ipsec</B>
-
-<B>eroute</B>
-
-<B>--clear</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>eroute</B>
-
-<B>--help</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>eroute</B>
-
-<B>--version</B>
-
-<P>
-
-Where &lt;SAID&gt; is
-<B>--af</B>
-
-(inet | inet6)
-<B>--edst</B>
-
-edst
-<B>--spi</B>
-
-spi
-<B>--proto</B>
-
-proto
-OR
-<B>--said</B>
-
-said
-OR
-<B>--said</B>
-
-<B>(%passthrough | %passthrough4 | %passthrough6)</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Eroute</I>
-
-manages the IPSEC extended routing tables,
-which control what (if any) processing is applied
-to non-encrypted packets arriving for IPSEC processing and forwarding.
-The form with no additional arguments lists the contents of
-/proc/net/ipsec_eroute.
-The
-<B>--add</B>
-
-form adds a table entry, the
-<B>--replace</B>
-
-form replaces a table entry, while the
-<B>--del</B>
-
-form deletes one.  The
-<B>--clear</B>
-
-form deletes the entire table.
-<P>
-
-A table entry consists of:
-<DL COMPACT>
-<DT>+<DD>
-source and destination addresses,
-with masks,
-for selection of packets
-<DT>+<DD>
-Security Association IDentifier, comprised of:
-<DT>+<DD>
-protocol
-(<I>proto</I>), indicating (together with the
-effective destination and the security parameters index)
-which Security Association should be used to process the packet
-<DT>+<DD>
-address family
-(<I>af</I>),
-<DT>+<DD>
-Security Parameters Index
-(<I>spi</I>), indicating (together with the
-effective destination and protocol)
-which Security Association should be used to process the packet
-(must be larger than or equal to 0x100)
-<DT>+<DD>
-effective destination
-(<I>edst</I>),
-where the packet should be forwarded after processing
-(normally the other security gateway)
-<DT>+<DD>
-OR
-<DT>+<DD>
-SAID
-(<I>said</I>), indicating 
-which Security Association should be used to process the packet
-</DL>
-<P>
-
-Addresses are written as IPv4 dotted quads or IPv6 coloned hex,
-protocol is one of &quot;ah&quot;, &quot;esp&quot;, &quot;comp&quot; or &quot;tun&quot; and SPIs are
-prefixed hexadecimal numbers where '.' represents IPv4 and ':'
-stands for IPv6.
-<P>
-
-SAIDs are written as &quot;<A HREF="mailto:protoafSPI@address">protoafSPI@address</A>&quot;.  There are also 5
-&quot;magic&quot; SAIDs which have special meaning:
-<DL COMPACT>
-<DT>+<DD>
-<B>%drop</B>
-
-means that matches are to be dropped
-<DT>+<DD>
-<B>%reject</B>
-
-means that matches are to be dropped and an ICMP returned, if
-possible to inform
-<DT>+<DD>
-<B>%trap</B>
-
-means that matches are to trigger an ACQUIRE message to the Key
-Management daemon(s) and a hold eroute will be put in place to
-prevent subsequent packets also triggering ACQUIRE messages.
-<DT>+<DD>
-<B>%hold</B>
-
-means that matches are to stored until the eroute is replaced or
-until that eroute gets reaped
-<DT>+<DD>
-<B>%pass</B>
-
-means that matches are to allowed to pass without IPSEC processing
-</DL>
-<P>
-
-The format of /proc/net/ipsec_eroute is listed in <A HREF="ipsec_eroute.5.html">ipsec_eroute</A>(5).
-<BR>
-
-
-<A NAME="lbAE">&nbsp;</A>
-<H2>EXAMPLES</H2>
-
-<P>
-
-<B>ipsec eroute --add --eraf inet --src 192.168.0.1/32 \</B>
-
-<BR>
-
-<B>   --dst 192.168.2.0/24 --af inet --edst 192.168.0.2 \</B>
-
-<BR>
-
-<B>   --spi 0x135 --proto tun</B>
-
-<P>
-
-sets up an
-<B>eroute</B>
-
-on a Security Gateway to protect traffic between the host
-<B>192.168.0.1</B>
-
-and the subnet
-<B>192.168.2.0</B>
-
-with
-<B>24</B>
-
-bits of subnet mask via Security Gateway
-<B>192.168.0.2</B>
-
-using the Security Association with address
-<B>192.168.0.2</B>,
-
-Security Parameters Index
-<B>0x135</B>
-
-and protocol
-<B>tun</B>
-
-(50, IPPROTO_ESP).
-<P>
-
-<B>ipsec eroute --add --eraf inet6 --src 3049:1::1/128 \</B>
-
-<BR>
-
-<B>   --dst 3049:2::/64 --af inet6 --edst 3049:1::2 \</B>
-
-<BR>
-
-<B>   --spi 0x145 --proto tun</B>
-
-<P>
-
-sets up an
-<B>eroute</B>
-
-on a Security Gateway to protect traffic between the host
-<B>3049:1::1</B>
-
-and the subnet
-<B>3049:2::</B>
-
-with
-<B>64</B>
-
-bits of subnet mask via Security Gateway
-<B>3049:1::2</B>
-
-using the Security Association with address
-<B>3049:1::2</B>,
-
-Security Parameters Index
-<B>0x145</B>
-
-and protocol
-<B>tun</B>
-
-(50, IPPROTO_ESP).
-<P>
-
-<B>ipsec eroute --replace --eraf inet --src company.com/24 \</B>
-
-<BR>
-
-<B>   --dst <A HREF="ftp://ftp.ngo.org">ftp.ngo.org</A>/32 --said <A HREF="mailto:tun.135@gw.ngo.org">tun.135@gw.ngo.org</A></B>
-
-<P>
-
-replaces an
-<B>eroute</B>
-
-on a Security Gateway to protect traffic between the subnet
-<B>company.com</B>
-
-with
-<B>24</B>
-
-bits of subnet mask and the host
-<B><A HREF="ftp://ftp.ngo.org">ftp.ngo.org</A></B>
-
-via Security Gateway
-<B>gw.ngo.org</B>
-
-using the Security Association with Security Association ID
-<B><A HREF="mailto:tun0x135@gw.ngo.org">tun0x135@gw.ngo.org</A></B>
-
-<P>
-
-<B>ipsec eroute --del --eraf inet --src company.com/24 \</B>
-
-<BR>
-
-<B>   --dst <A HREF="http://www.ietf.org">www.ietf.org</A>/32 --said %passthrough4</B>
-
-<P>
-
-deletes an
-<B>eroute</B>
-
-on a Security Gateway that allowed traffic between the subnet
-<B>company.com</B>
-
-with
-<B>24</B>
-
-bits of subnet mask and the host
-<B><A HREF="http://www.ietf.org">www.ietf.org</A></B>
-
-to pass in the clear, unprocessed.
-<A NAME="lbAF">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/ipsec_eroute, /usr/local/bin/ipsec
-<A NAME="lbAG">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A>(8), <A HREF="ipsec_spi.8.html">ipsec_spi</A>(8),
-<A HREF="ipsec_spigrp.8.html">ipsec_spigrp</A>(8), <A HREF="ipsec_klipsdebug.8.html">ipsec_klipsdebug</A>(8), <A HREF="ipsec_eroute.5.html">ipsec_eroute</A>(5)
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Richard Guy Briggs.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">EXAMPLES</A><DD>
-<DT><A HREF="#lbAF">FILES</A><DD>
-<DT><A HREF="#lbAG">SEE ALSO</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_goodmask.3.html b/doc/manpage.d/ipsec_goodmask.3.html
deleted file mode 100644
index a67a08d83..000000000
--- a/doc/manpage.d/ipsec_goodmask.3.html
+++ /dev/null
@@ -1,122 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_GOODMASK</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_GOODMASK</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec goodmask - is this Internet subnet mask a valid one?
-<BR>
-
-ipsec masktobits - convert Internet subnet mask to bit count
-<BR>
-
-ipsec bitstomask - convert bit count to Internet subnet mask
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int goodmask(struct in_addr mask);</B>
-
-<BR>
-
-<B>int masktobits(struct in_addr mask);</B>
-
-<BR>
-
-<B>struct in_addr bitstomask(int n);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete;
-see
-<I><A HREF="ipsec_masktocount.3.html">ipsec_masktocount</A></I>(3)
-
-for a partial replacement.
-<P>
-
-<I>Goodmask</I>
-
-reports whether the subnet
-<I>mask</I>
-
-is a valid one,
-i.e. consists of a (possibly empty) sequence of
-<B>1</B>s
-
-followed by a (possibly empty) sequence of
-<B>0</B>s.
-
-<I>Masktobits</I>
-
-takes a (valid) subnet mask and returns the number of
-<B>1</B>
-
-bits in it.
-<I>Bitstomask</I>
-
-reverses this,
-returning the subnet mask corresponding to bit count
-<I>n</I>.
-
-<P>
-
-All masks are in network byte order.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-<I>Masktobits</I>
-
-returns
-<B>-1</B>
-
-for an invalid mask.
-<I>Bitstomask</I>
-
-returns an all-zeros mask for a negative or out-of-range
-<I>n</I>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The error-reporting convention of
-<I>bitstomask</I>
-
-is less than ideal;
-zero is sometimes a legitimate mask.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_hostof.3.html b/doc/manpage.d/ipsec_hostof.3.html
deleted file mode 100644
index 57d4a5648..000000000
--- a/doc/manpage.d/ipsec_hostof.3.html
+++ /dev/null
@@ -1,107 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_SUBNETOF</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_SUBNETOF</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec subnetof - given Internet address and subnet mask, return subnet number
-<BR>
-
-ipsec hostof - given Internet address and subnet mask, return host part
-<BR>
-
-ipsec broadcastof - given Internet address and subnet mask, return broadcast address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>struct in_addr subnetof(struct in_addr addr,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr mask);</B>
-
-<BR>
-
-<B>struct in_addr hostof(struct in_addr addr,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr mask);</B>
-
-<BR>
-
-<B>struct in_addr broadcastof(struct in_addr addr,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr mask);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete; see
-<I><A HREF="ipsec_networkof.3.html">ipsec_networkof</A></I>(3)
-
-for their replacements.
-<P>
-
-<I>Subnetof</I>
-
-takes an Internet
-<I>address</I>
-
-and a subnet
-<I>mask</I>
-
-and returns the network part of the address
-(all in network byte order).
-<I>Hostof</I>
-
-similarly returns the host part, and
-<I>broadcastof</I>
-
-returns the broadcast address (all-1s convention) for the network.
-<P>
-
-These functions are provided to hide the Internet bit-munging inside
-an API, in hopes of easing the eventual transition to IPv6.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAG">&nbsp;</A>
-<H2>BUGS</H2>
-
-Calling functions for this is more costly than doing it yourself.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-<DT><A HREF="#lbAG">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_ikeping.8.html b/doc/manpage.d/ipsec_ikeping.8.html
deleted file mode 100644
index 03ed961f3..000000000
--- a/doc/manpage.d/ipsec_ikeping.8.html
+++ /dev/null
@@ -1,137 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_IKEPING</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_IKEPING</H1>
-Section: Maintenance Commands (8)<BR>Updated: 23 Feb 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ikeping - send/receive ISAKMP/IKE echo requests/replies
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>ikeping</B>
-
-[
-<B>--listen</B>
-
-] [
-<B>--verbose</B>
-
-] [
-<B>--wait </B>
-
-time ] [
-<B>--exchangenum </B>
-
-num ] [
-<B>--ikeport </B>
-
-localport ] [
-<B>--ikeaddress </B>
-
-address ] [ 
-<B>--inet</B>
-
-] [
-<B>--inet6</B>
-
-] destaddr[/dstport] ...
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ikeping</I>
-
-sends and receives ISAKMP/IKE echo request and echo reply packets. These
-packets are intended for diagnostics purposes, in a manner similar to 
-<I><A HREF="ping.8.html">ping</A></I>(8)
-
-does for ICMP echo request/reply packets.
-<P>
-
-At the time of this writing, the ISAKMP echo request/reply exchange is still
-an internet-draft, and is therefore completely non-standard.
-<P>
-
-<I>Ikeping</I>
-
-will bind to the local address given by 
-<B>--ikeaddress</B>
-
-and the port number given by
-<B>--ikeport</B>
-
-defaulting to the wildcard address and the ISAKMP port 500. An ISAKMP
-exchange of type 244 (a private use number) is sent to each of the
-address/ports listed on the command line. The exchange number may be
-overridden by the  
-<B>--exchangenum </B>
-
-option.
-<P>
-
-<I>Ikeping</I>
-
-then listens for replies, printing them as they are received. Replies
-are of exchange type 245 or the specified exchange number plus 1.
-<I>Ikeping </I>
-
-will keep listening until it either receives as many echo responses as it sent,
-or until the timeout period (10 seconds) has been reached. Receipt of a
-packet will reset the timer. The 
-<B>--wait</B>
-
-option can be used to specify a different timeout period. 
-<P>
-
-If the 
-<B>--listen</B>
-
-option is given, then 
-<I>ikeping</I>
-
-will not send any packets. Instead, it will listen for them and reply to
-each request received.
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-no external files
-<A NAME="lbAF">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ping.8.html">ping</A>(8), <A HREF="ipsec_pluto.8.html">ipsec_pluto</A>(8)
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Michael Richardson.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">SEE ALSO</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_initaddr.3.html b/doc/manpage.d/ipsec_initaddr.3.html
deleted file mode 100644
index ca1f857e7..000000000
--- a/doc/manpage.d/ipsec_initaddr.3.html
+++ /dev/null
@@ -1,232 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_INITADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_INITADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 11 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec initaddr - initialize an ip_address
-<BR>
-
-ipsec addrtypeof - get address type of an ip_address
-<BR>
-
-ipsec addrlenof - get length of address within an ip_address
-<BR>
-
-ipsec addrbytesof - get copy of address within an ip_address
-<BR>
-
-ipsec addrbytesptr - get pointer to address within an ip_address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *initaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int addrtypeof(const ip_address *src);</B>
-
-<BR>
-
-<B>size_t addrlenof(const ip_address *src);</B>
-
-<BR>
-
-<B>size_t addrbytesof(const ip_address *src,</B>
-
-<BR>
-&nbsp;
-<B>unsigned char *dst, size_t dstlen);</B>
-
-<BR>
-
-<B>size_t addrbytesptr(const ip_address *src,</B>
-
-<BR>
-&nbsp;
-<B>const unsigned char **dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-library uses an internal type
-<I>ip_address</I>
-
-to contain one of the (currently two) types of IP address.
-These functions provide basic tools for creating and examining this type.
-<P>
-
-<I>Initaddr</I>
-
-initializes a variable
-<I>*dst</I>
-
-of type
-<I>ip_address</I>
-
-from an address
-(in network byte order,
-indicated by a pointer
-<I>src</I>
-
-and a length
-<I>srclen</I>)
-
-and an address family
-<I>af</I>
-
-(typically
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>).
-
-The length must be consistent with the address family.
-<P>
-
-<I>Addrtypeof</I>
-
-returns the address type of an address,
-normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-(The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file arranges to include the necessary headers for these
-names to be known.)
-<P>
-
-<I>Addrlenof</I>
-
-returns the size (in bytes) of the address within an
-<I>ip_address</I>,
-
-to permit storage allocation etc.
-<P>
-
-<I>Addrbytesof</I>
-
-copies the address within the
-<I>ip_address</I>
-
-<I>src</I>
-
-to the buffer indicated by the pointer
-<I>dst</I>
-
-and the length
-<I>dstlen</I>,
-
-and returns the address length (in bytes).
-If the address will not fit,
-as many bytes as will fit are copied;
-the returned length is still the full length.
-It is the caller's responsibility to check the
-returned value to ensure that there was enough room.
-<P>
-
-<I>Addrbytesptr</I>
-
-sets
-<I>*dst</I>
-
-to a pointer to the internal address within the
-<I>ip_address</I>,
-
-and returns the address length (in bytes).
-If
-<I>dst</I>
-
-is
-<B>NULL</B>,
-
-it just returns the address length.
-The pointer points to
-<B>const</B>
-
-to discourage misuse.
-<P>
-
-<I>Initaddr</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<P>
-
-The functions which return
-<I>size_t</I>
-
-return
-<B>0</B>
-
-for a failure.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-An unknown address family is a fatal error for any of these functions
-except
-<I>addrtypeof</I>.
-
-An address-size mismatch is a fatal error for
-<I>initaddr</I>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-<I>Addrtypeof</I>
-
-should probably have been named
-<I>addrfamilyof</I>.
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_initsaid.3.html b/doc/manpage.d/ipsec_initsaid.3.html
deleted file mode 100644
index 2ba79a8ac..000000000
--- a/doc/manpage.d/ipsec_initsaid.3.html
+++ /dev/null
@@ -1,453 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TTOSA</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TTOSA</H1>
-Section: C Library Functions (3)<BR>Updated: 26 Nov 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ttosa, satot - convert IPsec Security Association IDs to and from text
-<BR>
-
-ipsec initsaid - initialize an SA ID
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>typedef struct {</B>
-
-<BR>
-&nbsp;
-<B>ip_address dst;</B>
-
-<BR>
-&nbsp;
-<B>ipsec_spi_t spi;</B>
-
-<BR>
-&nbsp;
-<B>int proto;</B>
-
-<BR>
-
-<B>} ip_said;</B>
-
-<P>
-<B>const char *ttosa(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>ip_said *sa);</B>
-
-<BR>
-
-<B>size_t satot(const ip_said *sa, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<BR>
-
-<B>void initsaid(const ip_address *addr, ipsec_spi_t spi,</B>
-
-<BR>
-&nbsp;
-<B>int proto, ip_said *dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ttosa</I>
-
-converts an ASCII Security Association (SA) specifier into an
-<B>ip_said</B>
-
-structure (containing
-a destination-host address
-in network byte order,
-an SPI number in network byte order, and
-a protocol code).
-<I>Satot</I>
-
-does the reverse conversion, back to a text SA specifier.
-<I>Initsaid</I>
-
-initializes an
-<B>ip_said</B>
-
-from separate items of information.
-<P>
-
-An SA is specified in text with a mail-like syntax, e.g.
-<B><A HREF="mailto:esp.5a7@1.2.3.4">esp.5a7@1.2.3.4</A></B>.
-
-An SA specifier contains
-a protocol prefix (currently
-<B>ah</B>,
-
-<B>esp</B>,
-
-<B>tun</B>,
-
-<B>comp</B>,
-
-or
-<B>int</B>),
-
-a single character indicating the address family
-(<B>.</B>
-
-for IPv4,
-<B>:</B>
-
-for IPv6),
-an unsigned integer SPI number in hexadecimal (with no
-<B>0x</B>
-
-prefix),
-and an IP address.
-The IP address can be any form accepted by
-<I><A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A></I>(3),
-
-e.g. dotted-decimal IPv4 address,
-colon-hex IPv6 address,
-or DNS name.
-<P>
-
-As a special case, the SA specifier
-<B>%passthrough4</B>
-
-or
-<B>%passthrough6</B>
-
-signifies the special SA used to indicate that packets should be
-passed through unaltered.
-(At present, these are synonyms for
-<B><A HREF="mailto:tun.0@0.0.0.0">tun.0@0.0.0.0</A></B>
-
-and
-<B>tun:0@::</B>
-
-respectively,
-but that is subject to change without notice.)
-<B>%passthrough</B>
-
-is a historical synonym for
-<B>%passthrough4</B>.
-
-These forms are known to both
-<I>ttosa</I>
-
-and
-<I>satot</I>,
-
-so the internal representation is never visible.
-<P>
-
-Similarly, the SA specifiers
-<B>%pass</B>,
-
-<B>%drop</B>,
-
-<B>%reject</B>,
-
-<B>%hold</B>,
-
-<B>%trap</B>,
-
-and
-<B>%trapsubnet</B>
-
-signify special ``magic'' SAs used to indicate that packets should be
-passed, dropped, rejected (dropped with ICMP notification),
-held,
-and trapped (sent up to
-<I><A HREF="ipsec_pluto.8.html">ipsec_pluto</A></I>(8),
-
-with either of two forms of
-<B>%hold</B>
-
-automatically installed)
-respectively.
-These forms too are known to both routines,
-so the internal representation of the magic SAs should never be visible.
-<P>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file supplies the
-<B>ip_said</B>
-
-structure, as well as a data type
-<B>ipsec_spi_t</B>
-
-which is an unsigned 32-bit integer.
-(There is no consistency between kernel and user on what such a type
-is called, hence the header hides the differences.)
-<P>
-
-The protocol code uses the same numbers that IP does.
-For user convenience, given the difficulty in acquiring the exact set of
-protocol names used by the kernel,
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-defines the names
-<B>SA_ESP</B>,
-
-<B>SA_AH</B>,
-
-<B>SA_IPIP</B>,
-
-and
-<B>SA_COMP</B>
-
-to have the same values as the kernel names
-<B>IPPROTO_ESP</B>,
-
-<B>IPPROTO_AH</B>,
-
-<B>IPPROTO_IPIP</B>,
-
-and
-<B>IPPROTO_COMP</B>.
-
-<P>
-
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-also defines
-<B>SA_INT</B>
-
-to have the value
-<B>61</B>
-
-(reserved by IANA for ``any host internal protocol'')
-and
-<B>SPI_PASS</B>,
-
-<B>SPI_DROP</B>,
-
-<B>SPI_REJECT</B>,
-
-<B>SPI_HOLD</B>,
-
-and
-<B>SPI_TRAP</B>
-
-to have the values 256-260 (in <I>host</I> byte order) respectively.
-These are used in constructing the magic SAs
-(which always have address
-<B>0.0.0.0</B>).
-
-<P>
-
-If
-<I>satot</I>
-
-encounters an unknown protocol code, e.g. 77,
-it yields output using a prefix
-showing the code numerically, e.g. ``unk77''.
-This form is
-<I>not</I>
-
-recognized by
-<I>ttosa</I>.
-
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>ttosa</I>
-
-specifies the length of the string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>satot</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file defines a constant,
-<B>SATOT_BUF</B>,
-
-which is the size of a buffer just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>satot</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the ASCII character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default
-(currently
-lowercase protocol prefix, lowercase hexadecimal SPI,
-dotted-decimal or colon-hex address).
-The value
-<B>'f'</B>
-
-is similar except that the SPI is padded with
-<B>0</B>s
-
-to a fixed 32-bit width, to ease aligning displayed tables.
-<P>
-
-<I>Ttosa</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<I>Satot</I>
-
-returns
-<B>0</B>
-
-for a failure, and otherwise
-always returns the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<P>
-
-There is also, temporarily, support for some obsolete
-forms of SA specifier which lack the address-family indicator.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec_ttoul.3.html">ipsec_ttoul</A>(3), <A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A>(3), <A HREF="ipsec_samesaid.3.html">ipsec_samesaid</A>(3), <A HREF="inet.3.html">inet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>ttosa</I>
-
-are:
-empty input;
-input too small to be a legal SA specifier;
-no
-<B>@</B>
-
-in input;
-unknown protocol prefix;
-conversion error in
-<I>ttoul</I>
-
-or
-<I>ttoaddr</I>.
-
-<P>
-
-Fatal errors in
-<I>satot</I>
-
-are:
-unknown format.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The restriction of text-to-binary error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The text-to-binary error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = ttosa( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_initsubnet.3.html b/doc/manpage.d/ipsec_initsubnet.3.html
deleted file mode 100644
index e442a9100..000000000
--- a/doc/manpage.d/ipsec_initsubnet.3.html
+++ /dev/null
@@ -1,238 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_INITSUBNET</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_INITSUBNET</H1>
-Section: C Library Functions (3)<BR>Updated: 12 March 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec initsubnet - initialize an ip_subnet
-<BR>
-
-ipsec addrtosubnet - initialize a singleton ip_subnet
-<BR>
-
-ipsec subnettypeof - get address type of an ip_subnet
-<BR>
-
-ipsec masktocount - convert subnet mask to bit count
-<BR>
-
-ipsec networkof - get base address of an ip_subnet
-<BR>
-
-ipsec maskof - get subnet mask of an ip_subnet
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *initsubnet(const ip_address *addr,</B>
-
-<BR>
-&nbsp;
-<B>int maskbits, int clash, ip_subnet *dst);</B>
-
-<BR>
-
-<B>const char *addrtosubnet(const ip_address *addr,</B>
-
-<BR>
-&nbsp;
-<B>ip_subnet *dst);</B>
-
-<P>
-<B>int subnettypeof(const ip_subnet *src);</B>
-
-<BR>
-
-<B>int masktocount(const ip_address *src);</B>
-
-<BR>
-
-<B>void networkof(const ip_subnet *src, ip_address *dst);</B>
-
-<BR>
-
-<B>void maskof(const ip_subnet *src, ip_address *dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-library uses an internal type
-<I>ip_subnet</I>
-
-to contain a description of an IP subnet
-(base address plus mask).
-These functions provide basic tools for creating and examining this type.
-<P>
-
-<I>Initsubnet</I>
-
-initializes a variable
-<I>*dst</I>
-
-of type
-<I>ip_subnet</I>
-
-from a base address and
-a count of mask bits.
-The
-<I>clash</I>
-
-parameter specifies what to do if the base address includes
-<B>1</B>
-
-bits outside the prefix specified by the mask
-(that is, in the ``host number'' part of the address):
-<DL COMPACT><DT><DD>
-<DL COMPACT>
-<DT>'0'<DD>
-zero out host-number bits
-<DT>'x'<DD>
-non-zero host-number bits are an error
-</DL>
-</DL>
-
-<P>
-
-<I>Initsubnet</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<P>
-
-<I>Addrtosubnet</I>
-
-initializes an
-<I>ip_subnet</I>
-
-variable
-<I>*dst</I>
-
-to a ``singleton subnet'' containing the single address
-<I>*addr</I>.
-
-It returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure.
-<P>
-
-<I>Subnettypeof</I>
-
-returns the address type of a subnet,
-normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-(The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file arranges to include the necessary headers for these
-names to be known.)
-<P>
-
-<I>Masktocount</I>
-
-converts a subnet mask, expressed as an address, to a bit count
-suitable for use with
-<I>initsubnet</I>.
-
-It returns
-<B>-1</B>
-
-for error; see DIAGNOSTICS.
-<P>
-
-<I>Networkof</I>
-
-fills in
-<I>*dst</I>
-
-with the base address of subnet
-<I>src</I>.
-
-<P>
-
-<I>Maskof</I>
-
-fills in
-<I>*dst</I>
-
-with the subnet mask of subnet
-<I>src</I>,
-
-expressed as an address.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_ttosubnet.3.html">ipsec_ttosubnet</A>(3), <A HREF="ipsec_rangetosubnet.3.html">ipsec_rangetosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>initsubnet</I>
-
-are:
-unknown address family;
-unknown
-<I>clash</I>
-
-value;
-impossible mask bit count;
-non-zero host-number bits and
-<I>clash</I>
-
-is
-<B>'x'</B>.
-
-Fatal errors in
-<I>addrtosubnet</I>
-
-are:
-unknown address family.
-Fatal errors in
-<I>masktocount</I>
-
-are:
-unknown address family;
-mask bits not contiguous.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_isanyaddr.3.html b/doc/manpage.d/ipsec_isanyaddr.3.html
deleted file mode 100644
index 974236005..000000000
--- a/doc/manpage.d/ipsec_isanyaddr.3.html
+++ /dev/null
@@ -1,166 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 8 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec anyaddr - get &quot;any&quot; address
-<BR>
-
-ipsec isanyaddr - test address for equality to &quot;any&quot; address
-<BR>
-
-ipsec unspecaddr - get &quot;unspecified&quot; address
-<BR>
-
-ipsec isunspecaddr - test address for equality to &quot;unspecified&quot; address
-<BR>
-
-ipsec loopbackaddr - get loopback address
-<BR>
-
-ipsec isloopbackaddr - test address for equality to loopback address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *anyaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isanyaddr(const ip_address *src);</B>
-
-<BR>
-
-<B>const char *unspecaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isunspecaddr(const ip_address *src);</B>
-
-<BR>
-
-<B>const char *loopbackaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isloopbackaddr(const ip_address *src);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions fill in, and test for, special values of the
-<I>ip_address</I>
-
-type.
-<P>
-
-<I>Anyaddr</I>
-
-fills in the destination
-<I>*dst</I>
-
-with the ``any'' address of address family
-<I>af</I>
-
-(normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>).
-
-The IPv4 ``any'' address is the one embodied in the old
-<B>INADDR_ANY</B>
-
-macro.
-<P>
-
-<I>Isanyaddr</I>
-
-returns
-<B>1</B>
-
-if the
-<I>src</I>
-
-address equals the ``any'' address,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-Similarly,
-<I>unspecaddr</I>
-
-supplies, and
-<I>isunspecaddr</I>
-
-tests for,
-the ``unspecified'' address,
-which may be the same as the ``any'' address.
-<P>
-
-Similarly,
-<I>loopbackaddr</I>
-
-supplies, and
-<I>islookbackaddr</I>
-
-tests for,
-the loopback address.
-<P>
-
-<I>Anyaddr</I>,
-
-<I>unspecaddr</I>,
-
-and
-<I>loopbackaddr</I>
-
-return
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_addrtot.3.html">ipsec_addrtot</A>(3), <A HREF="ipsec_sameaddr.3.html">ipsec_sameaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in the address-supplying functions are:
-unknown address family.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_isloopbackaddr.3.html b/doc/manpage.d/ipsec_isloopbackaddr.3.html
deleted file mode 100644
index 974236005..000000000
--- a/doc/manpage.d/ipsec_isloopbackaddr.3.html
+++ /dev/null
@@ -1,166 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 8 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec anyaddr - get &quot;any&quot; address
-<BR>
-
-ipsec isanyaddr - test address for equality to &quot;any&quot; address
-<BR>
-
-ipsec unspecaddr - get &quot;unspecified&quot; address
-<BR>
-
-ipsec isunspecaddr - test address for equality to &quot;unspecified&quot; address
-<BR>
-
-ipsec loopbackaddr - get loopback address
-<BR>
-
-ipsec isloopbackaddr - test address for equality to loopback address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *anyaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isanyaddr(const ip_address *src);</B>
-
-<BR>
-
-<B>const char *unspecaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isunspecaddr(const ip_address *src);</B>
-
-<BR>
-
-<B>const char *loopbackaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isloopbackaddr(const ip_address *src);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions fill in, and test for, special values of the
-<I>ip_address</I>
-
-type.
-<P>
-
-<I>Anyaddr</I>
-
-fills in the destination
-<I>*dst</I>
-
-with the ``any'' address of address family
-<I>af</I>
-
-(normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>).
-
-The IPv4 ``any'' address is the one embodied in the old
-<B>INADDR_ANY</B>
-
-macro.
-<P>
-
-<I>Isanyaddr</I>
-
-returns
-<B>1</B>
-
-if the
-<I>src</I>
-
-address equals the ``any'' address,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-Similarly,
-<I>unspecaddr</I>
-
-supplies, and
-<I>isunspecaddr</I>
-
-tests for,
-the ``unspecified'' address,
-which may be the same as the ``any'' address.
-<P>
-
-Similarly,
-<I>loopbackaddr</I>
-
-supplies, and
-<I>islookbackaddr</I>
-
-tests for,
-the loopback address.
-<P>
-
-<I>Anyaddr</I>,
-
-<I>unspecaddr</I>,
-
-and
-<I>loopbackaddr</I>
-
-return
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_addrtot.3.html">ipsec_addrtot</A>(3), <A HREF="ipsec_sameaddr.3.html">ipsec_sameaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in the address-supplying functions are:
-unknown address family.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_isunspecaddr.3.html b/doc/manpage.d/ipsec_isunspecaddr.3.html
deleted file mode 100644
index 974236005..000000000
--- a/doc/manpage.d/ipsec_isunspecaddr.3.html
+++ /dev/null
@@ -1,166 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 8 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec anyaddr - get &quot;any&quot; address
-<BR>
-
-ipsec isanyaddr - test address for equality to &quot;any&quot; address
-<BR>
-
-ipsec unspecaddr - get &quot;unspecified&quot; address
-<BR>
-
-ipsec isunspecaddr - test address for equality to &quot;unspecified&quot; address
-<BR>
-
-ipsec loopbackaddr - get loopback address
-<BR>
-
-ipsec isloopbackaddr - test address for equality to loopback address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *anyaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isanyaddr(const ip_address *src);</B>
-
-<BR>
-
-<B>const char *unspecaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isunspecaddr(const ip_address *src);</B>
-
-<BR>
-
-<B>const char *loopbackaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isloopbackaddr(const ip_address *src);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions fill in, and test for, special values of the
-<I>ip_address</I>
-
-type.
-<P>
-
-<I>Anyaddr</I>
-
-fills in the destination
-<I>*dst</I>
-
-with the ``any'' address of address family
-<I>af</I>
-
-(normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>).
-
-The IPv4 ``any'' address is the one embodied in the old
-<B>INADDR_ANY</B>
-
-macro.
-<P>
-
-<I>Isanyaddr</I>
-
-returns
-<B>1</B>
-
-if the
-<I>src</I>
-
-address equals the ``any'' address,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-Similarly,
-<I>unspecaddr</I>
-
-supplies, and
-<I>isunspecaddr</I>
-
-tests for,
-the ``unspecified'' address,
-which may be the same as the ``any'' address.
-<P>
-
-Similarly,
-<I>loopbackaddr</I>
-
-supplies, and
-<I>islookbackaddr</I>
-
-tests for,
-the loopback address.
-<P>
-
-<I>Anyaddr</I>,
-
-<I>unspecaddr</I>,
-
-and
-<I>loopbackaddr</I>
-
-return
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_addrtot.3.html">ipsec_addrtot</A>(3), <A HREF="ipsec_sameaddr.3.html">ipsec_sameaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in the address-supplying functions are:
-unknown address family.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:17 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_keyblobtoid.3.html b/doc/manpage.d/ipsec_keyblobtoid.3.html
deleted file mode 100644
index 109cfafa7..000000000
--- a/doc/manpage.d/ipsec_keyblobtoid.3.html
+++ /dev/null
@@ -1,174 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_KEYBLOBTOID</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_KEYBLOBTOID</H1>
-Section: C Library Functions (3)<BR>Updated: 25 March 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec keyblobtoid, splitkeytoid - generate key IDs from RSA keys
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>size_t keyblobtoid(const unsigned char *blob,</B>
-
-<BR>
-&nbsp;
-<B>size_t bloblen, char *dst, size_t dstlen);</B>
-
-<BR>
-
-<B>size_t splitkeytoid(const unsigned char *e, size_t elen,</B>
-
-<BR>
-&nbsp;
-<B>const unsigned char *m, size_t mlen, char *dst,</B>
-
-<BR>
-&nbsp;
-<B>size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Keyblobtoid</I>
-
-and
-<I>splitkeytoid</I>
-
-generate
-key IDs
-from RSA keys,
-for use in messages and reporting,
-writing the result to
-<I>dst</I>.
-
-A
-<I>key ID</I>
-
-is a short ASCII string identifying a key;
-currently it is just the first nine characters of the base64
-encoding of the RFC 2537/3110 ``byte blob'' representation of the key.
-(Beware that no finite key ID can be collision-proof:
-there is always some small chance of two random keys having the
-same ID.)
-<P>
-
-<I>Keyblobtoid</I>
-
-generates a key ID from a key which is already in the form of an
-RFC 2537/3110 binary key
-<I>blob</I>
-
-(encoded exponent length, exponent, modulus).
-<P>
-
-<I>Splitkeytoid</I>
-
-generates a key ID from a key given in the form of a separate
-(binary) exponent
-<I>e</I>
-
-and modulus
-<I>m</I>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of either
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines a constant
-<B>KEYID_BUF</B>
-
-which is the size of a buffer large enough for worst-case results.
-<P>
-
-Both functions return
-<B>0</B>
-
-for a failure, and otherwise
-always return the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-
-With keys generated by
-<I><A HREF="ipsec_rsasigkey.3.html">ipsec_rsasigkey</A></I>(3),
-
-the first two base64 digits are always the same,
-and the third carries only about one bit of information.
-It's worse with keys using longer fixed exponents,
-e.g. the 24-bit exponent that's common in X.509 certificates.
-However, being able to relate key IDs to the full
-base64 text form of keys by eye is sufficiently useful that this
-waste of space seems justifiable.
-The choice of nine digits is a compromise between bulk and
-probability of collision.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-RFC 3110,
-<I>RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)</I>,
-Eastlake, 2001
-(superseding the older but better-known RFC 2537).
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors are:
-key too short to supply enough bits to construct a complete key ID
-(almost certainly indicating a garbage key);
-exponent too long for its length to be representable.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_klipsdebug.5.html b/doc/manpage.d/ipsec_klipsdebug.5.html
deleted file mode 100644
index 964329256..000000000
--- a/doc/manpage.d/ipsec_klipsdebug.5.html
+++ /dev/null
@@ -1,229 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_KLIPSDEBUG</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_KLIPSDEBUG</H1>
-Section: File Formats (5)<BR>Updated: 26 Jun 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec_klipsdebug - list KLIPS (kernel IPSEC support) debug features and level
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>klipsdebug</B>
-
-<P>
-
-<B>cat</B>
-
-<B>/proc/net/ipsec_klipsdebug</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>/proc/net/ipsec_klipsdebug</I>
-
-lists flags that control various parts of the debugging output of Klips
-(the kernel portion of FreeS/WAN IPSEC).
-At this point it is a read-only file.
-<P>
-
-A table entry consists of:
-<DL COMPACT>
-<DT>+<DD>
-a KLIPS debug variable
-<DT>+<DD>
-a '=' separator for visual and automated parsing between the variable
-name and its current value
-<DT>+<DD>
-hexadecimal bitmap of variable's flags.
-</DL>
-<P>
-
-The variable names roughly describe the scope of the debugging variable.
-Currently, no flags are documented or individually accessible yet except
-tunnel-xmit.
-
-<P>
-
-The variable names are:
-<DL COMPACT>
-<DT><B>tunnel</B>
-
-<DD>
-tunnelling code
-<DT><B>netlink</B>
-
-<DD>
-userspace communication code (obsolete)
-<DT><B>xform</B>
-
-<DD>
-transform selection and manipulation code
-<DT><B>eroute</B>
-
-<DD>
-eroute table manipulation code
-<DT><B>spi</B>
-
-<DD>
-SA table manipulation code
-<DT><B>radij</B>
-
-<DD>
-radij tree manipulation code
-<DT><B>esp</B>
-
-<DD>
-encryptions transforms code
-<DT><B>ah</B>
-
-<DD>
-authentication transforms code
-<DT><B>rcv</B>
-
-<DD>
-receive code
-<DT><B>ipcomp</B>
-
-<DD>
-ip compression transforms code
-<DT><B>verbose</B>
-
-<DD>
-give even more information, beware this will probably trample the 4k kernel printk buffer giving inaccurate output
-</DL>
-<P>
-
-All KLIPS debug output appears as
-<B>kernel.info</B>
-
-messages to
-<I><A HREF="syslogd.8.html">syslogd</A></I>(8).
-
-Most systems are set up
-to log these messages to
-<I>/var/log/messages</I>.
-
-<P>
-
-<A NAME="lbAE">&nbsp;</A>
-<H2>EXAMPLES</H2>
-
-<P>
-
-<B>debug_tunnel=00000010.</B>
-
-<BR>
-
-<B>debug_netlink=00000000.</B>
-
-<BR>
-
-<B>debug_xform=00000000.</B>
-
-<BR>
-
-<B>debug_eroute=00000000.</B>
-
-<BR>
-
-<B>debug_spi=00000000.</B>
-
-<BR>
-
-<B>debug_radij=00000000.</B>
-
-<BR>
-
-<B>debug_esp=00000000.</B>
-
-<BR>
-
-<B>debug_ah=00000000.</B>
-
-<BR>
-
-<B>debug_rcv=00000000.</B>
-
-<BR>
-
-<B>debug_pfkey=ffffffff.</B>
-
-<P>
-
-means that one
-<B>tunnel</B>
-
-flag has been set (tunnel-xmit),
-full
-<B>pfkey</B>
-
-sockets debugging has been set and everything else is not set.
-<P>
-
-<A NAME="lbAF">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/ipsec_klipsdebug, /usr/local/bin/ipsec
-<A NAME="lbAG">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A>(8), <A HREF="ipsec_eroute.8.html">ipsec_eroute</A>(8),
-<A HREF="ipsec_spi.8.html">ipsec_spi</A>(8), <A HREF="ipsec_spigrp.8.html">ipsec_spigrp</A>(8), <A HREF="ipsec_klipsdebug.5.html">ipsec_klipsdebug</A>(5), <A HREF="ipsec_version.5.html">ipsec_version</A>(5),
-<A HREF="ipsec_pf_key.5.html">ipsec_pf_key</A>(5)
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Richard Guy Briggs.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">EXAMPLES</A><DD>
-<DT><A HREF="#lbAF">FILES</A><DD>
-<DT><A HREF="#lbAG">SEE ALSO</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_klipsdebug.8.html b/doc/manpage.d/ipsec_klipsdebug.8.html
deleted file mode 100644
index 67b1c3a5d..000000000
--- a/doc/manpage.d/ipsec_klipsdebug.8.html
+++ /dev/null
@@ -1,264 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_KLIPSDEBUG</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_KLIPSDEBUG</H1>
-Section: Maintenance Commands (8)<BR>Updated: 21 Jun 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec klipsdebug - set KLIPS (kernel IPSEC support) debug features and level
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>klipsdebug</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>klipsdebug</B>
-
-<B>--set</B>
-
-flagname
-<P>
-
-<B>ipsec</B>
-
-<B>klipsdebug</B>
-
-<B>--clear</B>
-
-flagname
-<P>
-
-<B>ipsec</B>
-
-<B>klipsdebug</B>
-
-<B>--all</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>klipsdebug</B>
-
-<B>--none</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>klipsdebug</B>
-
-<B>--help</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>klipsdebug</B>
-
-<B>--version</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Klipsdebug</I>
-
-sets and clears flags that control
-various parts of the debugging output of Klips
-(the kernel portion of FreeS/WAN IPSEC).
-The form with no additional arguments lists the present contents of
-/proc/net/ipsec_klipsdebug.
-The
-<B>--set</B>
-
-form turns the specified flag on,
-while the
-<B>--clear</B>
-
-form turns the specified flag off.
-The 
-<B>--all</B>
-
-form 
-turns all flags on except verbose, while the
-<B>--none</B>
-
-form turns all flags off.
-<P>
-
-The current flag names are:
-<DL COMPACT>
-<DT><B>tunnel</B>
-
-<DD>
-tunnelling code
-<DT><B>tunnel-xmit</B>
-
-<DD>
-tunnelling transmit only code
-<DT><B>pfkey</B>
-
-<DD>
-userspace communication code
-<DT><B>xform</B>
-
-<DD>
-transform selection and manipulation code
-<DT><B>eroute</B>
-
-<DD>
-eroute table manipulation code
-<DT><B>spi</B>
-
-<DD>
-SA table manipulation code
-<DT><B>radij</B>
-
-<DD>
-radij tree manipulation code
-<DT><B>esp</B>
-
-<DD>
-encryptions transforms code
-<DT><B>ah</B>
-
-<DD>
-authentication transforms code
-<B>rcv</B>
-
-receive code
-<DT><B>ipcomp</B>
-
-<DD>
-ip compression transforms code
-<DT><B>verbose</B>
-
-<DD>
-give even more information, BEWARE:
-a)this will print authentication and encryption keys in the logs
-b)this will probably trample the 4k kernel printk buffer giving inaccurate output
-</DL>
-<P>
-
-All Klips debug output appears as
-<B>kernel.info</B>
-
-messages to
-<I><A HREF="syslogd.8.html">syslogd</A></I>(8).
-
-Most systems are set up
-to log these messages to
-<I>/var/log/messages</I>.
-
-Beware that
-<B>klipsdebug</B>
-
-<B>--all</B>
-
-produces a lot of output and the log file will grow quickly.
-<P>
-
-The file format for /proc/net/ipsec_klipsdebug is discussed in
-<A HREF="ipsec_klipsdebug.5.html">ipsec_klipsdebug</A>(5).
-<A NAME="lbAE">&nbsp;</A>
-<H2>EXAMPLES</H2>
-
-<DL COMPACT>
-<DT><B>klipsdebug --all</B>
-
-<DD>
-turns on all KLIPS debugging except verbose.
-<DT><B>klipsdebug --clear tunnel</B>
-
-<DD>
-turns off only the
-<B>tunnel</B>
-
-debugging messages.
-</DL>
-<P>
-
-<A NAME="lbAF">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/ipsec_klipsdebug, /usr/local/bin/ipsec
-<A NAME="lbAG">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A>(8), <A HREF="ipsec_eroute.8.html">ipsec_eroute</A>(8),
-<A HREF="ipsec_spi.8.html">ipsec_spi</A>(8), <A HREF="ipsec_spigrp.8.html">ipsec_spigrp</A>(8), <A HREF="ipsec_klipsdebug.5.html">ipsec_klipsdebug</A>(5)
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Richard Guy Briggs.
-<A NAME="lbAI">&nbsp;</A>
-<H2>BUGS</H2>
-
-It really ought to be possible to set or unset selective combinations
-of flags.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">EXAMPLES</A><DD>
-<DT><A HREF="#lbAF">FILES</A><DD>
-<DT><A HREF="#lbAG">SEE ALSO</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-<DT><A HREF="#lbAI">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_look.8.html b/doc/manpage.d/ipsec_look.8.html
deleted file mode 100644
index ffe07a57c..000000000
--- a/doc/manpage.d/ipsec_look.8.html
+++ /dev/null
@@ -1,76 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of look</TITLE>
-</HEAD><BODY>
-<H1>look</H1>
-Section: Maintenance Commands (8)<BR>Updated: 25 Apr 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec look - get a quick summary of FreeS/WAN status
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<I>look</I>
-
-is used to get a quick overview of what the status of FreeSWAN is.
-It is equivalent to:
-&nbsp;&nbsp;&nbsp;ipsec eroute
-<P>
-&nbsp;&nbsp;&nbsp;ipsec spigrp
-<P>
-&nbsp;&nbsp;&nbsp;ipsec tncfg
-<P>
-&nbsp;&nbsp;&nbsp;ipsec spi
-<P>
-&nbsp;&nbsp;&nbsp;netstat -rn
-<P>
-<P>
-
-However a bit of processing is done to combine the outputs.
-<A NAME="lbAD">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A>(8), <A HREF="ipsec_spi.8.html">ipsec_spi</A>(8), <A HREF="ipsec_spigrp.8.html">ipsec_spigrp</A>(8), <A HREF="ipsec_eroute.5.html">ipsec_eroute</A>(5),
-<A HREF="netstat.8.html">netstat</A>(8).
-<A NAME="lbAE">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Man page written for the Linux FreeS/WAN project &lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael Richardson. Original program written by Henry Spencer.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">SEE ALSO</A><DD>
-<DT><A HREF="#lbAE">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_loopbackaddr.3.html b/doc/manpage.d/ipsec_loopbackaddr.3.html
deleted file mode 100644
index 92f69d99c..000000000
--- a/doc/manpage.d/ipsec_loopbackaddr.3.html
+++ /dev/null
@@ -1,166 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 8 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec anyaddr - get &quot;any&quot; address
-<BR>
-
-ipsec isanyaddr - test address for equality to &quot;any&quot; address
-<BR>
-
-ipsec unspecaddr - get &quot;unspecified&quot; address
-<BR>
-
-ipsec isunspecaddr - test address for equality to &quot;unspecified&quot; address
-<BR>
-
-ipsec loopbackaddr - get loopback address
-<BR>
-
-ipsec isloopbackaddr - test address for equality to loopback address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *anyaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isanyaddr(const ip_address *src);</B>
-
-<BR>
-
-<B>const char *unspecaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isunspecaddr(const ip_address *src);</B>
-
-<BR>
-
-<B>const char *loopbackaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isloopbackaddr(const ip_address *src);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions fill in, and test for, special values of the
-<I>ip_address</I>
-
-type.
-<P>
-
-<I>Anyaddr</I>
-
-fills in the destination
-<I>*dst</I>
-
-with the ``any'' address of address family
-<I>af</I>
-
-(normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>).
-
-The IPv4 ``any'' address is the one embodied in the old
-<B>INADDR_ANY</B>
-
-macro.
-<P>
-
-<I>Isanyaddr</I>
-
-returns
-<B>1</B>
-
-if the
-<I>src</I>
-
-address equals the ``any'' address,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-Similarly,
-<I>unspecaddr</I>
-
-supplies, and
-<I>isunspecaddr</I>
-
-tests for,
-the ``unspecified'' address,
-which may be the same as the ``any'' address.
-<P>
-
-Similarly,
-<I>loopbackaddr</I>
-
-supplies, and
-<I>islookbackaddr</I>
-
-tests for,
-the loopback address.
-<P>
-
-<I>Anyaddr</I>,
-
-<I>unspecaddr</I>,
-
-and
-<I>loopbackaddr</I>
-
-return
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_addrtot.3.html">ipsec_addrtot</A>(3), <A HREF="ipsec_sameaddr.3.html">ipsec_sameaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in the address-supplying functions are:
-unknown address family.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_lwdnsq.8.html b/doc/manpage.d/ipsec_lwdnsq.8.html
deleted file mode 100644
index 1122b188a..000000000
--- a/doc/manpage.d/ipsec_lwdnsq.8.html
+++ /dev/null
@@ -1,400 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC LWDNSQ</TITLE>
-</HEAD><BODY>
-<H1>IPSEC LWDNSQ</H1>
-Section:  (8)<BR>Updated: <BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-lwdnsq - lookup items in DNS to help pluto (and others)
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<P>
-<PRE>
-<B>ipsec lwdnsq</B> lwdnsq [<B>--prompt</B>] [<B>--serial</B>]
-</PRE>
-
-<P>
-<PRE>
-<B>ipsec lwdnsq</B> lwdnsq [<B>--help</B>]
-</PRE>
-
-<P>
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<P>
-<P>
-
-The <B>ipsec lwdnsq</B> is a helper program that does DNS lookups for other programs. It implements an asynchronous interface on stdin/stdout, with an ASCII driven command language.
-<P>
-<P>
-
-If stdin is a tty or if the <B>--prompt</B> option is given, then it issues a prompt to the user. Otherwise, it is silent, except for results.
-<P>
-<P>
-
-The program will accept multiple queries concurrently, with each result being marked with the ID provided on the output. The IDs are strings.
-<P>
-<P>
-
-If the <B>--serial</B> option is given, then the program will not attempt to execute concurrent queries, but will serialize all input and output.
-<P>
-<A NAME="lbAE">&nbsp;</A>
-<H2>QUERY LANGUAGE</H2>
-
-<P>
-<P>
-
-There are eleven command that the program understands. This is to lookup different types of records in both the forward and reverse maps. Every query includes a queryid, which is returned in the output, on every single line to identify the transaction.
-<P>
-<A NAME="lbAF">&nbsp;</A>
-<H3>KEY queryid FQDN</H3>
-
-<P>
-<P>
-
-This request looks up the KEY resource record for the given <B>FQDN.</B>.
-<P>
-<A NAME="lbAG">&nbsp;</A>
-<H3>KEY4 queryid A.B.C.D</H3>
-
-<P>
-<P>
-
-This request looks up the KEY resource record found in the reverse map for the IP version 4 address <B>A.B.C.D</B>, i.e. it looks up D.C.B.A.in-addr.arpa.
-<P>
-<A NAME="lbAH">&nbsp;</A>
-<H3>KEY6 queryid A:B::C:D</H3>
-
-<P>
-<P>
-
-This request looks up the KEY resource record found in the reverse map for the IPv6 address <B>A:B::C:D</B>, i.e. it looks the 32-nibble long entry in ip6.arpa (and ip6.int).
-<P>
-<A NAME="lbAI">&nbsp;</A>
-<H3>TXT4 queryid A.B.C.D</H3>
-
-<P>
-<P>
-
-This request looks up the TXT resource record found in the reverse map for the IP version 4 address <B>A.B.C.D</B>, i.e. it looks up D.C.B.A.in-addr.arpa.
-<P>
-<A NAME="lbAJ">&nbsp;</A>
-<H3>TXT6 queryid A:B::C:D</H3>
-
-<P>
-<P>
-
-This request looks up the TXT resource record found in the reverse map for the IPv6 address <B>A:B::C:D</B>, i.e. it looks the 32-nibble long entry in ip6.arpa (and ip6.int).
-<P>
-<A NAME="lbAK">&nbsp;</A>
-<H3>KEY queryid FQDN</H3>
-
-<P>
-<P>
-
-This request looks up the IPSECKEY resource record for the given <B>FQDN.</B>. See note about IPSECKEY processing, below.
-<P>
-<A NAME="lbAL">&nbsp;</A>
-<H3>IPSECKEY4 queryid A.B.C.D</H3>
-
-<P>
-<P>
-
-This request looks up the IPSECKEY resource record found in the reverse map for the IP version 4 address <B>A.B.C.D</B>, i.e. it looks up D.C.B.A.in-addr.arpa. See special note about IPSECKEY processing, below.
-<P>
-<A NAME="lbAM">&nbsp;</A>
-<H3>IPSECKEY6 queryid A:B::C:D</H3>
-
-<P>
-<P>
-
-This request looks up the IPSECKEY resource record found in the reverse map for the IPv6 address <B>A:B::C:D</B>, i.e. it looks the 32-nibble long entry in ip6.arpa (and ip6.int). See special note about IPSECKEY processing, below.
-<P>
-<A NAME="lbAN">&nbsp;</A>
-<H3>OE4 queryid A.B.C.D</H3>
-
-<P>
-<P>
-
-This request looks an appropriate record for Opportunistic Encryption for the given IP address. This attempts to look for the delegation record. This may be one of IPSECKEY, KEY, or TXT record. Unless configured otherwise, (see OE4 Directives, below), then a query type of ANY will be used to retrieve all relevant records, and all will be returned.
-<P>
-<A NAME="lbAO">&nbsp;</A>
-<H3>OE6 queryid A:B::C:D</H3>
-
-<P>
-<P>
-
-This request looks an appropriate record for Opportunistic Encryption for the given IPv6 address. This attempts to look for the delegation record. This may be one of IPSECKEY, KEY, or TXT record. Unless configured otherwise, (see OE Directives, below), then a query type of ALL will be used to retrieve all relevant records, and all will be returned. i.e. it looks the 32-nibble long entry in ip6.arpa (and ip6.int).
-<P>
-<A NAME="lbAP">&nbsp;</A>
-<H3>A queryid FQDN</H3>
-
-<P>
-<P>
-
-This request looks up the A (IPv4) resource record for the given <B>FQDN.</B>.
-<P>
-<A NAME="lbAQ">&nbsp;</A>
-<H3>AAAA queryid FQDN</H3>
-
-<P>
-<P>
-
-This request looks up the AAAA (IPv6) resource record for the given <B>FQDN.</B>.
-<P>
-<A NAME="lbAR">&nbsp;</A>
-<H2>REPLIES TO QUERIES</H2>
-
-<P>
-<P>
-
-All replies from the queries are in the following format: 
-<P>
-<PRE>
-
-&lt;ID&gt; &lt;TIME&gt; &lt;TTL&gt; &lt;TYPE&gt; &lt;TYPE-SPECIFIC&gt; \n
-
-</PRE>
-
-<BR>&nbsp;&nbsp;
-<P>
-<DL COMPACT>
-<DT><I>ID</I><DD>
-this is the <B>queryid</B> value that was provided in the query. It is repeated on every line to permit the replies to be properly associated with the query. When the response is not ascribable to particular query (such as for a mis-formed query), then the query ID &quot;0&quot; will be used.
-<P>
-<DT><I>TIME</I><DD>
-this is the current time in seconds since epoch.
-<P>
-<DT><I>TTL</I><DD>
-for answers which have a time to live, this is the current value. The answer is valid for this number of seconds. If there is no useful value here, then the number 0 is used.
-<P>
-<DT><I>TYPE</I><DD>
-This is the type of the record that is being returned. The types are described in the next section. The TYPE specific data that follows is specific to the type.
-<BR>&nbsp;
-<P>
-</DL>
-<P>
-
-The replies are limited to 4096 bytes, a value defined as <B>LWDNSQ_RESULT_LEN_MAX</B>. This is defined in <I>freeswan.h</I>.
-<P>
-<P>
-
-All of the replies which include resource records use the standard presentation format (with no line feeds or carriage returns) in their answer.
-<P>
-<A NAME="lbAS">&nbsp;</A>
-<H3>START</H3>
-
-<P>
-<P>
-
-This reply indicates that a query has been received and has been started. It serves as an anchor point for timing, as well as an acknowledgement.
-<P>
-<A NAME="lbAT">&nbsp;</A>
-<H3>DONE</H3>
-
-<P>
-<P>
-
-This reply indicates that a query is entirely over, and no further information from this query will be sent.
-<P>
-<A NAME="lbAU">&nbsp;</A>
-<H3>RETRY</H3>
-
-<P>
-<P>
-
-This reply indicates that a query is entirely over, but that no data was found. The records may exist, but appropriate servers could not be reached.
-<P>
-<A NAME="lbAV">&nbsp;</A>
-<H3>FATAL</H3>
-
-<P>
-<P>
-
-This reply indicates that a query is entirely over, and that no data of the type requested could be found. There were no timeouts, and all servers were available and confirmed non-existances. There may be NXT records returned prior to this.
-<P>
-<A NAME="lbAW">&nbsp;</A>
-<H3>CNAME</H3>
-
-<P>
-<P>
-
-This is an interim reply, and indicates that a CNAME was found (and followed) while performing the query. The value of the CNAME is present in the type specific section.
-<P>
-<A NAME="lbAX">&nbsp;</A>
-<H3>CNAMEFROM</H3>
-
-<P>
-<P>
-
-This is an interim reply, and indicates that a CNAME was found. The original name that was queries for was not the canonical name, and this reply indicates the name that was actually followed.
-<P>
-<A NAME="lbAY">&nbsp;</A>
-<H3>NAME</H3>
-
-<P>
-<P>
-
-This is an interim reply. The original name that was queries for was not the canonical name. This reply indicates the canonical name.
-<P>
-<A NAME="lbAZ">&nbsp;</A>
-<H3>DNSSEC</H3>
-
-<P>
-<P>
-
-This is an interim reply. It is followed either by &quot;OKAY&quot; or &quot;not present. It indicates if DNSSEC was available on the reply.
-<P>
-<A NAME="lbBA">&nbsp;</A>
-<H3>TXT and AD-TXT</H3>
-
-<P>
-<P>
-
-This is an interim reply. If there are TXT resource records in the reply, then each one is presented using this type. If preceeded by AD-, then this record was signed with DNSSEC.
-<P>
-<A NAME="lbBB">&nbsp;</A>
-<H3>A and AD-A</H3>
-
-<P>
-<P>
-
-This is an interim reply. If there are A resource records in the reply, then each one is presented using this type. If preceeded by AD-, then this record was signed with DNSSEC.
-<P>
-<A NAME="lbBC">&nbsp;</A>
-<H3>AAAA and AD-AAAA</H3>
-
-<P>
-<P>
-
-This is an interim reply. If there are AAAA resource records in the reply, then each one is presented using this type. If preceeded by AD-, then this record was signed with DNSSEC.
-<P>
-<A NAME="lbBD">&nbsp;</A>
-<H3>PTR and AD-PTR</H3>
-
-<P>
-<P>
-
-This is an interim reply. If there are PTR resource records in the reply, then each one is presented using this type. If preceeded by AD-, then this record was signed with DNSSEC.
-<P>
-<A NAME="lbBE">&nbsp;</A>
-<H3>KEY and AD-KEY</H3>
-
-<P>
-<P>
-
-This is an interim reply. If there are KEY resource records in the reply, then each one is presented using this type. If preceeded by AD-, then this record was signed with DNSSEC.
-<P>
-<A NAME="lbBF">&nbsp;</A>
-<H3>IPSECKEY and AD-IPSECKEY</H3>
-
-<P>
-<P>
-
-This is an interim reply. If there are IPSEC resource records in the reply, then each one is presented using this type. If preceeded by AD-, then this record was signed with DNSSEC.
-<P>
-<A NAME="lbBG">&nbsp;</A>
-<H2>SPECIAL IPSECKEY PROCESSING</H2>
-
-<P>
-<P>
-
-At the time of this writing, the IPSECKEY resource record is not entirely specified. In particular no resource record number has been assigned. This program assumes that it is resource record number 45. If the file /etc/ipsec.d/lwdnsq.conf exists, and contains a line like 
-<P>
-<PRE>
-
-ipseckey_rr=<B>number</B>
-
-</PRE>
-
-<BR>&nbsp;then&nbsp;this&nbsp;number&nbsp;will&nbsp;be&nbsp;used&nbsp;instead.&nbsp;The&nbsp;file&nbsp;is&nbsp;read&nbsp;only&nbsp;once&nbsp;at&nbsp;startup.
-<P>
-<A NAME="lbBH">&nbsp;</A>
-<H2>OE DIRECTIVES</H2>
-
-<P>
-<P>
-
-If the file /etc/ipsec.d/lwdnsq.conf exists, and contains a line like 
-<P>
-<PRE>
-
-queryany=false
-
-</PRE>
-
-<BR>&nbsp;then&nbsp;instead&nbsp;of&nbsp;doing&nbsp;an&nbsp;ALL&nbsp;query&nbsp;when&nbsp;looking&nbsp;for&nbsp;OE&nbsp;delegation&nbsp;records,&nbsp;lwdnsq&nbsp;will&nbsp;do&nbsp;a&nbsp;series&nbsp;of&nbsp;queries.&nbsp;It&nbsp;will&nbsp;first&nbsp;look&nbsp;for&nbsp;IPSECKEY,&nbsp;and&nbsp;then&nbsp;TXT&nbsp;record.&nbsp;If&nbsp;it&nbsp;finds&nbsp;neither,&nbsp;it&nbsp;will&nbsp;then&nbsp;look&nbsp;for&nbsp;KEY&nbsp;records&nbsp;of&nbsp;all&nbsp;kinds,&nbsp;although&nbsp;they&nbsp;do&nbsp;not&nbsp;contain&nbsp;delegation&nbsp;information.
-<P>
-<A NAME="lbBI">&nbsp;</A>
-<H2>SPECIAL IPSECKEY PROCESSING</H2>
-
-<P>
-<PRE>
-
-/etc/ipsec.d/lwdnsq.conf
-
-</PRE>
-
-<P>
-<A NAME="lbBJ">&nbsp;</A>
-<H2>AUTHOR</H2>
-
-Michael Richardson &lt;<A HREF="mailto:mcr@sandelman.ottawa.on.ca">mcr@sandelman.ottawa.on.ca</A>&gt;.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">QUERY LANGUAGE</A><DD>
-<DL>
-<DT><A HREF="#lbAF">KEY queryid FQDN</A><DD>
-<DT><A HREF="#lbAG">KEY4 queryid A.B.C.D</A><DD>
-<DT><A HREF="#lbAH">KEY6 queryid A:B::C:D</A><DD>
-<DT><A HREF="#lbAI">TXT4 queryid A.B.C.D</A><DD>
-<DT><A HREF="#lbAJ">TXT6 queryid A:B::C:D</A><DD>
-<DT><A HREF="#lbAK">KEY queryid FQDN</A><DD>
-<DT><A HREF="#lbAL">IPSECKEY4 queryid A.B.C.D</A><DD>
-<DT><A HREF="#lbAM">IPSECKEY6 queryid A:B::C:D</A><DD>
-<DT><A HREF="#lbAN">OE4 queryid A.B.C.D</A><DD>
-<DT><A HREF="#lbAO">OE6 queryid A:B::C:D</A><DD>
-<DT><A HREF="#lbAP">A queryid FQDN</A><DD>
-<DT><A HREF="#lbAQ">AAAA queryid FQDN</A><DD>
-</DL>
-<DT><A HREF="#lbAR">REPLIES TO QUERIES</A><DD>
-<DL>
-<DT><A HREF="#lbAS">START</A><DD>
-<DT><A HREF="#lbAT">DONE</A><DD>
-<DT><A HREF="#lbAU">RETRY</A><DD>
-<DT><A HREF="#lbAV">FATAL</A><DD>
-<DT><A HREF="#lbAW">CNAME</A><DD>
-<DT><A HREF="#lbAX">CNAMEFROM</A><DD>
-<DT><A HREF="#lbAY">NAME</A><DD>
-<DT><A HREF="#lbAZ">DNSSEC</A><DD>
-<DT><A HREF="#lbBA">TXT and AD-TXT</A><DD>
-<DT><A HREF="#lbBB">A and AD-A</A><DD>
-<DT><A HREF="#lbBC">AAAA and AD-AAAA</A><DD>
-<DT><A HREF="#lbBD">PTR and AD-PTR</A><DD>
-<DT><A HREF="#lbBE">KEY and AD-KEY</A><DD>
-<DT><A HREF="#lbBF">IPSECKEY and AD-IPSECKEY</A><DD>
-</DL>
-<DT><A HREF="#lbBG">SPECIAL IPSECKEY PROCESSING</A><DD>
-<DT><A HREF="#lbBH">OE DIRECTIVES</A><DD>
-<DT><A HREF="#lbBI">SPECIAL IPSECKEY PROCESSING</A><DD>
-<DT><A HREF="#lbBJ">AUTHOR</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_mailkey.8.html b/doc/manpage.d/ipsec_mailkey.8.html
deleted file mode 100644
index 83a532563..000000000
--- a/doc/manpage.d/ipsec_mailkey.8.html
+++ /dev/null
@@ -1,97 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_MAILKEY</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_MAILKEY</H1>
-Section: Maintenance Commands (8)<BR>Updated: 21 Feb 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec mailkey - mail DNS records for Opportunistic Encryption
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>mailkey</B>
-
---me
-<A HREF="mailto:my@address.tld">my@address.tld</A>
-[
-<B>--reverse</B>
-
-1.2.3.4
-] [
-<B>--forward</B>
-
-hostname.domain.tld
-]
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>mailkey</I>
-
-is a meta-program. It generates a script which will attempt to mail the TXT 
-records required to enable Opportunistic Encryption (OE).
-<P>
-
-An e-mail address for the domain's DNS administrator is derived from SOA records. 
-The mail body and destination address are freely editable in the script.
-<P>
-
-If no administrator can be located, the output file will not be executable.
-<P>
-
-<DL COMPACT>
-<DT><B>--me</B>&nbsp;<I><A HREF="mailto:my@address.tld">my@address.tld</A></I><DD>
-set the Reply-To: address of the mail to be sent.
-<DT><B>--forward</B>&nbsp;<I>hostname.domain.tld</I><DD>
-the domain name to be used for initator-only OE.  
-<DT><B>--reverse</B>&nbsp;<I>1.2.3.4</I><DD>
-the IP address to be used for full Opportunistic Encryption.
-</DL>
-<P>
-
-Only one of --forward or --reverse may be specified.
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-<PRE>
-/etc/ipsec.secrets
-</PRE>
-
-<A NAME="lbAF">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec_showhostkey.8.html">ipsec_showhostkey</A>(8), <A HREF="host.8.html">host</A>(8)
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project &lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt; by Sam Sgro.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-May produce indeterminate results when processing non-routable IPs.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">SEE ALSO</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_manual.8.html b/doc/manpage.d/ipsec_manual.8.html
deleted file mode 100644
index 77134f7d0..000000000
--- a/doc/manpage.d/ipsec_manual.8.html
+++ /dev/null
@@ -1,414 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_MANUAL</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_MANUAL</H1>
-Section: Maintenance Commands (8)<BR>Updated: 17 July 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec manual - take manually-keyed IPsec connections up and down
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>manual</B>
-
-[
-<B>--show</B>
-
-] [
-<B>--showonly</B>
-
-] [
-<B>--other</B>
-
-]
-<BR>
-
-&nbsp;&nbsp;&nbsp;[
-<B>--iam</B>
-
-address<B>@</B>interface
-
-] [
-<B>--config</B>
-
-configfile
-]
-<BR>
-
-&nbsp;&nbsp;&nbsp;operation connection
-<P>
-<B>ipsec</B>
-
-<B>manual</B>
-
-[
-<I>options</I>
-
-]
-<B>--union</B>
-
-operation part ...
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Manual</I>
-
-manipulates manually-keyed FreeS/WAN IPsec connections,
-setting them up and shutting them down,
-based on the information in the IPsec configuration file.
-In the normal usage,
-<I>connection</I>
-
-is the name of a connection specification in the configuration file;
-<I>operation</I>
-
-is
-<B>--up</B>,
-
-<B>--down</B>,
-
-<B>--route</B>,
-
-or
-<B>--unroute</B>.
-
-<I>Manual</I>
-
-generates setup (<B>--route</B>
-
-or
-<B>--up</B>)
-
-or
-teardown (<B>--down</B>
-
-or
-<B>--unroute</B>)
-
-commands for the connection and feeds them to a shell for execution.
-<P>
-
-The
-<B>--up</B>
-
-operation brings the specified connection up, including establishing a
-suitable route for it if necessary.
-<P>
-
-The
-<B>--route</B>
-
-operation just establishes the route for a connection.
-Unless and until an
-<B>--up</B>
-
-operation is done, packets routed by that route will simply be discarded.
-<P>
-
-The
-<B>--down</B>
-
-operation tears the specified connection down,
-<I>except</I>
-
-that it leaves the route in place.
-Unless and until an
-<B>--unroute</B>
-
-operation is done, packets routed by that route will simply be discarded.
-This permits establishing another connection to the same destination
-without any ``window'' in which packets can pass without encryption.
-<P>
-
-The
-<B>--unroute</B>
-
-operation (and only the
-<B>--unroute</B>
-
-operation) deletes any route established for a connection.
-<P>
-
-In the
-<B>--union</B>
-
-usage, each
-<I>part</I>
-
-is the name of a partial connection specification in the configuration file,
-and the union of all the partial specifications is the
-connection specification used.
-The effect is as if the contents of the partial specifications were
-concatenated together;
-restrictions on duplicate parameters, etc., do apply to the result.
-(The same effect can now be had, more gracefully, using the
-<B>also</B>
-
-parameter in connection descriptions;
-see
-<I><A HREF="ipsec.conf.5.html">ipsec.conf</A></I>(5)
-
-for details.)
-<P>
-
-The
-<B>--show</B>
-
-option turns on the
-<B>-x</B>
-
-option of the shell used to execute the commands,
-so each command is shown as it is executed.
-<P>
-
-The
-<B>--showonly</B>
-
-option causes
-<I>manual</I>
-
-to show the commands it would run, on standard output,
-and not run them.
-<P>
-
-The
-<B>--other</B>
-
-option causes
-<I>manual</I>
-
-to pretend it is the other end of the connection.
-This is probably not useful except in combination with
-<B>--showonly</B>.
-
-<P>
-
-The
-<B>--iam</B>
-
-option causes
-<I>manual</I>
-
-to believe it is running on the host with the specified IP
-<I>address</I>,
-
-and that it should use the specified
-<I>interface</I>
-
-(normally it determines all this automatically,
-based on what IPsec interfaces are up and how they are configured).
-<P>
-
-The
-<B>--config</B>
-
-option specifies a non-standard location for the FreeS/WAN IPsec
-configuration file (default
-<I>/etc/ipsec.conf</I>).
-
-<P>
-
-See
-<I><A HREF="ipsec.conf.5.html">ipsec.conf</A></I>(5)
-
-for details of the configuration file.
-Apart from the basic parameters which specify the endpoints and routing
-of a connection (<B>left</B>
-and
-<B>right</B>,
-
-plus possibly
-<B>leftsubnet</B>,
-
-<B>leftnexthop</B>,
-
-<B>leftfirewall</B>,
-
-their
-<B>right</B>
-
-equivalents,
-and perhaps
-<B>type</B>),
-
-a non-<B>passthrough</B>
-<I>manual</I>
-
-connection needs an
-<B>spi</B>
-
-or
-<B>spibase</B>
-
-parameter and some parameters specifying encryption, authentication, or
-both, most simply
-<B>esp</B>,
-
-<B>espenckey</B>,
-
-and
-<B>espauthkey</B>.
-
-Moderately-secure keys can be obtained from
-<I><A HREF="ipsec_ranbits.8.html">ipsec_ranbits</A></I>(8).
-
-For production use of manually-keyed connections,
-it is strongly recommended that the keys be kept in a separate file
-(with permissions
-<B>rw-------</B>)
-
-using the
-<B>include</B>
-
-and
-<B>also</B>
-
-facilities of the configuration file (see
-<I><A HREF="ipsec.conf.5.html">ipsec.conf</A></I>(5)).
-
-<P>
-
-If an
-<B>spi</B>
-
-parameter is given,
-<I>manual</I>
-
-uses that value as the SPI number for all the SAs
-(which are in separate number spaces anyway).
-If an
-<B>spibase</B>
-
-parameter is given instead,
-<I>manual</I>
-
-assigns SPI values by altering the bottom digit
-of that value;
-SAs going from left to right get even digits starting at 0,
-SAs going from right to left get odd digits starting at 1.
-Either way, it is suggested that manually-keyed connections use
-three-digit SPIs with the first digit non-zero,
-i.e. in the range
-<B>0x100</B>
-
-through
-<B>0xfff</B>;
-
-FreeS/WAN reserves those for manual keying and will not
-attempt to use them for automatic keying (unless requested to,
-presumably by a non-FreeS/WAN other end).
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-
-
-/etc/ipsec.conf<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>default IPsec configuration file<BR>
-<BR>
-
-/var/run/ipsec.info<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT><B>%defaultroute</B> information<BR>
-<A NAME="lbAF">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec.conf.5.html">ipsec.conf</A>(5), <A HREF="ipsec_spi.8.html">ipsec_spi</A>(8), <A HREF="ipsec_eroute.8.html">ipsec_eroute</A>(8), <A HREF="ipsec_spigrp.8.html">ipsec_spigrp</A>(8),
-<A HREF="route.8.html">route</A>(8)
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-It's not nearly as generous about the syntax of subnets,
-addresses, etc. as the usual FreeS/WAN user interfaces.
-Four-component dotted-decimal must be used for all addresses.
-It
-<I>is</I>
-
-smart enough to translate bit-count netmasks to dotted-decimal form.
-<P>
-
-If the connection specification for a connection is changed between an
-<B>--up</B>
-
-and the ensuing
-<B>--down</B>,
-
-chaos may ensue.
-<P>
-
-The
-<B>--up</B>
-
-operation is not smart enough to notice whether the connection is already up.
-<P>
-
-<I>Manual</I>
-
-is not smart enough to reject insecure combinations of algorithms,
-e.g. encryption with no authentication at all.
-<P>
-
-Any non-IPsec route to the other end which is replaced by the
-<B>--up</B>
-
-or
-<B>--route</B>
-
-operation will not be re-established by
-<B>--unroute</B>.
-
-Whether this is a feature or a bug depends on your viewpoint.
-<P>
-
-The optional parameters which
-override the automatic
-<B>spibase</B>-based
-
-SPI assignment are a messy area of the code and bugs are likely.
-<P>
-
-``Road warrior'' handling,
-and other special forms of setup which
-require negotiation between the two security gateways,
-inherently cannot be done with
-<I>manual</I>.
-
-<P>
-
-<I>Manual</I>
-
-generally lags behind
-<I>auto</I>
-
-in support of various features,
-even when implementation <I>would</I> be possible.
-For example, currently it does not do IPComp content compression.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">SEE ALSO</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_maskof.3.html b/doc/manpage.d/ipsec_maskof.3.html
deleted file mode 100644
index ea0f83f82..000000000
--- a/doc/manpage.d/ipsec_maskof.3.html
+++ /dev/null
@@ -1,238 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_INITSUBNET</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_INITSUBNET</H1>
-Section: C Library Functions (3)<BR>Updated: 12 March 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec initsubnet - initialize an ip_subnet
-<BR>
-
-ipsec addrtosubnet - initialize a singleton ip_subnet
-<BR>
-
-ipsec subnettypeof - get address type of an ip_subnet
-<BR>
-
-ipsec masktocount - convert subnet mask to bit count
-<BR>
-
-ipsec networkof - get base address of an ip_subnet
-<BR>
-
-ipsec maskof - get subnet mask of an ip_subnet
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *initsubnet(const ip_address *addr,</B>
-
-<BR>
-&nbsp;
-<B>int maskbits, int clash, ip_subnet *dst);</B>
-
-<BR>
-
-<B>const char *addrtosubnet(const ip_address *addr,</B>
-
-<BR>
-&nbsp;
-<B>ip_subnet *dst);</B>
-
-<P>
-<B>int subnettypeof(const ip_subnet *src);</B>
-
-<BR>
-
-<B>int masktocount(const ip_address *src);</B>
-
-<BR>
-
-<B>void networkof(const ip_subnet *src, ip_address *dst);</B>
-
-<BR>
-
-<B>void maskof(const ip_subnet *src, ip_address *dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-library uses an internal type
-<I>ip_subnet</I>
-
-to contain a description of an IP subnet
-(base address plus mask).
-These functions provide basic tools for creating and examining this type.
-<P>
-
-<I>Initsubnet</I>
-
-initializes a variable
-<I>*dst</I>
-
-of type
-<I>ip_subnet</I>
-
-from a base address and
-a count of mask bits.
-The
-<I>clash</I>
-
-parameter specifies what to do if the base address includes
-<B>1</B>
-
-bits outside the prefix specified by the mask
-(that is, in the ``host number'' part of the address):
-<DL COMPACT><DT><DD>
-<DL COMPACT>
-<DT>'0'<DD>
-zero out host-number bits
-<DT>'x'<DD>
-non-zero host-number bits are an error
-</DL>
-</DL>
-
-<P>
-
-<I>Initsubnet</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<P>
-
-<I>Addrtosubnet</I>
-
-initializes an
-<I>ip_subnet</I>
-
-variable
-<I>*dst</I>
-
-to a ``singleton subnet'' containing the single address
-<I>*addr</I>.
-
-It returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure.
-<P>
-
-<I>Subnettypeof</I>
-
-returns the address type of a subnet,
-normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-(The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file arranges to include the necessary headers for these
-names to be known.)
-<P>
-
-<I>Masktocount</I>
-
-converts a subnet mask, expressed as an address, to a bit count
-suitable for use with
-<I>initsubnet</I>.
-
-It returns
-<B>-1</B>
-
-for error; see DIAGNOSTICS.
-<P>
-
-<I>Networkof</I>
-
-fills in
-<I>*dst</I>
-
-with the base address of subnet
-<I>src</I>.
-
-<P>
-
-<I>Maskof</I>
-
-fills in
-<I>*dst</I>
-
-with the subnet mask of subnet
-<I>src</I>,
-
-expressed as an address.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_ttosubnet.3.html">ipsec_ttosubnet</A>(3), <A HREF="ipsec_rangetosubnet.3.html">ipsec_rangetosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>initsubnet</I>
-
-are:
-unknown address family;
-unknown
-<I>clash</I>
-
-value;
-impossible mask bit count;
-non-zero host-number bits and
-<I>clash</I>
-
-is
-<B>'x'</B>.
-
-Fatal errors in
-<I>addrtosubnet</I>
-
-are:
-unknown address family.
-Fatal errors in
-<I>masktocount</I>
-
-are:
-unknown address family;
-mask bits not contiguous.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_masktobits.3.html b/doc/manpage.d/ipsec_masktobits.3.html
deleted file mode 100644
index 6eccdd8d5..000000000
--- a/doc/manpage.d/ipsec_masktobits.3.html
+++ /dev/null
@@ -1,122 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_GOODMASK</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_GOODMASK</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec goodmask - is this Internet subnet mask a valid one?
-<BR>
-
-ipsec masktobits - convert Internet subnet mask to bit count
-<BR>
-
-ipsec bitstomask - convert bit count to Internet subnet mask
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int goodmask(struct in_addr mask);</B>
-
-<BR>
-
-<B>int masktobits(struct in_addr mask);</B>
-
-<BR>
-
-<B>struct in_addr bitstomask(int n);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete;
-see
-<I><A HREF="ipsec_masktocount.3.html">ipsec_masktocount</A></I>(3)
-
-for a partial replacement.
-<P>
-
-<I>Goodmask</I>
-
-reports whether the subnet
-<I>mask</I>
-
-is a valid one,
-i.e. consists of a (possibly empty) sequence of
-<B>1</B>s
-
-followed by a (possibly empty) sequence of
-<B>0</B>s.
-
-<I>Masktobits</I>
-
-takes a (valid) subnet mask and returns the number of
-<B>1</B>
-
-bits in it.
-<I>Bitstomask</I>
-
-reverses this,
-returning the subnet mask corresponding to bit count
-<I>n</I>.
-
-<P>
-
-All masks are in network byte order.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-<I>Masktobits</I>
-
-returns
-<B>-1</B>
-
-for an invalid mask.
-<I>Bitstomask</I>
-
-returns an all-zeros mask for a negative or out-of-range
-<I>n</I>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The error-reporting convention of
-<I>bitstomask</I>
-
-is less than ideal;
-zero is sometimes a legitimate mask.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_masktocount.3.html b/doc/manpage.d/ipsec_masktocount.3.html
deleted file mode 100644
index ea0f83f82..000000000
--- a/doc/manpage.d/ipsec_masktocount.3.html
+++ /dev/null
@@ -1,238 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_INITSUBNET</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_INITSUBNET</H1>
-Section: C Library Functions (3)<BR>Updated: 12 March 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec initsubnet - initialize an ip_subnet
-<BR>
-
-ipsec addrtosubnet - initialize a singleton ip_subnet
-<BR>
-
-ipsec subnettypeof - get address type of an ip_subnet
-<BR>
-
-ipsec masktocount - convert subnet mask to bit count
-<BR>
-
-ipsec networkof - get base address of an ip_subnet
-<BR>
-
-ipsec maskof - get subnet mask of an ip_subnet
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *initsubnet(const ip_address *addr,</B>
-
-<BR>
-&nbsp;
-<B>int maskbits, int clash, ip_subnet *dst);</B>
-
-<BR>
-
-<B>const char *addrtosubnet(const ip_address *addr,</B>
-
-<BR>
-&nbsp;
-<B>ip_subnet *dst);</B>
-
-<P>
-<B>int subnettypeof(const ip_subnet *src);</B>
-
-<BR>
-
-<B>int masktocount(const ip_address *src);</B>
-
-<BR>
-
-<B>void networkof(const ip_subnet *src, ip_address *dst);</B>
-
-<BR>
-
-<B>void maskof(const ip_subnet *src, ip_address *dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-library uses an internal type
-<I>ip_subnet</I>
-
-to contain a description of an IP subnet
-(base address plus mask).
-These functions provide basic tools for creating and examining this type.
-<P>
-
-<I>Initsubnet</I>
-
-initializes a variable
-<I>*dst</I>
-
-of type
-<I>ip_subnet</I>
-
-from a base address and
-a count of mask bits.
-The
-<I>clash</I>
-
-parameter specifies what to do if the base address includes
-<B>1</B>
-
-bits outside the prefix specified by the mask
-(that is, in the ``host number'' part of the address):
-<DL COMPACT><DT><DD>
-<DL COMPACT>
-<DT>'0'<DD>
-zero out host-number bits
-<DT>'x'<DD>
-non-zero host-number bits are an error
-</DL>
-</DL>
-
-<P>
-
-<I>Initsubnet</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<P>
-
-<I>Addrtosubnet</I>
-
-initializes an
-<I>ip_subnet</I>
-
-variable
-<I>*dst</I>
-
-to a ``singleton subnet'' containing the single address
-<I>*addr</I>.
-
-It returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure.
-<P>
-
-<I>Subnettypeof</I>
-
-returns the address type of a subnet,
-normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-(The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file arranges to include the necessary headers for these
-names to be known.)
-<P>
-
-<I>Masktocount</I>
-
-converts a subnet mask, expressed as an address, to a bit count
-suitable for use with
-<I>initsubnet</I>.
-
-It returns
-<B>-1</B>
-
-for error; see DIAGNOSTICS.
-<P>
-
-<I>Networkof</I>
-
-fills in
-<I>*dst</I>
-
-with the base address of subnet
-<I>src</I>.
-
-<P>
-
-<I>Maskof</I>
-
-fills in
-<I>*dst</I>
-
-with the subnet mask of subnet
-<I>src</I>,
-
-expressed as an address.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_ttosubnet.3.html">ipsec_ttosubnet</A>(3), <A HREF="ipsec_rangetosubnet.3.html">ipsec_rangetosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>initsubnet</I>
-
-are:
-unknown address family;
-unknown
-<I>clash</I>
-
-value;
-impossible mask bit count;
-non-zero host-number bits and
-<I>clash</I>
-
-is
-<B>'x'</B>.
-
-Fatal errors in
-<I>addrtosubnet</I>
-
-are:
-unknown address family.
-Fatal errors in
-<I>masktocount</I>
-
-are:
-unknown address family;
-mask bits not contiguous.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_networkof.3.html b/doc/manpage.d/ipsec_networkof.3.html
deleted file mode 100644
index ea0f83f82..000000000
--- a/doc/manpage.d/ipsec_networkof.3.html
+++ /dev/null
@@ -1,238 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_INITSUBNET</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_INITSUBNET</H1>
-Section: C Library Functions (3)<BR>Updated: 12 March 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec initsubnet - initialize an ip_subnet
-<BR>
-
-ipsec addrtosubnet - initialize a singleton ip_subnet
-<BR>
-
-ipsec subnettypeof - get address type of an ip_subnet
-<BR>
-
-ipsec masktocount - convert subnet mask to bit count
-<BR>
-
-ipsec networkof - get base address of an ip_subnet
-<BR>
-
-ipsec maskof - get subnet mask of an ip_subnet
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *initsubnet(const ip_address *addr,</B>
-
-<BR>
-&nbsp;
-<B>int maskbits, int clash, ip_subnet *dst);</B>
-
-<BR>
-
-<B>const char *addrtosubnet(const ip_address *addr,</B>
-
-<BR>
-&nbsp;
-<B>ip_subnet *dst);</B>
-
-<P>
-<B>int subnettypeof(const ip_subnet *src);</B>
-
-<BR>
-
-<B>int masktocount(const ip_address *src);</B>
-
-<BR>
-
-<B>void networkof(const ip_subnet *src, ip_address *dst);</B>
-
-<BR>
-
-<B>void maskof(const ip_subnet *src, ip_address *dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-library uses an internal type
-<I>ip_subnet</I>
-
-to contain a description of an IP subnet
-(base address plus mask).
-These functions provide basic tools for creating and examining this type.
-<P>
-
-<I>Initsubnet</I>
-
-initializes a variable
-<I>*dst</I>
-
-of type
-<I>ip_subnet</I>
-
-from a base address and
-a count of mask bits.
-The
-<I>clash</I>
-
-parameter specifies what to do if the base address includes
-<B>1</B>
-
-bits outside the prefix specified by the mask
-(that is, in the ``host number'' part of the address):
-<DL COMPACT><DT><DD>
-<DL COMPACT>
-<DT>'0'<DD>
-zero out host-number bits
-<DT>'x'<DD>
-non-zero host-number bits are an error
-</DL>
-</DL>
-
-<P>
-
-<I>Initsubnet</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<P>
-
-<I>Addrtosubnet</I>
-
-initializes an
-<I>ip_subnet</I>
-
-variable
-<I>*dst</I>
-
-to a ``singleton subnet'' containing the single address
-<I>*addr</I>.
-
-It returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure.
-<P>
-
-<I>Subnettypeof</I>
-
-returns the address type of a subnet,
-normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-(The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file arranges to include the necessary headers for these
-names to be known.)
-<P>
-
-<I>Masktocount</I>
-
-converts a subnet mask, expressed as an address, to a bit count
-suitable for use with
-<I>initsubnet</I>.
-
-It returns
-<B>-1</B>
-
-for error; see DIAGNOSTICS.
-<P>
-
-<I>Networkof</I>
-
-fills in
-<I>*dst</I>
-
-with the base address of subnet
-<I>src</I>.
-
-<P>
-
-<I>Maskof</I>
-
-fills in
-<I>*dst</I>
-
-with the subnet mask of subnet
-<I>src</I>,
-
-expressed as an address.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_ttosubnet.3.html">ipsec_ttosubnet</A>(3), <A HREF="ipsec_rangetosubnet.3.html">ipsec_rangetosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>initsubnet</I>
-
-are:
-unknown address family;
-unknown
-<I>clash</I>
-
-value;
-impossible mask bit count;
-non-zero host-number bits and
-<I>clash</I>
-
-is
-<B>'x'</B>.
-
-Fatal errors in
-<I>addrtosubnet</I>
-
-are:
-unknown address family.
-Fatal errors in
-<I>masktocount</I>
-
-are:
-unknown address family;
-mask bits not contiguous.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_newhostkey.8.html b/doc/manpage.d/ipsec_newhostkey.8.html
deleted file mode 100644
index e6cf302bf..000000000
--- a/doc/manpage.d/ipsec_newhostkey.8.html
+++ /dev/null
@@ -1,196 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_NEWHOSTKEY</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_NEWHOSTKEY</H1>
-Section: Maintenance Commands (8)<BR>Updated: 4 March 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec newhostkey - generate a new host authentication key
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>newhostkey</B>
-
-<B>--output</B>
-
-filename
-[
-<B>--quiet</B>
-
-]
-<B>\</B>
-
-<BR>
-
-
-[
-<B>--bits</B>
-
-n
-]
-[
-<B>--hostname</B>
-
-host
-]
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Newhostkey</I>
-
-outputs (into
-<I>filename</I>,
-
-which can be `<B>-</B>' for standard output)
-an RSA private key suitable for this host,
-in
-<I>/etc/ipsec.secrets</I>
-
-format
-(see
-<I><A HREF="ipsec.secrets.5.html">ipsec.secrets</A></I>(5)).
-
-Normally,
-<I>newhostkey</I>
-
-invokes
-<I>rsasigkey</I>
-
-(see
-<I><A HREF="ipsec_rsasigkey.8.html">ipsec_rsasigkey</A></I>(8))
-
-with the
-<B>--verbose</B>
-
-option, so a narrative of what is being done appears on standard error.
-<P>
-
-The
-<B>--output</B>
-
-specifier, although it is syntactically an option and can appear at
-any point among the options (it doesn't have to be first),
-is not optional.
-The specified
-<I>filename</I>
-
-is created under umask
-<B>077</B>
-
-if nonexistent;
-if it already exists and is non-empty,
-a warning message about that is sent to standard error,
-and the output is appended to the file.
-<P>
-
-The
-<B>--quiet</B>
-
-option suppresses both the
-<I>rsasigkey</I>
-
-narrative and the existing-file warning message.
-<P>
-
-The
-<B>--bits</B>
-
-option specifies the number of bits in the key;
-the current default is 2192 and we do not recommend use of anything
-shorter unless unusual constraints demand it.
-<P>
-
-The
-<B>--hostname</B>
-
-option is passed through to
-<I>rsasigkey</I>
-
-to tell it what host name to label the output with
-(via its
-<B>--hostname</B>
-
-option).
-<P>
-
-The output format is that of
-<I>rsasigkey</I>,
-
-with bracketing added to complete the
-<I>ipsec.secrets</I>
-
-format.
-In the usual case, where
-<I>ipsec.secrets</I>
-
-contains only the host's own private key,
-the output of
-<I>newhostkey</I>
-
-is sufficient as a complete
-<I>ipsec.secrets</I>
-
-file.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.secrets.5.html">ipsec.secrets</A>(5), <A HREF="ipsec_rsasigkey.8.html">ipsec_rsasigkey</A>(8)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Henry Spencer.
-<A NAME="lbAG">&nbsp;</A>
-<H2>BUGS</H2>
-
-As with
-<I>rsasigkey</I>,
-
-the run time is difficult to predict,
-since depletion of the system's randomness pool can cause
-arbitrarily long waits for random bits,
-and the prime-number searches can also take unpredictable
-(and potentially large) amounts of CPU time.
-See
-<I><A HREF="ipsec_rsasigkey.8.html">ipsec_rsasigkey</A></I>(8)
-
-for some typical performance numbers.
-<P>
-
-A higher-level tool which could handle the clerical details
-of changing to a new key would be helpful.
-<P>
-
-The requirement for
-<B>--output</B>
-
-is a blemish,
-but private keys are extremely sensitive information
-and unusual precautions seem justified.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-<DT><A HREF="#lbAG">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_optionsfrom.3.html b/doc/manpage.d/ipsec_optionsfrom.3.html
deleted file mode 100644
index 05d045e4d..000000000
--- a/doc/manpage.d/ipsec_optionsfrom.3.html
+++ /dev/null
@@ -1,275 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_OPTIONSFROM</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_OPTIONSFROM</H1>
-Section: C Library Functions (3)<BR>Updated: 16 Oct 1998<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec optionsfrom - read additional ``command-line'' options from file
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *optionsfrom(char *filename, int *argcp,</B>
-
-<BR>
-&nbsp;
-<B>char ***argvp, int optind, FILE *errsto);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Optionsfrom</I>
-
-is called from within a
-<I><A HREF="getopt_long.3.html">getopt_long</A></I>(3)
-
-scan,
-as the result of the appearance of an option (preferably
-<B>--optionsfrom</B>)
-
-to insert additional ``command-line'' arguments
-into the scan immediately after
-the option.
-Typically this would be done to pick up options which are
-security-sensitive and should not be visible to
-<I><A HREF="ps.1.html">ps</A></I>(1)
-
-and similar commands,
-and hence cannot be supplied as part
-of the actual command line or the environment.
-<P>
-
-<I>Optionsfrom</I>
-
-reads the additional arguments from the specified
-<I>filename</I>,
-
-allocates a new argument vector to hold pointers to the existing
-arguments plus the new ones,
-and amends
-<I>argc</I>
-
-and
-<I>argv</I>
-
-(via the pointers
-<I>argcp</I>
-
-and
-<I>argvp</I>,
-
-which must point to the
-<I>argc</I>
-
-and
-<I>argv</I>
-
-being supplied to
-<I><A HREF="getopt_long.3.html">getopt_long</A></I>(3))
-
-accordingly.
-<I>Optind</I>
-
-must be the index, in the original argument vector,
-of the next argument.
-<P>
-
-If
-<I>errsto</I>
-
-is NULL,
-<I>optionsfrom</I>
-
-returns NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-If
-<I>errsto</I>
-
-is non-NULL and an error occurs,
-<I>optionsfrom</I>
-
-prints a suitable complaint onto the
-<I>errsto</I>
-
-descriptor and invokes
-<I>exit</I>
-
-with an exit status of 2;
-this is a convenience for cases where more sophisticated
-responses are not required.
-<P>
-
-The text of existing arguments is not disturbed by
-<I>optionsfrom</I>,
-
-so pointers to them and into them remain valid.
-<P>
-
-The file of additional arguments is an ASCII text file.
-Lines consisting solely of white space,
-and lines beginning with
-<B>#</B>,
-
-are comments and are ignored.
-Otherwise, a line which does not begin with
-<B>-</B>
-
-is taken to be a single argument;
-if it both begins and ends with double-quote (&quot;),
-those quotes are stripped off (note, no other processing is done within
-the line!).
-A line beginning with
-<B>-</B>
-
-is considered to contain multiple arguments separated by white space.
-<P>
-
-Because
-<I>optionsfrom</I>
-
-reads its entire file before the
-<I><A HREF="getopt_long.3.html">getopt_long</A></I>(3)
-
-scan is resumed, an
-<I>optionsfrom</I>
-
-file can contain another
-<B>--optionsfrom</B>
-
-option.
-Obviously, infinite loops are possible here.
-If
-<I>errsto</I>
-
-is non-NULL,
-<I>optionsfrom</I>
-
-considers it an error to be called more than 100 times.
-If
-<I>errsto</I>
-
-is NULL,
-loop detection is up to the caller
-(and the internal loop counter is zeroed out).
-<A NAME="lbAE">&nbsp;</A>
-<H2>EXAMPLE</H2>
-
-A reasonable way to invoke
-<I>optionsfrom</I>
-
-would be like so:
-<P>
-
-<PRE>
-<B>#include &lt;<A HREF="file:/usr/include/getopt.h">getopt.h</A>&gt;
-
-struct option opts[] = {
-        /* ... */
-        &quot;optionsfrom&quot;,  1,      NULL,   '+',
-        /* ... */
-};
-
-int
-main(argc, argv)
-int argc;
-char *argv[];
-{
-        int opt;
-        extern char *optarg;
-        extern int optind;
-
-        while ((opt = getopt_long(argc, argv, &quot;&quot;, opts, NULL)) != EOF)
-                switch (opt) {
-                /* ... */
-                case '+':       /* optionsfrom */
-                        optionsfrom(optarg, &amp;argc, &amp;argv, optind, stderr);
-                        /* does not return on error */
-                        break;
-                /* ... */
-                }
-        /* ... */
-</B></PRE>
-
-<A NAME="lbAF">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="getopt_long.3.html">getopt_long</A>(3)
-<A NAME="lbAG">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Errors in
-<I>optionsfrom</I>
-
-are:
-unable to open file;
-attempt to allocate temporary storage for argument or
-argument vector failed;
-read error in file;
-line too long.
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAI">&nbsp;</A>
-<H2>BUGS</H2>
-
-The double-quote convention is rather simplistic.
-<P>
-
-Line length is currently limited to 1023 bytes,
-and there is no continuation convention.
-<P>
-
-The restriction of error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-<P>
-
-There is a certain element of unwarranted chumminess with
-the insides of
-<I><A HREF="getopt_long.3.html">getopt_long</A></I>(3)
-
-here.
-No non-public interfaces are actually used, but
-<I>optionsfrom</I>
-
-does rely on
-<I><A HREF="getopt_long.3.html">getopt_long</A></I>(3)
-
-being well-behaved in certain ways that are not actually
-promised by the specs.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">EXAMPLE</A><DD>
-<DT><A HREF="#lbAF">SEE ALSO</A><DD>
-<DT><A HREF="#lbAG">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-<DT><A HREF="#lbAI">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_pf_key.5.html b/doc/manpage.d/ipsec_pf_key.5.html
deleted file mode 100644
index 420c12900..000000000
--- a/doc/manpage.d/ipsec_pf_key.5.html
+++ /dev/null
@@ -1,176 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_PF_KEY</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_PF_KEY</H1>
-Section: File Formats (5)<BR>Updated: 29 Jun 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec_pf_key - lists PF_KEY sockets registered with KLIPS
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>cat</B>
-
-<B>/proc/net/pf_key</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>/proc/net/pf_key</I>
-
-is a read-only file which lists the presently open PF_KEY sockets on the
-local system and their parameters.
-<P>
-
-Each line lists one PF_KEY socket.
-A table entry consists of:
-<DL COMPACT>
-<DT>+<DD>
-sock pointer (sock)
-<DT>+<DD>
-PID of the socket owner (pid)
-<DT>+<DD>
-flag to indicate if the socket is dead (d)
-<DT>+<DD>
-socket wait queue (sleep)
-<DT>+<DD>
-socket pointer (socket)
-<DT>+<DD>
-next socket in chain (next)
-<DT>+<DD>
-previous socket in chain (prev)
-<DT>+<DD>
-last socket error (e)
-<DT>+<DD>
-pointer to destruct routine (destruct)
-<DT>+<DD>
-is this a reused socket (r)
-<DT>+<DD>
-has this socket been zapped (z)
-<DT>+<DD>
-socket family to which this socket belongs (fa)
-<DT>+<DD>
-local port number (n)
-<DT>+<DD>
-protocol version number (p)
-<DT>+<DD>
-Receive queue bytes committed (r)
-<DT>+<DD>
-Transmit queue bytes committed (w)
-<DT>+<DD>
-option memory allocations (o)
-<DT>+<DD>
-size of send buffer in bytes (sndbf)
-<DT>+<DD>
-timestamp in seconds (stamp)
-<DT>+<DD>
-socket flags (Flags)
-<DT>+<DD>
-socket type (Type)
-<DT>+<DD>
-connection state (St)
-<B>.SH</B>EXAMPLES
-
-<DT>
-<DD>
-<DT><B>c3b8c140 3553 0 c0599818 c05997fc        0        0 0        0 1 0 15 0 2 0 0 0 65535 0.103232 00000000 00000003 01</B>
-
-<DD>
-</DL>
-<P>
-
-shows that there is one pf_key socket set up that starts at
-<B>c3b8c140</B>,
-
-whose owning process has PID
-<B>3553</B>,
-
-the socket is not dead, its wait queue is at
-<B>c0599818</B>,
-
-whose owning socket is at
-<B>c05997fc</B>,
-
-with no other sockets in the chain, no errors, no destructor, it is a
-reused socket which has not been zapped, from protocol family
-<B>15</B>
-
-(PF_KEY), local port number
-<B>0</B>,
-
-protocol socket version
-<B>2</B>,
-
-no memory allocated to transmit, receive or option queues, a send buffer
-of almost
-<B>64kB</B>,
-
-a timestamp of
-<B>0.103232</B>,
-
-no flags set, type
-<B>3</B>,
-
-in state
-<B>1</B>.
-
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/pf_key
-<A NAME="lbAF">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_eroute.5.html">ipsec_eroute</A>(5), <A HREF="ipsec_spi.5.html">ipsec_spi</A>(5),
-<A HREF="ipsec_spigrp.5.html">ipsec_spigrp</A>(5), <A HREF="ipsec_klipsdebug.5.html">ipsec_klipsdebug</A>(5), <A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A>(8), <A HREF="ipsec_version.5.html">ipsec_version</A>(5)
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Richard Guy Briggs.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">SEE ALSO</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_pf_key.8.html b/doc/manpage.d/ipsec_pf_key.8.html
deleted file mode 100644
index e40cfb15b..000000000
--- a/doc/manpage.d/ipsec_pf_key.8.html
+++ /dev/null
@@ -1,122 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_PF_KEY</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_PF_KEY</H1>
-Section: User Commands  (1)<BR>Updated: 17 Oct 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-pf_key - shows pfkey messages emitted by the kernel
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>pf_key</B>
-
-<B>--ah</B>
-
-<B>--esp</B>
-
-<B>--ipip</B>
-
-<B>--ipcomp</B>
-
-<B>--daemon </B>
-
-<I>file</I>
-
-<B>hmac-md5-96</B>|<B>hmac-sha1-96</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<B>pf_key</B>
-
-is a program to open a PF_KEY socket and print all messages that are received
-from it. With no options, it will register itself to receive key requests for
-AH, ESP, IPIP and IPCOMP security associations. If given more specific
-options, then it will listen only to those protocols which are listed.
-<P>
-
-If the messages are recognized, the messages will be decoded.
-<P>
-
-If the option 
-<B>--daemon</B>
-
-is provided, then after doing the registrations, the program will fork
-into the background. The provided file will be opened and the process ID of
-the background process will be written to it. This option is present to
-present race conditions in regression testing.
-<A NAME="lbAE">&nbsp;</A>
-<H2>EXAMPLES</H2>
-
-<DL COMPACT>
-<DT>
-<DD>
-</DL>
-<A NAME="lbAF">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/pf_key
-<A NAME="lbAG">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="pf_key.5.html">pf_key</A>(5), <A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_eroute.5.html">ipsec_eroute</A>(5), <A HREF="ipsec_spi.5.html">ipsec_spi</A>(5),
-<A HREF="ipsec_spigrp.5.html">ipsec_spigrp</A>(5), <A HREF="ipsec_klipsdebug.5.html">ipsec_klipsdebug</A>(5), <A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A>(8), <A HREF="ipsec_version.5.html">ipsec_version</A>(5)
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael Richardson &lt;<A HREF="mailto:mcr@freeswan.org">mcr@freeswan.org</A>&gt;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">EXAMPLES</A><DD>
-<DT><A HREF="#lbAF">FILES</A><DD>
-<DT><A HREF="#lbAG">SEE ALSO</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_pluto.8.html b/doc/manpage.d/ipsec_pluto.8.html
deleted file mode 100644
index 2e2ce4c2f..000000000
--- a/doc/manpage.d/ipsec_pluto.8.html
+++ /dev/null
@@ -1,1824 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_PLUTO</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_PLUTO</H1>
-Section: Maintenance Commands (8)<BR>Updated: 28 March 1999<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec pluto - IPsec IKE keying daemon
-<BR>
-
-ipsec whack - control interface for IPSEC keying daemon
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-
-
-<DL COMPACT>
-<DT>
-<B>
-<DD>ipsec pluto
-[--help]
-[--version]
-[--optionsfrom&nbsp;</B><I>filename</I>]
-[--nofork]
-[--stderrlog]
-[--noklips]
-[--uniqueids]
-[<B>--interface</B> <I>interfacename</I>]
-[--ikeport&nbsp;<I>portnumber</I>]
-[--ctlbase&nbsp;<I>path</I>]
-[--secretsfile&nbsp;<I>secrets-file</I>]
-[--adns <I>pathname</I>]
-[--lwdnsq <I>pathname</I>]
-[--perpeerlog]
-[--perpeerlogbase&nbsp;<I>dirname</I>]
-[--debug-none]
-[--debug-all]
-[--debug-raw]
-[--debug-crypt]
-[--debug-parsing]
-[--debug-emitting]
-[--debug-control]
-[--debug-lifecycle]
-[--debug-klips]
-[--debug-dns]
-[--debug-oppo]
-[--debug-private]
-<DT>
-<B>
-<DD>ipsec whack
-[--help]
-[--version]
-<DT>
-
-<DD>ipsec whack
---name&nbsp;</B><I>connection-name</I>
-<BR>
-
-[--id&nbsp;<I>id</I>] [--host&nbsp;<I>ip-address</I>]
-[--ikeport&nbsp;<I>port-number</I>]
-[--nexthop&nbsp;<I>ip-address</I>]
-[--client&nbsp;<I>subnet</I>]
-[--dnskeyondemand]
-[--updown&nbsp;<I>updown</I>]
-<BR>
-
---to
-<BR>
-
-[--id&nbsp;<I>id</I>]
-[--host&nbsp;<I>ip-address</I>]
-[--ikeport&nbsp;<I>port-number</I>]
-[--nexthop&nbsp;<I>ip-address</I>]
-[--client&nbsp;<I>subnet</I>]
-[--dnskeyondemand]
-[--updown&nbsp;<I>updown</I>]
-<BR>
-
-[--psk]
-[--rsasig]
-[--encrypt]
-[--authenticate]
-[--compress]
-[--tunnel]
-[--pfs]
-[--disablearrivalcheck]
-[--ipv4]
-[--ipv6]
-[--tunnelipv4]
-[--tunnelipv6]
-[--ikelifetime&nbsp;<I>seconds</I>]
-[--ipseclifetime&nbsp;<I>seconds</I>]
-[--rekeymargin&nbsp;<I>seconds</I>]
-[--rekeyfuzz&nbsp;<I>percentage</I>]
-[--keyingtries&nbsp;<I>count</I>]
-[--dontrekey]
-[--delete]
-[--ctlbase&nbsp;<I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
---keyid&nbsp;</B><I>id</I>
-[--addkey]
-[--pubkeyrsa&nbsp;<I>key</I>]
-[--ctlbase&nbsp;<I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
---myid&nbsp;</B><I>id</I>
-<DT>
-<B>
-<DD>ipsec whack
---listen|--unlisten
-[--ctlbase&nbsp;</B><I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
---route|--unroute
---name&nbsp;</B><I>connection-name</I>
-[--ctlbase&nbsp;<I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
---initiate|--terminate
---name&nbsp;</B><I>connection-name</I>
-[--asynchronous]
-[--ctlbase&nbsp;<I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
-[--tunnelipv4]
-[--tunnelipv6]
---oppohere </B><I>ip-address</I>
---oppothere <I>ip-address</I>
-<DT>
-<B>
-<DD>ipsec whack
---delete
---name&nbsp;</B><I>connection-name</I>
-[--ctlbase&nbsp;<I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
---deletestate&nbsp;</B><I>state-number</I>
-[--ctlbase&nbsp;<I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
-[--name&nbsp;</B><I>connection-name</I>]
-[--debug-none]
-[--debug-all]
-[--debug-raw]
-[--debug-crypt]
-[--debug-parsing]
-[--debug-emitting]
-[--debug-control]
-[--debug-lifecycle]
-[--debug-klips]
-[--debug-dns]
-[--debug-oppo]
-[--debug-private]
-[--ctlbase&nbsp;<I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
---status
-[--ctlbase&nbsp;</B><I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
---shutdown
-[--ctlbase&nbsp;</B><I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-
-
-
-</DL>
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<B>pluto</B>
-
-is an IKE (``IPsec Key Exchange'') daemon.
-<B>whack</B>
-
-is an auxiliary program to allow requests to be made to a running
-<B>pluto</B>.
-
-<P>
-
-<B>pluto</B>
-
-is used to automatically build shared ``security associations'' on a
-system that has IPsec, the secure IP protocol.
-In other words,
-<B>pluto</B>
-
-can eliminate much of the work of manual keying.
-The actual
-secure transmission of packets is the responsibility of other parts of
-the system (see
-<B>KLIPS</B>,
-
-the companion implementation of IPsec).
-<I><A HREF="ipsec_auto.8.html">ipsec_auto</A></I>(8) provides a more convenient interface to
-<B>pluto</B> and <B>whack</B>.
-<A NAME="lbAE">&nbsp;</A>
-<H3>IKE's Job</H3>
-
-<P>
-
-A <I>Security Association</I> (<I>SA</I>) is an agreement between two network nodes on
-how to process certain traffic between them.  This processing involves
-encapsulation, authentication, encryption, or compression.
-<P>
-
-IKE can be deployed on a network node to negotiate Security
-Associations for that node.  These IKE implementations can only
-negotiate with other IKE implementations, so IKE must be on each node
-that is to be an endpoint of an IKE-negotiated Security Association.
-No other nodes need to be running IKE.
-<P>
-
-An IKE instance (i.e. an IKE implementation on a particular network
-node) communicates with another IKE instance using UDP IP packets, so
-there must be a route between the nodes in each direction.
-<P>
-
-The negotiation of Security Associations requires a number of choices
-that involve tradeoffs between security, convenience, trust, and
-efficiency.  These are policy issues and are normally specified to the
-IKE instance by the system administrator.
-<P>
-
-IKE deals with two kinds of Security Associations.  The first part of
-a negotiation between IKE instances is to build an ISAKMP SA.  An
-ISAKMP SA is used to protect communication between the two IKEs.
-IPsec SAs can then be built by the IKEs - these are used to carry
-protected IP traffic between the systems.
-<P>
-
-The negotiation of the ISAKMP SA is known as Phase 1.  In theory,
-Phase 1 can be accomplished by a couple of different exchange types,
-but we only implement one called Main Mode (we don't implement
-Aggressive Mode).
-<P>
-
-Any negotiation under the protection of an ISAKMP SA, including the
-negotiation of IPsec SAs, is part of Phase 2.  The exchange type
-that we use to negotiate an IPsec SA is called Quick Mode.
-<P>
-
-IKE instances must be able to authenticate each other as part of their
-negotiation of an ISAKMP SA.  This can be done by several mechanisms
-described in the draft standards.
-<P>
-
-IKE negotiation can be initiated by any instance with any other.  If
-both can find an agreeable set of characteristics for a Security
-Association, and both recognize each others authenticity, they can set
-up a Security Association.  The standards do not specify what causes
-an IKE instance to initiate a negotiation.
-<P>
-
-In summary, an IKE instance is prepared to automate the management of
-Security Associations in an IPsec environment, but a number of issues
-are considered policy and are left in the system administrator's hands.
-<A NAME="lbAF">&nbsp;</A>
-<H3>Pluto</H3>
-
-<P>
-
-<B>pluto</B> is an implementation of IKE.  It runs as a daemon on a network
-node.  Currently, this network node must be a LINUX system running the
-<B>KLIPS</B> implementation of IPsec.
-<P>
-
-<B>pluto</B> only implements a subset of IKE.  This is enough for it to
-interoperate with other instances of <B>pluto</B>, and many other IKE
-implementations.  We are working on implementing more of IKE.
-<P>
-
-The policy for acceptable characteristics for Security Associations is
-mostly hardwired into the code of <B>pluto</B> (spdb.c).  Eventually
-this will be moved into a security policy database with reasonable
-expressive power and more convenience.
-<P>
-
-<B>pluto</B> uses shared secrets or RSA signatures to authenticate
-peers with whom it is negotiating.
-<P>
-
-<B>pluto</B> initiates negotiation of a Security Association when it is
-manually prodded: the program <B>whack</B> is run to trigger this.
-It will also initiate a negotiation when <B>KLIPS</B> traps an outbound packet
-for Opportunistic Encryption.
-<P>
-
-<B>pluto</B> implements ISAKMP SAs itself.  After it has negotiated the
-characteristics of an IPsec SA, it directs <B>KLIPS</B> to implement it.
-It also invokes a script to adjust any firewall and issue <I><A HREF="route.8.html">route</A></I>(8)
-commands to direct IP packets through <B>KLIPS</B>.
-<P>
-
-When <B>pluto</B> shuts down, it closes all Security Associations.
-<A NAME="lbAG">&nbsp;</A>
-<H3>Before Running Pluto</H3>
-
-<P>
-
-<B>pluto</B> runs as a daemon with userid root.  Before running it, a few
-things must be set up.
-<P>
-
-<B>pluto</B> requires <B>KLIPS</B>, the FreeS/WAN implementation of IPsec.
-All of the components of <B>KLIPS</B> and <B>pluto</B> should be installed.
-<P>
-
-<B>pluto</B> supports multiple public networks (that is, networks
-that are considered insecure and thus need to have their traffic
-encrypted or authenticated).  It discovers the
-public interfaces to use by looking at all interfaces that are
-configured (the <B>--interface</B> option can be used to limit
-the interfaces considered).
-It does this only when <B>whack</B> tells it to --listen,
-so the interfaces must be configured by then.  Each interface with a name of the form
-<B>ipsec</B>[<B>0</B>-<B>9</B>] is taken as a <B>KLIPS</B> virtual public interface.
-Another network interface with the same IP address (there should be only
-one) is taken as the corresponding real public
-interface.  <I><A HREF="ifconfig.8.html">ifconfig</A></I>(8) with the <B>-a</B> flag will show
-the name and status of each network interface.
-<P>
-
-<B>pluto</B> requires a database of preshared secrets and RSA private keys.
-This is described in the
-<I><A HREF="ipsec.secrets.5.html">ipsec.secrets</A></I>(5).
-
-<B>pluto</B> is told of RSA public keys via <B>whack</B> commands.
-If the connection is Opportunistic, and no RSA public key is known,
-<B>pluto</B> will attempt to fetch RSA keys using the Domain Name System.
-<A NAME="lbAH">&nbsp;</A>
-<H3>Setting up <B>KLIPS</B> for <B>pluto</B></H3>
-
-<P>
-
-The most basic network topology that <B>pluto</B> supports has two security
-gateways negotiating on behalf of client subnets.  The diagram of RGB's
-testbed is a good example (see <I>klips/doc/rgb_setup.txt</I>).
-<P>
-
-The file <I>INSTALL</I> in the base directory of this distribution
-explains how to start setting up the whole system, including <B>KLIPS</B>.
-<P>
-
-Make sure that the security gateways have routes to each other.  This
-is usually covered by the default route, but may require issuing
-<I><A HREF="route.8.html">route</A></I>(8)
-
-commands.  The route must go through a particular IP
-interface (we will assume it is <I>eth0</I>, but it need not be).  The
-interface that connects the security gateway to its client must be a
-different one.
-<P>
-
-It is necessary to issue a
-<I><A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A></I>(8)
-
-command on each gateway.  The required command is:
-<P>
-&nbsp;&nbsp;&nbsp;ipsec tncfg --attach&nbsp;--virtual&nbsp;ipsec0 --physical&nbsp;eth0
-<P>
-A command to set up the ipsec0 virtual interface will also need to be
-run.  It will have the same parameters as the command used to set up
-the physical interface to which it has just been connected using
-<I><A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A></I>(8).
-
-<A NAME="lbAI">&nbsp;</A>
-<H3>ipsec.secrets file</H3>
-
-<P>
-
-A <B>pluto</B> daemon and another IKE daemon (for example, another instance
-of <B>pluto</B>) must convince each other that they are who they are supposed
-to be before any negotiation can succeed.  This authentication is
-accomplished by using either secrets that have been shared beforehand
-(manually) or by using RSA signatures.  There are other techniques,
-but they have not been implemented in <B>pluto</B>.
-<P>
-
-The file <I>/etc/ipsec.secrets</I> is used to keep preshared secret keys
-and RSA private keys for
-authentication with other IKE daemons.  For debugging, there is an
-argument to the <B>pluto</B> command to use a different file.
-This file is described in
-<I><A HREF="ipsec.secrets.5.html">ipsec.secrets</A></I>(5).
-
-<A NAME="lbAJ">&nbsp;</A>
-<H3>Running Pluto</H3>
-
-<P>
-
-To fire up the daemon, just type <B>pluto</B> (be sure to be running as
-the superuser).
-The default IKE port number is 500, the UDP port assigned by IANA for IKE Daemons.
-<B>pluto</B> must be run by the superuser to be able to use the UDP 500 port.
-<P>
-
-<B>pluto</B> attempts to create a lockfile with the name
-<I>/var/run/pluto.pid</I>.  If the lockfile cannot be created,
-<B>pluto</B> exits - this prevents multiple <B>pluto</B>s from
-competing  Any ``leftover'' lockfile must be removed before
-<B>pluto</B> will run.  <B>pluto</B> writes its pid into this file so
-that scripts can find it.  This lock will not function properly if it
-is on an NFS volume (but sharing locks on multiple machines doesn't
-make sense anyway).
-<P>
-
-<B>pluto</B> then forks and the parent exits.  This is the conventional
-``daemon fork''.  It can make debugging awkward, so there is an option
-to suppress this fork.
-<P>
-
-All logging, including diagnostics, is sent to
-<I><A HREF="syslog.3.html">syslog</A></I>(3)
-
-with facility=authpriv;
-it decides where to put these messages (possibly in /var/log/secure).
-Since this too can make debugging awkward, there is an option to
-steer logging to stderr.
-<P>
-
-If the <B>--perpeerlog</B> option is given, then pluto will open
-a log file per connection. By default, this is in /var/log/pluto/peer,
-in a subdirectory formed by turning all dot (.) [IPv4} or colon (:)
-[IPv6] into slashes (/).
-<P>
-
-The base directory can be changed with the <B>--perpeerlogbase</B>.
-<P>
-
-Once <B>pluto</B> is started, it waits for requests from <B>whack</B>.
-<A NAME="lbAK">&nbsp;</A>
-<H3>Pluto's Internal State</H3>
-
-<P>
-
-To understand how to use <B>pluto</B>, it is helpful to understand a little
-about its internal state.  Furthermore, the terminology is needed to decipher
-some of the diagnostic messages.
-<P>
-
-The <I>(potential) connection</I> database describes attributes of a
-connection.  These include the IP addresses of the hosts and client
-subnets and the security characteristics desired.  <B>pluto</B>
-requires this information (simply called a connection) before it can
-respond to a request to build an SA.  Each connection is given a name
-when it is created, and all references are made using this name.
-<P>
-
-During the IKE exchange to build an SA, the information about the
-negotiation is represented in a <I>state object</I>.  Each state object
-reflects how far the negotiation has reached.  Once the negotiation is
-complete and the SA established, the state object remains to represent
-the SA.  When the SA is terminated, the state object is discarded.
-Each State object is given a serial number and this is used to refer
-to the state objects in logged messages.
-<P>
-
-Each state object corresponds to a connection and can be thought of
-as an instantiation of that connection.
-At any particular time, there may be any number of state objects
-corresponding to a particular connection.
-Often there is one representing an ISAKMP SA and another representing
-an IPsec SA.
-<P>
-
-<B>KLIPS</B> hooks into the routing code in a LINUX kernel.
-Traffic to be processed by an IPsec SA must be directed through
-<B>KLIPS</B> by routing commands.  Furthermore, the processing to be
-done is specified by <I>ipsec <A HREF="eroute.8.html">eroute</A>(8)</I> commands.
-<B>pluto</B> takes the responsibility of managing both of these special
-kinds of routes.
-<P>
-
-Each connection may be routed, and must be while it has an IPsec SA.
-The connection specifies the characteristics of the route: the
-interface on this machine, the ``gateway'' (the nexthop),
-and the peer's client subnet.  Two
-connections may not be simultaneously routed if they are for the same
-peer's client subnet but use different interfaces or gateways
-(<B>pluto</B>'s logic does not reflect any advanced routing capabilities).
-<P>
-
-Each eroute is associated with the state object for an IPsec SA
-because it has the particular characteristics of the SA.
-Two eroutes conflict if they specify the identical local
-and remote clients (unlike for routes, the local clients are
-taken into account).
-<P>
-
-When <B>pluto</B> needs to install a route for a connection,
-it must make sure that no conflicting route is in use.  If another
-connection has a conflicting route, that route will be taken down, as long
-as there is no IPsec SA instantiating that connection.
-If there is such an IPsec SA, the attempt to install a route will fail.
-<P>
-
-There is an exception.  If <B>pluto</B>, as Responder, needs to install
-a route to a fixed client subnet for a connection, and there is
-already a conflicting route, then the SAs using the route are deleted
-to make room for the new SAs.  The rationale is that the new
-connection is probably more current.  The need for this usually is a
-product of Road Warrior connections (these are explained later; they
-cannot be used to initiate).
-<P>
-
-When <B>pluto</B> needs to install an eroute for an IPsec SA (for a
-state object), first the state object's connection must be routed (if
-this cannot be done, the eroute and SA will not be installed).
-If a conflicting eroute is already in place for another connection,
-the eroute and SA will not be installed (but note that the routing
-exception mentioned above may have already deleted potentially conflicting SAs).
-If another IPsec
-SA for the same connection already has an eroute, all its outgoing traffic
-is taken over by the new eroute.  The incoming traffic will still be
-processed.  This characteristic is exploited during rekeying.
-<P>
-
-All of these routing characteristics are expected change when
-<B>KLIPS</B> is modified to use the firewall hooks in the LINUX 2.4.x
-kernel.
-<A NAME="lbAL">&nbsp;</A>
-<H3>Using Whack</H3>
-
-<P>
-
-<B>whack</B> is used to command a running <B>pluto</B>.
-<B>whack</B> uses a UNIX domain socket to speak to <B>pluto</B>
-(by default, <I>/var/pluto.ctl</I>).
-<P>
-
-<B>whack</B> has an intricate argument syntax.
-This syntax allows many different functions to be specified.
-The help form shows the usage or version information.
-The connection form gives <B>pluto</B> a description of a potential connection.
-The public key form informs <B>pluto</B> of the RSA public key for a potential peer.
-The delete form deletes a connection description and all SAs corresponding
-to it.
-The listen form tells <B>pluto</B> to start or stop listening on the public interfaces
-for IKE requests from peers.
-The route form tells <B>pluto</B> to set up routing for a connection;
-the unroute form undoes this.
-The initiate form tells <B>pluto</B> to negotiate an SA corresponding to a connection.
-The terminate form tells <B>pluto</B> to remove all SAs corresponding to a connection,
-including those being negotiated.
-The status form displays the <B>pluto</B>'s internal state.
-The debug form tells <B>pluto</B> to change the selection of debugging output
-``on the fly''.  The shutdown form tells
-<B>pluto</B> to shut down, deleting all SAs.
-<P>
-
-Most options are specific to one of the forms, and will be described
-with that form.  There are three options that apply to all forms.
-<DL COMPACT>
-<DT><B>--ctlbase</B>&nbsp;<I>path</I><DD>
-<I>path</I>.ctl is used as the UNIX domain socket for talking
-to <B>pluto</B>.
-This option facilitates debugging.
-<DT><B>--optionsfrom</B>&nbsp;<I>filename</I><DD>
-adds the contents of the file to the argument list.
-<DT><B>--label</B>&nbsp;<I>string</I><DD>
-adds the string to all error messages generated by <B>whack</B>.
-</DL>
-<P>
-
-The help form of <B>whack</B> is self-explanatory.
-<DL COMPACT>
-<DT><B>--help</B><DD>
-display the usage message.
-<DT><B>--version</B><DD>
-display the version of <B>whack</B>.
-</DL>
-<P>
-
-The connection form describes a potential connection to <B>pluto</B>.
-<B>pluto</B> needs to know what connections can and should be negotiated.
-When <B>pluto</B> is the initiator, it needs to know what to propose.
-When <B>pluto</B> is the responder, it needs to know enough to decide whether
-is is willing to set up the proposed connection.
-<P>
-
-The description of a potential connection can specify a large number
-of details.  Each connection has a unique name.  This name will appear
-in a updown shell command, so it should not contain punctuation
-that would make the command ill-formed.
-<DL COMPACT>
-<DT><B>--name</B>&nbsp;<I>connection-name</I><DD>
-</DL>
-<P>
-
-The topology of
-a connection is symmetric, so to save space here is half a picture:
-<P>
-&nbsp;&nbsp;&nbsp;client_subnet&lt;--&gt;host:ikeport&lt;--&gt;nexthop&lt;---
-<P>
-A similar trick is used in the flags.  The same flag names are used for
-both ends.  Those before the <B>--to</B> flag describe the left side
-and those afterwards describe the right side.  When <B>pluto</B> attempts
-to use the connection, it decides whether it is the left side or the right
-side of the connection, based on the IP numbers of its interfaces.
-<DL COMPACT>
-<DT><B>--id</B>&nbsp;<I>id</I><DD>
-the identity of the end.  Currently, this can be an IP address (specified
-as dotted quad or as a Fully Qualified Domain Name, which will be resolved
-immediately) or as a Fully Qualified Domain Name itself (prefixed by ``@''
-to signify that it should not be resolved), or as <A HREF="mailto:user@FQDN">user@FQDN</A>, or as the
-magic value <B>%myid</B>.
-<B>Pluto</B> only authenticates the identity, and does not use it for
-addressing, so, for example, an IP address need not be the one to which
-packets are to be sent.  If the option is absent, the
-identity defaults to the IP address specified by <B>--host</B>.
-<B>%myid</B> allows the identity to be separately specified (by the <B>pluto</B> or <B>whack</B> option <B>--myid</B>
-or by the <B><A HREF="ipsec.conf.5.html">ipsec.conf</A></B>(5) <B>config setup</B> parameter myid).
-Otherwise, <B>pluto</B> tries to guess what <B>%myid</B> should stand for:
-the IP address of <B>%defaultroute</B>, if it is supported by a suitable TXT record in the reverse domain for that IP address,
-or the system's hostname, if it is supported by a suitable TXT record in its forward domain.
-
-<DT><B>--host</B>&nbsp;<I>ip-address</I><DD>
-<DT><B>--host</B>&nbsp;<B>%any</B><DD>
-<DT><B>--host</B>&nbsp;<B>%opportunistic</B><DD>
-the IP address of the end (generally the public interface).
-If <B>pluto</B> is to act as a responder
-for IKE negotiations initiated from unknown IP addresses (the
-``Road Warrior'' case), the
-IP address should be specified as <B>%any</B> (currently,
-the obsolete notation <B>0.0.0.0</B> is also accepted for this).
-If <B>pluto</B> is to opportunistically initiate the connection,
-use <B>%opportunistic</B>
-<DT><B>--ikeport</B>&nbsp;<I>port-number</I><DD>
-the UDP port that IKE listens to on that host.  The default is 500.
-(<B>pluto</B> on this machine uses the port specified by its own command
-line argument, so this only affects where <B>pluto</B> sends messages.)
-<DT><B>--nexthop</B>&nbsp;<I>ip-address</I><DD>
-where to route packets for the peer's client (presumably for the peer too,
-but it will not be used for this).
-When <B>pluto</B> installs an IPsec SA, it issues a route command.
-It uses the nexthop as the gateway.
-The default is the peer's IP address (this can be explicitly written as
-<B>%direct</B>; the obsolete notation <B>0.0.0.0</B> is accepted).
-This option is necessary if <B>pluto</B>'s host's interface used for sending
-packets to the peer is neither point-to-point nor directly connected to the
-peer.
-<DT><B>--client</B>&nbsp;<I>subnet</I><DD>
-the subnet for which the IPsec traffic will be destined.  If not specified,
-the host will be the client.
-The subnet can be specified in any of the forms supported by <I><A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A></I>(3).
-The general form is <I>address</I>/<I>mask</I>.  The <I>address</I> can be either
-a domain name or four decimal numbers (specifying octets) separated by dots.
-The most convenient form of the <I>mask</I> is a decimal integer, specifying
-the number of leading one bits in the mask.  So, for example, 10.0.0.0/8
-would specify the class A network ``Net 10''.
-<DT><B>--dnskeyondemand]</B><DD>
-specifies that when an RSA public key is needed to authenticate this
-host, and it isn't already known, fetch it from DNS.
-<DT><B>--updown</B>&nbsp;<I>updown</I><DD>
-specifies an external shell command to be run whenever <B>pluto</B>
-brings up or down a connection.
-The script is used to build a shell command, so it may contain positional
-parameters, but ought not to have punctuation that would cause the
-resulting command to be ill-formed.
-The default is <I>ipsec _updown</I>.
-<DT><B>--to</B><DD>
-separates the specification of the left and right ends of the connection.
-</DL>
-<P>
-
-The potential connection description also specifies characteristics of
-rekeying and security.
-<DL COMPACT>
-<DT><B>--psk</B><DD>
-Propose and allow preshared secret authentication for IKE peers.  This authentication
-requires that each side use the same secret.  May be combined with <B>--rsasig</B>;
-at least one must be specified.
-<DT><B>--rsasig</B><DD>
-Propose and allow RSA signatures for authentication of IKE peers.  This authentication
-requires that each side have have a private key of its own and know the
-public key of its peer.  May be combined with <B>--psk</B>;
-at least one must be specified.
-<DT><B>--encrypt</B><DD>
-All proposed or accepted IPsec SAs will include non-null ESP.
-The actual choices of transforms are wired into <B>pluto</B>.
-<DT><B>--authenticate</B><DD>
-All proposed IPsec SAs will include AH.
-All accepted IPsec SAs will include AH or ESP with authentication.
-The actual choices of transforms are wired into <B>pluto</B>.
-Note that this has nothing to do with IKE authentication.
-<DT><B>--compress</B><DD>
-All proposed IPsec SAs will include IPCOMP (compression).
-This will be ignored if KLIPS is not configured with IPCOMP support.
-<DT><B>--tunnel</B><DD>
-the IPsec SA should use tunneling.  Implicit if the SA is for clients.
-Must only be used with <B>--authenticate</B> or <B>--encrypt</B>.
-<DT><B>--ipv4</B><DD>
-The host addresses will be interpreted as IPv4 addresses.  This is the
-default.  Note that for a connection, all host addresses must be of
-the same Address Family (IPv4 and IPv6 use different Address Families).
-<DT><B>--ipv6</B><DD>
-The host addresses (including nexthop) will be interpreted as IPv6 addresses.
-Note that for a connection, all host addresses must be of
-the same Address Family (IPv4 and IPv6 use different Address Families).
-<DT><B>--tunnelipv4</B><DD>
-The client addresses will be interpreted as IPv4 addresses.  The default is
-to match what the host will be.  This does not imply <B>--tunnel</B> so the
-flag can be safely used when no tunnel is actually specified.
-Note that for a connection, all tunnel addresses must be of the same
-Address Family.
-<DT><B>--tunnelipv6</B><DD>
-The client addresses will be interpreted as IPv6 addresses.  The default is
-to match what the host will be.  This does not imply <B>--tunnel</B> so the
-flag can be safely used when no tunnel is actually specified.
-Note that for a connection, all tunnel addresses must be of the same
-Address Family.
-<DT><B>--pfs</B><DD>
-There should be Perfect Forward Secrecy - new keying material will
-be generated for each IPsec SA rather than being derived from the ISAKMP
-SA keying material.
-Since the group to be used cannot be negotiated (a dubious feature of the
-standard), <B>pluto</B> will propose the same group that was used during Phase 1.
-We don't implement a stronger form of PFS which would require that the
-ISAKMP SA be deleted after the IPSEC SA is negotiated.
-<DT><B>--disablearrivalcheck</B><DD>
-If the connection is a tunnel, allow packets arriving through the tunnel
-to have any source and destination addresses.
-</DL>
-<P>
-
-If none of the <B>--encrypt</B>, <B>--authenticate</B>, <B>--compress</B>,
-or <B>--pfs</B> flags is given, the initiating the connection will
-only build an ISAKMP SA.  For such a connection, client subnets have
-no meaning and must not be specified.
-<P>
-
-More work is needed to allow for flexible policies.  Currently
-policy is hardwired in the source file spdb.c.  The ISAKMP SAs may use
-Oakley groups MODP1024 and MODP1536; 3DES encryption; SHA1-96
-and MD5-96 authentication.  The IPsec SAs may use 3DES and
-MD5-96 or SHA1-96 for ESP, or just MD5-96 or SHA1-96 for AH.
-IPCOMP Compression is always Deflate.
-<DL COMPACT>
-<DT><B>--ikelifetime</B>&nbsp;<I>seconds</I><DD>
-how long <B>pluto</B> will propose that an ISAKMP SA be allowed to live.
-The default is 3600 (one hour) and the maximum is 28800 (8 hours).
-This option will not affect what is accepted.
-<B>pluto</B> will reject proposals that exceed the maximum.
-<DT><B>--ipseclifetime</B>&nbsp;<I>seconds</I><DD>
-how long <B>pluto</B> will propose that an IPsec SA be allowed to live.
-The default is 28800 (eight hours) and the maximum is 86400 (one day).
-This option will not affect what is accepted.
-<B>pluto</B> will reject proposals that exceed the maximum.
-<DT><B>--rekeymargin</B>&nbsp;<I>seconds</I><DD>
-how long before an SA's expiration should <B>pluto</B> try to negotiate
-a replacement SA.  This will only happen if <B>pluto</B> was the initiator.
-The default is 540 (nine minutes).
-<DT><B>--rekeyfuzz</B>&nbsp;<I>percentage</I><DD>
-maximum size of random component to add to rekeymargin, expressed as
-a percentage of rekeymargin.  <B>pluto</B> will select a delay uniformly
-distributed within this range.  By default, the percentage will be 100.
-If greater determinism is desired, specify 0.  It may be appropriate
-for the percentage to be much larger than 100.
-<DT><B>--keyingtries</B>&nbsp;<I>count</I><DD>
-how many times <B>pluto</B> should try to negotiate an SA,
-either for the first time or for rekeying.
-A value of 0 is interpreted as a very large number: never give up.
-The default is three.
-<DT><B>--dontrekey</B><DD>
-A misnomer.
-Only rekey a connection if we were the Initiator and there was recent
-traffic on the existing connection.
-This applies to Phase 1 and Phase 2.
-This is currently the only automatic way for a connection to terminate.
-It may be useful with Road Warrior or Opportunistic connections.
-<BR>
-
-Since SA lifetime negotiation is take-it-or-leave it, a Responder
-normally uses the shorter of the negotiated or the configured lifetime.
-This only works because if the lifetime is shorter than negotiated,
-the Responder will rekey in time so that everything works.
-This interacts badly with <B>--dontrekey</B>.  In this case,
-the Responder will end up rekeying to rectify a shortfall in an IPsec SA
-lifetime; for an ISAKMP SA, the Responder will accept the negotiated
-lifetime.
-<DT><B>--delete</B><DD>
-when used in the connection form, it causes any previous connection
-with this name to be deleted before this one is added.  Unlike a
-normal delete, no diagnostic is produced if there was no previous
-connection to delete.  Any routing in place for the connection is undone.
-</DL>
-<P>
-
-The delete form deletes a named connection description and any
-SAs established or negotiations initiated using this connection.
-Any routing in place for the connection is undone.
-<DL COMPACT>
-<DT><B>--delete</B><DD>
-<DT><B>--name</B>&nbsp;<I>connection-name</I><DD>
-</DL>
-<P>
-
-The deletestate form deletes the state object with the specified serial number.
-This is useful for selectively deleting instances of connections.
-<DL COMPACT>
-<DT><B>--deletestate</B>&nbsp;<I>state-number</I><DD>
-</DL>
-<P>
-
-The route form of the <B>whack</B> command tells <B>pluto</B> to set up
-routing for a connection.
-Although like a traditional route, it uses an ipsec device as a
-virtual interface.
-Once routing is set up, no packets will be
-sent ``in the clear'' to the peer's client specified in the connection.
-A TRAP shunt eroute will be installed; if outbound traffic is caught,
-Pluto will initiate the connection.
-An explicit <B>whack</B> route is not always needed: if it hasn't been
-done when an IPsec SA is being installed, one will be automatically attempted.
-<P>
-
-When a routing is attempted for a connection, there must not already
-be a routing for a different connection with the same subnet but different
-interface or destination, or if
-there is, it must not be being used by an IPsec SA.  Otherwise the
-attempt will fail.
-<DL COMPACT>
-<DT><B>--route</B><DD>
-<DT><B>--name</B>&nbsp;<I>connection-name</I><DD>
-</DL>
-<P>
-
-The unroute form of the <B>whack</B> command tells <B>pluto</B> to undo
-a routing.  <B>pluto</B> will refuse if an IPsec SA is using the connection.
-If another connection is sharing the same routing, it will be left in place.
-Without a routing, packets will be sent without encryption or authentication.
-<DL COMPACT>
-<DT><B>--unroute</B><DD>
-<DT><B>--name</B>&nbsp;<I>connection-name</I><DD>
-</DL>
-<P>
-
-The initiate form tells <B>pluto</B> to initiate a negotiation with another
-<B>pluto</B> (or other IKE daemon) according to the named connection.
-Initiation requires a route that <B>--route</B> would provide;
-if none is in place at the time an IPsec SA is being installed,
-<B>pluto</B> attempts to set one up.
-<DL COMPACT>
-<DT><B>--initiate</B><DD>
-<DT><B>--name</B>&nbsp;<I>connection-name</I><DD>
-<DT><B>--asynchronous<DD>
-</DL>
-<P>
-
-The initiate form of the whack</B> command will relay back from
-<B>pluto</B> status information via the UNIX domain socket (unless
---asynchronous is specified).  The status information is meant to
-look a bit like that from <B>FTP</B>.  Currently <B>whack</B> simply
-copies this to stderr.  When the request is finished (eg. the SAs are
-established or <B>pluto</B> gives up), <B>pluto</B> closes the channel,
-causing <B>whack</B> to terminate.
-<P>
-
-The opportunistic initiate form is mainly used for debugging.
-<DL COMPACT>
-<DT><B>--tunnelipv4</B><DD>
-<DT><B>--tunnelipv6</B><DD>
-<DT><B>--oppohere</B>&nbsp;<I>ip-address</I><DD>
-<DT><B>--oppothere</B>&nbsp;<I>ip-address</I><DD>
-</DL>
-<P>
-
-This will cause <B>pluto</B> to attempt to opportunistically initiate a
-connection from here to the there, even if a previous attempt
-had been made.
-The whack log will show the progress of this attempt.
-<P>
-
-The terminate form tells <B>pluto</B> to delete any SAs that use the specified
-connection and to stop any negotiations in process.
-It does not prevent new negotiations from starting (the delete form
-has this effect).
-<DL COMPACT>
-<DT><B>--terminate</B><DD>
-<DT><B>--name</B>&nbsp;<I>connection-name</I><DD>
-</DL>
-<P>
-
-The public key for informs <B>pluto</B> of the RSA public key for a potential peer.
-Private keys must be kept secret, so they are kept in
-<I><A HREF="ipsec.secrets.5.html">ipsec.secrets</A></I>(5).
-
-<DL COMPACT>
-<DT><B>--keyid&nbsp;</B><I>id</I><DD>
-specififies the identity of the peer for which a public key should be used.
-Its form is identical to the identity in the connection.
-If no public key is specified, <B>pluto</B> attempts to find KEY records
-from DNS for the id (if a FQDN) or through reverse lookup (if an IP address).
-Note that there several interesting ways in which this is not secure.
-<DT><B>--addkey</B><DD>
-specifies that the new key is added to the collection; otherwise the
-new key replaces any old ones.
-<DT><B>--pubkeyrsa&nbsp;</B><I>key</I><DD>
-specifies the value of the RSA public key.  It is a sequence of bytes
-as described in RFC 2537 ``RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)''.
-It is denoted in a way suitable for <I><A HREF="ipsec_ttodata.3.html">ipsec_ttodata</A></I>(3).
-For example, a base 64 numeral starts with 0s.
-</DL>
-<P>
-
-The listen form tells <B>pluto</B> to start listening for IKE requests
-on its public interfaces.  To avoid race conditions, it is normal to
-load the appropriate connections into <B>pluto</B> before allowing it
-to listen.  If <B>pluto</B> isn't listening, it is pointless to
-initiate negotiations, so it will refuse requests to do so.  Whenever
-the listen form is used, <B>pluto</B> looks for public interfaces and
-will notice when new ones have been added and when old ones have been
-removed.  This is also the trigger for <B>pluto</B> to read the
-<I>ipsec.secrets</I> file.  So listen may useful more than once.
-<DL COMPACT>
-<DT><B>--listen</B><DD>
-start listening for IKE traffic on public interfaces.
-<DT><B>--unlisten</B><DD>
-stop listening for IKE traffic on public interfaces.
-</DL>
-<P>
-
-The status form will display information about the internal state of
-<B>pluto</B>: information about each potential connection, about
-each state object, and about each shunt that <B>pluto</B> is managing
-without an associated connection.
-<DL COMPACT>
-<DT><B>--status</B><DD>
-</DL>
-<P>
-
-The shutdown form is the proper way to shut down <B>pluto</B>.
-It will tear down the SAs on this machine that <B>pluto</B> has negotiated.
-It does not inform its peers, so the SAs on their machines remain.
-<DL COMPACT>
-<DT><B>--shutdown</B><DD>
-</DL>
-<A NAME="lbAM">&nbsp;</A>
-<H3>Examples</H3>
-
-<P>
-
-It would be normal to start <B>pluto</B> in one of the system initialization
-scripts.  It needs to be run by the superuser.  Generally, no arguments are needed.
-To run in manually, the superuser can simply type
-<P>
-&nbsp;&nbsp;&nbsp;ipsec pluto
-<P>
-The command will immediately return, but a <B>pluto</B> process will be left
-running, waiting for requests from <B>whack</B> or a peer.
-<P>
-
-Using <B>whack</B>, several potential connections would be described:
-<DL COMPACT>
-<DT>
-
-&nbsp;&nbsp;&nbsp;ipsec whack --name&nbsp;silly
---host&nbsp;127.0.0.1 --to --host&nbsp;127.0.0.2
---ikelifetime&nbsp;900 --ipseclifetime&nbsp;800 --keyingtries&nbsp;3
-
-</DL>
-<P>
-
-<DD>Since this silly connection description specifies neither encryption,
-authentication, nor tunneling, it could only be used to establish
-an ISAKMP SA.
-<DL COMPACT>
-<DT>
-
-&nbsp;&nbsp;&nbsp;ipsec whack --name&nbsp;secret --host&nbsp;10.0.0.1 --client&nbsp;10.0.1.0/24
---to --host&nbsp;10.0.0.2 --client&nbsp;10.0.2.0/24
---encrypt
-
-</DL>
-<P>
-
-<DD>This is something that must be done on both sides.  If the other
-side is <B>pluto</B>, the same <B>whack</B> command could be used on it
-(the command syntax is designed to not distinguish which end is ours).
-<P>
-
-Now that the connections are specified, <B>pluto</B> is ready to handle
-requests and replies via the public interfaces.  We must tell it to discover
-those interfaces and start accepting messages from peers:
-<P>
-&nbsp;&nbsp;&nbsp;ipsec whack --listen
-<P>
-
-If we don't immediately wish to bring up a secure connection between
-the two clients, we might wish to prevent insecure traffic.
-The routing form asks <B>pluto</B> to cause the packets sent from
-our client to the peer's client to be routed through the ipsec0
-device; if there is no SA, they will be discarded:
-<P>
-&nbsp;&nbsp;&nbsp;ipsec whack --route secret
-<P>
-
-Finally, we are ready to get <B>pluto</B> to initiate negotiation
-for an IPsec SA (and implicitly, an ISAKMP SA):
-<P>
-&nbsp;&nbsp;&nbsp;ipsec whack --initiate&nbsp;--name&nbsp;secret
-<P>
-A small log of interesting events will appear on standard output
-(other logging is sent to syslog).
-<P>
-
-<B>whack</B> can also be used to terminate <B>pluto</B> cleanly, tearing down
-all SAs that it has negotiated.
-<P>
-&nbsp;&nbsp;&nbsp;ipsec whack --shutdown
-<P>
-Notification of any IPSEC SA deletion, but not ISAKMP SA deletion
-is sent to the peer.  Unfortunately, such Notification is not reliable.
-Furthermore, <B>pluto</B> itself ignores Notifications.
-<A NAME="lbAN">&nbsp;</A>
-<H3>The updown command</H3>
-
-<P>
-
-Whenever <B>pluto</B> brings a connection up or down, it invokes
-the updown command.  This command is specified using the <B>--updown</B>
-option.  This allows for customized control over routing and firewall manipulation.
-<P>
-
-The updown is invoked for five different operations.  Each of
-these operations can be for our client subnet or for our host itself.
-<DL COMPACT>
-<DT><B>prepare-host</B> or <B>prepare-client</B><DD>
-is run before bringing up a new connection if no other connection
-with the same clients is up.  Generally, this is useful for deleting a
-route that might have been set up before <B>pluto</B> was run or
-perhaps by some agent not known to <B>pluto</B>.
-<DT><B>route-host</B> or <B>route-client</B><DD>
-is run when bringing up a connection for a new peer client subnet
-(even if <B>prepare-host</B> or <B>prepare-client</B> was run).  The
-command should install a suitable route.  Routing decisions are based
-only on the destination (peer's client) subnet address, unlike eroutes
-which discriminate based on source too.
-<DT><B>unroute-host</B> or <B>unroute-client</B><DD>
-is run when bringing down the last connection for a particular peer
-client subnet.  It should undo what the <B>route-host</B> or <B>route-client</B>
-did.
-<DT><B>up-host</B> or <B>up-client</B><DD>
-is run when bringing up a tunnel eroute with a pair of client subnets
-that does not already have a tunnel eroute.
-This command should install firewall rules as appropriate.
-It is generally a good idea to allow IKE messages (UDP port 500)
-travel between the hosts.
-<DT><B>down-host</B> or <B>down-client</B><DD>
-is run when bringing down the eroute for a pair of client subnets.
-This command should delete firewall rules as appropriate.  Note that
-there may remain some inbound IPsec SAs with these client subnets.
-</DL>
-<P>
-
-The script is passed a large number of environment variables to specify
-what needs to be done.
-<DL COMPACT>
-<DT><B>PLUTO_VERSION</B><DD>
-indicates what version of this interface is being used.  This document
-describes version 1.1.  This is upwardly compatible with version 1.0.
-<DT><B>PLUTO_VERB</B><DD>
-specifies the name of the operation to be performed
-(<B>prepare-host</B>,r <B>prepare-client</B>,
-<B>up-host</B>, <B>up-client</B>,
-<B>down-host</B>, or <B>down-client</B>).  If the address family for
-security gateway to security gateway communications is IPv6, then
-a suffix of -v6 is added to the verb.
-<DT><B>PLUTO_CONNECTION</B><DD>
-is the name of the connection for which we are routing.
-<DT><B>PLUTO_NEXT_HOP</B><DD>
-is the next hop to which packets bound for the peer must be sent.
-<DT><B>PLUTO_INTERFACE</B><DD>
-is the name of the ipsec interface to be used.
-<DT><B>PLUTO_ME</B><DD>
-is the IP address of our host.
-<DT><B>PLUTO_MY_CLIENT</B><DD>
-is the IP address / count of our client subnet.
-If the client is just the host, this will be the host's own IP address / max
-(where max is 32 for IPv4 and 128 for IPv6).
-<DT><B>PLUTO_MY_CLIENT_NET</B><DD>
-is the IP address of our client net.
-If the client is just the host, this will be the host's own IP address.
-<DT><B>PLUTO_MY_CLIENT_MASK</B><DD>
-is the mask for our client net.
-If the client is just the host, this will be 255.255.255.255.
-<DT><B>PLUTO_PEER</B><DD>
-is the IP address of our peer.
-<DT><B>PLUTO_PEER_CLIENT</B><DD>
-is the IP address / count of the peer's client subnet.
-If the client is just the peer, this will be the peer's own IP address / max
-(where max is 32 for IPv4 and 128 for IPv6).
-<DT><B>PLUTO_PEER_CLIENT_NET</B><DD>
-is the IP address of the peer's client net.
-If the client is just the peer, this will be the peer's own IP address.
-<DT><B>PLUTO_PEER_CLIENT_MASK</B><DD>
-is the mask for the peer's client net.
-If the client is just the peer, this will be 255.255.255.255.
-</DL>
-<P>
-
-All output sent by the script to stderr or stdout is logged.  The
-script should return an exit status of 0 if and only if it succeeds.
-<P>
-
-<B>Pluto</B> waits for the script to finish and will not do any other
-processing while it is waiting.
-The script may assume that <B>pluto</B> will not change anything
-while the script runs.
-The script should avoid doing anything that takes much time and it
-should not issue any command that requires processing by <B>pluto</B>.
-Either of these activities could be performed by a background
-subprocess of the script.
-<A NAME="lbAO">&nbsp;</A>
-<H3>Rekeying</H3>
-
-<P>
-
-When an SA that was initiated by <B>pluto</B> has only a bit of
-lifetime left,
-<B>pluto</B> will initiate the creation of a new SA.  This applies to
-ISAKMP and IPsec SAs.
-The rekeying will be initiated when the SA's remaining lifetime is
-less than the rekeymargin plus a random percentage, between 0 and
-rekeyfuzz, of the rekeymargin.
-<P>
-
-Similarly, when an SA that was initiated by the peer has only a bit of
-lifetime left, <B>pluto</B> will try to initiate the creation of a
-replacement.
-To give preference to the initiator, this rekeying will only be initiated
-when the SA's remaining lifetime is half of rekeymargin.
-If rekeying is done by the responder, the roles will be reversed: the
-responder for the old SA will be the initiator for the replacement.
-The former initiator might also initiate rekeying, so there may
-be redundant SAs created.
-To avoid these complications, make sure that rekeymargin is generous.
-<P>
-
-One risk of having the former responder initiate is that perhaps
-none of its proposals is acceptable to the former initiator
-(they have not been used in a successful negotiation).
-To reduce the chances of this happening, and to prevent loss of security,
-the policy settings are taken from the old SA (this is the case even if
-the former initiator is initiating).
-These may be stricter than those of the connection.
-<P>
-
-<B>pluto</B> will not rekey an SA if that SA is not the most recent of its
-type (IPsec or ISAKMP) for its potential connection.
-This avoids creating redundant SAs.
-<P>
-
-The random component in the rekeying time (rekeyfuzz) is intended to
-make certain pathological patterns of rekeying unstable.  If both
-sides decide to rekey at the same time, twice as many SAs as necessary
-are created.  This could become a stable pattern without the
-randomness.
-<P>
-
-Another more important case occurs when a security gateway has SAs
-with many other security gateways.  Each of these connections might
-need to be rekeyed at the same time.  This would cause a high peek
-requirement for resources (network bandwidth, CPU time, entropy for
-random numbers).  The rekeyfuzz can be used to stagger the rekeying
-times.
-<P>
-
-Once a new set of SAs has been negotiated, <B>pluto</B> will never send
-traffic on a superseded one.  Traffic will be accepted on an old SA
-until it expires.
-<A NAME="lbAP">&nbsp;</A>
-<H3>Selecting a Connection When Responding: Road Warrior Support</H3>
-
-<P>
-
-When <B>pluto</B> receives an initial Main Mode message, it needs to
-decide which connection this message is for.  It picks based solely on
-the source and destination IP addresses of the message.  There might
-be several connections with suitable IP addresses, in which case one
-of them is arbitrarily chosen.  (The ISAKMP SA proposal contained in
-the message could be taken into account, but it is not.)
-<P>
-
-The ISAKMP SA is negotiated before the parties pass further
-identifying information, so all ISAKMP SA characteristics specified in
-the connection description should be the same for every connection
-with the same two host IP addresses.  At the moment, the only
-characteristic that might differ is authentication method.
-<P>
-
-Up to this point,
-all configuring has presumed that the IP addresses
-are known to all parties ahead of time.  This will not work
-when either end is mobile (or assigned a dynamic IP address for other
-reasons).  We call this situation ``Road Warrior''.  It is fairly tricky
-and has some important limitations, most of which are features of
-the IKE protocol.
-<P>
-
-Only the initiator may be mobile:
-the initiator may have an IP number unknown to the responder.  When
-the responder doesn't recognize the IP address on the first Main Mode
-packet, it looks for a connection with itself as one end and <B>%any</B>
-as the other.
-If it cannot find one, it refuses to negotiate.  If it
-does find one, it creates a temporary connection that is a duplicate
-except with the <B>%any</B> replaced by the source IP address from the
-packet; if there was no identity specified for the peer, the new IP
-address will be used.
-<P>
-
-When <B>pluto</B> is using one of these temporary connections and
-needs to find the preshared secret or RSA private key in <I>ipsec.secrets</I>,
-and and the connection specified no identity for the peer, <B>%any</B>
-is used as its identity.  After all, the real IP address was apparently
-unknown to the configuration, so it is unreasonable to require that
-it be used in this table.
-<P>
-
-Part way into the Phase 1 (Main Mode) negotiation using one of these
-temporary connection descriptions, <B>pluto</B> will be receive an
-Identity Payload.  At this point, <B>pluto</B> checks for a more
-appropriate connection, one with an identity for the peer that matches
-the payload but which would use the same keys so-far used for
-authentication.  If it finds one, it will switch to using this better
-connection (or a temporary derived from this, if it has <B>%any</B>
-for the peer's IP address).  It may even turn out that no connection
-matches the newly discovered identity, including the current connection;
-if so, <B>pluto</B> terminates negotiation.
-<P>
-
-Unfortunately, if preshared secret authentication is being used, the
-Identity Payload is encrypted using this secret, so the secret must be
-selected by the responder without knowing this payload.  This
-limits there to being at most one preshared secret for all Road Warrior
-systems connecting to a host.  RSA Signature authentications does not
-require that the responder know how to select the initiator's public key
-until after the initiator's Identity Payload is decoded (using the
-responder's private key, so that must be preselected).
-<P>
-
-When <B>pluto</B> is responding to a Quick Mode negotiation via one of these
-temporary connection descriptions, it may well find that the subnets
-specified by the initiator don't match those in the temporary
-connection description.  If so, it will look for a connection with
-matching subnets, its own host address, a peer address of <B>%any</B>
-and matching identities.
-If it finds one, a new temporary connection is derived from this one
-and used for the Quick Mode negotiation of IPsec SAs.  If it does not
-find one, <B>pluto</B> terminates negotiation.
-<P>
-
-Be sure to specify an appropriate nexthop for the responder
-to send a message to the initiator: <B>pluto</B> has no way of guessing
-it (if forwarding isn't required, use an explicit <B>%direct</B> as the nexthop
-and the IP address of the initiator will be filled in; the obsolete
-notation <B>0.0.0.0</B> is still accepted).
-<P>
-
-<B>pluto</B> has no special provision for the initiator side.  The current
-(possibly dynamic) IP address and nexthop must be used in defining
-connections.  These must be
-properly configured each time the initiator's IP address changes.
-<B>pluto</B> has no mechanism to do this automatically.
-<P>
-
-Although we call this Road Warrior Support, it could also be used to
-support encrypted connections with anonymous initiators.  The
-responder's organization could announce the preshared secret that would be used
-with unrecognized initiators and let anyone connect.  Of course the initiator's
-identity would not be authenticated.
-<P>
-
-If any Road Warrior connections are supported, <B>pluto</B> cannot
-reject an exchange initiated by an unknown host until it has
-determined that the secret is not shared or the signature is invalid.
-This must await the
-third Main Mode message from the initiator.  If no Road Warrior
-connection is supported, the first message from an unknown source
-would be rejected.  This has implications for ease of debugging
-configurations and for denial of service attacks.
-<P>
-
-Although a Road Warrior connection must be initiated by the mobile
-side, the other side can and will rekey using the temporary connection
-it has created.  If the Road Warrior wishes to be able to disconnect,
-it is probably wise to set <B>--keyingtries</B> to 1 in the
-connection on the non-mobile side to prevent it trying to rekey the
-connection.  Unfortunately, there is no mechanism to unroute the
-connection automatically.
-<A NAME="lbAQ">&nbsp;</A>
-<H3>Debugging</H3>
-
-<P>
-
-<B>pluto</B> accepts several optional arguments, useful mostly for debugging.
-Except for <B>--interface</B>, each should appear at most once.
-<DL COMPACT>
-<DT><B>--interface</B> <I>interfacename</I><DD>
-specifies that the named real public network interface should be considered.
-The interface name specified should not be <B>ipsec</B><I>N</I>.
-If the option doesn't appear, all interfaces are considered.
-To specify several interfaces, use the option once for each.
-One use of this option is to specify which interface should be used
-when two or more share the same IP address.
-<DT><B>--ikeport</B> <I>port-number</I><DD>
-changes the UDP port that <B>pluto</B> will use
-(default, specified by IANA: 500)
-<DT><B>--ctlbase</B> <I>path</I><DD>
-basename for control files.
-<I>path</I>.ctl is the socket through which <B>whack</B> communicates with
-<B>pluto</B>.
-<I>path</I>.pid is the lockfile to prevent multiple <B>pluto</B> instances.
-The default is <I>/var/run/pluto</I>).
-<DT><B>--secretsfile</B> <I>file</I><DD>
-specifies the file for authentication secrets
-(default: <I>/etc/ipsec.secrets</I>).
-This name is subject to ``globbing'' as in <I><A HREF="sh.1.html">sh</A></I>(1),
-so every file with a matching name is processed.
-Quoting is generally needed to prevent the shell from doing the globbing.
-<DT><B>--adns</B> <I>pathname</I><DD>
-<DT><B>--lwdnsq</B> <I>pathname</I><DD>
-specifies where to find <B>pluto</B>'s helper program for asynchronous DNS lookup.
-<B>pluto</B> can be built to use one of two helper programs: <B>_pluto_adns</B>
-or <B>lwdnsq</B>.  You must use the program for which it was built.
-By default, <B>pluto</B> will look for the program in
-<B>$IPSEC_DIR</B> (if that environment variable is defined) or, failing that,
-in the same directory as <B>pluto</B>.
-<DT><B>--nofork</B><DD>
-disable ``daemon fork'' (default is to fork).  In addition, after the
-lock file and control socket are created, print the line ``Pluto
-initialized'' to standard out.
-<DT><B>--noklips</B><DD>
-don't actually implement negotiated IPsec SAs
-<DT><B>--uniqueids</B><DD>
-if this option has been selected, whenever a new ISAKMP SA is
-established, any connection with the same Peer ID but a different
-Peer IP address is unoriented (causing all its SAs to be deleted).
-This helps clean up dangling SAs when a connection is lost and
-then regained at another IP address.
-<DT><B>--stderrlog</B><DD>
-log goes to standard out {default is to use <I><A HREF="syslogd.8.html">syslogd</A></I>(8))
-</DL>
-<P>
-
-For example
-<DL COMPACT>
-<DT>pluto --secretsfile&nbsp;ipsec.secrets --ctlbase&nbsp;pluto.base --ikeport&nbsp;8500 --nofork --noklips --stderrlog<DD>
-</DL>
-<P>
-
-lets one test <B>pluto</B> without using the superuser account.
-<P>
-
-<B>pluto</B> is willing to produce a prodigious amount of debugging
-information.  To do so, it must be compiled with -DDEBUG.  There are
-several classes of debugging output, and <B>pluto</B> may be directed to
-produce a selection of them.  All lines of
-debugging output are prefixed with ``|&nbsp;'' to distinguish them from error
-messages.
-<P>
-
-When <B>pluto</B> is invoked, it may be given arguments to specify
-which classes to output.  The current options are:
-<DL COMPACT>
-<DT><B>--debug-raw</B><DD>
-show the raw bytes of messages
-<DT><B>--debug-crypt</B><DD>
-show the encryption and decryption of messages
-<DT><B>--debug-parsing</B><DD>
-show the structure of input messages
-<DT><B>--debug-emitting</B><DD>
-show the structure of output messages
-<DT><B>--debug-control</B><DD>
-show <B>pluto</B>'s decision making
-<DT><B>--debug-lifecycle</B><DD>
-[this option is temporary] log more detail of lifecycle of SAs
-<DT><B>--debug-klips</B><DD>
-show <B>pluto</B>'s interaction with <B>KLIPS</B>
-<DT><B>--debug-dns</B><DD>
-show <B>pluto</B>'s interaction with <B>DNS</B> for KEY and TXT records
-<DT><B>--debug-oppo</B><DD>
-show why <B>pluto</B> didn't find a suitable DNS TXT record to authorize opportunistic initiation
-<DT><B>--debug-all</B><DD>
-all of the above
-<DT><B>--debug-private</B><DD>
-allow debugging output with private keys.
-<DT><B>--debug-none</B><DD>
-none of the above
-</DL>
-<P>
-
-The debug form of the
-<B>whack</B> command will change the selection in a running
-<B>pluto</B>.
-If a connection name is specified, the flags are added whenever
-<B>pluto</B> has identified that it is dealing with that connection.
-Unfortunately, this is often part way into the operation being observed.
-<P>
-
-For example, to start a <B>pluto</B> with a display of the structure of input
-and output:
-<DL COMPACT>
-<DT><DD>
-pluto --debug-emitting --debug-parsing
-</DL>
-<P>
-
-To later change this <B>pluto</B> to only display raw bytes:
-<DL COMPACT>
-<DT><DD>
-whack --debug-raw
-</DL>
-<P>
-
-For testing, SSH's IKE test page is quite useful:
-<DL COMPACT>
-<DT><DD>
-<I><A HREF="http://isakmp-test.ssh.fi/">http://isakmp-test.ssh.fi/</A></I>
-</DL>
-<P>
-
-Hint: ISAKMP SAs are often kept alive by IKEs even after the IPsec SA
-is established.  This allows future IPsec SA's to be negotiated
-directly.  If one of the IKEs is restarted, the other may try to use
-the ISAKMP SA but the new IKE won't know about it.  This can lead to
-much confusion.  <B>pluto</B> is not yet smart enough to get out of such a
-mess.
-<A NAME="lbAR">&nbsp;</A>
-<H3>Pluto's Behaviour When Things Go Wrong</H3>
-
-<P>
-
-When <B>pluto</B> doesn't understand or accept a message, it just
-ignores the message.  It is not yet capable of communicating the
-problem to the other IKE daemon (in the future it might use
-Notifications to accomplish this in many cases).  It does log a diagnostic.
-<P>
-
-When <B>pluto</B> gets no response from a message, it resends the same
-message (a message will be sent at most three times).  This is
-appropriate: UDP is unreliable.
-<P>
-
-When pluto gets a message that it has already seen, there are many
-cases when it notices and discards it.  This too is appropriate for UDP.
-<P>
-
-Combine these three rules, and you can explain many apparently
-mysterious behaviours.  In a <B>pluto</B> log, retrying isn't usually the
-interesting event.  The critical thing is either earlier (<B>pluto</B>
-got a message which it didn't like and so ignored, so it was still
-awaiting an acceptable message and got impatient) or on the other
-system (<B>pluto</B> didn't send a reply because it wasn't happy with
-the previous message).
-<A NAME="lbAS">&nbsp;</A>
-<H3>Notes</H3>
-
-<P>
-
-If <B>pluto</B> is compiled without -DKLIPS, it negotiates Security
-Associations but never ask the kernel to put them in place and never
-makes routing changes.  This allows <B>pluto</B> to be tested on systems
-without <B>KLIPS</B>, but makes it rather useless.
-<P>
-
-Each IPsec SA is assigned an SPI, a 32-bit number used to refer to the SA.
-The IKE protocol lets the destination of the SA choose the SPI.
-The range 0 to 0xFF is reserved for IANA.
-<B>Pluto</B> also avoids choosing an SPI in the range 0x100 to 0xFFF,
-leaving these SPIs free for manual keying.
-Remember that the peer, if not <B>pluto</B>, may well chose
-SPIs in this range.
-<A NAME="lbAT">&nbsp;</A>
-<H3>Policies</H3>
-
-<P>
-
-This catalogue of policies may be of use when trying to configure
-<B>Pluto</B> and another IKE implementation to interoperate.
-<P>
-
-In Phase 1, only Main Mode is supported.  We are not sure that
-Aggressive Mode is secure.  For one thing, it does not support
-identity protection.  It may allow more severe Denial Of Service
-attacks.
-<P>
-
-No Informational Exchanges are supported.  These are optional and
-since their delivery is not assured, they must not matter.
-It is the case that some IKE implementations won't interoperate
-without Informational Exchanges, but we feel they are broken.
-<P>
-
-No Informational Payloads are supported.  These are optional, but
-useful.  It is of concern that these payloads are not authenticated in
-Phase 1, nor in those Phase 2 messages authenticated with <A HREF="HASH.3.html">HASH</A>(3).
-<DL COMPACT>
-<DT>*<DD>
-Diffie Hellman Groups MODP 1024 and MODP 1536 (2 and 5)
-are supported.
-Group MODP768 (1) is not supported because it is too weak.
-<DT>*<DD>
-Host authetication can be done by RSA Signatures or Pre-Shared
-Secrets.
-<DT>*<DD>
-3DES CBC (Cypher Block Chaining mode) is the only encryption
-supported, both for ISAKMP SAs and IPSEC SAs.
-<DT>*<DD>
-MD5 and SHA1 hashing are supported for packet authentication in both
-kinds of SAs.
-<DT>*<DD>
-The ESP, AH, or AH plus ESP are supported.  If, and only if, AH and
-ESP are combined, the ESP need not have its own authentication
-component.  The selection is controlled by the --encrypt and
---authenticate flags.
-<DT>*<DD>
-Each of these may be combined with IPCOMP Deflate compression,
-but only if the potential connection specifies compression and only
-if KLIPS is configured with IPCOMP support.
-<DT>*<DD>
-The IPSEC SAs may be tunnel or transport mode, where appropriate.
-The --tunnel flag controls this when <B>pluto</B> is initiating.
-<DT>*<DD>
-When responding to an ISAKMP SA proposal, the maximum acceptable
-lifetime is eight hours.  The default is one hour.  There is no
-minimum.  The --ikelifetime flag controls this when <B>pluto</B>
-is initiating.
-<DT>*<DD>
-When responding to an IPSEC SA proposal, the maximum acceptable
-lifetime is one day.  The default is eight hours.  There is no
-minimum.  The --ipseclifetime flag controls this when <B>pluto</B>
-is initiating.
-<DT>*<DD>
-PFS is acceptable, and will be proposed if the --pfs flag was
-specified.  The DH group proposed will be the same as negotiated for
-Phase 1.
-</DL>
-<A NAME="lbAU">&nbsp;</A>
-<H2>SIGNALS</H2>
-
-<P>
-
-<B>Pluto</B> responds to <B>SIGHUP</B> by issuing a suggestion that ``<B>whack</B>
---listen'' might have been intended.
-<P>
-
-<B>Pluto</B> exits when it recieves <B>SIGTERM</B>.
-<A NAME="lbAV">&nbsp;</A>
-<H2>EXIT STATUS</H2>
-
-<P>
-
-<B>pluto</B> normally forks a daemon process, so the exit status is
-normally a very preliminary result.
-<DL COMPACT>
-<DT>0<DD>
-means that all is OK so far.
-<DT>1<DD>
-means that something was wrong.
-<DT>10<DD>
-means that the lock file already exists.
-</DL>
-<P>
-
-If <B>whack</B> detects a problem, it will return an exit status of 1.
-If it received progress messages from <B>pluto</B>, it returns as status
-the value of the numeric prefix from the last such message
-that was not a message sent to syslog or a comment
-(but the prefix for success is treated as 0).
-Otherwise, the exit status is 0.
-<A NAME="lbAW">&nbsp;</A>
-<H2>FILES</H2>
-
-<I>/var/run/pluto.pid</I>
-<BR>
-
-<I>/var/run/pluto.ctl</I>
-<BR>
-
-<I>/etc/ipsec.secrets</I>
-<BR>
-
-<I>$IPSEC_LIBDIR/_pluto_adns</I>
-<BR>
-
-<I>$IPSEC_EXECDIR/lwdnsq</I>
-<BR>
-
-<I>/dev/urandom</I>
-<A NAME="lbAX">&nbsp;</A>
-<H2>ENVIRONMENT</H2>
-
-<I>IPSEC_LIBDIR</I>
-<BR>
-
-<I>IPSEC_EXECDIR</I>
-<BR>
-
-<I>IPSECmyid</I>
-<A NAME="lbAY">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<P>
-
-The rest of the FreeS/WAN distribution, in particular <I><A HREF="ipsec.8.html">ipsec</A></I>(8).
-<P>
-
-<I><A HREF="ipsec_auto.8.html">ipsec_auto</A></I>(8) is designed to make using <B>pluto</B> more pleasant.
-Use it!
-<P>
-
-<I><A HREF="ipsec.secrets.5.html">ipsec.secrets</A></I>(5)
-
-describes the format of the secrets file.
-<P>
-
-<I><A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A></I>(3), part of the FreeS/WAN distribution, describes the
-forms that IP addresses may take.
-<I><A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A></I>(3), part of the FreeS/WAN distribution, describes the
-forms that subnet specifications.
-<P>
-
-For more information on IPsec, the mailing list, and the relevant
-documents, see:
-<DL COMPACT>
-<DT><DD>
-
-<I><A HREF="http://www.ietf.cnri.reston.va.us/html.charters/ipsec-charter.html">http://www.ietf.cnri.reston.va.us/html.charters/ipsec-charter.html</A></I>
-
-</DL>
-<P>
-
-At the time of writing, the most relevant IETF RFCs are:
-<DL COMPACT>
-<DT><DD>
-RFC2409 The Internet Key Exchange (IKE)
-<DT><DD>
-RFC2408 Internet Security Association and Key Management Protocol (ISAKMP)
-<DT><DD>
-RFC2407 The Internet IP Security Domain of Interpretation for ISAKMP
-</DL>
-<P>
-
-The FreeS/WAN web site &lt;<A HREF="htp://www.freeswan.org">htp://www.freeswan.org</A>&gt;
-and the mailing lists described there.
-<A NAME="lbAZ">&nbsp;</A>
-<H2>HISTORY</H2>
-
-This code is released under the GPL terms.
-See the accompanying file COPYING-2.0 for more details.
-The GPL does NOT apply to those pieces of code written by others
-which are included in this distribution, except as noted by the
-individual authors.
-<P>
-
-This software was originally written
-for the FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Angelos D. Keromytis
-(<A HREF="mailto:angelos@dsl.cis.upenn.edu">angelos@dsl.cis.upenn.edu</A>), in May/June 1997, in Athens, Greece.
-Thanks go to John Ioannidis for his help.
-<P>
-
-It is currently (2000)
-being developed and maintained by D. Hugh Redelmeier
-(<A HREF="mailto:hugh@mimosa.com">hugh@mimosa.com</A>), in Canada.  The regulations of Greece and Canada
-allow us to make the code freely redistributable.
-<P>
-
-Kai Martius (<A HREF="mailto:admin@imib.med.tu-dresden.de">admin@imib.med.tu-dresden.de</A>) contributed the initial
-version of the code supporting PFS.
-<P>
-
-Richard Guy Briggs &lt;<A HREF="mailto:rgb@conscoop.ottawa.on.ca">rgb@conscoop.ottawa.on.ca</A>&gt; and Peter Onion
-&lt;<A HREF="mailto:ponion@srd.bt.co.uk">ponion@srd.bt.co.uk</A>&gt; added the PFKEY2 support.
-<P>
-
-We gratefully acknowledge that we use parts of Eric Young's <I>libdes</I>
-package; see <I>../libdes/COPYRIGHT</I>.
-<A NAME="lbBA">&nbsp;</A>
-<H2>BUGS</H2>
-
-<B>pluto</B>
-
-is a work-in-progress.  It currently has many limitations.
-For example, it ignores notification messages that it receives, and
-it generates only Delete Notifications and those only for IPSEC SAs.
-<P>
-
-<B>pluto</B> does not support the Commit Flag.
-The Commit Flag is a bad feature of the IKE protocol.
-It isn't protected -- neither encrypted nor authenticated.
-A man in the middle could turn it on, leading to DoS.
-We just ignore it, with a warning.
-This should let us interoperate with
-implementations that insist on it, with minor damage.
-<P>
-
-<B>pluto</B> does not check that the SA returned by the Responder
-is actually one that was proposed.  It only checks that the SA is
-acceptable.  The difference is not large, but can show up in attributes
-such as SA lifetime.
-<P>
-
-There is no good way for a connection to be automatically terminated.
-This is a problem for Road Warrior and Opportunistic connections.
-The <B>--dontrekey</B> option does prevent the SAs from
-being rekeyed on expiry.
-Additonally, if a Road Warrior connection has a client subnet with a fixed IP
-address, a negotiation with that subnet will cause any other
-connection instantiations with that same subnet to be unoriented
-(deleted, in effect).
-See also the --uniqueids option for an extension of this.
-<P>
-
-When <B>pluto</B> sends a message to a peer that has disappeared,
-<B>pluto</B> receives incomplete information from the kernel, so it
-logs the unsatisfactory message ``some IKE message we sent has been
-rejected with ECONNREFUSED (kernel supplied no details)''.  John
-Denker suggests that this command is useful for tracking down the
-source of these problems:
-<BR>
-
-<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>tcpdump -i eth0 icmp[0] != 8 and icmp[0] != 0<BR>
-<BR>
-
-Substitute your public interface for eth0 if it is different.
-<P>
-
-The word ``authenticate'' is used for two different features.  We must
-authenticate each IKE peer to the other.  This is an important task of
-Phase 1.  Each packet must be authenticated, both in IKE and in IPsec,
-and the method for IPsec is negotiated as an AH SA or part of an ESP SA.
-Unfortunately, the protocol has no mechanism for authenticating the Phase 2
-identities.
-<P>
-
-Bugs should be reported to the &lt;<A HREF="mailto:users@lists.freeswan.org">users@lists.freeswan.org</A>&gt; mailing list.
-Caution: we cannot accept
-actual code from US residents, or even US citizens living outside the
-US, because that would bring FreeS/WAN under US export law.  Some
-other countries cause similar problems.  In general, we would prefer
-that you send detailed problem reports rather than code:  we want
-FreeS/WAN to be unquestionably freely exportable, which means being
-very careful about where the code comes from, and for a small bug fix,
-that is often more time-consuming than just reinventing the fix
-ourselves.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DL>
-<DT><A HREF="#lbAE">IKE's Job</A><DD>
-<DT><A HREF="#lbAF">Pluto</A><DD>
-<DT><A HREF="#lbAG">Before Running Pluto</A><DD>
-<DT><A HREF="#lbAH">Setting up <B>KLIPS</B> for <B>pluto</B></A><DD>
-<DT><A HREF="#lbAI">ipsec.secrets file</A><DD>
-<DT><A HREF="#lbAJ">Running Pluto</A><DD>
-<DT><A HREF="#lbAK">Pluto's Internal State</A><DD>
-<DT><A HREF="#lbAL">Using Whack</A><DD>
-<DT><A HREF="#lbAM">Examples</A><DD>
-<DT><A HREF="#lbAN">The updown command</A><DD>
-<DT><A HREF="#lbAO">Rekeying</A><DD>
-<DT><A HREF="#lbAP">Selecting a Connection When Responding: Road Warrior Support</A><DD>
-<DT><A HREF="#lbAQ">Debugging</A><DD>
-<DT><A HREF="#lbAR">Pluto's Behaviour When Things Go Wrong</A><DD>
-<DT><A HREF="#lbAS">Notes</A><DD>
-<DT><A HREF="#lbAT">Policies</A><DD>
-</DL>
-<DT><A HREF="#lbAU">SIGNALS</A><DD>
-<DT><A HREF="#lbAV">EXIT STATUS</A><DD>
-<DT><A HREF="#lbAW">FILES</A><DD>
-<DT><A HREF="#lbAX">ENVIRONMENT</A><DD>
-<DT><A HREF="#lbAY">SEE ALSO</A><DD>
-<DT><A HREF="#lbAZ">HISTORY</A><DD>
-<DT><A HREF="#lbBA">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_portof.3.html b/doc/manpage.d/ipsec_portof.3.html
deleted file mode 100644
index 3965ca62d..000000000
--- a/doc/manpage.d/ipsec_portof.3.html
+++ /dev/null
@@ -1,143 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_PORTOF</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_PORTOF</H1>
-Section: C Library Functions (3)<BR>Updated: 8 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec portof - get port field of an ip_address
-<BR>
-
-ipsec setportof - set port field of an ip_address
-<BR>
-
-ipsec sockaddrof - get pointer to internal sockaddr of an ip_address
-<BR>
-
-ipsec sockaddrlenof - get length of internal sockaddr of an ip_address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int portof(const ip_address *src);</B>
-
-<BR>
-
-<B>void setportof(int port, ip_address *dst);</B>
-
-<BR>
-
-<B>struct sockaddr *sockaddrof(ip_address *src);</B>
-
-<BR>
-
-<B>size_t sockaddrlenof(const ip_address *src);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-internal type
-<I>ip_address</I>
-
-contains one of the
-<I>sockaddr</I>
-
-types internally.
-<I>Reliance on this feature is discouraged</I>,
-but it may occasionally be necessary.
-These functions provide low-level tools for this purpose.
-<P>
-
-<I>Portof</I>
-
-and
-<I>setportof</I>
-
-respectively read and write the port-number field of the internal
-<I>sockaddr</I>.
-
-The values are in network byte order.
-<P>
-
-<I>Sockaddrof</I>
-
-returns a pointer to the internal
-<I>sockaddr</I>,
-
-for passing to other functions.
-<P>
-
-<I>Sockaddrlenof</I>
-
-reports the size of the internal
-<I>sockaddr</I>,
-
-for use in storage allocation.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_initaddr.3.html">ipsec_initaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-<I>Portof</I>
-
-returns
-<B>-1</B>,
-
-<I>sockaddrof</I>
-
-returns
-<B>NULL</B>,
-
-and
-<I>sockaddrlenof</I>
-
-returns
-<B>0</B>
-
-if an unknown address family is found within the
-<I>ip_address</I>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-These functions all depend on low-level details of the
-<I>ip_address</I>
-
-type, which are in principle subject to change.
-Avoid using them unless really necessary.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_prng.3.html b/doc/manpage.d/ipsec_prng.3.html
deleted file mode 100644
index 27763a2bb..000000000
--- a/doc/manpage.d/ipsec_prng.3.html
+++ /dev/null
@@ -1,204 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_PRNG</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_PRNG</H1>
-Section: C Library Functions (3)<BR>Updated: 1 April 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec prng_init - initialize IPsec pseudorandom-number generator
-<BR>
-
-ipsec prng_bytes - get bytes from IPsec pseudorandom-number generator
-<BR>
-
-ipsec prng_final - close down IPsec pseudorandom-number generator
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>void prng_init(struct prng *prng,</B>
-
-<BR>
-&nbsp;
-<B>const unsigned char *key, size_t keylen);</B>
-
-<BR>
-
-<B>void prng_bytes(struct prng *prng, char *dst,</B>
-
-<BR>
-&nbsp;
-<B>size_t dstlen);</B>
-
-<BR>
-
-<B>unsigned long prng_count(struct prng *prng);</B>
-
-<BR>
-
-<B>void prng_final(struct prng *prng);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Prng_init</I>
-
-initializes a crypto-quality pseudo-random-number generator from a key;
-<I>prng_bytes</I>
-
-obtains pseudo-random bytes from it;
-<I>prng_count</I>
-
-reports the number of bytes extracted from it to date;
-<I>prng_final</I>
-
-closes it down.
-It is the user's responsibility to initialize a PRNG before using it,
-and not to use it again after it is closed down.
-<P>
-
-<I>Prng_init</I>
-
-initializes,
-or re-initializes,
-the specified
-<I>prng</I>
-
-from the
-<I>key</I>,
-
-whose length is given by
-<I>keylen</I>.
-
-The user must allocate the
-<B>struct prng</B>
-
-pointed to by
-<I>prng</I>.
-
-There is no particular constraint on the length of the key,
-although a key longer than 256 bytes is unnecessary because
-only the first 256 would be used.
-Initialization requires on the order of 3000 integer operations,
-independent of key length.
-<P>
-
-<I>Prng_bytes</I>
-
-obtains
-<I>dstlen</I>
-
-pseudo-random bytes from the PRNG and puts them in
-<I>buf</I>.
-
-This is quite fast,
-on the order of 10 integer operations per byte.
-<P>
-
-<I>Prng_count</I>
-
-reports the number of bytes obtained from the PRNG
-since it was (last) initialized.
-<P>
-
-<I>Prng_final</I>
-
-closes down a PRNG by
-zeroing its internal memory,
-obliterating all trace of the state used to generate its previous output.
-This requires on the order of 250 integer operations.
-<P>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file supplies the definition of the
-<B>prng</B>
-
-structure.
-Examination of its innards is discouraged, as they may change.
-<P>
-
-The PRNG algorithm
-used by these functions is currently identical to that of RC4(TM).
-This algorithm is cryptographically strong,
-sufficiently unpredictable that even a hostile observer will
-have difficulty determining the next byte of output from past history,
-provided it is initialized from a reasonably large key composed of
-highly random bytes (see
-<I><A HREF="random.4.html">random</A></I>(4)).
-
-The usual run of software pseudo-random-number generators
-(e.g.
-<I><A HREF="random.3.html">random</A></I>(3))
-
-are
-<I>not</I>
-
-cryptographically strong.
-<P>
-
-The well-known attacks against RC4(TM),
-e.g. as found in 802.11b's WEP encryption system,
-apply only if multiple PRNGs are initialized with closely-related keys
-(e.g., using a counter appended to a base key).
-If such keys are used, the first few hundred pseudo-random bytes
-from each PRNG should be discarded,
-to give the PRNGs a chance to randomize their innards properly.
-No useful attacks are known if the key is well randomized to begin with.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="random.3.html">random</A>(3), <A HREF="random.4.html">random</A>(4)
-<BR>
-
-Bruce Schneier,
-<I>Applied Cryptography</I>, 2nd ed., 1996, ISBN 0-471-11709-9,
-pp. 397-8.
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAG">&nbsp;</A>
-<H2>BUGS</H2>
-
-If an attempt is made to obtain more than 4e9 bytes
-between initializations,
-the PRNG will continue to work but
-<I>prng_count</I>'s
-
-output will stick at
-<B>4000000000</B>.
-
-Fixing this would require a longer integer type and does
-not seem worth the trouble,
-since you should probably re-initialize before then anyway...
-<P>
-
-``RC4'' is a trademark of RSA Data Security, Inc.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-<DT><A HREF="#lbAG">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_prng_bytes.3.html b/doc/manpage.d/ipsec_prng_bytes.3.html
deleted file mode 100644
index 27763a2bb..000000000
--- a/doc/manpage.d/ipsec_prng_bytes.3.html
+++ /dev/null
@@ -1,204 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_PRNG</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_PRNG</H1>
-Section: C Library Functions (3)<BR>Updated: 1 April 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec prng_init - initialize IPsec pseudorandom-number generator
-<BR>
-
-ipsec prng_bytes - get bytes from IPsec pseudorandom-number generator
-<BR>
-
-ipsec prng_final - close down IPsec pseudorandom-number generator
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>void prng_init(struct prng *prng,</B>
-
-<BR>
-&nbsp;
-<B>const unsigned char *key, size_t keylen);</B>
-
-<BR>
-
-<B>void prng_bytes(struct prng *prng, char *dst,</B>
-
-<BR>
-&nbsp;
-<B>size_t dstlen);</B>
-
-<BR>
-
-<B>unsigned long prng_count(struct prng *prng);</B>
-
-<BR>
-
-<B>void prng_final(struct prng *prng);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Prng_init</I>
-
-initializes a crypto-quality pseudo-random-number generator from a key;
-<I>prng_bytes</I>
-
-obtains pseudo-random bytes from it;
-<I>prng_count</I>
-
-reports the number of bytes extracted from it to date;
-<I>prng_final</I>
-
-closes it down.
-It is the user's responsibility to initialize a PRNG before using it,
-and not to use it again after it is closed down.
-<P>
-
-<I>Prng_init</I>
-
-initializes,
-or re-initializes,
-the specified
-<I>prng</I>
-
-from the
-<I>key</I>,
-
-whose length is given by
-<I>keylen</I>.
-
-The user must allocate the
-<B>struct prng</B>
-
-pointed to by
-<I>prng</I>.
-
-There is no particular constraint on the length of the key,
-although a key longer than 256 bytes is unnecessary because
-only the first 256 would be used.
-Initialization requires on the order of 3000 integer operations,
-independent of key length.
-<P>
-
-<I>Prng_bytes</I>
-
-obtains
-<I>dstlen</I>
-
-pseudo-random bytes from the PRNG and puts them in
-<I>buf</I>.
-
-This is quite fast,
-on the order of 10 integer operations per byte.
-<P>
-
-<I>Prng_count</I>
-
-reports the number of bytes obtained from the PRNG
-since it was (last) initialized.
-<P>
-
-<I>Prng_final</I>
-
-closes down a PRNG by
-zeroing its internal memory,
-obliterating all trace of the state used to generate its previous output.
-This requires on the order of 250 integer operations.
-<P>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file supplies the definition of the
-<B>prng</B>
-
-structure.
-Examination of its innards is discouraged, as they may change.
-<P>
-
-The PRNG algorithm
-used by these functions is currently identical to that of RC4(TM).
-This algorithm is cryptographically strong,
-sufficiently unpredictable that even a hostile observer will
-have difficulty determining the next byte of output from past history,
-provided it is initialized from a reasonably large key composed of
-highly random bytes (see
-<I><A HREF="random.4.html">random</A></I>(4)).
-
-The usual run of software pseudo-random-number generators
-(e.g.
-<I><A HREF="random.3.html">random</A></I>(3))
-
-are
-<I>not</I>
-
-cryptographically strong.
-<P>
-
-The well-known attacks against RC4(TM),
-e.g. as found in 802.11b's WEP encryption system,
-apply only if multiple PRNGs are initialized with closely-related keys
-(e.g., using a counter appended to a base key).
-If such keys are used, the first few hundred pseudo-random bytes
-from each PRNG should be discarded,
-to give the PRNGs a chance to randomize their innards properly.
-No useful attacks are known if the key is well randomized to begin with.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="random.3.html">random</A>(3), <A HREF="random.4.html">random</A>(4)
-<BR>
-
-Bruce Schneier,
-<I>Applied Cryptography</I>, 2nd ed., 1996, ISBN 0-471-11709-9,
-pp. 397-8.
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAG">&nbsp;</A>
-<H2>BUGS</H2>
-
-If an attempt is made to obtain more than 4e9 bytes
-between initializations,
-the PRNG will continue to work but
-<I>prng_count</I>'s
-
-output will stick at
-<B>4000000000</B>.
-
-Fixing this would require a longer integer type and does
-not seem worth the trouble,
-since you should probably re-initialize before then anyway...
-<P>
-
-``RC4'' is a trademark of RSA Data Security, Inc.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-<DT><A HREF="#lbAG">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_prng_final.3.html b/doc/manpage.d/ipsec_prng_final.3.html
deleted file mode 100644
index 27763a2bb..000000000
--- a/doc/manpage.d/ipsec_prng_final.3.html
+++ /dev/null
@@ -1,204 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_PRNG</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_PRNG</H1>
-Section: C Library Functions (3)<BR>Updated: 1 April 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec prng_init - initialize IPsec pseudorandom-number generator
-<BR>
-
-ipsec prng_bytes - get bytes from IPsec pseudorandom-number generator
-<BR>
-
-ipsec prng_final - close down IPsec pseudorandom-number generator
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>void prng_init(struct prng *prng,</B>
-
-<BR>
-&nbsp;
-<B>const unsigned char *key, size_t keylen);</B>
-
-<BR>
-
-<B>void prng_bytes(struct prng *prng, char *dst,</B>
-
-<BR>
-&nbsp;
-<B>size_t dstlen);</B>
-
-<BR>
-
-<B>unsigned long prng_count(struct prng *prng);</B>
-
-<BR>
-
-<B>void prng_final(struct prng *prng);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Prng_init</I>
-
-initializes a crypto-quality pseudo-random-number generator from a key;
-<I>prng_bytes</I>
-
-obtains pseudo-random bytes from it;
-<I>prng_count</I>
-
-reports the number of bytes extracted from it to date;
-<I>prng_final</I>
-
-closes it down.
-It is the user's responsibility to initialize a PRNG before using it,
-and not to use it again after it is closed down.
-<P>
-
-<I>Prng_init</I>
-
-initializes,
-or re-initializes,
-the specified
-<I>prng</I>
-
-from the
-<I>key</I>,
-
-whose length is given by
-<I>keylen</I>.
-
-The user must allocate the
-<B>struct prng</B>
-
-pointed to by
-<I>prng</I>.
-
-There is no particular constraint on the length of the key,
-although a key longer than 256 bytes is unnecessary because
-only the first 256 would be used.
-Initialization requires on the order of 3000 integer operations,
-independent of key length.
-<P>
-
-<I>Prng_bytes</I>
-
-obtains
-<I>dstlen</I>
-
-pseudo-random bytes from the PRNG and puts them in
-<I>buf</I>.
-
-This is quite fast,
-on the order of 10 integer operations per byte.
-<P>
-
-<I>Prng_count</I>
-
-reports the number of bytes obtained from the PRNG
-since it was (last) initialized.
-<P>
-
-<I>Prng_final</I>
-
-closes down a PRNG by
-zeroing its internal memory,
-obliterating all trace of the state used to generate its previous output.
-This requires on the order of 250 integer operations.
-<P>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file supplies the definition of the
-<B>prng</B>
-
-structure.
-Examination of its innards is discouraged, as they may change.
-<P>
-
-The PRNG algorithm
-used by these functions is currently identical to that of RC4(TM).
-This algorithm is cryptographically strong,
-sufficiently unpredictable that even a hostile observer will
-have difficulty determining the next byte of output from past history,
-provided it is initialized from a reasonably large key composed of
-highly random bytes (see
-<I><A HREF="random.4.html">random</A></I>(4)).
-
-The usual run of software pseudo-random-number generators
-(e.g.
-<I><A HREF="random.3.html">random</A></I>(3))
-
-are
-<I>not</I>
-
-cryptographically strong.
-<P>
-
-The well-known attacks against RC4(TM),
-e.g. as found in 802.11b's WEP encryption system,
-apply only if multiple PRNGs are initialized with closely-related keys
-(e.g., using a counter appended to a base key).
-If such keys are used, the first few hundred pseudo-random bytes
-from each PRNG should be discarded,
-to give the PRNGs a chance to randomize their innards properly.
-No useful attacks are known if the key is well randomized to begin with.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="random.3.html">random</A>(3), <A HREF="random.4.html">random</A>(4)
-<BR>
-
-Bruce Schneier,
-<I>Applied Cryptography</I>, 2nd ed., 1996, ISBN 0-471-11709-9,
-pp. 397-8.
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAG">&nbsp;</A>
-<H2>BUGS</H2>
-
-If an attempt is made to obtain more than 4e9 bytes
-between initializations,
-the PRNG will continue to work but
-<I>prng_count</I>'s
-
-output will stick at
-<B>4000000000</B>.
-
-Fixing this would require a longer integer type and does
-not seem worth the trouble,
-since you should probably re-initialize before then anyway...
-<P>
-
-``RC4'' is a trademark of RSA Data Security, Inc.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-<DT><A HREF="#lbAG">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_prng_init.3.html b/doc/manpage.d/ipsec_prng_init.3.html
deleted file mode 100644
index 27763a2bb..000000000
--- a/doc/manpage.d/ipsec_prng_init.3.html
+++ /dev/null
@@ -1,204 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_PRNG</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_PRNG</H1>
-Section: C Library Functions (3)<BR>Updated: 1 April 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec prng_init - initialize IPsec pseudorandom-number generator
-<BR>
-
-ipsec prng_bytes - get bytes from IPsec pseudorandom-number generator
-<BR>
-
-ipsec prng_final - close down IPsec pseudorandom-number generator
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>void prng_init(struct prng *prng,</B>
-
-<BR>
-&nbsp;
-<B>const unsigned char *key, size_t keylen);</B>
-
-<BR>
-
-<B>void prng_bytes(struct prng *prng, char *dst,</B>
-
-<BR>
-&nbsp;
-<B>size_t dstlen);</B>
-
-<BR>
-
-<B>unsigned long prng_count(struct prng *prng);</B>
-
-<BR>
-
-<B>void prng_final(struct prng *prng);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Prng_init</I>
-
-initializes a crypto-quality pseudo-random-number generator from a key;
-<I>prng_bytes</I>
-
-obtains pseudo-random bytes from it;
-<I>prng_count</I>
-
-reports the number of bytes extracted from it to date;
-<I>prng_final</I>
-
-closes it down.
-It is the user's responsibility to initialize a PRNG before using it,
-and not to use it again after it is closed down.
-<P>
-
-<I>Prng_init</I>
-
-initializes,
-or re-initializes,
-the specified
-<I>prng</I>
-
-from the
-<I>key</I>,
-
-whose length is given by
-<I>keylen</I>.
-
-The user must allocate the
-<B>struct prng</B>
-
-pointed to by
-<I>prng</I>.
-
-There is no particular constraint on the length of the key,
-although a key longer than 256 bytes is unnecessary because
-only the first 256 would be used.
-Initialization requires on the order of 3000 integer operations,
-independent of key length.
-<P>
-
-<I>Prng_bytes</I>
-
-obtains
-<I>dstlen</I>
-
-pseudo-random bytes from the PRNG and puts them in
-<I>buf</I>.
-
-This is quite fast,
-on the order of 10 integer operations per byte.
-<P>
-
-<I>Prng_count</I>
-
-reports the number of bytes obtained from the PRNG
-since it was (last) initialized.
-<P>
-
-<I>Prng_final</I>
-
-closes down a PRNG by
-zeroing its internal memory,
-obliterating all trace of the state used to generate its previous output.
-This requires on the order of 250 integer operations.
-<P>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file supplies the definition of the
-<B>prng</B>
-
-structure.
-Examination of its innards is discouraged, as they may change.
-<P>
-
-The PRNG algorithm
-used by these functions is currently identical to that of RC4(TM).
-This algorithm is cryptographically strong,
-sufficiently unpredictable that even a hostile observer will
-have difficulty determining the next byte of output from past history,
-provided it is initialized from a reasonably large key composed of
-highly random bytes (see
-<I><A HREF="random.4.html">random</A></I>(4)).
-
-The usual run of software pseudo-random-number generators
-(e.g.
-<I><A HREF="random.3.html">random</A></I>(3))
-
-are
-<I>not</I>
-
-cryptographically strong.
-<P>
-
-The well-known attacks against RC4(TM),
-e.g. as found in 802.11b's WEP encryption system,
-apply only if multiple PRNGs are initialized with closely-related keys
-(e.g., using a counter appended to a base key).
-If such keys are used, the first few hundred pseudo-random bytes
-from each PRNG should be discarded,
-to give the PRNGs a chance to randomize their innards properly.
-No useful attacks are known if the key is well randomized to begin with.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="random.3.html">random</A>(3), <A HREF="random.4.html">random</A>(4)
-<BR>
-
-Bruce Schneier,
-<I>Applied Cryptography</I>, 2nd ed., 1996, ISBN 0-471-11709-9,
-pp. 397-8.
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAG">&nbsp;</A>
-<H2>BUGS</H2>
-
-If an attempt is made to obtain more than 4e9 bytes
-between initializations,
-the PRNG will continue to work but
-<I>prng_count</I>'s
-
-output will stick at
-<B>4000000000</B>.
-
-Fixing this would require a longer integer type and does
-not seem worth the trouble,
-since you should probably re-initialize before then anyway...
-<P>
-
-``RC4'' is a trademark of RSA Data Security, Inc.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-<DT><A HREF="#lbAG">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_ranbits.8.html b/doc/manpage.d/ipsec_ranbits.8.html
deleted file mode 100644
index 036b2a351..000000000
--- a/doc/manpage.d/ipsec_ranbits.8.html
+++ /dev/null
@@ -1,147 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_RANBITS</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_RANBITS</H1>
-Section: Maintenance Commands (8)<BR>Updated: 22 Aug 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ranbits - generate random bits in ASCII form
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>ranbits</B>
-
-[
-<B>--quick</B>
-
-] [
-<B>--continuous</B>
-
-] [
-<B>--bytes</B>
-
-] nbits
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ranbits</I>
-
-obtains
-<I>nbits</I>
-
-(rounded up to the nearest byte)
-high-quality random bits from
-<I><A HREF="random.4.html">random</A></I>(4),
-
-and emits them on standard output as an ASCII string.
-The default output format is
-<I><A HREF="datatot.3.html">datatot</A></I>(3)
-
-<B>h</B>
-
-format:
-lowercase hexadecimal with a
-<B>0x</B>
-
-prefix and an underscore every 32 bits.
-<P>
-
-The
-<B>--quick</B>
-
-option produces quick-and-dirty random bits:
-instead of using the high-quality random bits from
-<I>/dev/random</I>,
-
-which may take some time to supply the necessary bits if
-<I>nbits</I>
-
-is large,
-<I>ranbits</I>
-
-uses
-<I>/dev/urandom</I>,
-
-which yields prompt results but lower-quality randomness.
-<P>
-
-The
-<B>--continuous</B>
-
-option uses
-<I><A HREF="datatot.3.html">datatot</A></I>(3)
-
-<B>x</B>
-
-output format, like
-<B>h</B>
-
-but without the underscores.
-<P>
-
-The
-<B>--bytes</B>
-
-option causes
-<I>nbits</I>
-
-to be interpreted as a byte count rather than a bit count.
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-/dev/random, /dev/urandom
-<A NAME="lbAF">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec_datatot.3.html">ipsec_datatot</A>(3), <A HREF="random.4.html">random</A>(4)
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-There is an internal limit on
-<I>nbits</I>,
-
-currently 20000.
-<P>
-
-Without
-<B>--quick</B>,
-
-<I>ranbits</I>'s
-
-run time is difficult to predict.
-A request for a large number of bits,
-at a time when the system's entropy pool is low on randomness,
-may take quite a while to satisfy.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">SEE ALSO</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_rangetoa.3.html b/doc/manpage.d/ipsec_rangetoa.3.html
deleted file mode 100644
index 3bacd5943..000000000
--- a/doc/manpage.d/ipsec_rangetoa.3.html
+++ /dev/null
@@ -1,294 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ATOASR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ATOASR</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec atoasr - convert ASCII to Internet address, subnet, or range
-<BR>
-
-ipsec rangetoa - convert Internet address range to ASCII
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *atoasr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>char *type, struct in_addr *addrs);</B>
-
-<BR>
-
-<B>size_t rangetoa(struct in_addr *addrs, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete;
-there is no current equivalent,
-because so far they have not proved useful.
-<P>
-
-<I>Atoasr</I>
-
-converts an ASCII address, subnet, or address range
-into a suitable combination of binary addresses
-(in network byte order).
-<I>Rangetoa</I>
-
-converts an address range back into ASCII,
-using dotted-decimal form for the addresses
-(the other reverse conversions are handled by
-<I><A HREF="ipsec_addrtoa.3.html">ipsec_addrtoa</A></I>(3)
-
-and
-<I><A HREF="ipsec_subnettoa.3.html">ipsec_subnettoa</A></I>(3)).
-
-<P>
-
-A single address can be any form acceptable to
-<I><A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A></I>(3):
-
-dotted decimal, DNS name, or hexadecimal number.
-A subnet
-specification uses the form <I>network</I><B>/</B><I>mask</I>
-interpreted by
-<I><A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A></I>(3).
-
-<P>
-
-An address range is two
-<I><A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A></I>(3)
-
-addresses separated by a
-<B>...</B>
-
-delimiter.
-If there are four dots rather than three, the first is taken as
-part of the begin address,
-e.g. for a complete DNS name which ends with
-<B>.</B>
-
-to suppress completion attempts.
-The begin address of a range must be
-less than or equal to the end address.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>atoasr</I>
-
-specifies the length of the ASCII string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>type</I>
-
-parameter of
-<I>atoasr</I>
-
-must point to a
-<B>char</B>
-
-variable used to record which form was found.
-The
-<I>addrs</I>
-
-parameter must point to a two-element array of
-<B>struct in_addr</B>
-
-which receives the results.
-The values stored into
-<B>*type</B>,
-
-and the corresponding values in the array, are:
-<P>
-
-
-
-<TT>&nbsp;&nbsp;&nbsp;</TT>*typeaddrs[0]addrs[1]<BR>
-<P>
-address<B>'a'</B>address-<BR>
-<BR>
-
-subnet<TT>&nbsp;</TT><B>'s'</B>networkmask<BR>
-<BR>
-
-range<TT>&nbsp;&nbsp;</TT><B>'r'</B>beginend<BR>
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>rangetoa</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines a constant,
-<B>RANGETOA_BUF</B>,
-
-which is the size of a buffer just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>rangetoa</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the ASCII character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default,
-and is in fact the only format currently available.
-This parameter is a hedge against future needs.
-<P>
-
-<I>Atoasr</I>
-
-returns NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<I>Rangetoa</I>
-
-returns
-<B>0</B>
-
-for a failure, and otherwise
-always returns the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A>(3), <A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>atoasr</I>
-
-are:
-empty input;
-error in
-<I><A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A></I>(3)
-
-or
-<I><A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A></I>(3)
-
-during conversion;
-begin address of range exceeds end address.
-<P>
-
-Fatal errors in
-<I>rangetoa</I>
-
-are:
-unknown format.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The restriction of error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = atoasr( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_rangetosubnet.3.html b/doc/manpage.d/ipsec_rangetosubnet.3.html
deleted file mode 100644
index 9e03244ea..000000000
--- a/doc/manpage.d/ipsec_rangetosubnet.3.html
+++ /dev/null
@@ -1,116 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_RANGETOSUBNET</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_RANGETOSUBNET</H1>
-Section: C Library Functions (3)<BR>Updated: 8 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec rangetosubnet - convert address range to subnet
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *rangetosubnet(const ip_address *start,</B>
-
-<BR>
-&nbsp;
-<B>const ip_address *stop, ip_subnet *dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Rangetosubnet</I>
-
-accepts two IP addresses which define an address range,
-from
-<I>start</I>
-
-to
-<I>stop</I>
-
-inclusive,
-and converts this to a subnet if possible.
-The addresses must both be IPv4 or both be IPv6,
-and the address family of the resulting subnet is the same.
-<P>
-
-<I>Rangetosubnet</I>
-
-returns NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec_initsubnet.3.html">ipsec_initsubnet</A>(3), <A HREF="ipsec_ttosubnet.3.html">ipsec_ttosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>rangetosubnet</I>
-
-are:
-mixed address families;
-unknown address family;
-<I>start</I>
-
-and
-<I>stop</I>
-
-do not define a subnet.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The restriction of error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = rangetosubnet( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_rsasigkey.8.html b/doc/manpage.d/ipsec_rsasigkey.8.html
deleted file mode 100644
index 3173a9f13..000000000
--- a/doc/manpage.d/ipsec_rsasigkey.8.html
+++ /dev/null
@@ -1,401 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_RSASIGKEY</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_RSASIGKEY</H1>
-Section: Maintenance Commands (8)<BR>Updated: 22 July 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec rsasigkey - generate RSA signature key
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>rsasigkey</B>
-
-[
-<B>--verbose</B>
-
-] [
-<B>--random</B>
-
-filename
-]
-<B>\</B>
-
-<BR>
-
-&nbsp;&nbsp;&nbsp;[
-<B>--rounds</B>
-
-nr
-] [
-<B>--hostname</B>
-
-host ] [
-<B>--noopt</B>
-
-] nbits
-<BR>
-
-<B>ipsec</B>
-
-<B>rsasigkey</B>
-
-[
-<B>--verbose</B>
-
-] [
-<B>--hostname</B>
-
-host ]
-<B>\</B>
-
-<BR>
-
-&nbsp;&nbsp;&nbsp;
-[
-<B>--noopt</B>
-
-]
-<B>--oldkey</B>
-
-file
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Rsasigkey</I>
-
-generates an RSA public/private key pair,
-suitable for digital signatures,
-of (exactly)
-<I>nbits</I>
-
-bits (that is, two primes each of exactly
-<I>nbits</I>/2
-
-bits,
-and related numbers)
-and emits it on standard output as ASCII (mostly hex) data.
-<I>nbits</I>
-
-must be a multiple of 16.
-<P>
-
-The public exponent is forced to the value
-<B>3</B>,
-
-which has important speed advantages for signature checking.
-Beware that the resulting keys have known weaknesses as encryption keys
-<I>and should not be used for that purpose</I>.
-<P>
-
-The
-<B>--verbose</B>
-
-option makes
-<I>rsasigkey</I>
-
-give a running commentary on standard error.
-By default, it works in silence until it is ready to generate output.
-<P>
-
-The
-<B>--random</B>
-
-option specifies a source for random bits.
-The default is
-<I>/dev/random</I>
-
-(see
-<I><A HREF="random.4.html">random</A></I>(4)).
-
-Normally,
-<I>rsasigkey</I>
-
-reads exactly
-<I>nbits</I>
-
-random bits from the source;
-in extremely-rare circumstances it may need more.
-<P>
-
-The
-<B>--rounds</B>
-
-option specifies the number of rounds to be done by the
-<I>mpz_probab_prime_p</I>
-
-probabilistic primality checker.
-The default, 30, is fairly rigorous and should not normally
-have to be overridden.
-<P>
-
-The
-<B>--hostname</B>
-
-option specifies what host name to use in
-the first line of the output (see below);
-the default is what
-<I><A HREF="gethostname.2.html">gethostname</A></I>(2)
-
-returns.
-<P>
-
-The
-<B>--noopt</B>
-
-option suppresses an optimization of the private key
-(to be precise, setting of the decryption exponent to
-<B>lcm(p-1,q-1)</B>
-
-rather than
-<B>(p-1)*(q-1)</B>)
-
-which speeds up operations on it slightly
-but can cause it to flunk a validity check in old RSA implementations
-(notably, obsolete versions of
-<I><A HREF="ipsec_pluto.8.html">ipsec_pluto</A></I>(8)).
-
-<P>
-
-The
-<B>--oldkey</B>
-
-option specifies that rather than generate a new key,
-<I>rsasigkey</I>
-
-should read an old key from the
-<I>file</I>
-
-(the name
-<B>-</B>
-
-means ``standard input'')
-and use that to generate its output.
-Input lines which do not look like
-<I>rsasigkey</I>
-
-output are silently ignored.
-This permits updating old keys to the current format.
-<P>
-
-The output format looks like this (with long numbers trimmed down
-for clarity):
-<P>
-
-
-<PRE>
-        # RSA 2048 bits   xy.example.com   Sat Apr 15 13:53:22 2000
-        # for signatures only, UNSAFE FOR ENCRYPTION
-        #pubkey=0sAQOF8tZ2NZt...Y1P+buFuFn/
-        Modulus: 0xcc2a86fcf440...cf1011abb82d1
-        PublicExponent: 0x03
-        # everything after this point is secret
-        PrivateExponent: 0x881c59fdf8...ab05c8c77d23
-        Prime1: 0xf49fd1f779...46504c7bf3
-        Prime2: 0xd5a9108453...321d43cb2b
-        Exponent1: 0xa31536a4fb...536d98adda7f7
-        Exponent2: 0x8e70b5ad8d...9142168d7dcc7
-        Coefficient: 0xafb761d001...0c13e98d98
-</PRE>
-
-<P>
-
-The first (comment) line,
-indicating the nature and date of the key,
-and giving a host name,
-is used by
-<I><A HREF="ipsec_showhostkey.8.html">ipsec_showhostkey</A></I>(8)
-
-when generating some forms of key output.
-<P>
-
-The commented-out
-<B>pubkey=</B>
-
-line contains the public key---the public exponent and the modulus---combined
-in approximately RFC 2537 format
-(the one deviation is that the combined value is given with a
-<B>0s</B>
-
-prefix, rather than in unadorned base-64),
-suitable for use in the
-<I>ipsec.conf</I>
-
-file.
-<P>
-
-The
-<B>Modulus</B>,
-
-<B>PublicExponent</B>,
-
-and
-<B>PrivateExponent</B>
-
-lines give the basic signing and verification data.
-<P>
-
-The
-<B>Prime1</B>
-
-and
-<B>Prime2</B>
-
-lines give the primes themselves (aka
-<I>p</I>
-
-and
-<I>q</I>),
-
-largest first.
-The
-<B>Exponent1</B>
-
-and
-<B>Exponent2</B>
-
-lines give
-the private exponent mod
-<I>p-1</I>
-
-and
-<I>q-1</I>
-
-respectively.
-The
-<B>Coefficient</B>
-
-line gives the Chinese Remainder Theorem coefficient,
-which is the inverse of
-<I>q</I>,
-
-mod
-<I>p</I>.
-
-These additional numbers (which must all be kept as secret as the
-private exponent) are precomputed aids to rapid signature generation.
-<P>
-
-No attempt is made to break long lines.
-<P>
-
-The US patent on the RSA algorithm expired 20 Sept 2000.
-<A NAME="lbAE">&nbsp;</A>
-<H2>EXAMPLES</H2>
-
-<DL COMPACT>
-<DT><B>ipsec rsasigkey --verbose 2192 &gt;mykey</B>
-
-<DD>
-generates a 2192-bit signature key and puts it in the file
-<I>mykey</I>,
-
-with running commentary on standard error.
-The file contents can be inserted verbatim into a suitable entry in the
-<I>ipsec.secrets</I>
-
-file (see
-<I><A HREF="ipsec.secrets.5.html">ipsec.secrets</A></I>(5)),
-
-and the public key can then be extracted and edited into the
-<I>ipsec.conf</I>
-
-file (see
-<I><A HREF="ipsec.conf.5.html">ipsec.conf</A></I>(5)).
-
-<DT><B>ipsec rsasigkey --verbose --oldkey oldie &gt;latest</B>
-
-<DD>
-takes the old signature key from file
-<I>oldie</I>
-
-and puts a version in the current format into the file
-<I>latest</I>,
-
-with running commentary on standard error.
-</DL>
-<A NAME="lbAF">&nbsp;</A>
-<H2>FILES</H2>
-
-/dev/random
-<A NAME="lbAG">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="random.4.html">random</A>(4), <A HREF="ipsec_showhostkey.8.html">ipsec_showhostkey</A>(8)
-<BR>
-
-<I>Applied Cryptography</I>, 2nd. ed., by Bruce Schneier, Wiley 1996.
-<BR>
-
-RFCs 2537, 2313.
-<BR>
-
-<I>GNU MP, the GNU multiple precision arithmetic library, edition 2.0.2</I>,
-by Torbj Granlund.
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Henry Spencer.
-<A NAME="lbAI">&nbsp;</A>
-<H2>BUGS</H2>
-
-There is an internal limit on
-<I>nbits</I>,
-
-currently 20000.
-<P>
-
-<I>Rsasigkey</I>'s
-
-run time is difficult to predict,
-since
-<I>/dev/random</I>
-
-output can be arbitrarily delayed if
-the system's entropy pool is low on randomness,
-and the time taken by the search for primes is also somewhat unpredictable.
-A reasonably typical time for a 1024-bit key on a quiet 200MHz Pentium MMX
-with plenty of randomness available is 20 seconds,
-almost all of it in the prime searches.
-Generating a 2192-bit key on the same system usually takes several minutes.
-A 4096-bit key took an hour and a half of CPU time.
-<P>
-
-The
-<B>--oldkey</B>
-
-option does not check its input format as rigorously as it might.
-Corrupted
-<I>rsasigkey</I>
-
-output may confuse it.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">EXAMPLES</A><DD>
-<DT><A HREF="#lbAF">FILES</A><DD>
-<DT><A HREF="#lbAG">SEE ALSO</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-<DT><A HREF="#lbAI">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_sameaddr.3.html b/doc/manpage.d/ipsec_sameaddr.3.html
deleted file mode 100644
index 414a0d513..000000000
--- a/doc/manpage.d/ipsec_sameaddr.3.html
+++ /dev/null
@@ -1,274 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 28 Nov 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec sameaddr - are two addresses the same?
-<BR>
-
-ipsec addrcmp - ordered comparison of addresses
-<BR>
-
-ipsec samesubnet - are two subnets the same?
-<BR>
-
-ipsec addrinsubnet - is an address within a subnet?
-<BR>
-
-ipsec subnetinsubnet - is a subnet within another subnet?
-<BR>
-
-ipsec subnetishost - is a subnet a single host?
-<BR>
-
-ipsec samesaid - are two SA IDs the same?
-<BR>
-
-ipsec sameaddrtype - are two addresses of the same address family?
-<BR>
-
-ipsec samesubnettype - are two subnets of the same address family?
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int sameaddr(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int addrcmp(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int addrinsubnet(const ip_address *a, const ip_subnet *s);</B>
-
-<BR>
-
-<B>int subnetinsubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int subnetishost(const ip_subnet *s);</B>
-
-<BR>
-
-<B>int samesaid(const ip_said *a, const ip_said *b);</B>
-
-<BR>
-
-<B>int sameaddrtype(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnettype(const ip_subnet *a, const ip_subnet *b);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions do various comparisons and tests on the
-<I>ip_address</I>
-
-type and
-<I>ip_subnet</I>
-
-types.
-<P>
-
-<I>Sameaddr</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Addresses of different families are never identical.
-<P>
-
-<I>Addrcmp</I>
-
-returns
-<B>-1</B>,
-
-<B>0</B>,
-
-or
-<B>1</B>
-
-respectively
-if address
-<I>a</I>
-
-is less than, equal to, or greater than
-<I>b</I>.
-
-If they are not of the same address family,
-they are never equal;
-the ordering reported in this case is arbitrary
-(and probably not useful) but consistent.
-<P>
-
-<I>Samesubnet</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Subnets of different address families are never identical.
-<P>
-
-<I>Addrinsubnet</I>
-
-returns
-non-zero
-if address
-<I>a</I>
-
-is within subnet
-<I>s</I>
-
-and
-<B>0</B>
-
-otherwise.
-An address is never within a
-subnet of a different address family.
-<P>
-
-<I>Subnetinsubnet</I>
-
-returns
-non-zero
-if subnet
-<I>a</I>
-
-is a subset of subnet
-<I>b</I>
-
-and
-<B>0</B>
-
-otherwise.
-A subnet is deemed to be a subset of itself.
-A subnet is never a subset of another
-subnet if their address families differ.
-<P>
-
-<I>Subnetishost</I>
-
-returns
-non-zero
-if subnet
-<I>s</I>
-
-is in fact only a single host,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesaid</I>
-
-returns
-non-zero
-if SA IDs
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Sameaddrtype</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesubnettype</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_initaddr.3.html">ipsec_initaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_sameaddrtype.3.html b/doc/manpage.d/ipsec_sameaddrtype.3.html
deleted file mode 100644
index 414a0d513..000000000
--- a/doc/manpage.d/ipsec_sameaddrtype.3.html
+++ /dev/null
@@ -1,274 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 28 Nov 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec sameaddr - are two addresses the same?
-<BR>
-
-ipsec addrcmp - ordered comparison of addresses
-<BR>
-
-ipsec samesubnet - are two subnets the same?
-<BR>
-
-ipsec addrinsubnet - is an address within a subnet?
-<BR>
-
-ipsec subnetinsubnet - is a subnet within another subnet?
-<BR>
-
-ipsec subnetishost - is a subnet a single host?
-<BR>
-
-ipsec samesaid - are two SA IDs the same?
-<BR>
-
-ipsec sameaddrtype - are two addresses of the same address family?
-<BR>
-
-ipsec samesubnettype - are two subnets of the same address family?
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int sameaddr(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int addrcmp(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int addrinsubnet(const ip_address *a, const ip_subnet *s);</B>
-
-<BR>
-
-<B>int subnetinsubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int subnetishost(const ip_subnet *s);</B>
-
-<BR>
-
-<B>int samesaid(const ip_said *a, const ip_said *b);</B>
-
-<BR>
-
-<B>int sameaddrtype(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnettype(const ip_subnet *a, const ip_subnet *b);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions do various comparisons and tests on the
-<I>ip_address</I>
-
-type and
-<I>ip_subnet</I>
-
-types.
-<P>
-
-<I>Sameaddr</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Addresses of different families are never identical.
-<P>
-
-<I>Addrcmp</I>
-
-returns
-<B>-1</B>,
-
-<B>0</B>,
-
-or
-<B>1</B>
-
-respectively
-if address
-<I>a</I>
-
-is less than, equal to, or greater than
-<I>b</I>.
-
-If they are not of the same address family,
-they are never equal;
-the ordering reported in this case is arbitrary
-(and probably not useful) but consistent.
-<P>
-
-<I>Samesubnet</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Subnets of different address families are never identical.
-<P>
-
-<I>Addrinsubnet</I>
-
-returns
-non-zero
-if address
-<I>a</I>
-
-is within subnet
-<I>s</I>
-
-and
-<B>0</B>
-
-otherwise.
-An address is never within a
-subnet of a different address family.
-<P>
-
-<I>Subnetinsubnet</I>
-
-returns
-non-zero
-if subnet
-<I>a</I>
-
-is a subset of subnet
-<I>b</I>
-
-and
-<B>0</B>
-
-otherwise.
-A subnet is deemed to be a subset of itself.
-A subnet is never a subset of another
-subnet if their address families differ.
-<P>
-
-<I>Subnetishost</I>
-
-returns
-non-zero
-if subnet
-<I>s</I>
-
-is in fact only a single host,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesaid</I>
-
-returns
-non-zero
-if SA IDs
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Sameaddrtype</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesubnettype</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_initaddr.3.html">ipsec_initaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_samesaid.3.html b/doc/manpage.d/ipsec_samesaid.3.html
deleted file mode 100644
index 414a0d513..000000000
--- a/doc/manpage.d/ipsec_samesaid.3.html
+++ /dev/null
@@ -1,274 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 28 Nov 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec sameaddr - are two addresses the same?
-<BR>
-
-ipsec addrcmp - ordered comparison of addresses
-<BR>
-
-ipsec samesubnet - are two subnets the same?
-<BR>
-
-ipsec addrinsubnet - is an address within a subnet?
-<BR>
-
-ipsec subnetinsubnet - is a subnet within another subnet?
-<BR>
-
-ipsec subnetishost - is a subnet a single host?
-<BR>
-
-ipsec samesaid - are two SA IDs the same?
-<BR>
-
-ipsec sameaddrtype - are two addresses of the same address family?
-<BR>
-
-ipsec samesubnettype - are two subnets of the same address family?
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int sameaddr(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int addrcmp(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int addrinsubnet(const ip_address *a, const ip_subnet *s);</B>
-
-<BR>
-
-<B>int subnetinsubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int subnetishost(const ip_subnet *s);</B>
-
-<BR>
-
-<B>int samesaid(const ip_said *a, const ip_said *b);</B>
-
-<BR>
-
-<B>int sameaddrtype(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnettype(const ip_subnet *a, const ip_subnet *b);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions do various comparisons and tests on the
-<I>ip_address</I>
-
-type and
-<I>ip_subnet</I>
-
-types.
-<P>
-
-<I>Sameaddr</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Addresses of different families are never identical.
-<P>
-
-<I>Addrcmp</I>
-
-returns
-<B>-1</B>,
-
-<B>0</B>,
-
-or
-<B>1</B>
-
-respectively
-if address
-<I>a</I>
-
-is less than, equal to, or greater than
-<I>b</I>.
-
-If they are not of the same address family,
-they are never equal;
-the ordering reported in this case is arbitrary
-(and probably not useful) but consistent.
-<P>
-
-<I>Samesubnet</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Subnets of different address families are never identical.
-<P>
-
-<I>Addrinsubnet</I>
-
-returns
-non-zero
-if address
-<I>a</I>
-
-is within subnet
-<I>s</I>
-
-and
-<B>0</B>
-
-otherwise.
-An address is never within a
-subnet of a different address family.
-<P>
-
-<I>Subnetinsubnet</I>
-
-returns
-non-zero
-if subnet
-<I>a</I>
-
-is a subset of subnet
-<I>b</I>
-
-and
-<B>0</B>
-
-otherwise.
-A subnet is deemed to be a subset of itself.
-A subnet is never a subset of another
-subnet if their address families differ.
-<P>
-
-<I>Subnetishost</I>
-
-returns
-non-zero
-if subnet
-<I>s</I>
-
-is in fact only a single host,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesaid</I>
-
-returns
-non-zero
-if SA IDs
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Sameaddrtype</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesubnettype</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_initaddr.3.html">ipsec_initaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_samesubnet.3.html b/doc/manpage.d/ipsec_samesubnet.3.html
deleted file mode 100644
index 414a0d513..000000000
--- a/doc/manpage.d/ipsec_samesubnet.3.html
+++ /dev/null
@@ -1,274 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 28 Nov 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec sameaddr - are two addresses the same?
-<BR>
-
-ipsec addrcmp - ordered comparison of addresses
-<BR>
-
-ipsec samesubnet - are two subnets the same?
-<BR>
-
-ipsec addrinsubnet - is an address within a subnet?
-<BR>
-
-ipsec subnetinsubnet - is a subnet within another subnet?
-<BR>
-
-ipsec subnetishost - is a subnet a single host?
-<BR>
-
-ipsec samesaid - are two SA IDs the same?
-<BR>
-
-ipsec sameaddrtype - are two addresses of the same address family?
-<BR>
-
-ipsec samesubnettype - are two subnets of the same address family?
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int sameaddr(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int addrcmp(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int addrinsubnet(const ip_address *a, const ip_subnet *s);</B>
-
-<BR>
-
-<B>int subnetinsubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int subnetishost(const ip_subnet *s);</B>
-
-<BR>
-
-<B>int samesaid(const ip_said *a, const ip_said *b);</B>
-
-<BR>
-
-<B>int sameaddrtype(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnettype(const ip_subnet *a, const ip_subnet *b);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions do various comparisons and tests on the
-<I>ip_address</I>
-
-type and
-<I>ip_subnet</I>
-
-types.
-<P>
-
-<I>Sameaddr</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Addresses of different families are never identical.
-<P>
-
-<I>Addrcmp</I>
-
-returns
-<B>-1</B>,
-
-<B>0</B>,
-
-or
-<B>1</B>
-
-respectively
-if address
-<I>a</I>
-
-is less than, equal to, or greater than
-<I>b</I>.
-
-If they are not of the same address family,
-they are never equal;
-the ordering reported in this case is arbitrary
-(and probably not useful) but consistent.
-<P>
-
-<I>Samesubnet</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Subnets of different address families are never identical.
-<P>
-
-<I>Addrinsubnet</I>
-
-returns
-non-zero
-if address
-<I>a</I>
-
-is within subnet
-<I>s</I>
-
-and
-<B>0</B>
-
-otherwise.
-An address is never within a
-subnet of a different address family.
-<P>
-
-<I>Subnetinsubnet</I>
-
-returns
-non-zero
-if subnet
-<I>a</I>
-
-is a subset of subnet
-<I>b</I>
-
-and
-<B>0</B>
-
-otherwise.
-A subnet is deemed to be a subset of itself.
-A subnet is never a subset of another
-subnet if their address families differ.
-<P>
-
-<I>Subnetishost</I>
-
-returns
-non-zero
-if subnet
-<I>s</I>
-
-is in fact only a single host,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesaid</I>
-
-returns
-non-zero
-if SA IDs
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Sameaddrtype</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesubnettype</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_initaddr.3.html">ipsec_initaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_samesubnettype.3.html b/doc/manpage.d/ipsec_samesubnettype.3.html
deleted file mode 100644
index 414a0d513..000000000
--- a/doc/manpage.d/ipsec_samesubnettype.3.html
+++ /dev/null
@@ -1,274 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 28 Nov 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec sameaddr - are two addresses the same?
-<BR>
-
-ipsec addrcmp - ordered comparison of addresses
-<BR>
-
-ipsec samesubnet - are two subnets the same?
-<BR>
-
-ipsec addrinsubnet - is an address within a subnet?
-<BR>
-
-ipsec subnetinsubnet - is a subnet within another subnet?
-<BR>
-
-ipsec subnetishost - is a subnet a single host?
-<BR>
-
-ipsec samesaid - are two SA IDs the same?
-<BR>
-
-ipsec sameaddrtype - are two addresses of the same address family?
-<BR>
-
-ipsec samesubnettype - are two subnets of the same address family?
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int sameaddr(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int addrcmp(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int addrinsubnet(const ip_address *a, const ip_subnet *s);</B>
-
-<BR>
-
-<B>int subnetinsubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int subnetishost(const ip_subnet *s);</B>
-
-<BR>
-
-<B>int samesaid(const ip_said *a, const ip_said *b);</B>
-
-<BR>
-
-<B>int sameaddrtype(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnettype(const ip_subnet *a, const ip_subnet *b);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions do various comparisons and tests on the
-<I>ip_address</I>
-
-type and
-<I>ip_subnet</I>
-
-types.
-<P>
-
-<I>Sameaddr</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Addresses of different families are never identical.
-<P>
-
-<I>Addrcmp</I>
-
-returns
-<B>-1</B>,
-
-<B>0</B>,
-
-or
-<B>1</B>
-
-respectively
-if address
-<I>a</I>
-
-is less than, equal to, or greater than
-<I>b</I>.
-
-If they are not of the same address family,
-they are never equal;
-the ordering reported in this case is arbitrary
-(and probably not useful) but consistent.
-<P>
-
-<I>Samesubnet</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Subnets of different address families are never identical.
-<P>
-
-<I>Addrinsubnet</I>
-
-returns
-non-zero
-if address
-<I>a</I>
-
-is within subnet
-<I>s</I>
-
-and
-<B>0</B>
-
-otherwise.
-An address is never within a
-subnet of a different address family.
-<P>
-
-<I>Subnetinsubnet</I>
-
-returns
-non-zero
-if subnet
-<I>a</I>
-
-is a subset of subnet
-<I>b</I>
-
-and
-<B>0</B>
-
-otherwise.
-A subnet is deemed to be a subset of itself.
-A subnet is never a subset of another
-subnet if their address families differ.
-<P>
-
-<I>Subnetishost</I>
-
-returns
-non-zero
-if subnet
-<I>s</I>
-
-is in fact only a single host,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesaid</I>
-
-returns
-non-zero
-if SA IDs
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Sameaddrtype</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesubnettype</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_initaddr.3.html">ipsec_initaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_satoa.3.html b/doc/manpage.d/ipsec_satoa.3.html
deleted file mode 100644
index 2b2c7425c..000000000
--- a/doc/manpage.d/ipsec_satoa.3.html
+++ /dev/null
@@ -1,347 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ATOSA</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ATOSA</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec atosa, satoa - convert IPsec Security Association IDs to and from ASCII
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *atosa(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>struct sa_id *sa);</B>
-
-<BR>
-
-<B>size_t satoa(struct sa_id sa, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<P>
-<B>struct sa_id {</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr dst;</B>
-
-<BR>
-&nbsp;
-<B>ipsec_spi_t spi;</B>
-
-<BR>
-&nbsp;
-<B>int proto;</B>
-
-<BR>
-
-<B>};</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete; see
-<I><A HREF="ipsec_ttosa.3.html">ipsec_ttosa</A></I>(3)
-
-for their replacements.
-<P>
-
-<I>Atosa</I>
-
-converts an ASCII Security Association (SA) specifier into an
-<B>sa_id</B>
-
-structure (containing
-a destination-host address
-in network byte order,
-an SPI number in network byte order, and
-a protocol code).
-<I>Satoa</I>
-
-does the reverse conversion, back to an ASCII SA specifier.
-<P>
-
-An SA is specified in ASCII with a mail-like syntax, e.g.
-<B><A HREF="mailto:esp507@1.2.3.4">esp507@1.2.3.4</A></B>.
-
-An SA specifier contains
-a protocol prefix (currently
-<B>ah</B>,
-
-<B>esp</B>,
-
-or
-<B>tun</B>),
-
-an unsigned integer SPI number,
-and an IP address.
-The SPI number can be decimal or hexadecimal
-(with
-<B>0x</B>
-
-prefix), as accepted by
-<I><A HREF="ipsec_atoul.3.html">ipsec_atoul</A></I>(3).
-
-The IP address can be any form accepted by
-<I><A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A></I>(3),
-
-e.g. dotted-decimal address or DNS name.
-<P>
-
-As a special case, the SA specifier
-<B>%passthrough</B>
-
-signifies the special SA used to indicate that packets should be
-passed through unaltered.
-(At present, this is a synonym for
-<B><A HREF="mailto:tun0x0@0.0.0.0">tun0x0@0.0.0.0</A></B>,
-
-but that is subject to change without notice.)
-This form is known to both
-<I>atosa</I>
-
-and
-<I>satoa</I>,
-
-so the internal form of
-<B>%passthrough</B>
-
-is never visible.
-<P>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file supplies the
-<B>sa_id</B>
-
-structure, as well as a data type
-<B>ipsec_spi_t</B>
-
-which is an unsigned 32-bit integer.
-(There is no consistency between kernel and user on what such a type
-is called, hence the header hides the differences.)
-<P>
-
-The protocol code uses the same numbers that IP does.
-For user convenience, given the difficulty in acquiring the exact set of
-protocol names used by the kernel,
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-defines the names
-<B>SA_ESP</B>,
-
-<B>SA_AH</B>,
-
-and
-<B>SA_IPIP</B>
-
-to have the same values as the kernel names
-<B>IPPROTO_ESP</B>,
-
-<B>IPPROTO_AH</B>,
-
-and
-<B>IPPROTO_IPIP</B>.
-
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>atosa</I>
-
-specifies the length of the ASCII string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>satoa</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines a constant,
-<B>SATOA_BUF</B>,
-
-which is the size of a buffer just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>satoa</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the ASCII character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default
-(currently
-lowercase protocol prefix, lowercase hexadecimal SPI, dotted-decimal address).
-The value
-<B>d</B>
-
-causes the SPI to be generated in decimal instead.
-<P>
-
-<I>Atosa</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<I>Satoa</I>
-
-returns
-<B>0</B>
-
-for a failure, and otherwise
-always returns the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec_atoul.3.html">ipsec_atoul</A>(3), <A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A>(3), <A HREF="inet.3.html">inet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>atosa</I>
-
-are:
-empty input;
-input too small to be a legal SA specifier;
-no
-<B>@</B>
-
-in input;
-unknown protocol prefix;
-conversion error in
-<I>atoul</I>
-
-or
-<I>atoaddr</I>.
-
-<P>
-
-Fatal errors in
-<I>satoa</I>
-
-are:
-unknown format; unknown protocol code.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The
-<B>tun</B>
-
-protocol code is a FreeS/WANism which may eventually disappear.
-<P>
-
-The restriction of ASCII-to-binary error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The ASCII-to-binary error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = atoaddr( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_satot.3.html b/doc/manpage.d/ipsec_satot.3.html
deleted file mode 100644
index 1e457fc24..000000000
--- a/doc/manpage.d/ipsec_satot.3.html
+++ /dev/null
@@ -1,453 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TTOSA</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TTOSA</H1>
-Section: C Library Functions (3)<BR>Updated: 26 Nov 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ttosa, satot - convert IPsec Security Association IDs to and from text
-<BR>
-
-ipsec initsaid - initialize an SA ID
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>typedef struct {</B>
-
-<BR>
-&nbsp;
-<B>ip_address dst;</B>
-
-<BR>
-&nbsp;
-<B>ipsec_spi_t spi;</B>
-
-<BR>
-&nbsp;
-<B>int proto;</B>
-
-<BR>
-
-<B>} ip_said;</B>
-
-<P>
-<B>const char *ttosa(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>ip_said *sa);</B>
-
-<BR>
-
-<B>size_t satot(const ip_said *sa, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<BR>
-
-<B>void initsaid(const ip_address *addr, ipsec_spi_t spi,</B>
-
-<BR>
-&nbsp;
-<B>int proto, ip_said *dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ttosa</I>
-
-converts an ASCII Security Association (SA) specifier into an
-<B>ip_said</B>
-
-structure (containing
-a destination-host address
-in network byte order,
-an SPI number in network byte order, and
-a protocol code).
-<I>Satot</I>
-
-does the reverse conversion, back to a text SA specifier.
-<I>Initsaid</I>
-
-initializes an
-<B>ip_said</B>
-
-from separate items of information.
-<P>
-
-An SA is specified in text with a mail-like syntax, e.g.
-<B><A HREF="mailto:esp.5a7@1.2.3.4">esp.5a7@1.2.3.4</A></B>.
-
-An SA specifier contains
-a protocol prefix (currently
-<B>ah</B>,
-
-<B>esp</B>,
-
-<B>tun</B>,
-
-<B>comp</B>,
-
-or
-<B>int</B>),
-
-a single character indicating the address family
-(<B>.</B>
-
-for IPv4,
-<B>:</B>
-
-for IPv6),
-an unsigned integer SPI number in hexadecimal (with no
-<B>0x</B>
-
-prefix),
-and an IP address.
-The IP address can be any form accepted by
-<I><A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A></I>(3),
-
-e.g. dotted-decimal IPv4 address,
-colon-hex IPv6 address,
-or DNS name.
-<P>
-
-As a special case, the SA specifier
-<B>%passthrough4</B>
-
-or
-<B>%passthrough6</B>
-
-signifies the special SA used to indicate that packets should be
-passed through unaltered.
-(At present, these are synonyms for
-<B><A HREF="mailto:tun.0@0.0.0.0">tun.0@0.0.0.0</A></B>
-
-and
-<B>tun:0@::</B>
-
-respectively,
-but that is subject to change without notice.)
-<B>%passthrough</B>
-
-is a historical synonym for
-<B>%passthrough4</B>.
-
-These forms are known to both
-<I>ttosa</I>
-
-and
-<I>satot</I>,
-
-so the internal representation is never visible.
-<P>
-
-Similarly, the SA specifiers
-<B>%pass</B>,
-
-<B>%drop</B>,
-
-<B>%reject</B>,
-
-<B>%hold</B>,
-
-<B>%trap</B>,
-
-and
-<B>%trapsubnet</B>
-
-signify special ``magic'' SAs used to indicate that packets should be
-passed, dropped, rejected (dropped with ICMP notification),
-held,
-and trapped (sent up to
-<I><A HREF="ipsec_pluto.8.html">ipsec_pluto</A></I>(8),
-
-with either of two forms of
-<B>%hold</B>
-
-automatically installed)
-respectively.
-These forms too are known to both routines,
-so the internal representation of the magic SAs should never be visible.
-<P>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file supplies the
-<B>ip_said</B>
-
-structure, as well as a data type
-<B>ipsec_spi_t</B>
-
-which is an unsigned 32-bit integer.
-(There is no consistency between kernel and user on what such a type
-is called, hence the header hides the differences.)
-<P>
-
-The protocol code uses the same numbers that IP does.
-For user convenience, given the difficulty in acquiring the exact set of
-protocol names used by the kernel,
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-defines the names
-<B>SA_ESP</B>,
-
-<B>SA_AH</B>,
-
-<B>SA_IPIP</B>,
-
-and
-<B>SA_COMP</B>
-
-to have the same values as the kernel names
-<B>IPPROTO_ESP</B>,
-
-<B>IPPROTO_AH</B>,
-
-<B>IPPROTO_IPIP</B>,
-
-and
-<B>IPPROTO_COMP</B>.
-
-<P>
-
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-also defines
-<B>SA_INT</B>
-
-to have the value
-<B>61</B>
-
-(reserved by IANA for ``any host internal protocol'')
-and
-<B>SPI_PASS</B>,
-
-<B>SPI_DROP</B>,
-
-<B>SPI_REJECT</B>,
-
-<B>SPI_HOLD</B>,
-
-and
-<B>SPI_TRAP</B>
-
-to have the values 256-260 (in <I>host</I> byte order) respectively.
-These are used in constructing the magic SAs
-(which always have address
-<B>0.0.0.0</B>).
-
-<P>
-
-If
-<I>satot</I>
-
-encounters an unknown protocol code, e.g. 77,
-it yields output using a prefix
-showing the code numerically, e.g. ``unk77''.
-This form is
-<I>not</I>
-
-recognized by
-<I>ttosa</I>.
-
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>ttosa</I>
-
-specifies the length of the string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>satot</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file defines a constant,
-<B>SATOT_BUF</B>,
-
-which is the size of a buffer just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>satot</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the ASCII character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default
-(currently
-lowercase protocol prefix, lowercase hexadecimal SPI,
-dotted-decimal or colon-hex address).
-The value
-<B>'f'</B>
-
-is similar except that the SPI is padded with
-<B>0</B>s
-
-to a fixed 32-bit width, to ease aligning displayed tables.
-<P>
-
-<I>Ttosa</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<I>Satot</I>
-
-returns
-<B>0</B>
-
-for a failure, and otherwise
-always returns the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<P>
-
-There is also, temporarily, support for some obsolete
-forms of SA specifier which lack the address-family indicator.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec_ttoul.3.html">ipsec_ttoul</A>(3), <A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A>(3), <A HREF="ipsec_samesaid.3.html">ipsec_samesaid</A>(3), <A HREF="inet.3.html">inet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>ttosa</I>
-
-are:
-empty input;
-input too small to be a legal SA specifier;
-no
-<B>@</B>
-
-in input;
-unknown protocol prefix;
-conversion error in
-<I>ttoul</I>
-
-or
-<I>ttoaddr</I>.
-
-<P>
-
-Fatal errors in
-<I>satot</I>
-
-are:
-unknown format.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The restriction of text-to-binary error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The text-to-binary error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = ttosa( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_send-pr.8.html b/doc/manpage.d/ipsec_send-pr.8.html
deleted file mode 100644
index 19026543a..000000000
--- a/doc/manpage.d/ipsec_send-pr.8.html
+++ /dev/null
@@ -1,427 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of SEND-PR</TITLE>
-</HEAD><BODY>
-<H1>SEND-PR</H1>
-Section: User Commands  (1)<BR>Updated: xVERSIONx<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec send-pr - send problem report (PR) to a central support site
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec send-pr</B>
-
-[
-<I>site</I>
-
-]
-[
-<B>-f</B>
-
-<I>problem-report</I>
-
-]
-[
-<B>-t</B>
-
-<I>mail-address</I>
-
-]
-<BR>
-
-
-[
-<B>-P</B>
-
-]
-[
-<B>-L</B>
-
-]
-[
-<B>-s</B>
-
-<I>severity</I>
-
-]
-[
-<B>-c</B>
-
-<I>address</I>
-
-]
-<BR>
-
-[
-<B>--request-id</B>
-
-]
-[
-<B>-V</B>
-
-]
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<B>ipsec send-pr</B>
-
-is a tool used to submit 
-<I>problem reports </I>
-
-
-(PRs) to a central support site.  In most cases the correct 
-<I>site</I>
-
-will be the default.  This argument indicates the support site which
-is responsible for the category of problem involved.  Some sites may
-use a local address as a default.  
-<I>site</I>
-
-values are defined by using the 
-<B><A HREF="aliases.5.html">aliases</A></B>(5).
-
-<P>
-
-<B>ipsec send-pr</B>
-
-invokes an editor on a problem report template (after trying to fill
-in some fields with reasonable default values).  When you exit the
-editor,
-<B>ipsec send-pr </B>
-
-sends the completed form to the
-<I>Problem Report Management System</I>
-
-(<B>GNATS</B>) at a central support site.  At the support site, the PR
-is assigned a unique number and is stored in the <B>GNATS</B> database
-according to its category and submitter-id.  <B>GNATS</B> automatically
-replies with an acknowledgement, citing the category and the PR
-number.
-<P>
-
-To ensure that a PR is handled promptly, it should contain your (unique)
-<I>submitter-id</I> and one of the available <I>categories</I> to identify the
-problem area.  (Use
-<B>`ipsec send-pr -L'</B>
-
-to see a list of categories.)
-<P>
-
-The
-<B>ipsec send-pr</B>
-
-template at your site should already be customized with your
-submitter-id (running `<B>install-sid</B> <I>submitter-id</I>' to
-accomplish this is part of the installation procedures for
-<B>ipsec</B>send-pr<B>).</B>
-
-If this hasn't been done, see your system administrator for your
-submitter-id, or request one from your support site by invoking
-<B>`ipsec send-pr --request-id'.</B>
-
-If your site does not distinguish between different user sites, or if
-you are not affiliated with the support site, use
-<B>`net'</B>
-
-for this field.
-<P>
-
-The more precise your problem description and the more complete your
-information, the faster your support team can solve your problems.
-<A NAME="lbAE">&nbsp;</A>
-<H2>OPTIONS</H2>
-
-<DL COMPACT>
-<DT><B>-f</B><I> problem-report</I>
-
-<DD>
-specify a file (<I>problem-report</I>) which already contains a
-complete problem report.
-<B>ipsec send-pr</B>
-
-sends the contents of the file without invoking the editor.  If 
-the value for 
-<I>problem-report</I>
-
-is
-<B>`-'</B>,
-
-then
-<B>ipsec send-pr</B>
-
-reads from standard input.
-<DT><B>-s</B><I> severity</I>
-
-<DD>
-Give the problem report the severity
-<I>severity</I>.
-
-<DT><B>-t</B><I> mail-address</I>
-
-<DD>
-Change mail address at the support site for problem reports.  The
-default 
-<I>mail-address</I>
-
-is the address used for the default 
-<I>site</I>.
-
-Use the
-<I>site</I>
-
-argument rather than this option in nearly all cases.
-<DT><B>-c</B><I> address</I>
-
-<DD>
-Put
-<I>address</I>
-
-in the 
-<B>Cc:</B>
-
-header of the message.
-<DT><B>-P</B>
-
-<DD>
-print the form specified by the environment variable 
-<B>PR_FORM </B>
-
-on standard output.  If 
-<B>PR_FORM</B>
-
-is not set, print the standard blank PR template.  No mail is sent.
-<DT><B>-L</B>
-
-<DD>
-print the list of available categories.  No mail is sent.
-<DT><B>--request-id</B>
-
-<DD>
-sends mail to the default support site, or
-<I>site</I>
-
-if specified, with a request for your 
-<I>submitter-id</I>.
-
-If you are
-not affiliated with 
-<I>site</I>,
-
-use a
-<I>submitter-id</I>
-
-of
-<B>net</B>'.
-
-<DT><B>-V</B>
-
-<DD>
-Display the 
-<B>ipsec send-pr</B>
-
-version number.
-</DL>
-<P>
-
-Note: use
-<B>ipsec send-pr</B>
-
-to submit problem reports rather than mailing them directly.  Using
-both the template and
-<B>ipsec send-pr</B>
-
-itself will help ensure all necessary information will reach the
-support site.
-<A NAME="lbAF">&nbsp;</A>
-<H2>ENVIRONMENT</H2>
-
-The environment variable 
-<B>EDITOR</B>
-
-specifies the editor to invoke on the template.
-<BR>
-
-default:
-<B>vi</B>
-
-<P>
-If the environment variable 
-<B>PR_FORM</B>
-
-is set, then its value is used as the file name of the template for
-your problem-report editing session.  You can use this to start with a
-partially completed form (for example, a form with the identification
-fields already completed).
-<A NAME="lbAG">&nbsp;</A>
-<H2>HOW TO FILL OUT A PROBLEM REPORT</H2>
-
-Problem reports have to be in a particular form so that a program can
-easily manage them.  Please remember the following guidelines:
-<DL COMPACT>
-<DT>*<DD>
-describe only 
-<B>one problem</B>
-
-with each problem report.
-<DT>*<DD>
-For follow-up mail, use the same subject line as the one in the automatic
-acknowledgent. It consists of category, PR number and the original synopsis
-line.  This allows the support site to relate several mail messages to a
-particular PR and to record them automatically.
-<DT>*<DD>
-Please try to be as accurate as possible in the subject and/or synopsis line.
-<DT>*<DD>
-The subject and the synopsis line are not confidential.  This is
-because open-bugs lists are compiled from them.  Avoid confidential
-information there.
-</DL>
-<P>
-
-See the GNU 
-<B>Info </B>
-
-file
-<B>send-pr.info</B>
-
-or the document <I>Reporting Problems With send-pr</I>&nbsp;for detailed
-information on reporting problems
-<A NAME="lbAH">&nbsp;</A>
-<H2>HOW TO SUBMIT TEST CASES, CODE, ETC.</H2>
-
-Submit small code samples with the PR.  Contact the support site for
-instructions on submitting larger test cases and problematic source
-code.
-<A NAME="lbAI">&nbsp;</A>
-<H2>FILES</H2>
-
-
-
-/tmp/p$$<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>copy of PR used in editing session<BR>
-<BR>
-
-/tmp/pf$$<TT>&nbsp;&nbsp;&nbsp;</TT>copy of empty PR form, for testing purposes<BR>
-<BR>
-
-/tmp/pbad$$<TT>&nbsp;</TT>file for rejected PRs<BR>
-<BR>
-
-@IPSEC_DIR@/send-pr.confscript to customize send-pr.<BR>
-<A NAME="lbAJ">&nbsp;</A>
-<H2>EMACS USER INTERFACE</H2>
-
-An Emacs user interface for 
-<B>send-pr</B>
-
-with completion of field values is part of the 
-<B>send-pr</B>
-
-distribution (invoked with
-<B>M-x send-pr</B>).
-
-See the file
-<B>send-pr.info</B>
-
-or the ASCII file
-<B>INSTALL</B>
-
-in the top level directory of the distribution for configuration and
-installation information.  The Emacs LISP template file is 
-<B>send-pr-el.in</B>
-
-and is installed as
-<B>send-pr.el</B>.
-
-<A NAME="lbAK">&nbsp;</A>
-<H2>INSTALLATION AND CONFIGURATION</H2>
-
-See 
-<B>send-pr.info</B>
-
-or
-<B>INSTALL</B>
-
-for installation instructions.
-<A NAME="lbAL">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<I>Reporting Problems Using send-pr</I>
-
-(also installed as the GNU Info file
-<B>send-pr.info</B>).
-
-<P>
-
-<B><A HREF="http://localhost/cgi-bin/man/man2html?l+gnats">gnats</A></B>(l),
-
-<B><A HREF="query-pr.1.html">query-pr</A></B>(1),
-
-<B><A HREF="edit-pr.1.html">edit-pr</A></B>(1),
-
-<B><A HREF="gnats.8.html">gnats</A></B>(8),
-
-<B><A HREF="queue-pr.8.html">queue-pr</A></B>(8),
-
-<B><A HREF="at-pr.8.html">at-pr</A></B>(8),
-
-<B><A HREF="mkcat.8.html">mkcat</A></B>(8),
-
-<B><A HREF="mkdist.8.html">mkdist</A></B>(8).
-
-<A NAME="lbAM">&nbsp;</A>
-<H2>AUTHORS</H2>
-
-Jeffrey Osier, Brendan Kehoe, Jason Merrill, Heinz G. Seidl (Cygnus
-Support)
-<A NAME="lbAN">&nbsp;</A>
-<H2>COPYING</H2>
-
-Copyright (c) 1992, 1993 Free Software Foundation, Inc.
-<P>
-
-Permission is granted to make and distribute verbatim copies of
-this manual provided the copyright notice and this permission notice
-are preserved on all copies.
-<P>
-
-Permission is granted to copy and distribute modified versions of this
-manual under the conditions for verbatim copying, provided that the
-entire resulting derived work is distributed under the terms of a
-permission notice identical to this one.
-<P>
-
-Permission is granted to copy and distribute translations of this
-manual into another language, under the above conditions for modified
-versions, except that this permission notice may be included in
-translations approved by the Free Software Foundation instead of in
-the original English.
-<P>
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">OPTIONS</A><DD>
-<DT><A HREF="#lbAF">ENVIRONMENT</A><DD>
-<DT><A HREF="#lbAG">HOW TO FILL OUT A PROBLEM REPORT</A><DD>
-<DT><A HREF="#lbAH">HOW TO SUBMIT TEST CASES, CODE, ETC.</A><DD>
-<DT><A HREF="#lbAI">FILES</A><DD>
-<DT><A HREF="#lbAJ">EMACS USER INTERFACE</A><DD>
-<DT><A HREF="#lbAK">INSTALLATION AND CONFIGURATION</A><DD>
-<DT><A HREF="#lbAL">SEE ALSO</A><DD>
-<DT><A HREF="#lbAM">AUTHORS</A><DD>
-<DT><A HREF="#lbAN">COPYING</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_setportof.3.html b/doc/manpage.d/ipsec_setportof.3.html
deleted file mode 100644
index 3965ca62d..000000000
--- a/doc/manpage.d/ipsec_setportof.3.html
+++ /dev/null
@@ -1,143 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_PORTOF</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_PORTOF</H1>
-Section: C Library Functions (3)<BR>Updated: 8 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec portof - get port field of an ip_address
-<BR>
-
-ipsec setportof - set port field of an ip_address
-<BR>
-
-ipsec sockaddrof - get pointer to internal sockaddr of an ip_address
-<BR>
-
-ipsec sockaddrlenof - get length of internal sockaddr of an ip_address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int portof(const ip_address *src);</B>
-
-<BR>
-
-<B>void setportof(int port, ip_address *dst);</B>
-
-<BR>
-
-<B>struct sockaddr *sockaddrof(ip_address *src);</B>
-
-<BR>
-
-<B>size_t sockaddrlenof(const ip_address *src);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-internal type
-<I>ip_address</I>
-
-contains one of the
-<I>sockaddr</I>
-
-types internally.
-<I>Reliance on this feature is discouraged</I>,
-but it may occasionally be necessary.
-These functions provide low-level tools for this purpose.
-<P>
-
-<I>Portof</I>
-
-and
-<I>setportof</I>
-
-respectively read and write the port-number field of the internal
-<I>sockaddr</I>.
-
-The values are in network byte order.
-<P>
-
-<I>Sockaddrof</I>
-
-returns a pointer to the internal
-<I>sockaddr</I>,
-
-for passing to other functions.
-<P>
-
-<I>Sockaddrlenof</I>
-
-reports the size of the internal
-<I>sockaddr</I>,
-
-for use in storage allocation.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_initaddr.3.html">ipsec_initaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-<I>Portof</I>
-
-returns
-<B>-1</B>,
-
-<I>sockaddrof</I>
-
-returns
-<B>NULL</B>,
-
-and
-<I>sockaddrlenof</I>
-
-returns
-<B>0</B>
-
-if an unknown address family is found within the
-<I>ip_address</I>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-These functions all depend on low-level details of the
-<I>ip_address</I>
-
-type, which are in principle subject to change.
-Avoid using them unless really necessary.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_setup.8.html b/doc/manpage.d/ipsec_setup.8.html
deleted file mode 100644
index 7197e2b18..000000000
--- a/doc/manpage.d/ipsec_setup.8.html
+++ /dev/null
@@ -1,237 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_SETUP</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_SETUP</H1>
-Section: Maintenance Commands (8)<BR>Updated: 23 July 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec setup - control IPsec subsystem
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>setup</B>
-
-[
-<B>--show</B>
-
-|
-<B>--showonly</B>
-
-]
-command
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Setup</I>
-
-controls the FreeS/WAN IPsec subsystem,
-including both the Klips kernel code and the Pluto key-negotiation daemon.
-(It is a synonym for the ``rc'' script for the subsystem;
-the system runs the equivalent of
-<B>ipsec setup start</B>
-
-at boot time,
-and
-<B>ipsec setup stop</B>
-
-at shutdown time, more or less.)
-<P>
-
-The action taken depends on the specific
-<I>command</I>,
-
-and on the contents of the
-<B>config</B>
-
-<B>setup</B>
-
-section of the
-IPsec configuration file (<I>/etc/ipsec.conf</I>,
-
-see
-<I><A HREF="ipsec.conf.5.html">ipsec.conf</A></I>(5)).
-
-Current
-<I>command</I>s
-
-are:
-<DL COMPACT>
-<DT><B>start</B>
-
-<DD>
-start Klips and Pluto,
-including setting up Klips to do crypto operations on the 
-interface(s) specified in the configuration file,
-and (if the configuration file so specifies)
-setting up manually-keyed connections and/or
-asking Pluto to negotiate automatically-keyed connections
-to other security gateways
-<DT><B>stop</B>
-
-<DD>
-shut down Klips and Pluto,
-including tearing down all existing crypto connections
-<DT><B>restart</B>
-
-<DD>
-equivalent to
-<B>stop</B>
-
-followed by
-<B>start</B>
-
-<DT><B>status</B>
-
-<DD>
-report the status of the subsystem;
-normally just reports
-<B>IPsec running</B>
-
-and
-<B>pluto pid </B><I>nnn</I>,
-
-or
-<B>IPsec stopped</B>,
-
-and exits with status 0,
-but will go into more detail (and exit with status 1)
-if something strange is found.
-(An ``illicit'' Pluto is one that does not match the process ID in
-Pluto's lock file;
-an ``orphaned'' Pluto is one with no lock file.)
-</DL>
-<P>
-
-The
-<B>stop</B>
-
-operation tries to clean up properly even if assorted accidents
-have occurred,
-e.g. Pluto having died without removing its lock file.
-If
-<B>stop</B>
-
-discovers that the subsystem is (supposedly) not running,
-it will complain,
-but will do its cleanup anyway before exiting with status 1.
-<P>
-
-Although a number of configuration-file parameters influence
-<I>setup</I>'s
-
-operations, the key one is the
-<B>interfaces</B>
-
-parameter, which must be right or chaos will ensue.
-<P>
-
-The
-<B>--show</B>
-
-and
-<B>--showonly</B>
-
-options cause
-<I>setup</I>
-
-to display the shell commands that it would execute.
-<B>--showonly</B>
-
-suppresses their execution.
-Only
-<B>start</B>,
-
-<B>stop</B>,
-
-and
-<B>restart</B>
-
-commands recognize these flags.
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-
-
-/etc/rc.d/init.d/ipsec<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>the script itself<BR>
-<BR>
-
-/etc/init.d/ipsec<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>alternate location for the script<BR>
-<BR>
-
-/etc/ipsec.conf<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>IPsec configuration file<BR>
-<BR>
-
-/proc/sys/net/ipv4/ip_forward<TT>&nbsp;</TT>forwarding control<BR>
-<BR>
-
-/var/run/ipsec.info<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>saved information<BR>
-<BR>
-
-/var/run/pluto.pid<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>Pluto lock file<BR>
-<BR>
-
-/var/run/ipsec_setup.pid<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>IPsec lock file<BR>
-<A NAME="lbAF">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.conf.5.html">ipsec.conf</A>(5), <A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_auto.8.html">ipsec_auto</A>(8), <A HREF="route.8.html">route</A>(8)
-<A NAME="lbAG">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-All output from the commands
-<B>start</B>
-
-and
-<B>stop</B>
-
-goes both to standard
-output and to
-<I><A HREF="syslogd.8.html">syslogd</A></I>(8),
-
-via
-<I><A HREF="logger.1.html">logger</A></I>(1).
-
-Selected additional information is logged only to
-<I><A HREF="syslogd.8.html">syslogd</A></I>(8).
-
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Henry Spencer.
-<A NAME="lbAI">&nbsp;</A>
-<H2>BUGS</H2>
-
-Old versions of
-<I><A HREF="logger.1.html">logger</A></I>(1)
-
-inject spurious extra newlines onto standard output.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">SEE ALSO</A><DD>
-<DT><A HREF="#lbAG">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-<DT><A HREF="#lbAI">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_showdefaults.8.html b/doc/manpage.d/ipsec_showdefaults.8.html
deleted file mode 100644
index e1786dc0a..000000000
--- a/doc/manpage.d/ipsec_showdefaults.8.html
+++ /dev/null
@@ -1,82 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_SHOWDEFAULTS</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_SHOWDEFAULTS</H1>
-Section: Maintenance Commands (8)<BR>Updated: 23 Jan 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec showdefaults - show %defaultroute defaults
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>showdefaults</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Showdefaults</I>
-
-outputs (on standard output) a terse description of the defaults
-used by the
-<B>%defaultroute</B>
-
-facilities in
-<I><A HREF="ipsec_auto.8.html">ipsec_auto</A></I>(8)
-
-and
-<I><A HREF="ipsec_manual.8.html">ipsec_manual</A></I>(8).
-
-<P>
-
-Beware that the exact output format is subject to change.
-<A NAME="lbAE">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Normal exit status is 0.
-If no defaults are available,
-i.e. the
-<B>interfaces</B>
-
-parameter in
-<B>config setup</B>
-
-is not
-<B>%defaultroute</B>,
-
-produces a message on standard error and exits with status 1.
-<A NAME="lbAF">&nbsp;</A>
-<H2>FILES</H2>
-
-/var/run/ipsec.info
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAF">FILES</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_showhostkey.8.html b/doc/manpage.d/ipsec_showhostkey.8.html
deleted file mode 100644
index 90a16d5ee..000000000
--- a/doc/manpage.d/ipsec_showhostkey.8.html
+++ /dev/null
@@ -1,269 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_SHOWHOSTKEY</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_SHOWHOSTKEY</H1>
-Section: Maintenance Commands (8)<BR>Updated: 5 March 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec showhostkey - show host's authentication key
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>showhostkey</B>
-
-[
-<B>--key</B>
-
-] [
-<B>--left</B>
-
-] [
-<B>--right</B>
-
-] [
-<B>--txt</B>
-
-gateway
-] [
-<B>--dhclient</B>
-
-] [
-<B>--file</B>
-
-secretfile
-] [
-<B>--id</B>
-
-identity
-]
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Showhostkey</I>
-
-outputs (on standard output) a public key suitable for this host,
-in the format specified,
-using the host key information stored in
-<I>/etc/ipsec.secrets</I>.
-
-In general only the super-user can run this command,
-since only he can read
-<I>ipsec.secrets</I>.
-
-<P>
-
-The
-<B>--txt</B>
-
-option causes the output to be in opportunistic-encryption DNS TXT record
-format,
-with the specified
-<I>gateway</I>
-
-value.
-If information about how the key was generated is available,
-that is provided as a DNS-file comment.
-For example,
-<B>--txt 10.11.12.13</B>
-
-might give (with the key data trimmed for clarity):
-<P>
-
-<PRE>
-  ; RSA 2048 bits   xy.example.com   Sat Apr 15 13:53:22 2000
-      IN TXT  &quot;X-IPsec-Server(10)=10.11.12.13 AQOF8tZ2...+buFuFn/&quot;
-</PRE>
-
-<P>
-
-No name is supplied in the TXT record
-because there are too many possibilities,
-depending on how it will be used.
-If the text string is longer than 255 bytes,
-it is split up into multiple strings (matching the restrictions of
-the DNS TXT binary format).
-If any split is needed, the first split will be at the start of the key:
-this increases the chances that later hand editing will work.
-<P>
-
-The
-<B>--left</B>
-
-and
-<B>--right</B>
-
-options cause the output to be in
-<I><A HREF="ipsec.conf.5.html">ipsec.conf</A></I>(5)
-
-format, as a
-<B>leftrsasigkey</B>
-
-or
-<B>rightrsasigkey</B>
-
-parameter respectively.
-Again, generation information is included if available.
-For example,
-<B>--left</B>
-
-might give (with the key data trimmed down for clarity):
-<P>
-
-<PRE>
-  # RSA 2048 bits   xy.example.com   Sat Apr 15 13:53:22 2000
-  leftrsasigkey=0sAQOF8tZ2...+buFuFn/
-</PRE>
-
-<P>
-
-The
-<B>--dhclient</B>
-
-option cause the output to be suitable for inclusion in
-<I><A HREF="dhclient.conf.5.html">dhclient.conf</A></I>(5)
-
-as part of configuring WAVEsec.
-See &lt;<A HREF="http://www.wavesec.org">http://www.wavesec.org</A>&gt;.
-<P>
-
-If
-<B>--key</B>
-
-is specified,
-the output format is the text form of a DNS KEY record;
-the host name is the one included in the key information
-(or, if that is not available,
-the output of
-<B>hostname&nbsp;--fqdn</B>),
-
-with a
-<B>.</B>
-
-appended.
-Again, generation information is included if available.
-For example (with the key data trimmed down for clarity):
-<P>
-
-<PRE>
-  ; RSA 2048 bits   xy.example.com   Sat Apr 15 13:53:22 2000
-  xy.example.com.   IN   KEY   0x4200 4 1 AQOF8tZ2...+buFuFn/
-</PRE>
-
-<P>
-
-Normally, the default key for this host
-(the one with no host identities specified for it) is the one extracted.
-The
-<B>--id</B>
-
-option overrides this,
-causing extraction of the key labeled with the specified
-<I>identity</I>,
-
-if any.
-The specified
-<I>identity</I>
-
-must
-<I>exactly</I>
-
-match the identity in the file;
-in particular, the comparison is case-sensitive.
-<P>
-
-The
-<B>--file</B>
-
-option overrides the default for where the key information should be
-found, and takes it from the specified
-<I>secretfile</I>.
-
-<A NAME="lbAE">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-A complaint about ``no pubkey line found'' indicates that the
-host has a key but it was generated with an old version of FreeS/WAN
-and does not contain the information that
-<I>showhostkey</I>
-
-needs.
-<A NAME="lbAF">&nbsp;</A>
-<H2>FILES</H2>
-
-/etc/ipsec.secrets
-<A NAME="lbAG">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.secrets.5.html">ipsec.secrets</A>(5), <A HREF="ipsec.conf.5.html">ipsec.conf</A>(5), <A HREF="ipsec_rsasigkey.8.html">ipsec_rsasigkey</A>(8)
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Henry Spencer.
-<A NAME="lbAI">&nbsp;</A>
-<H2>BUGS</H2>
-
-Arguably,
-rather than just reporting the no-IN-KEY-line-found problem,
-<I>showhostkey</I>
-
-should be smart enough to run the existing key through
-<I>rsasigkey</I>
-
-with the
-<B>--oldkey</B>
-
-option, to generate a suitable output line.
-<P>
-
-The need to specify the gateway address (etc.) for
-<B>--txt</B>
-
-is annoying, but there is no good way to determine it automatically.
-<P>
-
-There should be a way to specify the priority value for TXT records;
-currently it is hardwired to
-<B>10</B>.
-
-<P>
-
-The
-<B>--id</B>
-
-option assumes that the
-<I>identity</I>
-
-appears on the same line as the
-<B>:&nbsp;RSA&nbsp;{</B>
-
-that begins the key proper.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAF">FILES</A><DD>
-<DT><A HREF="#lbAG">SEE ALSO</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-<DT><A HREF="#lbAI">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_showpolicy.8.html b/doc/manpage.d/ipsec_showpolicy.8.html
deleted file mode 100644
index 470c40879..000000000
--- a/doc/manpage.d/ipsec_showpolicy.8.html
+++ /dev/null
@@ -1,88 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_SHOWPOLICY</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_SHOWPOLICY</H1>
-Section: Maintenance Commands (8)<BR>Updated: 7 May 2003<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec showpolicy - dump policy of socket found as stdin
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<P>
-
-<B>ipsec</B>
-
-<B>showpolicy</B>
-
-<P>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>showpolicy</I>
-
-calls the 
-<I><A HREF="ipsec_policy_lookup.3.html">ipsec_policy_lookup</A></I>(3)
-
-function on the file description which is its stdin.
-<P>
-
-It then dumps the resulting query in a human readable form.
-<P>
-
-This is a test program. One might run it from inetd, via:
-<DL COMPACT>
-<DT>discard stream tcp nowait nobody /usr/local/libexec/ipsec/showpolicy showpolicy<DD>
-</DL>
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-/var/run/ipsecpolicy.ctl
-<A NAME="lbAF">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_policy_query.3.html">ipsec_policy_query</A>(3), <A HREF="ipsec_pluto.8.html">ipsec_pluto</A>(8)
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael Richardson
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">SEE ALSO</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_sockaddrlenof.3.html b/doc/manpage.d/ipsec_sockaddrlenof.3.html
deleted file mode 100644
index 3965ca62d..000000000
--- a/doc/manpage.d/ipsec_sockaddrlenof.3.html
+++ /dev/null
@@ -1,143 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_PORTOF</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_PORTOF</H1>
-Section: C Library Functions (3)<BR>Updated: 8 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec portof - get port field of an ip_address
-<BR>
-
-ipsec setportof - set port field of an ip_address
-<BR>
-
-ipsec sockaddrof - get pointer to internal sockaddr of an ip_address
-<BR>
-
-ipsec sockaddrlenof - get length of internal sockaddr of an ip_address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int portof(const ip_address *src);</B>
-
-<BR>
-
-<B>void setportof(int port, ip_address *dst);</B>
-
-<BR>
-
-<B>struct sockaddr *sockaddrof(ip_address *src);</B>
-
-<BR>
-
-<B>size_t sockaddrlenof(const ip_address *src);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-internal type
-<I>ip_address</I>
-
-contains one of the
-<I>sockaddr</I>
-
-types internally.
-<I>Reliance on this feature is discouraged</I>,
-but it may occasionally be necessary.
-These functions provide low-level tools for this purpose.
-<P>
-
-<I>Portof</I>
-
-and
-<I>setportof</I>
-
-respectively read and write the port-number field of the internal
-<I>sockaddr</I>.
-
-The values are in network byte order.
-<P>
-
-<I>Sockaddrof</I>
-
-returns a pointer to the internal
-<I>sockaddr</I>,
-
-for passing to other functions.
-<P>
-
-<I>Sockaddrlenof</I>
-
-reports the size of the internal
-<I>sockaddr</I>,
-
-for use in storage allocation.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_initaddr.3.html">ipsec_initaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-<I>Portof</I>
-
-returns
-<B>-1</B>,
-
-<I>sockaddrof</I>
-
-returns
-<B>NULL</B>,
-
-and
-<I>sockaddrlenof</I>
-
-returns
-<B>0</B>
-
-if an unknown address family is found within the
-<I>ip_address</I>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-These functions all depend on low-level details of the
-<I>ip_address</I>
-
-type, which are in principle subject to change.
-Avoid using them unless really necessary.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_sockaddrof.3.html b/doc/manpage.d/ipsec_sockaddrof.3.html
deleted file mode 100644
index 3965ca62d..000000000
--- a/doc/manpage.d/ipsec_sockaddrof.3.html
+++ /dev/null
@@ -1,143 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_PORTOF</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_PORTOF</H1>
-Section: C Library Functions (3)<BR>Updated: 8 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec portof - get port field of an ip_address
-<BR>
-
-ipsec setportof - set port field of an ip_address
-<BR>
-
-ipsec sockaddrof - get pointer to internal sockaddr of an ip_address
-<BR>
-
-ipsec sockaddrlenof - get length of internal sockaddr of an ip_address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int portof(const ip_address *src);</B>
-
-<BR>
-
-<B>void setportof(int port, ip_address *dst);</B>
-
-<BR>
-
-<B>struct sockaddr *sockaddrof(ip_address *src);</B>
-
-<BR>
-
-<B>size_t sockaddrlenof(const ip_address *src);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-internal type
-<I>ip_address</I>
-
-contains one of the
-<I>sockaddr</I>
-
-types internally.
-<I>Reliance on this feature is discouraged</I>,
-but it may occasionally be necessary.
-These functions provide low-level tools for this purpose.
-<P>
-
-<I>Portof</I>
-
-and
-<I>setportof</I>
-
-respectively read and write the port-number field of the internal
-<I>sockaddr</I>.
-
-The values are in network byte order.
-<P>
-
-<I>Sockaddrof</I>
-
-returns a pointer to the internal
-<I>sockaddr</I>,
-
-for passing to other functions.
-<P>
-
-<I>Sockaddrlenof</I>
-
-reports the size of the internal
-<I>sockaddr</I>,
-
-for use in storage allocation.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_initaddr.3.html">ipsec_initaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-<I>Portof</I>
-
-returns
-<B>-1</B>,
-
-<I>sockaddrof</I>
-
-returns
-<B>NULL</B>,
-
-and
-<I>sockaddrlenof</I>
-
-returns
-<B>0</B>
-
-if an unknown address family is found within the
-<I>ip_address</I>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-These functions all depend on low-level details of the
-<I>ip_address</I>
-
-type, which are in principle subject to change.
-Avoid using them unless really necessary.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_spi.5.html b/doc/manpage.d/ipsec_spi.5.html
deleted file mode 100644
index b1cf89033..000000000
--- a/doc/manpage.d/ipsec_spi.5.html
+++ /dev/null
@@ -1,305 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_SPI</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_SPI</H1>
-Section: File Formats (5)<BR>Updated: 26 Jun 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec_spi - list IPSEC Security Associations
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>spi</B>
-
-<P>
-
-<B>cat</B>
-
-<B>/proc/net/ipsec_spi</B>
-
-<P>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>/proc/net/ipsec_spi</I>
-
-is a read-only file that lists the current IPSEC Security Associations.
-A Security Association (SA) is a transform through which packet contents
-are to be processed before being forwarded.  A transform can be an
-IPv4-in-IPv4 or IPv6-in-IPv6 encapsulation, an IPSEC Authentication Header (authentication
-with no encryption), or an IPSEC Encapsulation Security Payload
-(encryption, possibly including authentication).
-<P>
-
-When a packet is passed from a higher networking layer through an IPSEC
-virtual interface, a search in the extended routing table (see
-<I><A HREF="ipsec_eroute.5.html">ipsec_eroute</A></I>(5))
-
-yields
-a IP protocol number
-,
-a Security Parameters Index (SPI)
-and
-an effective destination address
-When an IPSEC packet arrives from the network,
-its ostensible destination, an SPI and an IP protocol
-specified by its outermost IPSEC header are used.
-The destination/SPI/protocol combination is used to select a relevant SA.
-(See
-<I><A HREF="ipsec_spigrp.5.html">ipsec_spigrp</A></I>(5)
-
-for discussion of how multiple transforms are combined.)
-<P>
-
-An
-<I>spi ,</I>
-
-<I>proto, </I>
-
-<I>daddr</I>
-
-and
-<I>address_family</I>
-
-arguments specify an SAID.
-<I>Proto</I>
-
-is an ASCII string, &quot;ah&quot;, &quot;esp&quot;, &quot;comp&quot; or &quot;tun&quot;, specifying the IP protocol.
-<I>Spi</I>
-
-is a number, preceded by '.' indicating hexadecimal and IPv4 or by ':' indicating hexadecimal and IPv6,
-where each hexadecimal digit represents 4 bits,
-between
-<B>0x100</B>
-
-and
-<B>0xffffffff</B>;
-
-values from
-<B>0x0</B>
-
-to
-<B>0xff</B>
-
-are reserved.
-<I>Daddr</I>
-
-is a dotted-decimal IPv4 destination address or a coloned hex IPv6 destination address.
-<P>
-
-An
-<I>SAID</I>
-
-combines the three parameters above, such as: &quot;<A HREF="mailto:tun.101@1.2.3.4">tun.101@1.2.3.4</A>&quot; for IPv4 or &quot;tun:<A HREF="mailto:101@3049">101@3049</A>:1::1&quot; for IPv6
-<P>
-
-A table entry consists of:
-<DL COMPACT>
-<DT>+<DD>
-<B>SAID</B>
-
-<DT>+<DD>
-&lt;transform name (proto,encalg,authalg)&gt;:
-<DT>+<DD>
-direction (dir=)
-<DT>+<DD>
-source address (src=)
-<DT>+<DD>
-source and destination addresses and masks for inner header policy check
-addresses (policy=), as dotted-quads or coloned hex, separated by '-&gt;',
-for IPv4-in-IPv4 or IPv6-in-IPv6 SAs only
-<DT>+<DD>
-initialisation vector length and value (iv_bits=, iv=) if non-zero
-<DT>+<DD>
-out-of-order window size, number of out-of-order errors, sequence
-number, recently received packet bitmask, maximum difference between
-sequence numbers (ooowin=, ooo_errs=, seq=, bit=, max_seq_diff=) if SA
-is AH or ESP and if individual items are non-zero
-<DT>+<DD>
-extra flags (flags=) if any are set
-<DT>+<DD>
-authenticator length in bits (alen=) if non-zero
-<DT>+<DD>
-authentication key length in bits (aklen=) if non-zero
-<DT>+<DD>
-authentication errors (auth_errs=) if non-zero
-<DT>+<DD>
-encryption key length in bits (eklen=) if non-zero
-<DT>+<DD>
-encryption size errors (encr_size_errs=) if non-zero
-<DT>+<DD>
-encryption padding error warnings (encr_pad_errs=) if non-zero
-<DT>+<DD>
-lifetimes legend, c=Current status, s=Soft limit when exceeded will
-initiate rekeying, h=Hard limit will cause termination of SA (life(c,s,h)=)
-<DT>+<DD>
-number of connections to which the SA is allocated (c), that will cause a
-rekey (s), that will cause an expiry (h) (alloc=), if any value is non-zero
-<DT>+<DD>
-number of bytes processesd by this SA (c), that will cause a rekey (s), that
-will cause an expiry (h) (bytes=), if any value is non-zero
-<DT>+<DD>
-time since the SA was added (c), until rekey (s), until expiry (h), in seconds (add=)
-<DT>+<DD>
-time since the SA was first used (c), until rekey (s), until expiry (h), in seconds (used=),
-if any value is non-zero
-<DT>+<DD>
-number of packets processesd by this SA (c), that will cause a rekey (s), that
-will cause an expiry (h) (packets=), if any value is non-zero
-<DT>+<DD>
-time since the last packet was processed, in seconds (idle=), if SA has
-been used
-<DT><DD>
-average compression ratio (ratio=)
-</DL>
-<A NAME="lbAE">&nbsp;</A>
-<H2>EXAMPLES</H2>
-
-<B><A HREF="mailto:tun.12a@192.168.43.1">tun.12a@192.168.43.1</A> IPIP: dir=out src=192.168.43.2</B>
-
-<BR>
-
-<B>      life(c,s,h)=bytes(14073,0,0)add(269,0,0)</B>
-
-<BR>
-
-<B>      use(149,0,0)packets(14,0,0)</B>
-
-<BR>
-
-<B>      idle=23</B>
-
-<P>
-
-is an outbound IPv4-in-IPv4 (protocol 4) tunnel-mode SA set up between machines
-192.168.43.2 and 192.168.43.1 with an SPI of 12a in hexadecimal that has
-passed about 14 kilobytes of traffic in 14 packets since it was created,
-269 seconds ago, first used 149 seconds ago and has been idle for 23
-seconds.
-<P>
-
-<B>esp:<A HREF="mailto:9a35fc02@3049">9a35fc02@3049</A>:1::1 ESP_3DES_HMAC_MD5:</B>
-
-<BR>
-
-<B>      dir=in src=<A HREF="mailto:9a35fc02@3049">9a35fc02@3049</A>:1::2</B>
-
-<BR>
-
-<B>      ooowin=32 seq=7149 bit=0xffffffff</B>
-
-<BR>
-
-<B>      alen=128 aklen=128 eklen=192</B>
-
-<BR>
-
-<B>      life(c,s,h)=bytes(1222304,0,0)add(4593,0,0)</B>
-
-<BR>
-
-<B>      use(3858,0,0)packets(7149,0,0)</B>
-
-<BR>
-
-<B>      idle=23</B>
-
-<P>
-
-is an inbound Encapsulating Security Payload (protocol 50) SA on machine
-3049:1::1 with an SPI of 9a35fc02 that uses 3DES as the encryption
-cipher, HMAC MD5 as the authentication algorithm, an out-of-order
-window of 32 packets, a present sequence number of 7149, every one of
-the last 32 sequence numbers was received, the authenticator length and
-keys is 128 bits, the encryption key is 192 bits (actually 168 for 3DES
-since 1 of 8 bits is a parity bit), has passed 1.2 Mbytes of data in
-7149 packets, was added 4593 seconds ago, first used
-3858 seconds ago and has been idle for 23 seconds.
-<P>
-
-<A NAME="lbAF">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/ipsec_spi, /usr/local/bin/ipsec
-<A NAME="lbAG">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_tncfg.5.html">ipsec_tncfg</A>(5), <A HREF="ipsec_eroute.5.html">ipsec_eroute</A>(5),
-<A HREF="ipsec_spigrp.5.html">ipsec_spigrp</A>(5), <A HREF="ipsec_klipsdebug.5.html">ipsec_klipsdebug</A>(5), <A HREF="ipsec_spi.8.html">ipsec_spi</A>(8), <A HREF="ipsec_version.5.html">ipsec_version</A>(5),
-<A HREF="ipsec_pf_key.5.html">ipsec_pf_key</A>(5)
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Richard Guy Briggs.
-<A NAME="lbAI">&nbsp;</A>
-<H2>BUGS</H2>
-
-The add and use times are awkward, displayed in seconds since machine
-start.  It would be better to display them in seconds before now for
-human readability.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">EXAMPLES</A><DD>
-<DT><A HREF="#lbAF">FILES</A><DD>
-<DT><A HREF="#lbAG">SEE ALSO</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-<DT><A HREF="#lbAI">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_spi.8.html b/doc/manpage.d/ipsec_spi.8.html
deleted file mode 100644
index a40d06d9b..000000000
--- a/doc/manpage.d/ipsec_spi.8.html
+++ /dev/null
@@ -1,790 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_SPI</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_SPI</H1>
-Section: Maintenance Commands (8)<BR>Updated: 23 Oct 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec spi - manage IPSEC Security Associations
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<BR>
-
-Note: In the following,
-<BR>
-
-<B>&lt;SA&gt;</B>
-
-means:
-<B>--af</B>
-
-(inet | inet6)
-<B>--edst</B>
-
-daddr
-<B>--spi</B>
-
-spi
-<B>--proto</B>
-
-proto OR 
-<B>--said</B>
-
-said,
-<BR>
-
-<B>&lt;life&gt;</B>
-
-means:
-<B>--life</B>
-
-(soft | hard)-(allocations | bytes | addtime | usetime | packets)=value[,...]
-<P>
-
-<B>ipsec</B>
-
-<B>spi</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>spi</B>
-
-<B>&lt;SA&gt;</B>
-
-<B>--src</B>
-
-src
-<B>--ah</B>
-
-<B>hmac-md5-96</B>|<B>hmac-sha1-96</B>
-
-[
-<B>--replay_window</B>
-
-replayw ]
-[
-<B>&lt;life&gt;</B>
-
-]
-<B>--authkey</B>
-
-akey
-<P>
-
-<B>ipsec</B>
-
-<B>spi</B>
-
-<B>&lt;SA&gt;</B>
-
-<B>--src</B>
-
-src
-<B>--esp</B>
-
-<B>3des</B>
-
-[
-<B>--replay_window</B>
-
-replayw ]
-[
-<B>&lt;life&gt;</B>
-
-]
-<B>--enckey</B>
-
-ekey
-<P>
-
-<B>ipsec</B>
-
-<B>spi</B>
-
-<B>&lt;SA&gt;</B>
-
-<B>--src</B>
-
-src
-<B>--esp</B>
-
-<B>3des-md5-96</B>|<B>3des-sha1-96</B>
-
-[
-<B>--replay_window</B>
-
-replayw ]
-[
-<B>&lt;life&gt;</B>
-
-]
-<B>--enckey</B>
-
-ekey
-<B>--authkey</B>
-
-akey
-<P>
-
-<B>ipsec</B>
-
-<B>spi</B>
-
-<B>&lt;SA&gt;</B>
-
-<B>--src</B>
-
-src
-<B>--comp</B>
-
-<B>deflate</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>spi</B>
-
-<B>&lt;SA&gt;</B>
-
-<B>--ip4</B>
-
-<B>--src</B>
-
-encap-src
-<B>--dst</B>
-
-encap-dst
-<P>
-
-<B>ipsec</B>
-
-<B>spi</B>
-
-<B>&lt;SA&gt;</B>
-
-<B>--ip6</B>
-
-<B>--src</B>
-
-encap-src
-<B>--dst</B>
-
-encap-dst
-<P>
-
-<B>ipsec</B>
-
-<B>spi</B>
-
-<B>&lt;SA&gt;</B>
-
-<B>--del</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>spi</B>
-
-<B>--help</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>spi</B>
-
-<B>--version</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>spi</B>
-
-<B>--clear</B>
-
-<P>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Spi</I>
-
-creates and deletes IPSEC Security Associations.
-A Security Association (SA) is a transform through which packet
-contents are to be processed before being forwarded.
-A transform can be an IPv4-in-IPv4 or an IPv6-in-IPv6 encapsulation,
-an IPSEC Authentication Header (authentication with no encryption),
-or an IPSEC Encapsulation Security Payload (encryption, possibly
-including authentication).
-<P>
-
-When a packet is passed from a higher networking layer
-through an IPSEC virtual interface,
-a search in the extended routing table (see
-<I><A HREF="ipsec_eroute.8.html">ipsec_eroute</A></I>(8))
-
-yields an effective destination address, a
-Security Parameters Index (SPI) and a IP protocol number.
-When an IPSEC packet arrives from the network,
-its ostensible destination, an SPI and an IP protocol
-specified by its outermost IPSEC header are used.
-The destination/SPI/protocol combination is used to select a relevant SA.
-(See
-<I><A HREF="ipsec_spigrp.8.html">ipsec_spigrp</A></I>(8)
-
-for discussion of how multiple transforms are combined.)
-<P>
-
-The
-<I>af</I>,
-
-<I>daddr</I>,
-
-<I>spi</I>
-
-and
-<I>proto</I>
-
-arguments specify the SA to be created or deleted.
-<I>af</I>
-
-is the address family (inet for IPv4, inet6 for IPv6).
-<I>Daddr</I>
-
-is a destination address
-in dotted-decimal notation for IPv4 
-or in a coloned hex notation for IPv6.
-<I>Spi</I>
-
-is a number, preceded by '0x' for hexadecimal,
-between
-<B>0x100</B>
-
-and
-<B>0xffffffff</B>;
-
-values from
-<B>0x0</B>
-
-to
-<B>0xff</B>
-
-are reserved.
-<I>Proto</I>
-
-is an ASCII string, &quot;ah&quot;, &quot;esp&quot;, &quot;comp&quot; or &quot;tun&quot;, specifying the IP protocol.
-The protocol must agree with the algorithm selected.
-<P>
-
-Alternatively, the
-<I>said</I>
-
-argument can also specify an SA to be created or deleted.
-<I>Said</I>
-
-combines the three parameters above, such as: &quot;<A HREF="mailto:tun.101@1.2.3.4">tun.101@1.2.3.4</A>&quot; or &quot;tun:101@1:2::3:4&quot;,
-where the address family is specified by &quot;.&quot; for IPv4 and &quot;:&quot; for IPv6. The address
-family indicators substitute the &quot;0x&quot; for hexadecimal.
-<P>
-
-The source address,
-<I>src</I>,
-
-must also be provided for the inbound policy check to
-function.  The source address does not need to be included if inbound
-policy checking has been disabled.
-<P>
-
-Keys vectors must be entered as hexadecimal or base64 numbers.
-They should be cryptographically strong random numbers.
-<P>
-
-All hexadecimal numbers are entered as strings of hexadecimal digits
-(0-9 and a-f), without spaces, preceded by '0x', where each hexadecimal
-digit represents 4 bits.
-All base64 numbers are entered as strings of base64 digits
-<BR>&nbsp;(0-9,&nbsp;A-Z,&nbsp;a-z,&nbsp;'+'&nbsp;and&nbsp;'/'),&nbsp;without&nbsp;spaces,&nbsp;preceded&nbsp;by&nbsp;'0s',
-where each hexadecimal digit represents 6 bits and '=' is used for padding.
-<P>
-
-The deletion of an SA which has been grouped will result in the entire chain
-being deleted.
-<P>
-
-The form with no additional arguments lists the contents of
-/proc/net/ipsec_spi.  The format of /proc/net/ipsec_spi is discussed in
-<A HREF="ipsec_spi.5.html">ipsec_spi</A>(5).
-<P>
-
-The lifetime severity of
-<B>soft</B>
-
-sets a limit when the key management daemons are asked to rekey the SA.
-The lifetime severity of
-<B>hard</B>
-
-sets a limit when the SA must expire.
-The lifetime type
-<B>allocations</B>
-
-tells the system when to expire the SA because it is being shared by too many
-eroutes (not currently used).  The lifetime type of
-<B>bytes</B>
-
-tells the system to expire the SA after a certain number of bytes have been
-processed with that SA.  The lifetime type of
-<B>addtime</B>
-
-tells the system to expire the SA a certain number of seconds after the SA was
-installed.  The lifetime type of
-<B>usetime</B>
-
-tells the system to expire the SA a certain number of seconds after that SA has
-processed its first packet.  The lifetime type of
-<B>packets</B>
-
-tells the system to expire the SA after a certain number of packets have been
-processed with that SA.
-<A NAME="lbAE">&nbsp;</A>
-<H2>OPTIONS</H2>
-
-<DL COMPACT>
-<DT><B>--af</B>
-
-<DD>
-specifies the address family (inet for IPv4, inet6 for IPv6)
-<DT><B>--edst</B>
-
-<DD>
-specifies the effective destination
-<I>daddr</I>
-
-of the Security Association
-<DT><B>--spi</B>
-
-<DD>
-specifies the Security Parameters Index
-<I>spi</I>
-
-of the Security Association
-<DT><B>--proto</B>
-
-<DD>
-specifies the IP protocol
-<I>proto</I>
-
-of the Security Association
-<DT><B>--said</B>
-
-<DD>
-specifies the Security Association in monolithic format
-<DT><B>--ah</B>
-
-<DD>
-add an SA for an IPSEC Authentication Header,
-specified by the following transform identifier
-(<B>hmac-md5-96</B>
-
-or
-<B>hmac-sha1-96</B>)
-
-(RFC2402, obsoletes RFC1826)
-<DT><B>hmac-md5-96</B>
-
-<DD>
-transform following the HMAC and MD5 standards,
-using a 128-bit
-<I>key</I>
-
-to produce a 96-bit authenticator (RFC2403)
-<DT><B>hmac-sha1-96</B>
-
-<DD>
-transform following the HMAC and SHA1 standards,
-using a 160-bit
-<I>key</I>
-
-to produce a 96-bit authenticator (RFC2404)
-<DT><B>--esp</B>
-
-<DD>
-add an SA for an IPSEC Encapsulation Security Payload,
-specified by the following
-transform identifier (<B>3des</B>,
-
-or
-<B>3des-md5-96</B>)
-
-(RFC2406, obsoletes RFC1827)
-<DT><B>3des</B>
-
-<DD>
-encryption transform following the Triple-DES standard in
-Cipher-Block-Chaining mode using a 64-bit
-<I>iv</I>
-
-(internally generated) and a 192-bit 3DES
-<I>ekey</I>
-
-(RFC2451)
-<DT><B>3des-md5-96</B>
-
-<DD>
-encryption transform following the Triple-DES standard in
-Cipher-Block-Chaining mode with authentication provided by
-HMAC and MD5
-(96-bit authenticator),
-using a 64-bit
-<I>iv</I>
-
-(internally generated), a 192-bit 3DES
-<I>ekey</I>
-
-and a 128-bit HMAC-MD5
-<I>akey</I>
-
-(RFC2451, RFC2403)
-<DT><B>3des-sha1-96</B>
-
-<DD>
-encryption transform following the Triple-DES standard in
-Cipher-Block-Chaining mode with authentication provided by
-HMAC and SHA1
-(96-bit authenticator),
-using a 64-bit
-<I>iv</I>
-
-(internally generated), a 192-bit 3DES
-<I>ekey</I>
-
-and a 160-bit HMAC-SHA1
-<I>akey</I>
-
-(RFC2451, RFC2404)
-<DT><B>--replay_window</B> replayw
-
-<DD>
-sets the replay window size; valid values are decimal, 1 to 64
-<DT><B>--life</B> life_param[,life_param]
-
-<DD>
-sets the lifetime expiry; the format of
-<B>life_param</B>
-
-consists of a comma-separated list of lifetime specifications without spaces;
-a lifetime specification is comprised of a severity of
-<B>soft</B> or <B>hard</B>
-
-followed by a '-', followed by a lifetime type of
-<B>allocations</B>, <B>bytes</B>, <B>addtime</B>, <B>usetime</B> or <B>packets</B>
-
-followed by an '=' and finally by a value
-<DT><B>--comp</B>
-
-<DD>
-add an SA for IPSEC IP Compression,
-specified by the following
-transform identifier (<B>deflate</B>)
-
-(RFC2393)
-<DT><B>deflate</B>
-
-<DD>
-compression transform following the patent-free Deflate compression algorithm
-(RFC2394)
-<DT><B>--ip4</B>
-
-<DD>
-add an SA for an IPv4-in-IPv4
-tunnel from
-<I>encap-src</I>
-
-to
-<I>encap-dst</I>
-
-<DT><B>--ip6</B>
-
-<DD>
-add an SA for an IPv6-in-IPv6
-tunnel from
-<I>encap-src</I>
-
-to
-<I>encap-dst</I>
-
-<DT><B>--src</B>
-
-<DD>
-specify the source end of an IP-in-IP tunnel from
-<I>encap-src</I>
-
-to
-<I>encap-dst</I>
-
-and also specifies the source address of the Security Association to be
-used in inbound policy checking and must be the same address
-family as
-<I>af</I>
-
-and
-<I>edst</I>
-
-<DT><B>--dst</B>
-
-<DD>
-specify the destination end of an IP-in-IP tunnel from
-<I>encap-src</I>
-
-to
-<I>encap-dst</I>
-
-<DT><B>--del</B>
-
-<DD>
-delete the specified SA
-<DT><B>--clear</B>
-
-<DD>
-clears the table of
-<B>SA</B>s
-
-<DT><B>--help</B>
-
-<DD>
-display synopsis
-<DT><B>--version</B>
-
-<DD>
-display version information
-</DL>
-<A NAME="lbAF">&nbsp;</A>
-<H2>EXAMPLES</H2>
-
-To keep line lengths down and reduce clutter,
-some of the long keys in these examples have been abbreviated
-by replacing part of their text with
-``<I>...</I>''.
-
-Keys used when the programs are actually run must,
-of course, be the full length required for the particular algorithm.
-<P>
-
-<B>ipsec spi --af inet --edst gw2 --spi 0x125 --proto esp \</B>
-
-<BR>
-
-<B>   --src gw1 \</B>
-
-<BR>
-
-<B>   --esp 3des-md5-96 \</B>
-
-<BR>
-
-<B>&nbsp;&nbsp;&nbsp;--enckey&nbsp;0x6630</B><I>...</I><B>97ce&nbsp;\</B>
-
-<BR>
-
-<B>   --authkey 0x9941</B><I>...</I><B>71df</B>
-
-<P>
-
-sets up an SA from
-<B>gw1</B>
-
-to
-<B>gw2</B>
-
-with an SPI of 
-<B>0x125</B>
-
-and protocol
-<B>ESP</B>
-
-(50) using
-<B>3DES</B>
-
-encryption with integral
-<B>MD5-96</B>
-
-authentication transform, using an encryption key of
-<B>0x6630</B><I>...</I><B>97ce</B>
-
-and an authentication key of
-<B>0x9941</B><I>...</I><B>71df</B>
-
-(see note above about abbreviated keys).
-<P>
-
-<B>ipsec spi --af inet6 --edst 3049:9::9000:3100 --spi 0x150 --proto ah \</B>
-
-<BR>
-
-<B>   --src 3049:9::9000:3101 \</B>
-
-<BR>
-
-<B>   --ah hmac-md5-96 \</B>
-
-<BR>
-
-<B>&nbsp;&nbsp;&nbsp;--authkey&nbsp;0x1234</B><I>...</I><B>2eda&nbsp;\</B>
-
-<P>
-
-sets up an SA from
-<B>3049:9::9000:3101</B>
-
-to
-<B>3049:9::9000:3100</B>
-
-with an SPI of 
-<B>0x150</B>
-
-and protocol
-<B>AH</B>
-
-(50) using
-<B>MD5-96</B>
-
-authentication transform, using an authentication key of
-<B>0x1234</B><I>...</I><B>2eda</B>
-
-(see note above about abbreviated keys).
-<P>
-
-<B>ipsec spi --said <A HREF="mailto:tun.987@192.168.100.100">tun.987@192.168.100.100</A> --del </B>
-
-<P>
-
-deletes an SA to
-<B>192.168.100.100</B>
-
-with an SPI of 
-<B>0x987</B>
-
-and protocol
-<B>IPv4-in-IPv4</B>
-
-(4).
-<P>
-
-<B>ipsec spi --said tun:<A HREF="mailto:500@3049">500@3049</A>:9::1000:1 --del </B>
-
-<P>
-
-deletes an SA to
-<B>3049:9::1000:1</B>
-
-with an SPI of 
-<B>0x500</B>
-
-and protocol
-<B>IPv6-in-IPv6</B>
-
-(4).
-<P>
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/ipsec_spi, /usr/local/bin/ipsec
-<A NAME="lbAH">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A>(8), <A HREF="ipsec_eroute.8.html">ipsec_eroute</A>(8),
-<A HREF="ipsec_spigrp.8.html">ipsec_spigrp</A>(8), <A HREF="ipsec_klipsdebug.8.html">ipsec_klipsdebug</A>(8), <A HREF="ipsec_spi.5.html">ipsec_spi</A>(5)
-<A NAME="lbAI">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Richard Guy Briggs.
-<A NAME="lbAJ">&nbsp;</A>
-<H2>BUGS</H2>
-
-The syntax is messy and the transform naming needs work.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">OPTIONS</A><DD>
-<DT><A HREF="#lbAF">EXAMPLES</A><DD>
-<DT><A HREF="#lbAG">FILES</A><DD>
-<DT><A HREF="#lbAH">SEE ALSO</A><DD>
-<DT><A HREF="#lbAI">HISTORY</A><DD>
-<DT><A HREF="#lbAJ">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_spigrp.5.html b/doc/manpage.d/ipsec_spigrp.5.html
deleted file mode 100644
index e0efcb73e..000000000
--- a/doc/manpage.d/ipsec_spigrp.5.html
+++ /dev/null
@@ -1,193 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_SPIGRP</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_SPIGRP</H1>
-Section: File Formats (5)<BR>Updated: 27 Jun 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec_spigrp - list IPSEC Security Association groupings
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>spigrp</B>
-
-<P>
-
-<B>cat</B>
-
-<B>/proc/net/ipsec_spigrp</B>
-
-<P>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>/proc/net/ipsec_spigrp</I>
-
-is a read-only file that lists groups of IPSEC Security Associations
-(SAs).
-<P>
-
-An entry in the IPSEC extended routing table can only point (via an
-SAID) to one SA.  If more than one transform must be applied to a given
-type of packet, this can be accomplished by setting up several SAs with
-the same destination address but potentially different SPIs and
-protocols, and grouping them with
-<I><A HREF="ipsec_spigrp.8.html">ipsec_spigrp</A>(8)</I>.
-
-<P>
-
-The SA groups are listed, one line per connection/group, as a sequence
-of SAs to be applied (or that should have been applied, in the case of
-an incoming packet) from inside to outside the packet.  An SA is
-identified by its SAID, which consists of protocol (&quot;ah&quot;, &quot;esp&quot;, &quot;comp&quot; or
-&quot;tun&quot;), SPI (with '.' for IPv4 or ':' for IPv6 prefixed hexadecimal number ) and destination address
-(IPv4 dotted quad or IPv6 coloned hex) prefixed by '@', in the format &lt;proto&gt;&lt;af&gt;&lt;spi&gt;@&lt;dest&gt;.
-<A NAME="lbAE">&nbsp;</A>
-<H2>EXAMPLES</H2>
-
-<DL COMPACT>
-<DT><B><A HREF="mailto:tun.3d0@192.168.2.110">tun.3d0@192.168.2.110</A></B>
-
-<DD>
-<B><A HREF="mailto:comp.3d0@192.168.2.110">comp.3d0@192.168.2.110</A></B>
-
-<B><A HREF="mailto:esp.187a101b@192.168.2.110">esp.187a101b@192.168.2.110</A></B>
-
-<B><A HREF="mailto:ah.187a101a@192.168.2.110">ah.187a101a@192.168.2.110</A> </B>
-
-</DL>
-<P>
-
-is a group of 3 SAs, destined for 
-<B>192.168.2.110</B>
-
-with an IPv4-in-IPv4 tunnel SA applied first with an SPI of
-<B>3d0</B>
-
-in hexadecimal, followed by a Deflate compression header to compress
-the packet with CPI of
-<B>3d0</B>
-
-in hexadecimal, followed by an Encapsulating Security Payload header to
-encrypt the packet with SPI
-<B>187a101b</B>
-
-in hexadecimal, followed by an Authentication Header to authenticate the
-packet with SPI
-<B>187a101a</B>
-
-in hexadecimal, applied from inside to outside the packet.  This could
-be an incoming or outgoing group, depending on the address of the local
-machine.
-<P>
-
-<DL COMPACT>
-<DT><B>tun:<A HREF="mailto:3d0@3049">3d0@3049</A>:1::2</B>
-
-<DD>
-<B>comp:<A HREF="mailto:3d0@3049">3d0@3049</A>:1::2</B>
-
-<B>esp:<A HREF="mailto:187a101b@3049">187a101b@3049</A>:1::2</B>
-
-<B>ah:<A HREF="mailto:187a101a@3049">187a101a@3049</A>:1::2 </B>
-
-</DL>
-<P>
-
-is a group of 3 SAs, destined for 
-<B>3049:1::2</B>
-
-with an IPv6-in-IPv6 tunnel SA applied first with an SPI of
-<B>3d0</B>
-
-in hexadecimal, followed by a Deflate compression header to compress
-the packet with CPI of
-<B>3d0</B>
-
-in hexadecimal, followed by an Encapsulating Security Payload header to
-encrypt the packet with SPI
-<B>187a101b</B>
-
-in hexadecimal, followed by an Authentication Header to authenticate the
-packet with SPI
-<B>187a101a</B>
-
-in hexadecimal, applied from inside to outside the packet.  This could
-be an incoming or outgoing group, depending on the address of the local
-machine.
-<P>
-
-<A NAME="lbAF">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/ipsec_spigrp, /usr/local/bin/ipsec
-<A NAME="lbAG">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_tncfg.5.html">ipsec_tncfg</A>(5), <A HREF="ipsec_eroute.5.html">ipsec_eroute</A>(5),
-<A HREF="ipsec_spi.5.html">ipsec_spi</A>(5), <A HREF="ipsec_klipsdebug.5.html">ipsec_klipsdebug</A>(5), <A HREF="ipsec_spigrp.8.html">ipsec_spigrp</A>(8), <A HREF="ipsec_version.5.html">ipsec_version</A>(5),
-<A HREF="ipsec_pf_key.5.html">ipsec_pf_key</A>(5)
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Richard Guy Briggs.
-<A NAME="lbAI">&nbsp;</A>
-<H2>BUGS</H2>
-
-:-)
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">EXAMPLES</A><DD>
-<DT><A HREF="#lbAF">FILES</A><DD>
-<DT><A HREF="#lbAG">SEE ALSO</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-<DT><A HREF="#lbAI">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_spigrp.8.html b/doc/manpage.d/ipsec_spigrp.8.html
deleted file mode 100644
index 2e96c0574..000000000
--- a/doc/manpage.d/ipsec_spigrp.8.html
+++ /dev/null
@@ -1,280 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_SPIGRP</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_SPIGRP</H1>
-Section: Maintenance Commands (8)<BR>Updated: 21 Jun 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec spigrp - group/ungroup IPSEC Security Associations
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>spigrp</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>spigrp</B>
-
-[
-<B>--label</B>
-
-label ]
-af1 dst1 spi1 proto1 [ af2 dst2 spi2 proto2 [ af3 dst3 spi3 proto3 [ af4 dst4 spi4 proto4 ] ] ] 
-<P>
-
-<B>ipsec</B>
-
-<B>spigrp</B>
-
-[
-<B>--label</B>
-
-label ]
-<B>--said</B>
-
-SA1 [ SA2 [ SA3 [ SA4 ] ] ] 
-<P>
-
-<B>ipsec</B>
-
-<B>spigrp</B>
-
-<B>--help</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>spigrp</B>
-
-<B>--version</B>
-
-<P>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Spigrp</I>
-
-groups IPSEC Security Associations (SAs) together or ungroups
-previously grouped SAs.
-An entry in the IPSEC extended
-routing table can only point
-(via a destination address, a Security Parameters Index (SPI) and
-a protocol identifier) to one SA.
-If more than one transform must be applied to a given type of packet,
-this can be accomplished by setting up several SAs
-with the same destination address but potentially different SPIs and protocols,
-and grouping them with
-<I>spigrp</I>.
-
-<P>
-
-The SAs to be grouped,
-specified by destination address (DNS name lookup, IPv4 dotted quad or IPv6 coloned hex), SPI
-('0x'-prefixed hexadecimal number) and protocol (&quot;ah&quot;, &quot;esp&quot;, &quot;comp&quot; or &quot;tun&quot;),
-are listed from the inside transform to the
-outside;
-in other words, the transforms are applied in
-the order of the command line and removed in the reverse
-order.
-The resulting SA group is referred to by its first SA (by
-<I>af1</I>,
-
-<I>dst1</I>,
-
-<I>spi1</I>
-
-and
-<I>proto1</I>).
-
-<P>
-
-The --said option indicates that the SA IDs are to be specified as
-one argument each, in the format &lt;proto&gt;&lt;af&gt;&lt;spi&gt;@&lt;dest&gt;.  The SA IDs must
-all be specified as separate parameters without the --said option or
-all as monolithic parameters after the --said option.
-<P>
-
-The SAs must already exist and must not already
-be part of a group.
-<P>
-
-If
-<I>spigrp</I>
-
-is invoked with only one SA specification,
-it ungroups the previously-grouped set of SAs containing
-the SA specified.
-<P>
-
-The --label option identifies all responses from that command
-invocation with a user-supplied label, provided as an argument to the
-label option.  This can be helpful for debugging one invocation of the
-command out of a large number.
-<P>
-
-The command form with no additional arguments lists the contents of
-/proc/net/ipsec_spigrp.  The format of /proc/net/ipsec_spigrp is
-discussed in <A HREF="ipsec_spigrp.5.html">ipsec_spigrp</A>(5).
-<A NAME="lbAE">&nbsp;</A>
-<H2>EXAMPLES</H2>
-
-<DL COMPACT>
-<DT><B>ipsec spigrp inet gw2 0x113 tun inet gw2 0x115 esp inet gw2 0x116 ah</B>
-
-<DD>
-groups 3 SAs together, all destined for
-<B>gw2</B>,
-
-but with an IPv4-in-IPv4 tunnel SA applied first with SPI
-<B>0x113</B>,
-
-then an ESP header to encrypt the packet with SPI
-<B>0x115</B>,
-
-and finally an AH header to authenticate the packet with SPI
-<B>0x116</B>.
-
-</DL>
-<P>
-
-<DL COMPACT>
-<DT><B>ipsec spigrp --said tun.113@gw2 esp.115@gw2 ah.116@gw2 </B>
-
-<DD>
-groups 3 SAs together, all destined for
-<B>gw2</B>,
-
-but with an IPv4-in-IPv4 tunnel SA applied first with SPI
-<B>0x113</B>,
-
-then an ESP header to encrypt the packet with SPI
-<B>0x115</B>,
-
-and finally an AH header to authenticate the packet with SPI
-<B>0x116</B>.
-
-</DL>
-<P>
-
-<DL COMPACT>
-<DT><B>ipsec spigrp --said tun:<A HREF="mailto:233@3049">233@3049</A>:1::1 esp:<A HREF="mailto:235@3049">235@3049</A>:1::1 ah:<A HREF="mailto:236@3049">236@3049</A>:1::1 </B>
-
-<DD>
-groups 3 SAs together, all destined for
-<B>3049:1::1,</B>
-
-but with an IPv6-in-IPv6 tunnel SA applied first with SPI
-<B>0x233</B>,
-
-then an ESP header to encrypt the packet with SPI
-<B>0x235</B>,
-
-and finally an AH header to authenticate the packet with SPI
-<B>0x236</B>.
-
-</DL>
-<P>
-
-<DL COMPACT>
-<DT><B>ipsec spigrp inet6 3049:1::1 0x233 tun inet6 3049:1::1 0x235 esp inet6 3049:1::1 0x236 ah</B>
-
-<DD>
-groups 3 SAs together, all destined for
-<B>3049:1::1,</B>
-
-but with an IPv6-in-IPv6 tunnel SA applied first with SPI
-<B>0x233</B>,
-
-then an ESP header to encrypt the packet with SPI
-<B>0x235</B>,
-
-and finally an AH header to authenticate the packet with SPI
-<B>0x236</B>.
-
-</DL>
-<P>
-
-<A NAME="lbAF">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/ipsec_spigrp, /usr/local/bin/ipsec
-<A NAME="lbAG">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A>(8), <A HREF="ipsec_eroute.8.html">ipsec_eroute</A>(8),
-<A HREF="ipsec_spi.8.html">ipsec_spi</A>(8), <A HREF="ipsec_klipsdebug.8.html">ipsec_klipsdebug</A>(8), <A HREF="ipsec_spigrp.5.html">ipsec_spigrp</A>(5)
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Richard Guy Briggs.
-<A NAME="lbAI">&nbsp;</A>
-<H2>BUGS</H2>
-
-Yes, it really is limited to a maximum of four SAs,
-although admittedly it's hard to see why you would need more.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">EXAMPLES</A><DD>
-<DT><A HREF="#lbAF">FILES</A><DD>
-<DT><A HREF="#lbAG">SEE ALSO</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-<DT><A HREF="#lbAI">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_splitkeytoid.3.html b/doc/manpage.d/ipsec_splitkeytoid.3.html
deleted file mode 100644
index 109cfafa7..000000000
--- a/doc/manpage.d/ipsec_splitkeytoid.3.html
+++ /dev/null
@@ -1,174 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_KEYBLOBTOID</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_KEYBLOBTOID</H1>
-Section: C Library Functions (3)<BR>Updated: 25 March 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec keyblobtoid, splitkeytoid - generate key IDs from RSA keys
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>size_t keyblobtoid(const unsigned char *blob,</B>
-
-<BR>
-&nbsp;
-<B>size_t bloblen, char *dst, size_t dstlen);</B>
-
-<BR>
-
-<B>size_t splitkeytoid(const unsigned char *e, size_t elen,</B>
-
-<BR>
-&nbsp;
-<B>const unsigned char *m, size_t mlen, char *dst,</B>
-
-<BR>
-&nbsp;
-<B>size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Keyblobtoid</I>
-
-and
-<I>splitkeytoid</I>
-
-generate
-key IDs
-from RSA keys,
-for use in messages and reporting,
-writing the result to
-<I>dst</I>.
-
-A
-<I>key ID</I>
-
-is a short ASCII string identifying a key;
-currently it is just the first nine characters of the base64
-encoding of the RFC 2537/3110 ``byte blob'' representation of the key.
-(Beware that no finite key ID can be collision-proof:
-there is always some small chance of two random keys having the
-same ID.)
-<P>
-
-<I>Keyblobtoid</I>
-
-generates a key ID from a key which is already in the form of an
-RFC 2537/3110 binary key
-<I>blob</I>
-
-(encoded exponent length, exponent, modulus).
-<P>
-
-<I>Splitkeytoid</I>
-
-generates a key ID from a key given in the form of a separate
-(binary) exponent
-<I>e</I>
-
-and modulus
-<I>m</I>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of either
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines a constant
-<B>KEYID_BUF</B>
-
-which is the size of a buffer large enough for worst-case results.
-<P>
-
-Both functions return
-<B>0</B>
-
-for a failure, and otherwise
-always return the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-
-With keys generated by
-<I><A HREF="ipsec_rsasigkey.3.html">ipsec_rsasigkey</A></I>(3),
-
-the first two base64 digits are always the same,
-and the third carries only about one bit of information.
-It's worse with keys using longer fixed exponents,
-e.g. the 24-bit exponent that's common in X.509 certificates.
-However, being able to relate key IDs to the full
-base64 text form of keys by eye is sufficiently useful that this
-waste of space seems justifiable.
-The choice of nine digits is a compromise between bulk and
-probability of collision.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-RFC 3110,
-<I>RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)</I>,
-Eastlake, 2001
-(superseding the older but better-known RFC 2537).
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors are:
-key too short to supply enough bits to construct a complete key ID
-(almost certainly indicating a garbage key);
-exponent too long for its length to be representable.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_subnetinsubnet.3.html b/doc/manpage.d/ipsec_subnetinsubnet.3.html
deleted file mode 100644
index 414a0d513..000000000
--- a/doc/manpage.d/ipsec_subnetinsubnet.3.html
+++ /dev/null
@@ -1,274 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 28 Nov 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec sameaddr - are two addresses the same?
-<BR>
-
-ipsec addrcmp - ordered comparison of addresses
-<BR>
-
-ipsec samesubnet - are two subnets the same?
-<BR>
-
-ipsec addrinsubnet - is an address within a subnet?
-<BR>
-
-ipsec subnetinsubnet - is a subnet within another subnet?
-<BR>
-
-ipsec subnetishost - is a subnet a single host?
-<BR>
-
-ipsec samesaid - are two SA IDs the same?
-<BR>
-
-ipsec sameaddrtype - are two addresses of the same address family?
-<BR>
-
-ipsec samesubnettype - are two subnets of the same address family?
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int sameaddr(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int addrcmp(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int addrinsubnet(const ip_address *a, const ip_subnet *s);</B>
-
-<BR>
-
-<B>int subnetinsubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int subnetishost(const ip_subnet *s);</B>
-
-<BR>
-
-<B>int samesaid(const ip_said *a, const ip_said *b);</B>
-
-<BR>
-
-<B>int sameaddrtype(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnettype(const ip_subnet *a, const ip_subnet *b);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions do various comparisons and tests on the
-<I>ip_address</I>
-
-type and
-<I>ip_subnet</I>
-
-types.
-<P>
-
-<I>Sameaddr</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Addresses of different families are never identical.
-<P>
-
-<I>Addrcmp</I>
-
-returns
-<B>-1</B>,
-
-<B>0</B>,
-
-or
-<B>1</B>
-
-respectively
-if address
-<I>a</I>
-
-is less than, equal to, or greater than
-<I>b</I>.
-
-If they are not of the same address family,
-they are never equal;
-the ordering reported in this case is arbitrary
-(and probably not useful) but consistent.
-<P>
-
-<I>Samesubnet</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Subnets of different address families are never identical.
-<P>
-
-<I>Addrinsubnet</I>
-
-returns
-non-zero
-if address
-<I>a</I>
-
-is within subnet
-<I>s</I>
-
-and
-<B>0</B>
-
-otherwise.
-An address is never within a
-subnet of a different address family.
-<P>
-
-<I>Subnetinsubnet</I>
-
-returns
-non-zero
-if subnet
-<I>a</I>
-
-is a subset of subnet
-<I>b</I>
-
-and
-<B>0</B>
-
-otherwise.
-A subnet is deemed to be a subset of itself.
-A subnet is never a subset of another
-subnet if their address families differ.
-<P>
-
-<I>Subnetishost</I>
-
-returns
-non-zero
-if subnet
-<I>s</I>
-
-is in fact only a single host,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesaid</I>
-
-returns
-non-zero
-if SA IDs
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Sameaddrtype</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesubnettype</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_initaddr.3.html">ipsec_initaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_subnetishost.3.html b/doc/manpage.d/ipsec_subnetishost.3.html
deleted file mode 100644
index 414a0d513..000000000
--- a/doc/manpage.d/ipsec_subnetishost.3.html
+++ /dev/null
@@ -1,274 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 28 Nov 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec sameaddr - are two addresses the same?
-<BR>
-
-ipsec addrcmp - ordered comparison of addresses
-<BR>
-
-ipsec samesubnet - are two subnets the same?
-<BR>
-
-ipsec addrinsubnet - is an address within a subnet?
-<BR>
-
-ipsec subnetinsubnet - is a subnet within another subnet?
-<BR>
-
-ipsec subnetishost - is a subnet a single host?
-<BR>
-
-ipsec samesaid - are two SA IDs the same?
-<BR>
-
-ipsec sameaddrtype - are two addresses of the same address family?
-<BR>
-
-ipsec samesubnettype - are two subnets of the same address family?
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>int sameaddr(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int addrcmp(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int addrinsubnet(const ip_address *a, const ip_subnet *s);</B>
-
-<BR>
-
-<B>int subnetinsubnet(const ip_subnet *a, const ip_subnet *b);</B>
-
-<BR>
-
-<B>int subnetishost(const ip_subnet *s);</B>
-
-<BR>
-
-<B>int samesaid(const ip_said *a, const ip_said *b);</B>
-
-<BR>
-
-<B>int sameaddrtype(const ip_address *a, const ip_address *b);</B>
-
-<BR>
-
-<B>int samesubnettype(const ip_subnet *a, const ip_subnet *b);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions do various comparisons and tests on the
-<I>ip_address</I>
-
-type and
-<I>ip_subnet</I>
-
-types.
-<P>
-
-<I>Sameaddr</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Addresses of different families are never identical.
-<P>
-
-<I>Addrcmp</I>
-
-returns
-<B>-1</B>,
-
-<B>0</B>,
-
-or
-<B>1</B>
-
-respectively
-if address
-<I>a</I>
-
-is less than, equal to, or greater than
-<I>b</I>.
-
-If they are not of the same address family,
-they are never equal;
-the ordering reported in this case is arbitrary
-(and probably not useful) but consistent.
-<P>
-
-<I>Samesubnet</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-Subnets of different address families are never identical.
-<P>
-
-<I>Addrinsubnet</I>
-
-returns
-non-zero
-if address
-<I>a</I>
-
-is within subnet
-<I>s</I>
-
-and
-<B>0</B>
-
-otherwise.
-An address is never within a
-subnet of a different address family.
-<P>
-
-<I>Subnetinsubnet</I>
-
-returns
-non-zero
-if subnet
-<I>a</I>
-
-is a subset of subnet
-<I>b</I>
-
-and
-<B>0</B>
-
-otherwise.
-A subnet is deemed to be a subset of itself.
-A subnet is never a subset of another
-subnet if their address families differ.
-<P>
-
-<I>Subnetishost</I>
-
-returns
-non-zero
-if subnet
-<I>s</I>
-
-is in fact only a single host,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesaid</I>
-
-returns
-non-zero
-if SA IDs
-<I>a</I>
-
-and
-<I>b</I>
-
-are identical,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Sameaddrtype</I>
-
-returns
-non-zero
-if addresses
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-<I>Samesubnettype</I>
-
-returns
-non-zero
-if subnets
-<I>a</I>
-
-and
-<I>b</I>
-
-are of the same address family,
-and
-<B>0</B>
-
-otherwise.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_initaddr.3.html">ipsec_initaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_subnetof.3.html b/doc/manpage.d/ipsec_subnetof.3.html
deleted file mode 100644
index a185d716b..000000000
--- a/doc/manpage.d/ipsec_subnetof.3.html
+++ /dev/null
@@ -1,107 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_SUBNETOF</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_SUBNETOF</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec subnetof - given Internet address and subnet mask, return subnet number
-<BR>
-
-ipsec hostof - given Internet address and subnet mask, return host part
-<BR>
-
-ipsec broadcastof - given Internet address and subnet mask, return broadcast address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>struct in_addr subnetof(struct in_addr addr,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr mask);</B>
-
-<BR>
-
-<B>struct in_addr hostof(struct in_addr addr,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr mask);</B>
-
-<BR>
-
-<B>struct in_addr broadcastof(struct in_addr addr,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr mask);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete; see
-<I><A HREF="ipsec_networkof.3.html">ipsec_networkof</A></I>(3)
-
-for their replacements.
-<P>
-
-<I>Subnetof</I>
-
-takes an Internet
-<I>address</I>
-
-and a subnet
-<I>mask</I>
-
-and returns the network part of the address
-(all in network byte order).
-<I>Hostof</I>
-
-similarly returns the host part, and
-<I>broadcastof</I>
-
-returns the broadcast address (all-1s convention) for the network.
-<P>
-
-These functions are provided to hide the Internet bit-munging inside
-an API, in hopes of easing the eventual transition to IPv6.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAG">&nbsp;</A>
-<H2>BUGS</H2>
-
-Calling functions for this is more costly than doing it yourself.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-<DT><A HREF="#lbAG">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_subnettoa.3.html b/doc/manpage.d/ipsec_subnettoa.3.html
deleted file mode 100644
index 718fa935a..000000000
--- a/doc/manpage.d/ipsec_subnettoa.3.html
+++ /dev/null
@@ -1,448 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ATOADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ATOADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec atoaddr, addrtoa - convert Internet addresses to and from ASCII
-<BR>
-
-ipsec atosubnet, subnettoa - convert subnet/mask ASCII form to and from addresses
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *atoaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr *addr);</B>
-
-<BR>
-
-<B>size_t addrtoa(struct in_addr addr, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<P>
-<B>const char *atosubnet(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>struct in_addr *addr, struct in_addr *mask);</B>
-
-<BR>
-
-<B>size_t subnettoa(struct in_addr addr, struct in_addr mask,</B>
-
-<BR>
-&nbsp;
-<B>int format, char *dst, size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete; see
-<I><A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A></I>(3)
-
-for their replacements.
-<P>
-
-<I>Atoaddr</I>
-
-converts an ASCII name or dotted-decimal address into a binary address
-(in network byte order).
-<I>Addrtoa</I>
-
-does the reverse conversion, back to an ASCII dotted-decimal address.
-<I>Atosubnet</I>
-
-and
-<I>subnettoa</I>
-
-do likewise for the ``address/mask'' ASCII form used to write a
-specification of a subnet.
-<P>
-
-An address is specified in ASCII as a
-dotted-decimal address (e.g.
-<B>1.2.3.4</B>),
-
-an eight-digit network-order hexadecimal number with the usual C prefix (e.g.
-<B>0x01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>),
-
-an eight-digit host-order hexadecimal number with a
-<B>0h</B>
-
-prefix (e.g.
-<B>0h01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>
-
-on a big-endian host and
-<B>4.3.2.1</B>
-
-on a little-endian host),
-a DNS name to be looked up via
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3),
-
-or an old-style network name to be looked up via
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3).
-
-<P>
-
-A dotted-decimal address may be incomplete, in which case
-ASCII-to-binary conversion implicitly appends
-as many instances of
-<B>.0</B>
-
-as necessary to bring it up to four components.
-The components of a dotted-decimal address are always taken as
-decimal, and leading zeros are ignored.
-For example,
-<B>10</B>
-
-is synonymous with
-<B>10.0.0.0</B>,
-
-and
-<B>128.009.000.032</B>
-
-is synonymous with
-<B>128.9.0.32</B>
-
-(the latter example is verbatim from RFC 1166).
-The result of
-<I>addrtoa</I>
-
-is always complete and does not contain leading zeros.
-<P>
-
-The letters in
-a hexadecimal address may be uppercase or lowercase or any mixture thereof.
-Use of hexadecimal addresses is
-<B>strongly</B>
-
-<B>discouraged</B>;
-
-they are included only to save hassles when dealing with
-the handful of perverted programs which already print 
-network addresses in hexadecimal.
-<P>
-
-DNS names may be complete (optionally terminated with a ``.'')
-or incomplete, and are looked up as specified by local system configuration
-(see
-<I><A HREF="resolver.5.html">resolver</A></I>(5)).
-
-The
-<I>h_addr</I>
-
-value returned by
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3)
-
-is used,
-so with current DNS implementations,
-the result when the name corresponds to more than one address is
-difficult to predict.
-Name lookup resorts to
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3)
-
-only if
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3)
-
-fails.
-<P>
-
-A subnet specification is of the form <I>network</I><B>/</B><I>mask</I>.
-The
-<I>network</I>
-
-and
-<I>mask</I>
-
-can be any form acceptable to
-<I>atoaddr</I>.
-
-In addition, the
-<I>mask</I>
-
-can be a decimal integer (leading zeros ignored) giving a bit count,
-in which case
-it stands for a mask with that number of high bits on and all others off
-(e.g.,
-<B>24</B>
-
-means
-<B>255.255.255.0</B>).
-
-In any case, the mask must be contiguous
-(a sequence of high bits on and all remaining low bits off).
-As a special case, the subnet specification
-<B>%default</B>
-
-is a synonym for
-<B>0.0.0.0/0</B>.
-
-<P>
-
-<I>Atosubnet</I>
-
-ANDs the mask with the address before returning,
-so that any non-network bits in the address are turned off
-(e.g.,
-<B>10.1.2.3/24</B>
-
-is synonymous with
-<B>10.1.2.0/24</B>).
-
-<I>Subnettoa</I>
-
-generates the decimal-integer-bit-count
-form of the mask,
-with no leading zeros,
-unless the mask is non-contiguous.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>atoaddr</I>
-
-and
-<I>atosubnet</I>
-
-specifies the length of the ASCII string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>addrtoa</I>
-
-and
-<I>subnettoa</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines constants,
-<B>ADDRTOA_BUF</B>
-
-and
-<B>SUBNETTOA_BUF</B>,
-
-which are the sizes of buffers just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>addrtoa</I>
-
-and
-<I>subnettoa</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the ASCII character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default,
-and is in fact the only format currently available.
-This parameter is a hedge against future needs.
-<P>
-
-The ASCII-to-binary functions return NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-The binary-to-ASCII functions return
-<B>0</B>
-
-for a failure, and otherwise
-always return the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>atoaddr</I>
-
-are:
-empty input;
-attempt to allocate temporary storage for a very long name failed;
-name lookup failed;
-syntax error in dotted-decimal form;
-dotted-decimal component too large to fit in 8 bits.
-<P>
-
-Fatal errors in
-<I>atosubnet</I>
-
-are:
-no
-<B>/</B>
-
-in
-<I>src</I>;
-
-<I>atoaddr</I>
-
-error in conversion of
-<I>network</I>
-
-or
-<I>mask</I>;
-
-bit-count mask too big;
-mask non-contiguous.
-<P>
-
-Fatal errors in
-<I>addrtoa</I>
-
-and
-<I>subnettoa</I>
-
-are:
-unknown format.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The interpretation of incomplete dotted-decimal addresses
-(e.g.
-<B>10/24</B>
-
-means
-<B>10.0.0.0/24</B>)
-
-differs from that of some older conversion
-functions, e.g. those of
-<I><A HREF="inet.3.html">inet</A></I>(3).
-
-The behavior of the older functions has never been
-particularly consistent or particularly useful.
-<P>
-
-Ignoring leading zeros in dotted-decimal components and bit counts
-is arguably the most useful behavior in this application,
-but it might occasionally cause confusion with the historical use of leading 
-zeros to denote octal numbers.
-<P>
-
-It is barely possible that somebody, somewhere,
-might have a legitimate use for non-contiguous subnet masks.
-<P>
-
-<I><A HREF="Getnetbyname.3.html">Getnetbyname</A></I>(3)
-
-is a historical dreg.
-<P>
-
-The restriction of ASCII-to-binary error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The ASCII-to-binary error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = atoaddr( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_subnettot.3.html b/doc/manpage.d/ipsec_subnettot.3.html
deleted file mode 100644
index 199937a35..000000000
--- a/doc/manpage.d/ipsec_subnettot.3.html
+++ /dev/null
@@ -1,569 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TTOADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TTOADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 28 Sept 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ttoaddr, tnatoaddr, addrtot - convert Internet addresses to and from text
-<BR>
-
-ipsec ttosubnet, subnettot - convert subnet/mask text form to and from addresses
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *ttoaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *addr);</B>
-
-<BR>
-
-<B>const char *tnatoaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *addr);</B>
-
-<BR>
-
-<B>size_t addrtot(const ip_address *addr, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<P>
-<B>const char *ttosubnet(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_subnet *dst);</B>
-
-<BR>
-
-<B>size_t subnettot(const ip_subnet *sub, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ttoaddr</I>
-
-converts a text-string name or numeric address into a binary address
-(in network byte order).
-<I>Tnatoaddr</I>
-
-does the same conversion,
-but the only text forms it accepts are
-the ``official'' forms of
-numeric address (dotted-decimal for IPv4, colon-hex for IPv6).
-<I>Addrtot</I>
-
-does the reverse conversion, from binary address back to a text form.
-<I>Ttosubnet</I>
-
-and
-<I>subnettot</I>
-
-do likewise for the ``address/mask'' form used to write a
-specification of a subnet.
-<P>
-
-An IPv4 address is specified in text as a
-dotted-decimal address (e.g.
-<B>1.2.3.4</B>),
-
-an eight-digit network-order hexadecimal number with the usual C prefix (e.g.
-<B>0x01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>),
-
-an eight-digit host-order hexadecimal number with a
-<B>0h</B>
-
-prefix (e.g.
-<B>0h01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>
-
-on a big-endian host and
-<B>4.3.2.1</B>
-
-on a little-endian host),
-a DNS name to be looked up via
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3),
-
-or an old-style network name to be looked up via
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3).
-
-<P>
-
-A dotted-decimal address may be incomplete, in which case
-text-to-binary conversion implicitly appends
-as many instances of
-<B>.0</B>
-
-as necessary to bring it up to four components.
-The components of a dotted-decimal address are always taken as
-decimal, and leading zeros are ignored.
-For example,
-<B>10</B>
-
-is synonymous with
-<B>10.0.0.0</B>,
-
-and
-<B>128.009.000.032</B>
-
-is synonymous with
-<B>128.9.0.32</B>
-
-(the latter example is verbatim from RFC 1166).
-The result of applying
-<I>addrtot</I>
-
-to an IPv4 address is always complete and does not contain leading zeros.
-<P>
-
-Use of hexadecimal addresses is
-<B>strongly</B>
-
-<B>discouraged</B>;
-
-they are included only to save hassles when dealing with
-the handful of perverted programs which already print 
-network addresses in hexadecimal.
-<P>
-
-An IPv6 address is specified in text with
-colon-hex notation (e.g.
-<B>0:56:78ab:22:33:44:55:66</B>),
-
-colon-hex with
-<B>::</B>
-
-abbreviating at most one subsequence of multiple zeros (e.g.
-<B>99:ab::54:068</B>,
-
-which is synonymous with
-<B>99:ab:0:0:0:0:54:68</B>),
-
-or a DNS name to be looked up via
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3).
-
-The result of applying
-<I>addrtot</I>
-
-to an IPv6 address will use
-<B>::</B>
-
-abbreviation if possible,
-and will not contain leading zeros.
-<P>
-
-The letters in hexadecimal
-may be uppercase or lowercase or any mixture thereof.
-<P>
-
-DNS names may be complete (optionally terminated with a ``.'')
-or incomplete, and are looked up as specified by local system configuration
-(see
-<I><A HREF="resolver.5.html">resolver</A></I>(5)).
-
-The
-<I>h_addr</I>
-
-value returned by
-<I><A HREF="gethostbyname2.3.html">gethostbyname2</A></I>(3)
-
-is used,
-so with current DNS implementations,
-the result when the name corresponds to more than one address is
-difficult to predict.
-IPv4 name lookup resorts to
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3)
-
-only if
-<I><A HREF="gethostbyname2.3.html">gethostbyname2</A></I>(3)
-
-fails.
-<P>
-
-A subnet specification is of the form <I>network</I><B>/</B><I>mask</I>.
-The
-<I>network</I>
-
-and
-<I>mask</I>
-
-can be any form acceptable to
-<I>ttoaddr</I>.
-
-In addition, and preferably, the
-<I>mask</I>
-
-can be a decimal integer (leading zeros ignored) giving a bit count,
-in which case
-it stands for a mask with that number of high bits on and all others off
-(e.g.,
-<B>24</B>
-
-in IPv4 means
-<B>255.255.255.0</B>).
-
-In any case, the mask must be contiguous
-(a sequence of high bits on and all remaining low bits off).
-As a special case, the subnet specification
-<B>%default</B>
-
-is a synonym for
-<B>0.0.0.0/0</B>
-
-or
-<B>::/0</B>
-
-in IPv4 or IPv6 respectively.
-<P>
-
-<I>Ttosubnet</I>
-
-ANDs the mask with the address before returning,
-so that any non-network bits in the address are turned off
-(e.g.,
-<B>10.1.2.3/24</B>
-
-is synonymous with
-<B>10.1.2.0/24</B>).
-
-<I>Subnettot</I>
-
-always generates the decimal-integer-bit-count
-form of the mask,
-with no leading zeros.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>ttoaddr</I>
-
-and
-<I>ttosubnet</I>
-
-specifies the length of the text string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>af</I>
-
-parameter of
-<I>ttoaddr</I>
-
-and
-<I>ttosubnet</I>
-
-specifies the address family of interest.
-It should be either
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines constants,
-<B>ADDRTOT_BUF</B>
-
-and
-<B>SUBNETTOT_BUF</B>,
-
-which are the sizes of buffers just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default,
-and is in fact the only format currently available in
-<I>subnettot</I>.
-
-<I>Addrtot</I>
-
-also accepts format values
-<B>'r'</B>
-
-(signifying a text form suitable for DNS reverse lookups,
-e.g.
-<B>4.3.2.1.IN-ADDR.ARPA.</B>
-
-for IPv4 and
-RFC 2874 format for IPv6),
-and
-<B>'R'</B>
-
-(signifying an alternate reverse-lookup form,
-an error for IPv4 and RFC 1886 format for IPv6).
-Reverse-lookup names always end with a ``.''.
-<P>
-
-The text-to-binary functions return NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-The binary-to-text functions return
-<B>0</B>
-
-for a failure, and otherwise
-always return the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>ttoaddr</I>
-
-are:
-empty input;
-unknown address family;
-attempt to allocate temporary storage for a very long name failed;
-name lookup failed;
-syntax error in dotted-decimal or colon-hex form;
-dotted-decimal or colon-hex component too large.
-<P>
-
-Fatal errors in
-<I>ttosubnet</I>
-
-are:
-no
-<B>/</B>
-
-in
-<I>src</I>;
-
-<I>ttoaddr</I>
-
-error in conversion of
-<I>network</I>
-
-or
-<I>mask</I>;
-
-bit-count mask too big;
-mask non-contiguous.
-<P>
-
-Fatal errors in
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-are:
-unknown format.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The interpretation of incomplete dotted-decimal addresses
-(e.g.
-<B>10/24</B>
-
-means
-<B>10.0.0.0/24</B>)
-
-differs from that of some older conversion
-functions, e.g. those of
-<I><A HREF="inet.3.html">inet</A></I>(3).
-
-The behavior of the older functions has never been
-particularly consistent or particularly useful.
-<P>
-
-Ignoring leading zeros in dotted-decimal components and bit counts
-is arguably the most useful behavior in this application,
-but it might occasionally cause confusion with the historical use of leading 
-zeros to denote octal numbers.
-<P>
-
-<I>Ttoaddr</I>
-
-does not support the mixed colon-hex-dotted-decimal
-convention used to embed an IPv4 address in an IPv6 address.
-<P>
-
-<I>Addrtot</I>
-
-always uses the
-<B>::</B>
-
-abbreviation (which can appear only once in an address) for the
-<I>first</I>
-
-sequence of multiple zeros in an IPv6 address.
-One can construct addresses (unlikely ones) in which this is suboptimal.
-<P>
-
-<I>Addrtot</I>
-
-<B>'r'</B>
-
-conversion of an IPv6 address uses lowercase hexadecimal,
-not the uppercase used in RFC 2874's examples.
-It takes careful reading of RFCs 2874, 2673, and 2234 to realize
-that lowercase is technically legitimate here,
-and there may be software which botches this
-and hence would have trouble with lowercase hex.
-<P>
-
-Possibly
-<I>subnettot</I>
-
-ought to recognize the
-<B>%default</B>
-
-case and generate that string as its output.
-Currently it doesn't.
-<P>
-
-It is barely possible that somebody, somewhere,
-might have a legitimate use for non-contiguous subnet masks.
-<P>
-
-<I><A HREF="Getnetbyname.3.html">Getnetbyname</A></I>(3)
-
-is a historical dreg.
-<P>
-
-<I>Tnatoaddr</I>
-
-probably should enforce completeness of dotted-decimal addresses.
-<P>
-
-The restriction of text-to-binary error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The text-to-binary error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = ttoaddr( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_subnettypeof.3.html b/doc/manpage.d/ipsec_subnettypeof.3.html
deleted file mode 100644
index ea0f83f82..000000000
--- a/doc/manpage.d/ipsec_subnettypeof.3.html
+++ /dev/null
@@ -1,238 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_INITSUBNET</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_INITSUBNET</H1>
-Section: C Library Functions (3)<BR>Updated: 12 March 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec initsubnet - initialize an ip_subnet
-<BR>
-
-ipsec addrtosubnet - initialize a singleton ip_subnet
-<BR>
-
-ipsec subnettypeof - get address type of an ip_subnet
-<BR>
-
-ipsec masktocount - convert subnet mask to bit count
-<BR>
-
-ipsec networkof - get base address of an ip_subnet
-<BR>
-
-ipsec maskof - get subnet mask of an ip_subnet
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *initsubnet(const ip_address *addr,</B>
-
-<BR>
-&nbsp;
-<B>int maskbits, int clash, ip_subnet *dst);</B>
-
-<BR>
-
-<B>const char *addrtosubnet(const ip_address *addr,</B>
-
-<BR>
-&nbsp;
-<B>ip_subnet *dst);</B>
-
-<P>
-<B>int subnettypeof(const ip_subnet *src);</B>
-
-<BR>
-
-<B>int masktocount(const ip_address *src);</B>
-
-<BR>
-
-<B>void networkof(const ip_subnet *src, ip_address *dst);</B>
-
-<BR>
-
-<B>void maskof(const ip_subnet *src, ip_address *dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-library uses an internal type
-<I>ip_subnet</I>
-
-to contain a description of an IP subnet
-(base address plus mask).
-These functions provide basic tools for creating and examining this type.
-<P>
-
-<I>Initsubnet</I>
-
-initializes a variable
-<I>*dst</I>
-
-of type
-<I>ip_subnet</I>
-
-from a base address and
-a count of mask bits.
-The
-<I>clash</I>
-
-parameter specifies what to do if the base address includes
-<B>1</B>
-
-bits outside the prefix specified by the mask
-(that is, in the ``host number'' part of the address):
-<DL COMPACT><DT><DD>
-<DL COMPACT>
-<DT>'0'<DD>
-zero out host-number bits
-<DT>'x'<DD>
-non-zero host-number bits are an error
-</DL>
-</DL>
-
-<P>
-
-<I>Initsubnet</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<P>
-
-<I>Addrtosubnet</I>
-
-initializes an
-<I>ip_subnet</I>
-
-variable
-<I>*dst</I>
-
-to a ``singleton subnet'' containing the single address
-<I>*addr</I>.
-
-It returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure.
-<P>
-
-<I>Subnettypeof</I>
-
-returns the address type of a subnet,
-normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-(The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file arranges to include the necessary headers for these
-names to be known.)
-<P>
-
-<I>Masktocount</I>
-
-converts a subnet mask, expressed as an address, to a bit count
-suitable for use with
-<I>initsubnet</I>.
-
-It returns
-<B>-1</B>
-
-for error; see DIAGNOSTICS.
-<P>
-
-<I>Networkof</I>
-
-fills in
-<I>*dst</I>
-
-with the base address of subnet
-<I>src</I>.
-
-<P>
-
-<I>Maskof</I>
-
-fills in
-<I>*dst</I>
-
-with the subnet mask of subnet
-<I>src</I>,
-
-expressed as an address.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_ttosubnet.3.html">ipsec_ttosubnet</A>(3), <A HREF="ipsec_rangetosubnet.3.html">ipsec_rangetosubnet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>initsubnet</I>
-
-are:
-unknown address family;
-unknown
-<I>clash</I>
-
-value;
-impossible mask bit count;
-non-zero host-number bits and
-<I>clash</I>
-
-is
-<B>'x'</B>.
-
-Fatal errors in
-<I>addrtosubnet</I>
-
-are:
-unknown address family.
-Fatal errors in
-<I>masktocount</I>
-
-are:
-unknown address family;
-mask bits not contiguous.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_tnatoaddr.3.html b/doc/manpage.d/ipsec_tnatoaddr.3.html
deleted file mode 100644
index 199937a35..000000000
--- a/doc/manpage.d/ipsec_tnatoaddr.3.html
+++ /dev/null
@@ -1,569 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TTOADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TTOADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 28 Sept 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ttoaddr, tnatoaddr, addrtot - convert Internet addresses to and from text
-<BR>
-
-ipsec ttosubnet, subnettot - convert subnet/mask text form to and from addresses
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *ttoaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *addr);</B>
-
-<BR>
-
-<B>const char *tnatoaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *addr);</B>
-
-<BR>
-
-<B>size_t addrtot(const ip_address *addr, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<P>
-<B>const char *ttosubnet(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_subnet *dst);</B>
-
-<BR>
-
-<B>size_t subnettot(const ip_subnet *sub, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ttoaddr</I>
-
-converts a text-string name or numeric address into a binary address
-(in network byte order).
-<I>Tnatoaddr</I>
-
-does the same conversion,
-but the only text forms it accepts are
-the ``official'' forms of
-numeric address (dotted-decimal for IPv4, colon-hex for IPv6).
-<I>Addrtot</I>
-
-does the reverse conversion, from binary address back to a text form.
-<I>Ttosubnet</I>
-
-and
-<I>subnettot</I>
-
-do likewise for the ``address/mask'' form used to write a
-specification of a subnet.
-<P>
-
-An IPv4 address is specified in text as a
-dotted-decimal address (e.g.
-<B>1.2.3.4</B>),
-
-an eight-digit network-order hexadecimal number with the usual C prefix (e.g.
-<B>0x01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>),
-
-an eight-digit host-order hexadecimal number with a
-<B>0h</B>
-
-prefix (e.g.
-<B>0h01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>
-
-on a big-endian host and
-<B>4.3.2.1</B>
-
-on a little-endian host),
-a DNS name to be looked up via
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3),
-
-or an old-style network name to be looked up via
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3).
-
-<P>
-
-A dotted-decimal address may be incomplete, in which case
-text-to-binary conversion implicitly appends
-as many instances of
-<B>.0</B>
-
-as necessary to bring it up to four components.
-The components of a dotted-decimal address are always taken as
-decimal, and leading zeros are ignored.
-For example,
-<B>10</B>
-
-is synonymous with
-<B>10.0.0.0</B>,
-
-and
-<B>128.009.000.032</B>
-
-is synonymous with
-<B>128.9.0.32</B>
-
-(the latter example is verbatim from RFC 1166).
-The result of applying
-<I>addrtot</I>
-
-to an IPv4 address is always complete and does not contain leading zeros.
-<P>
-
-Use of hexadecimal addresses is
-<B>strongly</B>
-
-<B>discouraged</B>;
-
-they are included only to save hassles when dealing with
-the handful of perverted programs which already print 
-network addresses in hexadecimal.
-<P>
-
-An IPv6 address is specified in text with
-colon-hex notation (e.g.
-<B>0:56:78ab:22:33:44:55:66</B>),
-
-colon-hex with
-<B>::</B>
-
-abbreviating at most one subsequence of multiple zeros (e.g.
-<B>99:ab::54:068</B>,
-
-which is synonymous with
-<B>99:ab:0:0:0:0:54:68</B>),
-
-or a DNS name to be looked up via
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3).
-
-The result of applying
-<I>addrtot</I>
-
-to an IPv6 address will use
-<B>::</B>
-
-abbreviation if possible,
-and will not contain leading zeros.
-<P>
-
-The letters in hexadecimal
-may be uppercase or lowercase or any mixture thereof.
-<P>
-
-DNS names may be complete (optionally terminated with a ``.'')
-or incomplete, and are looked up as specified by local system configuration
-(see
-<I><A HREF="resolver.5.html">resolver</A></I>(5)).
-
-The
-<I>h_addr</I>
-
-value returned by
-<I><A HREF="gethostbyname2.3.html">gethostbyname2</A></I>(3)
-
-is used,
-so with current DNS implementations,
-the result when the name corresponds to more than one address is
-difficult to predict.
-IPv4 name lookup resorts to
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3)
-
-only if
-<I><A HREF="gethostbyname2.3.html">gethostbyname2</A></I>(3)
-
-fails.
-<P>
-
-A subnet specification is of the form <I>network</I><B>/</B><I>mask</I>.
-The
-<I>network</I>
-
-and
-<I>mask</I>
-
-can be any form acceptable to
-<I>ttoaddr</I>.
-
-In addition, and preferably, the
-<I>mask</I>
-
-can be a decimal integer (leading zeros ignored) giving a bit count,
-in which case
-it stands for a mask with that number of high bits on and all others off
-(e.g.,
-<B>24</B>
-
-in IPv4 means
-<B>255.255.255.0</B>).
-
-In any case, the mask must be contiguous
-(a sequence of high bits on and all remaining low bits off).
-As a special case, the subnet specification
-<B>%default</B>
-
-is a synonym for
-<B>0.0.0.0/0</B>
-
-or
-<B>::/0</B>
-
-in IPv4 or IPv6 respectively.
-<P>
-
-<I>Ttosubnet</I>
-
-ANDs the mask with the address before returning,
-so that any non-network bits in the address are turned off
-(e.g.,
-<B>10.1.2.3/24</B>
-
-is synonymous with
-<B>10.1.2.0/24</B>).
-
-<I>Subnettot</I>
-
-always generates the decimal-integer-bit-count
-form of the mask,
-with no leading zeros.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>ttoaddr</I>
-
-and
-<I>ttosubnet</I>
-
-specifies the length of the text string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>af</I>
-
-parameter of
-<I>ttoaddr</I>
-
-and
-<I>ttosubnet</I>
-
-specifies the address family of interest.
-It should be either
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines constants,
-<B>ADDRTOT_BUF</B>
-
-and
-<B>SUBNETTOT_BUF</B>,
-
-which are the sizes of buffers just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default,
-and is in fact the only format currently available in
-<I>subnettot</I>.
-
-<I>Addrtot</I>
-
-also accepts format values
-<B>'r'</B>
-
-(signifying a text form suitable for DNS reverse lookups,
-e.g.
-<B>4.3.2.1.IN-ADDR.ARPA.</B>
-
-for IPv4 and
-RFC 2874 format for IPv6),
-and
-<B>'R'</B>
-
-(signifying an alternate reverse-lookup form,
-an error for IPv4 and RFC 1886 format for IPv6).
-Reverse-lookup names always end with a ``.''.
-<P>
-
-The text-to-binary functions return NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-The binary-to-text functions return
-<B>0</B>
-
-for a failure, and otherwise
-always return the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>ttoaddr</I>
-
-are:
-empty input;
-unknown address family;
-attempt to allocate temporary storage for a very long name failed;
-name lookup failed;
-syntax error in dotted-decimal or colon-hex form;
-dotted-decimal or colon-hex component too large.
-<P>
-
-Fatal errors in
-<I>ttosubnet</I>
-
-are:
-no
-<B>/</B>
-
-in
-<I>src</I>;
-
-<I>ttoaddr</I>
-
-error in conversion of
-<I>network</I>
-
-or
-<I>mask</I>;
-
-bit-count mask too big;
-mask non-contiguous.
-<P>
-
-Fatal errors in
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-are:
-unknown format.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The interpretation of incomplete dotted-decimal addresses
-(e.g.
-<B>10/24</B>
-
-means
-<B>10.0.0.0/24</B>)
-
-differs from that of some older conversion
-functions, e.g. those of
-<I><A HREF="inet.3.html">inet</A></I>(3).
-
-The behavior of the older functions has never been
-particularly consistent or particularly useful.
-<P>
-
-Ignoring leading zeros in dotted-decimal components and bit counts
-is arguably the most useful behavior in this application,
-but it might occasionally cause confusion with the historical use of leading 
-zeros to denote octal numbers.
-<P>
-
-<I>Ttoaddr</I>
-
-does not support the mixed colon-hex-dotted-decimal
-convention used to embed an IPv4 address in an IPv6 address.
-<P>
-
-<I>Addrtot</I>
-
-always uses the
-<B>::</B>
-
-abbreviation (which can appear only once in an address) for the
-<I>first</I>
-
-sequence of multiple zeros in an IPv6 address.
-One can construct addresses (unlikely ones) in which this is suboptimal.
-<P>
-
-<I>Addrtot</I>
-
-<B>'r'</B>
-
-conversion of an IPv6 address uses lowercase hexadecimal,
-not the uppercase used in RFC 2874's examples.
-It takes careful reading of RFCs 2874, 2673, and 2234 to realize
-that lowercase is technically legitimate here,
-and there may be software which botches this
-and hence would have trouble with lowercase hex.
-<P>
-
-Possibly
-<I>subnettot</I>
-
-ought to recognize the
-<B>%default</B>
-
-case and generate that string as its output.
-Currently it doesn't.
-<P>
-
-It is barely possible that somebody, somewhere,
-might have a legitimate use for non-contiguous subnet masks.
-<P>
-
-<I><A HREF="Getnetbyname.3.html">Getnetbyname</A></I>(3)
-
-is a historical dreg.
-<P>
-
-<I>Tnatoaddr</I>
-
-probably should enforce completeness of dotted-decimal addresses.
-<P>
-
-The restriction of text-to-binary error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The text-to-binary error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = ttoaddr( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_tncfg.5.html b/doc/manpage.d/ipsec_tncfg.5.html
deleted file mode 100644
index e4082a28f..000000000
--- a/doc/manpage.d/ipsec_tncfg.5.html
+++ /dev/null
@@ -1,175 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TNCFG</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TNCFG</H1>
-Section: File Formats (5)<BR>Updated: 27 Jun 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec_tncfg - lists IPSEC virtual interfaces attached to real interfaces
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>tncfg</B>
-
-<P>
-
-<B>cat</B>
-
-<B>/proc/net/ipsec_tncfg</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>/proc/net/ipsec_tncfg</I>
-
-is a read-only file which lists which IPSEC virtual interfaces are
-attached to which real interfaces, through which packets will be
-forwarded once processed by IPSEC.
-<P>
-
-Each line lists one ipsec I/F.
-A table entry consists of:
-<DL COMPACT>
-<DT>+<DD>
-an ipsec virtual I/F name
-<DT>+<DD>
-a visual and machine parsable separator '-&gt;', separating the virtual I/F
-and the physical I/F,
-<DT>+<DD>
-a physical I/F name, to which the ipsec virtual I/F is attached or NULL
-if it is not attached,
-<DT>+<DD>
-the keyword
-<B>mtu=</B>,
-
-<DT>+<DD>
-the MTU of the ipsec virtual I/F,
-<DT>+<DD>
-the automatically adjusted effective MTU for PMTU discovery, in brackets,
-<DT>+<DD>
-a visual and machine parsable separator '-&gt;', separating the virtual I/F
-MTU and the physical I/F MTU,
-<DT>+<DD>
-the MTU of the attached physical I/F.
-<B>.SH</B>EXAMPLES
-
-<DT><B>ipsec2 -&gt; eth3 mtu=16260(1443) -&gt; 1500</B>
-
-<DD>
-</DL>
-<P>
-
-shows that virtual device
-<B>ipsec2</B>
-
-with an MTU of
-<B>16260</B>
-
-is connected to physical device
-<B>eth3</B>
-
-with an MTU of
-<B>1500</B>
-
-and that the effective MTU as a result of PMTU discovery has been
-automatically set to
-<B>1443.</B>
-
-<DL COMPACT>
-<DT><B>ipsec0 -&gt; wvlan0 mtu=1400(16260) -&gt; 1500</B>
-
-<DD>
-</DL>
-<P>
-
-shows that virtual device
-<B>ipsec0</B>
-
-with an MTU of
-<B>1400</B>
-
-is connected to physical device
-<B>wvlan0</B>
-
-with an MTU of
-<B>1500</B>
-
-and no PMTU packets have gotten far enough to bump down the effective MTU
-from its default of 16260.
-<DL COMPACT>
-<DT><B>ipsec3 -&gt; NULL mtu=0(0) -&gt; 0</B>
-
-<DD>
-</DL>
-<P>
-
-shows that virtual device
-<B>ipsec3</B>
-
-is not connected to any physical device.
-<P>
-
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/ipsec_tncfg, /usr/local/bin/ipsec
-<A NAME="lbAF">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_eroute.5.html">ipsec_eroute</A>(5), <A HREF="ipsec_spi.5.html">ipsec_spi</A>(5),
-<A HREF="ipsec_spigrp.5.html">ipsec_spigrp</A>(5), <A HREF="ipsec_klipsdebug.5.html">ipsec_klipsdebug</A>(5), <A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A>(8), <A HREF="ipsec_version.5.html">ipsec_version</A>(5),
-<A HREF="ipsec_pf_key.5.html">ipsec_pf_key</A>(5)
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Richard Guy Briggs.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">SEE ALSO</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_tncfg.8.html b/doc/manpage.d/ipsec_tncfg.8.html
deleted file mode 100644
index e5965267c..000000000
--- a/doc/manpage.d/ipsec_tncfg.8.html
+++ /dev/null
@@ -1,195 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TNCFG</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TNCFG</H1>
-Section: Maintenance Commands (8)<BR>Updated: 21 Jun 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec tncfg - associate IPSEC virtual interface with physical interface
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>tncfg</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>tncfg</B>
-
-<B>--attach</B>
-
-<B>--virtual</B>
-
-virtual
-<B>--physical</B>
-
-physical
-<P>
-
-<B>ipsec</B>
-
-<B>tncfg</B>
-
-<B>--detach</B>
-
-<B>--virtual</B>
-
-virtual
-<P>
-
-<B>ipsec</B>
-
-<B>tncfg</B>
-
-<B>--clear</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>tncfg</B>
-
-<B>--version</B>
-
-<P>
-
-<B>ipsec</B>
-
-<B>tncfg</B>
-
-<B>--help</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Tncfg</I>
-
-attaches/detaches IPSEC virtual interfaces to/from
-physical interfaces,
-through which packets will be forwarded once processed by IPSEC.
-<P>
-
-The form with no additional arguments lists the contents of
-/proc/net/ipsec_tncfg.  The format of /proc/net/ipsec_tncfg is discussed
-in <A HREF="ipsec_tncfg.5.html">ipsec_tncfg</A>(5).
-The
-<B>--attach</B>
-
-form attaches the
-<I>virtual</I>
-
-interface to the
-<I>physical</I>
-
-one.
-The
-<B>--detach</B>
-
-form detaches the
-<I>virtual</I>
-
-interface from whichever physical interface it is attached to.
-The
-<B>--clear</B>
-
-form clears all the
-<I>virtual</I>
-
-interfaces from whichever physical interfaces they were attached to.
-<P>
-
-Virtual interfaces typically have names like
-<B>ipsec0</B>,
-
-while physical interfaces typically have names like
-<B>eth0</B>
-
-or
-<B>ppp0</B>.
-
-<A NAME="lbAE">&nbsp;</A>
-<H2>EXAMPLES</H2>
-
-<DL COMPACT>
-<DT><B>ipsec tncfg --attach --virtual ipsec0 --physical eth0</B>
-
-<DD>
-attaches the
-<B>ipsec0</B>
-
-virtual device to the
-<B>eth0</B>
-
-physical device.
-</DL>
-<P>
-
-<A NAME="lbAF">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/ipsec_tncfg, /usr/local/bin/ipsec
-<A NAME="lbAG">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_eroute.8.html">ipsec_eroute</A>(8), <A HREF="ipsec_spi.8.html">ipsec_spi</A>(8),
-<A HREF="ipsec_spigrp.8.html">ipsec_spigrp</A>(8), <A HREF="ipsec_klipsdebug.8.html">ipsec_klipsdebug</A>(8), <A HREF="ipsec_tncfg.5.html">ipsec_tncfg</A>(5)
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Richard Guy Briggs.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">EXAMPLES</A><DD>
-<DT><A HREF="#lbAF">FILES</A><DD>
-<DT><A HREF="#lbAG">SEE ALSO</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_trap_count.5.html b/doc/manpage.d/ipsec_trap_count.5.html
deleted file mode 100644
index 8da655f77..000000000
--- a/doc/manpage.d/ipsec_trap_count.5.html
+++ /dev/null
@@ -1,74 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TRAP_COUNT</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TRAP_COUNT</H1>
-Section: File Formats (5)<BR>Updated: 19 Jun 2003<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-trap_count - KLIPS statistic on number of ACQUIREs
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>cat</B>
-
-<B>/proc/net/ipsec/stats/trap_count</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>/proc/net/ipsec/stats/trap_count</I>
-
-is a read-only file. It contains a hexadecimal number which records the
-number of attempts to send PF_ACQUIRE messages. Only those recorded by
-trap_sendcount were actually successfully passed to userland. Note that the
-userland may still have lost them on its own.
-<P>
-
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/ipsec/stats/trap_sendcount
-<A NAME="lbAF">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_pf_key.5.html">ipsec_pf_key</A>(5), <A HREF="trap_sendcount.5.html">trap_sendcount</A>(5), <A HREF="pluto.8.html">pluto</A>(8)
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael C. Richardson &lt;<A HREF="mailto:mcr@freeswan.org">mcr@freeswan.org</A>&gt;
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">SEE ALSO</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_trap_sendcount.5.html b/doc/manpage.d/ipsec_trap_sendcount.5.html
deleted file mode 100644
index 94f56b3a7..000000000
--- a/doc/manpage.d/ipsec_trap_sendcount.5.html
+++ /dev/null
@@ -1,72 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TRAP_SENDCOUNT</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TRAP_SENDCOUNT</H1>
-Section: File Formats (5)<BR>Updated: 19 Jun 2003<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-trap_sendcount - KLIPS statistic on number of successful ACQUIREs
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>cat</B>
-
-<B>/proc/net/ipsec/stats/trap_sendcount</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>/proc/net/ipsec/stats/trap_sendcount</I>
-
-is a read-only file. It contains a hexadecimal number which records the
-number of successful PF_ACQUIRE messages that were sent.
-<P>
-
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/ipsec/stats/trap_sendcount
-<A NAME="lbAF">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_pf_key.5.html">ipsec_pf_key</A>(5), <A HREF="trap_count.5.html">trap_count</A>(5), <A HREF="pluto.8.html">pluto</A>(8)
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Michael C. Richardson &lt;<A HREF="mailto:mcr@freeswan.org">mcr@freeswan.org</A>&gt;
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">SEE ALSO</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_ttoaddr.3.html b/doc/manpage.d/ipsec_ttoaddr.3.html
deleted file mode 100644
index 199937a35..000000000
--- a/doc/manpage.d/ipsec_ttoaddr.3.html
+++ /dev/null
@@ -1,569 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TTOADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TTOADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 28 Sept 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ttoaddr, tnatoaddr, addrtot - convert Internet addresses to and from text
-<BR>
-
-ipsec ttosubnet, subnettot - convert subnet/mask text form to and from addresses
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *ttoaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *addr);</B>
-
-<BR>
-
-<B>const char *tnatoaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *addr);</B>
-
-<BR>
-
-<B>size_t addrtot(const ip_address *addr, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<P>
-<B>const char *ttosubnet(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_subnet *dst);</B>
-
-<BR>
-
-<B>size_t subnettot(const ip_subnet *sub, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ttoaddr</I>
-
-converts a text-string name or numeric address into a binary address
-(in network byte order).
-<I>Tnatoaddr</I>
-
-does the same conversion,
-but the only text forms it accepts are
-the ``official'' forms of
-numeric address (dotted-decimal for IPv4, colon-hex for IPv6).
-<I>Addrtot</I>
-
-does the reverse conversion, from binary address back to a text form.
-<I>Ttosubnet</I>
-
-and
-<I>subnettot</I>
-
-do likewise for the ``address/mask'' form used to write a
-specification of a subnet.
-<P>
-
-An IPv4 address is specified in text as a
-dotted-decimal address (e.g.
-<B>1.2.3.4</B>),
-
-an eight-digit network-order hexadecimal number with the usual C prefix (e.g.
-<B>0x01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>),
-
-an eight-digit host-order hexadecimal number with a
-<B>0h</B>
-
-prefix (e.g.
-<B>0h01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>
-
-on a big-endian host and
-<B>4.3.2.1</B>
-
-on a little-endian host),
-a DNS name to be looked up via
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3),
-
-or an old-style network name to be looked up via
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3).
-
-<P>
-
-A dotted-decimal address may be incomplete, in which case
-text-to-binary conversion implicitly appends
-as many instances of
-<B>.0</B>
-
-as necessary to bring it up to four components.
-The components of a dotted-decimal address are always taken as
-decimal, and leading zeros are ignored.
-For example,
-<B>10</B>
-
-is synonymous with
-<B>10.0.0.0</B>,
-
-and
-<B>128.009.000.032</B>
-
-is synonymous with
-<B>128.9.0.32</B>
-
-(the latter example is verbatim from RFC 1166).
-The result of applying
-<I>addrtot</I>
-
-to an IPv4 address is always complete and does not contain leading zeros.
-<P>
-
-Use of hexadecimal addresses is
-<B>strongly</B>
-
-<B>discouraged</B>;
-
-they are included only to save hassles when dealing with
-the handful of perverted programs which already print 
-network addresses in hexadecimal.
-<P>
-
-An IPv6 address is specified in text with
-colon-hex notation (e.g.
-<B>0:56:78ab:22:33:44:55:66</B>),
-
-colon-hex with
-<B>::</B>
-
-abbreviating at most one subsequence of multiple zeros (e.g.
-<B>99:ab::54:068</B>,
-
-which is synonymous with
-<B>99:ab:0:0:0:0:54:68</B>),
-
-or a DNS name to be looked up via
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3).
-
-The result of applying
-<I>addrtot</I>
-
-to an IPv6 address will use
-<B>::</B>
-
-abbreviation if possible,
-and will not contain leading zeros.
-<P>
-
-The letters in hexadecimal
-may be uppercase or lowercase or any mixture thereof.
-<P>
-
-DNS names may be complete (optionally terminated with a ``.'')
-or incomplete, and are looked up as specified by local system configuration
-(see
-<I><A HREF="resolver.5.html">resolver</A></I>(5)).
-
-The
-<I>h_addr</I>
-
-value returned by
-<I><A HREF="gethostbyname2.3.html">gethostbyname2</A></I>(3)
-
-is used,
-so with current DNS implementations,
-the result when the name corresponds to more than one address is
-difficult to predict.
-IPv4 name lookup resorts to
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3)
-
-only if
-<I><A HREF="gethostbyname2.3.html">gethostbyname2</A></I>(3)
-
-fails.
-<P>
-
-A subnet specification is of the form <I>network</I><B>/</B><I>mask</I>.
-The
-<I>network</I>
-
-and
-<I>mask</I>
-
-can be any form acceptable to
-<I>ttoaddr</I>.
-
-In addition, and preferably, the
-<I>mask</I>
-
-can be a decimal integer (leading zeros ignored) giving a bit count,
-in which case
-it stands for a mask with that number of high bits on and all others off
-(e.g.,
-<B>24</B>
-
-in IPv4 means
-<B>255.255.255.0</B>).
-
-In any case, the mask must be contiguous
-(a sequence of high bits on and all remaining low bits off).
-As a special case, the subnet specification
-<B>%default</B>
-
-is a synonym for
-<B>0.0.0.0/0</B>
-
-or
-<B>::/0</B>
-
-in IPv4 or IPv6 respectively.
-<P>
-
-<I>Ttosubnet</I>
-
-ANDs the mask with the address before returning,
-so that any non-network bits in the address are turned off
-(e.g.,
-<B>10.1.2.3/24</B>
-
-is synonymous with
-<B>10.1.2.0/24</B>).
-
-<I>Subnettot</I>
-
-always generates the decimal-integer-bit-count
-form of the mask,
-with no leading zeros.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>ttoaddr</I>
-
-and
-<I>ttosubnet</I>
-
-specifies the length of the text string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>af</I>
-
-parameter of
-<I>ttoaddr</I>
-
-and
-<I>ttosubnet</I>
-
-specifies the address family of interest.
-It should be either
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines constants,
-<B>ADDRTOT_BUF</B>
-
-and
-<B>SUBNETTOT_BUF</B>,
-
-which are the sizes of buffers just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default,
-and is in fact the only format currently available in
-<I>subnettot</I>.
-
-<I>Addrtot</I>
-
-also accepts format values
-<B>'r'</B>
-
-(signifying a text form suitable for DNS reverse lookups,
-e.g.
-<B>4.3.2.1.IN-ADDR.ARPA.</B>
-
-for IPv4 and
-RFC 2874 format for IPv6),
-and
-<B>'R'</B>
-
-(signifying an alternate reverse-lookup form,
-an error for IPv4 and RFC 1886 format for IPv6).
-Reverse-lookup names always end with a ``.''.
-<P>
-
-The text-to-binary functions return NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-The binary-to-text functions return
-<B>0</B>
-
-for a failure, and otherwise
-always return the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>ttoaddr</I>
-
-are:
-empty input;
-unknown address family;
-attempt to allocate temporary storage for a very long name failed;
-name lookup failed;
-syntax error in dotted-decimal or colon-hex form;
-dotted-decimal or colon-hex component too large.
-<P>
-
-Fatal errors in
-<I>ttosubnet</I>
-
-are:
-no
-<B>/</B>
-
-in
-<I>src</I>;
-
-<I>ttoaddr</I>
-
-error in conversion of
-<I>network</I>
-
-or
-<I>mask</I>;
-
-bit-count mask too big;
-mask non-contiguous.
-<P>
-
-Fatal errors in
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-are:
-unknown format.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The interpretation of incomplete dotted-decimal addresses
-(e.g.
-<B>10/24</B>
-
-means
-<B>10.0.0.0/24</B>)
-
-differs from that of some older conversion
-functions, e.g. those of
-<I><A HREF="inet.3.html">inet</A></I>(3).
-
-The behavior of the older functions has never been
-particularly consistent or particularly useful.
-<P>
-
-Ignoring leading zeros in dotted-decimal components and bit counts
-is arguably the most useful behavior in this application,
-but it might occasionally cause confusion with the historical use of leading 
-zeros to denote octal numbers.
-<P>
-
-<I>Ttoaddr</I>
-
-does not support the mixed colon-hex-dotted-decimal
-convention used to embed an IPv4 address in an IPv6 address.
-<P>
-
-<I>Addrtot</I>
-
-always uses the
-<B>::</B>
-
-abbreviation (which can appear only once in an address) for the
-<I>first</I>
-
-sequence of multiple zeros in an IPv6 address.
-One can construct addresses (unlikely ones) in which this is suboptimal.
-<P>
-
-<I>Addrtot</I>
-
-<B>'r'</B>
-
-conversion of an IPv6 address uses lowercase hexadecimal,
-not the uppercase used in RFC 2874's examples.
-It takes careful reading of RFCs 2874, 2673, and 2234 to realize
-that lowercase is technically legitimate here,
-and there may be software which botches this
-and hence would have trouble with lowercase hex.
-<P>
-
-Possibly
-<I>subnettot</I>
-
-ought to recognize the
-<B>%default</B>
-
-case and generate that string as its output.
-Currently it doesn't.
-<P>
-
-It is barely possible that somebody, somewhere,
-might have a legitimate use for non-contiguous subnet masks.
-<P>
-
-<I><A HREF="Getnetbyname.3.html">Getnetbyname</A></I>(3)
-
-is a historical dreg.
-<P>
-
-<I>Tnatoaddr</I>
-
-probably should enforce completeness of dotted-decimal addresses.
-<P>
-
-The restriction of text-to-binary error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The text-to-binary error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = ttoaddr( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_ttodata.3.html b/doc/manpage.d/ipsec_ttodata.3.html
deleted file mode 100644
index 960392fe0..000000000
--- a/doc/manpage.d/ipsec_ttodata.3.html
+++ /dev/null
@@ -1,439 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TTODATA</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TTODATA</H1>
-Section: C Library Functions (3)<BR>Updated: 16 August 2003<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ttodata, datatot - convert binary data bytes from and to text formats
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *ttodata(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int base, char *dst, size_t dstlen, size_t *lenp);</B>
-
-<BR>
-
-<B>const char *ttodatav(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int base, char *dst, size_t dstlen, size_t *lenp,</B>
-
-<BR>
-&nbsp;
-<B>char *errp, size_t errlen, int flags);</B>
-
-<BR>
-
-<B>size_t datatot(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int format, char *dst, size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ttodata</I>,
-
-<I>ttodatav</I>,
-
-and
-<I>datatot</I>
-
-convert arbitrary binary data (e.g. encryption or authentication keys)
-from and to more-or-less human-readable text formats.
-<P>
-
-Currently supported formats are hexadecimal, base64, and characters.
-<P>
-
-A hexadecimal text value begins with a
-<B>0x</B>
-
-(or
-<B>0X</B>)
-
-prefix and continues with two-digit groups
-of hexadecimal digits (0-9, and a-f or A-F),
-each group encoding the value of one binary byte, high-order digit first.
-A single
-<B>_</B>
-
-(underscore)
-between consecutive groups is ignored, permitting punctuation to improve 
-readability; doing this every eight digits seems about right.
-<P>
-
-A base64 text value begins with a
-<B>0s</B>
-
-(or
-<B>0S</B>)
-
-prefix 
-and continues with four-digit groups of base64 digits (A-Z, a-z, 0-9, +, and /),
-each group encoding the value of three binary bytes as described in
-section 6.8 of RFC 2045.
-If
-<B>flags</B>
-
-has the
-<B>TTODATAV_IGNORESPACE</B>
-
-bit on, blanks are ignore (after the prefix).
-Note that the last one or two digits of a base64 group can be
-<B>=</B>
-
-to indicate that fewer than three binary bytes are encoded.
-<P>
-
-A character text value begins with a
-<B>0t</B>
-
-(or
-<B>0T</B>)
-
-prefix
-and continues with text characters, each being the value of one binary byte. 
-<P>
-
-All these functions basically copy data from
-<I>src</I>
-
-(whose size is specified by
-<I>srclen</I>)
-
-to
-<I>dst</I>
-
-(whose size is specified by
-<I>dstlen</I>),
-
-doing the conversion en route.
-If the result will not fit in
-<I>dst</I>,
-
-it is truncated;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes of result written to
-<I>dst</I>.
-
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result bytes are written at all.
-<P>
-
-The
-<I>base</I>
-
-parameter of
-<I>ttodata</I>
-
-and
-<I>ttodatav</I>
-
-specifies what format the input is in;
-normally it should be
-<B>0</B>
-
-to signify that this gets figured out from the prefix.
-Values of
-<B>16</B>,
-
-<B>64</B>,
-
-and
-<B>256</B>
-
-respectively signify hexadecimal, base64, and character-text formats
-without prefixes.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>datatot</I>,
-
-a single character used as a type code,
-specifies which text format is wanted.
-The value
-<B>0</B>
-
-(not ASCII
-<B>'0'</B>,
-
-but a zero value) specifies a reasonable default.
-Other currently-supported values are:
-<DL COMPACT><DT><DD>
-<DL COMPACT>
-<DT><B>'x'</B>
-
-<DD>
-continuous lower-case hexadecimal with a
-<B>0x</B>
-
-prefix
-<DT><B>'h'</B>
-
-<DD>
-lower-case hexadecimal with a
-<B>0x</B>
-
-prefix and a
-<B>_</B>
-
-every eight digits
-<DT><B>':'</B>
-
-<DD>
-lower-case hexadecimal with no prefix and a
-<B>:</B>
-
-(colon) every two digits
-<DT><B>16</B>
-
-<DD>
-lower-case hexadecimal with no prefix or
-<B>_</B>
-
-<DT><B>'s'</B>
-
-<DD>
-continuous base64 with a
-<B>0s</B>
-
-prefix
-<DT><B>64</B>
-
-<DD>
-continuous base64 with no prefix
-</DL>
-</DL>
-
-<P>
-
-The default format is currently
-<B>'h'</B>.
-
-<P>
-
-<I>Ttodata</I>
-
-returns NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-On success,
-if and only if
-<I>lenp</I>
-
-is non-NULL,
-<B>*lenp</B>
-
-is set to the number of bytes required to contain the full untruncated result.
-It is the caller's responsibility to check this against
-<I>dstlen</I>
-
-to determine whether he has obtained a complete result.
-The
-<B>*lenp</B>
-
-value is correct even if
-<I>dstlen</I>
-
-is zero, which offers a way to determine how much space would be needed
-before having to allocate any.
-<P>
-
-<I>Ttodatav</I>
-
-is just like
-<I>ttodata</I>
-
-except that in certain cases,
-if
-<I>errp</I>
-
-is non-NULL,
-the buffer pointed to by
-<I>errp</I>
-
-(whose length is given by
-<I>errlen</I>)
-
-is used to hold a more detailed error message.
-The return value is NULL for success,
-and is either
-<I>errp</I>
-
-or a pointer to a string literal for failure.
-If the size of the error-message buffer is
-inadequate for the desired message,
-<I>ttodatav</I>
-
-will fall back on returning a pointer to a literal string instead.
-The
-<I>freeswan.h</I>
-
-header file defines a constant
-<B>TTODATAV_BUF</B>
-
-which is the size of a buffer large enough for worst-case results.
-<P>
-
-The normal return value of
-<I>datatot</I>
-
-is the number of bytes required
-to contain the full untruncated result.
-It is the caller's responsibility to check this against
-<I>dstlen</I>
-
-to determine whether he has obtained a complete result.
-The return value is correct even if
-<I>dstlen</I>
-
-is zero, which offers a way to determine how much space would be needed
-before having to allocate any.
-A return value of
-<B>0</B>
-
-signals a fatal error of some kind
-(see DIAGNOSTICS).
-<P>
-
-A zero value for
-<I>srclen</I>
-
-in
-<I>ttodata</I>
-
-(but not
-<I>datatot</I>!)
-
-is synonymous with
-<B>strlen(src)</B>.
-
-A non-zero
-<I>srclen</I>
-
-in
-<I>ttodata</I>
-
-must not include the terminating NUL.
-<P>
-
-Unless
-<I>dstlen</I>
-
-is zero,
-the result supplied by
-<I>datatot</I>
-
-is always NUL-terminated,
-and its needed-size return value includes space for the terminating NUL.
-<P>
-
-Several obsolete variants of these functions
-(<I>atodata</I>,
-
-<I>datatoa</I>,
-
-<I>atobytes</I>,
-
-and
-<I>bytestoa</I>)
-
-are temporarily also supported.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="sprintf.3.html">sprintf</A>(3), <A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>ttodata</I>
-
-and
-<I>ttodatav</I>
-
-are:
-unknown characters in the input;
-unknown or missing prefix;
-unknown base;
-incomplete digit group;
-non-zero padding in a base64 less-than-three-bytes digit group;
-zero-length input.
-<P>
-
-Fatal errors in
-<I>datatot</I>
-
-are:
-unknown format code;
-zero-length input.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-<I>Datatot</I>
-
-should have a format code to produce character-text output.
-<P>
-
-The
-<B>0s</B>
-
-and
-<B>0t</B>
-
-prefixes are the author's inventions and are not a standard
-of any kind.
-They have been chosen to avoid collisions with existing practice
-(some C implementations use
-<B>0b</B>
-
-for binary)
-and possible confusion with unprefixed hexadecimal.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_ttosa.3.html b/doc/manpage.d/ipsec_ttosa.3.html
deleted file mode 100644
index 1e457fc24..000000000
--- a/doc/manpage.d/ipsec_ttosa.3.html
+++ /dev/null
@@ -1,453 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TTOSA</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TTOSA</H1>
-Section: C Library Functions (3)<BR>Updated: 26 Nov 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ttosa, satot - convert IPsec Security Association IDs to and from text
-<BR>
-
-ipsec initsaid - initialize an SA ID
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>typedef struct {</B>
-
-<BR>
-&nbsp;
-<B>ip_address dst;</B>
-
-<BR>
-&nbsp;
-<B>ipsec_spi_t spi;</B>
-
-<BR>
-&nbsp;
-<B>int proto;</B>
-
-<BR>
-
-<B>} ip_said;</B>
-
-<P>
-<B>const char *ttosa(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>ip_said *sa);</B>
-
-<BR>
-
-<B>size_t satot(const ip_said *sa, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<BR>
-
-<B>void initsaid(const ip_address *addr, ipsec_spi_t spi,</B>
-
-<BR>
-&nbsp;
-<B>int proto, ip_said *dst);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ttosa</I>
-
-converts an ASCII Security Association (SA) specifier into an
-<B>ip_said</B>
-
-structure (containing
-a destination-host address
-in network byte order,
-an SPI number in network byte order, and
-a protocol code).
-<I>Satot</I>
-
-does the reverse conversion, back to a text SA specifier.
-<I>Initsaid</I>
-
-initializes an
-<B>ip_said</B>
-
-from separate items of information.
-<P>
-
-An SA is specified in text with a mail-like syntax, e.g.
-<B><A HREF="mailto:esp.5a7@1.2.3.4">esp.5a7@1.2.3.4</A></B>.
-
-An SA specifier contains
-a protocol prefix (currently
-<B>ah</B>,
-
-<B>esp</B>,
-
-<B>tun</B>,
-
-<B>comp</B>,
-
-or
-<B>int</B>),
-
-a single character indicating the address family
-(<B>.</B>
-
-for IPv4,
-<B>:</B>
-
-for IPv6),
-an unsigned integer SPI number in hexadecimal (with no
-<B>0x</B>
-
-prefix),
-and an IP address.
-The IP address can be any form accepted by
-<I><A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A></I>(3),
-
-e.g. dotted-decimal IPv4 address,
-colon-hex IPv6 address,
-or DNS name.
-<P>
-
-As a special case, the SA specifier
-<B>%passthrough4</B>
-
-or
-<B>%passthrough6</B>
-
-signifies the special SA used to indicate that packets should be
-passed through unaltered.
-(At present, these are synonyms for
-<B><A HREF="mailto:tun.0@0.0.0.0">tun.0@0.0.0.0</A></B>
-
-and
-<B>tun:0@::</B>
-
-respectively,
-but that is subject to change without notice.)
-<B>%passthrough</B>
-
-is a historical synonym for
-<B>%passthrough4</B>.
-
-These forms are known to both
-<I>ttosa</I>
-
-and
-<I>satot</I>,
-
-so the internal representation is never visible.
-<P>
-
-Similarly, the SA specifiers
-<B>%pass</B>,
-
-<B>%drop</B>,
-
-<B>%reject</B>,
-
-<B>%hold</B>,
-
-<B>%trap</B>,
-
-and
-<B>%trapsubnet</B>
-
-signify special ``magic'' SAs used to indicate that packets should be
-passed, dropped, rejected (dropped with ICMP notification),
-held,
-and trapped (sent up to
-<I><A HREF="ipsec_pluto.8.html">ipsec_pluto</A></I>(8),
-
-with either of two forms of
-<B>%hold</B>
-
-automatically installed)
-respectively.
-These forms too are known to both routines,
-so the internal representation of the magic SAs should never be visible.
-<P>
-
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file supplies the
-<B>ip_said</B>
-
-structure, as well as a data type
-<B>ipsec_spi_t</B>
-
-which is an unsigned 32-bit integer.
-(There is no consistency between kernel and user on what such a type
-is called, hence the header hides the differences.)
-<P>
-
-The protocol code uses the same numbers that IP does.
-For user convenience, given the difficulty in acquiring the exact set of
-protocol names used by the kernel,
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-defines the names
-<B>SA_ESP</B>,
-
-<B>SA_AH</B>,
-
-<B>SA_IPIP</B>,
-
-and
-<B>SA_COMP</B>
-
-to have the same values as the kernel names
-<B>IPPROTO_ESP</B>,
-
-<B>IPPROTO_AH</B>,
-
-<B>IPPROTO_IPIP</B>,
-
-and
-<B>IPPROTO_COMP</B>.
-
-<P>
-
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-also defines
-<B>SA_INT</B>
-
-to have the value
-<B>61</B>
-
-(reserved by IANA for ``any host internal protocol'')
-and
-<B>SPI_PASS</B>,
-
-<B>SPI_DROP</B>,
-
-<B>SPI_REJECT</B>,
-
-<B>SPI_HOLD</B>,
-
-and
-<B>SPI_TRAP</B>
-
-to have the values 256-260 (in <I>host</I> byte order) respectively.
-These are used in constructing the magic SAs
-(which always have address
-<B>0.0.0.0</B>).
-
-<P>
-
-If
-<I>satot</I>
-
-encounters an unknown protocol code, e.g. 77,
-it yields output using a prefix
-showing the code numerically, e.g. ``unk77''.
-This form is
-<I>not</I>
-
-recognized by
-<I>ttosa</I>.
-
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>ttosa</I>
-
-specifies the length of the string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>satot</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<B>&lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-header file defines a constant,
-<B>SATOT_BUF</B>,
-
-which is the size of a buffer just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>satot</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the ASCII character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default
-(currently
-lowercase protocol prefix, lowercase hexadecimal SPI,
-dotted-decimal or colon-hex address).
-The value
-<B>'f'</B>
-
-is similar except that the SPI is padded with
-<B>0</B>s
-
-to a fixed 32-bit width, to ease aligning displayed tables.
-<P>
-
-<I>Ttosa</I>
-
-returns
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<I>Satot</I>
-
-returns
-<B>0</B>
-
-for a failure, and otherwise
-always returns the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<P>
-
-There is also, temporarily, support for some obsolete
-forms of SA specifier which lack the address-family indicator.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec_ttoul.3.html">ipsec_ttoul</A>(3), <A HREF="ipsec_ttoaddr.3.html">ipsec_ttoaddr</A>(3), <A HREF="ipsec_samesaid.3.html">ipsec_samesaid</A>(3), <A HREF="inet.3.html">inet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>ttosa</I>
-
-are:
-empty input;
-input too small to be a legal SA specifier;
-no
-<B>@</B>
-
-in input;
-unknown protocol prefix;
-conversion error in
-<I>ttoul</I>
-
-or
-<I>ttoaddr</I>.
-
-<P>
-
-Fatal errors in
-<I>satot</I>
-
-are:
-unknown format.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The restriction of text-to-binary error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The text-to-binary error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = ttosa( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_ttosubnet.3.html b/doc/manpage.d/ipsec_ttosubnet.3.html
deleted file mode 100644
index 199937a35..000000000
--- a/doc/manpage.d/ipsec_ttosubnet.3.html
+++ /dev/null
@@ -1,569 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TTOADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TTOADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 28 Sept 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ttoaddr, tnatoaddr, addrtot - convert Internet addresses to and from text
-<BR>
-
-ipsec ttosubnet, subnettot - convert subnet/mask text form to and from addresses
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *ttoaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *addr);</B>
-
-<BR>
-
-<B>const char *tnatoaddr(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_address *addr);</B>
-
-<BR>
-
-<B>size_t addrtot(const ip_address *addr, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<P>
-<B>const char *ttosubnet(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int af, ip_subnet *dst);</B>
-
-<BR>
-
-<B>size_t subnettot(const ip_subnet *sub, int format,</B>
-
-<BR>
-&nbsp;
-<B>char *dst, size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ttoaddr</I>
-
-converts a text-string name or numeric address into a binary address
-(in network byte order).
-<I>Tnatoaddr</I>
-
-does the same conversion,
-but the only text forms it accepts are
-the ``official'' forms of
-numeric address (dotted-decimal for IPv4, colon-hex for IPv6).
-<I>Addrtot</I>
-
-does the reverse conversion, from binary address back to a text form.
-<I>Ttosubnet</I>
-
-and
-<I>subnettot</I>
-
-do likewise for the ``address/mask'' form used to write a
-specification of a subnet.
-<P>
-
-An IPv4 address is specified in text as a
-dotted-decimal address (e.g.
-<B>1.2.3.4</B>),
-
-an eight-digit network-order hexadecimal number with the usual C prefix (e.g.
-<B>0x01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>),
-
-an eight-digit host-order hexadecimal number with a
-<B>0h</B>
-
-prefix (e.g.
-<B>0h01020304</B>,
-
-which is synonymous with
-<B>1.2.3.4</B>
-
-on a big-endian host and
-<B>4.3.2.1</B>
-
-on a little-endian host),
-a DNS name to be looked up via
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3),
-
-or an old-style network name to be looked up via
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3).
-
-<P>
-
-A dotted-decimal address may be incomplete, in which case
-text-to-binary conversion implicitly appends
-as many instances of
-<B>.0</B>
-
-as necessary to bring it up to four components.
-The components of a dotted-decimal address are always taken as
-decimal, and leading zeros are ignored.
-For example,
-<B>10</B>
-
-is synonymous with
-<B>10.0.0.0</B>,
-
-and
-<B>128.009.000.032</B>
-
-is synonymous with
-<B>128.9.0.32</B>
-
-(the latter example is verbatim from RFC 1166).
-The result of applying
-<I>addrtot</I>
-
-to an IPv4 address is always complete and does not contain leading zeros.
-<P>
-
-Use of hexadecimal addresses is
-<B>strongly</B>
-
-<B>discouraged</B>;
-
-they are included only to save hassles when dealing with
-the handful of perverted programs which already print 
-network addresses in hexadecimal.
-<P>
-
-An IPv6 address is specified in text with
-colon-hex notation (e.g.
-<B>0:56:78ab:22:33:44:55:66</B>),
-
-colon-hex with
-<B>::</B>
-
-abbreviating at most one subsequence of multiple zeros (e.g.
-<B>99:ab::54:068</B>,
-
-which is synonymous with
-<B>99:ab:0:0:0:0:54:68</B>),
-
-or a DNS name to be looked up via
-<I><A HREF="gethostbyname.3.html">gethostbyname</A></I>(3).
-
-The result of applying
-<I>addrtot</I>
-
-to an IPv6 address will use
-<B>::</B>
-
-abbreviation if possible,
-and will not contain leading zeros.
-<P>
-
-The letters in hexadecimal
-may be uppercase or lowercase or any mixture thereof.
-<P>
-
-DNS names may be complete (optionally terminated with a ``.'')
-or incomplete, and are looked up as specified by local system configuration
-(see
-<I><A HREF="resolver.5.html">resolver</A></I>(5)).
-
-The
-<I>h_addr</I>
-
-value returned by
-<I><A HREF="gethostbyname2.3.html">gethostbyname2</A></I>(3)
-
-is used,
-so with current DNS implementations,
-the result when the name corresponds to more than one address is
-difficult to predict.
-IPv4 name lookup resorts to
-<I><A HREF="getnetbyname.3.html">getnetbyname</A></I>(3)
-
-only if
-<I><A HREF="gethostbyname2.3.html">gethostbyname2</A></I>(3)
-
-fails.
-<P>
-
-A subnet specification is of the form <I>network</I><B>/</B><I>mask</I>.
-The
-<I>network</I>
-
-and
-<I>mask</I>
-
-can be any form acceptable to
-<I>ttoaddr</I>.
-
-In addition, and preferably, the
-<I>mask</I>
-
-can be a decimal integer (leading zeros ignored) giving a bit count,
-in which case
-it stands for a mask with that number of high bits on and all others off
-(e.g.,
-<B>24</B>
-
-in IPv4 means
-<B>255.255.255.0</B>).
-
-In any case, the mask must be contiguous
-(a sequence of high bits on and all remaining low bits off).
-As a special case, the subnet specification
-<B>%default</B>
-
-is a synonym for
-<B>0.0.0.0/0</B>
-
-or
-<B>::/0</B>
-
-in IPv4 or IPv6 respectively.
-<P>
-
-<I>Ttosubnet</I>
-
-ANDs the mask with the address before returning,
-so that any non-network bits in the address are turned off
-(e.g.,
-<B>10.1.2.3/24</B>
-
-is synonymous with
-<B>10.1.2.0/24</B>).
-
-<I>Subnettot</I>
-
-always generates the decimal-integer-bit-count
-form of the mask,
-with no leading zeros.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>ttoaddr</I>
-
-and
-<I>ttosubnet</I>
-
-specifies the length of the text string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>af</I>
-
-parameter of
-<I>ttoaddr</I>
-
-and
-<I>ttosubnet</I>
-
-specifies the address family of interest.
-It should be either
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>.
-
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines constants,
-<B>ADDRTOT_BUF</B>
-
-and
-<B>SUBNETTOT_BUF</B>,
-
-which are the sizes of buffers just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-specifies what format is to be used for the conversion.
-The value
-<B>0</B>
-
-(not the character
-<B>'0'</B>,
-
-but a zero value)
-specifies a reasonable default,
-and is in fact the only format currently available in
-<I>subnettot</I>.
-
-<I>Addrtot</I>
-
-also accepts format values
-<B>'r'</B>
-
-(signifying a text form suitable for DNS reverse lookups,
-e.g.
-<B>4.3.2.1.IN-ADDR.ARPA.</B>
-
-for IPv4 and
-RFC 2874 format for IPv6),
-and
-<B>'R'</B>
-
-(signifying an alternate reverse-lookup form,
-an error for IPv4 and RFC 1886 format for IPv6).
-Reverse-lookup names always end with a ``.''.
-<P>
-
-The text-to-binary functions return NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-The binary-to-text functions return
-<B>0</B>
-
-for a failure, and otherwise
-always return the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>ttoaddr</I>
-
-are:
-empty input;
-unknown address family;
-attempt to allocate temporary storage for a very long name failed;
-name lookup failed;
-syntax error in dotted-decimal or colon-hex form;
-dotted-decimal or colon-hex component too large.
-<P>
-
-Fatal errors in
-<I>ttosubnet</I>
-
-are:
-no
-<B>/</B>
-
-in
-<I>src</I>;
-
-<I>ttoaddr</I>
-
-error in conversion of
-<I>network</I>
-
-or
-<I>mask</I>;
-
-bit-count mask too big;
-mask non-contiguous.
-<P>
-
-Fatal errors in
-<I>addrtot</I>
-
-and
-<I>subnettot</I>
-
-are:
-unknown format.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-The interpretation of incomplete dotted-decimal addresses
-(e.g.
-<B>10/24</B>
-
-means
-<B>10.0.0.0/24</B>)
-
-differs from that of some older conversion
-functions, e.g. those of
-<I><A HREF="inet.3.html">inet</A></I>(3).
-
-The behavior of the older functions has never been
-particularly consistent or particularly useful.
-<P>
-
-Ignoring leading zeros in dotted-decimal components and bit counts
-is arguably the most useful behavior in this application,
-but it might occasionally cause confusion with the historical use of leading 
-zeros to denote octal numbers.
-<P>
-
-<I>Ttoaddr</I>
-
-does not support the mixed colon-hex-dotted-decimal
-convention used to embed an IPv4 address in an IPv6 address.
-<P>
-
-<I>Addrtot</I>
-
-always uses the
-<B>::</B>
-
-abbreviation (which can appear only once in an address) for the
-<I>first</I>
-
-sequence of multiple zeros in an IPv6 address.
-One can construct addresses (unlikely ones) in which this is suboptimal.
-<P>
-
-<I>Addrtot</I>
-
-<B>'r'</B>
-
-conversion of an IPv6 address uses lowercase hexadecimal,
-not the uppercase used in RFC 2874's examples.
-It takes careful reading of RFCs 2874, 2673, and 2234 to realize
-that lowercase is technically legitimate here,
-and there may be software which botches this
-and hence would have trouble with lowercase hex.
-<P>
-
-Possibly
-<I>subnettot</I>
-
-ought to recognize the
-<B>%default</B>
-
-case and generate that string as its output.
-Currently it doesn't.
-<P>
-
-It is barely possible that somebody, somewhere,
-might have a legitimate use for non-contiguous subnet masks.
-<P>
-
-<I><A HREF="Getnetbyname.3.html">Getnetbyname</A></I>(3)
-
-is a historical dreg.
-<P>
-
-<I>Tnatoaddr</I>
-
-probably should enforce completeness of dotted-decimal addresses.
-<P>
-
-The restriction of text-to-binary error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The text-to-binary error-reporting convention lends itself
-to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = ttoaddr( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_ttoul.3.html b/doc/manpage.d/ipsec_ttoul.3.html
deleted file mode 100644
index b722dcc13..000000000
--- a/doc/manpage.d/ipsec_ttoul.3.html
+++ /dev/null
@@ -1,310 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TTOUL</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TTOUL</H1>
-Section: C Library Functions (3)<BR>Updated: 16 Aug 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ttoul, ultot - convert unsigned-long numbers to and from text
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *ttoul(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int base, unsigned long *n);</B>
-
-<BR>
-
-<B>size_t ultot(unsigned long n, int format, char *dst,</B>
-
-<BR>
-&nbsp;
-<B>size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ttoul</I>
-
-converts a text-string number into a binary
-<B>unsigned long</B>
-
-value.
-<I>Ultot</I>
-
-does the reverse conversion, back to a text version.
-<P>
-
-Numbers are specified in text as
-decimal (e.g.
-<B>123</B>),
-
-octal with a leading zero (e.g.
-<B>012</B>,
-
-which has value 10),
-or hexadecimal with a leading
-<B>0x</B>
-
-(e.g.
-<B>0x1f</B>,
-
-which has value 31)
-in either upper or lower case.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>ttoul</I>
-
-specifies the length of the string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>base</I>
-
-parameter of
-<I>ttoul</I>
-
-can be
-<B>8</B>,
-
-<B>10</B>,
-
-or
-<B>16</B>,
-
-in which case the number supplied is assumed to be of that form
-(and in the case of
-<B>16</B>,
-
-to lack any
-<B>0x</B>
-
-prefix).
-It can also be
-<B>0</B>,
-
-in which case the number is examined for a leading zero
-or a leading
-<B>0x</B>
-
-to determine its base.
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>ultot</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines a constant,
-<B>ULTOT_BUF</B>,
-
-which is the size of a buffer just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>ultot</I>
-
-must be one of:
-<DL COMPACT><DT><DD>
-<DL COMPACT>
-<DT><B>'o'</B><DD>
-octal conversion with leading
-<B>0</B>
-
-<DT><B>&nbsp;8</B><DD>
-octal conversion with no leading
-<B>0</B>
-
-<DT><B>'d'</B><DD>
-decimal conversion
-<DT><B>10</B><DD>
-same as
-<B>d</B>
-
-<DT><B>'x'</B><DD>
-hexadecimal conversion, including leading
-<B>0x</B>
-
-<DT><B>16</B><DD>
-hexadecimal conversion with no leading
-<B>0x</B>
-
-<DT><B>17</B><DD>
-like
-<B>16</B>
-
-except padded on left with
-<B>0</B>s
-
-to eight digits (full width of a 32-bit number)
-</DL>
-</DL>
-
-<P>
-
-<I>Ttoul</I>
-
-returns NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<I>Ultot</I>
-
-returns
-<B>0</B>
-
-for a failure, and otherwise
-returns the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL
-(it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred).
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="atol.3.html">atol</A>(3), <A HREF="strtoul.3.html">strtoul</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>ttoul</I>
-
-are:
-empty input;
-unknown
-<I>base</I>;
-
-non-digit character found;
-number too large for an
-<B>unsigned long</B>.
-
-<P>
-
-Fatal errors in
-<I>ultot</I>
-
-are:
-unknown
-<I>format</I>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-Conversion of
-<B>0</B>
-
-with format
-<B>o</B>
-
-yields
-<B>00</B>.
-
-<P>
-
-<I>Ultot</I>
-
-format
-<B>17</B>
-
-is a bit of a kludge.
-<P>
-
-The restriction of error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The error-reporting convention lends itself to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = ttoul( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_ultoa.3.html b/doc/manpage.d/ipsec_ultoa.3.html
deleted file mode 100644
index 7669dce52..000000000
--- a/doc/manpage.d/ipsec_ultoa.3.html
+++ /dev/null
@@ -1,266 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ATOUL</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ATOUL</H1>
-Section: C Library Functions (3)<BR>Updated: 11 June 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec atoul, ultoa - convert unsigned-long numbers to and from ASCII
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *atoul(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int base, unsigned long *n);</B>
-
-<BR>
-
-<B>size_t ultoa(unsigned long n, int base, char *dst,</B>
-
-<BR>
-&nbsp;
-<B>size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions are obsolete; see
-<I><A HREF="ipsec_ttoul.3.html">ipsec_ttoul</A></I>(3)
-
-for their replacements.
-<P>
-
-<I>Atoul</I>
-
-converts an ASCII number into a binary
-<B>unsigned long</B>
-
-value.
-<I>Ultoa</I>
-
-does the reverse conversion, back to an ASCII version.
-<P>
-
-Numbers are specified in ASCII as
-decimal (e.g.
-<B>123</B>),
-
-octal with a leading zero (e.g.
-<B>012</B>,
-
-which has value 10),
-or hexadecimal with a leading
-<B>0x</B>
-
-(e.g.
-<B>0x1f</B>,
-
-which has value 31)
-in either upper or lower case.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>atoul</I>
-
-specifies the length of the ASCII string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>base</I>
-
-parameter of
-<I>atoul</I>
-
-can be
-<B>8</B>,
-
-<B>10</B>,
-
-or
-<B>16</B>,
-
-in which case the number supplied is assumed to be of that form
-(and in the case of
-<B>16</B>,
-
-to lack any
-<B>0x</B>
-
-prefix).
-It can also be
-<B>0</B>,
-
-in which case the number is examined for a leading zero
-or a leading
-<B>0x</B>
-
-to determine its base,
-or
-<B>13</B>
-
-(halfway between 10 and 16),
-which has the same effect as
-<B>0</B>
-
-except that a non-hexadecimal
-number is considered decimal regardless of any leading zero.
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>ultoa</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-<P>
-
-The
-<I>base</I>
-
-parameter of
-<I>ultoa</I>
-
-must be
-<B>8</B>,
-
-<B>10</B>,
-
-or
-<B>16</B>.
-
-<P>
-
-<I>Atoul</I>
-
-returns NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<I>Ultoa</I>
-
-returns the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL;
-it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="atol.3.html">atol</A>(3), <A HREF="strtoul.3.html">strtoul</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>atoul</I>
-
-are:
-empty input;
-unknown
-<I>base</I>;
-
-non-digit character found;
-number too large for an
-<B>unsigned long</B>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-There is no provision for reporting an invalid
-<I>base</I>
-
-parameter given to
-<I>ultoa</I>.
-
-<P>
-
-The restriction of error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The error-reporting convention lends itself to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = atoul( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_ultot.3.html b/doc/manpage.d/ipsec_ultot.3.html
deleted file mode 100644
index b722dcc13..000000000
--- a/doc/manpage.d/ipsec_ultot.3.html
+++ /dev/null
@@ -1,310 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_TTOUL</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_TTOUL</H1>
-Section: C Library Functions (3)<BR>Updated: 16 Aug 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ttoul, ultot - convert unsigned-long numbers to and from text
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *ttoul(const char *src, size_t srclen,</B>
-
-<BR>
-&nbsp;
-<B>int base, unsigned long *n);</B>
-
-<BR>
-
-<B>size_t ultot(unsigned long n, int format, char *dst,</B>
-
-<BR>
-&nbsp;
-<B>size_t dstlen);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>Ttoul</I>
-
-converts a text-string number into a binary
-<B>unsigned long</B>
-
-value.
-<I>Ultot</I>
-
-does the reverse conversion, back to a text version.
-<P>
-
-Numbers are specified in text as
-decimal (e.g.
-<B>123</B>),
-
-octal with a leading zero (e.g.
-<B>012</B>,
-
-which has value 10),
-or hexadecimal with a leading
-<B>0x</B>
-
-(e.g.
-<B>0x1f</B>,
-
-which has value 31)
-in either upper or lower case.
-<P>
-
-The
-<I>srclen</I>
-
-parameter of
-<I>ttoul</I>
-
-specifies the length of the string pointed to by
-<I>src</I>;
-
-it is an error for there to be anything else
-(e.g., a terminating NUL) within that length.
-As a convenience for cases where an entire NUL-terminated string is
-to be converted,
-a
-<I>srclen</I>
-
-value of
-<B>0</B>
-
-is taken to mean
-<B>strlen(src)</B>.
-
-<P>
-
-The
-<I>base</I>
-
-parameter of
-<I>ttoul</I>
-
-can be
-<B>8</B>,
-
-<B>10</B>,
-
-or
-<B>16</B>,
-
-in which case the number supplied is assumed to be of that form
-(and in the case of
-<B>16</B>,
-
-to lack any
-<B>0x</B>
-
-prefix).
-It can also be
-<B>0</B>,
-
-in which case the number is examined for a leading zero
-or a leading
-<B>0x</B>
-
-to determine its base.
-<P>
-
-The
-<I>dstlen</I>
-
-parameter of
-<I>ultot</I>
-
-specifies the size of the
-<I>dst</I>
-
-parameter;
-under no circumstances are more than
-<I>dstlen</I>
-
-bytes written to
-<I>dst</I>.
-
-A result which will not fit is truncated.
-<I>Dstlen</I>
-
-can be zero, in which case
-<I>dst</I>
-
-need not be valid and no result is written,
-but the return value is unaffected;
-in all other cases, the (possibly truncated) result is NUL-terminated.
-The
-<I>freeswan.h</I>
-
-header file defines a constant,
-<B>ULTOT_BUF</B>,
-
-which is the size of a buffer just large enough for worst-case results.
-<P>
-
-The
-<I>format</I>
-
-parameter of
-<I>ultot</I>
-
-must be one of:
-<DL COMPACT><DT><DD>
-<DL COMPACT>
-<DT><B>'o'</B><DD>
-octal conversion with leading
-<B>0</B>
-
-<DT><B>&nbsp;8</B><DD>
-octal conversion with no leading
-<B>0</B>
-
-<DT><B>'d'</B><DD>
-decimal conversion
-<DT><B>10</B><DD>
-same as
-<B>d</B>
-
-<DT><B>'x'</B><DD>
-hexadecimal conversion, including leading
-<B>0x</B>
-
-<DT><B>16</B><DD>
-hexadecimal conversion with no leading
-<B>0x</B>
-
-<DT><B>17</B><DD>
-like
-<B>16</B>
-
-except padded on left with
-<B>0</B>s
-
-to eight digits (full width of a 32-bit number)
-</DL>
-</DL>
-
-<P>
-
-<I>Ttoul</I>
-
-returns NULL for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<I>Ultot</I>
-
-returns
-<B>0</B>
-
-for a failure, and otherwise
-returns the size of buffer which would 
-be needed to
-accommodate the full conversion result, including terminating NUL
-(it is the caller's responsibility to check this against the size of
-the provided buffer to determine whether truncation has occurred).
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="atol.3.html">atol</A>(3), <A HREF="strtoul.3.html">strtoul</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in
-<I>ttoul</I>
-
-are:
-empty input;
-unknown
-<I>base</I>;
-
-non-digit character found;
-number too large for an
-<B>unsigned long</B>.
-
-<P>
-
-Fatal errors in
-<I>ultot</I>
-
-are:
-unknown
-<I>format</I>.
-
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<A NAME="lbAH">&nbsp;</A>
-<H2>BUGS</H2>
-
-Conversion of
-<B>0</B>
-
-with format
-<B>o</B>
-
-yields
-<B>00</B>.
-
-<P>
-
-<I>Ultot</I>
-
-format
-<B>17</B>
-
-is a bit of a kludge.
-<P>
-
-The restriction of error reports to literal strings
-(so that callers don't need to worry about freeing them or copying them)
-does limit the precision of error reporting.
-<P>
-
-The error-reporting convention lends itself to slightly obscure code,
-because many readers will not think of NULL as signifying success.
-A good way to make it clearer is to write something like:
-<P>
-
-<DL COMPACT><DT><DD>
-<PRE>
-<B>const char *error;</B>
-
-<B>error = ttoul( /* ... */ );</B>
-<B>if (error != NULL) {</B>
-<B>        /* something went wrong */</B>
-</PRE>
-
-</DL>
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-<DT><A HREF="#lbAH">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_unspecaddr.3.html b/doc/manpage.d/ipsec_unspecaddr.3.html
deleted file mode 100644
index 92f69d99c..000000000
--- a/doc/manpage.d/ipsec_unspecaddr.3.html
+++ /dev/null
@@ -1,166 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_ANYADDR</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_ANYADDR</H1>
-Section: C Library Functions (3)<BR>Updated: 8 Sept 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec anyaddr - get &quot;any&quot; address
-<BR>
-
-ipsec isanyaddr - test address for equality to &quot;any&quot; address
-<BR>
-
-ipsec unspecaddr - get &quot;unspecified&quot; address
-<BR>
-
-ipsec isunspecaddr - test address for equality to &quot;unspecified&quot; address
-<BR>
-
-ipsec loopbackaddr - get loopback address
-<BR>
-
-ipsec isloopbackaddr - test address for equality to loopback address
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *anyaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isanyaddr(const ip_address *src);</B>
-
-<BR>
-
-<B>const char *unspecaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isunspecaddr(const ip_address *src);</B>
-
-<BR>
-
-<B>const char *loopbackaddr(int af, ip_address *dst);</B>
-
-<BR>
-
-<B>int isloopbackaddr(const ip_address *src);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions fill in, and test for, special values of the
-<I>ip_address</I>
-
-type.
-<P>
-
-<I>Anyaddr</I>
-
-fills in the destination
-<I>*dst</I>
-
-with the ``any'' address of address family
-<I>af</I>
-
-(normally
-<B>AF_INET</B>
-
-or
-<B>AF_INET6</B>).
-
-The IPv4 ``any'' address is the one embodied in the old
-<B>INADDR_ANY</B>
-
-macro.
-<P>
-
-<I>Isanyaddr</I>
-
-returns
-<B>1</B>
-
-if the
-<I>src</I>
-
-address equals the ``any'' address,
-and
-<B>0</B>
-
-otherwise.
-<P>
-
-Similarly,
-<I>unspecaddr</I>
-
-supplies, and
-<I>isunspecaddr</I>
-
-tests for,
-the ``unspecified'' address,
-which may be the same as the ``any'' address.
-<P>
-
-Similarly,
-<I>loopbackaddr</I>
-
-supplies, and
-<I>islookbackaddr</I>
-
-tests for,
-the loopback address.
-<P>
-
-<I>Anyaddr</I>,
-
-<I>unspecaddr</I>,
-
-and
-<I>loopbackaddr</I>
-
-return
-<B>NULL</B>
-
-for success and
-a pointer to a string-literal error message for failure;
-see DIAGNOSTICS.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="inet.3.html">inet</A>(3), <A HREF="ipsec_addrtot.3.html">ipsec_addrtot</A>(3), <A HREF="ipsec_sameaddr.3.html">ipsec_sameaddr</A>(3)
-<A NAME="lbAF">&nbsp;</A>
-<H2>DIAGNOSTICS</H2>
-
-Fatal errors in the address-supplying functions are:
-unknown address family.
-<A NAME="lbAG">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">DIAGNOSTICS</A><DD>
-<DT><A HREF="#lbAG">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_verify.8.html b/doc/manpage.d/ipsec_verify.8.html
deleted file mode 100644
index 09d04894b..000000000
--- a/doc/manpage.d/ipsec_verify.8.html
+++ /dev/null
@@ -1,107 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_VERIFY</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_VERIFY</H1>
-Section: Maintenance Commands (8)<BR>Updated: 8 June 2002<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec verify - see if FreeSWAN has been installed correctly
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>ipsec</B>
-
-<B>verify</B>
-
-[
-<B>--host</B>
-
-&nbsp;name&nbsp;]
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<P>
-
-Invoked without argument,
-<I>verify  </I>
-
-examines the local system for a number of common system faults: 
-IPsec not in path, no secrets file generated, 
-pluto not running, and IPsec support not present in kernel
-(or IPsec module not loaded).
-If two or more interfaces are found, it performs checks relevant on an 
-IPsec gateway: whether IP forwarding is allowed, and if so, 
-whether MASQ or NAT rules are in play.
-<P>
-
-In addition, 
-<I>verify </I>
-
-performs checks relevant to Opportunistic Encryption. 
-It looks in forward DNS for a TXT record for the system's hostname, and
-in reverse DNS for a TXT record for the system's IP addresses.
-It checks whether the system has a public IP. 
-<P>
-
-The
-<B>--host</B>
-
-option causes
-<B>verify</B>
-
-to look for a TXT record for 
-<I>name</I>
-
-in forward and reverse DNS.
-<A NAME="lbAE">&nbsp;</A>
-<H2>FILES</H2>
-
-<PRE>
-/proc/net/ipsec_eroute
-/etc/ipsec.secrets
-</PRE>
-
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Michael Richardson.
-<A NAME="lbAG">&nbsp;</A>
-<H2>BUGS</H2>
-
-<I>Verify </I>
-
-does not check for 
-<B>ipchains</B>
-
-masquerading.
-<P>
-
-<I>Verify</I>
-
-does not look for TXT records for Opportunistic clients behind the system.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">FILES</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-<DT><A HREF="#lbAG">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_version.3.html b/doc/manpage.d/ipsec_version.3.html
deleted file mode 100644
index bcad75a46..000000000
--- a/doc/manpage.d/ipsec_version.3.html
+++ /dev/null
@@ -1,94 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_VERSION</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_VERSION</H1>
-Section: C Library Functions (3)<BR>Updated: 21 Nov 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ipsec_version_code - get IPsec version code
-<BR>
-
-ipsec ipsec_version_string - get full IPsec version string
-<BR>
-
-ipsec ipsec_copyright_notice - get IPsec copyright notice
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *ipsec_version_code(void);</B>
-
-<BR>
-
-<B>const char *ipsec_version_string(void);</B>
-
-<BR>
-
-<B>const char **ipsec_copyright_notice(void);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions provide information on version numbering and copyright
-of the Linux FreeS/WAN IPsec implementation.
-<P>
-
-<I>Ipsec_version_code</I>
-
-returns a pointer to a string constant
-containing the current IPsec version code,
-such as ``1.92'' or ``snap2001Nov19b''.
-<P>
-
-<I>Ipsec_version_string</I>
-
-returns a pointer to a string constant giving a full version identification,
-consisting of the version code preceded by a prefix identifying the software,
-e.g. ``Linux FreeS/WAN 1.92''.
-<P>
-
-<I>Ipsec_copyright_notice</I>
-
-returns a pointer to a vector of pointers,
-terminated by a
-<B>NULL</B>,
-
-which is the text of a suitable copyright notice.
-Each pointer points to a string constant (possibly empty) which is one line
-of the somewhat-verbose copyright notice.
-The strings are NUL-terminated and do not contain a newline;
-supplying suitable line termination for the output device is
-the caller's responsibility.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_version.5.html b/doc/manpage.d/ipsec_version.5.html
deleted file mode 100644
index 89bee0f97..000000000
--- a/doc/manpage.d/ipsec_version.5.html
+++ /dev/null
@@ -1,103 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_VERSION</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_VERSION</H1>
-Section: File Formats (5)<BR>Updated: 29 Jun 2000<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec_version - lists KLIPS version information
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>cat</B>
-
-<B>/proc/net/ipsec_version</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<I>/proc/net/ipsec_version</I>
-
-is a read-only file which lists the currently running KLIPS version
-information.
-<P>
-
-<A NAME="lbAE">&nbsp;</A>
-<H2>EXAMPLES</H2>
-
-<DL COMPACT>
-<DT><B>FreeS/WAN version: 1.4</B>
-
-<DD>
-</DL>
-<P>
-
-shows that the currently loaded
-<B>KLIPS</B>
-
-is from
-<B>FreeS/WAN 1.4.</B>
-
-<P>
-
-<A NAME="lbAF">&nbsp;</A>
-<H2>FILES</H2>
-
-/proc/net/ipsec_version
-<A NAME="lbAG">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_eroute.5.html">ipsec_eroute</A>(5), <A HREF="ipsec_spi.5.html">ipsec_spi</A>(5),
-<A HREF="ipsec_spigrp.5.html">ipsec_spigrp</A>(5), <A HREF="ipsec_klipsdebug.5.html">ipsec_klipsdebug</A>(5), <A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A>(8), <A HREF="ipsec_pf_key.5.html">ipsec_pf_key</A>(5)
-<A NAME="lbAH">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the Linux FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
-by Richard Guy Briggs.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">EXAMPLES</A><DD>
-<DT><A HREF="#lbAF">FILES</A><DD>
-<DT><A HREF="#lbAG">SEE ALSO</A><DD>
-<DT><A HREF="#lbAH">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_version_code.3.html b/doc/manpage.d/ipsec_version_code.3.html
deleted file mode 100644
index bcad75a46..000000000
--- a/doc/manpage.d/ipsec_version_code.3.html
+++ /dev/null
@@ -1,94 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_VERSION</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_VERSION</H1>
-Section: C Library Functions (3)<BR>Updated: 21 Nov 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ipsec_version_code - get IPsec version code
-<BR>
-
-ipsec ipsec_version_string - get full IPsec version string
-<BR>
-
-ipsec ipsec_copyright_notice - get IPsec copyright notice
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *ipsec_version_code(void);</B>
-
-<BR>
-
-<B>const char *ipsec_version_string(void);</B>
-
-<BR>
-
-<B>const char **ipsec_copyright_notice(void);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions provide information on version numbering and copyright
-of the Linux FreeS/WAN IPsec implementation.
-<P>
-
-<I>Ipsec_version_code</I>
-
-returns a pointer to a string constant
-containing the current IPsec version code,
-such as ``1.92'' or ``snap2001Nov19b''.
-<P>
-
-<I>Ipsec_version_string</I>
-
-returns a pointer to a string constant giving a full version identification,
-consisting of the version code preceded by a prefix identifying the software,
-e.g. ``Linux FreeS/WAN 1.92''.
-<P>
-
-<I>Ipsec_copyright_notice</I>
-
-returns a pointer to a vector of pointers,
-terminated by a
-<B>NULL</B>,
-
-which is the text of a suitable copyright notice.
-Each pointer points to a string constant (possibly empty) which is one line
-of the somewhat-verbose copyright notice.
-The strings are NUL-terminated and do not contain a newline;
-supplying suitable line termination for the output device is
-the caller's responsibility.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_version_string.3.html b/doc/manpage.d/ipsec_version_string.3.html
deleted file mode 100644
index bcad75a46..000000000
--- a/doc/manpage.d/ipsec_version_string.3.html
+++ /dev/null
@@ -1,94 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_VERSION</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_VERSION</H1>
-Section: C Library Functions (3)<BR>Updated: 21 Nov 2001<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec ipsec_version_code - get IPsec version code
-<BR>
-
-ipsec ipsec_version_string - get full IPsec version string
-<BR>
-
-ipsec ipsec_copyright_notice - get IPsec copyright notice
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-<B>#include &lt;<A HREF="file:/usr/include/freeswan.h">freeswan.h</A>&gt;</B>
-
-<P>
-<B>const char *ipsec_version_code(void);</B>
-
-<BR>
-
-<B>const char *ipsec_version_string(void);</B>
-
-<BR>
-
-<B>const char **ipsec_copyright_notice(void);</B>
-
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-These functions provide information on version numbering and copyright
-of the Linux FreeS/WAN IPsec implementation.
-<P>
-
-<I>Ipsec_version_code</I>
-
-returns a pointer to a string constant
-containing the current IPsec version code,
-such as ``1.92'' or ``snap2001Nov19b''.
-<P>
-
-<I>Ipsec_version_string</I>
-
-returns a pointer to a string constant giving a full version identification,
-consisting of the version code preceded by a prefix identifying the software,
-e.g. ``Linux FreeS/WAN 1.92''.
-<P>
-
-<I>Ipsec_copyright_notice</I>
-
-returns a pointer to a vector of pointers,
-terminated by a
-<B>NULL</B>,
-
-which is the text of a suitable copyright notice.
-Each pointer points to a string constant (possibly empty) which is one line
-of the somewhat-verbose copyright notice.
-The strings are NUL-terminated and do not contain a newline;
-supplying suitable line termination for the output device is
-the caller's responsibility.
-<A NAME="lbAE">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<A HREF="ipsec.8.html">ipsec</A>(8)
-<A NAME="lbAF">&nbsp;</A>
-<H2>HISTORY</H2>
-
-Written for the FreeS/WAN project by Henry Spencer.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DT><A HREF="#lbAE">SEE ALSO</A><DD>
-<DT><A HREF="#lbAF">HISTORY</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpage.d/ipsec_whack.8.html b/doc/manpage.d/ipsec_whack.8.html
deleted file mode 100644
index 2e2ce4c2f..000000000
--- a/doc/manpage.d/ipsec_whack.8.html
+++ /dev/null
@@ -1,1824 +0,0 @@
-Content-type: text/html
-
-<HTML><HEAD><TITLE>Manpage of IPSEC_PLUTO</TITLE>
-</HEAD><BODY>
-<H1>IPSEC_PLUTO</H1>
-Section: Maintenance Commands (8)<BR>Updated: 28 March 1999<BR><A HREF="#index">Index</A>
-<A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
-
-<A NAME="lbAB">&nbsp;</A>
-<H2>NAME</H2>
-
-ipsec pluto - IPsec IKE keying daemon
-<BR>
-
-ipsec whack - control interface for IPSEC keying daemon
-<A NAME="lbAC">&nbsp;</A>
-<H2>SYNOPSIS</H2>
-
-
-
-<DL COMPACT>
-<DT>
-<B>
-<DD>ipsec pluto
-[--help]
-[--version]
-[--optionsfrom&nbsp;</B><I>filename</I>]
-[--nofork]
-[--stderrlog]
-[--noklips]
-[--uniqueids]
-[<B>--interface</B> <I>interfacename</I>]
-[--ikeport&nbsp;<I>portnumber</I>]
-[--ctlbase&nbsp;<I>path</I>]
-[--secretsfile&nbsp;<I>secrets-file</I>]
-[--adns <I>pathname</I>]
-[--lwdnsq <I>pathname</I>]
-[--perpeerlog]
-[--perpeerlogbase&nbsp;<I>dirname</I>]
-[--debug-none]
-[--debug-all]
-[--debug-raw]
-[--debug-crypt]
-[--debug-parsing]
-[--debug-emitting]
-[--debug-control]
-[--debug-lifecycle]
-[--debug-klips]
-[--debug-dns]
-[--debug-oppo]
-[--debug-private]
-<DT>
-<B>
-<DD>ipsec whack
-[--help]
-[--version]
-<DT>
-
-<DD>ipsec whack
---name&nbsp;</B><I>connection-name</I>
-<BR>
-
-[--id&nbsp;<I>id</I>] [--host&nbsp;<I>ip-address</I>]
-[--ikeport&nbsp;<I>port-number</I>]
-[--nexthop&nbsp;<I>ip-address</I>]
-[--client&nbsp;<I>subnet</I>]
-[--dnskeyondemand]
-[--updown&nbsp;<I>updown</I>]
-<BR>
-
---to
-<BR>
-
-[--id&nbsp;<I>id</I>]
-[--host&nbsp;<I>ip-address</I>]
-[--ikeport&nbsp;<I>port-number</I>]
-[--nexthop&nbsp;<I>ip-address</I>]
-[--client&nbsp;<I>subnet</I>]
-[--dnskeyondemand]
-[--updown&nbsp;<I>updown</I>]
-<BR>
-
-[--psk]
-[--rsasig]
-[--encrypt]
-[--authenticate]
-[--compress]
-[--tunnel]
-[--pfs]
-[--disablearrivalcheck]
-[--ipv4]
-[--ipv6]
-[--tunnelipv4]
-[--tunnelipv6]
-[--ikelifetime&nbsp;<I>seconds</I>]
-[--ipseclifetime&nbsp;<I>seconds</I>]
-[--rekeymargin&nbsp;<I>seconds</I>]
-[--rekeyfuzz&nbsp;<I>percentage</I>]
-[--keyingtries&nbsp;<I>count</I>]
-[--dontrekey]
-[--delete]
-[--ctlbase&nbsp;<I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
---keyid&nbsp;</B><I>id</I>
-[--addkey]
-[--pubkeyrsa&nbsp;<I>key</I>]
-[--ctlbase&nbsp;<I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
---myid&nbsp;</B><I>id</I>
-<DT>
-<B>
-<DD>ipsec whack
---listen|--unlisten
-[--ctlbase&nbsp;</B><I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
---route|--unroute
---name&nbsp;</B><I>connection-name</I>
-[--ctlbase&nbsp;<I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
---initiate|--terminate
---name&nbsp;</B><I>connection-name</I>
-[--asynchronous]
-[--ctlbase&nbsp;<I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
-[--tunnelipv4]
-[--tunnelipv6]
---oppohere </B><I>ip-address</I>
---oppothere <I>ip-address</I>
-<DT>
-<B>
-<DD>ipsec whack
---delete
---name&nbsp;</B><I>connection-name</I>
-[--ctlbase&nbsp;<I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
---deletestate&nbsp;</B><I>state-number</I>
-[--ctlbase&nbsp;<I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
-[--name&nbsp;</B><I>connection-name</I>]
-[--debug-none]
-[--debug-all]
-[--debug-raw]
-[--debug-crypt]
-[--debug-parsing]
-[--debug-emitting]
-[--debug-control]
-[--debug-lifecycle]
-[--debug-klips]
-[--debug-dns]
-[--debug-oppo]
-[--debug-private]
-[--ctlbase&nbsp;<I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
---status
-[--ctlbase&nbsp;</B><I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-<DT>
-<B>
-<DD>ipsec whack
---shutdown
-[--ctlbase&nbsp;</B><I>path</I>]
-[--optionsfrom&nbsp;<I>filename</I>]
-[--label&nbsp;<I>string</I>]
-
-
-
-</DL>
-<A NAME="lbAD">&nbsp;</A>
-<H2>DESCRIPTION</H2>
-
-<B>pluto</B>
-
-is an IKE (``IPsec Key Exchange'') daemon.
-<B>whack</B>
-
-is an auxiliary program to allow requests to be made to a running
-<B>pluto</B>.
-
-<P>
-
-<B>pluto</B>
-
-is used to automatically build shared ``security associations'' on a
-system that has IPsec, the secure IP protocol.
-In other words,
-<B>pluto</B>
-
-can eliminate much of the work of manual keying.
-The actual
-secure transmission of packets is the responsibility of other parts of
-the system (see
-<B>KLIPS</B>,
-
-the companion implementation of IPsec).
-<I><A HREF="ipsec_auto.8.html">ipsec_auto</A></I>(8) provides a more convenient interface to
-<B>pluto</B> and <B>whack</B>.
-<A NAME="lbAE">&nbsp;</A>
-<H3>IKE's Job</H3>
-
-<P>
-
-A <I>Security Association</I> (<I>SA</I>) is an agreement between two network nodes on
-how to process certain traffic between them.  This processing involves
-encapsulation, authentication, encryption, or compression.
-<P>
-
-IKE can be deployed on a network node to negotiate Security
-Associations for that node.  These IKE implementations can only
-negotiate with other IKE implementations, so IKE must be on each node
-that is to be an endpoint of an IKE-negotiated Security Association.
-No other nodes need to be running IKE.
-<P>
-
-An IKE instance (i.e. an IKE implementation on a particular network
-node) communicates with another IKE instance using UDP IP packets, so
-there must be a route between the nodes in each direction.
-<P>
-
-The negotiation of Security Associations requires a number of choices
-that involve tradeoffs between security, convenience, trust, and
-efficiency.  These are policy issues and are normally specified to the
-IKE instance by the system administrator.
-<P>
-
-IKE deals with two kinds of Security Associations.  The first part of
-a negotiation between IKE instances is to build an ISAKMP SA.  An
-ISAKMP SA is used to protect communication between the two IKEs.
-IPsec SAs can then be built by the IKEs - these are used to carry
-protected IP traffic between the systems.
-<P>
-
-The negotiation of the ISAKMP SA is known as Phase 1.  In theory,
-Phase 1 can be accomplished by a couple of different exchange types,
-but we only implement one called Main Mode (we don't implement
-Aggressive Mode).
-<P>
-
-Any negotiation under the protection of an ISAKMP SA, including the
-negotiation of IPsec SAs, is part of Phase 2.  The exchange type
-that we use to negotiate an IPsec SA is called Quick Mode.
-<P>
-
-IKE instances must be able to authenticate each other as part of their
-negotiation of an ISAKMP SA.  This can be done by several mechanisms
-described in the draft standards.
-<P>
-
-IKE negotiation can be initiated by any instance with any other.  If
-both can find an agreeable set of characteristics for a Security
-Association, and both recognize each others authenticity, they can set
-up a Security Association.  The standards do not specify what causes
-an IKE instance to initiate a negotiation.
-<P>
-
-In summary, an IKE instance is prepared to automate the management of
-Security Associations in an IPsec environment, but a number of issues
-are considered policy and are left in the system administrator's hands.
-<A NAME="lbAF">&nbsp;</A>
-<H3>Pluto</H3>
-
-<P>
-
-<B>pluto</B> is an implementation of IKE.  It runs as a daemon on a network
-node.  Currently, this network node must be a LINUX system running the
-<B>KLIPS</B> implementation of IPsec.
-<P>
-
-<B>pluto</B> only implements a subset of IKE.  This is enough for it to
-interoperate with other instances of <B>pluto</B>, and many other IKE
-implementations.  We are working on implementing more of IKE.
-<P>
-
-The policy for acceptable characteristics for Security Associations is
-mostly hardwired into the code of <B>pluto</B> (spdb.c).  Eventually
-this will be moved into a security policy database with reasonable
-expressive power and more convenience.
-<P>
-
-<B>pluto</B> uses shared secrets or RSA signatures to authenticate
-peers with whom it is negotiating.
-<P>
-
-<B>pluto</B> initiates negotiation of a Security Association when it is
-manually prodded: the program <B>whack</B> is run to trigger this.
-It will also initiate a negotiation when <B>KLIPS</B> traps an outbound packet
-for Opportunistic Encryption.
-<P>
-
-<B>pluto</B> implements ISAKMP SAs itself.  After it has negotiated the
-characteristics of an IPsec SA, it directs <B>KLIPS</B> to implement it.
-It also invokes a script to adjust any firewall and issue <I><A HREF="route.8.html">route</A></I>(8)
-commands to direct IP packets through <B>KLIPS</B>.
-<P>
-
-When <B>pluto</B> shuts down, it closes all Security Associations.
-<A NAME="lbAG">&nbsp;</A>
-<H3>Before Running Pluto</H3>
-
-<P>
-
-<B>pluto</B> runs as a daemon with userid root.  Before running it, a few
-things must be set up.
-<P>
-
-<B>pluto</B> requires <B>KLIPS</B>, the FreeS/WAN implementation of IPsec.
-All of the components of <B>KLIPS</B> and <B>pluto</B> should be installed.
-<P>
-
-<B>pluto</B> supports multiple public networks (that is, networks
-that are considered insecure and thus need to have their traffic
-encrypted or authenticated).  It discovers the
-public interfaces to use by looking at all interfaces that are
-configured (the <B>--interface</B> option can be used to limit
-the interfaces considered).
-It does this only when <B>whack</B> tells it to --listen,
-so the interfaces must be configured by then.  Each interface with a name of the form
-<B>ipsec</B>[<B>0</B>-<B>9</B>] is taken as a <B>KLIPS</B> virtual public interface.
-Another network interface with the same IP address (there should be only
-one) is taken as the corresponding real public
-interface.  <I><A HREF="ifconfig.8.html">ifconfig</A></I>(8) with the <B>-a</B> flag will show
-the name and status of each network interface.
-<P>
-
-<B>pluto</B> requires a database of preshared secrets and RSA private keys.
-This is described in the
-<I><A HREF="ipsec.secrets.5.html">ipsec.secrets</A></I>(5).
-
-<B>pluto</B> is told of RSA public keys via <B>whack</B> commands.
-If the connection is Opportunistic, and no RSA public key is known,
-<B>pluto</B> will attempt to fetch RSA keys using the Domain Name System.
-<A NAME="lbAH">&nbsp;</A>
-<H3>Setting up <B>KLIPS</B> for <B>pluto</B></H3>
-
-<P>
-
-The most basic network topology that <B>pluto</B> supports has two security
-gateways negotiating on behalf of client subnets.  The diagram of RGB's
-testbed is a good example (see <I>klips/doc/rgb_setup.txt</I>).
-<P>
-
-The file <I>INSTALL</I> in the base directory of this distribution
-explains how to start setting up the whole system, including <B>KLIPS</B>.
-<P>
-
-Make sure that the security gateways have routes to each other.  This
-is usually covered by the default route, but may require issuing
-<I><A HREF="route.8.html">route</A></I>(8)
-
-commands.  The route must go through a particular IP
-interface (we will assume it is <I>eth0</I>, but it need not be).  The
-interface that connects the security gateway to its client must be a
-different one.
-<P>
-
-It is necessary to issue a
-<I><A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A></I>(8)
-
-command on each gateway.  The required command is:
-<P>
-&nbsp;&nbsp;&nbsp;ipsec tncfg --attach&nbsp;--virtual&nbsp;ipsec0 --physical&nbsp;eth0
-<P>
-A command to set up the ipsec0 virtual interface will also need to be
-run.  It will have the same parameters as the command used to set up
-the physical interface to which it has just been connected using
-<I><A HREF="ipsec_tncfg.8.html">ipsec_tncfg</A></I>(8).
-
-<A NAME="lbAI">&nbsp;</A>
-<H3>ipsec.secrets file</H3>
-
-<P>
-
-A <B>pluto</B> daemon and another IKE daemon (for example, another instance
-of <B>pluto</B>) must convince each other that they are who they are supposed
-to be before any negotiation can succeed.  This authentication is
-accomplished by using either secrets that have been shared beforehand
-(manually) or by using RSA signatures.  There are other techniques,
-but they have not been implemented in <B>pluto</B>.
-<P>
-
-The file <I>/etc/ipsec.secrets</I> is used to keep preshared secret keys
-and RSA private keys for
-authentication with other IKE daemons.  For debugging, there is an
-argument to the <B>pluto</B> command to use a different file.
-This file is described in
-<I><A HREF="ipsec.secrets.5.html">ipsec.secrets</A></I>(5).
-
-<A NAME="lbAJ">&nbsp;</A>
-<H3>Running Pluto</H3>
-
-<P>
-
-To fire up the daemon, just type <B>pluto</B> (be sure to be running as
-the superuser).
-The default IKE port number is 500, the UDP port assigned by IANA for IKE Daemons.
-<B>pluto</B> must be run by the superuser to be able to use the UDP 500 port.
-<P>
-
-<B>pluto</B> attempts to create a lockfile with the name
-<I>/var/run/pluto.pid</I>.  If the lockfile cannot be created,
-<B>pluto</B> exits - this prevents multiple <B>pluto</B>s from
-competing  Any ``leftover'' lockfile must be removed before
-<B>pluto</B> will run.  <B>pluto</B> writes its pid into this file so
-that scripts can find it.  This lock will not function properly if it
-is on an NFS volume (but sharing locks on multiple machines doesn't
-make sense anyway).
-<P>
-
-<B>pluto</B> then forks and the parent exits.  This is the conventional
-``daemon fork''.  It can make debugging awkward, so there is an option
-to suppress this fork.
-<P>
-
-All logging, including diagnostics, is sent to
-<I><A HREF="syslog.3.html">syslog</A></I>(3)
-
-with facility=authpriv;
-it decides where to put these messages (possibly in /var/log/secure).
-Since this too can make debugging awkward, there is an option to
-steer logging to stderr.
-<P>
-
-If the <B>--perpeerlog</B> option is given, then pluto will open
-a log file per connection. By default, this is in /var/log/pluto/peer,
-in a subdirectory formed by turning all dot (.) [IPv4} or colon (:)
-[IPv6] into slashes (/).
-<P>
-
-The base directory can be changed with the <B>--perpeerlogbase</B>.
-<P>
-
-Once <B>pluto</B> is started, it waits for requests from <B>whack</B>.
-<A NAME="lbAK">&nbsp;</A>
-<H3>Pluto's Internal State</H3>
-
-<P>
-
-To understand how to use <B>pluto</B>, it is helpful to understand a little
-about its internal state.  Furthermore, the terminology is needed to decipher
-some of the diagnostic messages.
-<P>
-
-The <I>(potential) connection</I> database describes attributes of a
-connection.  These include the IP addresses of the hosts and client
-subnets and the security characteristics desired.  <B>pluto</B>
-requires this information (simply called a connection) before it can
-respond to a request to build an SA.  Each connection is given a name
-when it is created, and all references are made using this name.
-<P>
-
-During the IKE exchange to build an SA, the information about the
-negotiation is represented in a <I>state object</I>.  Each state object
-reflects how far the negotiation has reached.  Once the negotiation is
-complete and the SA established, the state object remains to represent
-the SA.  When the SA is terminated, the state object is discarded.
-Each State object is given a serial number and this is used to refer
-to the state objects in logged messages.
-<P>
-
-Each state object corresponds to a connection and can be thought of
-as an instantiation of that connection.
-At any particular time, there may be any number of state objects
-corresponding to a particular connection.
-Often there is one representing an ISAKMP SA and another representing
-an IPsec SA.
-<P>
-
-<B>KLIPS</B> hooks into the routing code in a LINUX kernel.
-Traffic to be processed by an IPsec SA must be directed through
-<B>KLIPS</B> by routing commands.  Furthermore, the processing to be
-done is specified by <I>ipsec <A HREF="eroute.8.html">eroute</A>(8)</I> commands.
-<B>pluto</B> takes the responsibility of managing both of these special
-kinds of routes.
-<P>
-
-Each connection may be routed, and must be while it has an IPsec SA.
-The connection specifies the characteristics of the route: the
-interface on this machine, the ``gateway'' (the nexthop),
-and the peer's client subnet.  Two
-connections may not be simultaneously routed if they are for the same
-peer's client subnet but use different interfaces or gateways
-(<B>pluto</B>'s logic does not reflect any advanced routing capabilities).
-<P>
-
-Each eroute is associated with the state object for an IPsec SA
-because it has the particular characteristics of the SA.
-Two eroutes conflict if they specify the identical local
-and remote clients (unlike for routes, the local clients are
-taken into account).
-<P>
-
-When <B>pluto</B> needs to install a route for a connection,
-it must make sure that no conflicting route is in use.  If another
-connection has a conflicting route, that route will be taken down, as long
-as there is no IPsec SA instantiating that connection.
-If there is such an IPsec SA, the attempt to install a route will fail.
-<P>
-
-There is an exception.  If <B>pluto</B>, as Responder, needs to install
-a route to a fixed client subnet for a connection, and there is
-already a conflicting route, then the SAs using the route are deleted
-to make room for the new SAs.  The rationale is that the new
-connection is probably more current.  The need for this usually is a
-product of Road Warrior connections (these are explained later; they
-cannot be used to initiate).
-<P>
-
-When <B>pluto</B> needs to install an eroute for an IPsec SA (for a
-state object), first the state object's connection must be routed (if
-this cannot be done, the eroute and SA will not be installed).
-If a conflicting eroute is already in place for another connection,
-the eroute and SA will not be installed (but note that the routing
-exception mentioned above may have already deleted potentially conflicting SAs).
-If another IPsec
-SA for the same connection already has an eroute, all its outgoing traffic
-is taken over by the new eroute.  The incoming traffic will still be
-processed.  This characteristic is exploited during rekeying.
-<P>
-
-All of these routing characteristics are expected change when
-<B>KLIPS</B> is modified to use the firewall hooks in the LINUX 2.4.x
-kernel.
-<A NAME="lbAL">&nbsp;</A>
-<H3>Using Whack</H3>
-
-<P>
-
-<B>whack</B> is used to command a running <B>pluto</B>.
-<B>whack</B> uses a UNIX domain socket to speak to <B>pluto</B>
-(by default, <I>/var/pluto.ctl</I>).
-<P>
-
-<B>whack</B> has an intricate argument syntax.
-This syntax allows many different functions to be specified.
-The help form shows the usage or version information.
-The connection form gives <B>pluto</B> a description of a potential connection.
-The public key form informs <B>pluto</B> of the RSA public key for a potential peer.
-The delete form deletes a connection description and all SAs corresponding
-to it.
-The listen form tells <B>pluto</B> to start or stop listening on the public interfaces
-for IKE requests from peers.
-The route form tells <B>pluto</B> to set up routing for a connection;
-the unroute form undoes this.
-The initiate form tells <B>pluto</B> to negotiate an SA corresponding to a connection.
-The terminate form tells <B>pluto</B> to remove all SAs corresponding to a connection,
-including those being negotiated.
-The status form displays the <B>pluto</B>'s internal state.
-The debug form tells <B>pluto</B> to change the selection of debugging output
-``on the fly''.  The shutdown form tells
-<B>pluto</B> to shut down, deleting all SAs.
-<P>
-
-Most options are specific to one of the forms, and will be described
-with that form.  There are three options that apply to all forms.
-<DL COMPACT>
-<DT><B>--ctlbase</B>&nbsp;<I>path</I><DD>
-<I>path</I>.ctl is used as the UNIX domain socket for talking
-to <B>pluto</B>.
-This option facilitates debugging.
-<DT><B>--optionsfrom</B>&nbsp;<I>filename</I><DD>
-adds the contents of the file to the argument list.
-<DT><B>--label</B>&nbsp;<I>string</I><DD>
-adds the string to all error messages generated by <B>whack</B>.
-</DL>
-<P>
-
-The help form of <B>whack</B> is self-explanatory.
-<DL COMPACT>
-<DT><B>--help</B><DD>
-display the usage message.
-<DT><B>--version</B><DD>
-display the version of <B>whack</B>.
-</DL>
-<P>
-
-The connection form describes a potential connection to <B>pluto</B>.
-<B>pluto</B> needs to know what connections can and should be negotiated.
-When <B>pluto</B> is the initiator, it needs to know what to propose.
-When <B>pluto</B> is the responder, it needs to know enough to decide whether
-is is willing to set up the proposed connection.
-<P>
-
-The description of a potential connection can specify a large number
-of details.  Each connection has a unique name.  This name will appear
-in a updown shell command, so it should not contain punctuation
-that would make the command ill-formed.
-<DL COMPACT>
-<DT><B>--name</B>&nbsp;<I>connection-name</I><DD>
-</DL>
-<P>
-
-The topology of
-a connection is symmetric, so to save space here is half a picture:
-<P>
-&nbsp;&nbsp;&nbsp;client_subnet&lt;--&gt;host:ikeport&lt;--&gt;nexthop&lt;---
-<P>
-A similar trick is used in the flags.  The same flag names are used for
-both ends.  Those before the <B>--to</B> flag describe the left side
-and those afterwards describe the right side.  When <B>pluto</B> attempts
-to use the connection, it decides whether it is the left side or the right
-side of the connection, based on the IP numbers of its interfaces.
-<DL COMPACT>
-<DT><B>--id</B>&nbsp;<I>id</I><DD>
-the identity of the end.  Currently, this can be an IP address (specified
-as dotted quad or as a Fully Qualified Domain Name, which will be resolved
-immediately) or as a Fully Qualified Domain Name itself (prefixed by ``@''
-to signify that it should not be resolved), or as <A HREF="mailto:user@FQDN">user@FQDN</A>, or as the
-magic value <B>%myid</B>.
-<B>Pluto</B> only authenticates the identity, and does not use it for
-addressing, so, for example, an IP address need not be the one to which
-packets are to be sent.  If the option is absent, the
-identity defaults to the IP address specified by <B>--host</B>.
-<B>%myid</B> allows the identity to be separately specified (by the <B>pluto</B> or <B>whack</B> option <B>--myid</B>
-or by the <B><A HREF="ipsec.conf.5.html">ipsec.conf</A></B>(5) <B>config setup</B> parameter myid).
-Otherwise, <B>pluto</B> tries to guess what <B>%myid</B> should stand for:
-the IP address of <B>%defaultroute</B>, if it is supported by a suitable TXT record in the reverse domain for that IP address,
-or the system's hostname, if it is supported by a suitable TXT record in its forward domain.
-
-<DT><B>--host</B>&nbsp;<I>ip-address</I><DD>
-<DT><B>--host</B>&nbsp;<B>%any</B><DD>
-<DT><B>--host</B>&nbsp;<B>%opportunistic</B><DD>
-the IP address of the end (generally the public interface).
-If <B>pluto</B> is to act as a responder
-for IKE negotiations initiated from unknown IP addresses (the
-``Road Warrior'' case), the
-IP address should be specified as <B>%any</B> (currently,
-the obsolete notation <B>0.0.0.0</B> is also accepted for this).
-If <B>pluto</B> is to opportunistically initiate the connection,
-use <B>%opportunistic</B>
-<DT><B>--ikeport</B>&nbsp;<I>port-number</I><DD>
-the UDP port that IKE listens to on that host.  The default is 500.
-(<B>pluto</B> on this machine uses the port specified by its own command
-line argument, so this only affects where <B>pluto</B> sends messages.)
-<DT><B>--nexthop</B>&nbsp;<I>ip-address</I><DD>
-where to route packets for the peer's client (presumably for the peer too,
-but it will not be used for this).
-When <B>pluto</B> installs an IPsec SA, it issues a route command.
-It uses the nexthop as the gateway.
-The default is the peer's IP address (this can be explicitly written as
-<B>%direct</B>; the obsolete notation <B>0.0.0.0</B> is accepted).
-This option is necessary if <B>pluto</B>'s host's interface used for sending
-packets to the peer is neither point-to-point nor directly connected to the
-peer.
-<DT><B>--client</B>&nbsp;<I>subnet</I><DD>
-the subnet for which the IPsec traffic will be destined.  If not specified,
-the host will be the client.
-The subnet can be specified in any of the forms supported by <I><A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A></I>(3).
-The general form is <I>address</I>/<I>mask</I>.  The <I>address</I> can be either
-a domain name or four decimal numbers (specifying octets) separated by dots.
-The most convenient form of the <I>mask</I> is a decimal integer, specifying
-the number of leading one bits in the mask.  So, for example, 10.0.0.0/8
-would specify the class A network ``Net 10''.
-<DT><B>--dnskeyondemand]</B><DD>
-specifies that when an RSA public key is needed to authenticate this
-host, and it isn't already known, fetch it from DNS.
-<DT><B>--updown</B>&nbsp;<I>updown</I><DD>
-specifies an external shell command to be run whenever <B>pluto</B>
-brings up or down a connection.
-The script is used to build a shell command, so it may contain positional
-parameters, but ought not to have punctuation that would cause the
-resulting command to be ill-formed.
-The default is <I>ipsec _updown</I>.
-<DT><B>--to</B><DD>
-separates the specification of the left and right ends of the connection.
-</DL>
-<P>
-
-The potential connection description also specifies characteristics of
-rekeying and security.
-<DL COMPACT>
-<DT><B>--psk</B><DD>
-Propose and allow preshared secret authentication for IKE peers.  This authentication
-requires that each side use the same secret.  May be combined with <B>--rsasig</B>;
-at least one must be specified.
-<DT><B>--rsasig</B><DD>
-Propose and allow RSA signatures for authentication of IKE peers.  This authentication
-requires that each side have have a private key of its own and know the
-public key of its peer.  May be combined with <B>--psk</B>;
-at least one must be specified.
-<DT><B>--encrypt</B><DD>
-All proposed or accepted IPsec SAs will include non-null ESP.
-The actual choices of transforms are wired into <B>pluto</B>.
-<DT><B>--authenticate</B><DD>
-All proposed IPsec SAs will include AH.
-All accepted IPsec SAs will include AH or ESP with authentication.
-The actual choices of transforms are wired into <B>pluto</B>.
-Note that this has nothing to do with IKE authentication.
-<DT><B>--compress</B><DD>
-All proposed IPsec SAs will include IPCOMP (compression).
-This will be ignored if KLIPS is not configured with IPCOMP support.
-<DT><B>--tunnel</B><DD>
-the IPsec SA should use tunneling.  Implicit if the SA is for clients.
-Must only be used with <B>--authenticate</B> or <B>--encrypt</B>.
-<DT><B>--ipv4</B><DD>
-The host addresses will be interpreted as IPv4 addresses.  This is the
-default.  Note that for a connection, all host addresses must be of
-the same Address Family (IPv4 and IPv6 use different Address Families).
-<DT><B>--ipv6</B><DD>
-The host addresses (including nexthop) will be interpreted as IPv6 addresses.
-Note that for a connection, all host addresses must be of
-the same Address Family (IPv4 and IPv6 use different Address Families).
-<DT><B>--tunnelipv4</B><DD>
-The client addresses will be interpreted as IPv4 addresses.  The default is
-to match what the host will be.  This does not imply <B>--tunnel</B> so the
-flag can be safely used when no tunnel is actually specified.
-Note that for a connection, all tunnel addresses must be of the same
-Address Family.
-<DT><B>--tunnelipv6</B><DD>
-The client addresses will be interpreted as IPv6 addresses.  The default is
-to match what the host will be.  This does not imply <B>--tunnel</B> so the
-flag can be safely used when no tunnel is actually specified.
-Note that for a connection, all tunnel addresses must be of the same
-Address Family.
-<DT><B>--pfs</B><DD>
-There should be Perfect Forward Secrecy - new keying material will
-be generated for each IPsec SA rather than being derived from the ISAKMP
-SA keying material.
-Since the group to be used cannot be negotiated (a dubious feature of the
-standard), <B>pluto</B> will propose the same group that was used during Phase 1.
-We don't implement a stronger form of PFS which would require that the
-ISAKMP SA be deleted after the IPSEC SA is negotiated.
-<DT><B>--disablearrivalcheck</B><DD>
-If the connection is a tunnel, allow packets arriving through the tunnel
-to have any source and destination addresses.
-</DL>
-<P>
-
-If none of the <B>--encrypt</B>, <B>--authenticate</B>, <B>--compress</B>,
-or <B>--pfs</B> flags is given, the initiating the connection will
-only build an ISAKMP SA.  For such a connection, client subnets have
-no meaning and must not be specified.
-<P>
-
-More work is needed to allow for flexible policies.  Currently
-policy is hardwired in the source file spdb.c.  The ISAKMP SAs may use
-Oakley groups MODP1024 and MODP1536; 3DES encryption; SHA1-96
-and MD5-96 authentication.  The IPsec SAs may use 3DES and
-MD5-96 or SHA1-96 for ESP, or just MD5-96 or SHA1-96 for AH.
-IPCOMP Compression is always Deflate.
-<DL COMPACT>
-<DT><B>--ikelifetime</B>&nbsp;<I>seconds</I><DD>
-how long <B>pluto</B> will propose that an ISAKMP SA be allowed to live.
-The default is 3600 (one hour) and the maximum is 28800 (8 hours).
-This option will not affect what is accepted.
-<B>pluto</B> will reject proposals that exceed the maximum.
-<DT><B>--ipseclifetime</B>&nbsp;<I>seconds</I><DD>
-how long <B>pluto</B> will propose that an IPsec SA be allowed to live.
-The default is 28800 (eight hours) and the maximum is 86400 (one day).
-This option will not affect what is accepted.
-<B>pluto</B> will reject proposals that exceed the maximum.
-<DT><B>--rekeymargin</B>&nbsp;<I>seconds</I><DD>
-how long before an SA's expiration should <B>pluto</B> try to negotiate
-a replacement SA.  This will only happen if <B>pluto</B> was the initiator.
-The default is 540 (nine minutes).
-<DT><B>--rekeyfuzz</B>&nbsp;<I>percentage</I><DD>
-maximum size of random component to add to rekeymargin, expressed as
-a percentage of rekeymargin.  <B>pluto</B> will select a delay uniformly
-distributed within this range.  By default, the percentage will be 100.
-If greater determinism is desired, specify 0.  It may be appropriate
-for the percentage to be much larger than 100.
-<DT><B>--keyingtries</B>&nbsp;<I>count</I><DD>
-how many times <B>pluto</B> should try to negotiate an SA,
-either for the first time or for rekeying.
-A value of 0 is interpreted as a very large number: never give up.
-The default is three.
-<DT><B>--dontrekey</B><DD>
-A misnomer.
-Only rekey a connection if we were the Initiator and there was recent
-traffic on the existing connection.
-This applies to Phase 1 and Phase 2.
-This is currently the only automatic way for a connection to terminate.
-It may be useful with Road Warrior or Opportunistic connections.
-<BR>
-
-Since SA lifetime negotiation is take-it-or-leave it, a Responder
-normally uses the shorter of the negotiated or the configured lifetime.
-This only works because if the lifetime is shorter than negotiated,
-the Responder will rekey in time so that everything works.
-This interacts badly with <B>--dontrekey</B>.  In this case,
-the Responder will end up rekeying to rectify a shortfall in an IPsec SA
-lifetime; for an ISAKMP SA, the Responder will accept the negotiated
-lifetime.
-<DT><B>--delete</B><DD>
-when used in the connection form, it causes any previous connection
-with this name to be deleted before this one is added.  Unlike a
-normal delete, no diagnostic is produced if there was no previous
-connection to delete.  Any routing in place for the connection is undone.
-</DL>
-<P>
-
-The delete form deletes a named connection description and any
-SAs established or negotiations initiated using this connection.
-Any routing in place for the connection is undone.
-<DL COMPACT>
-<DT><B>--delete</B><DD>
-<DT><B>--name</B>&nbsp;<I>connection-name</I><DD>
-</DL>
-<P>
-
-The deletestate form deletes the state object with the specified serial number.
-This is useful for selectively deleting instances of connections.
-<DL COMPACT>
-<DT><B>--deletestate</B>&nbsp;<I>state-number</I><DD>
-</DL>
-<P>
-
-The route form of the <B>whack</B> command tells <B>pluto</B> to set up
-routing for a connection.
-Although like a traditional route, it uses an ipsec device as a
-virtual interface.
-Once routing is set up, no packets will be
-sent ``in the clear'' to the peer's client specified in the connection.
-A TRAP shunt eroute will be installed; if outbound traffic is caught,
-Pluto will initiate the connection.
-An explicit <B>whack</B> route is not always needed: if it hasn't been
-done when an IPsec SA is being installed, one will be automatically attempted.
-<P>
-
-When a routing is attempted for a connection, there must not already
-be a routing for a different connection with the same subnet but different
-interface or destination, or if
-there is, it must not be being used by an IPsec SA.  Otherwise the
-attempt will fail.
-<DL COMPACT>
-<DT><B>--route</B><DD>
-<DT><B>--name</B>&nbsp;<I>connection-name</I><DD>
-</DL>
-<P>
-
-The unroute form of the <B>whack</B> command tells <B>pluto</B> to undo
-a routing.  <B>pluto</B> will refuse if an IPsec SA is using the connection.
-If another connection is sharing the same routing, it will be left in place.
-Without a routing, packets will be sent without encryption or authentication.
-<DL COMPACT>
-<DT><B>--unroute</B><DD>
-<DT><B>--name</B>&nbsp;<I>connection-name</I><DD>
-</DL>
-<P>
-
-The initiate form tells <B>pluto</B> to initiate a negotiation with another
-<B>pluto</B> (or other IKE daemon) according to the named connection.
-Initiation requires a route that <B>--route</B> would provide;
-if none is in place at the time an IPsec SA is being installed,
-<B>pluto</B> attempts to set one up.
-<DL COMPACT>
-<DT><B>--initiate</B><DD>
-<DT><B>--name</B>&nbsp;<I>connection-name</I><DD>
-<DT><B>--asynchronous<DD>
-</DL>
-<P>
-
-The initiate form of the whack</B> command will relay back from
-<B>pluto</B> status information via the UNIX domain socket (unless
---asynchronous is specified).  The status information is meant to
-look a bit like that from <B>FTP</B>.  Currently <B>whack</B> simply
-copies this to stderr.  When the request is finished (eg. the SAs are
-established or <B>pluto</B> gives up), <B>pluto</B> closes the channel,
-causing <B>whack</B> to terminate.
-<P>
-
-The opportunistic initiate form is mainly used for debugging.
-<DL COMPACT>
-<DT><B>--tunnelipv4</B><DD>
-<DT><B>--tunnelipv6</B><DD>
-<DT><B>--oppohere</B>&nbsp;<I>ip-address</I><DD>
-<DT><B>--oppothere</B>&nbsp;<I>ip-address</I><DD>
-</DL>
-<P>
-
-This will cause <B>pluto</B> to attempt to opportunistically initiate a
-connection from here to the there, even if a previous attempt
-had been made.
-The whack log will show the progress of this attempt.
-<P>
-
-The terminate form tells <B>pluto</B> to delete any SAs that use the specified
-connection and to stop any negotiations in process.
-It does not prevent new negotiations from starting (the delete form
-has this effect).
-<DL COMPACT>
-<DT><B>--terminate</B><DD>
-<DT><B>--name</B>&nbsp;<I>connection-name</I><DD>
-</DL>
-<P>
-
-The public key for informs <B>pluto</B> of the RSA public key for a potential peer.
-Private keys must be kept secret, so they are kept in
-<I><A HREF="ipsec.secrets.5.html">ipsec.secrets</A></I>(5).
-
-<DL COMPACT>
-<DT><B>--keyid&nbsp;</B><I>id</I><DD>
-specififies the identity of the peer for which a public key should be used.
-Its form is identical to the identity in the connection.
-If no public key is specified, <B>pluto</B> attempts to find KEY records
-from DNS for the id (if a FQDN) or through reverse lookup (if an IP address).
-Note that there several interesting ways in which this is not secure.
-<DT><B>--addkey</B><DD>
-specifies that the new key is added to the collection; otherwise the
-new key replaces any old ones.
-<DT><B>--pubkeyrsa&nbsp;</B><I>key</I><DD>
-specifies the value of the RSA public key.  It is a sequence of bytes
-as described in RFC 2537 ``RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)''.
-It is denoted in a way suitable for <I><A HREF="ipsec_ttodata.3.html">ipsec_ttodata</A></I>(3).
-For example, a base 64 numeral starts with 0s.
-</DL>
-<P>
-
-The listen form tells <B>pluto</B> to start listening for IKE requests
-on its public interfaces.  To avoid race conditions, it is normal to
-load the appropriate connections into <B>pluto</B> before allowing it
-to listen.  If <B>pluto</B> isn't listening, it is pointless to
-initiate negotiations, so it will refuse requests to do so.  Whenever
-the listen form is used, <B>pluto</B> looks for public interfaces and
-will notice when new ones have been added and when old ones have been
-removed.  This is also the trigger for <B>pluto</B> to read the
-<I>ipsec.secrets</I> file.  So listen may useful more than once.
-<DL COMPACT>
-<DT><B>--listen</B><DD>
-start listening for IKE traffic on public interfaces.
-<DT><B>--unlisten</B><DD>
-stop listening for IKE traffic on public interfaces.
-</DL>
-<P>
-
-The status form will display information about the internal state of
-<B>pluto</B>: information about each potential connection, about
-each state object, and about each shunt that <B>pluto</B> is managing
-without an associated connection.
-<DL COMPACT>
-<DT><B>--status</B><DD>
-</DL>
-<P>
-
-The shutdown form is the proper way to shut down <B>pluto</B>.
-It will tear down the SAs on this machine that <B>pluto</B> has negotiated.
-It does not inform its peers, so the SAs on their machines remain.
-<DL COMPACT>
-<DT><B>--shutdown</B><DD>
-</DL>
-<A NAME="lbAM">&nbsp;</A>
-<H3>Examples</H3>
-
-<P>
-
-It would be normal to start <B>pluto</B> in one of the system initialization
-scripts.  It needs to be run by the superuser.  Generally, no arguments are needed.
-To run in manually, the superuser can simply type
-<P>
-&nbsp;&nbsp;&nbsp;ipsec pluto
-<P>
-The command will immediately return, but a <B>pluto</B> process will be left
-running, waiting for requests from <B>whack</B> or a peer.
-<P>
-
-Using <B>whack</B>, several potential connections would be described:
-<DL COMPACT>
-<DT>
-
-&nbsp;&nbsp;&nbsp;ipsec whack --name&nbsp;silly
---host&nbsp;127.0.0.1 --to --host&nbsp;127.0.0.2
---ikelifetime&nbsp;900 --ipseclifetime&nbsp;800 --keyingtries&nbsp;3
-
-</DL>
-<P>
-
-<DD>Since this silly connection description specifies neither encryption,
-authentication, nor tunneling, it could only be used to establish
-an ISAKMP SA.
-<DL COMPACT>
-<DT>
-
-&nbsp;&nbsp;&nbsp;ipsec whack --name&nbsp;secret --host&nbsp;10.0.0.1 --client&nbsp;10.0.1.0/24
---to --host&nbsp;10.0.0.2 --client&nbsp;10.0.2.0/24
---encrypt
-
-</DL>
-<P>
-
-<DD>This is something that must be done on both sides.  If the other
-side is <B>pluto</B>, the same <B>whack</B> command could be used on it
-(the command syntax is designed to not distinguish which end is ours).
-<P>
-
-Now that the connections are specified, <B>pluto</B> is ready to handle
-requests and replies via the public interfaces.  We must tell it to discover
-those interfaces and start accepting messages from peers:
-<P>
-&nbsp;&nbsp;&nbsp;ipsec whack --listen
-<P>
-
-If we don't immediately wish to bring up a secure connection between
-the two clients, we might wish to prevent insecure traffic.
-The routing form asks <B>pluto</B> to cause the packets sent from
-our client to the peer's client to be routed through the ipsec0
-device; if there is no SA, they will be discarded:
-<P>
-&nbsp;&nbsp;&nbsp;ipsec whack --route secret
-<P>
-
-Finally, we are ready to get <B>pluto</B> to initiate negotiation
-for an IPsec SA (and implicitly, an ISAKMP SA):
-<P>
-&nbsp;&nbsp;&nbsp;ipsec whack --initiate&nbsp;--name&nbsp;secret
-<P>
-A small log of interesting events will appear on standard output
-(other logging is sent to syslog).
-<P>
-
-<B>whack</B> can also be used to terminate <B>pluto</B> cleanly, tearing down
-all SAs that it has negotiated.
-<P>
-&nbsp;&nbsp;&nbsp;ipsec whack --shutdown
-<P>
-Notification of any IPSEC SA deletion, but not ISAKMP SA deletion
-is sent to the peer.  Unfortunately, such Notification is not reliable.
-Furthermore, <B>pluto</B> itself ignores Notifications.
-<A NAME="lbAN">&nbsp;</A>
-<H3>The updown command</H3>
-
-<P>
-
-Whenever <B>pluto</B> brings a connection up or down, it invokes
-the updown command.  This command is specified using the <B>--updown</B>
-option.  This allows for customized control over routing and firewall manipulation.
-<P>
-
-The updown is invoked for five different operations.  Each of
-these operations can be for our client subnet or for our host itself.
-<DL COMPACT>
-<DT><B>prepare-host</B> or <B>prepare-client</B><DD>
-is run before bringing up a new connection if no other connection
-with the same clients is up.  Generally, this is useful for deleting a
-route that might have been set up before <B>pluto</B> was run or
-perhaps by some agent not known to <B>pluto</B>.
-<DT><B>route-host</B> or <B>route-client</B><DD>
-is run when bringing up a connection for a new peer client subnet
-(even if <B>prepare-host</B> or <B>prepare-client</B> was run).  The
-command should install a suitable route.  Routing decisions are based
-only on the destination (peer's client) subnet address, unlike eroutes
-which discriminate based on source too.
-<DT><B>unroute-host</B> or <B>unroute-client</B><DD>
-is run when bringing down the last connection for a particular peer
-client subnet.  It should undo what the <B>route-host</B> or <B>route-client</B>
-did.
-<DT><B>up-host</B> or <B>up-client</B><DD>
-is run when bringing up a tunnel eroute with a pair of client subnets
-that does not already have a tunnel eroute.
-This command should install firewall rules as appropriate.
-It is generally a good idea to allow IKE messages (UDP port 500)
-travel between the hosts.
-<DT><B>down-host</B> or <B>down-client</B><DD>
-is run when bringing down the eroute for a pair of client subnets.
-This command should delete firewall rules as appropriate.  Note that
-there may remain some inbound IPsec SAs with these client subnets.
-</DL>
-<P>
-
-The script is passed a large number of environment variables to specify
-what needs to be done.
-<DL COMPACT>
-<DT><B>PLUTO_VERSION</B><DD>
-indicates what version of this interface is being used.  This document
-describes version 1.1.  This is upwardly compatible with version 1.0.
-<DT><B>PLUTO_VERB</B><DD>
-specifies the name of the operation to be performed
-(<B>prepare-host</B>,r <B>prepare-client</B>,
-<B>up-host</B>, <B>up-client</B>,
-<B>down-host</B>, or <B>down-client</B>).  If the address family for
-security gateway to security gateway communications is IPv6, then
-a suffix of -v6 is added to the verb.
-<DT><B>PLUTO_CONNECTION</B><DD>
-is the name of the connection for which we are routing.
-<DT><B>PLUTO_NEXT_HOP</B><DD>
-is the next hop to which packets bound for the peer must be sent.
-<DT><B>PLUTO_INTERFACE</B><DD>
-is the name of the ipsec interface to be used.
-<DT><B>PLUTO_ME</B><DD>
-is the IP address of our host.
-<DT><B>PLUTO_MY_CLIENT</B><DD>
-is the IP address / count of our client subnet.
-If the client is just the host, this will be the host's own IP address / max
-(where max is 32 for IPv4 and 128 for IPv6).
-<DT><B>PLUTO_MY_CLIENT_NET</B><DD>
-is the IP address of our client net.
-If the client is just the host, this will be the host's own IP address.
-<DT><B>PLUTO_MY_CLIENT_MASK</B><DD>
-is the mask for our client net.
-If the client is just the host, this will be 255.255.255.255.
-<DT><B>PLUTO_PEER</B><DD>
-is the IP address of our peer.
-<DT><B>PLUTO_PEER_CLIENT</B><DD>
-is the IP address / count of the peer's client subnet.
-If the client is just the peer, this will be the peer's own IP address / max
-(where max is 32 for IPv4 and 128 for IPv6).
-<DT><B>PLUTO_PEER_CLIENT_NET</B><DD>
-is the IP address of the peer's client net.
-If the client is just the peer, this will be the peer's own IP address.
-<DT><B>PLUTO_PEER_CLIENT_MASK</B><DD>
-is the mask for the peer's client net.
-If the client is just the peer, this will be 255.255.255.255.
-</DL>
-<P>
-
-All output sent by the script to stderr or stdout is logged.  The
-script should return an exit status of 0 if and only if it succeeds.
-<P>
-
-<B>Pluto</B> waits for the script to finish and will not do any other
-processing while it is waiting.
-The script may assume that <B>pluto</B> will not change anything
-while the script runs.
-The script should avoid doing anything that takes much time and it
-should not issue any command that requires processing by <B>pluto</B>.
-Either of these activities could be performed by a background
-subprocess of the script.
-<A NAME="lbAO">&nbsp;</A>
-<H3>Rekeying</H3>
-
-<P>
-
-When an SA that was initiated by <B>pluto</B> has only a bit of
-lifetime left,
-<B>pluto</B> will initiate the creation of a new SA.  This applies to
-ISAKMP and IPsec SAs.
-The rekeying will be initiated when the SA's remaining lifetime is
-less than the rekeymargin plus a random percentage, between 0 and
-rekeyfuzz, of the rekeymargin.
-<P>
-
-Similarly, when an SA that was initiated by the peer has only a bit of
-lifetime left, <B>pluto</B> will try to initiate the creation of a
-replacement.
-To give preference to the initiator, this rekeying will only be initiated
-when the SA's remaining lifetime is half of rekeymargin.
-If rekeying is done by the responder, the roles will be reversed: the
-responder for the old SA will be the initiator for the replacement.
-The former initiator might also initiate rekeying, so there may
-be redundant SAs created.
-To avoid these complications, make sure that rekeymargin is generous.
-<P>
-
-One risk of having the former responder initiate is that perhaps
-none of its proposals is acceptable to the former initiator
-(they have not been used in a successful negotiation).
-To reduce the chances of this happening, and to prevent loss of security,
-the policy settings are taken from the old SA (this is the case even if
-the former initiator is initiating).
-These may be stricter than those of the connection.
-<P>
-
-<B>pluto</B> will not rekey an SA if that SA is not the most recent of its
-type (IPsec or ISAKMP) for its potential connection.
-This avoids creating redundant SAs.
-<P>
-
-The random component in the rekeying time (rekeyfuzz) is intended to
-make certain pathological patterns of rekeying unstable.  If both
-sides decide to rekey at the same time, twice as many SAs as necessary
-are created.  This could become a stable pattern without the
-randomness.
-<P>
-
-Another more important case occurs when a security gateway has SAs
-with many other security gateways.  Each of these connections might
-need to be rekeyed at the same time.  This would cause a high peek
-requirement for resources (network bandwidth, CPU time, entropy for
-random numbers).  The rekeyfuzz can be used to stagger the rekeying
-times.
-<P>
-
-Once a new set of SAs has been negotiated, <B>pluto</B> will never send
-traffic on a superseded one.  Traffic will be accepted on an old SA
-until it expires.
-<A NAME="lbAP">&nbsp;</A>
-<H3>Selecting a Connection When Responding: Road Warrior Support</H3>
-
-<P>
-
-When <B>pluto</B> receives an initial Main Mode message, it needs to
-decide which connection this message is for.  It picks based solely on
-the source and destination IP addresses of the message.  There might
-be several connections with suitable IP addresses, in which case one
-of them is arbitrarily chosen.  (The ISAKMP SA proposal contained in
-the message could be taken into account, but it is not.)
-<P>
-
-The ISAKMP SA is negotiated before the parties pass further
-identifying information, so all ISAKMP SA characteristics specified in
-the connection description should be the same for every connection
-with the same two host IP addresses.  At the moment, the only
-characteristic that might differ is authentication method.
-<P>
-
-Up to this point,
-all configuring has presumed that the IP addresses
-are known to all parties ahead of time.  This will not work
-when either end is mobile (or assigned a dynamic IP address for other
-reasons).  We call this situation ``Road Warrior''.  It is fairly tricky
-and has some important limitations, most of which are features of
-the IKE protocol.
-<P>
-
-Only the initiator may be mobile:
-the initiator may have an IP number unknown to the responder.  When
-the responder doesn't recognize the IP address on the first Main Mode
-packet, it looks for a connection with itself as one end and <B>%any</B>
-as the other.
-If it cannot find one, it refuses to negotiate.  If it
-does find one, it creates a temporary connection that is a duplicate
-except with the <B>%any</B> replaced by the source IP address from the
-packet; if there was no identity specified for the peer, the new IP
-address will be used.
-<P>
-
-When <B>pluto</B> is using one of these temporary connections and
-needs to find the preshared secret or RSA private key in <I>ipsec.secrets</I>,
-and and the connection specified no identity for the peer, <B>%any</B>
-is used as its identity.  After all, the real IP address was apparently
-unknown to the configuration, so it is unreasonable to require that
-it be used in this table.
-<P>
-
-Part way into the Phase 1 (Main Mode) negotiation using one of these
-temporary connection descriptions, <B>pluto</B> will be receive an
-Identity Payload.  At this point, <B>pluto</B> checks for a more
-appropriate connection, one with an identity for the peer that matches
-the payload but which would use the same keys so-far used for
-authentication.  If it finds one, it will switch to using this better
-connection (or a temporary derived from this, if it has <B>%any</B>
-for the peer's IP address).  It may even turn out that no connection
-matches the newly discovered identity, including the current connection;
-if so, <B>pluto</B> terminates negotiation.
-<P>
-
-Unfortunately, if preshared secret authentication is being used, the
-Identity Payload is encrypted using this secret, so the secret must be
-selected by the responder without knowing this payload.  This
-limits there to being at most one preshared secret for all Road Warrior
-systems connecting to a host.  RSA Signature authentications does not
-require that the responder know how to select the initiator's public key
-until after the initiator's Identity Payload is decoded (using the
-responder's private key, so that must be preselected).
-<P>
-
-When <B>pluto</B> is responding to a Quick Mode negotiation via one of these
-temporary connection descriptions, it may well find that the subnets
-specified by the initiator don't match those in the temporary
-connection description.  If so, it will look for a connection with
-matching subnets, its own host address, a peer address of <B>%any</B>
-and matching identities.
-If it finds one, a new temporary connection is derived from this one
-and used for the Quick Mode negotiation of IPsec SAs.  If it does not
-find one, <B>pluto</B> terminates negotiation.
-<P>
-
-Be sure to specify an appropriate nexthop for the responder
-to send a message to the initiator: <B>pluto</B> has no way of guessing
-it (if forwarding isn't required, use an explicit <B>%direct</B> as the nexthop
-and the IP address of the initiator will be filled in; the obsolete
-notation <B>0.0.0.0</B> is still accepted).
-<P>
-
-<B>pluto</B> has no special provision for the initiator side.  The current
-(possibly dynamic) IP address and nexthop must be used in defining
-connections.  These must be
-properly configured each time the initiator's IP address changes.
-<B>pluto</B> has no mechanism to do this automatically.
-<P>
-
-Although we call this Road Warrior Support, it could also be used to
-support encrypted connections with anonymous initiators.  The
-responder's organization could announce the preshared secret that would be used
-with unrecognized initiators and let anyone connect.  Of course the initiator's
-identity would not be authenticated.
-<P>
-
-If any Road Warrior connections are supported, <B>pluto</B> cannot
-reject an exchange initiated by an unknown host until it has
-determined that the secret is not shared or the signature is invalid.
-This must await the
-third Main Mode message from the initiator.  If no Road Warrior
-connection is supported, the first message from an unknown source
-would be rejected.  This has implications for ease of debugging
-configurations and for denial of service attacks.
-<P>
-
-Although a Road Warrior connection must be initiated by the mobile
-side, the other side can and will rekey using the temporary connection
-it has created.  If the Road Warrior wishes to be able to disconnect,
-it is probably wise to set <B>--keyingtries</B> to 1 in the
-connection on the non-mobile side to prevent it trying to rekey the
-connection.  Unfortunately, there is no mechanism to unroute the
-connection automatically.
-<A NAME="lbAQ">&nbsp;</A>
-<H3>Debugging</H3>
-
-<P>
-
-<B>pluto</B> accepts several optional arguments, useful mostly for debugging.
-Except for <B>--interface</B>, each should appear at most once.
-<DL COMPACT>
-<DT><B>--interface</B> <I>interfacename</I><DD>
-specifies that the named real public network interface should be considered.
-The interface name specified should not be <B>ipsec</B><I>N</I>.
-If the option doesn't appear, all interfaces are considered.
-To specify several interfaces, use the option once for each.
-One use of this option is to specify which interface should be used
-when two or more share the same IP address.
-<DT><B>--ikeport</B> <I>port-number</I><DD>
-changes the UDP port that <B>pluto</B> will use
-(default, specified by IANA: 500)
-<DT><B>--ctlbase</B> <I>path</I><DD>
-basename for control files.
-<I>path</I>.ctl is the socket through which <B>whack</B> communicates with
-<B>pluto</B>.
-<I>path</I>.pid is the lockfile to prevent multiple <B>pluto</B> instances.
-The default is <I>/var/run/pluto</I>).
-<DT><B>--secretsfile</B> <I>file</I><DD>
-specifies the file for authentication secrets
-(default: <I>/etc/ipsec.secrets</I>).
-This name is subject to ``globbing'' as in <I><A HREF="sh.1.html">sh</A></I>(1),
-so every file with a matching name is processed.
-Quoting is generally needed to prevent the shell from doing the globbing.
-<DT><B>--adns</B> <I>pathname</I><DD>
-<DT><B>--lwdnsq</B> <I>pathname</I><DD>
-specifies where to find <B>pluto</B>'s helper program for asynchronous DNS lookup.
-<B>pluto</B> can be built to use one of two helper programs: <B>_pluto_adns</B>
-or <B>lwdnsq</B>.  You must use the program for which it was built.
-By default, <B>pluto</B> will look for the program in
-<B>$IPSEC_DIR</B> (if that environment variable is defined) or, failing that,
-in the same directory as <B>pluto</B>.
-<DT><B>--nofork</B><DD>
-disable ``daemon fork'' (default is to fork).  In addition, after the
-lock file and control socket are created, print the line ``Pluto
-initialized'' to standard out.
-<DT><B>--noklips</B><DD>
-don't actually implement negotiated IPsec SAs
-<DT><B>--uniqueids</B><DD>
-if this option has been selected, whenever a new ISAKMP SA is
-established, any connection with the same Peer ID but a different
-Peer IP address is unoriented (causing all its SAs to be deleted).
-This helps clean up dangling SAs when a connection is lost and
-then regained at another IP address.
-<DT><B>--stderrlog</B><DD>
-log goes to standard out {default is to use <I><A HREF="syslogd.8.html">syslogd</A></I>(8))
-</DL>
-<P>
-
-For example
-<DL COMPACT>
-<DT>pluto --secretsfile&nbsp;ipsec.secrets --ctlbase&nbsp;pluto.base --ikeport&nbsp;8500 --nofork --noklips --stderrlog<DD>
-</DL>
-<P>
-
-lets one test <B>pluto</B> without using the superuser account.
-<P>
-
-<B>pluto</B> is willing to produce a prodigious amount of debugging
-information.  To do so, it must be compiled with -DDEBUG.  There are
-several classes of debugging output, and <B>pluto</B> may be directed to
-produce a selection of them.  All lines of
-debugging output are prefixed with ``|&nbsp;'' to distinguish them from error
-messages.
-<P>
-
-When <B>pluto</B> is invoked, it may be given arguments to specify
-which classes to output.  The current options are:
-<DL COMPACT>
-<DT><B>--debug-raw</B><DD>
-show the raw bytes of messages
-<DT><B>--debug-crypt</B><DD>
-show the encryption and decryption of messages
-<DT><B>--debug-parsing</B><DD>
-show the structure of input messages
-<DT><B>--debug-emitting</B><DD>
-show the structure of output messages
-<DT><B>--debug-control</B><DD>
-show <B>pluto</B>'s decision making
-<DT><B>--debug-lifecycle</B><DD>
-[this option is temporary] log more detail of lifecycle of SAs
-<DT><B>--debug-klips</B><DD>
-show <B>pluto</B>'s interaction with <B>KLIPS</B>
-<DT><B>--debug-dns</B><DD>
-show <B>pluto</B>'s interaction with <B>DNS</B> for KEY and TXT records
-<DT><B>--debug-oppo</B><DD>
-show why <B>pluto</B> didn't find a suitable DNS TXT record to authorize opportunistic initiation
-<DT><B>--debug-all</B><DD>
-all of the above
-<DT><B>--debug-private</B><DD>
-allow debugging output with private keys.
-<DT><B>--debug-none</B><DD>
-none of the above
-</DL>
-<P>
-
-The debug form of the
-<B>whack</B> command will change the selection in a running
-<B>pluto</B>.
-If a connection name is specified, the flags are added whenever
-<B>pluto</B> has identified that it is dealing with that connection.
-Unfortunately, this is often part way into the operation being observed.
-<P>
-
-For example, to start a <B>pluto</B> with a display of the structure of input
-and output:
-<DL COMPACT>
-<DT><DD>
-pluto --debug-emitting --debug-parsing
-</DL>
-<P>
-
-To later change this <B>pluto</B> to only display raw bytes:
-<DL COMPACT>
-<DT><DD>
-whack --debug-raw
-</DL>
-<P>
-
-For testing, SSH's IKE test page is quite useful:
-<DL COMPACT>
-<DT><DD>
-<I><A HREF="http://isakmp-test.ssh.fi/">http://isakmp-test.ssh.fi/</A></I>
-</DL>
-<P>
-
-Hint: ISAKMP SAs are often kept alive by IKEs even after the IPsec SA
-is established.  This allows future IPsec SA's to be negotiated
-directly.  If one of the IKEs is restarted, the other may try to use
-the ISAKMP SA but the new IKE won't know about it.  This can lead to
-much confusion.  <B>pluto</B> is not yet smart enough to get out of such a
-mess.
-<A NAME="lbAR">&nbsp;</A>
-<H3>Pluto's Behaviour When Things Go Wrong</H3>
-
-<P>
-
-When <B>pluto</B> doesn't understand or accept a message, it just
-ignores the message.  It is not yet capable of communicating the
-problem to the other IKE daemon (in the future it might use
-Notifications to accomplish this in many cases).  It does log a diagnostic.
-<P>
-
-When <B>pluto</B> gets no response from a message, it resends the same
-message (a message will be sent at most three times).  This is
-appropriate: UDP is unreliable.
-<P>
-
-When pluto gets a message that it has already seen, there are many
-cases when it notices and discards it.  This too is appropriate for UDP.
-<P>
-
-Combine these three rules, and you can explain many apparently
-mysterious behaviours.  In a <B>pluto</B> log, retrying isn't usually the
-interesting event.  The critical thing is either earlier (<B>pluto</B>
-got a message which it didn't like and so ignored, so it was still
-awaiting an acceptable message and got impatient) or on the other
-system (<B>pluto</B> didn't send a reply because it wasn't happy with
-the previous message).
-<A NAME="lbAS">&nbsp;</A>
-<H3>Notes</H3>
-
-<P>
-
-If <B>pluto</B> is compiled without -DKLIPS, it negotiates Security
-Associations but never ask the kernel to put them in place and never
-makes routing changes.  This allows <B>pluto</B> to be tested on systems
-without <B>KLIPS</B>, but makes it rather useless.
-<P>
-
-Each IPsec SA is assigned an SPI, a 32-bit number used to refer to the SA.
-The IKE protocol lets the destination of the SA choose the SPI.
-The range 0 to 0xFF is reserved for IANA.
-<B>Pluto</B> also avoids choosing an SPI in the range 0x100 to 0xFFF,
-leaving these SPIs free for manual keying.
-Remember that the peer, if not <B>pluto</B>, may well chose
-SPIs in this range.
-<A NAME="lbAT">&nbsp;</A>
-<H3>Policies</H3>
-
-<P>
-
-This catalogue of policies may be of use when trying to configure
-<B>Pluto</B> and another IKE implementation to interoperate.
-<P>
-
-In Phase 1, only Main Mode is supported.  We are not sure that
-Aggressive Mode is secure.  For one thing, it does not support
-identity protection.  It may allow more severe Denial Of Service
-attacks.
-<P>
-
-No Informational Exchanges are supported.  These are optional and
-since their delivery is not assured, they must not matter.
-It is the case that some IKE implementations won't interoperate
-without Informational Exchanges, but we feel they are broken.
-<P>
-
-No Informational Payloads are supported.  These are optional, but
-useful.  It is of concern that these payloads are not authenticated in
-Phase 1, nor in those Phase 2 messages authenticated with <A HREF="HASH.3.html">HASH</A>(3).
-<DL COMPACT>
-<DT>*<DD>
-Diffie Hellman Groups MODP 1024 and MODP 1536 (2 and 5)
-are supported.
-Group MODP768 (1) is not supported because it is too weak.
-<DT>*<DD>
-Host authetication can be done by RSA Signatures or Pre-Shared
-Secrets.
-<DT>*<DD>
-3DES CBC (Cypher Block Chaining mode) is the only encryption
-supported, both for ISAKMP SAs and IPSEC SAs.
-<DT>*<DD>
-MD5 and SHA1 hashing are supported for packet authentication in both
-kinds of SAs.
-<DT>*<DD>
-The ESP, AH, or AH plus ESP are supported.  If, and only if, AH and
-ESP are combined, the ESP need not have its own authentication
-component.  The selection is controlled by the --encrypt and
---authenticate flags.
-<DT>*<DD>
-Each of these may be combined with IPCOMP Deflate compression,
-but only if the potential connection specifies compression and only
-if KLIPS is configured with IPCOMP support.
-<DT>*<DD>
-The IPSEC SAs may be tunnel or transport mode, where appropriate.
-The --tunnel flag controls this when <B>pluto</B> is initiating.
-<DT>*<DD>
-When responding to an ISAKMP SA proposal, the maximum acceptable
-lifetime is eight hours.  The default is one hour.  There is no
-minimum.  The --ikelifetime flag controls this when <B>pluto</B>
-is initiating.
-<DT>*<DD>
-When responding to an IPSEC SA proposal, the maximum acceptable
-lifetime is one day.  The default is eight hours.  There is no
-minimum.  The --ipseclifetime flag controls this when <B>pluto</B>
-is initiating.
-<DT>*<DD>
-PFS is acceptable, and will be proposed if the --pfs flag was
-specified.  The DH group proposed will be the same as negotiated for
-Phase 1.
-</DL>
-<A NAME="lbAU">&nbsp;</A>
-<H2>SIGNALS</H2>
-
-<P>
-
-<B>Pluto</B> responds to <B>SIGHUP</B> by issuing a suggestion that ``<B>whack</B>
---listen'' might have been intended.
-<P>
-
-<B>Pluto</B> exits when it recieves <B>SIGTERM</B>.
-<A NAME="lbAV">&nbsp;</A>
-<H2>EXIT STATUS</H2>
-
-<P>
-
-<B>pluto</B> normally forks a daemon process, so the exit status is
-normally a very preliminary result.
-<DL COMPACT>
-<DT>0<DD>
-means that all is OK so far.
-<DT>1<DD>
-means that something was wrong.
-<DT>10<DD>
-means that the lock file already exists.
-</DL>
-<P>
-
-If <B>whack</B> detects a problem, it will return an exit status of 1.
-If it received progress messages from <B>pluto</B>, it returns as status
-the value of the numeric prefix from the last such message
-that was not a message sent to syslog or a comment
-(but the prefix for success is treated as 0).
-Otherwise, the exit status is 0.
-<A NAME="lbAW">&nbsp;</A>
-<H2>FILES</H2>
-
-<I>/var/run/pluto.pid</I>
-<BR>
-
-<I>/var/run/pluto.ctl</I>
-<BR>
-
-<I>/etc/ipsec.secrets</I>
-<BR>
-
-<I>$IPSEC_LIBDIR/_pluto_adns</I>
-<BR>
-
-<I>$IPSEC_EXECDIR/lwdnsq</I>
-<BR>
-
-<I>/dev/urandom</I>
-<A NAME="lbAX">&nbsp;</A>
-<H2>ENVIRONMENT</H2>
-
-<I>IPSEC_LIBDIR</I>
-<BR>
-
-<I>IPSEC_EXECDIR</I>
-<BR>
-
-<I>IPSECmyid</I>
-<A NAME="lbAY">&nbsp;</A>
-<H2>SEE ALSO</H2>
-
-<P>
-
-The rest of the FreeS/WAN distribution, in particular <I><A HREF="ipsec.8.html">ipsec</A></I>(8).
-<P>
-
-<I><A HREF="ipsec_auto.8.html">ipsec_auto</A></I>(8) is designed to make using <B>pluto</B> more pleasant.
-Use it!
-<P>
-
-<I><A HREF="ipsec.secrets.5.html">ipsec.secrets</A></I>(5)
-
-describes the format of the secrets file.
-<P>
-
-<I><A HREF="ipsec_atoaddr.3.html">ipsec_atoaddr</A></I>(3), part of the FreeS/WAN distribution, describes the
-forms that IP addresses may take.
-<I><A HREF="ipsec_atosubnet.3.html">ipsec_atosubnet</A></I>(3), part of the FreeS/WAN distribution, describes the
-forms that subnet specifications.
-<P>
-
-For more information on IPsec, the mailing list, and the relevant
-documents, see:
-<DL COMPACT>
-<DT><DD>
-
-<I><A HREF="http://www.ietf.cnri.reston.va.us/html.charters/ipsec-charter.html">http://www.ietf.cnri.reston.va.us/html.charters/ipsec-charter.html</A></I>
-
-</DL>
-<P>
-
-At the time of writing, the most relevant IETF RFCs are:
-<DL COMPACT>
-<DT><DD>
-RFC2409 The Internet Key Exchange (IKE)
-<DT><DD>
-RFC2408 Internet Security Association and Key Management Protocol (ISAKMP)
-<DT><DD>
-RFC2407 The Internet IP Security Domain of Interpretation for ISAKMP
-</DL>
-<P>
-
-The FreeS/WAN web site &lt;<A HREF="htp://www.freeswan.org">htp://www.freeswan.org</A>&gt;
-and the mailing lists described there.
-<A NAME="lbAZ">&nbsp;</A>
-<H2>HISTORY</H2>
-
-This code is released under the GPL terms.
-See the accompanying file COPYING-2.0 for more details.
-The GPL does NOT apply to those pieces of code written by others
-which are included in this distribution, except as noted by the
-individual authors.
-<P>
-
-This software was originally written
-for the FreeS/WAN project
-&lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
-by Angelos D. Keromytis
-(<A HREF="mailto:angelos@dsl.cis.upenn.edu">angelos@dsl.cis.upenn.edu</A>), in May/June 1997, in Athens, Greece.
-Thanks go to John Ioannidis for his help.
-<P>
-
-It is currently (2000)
-being developed and maintained by D. Hugh Redelmeier
-(<A HREF="mailto:hugh@mimosa.com">hugh@mimosa.com</A>), in Canada.  The regulations of Greece and Canada
-allow us to make the code freely redistributable.
-<P>
-
-Kai Martius (<A HREF="mailto:admin@imib.med.tu-dresden.de">admin@imib.med.tu-dresden.de</A>) contributed the initial
-version of the code supporting PFS.
-<P>
-
-Richard Guy Briggs &lt;<A HREF="mailto:rgb@conscoop.ottawa.on.ca">rgb@conscoop.ottawa.on.ca</A>&gt; and Peter Onion
-&lt;<A HREF="mailto:ponion@srd.bt.co.uk">ponion@srd.bt.co.uk</A>&gt; added the PFKEY2 support.
-<P>
-
-We gratefully acknowledge that we use parts of Eric Young's <I>libdes</I>
-package; see <I>../libdes/COPYRIGHT</I>.
-<A NAME="lbBA">&nbsp;</A>
-<H2>BUGS</H2>
-
-<B>pluto</B>
-
-is a work-in-progress.  It currently has many limitations.
-For example, it ignores notification messages that it receives, and
-it generates only Delete Notifications and those only for IPSEC SAs.
-<P>
-
-<B>pluto</B> does not support the Commit Flag.
-The Commit Flag is a bad feature of the IKE protocol.
-It isn't protected -- neither encrypted nor authenticated.
-A man in the middle could turn it on, leading to DoS.
-We just ignore it, with a warning.
-This should let us interoperate with
-implementations that insist on it, with minor damage.
-<P>
-
-<B>pluto</B> does not check that the SA returned by the Responder
-is actually one that was proposed.  It only checks that the SA is
-acceptable.  The difference is not large, but can show up in attributes
-such as SA lifetime.
-<P>
-
-There is no good way for a connection to be automatically terminated.
-This is a problem for Road Warrior and Opportunistic connections.
-The <B>--dontrekey</B> option does prevent the SAs from
-being rekeyed on expiry.
-Additonally, if a Road Warrior connection has a client subnet with a fixed IP
-address, a negotiation with that subnet will cause any other
-connection instantiations with that same subnet to be unoriented
-(deleted, in effect).
-See also the --uniqueids option for an extension of this.
-<P>
-
-When <B>pluto</B> sends a message to a peer that has disappeared,
-<B>pluto</B> receives incomplete information from the kernel, so it
-logs the unsatisfactory message ``some IKE message we sent has been
-rejected with ECONNREFUSED (kernel supplied no details)''.  John
-Denker suggests that this command is useful for tracking down the
-source of these problems:
-<BR>
-
-<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>tcpdump -i eth0 icmp[0] != 8 and icmp[0] != 0<BR>
-<BR>
-
-Substitute your public interface for eth0 if it is different.
-<P>
-
-The word ``authenticate'' is used for two different features.  We must
-authenticate each IKE peer to the other.  This is an important task of
-Phase 1.  Each packet must be authenticated, both in IKE and in IPsec,
-and the method for IPsec is negotiated as an AH SA or part of an ESP SA.
-Unfortunately, the protocol has no mechanism for authenticating the Phase 2
-identities.
-<P>
-
-Bugs should be reported to the &lt;<A HREF="mailto:users@lists.freeswan.org">users@lists.freeswan.org</A>&gt; mailing list.
-Caution: we cannot accept
-actual code from US residents, or even US citizens living outside the
-US, because that would bring FreeS/WAN under US export law.  Some
-other countries cause similar problems.  In general, we would prefer
-that you send detailed problem reports rather than code:  we want
-FreeS/WAN to be unquestionably freely exportable, which means being
-very careful about where the code comes from, and for a small bug fix,
-that is often more time-consuming than just reinventing the fix
-ourselves.
-<P>
-
-<HR>
-<A NAME="index">&nbsp;</A><H2>Index</H2>
-<DL>
-<DT><A HREF="#lbAB">NAME</A><DD>
-<DT><A HREF="#lbAC">SYNOPSIS</A><DD>
-<DT><A HREF="#lbAD">DESCRIPTION</A><DD>
-<DL>
-<DT><A HREF="#lbAE">IKE's Job</A><DD>
-<DT><A HREF="#lbAF">Pluto</A><DD>
-<DT><A HREF="#lbAG">Before Running Pluto</A><DD>
-<DT><A HREF="#lbAH">Setting up <B>KLIPS</B> for <B>pluto</B></A><DD>
-<DT><A HREF="#lbAI">ipsec.secrets file</A><DD>
-<DT><A HREF="#lbAJ">Running Pluto</A><DD>
-<DT><A HREF="#lbAK">Pluto's Internal State</A><DD>
-<DT><A HREF="#lbAL">Using Whack</A><DD>
-<DT><A HREF="#lbAM">Examples</A><DD>
-<DT><A HREF="#lbAN">The updown command</A><DD>
-<DT><A HREF="#lbAO">Rekeying</A><DD>
-<DT><A HREF="#lbAP">Selecting a Connection When Responding: Road Warrior Support</A><DD>
-<DT><A HREF="#lbAQ">Debugging</A><DD>
-<DT><A HREF="#lbAR">Pluto's Behaviour When Things Go Wrong</A><DD>
-<DT><A HREF="#lbAS">Notes</A><DD>
-<DT><A HREF="#lbAT">Policies</A><DD>
-</DL>
-<DT><A HREF="#lbAU">SIGNALS</A><DD>
-<DT><A HREF="#lbAV">EXIT STATUS</A><DD>
-<DT><A HREF="#lbAW">FILES</A><DD>
-<DT><A HREF="#lbAX">ENVIRONMENT</A><DD>
-<DT><A HREF="#lbAY">SEE ALSO</A><DD>
-<DT><A HREF="#lbAZ">HISTORY</A><DD>
-<DT><A HREF="#lbBA">BUGS</A><DD>
-</DL>
-<HR>
-This document was created by
-<A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
-using the manual pages.<BR>
-Time: 21:40:18 GMT, November 11, 2003
-</BODY>
-</HTML>
diff --git a/doc/manpages.html b/doc/manpages.html
deleted file mode 100644
index 81ca11ae0..000000000
--- a/doc/manpages.html
+++ /dev/null
@@ -1,145 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="faq.html">Previous</A>
-<A HREF="firewall.html">Next</A>
-<HR>
-<H1><A name="manpages">FreeS/WAN manual pages</A></H1>
-<P>The various components of Linux FreeS/WAN are of course documented in
- standard Unix manual pages, accessible via the man(1) command.</P>
-<P>Links here take you to an HTML version of the man pages.</P>
-<H2><A name="man.file">Files</A></H2>
-<DL>
-<DT><A href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A></DT>
-<DD>IPsec configuration and connections</DD>
-<DT><A href="manpage.d/ipsec.secrets.5.html">ipsec.secrets(5)</A></DT>
-<DD>secrets for IKE authentication, either pre-shared keys or RSA
- private keys</DD>
-</DL>
-<P>These files are also discussed in the<A href="config.html">
- configuration</A> section.</P>
-<H2><A name="man.command">Commands</A></H2>
-<P>Many users will never give most of the FreeS/WAN commands directly.
- Configure the files listed above correctly and everything should be
- automatic.</P>
-<P>The exceptions are commands for mainpulating the<A href="glossary.html#RSA">
- RSA</A> keys used in Pluto authentication:</P>
-<DL>
-<DT><A href="manpage.d/ipsec_rsasigkey.8.html">ipsec_rsasigkey(8)</A></DT>
-<DD>generate keys</DD>
-<DT><A href="manpage.d/ipsec_newhostkey.8.html">ipsec_newhostkey(8)</A></DT>
-<DD>generate keys in a convenient format</DD>
-<DT><A href="manpage.d/ipsec_showhostkey.8.html">ipsec_showhostkey(8)</A>
-</DT>
-<DD>extract<A href="glossary.html#RSA"> RSA</A> keys from<A href="manpage.d/ipsec.secrets.5.html">
- ipsec.secrets(5)</A> (or optionally, another file) and format them for
- insertion in<A href="manpage.d/ipsec.conf.5.html"> ipsec.conf(5)</A> or
- in DNS records</DD>
-</DL>
-<P>Note that:</P>
-<UL>
-<LI>These keys are for<STRONG> authentication only</STRONG>. They are<STRONG>
- not secure for encryption</STRONG>.</LI>
-<LI>The utility uses random(4) as a source of<A href="glossary.html#random">
- random numbers</A>. This may block for some time if there is not enough
- activity on the machine to provide the required entropy. You may want
- to give it some bogus activity such as random mouse movements or some
- command such as<NOBR> <TT>du /usr &gt; /dev/null &amp;</TT>.</LI>
-</UL>
-<P>The following commands are fairly likely to be used, if only for
- testing and status checks:</P>
-<DL>
-<DT><A href="manpage.d/ipsec.8.html">ipsec(8)</A></DT>
-<DD>invoke IPsec utilities</DD>
-<DT><A href="manpage.d/ipsec_setup.8.html">ipsec_setup(8)</A></DT>
-<DD>control IPsec subsystem</DD>
-<DT><A href="manpage.d/ipsec_auto.8.html">ipsec_auto(8)</A></DT>
-<DD>control automatically-keyed IPsec connections</DD>
-<DT><A href="manpage.d/ipsec_manual.8.html">ipsec_manual(8)</A></DT>
-<DD>take manually-keyed IPsec connections up and down</DD>
-<DT><A href="manpage.d/ipsec_ranbits.8.html">ipsec_ranbits(8)</A></DT>
-<DD>generate random bits in ASCII form</DD>
-<DT><A href="manpage.d/ipsec_look.8.html">ipsec_look(8)</A></DT>
-<DD>show minimal debugging information</DD>
-<DT><A href="manpage.d/ipsec_barf.8.html">ipsec_barf(8)</A></DT>
-<DD>spew out collected IPsec debugging information</DD>
-</DL>
-<P>The lower-level utilities listed below are normally invoked via
- scripts listed above, but they can also be used directly when required.</P>
-<DL>
-<DT><A href="manpage.d/ipsec_eroute.8.html">ipsec_eroute(8)</A></DT>
-<DD>manipulate IPsec extended routing tables</DD>
-<DT><A href="manpage.d/ipsec_klipsdebug.8.html">ipsec_klipsdebug(8)</A></DT>
-<DD>set Klips (kernel IPsec support) debug features and level</DD>
-<DT><A href="manpage.d/ipsec_pluto.8.html">ipsec_pluto(8)</A></DT>
-<DD>IPsec IKE keying daemon</DD>
-<DT><A href="manpage.d/ipsec_spi.8.html">ipsec_spi(8)</A></DT>
-<DD>manage IPsec Security Associations</DD>
-<DT><A href="manpage.d/ipsec_spigrp.8.html">ipsec_spigrp(8)</A></DT>
-<DD>group/ungroup IPsec Security Associations</DD>
-<DT><A href="manpage.d/ipsec_tncfg.8.html">ipsec_tncfg(8)</A></DT>
-<DD>associate IPsec virtual interface with real interface</DD>
-<DT><A href="manpage.d/ipsec_whack.8.html">ipsec_whack(8)</A></DT>
-<DD>control interface for IPsec keying daemon</DD>
-</DL>
-<H2><A name="man.lib">Library routines</A></H2>
-<DL>
-<DT><A href="manpage.d/ipsec_atoaddr.3.html">ipsec_atoaddr(3)</A></DT>
-<DT><A href="manpage.d/ipsec_addrtoa.3.html">ipsec_addrtoa(3)</A></DT>
-<DD>convert Internet addresses to and from ASCII</DD>
-<DT><A href="manpage.d/ipsec_atosubnet.3.html">ipsec_atosubnet(3)</A></DT>
-<DT><A href="manpage.d/ipsec_subnettoa.3.html">ipsec_subnettoa(3)</A></DT>
-<DD>convert subnet/mask ASCII form to and from addresses</DD>
-<DT><A href="manpage.d/ipsec_atoasr.3.html">ipsec_atoasr(3)</A></DT>
-<DD>convert ASCII to Internet address, subnet, or range</DD>
-<DT><A href="manpage.d/ipsec_rangetoa.3.html">ipsec_rangetoa(3)</A></DT>
-<DD>convert Internet address range to ASCII</DD>
-<DT>ipsec_atodata(3)</DT>
-<DT><A href="manpage.d/ipsec_datatoa.3.html">ipsec_datatoa(3)</A></DT>
-<DD>convert binary data from and to ASCII formats</DD>
-<DT><A href="manpage.d/ipsec_atosa.3.html">ipsec_atosa(3)</A></DT>
-<DT><A href="manpage.d/ipsec_satoa.3.html">ipsec_satoa(3)</A></DT>
-<DD>convert IPsec Security Association IDs to and from ASCII</DD>
-<DT><A href="manpage.d/ipsec_atoul.3.html">ipsec_atoul(3)</A></DT>
-<DT><A href="manpage.d/ipsec_ultoa.3.html">ipsec_ultoa(3)</A></DT>
-<DD>convert unsigned-long numbers to and from ASCII</DD>
-<DT><A href="manpage.d/ipsec_goodmask.3.html">ipsec_goodmask(3)</A></DT>
-<DD>is this Internet subnet mask a valid one?</DD>
-<DT><A href="manpage.d/ipsec_masktobits.3.html">ipsec_masktobits(3)</A></DT>
-<DD>convert Internet subnet mask to bit count</DD>
-<DT><A href="manpage.d/ipsec_bitstomask.3.html">ipsec_bitstomask(3)</A></DT>
-<DD>convert bit count to Internet subnet mask</DD>
-<DT><A href="manpage.d/ipsec_optionsfrom.3.html">ipsec_optionsfrom(3)</A>
-</DT>
-<DD>read additional ``command-line'' options from file</DD>
-<DT><A href="manpage.d/ipsec_subnetof.3.html">ipsec_subnetof(3)</A></DT>
-<DD>given Internet address and subnet mask, return subnet number</DD>
-<DT><A href="manpage.d/ipsec_hostof.3.html">ipsec_hostof(3)</A></DT>
-<DD>given Internet address and subnet mask, return host part</DD>
-<DT><A href="manpage.d/ipsec_broadcastof.3.html">ipsec_broadcastof(3)</A>
-</DT>
-<DD>given Internet address and subnet mask, return broadcast address</DD>
-</DL>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="faq.html">Previous</A>
-<A HREF="firewall.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/nightly.html b/doc/nightly.html
deleted file mode 100644
index 580fc0fc5..000000000
--- a/doc/nightly.html
+++ /dev/null
@@ -1,125 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="makecheck.html">Previous</A>
-<HR>
-<H1><A name="nightly">Nightly regression testing</A></H1>
-<P> The nightly regression testing system consists of several shell
- scripts and some perl scripts. The goal is to check out a fresh tree,
- run &quot;make check&quot; on it, record the results and summarize the results to
- the team and to the web site.</P>
-<P> Output can be found on<A HREF="http://bugs.freeswan.org:81/"> adams</A>
-, although the tests are actually run on another project machine.</P>
-<H1><A name="nightlyhowto">How to setup the nightly build</A></H1>
-<P> The best way to do nightly testing is to setup a new account. We
- call the account &quot;build&quot; - you could call it something else, but there
- may still be some references to ~build in the scripts.</P>
-<H2><A NAME="42_1"> Files you need to know about</A></H2>
-<P> As few files as possible need to be extracted from the source tree -
- files are run from the source tree whenever possible. However, there
- are some bootstrap and configuration files that are necessary.</P>
-<P> There are 7 files in testing/utils that are involved:</P>
-<DL>
-<DT> nightly-sample.sh</DT>
-<DD> This is the root of the build process. This file should be copied
- out of the CVS tree, to $HOME/bin/nightly.sh of the build account. This
- file should be invoked from cron.</DD>
-<DT> freeswan-regress-env-sample.sh</DT>
-<DD> This file should be copied to $HOME/freeswan-regress-env.sh. It
- should be edited to localize the values. See below.</DD>
-<DT> regress-cleanup.pl</DT>
-<DD> This file needs to be copied to $HOME/bin/regress-cleanup.pl. It is
- invoked by the nightly file before doing anything else. It removes
- previous nights builds in order to free up disk space for the build
- about to be done.</DD>
-<DT> teammail-sample.sh</DT>
-<DD> A script used to send results email to the &quot;team&quot;. This sample
- script could be copied to $HOME/bin/teammail.sh. This version will PGP
- encrypt all the output to the team members. If this script is used,
- then PGP will have to be properly setup to have the right keys.</DD>
-<DT> regress-nightly.sh</DT>
-<DD> This is the first stage of the nightly build. This stage will call
- other scripts as appropriate, and will extract the source code from
- CVS. This script should be copied to $HOME/bin/regress-nightly.sh</DD>
-<DT> regress-stage2.sh</DT>
-<DD> This is the second stage of the nightly build. It is called in
- place. It essentially sets up the UML setup in umlsetup.sh, and calls
- &quot;make check&quot;.</DD>
-<DT> regress-summarize-results.pl</DT>
-<DD> This script will summarize the results from the tests to a
- permanent directory set by $REGRESSRESULTS. It is invoked from the
- stage2 nightly script.</DD>
-<DT> regress-chart.sh</DT>
-<DD> This script is called at the end of the build process, and will
- summarize each night's results (as saved into $REGRESSRESULTS by
- regress-summarize-results.pl) as a chart using gnuplot. Note that this
- requires at least gnuplot 3.7.2.</DD>
-</DL>
-<H2><A NAME="42_2">Configuring freeswan-regress-env.sh</A></H2>
-<P>For more info on KERNPOOL, UMLPATCH, BASICROOT and SHAREDIR, see<A HREF="umltesting.html">
- User-Mode-Linux testing guide</A>.</P>
-<DL>
-<DT> KERNPOOL</DT>
-<DD> Extract copy of some kernel source to be used for UML builds</DD>
-<DT> UMLPATCH</DT>
-<DD> matching User-Mode-Linux patch.</DD>
-<DT> BASICROOT</DT>
-<DD> the root file system image (see<A HREF="umltesting.html">
- User-Mode-Linux testing guide</A>).</DD>
-<DT> SHAREDIR=${BASICROOT}/usr/share</DT>
-<DD> The /usr/share to use.</DD>
-<DT> REGRESSTREE</DT>
-<DD> A directory in which to store the nightly regression results.
- Directories will be created by date in this tree.</DD>
-<DT> TCPDUMP=tcpdump-3.7.1</DT>
-<DD> The path to the<A HREF="http://www.tcpdump.org/"> tcpdump</A> to
- use. This must have crypto compiled in, and must be at least 3.7.1</DD>
-<DT> KERNEL_RH7_2_SRC=/a3/kernel_sources/linux-2.4.9-13/</DT>
-<DD> An extracted copy of the RedHat 7.2. kernel source. If set, then
- the packaging/rpm-rh72-install-01 test will be run, and an RPM will be
- built as a test.</DD>
-<DT> KERNEL_RH7_3_SRC=/a3/kernel_sources/rh/linux-2.4.18-5</DT>
-<DD> An extracted copy of the RedHat 7.3. kernel source. If set, then
- the packaging/rpm-rh73-install-01 test will be run, and an RPM will be
- built as a test.</DD>
-<DT> NIGHTLY_WATCHERS=&quot;userid,userid,userid&quot;</DT>
-<DD> The list of people who should receive nightly output. This is used
- by teammail.sh</DD>
-<DT> FAILLINES=128</DT>
-<DD> How many lines of failed test output to include in the nightly
- output</DD>
-<DT> PATH=$PATH:/sandel/bin export PATH</DT>
-<DD> You can also override the path if necessary here.</DD>
-<DT> CVSROOT=:pserver:anoncvs@ip212.xs4net.freeswan.org:/freeswan/MASTER</DT>
-<DD> The CVSROOT to use. This example may work for anonymous CVS, but
- will be 12 hours behind the primary, and is still experimental</DD>
-<DT> SNAPSHOTSIGDIR=$HOME/snapshot-sig</DT>
-<DD> For the release tools, where to put the generated per-snapshot
- signature keys</DD>
-<DT> LASTREL=1.97</DT>
-<DD> the name of the last release branch (to find the right per-snapshot
- signature</DD>
-<DD></DD>
-</DL>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="makecheck.html">Previous</A>
-</BODY>
-</HTML>
diff --git a/doc/oppimpl.txt b/doc/oppimpl.txt
deleted file mode 100644
index fe4527d4e..000000000
--- a/doc/oppimpl.txt
+++ /dev/null
@@ -1,514 +0,0 @@
-Implementing Opportunistic Encryption
-
-Henry Spencer & D. Hugh Redelmeier
-
-Version 4+, 15 Dec 2000
-
-
-
-Updates
-
-Major changes since last version:  "Negotiation Issues" section discussing
-some interoperability matters, plus some wording cleanup.  Some issues
-arising from discussions at OLS are not yet resolved, so there will almost
-certainly be another version soon.
-
-xxx incoming could be opportunistic or RW.  xxx any way of saving unaware
-implementations???  xxx compression needs mention.
-
-
-
-Introduction
-
-A major long-term goal of the FreeS/WAN project is opportunistic
-encryption:  a security gateway intercepts an outgoing packet aimed at a
-new remote host, and quickly attempts to negotiate an IPsec tunnel to that
-host's security gateway, so that traffic can be encrypted and
-authenticated without changes to the host software.  (This generalizes
-trivially to the end-to-end case where host and security gateway are one
-and the same.)  If the attempt fails, the packet (or a retry thereof)
-passes through in clear or is dropped, depending on local policy. 
-Prearranged tunnels bypass all this, so static VPNs can coexist with
-opportunistic encryption. 
-
-xxx here Although significant intelligence about all this is necessary at the
-initiator end, it's highly desirable for little or no special machinery
-to be needed at the responder end.  In particular, if none were needed,
-then a security gateway which knows nothing about opportunistic encryption
-could nevertheless participate in some opportunistic connections.
-
-IPSEC gives us the low-level mechanisms, and the key-exchange machinery,
-but there are some vague spots (to put it mildly) at higher levels.
-
-One constraint which deserves comment is that the process of tunnel setup
-should be quick.  Moreover, the decision that no tunnel can be created
-should also be quick, since that will be a common case, at least in the
-beginning.  People will be reluctant to use opportunistic encryption if it
-causes gross startup delays on every connection, even connections which see
-no benefit from it.  Win or lose, the process must be rapid.
-
-There's nothing much we can do to speed up the key exchange itself.  (The
-one thing which conceivably might be done is to use Aggressive Mode, which
-involves fewer round trips, but it has limitations and possible security
-problems, and we're reluctant to touch it.)  What we can do, is to make the
-other parts of the setup process as quick as possible.  This desire will
-come back to haunt us below. :-)
-
-A further note is that we must consider the processing at the responder
-end as well as the initiator end.
-
-Several pieces of new machinery are needed to make this work.  Here's a
-brief list, with details considered below.
-
-+ Outgoing Packet Interception.  KLIPS needs to intercept packets which
-likely would benefit from tunnel setup, and bring them to Pluto's
-attention.  There needs to be enough memory in the process that the same
-tunnel doesn't get proposed too often (win or lose). 
-
-+ Smart Connection Management.  Not only do we need to establish tunnels
-on request, once a tunnel is set up, it needs to be torn down eventually
-if it's not in use.  It's also highly desirable to detect the fact that it
-has stopped working, and do something useful.  Status changes should be
-coordinated between the two security gateways unless one has crashed,
-and even then, they should get back into sync eventually.
-
-+ Security Gateway Discovery.  Given a packet destination, we must decide
-who to attempt to negotiate a tunnel with.  This must be done quickly, win
-or lose, and reliably even in the presence of diverse network setups.
-
-+ Authentication Without Prearrangement.  We need to be sure we're really
-talking to the intended security gateway, without being able to prearrange
-any shared information.  He needs the same assurance about us.
-
-+ More Flexible Policy.  In particular, the responding Pluto needs a way
-to figure out whether the connection it is being asked to make is okay.
-This isn't as simple as just searching our existing conn database -- we
-probably have to specify *classes* of legitimate connections.
-
-Conveniently, we have a three-letter acronym for each of these. :-)
-
-Note on philosophy:  we have deliberately avoided providing six different
-ways to do each step, in favor of specifying one good one.  Choices are
-provided only when they appear to be necessary.  (Or when we are not yet
-quite sure yet how best to do something...)
-
-
-
-OPI, SCM
-
-Smart Connection Management would be quite useful even by itself,
-requiring manual triggering.  (Right now, we do the manual triggering, but
-not the other parts of SCM.)  Outgoing Packet Interception fits together
-with SCM quite well, and improves its usefulness further.  Going through a
-connection's life cycle from the start... 
-
-OPI itself is relatively straightforward, aside from the nagging question
-of whether the intercepted packet is put on hold and then released, or
-dropped.  Putting it on hold is preferable; the alternative is to rely on
-the application or the transport layer re-trying.  The downside of packet
-hold is extra resources; the downside of packet dropping is that IPSEC
-knows *when* the packet can finally go out, and the higher layers don't. 
-Either way, life gets a little tricky because a quickly-retrying
-application may try more than once before we know for sure whether a
-tunnel can be set up, and something has to detect and filter out the
-duplications.  Some ARP implementations use the approach of keeping one
-packet for an as-yet-unresolved address, and throwing away any more that
-appear; that seems a reasonable choice.
-
-(Is it worth intercepting *incoming* packets, from the outside world, and
-attempting tunnel setup based on them?  Perhaps... if, and only if, we
-organize AWP so that non-opportunistic SGs can do it somehow.  Otherwise,
-if the other end has not initiated tunnel setup itself, it will not be
-prepared to do so at our request.)
-
-Once a tunnel is up, packets going into it naturally are not intercepted
-by OPI.  However, we need to do something about the flip side of this too: 
-after deciding that we *cannot* set up a tunnel, either because we don't
-have enough information or because the other security gateway is
-uncooperative, we have to remember that for a while, so we don't keep
-knocking on the same locked door.  One plausible way of doing that is to
-set up a bypass "tunnel" -- the equivalent of our current %passthrough
-connection -- and have it managed like a real SCM tunnel (finite lifespan
-etc.).  This sounds a bit heavyweight, but in practice, the alternatives
-all end up doing something very similar when examined closely.  Note that
-we need an extra variant of this, a block rather than a bypass, to cover
-the case where local policy dictates that packets *not* be passed through;
-we still have to remember the fact that we can't set up a real tunnel.
-
-When to tear tunnels down is a bit problematic, but if we're setting up a
-potentially unbounded number of them, we have to tear them down *somehow*
-*sometime*.  It seems fairly obvious that we set a tentative lifespan,
-probably fairly short (say 1min), and when it expires, we look to see if
-the tunnel is still in use (say, has had traffic in the last half of the
-lifespan).  If so, we assign it a somewhat longer lifespan (say 10min),
-after which we look again.  If not, we close it down.  (This lifespan is
-independent of key lifetime; it is just the time when the tunnel's future
-is next considered.  This should happen reasonably frequently, unlike
-rekeying, which is costly and shouldn't be too frequent.)  Multi-step
-backoff algorithms probably are not worth the trouble; looking every
-10min doesn't seem onerous.
-
-For the tunnel-expiry decision, we need to know how long it has been since
-the last traffic went through.  A more detailed history of the traffic
-does not seem very useful; a simple idle timer (or last-traffic timestamp)
-is both necessary and sufficient.  And KLIPS already has this.
-
-As noted, default initial lifespan should be short.  However, Pluto should
-keep a history of recently-closed tunnels, to detect cases where a tunnel
-is being repeatedly re-established and should be given a longer lifespan. 
-(Not only is tunnel setup costly, but it adds user-visible delay, so
-keeping a tunnel alive is preferable if we have reason to suspect more
-traffic soon.)  Any tunnel re-established within 10min of dying should have
-10min added to its initial lifespan.  (Just leaving all tunnels open longer
-is unappealing -- adaptive lifetimes which are sensitive to the behavior
-of a particular tunnel are wanted.  Tunnels are relatively cheap entities
-for us, but that is not necessarily true of all implementations, and there
-may also be administrative problems in sorting through large accumulations
-of idle tunnels.)
-
-It might be desirable to have detailed information about the initial
-packet when determining lifespans.  HTTP connections in particular are
-notoriously bursty and repetitive. 
-
-Arguably it would be nice to monitor TCP connection status.  A still-open
-TCP connection is almost a guarantee that more traffic is coming, while
-the closing of the only TCP connection through a tunnel is a good hint
-that none is.  But the monitoring is complex, and it doesn't seem worth
-the trouble. 
-
-IKE connections likewise should be torn down when it appears the need has
-passed.  They should linger longer than the last tunnel they administer,
-just in case they are needed again; the cost of retaining them is low.  An
-SG with only a modest number of them open might want to simply retain each
-until rekeying time, with more aggressive management cutting in only when
-the number gets large.  (They should be torn down eventually, if only to
-minimize the length of a status report, but rekeying is the only expensive
-event for them.)
-
-It's worth remembering that tunnels sometimes go down because the other
-end crashes, or disconnects, or has a network link break, and we don't get
-any notice of this in the general case.  (Even in the event of a crash and
-successful reboot, we won't hear about it unless the other end has
-specific reason to talk IKE to us immediately.)  Of course, we have to
-guard against being too quick to respond to temporary network outages,
-but it's not quite the same issue for us as for TCP, because we can tear
-down and then re-establish a tunnel without any user-visible effect except
-a pause in traffic.  And if the other end does go down and come back up,
-we and it can't communicate *at all* (except via IKE) until we tear down
-our tunnel.
-
-So... we need some kind of heartbeat mechanism.  Currently there is none
-in IKE, but there is discussion of changing that, and this seems like the
-best approach.  Doing a heartbeat at the IP level will not tell us about a
-crash/reboot event, and sending heartbeat packets through tunnels has
-various complications (they should stop at the far mouth of the tunnel
-instead of going on to a subnet; they should not count against idle
-timers; etc.).  Heartbeat exchanges obviously should be done only when
-there are tunnels established *and* there has been no recent incoming
-traffic through them.  It seems reasonable to do them at lifespan ends,
-subject to appropriate rate limiting when more than one tunnel goes to the
-same other SG.  When all traffic between the two ends is supposed to go
-via the tunnel, it might be reasonable to do a heartbeat -- subject to a
-rate limiter to avoid DOS attacks -- if the kernel sees a non-tunnel
-non-IKE packet from the other end. 
-
-If a heartbeat gets no response, try a few (say 3) pings to check IP
-connectivity; if one comes back, try another heartbeat; if it gets no
-response, the other end has rebooted, or otherwise been re-initialized,
-and its tunnels should be torn down.  If there's no response to the pings,
-note the fact and try the sequence again at the next lifespan end; if
-there's nothing then either, declare the tunnels dead. 
-
-Finally... except in cases where we've decided that the other end is dead
-or has rebooted, tunnel teardown should always be coordinated with the
-other end.  This means interpreting and sending Delete notifications, and
-also Initial-Contacts.  Receiving a Delete for the other party's tunnel
-SAs should lead us to tear down our end too -- SAs (SA bundles, really)
-need to be considered as paired bidirectional entities, even though the
-low-level protocols don't think of them that way. 
-
-
-
-SGD, AWP
-
-Given a packet destination, how do we decide who to (attempt to) negotiate
-a tunnel with?  And as a related issue, how do the negotiating parties
-authenticate each other?  DNSSEC obviously provides the tools for the
-latter, but how exactly do we use them?
-
-Having intercepted a packet, what we know is basically the IP addresses of
-source and destination (plus, in principle, some information about the
-desired communication, like protocol and port).  We might be able to map
-the source address to more information about the source, depending on how
-well we control our local networks, but we know nothing further about the
-destination. 
-
-The obvious first thing to do is a DNS reverse lookup on the destination
-address; that's about all we can do with available data.  Ideally, we'd
-like to get all necessary information with this one DNS lookup, because
-DNS lookups are time-consuming -- all the more so if they involve a DNSSEC
-signature-checking treewalk by the name server -- and we've got to hurry.
-While it is unusual for a reverse lookup to yield records other than PTR
-records (or possibly CNAME records, for RFC 2317 classless delegation),
-there's no reason why it can't.
-
-(For purposes like logging, a reverse lookup is usually followed by a
-forward lookup, to verify that the reverse lookup wasn't lying about the
-host name.  For our purposes, this is not vital, since we use stronger
-authentication methods anyway.)
-
-While we want to get as much data as possible (ideally all of it) from one
-lookup, it is useful to first consider how the necessary information would
-be obtained if DNS lookups were instantaneous.  Two pieces of information
-are absolutely vital at this point:  the IP address of the other end's
-security gateway, and the SG's public key*. 
-
-(* Actually, knowledge of the key can be postponed slightly -- it's not
-needed until the second exchange of the negotiations, while we can't even
-start negotiations without knowing the IP address.  The SG is not
-necessarily on the plain-IP route to the destination, especially when
-multiple SGs are present.)
-
-Given instantaneous DNS lookups, we would:
-
-+ Start with a reverse lookup to turn the address into a name.
-
-+ Look for something like RFC-2782 SRV records using the name, to find out
-who provides this particular service.  If none comes back, we can abandon
-the whole process. 
-
-+ Select one SRV record, which gives us the name of a target host (plus
-possibly one or more addresses, if the name server has supplied address
-records as Additional Data for the SRV records -- this is recommended
-behavior but is not required). 
-
-+ Use the target name to look up a suitable KEY record, and also address
-record(s) if they are still needed. 
-
-This gives us the desired address(es) and key.  However, it requires three
-lookups, and we don't even find out whether there's any point in trying
-until after the second.
-
-With real DNS lookups, which are far from instantaneous, some optimization
-is needed.  At the very least, typical cases should need fewer lookups.
-
-So when we do the reverse lookup on the IP address, instead of asking for
-PTR, we ask for TXT.  If we get none, we abandon opportunistic
-negotiation, and set up a bypass/block with a relatively long life (say
-6hr) because it's not worth trying again soon.  (Note, there needs to be a
-way to manually force an early retry -- say, by just clearing out all
-memory of a particular address -- to cover cases where a configuration
-error is discovered and fixed.)
-
-xxx need to discuss multi-string TXTs
-
-In the results, we look for at least one TXT record with content
-"X-IPsec-Server(nnn)=a.b.c.d kkk", following RFC 1464 attribute/value
-notation.  (The "X-" indicates that this is tentative and experimental;
-this design will probably need modification after initial experiments.)
-Again, if there is no such record, we abandon opportunistic negotiation. 
-
-"nnn" and the parentheses surrounding it are optional.  If present, it
-specifies a priority (low number high priority), as for MX records, to
-control the order in which multiple servers are tried.  If there are no
-priorities, or there are ties, pick one randomly.
-
-"a.b.c.d" is the dotted-decimal IP address of the SG.  (Suitable extensions
-for IPv6, when the time comes, are straightforward.)
-
-"kkk" is either an RSA-MD5 public key in base-64 notation, as in the text
-form of an RFC 2535 KEY record, or "@hhh".  In the latter case, hhh is a
-DNS name, under which one Host/Authentication/IPSEC/RSA-MD5 KEY record is
-present, giving the server's authentication key.  (The delay of the extra
-lookup is undesirable, but practical issues of key management may make it
-advisable not to duplicate the key itself in DNS entries for many
-clients.)
-
-It unfortunately does appear that the authentication key has to be
-associated with the server, not the client behind it.  At the time when
-the responder has to authenticate our SG, it does not know which of its
-clients we are interested in (i.e., which key to use), and there is no
-good way to tell it.  (There are some bad ways; this decision may merit
-re-examination after experimental use.)
-
-The responder authenticates our SG by doing a reverse lookup on its IP
-address to get a Host/Authentication/IPSEC/RSA-MD5 KEY record.  He can
-attempt this in parallel with the early parts of the negotiation (since he
-knows our SG IP address from the first negotiation packet), at the risk of
-having to abandon the attempt and do a different lookup if we use
-something different as our ID (see below).  Unfortunately, he doesn't yet
-know what client we will claim to represent, so he'll need to do another
-lookup as part of phase 2 negotiation (unless the client *is* our SG), to
-confirm that the client has a TXT X-IPsec-Server record pointing to our
-SG.  (Checking that the record specifies the same key is not important,
-since the responder already has a trustworthy key for our SG.)
-
-Also unfortunately, opportunistic tunnels can only have degenerate subnets
-(/32 subnets, containing one host) at their ends.  It's superficially
-attractive to negotiate broader connections... but without prearrangement,
-you don't know whether you can trust the other end's claim to have a
-specific subnet behind it.  Fixing this would require a way to do a
-reverse lookup on the *subnet* (you cannot trust information in DNS
-records for a name or a single address, which may be controlled by people
-who do not control the whole subnet) with both the address and the mask
-included in the name.  Except in the special case of a subnet masked on a
-byte boundary (in which case RFC 1035's convention of an incomplete
-in-addr.arpa name could be used), this would need extensions to the
-reverse-map name space, which is awkward, especially in the presence of
-RFC 2317 delegation.  (IPv6 delegation is more flexible and it might be
-easier there.)
-
-There is a question of what ID should be used in later steps of
-negotiation.  However, the desire not to put more DNS lookups in the
-critical path suggests avoiding the extra complication of varied IDs,
-except in the Road Warrior case (where an extra lookup is inevitable).
-Also, figuring out what such IDs *mean* gets messy.  To keep things simple,
-except in the RW case, all IDs should be IP addresses identical to those
-used in the packet headers.
-
-For Road Warrior, the RW must be the initiator, since the home-base SG has
-no idea what address the RW will appear at.  Moreover, in general the RW
-does not control the DNS entries for his address.  This inherently denies
-the home base any authentication of the RW's IP address; the most it can
-do is to verify an identity he provides, and perhaps decide whether it
-wishes to talk to someone with that identity, but this does not verify his
-right to use that IP address -- nothing can, really. 
-
-(That may sound like it would permit some man-in-the-middle attacks, but
-the RW can still do full authentication of the home base, so a man in the
-middle cannot successfully impersonate home base.  Furthermore, a man in
-the middle must impersonate both sides for the DH exchange to work.  So
-either way, the IKE negotiation falls apart.)
-
-A Road Warrior provides an FQDN ID, used for a forward lookup to obtain a
-Host/Authentication/IPSEC/RSA-MD5 KEY record.  (Note, an FQDN need not
-actually correspond to a host -- e.g., the DNS data for it need not
-include an A record.)  This suffices, since the RW is the initiator and
-the responder knows his address from his first packet.
-
-Certain situations where a host has a more-or-less permanent IP address,
-but does not control its DNS entries, must be treated essentially like
-Road Warrior.  It is unfortunate that DNS's old inverse-query feature
-cannot be used (nonrecursively) to ask the initiator's local DNS server
-whether it has a name for the address, because the address will almost
-always have been obtained from a DNS name lookup, and it might be a lookup
-of a name whose DNS entries the host *does* control.  (Real examples of
-this exist:  the host has a preferred name whose host-controlled entry
-includes an A record, but a reverse lookup on the address sends you to an
-ISP-controlled name whose entry has an A record but not much else.)  Alas,
-inverse query is long obsolete and is not widely implemented now. 
-
-There are some questions in failure cases.  If we cannot acquire the info
-needed to set up a tunnel, this is the no-tunnel-possible case.  If we
-reach an SG but negotiation fails, this too is the no-tunnel-possible
-case, with a relatively long bypass/block lifespan (say 1hr) since
-fruitless negotiations are expensive.  (In the multiple-SG case, it seems
-unlikely to be worthwhile to try other SGs just in case one of them might
-have a configuration permitting successful negotiation.)
-
-Finally, there is a sticky problem with timeouts.  If the other SG is down
-or otherwise inaccessible, in the worst case we won't hear about this
-except by not getting responses.  Some other, more pathological or even
-evil, failure cases can have the same result.  The problem is that in the
-case where a bypass is permitted, we want to decide whether a tunnel is
-possible quickly.  It gets even worse if there are multiple SGs, in which
-case conceivably we might want to try them all (since some SGs being up
-when others are down is much more likely than SGs differing in policy). 
-
-The patience setting needs to be configurable policy, with a reasonable
-default (to be determined by experiment).  If it expires, we simply have
-to declare the attempt a failure, and set up a bypass/block.  (Setting up
-a tentative bypass/block, and replacing it with a real tunnel if remaining
-attempts do produce one, looks attractive at first glance... but exposing
-the first few seconds of a connection is often almost as bad as exposing
-the whole thing!)  Such a bypass/block should have a short lifespan, say
-10min, because the SG(s) might be only temporarily unavailable.
-
-The flip side of IKE waiting for a timeout is that all other forms of
-feedback, e.g. "host not reachable", should be *ignored*, because you
-cannot trust them!  This may need kernel changes. 
-
-Can AWP be done by non-opportunistic SGs?  Probably not; existing SG
-implementations generally aren't prepared to do anything suitable, except
-perhaps via the messy business of certificates.  There is one borderline
-exception:  some implementations rely on LDAP for at least some of their
-information fetching, and it might be possible to substitute a custom LDAP
-server which does the right things for them.  Feasibility of this depends
-on details, which we don't know well enough. 
-
-[This could do with a full example, a complete packet by packet walkthrough
-including all DNS and IKE traffic.]
-
-
-
-MFP
-
-Our current conn database simply isn't flexible enough to cover all this
-properly.  In particular, the responding Pluto needs a way to figure out
-whether the connection it is being asked to make is legitimate.
-
-This is more subtle than it sounds, given the problem noted earlier, that
-there's no clear way to authenticate claims to represent a non-degenerate
-subnet.  Our database has to be able to say "a connection to any host in
-this subnet is okay" or "a connection to any subnet within this subnet is
-okay", rather than "a connection to exactly this subnet is okay".  (There
-is some analogy to the Road Warrior case here, which may be relevant.)
-This will require at least a re-interpretation of ipsec.conf.
-
-Interim stages of implementation of this will require a bit of thought.
-Notably, we need some way of dealing with the lack of fully signed DNSSEC
-records.  Without user interaction, probably the best we can do is to
-remember the results of old fetches, compare them to the results of new
-fetches, and complain and disbelieve all of it if there's a mismatch. 
-This does mean that somebody who gets fake data into our very first fetch
-will fool us, at least for a while, but that seems an acceptable tradeoff.
-
-
-
-Negotiation Issues
-
-There are various options which are nominally open to negotiation as part
-of setup, but which have to be nailed down at least well enough that
-opportunistic SGs can reliably interoperate.  Somewhat arbitrarily and
-tentatively, opportunistic SGs must support Main Mode, Oakley group 5 for
-D-H, 3DES encryption and MD5 authentication for both ISAKMP and IPsec SAs,
-RSA digital-signature authentication with keys between 2048 and 8192 bits,
-and ESP doing both encryption and authentication.  They must do key PFS
-in Quick Mode, but not identity PFS.
-
-
-
-What we need from DNS
-
-Fortunately, we don't need any new record types or suchlike to make this
-all work.  We do, however, need attention to a couple of areas in DNS
-implementation.
-
-First, size limits.  Although the information we directly need from a
-lookup is not enormous -- the only potentially-big item is the KEY record,
-and there should be only one of those -- there is still a problem with
-DNSSEC authentication signatures.  With a 2048-bit key and assorted
-supporting information, we will fill most of a 512-byte DNS UDP packet...
-and if the data is to have DNSSEC authentication, at least one quite large
-SIG record will come too.  Plus maybe a TSIG signature on the whole
-response, to authenticate it to our resolver.  So:  DNSSEC-capable name
-servers must fix the 512-byte UDP limit.  We're told there are provisions
-for this; implementation of them is mandatory. 
-
-Second, interface.  It is unclear how the resolver interface will let us
-ask for DNSSEC authentication.  We would prefer to ask for "authentication
-where possible", and get back the data with each item flagged by whether
-authentication was available (and successful!) or not available.  Having
-to ask separately for authenticated and non-authenticated data would
-probably be acceptable, *provided* both will be cached on the first
-request, so the two requests incur only one set of (non-local) network
-traffic.  Either way, we want to see the name server and resolver do this
-for us; that makes sense in any case, since it's important that
-verification be done somewhere where it can be cached, the more centrally
-the better. 
-
-Finally, a wistful note:  the ability to do a limited form of inverse
-queries (an almost forgotten feature), to ask the local name server which
-hostname it recently mapped to a particular address, would be quite
-helpful.  Note, this is *NOT* the same as a reverse lookup, and crude
-fakes like putting a dotted-decimal address in brackets do not suffice. 
diff --git a/doc/opportunism-spec.txt b/doc/opportunism-spec.txt
deleted file mode 100644
index fbe319a57..000000000
--- a/doc/opportunism-spec.txt
+++ /dev/null
@@ -1,1254 +0,0 @@
-
-
-
-
-
-
-
-
-
-                  Opportunistic Encryption
-
-                       Henry Spencer
-                     D. Hugh Redelmeier
-                    henry@spsystems.net
-                      hugh@mimosa.com
-                  Linux FreeS/WAN Project
-
-
-
-          Opportunistic   encryption   permits   secure
-     (encrypted, authenticated) communication via IPsec
-     without  connection-by-connection  prearrangement,
-     either explicitly between hosts  (when  the  hosts
-     are  capable  of  it) or transparently via packet-
-     intercepting  security  gateways.   It  uses   DNS
-     records (authenticated with DNSSEC) to provide the
-     necessary information for  gateway  discovery  and
-     gateway authentication, and constrains negotiation
-     enough to guarantee success.
-
-     Substantive  changes  since  draft  3:  write  off
-     inverse  queries  as a lost cause; use Invalid-SPI
-     rather than Delete as notification of unknown  SA;
-     minor  wording  improvements  and  clarifications.
-     This document takes over from the  older  ``Imple-
-     menting Opportunistic Encryption'' document.
-
-
-1.  Introduction
-
-A  major  goal  of  the  FreeS/WAN  project is opportunistic
-encryption: a  (security)  gateway  intercepts  an  outgoing
-packet aimed at a remote host, and quickly attempts to nego-
-tiate an IPsec tunnel to that host's security  gateway.   If
-the  attempt succeeds, traffic can then be secure, transpar-
-ently (without  changes  to  the  host  software).   If  the
-attempt  fails,  the  packet  (or  a  retry  thereof) passes
-through in clear or is dropped, depending on  local  policy.
-Prearranged  tunnels bypass the packet interception etc., so
-static VPNs can coexist with opportunistic encryption.
-
-This generalizes trivially to the end-to-end case: host  and
-security  gateway  simply  are one and the same.  Some opti-
-mizations are possible in that case, but  the  basic  scheme
-need not change.
-
-The  objectives  for  security systems need to be explicitly
-stated.  Opportunistic encryption is meant to achieve secure
-communication, without prearrangement of the individual con-
-nection (although some prearrangement on a per-host basis is
-
-
-
-Draft 4                  3 May 2001                        1
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-required),  between any two hosts which implement the proto-
-col (and, if they act as security  gateways,  between  hosts
-behind  them).   Here ``secure'' means strong encryption and
-authentication of packets, with authentication  of  partici-
-pants--to   prevent   man-in-the-middle   and  impersonation
-attacks--dependent on several factors.  The  biggest  factor
-is  the authentication of DNS records, via DNSSEC or equiva-
-lent means.  A lesser factor is which exact variant  of  the
-setup  procedure (see section 2.2) is used, because there is
-a tradeoff between strong authentication of  the  other  end
-and ability to negotiate opportunistic encryption with hosts
-which have limited or no control of  their  reverse-map  DNS
-records: without reverse-map information, we can verify that
-the host has the right to use a particular FQDN (Fully Qual-
-ified  Domain Name), but not whether that FQDN is authorized
-to use that IP address.  Local policy  must  decide  whether
-authentication or connectivity has higher priority.
-
-Apart  from  careful  attention  to detail in various areas,
-there are three crucial design  problems  for  opportunistic
-encryption.   It  needs a way to quickly identify the remote
-host's security gateway.  It needs a way to  quickly  obtain
-an  authentication  key  for  the security gateway.  And the
-numerous options which can be specified  with  IKE  must  be
-constrained  sufficiently  that  two independent implementa-
-tions  are  guaranteed  to  reach  agreement,  without   any
-explicit  prearrangement  or  preliminary  negotiation.  The
-first two problems are solved using DNS, with DNSSEC  ensur-
-ing  that the data obtained is reliable; the third is solved
-by specifying a minimum standard which must be supported.
-
-A note on philosophy: we have deliberately avoided providing
-six  different  ways  to do each job, in favor of specifying
-one good one.  Choices are provided only when they appear to
-be necessary, or at least important.
-
-A note on terminology: to avoid constant circumlocutions, an
-ISAKMP/IKE SA, possibly recreated occasionally by  rekeying,
-will  be  referred  to as a ``keying channel'', and a set of
-IPsec SAs providing bidirectional communication between  two
-IPsec  hosts,  possibly  recreated occasionally by rekeying,
-will be referred to as a ``tunnel''  (it  could  conceivably
-use transport mode in the host-to-host case, but we advocate
-using tunnel mode even there).  The word  ``connection''  is
-here  used  in  a more generic sense.  The word ``lifetime''
-will be avoided in favor  of  ``rekeying  interval'',  since
-many  of  the connections will have useful lives far shorter
-than any reasonable rekeying interval,  and  hence  the  two
-concepts must be separated.
-
-A note on document structure: Discussions of why things were
-done a particular way, or not done  a  particular  way,  are
-broken  out in paragraphs headed ``Rationale:'' (to preserve
-the flow of the text, many such paragraphs are  deferred  to
-
-
-
-Draft 4                  3 May 2001                        2
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-the ends of sections).  Paragraphs headed ``Ahem:'' are dis-
-cussions of where the problem is  being  made  significantly
-harder  by  problems  elsewhere,  and how that might be cor-
-rected.  Some meta-comments are enclosed in [].
-
-Rationale: The motive is  to  get  the  Internet  encrypted.
-That  requires  encryption  without connection-by-connection
-prearrangement: a system must be able to reliably  negotiate
-an   encrypted,   authenticated   connection  with  a  total
-stranger.  While end-to-end encryption is preferable,  doing
-opportunistic encryption in security gateways gives enormous
-leverage for quick deployment of this technology, in a world
-where  end-host software is often primitive, rigid, and out-
-dated.
-
-Rationale: Speed is of the essence in tunnel setup:  a  con-
-nection-establishment  delay  longer  than  about 10 seconds
-begins to cause problems for users and  applications.   Thus
-the emphasis on rapidity in gateway discovery and key fetch-
-ing.
-
-Ahem: Host-to-host opportunistic encryption would be utterly
-trivial  if a fast public-key encryption/signature algorithm
-was available.  You would do a reverse lookup on the  desti-
-nation  address to obtain a public key for that address, and
-simply encrypt all packets going to it with that key,  sign-
-ing them with your own private key.  Alas, this is impracti-
-cal with current CPU speeds and current algorithms (although
-as  noted  later,  it  might be of some use for limited pur-
-poses).  Nevertheless, it is a useful model.
-
-2.  Connection Setup
-
-For purposes of discussion, the network  is  taken  to  look
-like this:
-
-     Source----Initiator----...----Responder----Destination
-
-The  intercepted packet comes from the Source, bound for the
-Destination, and is intercepted at the Initiator.  The  Ini-
-tiator  communicates  over  the  insecure  Internet  to  the
-Responder.  The Source and the Initiator might be  the  same
-host,  or  the Source might be an end-user host and the Ini-
-tiator a security gateway (SG).  Likewise for the  Responder
-and the Destination.
-
-Given  an  intercepted packet, whose useful information (for
-our purposes)  is  essentially  only  the  Destination's  IP
-address,  the Initiator must quickly determine the Responder
-(the  Destination's  SG)  and  fetch  everything  needed  to
-authenticate  it.   The  Responder  must do likewise for the
-Initiator.  Both must eventually also confirm that the other
-is  authorized to act on behalf of the client host behind it
-(if any).
-
-
-
-Draft 4                  3 May 2001                        3
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-An important subtlety here is that if the alternative to  an
-IPsec  tunnel  is  plaintext  transmission, negative results
-must be obtained quickly.  That is,  the  decision  that  no
-tunnel can be established must also be made rapidly.
-
-2.1.  Packet Interception
-
-Interception  of outgoing packets is relatively straightfor-
-ward in principle.  It is preferable to put the  intercepted
-packet  on  hold rather than dropping it, since higher-level
-retries are not necessarily well-timed.  There is a  problem
-of hosts and applications retrying during negotiations.  ARP
-implementations,  which  face  the  same  problem,  use  the
-approach  of  keeping  the most recent packet for an as-yet-
-unresolved address, and throwing away older  ones.   (Incre-
-menting  of request numbers etc. means that replies to older
-ones may no longer be accepted.)
-
-Is it worth intercepting incoming packets, from the  outside
-world,  and  attempting  tunnel  setup  based  on them?  No,
-unless and until a way can be  devised  to  initiate  oppor-
-tunistic   encryption   to  a  non-opportunistic  responder,
-because if the other end  has  not  initiated  tunnel  setup
-itself, it will not be prepared to do so at our request.
-
-Rationale:  Note,  however,  that most incoming packets will
-promptly be followed by  an  outgoing  packet  in  response!
-Conceivably  it  might  be  useful  to start early stages of
-negotiation, at least as far as looking up  information,  in
-response to an incoming packet.
-
-Rationale: If a plaintext incoming packet indicates that the
-other end is not prepared to do opportunistic encryption, it
-might  seem that this fact should be noted, to avoid consum-
-ing resources and delaying traffic in an attempt  at  oppor-
-tunistic setup which is doomed to fail.  However, this would
-be a major security hole, since the plaintext packet is  not
-authenticated; see section 2.5.
-
-2.2.  Algorithm
-
-For  clarity,  the following defers most discussion of error
-handling to the end.
-
-Step 1.  Initiator does a DNS reverse lookup on the Destina-
-         tion address, asking not for the usual PTR records,
-         but for TXT  records.   Meanwhile,  Initiator  also
-         sends a ping to the Destination, to cause any other
-         dynamic setup actions to  start  happening.   (Ping
-         replies  are  disregarded;  the  host  might not be
-         reachable with plaintext pings.)
-
-Step 2A. If at least one suitable TXT  record  (see  section
-         2.3)   comes   back,   each  contains  a  potential
-
-
-
-Draft 4                  3 May 2001                        4
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-         Responder's IP address and that Responder's  public
-         key (or where to find it).  Initiator picks one TXT
-         record, based on priority (see 2.3), thus picking a
-         Responder.   If  there was no public key in the TXT
-         record, the Initiator also starts a DNS lookup  (as
-         specified by the TXT record) to get KEY records.
-
-Step 2B. If  no suitable TXT record is available, and policy
-         permits,  Initiator  designates   the   Destination
-         itself as the Responder (see section 2.4).  If pol-
-         icy does not permit, or the  Destination  is  unre-
-         sponsive  to  the  negotiation,  then opportunistic
-         encryption is not possible, and Initiator gives  up
-         (see section 2.5).
-
-Step 3.  If there already is a keying channel to the Respon-
-         der's IP address, the Initiator uses  the  existing
-         keying  channel;  skip  to step 10.  Otherwise, the
-         Initiator starts an IKE Phase  1  negotiation  (see
-         section  2.7  for details) with the Responder.  The
-         address family of the Responder's IP  address  dic-
-         tates whether the keying channel and the outside of
-         the tunnel should be IPv4 or IPv6.
-
-Step 4.  Responder gets the first IKE message, and responds.
-         It  also starts a DNS reverse lookup on the Initia-
-         tor's IP address, for KEY records, on  speculation.
-
-Step 5.  Initiator  gets  Responder's reply, and sends first
-         message of IKE's D-H exchange (see 2.4).
-
-Step 6.  Responder  gets  Initiator's   D-H   message,   and
-         responds with a matching one.
-
-Step 7.  Initiator  gets Responder's D-H message; encryption
-         is now established, authentication  remains  to  be
-         done.   Initiator sends IKE authentication message,
-         with an FQDN identity if a reverse  lookup  on  its
-         address  will  not  yield  a  suitable  KEY record.
-         (Note, an FQDN need not actually  correspond  to  a
-         host--e.g., the DNS data for it need not include an
-         A record.)
-
-Step 8.  Responder gets Initiator's authentication  message.
-         If  there  is no identity included, Responder waits
-         for step 4's speculative DNS lookup to  finish;  it
-         should  yield  a suitable KEY record (see 2.3).  If
-         there is an FQDN identity, responder  discards  any
-         data obtained from step 4's DNS lookup; does a for-
-         ward lookup on the FQDN, for a  KEY  record;  waits
-         for  that lookup to return; it should yield a suit-
-         able KEY record.  Either way,  Responder  uses  the
-         KEY  data  to verify the message's hash.  Responder
-         replies with an  authentication  message,  with  an
-
-
-
-Draft 4                  3 May 2001                        5
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-         FQDN  identity  if  a reverse lookup on its address
-         will not yield a suitable KEY record.
-
-Step 9A. (If step 2A was  used.)   The  Initiator  gets  the
-         Responder's  authentication  message.   Step 2A has
-         provided a key (from the  TXT  record  or  via  DNS
-         lookup).   Verify  message's  hash.   Encrypted and
-         authenticated keying channel  established,  man-in-
-         middle attack precluded.
-
-Step 9B. (If  step  2B  was  used.)   The Initiator gets the
-         Responder's authentication message, which must con-
-         tain an FQDN identity (if the Responder can't put a
-         TXT in his reverse map he presumably can't do a KEY
-         either).   Do forward lookup on the FQDN, get suit-
-         able KEY record,  verify  hash.   Encrypted  keying
-         channel   established,  man-in-middle  attack  pre-
-         cluded, but authentication weak (see 2.4).
-
-Step 10. Initiator initiates IKE Phase  2  negotiation  (see
-         2.7)  to  establish  tunnel,  specifying Source and
-         Destination identities as IP addresses  (see  2.6).
-         The  address  family of those addresses also deter-
-         mines whether the inside of the  tunnel  should  be
-         IPv4 or IPv6.
-
-Step 11. Responder  gets  first  Phase  2  message.  Now the
-         Responder finally knows what's  going  on!   Unless
-         the specified Source is identical to the Initiator,
-         Responder initiates DNS reverse lookup on Source IP
-         address,  for  TXT  records; waits for result; gets
-         suitable TXT record(s) (see 2.3), which should con-
-         tain  either  the Initiator's IP address or an FQDN
-         identity identical to that supplied by the  Initia-
-         tor in step 7.  This verifies that the Initiator is
-         authorized to act as SG for the Source.   Responder
-         replies  with  second  Phase  2  message, selecting
-         acceptable details (see 2.7), and establishes  tun-
-         nel.
-
-Step 12. Initiator  gets second Phase 2 message, establishes
-         tunnel (if he didn't  already),  and  releases  the
-         intercepted packet into it, finally.
-
-Step 13. Communication  proceeds.   See  section  3 for what
-         happens later.
-
-As additional  information  becomes  available,  notably  in
-steps 1, 2, 4, 8, 9, 11, and 12, there is always a possibil-
-ity that local policy (e.g., access limitations) might  pre-
-vent  further progress.  Whenever possible, at least attempt
-to inform the other end of this.
-
-
-
-
-
-Draft 4                  3 May 2001                        6
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-At any time, there is a possibility of the negotiation fail-
-ing  due  to  unexpected  responses,  e.g. the Responder not
-responding at all or rejecting  all  Initiator's  proposals.
-If  multiple SGs were found as possible Responders, the Ini-
-tiator should try at least one more before giving  up.   The
-number  tried  should  be influenced by what the alternative
-is: if the traffic will otherwise be discarded,  trying  the
-full  list is probably appropriate, while if the alternative
-is plaintext transmission, it might be based on how long the
-tries  are  taking.   The Initiator should try as many as it
-reasonably can, ideally all of them.
-
-There is a sticky problem with timeouts.  If  the  Responder
-is  down  or  otherwise  inaccessible,  in the worst case we
-won't hear about this except by not getting responses.  Some
-other,  more  pathological  or  even evil, failure cases can
-have the same result.  The problem is that in the case where
-plaintext  is  permitted, we want to decide whether a tunnel
-is possible quickly.  There is no  good  solution  to  this,
-alas; we just have to take the time and do it right.  (Pass-
-ing plaintext meanwhile looks attractive at first  glance...
-but  exposing the first few seconds of a connection is often
-almost as bad as exposing the whole thing.   Worse,  if  the
-user  checks  the status of the connection, after that brief
-window it looks secure!)
-
-The flip side of waiting for a timeout  is  that  all  other
-forms  of  feedback,  e.g.  ``host not reachable'', arguably
-should be ignored, because in the absence  of  authenticated
-ICMP, you cannot trust them!
-
-Rationale:  An  alternative, sometimes suggested, to the use
-of explicit DNS records for  SG  discovery  is  to  directly
-attempt  IKE  negotiation  with  the  destination  host, and
-assume that any relevant SG will be on the packet path, will
-intercept the IKE packets, and will impersonate the destina-
-tion host for the IKE negotiation.   This  is  superficially
-attractive  but is a very bad idea.  It assumes that routing
-is stable throughout negotiation, that  the  SG  is  on  the
-plaintext-packets  path,  and  that  the destination host is
-routable (yes, it is possible to have (private) DNS data for
-an  unroutable host).  Playing extra games in the plaintext-
-packet path hurts performance and  can  be  expected  to  be
-unpopular.  Various difficulties ensue when there are multi-
-ple SGs along the path (there is already bad experience with
-this,  in  RSVP),  and  the presence of even one can make it
-impossible to do IKE direct to the host when that is  what's
-wanted.  Worst of all, such impersonation breaks the IP net-
-work model badly, making problems difficult to diagnose  and
-impossible  to work around (and there is already bad experi-
-ence with this, in areas like web caching).
-
-Rationale: (Step 1.)  Dynamic setup  actions  might  include
-establishment   of  demand-dialed  links.   These  might  be
-
-
-
-Draft 4                  3 May 2001                        7
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-present anywhere along the path, so one cannot rely on  out-
-of-band  communication  at  the  Initiator  to trigger them.
-Hence the ping.
-
-Rationale: (Step 2.)  In many cases, the IP address  on  the
-intercepted  packet will be the result of a name lookup just
-done.  Inverse queries, an obscure DNS feature from the dis-
-tant  past,  in  theory  can  be used to ask a DNS server to
-reverse that lookup,  giving  the  name  that  produced  the
-address.   This is not the same as a reverse lookup, and the
-difference can matter a great deal in  cases  where  a  host
-does  not  control its reverse map (e.g., when the host's IP
-address is dynamically  assigned).   Unfortunately,  inverse
-queries were never widely implemented and are now considered
-obsolete.  Phooey.
-
-Ahem: Support for a small subset of this  admittedly-obscure
-feature  would be useful.  Unfortunately, it seems unlikely.
-
-Rationale: (Step 3.)  Using  only  IP  addresses  to  decide
-whether  there  is  already a relevant keying channel avoids
-some difficult problems.  In particular, it might seem  that
-this  should be based on identities, but those are not known
-until very late in IKE Phase 1 negotiations.
-
-Rationale: (Step 4.)  The DNS lookup is done on  speculation
-because  the data will probably be useful and the lookup can
-be done in parallel with IKE activity, potentially  speeding
-things up.
-
-Rationale:  (Steps  7 and 8.)  If an SG does not control its
-reverse map, there is no way it can prove its right  to  use
-an  IP address, but it can nevertheless supply both an iden-
-tity (as an FQDN) and proof of its right to use  that  iden-
-tity.   This  is  somewhat  better  than nothing, and may be
-quite useful if the SG is representing a client  host  which
-can  prove  its  right  to  its IP address.  (For example, a
-fixed-address subnet might live behind an SG with a  dynami-
-cally-assigned  address; such an SG has to be the Initiator,
-not the Responder, so the subnet's TXT records  can  contain
-FQDN identities, but with that restriction, this works.)  It
-might sound like this would  permit  some  man-in-the-middle
-attacks in important cases like Road Warrior, but the RW can
-still do full authentication of the home base, so a  man  in
-the  middle  cannot  successfully impersonate home base, and
-the D-H exchange doesn't work unless the man in  the  middle
-impersonates both ends.
-
-Rationale:  (Steps  7 and 8.)  Another situation where proof
-of the right to use an identity can be very useful  is  when
-access is deliberately limited.  While opportunistic encryp-
-tion is intended as a general-purpose  connection  mechanism
-between strangers, it may well be convenient for prearranged
-connections to use the same mechanism.
-
-
-
-Draft 4                  3 May 2001                        8
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-Rationale: (Steps 7 and 8.)  FQDNs as identities are avoided
-where  possible,  since  they  can  involve  synchronous DNS
-lookups.
-
-Rationale: (Step 11.)  Note that only here, in Phase 2, does
-the  Responder actually learn who the Source and Destination
-hosts are.  This unfortunately  demands  a  synchronous  DNS
-lookup  to verify that the Initiator is authorized to repre-
-sent the Source, unless they are one and the same.  This and
-the  initial TXT lookup are the only synchronous DNS lookups
-absolutely required by the algorithm, and they appear to  be
-unavoidable.
-
-Rationale:  While  it  might seem unlikely that a refusal to
-cooperate from one SG could be remedied by trying  another--
-presumably  they all use the same policies--it's conceivable
-that one might be misconfigured.  Preferably they should all
-be tried, but it may be necessary to set some limits on this
-if alternatives exist.
-
-2.3.  DNS Records
-
-Gateway discovery and key lookup are based on  TXT  and  KEY
-DNS  records.   The TXT record specifies IP address or other
-identity of a host's SG, and possibly  supplies  its  public
-key  as  well, while the KEY record supplies public keys not
-found in TXT records.
-
-2.3.1.  TXT
-
-Opportunistic-encryption SG discovery uses TXT records  with
-the content:
-
-     X-IPsec-Gateway(nnn)=iii kkk
-
-following  RFC 1464 attribute/value notation.  Records which
-do not contain an ``='', or which do not  have  exactly  the
-specified form to the left of it, are ignored.  (Near misses
-perhaps should be reported.)
-
-The nnn is an unsigned integer which will fit  in  16  bits,
-specifying  an  MX-style preference (lower number = stronger
-preference) to control the order in which multiple  SGs  are
-tried.   If  there  are ties, pick one, randomly enough that
-the choice will probably be different each time.  The  pref-
-erence field is not optional; use ``0'' if there is no mean-
-ingful preference ordering.
-
-The iii part identifies the SG.  Normally this is a  dotted-
-decimal  IPv4 address or a colon-hex IPv6 address.  The sole
-exception is if the SG has no fixed address  (see  2.4)  but
-the  host(s)  behind it do, in which case iii is of the form
-``@fqdn'', where fqdn is the FQDN that the SG  will  use  to
-identify  itself  (in  step 7 of section 2.2); such a record
-
-
-
-Draft 4                  3 May 2001                        9
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-cannot be used for SG discovery by an Initiator, but can  be
-used for SG verification (step 11 of 2.2) by a Responder.
-
-The  kkk  part is optional.  If it is present, it is an RSA-
-MD5 public key in base-64 notation, as in the text  form  of
-an  RFC  2535 KEY record.  If it is not present, this speci-
-fies that the public key  can  be  found  in  a  KEY  record
-located  based  on  the SG's identification: if iii is an IP
-address, do a reverse lookup on that address, else do a for-
-ward lookup on the FQDN.
-
-Rationale:  While  it  is unusual for a reverse lookup to go
-for records  other  than  PTR  records  (or  possibly  CNAME
-records, for RFC 2317 classless delegation), there's no rea-
-son why it can't.  The TXT record is  a  temporary  stand-in
-for  (we  hope, someday) a new DNS record for SG identifica-
-tion and keying.  Keeping the setup  process  fast  requires
-minimizing  the  number  of DNS lookups, hence the desire to
-put all the information in one place.
-
-Rationale: The use of RFC 1464  notation  avoids  collisions
-with other uses of TXT records.  The ``X-'' in the attribute
-name indicates that this format is tentative and  experimen-
-tal;  this design will probably need modification after ini-
-tial experiments.  The format is chosen with an eye on even-
-tual  binary  encoding.   Note,  in particular, that the TXT
-record normally contains the address of the SG, not (repeat,
-not)  its  name.   Name-to-address  conversion is the job of
-whatever generates the TXT record, which is expected to be a
-program,  not a human--this is conceptually a binary record,
-temporarily using a text encoding.  The  ``@fqdn''  form  of
-the  SG identity is for specialized uses and is never mapped
-to an address.
-
-Ahem: A DNS  TXT  record  contains  one  or  more  character
-strings, but RFC 1035 does not describe exactly how a multi-
-string TXT record is interpreted.  This is relevant  because
-a  string can be at most 255 characters, and public keys can
-exceed this.  Empirically, the standard pattern is that each
-string  which  is  both less than 255 characters and not the
-final string of the record should have a blank  appended  to
-it,  and  the  strings of the record should then be concate-
-nated.  (This observation is based on how BIND 8  transforms
-a TXT record from text to DNS binary.)
-
-2.3.2.  KEY
-
-An opportunistic-encryption KEY record is an Authentication-
-permitted,  Entity  (host),  non-Signatory,  IPsec,  RSA/MD5
-record  (that  is,  its first four bytes are 0x42000401), as
-per RFCs 2535 and 2537.  KEY records with other flags,  pro-
-tocol, or algorithm values are ignored.
-
-
-
-
-
-Draft 4                  3 May 2001                       10
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-Rationale:  Unfortunately,  the public key has to be associ-
-ated with the SG,  not  the  client  host  behind  it.   The
-Responder  does  not  know which client it is supposed to be
-representing, or which client the Initiator is representing,
-until far too late.
-
-Ahem: Per-client keys would reduce vulnerability to key com-
-promise, and simplify key changes, but  they  would  require
-changes  to  IKE  Phase 1, to separately identify the SG and
-its initial client(s).  (At present, the  client  identities
-are  not  known  to the Responder until IKE Phase 2.)  While
-the current IKE standard does not actually specify  (!)  who
-is  being  identified by identity payloads, the overwhelming
-consensus is that they identify the SG, and as seen earlier,
-this has important uses.
-
-2.3.3.  Summary
-
-For reference, the minimum set of DNS records needed to make
-this all work is either:
-
-1.  TXT in Destination reverse  map,  identifying  Responder
-    and providing public key.
-
-2.  KEY in Initiator reverse map, providing public key.
-
-3.  TXT  in  Source  reverse  map, verifying relationship to
-    Initiator.
-
-or:
-
-1.  TXT in Destination reverse map, identifying Responder.
-
-2.  KEY in Responder reverse map, providing public key.
-
-3.  KEY in Initiator reverse map, providing public key.
-
-4.  TXT in Source reverse  map,  verifying  relationship  to
-    Initiator.
-
-Slight  complications  ensue  for dynamic addresses, lack of
-control over reverse maps, etc.
-
-2.3.4.  Implementation
-
-In the long run, we need either a tree of trust or a web  of
-trust,  so  we can trust our DNS data.  The obvious approach
-for DNS is a tree of trust, but there are various  practical
-problems  with running all of this through the root servers,
-and a web of trust is arguably more robust anyway.  This  is
-logically  independent  of  opportunistic  encryption, and a
-separate design proposal will be prepared.
-
-
-
-
-
-Draft 4                  3 May 2001                       11
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-Interim stages of implementation of this will require a  bit
-of  thought.   Notably, we need some way of dealing with the
-lack of fully signed DNSSEC  records  right  away.   Without
-user interaction, probably the best we can do is to remember
-the results of old fetches, compare them to the  results  of
-new  fetches,  and  complain  and  disbelieve  all  of it if
-there's a mismatch.  This does mean that somebody  who  gets
-fake  data  into our very first fetch will fool us, at least
-for a while, but that seems an acceptable tradeoff.   (Obvi-
-ously  there  needs to be a way to manually flush the remem-
-bered results for a  specific  host,  to  permit  deliberate
-changes.)
-
-2.4.  Responders Without Credentials
-
-In  cases  where the Destination simply does not control its
-DNS reverse-map entries,  there  is  no  verifiable  way  to
-determine  a  suitable SG.  This does not make communication
-utterly impossible, though.
-
-Simply attempting negotiation directly with the  host  is  a
-last  resort.   (An  aggressive implementation might wish to
-attempt it in parallel,  rather  than  waiting  until  other
-options  are  known  to  be unavailable.)  In particular, in
-many cases involving dynamic addresses, it  will  work.   It
-has  the  disadvantage of delaying the discovery that oppor-
-tunistic encryption is entirely  impossible,  but  the  case
-seems common enough to justify the overhead.
-
-However, there are policy issues here either way, because it
-is possible to impersonate such a host.  The host can supply
-an  FQDN identity and verify its right to use that identity,
-but except by prearrangement, there is no way to verify that
-the  FQDN  is  the right one for that IP address.  (The data
-from forward lookups may be controlled by people who do  not
-own  the  address, so it cannot be trusted.)  The encryption
-is still solid, though, so in many cases this may be useful.
-
-2.5.  Failure of Opportunism
-
-When  there is no way to do opportunistic encryption, a pol-
-icy issue arises: whether to put in a bypass  (which  allows
-plaintext  traffic  through)  or a block (which discards it,
-perhaps with notification back to the sender).   The  choice
-is  very  much  a  matter of local policy, and may depend on
-details such as the higher-level protocol being  used.   For
-example,  an  SG might well permit plaintext HTTP but forbid
-plaintext Telnet, in which case both a block  and  a  bypass
-would be set up if opportunistic encryption failed.
-
-A  bypass/block  must,  in practice, be treated much like an
-IPsec tunnel.  It should persist for a while, so that  high-
-overhead  processing  doesn't  have  to  be  done  for every
-packet, but should go away eventually to  return  resources.
-
-
-
-Draft 4                  3 May 2001                       12
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-It  may  be simplest to treat it as a degenerate tunnel.  It
-should have a relatively long lifetime (say 6h) to keep  the
-frequency  of  negotiation attempts down, except in the case
-where the other SG simply did not respond  to  IKE  packets,
-where  the  lifetime should be short (say 10min) because the
-other SG is presumably down and might come  back  up  again.
-(Cases  where the other SG responded to IKE with unauthenti-
-cated error reports like ``port  unreachable''  are  border-
-line,  and  might  deserve  to be treated as an intermediate
-case: while such reports cannot be trusted unreservedly,  in
-the  absence of any other response, they do give some reason
-to suspect that the other SG is unable or unwilling to  par-
-ticipate in opportunistic encryption.)
-
-As  noted  in section 2.1, one might think that arrival of a
-plaintext incoming packet should cause a bypass/block to  be
-set  up  for its source host: such a packet is almost always
-followed by an outgoing reply packet; the incoming packet is
-clear  evidence  that opportunistic encryption is not avail-
-able at the other end; attempting it  will  waste  resources
-and  delay  traffic to no good purpose.  Unfortunately, this
-means that anyone out on the Internet who can forge a source
-address  can  prevent  encrypted communication!  Since their
-source addresses are not  authenticated,  plaintext  packets
-cannot be taken as evidence of anything, except perhaps that
-communication from that host is likely to occur soon.
-
-There needs to be a way for local administrators to remove a
-bypass/block  ahead  of  its  normal expiry time, to force a
-retry after a problem at the other end is known to have been
-fixed.
-
-2.6.  Subnet Opportunism
-
-In principle, when the Source or Destination host belongs to
-a subnet and the corresponding SG is willing to provide tun-
-nels  to the whole subnet, this should be done.  There is no
-extra overhead,  and  considerable  potential  for  avoiding
-later  overhead  if  similar communication occurs with other
-members of the subnet.  Unfortunately, at the moment, oppor-
-tunistic  tunnels  can  only have degenerate subnets (single
-hosts) at their ends.  (This does, at least, set up the key-
-ing channel, so that negotiations for tunnels to other hosts
-in the same subnets will be considerably faster.)
-
-The crucial problem is step 11 of section 2.2: the Responder
-must  verify  that  the Initiator is authorized to represent
-the Source, and this is  impossible  for  a  subnet  because
-there  is  no way to do a reverse lookup on it.  Information
-in DNS records for a name or  a  single  address  cannot  be
-trusted, because they may be controlled by people who do not
-control the whole subnet.
-
-
-
-
-
-Draft 4                  3 May 2001                       13
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-Ahem: Except in the special case of a  subnet  masked  on  a
-byte  boundary  (in  which  case RFC 1035's convention of an
-incomplete in-addr.arpa name could be used),  subnet  lookup
-would need extensions to the reverse-map name space, perhaps
-along the lines of that commonly done for RFC  2317  delega-
-tion.   IPv6  already  has  suitable  name syntax, as in RFC
-2874, but has no specific provisions for subnet  entries  in
-its  reverse  maps.   Fixing all this is is not conceptually
-difficult, but is  logically  independent  of  opportunistic
-encryption, and will be proposed separately.
-
-A less-troublesome problem is that the Initiator, in step 10
-of 2.2, must know exactly what  subnet  is  present  on  the
-Responder's  end  so  he  can  propose a tunnel to it.  This
-information could be included in the TXT record of the  Des-
-tination (it would have to be verified with a subnet lookup,
-but that could be done in parallel with  other  operations).
-The Initiator presumably can be configured to know what sub-
-net(s) are present on its end.
-
-2.7.  Option Settings
-
-IPsec and IKE have far too many useless options, and  a  few
-useful  ones.  IKE negotiation is quite simplistic, and can-
-not handle even simple discrepancies between  the  two  SGs.
-So it is necessary to be quite specific about what should be
-done and what should be proposed,  to  guarantee  interoper-
-ability  without  prearrangement or other negotiation proto-
-cols.
-
-Rationale: The prohibition of other negotiations  is  simply
-because there is no time.  The setup algorithm (section 2.2)
-is lengthy already.
-
-[Open question: should opportunistic  IKE  use  a  different
-port than normal IKE?]
-
-Somewhat arbitrarily and tentatively, opportunistic SGs must
-support Main Mode, Oakley group 5 for D-H,  3DES  encryption
-and  MD5  authentication  for  both  ISAKMP  and  IPsec SAs,
-RSA/MD5 digital-signature authentication with  keys  between
-2048  and  8192  bits,  and  ESP  doing  both encryption and
-authentication.  They must do key PFS in Quick Mode, but not
-identity  PFS.   They  may  support IPComp, preferably using
-Deflate, but must not insist on it.  They may support AES as
-an alternative to 3DES, but must not insist on it.
-
-Rationale:  Identity PFS essentially requires establishing a
-complete new keying channel for each new tunnel, but key PFS
-just  does  a new Diffie-Hellman exchange for each rekeying,
-which is relatively cheap.
-
-Keying channels must remain in existence at least as long as
-any  tunnel  created with them remains (they are not costly,
-
-
-
-Draft 4                  3 May 2001                       14
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-and keeping the management path up and available  simplifies
-various issues).  See section 3.1 for related issues.  Given
-the use of key PFS, frequent rekeying does not seem critical
-here.   In the absence of strong reason to do otherwise, the
-Initiator  should  propose  rekeying  at  8hr-or-1MB.    The
-Responder  must accept any proposal which specifies a rekey-
-ing time between 1hr and 24hr inclusive and a rekeying  vol-
-ume between 100KB and 10MB inclusive.
-
-Given  the  short  expected useful life of most tunnels (see
-section 3.1), very few of them will survive long  enough  to
-be  rekeyed.   In  the absence of strong reason to do other-
-wise, the Initiator should propose rekeying at 1hr-or-100MB.
-The  Responder  must  accept  any proposal which specifies a
-rekeying time between 10min and 8hr inclusive and a rekeying
-volume between 1MB and 1000MB inclusive.
-
-It  is  highly  desirable  to  add some random jitter to the
-times of actual rekeying attempts, to break  up  ``convoys''
-of rekeying events; this and certain other aspects of robust
-rekeying practice will be the subject of a  separate  design
-proposal.
-
-Rationale:  The numbers used here for rekeying intervals are
-chosen quite arbitrarily and  should  be  re-assessed  after
-some implementation experience is gathered.
-
-3.  Renewal and Teardown
-
-3.1.  Aging
-
-When to tear tunnels down is a bit problematic, but if we're
-setting up a potentially unbounded number of them,  we  have
-to tear them down somehow sometime.
-
-Set a short initial tentative lifespan, say 1min, since most
-net flows in fact  last  only  a  few  seconds.   When  that
-expires,  look to see if the tunnel is still in use (defini-
-tion: has had traffic, in either direction, in the last half
-of  the  tentative  lifespan).   If so, assign it a somewhat
-longer tentative lifespan,  say  20min,  after  which,  look
-again.   If not, close it down.  (This tentative lifespan is
-independent of rekeying; it is just the time when  the  tun-
-nel's future is next considered.  This should happen reason-
-ably  frequently,  unlike  rekeying,  which  is  costly  and
-shouldn't  be  too frequent.)  Multi-step backoff algorithms
-are not worth the trouble; looking every 20min doesn't  seem
-onerous.
-
-If  the security gateway and the client host are one and the
-same, tunnel teardown decisions might wish to pay  attention
-to  TCP  connection  status,  as  reported  by the local TCP
-layer.  A still-open TCP connection is  almost  a  guarantee
-that  more  traffic  is coming, while the demise of the only
-
-
-
-Draft 4                  3 May 2001                       15
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-TCP connection through a tunnel is a strong hint  that  none
-is.   If  the  SG and the client host are separate machines,
-though,  tracking  TCP  connection  status  requires  packet
-snooping,  which is complicated and probably not worthwhile.
-
-IKE keying channels likewise are torn down when  it  appears
-the  need  has  passed.   They always linger longer than the
-last tunnel they administer, in case they are needed  again;
-the  cost of retaining them is low.  Other than that, unless
-the number of keying channels on the SG gets large,  the  SG
-should  simply retain all of them until rekeying time, since
-rekeying is the only costly event.  When about  to  rekey  a
-keying  channel  which has no current tunnels, note when the
-last actual keying-channel traffic occurred, and  close  the
-keying  channel  down  if it wasn't in the last, say, 30min.
-When rekeying a keying channel (or  perhaps  shortly  before
-rekeying  is  expected),  Initiator and Responder should re-
-fetch the public keys used for  SG  authentication,  against
-the possibility that they have changed or disappeared.
-
-See section 2.7 for discussion of rekeying intervals.
-
-Given  the  low user impact of tearing down and rebuilding a
-connection (a tunnel or a keying channel), rekeying attempts
-should  not  be  too persistent: one can always just rebuild
-when needed, so heroic efforts to preserve an existing  con-
-nection  are  unnecessary.   Say, try every 10s for a minute
-and every minute for 5min, and then give up and declare  the
-connection  (and  all  other  connections  to that IKE peer)
-dead.
-
-Rationale: In future, more sophisticated, versions  of  this
-protocol,  examining  the initial packet might permit a more
-intelligent guess at the tunnel's useful life.  HTTP connec-
-tions in particular are notoriously bursty and repetitive.
-
-Rationale:  Note that rekeying a keying connection basically
-consists of building a new keying connection  from  scratch,
-using IKE Phase 1, and abandoning the old one.
-
-3.2.  Teardown and Cleanup
-
-Teardown  should  always  be coordinated with the other end.
-This means interpreting and sending Delete notifications.
-
-On receiving a Delete for the outbound SAs of a  tunnel  (or
-some  subset  of  them), tear down the inbound ones too, and
-notify the other end with a Delete.  Tunnels need to be con-
-sidered as bidirectional entities, even though the low-level
-protocols don't think of them that way.
-
-When the deletion is initiated locally,  rather  than  as  a
-response  to  a received Delete, send a Delete for (all) the
-inbound SAs  of  a  tunnel.   If  no  responding  Delete  is
-
-
-
-Draft 4                  3 May 2001                       16
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-received  for  the outbound SAs, try re-sending the original
-Delete.  Three tries spaced 10s  apart  seems  a  reasonable
-level  of effort.  (Indefinite persistence is not necessary;
-whether the other end isn't cooperating because  it  doesn't
-feel  like  it, or because it is down/disconnected/etc., the
-problem will eventually be cleared up by other means.)
-
-After rekeying, transmission should switch to using the  new
-SAs  (ISAKMP or IPsec) immediately, and the old leftover SAs
-should be cleared out promptly  (and  Deletes  sent)  rather
-than  waiting  for them to expire.  This reduces clutter and
-minimizes confusion.
-
-Since there  is  only  one  keying  channel  per  remote  IP
-address,  the  question of whether a Delete notification has
-appeared on a ``suitable'' keying channel does not arise.
-
-Rationale: The pairing of Delete  notifications  effectively
-constitutes  an  acknowledged Delete, which is highly desir-
-able.
-
-3.3.  Outages and Reboots
-
-Tunnels sometimes go down because the other end crashes,  or
-disconnects,  or  has  a network link break, and there is no
-notice of this in the general case.  (Even in the event of a
-crash  and  successful reboot, other SGs don't hear about it
-unless the rebooted SG has specific reason to talk  to  them
-immediately.)  Over-quick response to temporary network out-
-ages is undesirable...  but note that a tunnel can  be  torn
-down and then re-established without any user-visible effect
-except a pause in traffic, whereas if one end  does  reboot,
-the  other  end  can't  get packets to it at all (except via
-IKE) until the situation is noticed.  So a bias toward quick
-response  is  appropriate,  even  at  the cost of occasional
-false alarms.
-
-Heartbeat mechanisms are somewhat unsatisfactory  for  this.
-Unless  they are very frequent, which causes other problems,
-they do not detect the problem promptly.
-
-Ahem: What is really wanted  is  authenticated  ICMP.   This
-might  be  a case where public-key encryption/authentication
-of network packets is the right thing  to  do,  despite  the
-expense.
-
-In the absence of that, a two-part approach seems warranted.
-
-First, when an SG receives an IPsec packet that is addressed
-to  it,  and  otherwise  appears  healthy,  but specifies an
-unknown SA and is from a host that  the  receiver  currently
-has  no  keying  channel  to,  the  receiver must attempt to
-inform the sender via an  IKE  Initial-Contact  notification
-(necessarily  sent  in plaintext, since there is no suitable
-
-
-
-Draft 4                  3 May 2001                       17
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-keying channel).  This must be severely rate-limited on both
-ends; one notification per SG pair per minute seems ample.
-
-Second,  there  is an obvious difficulty with this: the Ini-
-tial-Contact notification is unauthenticated and  cannot  be
-trusted.   So it must be taken as a hint only: there must be
-a way to confirm it.
-
-What is needed here is something that's desirable for debug-
-ging and testing anyway: an IKE-level ping mechanism.  Ping-
-ing direct at the IP level instead will not tell us about  a
-crash/reboot event.  Sending pings through tunnels has vari-
-ous complications (they should stop at the far mouth of  the
-tunnel  instead  of  going  on  to a subnet; they should not
-count against idle timers; etc.).  What is needed is a  con-
-tinuity check on a keying channel.  (This could also be used
-as a heartbeat, should that seem useful.)
-
-IKE Ping delivery need not  be  reliable,  since  the  whole
-point  of  a  ping  is simply to provoke an acknowledgement.
-They should preferably be authenticated, but it is not clear
-that  this is absolutely necessary, although if they are not
-they need encryption plus a timestamp or a  nonce,  to  foil
-replay  mischief.   How  they are implemented is a secondary
-issue, and a separate design proposal will be prepared.
-
-Ahem: Some existing implementations are already using  (pri-
-vate)  notify value 30000 (``LIKE_HELLO'') as ping and (pri-
-vate) notify value 30002 (``SHUT_UP'') as ping reply.
-
-If an IKE Ping gets no response, try some (say 8) IP  pings,
-spaced a few seconds apart, to check IP connectivity; if one
-comes back, try another IKE Ping; if that gets no  response,
-the  other  end probably has rebooted, or otherwise been re-
-initialized, and its tunnels and keying channel(s) should be
-torn down.
-
-In  a  similar  vein, giving limited rekeying persistence, a
-short network outage could take some  tunnels  down  without
-disrupting  others.  On receiving a packet for an unknown SA
-from a host that a keying channel is currently open to, send
-that host a Invalid-SPI notification for that SA.  The other
-host can then tear down the half-torn-down tunnel, and nego-
-tiate a new tunnel for the traffic it presumably still wants
-to send.
-
-Finally, it would be helpful if SGs  made  some  attempt  to
-deal  intelligently  with crashes and reboots.  A deliberate
-shutdown should include an attempt to notify all  other  SGs
-currently  connected by keying channels, using Deletes, that
-communication is about to fail.  (Again, these will be taken
-as  teardowns;  attempts  by  the other SGs to negotiate new
-tunnels as replacements should be ignored  at  this  point.)
-And   when   possible,   SGs   should  attempt  to  preserve
-
-
-
-Draft 4                  3 May 2001                       18
-
-
-
-
-
-                  Opportunistic Encryption
-
-
-information about currently-connected  SGs  in  non-volatile
-storage,  so  that  after a crash, an Initial-Contact can be
-sent to previous partners to indicate  loss  of  all  previ-
-ously-established connections.
-
-4.  Conclusions
-
-This  design  appears to achieve the objective of setting up
-encryption with strangers.  The authentication aspects  also
-seem  adequately  addressed  if the destination controls its
-reverse-map DNS entries and the DNS data itself can be reli-
-ably  authenticated as having originated from the legitimate
-administrators of that subnet/FQDN.  The authentication sit-
-uation is less satisfactory when DNS is less helpful, but it
-is difficult to see what else could be done about it.
-
-5.  References
-
-[TBW]
-
-6.  Appendix:  Separate Design Proposals TBW
-
-o  How can we build a web of trust with DNSSEC?   (See  sec-
-   tion 2.3.4.)
-
-o  How  can  we extend DNS reverse lookups to permit reverse
-   lookup on a subnet?  (Both address and mask  must  appear
-   in the name to be looked up.)  (See section 2.6.)
-
-o  How  can  rekeying  be done as robustly as possible?  (At
-   least partly, this is just documenting current  FreeS/WAN
-   practice.)  (See section 2.7.)
-
-o  How  should IKE Pings be implemented?  (See section 3.3.)
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Draft 4                  3 May 2001                       19
-
-
diff --git a/doc/opportunism.howto b/doc/opportunism.howto
deleted file mode 100644
index 14b5ed5a2..000000000
--- a/doc/opportunism.howto
+++ /dev/null
@@ -1,415 +0,0 @@
-FreeS/WAN Opportunism HowTo
-===========================
-
-RCSID $Id: opportunism.howto,v 1.1 2004/03/15 20:35:21 as Exp $
-
-D. Hugh Redelmeier
-
-
-FreeS/WAN, the LINUX IPSEC implementation, is intended to allow
-systems to connect through secure tunnels with or without prearrangement.
-We use the term "Opportunism" to describe tunnels set up without
-prearrangement.  This HowTo will show you how to set your system up
-for Opportunism.
-
-You are expected to already have built and used FreeS/WAN.  Much more
-information about FreeS/WAN is provided at http://www.freeswan.org.
-This document is only intended to describe the support for
-opportunism.  The features described here are available in FreeS/WAN
-version 1.91 or later (there were important bugs up until 1.95).
-
-For a more complete description of the design of Opportunism, see our
-paper "Opportunistic Encryption" (available as opportunism.spec in
-the same directory as this document).
-
-
-Steps
-=====
-
-- Understand what you are attempting.  Security requires care.
-  Problems are hard to untangle.  Be sure to read the last section
-  "Important Limitations".
-
-- Install FreeS/WAN (version 1.91 or later).
-
-- Add appropriate DNS records to your reverse-map domains.
-
-- Add suitable conns to /etc/ipsec.conf.
-
-- Try it out: start it, monitor it, fix it.
-
-- Now you understand the system better, reread "Important Limitations"
-
-These steps are also an outline of this document.
-
-
-Theory
-======
-
-FreeS/WAN runs on a machine that we will call a "Security Gateway".
-Usually this machine is a gateway to the internet.  It may be that the
-only machine for which it provides gateway services is itself, but
-that is just a special case -- we will still call it a Security
-Gateway.
-
-A FreeS/WAN Security Gateway implements secure tunnels to other
-Security Gateways.  One problem is to arrange for these tunnels to be
-created and used.  If opportunism is enabled, a Security Gateway
-running FreeS/WAN will intercept the first outbound packet to a
-particular destination (IP address), and try to negotiate a security
-tunnel suitable for traffic to that destination.
-
-To make this work going the other way, the Security Gateway must be
-willing to negotiate with peers trying to protect traffic initiated
-from their side.
-
-The first novel problem is that our Security Gateway needs to discover
-the IP address of the other Security Gateway for the packet that
-prompted the negotiation.  Oh, and quickly discover if there is none
--- that negotiation will be impossible.
-
-The second novel problem is that our Security Gateway needs to
-authenticate the other Security Gateway.  This authentication needs to
-ensure that the other Security Gateway is who it claims to be AND that
-it is authorized to represent the client for which it claims to be the
-gateway.
-
-The roles in a particular negotiation are:
-     Source----Initiator----...----Responder----Destination
-
-The Source and Destination are endpoints of the traffic that is to be
-protected.  The Source is the one that happened to send the first
-packet of traffic.  Neither needs to be aware of IPSEC or FreeS/WAN.
-That is the job of their respective Security Gateways, Initiator and
-Responder.  The names "Initiator" and "Responder" match those used in
-the IPSEC standards for IKE negotiation.  Remember that Source and
-Initiator could be the same machine; similarly, Destination and
-Responder could be the same.  All traffic from Source or Destination
-must flow through their Security Gateways if it is to be considered
-for protection.  These roles are fluid -- they can be different for
-each negotiation.
-
-We use the DNS (the Domain Name System) as a distributed database to
-publish the required information.
-
-
-DNS Records Required
-====================
-
-See section 2.3 of "Opportunistic Encryption" for a fuller
-explanation.
-
-Generally, we need to add records to the reverse-map DNS entries for
-the client machine and its Security Gateway machine.  There are
-special cases that are exceptions.
-
-A Security Gateway that is going to initiate an Opportunistic
-negotiation needs to provide a way for the Responding SG to find a
-public key for the Initiator to allow authentication.  This is
-accomplished by putting the public key in a KEY record in the
-reverse-map of the Initiator.  Conveniently, the KEY record can
-be generated by the ipsec_showhostkey(8) command.
-
-	ipsec showhostkey
-
-Here is an example of the output, with many characters of the key
-itself left out:
-
-	; RSA 2048 bits   xy.example.com   Sat Apr 15 13:53:22 2000
-	xy.example.com.   IN   KEY   0x4200 4 1 AQOF8tZ2...+buFuFn/
-
-=> Copy the output of the command into the zone information for the
-   reverse-map of the Security Gateway's public interface.
-
-Each client that is to be protected by Opportunistic Encryption must
-include a special TXT record in its reverse-map.  The
-ipsec_showhostkey(8) command can create this too.  Remember:  this
-command must be run on the Security Gateway where the ipsec.secrets
-file resides.  You must tell the command what IP address to put in the
-TXT record.  The IP address is that of the Security Gateway.
-
-	ipsec showhostkey --txt 10.11.12.13
-
-This command might produce the output:
-
-	; RSA 2048 bits   xy.example.com   Sat Apr 15 13:53:22 2000
-	IN TXT  "X-IPsec-Server(10)=10.11.12.13 AQOF8tZ2...+buFuFn/"
-
-- The quotes matter: this is a single string, as far as DNS is
-  concerned.
-
-- The X-IPsec-Server is a prefix that signifies that the TXT record
-  contains Opportunism configuration information.
-
-- The (10) specifies a precedence for this record.  This is similar
-  to MX record preferences.  Lower numbers have stronger preference.
-
-- 10.11.12.13 specifies the IP address of the Security Gateway for
-  this machine.
-
-- AQOF8tZ2...+buFuFn/ is the (shortened) encoding of the RSA Public
-  key of the Security Gateway.
-
-=> Added this output to the zone information for the reverse-map for
-   each client machine.  This gets a bit dull and repetitive.
-
-Unfortunately, not every administrator has control over the contents
-of the reverse-map.  The only case where we can work around this is
-where the Initiator has no suitable reverse map.  In this case, the
-Source's TXT record gives @FQDN ("Fully Qualified Domain Name") in
-place of its Security Gateway's IP address.  This FQDN must match the
-ID-payload used by the Initiator.  Furthermore, a forward lookup for a
-KEY record on the FQDN must yield the Initiator's public key.
-
-If the Source's IP address is the same as the Initiator's IP address,
-the Responder will assume that the Initiator is authorized to talk for
-the Source (itself!).  In this case, the Responder won't try to fetch
-the Source's TXT record from the reverse map for the Source's IP
-address.
-
-These two features can be combined.  If the Source and the Initiator
-are the same (i.e. the Security Gateway is protecting itself), and the
-Initiator uses a @FQDN ID (leftid=@example.com), then the
-administrator of that machine need only have installed a KEY record in
-the FQDN domain -- he need not control any reverse map.
-
-Obscure fact: the forward lookup is only done by a Responder, and then
-only when the Initiator's ID payload specifies the FQDN.  There is no
-provision for a Responder with no control over its reverse-map.
-
-Beware: DNS changes sometimes take a long time to propagate.
-
-
-Configuring FreeS/WAN
-=====================
-
-To enable opportunism, you must include a suitable conn in
-/etc/ipsec.conf and you must enable it.
-
-A suitable conn looks roughly like an ordinary conn.  It more closely
-resembles a Road Warrior conn (a Road Warrior conn is one that has a
-wildcard %any specified as the other Security Gateway).  But in the
-Opportunistic case, both the other Security Gateway AND its client are
-unknown ahead of time.
-
-conn client-to-anyone	# for our client subnet
-	leftsubnet=10.3.2.1.0/24	# any single client in our subnet
-	also=sg-to-anyone	# rest is same as for SG
-
-conn sg-to-anyone	# for our Security Gateway
-	left=%defaultroute	# our SG (defaults leftnexthop too)
-	right=%opportunistic
-	authby=rsasig	# almost always the right choice
-	keyingtries=2	# don't be persistent -- peer might disappear
-	auto=route	# enable at ipsec startup
-
-(%defaultroute only works if you have specified
-interfaces=%defaultroute.  Since this isn't the topic of the howto,
-you will have to look at the other documentation to find out how to
-handle other cases.)
-
-You can have any number of opportunistic conns, but generally it only
-makes sense to have one for each client subnet and one for the
-Security Gateway itself.
-
-Currently only one interface may be used for opportunism: Pluto knows
-nothing about routing, so would be unable to choose amongst several.
-Almost certainly our side's nexthop must be predetermined
-(%defaultroute will do that).
-
-Note: the routing done for outbound Opportunism will catch any packets
-not covered by a more specific route.  This is what you want for
-packets that are also covered by an eroute.  But packets caught by the
-route and not an eroute will be subject to the no-eroute policy of
-KLIPS, which defaults to %drop.  Remember that routing ignores the
-packet's source address, but erouting pays attention to it.  So if
-Opportunism is enabled, it is best to provide for it covering all IP
-addresses behind or on the Security Gateway.
-
-To enable these conns for inbound opportunistic negotiation, they must be
---added.  auto=add would accomplish this at ipsec startup, but if you cannot
-wait:
-	ipsec auto --add sg-to-anyone
-	ipsec auto --add client-to-anyone
-
-To enable these conns for outbound opportunistic negotiation, they must
-be both --added and --routed.  Outbound packets will then be trapped
-and will trigger negotiation.  auto=route would cause this to happen
-at startup, but if you wish to do this at another time:
-	ipsec auto --add sg-to-anyone
-	ipsec auto --add client-to-anyone
-	ipsec auto --route sg-to-anyone
-	ipsec auto --route client-to-anyone
-
-
-Getting DNS Through
-===================
-
-There is a serious chicken-and-egg problem.  Outbound Opportunism blocks
-communication with an IP address until Pluto discovers whether that IP
-address can have an IPSEC connection negotiated.  This discovery takes
-DNS queries.  These DNS queries might involve communicating with
-arbitrary IP addresses.  Thus we require DNS queries to succeed before
-any communication succeeds, including those same DNS queries!  The way
-out of this conundrum is to exempt at least some DNS query IP traffic
-from Opportunism.
-
-There are several possible solutions, all of which have advantages and
-disadvantages.
-
-1. If you use a single machine, outside your Security Gateway, as DNS
-server, you can build a clear path (or even an IPSEC tunnel, but not
-opportunistically) directly to that machine.
-
-- you could use a type=passthrough conn to provide a clear path
-  between your machine and the DNS machine.
-
-- better still, you could explicitly create an IPSEC connection to
-  your DNS server.  Just be sure that Pluto does not need to access
-  DNS to find the IP addresses or RSA public keys for that connection!
-
-- you could install an explicit route to the DNS machine through
-  your public interface (not ipsecN).  This will bypass KLIPS
-  processing.  You might have to adjust your firewall.  For example:
-
-  	route add host -net ns.example.com gw gw.example.com dev eth1
-
-2. Generally, it is better to run DNS on your Security Gateway.  This
-leads to a need for non-opportunistic paths to an arbitrary number of
-DNS servers in the internet.  One way to accomplish this is to NOT
-have outbound opportunism cover the SG itself, but only the subnet
-behind it.  In other words, leave out the
-	ipsec auto --route sg-to-anyone
-You must also add a type=passthrough eroute specifically for
-sg-to-anyone (without this, the traffic will be handled by the KLIPS
-no-eroute policy).
-
-3. It is actually possible to use a single machine inside your client
-subnet as a DNS server.  The techniques listed in 1 could be used to
-let it communicate with other DNS servers without interference.  This
-might have advantages over 1 if the DNS machine *only* did DNS.
-Another technique (not often possible or reasonable) is to give this
-machine another route to the internet, one that avoids the SG.
-
-4. DNS queries will eventually time out and then Pluto will give up
-and establish %pass eroutes.  So communications should start flowing.
-
-We would like to have better solutions.  Perhaps we will in the
-future.  Suggestions are welcome.
-
-
-Figuring out what is going on
-=============================
-
-Since Opportunism lets your SG operate with less supervision, you may
-be puzzled by what it is up to.  The usual tools exist, but their use
-is more important.  To look at what Pluto is doing, use:
-	ipsec auto --status
-To look at what KLIPS is doing, use
-	ipsec look
-
-To just see the kernel's eroute table, look at the "file"
-/proc/net/ipsec_eroute.  It contains a description of all the eroutes
-in the kernel.  Here is an example:
-
-10         10.2.1.0/24      -> 0.0.0.0/0          => %trap
-259        10.2.1.115/32    -> 10.19.75.161/32    => tun0x1002@10.19.75.145
-71         10.44.73.97/32   -> 0.0.0.0/0          => %trap
-4119       10.44.73.97/32   -> 10.114.121.41/32   => %pass
-
-You read each line as: a packet from within the first subnet, destined
-for the second subnet, will be processed by the Security Association
-Identity (SAID) specified last.  The first column is the number of
-(outbound) packets processed by this eroute.
-
-For shunt eroutes, the SAID is printed as just the type of shunt:
-%pass	pass the packet through with no processing
-%drop	discard the packet
-%reject	discard the packet and notify sender
-%hold	keep the last packet; discard others
-%trap	cause any trapped packet to generate a PF_KEY ACQUIRE
-	to request negotiation; install a corresponding %hold
-	shunt and attach this packet to the %hold
-
-For other eroutes, the SAID is printed as a triple: protocol (three
-letters), SPI (32-bit number in hex), and destination IP address.
-Protocols include:
-
-tun	IP in IP encapsulation (used for most tunnels)
-esp	ESP encapsulation -- part of an IPSEC SA group
-ah	AH packet authentication -- part of an IPSEC SA group
-
-So, looking at our sample eroutes:
-
-10         10.2.1.0/24      -> 0.0.0.0/0          => %trap
-
-	This is a TRAP (int0x104) shunt eroute.  It was installed by
-	Pluto so that it can catch all traffic from its client subnet
-	to the world at large.  Ten outbound packets have been trapped.
-
-259        10.2.1.115/32    -> 10.19.75.161/32    => tun0x1002@10.19.75.145
-
-	This is a tunnel eroute: packets from 10.2.1.115 (within
-	our client subnet) going to 10.19.75.161 will be encrypted
-	and sent to the peer SG 10.19.75.145.  This was the product
-	of an Opportunistic negotiation (a hint is that each client
-	subnet has only one member).  259 packets have been sent
-	through this tunnel.
-
-71         10.44.73.97/32   -> 0.0.0.0/0          => %trap
-
-	This is another TRAP shunt eroute.  It is to catch traffic
-	from the Security Gateway to the world.  It has caught
-	71 outbound packets.
-
-4119       10.44.73.97/32   -> 10.114.121.41/32   => %pass
-
-	This is a %pass (0x100) shunt eroute.  It was installed when an
-	attempted Opportunistic negotiation failed because the reverse
-	domain of 10.114.121.41 had no suitable TXT record.  4119
-	outbound packets have been passed.
-
-
-Important Limitations
-=====================
-
-Pluto's DNS lookup is synchronous (single-threaded).  Not only does
-this slow things down, but it turns out that in extreme cases where
-there are a lot of ACQUIRE messages from KLIPS at once, some of those
-messages can be lost and communications will be blocked by the %hold
-eroute that Pluto doesn't know about.  Pluto now looks every 2 minutes
-for any %holds that it missed.
-
-DNS lookup is not verified -- we don't use Secure DNS.  A spoofed DNS
-could compromise Opportunism.
-
-There are several new opportunities for Denial of Service attacks.
-For example, a Bad Guy could spray our system with pings with forged
-source addresses.  For each unique source address, our system would do
-a (synchronous!) DNS lookup.
-
-Once a %pass eroute is added for a failed negotiation, it will stay
-until it has been inactive for about 15 minutes.  The only activity
-that counts is outbound -- not surprising since a %pass only affects
-outbound traffic.
-
-If a destination's DNS entry specifies the information we need for
-negotiation, Pluto will not let communications proceed without
-negotiating a Security Tunnel.
-
-There is currently no way to tear down a tunnel that is no longer in
-use.  To add insult to injury, when the lifetime is about to be
-exceeded, the initiating Pluto will rekey!  Restarting will clear
-these out.  rekey=no doesn't solve this since SA expiry would be
-uncoordinated and hence cause packets to be lost.
-
-If one side of a Security Tunnel restarts, but doesn't initiate
-negotiation with its peer, the peer will not be able to communicate
-with it until the peer thinks the tunnel needs rekeying due to
-lifetime, or the restarted Security Gateway decides to negotiate for
-its own reasons.
-
-It isn't clear what firewall policies make sense with Opportunism.
-
-If VPN and Opportunism connections coexist, security policies
-implemented via a firewall can only distinguish traffic by IP address.
diff --git a/doc/opportunism.known-issues b/doc/opportunism.known-issues
deleted file mode 100644
index 90752dee3..000000000
--- a/doc/opportunism.known-issues
+++ /dev/null
@@ -1,287 +0,0 @@
-Known issues with Opportunistic Encryption                     Claudia Schmeing
-------------------------------------------
-
-
-This is an overview of known issues with OE.
-
-
-This document supplements:
-
-
-FreeS/WAN Quickstart Guide        doc/quickstart.html
-
-Opportunism HOWTO                 doc/opportunism.howto
-
-Opportunism spec                  doc/opportunism.spec
-
-Internet Draft                    doc/draft-richardson-ipsec-opportunistic.txt
-
-
-
-* Use the most recent Linux FreeS/WAN 2.x release from ftp.xs4all.nl 
-  to try OE.
-
-
-DESIGN LIMITATIONS
-
-
-* Because Opportunistic Encryption relies on DNS:
-  - to authenticate one FreeS/WAN to another, and
-  - to prove that we have the right to protect traffic for a given IP,
-  this authentication/authorization is only as strong as your DNS is 
-  secure.
-
-  Without secure DNS, OE protects against passive snooping only.
-  Because the public key and gateway information that FreeS/WAN gets from 
-  DNS is not authenticated, a man-in-the-middle attack is still possible.  
-  We hope that as DNSsec is widely adopted, OE with strong authentication
-  will become more widespread.
-
-  However, our software does not yet distinguish between strongly and weakly 
-  authenticated OE. This information might be useful for defining local 
-  security policy.
-
-
-* Denial of service attacks are possible against OE. If you rely on OE rather 
-  than VPN to connect several offices, a determined attacker could prevent you 
-  from communicating securely.
-
-
-* OE challenges the notion that all IPsec peers are "friends". With OE, 
-  strangers can potentially tunnel IPsec packets _through_ your defenses 
-  against cleartext packets. This may call for a re-visit to firewall policy.
-
-
-* FreeS/WAN only creates OE connections when it traps an outgoing packet.
-  Since most traffic is two-way, for most traffic, FreeS/WAN 2.x may soon 
-  trap an outgoing packet and create an IPsec connection to
-  protect both incoming and outgoing traffic. However, if a local 
-  FreeS/WAN box accepts inbound traffic from a remote peer but 
-  generates no outbound traffic in response, the local FreeS/WAN will not 
-  attempt to initiate OE. Of course, the peer may also initiate OE upon
-  trapping its own outbound traffic.
-  
-
-* OE is only as reliable as your DNS is.
-  
-  If your DNS service is flaky, you will not be able to reliably establish 
-  OE connections to known OE-capable peers.
-  
-  If you ping a peer, but your FreeS/WAN does not find a TXT record signifying 
-  the peer's ability to respond to OE negotiation), FreeS/WAN will not try to 
-  opportunistically initiate, and communication will fallback to clear.
-
-  For more secure and reliable DNS, we recommend that you run DNS
-  within your security perimeter, either on your security gateway, or
-  on a machine to which you have a VPN connection. It is also possible
-  to have your DNS server located elsewhere on your LAN, though this may
-  cause lag on startup.
-  
-  This mailing list message explains how to run a local caching name server:
-  http://lists.freeswan.org/pipermail/design/2003-January/004205.html
- 
-  See also "Getting DNS through" in opportunism.howto
-  http://lists.freeswan.org/pipermail/design/2002-April/002285.html .
-
-
-
-CURRENT ISSUES
-
-* There are several special issues re: using OE when running FreeS/WAN with
-  kernel native IPsec, introduced in the 2.6 kernel. Please see 
-  doc/2.6.known-issues.
-
-* If A and B have an OE connection, but A is rebooted, normally A will try to 
-  re-connect to B and (if it has no DNS-related failures) it will succeed. 
-  But, if A is set up for responder-only OE, you will have a one-way 
-  connection until B notices that its original tunnel has expired. For details 
-  see:
-
-      http://lists.freeswan.org/pipermail/design/2002-May/002582.html
-      http://lists.freeswan.org/pipermail/design/2002-June/002610.html
-
-  TIP:  If an OE connection isn't behaving, you can recreate it with
-
-      ipsec whack --oppohere sourceIPaddress --oppothere targetIPaddress
-
-
-* There is no good clean facility to delete OE connections.
-  Available are:
-
-      ipsec auto --status to list connections
-      ipsec whack --deletestate to delete by state#.
-   
-
-* You may experience seeming gaps at rekey time. Once you generate traffic,
-  you will find that the OE connection returns.
-
-  By default, OE connections are not rekeyed; if they were we'd have a 
-  mountain of useless connections. As a consequence, if your OE connection is
-  idle at rekey time, it will go down until you generate further traffic.
-  To ensure prompt rekeying, you can run a ping thorough the OE tunnel.
-
-
-* At the moment, you can only run active OE on one physical interface.
-
-  Active means --routed, to trap outbound packets.  It is this route
-  that is a problem.
-
-  Untested theory: you can have multiple active OE conns, for different 
-  source addresses, but they all have to point their traffic out the single 
-  interface.
-
-  When responding: you can only define one OE connection (per host or subnet) 
-  in ipsec.conf, and that conn will apply to one interface. Normally this 
-  will be the public interface which your default route uses; it is, however, 
-  configurable.
-
-  Theoretically, it might make sense to select between multiple OE conns 
-  based on some criterion, such as address ranges. This might be useful for 
-  local OE, or in a complex routing scenario.
-
-  Currently, Pluto expects only one OE connection. If you add another,
-  Pluto may choose randomly between them, producing unpredictable results.
-
-
-* Building OE conns between nodes on a LAN is not possible.
-
-  This is a side effect of conflicts about ARP entries 
-  in the rt_cache and our "stupid routing tricks".
-  There is no known workaround at this time.
-
-  "Stupid routing tricks" are an ongoing issue, and should
-  go away in a future software revision.
-
-  See these explanations:
-      http://lists.freeswan.org/pipermail/design/2002-April/002285.html
-      http://lists.freeswan.org/pipermail/design/2002-August/003249.html
-
-
-* FreeS/WAN may not correctly follow a CNAME (Canonical Name) trail resulting
-  from reverse DNS delegation.
-
-  Solution: Use a recent Bind 9 (we tested with Bind snap-pre9.3) for the 
-  DNS services which the FreeS/WAN box relies on. 
-
-  Reason: This Bind correctly implements "implied helper support" for 
-  traditional DNS records, and so can follow a properly constructed CNAME 
-  record trail which ends in a TXT record. Thus, in cases where a reverse 
-  domain has been delegated, FreeS/WAN + Bind 9 can find a TXT record and 
-  create an OE connection.
-
-  For more on the problem, see "OLD ISSUES", below.
-
-
-* To make OE operation smoother, we may need a script that runs and warns 
-  if we have the reverse DNS records, but not the software running.
-  The reverse records advertise that we can do OE, but when the software is
-  not running this is false advertising.
-
-
-
-OLD ISSUES
-
-* Coterminal OE doesn't work in practise. This includes OE-in-WAVEsec.
-  Solved in 2.02.
-
-  Old diagnosis:
-
-  If you have coterminal OE connections (two OE connections which share
-  one endpoint), you should have use of one of the encrypted links, but it 
-  is not clear which one KLIPS will prefer. In particular, the behaviour 
-  may not be symmetrical.
-
-  Worse yet, it just seems to trip over itself and be generally
-  unworkable.
-
-  Weird but predictable:
-
-  If you have both a gateway and a host who advertise (via DNS) an 
-  ability to do OE you need to be serious about doing host-based
-  OE, or you will be stuck in initiator-only mode. If your host 
-  advertises but does not run OE, then when a peer tries to connect to 
-  your host, it will fail to clear. The peer will then not try to encrypt 
-  traffic bound for that host as it travels to the gateway. To remedy 
-  the situation, restart ipsec on the peer (or otherwise flush out 
-  the %pass eroute), and ping the peer from your host to initiate 
-  OE.
-
-
-* One-way connection was created on rekey. Solved in 2.0.
-
-  If one side (A) has a shorter _keylife_ than the other,
-  and that side also has _rekey=no_, then when the keylife has 
-  expired, it will expect that its peer (B) will make a new conn to replace 
-  the existing one. Unfortunately, B has no idea. 
-
-  B continues to send out encrypted packets on the original connection,
-  while A passes the return packets along in the clear.
-
-  There is a proposed patch for (A) here:
-      http://lists.freeswan.org/pipermail/design/2002-July/003114.html
-
-
-* Failure to look up own host name is a show stopper.
-  Solved in 1.98 and 1.98b.
-
-  Solution: new setting %dnsondemand. Usage:
-
-      leftrsasigkey=%dnsondemand   # now in sample ipsec.conf
-      rightrsasigkey=%dnsondemand.
-
-  From man ipsec.conf:
-
-      The value  %dnsondemand  means  the key is to fetched from DNS 
-      at the time it is needed.
-
-  If Linux FreeS/WAN can't get the key for your public interface from 
-  DNS, it will not keep trying, and you will not be able to do OE.
-
-  The error message is:
-
-  May 14 09:40:24 road Pluto[21210]: failure to fetch key for 193.110.157.18 
-  from DNS: failure querying DNS for KEY of 18.157.110.193.in-addr.arpa.: 
-  Host name lookup failure
-
-  Workaround: 1 or 2
-  1. Supply a key in the conn. leftrsasigkey=0s...
-  2. Fix the KEY lookup failure and try again.
-
-
-* Assertion failure at OE rekey time. Fixed in 2.0pre0. Patch for 1.98b posted 
-  at http://lists.freeswan.org/pipermail/design/2002-August/003347.html
-
-
-* 1.91 to 1.94 have serious problems with %trap and %hold bugs. These bugs, 
-  introduced while coding the support structure for OE, affect both OE and VPN 
-  connections.
-
-
-* OE may not work with reverse delegation (CNAMEs). This problem was once 
-  capable of being a show stopper.
-
-  When relying on Bind versions before 9 for local DNS services, FreeS/WAN 
-  could not follow a well constructed CNAME trail that ended in a TXT or KEY 
-  record. Although OE required both record types, in practise we noticed the 
-  problem with the more common TXT lookups, rather than the rarer KEY lookups. 
-  Bind 9 largely solves the problem, by correctly seeking TXT records in 
-  delegated reverse domains. In addition, OE between two FreeS/WAN 2.02 or 
-  later boxes no longer relies on KEY records.
-    
-  Old symptoms:
-
-  When a DNS server queried by Linux FreeS/WAN follows a CNAME, 
-  it seems to forget what record type it is looking for, and it 
-  returns a PTR, despite the fact that another record type was requested.
-
-  Workaround:
-
-  Send your provider KEY and TXT records for direct insertion into the 
-  reverse ZONE files, rather than asking your provider to delegate authority 
-  using CNAME.
-
-  People who own IP blocks, rather than leasing them, may not 
-  experience this problem. If you were assigned IPs more than 
-  five years ago, you may own your IPs.
-
-
diff --git a/doc/opportunism.nr b/doc/opportunism.nr
deleted file mode 100644
index c5cae757a..000000000
--- a/doc/opportunism.nr
+++ /dev/null
@@ -1,1115 +0,0 @@
-.DA "3 May 2001"
-.ds LH "
-.ds CH "Opportunistic Encryption
-.ds RH "
-.ds LF "Draft 4+
-.ds CF "\\*(DY
-.ds RF %
-.de P
-.LP
-..
-.de R
-.LP
-\fBRationale:\fR
-..
-.de A
-.LP
-\fBAhem:\fR
-..
-.TL
-Opportunistic Encryption
-.AU
-Henry Spencer
-D. Hugh Redelmeier
-.AI
-henry@spsystems.net
-hugh@mimosa.com
-Linux FreeS/WAN Project
-.AB no
-xxx cases where reverses not controlled, all possibilities.
-xxx DHR suggests okay if gateway doesn't control reverse but destination does.
-xxx level of patience where Responder just doesn't answer the phone.
-xxx IKE finger to get basic keying info, to be confirmed via DNSSEC?
-xxx packets from some OE connections might get special status,
-if the other end is definitely someone we trust.
-Opportunistic encryption permits secure (encrypted, authenticated)
-communication via IPsec without connection-by-connection prearrangement,
-either explicitly between hosts (when the hosts are capable of it) or
-transparently via packet-intercepting security gateways.
-It uses DNS records (authenticated with DNSSEC) to provide
-the necessary information for gateway discovery and gateway authentication,
-and constrains negotiation enough to guarantee success.
-.sp
-Substantive changes since draft 3:
-write off inverse queries as a lost cause;
-use Invalid-SPI rather than Delete as notification of unknown SA;
-minor wording improvements and clarifications.
-This document takes over from the older ``Implementing Opportunistic
-Encryption'' document.
-.AE
-.NH 1
-Introduction
-.P
-A major goal of the FreeS/WAN project is opportunistic encryption:
-a (security) gateway intercepts an outgoing packet aimed at a
-remote host, and quickly attempts to negotiate an IPsec tunnel to that
-host's security gateway.
-If the attempt succeeds, traffic can then be secure,
-transparently (without changes to the host software).
-If the attempt fails,
-the packet (or a retry thereof) passes through in clear or is dropped,
-depending on local policy.
-Prearranged tunnels bypass the packet interception etc., so static VPNs
-can coexist with opportunistic encryption.
-.P
-This generalizes trivially to the end-to-end case:
-host and security gateway simply are one and the same.
-Some optimizations are possible in that case,
-but the basic scheme need not change.
-.P
-The objectives for security systems need to be explicitly stated.
-Opportunistic encryption is meant to achieve secure communication,
-without prearrangement of the individual connection
-(although some prearrangement on a per-host basis is required),
-between any two hosts which implement the protocol
-(and, if they act as security gateways,
-between hosts behind them).
-Here ``secure'' means strong encryption and authentication of packets,
-with authentication of participants\(emto prevent man-in-the-middle
-and impersonation attacks\(emdependent on several factors.
-The biggest factor is the authentication of DNS records,
-via DNSSEC or equivalent means.
-A lesser factor is which exact variant
-of the setup procedure (see section 2.2) is used,
-because there is a tradeoff between strong authentication of the other end
-and ability
-to negotiate opportunistic encryption with hosts which have limited
-or no control of their reverse-map DNS records:
-without reverse-map information,
-we can verify that the host has the right to use a particular FQDN
-(Fully Qualified Domain Name),
-but not whether that FQDN is authorized to use that IP address.
-Local policy must decide whether authentication
-or connectivity has higher priority.
-.P
-Apart from careful attention to detail in various areas,
-there are three crucial design problems for opportunistic encryption.
-It needs a way to quickly identify the remote host's security gateway.
-It needs a way to quickly obtain an authentication key for the
-security gateway.
-And the numerous options which can be specified with IKE
-must be constrained sufficiently that two independent implementations are
-guaranteed to reach agreement,
-without any explicit prearrangement or preliminary negotiation.
-The first two problems are solved using DNS,
-with DNSSEC ensuring that the data obtained is reliable;
-the third is solved by specifying a minimum standard which must be supported.
-.P
-A note on philosophy:
-we have deliberately avoided providing six different
-ways to do each job, in favor of specifying one good one.
-Choices are
-provided only when they appear to be necessary,
-or at least important.
-.P
-A note on terminology:
-to avoid constant circumlocutions,
-an ISAKMP/IKE SA, possibly recreated occasionally by rekeying,
-will be referred to as a ``keying channel'',
-and a set of IPsec SAs providing bidirectional communication between
-two IPsec hosts,
-possibly recreated occasionally by rekeying,
-will be referred to as a ``tunnel''
-(it could conceivably use transport mode in the host-to-host case,
-but we advocate using tunnel mode even there).
-The word ``connection'' is here used in a more generic sense.
-The word ``lifetime'' will be avoided in favor of ``rekeying interval'',
-since many of the connections will have useful lives far shorter
-than any reasonable rekeying interval,
-and hence the two concepts must be separated.
-.P
-A note on document structure:
-Discussions of \fIwhy\fR things were done a particular way,
-or not done a particular way,
-are broken out in paragraphs headed ``Rationale:''
-(to preserve the flow of the text, many such paragraphs are deferred
-to the ends of sections).
-Paragraphs headed ``Ahem:'' are discussions of where the problem is being
-made significantly harder by problems elsewhere,
-and how that might be corrected.
-Some meta-comments are enclosed in [].
-.R
-The motive is to get the Internet encrypted.
-That requires encryption without connection-by-connection prearrangement:
-a system must be able to
-reliably negotiate an encrypted, authenticated
-connection with a total stranger.
-While end-to-end encryption is preferable,
-doing opportunistic encryption in security gateways
-gives enormous leverage for quick deployment of this technology,
-in a world where end-host software is often primitive, rigid, and outdated.
-.R
-Speed is of the essence in tunnel setup:
-a connection-establishment delay longer than about 10 seconds
-begins to cause problems for users and applications.
-Thus the emphasis on rapidity in gateway discovery and key fetching.
-.A
-Host-to-host opportunistic encryption
-would be utterly trivial if a fast public-key
-encryption/signature
-algorithm was available.
-You would do a reverse lookup on the destination address to obtain a
-public key for that address,
-and simply encrypt all packets going to it with that key,
-signing them with your own private key.
-Alas, this is impractical with current CPU speeds and current algorithms
-(although as noted later, it might be of some use for limited purposes).
-Nevertheless, it is a useful model.
-.NH 1
-Connection Setup
-.P
-For purposes of discussion, the network is taken to look like this:
-.DS
-Source----Initiator----...----Responder----Destination
-.DE
-The intercepted packet comes from the Source,
-bound for the Destination,
-and is intercepted at the Initiator.
-The Initiator communicates over the insecure Internet to the Responder.
-The Source and the Initiator might be the same host,
-or the Source might be an end-user host and the Initiator a
-security gateway (SG).
-Likewise for the Responder and the Destination.
-.P
-Given an intercepted packet,
-whose useful information (for our purposes)
-is essentially only the Destination's IP address,
-the Initiator
-must quickly determine the Responder (the Destination's SG) and
-fetch everything needed to authenticate it.
-The Responder must do likewise for the Initiator.
-Both must eventually also confirm that the other is authorized to act
-on behalf of the client host behind it (if any).
-.P
-An important subtlety here is that if the alternative to an IPsec tunnel
-is plaintext transmission, negative results must be obtained quickly.
-That is,
-the decision that \fIno\fR tunnel can be established must also be made rapidly.
-.NH 2
-Packet Interception
-.P
-Interception of outgoing packets is relatively straightforward
-in principle.
-It is preferable to put the intercepted packet on hold rather than
-dropping it, since higher-level retries are not necessarily well-timed.
-There is a problem of hosts and applications retrying during negotiations.
-ARP implementations, which face the same problem,
-use the approach of keeping the \fImost recent\fR
-packet for an as-yet-unresolved address,
-and throwing away older ones.
-(Incrementing of request numbers etc. means that replies to older ones may no
-longer be accepted.)
-.P
-Is it worth intercepting \fIincoming\fR packets, from the outside world, and
-attempting tunnel setup based on them?
-No, unless and until a way can be devised to initiate opportunistic encryption
-to a non-opportunistic responder,
-because
-if the other end has not initiated tunnel setup itself, it will not be
-prepared to do so at our request.
-.R
-Note, however, that most incoming packets will promptly be followed by
-an outgoing packet in response!
-Conceivably it might be useful to start early stages of negotiation,
-at least as far as looking up information,
-in response to an incoming packet.
-.R
-If a plaintext incoming packet indicates that the other
-end is not prepared to do opportunistic encryption,
-it might seem that this fact should be noted, to
-avoid consuming resources and delaying
-traffic in an attempt at opportunistic setup which is doomed to fail.
-However, this would be a major security hole,
-since the plaintext packet is not authenticated;
-see section 2.5.
-.NH 2
-Algorithm
-.P
-For clarity,
-the following defers most discussion of error handling to the end.
-.nr x \w'Step 3A.'u+1n
-.de S
-.IP "Step \\$1." \nxu
-..
-.S 1
-Initiator does a DNS reverse lookup on the Destination address,
-asking not for the usual PTR records,
-but for TXT records.
-Meanwhile, Initiator also sends a ping to the Destination,
-to cause any other dynamic setup actions to start happening.
-(Ping replies are disregarded;
-the host might not be reachable with plaintext pings.)
-.S 2A
-If at least one suitable TXT record (see section 2.3) comes back,
-each contains a potential Responder's IP address
-and that Responder's public key (or where to find it).
-Initiator picks one TXT record, based on priority (see 2.3),
-thus picking a Responder.
-If there was no public key in the TXT record,
-the Initiator also starts a DNS lookup (as specified by the TXT record)
-to get KEY records.
-.S 2B
-If no suitable TXT record is available,
-and policy permits,
-Initiator designates the Destination itself as the Responder
-(see section 2.4).
-If policy does not permit,
-or the Destination is unresponsive to the negotiation,
-then opportunistic encryption is not possible,
-and Initiator gives up (see section 2.5).
-.S 3
-If there already is a keying channel to the Responder's IP address,
-the Initiator uses the existing keying channel;
-skip to step 10.
-Otherwise, the Initiator starts an IKE Phase 1 negotiation
-(see section 2.7 for details)
-with the Responder.
-The address family of the Responder's IP address dictates whether
-the keying channel and the outside of the tunnel should be IPv4 or IPv6.
-.S 4
-Responder gets the first IKE message,
-and responds.
-It also starts a DNS reverse lookup on the Initiator's IP address,
-for KEY records, on speculation.
-.S 5
-Initiator gets Responder's reply,
-and sends first message of IKE's D-H exchange (see 2.4).
-.S 6
-Responder gets Initiator's D-H message,
-and responds with a matching one.
-.S 7
-Initiator gets Responder's D-H message;
-encryption is now established, authentication remains to be done.
-Initiator sends IKE authentication message,
-with an FQDN identity if a reverse lookup on its address will not yield a
-suitable KEY record.
-(Note, an FQDN need not
-actually correspond to a host\(eme.g., the DNS data for it need not
-include an A record.)
-.S 8
-Responder gets Initiator's authentication message.
-If there is no identity included,
-Responder waits for step 4's speculative DNS lookup to finish;
-it should yield a suitable KEY record (see 2.3).
-If there is an FQDN identity,
-responder discards any data obtained from step 4's DNS lookup;
-does a forward lookup on the FQDN, for a KEY record;
-waits for that lookup to return;
-it should yield a suitable KEY record.
-Either way, Responder uses the KEY data to verify the message's hash.
-Responder replies with an authentication message,
-with an FQDN identity if a reverse lookup on its address will not yield a
-suitable KEY record.
-.S 9A
-(If step 2A was used.)
-The Initiator gets the Responder's authentication message.
-Step 2A has provided a key (from the TXT record or via DNS lookup).
-Verify message's hash.
-Encrypted and authenticated keying channel established,
-man-in-middle attack precluded.
-.S 9B
-(If step 2B was used.)
-The Initiator gets the Responder's authentication message,
-which must contain an FQDN identity (if the Responder can't put a TXT in his
-reverse map he presumably can't do a KEY either).
-Do forward lookup on the FQDN,
-get suitable KEY record, verify hash.
-Encrypted keying channel established,
-man-in-middle attack precluded,
-but authentication weak (see 2.4).
-.S 10
-Initiator initiates IKE Phase 2 negotiation (see 2.7) to establish tunnel,
-specifying Source and Destination identities as IP addresses (see 2.6).
-The address family of those addresses also determines whether the inside
-of the tunnel should be IPv4 or IPv6.
-.S 11
-Responder gets first Phase 2 message.
-Now the Responder finally knows what's going on!
-Unless the specified Source is identical to the Initiator,
-Responder initiates DNS reverse lookup on Source IP address,
-for TXT records;
-waits for result;
-gets suitable TXT record(s) (see 2.3),
-which should contain either the Initiator's IP address
-or an FQDN identity identical to that supplied by the Initiator in step 7.
-This verifies that the Initiator is authorized
-to act as SG for the Source.
-Responder replies with second Phase 2 message,
-selecting acceptable details (see 2.7),
-and establishes tunnel.
-.S 12
-Initiator gets second Phase 2 message,
-establishes tunnel (if he didn't already),
-and releases the intercepted packet into it, finally.
-.S 13
-Communication proceeds.
-See section 3 for what happens later.
-.P
-As additional information becomes available,
-notably in steps 1, 2, 4, 8, 9, 11, and 12,
-there is always a possibility that local policy
-(e.g., access limitations) might prevent further progress.
-Whenever possible,
-at least attempt to inform the other end of this.
-.P
-At any time, there is a possibility of the negotiation failing due to
-unexpected responses, e.g. the Responder not responding at all
-or rejecting all Initiator's proposals.
-If multiple SGs were found as possible Responders,
-the Initiator should try at least one more before giving up.
-The number tried should be influenced by what the alternative is:
-if the traffic will otherwise be discarded, trying the full list is
-probably appropriate,
-while if the alternative is plaintext transmission,
-it might be based on how long the tries are taking.
-The Initiator should try as many as it reasonably can,
-ideally all of them.
-.P
-There is a sticky problem with timeouts.
-If the Responder is down
-or otherwise inaccessible, in the worst case we won't hear about this
-except by not getting responses.
-Some other, more pathological or even
-evil, failure cases can have the same result.
-The problem is that in the
-case where plaintext is permitted, we want to decide whether a tunnel is
-possible quickly.
-There is no good solution to this, alas;
-we just have to take the time and do it right.
-(Passing plaintext meanwhile
-looks attractive at first glance... but exposing
-the first few seconds of a connection is often almost as bad as exposing
-the whole thing.
-Worse, if the user checks the status of the connection,
-after that brief window it looks secure!)
-.P
-The flip side of waiting for a timeout is that all other forms of
-feedback, e.g. ``host not reachable'',
-arguably should be \fIignored\fR,
-because in the absence of authenticated ICMP,
-you cannot trust them!
-.R
-An alternative, sometimes suggested, to the use of explicit DNS records
-for SG discovery is to directly attempt IKE negotiation with the
-destination host,
-and assume that any relevant SG will be on the packet path,
-will intercept the IKE packets,
-and will impersonate the destination host for the IKE negotiation.
-This is superficially attractive but is a very bad idea.
-It assumes that routing is stable throughout negotiation,
-that the SG is on the plaintext-packets path,
-and that the destination host is routable
-(yes, it is possible to have (private) DNS data for an unroutable host).
-Playing extra games in the plaintext-packet path hurts performance and
-can be expected to be unpopular.
-Various difficulties ensue when there are multiple SGs along the path
-(there is already bad experience with this, in RSVP),
-and the presence of even one can make it impossible
-to do IKE direct to the host when that is what's wanted.
-Worst of all, such impersonation breaks the IP network model badly,
-making problems difficult to diagnose and impossible to work around
-(and there is already bad experience with this, in areas like web caching).
-.R
-(Step 1.)
-Dynamic setup actions might include establishment of demand-dialed links.
-These might be present anywhere along the path,
-so one cannot rely on out-of-band communication at the Initiator to
-trigger them.
-Hence the ping.
-.R
-(Step 2.)
-In many cases, the IP address on the intercepted packet will be the
-result of a name lookup just done.
-Inverse queries, an obscure DNS feature from the distant past,
-in theory can be used to ask a DNS server to reverse that lookup,
-giving the name that produced the address.
-This is not the same as a reverse lookup,
-and the difference can matter a great deal in cases where a host
-does not control its reverse map
-(e.g., when the host's IP address is dynamically assigned).
-Unfortunately, inverse queries were never widely implemented and
-are now considered obsolete.
-Phooey.
-.A
-Support for a small subset of this admittedly-obscure feature
-would be useful.
-Unfortunately, it seems unlikely.
-.R
-(Step 3.)
-Using only IP addresses to decide whether there is already a relevant
-keying channel avoids some
-difficult problems.
-In particular, it might seem that this should be based on identities,
-but those are not known until very late in IKE Phase 1 negotiations.
-.R
-(Step 4.)
-The DNS lookup is done on speculation
-because the data will probably be useful and the lookup can be done
-in parallel with IKE activity,
-potentially speeding things up.
-.R
-(Steps 7 and 8.)
-If an SG does not control its reverse map,
-there is no way it can prove its right to use an IP address,
-but it can nevertheless supply both an identity (as an FQDN) and
-proof of its right to use that identity.
-This is somewhat better than nothing,
-and may be quite useful if the SG is representing a client host
-which \fIcan\fR prove its right to \fIits\fR IP address.
-(For example, a fixed-address subnet might live behind an SG with
-a dynamically-assigned address;
-such an SG has to be the Initiator, not the Responder,
-so the subnet's TXT records can contain FQDN identities,
-but with that restriction, this works.)
-It might sound like this would permit some man-in-the-middle attacks
-in important cases like Road Warrior,
-but the RW can still do full authentication of the home base,
-so a man in the middle cannot successfully impersonate home base,
-and the D-H exchange doesn't work unless the man in the middle
-impersonates \fIboth\fR ends.
-.R
-(Steps 7 and 8.)
-Another situation where proof of the right to use an identity can be
-very useful is when access is deliberately limited.
-While opportunistic encryption is intended as a general-purpose
-connection mechanism between strangers,
-it may well be convenient for prearranged connections to use
-the same mechanism.
-.R
-(Steps 7 and 8.)
-FQDNs as identities are avoided where possible,
-since they can involve synchronous DNS lookups.
-.R
-(Step 11.)
-Note that only here, in Phase 2,
-does the Responder actually learn who the
-Source and Destination hosts are.
-This unfortunately demands a synchronous DNS lookup to verify that the
-Initiator is authorized to represent the Source,
-unless they are one and the same.
-This and the initial TXT lookup are the only synchronous DNS lookups
-absolutely required by the algorithm,
-and they appear to be unavoidable.
-.R
-While it might seem unlikely that a refusal to cooperate from one SG
-could be remedied by trying another\(empresumably they all use the
-same policies\(emit's conceivable that one might be misconfigured.
-Preferably they should all be tried,
-but it may be necessary to set some limits on this
-if alternatives exist.
-.NH 2
-DNS Records
-.P
-Gateway discovery and key lookup are based on TXT and KEY DNS records.
-The TXT record specifies IP address or other identity of a host's SG,
-and possibly supplies its public key as well,
-while the KEY record supplies public keys not found in TXT records.
-.NH 3
-TXT
-.P
-Opportunistic-encryption SG discovery uses TXT records with the content:
-.DS
-X-IPsec-Gateway(\fInnn\fR)=\fIiii\fR\ \fIkkk\fR
-.DE
-following RFC 1464 attribute/value
-notation.
-Records which
-do not contain an ``='',
-or which do not have exactly the specified form to the left of it,
-are ignored.
-(Near misses perhaps should be reported.)
-.P
-The \fInnn\fR is an unsigned integer which will fit in 16 bits,
-specifying an MX-style preference
-(lower number = stronger preference) to
-control the order in which multiple SGs are tried.
-If there are ties, pick one,
-randomly enough that the choice will probably be different each time.
-xxx rollover.
-The preference field is not optional;
-use ``0'' if there is no meaningful preference ordering.
-.P
-The \fIiii\fR part identifies the SG.
-Normally this is a dotted-decimal IPv4 address or
-a colon-hex IPv6 address.
-The sole exception is if the SG has no fixed address (see 2.4) but
-the host(s) behind it do,
-in which case \fIiii\fR is of the form ``@fqdn'',
-where \fIfqdn\fR is the FQDN that the SG will use to
-identify itself (in step 7 of section 2.2);
-such a record cannot be used for SG discovery by an Initiator,
-but can be used for
-SG verification (step 11 of 2.2) by a Responder.
-.P
-The \fIkkk\fR part is optional.
-If it is present,
-it is an RSA-MD5 public key in base-64 notation, as in the text
-form of an RFC 2535 KEY record.
-If it is not present,
-this specifies that the public key can be found in a KEY
-record located based on the SG's identification:
-if \fIiii\fR is an IP address,
-do a reverse lookup on that address,
-else do a forward lookup on the FQDN.
-.R
-While it is unusual for a reverse lookup to go for records other than PTR
-records (or possibly CNAME records, for RFC 2317 classless delegation),
-there's no reason why it can't.
-The TXT record is a temporary stand-in
-for (we hope, someday) a new DNS record for SG identification and keying.
-Keeping the setup process fast requires minimizing the number of DNS
-lookups, hence the desire to put all the information in one place.
-.R
-The use of RFC 1464 notation avoids collisions with other uses of TXT
-records.
-The ``X-'' in the attribute name
-indicates that this format is tentative and experimental;
-this design will probably need modification after initial experiments.
-The format is chosen with an eye on eventual binary encoding.
-Note, in particular,
-that the TXT record normally contains the \fIaddress\fR of the SG,
-not (repeat, not) its name.
-Name-to-address conversion is the job of
-whatever generates the TXT record,
-which is expected to be a program, not a human\(emthis is conceptually
-a \fIbinary\fR record, temporarily using a text encoding.
-The ``@fqdn'' form of the SG identity is
-for specialized uses and is never mapped to an address.
-.A
-A DNS TXT record contains one or more character strings,
-but RFC 1035 does not describe exactly how
-a multi-string TXT record is interpreted.
-This is relevant because a string can be at most 255 characters,
-and public keys can exceed this.
-Empirically, the standard pattern is that
-each string which is
-both less than 255 characters \fIand\fR not the final string of the
-record should have a blank appended to it,
-and the strings of the record
-should then be concatenated.
-(This observation is based on how BIND 8 transforms a TXT record
-from text to DNS binary.)
-.NH 3
-KEY
-.P
-An opportunistic-encryption KEY record
-is an Authentication-permitted,
-Entity (host),
-non-Signatory,
-IPsec,
-RSA/MD5 record
-(that is, its first four bytes are 0x42000401),
-as per RFCs 2535 and 2537.
-KEY records with other \fIflags\fR, \fIprotocol\fR, or \fIalgorithm\fR
-values are ignored.
-.R
-Unfortunately, the public key has to be
-associated with the SG, not the client host behind it.
-The Responder does not know which client it is supposed to be representing,
-or which client the Initiator is representing,
-until far too late.
-.A
-Per-client keys would reduce vulnerability to key compromise,
-and simplify key changes,
-but they would require changes to IKE Phase 1, to separately identify
-the SG and its initial client(s).
-(At present, the client identities are not known to the Responder
-until IKE Phase 2.)
-While the current IKE standard does not actually specify (!) who is
-being identified by identity payloads,
-the overwhelming consensus is that they identify the SG,
-and as seen earlier,
-this has important uses.
-.NH 3
-Summary
-.P
-For reference, the minimum set of DNS records needed to make this
-all work is either:
-.IP 1. \w'1.'u+2n
-TXT in Destination reverse map, identifying Responder and providing public key.
-.IP 2.
-KEY in Initiator reverse map, providing public key.
-.IP 3.
-TXT in Source reverse map, verifying relationship to Initiator.
-.P
-or:
-.IP 1. \w'1.'u+2n
-TXT in Destination reverse map, identifying Responder.
-.IP 2.
-KEY in Responder reverse map, providing public key.
-.IP 3.
-KEY in Initiator reverse map, providing public key.
-.IP 4.
-TXT in Source reverse map, verifying relationship to Initiator.
-.P
-Slight complications ensue for dynamic addresses,
-lack of control over reverse maps, etc.
-.NH 3
-Implementation
-.P
-In the long run, we need either a tree of trust or a web of trust,
-so we can trust our DNS data.
-The obvious approach for DNS is a tree of trust,
-but there are various practical problems with running all of this
-through the root servers,
-and a web of trust is arguably more robust anyway.
-This is logically independent of opportunistic encryption,
-and a separate design proposal will be prepared.
-.P
-Interim stages of implementation of this will require a bit of thought.
-Notably, we need some way of dealing with the lack of fully signed DNSSEC
-records right away.
-Without user interaction, probably the best we can do is to
-remember the results of old fetches, compare them to the results of new
-fetches, and complain and disbelieve all of it if there's a mismatch. 
-This does mean that somebody who gets fake data into our very first fetch
-will fool us, at least for a while, but that seems an acceptable tradeoff.
-(Obviously there needs to be a way to manually flush the remembered results
-for a specific host, to permit deliberate changes.)
-.NH 2
-Responders Without Credentials
-.P
-In cases where the Destination simply does not control its
-DNS reverse-map entries,
-there is no verifiable way to determine a suitable SG.
-This does not make communication utterly impossible, though.
-.P
-Simply attempting negotiation directly with the host is a last resort.
-(An aggressive implementation might wish to attempt it in parallel,
-rather than waiting until other options are known to be unavailable.)
-In particular, in many cases involving dynamic addresses, it will work.
-It has the disadvantage of delaying the discovery that opportunistic
-encryption is entirely impossible,
-but the case seems common enough to justify the overhead.
-.P
-However, there are policy issues here either way, because
-it is possible to impersonate such a host.
-The host can supply an FQDN identity and verify its right to use that
-identity,
-but except by prearrangement,
-there is no way to verify that the FQDN is the right one for that
-IP address.
-(The data from forward lookups may be controlled by people
-who do not own the address, so it cannot be trusted.)
-The encryption is still solid, though,
-so in many cases this may be useful.
-.NH 2
-Failure of Opportunism
-.P
-When there is no way to do opportunistic encryption, a policy issue arises:
-whether to put in a bypass (which allows plaintext traffic through)
-or a block (which discards it, perhaps with notification back to the sender).
-The choice is very much a matter of local policy,
-and may depend on details such as the higher-level protocol being used.
-For example,
-an SG might well permit plaintext HTTP but forbid plaintext Telnet,
-in which case \fIboth\fR a block and a bypass would be set up if
-opportunistic encryption failed.
-.P
-A bypass/block must, in practice,
-be treated much like an IPsec tunnel.
-It should persist for a while,
-so that high-overhead processing doesn't have to be done for every packet,
-but should go away eventually to return resources.
-It may be simplest to treat it as a degenerate tunnel.
-It should have a relatively long lifetime (say 6h) to keep the frequency
-of negotiation attempts down,
-except in the case where the other SG simply did not respond to IKE packets,
-where the lifetime should be short (say 10min) because
-the other SG is presumably down and might come back up again.
-(Cases where the other SG responded to IKE with unauthenticated error
-reports like ``port unreachable'' are borderline,
-and might deserve to be treated as an intermediate case:
-while such reports cannot be trusted unreservedly,
-in the absence of any other response,
-they do give some reason to suspect that the other SG is unable or
-unwilling to participate in opportunistic encryption.)
-.P
-As noted in section 2.1, one might think that
-arrival of a plaintext incoming packet should cause a
-bypass/block to be set up for its source host:
-such a packet is almost always followed by an outgoing reply packet;
-the incoming packet is clear evidence that opportunistic encryption is
-not available at the other end;
-attempting it will waste resources and delay traffic to no good purpose.
-Unfortunately, this means that anyone out on the Internet
-who can forge a source address can prevent encrypted communication!
-Since their source addresses are not authenticated,
-plaintext packets cannot be taken as evidence of anything,
-except perhaps that communication from that host is likely to occur soon.
-.P
-There needs to be a way for local administrators to remove a bypass/block
-ahead of its normal expiry time,
-to force a retry after a problem at the other end is known to have been fixed.
-.NH 2
-Subnet Opportunism
-.P
-In principle, when the Source or Destination host belongs to a subnet
-and the corresponding SG is willing to provide tunnels to the whole subnet,
-this should be done.
-There is no extra overhead,
-and considerable potential for avoiding later overhead if
-similar communication occurs with other members of the subnet.
-Unfortunately,
-at the moment,
-opportunistic tunnels can only have degenerate subnets (single hosts)
-at their ends.
-(This does, at least, set up the keying channel,
-so that negotiations for tunnels to other hosts in the same subnets
-will be considerably faster.)
-.P
-The crucial problem is step 11 of section 2.2:
-the Responder must verify that the Initiator is authorized to represent
-the Source,
-and this is impossible for a subnet because
-there is no way to do a reverse lookup on it.
-Information in DNS
-records for a name or a single address cannot be trusted,
-because they may be controlled by people who do not control the whole subnet.
-.A
-Except in the special case of a subnet masked on a
-byte boundary (in which case RFC 1035's convention of an incomplete
-in-addr.arpa name could be used), subnet lookup would need extensions to the
-reverse-map name space, perhaps along the lines of that commonly done for
-RFC 2317 delegation.
-IPv6 already has suitable name syntax, as in RFC 2874,
-but has no specific provisions for subnet entries in its reverse maps.
-Fixing all this is is not conceptually difficult,
-but is logically independent of opportunistic encryption,
-and will be proposed separately.
-.P
-A less-troublesome problem is that the Initiator,
-in step 10 of 2.2,
-must know exactly what subnet is present on the Responder's end
-so he can propose a tunnel to it.
-This information could be included in the TXT record
-of the Destination
-(it would have to be verified with a subnet lookup,
-but that could be done in parallel with other operations).
-The Initiator presumably
-can be configured to know what subnet(s) are present on its end.
-.NH 2
-Option Settings
-.P
-IPsec and IKE have far too many useless options, and a few useful ones.
-IKE negotiation is quite simplistic, and cannot handle even simple
-discrepancies between the two SGs.
-So it is necessary to be quite specific about what should be done and
-what should be proposed,
-to guarantee interoperability without prearrangement or
-other negotiation protocols.
-.R
-The prohibition of other negotiations is simply because there is no time.
-The setup algorithm (section 2.2) is lengthy already.
-.P
-[Open question:
-should opportunistic IKE use a different port than normal IKE?]
-.P
-Somewhat arbitrarily and
-tentatively, opportunistic SGs must support Main Mode, Oakley group 5 for
-D-H, 3DES encryption and MD5 authentication for both ISAKMP and IPsec SAs,
-RSA/MD5 digital-signature authentication with keys between 2048 and 8192 bits,
-and ESP doing both encryption and authentication.
-They must do key PFS
-in Quick Mode, but not identity PFS.
-They may support IPComp, preferably using Deflate,
-but must not insist on it.
-They may support AES as an alternative to 3DES,
-but must not insist on it.
-.R
-Identity PFS essentially requires establishing
-a complete new keying channel for each new tunnel,
-but key PFS just does a new Diffie-Hellman exchange for each rekeying,
-which is relatively cheap.
-.P
-Keying channels must remain in existence at least as long as any
-tunnel created with them remains (they are not costly, and keeping
-the management path up and available simplifies various issues).
-See section 3.1 for related issues.
-Given the use of key PFS,
-frequent rekeying does not seem critical here.
-In the absence of strong reason to do otherwise,
-the Initiator should propose rekeying at 8hr-or-1MB.
-The Responder must accept any proposal which specifies
-a rekeying time between 1hr and 24hr inclusive
-and a rekeying volume between 100KB and 10MB inclusive.
-.P
-Given the short expected useful life of most tunnels (see section 3.1),
-very few of them will survive long enough to be rekeyed.
-In the absence of strong reason to do otherwise,
-the Initiator should propose rekeying at 1hr-or-100MB.
-The Responder must accept any proposal which specifies
-a rekeying time between 10min and 8hr inclusive
-and a rekeying volume between 1MB and 1000MB inclusive.
-.P
-It is highly desirable to add some random jitter
-to the times of actual rekeying attempts,
-to break up ``convoys'' of rekeying events;
-this and certain other aspects of robust rekeying practice will be the subject
-of a separate design proposal.
-.R
-The numbers used here for rekeying intervals are chosen quite arbitrarily
-and should be re-assessed after some implementation experience is gathered.
-.NH 1
-Renewal and Teardown
-.NH 2
-Aging
-.P
-When to tear tunnels down is a bit problematic, but if we're setting up a
-potentially unbounded number of them,
-we have to tear them down \fIsomehow sometime\fR.
-.P
-Set a short initial tentative lifespan, say 1min,
-since most net flows in fact last only a few seconds.
-When that expires, look to see if
-the tunnel is still in use (definition:
-has had traffic, in either direction,
-in the last half of the tentative lifespan).
-If so, assign it a somewhat longer tentative lifespan, say 20min,
-after which, look again.
-If not, close it down.
-(This tentative lifespan is
-independent of rekeying; it is just the time when the tunnel's future
-is next considered.
-This should happen reasonably frequently, unlike
-rekeying, which is costly and shouldn't be too frequent.)
-Multi-step backoff algorithms are not worth the trouble; looking every
-20min doesn't seem onerous.
-.P
-If the security gateway and the client host are one and the same,
-tunnel teardown decisions might wish to pay attention to TCP connection status,
-as reported by the local TCP layer.
-A still-open
-TCP connection is almost a guarantee that more traffic is coming, while
-the demise of the only TCP connection through a tunnel is a strong hint
-that none is.
-If the SG and the client host are separate machines,
-though, tracking TCP connection status requires packet snooping,
-which is complicated and probably not worthwhile.
-.P
-IKE keying channels likewise are torn down when it appears the need has
-passed.
-They always linger longer than the last tunnel they administer,
-in case they are needed again; the cost of retaining them is low.
-Other than that,
-unless the number of keying channels on the SG gets large,
-the SG should simply retain all of them until rekeying time,
-since rekeying is the only costly event.
-When about to rekey a keying channel which has no current tunnels,
-note when the last actual keying-channel traffic occurred,
-and close the keying channel down if it wasn't in the last, say, 30min.
-When rekeying a keying channel (or perhaps shortly before rekeying is expected),
-Initiator and Responder should re-fetch the public keys used for
-SG authentication,
-against the possibility that they have changed or disappeared.
-.P
-See section 2.7 for discussion of rekeying intervals.
-.P
-Given the low user impact of tearing down and rebuilding a connection
-(a tunnel or a keying channel),
-rekeying attempts should not be too persistent:
-one can always just rebuild when needed,
-so heroic efforts to preserve an existing connection are unnecessary.
-Say, try every 10s for a minute and every minute for 5min,
-and then give up and declare the connection
-(and all other connections to that IKE peer) dead.
-.R
-In future, more sophisticated, versions of this protocol,
-examining the initial packet might permit a more intelligent guess at
-the tunnel's useful life.
-HTTP connections in particular are
-notoriously bursty and repetitive.
-.R
-Note that rekeying a keying connection basically consists of building a
-new keying connection from scratch,
-using IKE Phase 1,
-and abandoning the old one.
-.NH 2
-Teardown and Cleanup
-.P
-Teardown should always be coordinated with the other end.
-This means interpreting and sending Delete notifications.
-.P
-On receiving a Delete for the outbound SAs of a tunnel
-(or some subset of them),
-tear down the inbound ones too, and notify the other end
-with a Delete.
-Tunnels need to be considered as bidirectional entities,
-even though the low-level protocols don't think of them that way.
-.P
-When the deletion is initiated locally,
-rather than as a response to a received Delete,
-send a Delete for (all) the inbound SAs of a tunnel.
-If no responding Delete is received for the outbound SAs,
-try re-sending the original Delete.
-Three tries spaced 10s apart seems a reasonable level of effort.
-(Indefinite persistence is not necessary;
-whether the other end isn't cooperating because it doesn't feel like
-it, or because it is down/disconnected/etc.,
-the problem will eventually be cleared up by other means.)
-.P
-After rekeying,
-transmission should switch to using the new SAs (ISAKMP or IPsec)
-immediately,
-and the old leftover SAs should be cleared out promptly
-(and Deletes sent) rather than waiting for them to expire.
-This reduces clutter and minimizes confusion.
-.P
-Since there is only one keying channel per remote IP address,
-the question of whether a Delete notification has appeared on a
-``suitable'' keying channel does not arise.
-.R
-The pairing of Delete notifications effectively constitutes an
-acknowledged Delete, which is highly desirable.
-.NH 2
-Outages and Reboots
-.P
-Tunnels sometimes go down because the other
-end crashes, or disconnects, or has a network link break,
-and there is no notice of this in the general case.
-(Even in the event of a crash and
-successful reboot, other SGs don't hear about it unless the
-rebooted SG has specific reason to talk to them immediately.)
-Over-quick response to temporary network outages is undesirable...
-but note that a tunnel can be torn
-down and then re-established without any user-visible effect except
-a pause in traffic,
-whereas if one end does reboot,
-the other end can't get packets to it \fIat all\fR (except via IKE)
-until the situation is noticed.
-So a bias toward quick response is appropriate,
-even at the cost of occasional false alarms.
-.P
-Heartbeat mechanisms are somewhat unsatisfactory for this.
-Unless they are very frequent, which causes other problems,
-they do not detect the problem promptly.
-.A
-What is really wanted is authenticated ICMP.
-This might be a case where public-key encryption/authentication
-of network packets is the right thing to do,
-despite the expense.
-.P
-In the absence of that, a two-part approach seems warranted.
-.P
-First,
-when an SG receives an IPsec packet that is addressed to it,
-and otherwise appears healthy,
-but specifies an unknown SA and is from a host that the receiver currently
-has no keying channel to,
-the receiver must attempt to inform the sender
-via an IKE Initial-Contact notification
-(necessarily sent in plaintext,
-since there is no suitable keying channel).
-This must be severely rate-limited on \fIboth\fR ends;
-one notification per SG pair per minute seems ample.
-.P
-Second, there is an obvious difficulty with this:
-the Initial-Contact notification is unauthenticated
-and cannot be trusted.
-So it must be taken as a hint only:
-there must be a way to confirm it.
-.P
-What is needed here is something that's desirable for
-debugging and testing anyway:
-an IKE-level ping mechanism.
-Pinging direct at the IP level instead will not tell us about a
-crash/reboot event.
-Sending pings through tunnels has
-various complications (they should stop at the far mouth of the tunnel
-instead of going on to a subnet; they should not count against idle
-timers; etc.).
-What is needed is a continuity check on a keying channel.
-(This could also be used as a heartbeat,
-should that seem useful.)
-.P
-IKE Ping delivery need not be reliable, since the whole point of a ping is
-simply to provoke an acknowledgement.
-They should preferably be authenticated,
-but it is not clear that this is absolutely necessary,
-although if they are not they need
-encryption plus a timestamp or a nonce,
-to foil replay mischief.
-How they are implemented is a secondary issue,
-and a separate design proposal will be prepared.
-.A
-Some existing implementations are already using
-(private) notify value 30000 (``LIKE_HELLO'') as ping
-and (private) notify value 30002 (``SHUT_UP'') as ping reply.
-.P
-If an IKE Ping gets no response, try some (say 8) IP pings,
-spaced a few seconds apart, to check IP connectivity;
-if one comes back, try another IKE Ping;
-if that gets no response,
-the other end probably has rebooted, or otherwise been re-initialized,
-and its tunnels and keying channel(s) should be torn down.
-.P
-In a similar vein,
-giving limited rekeying persistence,
-a short network outage could take some tunnels down without
-disrupting others.
-On receiving a packet for an unknown SA from a host that a keying
-channel is currently open to,
-send that host a Invalid-SPI notification for that SA.
-xxx that's not what Invalid-SPI is for.
-The other host can then tear down the half-torn-down tunnel,
-and negotiate a new tunnel for the traffic
-it presumably still wants to send.
-.P
-Finally,
-it would be helpful if SGs made some attempt to deal intelligently
-with crashes and reboots.
-A deliberate shutdown should include an attempt to notify all other SGs
-currently connected by keying channels,
-using Deletes,
-that communication is about to fail.
-(Again, these will be taken as teardowns;
-attempts by the other SGs to negotiate new tunnels as replacements
-should be ignored at this point.)
-And when possible, SGs should attempt to preserve information
-about currently-connected SGs in non-volatile storage, 
-so that after a crash,
-an Initial-Contact can be sent to previous partners to
-indicate loss of all previously-established connections.
-.NH 1
-Conclusions
-.P
-This design appears to achieve the objective of setting up encryption
-with strangers.
-The authentication aspects also seem adequately addressed if the
-destination controls its reverse-map DNS entries
-and the DNS data itself can be reliably authenticated
-as having originated from the legitimate administrators of that
-subnet/FQDN.
-The authentication situation is less satisfactory when DNS is less helpful,
-but it is difficult to see what else could be done about it.
-.NH 1
-References
-.P
-[TBW]
-.NH 1
-Appendix:  Separate Design Proposals TBW
-.IP \(bu \w'\(bu'u+2n
-How can we build a web of trust with DNSSEC?
-(See section 2.3.4.)
-.IP \(bu
-How can we extend DNS reverse lookups to permit reverse lookup
-on a subnet?
-(Both address and mask must appear in the name to be looked up.)
-(See section 2.6.)
-.IP \(bu
-How can rekeying be done as robustly as possible?
-(At least partly, this is just documenting current FreeS/WAN practice.)
-(See section 2.7.)
-.IP \(bu
-How should IKE Pings be implemented?
-(See section 3.3.)
diff --git a/doc/performance.html b/doc/performance.html
deleted file mode 100644
index 2258eeeda..000000000
--- a/doc/performance.html
+++ /dev/null
@@ -1,458 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="interop.html">Previous</A>
-<A HREF="testing.html">Next</A>
-<HR>
-<H1><A name="performance">Performance of FreeS/WAN</A></H1>
- The performance of FreeS/WAN is adequate for most applications.
-<P>In normal operation, the main concern is the overhead for encryption,
- decryption and authentication of the actual IPsec (<A href="glossary.html#ESP">
-ESP</A> and/or<A href="glossary.html#AH"> AH</A>) data packets. Tunnel
- setup and rekeying occur so much less frequently than packet processing
- that, in general, their overheads are not worth worrying about.</P>
-<P>At startup, however, tunnel setup overheads may be significant. If
- you reboot a gateway and it needs to establish many tunnels, expect
- some delay. This and other issues for large gateways are discussed<A href="#biggate">
- below</A>.</P>
-<H2><A name="pub.bench">Published material</A></H2>
-<P>The University of Wales at Aberystwyth has done quite detailed speed
- tests and put<A href="http://tsc.llwybr.org.uk/public/reports/SWANTIME/">
- their results</A> on the web.</P>
-<P>Davide Cerri's<A href="http://www.linux.it/~davide/doc/"> thesis (in
- Italian)</A> includes performance results for FreeS/WAN and for<A href="glossary.html#TLS">
- TLS</A>. He posted an<A href="http://lists.freeswan.org/pipermail/users/2001-December/006303.html">
- English summary</A> on the mailing list.</P>
-<P>Steve Bellovin used one of AT&amp;T Research's FreeS/WAN gateways as his
- data source for an analysis of the cache sizes required for key
- swapping in IPsec. Available as<A href="http://www.research.att.com/~smb/talks/key-agility.email.txt">
- text</A> or<A href="http://www.research.att.com/~smb/talks/key-agility.pdf">
- PDF slides</A> for a talk on the topic.</P>
-<P>See also the NAI work mentioned in the next section.</P>
-<H2><A name="perf.estimate">Estimating CPU overheads</A></H2>
-<P>We can come up with a formula that roughly relates CPU speed to the
- rate of IPsec processing possible. It is far from exact, but should be
- usable as a first approximation.</P>
-<P>An analysis of authentication overheads for high-speed networks,
- including some tests using FreeS/WAN, is on the<A href="http://www.pgp.com/research/nailabs/cryptographic/adaptive-cryptographic.asp">
- NAI Labs site</A>. In particular, see figure 3 in this<A href="http://download.nai.com/products/media/pgp/pdf/acsa_final_report.pdf">
- PDF document</A>. Their estimates of overheads, measured in Pentium II
- cycles per byte processed are:</P>
-<TABLE align="center" border="1"><TBODY></TBODY>
-<TR><TH></TH><TH>IPsec</TH><TH>authentication</TH><TH>encryption</TH><TH>
-cycles/byte</TH></TR>
-<TR><TD>Linux IP stack alone</TD><TD>no</TD><TD>no</TD><TD>no</TD><TD align="right">
-5</TD></TR>
-<TR><TD>IPsec without crypto</TD><TD>yes</TD><TD>no</TD><TD>no</TD><TD align="right">
-11</TD></TR>
-<TR><TD>IPsec, authentication only</TD><TD>yes</TD><TD>SHA-1</TD><TD>no</TD><TD
-align="right">24</TD></TR>
-<TR><TD>IPsec with encryption</TD><TD>yes</TD><TD>yes</TD><TD>yes</TD><TD
-align="right">not tested</TD></TR>
-</TABLE>
-<P>Overheads for IPsec with encryption were not tested in the NAI work,
- but Antoon Bosselaers'<A href="http://www.esat.kuleuven.ac.be/~bosselae/fast.html">
- web page</A> gives cost for his optimised Triple DES implementation as
- 928 Pentium cycles per block, or 116 per byte. Adding that to the 24
- above, we get 140 cycles per byte for IPsec with encryption.</P>
-<P>At 140 cycles per byte, a 140 MHz machine can handle a megabyte -- 8
- megabits -- per second. Speeds for other machines will be proportional
- to this. To saturate a link with capacity C megabits per second, you
- need a machine running at<VAR> C * 140/8 = C * 17.5</VAR> MHz.</P>
-<P>However, that estimate is not precise. It ignores the differences
- between:</P>
-<UL>
-<LI>NAI's test packets and real traffic</LI>
-<LI>NAI's Pentium II cycles, Bosselaers' Pentium cycles, and your
- machine's cycles</LI>
-<LI>different 3DES implementations</LI>
-<LI>SHA-1 and MD5</LI>
-</UL>
-<P>and does not account for some overheads you will almost certainly
- have:</P>
-<UL>
-<LI>communication on the client-side interface</LI>
-<LI>switching between multiple tunnels -- re-keying, cache reloading and
- so on</LI>
-</UL>
-<P>so we suggest using<VAR> C * 25</VAR> to get an estimate with a bit
- of a built-in safety factor.</P>
-<P>This covers only IP and IPsec processing. If you have other loads on
- your gateway -- for example if it is also working as a firewall -- then
- you will need to add your own safety factor atop that.</P>
-<P>This estimate matches empirical data reasonably well. For example,
- Metheringham's tests, described<A href="#klips.bench"> below</A>, show
- a 733 topping out between 32 and 36 Mbit/second, pushing data as fast
- as it can down a 100 Mbit link. Our formula suggests you need at least
- an 800 to handle a fully loaded 32 Mbit link. The two results are
- consistent.</P>
-<P>Some examples using this estimation method:</P>
-<TABLE align="center" border="1"><TBODY></TBODY>
-<TR><TH colspan="2">Interface</TH><TH colspan="3">Machine speed in MHz</TH>
-</TR>
-<TR><TH>Type</TH><TH>Mbit per
-<BR> second</TH><TH>Estimate
-<BR> Mbit*25</TH><TH>Minimum IPSEC gateway</TH><TH>Minimum with other
- load
-<P>(e.g. firewall)</P>
-</TH></TR>
-<TR><TD>DSL</TD><TD align="right">1</TD><TD align="right">25 MHz</TD><TD rowspan="2">
-whatever you have</TD><TD rowspan="2">133, or better if you have it</TD></TR>
-<TR><TD>cable modem</TD><TD align="right">3</TD><TD align="right">75 MHz</TD>
-</TR>
-<TR><TD><STRONG>any link, light load</STRONG></TD><TD align="right"><STRONG>
-5</STRONG></TD><TD align="right">125 MHz</TD><TD>133</TD><TD>200+,<STRONG>
- almost any surplus machine</STRONG></TD></TR>
-<TR><TD>Ethernet</TD><TD align="right">10</TD><TD align="right">250 MHz</TD><TD>
-surplus 266 or 300</TD><TD>500+</TD></TR>
-<TR><TD><STRONG>fast link, moderate load</STRONG></TD><TD align="right"><STRONG>
-20</STRONG></TD><TD align="right">500 MHz</TD><TD>500</TD><TD>800+,<STRONG>
- any current off-the-shelf PC</STRONG></TD></TR>
-<TR><TD>T3 or E3</TD><TD align="right">45</TD><TD align="right">1125 MHz</TD><TD>
-1200</TD><TD>1500+</TD></TR>
-<TR><TD>fast Ethernet</TD><TD align="right">100</TD><TD align="right">
-2500 MHz</TD><TD align="center" colspan="2" rowspan="2">// not feasible
- with 3DES in software on current machines //</TD></TR>
-<TR><TD>OC3</TD><TD align="right">155</TD><TD align="right">3875 MHz</TD>
-</TR>
-</TABLE>
-<P>Such an estimate is far from exact, but should be usable as minimum
- requirement for planning. The key observations are:</P>
-<UL>
-<LI>older<STRONG> surplus machines</STRONG> are fine for IPsec gateways
- at loads up to<STRONG> 5 megabits per second</STRONG> or so</LI>
-<LI>a<STRONG> mid-range new machine</STRONG> can handle IPsec at rates
- up to<STRONG> 20 megabits per second</STRONG> or more</LI>
-</UL>
-<H3><A name="perf.more">Higher performance alternatives</A></H3>
-<P><A href="glossary.html#AES">AES</A> is a new US government block
- cipher standard, designed to replace the obsolete<A href="glossary.html#DES">
- DES</A>. If FreeS/WAN using<A href="glossary.html#3DES"> 3DES</A> is
- not fast enough for your application, the AES<A href="web.html#patch">
- patch</A> may help.</P>
-<P>To date (March 2002) we have had only one<A href="http://lists.freeswan.org/pipermail/users/2002-February/007771.html">
- mailing list report</A> of measurements with the patch applied. It
- indicates that, at least for the tested load on that user's network,<STRONG>
- AES roughly doubles IPsec throughput</STRONG>. If further testing
- confirms this, it may prove possible to saturate an OC3 link in
- software on a high-end box.</P>
-<P>Also, some work is being done toward support of<A href="compat.html#hardware">
- hardware IPsec acceleration</A> which might extend the range of
- requirements FreeS/WAN could meet.</P>
-<H3><A NAME="11_2_2">Other considerations</A></H3>
-<P>CPU speed may be the main issue for IPsec performance, but of course
- it isn't the only one.</P>
-<P>You need good ethernet cards or other network interface hardware to
- get the best performance. See this<A href="http://www.ethermanage.com/ethernet/ethernet.html">
- ethernet information</A> page and this<A href="http://www.scyld.com/diag">
- Linux network driver</A> page.</P>
-<P>The current FreeS/WAN kernel code is largely single-threaded. It is
- SMP safe, and will run just fine on a multiprocessor machine (<A href="compat.html#multiprocessor">
-discussion</A>), but the load within the kernel is not shared
- effectively. This means that, for example to saturate a T3 -- which
- needs about a 1200 MHz machine -- you cannot expect something like a
- dual 800 to do the job.</P>
-<P>On the other hand, SMP machines do tend to share loads well so --
- provided one CPU is fast enough for the IPsec work -- a multiprocessor
- machine may be ideal for a gateway with a mixed load.</P>
-<H2><A name="biggate">Many tunnels from a single gateway</A></H2>
-<P>FreeS/WAN allows a single gateway machine to build tunnels to many
- others. There may, however, be some problems for large numbers as
- indicated in this message from the mailing list:</P>
-<PRE>Subject: Re: Maximum number of ipsec tunnels?
-   Date: Tue, 18 Apr 2000
-   From: &quot;John S. Denker&quot; &lt;jsd@research.att.com&gt;
-
-Christopher Ferris wrote:
-
-&gt;&gt; What are the maximum number ipsec tunnels FreeS/WAN can handle??
-
-Henry Spencer wrote:
-
-&gt;There is no particular limit.  Some of the setup procedures currently
-&gt;scale poorly to large numbers of connections, but there are (clumsy)
-&gt;workarounds for that now, and proper fixes are coming.
-
-1) &quot;Large&quot; numbers means anything over 50 or so.  I routinely run boxes
-with about 200 tunnels.  Once you get more than 50 or so, you need to worry
-about several scalability issues:
-
-a) You need to put a &quot;-&quot; sign in syslogd.conf, and rotate the logs daily
-not weekly.
-
-b) Processor load per tunnel is small unless the tunnel is not up, in which
-case a new half-key gets generated every 90 seconds, which can add up if
-you've got a lot of down tunnels.
-
-c) There's other bits of lore you need when running a large number of
-tunnels.  For instance, systematically keeping the .conf file free of
-conflicts requires tools that aren't shipped with the standard freeswan
-package.
-
-d) The pluto startup behavior is quadratic.  With 200 tunnels, this eats up
-several minutes at every restart.   I'm told fixes are coming soon.
-
-2) Other than item (1b), the CPU load depends mainly on the size of the
-pipe attached, not on the number of tunnels.
-</PRE>
-<P>It is worth noting that item (1b) applies only to repeated attempts
- to re-key a data connection (IPsec SA, Phase 2) over an established
- keying connection (ISAKMP SA, Phase 1). There are two ways to reduce
- this overhead using settings in<A href="manpage.d/ipsec.conf.5.html">
- ipsec.conf(5)</A>:</P>
-<UL>
-<LI>set<VAR> keyingtries</VAR> to some small value to limit repetitions</LI>
-<LI>set<VAR> keylife</VAR> to a short time so that a failing data
- connection will be cleaned up when the keying connection is reset.</LI>
-</UL>
-<P>The overheads for establishing keying connections (ISAKMP SAs, Phase
- 1) are lower because for these Pluto does not perform expensive
- operations before receiving a reply from the peer.</P>
-<P>A gateway that does a lot of rekeying -- many tunnels and/or low
- settings for tunnel lifetimes -- will also need a lot of<A href="glossary.html#random">
- random numbers</A> from the random(4) driver.</P>
-<H2><A name="low-end">Low-end systems</A></H2>
-<P><EM>Even a 486 can handle a T1 line</EM>, according to this mailing
- list message:</P>
-<PRE>Subject: Re: linux-ipsec: IPSec Masquerade
-   Date: Fri, 15 Jan 1999 11:13:22 -0500
-   From: Michael Richardson 
-
-. . . A 486/66 has been clocked by Phil Karn to do
-10Mb/s encryption.. that uses all the CPU, so half that to get some CPU,
-and you have 5Mb/s. 1/3 that for 3DES and you get 1.6Mb/s....</PRE>
-<P>and a piece of mail from project technical lead Henry Spencer:</P>
-<PRE>Oh yes, and a new timing point for Sandy's docs...  A P60 -- yes, a 60MHz
-Pentium, talk about antiques -- running a host-to-host tunnel to another
-machine shows an FTP throughput (that is, end-to-end results with a real
-protocol) of slightly over 5Mbit/s either way.  (The other machine is much
-faster, the network is 100Mbps, and the ether cards are good ones... so
-the P60 is pretty definitely the bottleneck.)</PRE>
-<P>From the above, and from general user experience as reported on the
- list, it seems clear that a cheap surplus machine -- a reasonable 486,
- a minimal Pentium box, a Sparc 5, ... -- can easily handle a home
- office or a small company connection using any of:</P>
-<UL>
-<LI>ADSL service</LI>
-<LI>cable modem</LI>
-<LI>T1</LI>
-<LI>E1</LI>
-</UL>
-<P>If available, we suggest using a Pentium 133 or better. This should
- ensure that, even under maximum load, IPsec will use less than half the
- CPU cycles. You then have enough left for other things you may want on
- your gateway -- firewalling, web caching, DNS and such.</P>
-<H2><A name="klips.bench">Measuring KLIPS</A></H2>
-<P>Here is some additional data from the mailing list.</P>
-<PRE>Subject: FreeSWAN (specically KLIPS) performance measurements
-   Date: Thu, 01 Feb 2001
-   From: Nigel Metheringham &lt;Nigel.Metheringham@intechnology.co.uk&gt;
-
-I've spent a happy morning attempting performance tests against KLIPS 
-(this is due to me not being able to work out the CPU usage of KLIPS so 
-resorting to the crude measurements of maximum throughput to give a 
-baseline to work out loading of a box).
-
-Measurements were done using a set of 4 boxes arranged in a line, each 
-connected to the next by 100Mbit duplex ethernet.  The inner 2 had an 
-ipsec tunnel between them (shared secret, but I was doing measurements 
-when the tunnel was up and running - keying should not be an issue 
-here).  The outer pair of boxes were traffic generators or traffic sink.
-
-The crypt boxes are Compaq DL380s - Uniprocessor PIII/733 with 256K 
-cache.  They have 128M main memory.  Nothing significant was running on 
-the boxes other than freeswan.  The kernel was a 2.2.19pre7 patched 
-with freeswan and ext3.
-
-Without an ipsec tunnel in the chain (ie the 2 inner boxes just being 
-100BaseT routers), throughput (measured with ttcp) was between 10644 
-and 11320 KB/sec
-
-With an ipsec tunnel in place, throughput was between 3268 and 3402 
-KB/sec
-
-These measurements are for data pushed across a TCP link, so the 
-traffic on the wire between the 2 ipsec boxes would have been higher 
-than this....
-
-vmstat (run during some other tests, so not affecting those figures) on 
-the encrypting box shows approx 50% system &amp; 50% idle CPU - which I 
-don't believe at all.  Interactive feel of the box was significantly 
-sluggish.
-
-I also tried running the kernel profiler (see man readprofile) during 
-test runs.
-
-A box doing primarily decrypt work showed basically nothing happening - 
-I assume interrupts were off.
-A box doing encrypt work showed the following:-
- Ticks Function                                   Load
- ~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~    ~~~~~~
-   956 total                                      0.0010
-   532 des_encrypt2                               0.1330
-   110 MD5Transform                               0.0443
-    97 kmalloc                                    0.1880
-    39 des_encrypt3                               0.1336
-    23 speedo_interrupt                           0.0298
-    14 skb_copy_expand                            0.0250
-    13 ipsec_tunnel_start_xmit                    0.0009
-    13 Decode                                     0.1625
-    11 handle_IRQ_event                           0.1019
-    11 .des_ncbc_encrypt_end                      0.0229
-    10 speedo_start_xmit                          0.0188
-     9 satoa                                      0.0225
-     8 kfree                                      0.0118
-     8 ip_fragment                                0.0121
-     7 ultoa                                      0.0365
-     5 speedo_rx                                  0.0071
-     5 .des_encrypt2_end                          5.0000
-     4 _stext                                     0.0140
-     4 ip_fw_check                                0.0035
-     2 rj_match                                   0.0034
-     2 ipfw_output_check                          0.0200
-     2 inet_addr_type                             0.0156
-     2 eth_copy_and_sum                           0.0139
-     2 dev_get                                    0.0294
-     2 addrtoa                                    0.0143
-     1 speedo_tx_buffer_gc                        0.0024
-     1 speedo_refill_rx_buf                       0.0022
-     1 restore_all                                0.0667
-     1 number                                     0.0020
-     1 net_bh                                     0.0021
-     1 neigh_connected_output                     0.0076
-     1 MD5Final                                   0.0083
-     1 kmem_cache_free                            0.0016
-     1 kmem_cache_alloc                           0.0022
-     1 __kfree_skb                                0.0060
-     1 ipsec_rcv                                  0.0001
-     1 ip_rcv                                     0.0014
-     1 ip_options_fragment                        0.0071
-     1 ip_local_deliver                           0.0023
-     1 ipfw_forward_check                         0.0139
-     1 ip_forward                                 0.0011
-     1 eth_header                                 0.0040
-     1 .des_encrypt3_end                          0.0833
-     1 des_decrypt3                               0.0034
-     1 csum_partial_copy_generic                  0.0045
-     1 call_out_firewall                          0.0125
-
-Hope this data is helpful to someone... however the lack of visibility 
-into the decrypt side makes things less clear</PRE>
-<H2><A name="speed.compress">Speed with compression</A></H2>
-<P>Another user reported some results for connections with and without
- IP compression:</P>
-<PRE>Subject: [Users] Speed with compression
-   Date: Fri, 29 Jun 2001
-   From: John McMonagle &lt;johnm@advocap.org&gt;
-
-Did a couple tests with compression using the new 1.91 freeswan.
-
-Running between 2 sites with cable modems.  Both  using approximately
-130 mhz pentium.
-
-Transferred files with ncftp.
-
-Compressed file was a 6mb compressed  installation file.
-Non compressed was 18mb /var/lib/rpm/packages.rpm
-
-                            Compressed vpn          regular vpn
-Compress file                42.59 kBs               42.08 kBs
-regular file                110.84 kBs               41.66 kBs
-
-Load  was about 0 either way.
-Ping times were very similar  a bit above 9 ms.
-
-Compression looks attractive to me.</PRE>
- Later in the same thread, project technical lead Henry Spencer added:
-<PRE>&gt; is there a reason not to switch compression on?  I have large gateway boxes
-&gt; connecting 3 connections, one of them with a measly DS1 link...
-
-Run some timing tests with and without, with data and loads representative
-of what you expect in production.  That's the definitive way to decide. 
-If compression is a net loss, then obviously, leave it turned off.  If it
-doesn't make much difference, leave it off for simplicity and hence
-robustness.  If there's a substantial gain, by all means turn it on. 
-
-If both ends support compression and can successfully negotiate a
-compressed connection (trivially true if both are FreeS/WAN 1.91), then
-the crucial question is CPU cycles. 
-
-Compression has some overhead, so one question is whether *your* data
-compresses well enough to save you more CPU cycles (by reducing the volume
-of data going through CPU-intensive encryption/decryption) than it costs
-you.  Last time I ran such tests on data that was reasonably compressible
-but not deliberately contrived to be so, this generally was not true --
-compression cost extra CPU cycles -- so compression was worthwhile only if
-the link, not the CPU, was the bottleneck.  However, that was before the
-slow-compression bug was fixed.  I haven't had a chance to re-run those
-tests yet, but it sounds like I'd probably see a different result. </PRE>
- The bug he refers to was a problem with the compression libraries that
- had us using C code, rather than assembler, for compression. It was
- fixed before 1.91.
-<H2><A name="methods">Methods of measuring</A></H2>
-<P>If you want to measure the loads FreeS/WAN puts on a system, note
- that tools such as top or measurements such as load average are
- more-or-less useless for this. They are not designed to measure
- something that does most of its work inside the kernel.</P>
-<P>Here is a message from FreeS/WAN kernel programmer Richard Guy Briggs
- on this:</P>
-<PRE>&gt; I have a batch of boxes doing Freeswan stuff.
-&gt; I want to measure the CPU loading of the Freeswan tunnels, but am 
-&gt; having trouble seeing how I get some figures out...
-&gt; 
-&gt;  - Keying etc is in userspace so will show up on the per-process
-&gt;    and load average etc (ie pluto's load)
-
-Correct.
-
-&gt;  - KLIPS is in the kernel space, and does not show up in load average
-&gt;    I think also that the KLIPS per-packet processing stuff is running
-&gt;    as part of an interrupt handler so it does not show up in the
-&gt;    /proc/stat system_cpu or even idle_cpu figures
-
-It is not running in interrupt handler.  It is in the bottom half.
-This is somewhere between user context (careful, this is not
-userspace!) and hardware interrupt context.
-
-&gt; Is this correct, and is there any means of instrumenting how much the 
-&gt; cpu is being loaded - I don't like the idea of a system running out of 
-&gt; steam whilst still showing 100% idle CPU :-)
-
-vmstat seems to do a fairly good job, but use a running tally to get a
-good idea.  A one-off call to vmstat gives different numbers than a
-running stat.  To do this, put an interval on your vmstat command
-line.</PRE>
- and another suggestion from the same thread:
-<PRE>Subject: Re: Measuring the CPU usage of Freeswan
-   Date: Mon, 29 Jan 2001
-   From: Patrick Michael Kane &lt;modus@pr.es.to&gt;
- 
-The only truly accurate way to accurately track FreeSWAN CPU usage is to use
-a CPU soaker. You run it on an unloaded system as a benchmark, then start up
-FreeSWAN and take the difference to determine how much FreeSWAN is eating.
-I believe someone has done this in the past, so you may find something in
-the FreeSWAN archives.  If not, someone recently posted a URL to a CPU
-soaker benchmark tool on linux-kernel.</PRE>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="interop.html">Previous</A>
-<A HREF="testing.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/policygroups.html b/doc/policygroups.html
deleted file mode 100644
index 6a507b1f6..000000000
--- a/doc/policygroups.html
+++ /dev/null
@@ -1,341 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="quickstart.html">Previous</A>
-<A HREF="faq.html">Next</A>
-<HR>
-<H1><A NAME="4">How to Configure Linux FreeS/WAN with Policy Groups</A></H1>
-<A NAME="policygroups"></A>
-<H2><A NAME="4_1">What are Policy Groups?</A></H2>
-<P><STRONG>Policy Groups</STRONG> are an elegant general mechanism to
- configure FreeS/WAN. They are useful for many FreeS/WAN users.</P>
-<P>In previous FreeS/WAN versions, you needed to configure each IPsec
- connection explicitly, on both local and remote hosts. This could
- become complex.</P>
-<P>By contrast, Policy Groups allow you to set local IPsec policy for
- lists of remote hosts and networks, simply by listing the hosts and
- networks which you wish to have special treatment in one of several
- Policy Group files. FreeS/WAN then internally creates the connections
- needed to implement each policy.</P>
-<P>In the next section we describe our five Base Policy Groups, which
- you can use to configure IPsec in many useful ways. Later, we will show
- you how to create an IPsec VPN using one line of configuration for each
- remote host or network.</P>
-<A NAME="builtin_policygroups"></A>
-<H3><A NAME="4_1_1">Built-In Security Options</A></H3>
-<P>FreeS/WAN offers these Base Policy Groups:</P>
-<DL>
-<DT>private</DT>
-<DD> FreeS/WAN only communicates privately with the listed<A HREF="glossary.html#CIDR">
- CIDR</A> blocks. If needed, FreeS/WAN attempts to create a connection
- opportunistically. If this fails, FreeS/WAN blocks communication.
- Inbound blocking is assumed to be done by the firewall. FreeS/WAN
- offers firewall hooks but no modern firewall rules to help with inbound
- blocking.</DD>
-<DT>private-or-clear</DT>
-<DD> FreeS/WAN prefers private communication with the listed CIDR
- blocks. If needed, FreeS/WAN attempts to create a connection
- opportunistically. If this fails, FreeS/WAN allows traffic in the
- clear.</DD>
-<DT>clear-or-private</DT>
-<DD> FreeS/WAN communicates cleartext with the listed CIDR blocks, but
- also accepts inbound OE connection requests from them. Also known as<A HREF="glossary.html#passive.OE">
- passive OE (pOE)</A>, this policy may be used to create an<A HREF="glossary.html#responder">
- opportunistic responder</A>.</DD>
-<DT>clear</DT>
-<DD> FreeS/WAN only communicates cleartext with the listed CIDR blocks.</DD>
-<DT>block</DT>
-<DD>FreeS/WAN blocks traffic to and from and the listed CIDR blocks.
- Inbound blocking is assumed to be done by the firewall. FreeS/WAN
- offers firewall hooks but no modern firewall rules to help with inbound
- blocking.
-<!-- also called "blockdrop".-->
-</DD>
-</DL>
-<A NAME="policy.group.notes"></A>
-<P>Notes:</P>
-<UL>
-<LI>Base Policy Groups apply to communication with this host only.</LI>
-<LI>The most specific rule (whether policy or pre-configured connection)
- applies. This has several practical applications:
-<UL>
-<LI>If CIDR blocks overlap, FreeS/WAN chooses the most specific
- applicable block.</LI>
-<LI>This decision also takes into account any pre-configured connections
- you may have.</LI>
-<LI>If the most specific connection is a pre-configured connection, the
- following procedure applies. If that connection is up, it will be used.
- If it is routed, it will be brought up. If it is added, no action will
- be taken.</LI>
-</UL>
-</LI>
-<LI>Base Policy Groups are created using built-in connections. Details
- in<A HREF="manpage.d/ipsec.conf.5.html"> man ipsec.conf</A>.</LI>
-<LI>All Policy Groups are bidirectional.<A HREF="src/policy-groups-table.html">
- This chart</A> shows some technical details. FreeS/WAN does not support
- one-way encryption, since it can give users a false sense of security.</LI>
-</UL>
-<H2><A NAME="4_2">Using Policy Groups</A></H2>
-<P>The Base Policy Groups which build IPsec connections rely on
- Opportunistic Encryption. To use the following examples, you must first
- become OE-capable, as described in our<A HREF="quickstart.html#quickstart">
- quickstart guide</A>.<A NAME="example1"></A></P>
-<H3><A NAME="4_2_1">Example 1: Using a Base Policy Group</A></H3>
-<P>Simply place CIDR blocks (<A HREF="#dnswarning">names</A>, IPs or IP
- ranges) in /etc/ipsec.d/policies/<VAR>[groupname]</VAR>, and reread the
- policy group files.</P>
-<P>For example, the<VAR> private-or-clear</VAR> policy tells FreeS/WAN
- to prefer encrypted communication to the listed CIDR blocks. Failing
- that, it allows talk in the clear.</P>
-<P>To make this your default policy, place<A HREF="glossary.html#fullnet">
- fullnet</A> in the<VAR> private-or-clear</VAR> policy group file:</P>
-<PRE>    [root@xy root]# cat /etc/ipsec.d/policies/private-or-clear
-    # This file defines the set of CIDRs (network/mask-length) to which
-    # communication should be private, if possible, but in the clear otherwise.
-    ....
-    0.0.0.0/0</PRE>
-<P>and reload your policies with</P>
-<PRE>    ipsec auto --rereadgroups</PRE>
-<P>Use<A HREF="quickstart.html#opp.test"> this test</A> to verify
- opportunistic connections.</P>
-<A NAME="example2"></A>
-<H3><A NAME="4_2_2">Example 2: Defining IPsec Security Policy with
- Groups</A></H3>
-<P>Defining IPsec security policy with Base Policy Groups is like
- creating a shopping list: just put CIDR blocks in the appropriate group
- files. For example:</P>
-<PRE>    [root@xy root]# cd /etc/ipsec.d/policies
-    [root@xy policies]# cat private
-        192.0.2.96/27              # The finance department
-        192.0.2.192/29             # HR
-	192.0.2.12                 # HR gateway
-        irc.private.example.com    # Private IRC server
-  
-    [root@xy policies]# cat private-or-clear
-        0.0.0.0/0                  # My default policy: try to encrypt.
-
-    [root@xy policies]# cat clear
-        192.0.2.18/32              # My POP3 server
-        192.0.2.19/32              # My Web proxy
-
-    [root@xy policies]# cat block
-        spamsource.example.com</PRE>
-<P>To make these settings take effect, type:</P>
-<PRE>    ipsec auto --rereadgroups</PRE>
-<P>Notes:</P>
-<UL>
-<LI>For opportunistic connection attempts to succeed, all participating
- FreeS/WAN hosts and gateways must be configured for OE.</LI>
-<LI>Examples 3 through 5 show how to implement a detailed<VAR> private</VAR>
- policy.</LI>
-<LI><A NAME="dnswarning"></A><FONT COLOR="RED"> Warning:</FONT> Using
- DNS names in policy files and ipsec.conf can be tricky. If the name
- does not resolve, the policy will not be implemented for that name. It
- is therefore safer either to use IPs, or to put any critical names in
- /etc/hosts. We plan to implement periodic DNS retry to help with this.
-<BR> Names are resolved at FreeS/WAN startup, or when the policies are
- reloaded. Unfortunately, name lookup can hold up the startup process.
- If you have fast DNS servers, the problem may be less severe.</LI>
-</UL>
-<A HREF="example3"></A>
-<H3><A NAME="4_2_3">Example 3: Creating a Simple IPsec VPN with the<VAR>
- private</VAR> Group</A></H3>
-<P>You can create an IPsec VPN between several hosts, with only one line
- of configuration per host, using the<VAR> private</VAR> policy group.</P>
-<P>First, use our<A HREF="quickstart.html"> quickstart guide</A> to set
- up each participating host with a FreeS/WAN install and OE.</P>
-<P>In one host's<VAR> /etc/ipsec.d/policies/private</VAR>, list the
- peers to which you wish to protect traffic. For example:</P>
-<PRE>    [root@xy root]# cd /etc/ipsec.d/policies
-    [root@xy policies]# cat private
-        192.0.2.9              # several hosts at example.com
-        192.0.2.11             
-        192.0.2.12                 
-        irc.private.example.com 
-</PRE>
-<P>Copy the<VAR> private</VAR> file to each host. Remove the local host,
- and add the initial host.</P>
-<PRE>    scp2 /etc/ipsec.d/policies/private root@192.0.2.12:/etc/ipsec.d/policies/private</PRE>
-<P>On each host, reread the policy groups with</P>
-<PRE>    ipsec auto --rereadgroups</PRE>
-<P>That's it! You're configured.</P>
-<P>Test by pinging between two hosts. After a second or two, traffic
- should flow, and</P>
-<PRE>    ipsec eroute</PRE>
-<P>should yield something like</P>
-<PRE>    192.0.2.11/32   -&gt; 192.0.2.8/32  =&gt; tun0x149f@192.0.2.8</PRE>
-<P>where your host IPs are substituted for 192.0.2.11 and 192.0.2.8.</P>
-<P>If traffic does not flow, there may be an error in your OE setup.
- Revisit our<A HREF="quickstart.html"> quickstart guide</A>.</P>
-<P>Our next two examples show you how to add subnets to this IPsec VPN.</P>
-<A NAME="example4"></A>
-<H3><A NAME="4_2_4">Example 4: New Policy Groups to Protect a Subnet</A></H3>
-<P>To protect traffic to a subnet behind your FreeS/WAN gateway, you'll
- need additional DNS records, and new policy groups. To set up the DNS,
- see our<A HREF="quickstart.html#opp.gate"> quickstart guide</A>. To
- create five new policy groups for your subnet, copy these connections
- to<VAR> /etc/ipsec.conf</VAR>. Substitute your subnet's IPs for
- 192.0.2.128/29.</P>
-<PRE>
-conn private-net
-    also=private  # inherits settings (eg. auto=start) from built in conn
-    leftsubnet=192.0.2.128/29  # your subnet's IPs here
-
-conn private-or-clear-net
-    also=private-or-clear
-    leftsubnet=192.0.2.128/29
-
-conn clear-or-private-net
-    also=clear-or-private
-    leftsubnet=192.0.2.128/29
-
-conn clear-net
-    also=clear
-    leftsubnet=192.0.2.128/29
-
-conn block-net
-    also=block
-    leftsubnet=192.0.2.128/29
-</PRE>
-<P>Copy the gateway's files to serve as the initial policy group files
- for the new groups:</P>
-<PRE>
-    cp -p /etc/ipsec.d/policies/private /etc/ipsec.d/policies/private-net
-    cp -p /etc/ipsec.d/policies/private-or-clear /etc/ipsec.d/policies/private-or-clear-net
-    cp -p /etc/ipsec.d/policies/clear-or-private /etc/ipsec.d/policies/clear-or-private-net
-    cp -p /etc/ipsec.d/policies/clear /etc/ipsec.d/policies/clear-net
-    cp -p /etc/ipsec.d/policies/block /etc/ipsec.d/policies/block
-</PRE>
-<P><STRONG>Tip: Since a missing policy group file is equivalent to a
- file with no entries, you need only create files for the connections
- you'll use.</STRONG></P>
-<P>To test one of your new groups, place the fullnet 0.0.0.0/0 in<VAR>
- private-or-clear-net</VAR>. Perform the subnet test in<A HREF="quickstart.html#opp.test">
- our quickstart guide</A>. You should see a connection, and</P>
-<PRE>    ipsec eroute</PRE>
-<P>should include an entry which mentions the subnet node's IP and the
- OE test site IP, like this:</P>
-<PRE>    192.0.2.131/32   -&gt; 192.139.46.77/32  =&gt; tun0x149f@192.0.2.11</PRE>
-<A HREF="example5"></A>
-<H3><A NAME="4_2_5">Example 5: Adding a Subnet to the VPN</A></H3>
-<P>Suppose you wish to secure traffic to a subnet 192.0.2.192/29 behind
- a FreeS/WAN box 192.0.2.12.</P>
-<P>First, add DNS entries to configure 192.0.2.12 as an opportunistic
- gateway for that subnet. Instructions are in our<A HREF="quickstart.html#opp.gate">
- quickstart guide</A>. Next, create a<VAR> private-net</VAR> group on
- 192.0.2.12 as described in<A HREF="#example4"> Example 4</A>.</P>
-<P>On each other host, add the subnet 192.0.2.192/29 to<VAR> private</VAR>
-, yielding for example</P>
-<PRE>    [root@xy root]# cd /etc/ipsec.d/policies
-    [root@xy policies]# cat private
-        192.0.2.9              # several hosts at example.com
-        192.0.2.11
-        192.0.2.12             # HR department gateway
-        192.0.2.192/29         # HR subnet
-        irc.private.example.com
-</PRE>
-<P>and reread policy groups with</P>
-<PRE>    ipsec auto --rereadgroups</PRE>
-<P>That's all the configuration you need.</P>
-<P>Test your VPN by pinging from a machine on 192.0.2.192/29 to any
- other host:</P>
-<PRE>    [root@192.0.2.194]# ping 192.0.2.11</PRE>
-<P>After a second or two, traffic should flow, and</P>
-<PRE>    ipsec eroute</PRE>
-<P>should yield something like</P>
-<PRE>    192.0.2.11/32   -&gt; 192.0.2.194/32  =&gt; tun0x149f@192.0.2.12
-</PRE>
-<P>Key:</P>
-<TABLE>
-<TR><TD>1.</TD><TD>192.0.2.11/32</TD><TD>Local start point of the
- protected traffic.</TD></TR>
-<TR><TD>2.</TD><TD>192.0.2.194/32</TD><TD>Remote end point of the
- protected traffic.</TD></TR>
-<TR><TD>3.</TD><TD>192.0.2.12</TD><TD>Remote FreeS/WAN node (gateway or
- host). May be the same as (2).</TD></TR>
-<TR><TD>4.</TD><TD>[not shown]</TD><TD>Local FreeS/WAN node (gateway or
- host), where you've produced the output. May be the same as (1).</TD></TR>
-</TABLE>
-<P>For additional assurance, you can verify with a packet sniffer that
- the traffic is being encrypted.</P>
-<P>Note</P>
-<UL>
-<LI>Because strangers may also connect via OE, this type of VPN may
- require a stricter firewalling policy than a conventional VPN.</LI>
-</UL>
-<H2><A NAME="4_3">Appendix</A></H2>
-<A NAME="hiddenconn"></A>
-<H3><A NAME="4_3_1">Our Hidden Connections</A></H3>
-<P>Our Base Policy Groups are created using hidden connections. These
- are spelled out in<A HREF="manpage.d/ipsec.conf.5.html"> man ipsec.conf</A>
- and defined in<VAR> /usr/local/lib/ipsec/_confread</VAR>.</P>
-<A NAME="custom_policygroups"></A>
-<H3><A NAME="4_3_2">Custom Policy Groups</A></H3>
-<P>A policy group is built using a special connection description in<VAR>
- ipsec.conf</VAR>, which:</P>
-<UL>
-<LI>is<STRONG> generic</STRONG>. It uses<VAR>
- right=[%group|%opportunisticgroup]</VAR> rather than specific IPs. The
- connection is cloned for every name or IP range listed in its Policy
- Group file.</LI>
-<LI>often has a<STRONG> failure rule</STRONG>. This rule, written<VAR>
- failureshunt=[passthrough|drop|reject|none]</VAR>, tells FreeS/WAN what
- to do with packets for these CIDRs if it fails to establish the
- connection. Default is<VAR> none</VAR>.</LI>
-</UL>
-<P>To create a new group:</P>
-<OL>
-<LI>Create its connection definition in<VAR> ipsec.conf</VAR>.</LI>
-<LI>Create a Policy Group file in<VAR> /etc/ipsec.d/policies</VAR> with
- the same name as your connection.</LI>
-<LI>Put a CIDR block in that file.</LI>
-<LI>Reread groups with<VAR> ipsec auto --rereadgroups</VAR>.</LI>
-<LI>Test:<VAR> ping</VAR> to activate any OE connection, and view
- results with<VAR> ipsec eroute</VAR>.</LI>
-</OL>
-<A NAME="disable_oe"></A><A NAME="disable_policygroups"></A>
-<H3><A NAME="4_3_3">Disabling Opportunistic Encryption</A></H3>
-<P>To disable OE (eg. policy groups and packetdefault), cut and paste
- the following lines to<VAR> /etc/ipsec.conf</VAR>:</P>
-<PRE>conn block
-    auto=ignore
-
-conn private
-    auto=ignore
-
-conn private-or-clear
-    auto=ignore
-
-conn clear-or-private
-    auto=ignore
-
-conn clear
-    auto=ignore
-
-conn packetdefault
-    auto=ignore</PRE>
-<P>Restart FreeS/WAN so that the changes take effect:</P>
-<PRE>    ipsec setup restart</PRE>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="quickstart.html">Previous</A>
-<A HREF="faq.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/politics.html b/doc/politics.html
deleted file mode 100644
index 5dd1e9f96..000000000
--- a/doc/politics.html
+++ /dev/null
@@ -1,1231 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="umltesting.html">Previous</A>
-<A HREF="ipsec.html">Next</A>
-<HR>
-<H1><A name="politics">History and politics of cryptography</A></H1>
-<P>Cryptography has a long and interesting history, and has been the
- subject of considerable political controversy.</P>
-<H2><A name="intro.politics">Introduction</A></H2>
-<H3><A NAME="26_1_1">History</A></H3>
-<P>The classic book on the history of cryptography is David Kahn's<A href="biblio.html#Kahn">
- The Codebreakers</A>. It traces codes and codebreaking from ancient
- Egypt to the 20th century.</P>
-<P>Diffie and Landau<A href="biblio.html#diffie"> Privacy on the Line:
- The Politics of Wiretapping and Encryption</A> covers the history from
- the First World War to the 1990s, with an emphasis on the US.</P>
-<H4>World War II</H4>
-<P>During the Second World War, the British &quot;Ultra&quot; project achieved one
- of the greatest intelligence triumphs in the history of warfare,
- breaking many Axis codes. One major target was the Enigma cipher
- machine, a German device whose users were convinced it was unbreakable.
- The American &quot;Magic&quot; project had some similar triumphs against Japanese
- codes.</P>
-<P>There are many books on this period. See our bibliography for
- several. Two I particularly like are:</P>
-<UL>
-<LI>Andrew Hodges has done a superb<A href="http://www.turing.org.uk/book/">
- biography</A> of Alan Turing, a key player among the Ultra
- codebreakers. Turing was also an important computer pioneer. The terms<A
-href="http://www.abelard.org/turpap/turpap.htm"> Turing test</A> and<A href="http://plato.stanford.edu/entries/turing-machine/">
- Turing machine</A> are named for him, as is the<A href="http://www.acm.org">
- ACM</A>'s highest technical<A href="http://www.acm.org/awards/taward.html">
- award</A>.</LI>
-<LI>Neal Stephenson's<A href="biblio.html#neal"> Cryptonomicon</A> is a
- novel with cryptography central to the plot. Parts of it take place
- during WW II, other parts today.</LI>
-</UL>
-<P>Bletchley Park, where much of the Ultra work was done, now has a
- museum and a<A href="http://www.bletchleypark.org.uk/"> web site</A>.</P>
-<P>The Ultra work introduced three major innovations.</P>
-<UL>
-<LI>The first break of Enigma was achieved by Polish Intelligence in
- 1931. Until then most code-breakers had been linguists, but a different
- approach was needed to break machine ciphers. Polish Intelligence
- recruited bright young mathematicians to crack the &quot;unbreakable&quot;
- Enigma. When war came in 1939, the Poles told their allies about this,
- putting Britain on the road to Ultra. The British also adopted a
- mathematical approach.</LI>
-<LI>Machines were extensively used in the attacks. First the Polish
- &quot;Bombe&quot; for attacking Enigma, then British versions of it, then
- machines such as Collosus for attacking other codes. By the end of the
- war, some of these machines were beginning to closely resemble digital
- computers. After the war, a team at Manchester University, several old
- Ultra hands included, built one of the world's first actual
- general-purpose digital computers.</LI>
-<LI>Ultra made codebreaking a large-scale enterprise, producing
- intelligence on an industrial scale. This was not a &quot;black chamber&quot;,
- not a hidden room in some obscure government building with a small crew
- of code-breakers. The whole operation -- from wholesale interception of
- enemy communications by stations around the world, through large-scale
- code-breaking and analysis of the decrypted material (with an enormous
- set of files for cross-referencing), to delivery of intelligence to
- field commanders -- was huge, and very carefully managed.</LI>
-</UL>
-<P>So by the end of the war, Allied code-breakers were expert at
- large-scale mechanised code-breaking. The payoffs were enormous.</P>
-<H4><A name="postwar">Postwar and Cold War</A></H4>
-<P>The wartime innovations were enthusiastically adopted by post-war and
- Cold War signals intelligence agencies. Presumably many nations now
- have some agency capable of sophisticated attacks on communications
- security, and quite a few engage in such activity on a large scale.</P>
-<P>America's<A href="glossary.html#NSA"> NSA</A>, for example, is said
- to be both the world's largest employer of mathematicians and the
- world's largest purchaser of computer equipment. Such claims may be
- somewhat exaggerated, but beyond doubt the NSA -- and similar agencies
- in other countries -- have some excellent mathematicians, lots of
- powerful computers, sophisticated software, and the organisation and
- funding to apply them on a large scale. Details of the NSA budget are
- secret, but there are some published<A href="http://www.fas.org/irp/nsa/nsabudget.html">
- estimates</A>.</P>
-<P>Changes in the world's communications systems since WW II have
- provided these agencies with new targets. Cracking the codes used on an
- enemy's military or diplomatic communications has been common practice
- for centuries. Extensive use of radio in war made large-scale attacks
- such as Ultra possible. Modern communications make it possible to go
- far beyond that. Consider listening in on cell phones, or intercepting
- electronic mail, or tapping into the huge volumes of data on new media
- such as fiber optics or satellite links. None of these targets existed
- in 1950. All of them can be attacked today, and almost certainly are
- being attacked.</P>
-<P>The Ultra story was not made public until the 1970s. Much of the
- recent history of codes and code-breaking has not been made public, and
- some of it may never be. Two important books are:</P>
-<UL>
-<LI>Bamford's<A href="biblio.html#puzzle"> The Puzzle Palace</A>, a
- history of the NSA</LI>
-<LI>Hager's<A href="http://www.fas.org/irp/eprint/sp/index.html"> Secret
- Power</A>, about the<A href="http://sg.yahoo.com/government/intelligence/echelon_network/">
- Echelon</A> system -- the US, UK, Canada, Australia and New Zealand
- co-operating to monitor much of the world's communications.</LI>
-</UL>
-<P>Note that these books cover only part of what is actually going on,
- and then only the activities of nations open and democratic enough that
- (some of) what they are doing can be discovered. A full picture,
- including:</P>
-<UL>
-<LI>actions of the English-speaking democracies not covered in those
- books</LI>
-<LI>actions of other more-or-less sane governments</LI>
-<LI>the activities of various more-or-less insane governments</LI>
-<LI>possibilities for unauthorized action by government employees</LI>
-<LI>possible actions by large non-government organisations:
- corporations, criminals, or conspiracies</LI>
-</UL>
-<P>might be really frightening.</P>
-<H4><A name="recent">Recent history -- the crypto wars</A></H4>
-<P>Until quite recently, cryptography was primarily a concern of
- governments, especially of the military, of spies, and of diplomats.
- Much of it was extremely secret.</P>
-<P>In recent years, that has changed a great deal. With computers and
- networking becoming ubiquitous, cryptography is now important to almost
- everyone. Among the developments since the 1970s:</P>
-<UL>
-<LI>The US gov't established the Data Encryption Standard,<A href="glossary.html#DES">
- DES</A>, a<A href="glossary.html#block"> block cipher</A> for
- cryptographic protection of unclassfied documents.</LI>
-<LI>DES also became widely used in industry, especially regulated
- industries such as banking.</LI>
-<LI>Other nations produced their own standards, such as<A href="glossary.html#GOST">
- GOST</A> in the Soviet Union.</LI>
-<LI><A href="glossary.html#public">Public key</A> cryptography was
- invented by Diffie and Hellman.</LI>
-<LI>Academic conferences such as<A href="http://www-cse.ucsd.edu/users/mihir/crypto2k.html">
- Crypto</A> and<A href="http://www.esat.kuleuven.ac.be/cosic/eurocrypt2000/">
- Eurocrypt</A> began.</LI>
-<LI>Several companies began offerring cryptographic products:<A href="glossary.html#RSAco">
- RSA</A>,<A href="glossary.html#PGPI"> PGP</A>, the many vendors with<A href="glossary.html#PKI">
- PKI</A> products, ...</LI>
-<LI>Cryptography appeared in other products: operating systems, word
- processors, ...</LI>
-<LI>Network protocols based on crypto were developed:<A href="glossary.html#SSH">
- SSH</A>,<A href="glossary.html#SSL"> SSL</A>,<A href="glossary.html#IPsec">
- IPsec</A>, ...</LI>
-<LI>Crytography came into widespread use to secure bank cards,
- terminals, ...</LI>
-<LI>The US government replaced<A href="glossary.html#DES"> DES</A> with
- the much stronger Advanced Encryption Standard,<A href="glossary.html#AES">
- AES</A></LI>
-</UL>
-<P>This has led to a complex ongoing battle between various mainly
- government groups wanting to control the spread of crypto and various
- others, notably the computer industry and the<A href="http://online.offshore.com.ai/security/">
- cypherpunk</A> crypto advocates, wanting to encourage widespread use.</P>
-<P>Steven Levy has written a fine history of much of this, called<A href="biblio.html#crypto">
- Crypto: How the Code rebels Beat the Government -- Saving Privacy in
- the Digital Age</A>.</P>
-<P>The FreeS/WAN project is to a large extent an outgrowth of cypherpunk
- ideas. Our reasons for doing the project can be seen in these quotes
- from the<A href="http://www.eff.org/pub/Privacy/Crypto_misc/cypherpunk.manifesto">
- Cypherpunk Manifesto</A>:</P>
-<BLOCKQUOTE> Privacy is necessary for an open society in the electronic
- age. ...
-<P>We cannot expect governments, corporations, or other large, faceless
- organizations to grant us privacy out of their beneficence. It is to
- their advantage to speak of us, and we should expect that they will
- speak. ...</P>
-<P>We must defend our own privacy if we expect to have any. ...</P>
-<P>Cypherpunks write code. We know that someone has to write software to
- defend privacy, and since we can't get privacy unless we all do, we're
- going to write it. We publish our code so that our fellow Cypherpunks
- may practice and play with it. Our code is free for all to use,
- worldwide. We don't much care if you don't approve of the software we
- write. We know that software can't be destroyed and that a widely
- dispersed system can't be shut down.</P>
-<P>Cypherpunks deplore regulations on cryptography, for encryption is
- fundamentally a private act. ...</P>
-<P>For privacy to be widespread it must be part of a social contract.
- People must come and together deploy these systems for the common good.
- ...</P>
-</BLOCKQUOTE>
-<P>To quote project leader John Gilmore:</P>
-<BLOCKQUOTE> We are literally in a race between our ability to build and
- deploy technology, and their ability to build and deploy laws and
- treaties. Neither side is likely to back down or wise up until it has
- definitively lost the race.</BLOCKQUOTE>
-<P>If FreeS/WAN reaches its goal of making<A href="intro.html#opp.intro">
- opportunistic encryption</A> widespread so that secure communication
- can become the default for a large part of the net, we will have struck
- a major blow.</P>
-<H3><A name="intro.poli">Politics</A></H3>
-<P>The political problem is that nearly all governments want to monitor
- their enemies' communications, and some want to monitor their citizens.
- They may be very interested in protecting some of their own
- communications, and often some types of business communication, but not
- in having everyone able to communicate securely. They therefore attempt
- to restrict availability of strong cryptography as much as possible.</P>
-<P>Things various governments have tried or are trying include:</P>
-<UL>
-<LI>Echelon, a monitor-the-world project of the US, UK, NZ, Australian
- and Canadian<A href="glossary.html#SIGINT"> signals intelligence</A>
- agencies. See this<A href="http://sg.yahoo.com/government/intelligence/echelon_network/">
- collection</A> of links and this<A href="http://www.zdnet.com/zdnn/stories/news/0,4586,2640682,00.html">
- story</A> on the French Parliament's reaction.</LI>
-<LI>Others governments may well have their own Echelon-like projects. To
- quote the Dutch Minister of Defense, as reported in a German<A href="http://www.heise.de/tp/english/inhalt/te/4729/1.html">
- magazine</A>:<BLOCKQUOTE> The government believes not only the
- governments associated with Echelon are able to intercept communication
- systems, but that it is an activity of the investigative authorities
- and intelligence services of many countries with governments of
- different political signature.</BLOCKQUOTE> Even if they have nothing
- on the scale of Echelon, most intelligence agencies and police forces
- certainly have some interception capability.</LI>
-<LI><A href="glossary.html#NSA">NSA</A> tapping of submarine
- communication cables, described in<A href="http://www.zdnet.com/zdnn/stories/news/0,4586,2764372,00.html">
- this article</A></LI>
-<LI>A proposal for international co-operation on<A href="http://www.heise.de/tp/english/special/enfo/4306/1.html">
- Internet surveillance</A>.</LI>
-<LI>Alleged<A href="http://cryptome.org/nsa-sabotage.htm"> sabotage</A>
- of security products by the<A href="glossary.html#NSA"> NSA</A> (the US
- signals intelligence agency).</LI>
-<LI>The German armed forces and some government departments will stop
- using American software for fear of NSA &quot;back doors&quot;, according to this<A
-href="http://www.theregister.co.uk/content/4/17679.html"> news story</A>
-.</LI>
-<LI>The British Regulation of Investigatory Powers bill. See this<A href="http://www.fipr.org/rip/index.html">
- web page.</A> and perhaps this<A href="http://ars.userfriendly.org/cartoons/?id=20000806&amp;mode=classic">
- cartoon</A>.</LI>
-<LI>A Russian<A href="http://www.eff.org/pub/Privacy/Foreign_and_local/Russia/russian_crypto_ban_english.edict">
- ban</A> on cryptography</LI>
-<LI>Chinese<A href="http://www.eff.org/pub/Misc/Publications/Declan_McCullagh/www/global/china">
- controls</A> on net use.</LI>
-<LI>The FBI's carnivore system for covert searches of email. See this<A href="http://www.zdnet.com/zdnn/stories/news/0,4586,2601502,00.html">
- news coverage</A> and this<A href="http://www.crypto.com/papers/carnivore-risks.html">
- risk assessment</A>. The government had an external review of some
- aspects of this system done. See this<A href="http://www.crypto.com/papers/carnivore_report_comments.html">
- analysis</A> of that review. Possible defenses against Carnivore
- include:
-<UL>
-<LI><A href="glossary.html#PGP">PGP</A> for end-to-end mail encryption</LI>
-<LI><A href="http://www.home.aone.net.au/qualcomm/">secure sendmail</A>
- for server-to-server encryption</LI>
-<LI>IPsec encryption on the underlying IP network</LI>
-</UL>
-</LI>
-<LI>export laws restricting strong cryptography as a munition. See<A href="#exlaw">
- discussion</A> below.</LI>
-<LI>various attempts to convince people that fundamentally flawed
- cryptography, such as encryption with a<A href="#escrow"> back door</A>
- for government access to data or with<A href="#shortkeys"> inadequate
- key lengths</A>, was adequate for their needs.</LI>
-</UL>
-<P>Of course governments are by no means the only threat to privacy and
- security on the net. Other threats include:</P>
-<UL>
-<LI>industrial espionage, as for example in this<A href="http://www.zdnet.com/zdnn/stories/news/0,4586,2626931,00.html">
- news story</A></LI>
-<LI>attacks by organised criminals, as in this<A href="http://www.sans.org/newlook/alerts/NTE-bank.htm">
- large-scale attack</A></LI>
-<LI>collection of personal data by various companies.
-<UL>
-<LI>for example, consider the various corporate winners of Privacy
- International's<A href="http://www.privacyinternational.org/bigbrother/">
- Big Brother Awards</A>.</LI>
-<LI><A href="http://www.zeroknowledge.com">Zero Knowledge</A> sell tools
- to defend against this</LI>
-</UL>
-</LI>
-<LI>individuals may also be a threat in a variety of ways and for a
- variety of reasons</LI>
-<LI>in particular, an individual with access to government or industry
- data collections could do considerable damage using that data in
- unauthorized ways.</LI>
-</UL>
-<P>One<A href="http://www.zdnet.com/zdnn/stories/news/0,4586,2640674,00.html">
- study</A> enumerates threats and possible responses for small and
- medium businesses. VPNs are a key part of the suggested strategy.</P>
-<P>We consider privacy a human right. See the UN's<A href="http://www.un.org/Overview/rights.html">
- Universal Declaration of Human Rights</A>, article twelve:</P>
-<BLOCKQUOTE> No one shall be subjected to arbitrary interference with
- his privacy, family, home or correspondence, nor to attacks upon his
- honor and reputation. Everyone has the right to the protection of the
- law against such interference or attacks.</BLOCKQUOTE>
-<P>Our objective is to help make privacy possible on the Internet using
- cryptography strong enough not even those well-funded government
- agencies are likely to break it. If we can do that, the chances of
- anyone else breaking it are negliible.</P>
-<H3><A NAME="26_1_3">Links</A></H3>
-<P>Many groups are working in different ways to defend privacy on the
- net and elsewhere. Please consider contributing to one or more of these
- groups:</P>
-<UL>
-<LI>the EFF's<A href="http://www.eff.org/crypto/"> Privacy Now!</A>
- campaign</LI>
-<LI>the<A href="http://www.gilc.org"> Global Internet Liberty Campaign</A>
-</LI>
-<LI><A href="http://www.cpsr.org/program/privacy/privacy.html">Computer
- Professionals for Social Responsibility</A></LI>
-</UL>
-<P>For more on these issues see:</P>
-<UL>
-<LI>Steven Levy (Newsweek's chief technology writer and author of the
- classic &quot;Hackers&quot;) new book<A href="biblio.html#crypto"> Crypto: How
- the Code Rebels Beat the Government--Saving Privacy in the Digital Age</A>
-</LI>
-<LI>Simson Garfinkel (Boston Globe columnist and author of books on<A href="biblio.html#PGP">
- PGP</A> and<A href="biblio.html#practical"> Unix Security</A>) book<A href="biblio.html#Garfinkel">
- Database Nation: the death of privacy in the 21st century</A></LI>
-</UL>
-<P>There are several collections of<A href="web.html#quotes"> crypto
- quotes</A> on the net.</P>
-<P>See also the<A href="biblio.html"> bibliography</A> and our list of<A href="web.html#policy">
- web references</A> on cryptography law and policy.</P>
-<H3><A NAME="26_1_4">Outline of this section</A></H3>
-<P>The remainder of this section includes two pieces of writing by our
- project leader</P>
-<UL>
-<LI>his<A href="#gilmore"> rationale</A> for starting this</LI>
-<LI>another<A href="#policestate"> discussion</A> of project goals</LI>
-</UL>
-<P>and discussions of:</P>
-<UL>
-<LI><A href="#desnotsecure">why we do not use DES</A></LI>
-<LI><A href="#exlaw">cryptography export laws</A></LI>
-<LI>why<A href="#escrow"> government access to keys</A> is not a good
- idea</LI>
-<LI>the myth that<A href="#shortkeys"> short keys</A> are adequate for
- some security requirements</LI>
-</UL>
-<P>and a section on<A href="#press"> press coverage of FreeS/WAN</A>.</P>
-<H2><A name="leader">From our project leader</A></H2>
-<P>FreeS/WAN project founder John Gilmore wrote a web page about why we
- are doing this. The version below is slightly edited, to fit this
- format and to update some links. For a version without these edits, see
- his<A href="http://www.toad.com/gnu/"> home page</A>.</P>
-<CENTER>
-<H3><A name="gilmore">Swan: Securing the Internet against Wiretapping</A>
-</H3>
-</CENTER>
-<P>My project for 1996 was to<B> secure 5% of the Internet traffic
- against passive wiretapping</B>. It didn't happen in 1996, so I'm still
- working on it in 1997, 1998, and 1999! If we get 5% in 1999 or 2000, we
- can secure 20% the next year, against both active and passive attacks;
- and 80% the following year. Soon the whole Internet will be private and
- secure. The project is called S/WAN or S/Wan or Swan for Secure Wide
- Area Network; since it's free software, we call it FreeSwan to
- distinguish it from various commercial implementations.<A href="http://www.rsa.com/rsa/SWAN/">
- RSA</A> came up with the term &quot;S/WAN&quot;. Our main web site is at<A href="http://www.freeswan.org/">
- http://www.freeswan.org/</A>. Want to help?</P>
-<P>The idea is to deploy PC-based boxes that will sit between your local
- area network and the Internet (near your firewall or router) which
- opportunistically encrypt your Internet packets. Whenever you talk to a
- machine (like a Web site) that doesn't support encryption, your traffic
- goes out &quot;in the clear&quot; as usual. Whenever you connect to a machine
- that does support this kind of encryption, this box automatically
- encrypts all your packets, and decrypts the ones that come in. In
- effect, each packet gets put into an &quot;envelope&quot; on one side of the net,
- and removed from the envelope when it reaches its destination. This
- works for all kinds of Internet traffic, including Web access, Telnet,
- FTP, email, IRC, Usenet, etc.</P>
-<P>The encryption boxes are standard PC's that use freely available
- Linux software that you can download over the Internet or install from
- a cheap CDROM.</P>
-<P>This wasn't just my idea; lots of people have been working on it for
- years. The encryption protocols for these boxes are called<A href="glossary.html#IPsec">
- IPSEC (IP Security)</A>. They have been developed by the<A href="http://www.ietf.cnri.reston.va.us/html.charters/ipsec-charter.html">
- IP Security Working Group</A> of the<A href="http://www.ietf.org/">
- Internet Engineering Task Force</A>, and will be a standard part of the
- next major version of the Internet protocols (<A href="http://playground.sun.com/pub/ipng/html/ipng-main.html">
-IPv6</A>). For today's (IP version 4) Internet, they are an option.</P>
-<P>The<A href="http://www.iab.org/iab"> Internet Architecture Board</A>
- and<A href="http://www.ietf.org/"> Internet Engineering Steering Group</A>
- have taken a<A href="iab-iesg.stmt"> strong stand</A> that the Internet
- should use powerful encryption to provide security and privacy. I think
- these protocols are the best chance to do that, because they can be
- deployed very easily, without changing your hardware or software or
- retraining your users. They offer the best security we know how to
- build, using the Triple-DES, RSA, and Diffie-Hellman algorithms.</P>
-<P>This &quot;opportunistic encryption box&quot; offers the &quot;fax effect&quot;. As each
- person installs one for their own use, it becomes more valuable for
- their neighbors to install one too, because there's one more person to
- use it with. The software automatically notices each newly installed
- box, and doesn't require a network administrator to reconfigure it.
- Instead of &quot;virtual private networks&quot; we have a &quot;REAL private network&quot;;
- we add privacy to the real network instead of layering a
- manually-maintained virtual network on top of an insecure Internet.</P>
-<H4>Deployment of IPSEC</H4>
-<P>The US government would like to control the deployment of IP Security
- with its<A href="#exlaw"> crypto export laws</A>. This isn't a problem
- for my effort, because the cryptographic work is happening outside the
- United States. A foreign philanthropist, and others, have donated the
- resources required to add these protocols to the Linux operating
- system.<A href="http://www.linux.org/"> Linux</A> is a complete, freely
- available operating system for IBM PC's and several kinds of
- workstation, which is compatible with Unix. It was written by Linus
- Torvalds, and is still maintained by a talented team of expert
- programmers working all over the world and coordinating over the
- Internet. Linux is distributed under the<A href="glossary.html#GPL">
- GNU Public License</A>, which gives everyone the right to copy it,
- improve it, give it to their friends, sell it commercially, or do just
- about anything else with it, without paying anyone for the privilege.</P>
-<P>Organizations that want to secure their network will be able to put
- two Ethernet cards into an IBM PC, install Linux on it from a $30 CDROM
- or by downloading it over the net, and plug it in between their
- Ethernet and their Internet link or firewall. That's all they'll have
- to do to encrypt their Internet traffic everywhere outside their own
- local area network.</P>
-<P>Travelers will be able to run Linux on their laptops, to secure their
- connection back to their home network (and to everywhere else that they
- connect to, such as customer sites). Anyone who runs Linux on a
- standalone PC will also be able to secure their network connections,
- without changing their application software or how they operate their
- computer from day to day.</P>
-<P>There will also be numerous commercially available firewalls that use
- this technology.<A href="http://www.rsa.com/"> RSA Data Security</A> is
- coordinating the<A href="http://www.rsa.com/rsa/SWAN"> S/Wan (Secure
- Wide Area Network)</A> project among more than a dozen vendors who use
- these protocols. There's a<A href="http://www.rsa.com/rsa/SWAN/swan_test.htm">
- compatability chart</A> that shows which vendors have tested their
- boxes against which other vendors to guarantee interoperatility.</P>
-<P>Eventually it will also move into the operating systems and
- networking protocol stacks of major vendors. This will probably take
- longer, because those vendors will have to figure out what they want to
- do about the export controls.</P>
-<H4>Current status</H4>
-<P>My initial goal of securing 5% of the net by Christmas '96 was not
- met. It was an ambitious goal, and inspired me and others to work hard,
- but was ultimately too ambitious. The protocols were in an early stage
- of development, and needed a lot more protocol design before they could
- be implemented. As of April 1999, we have released version 1.0 of the
- software (<A href="ftp://ftp.xs4all.nl/freeswan/freeswan-1.0.tar.gz">
-freeswan-1.0.tar.gz</A>), which is suitable for setting up Virtual
- Private Networks using shared secrets for authentication. It does not
- yet do opportunistic encryption, or use DNSSEC for authentication;
- those features are coming in a future release.</P>
-<DL>
-<DT>Protocols</DT>
-<DD>The low-level encrypted packet formats are defined. The system for
- publishing keys and providing secure domain name service is defined.
- The IP Security working group has settled on an NSA-sponsored protocol
- for key agreement (called ISAKMP/Oakley), but it is still being worked
- on, as the protocol and its documentation is too complex and
- incomplete. There are prototype implementations of ISAKMP. The protocol
- is not yet defined to enable opportunistic encryption or the use of
- DNSSEC keys.</DD>
-<DT>Linux Implementation</DT>
-<DD>The Linux implementation has reached its first major release and is
- ready for production use in manually-configured networks, using Linux
- kernel version 2.0.36.</DD>
-<DT>Domain Name System Security</DT>
-<DD>There is now a release of BIND 8.2 that includes most DNS Security
- features.
-<P>The first prototype implementation of Domain Name System Security was
- funded by<A href="glossary.html#DARPA"> DARPA</A> as part of their<A href="http://www.darpa.mil/ito/research/is/index.html">
- Information Survivability program</A>.<A href="http://www.tis.com">
- Trusted Information Systems</A> wrote a modified version of<A href="http://www.isc.org/bind.html">
- BIND</A>, the widely-used Berkeley implementation of the Domain Name
- System.</P>
-<P>TIS, ISC, and I merged the prototype into the standard version of
- BIND. The first production version that supports KEY and SIG records is<B>
- bind-4.9.5</B>. This or any later version of BIND will do for
- publishing keys. It is available from the<A href="http://www.isc.org/bind.html">
- Internet Software Consortium</A>. This version of BIND is not
- export-controlled since it does not contain any cryptography. Later
- releases starting with BIND 8.2 include cryptography for authenticating
- DNS records, which is also exportable. Better documentation is needed.</P>
-</DD>
-</DL>
-<H4>Why?</H4>
-<P>Because I can. I have made enough money from several successful
- startup companies, that for a while I don't have to work to support
- myself. I spend my energies and money creating the kind of world that
- I'd like to live in and that I'd like my (future) kids to live in.
- Keeping and improving on the civil rights we have in the United States,
- as we move more of our lives into cyberspace, is a particular goal of
- mine.</P>
-<H4>What You Can Do</H4>
-<DL>
-<DT>Install the latest BIND at your site.</DT>
-<DD>You won't be able to publish any keys for your domain, until you
- have upgraded your copy of BIND. The thing you really need from it is
- the new version of<I> named</I>, the Name Daemon, which knows about the
- new KEY and SIG record types. So, download it from the<A href="http://www.isc.org/bind.html">
- Internet Software Consortium</A> and install it on your name server
- machine (or get your system administrator, or Internet Service
- Provider, to install it). Both your primary DNS site and all of your
- secondary DNS sites will need the new release before you will be able
- to publish your keys. You can tell which sites this is by running the
- Unix command &quot;dig MYDOMAIN ns&quot; and seeing which sites are mentioned in
- your NS (name server) records.</DD>
-<DT>Set up a Linux system and run a 2.0.x kernel on it</DT>
-<DD>Get a machine running Linux (say the 5.2 release from<A href="http://www.redhat.com">
- Red Hat</A>). Give the machine two Ethernet cards.</DD>
-<DT>Install the Linux IPSEC (Freeswan) software</DT>
-<DD>If you're an experienced sysadmin or Linux hacker, install the
- freeswan-1.0 release, or any later release or snapshot. These releases
- do NOT provide automated &quot;opportunistic&quot; operation; they must be
- manually configured for each site you wish to encrypt with.</DD>
-<DT>Get on the linux-ipsec mailing list</DT>
-<DD>The discussion forum for people working on the project, and testing
- the code and documentation, is: linux-ipsec@clinet.fi. To join this
- mailing list, send email to<A href="mailto:linux-ipsec-REQUEST@clinet.fi">
- linux-ipsec-REQUEST@clinet.fi</A> containing a line of text that says
- &quot;subscribe linux-ipsec&quot;. (You can later get off the mailing list the
- same way -- just send &quot;unsubscribe linux-ipsec&quot;).</DD>
-<P></P>
-<DT>Check back at this web page every once in a while</DT>
-<DD>I update this page periodically, and there may be new information in
- it that you haven't seen. My intent is to send email to the mailing
- list when I update the page in any significant way, so subscribing to
- the list is an alternative.</DD>
-</DL>
-<P>Would you like to help? I can use people who are willing to write
- documentation, install early releases for testing, write cryptographic
- code outside the United States, sell pre-packaged software or systems
- including this technology, and teach classes for network administrators
- who want to install this technology. To offer to help, send me email at
- gnu@toad.com. Tell me what country you live in and what your
- citizenship is (it matters due to the export control laws; personally I
- don't care). Include a copy of your resume and the URL of your home
- page. Describe what you'd like to do for the project, and what you're
- uniquely qualified for. Mention what other volunteer projects you've
- been involved in (and how they worked out). Helping out will require
- that you be able to commit to doing particular things, meet your
- commitments, and be responsive by email. Volunteer projects just don't
- work without those things.</P>
-<H4>Related projects</H4>
-<DL>
-<DT>IPSEC for NetBSD</DT>
-<DD>This prototype implementation of the IP Security protocols is for
- another free operating system.<A href="ftp://ftp.funet.fi/pub/unix/security/net/ip/BSDipsec.tar.gz">
- Download BSDipsec.tar.gz</A>.</DD>
-<DT>IPSEC for<A href="http://www.openbsd.org"> OpenBSD</A></DT>
-<DD>This prototype implementation of the IP Security protocols is for
- yet another free operating system. It is directly integrated into the
- OS release, since the OS is maintained in Canada, which has freedom of
- speech in software.</DD>
-</DL>
-<H3><A name="policestate">Stopping wholesale monitoring</A></H3>
-<P>From a message project leader John Gilmore posted to the mailing
- list:</P>
-<PRE>John Denker wrote:
-
-&gt; Indeed there are several ways in which the documentation overstates the 
-&gt; scope of what this project does -- starting with the name 
-&gt; FreeS/WAN.  There's a big difference between having an encrypted IP tunnel 
-&gt; versus having a Secure Wide-Area Network.  This software does a fine job of 
-&gt; the former, which is necessary but not sufficient for the latter.
-
-The goal of the project is to make it very hard to tap your wide area
-communications.  The current system provides very good protection
-against passive attacks (wiretapping and those big antenna farms).
-Active attacks, which involve the intruder sending packets to your
-system (like packets that break into sendmail and give them a root
-shell :-) are much harder to guard against.  Active attacks that
-involve sending people (breaking into your house and replacing parts
-of your computer with ones that transmit what you're doing) are also
-much harder to guard against.  Though we are putting effort into
-protecting against active attacks, it's a much bigger job than merely
-providing strong encryption.  It involves general computer security,
-and general physical security, which are two very expensive problems
-for even a site to solve, let alone to build into a whole society.
-
-The societal benefit of building an infrastructure that protects
-well against passive attacks is that it makes it much harder to do
-undetected bulk monitoring of the population.  It's a defense against
-police-states, not against policemen.
-
-Policemen can put in the effort required to actively attack sites that
-they have strong suspicions about.  But police states won't be able to
-build systems that automatically monitor everyone's communications.
-Either they will be able to monitor only a small subset of the
-populace (by targeting those who screwed up their passive security),
-or their monitoring activities will be detectable by those monitored
-(active attacks leave packet traces or footprints), which can then be
-addressed through the press and through political means if they become
-too widespread.
-
-FreeS/WAN does not protect very well against traffic analysis, which
-is a kind of widespread police-state style monitoring that still
-reveals significant information (who's talking to who) without
-revealing the contents of what was said.  Defenses against traffic
-analysis are an open research problem.  Zero Knowledge Systems is
-actively deploying a system designed to thwart it, designed by Ian
-Goldberg.  The jury is out on whether it actually works; a lot more
-experience with it will be needed.</PRE>
-<P>Notes on things mentioned in that message:</P>
-<UL>
-<LI>Denker is a co-author of a<A href="intro.html#applied"> paper</A> on
- a large FreeS/WAN application.</LI>
-<LI>Information on Zero Knowledge is on their<A href="http://www.zks.net/">
- web site</A>. Their Freedom product, designed to provide untracable
- pseudonyms for use on the net, is no longer marketed.</LI>
-<LI>Another section of our documentation discusses ways to<A href="ipsec.html#traffic.resist">
- resist traffic analysis</A>.</LI>
-</UL>
-<H2><A name="weak">Government promotion of weak crypto</A></H2>
-<P>Various groups, especially governments and especially the US
- government, have a long history of advocating various forms of bogus
- security.</P>
-<P>We regard bogus security as extremely dangerous. If users are
- deceived into relying on bogus security, then they may be exposed to
- large risks. They would be better off having no security and knowing
- it. At least then they would be careful about what they said.</P>
-<P><STRONG>Avoiding bogus security is a key design criterion for
- everything we do in FreeS/WAN</STRONG>. The most conspicuous example is
- our refusal to support<A href="#desnotsecure"> single DES</A>. Other
- IPsec &quot;features&quot; which we do not implement are discussed in our<A href="compat.html#dropped">
- compatibility</A> document.</P>
-<H3><A name="escrow">Escrowed encryption</A></H3>
-<P>Various governments have made persistent attempts to encourage or
- mandate &quot;escrowed encrytion&quot;, also called &quot;key recovery&quot;, or GAK for
- &quot;government access to keys&quot;. The idea is that cryptographic keys be
- held by some third party and turned over to law enforcement or security
- agencies under some conditions.</P>
-<PRE>  Mary had a little key - she kept it in escrow,
-  and every thing that Mary said,
-  the feds were sure to know.</PRE>
-<P>A<A href="web.html#quotes"> crypto quotes</A> page attributes this to<A
-href="http://www.scramdisk.clara.net/"> Sam Simpson</A>.</P>
-<P>There is an excellent paper available on<A href="http://www.cdt.org/crypto/risks98/">
- Risks of Escrowed Encryption</A>, from a group of cryptographic
- luminaries which included our project leader.</P>
-<P>Like any unnecessary complication, GAK tends to weaken security of
- any design it infects. For example:</P>
-<UL>
-<LI>Matt Blaze found a fatal flaw in the US government's Clipper chip
- shortly after design information became public. See his paper &quot;Protocol
- Failure in the Escrowed Encryption Standard&quot; on his<A href="http://www.crypto.com/papers/">
- papers</A> page.</LI>
-<LI>a rather<A href="http://www.pgp.com/other/advisories/adk.asp"> nasty
- bug</A> was found in the &quot;additional decryption keys&quot; &quot;feature&quot; of some
- releases of<A href="glossary.html#PGP"> PGP</A></LI>
-</UL>
-<P>FreeS/WAN does not support escrowed encryption, and never will.</P>
-<H3><A name="shortkeys">Limited key lengths</A></H3>
-<P>Various governments, and some vendors, have also made persistent
- attempts to convince people that:</P>
-<UL>
-<LI>weak systems are sufficient for some data</LI>
-<LI>strong cryptography should be reserved for cases where the extra
- overheads are justified</LI>
-</UL>
-<P><STRONG>This is utter nonsense</STRONG>.</P>
-<P>Weak systems touted include:</P>
-<UL>
-<LI>the ludicrously weak (deliberately crippled) 40-bit ciphers that
- until recently were all various<A href="#exlaw"> export laws</A>
- allowed</LI>
-<LI>56-bit single DES, discussed<A href="#desnotsecure"> below</A></LI>
-<LI>64-bit symmetric ciphers and 512-bit RSA, the maximums for
- unrestricted export under various current laws</LI>
-</UL>
-<P>The notion that choice of ciphers or keysize should be determined by
- a trade-off between security requirements and overheads is pure
- bafflegab.</P>
-<UL>
-<LI>For most<A href="glossary.html#symmetric"> symmetric ciphers</A>, it
- is simply a lie. Any block cipher has some natural maximum keysize
- inherent in the design -- 128 bits for<A href="glossary.html#IDEA">
- IDEA</A> or<A href="glossary.html#CAST128"> CAST-128</A>, 256 for
- Serpent or Twofish, 448 for<A href="glossary.html#Blowfish"> Blowfish</A>
- and 2048 for<A href="glossary.html#RC4"> RC4</A>. Using a key size
- smaller than that limit gives<EM> exactly zero</EM> savings in
- overhead. The crippled 40-bit or 64-bit version of the cipher provides<EM>
- no advantage whatsoever</EM>.</LI>
-<LI><A href="glossary.html#AES">AES</A> uses 10 rounds with 128-bit
- keys, 12 rounds for 192-bit and 14 rounds for 256-bit, so there
- actually is a small difference in overhead, but not enough to matter in
- most applications.</LI>
-<LI>For<A href="glossary.html#3DES"> triple DES</A> there is a grain of
- truth in the argument. 3DES is indeed three times slower than single
- DES. However, the solution is not to use the insecure single DES, but
- to pick a faster secure cipher.<A href="glossary.html#CAST128">
- CAST-128</A>,<A href="glossary.html#Blowfish"> Blowfish</A> and the<A href="glossary.html#AES">
- AES candidate</A> ciphers are are all considerably faster in software
- than DES (let alone 3DES!), and apparently secure.</LI>
-<LI>For<A href="glossary.html#public"> public key</A> techniques, there
- are extra overheads for larger keys, but they generally do not affect
- overall performance significantly. Practical public key applications
- are usually<A href="glossary.html#hybrid"> hybrid</A> systems in which
- the bulk of the work is done by a symmetric cipher. The effect of
- increasing the cost of the public key operations is typically
- negligible because the public key operations use only a tiny fraction
- of total resources.
-<P>For example, suppose public key operations use use 1% of the time in
- a hybrid system and you triple the cost of public key operations. The
- cost of symmetric cipher operations is unchanged at 99% of the original
- total cost, so the overall effect is a jump from 99 + 1 = 100 to 99 + 3
- = 102, a 2% rise in system cost.</P>
-</LI>
-</UL>
-<P>In short,<STRONG> there has never been any technical reason to use
- inadequate ciphers</STRONG>. The only reason there has ever been for
- anyone to use such ciphers is that government agencies want weak
- ciphers used so that they can crack them. The alleged savings are
- simply propaganda.</P>
-<PRE>   Mary had a little key (It's all she could export),
-   and all the email that she sent was opened at the Fort.</PRE>
-<P>A<A href="web.html#quotes"> crypto quotes</A> page attributes this to<A
-href="http://theory.lcs.mit.edu:80/~rivest/"> Ron Rivest</A>. NSA
- headquarters is at Fort Meade, Maryland.</P>
-<P>Our policy in FreeS/WAN is to use only cryptographic components with
- adequate keylength and no known weaknesses.</P>
-<UL>
-<LI>We do not implement single DES because it is clearly<A href="#desnotsecure">
- insecure</A>, so implemeting it would violate our policy of avoiding
- bogus security. Our default cipher is<A href="glossary.html#3DES"> 3DES</A>
-</LI>
-<LI>Similarly, we do not implement the 768-bit Group 1 for<A href="glossary.html#DH">
- Diffie-Hellman</A> key negotiation. We provide only the 1024-bit Group
- 2 and 1536-bit Group 5.</LI>
-</UL>
-<P>Detailed discussion of which IPsec features we implement or omit is
- in out<A href="compat.html"> compatibility document</A>.</P>
-<P>These decisions imply that we cannot fully conform to the IPsec RFCs,
- since those have DES as the only required cipher and Group 1 as the
- only required DH group. (In our view, the standards were subverted into
- offerring bogus security.) Fortunately, we can still interoperate with
- most other IPsec implementations since nearly all implementers provide
- at least 3DES and Group 2 as well.</P>
-<P>We hope that eventually the RFCs will catch up with our (and others')
- current practice and reject dubious components. Some of our team and a
- number of others are working on this in<A href="glossary.html#IETF">
- IETF</A> working groups.</P>
-<H4>Some real trade-offs</H4>
-<P>Of course, making systems secure does involve costs, and trade-offs
- can be made between cost and security. However, the real trade-offs
- have nothing to do with using weaker ciphers.</P>
-<P>There can be substantial hardware and software costs. There are often
- substantial training costs, both to train administrators and to
- increase user awareness of security issues and procedures. There are
- almost always substantial staff or contracting costs.</P>
-<P>Security takes staff time for planning, implementation, testing and
- auditing. Some of the issues are subtle; you need good (hence often
- expensive) people for this. You also need people to monitor your
- systems and respond to problems. The best safe ever built is insecure
- if an attacker can work on it for days without anyone noticing. Any
- computer is insecure if the administrator is &quot;too busy&quot; to check the
- logs.</P>
-<P>Moreover, someone in your organisation (or on contract to it) needs
- to spend considerable time keeping up with new developments. EvilDoers<EM>
- will</EM> know about new attacks shortly after they are found. You need
- to know about them before your systems are attacked. If your vendor
- provides a patch, you need to apply it. If the vendor does nothing, you
- need to complain or start looking for another vendor.</P>
-<P>For a fairly awful example, see this<A href="http://www.sans.org/newlook/alerts/NTE-bank.htm">
- report</A>. In that case over a million credit card numbers were taken
- from e-commerce sites, using security flaws in Windows NT servers.
- Microsoft had long since released patches for most or all of the flaws,
- but the site administrators had not applied them.</P>
-<P>At an absolute minimum, you must do something about such issues<EM>
- before</EM> an exploitation tool is posted to the net for downloading
- by dozens of &quot;script kiddies&quot;. Such a tool might appear at any time
- from the announcement of the security hole to several months later.
- Once it appears, anyone with a browser and an attitude can break any
- system whose administrators have done nothing about the flaw.</P>
-<P>Compared to those costs, cipher overheads are an insignificant factor
- in the cost of security.</P>
-<P>The only thing using a weak cipher can do for you is to cause all
- your other investment to be wasted.</P>
-<H2><A name="exlaw">Cryptography Export Laws</A></H2>
-<P>Many nations restrict the export of cryptography and some restrict
- its use by their citizens or others within their borders.</P>
-<H3><A name="USlaw">US Law</A></H3>
-<P>US laws, as currently interpreted by the US government, forbid export
- of most cryptographic software from the US in machine-readable form
- without government permission. In general, the restrictions apply even
- if the software is widely-disseminated or public-domain and even if it
- came from outside the US originally. Cryptography is legally a munition
- and export is tightly controlled under the<A href="glossary.html#EAR">
- EAR</A> Export Administration Regulations.</P>
-<P>If you are a US citizen, your brain is considered US territory no
- matter where it is physically located at the moment. The US believes
- that its laws apply to its citizens everywhere, not just within the US.
- Providing technical assistance or advice to foreign &quot;munitions&quot;
- projects is illegal. The US government has very little sense of humor
- about this issue and does not consider good intentions to be sufficient
- excuse. Beware.</P>
-<P>The<A href="http://www.bxa.doc.gov/Encryption/"> official website</A>
- for these regulations is run by the Commerce Department's Bureau of
- Export Administration (BXA).</P>
-<P>The<A href="http://www.eff.org/bernstein/"> Bernstein case</A>
- challenges the export restrictions on Constitutional grounds. Code is
- speech so restrictions on export of code violate the First Amendment's
- free speech provisions. This argument has succeeded in two levels of
- court so far. It is quite likely to go on to the Supreme Court.</P>
-<P>The regulations were changed substantially in January 2000,
- apparently as a government attempt to get off the hook in the Bernstein
- case. It is now legal to export public domain source code for
- encryption, provided you notify the<A href="glossary.html#BXA"> BXA</A>
-.</P>
-<P>There are, however, still restrictions in force. Moreover, the
- regulations can still be changed again whenever the government chooses
- to do so. Short of a Supreme Court ruling (in the Berstein case or
- another) that overturns the regulations completely, the problem of
- export regulation is not likely to go away in the forseeable future.</P>
-<H4><A name="UScontrib">US contributions to FreeS/WAN</A></H4>
-<P>The FreeS/WAN project<STRONG> cannot accept software contributions,<EM>
- not even small bug fixes</EM>, from US citizens or residents</STRONG>.
- We want it to be absolutely clear that our distribution is not subject
- to US export law. Any contribution from an American might open that
- question to a debate we'd prefer to avoid. It might also put the
- contributor at serious legal risk.</P>
-<P>Of course Americans can still make valuable contributions (many
- already have) by reporting bugs, or otherwise contributing to
- discussions, on the project<A href="mail.html"> mailing list</A>. Since
- the list is public, this is clearly constitutionally protected free
- speech.</P>
-<P>Note, however, that the export laws restrict Americans from providing
- technical assistance to foreign &quot;munitions&quot; projects. The government
- might claim that private discussions or correspondence with FreeS/WAN
- developers were covered by this. It is not clear what the courts would
- do with such a claim, so we strongly encourage Americans to use the
- list rather than risk the complications.</P>
-<H3><A name="wrong">What's wrong with restrictions on cryptography</A></H3>
-<P>Some quotes from prominent cryptography experts:</P>
-<BLOCKQUOTE> The real aim of current policy is to ensure the continued
- effectiveness of US information warfare assets against individuals,
- businesses and governments in Europe and elsewhere.
-<BR><A href="http://www.cl.cam.ac.uk/users/rja14"> Ross Anderson,
- Cambridge University</A></BLOCKQUOTE><BLOCKQUOTE> If the government
- were honest about its motives, then the debate about crypto export
- policy would have ended years ago.
-<BR><A href="http://www.counterpane.com"> Bruce Schneier, Counterpane
- Systems</A></BLOCKQUOTE><BLOCKQUOTE> The NSA regularly lies to people
- who ask it for advice on export control. They have no reason not to;
- accomplishing their goal by any legal means is fine by them. Lying by
- government employees is legal.
-<BR> John Gilmore.</BLOCKQUOTE>
-<P>The Internet Architecture Board (IAB) and the Internet Engineering
- Steering Group (IESG) made a<A href="iab-iesg.stmt"> strong statement</A>
- in favour of worldwide access to strong cryptography. Essentially the
- same statement is in the appropriately numbered<A href="ftp://ftp.isi.edu/in-notes/rfc1984.txt">
- RFC 1984</A>. Two critical paragraphs are:</P>
-<BLOCKQUOTE> ... various governments have actual or proposed policies on
- access to cryptographic technology ...
-<P>(a) ... export controls ...
-<BR> (b) ... short cryptographic keys ...
-<BR> (c) ... keys should be in the hands of the government or ...
-<BR> (d) prohibit the use of cryptology ...</P>
-<P>We believe that such policies are against the interests of consumers
- and the business community, are largely irrelevant to issues of
- military security, and provide only a marginal or illusory benefit to
- law enforcement agencies, ...</P>
-<P>The IAB and IESG would like to encourage policies that allow ready
- access to uniform strong cryptographic technology for all Internet
- users in all countries.</P>
-</BLOCKQUOTE>
-<P>Our goal in the FreeS/WAN project is to build just such &quot;strong
- cryptographic technology&quot; and to distribute it &quot;for all Internet users
- in all countries&quot;.</P>
-<P>More recently, the same two bodies (IESG and IAB) have issued<A href="ftp://ftp.isi.edu/in-notes/rfc2804.txt">
- RFC 2804</A> on why the IETF should not build wiretapping capabilities
- into protocols for the convenience of security or law enforcement
- agenicies. The abstract from that document is:</P>
-<BLOCKQUOTE> The Internet Engineering Task Force (IETF) has been asked
- to take a position on the inclusion into IETF standards-track documents
- of functionality designed to facilitate wiretapping.
-<P>This memo explains what the IETF thinks the question means, why its
- answer is &quot;no&quot;, and what that answer means.</P>
-</BLOCKQUOTE> A quote from the debate leading up to that RFC:<BLOCKQUOTE>
- We should not be building surveillance technology into standards. Law
- enforcement was not supposed to be easy. Where it is easy, it's called
- a police state.
-<BR> Jeff Schiller of MIT, in a discussion of FBI demands for wiretap
- capability on the net, as quoted by<A href="http://www.wired.com/news/politics/0,1283,31895,00.html">
- Wired</A>.</BLOCKQUOTE>
-<P>The<A href="http://www.ietf.org/mailman/listinfo/raven"> Raven</A>
- mailing list was set up for this IETF discussion.</P>
-<P>Our goal is to go beyond that RFC and prevent Internet wiretapping
- entirely.</P>
-<H3><A name="Wassenaar">The Wassenaar Arrangement</A></H3>
-<P>Restrictions on the export of cryptography are not just US policy,
- though some consider the US at least partly to blame for the policies
- of other nations in this area.</P>
-<P>A number of countries:</P>
-<P>Argentina, Australia, Austria, Belgium, Bulgaria, Canada, Czech
- Republic, Denmark, Finland, France, Germany, Greece, Hungary, Ireland,
- Italy, Japan, Luxembourg, Netherlands, New Zealand, Norway, Poland,
- Portugal, Republic of Korea, Romania, Russian Federation, Slovak
- Republic, Spain, Sweden, Switzerland, Turkey, Ukraine, United Kingdom
- and United States</P>
-<P>have signed the Wassenaar Arrangement which restricts export of
- munitions and other tools of war. Cryptographic sofware is covered
- there.</P>
-<P>Wassenaar details are available from the<A href="http://www.wassenaar.org/">
- Wassenaar Secretariat</A>, and elsewhere in a more readable<A href="http://www.fitug.de/news/wa/index.html">
- HTML version</A>.</P>
-<P>For a critique see the<A href="http://www.gilc.org/crypto/wassenaar">
- GILC site</A>:</P>
-<BLOCKQUOTE> The Global Internet Liberty Campaign (GILC) has begun a
- campaign calling for the removal of cryptography controls from the
- Wassenaar Arrangement.
-<P>The aim of the Wassenaar Arrangement is to prevent the build up of
- military capabilities that threaten regional and international security
- and stability . . .</P>
-<P>There is no sound basis within the Wassenaar Arrangement for the
- continuation of any export controls on cryptographic products.</P>
-</BLOCKQUOTE>
-<P>We agree entirely.</P>
-<P>An interesting analysis of Wassenaar can be found on the<A href="http://www.cyber-rights.org/crypto/wassenaar.htm">
- cyber-rights.org</A> site.</P>
-<H3><A name="status">Export status of Linux FreeS/WAN</A></H3>
-<P>We believe our software is entirely exempt from these controls since
- the Wassenaar<A href="http://www.wassenaar.org/list/GTN%20and%20GSN%20-%2099.pdf">
- General Software Note</A> says:</P>
-<BLOCKQUOTE> The Lists do not control &quot;software&quot; which is either:
-<OL>
-<LI>Generally available to the public by . . . retail . . . or</LI>
-<LI>&quot;In the public domain&quot;.</LI>
-</OL>
-</BLOCKQUOTE>
-<P>There is a note restricting some of this, but it is a sub-heading
- under point 1, so it appears not to apply to public domain software.</P>
-<P>Their glossary defines &quot;In the public domain&quot; as:</P>
-<BLOCKQUOTE> . . . &quot;technology&quot; or &quot;software&quot; which has been made
- available without restrictions upon its further dissemination.
-<P>N.B. Copyright restrictions do not remove &quot;technology&quot; or &quot;software&quot;
- from being &quot;in the public domain&quot;.</P>
-</BLOCKQUOTE>
-<P>We therefore believe that software freely distributed under the<A href="glossary.html#GPL">
- GNU Public License</A>, such as Linux FreeS/WAN, is exempt from
- Wassenaar restrictions.</P>
-<P>Most of the development work is being done in Canada. Our
- understanding is that the Canadian government accepts this
- interpretation.</P>
-<UL>
-<LI>A web statement of<A href="http://www.dfait-maeci.gc.ca/~eicb/notices/ser113-e.htm">
- Canadian policy</A> is available from the Department of Foreign Affairs
- and International Trade.</LI>
-<LI>Another document from that department states that<A href="http://www.dfait-maeci.gc.ca/~eicb/export/gr1_e.htm">
- public domain software</A> is exempt from the export controls.</LI>
-<LI>A researcher's<A href="http://insight.mcmaster.ca/org/efc/pages/doc/crypto-export.html">
- analysis</A> of Canadian policy is also available.</LI>
-</UL>
-<P>Recent copies of the freely modifiable and distributable source code
- exist in many countries. Citizens all over the world participate in its
- use and evolution, and guard its ongoing distribution. Even if Canadian
- policy were to change, the software would continue to evolve in
- countries which do not restrict exports, and would continue to be
- imported from there into unfree countries. &quot;The Net culture treats
- censorship as damage, and routes around it.&quot;</P>
-<H3><A name="help">Help spread IPsec around</A></H3>
-<P>You can help. If you don't know of a Linux FreeS/WAN archive in your
- own country, please download it now to your personal machine, and
- consider making it publicly accessible if that doesn't violate your own
- laws. If you have the resources, consider going one step further and
- setting up a mirror site for the whole<A href="intro.html#munitions">
- munitions</A> Linux crypto software archive.</P>
-<P>If you make Linux CD-ROMs, please consider including this code, in a
- way that violates no laws (in a free country, or in a domestic-only CD
- product).</P>
-<P>Please send a note about any new archive mirror sites or CD
- distributions to linux-ipsec@clinet.fi so we can update the
- documentation.</P>
-<P>Lists of current<A href="intro.html#sites"> mirror sites</A> and of<A href="intro.html#distwith">
- distributions</A> which include FreeS/WAN are in our introduction
- section.</P>
-<H2><A name="desnotsecure">DES is Not Secure</A></H2>
-<P>DES, the<STRONG> D</STRONG>ata<STRONG> E</STRONG>ncryption<STRONG> S</STRONG>
-tandard, can no longer be considered secure. While no major flaws in its
- innards are known, it is fundamentally inadequate because its<STRONG>
- 56-bit key is too short</STRONG>. It is vulnerable to<A href="glossary.html#brute">
- brute-force search</A> of the whole key space, either by large
- collections of general-purpose machines or even more quickly by
- specialized hardware. Of course this also applies to<STRONG> any other
- cipher with only a 56-bit key</STRONG>. The only reason anyone could
- have for using a 56 or 64-bit key is to comply with various<A href="exportlaw.html">
- export laws</A> intended to ensure the use of breakable ciphers.</P>
-<P>Non-government cryptologists have been saying DES's 56-bit key was
- too short for some time -- some of them were saying it in the 70's when
- DES became a standard -- but the US government has consistently
- ridiculed such suggestions.</P>
-<P>A group of well-known cryptographers looked at key lengths in a<A href="http://www.counterpane.com/keylength.html">
- 1996 paper</A>. They suggested a<EM> minimum</EM> of 75 bits to
- consider an existing cipher secure and a<EM> minimum of 90 bits for new
- ciphers</EM>. More recent papers, covering both<A href="glossary.html#symmetric">
- symmetric</A> and<A href="glossary.html#public"> public key</A> systems
- are at<A href="http://www.cryptosavvy.com/"> cryptosavvy.com</A> and<A href="http://www.rsasecurity.com/rsalabs/bulletins/bulletin13.html">
- rsa.com</A>. For all algorithms, the minimum keylengths recommended in
- such papers are significantly longer than the maximums allowed by
- various export laws.</P>
-<P>In a<A href="http://www.privacy.nb.ca/cryptography/archives/cryptography/html/1998-09/0095.html">
- 1998 ruling</A>, a German court described DES as &quot;out-of-date and not
- safe enough&quot; and held a bank liable for using it.</P>
-<H3><A name="deshware">Dedicated hardware breaks DES in a few days</A></H3>
-<P>The question of DES security has now been settled once and for all.
- In early 1998, the<A href="http://www.eff.org/"> Electronic Frontier
- Foundation</A> built a<A href="http://www.eff.org/descracker.html">
- DES-cracking machine</A>. It can find a DES key in an average of a few
- days' search. The details of all this, including complete code listings
- and complete plans for the machine, have been published in<A href="biblio.html#EFF">
-<CITE> Cracking DES</CITE></A>, by the Electronic Frontier Foundation.</P>
-<P>That machine cost just over $200,000 to design and build. &quot;Moore's
- Law&quot; is that machines get faster (or cheaper, for the same speed) by
- roughly a factor of two every 18 months. At that rate, their $200,000
- in 1998 becomes $50,000 in 2001.</P>
-<P>However, Moore's Law is not exact and the $50,000 estimate does not
- allow for the fact that a copy based on the published EFF design would
- cost far less than the original. We cannot say exactly what such a
- cracker would cost today, but it would likely be somewhere between
- $10,000 and $100,000.</P>
-<P>A large corporation could build one of these out of petty cash. The
- cost is low enough for a senior manager to hide it in a departmental
- budget and avoid having to announce or justify the project. Any
- government agency, from a major municipal police force up, could afford
- one. Or any other group with a respectable budget -- criminal
- organisations, political groups, labour unions, religious groups, ...
- Or any millionaire with an obsession or a grudge, or just strange taste
- in toys.</P>
-<P>One might wonder if a private security or detective agency would have
- one for rent. They wouldn't need many clients to pay off that
- investment.</P>
-<H3><A name="spooks">Spooks may break DES faster yet</A></H3>
-<P>As for the security and intelligence agencies of various nations,
- they may have had DES crackers for years, and theirs may be much
- faster. It is difficult to make most computer applications work well on
- parallel machines, or to design specialised hardware to accelerate
- them. Cipher-cracking is one of the very few exceptions. It is entirely
- straightforward to speed up cracking by just adding hardware. Within
- very broad limits, you can make it as fast as you like if you have the
- budget. The EFF's $200,000 machine breaks DES in a few days. An<A href="http://www.planepage.com/">
- aviation website</A> gives the cost of a B1 bomber as $200,000,000.
- Spending that much, an intelligence agency could break DES in an
- average time of<EM> six and a half minutes</EM>.</P>
-<P>That estimate assumes they use the EFF's 1998 technology and just
- spend more money. They may have an attack that is superior to brute
- force, they quite likely have better chip technology (Moore's law, a
- bigger budget, and whatever secret advances they may have made) and of
- course they may have spent the price of an aircraft carrier, not just
- one aircraft.</P>
-<P>In short, we have<EM> no idea</EM> how quickly these organisations
- can break DES. Unless they're spectacularly incompetent or horribly
- underfunded, they can certainly break it, but we cannot guess how
- quickly. Pick any time unit between days and milliseconds; none is
- entirely unbelievable. More to the point, none of them is of any
- comfort if you don't want such organisations reading your
- communications.</P>
-<P>Note that this may be a concern even if nothing you do is a threat to
- anyone's national security. An intelligence agency might well consider
- it to be in their national interest for certain companies to do well.
- If you're competing against such companies in a world market and that
- agency can read your secrets, you have a serious problem.</P>
-<P>One might wonder about technology the former Soviet Union and its
- allies developed for cracking DES during the Cold War. They must have
- tried; the cipher was an American standard and widely used. Certainly
- those countries have some fine mathematicians, and those agencies had
- budget. How well did they succeed? Is their technology now for sale or
- rent?</P>
-<H3><A name="desnet">Networks break DES in a few weeks</A></H3>
-<P>Before the definitive EFF effort, DES had been cracked several times
- by people using many machines. See this<A href="http://www.distributed.net/pressroom/DESII-1-PR.html">
- press release</A> for example.</P>
-<P>A major corporation, university, or government department could break
- DES by using spare cycles on their existing collection of computers, by
- dedicating a group of otherwise surplus machines to the problem, or by
- combining the two approaches. It might take them weeks or months,
- rather than the days required for the EFF machine, but they could do
- it.</P>
-<P>What about someone working alone, without the resources of a large
- organisation? For them, cracking DES will not be easy, but it may be
- possible. A few thousand dollars buys a lot of surplus workstations. A
- pile of such machines will certainly heat your garage nicely and might
- break DES in a few months or years. Or enroll at a university and use
- their machines. Or use an employer's machines. Or crack security
- somewhere and steal the resources to crack a DES key. Or write a virus
- that steals small amounts of resources on many machines. Or . . .</P>
-<P>None of these approaches are easy or break DES really quickly, but an
- attacker only needs to find one that is feasible and breaks DES quickly
- enough to be dangerous. How much would you care to bet that this will
- be impossible if the attacker is clever and determined? How valuable is
- your data? Are you authorised to risk it on a dubious bet?</P>
-<H3><A name="no_des">We disable DES</A></H3>
-<P>In short, it is now absolutely clear that<STRONG> DES is not secure</STRONG>
- against</P>
-<UL>
-<LI>any<STRONG> well-funded opponent</STRONG></LI>
-<LI>any opponent (even a penniless one) with access (even stolen access)
- to<STRONG> enough general purpose computers</STRONG></LI>
-</UL>
-<P>That is why<STRONG> Linux FreeS/WAN disables all transforms which use
- plain DES</STRONG> for encryption.</P>
-<P>DES is in the source code, because we need DES to implement our
- default encryption transform,<A href="glossary.html#3DES"> Triple DES</A>
-.<STRONG> We urge you not to use single DES</STRONG>. We do not provide
- any easy way to enable it in FreeS/WAN, and our policy is to provide no
- assistance to anyone wanting to do so.</P>
-<H3><A name="40joke">40-bits is laughably weak</A></H3>
-<P>The same is true, in spades, of ciphers -- DES or others -- crippled
- by 40-bit keys, as many ciphers were required to be until recently
- under various<A href="#exlaw"> export laws</A>. A brute force search of
- such a cipher's keyspace is 2<SUP>16</SUP> times faster than a similar
- search against DES. The EFF's machine can do a brute-force search of a
- 40-bit key space in<EM> seconds</EM>. One contest to crack a 40-bit
- cipher was won by a student<A href="http://catless.ncl.ac.uk/Risks/18.80.html#subj1">
- using a few hundred idle machines at his university</A>. It took only
- three and half hours.</P>
-<P>We do not, and will not, implement any 40-bit cipher.</P>
-<H3><A name="altdes">Triple DES is almost certainly secure</A></H3>
-<P><A href="glossary.html#3DES">Triple DES</A>, usually abbreviated
- 3DES, applies DES three times, with three different keys. DES seems to
- be basically an excellent cipher design; it has withstood several
- decades of intensive analysis without any disastrous flaws being found.
- It's only major flaw is that the small keyspace allows brute force
- attacks to succeeed. Triple DES enlarges the key space to 168 bits,
- making brute-force search a ridiculous impossibility.</P>
-<P>3DES is currently the only block cipher implemented in FreeS/WAN.
- 3DES is, unfortunately, about 1/3 the speed of DES, but modern CPUs
- still do it at quite respectable speeds. Some<A href="glossary.html#benchmarks">
- speed measurements</A> for our code are available.</P>
-<H3><A name="aes.ipsec">AES in IPsec</A></H3>
-<P>The<A href="glossary.html#AES"> AES</A> project has chosen a
- replacement for DES, a new standard cipher for use in non-classified US
- government work and in regulated industries such as banking. This
- cipher will almost certainly become widely used for many applications,
- including IPsec.</P>
-<P>The winner, announced in October 2000 after several years of analysis
- and discussion, was the<A href="http://www.esat.kuleuven.ac.be/~rijmen/rijndael/">
- Rijndael</A> cipher from two Belgian designers.</P>
-<P>It is almost certain that FreeS/WAN will add AES support.<A href="web.html#patch">
- AES patches</A> are already available.</P>
-<H2><A name="press">Press coverage of Linux FreeS/WAN:</A></H2>
-<H3><A NAME="26_6_1">FreeS/WAN 1.0 press</A></H3>
-<UL>
-<LI><A href="http://www.wired.com/news/news/technology/story/19136.html">
-Wired</A> &quot;Linux-Based Crypto Stops Snoops&quot;, James Glave April 15 1999</LI>
-<LI><A href="http://slashdot.org/articles/99/04/15/1851212.shtml">
-Slashdot</A></LI>
-<LI><A href="http://dgl.com/itinfo/1999/it990415.html">DGL</A>, Damar
- Group Limited; looking at FreeS/WAN from a perspective of business
- computing</LI>
-<LI><A href="http://linuxtoday.com/stories/5010.html">Linux Today</A></LI>
-<LI><A href="http://www.tbtf.com/archive/1999-04-21.html#Tcep">TBTF</A>,
- Tasty Bits from the Technology Front</LI>
-<LI><A href="http://www.salonmagazine.com/tech/log/1999/04/16/encryption/index.html">
-Salon Magazine</A> &quot;Free Encryption Takes a Big Step&quot;</LI>
-</UL>
-<H3><A name="release">Press release for version 1.0</A></H3>
-<PRE>        Strong Internet Privacy Software Free for Linux Users Worldwide
-
-Toronto, ON, April 14, 1999 - 
-
-The Linux FreeS/WAN project today released free software to protect
-the privacy of Internet communications using strong encryption codes.
-FreeS/WAN automatically encrypts data as it crosses the Internet, to
-prevent unauthorized people from receiving or modifying it.  One
-ordinary PC per site runs this free software under Linux to become a
-secure gateway in a Virtual Private Network, without having to modify
-users' operating systems or application software.  The project built
-and released the software outside the United States, avoiding US
-government regulations which prohibit good privacy protection.
-FreeS/WAN version 1.0 is available immediately for downloading at
-http://www.xs4all.nl/~freeswan/.
-
-&quot;Today's FreeS/WAN release allows network administrators to build
-excellent secure gateways out of old PCs at no cost, or using a cheap
-new PC,&quot; said John Gilmore, the entrepreneur who instigated the
-project in 1996.  &quot;They can build operational experience with strong
-network encryption and protect their users' most important
-communications worldwide.&quot;
-
-&quot;The software was written outside the United States, and we do not
-accept contributions from US citizens or residents, so that it can be
-freely published for use in every country,&quot; said Henry Spencer, who
-built the release in Toronto, Canada.  &quot;Similar products based in the
-US require hard-to-get government export licenses before they can be
-provided to non-US users, and can never be simply published on a Web
-site.  Our product is freely available worldwide for immediate
-downloading, at no cost.&quot;
-
-FreeS/WAN provides privacy against both quiet eavesdropping (such as
-&quot;packet sniffing&quot;) and active attempts to compromise communications
-(such as impersonating participating computers).  Secure &quot;tunnels&quot; carry
-information safely across the Internet between locations such as a
-company's main office, distant sales offices, and roaming laptops.  This
-protects the privacy and integrity of all information sent among those
-locations, including sensitive intra-company email, financial transactions
-such as mergers and acquisitions, business negotiations, personal medical
-records, privileged correspondence with lawyers, and information about
-crimes or civil rights violations.  The software will be particularly
-useful to frequent wiretapping targets such as private companies competing
-with government-owned companies, civil rights groups and lawyers,
-opposition political parties, and dissidents. 
-
-FreeS/WAN provides privacy for Internet packets using the proposed
-standard Internet Protocol Security (IPSEC) protocols.  FreeS/WAN
-negotiates strong keys using Diffie-Hellman key agreement with 1024-bit
-keys, and encrypts each packet with 168-bit Triple-DES (3DES).  A modern
-$500 PC can set up a tunnel in less than a second, and can encrypt
-6 megabits of packets per second, easily handling the whole available
-bandwidth at the vast majority of Internet sites.  In preliminary testing,
-FreeS/WAN interoperated with 3DES IPSEC products from OpenBSD, PGP, SSH,
-Cisco, Raptor, and Xedia.  Since FreeS/WAN is distributed as source code,
-its innards are open to review by outside experts and sophisticated users,
-reducing the chance of undetected bugs or hidden security compromises.
-
-The software has been in development for several years.  It has been
-funded by several philanthropists interested in increased privacy on
-the Internet, including John Gilmore, co-founder of the Electronic
-Frontier Foundation, a leading online civil rights group.
-
-Press contacts:
-Hugh Daniel,   +1 408 353 8124, hugh@toad.com
-Henry Spencer, +1 416 690 6561, henry@spsystems.net
-
-* FreeS/WAN derives its name from S/WAN, which is a trademark of RSA Data
-  Security, Inc; used by permission.</PRE>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="umltesting.html">Previous</A>
-<A HREF="ipsec.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/quickstart.html b/doc/quickstart.html
deleted file mode 100644
index 44d73abc5..000000000
--- a/doc/quickstart.html
+++ /dev/null
@@ -1,323 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="upgrading.html">Previous</A>
-<A HREF="policygroups.html">Next</A>
-<HR>
-<H1><A name="quickstart">Quickstart Guide to Opportunistic Encryption</A>
-</H1>
-<A name="quick_guide"></A>
-<H2><A name="opp.setup">Purpose</A></H2>
-<P>This page will get you started using Linux FreeS/WAN with
- opportunistic encryption (OE). OE enables you to set up IPsec tunnels
- without co-ordinating with another site administrator, and without hand
- configuring each tunnel. If enough sites support OE, a &quot;FAX effect&quot;
- occurs, and many of us can communicate without eavesdroppers.</P>
-<H3><A NAME="3_1_1">OE &quot;flag day&quot;</A></H3>
-<P>As of FreeS/WAN 2.01, OE uses DNS TXT resource records (RRs) only
- (rather than TXT with KEY). This change causes a<A href="http://jargon.watson-net.com/jargon.asp?w=flag+day">
- &quot;flag day&quot;</A>. Users of FreeS/WAN 2.00 (or earlier) OE who are
- upgrading may require additional resource records, as detailed in our<A href="upgrading.html#upgrading.flagday">
- upgrading document</A>. OE setup instructions here are for 2.02 or
- later.</P>
-<H2><A name="opp.dns">Requirements</A></H2>
-<P>To set up opportunistic encryption, you will need:</P>
-<UL>
-<LI>a Linux box. For OE to the public Internet, this box must NOT be
- behind<A HREF="glossary.html#NAT.gloss"> Network Address Translation</A>
- (NAT).</LI>
-<LI>to install Linux FreeS/WAN 2.02 or later</LI>
-<LI>either control over your reverse DNS (for full opportunism) or the
- ability to write to some forward domain (for initiator-only).<A HREF="http://www.fdns.net">
- This free DNS service</A> explicitly supports forward TXT records for
- FreeS/WAN use.</LI>
-<LI>(for full opportunism) a static IP</LI>
-</UL>
-<P>Note: Currently, only Linux FreeS/WAN supports opportunistic
- encryption.</P>
-<H2><A name="easy.install">RPM install</A></H2>
-<P>Our instructions are for a recent Red Hat with a 2.4-series stock or
- Red Hat updated kernel. For other ways to install, see our<A href="install.html#install">
- install document</A>.</P>
-<H3><A NAME="3_3_1">Download RPMs</A></H3>
-<P>If we have prebuilt RPMs for your Red Hat system, this command will
- get them:</P>
-<PRE>    ncftpget ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs/`uname -r | tr -d 'a-wy-z'`/\*</PRE>
-<P>If that fails, you will need to try<A HREF="install.html"> another
- install method</A>. Our kernel modules<B> will only work on the Red Hat
- kernel they were built for</B>, since they are very sensitive to small
- changes in the kernel.</P>
-<P>If it succeeds, you will have userland tools, a kernel module, and an
- RPM signing key:</P>
-<PRE>    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm
-    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm
-    freeswan-rpmsign.asc</PRE>
-<H3><A NAME="3_3_2">Check signatures</A></H3>
-<P>If you're running RedHat 8.x or later, import the RPM signing key
- into the RPM database:</P>
-<PRE>    rpm --import freeswan-rpmsign.asc</PRE>
-<P>For RedHat 7.x systems, you'll need to add it to your<A HREF="glossary.html#PGP">
- PGP</A> keyring:</P>
-<PRE>    pgp -ka freeswan-rpmsign.asc</PRE>
-<P>Check the digital signatures on both RPMs using:</P>
-<PRE>    rpm --checksig freeswan*.rpm </PRE>
-<P>You should see that these signatures are good:</P>
-<PRE>    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm: pgp md5 OK
-    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm: pgp md5 OK</PRE>
-<H3><A NAME="3_3_3">Install the RPMs</A></H3>
-<P>Become root:</P>
-<PRE>    su</PRE>
-<P>Install your RPMs with:</P>
-<P></P>
-<PRE>    rpm -ivh freeswan*.rpm</PRE>
-<P>If you're upgrading from FreeS/WAN 1.x RPMs, and have problems with
- that command, see<A HREF="upgrading.html#upgrading.rpms"> this note</A>
-.</P>
-<P>Then, start FreeS/WAN:</P>
-<PRE>    service ipsec start</PRE>
-<H3><A name="testinstall">Test</A></H3>
-<P>To check that you have a successful install, run:</P>
-<PRE>    ipsec verify</PRE>
-<P>You should see as part of the<VAR> verify</VAR> output:</P>
-<PRE>
-    Checking your system to see if IPsec got installed and started correctly
-    Version check and ipsec on-path                             [OK]
-    Checking for KLIPS support in kernel                        [OK]
-    Checking for RSA private key (/etc/ipsec.secrets)           [OK]
-    Checking that pluto is running                              [OK]
-    ...</PRE>
-<P>If any of these first four checks fails, see our<A href="trouble.html#install.check">
- troubleshooting guide</A>.</P>
-<H2><A name="opp.setups.list">Our Opportunistic Setups</A></H2>
-<H3><A NAME="3_4_1">Full or partial opportunism?</A></H3>
-<P>Determine the best form of opportunism your system can support.</P>
-<UL>
-<LI>For<A HREF="#opp.incoming"> full opportunism</A>, you'll need a
- static IP and and either control over your reverse DNS or an ISP that
- can add the required TXT record for you.</LI>
-<LI>If you have a dynamic IP, and/or write access to forward DNS only,
- you can do<A HREF="#opp.client"> initiate-only opportunism</A></LI>
-<LI>To protect traffic bound for real IPs behind your gateway, use<A HREF="adv_config.html#opp.gate">
- this form of full opportunism</A>.</LI>
-</UL>
-<H2><A name="opp.client">Initiate-only setup</A></H2>
-<H3><A NAME="3_5_1">Restrictions</A></H3>
-<P>When you set up initiate-only Opportunistic Encryption (iOE):</P>
-<UL>
-<LI>there will be<STRONG> no incoming connection requests</STRONG>; you
- can initiate all the IPsec connections you need.</LI>
-<LI><STRONG>only one machine is visible</STRONG> on your end of the
- connection.</LI>
-<LI>iOE also protects traffic on behalf of<A HREF="glossary.html#NAT.gloss">
- NATted</A> hosts behind the iOE box.</LI>
-</UL>
-<P>You cannot network a group of initiator-only machines if none of
- these is capable of responding to OE. If one is capable of responding,
- you may be able to create a hub topology using routing.</P>
-<H3><A name="forward.dns">Create and publish a forward DNS record</A></H3>
-<H4>Find a domain you can use</H4>
-<P>Find a DNS forward domain (e.g. example.com) where you can publish
- your key. You'll need access to the DNS zone files for that domain.
- This is common for a domain you own. Some free DNS providers, such as<A HREF="http://www.fdns.net">
- this one</A>, also provide this service.</P>
-<P>Dynamic IP users take note: the domain where you place your key need
- not be associated with the IP address for your system, or even with
- your system's usual hostname.</P>
-<H4>Choose your ID</H4>
-<P>Choose a name within that domain which you will use to identify your
- machine. It's convenient if this can be the same as your hostname:</P>
-<PRE>    [root@xy root]# hostname --fqdn
-    xy.example.com</PRE>
-<P>This name in FQDN (fully-qualified domain name) format will be your
- ID, for DNS key lookup and IPsec negotiation.</P>
-<H4>Create a forward TXT record</H4>
-<P>Generate a forward TXT record containing your system's public key
- with a command like:</P>
-<PRE>    ipsec showhostkey --txt @xy.example.com</PRE>
-<P>using your chosen ID in place of xy.example.com. This command takes
- the contents of /etc/ipsec.secrets and reformats it into something
- usable by ISC's BIND. The result should look like this (with the key
- data trimmed down for clarity):</P>
-<PRE>
-    ; RSA 2192 bits   xy.example.com   Thu Jan  2 12:41:44 2003
-        IN      TXT     &quot;X-IPsec-Server(10)=@xy.example.com&quot; 
-    &quot;AQOF8tZ2... ...+buFuFn/&quot;
-</PRE>
-<H4>Publish the forward TXT record</H4>
-<P>Insert the record into DNS, or have a system adminstrator do it for
- you. It may take up to 48 hours for the record to propagate, but it's
- usually much quicker.</P>
-<H3><A NAME="3_5_3">Test that your key has been published</A></H3>
-<P>Check your DNS work</P>
-<PRE>    ipsec verify --host xy.example.com</PRE>
-<P>As part of the<VAR> verify</VAR> output, you ought to see something
- like:</P>
-<PRE>    ...
-    Looking for TXT in forward map: xy.example.com          [OK]
-    ...</PRE>
-<P>For this type of opportunism, only the forward test is relevant; you
- can ignore the tests designed to find reverse records.</P>
-<H3><A NAME="3_5_4">Configure, if necessary</A></H3>
-<P> If your ID is the same as your hostname, you're ready to go.
- FreeS/WAN will use its<A HREF="policygroups.html"> built-in connections</A>
- to create your iOE functionality.</P>
-<P>If you have chosen a different ID, you must tell FreeS/WAN about it
- via<A HREF="manpage.d/ipsec.conf.5.html"><VAR> ipsec.conf</VAR></A>:</P>
-<PRE>    config setup
-        myid=@myname.freedns.example.com</PRE>
-<P>and restart FreeS/WAN:</P>
-<PRE>    service ipsec restart</PRE>
-<P>The new ID will be applied to the built-in connections.</P>
-<P>Note: you can create more complex iOE configurations as explained in
- our<A HREF="policygroups.html#policygroups"> policy groups document</A>
-, or disable OE using<A HREF="policygroups.html#disable_policygroups">
- these instructions</A>.</P>
-<H3><A NAME="3_5_5">Test</A></H3>
-<P>That's it!<A HREF="#opp.test"> Test your connections</A>.</P>
-<A name="opp.incoming"></A>
-<H2><A NAME="3_6">Full Opportunism</A></H2>
-<P>Full opportunism allows you to initiate and receive opportunistic
- connections on your machine.</P>
-<A name="incoming.opp.dns"></A>
-<H3><A NAME="3_6_1">Put a TXT record in a Forward Domain</A></H3>
-<P>To set up full opportunism, first<A HREF="#forward.dns"> set up a
- forward TXT record</A> as for<A HREF="#opp.client"> initiator-only OE</A>
-, using an ID (for example, your hostname) that resolves to your IP. Do
- not configure<VAR> /etc/ipsec.conf</VAR>, but continue with the
- instructions for full opportunism, below.</P>
-<P>Note that this forward record is not currently necessary for full OE,
- but will facilitate future features.</P>
-<A name="incoming.opp.dns"></A>
-<H3><A NAME="3_6_2">Put a TXT record in Reverse DNS</A></H3>
-<P>You must be able to publish your DNS RR directly in the reverse
- domain. FreeS/WAN will not follow a PTR which appears in the reverse,
- since a second lookup at connection start time is too costly.</P>
-<H4>Create a Reverse DNS TXT record</H4>
-<P>This record serves to publicize your FreeS/WAN public key. In
- addition, it lets others know that this machine can receive
- opportunistic connections, and asserts that the machine is authorized
- to encrypt on its own behalf.</P>
-<P>Use the command:</P>
-<PRE>    ipsec showhostkey --txt 192.0.2.11</PRE>
-<P>where you replace 192.0.2.11 with your public IP.</P>
-<P>The record (with key shortened) looks like:</P>
-<PRE>    ; RSA 2048 bits  xy.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;</PRE>
-<H4>Publish your TXT record</H4>
-<P>Send these records to your ISP, to be published in your IP's reverse
- map. It may take up to 48 hours for these to propagate, but usually
- takes much less time.</P>
-<H3><A NAME="3_6_3">Test your DNS record</A></H3>
-<P>Check your DNS work with</P>
-<PRE>    ipsec verify --host xy.example.com</PRE>
-<P>As part of the<VAR> verify</VAR> output, you ought to see something
- like:</P>
-<PRE>    ...
-    Looking for TXT in reverse map: 11.2.0.192.in-addr.arpa [OK]
-    ...</PRE>
-<P>which indicates that you've passed the reverse-map test.</P>
-<H3><A NAME="3_6_4">No Configuration Needed</A></H3>
-<P>FreeS/WAN 2.x ships with full OE enabled, so you don't need to
- configure anything. To enable OE out of the box, FreeS/WAN 2.x uses the
- policy group<VAR> private-or-clear</VAR>, which creates IPsec
- connections if possible (using OE if needed), and allows traffic in the
- clear otherwise. You can create more complex OE configurations as
- described in our<A HREF="policygroups.html#policygroups"> policy groups
- document</A>, or disable OE using<A HREF="policygroups.html#disable_policygroups">
- these instructions</A>.</P>
-<P>If you've previously configured for initiator-only opportunism,
- remove<VAR> myid=</VAR> from<VAR> config setup</VAR>, so that peer
- FreeS/WANs will look up your key by IP. Restart FreeS/WAN so that your
- change will take effect, with</P>
-<PRE>    service ipsec restart</PRE>
-<H3><A NAME="3_6_5">Consider Firewalling</A></H3>
-<P>If you are running a default install of RedHat 8.x, take note: you
- will need to alter your iptables rule setup to allow IPSec traffic
- through your firewall. See<A HREF="firewall.html#simple.rules"> our
- firewall document</A> for sample<VAR> iptables</VAR> rules.</P>
-<H3><A NAME="3_6_6">Test</A></H3>
-<P>That's it. Now,<A HREF="#opp.test"> test your connection</A>.</P>
-<H3><A NAME="3_6_7">Test</A></H3>
-<P>Instructions are in the next section.</P>
-<H2><A NAME="opp.test">Testing opportunistic connections</A></H2>
-<P>Be sure IPsec is running. You can see whether it is with:</P>
-<PRE>    ipsec setup status</PRE>
-<P>If need be, you can restart it with:</P>
-<PRE>    service ipsec restart</PRE>
-<P>Load a FreeS/WAN test website from the host on which you're running
- FreeS/WAN. Note: the feds may be watching these sites. Type one of:</P>
-<P></P>
-<PRE>   links oetest.freeswan.org</PRE>
-<PRE>   links oetest.freeswan.nl</PRE>
-
-<!--<PRE>   links oetest.freeswan.ca</PRE>-->
-<P>A positive result looks like this:</P>
-<PRE>
-   You  seem  to  be  connecting  from:  192.0.2.11 which DNS says is:
-   gateway.example.com
-     _________________________________________________________________
-
-   Status E-route
-   OE    enabled    16    192.139.46.73/32    -&gt;    192.0.2.11/32   =&gt;
-   tun0x2097@192.0.2.11
-   OE    enabled    176    192.139.46.77/32    -&gt;   192.0.2.11/32   =&gt;
-   tun0x208a@192.0.2.11
-</PRE>
-<P>If you see this, congratulations! Your OE host or gateway will now
- encrypt its own traffic whenever it can. For more OE tests, please see
- our<A HREF="testing.html#test.oe"> testing document</A>. If you have
- difficulty, see our<A HREF="#oe.trouble"> OE troubleshooting tips</A>.</P>
-<H2><A NAME="3_8">Now what?</A></H2>
-<P>Please see our<A HREF="policygroups.html"> policy groups document</A>
- for more ways to set up Opportunistic Encryption.</P>
-<P>You may also wish to make some<A HREF="config.html"> pre-configured
- connections</A>.</P>
-<H2><A NAME="3_9">Notes</A></H2>
-<UL>
-<LI>We assume some facts about your system in order to make
- Opportunistic Encryption easier to configure. For example, we assume
- that you wish to have FreeS/WAN secure your default interface.</LI>
-<LI>You may change this, and other settings, by altering the<VAR> config
- setup</VAR> section in<VAR> /etc/ipsec.conf</VAR>.</LI>
-<LI>Note that the built-in connections used to build policy groups do
- not inherit from<VAR> conn default</VAR>.</LI>
-
-<!--
-<LI>If you do not define your local identity
-(eg. <VAR>leftid</VAR>), this will be the IP address of your default
-FreeS/WAN interface.  
--->
-<LI> If you fail to define your local identity and do not fill in your
- reverse DNS entry, you will not be able to use OE.</LI>
-</UL>
-<A NAME="oe.trouble"></A>
-<H2><A NAME="3_10">Troubleshooting OE</A></H2>
-<P>See the OE troubleshooting hints in our<A HREF="trouble.html#oe.trouble">
- troubleshooting guide</A>.</P>
-<A NAME="oe.known-issues"></A>
-<H2><A NAME="3_11">Known Issues</A></H2>
-<P>Please see<A HREF="opportunism.known-issues"> this list</A> of known
- issues with Opportunistic Encryption.</P>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="upgrading.html">Previous</A>
-<A HREF="policygroups.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/rfc.html b/doc/rfc.html
deleted file mode 100644
index 29785d8de..000000000
--- a/doc/rfc.html
+++ /dev/null
@@ -1,135 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="biblio.html">Previous</A>
-<A HREF="roadmap.html">Next</A>
-<HR>
-<H1><A name="RFC">IPsec RFCs and related documents</A></H1>
-<H2><A name="RFCfile">The RFCs.tar.gz Distribution File</A></H2>
-<P>The Linux FreeS/WAN distribution is available from<A href="http://www.xs4all.nl/~freeswan">
- our primary distribution site</A> and various mirror sites. To give
- people more control over their downloads, the RFCs that define IP
- security are bundled separately in the file RFCs.tar.gz.</P>
-<P>The file you are reading is included in the main distribution and is
- available on the web site. It describes the RFCs included in the<A href="#RFCs.tar.gz">
- RFCs.tar.gz</A> bundle and gives some pointers to<A href="#sources">
- other ways to get them</A>.</P>
-<H2><A name="sources">Other sources for RFCs &amp; Internet drafts</A></H2>
-<H3><A name="RFCdown">RFCs</A></H3>
-<P>RFCs are downloadble at many places around the net such as:</P>
-<UL>
-<LI><A href="http://www.rfc-editor.org">http://www.rfc-editor.org</A></LI>
-<LI><A href="http://nis.nsf.net/internet/documents/rfc">NSF.net</A></LI>
-<LI><A href="http://sunsite.doc.ic.ac.uk/computing/internet/rfc">Sunsite
- in the UK</A></LI>
-</UL>
-<P>browsable in HTML form at others such as:</P>
-<UL>
-<LI><A href="http://www.landfield.com/rfcs/index.html">landfield.com</A></LI>
-<LI><A href="http://www.library.ucg.ie/Connected/RFC">Connected Internet
- Encyclopedia</A></LI>
-</UL>
-<P>and some of them are available in translation:</P>
-<UL>
-<LI><A href="http://www.eisti.fr/eistiweb/docs/normes/">French</A></LI>
-</UL>
-<P>There is also a published<A href="biblio.html#RFCs"> Big Book of
- IPSEC RFCs</A>.</P>
-<H3><A name="drafts">Internet Drafts</A></H3>
-<P>Internet Drafts, working documents which sometimes evolve into RFCs,
- are also available.</P>
-<UL>
-<LI><A href="http://www.ietf.org/ID.html">Overall reference page</A></LI>
-<LI><A href="http://www.ietf.org/ids.by.wg/ipsec.html">IPsec</A> working
- group</LI>
-<LI><A href="http://www.ietf.org/ids.by.wg/ipsra.html">IPSRA (IPsec
- Remote Access)</A> working group</LI>
-<LI><A href="http://www.ietf.org/ids.by.wg/ipsp.html">IPsec Policy</A>
- working group</LI>
-<LI><A href="http://www.ietf.org/ids.by.wg/kink.html">KINK (Kerberized
- Internet Negotiation of Keys)</A> working group</LI>
-</UL>
-<P>Note: some of these may be obsolete, replaced by later drafts or by
- RFCs.</P>
-<H3><A name="FIPS1">FIPS standards</A></H3>
-<P>Some things used by<A href="glossary.html#IPSEC"> IPsec</A>, such as<A
-href="glossary.html#DES"> DES</A> and<A href="glossary.html#SHA"> SHA</A>
-, are defined by US government standards called<A href="glossary.html#FIPS">
- FIPS</A>. The issuing organisation,<A href="glossary.html#NIST"> NIST</A>
-, have a<A href="http://www.itl.nist.gov/div897/pubs"> FIPS home page</A>
-.</P>
-<H2><A name="RFCs.tar.gz">What's in the RFCs.tar.gz bundle?</A></H2>
-<P>All filenames are of the form rfc*.txt, with the * replaced with the
- RFC number.</P>
-<PRE>RFC#        Title</PRE>
-<H3><A name="rfc.ov">Overview RFCs</A></H3>
-<PRE>2401        Security Architecture for the Internet Protocol
-2411        IP Security Document Roadmap</PRE>
-<H3><A name="basic.prot">Basic protocols</A></H3>
-<PRE>2402        IP Authentication Header
-2406        IP Encapsulating Security Payload (ESP)</PRE>
-<H3><A name="key.ike">Key management</A></H3>
-<PRE>2367        PF_KEY Key Management API, Version 2
-2407        The Internet IP Security Domain of Interpretation for ISAKMP
-2408        Internet Security Association and Key Management Protocol (ISAKMP)
-2409        The Internet Key Exchange (IKE)
-2412        The OAKLEY Key Determination Protocol
-2528        Internet X.509 Public Key Infrastructure</PRE>
-<H3><A name="rfc.detail">Details of various things used</A></H3>
-<PRE>2085        HMAC-MD5 IP Authentication with Replay Prevention
-2104        HMAC: Keyed-Hashing for Message Authentication
-2202        Test Cases for HMAC-MD5 and HMAC-SHA-1
-2207        RSVP Extensions for IPSEC Data Flows
-2403        The Use of HMAC-MD5-96 within ESP and AH
-2404        The Use of HMAC-SHA-1-96 within ESP and AH
-2405        The ESP DES-CBC Cipher Algorithm With Explicit IV
-2410        The NULL Encryption Algorithm and Its Use With IPsec
-2451        The ESP CBC-Mode Cipher Algorithms
-2521        ICMP Security Failures Messages</PRE>
-<H3><A name="rfc.ref">Older RFCs which may be referenced</A></H3>
-<PRE>1321        The MD5 Message-Digest Algorithm
-1828        IP Authentication using Keyed MD5
-1829        The ESP DES-CBC Transform
-1851        The ESP Triple DES Transform
-1852        IP Authentication using Keyed SHA</PRE>
-<H3><A name="rfc.dns">RFCs for secure DNS service, which IPsec may use</A>
-</H3>
-<PRE>2137        Secure Domain Name System Dynamic Update
-2230        Key Exchange Delegation Record for the DNS
-2535        Domain Name System Security Extensions
-2536        DSA KEYs and SIGs in the Domain Name System (DNS)
-2537        RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)
-2538        Storing Certificates in the Domain Name System (DNS)
-2539        Storage of Diffie-Hellman Keys in the Domain Name System (DNS)</PRE>
-<H3><A name="rfc.exp">RFCs labelled &quot;experimental&quot;</A></H3>
-<PRE>2521        ICMP Security Failures Messages
-2522        Photuris: Session-Key Management Protocol
-2523        Photuris: Extended Schemes and Attributes</PRE>
-<H3><A name="rfc.rel">Related RFCs</A></H3>
-<PRE>1750        Randomness Recommendations for Security
-1918        Address Allocation for Private Internets
-1984        IAB and IESG Statement on Cryptographic Technology and the Internet
-2144        The CAST-128 Encryption Algorithm</PRE>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="biblio.html">Previous</A>
-<A HREF="roadmap.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/roadmap.html b/doc/roadmap.html
deleted file mode 100644
index ce547582c..000000000
--- a/doc/roadmap.html
+++ /dev/null
@@ -1,167 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="rfc.html">Previous</A>
-<A HREF="umltesting.html">Next</A>
-<HR>
-<H1><A name="roadmap">Distribution Roadmap: What's Where in Linux
- FreeS/WAN</A></H1>
-<P> This file is a guide to the locations of files within the FreeS/WAN
- distribution. Everything described here should be on your system once
- you download, gunzip, and untar the distribution.</P>
-<P>This distribution contains two major subsystems</P>
-<DL>
-<DT><A href="#klips.roadmap">KLIPS</A></DT>
-<DD>the kernel code</DD>
-<DT><A href="#pluto.roadmap">Pluto</A></DT>
-<DD>the user-level key-management daemon</DD>
-</DL>
-<P>plus assorted odds and ends.</P>
-<H2><A name="top">Top directory</A></H2>
-<P>The top directory has essential information in text files:</P>
-<DL>
-<DT>README</DT>
-<DD>introduction to the software</DD>
-<DT>INSTALL</DT>
-<DD>short experts-only installation procedures. More detalied procedures
- are in<A href="install.html"> installation</A> and<A href="config.html">
- configuration</A> HTML documents.</DD>
-<DT>BUGS</DT>
-<DD>major known bugs in the current release.</DD>
-<DT>CHANGES</DT>
-<DD>changes from previous releases</DD>
-<DT>CREDITS</DT>
-<DD>acknowledgement of contributors</DD>
-<DT>COPYING</DT>
-<DD>licensing and distribution information</DD>
-</DL>
-<H2><A name="doc">Documentation</A></H2>
-<P> The doc directory contains the bulk of the documentation, most of it
- in HTML format. See the<A href="index.html"> index file</A> for
- details.</P>
-<H2><A name="klips.roadmap">KLIPS: kernel IP security</A></H2>
-<P><A href="glossary.html#KLIPS"> KLIPS</A> is<STRONG> K</STRONG>erne<STRONG>
-L</STRONG><STRONG> IP</STRONG><STRONG> S</STRONG>ecurity. It lives in
- the klips directory, of course.</P>
-<DL>
-<DT>klips/doc</DT>
-<DD>documentation</DD>
-<DT>klips/patches</DT>
-<DD>patches for existing kernel files</DD>
-<DT>klips/test</DT>
-<DD>test stuff</DD>
-<DT>klips/utils</DT>
-<DD>low-level user utilities</DD>
-<DT>klips/net/ipsec</DT>
-<DD>actual klips kernel files</DD>
-<DT>klips/src</DT>
-<DD>symbolic link to klips/net/ipsec
-<P>The &quot;make insert&quot; step of installation installs the patches and makes
- a symbolic link from the kernel tree to klips/net/ipsec. The odd name
- of klips/net/ipsec is dictated by some annoying limitations of the
- scripts which build the Linux kernel. The symbolic-link business is a
- bit messy, but all the alternatives are worse.</P>
-<P></P>
-</DD>
-<DT>klips/utils</DT>
-<DD>Utility programs:
-<P></P>
-<DL>
-<DT>eroute</DT>
-<DD>manipulate IPsec extended routing tables</DD>
-<DT>klipsdebug</DT>
-<DD>set Klips (kernel IPsec support) debug features and level</DD>
-<DT>spi</DT>
-<DD>manage IPsec Security Associations</DD>
-<DT>spigrp</DT>
-<DD>group/ungroup IPsec Security Associations</DD>
-<DT>tncfg</DT>
-<DD>associate IPsec virtual interface with real interface</DD>
-</DL>
-<P>These are all normally invoked by ipsec(8) with commands such as</P>
-<PRE>        ipsec tncfg <VAR>arguments</VAR></PRE>
- There are section 8 man pages for all of these; the names have &quot;ipsec_&quot;
- as a prefix, so your man command should be something like:
-<PRE>        man 8 ipsec_tncfg</PRE>
-</DD>
-</DL>
-<H2><A name="pluto.roadmap">Pluto key and connection management daemon</A>
-</H2>
-<P><A href="glossary.html#Pluto"> Pluto</A> is our key management and
- negotiation daemon. It lives in the pluto directory, along with its
- low-level user utility, whack.</P>
-<P> There are no subdirectories. Documentation is a man page,<A href="manpage.d/ipsec_pluto.8.html">
- pluto.8</A>. This covers whack as well.</P>
-<H2><A name="utils">Utils</A></H2>
-<P> The utils directory contains a growing collection of higher-level
- user utilities, the commands that administer and control the software.
- Most of the things that you will actually have to run yourself are in
- there.</P>
-<DL>
-<DT>ipsec</DT>
-<DD>invoke IPsec utilities
-<P>ipsec(8) is normally the only program installed in a standard
- directory, /usr/local/sbin. It is used to invoke the others, both those
- listed below and the ones in klips/utils mentioned above.</P>
-<P></P>
-</DD>
-<DT>auto</DT>
-<DD>control automatically-keyed IPsec connections</DD>
-<DT>manual</DT>
-<DD>take manually-keyed IPsec connections up and down</DD>
-<DT>barf</DT>
-<DD>generate copious debugging output</DD>
-<DT>look</DT>
-<DD>generate moderate amounts of debugging output</DD>
-</DL>
-<P> There are .8 manual pages for these. look is covered in barf.8. The
- man pages have an &quot;ipsec_&quot; prefix so your man command should be
- something like:</P>
-<PRE>
-        man 8 ipsec_auto
-</PRE>
-<P> Examples are in various files with names utils/*.eg</P>
-<H2><A name="lib">Libraries</A></H2>
-<H3><A name="fswanlib">FreeS/WAN Library</A></H3>
-<P> The lib directory is the FreeS/WAN library, also steadily growing,
- used by both user-level and kernel code.
-<BR /> It includes section 3<A href="manpages.html"> man pages</A> for
- the library routines.</P>
-<H3><A name="otherlib">Imported Libraries</A></H3>
-<H4>LibDES</H4>
- The libdes library, originally from SSLeay, is used by both Klips and
- Pluto for<A href="glossary.html#3DES"> Triple DES</A> encryption.
- Single DES is not used because<A href="politics.html#desnotsecure"> it
- is insecure</A>.
-<P> Note that this library has its own license, different from the<A href="glossary.html#GPL">
- GPL</A> used for other code in FreeS/WAN.</P>
-<P> The library includes its own documentation.</P>
-<H4>GMP</H4>
- The GMP (GNU multi-precision) library is used for multi-precision
- arithmetic in Pluto's key-exchange code and public key code.
-<P> Older versions (up to 1.7) of FreeS/WAN included a copy of this
- library in the FreeS/WAN distribution.</P>
-<P> Since 1.8, we have begun to rely on the system copy of GMP.</P>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="rfc.html">Previous</A>
-<A HREF="umltesting.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/src/.cvsignore b/doc/src/.cvsignore
deleted file mode 100644
index 3ed29bc59..000000000
--- a/doc/src/.cvsignore
+++ /dev/null
@@ -1,3 +0,0 @@
-foo.xml
-foobar.html
-makecheck-2.html
diff --git a/doc/src/adv_config.html b/doc/src/adv_config.html
deleted file mode 100644
index ab6901b5e..000000000
--- a/doc/src/adv_config.html
+++ /dev/null
@@ -1,1412 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>Advanced FreeS/WAN configuration</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, configuration">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Maintained by Claudia Schmeing for same.
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: adv_config.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1><a name="adv_config">Other configuration possibilities</a></h1>
-
-<p>This document describes various options for FreeS/WAN configuration which
-are less used or more complex (often both) than the standard cases described
-in our <a href="config.html#config">config</a> and 
-<a href="quickstart.html#quick_guide">quickstart</a> documents.</p>
-
-<h2><a name="thumb">Some rules of thumb about configuration</a></h2>
-
-<h3><a name="cheap.tunnel">Tunnels are cheap</a></h3>
-
-<p>Nearly all of the overhead in IPsec processing is in the encryption and
-authentication of packets. Our <a href="performance.html">performance</a>
-document discusses these overheads.</p>
-
-<p>Beside those overheads, the cost of managing additional tunnels is
-trivial. Whether your gateway supports one tunnel or ten just does not
-matter. A hundred might be a problem; there is a <a
-href="performance.html#biggate">section</a> on this in the performance
-document.</p>
-
-<p>So, in nearly all cases, if using multiple tunnels gives you a reasonable
-way to describe what you need to do, you should describe it that way in your
-configuration files.</p>
-
-<p>For example, one user recently asked on a mailing list about this network
-configuration:</p>
-<pre>        netA---gwA---gwB---netB
-                            |----netC
-
-   netA and B are secured netC not.
-   netA and gwA can not access netC</pre>
-
-<p>The user had constructed only one tunnel, netA to netB, and wanted to know
-how to use ip-route to get netC packets into it. This is entirely
-unnecessary. One of the replies was:</p>
-<pre>  The simplest way and indeed the right way to
-  solve this problem is to set up two connections:
-
-        leftsubnet=NetA
-        left=gwA
-        right=gwB
-        rightsubnet=NetB
-  and
-        leftsubnet=NetA
-        left=gwA
-        right=gwB
-        rightsubnet=NetC</pre>
-
-<p>This would still be correct even if we added nets D, E, F,
-... to the above diagram and needed twenty tunnels.</p>
-
-<p>Of course another possibility would be to just use one tunnel, with a
-subnet mask that includes both netB and netC (or B, C, D, ...). See next
-section.</p>
-
-<p>In general, you can construct as many tunnels as you need. Networks like
-netC in this example that do not connect directly to the gateway are fine, as
-long as the gateway can route to them.</p>
-
-<p>The number of tunnels can become an issue if it reaches 50 or so. This is
-discussed in the <a href="performance.html#biggate">performance</a> document.
-Look there for information on supporting hundreds of Road Warriors from one
-gateway.</p>
-
-<p>If you find yourself with too many tunnels for some reason like having
-eight subnets at one location and nine at another so you end up with
-9*8=72 tunnels, read the next section here.</p>
-
-<h3><a name="subnet.size">Subnet sizes</a></h3>
-
-<p>The subnets used in <var>leftsubnet</var> and <var>rightsubnet</var> can
-be of any size that fits your needs, and they need not correspond to physical
-networks.</p>
-
-<p>You adjust the size by changing the <a href="glossary.html#subnet">subnet
-mask</a>, the number after the slash in the subnet description. For
-example</p>
-<ul>
-  <li>in 192.168.100.0/24 the /24 mask says 24 bits are used to designate the
-    network. This leave 8 bits to label machines. This subnet has 256
-    addresses. .0 and .255 are reserved, so it can have 254 machines.</li>
-  <li>A subnet with a /23 mask would be twice as large, 512 addresses.</li>
-  <li>A subnet with a /25 mask would be half the size, 128 addresses.</li>
-  <li>/0 is the whole Internet</li>
-  <li>/32 is a single machine</li>
-</ul>
-
-<p>As an example of using these in connection descriptions, suppose your
-company's head office has four physical networks using the address ranges:</p>
-<dl>
-  <dt>192.168.100.0/24</dt>
-    <dd>development</dd>
-  <dt>192.168.101.0/24</dt>
-    <dd>production</dd>
-  <dt>192.168.102.0/24</dt>
-    <dd>marketing</dd>
-  <dt>192.168.103.0/24</dt>
-    <dd>administration</dd>
-</dl>
-
-<p>You can use exactly those subnets in your connection descriptions, or use
-larger subnets to grant broad access if required:</p>
-<dl>
-  <dt>leftsubnet=192.168.100.0/24</dt>
-    <dd>remote hosts can access only development</dd>
-  <dt>leftsubnet=192.168.100.0/23</dt>
-    <dd>remote hosts can access development or production</dd>
-  <dt>leftsubnet=192.168.102.0/23</dt>
-    <dd>remote hosts can access marketing or administration</dd>
-  <dt>leftsubnet=192.168.100.0/22</dt>
-    <dd>remote hosts can access any of the four departments</dd>
-</dl>
-
-<p>or use smaller subnets to restrict access:</p>
-<dl>
-  <dt>leftsubnet=192.168.103.0/24</dt>
-    <dd>remote hosts can access any machine in administration</dd>
-  <dt>leftsubnet=192.168.103.64/28</dt>
-    <dd>remote hosts can access only certain machines in administration.</dd>
-  <dt>leftsubnet=192.168.103.42/32</dt>
-    <dd>remote hosts can access only one particular machine in
-    administration</dd>
-</dl>
-
-<p>To be exact, 192.68.103.64/28 means all addresses whose top 28 bits match
-192.168.103.64. There are 16 of these because there are  16 possibilities for
-the remainingg 4 bits. Their addresses are 192.168.103.64 to
-192.168.103.79.</p>
-
-<p>Each connection description can use a different subnet if required.</p>
-
-<p>It is possible to use all the examples above on the same FreeS/WAN
-gateway, each in a different connection description, perhaps for different
-classes of user or for different remote offices.</p>
-
-<p>It is also possible to have multiple tunnels using different
-<var>leftsubnet</var> descriptions with the same <var>right</var>. For
-example, when the marketing manager is on the road he or she might have
-access to:</p>
-<dl>
-  <dt>leftsubnet=192.168.102.0/24</dt>
-    <dd>all machines in marketing</dd>
-  <dt>192.168.101.32/29</dt>
-    <dd>some machines in production</dd>
-  <dt>leftsubnet=192.168.103.42/32</dt>
-    <dd>one particular machine in administration</dd>
-</dl>
-
-<p>This takes three tunnels, but tunnels are cheap. If the laptop is set up
-to build all three tunnels automatically, then he or she can access all these
-machines concurrently, perhaps from different windows.</p>
-
-<h3><a name="example.more">Other network layouts</a></h3>
-
-<p>Here is the usual network picture for a site-to-site VPN::</p>
-<pre>     Sunset==========West------------------East=========Sunrise
-           local net       untrusted net       local net</pre>
-
-<p>and for the Road Warrior::</p>
-<pre>                                           telecommuter's PC or
-                                           traveller's laptop
-     Sunset==========West------------------East
-         corporate LAN     untrusted net</pre>
-
-<p>Other configurations are also possible.</p>
-
-<h4><a name="internet.subnet">The Internet as a big subnet</a></h4>
-
-<p>A telecommuter might have:</p>
-<pre>     Sunset==========West------------------East ================= firewall --- the Internet
-         home network      untrusted net        corporate network</pre>
-
-<p>This can be described as a special case of the general subnet-to-subnet
-connection. The subnet on the right is 0.0.0.0/0, the whole Internet.</p>
-
-<p>West (the home gateway) can have its firewall rules set up so that only
-IPsec packets to East are allowed out. It will then behave as if its only
-connection to the world was a wire to East.</p>
-
-<p>When machines on the home network need to reach the Internet, they do so
-via the tunnel, East and the corporate firewall. From the viewpoint of the
-Internet (perhaps of some EvilDoer trying to break in!), those home office
-machines are behind the firewall and protected by it.</p>
-
-<h4><a name="wireless.config">Wireless</a></h4>
-
-<p>Another possible configuration comes up when you do not trust the local
-network, either because you have very high security standards or because your
-are using easily-intercepted wireless signals.</p>
-
-<p>Some wireless networks have built-in encryption called <a
-href="glossary.html#WEP">WEP</a>, but its security is dubious. It is a fairly
-common practice to use IPsec instead.</p>
-
-<p>In this case, part of your network may look like this:</p>
-<pre>          West-----------------------------East == the rest of your network
-     workstation   untrusted wireless net</pre>
-
-<p>Of course, there would likely be several wireless workstations, each with
-its own IPsec tunnel to the East gateway.</p>
-
-<p>The connection descriptions look much like Road Warrior descriptions:</p>
-<ul>
-  <li>each workstation should have its own unique
-    <ul>
-      <li>identifier for IPsec</li>
-      <li>RSA key</li>
-      <li>connection description.</li>
-    </ul>
-  </li>
-  <li>on the gateway, use <var>left=%any</var>, or the workstation IP
-  address</li>
-  <li>on workstations, <var>left=%defaultroute</var>, or the workstation IP
-    address</li>
-  <li><var>leftsubnet=</var> is not used.</li>
-</ul>
-
-<p>The <var>rightsubnet=</var> parameter might be set in any of several
-ways:</p>
-<dl>
-  <dt>rightsubnet=0.0.0.0/0</dt>
-    <dd>allowing workstations to access the entire Internet (see <a
-      href="#internet.subnet">above</a>)</dd>
-  <dt>rightsubnet=a.b.c.0/24</dt>
-    <dd>allowing access to your entire local network</dd>
-  <dt>rightsubnet=a.b.c.d/32</dt>
-    <dd>restricting the workstation to connecting to a particular server</dd>
-</dl>
-
-<p>Of course you can mix and match these as required. For example, a
-university might allow faculty full Internet access while letting student
-laptops connect only to a group of lab machines.</p>
-
-<h2><a name="choose">Choosing connection types</a></h2>
-
-<p>One choice you need to make before configuring additional connections is
-what type or types of connections you will use. There are several options,
-and you can use more than one concurrently.</p>
-
-<h3><a name="man-auto">Manual vs. automatic keying</a></h3>
-
-<p>IPsec allows two types of connections, with manual or automatic keying.
-FreeS/WAN starts them with commands such as:</p>
-<pre>        ipsec manual --up <var>name</var>
-        ipsec auto --up <var>name</var></pre>
-
-<p>The difference is in how they are keyed.</p>
-<dl>
-  <dt><a href="glossary.html#manual">Manually keyed</a> connections</dt>
-    <dd>use keys stored in <a
-      href="manpage.d/ipsec.conf.5.html">ipsec.conf</a>.</dd>
-  <dt><a href="glossary.html#auto">Automatically keyed</a> connections</dt>
-    <dd>use keys automatically generated by the Pluto key negotiation daemon.
-      The key negotiation protocol, <a href="glossary.html#IKE">IKE</a>, must
-      authenticate the other system. (It is vulnerable to a <a
-      href="glossary.html#middle">man-in-the-middle attack</a> if used
-      without authentication.) We currently support two authentication
-      methods:
-      <ul>
-        <li>using shared secrets stored in <a
-          href="manpage.d/ipsec.secrets.5.html">ipsec.secrets</a>.</li>
-        <li>RSA <a href="glossary.html#public">public key</a> authentication,
-          with our machine's private key in <a
-          href="manpage.d/ipsec.secrets.5.html">ipsec.secrets</a>. Public
-          keys for other machines may either be placed in <a
-          href="manpage.d/ipsec.conf.5.html">ipsec.conf</a> or provided via
-          DNS.</li>
-      </ul>
-        <p>A third method, using RSA keys embedded in <a
-        href="glossary.html#X509">X.509</a> certtificates, is provided by
-        user <a href="web.html#patch">patches</a>.</p>
-    </dd>
-</dl>
-
-<p><a href="glossary.html#manual">Manually keyed</a> connections provide
-weaker security than <a href="glossary.html#auto">automatically keyed</a>
-connections. An opponent who reads ipsec.secrets(5) gets your encryption key
-and can read all data encrypted by it. If he or she has an archive of old
-messages, all of them back to your last key change are also readable.</p>
-
-<p>With automatically-(re)-keyed connections, an opponent who reads
-ipsec.secrets(5) gets the key used to authenticate your system in IKE -- the
-shared secret or your private key, depending what authentication mechanism is
-in use. However, he or she does not automatically gain access to any
-encryption keys or any data.</p>
-
-<p>An attacker who has your authentication key can mount  a <a
-href="glossary.html#middle">man-in-the-middle attack</a> and, if that
-succeeds, he or she will get encryption keys and data. This is a serious
-danger, but it is better than having the attacker read everyting as soon as
-he or she breaks into ipsec.secrets(5).. Moreover, the keys change often so
-an opponent who gets one key does not get a large amount of data. To read all
-your data, he or she would have to do a man-in-the-middle attack at every key
-change.</p>
-
-<p>We discuss using <a href="#prodman">manual keying in production</a> below,
-but this is <strong>not recommended</strong> except in special circumstances,
-such as needing to communicate with some implementation that offers no
-auto-keyed mode compatible with FreeS/WAN.</p>
-
-<p>Manual keying may also be useful for testing. There is some discussion of
-this in our <a href="faq.html#man4debug">FAQ</a>.</p>
-
-<h3><a name="auto-auth">Authentication methods for auto-keying</a></h3>
-
-<p>The IKE protocol which Pluto uses to negotiate connections between
-gateways must use some form of authentication of peers. A gateway must know
-who it is talking to before it can create a secure connection. We support two
-basic methods for this authentication:</p>
-<ul>
-  <li>shared secrets, stored in <a
-    href="manpage.d/ipsec.secrets.5.html">ipsec.secrets(5)</a></li>
-  <li>RSA authentication</li>
-</ul>
-
-<p>There are, howver, several variations on the RSA theme, using different
-methods of managing the RSA keys:</p>
-<ul>
-  <li>our RSA private key in  <a
-    href="manpage.d/ipsec.secrets.5.html">ipsec.secrets(5)</a> with other
-    gateways' public keys
-    <dl>
-      <dt>either</dt>
-        <dd>stored in <a
-        href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a></dd>
-      <dt>or</dt>
-        <dd>looked up via <a href="glossary.html#DNS">DNS</a></dd>
-    </dl>
-  </li>
-  <li>authentication with <a href="glossary.html#x509">x.509</a>
-    certificates.; See our <a href="web.html#patch">links section</a> for
-    information on user-contributed patches for this.:</li>
-</ul>
-
-<p>Public keys in <a href="manpage.d/ipsec.conf.5.html">ipsec.conf(5</a>)
-give a reasonably straightforward method of specifying keys for explicitly
-configured connections.</p>
-
-<p>Putting public keys in DNS allows us to support <a
-href="glossary.html#carpediem">opportunistic encryption</a>. Any two
-FreeS/WAN gateways can provide secure communication, without either of them
-having any preset information about the other.</p>
-
-<p>X.509 certificates may be required to interface to various <a
-href="glossary.html#PKI">PKI</a>s.</p>
-
-<h3><a name="adv-pk">Advantages of public key methods</a></h3>
-
-<p>Authentication with a <a href="glossary.html#public">public key</a> method
-such as <a href="glossary.html#RSA">RSA</a> has some important advantages
-over using shared secrets.</p>
-<ul>
-  <li>no problem of secure transmission of secrets
-    <ul>
-      <li>A shared secret must be shared, so you have the problem of
-        transmitting it securely to the other party. If you get this wrong,
-        you have no security.</li>
-      <li>With a public key technique, you transmit only your public key. The
-        system is designed to ensure that it does not matter if an enemy
-        obtains public keys. The private key never leaves your machine.</li>
-    </ul>
-  </li>
-  <li>easier management
-    <ul>
-      <li>Suppose you have 20 branch offices all connecting to one gateway at
-        head office, and all using shared secrets. Then the head office admin
-        has 20 secrets to manage. Each of them must be kept secret not only
-        from outsiders, but also from 19 of the branch office admins. The
-        branch office admins have only one secret each to manage.
-        <p>If the branch offices need to talk to each other, this becomes
-        problematic. You need another 20*19/2 = 190 secrets for
-        branch-to-branch communication, each known to exactly two branches.
-        Now all the branch admins have the headache of handling 20 keys, each
-        shared with exactly one other branch or with head office.</p>
-        <p>For larger numbers of branches, the number of connections and
-        secrets increases quadratically  and managing them becomes a
-        nightmare. A 1000-gateway fully connected network needs 499,500
-        secrets, each known to exactly two players. There are ways to reduce
-        this problem, for example by introducing a central key server, but
-        these involve additional communication overheads, more administrative
-        work, and new threats that must be carefully guarded against.</p>
-      </li>
-      <li>With public key techniques, the <em>only</em> thing you have to
-        keep secret is your private key, and <em>you keep that secret from
-        everyone</em>.
-        <p>As network size increaes, the number of public keys used increases
-        linearly with the number of nodes. This still requires careful
-        administration in large applications, but is nothing like the
-        disaster of a quadratic increase. On a 1000-gateway network, you have
-        1000 private keys, each of which must be kept secure on one machine,
-        and 1000 public keys which must be distributed. This is not a trivial
-        problem, but it is manageable.</p>
-      </li>
-    </ul>
-  </li>
-  <li>does not require fixed IP addresses
-    <ul>
-      <li>When shared secrets are used in IPsec, the responder must be able
-        to tell which secret to use by looking at the IP address on the
-        incoming packets.  When the other parties do not have a fixed IP
-        address to be identified by (for example, on nearly all dialup ISP
-        connections and many cable or ADSL links), this does not work well --
-        all must share the same secret!</li>
-      <li>When RSA authentication is in use, the initiator can identify
-        itself by name before the key must be determined.  The responder then
-        checks that the message is signed with the public key corresponding
-        to that name.</li>
-    </ul>
-  </li>
-</ul>
-
-<p>There is also a disadvantage:</p>
-<ul>
-  <li>your private key is a single point of attack, extremely valuable to an
-    enemy
-    <ul>
-      <li>with shared secrets, an attacker who steals your ipsec.secrets file
-        can impersonate you or try <a
-        href="glossary.html#middle">man-in-the-middle</a> attacks, but can
-        only attack connections described in that file</li>
-      <li>an attacker who steals your private key gains the chance to attack
-        not only existing connections <em>but also any future
-        connections</em> created using that key</li>
-    </ul>
-  </li>
-</ul>
-
-<p>This is partly counterbalanced by the fact that the key is never
-transmitted and remains under your control at all times. It is likely
-necessary, however, to take account of this in setting security policy. For
-example, you should change gateway keys when an administrator leaves the
-company, and should change them periodically in any case.</p>
-
-<p>Overall, public key methods are <strong>more secure, more easily managed
-and more flexible</strong>. We recommend that they be used for all
-connections, unless there is a compelling reason to do otherwise.</p>
-
-<h2><a name="prodsecrets">Using shared secrets in production</a></h2>
-
-<p>Generally, public key methods are preferred for reasons given above, but
-shared secrets can be used with no loss of security, just more work and
-perhaps more need to take precautions.</p>
-
-<p>What I call "shared secrets" are sometimes also called "pre-shared keys".
-They are used only for for authentication, never for encryption. Calling them
-"pre-shared keys" has confused some users into thinking they were encryption
-keys, so I prefer to avoid the term..</p>
-
-<p>If you are interoperating with another IPsec implementation, you may find
-its documentation calling them "passphrases".</p>
-
-<h3><a name="secrets">Putting secrets in ipsec.secrets(5)</a></h3>
-
-<p>If shared secrets are to be used to <a
-href="glossary.html#authentication">authenticate</a> communication for the <a
-href="glossary.html#DH">Diffie-Hellman</a> key exchange in the <a
-href="glossary.html#IKE">IKE</a> protocol, then those secrets must be stored
-in <var>/etc/ipsec.secrets</var>. For details, see the <a
-href="manpage.d/ipsec.secrets.5.html">ipsec.secrets(5)</a> man page.</p>
-
-<p>A few considerations are vital:</p>
-<ul>
-  <li>make the secrets long and unguessable. Since they need not be
-    remembered by humans, very long ugly strings may be used. We suggest
-    using our <a href="manpage.d/ipsec_ranbits.8.html">ipsec_ranbits(8)</a>
-    utility to generate long (128 bits or more) random strings.</li>
-  <li>transmit secrets securely. You have to share them with other systems,
-    but you lose if they are intercepted and used against you. Use <a
-    href="glossary.html#PGP">PGP</a>, <a href="glossary.html#SSH">SSH</a>,
-    hand delivery of a floppy disk which is then destroyed, or some other
-    trustworthy method to deliver them.</li>
-  <li>store secrets securely, in root-owned files with permissions
-  rw------.</li>
-  <li>limit sharing of secrets. Alice, Bob, Carol and Dave may all talk to
-    each other, but only Alice and Bob should know the secret for an
-    Alice-Bob link.</li>
-  <li><strong>do not share private keys</strong>. The private key for RSA
-    authentication of your system is stored in <a
-    href="manpage.d/ipsec.secrets.5.html">ipsec.secrets(5)</a>, but it is a
-    different class of secret from the pre-shared keys used for the "shared
-    secret" authentication. No-one but you should have the RSA private
-  key.</li>
-</ul>
-
-<p>Each line has the IP addresses of the two gateways plus the secret. It
-should look something like this:</p>
-<pre>        10.0.0.1 11.0.0.1 : PSK "jxTR1lnmSjuj33n4W51uW3kTR55luUmSmnlRUuWnkjRj3UuTV4T3USSu23Uk55nWu5TkTUnjT"</pre>
-
-<p><var>PSK</var> indicates the use of a
-<strong>p</strong>re-<strong>s</strong>hared <strong>k</strong>ey. The quotes
-and the whitespace shown are required.</p>
-
-<p>You can use any character string as your secret. For security, it should
-be both long and extremely hard to guess. We provide a utility to generate
-such strings, <a
-href="manpage.d/ipsec_ranbits.8.html">ipsec_ranbits(8)</a>.</p>
-
-<p>You want the same secret on the two gateways used, so you create a line
-with that secret and the two gateway IP addresses. The installation process
-supplies an example secret, useful <em>only</em> for testing. You must change
-it for production use.</p>
-
-<h3><a name="securing.secrets">File security</a></h3>
-
-<p>You must deliver this file, or the relevant part of it, to the other
-gateway machine by some <strong>secure</strong> means. <em>Don't just FTP or
-mail the file!</em> It is vital that the secrets in it remain secret. An
-attacker who knew those could easily have <em>all the data on your "secure"
-connection</em>.</p>
-
-<p>This file must be owned by root and should have permissions
-<var>rw-------</var>.</p>
-
-<h3><a name="notroadshared">Shared secrets for road warriors</a></h3>
-
-<p>You can use a shared secret to support a single road warrior connecting to
-your gateway, and this is a reasonable thing to do in some circumstances.
-Public key methods have advantages, discussed <a href="#choose">above</a>,
-but they are not critical in this case.</p>
-
-<p>To do this, the line in ipsec.secrets(5) is something like:</p>
-<pre>        10.0.0.1 0.0.0.0 : PSK "jxTR1lnmSjuj33n4W51uW3kTR55luUmSmnlRUuWnkjRj3UuTV4T3USSu23Uk55nWu5TkTUnjT"</pre>
-where the <var>0.0.0.0</var> means that any IP address is acceptable.
-
-<p><strong>For more than one road warrior, shared secrets are <em>not</em> 
-recommended.</strong> If shared secrets are used, then when the responder
-needs to look up the secret, all it knows about the sender is an IP address.
-This is fine if the sender is at a fixed IP address specified in the config
-file. It is also fine if only one road warrior uses the wildcard
-<var>0.0.0.0</var> address. However, if you have more than one road warrior
-using shared secret authentication, then they must all use that wildcard and
-therefore <strong>all road warriors using PSK autentication must use the same
-secret</strong>. Obviously, this is insecure.</p>
-
-<p><strong>For multiple road warriors, use public key
-authentication.</strong> Each roadwarrior can then have its own identity (our
-<var>leftid=</var> or <var>rightid=</var> parameters), its own public/private
-key pair, and its own secure connection.</p>
-
-<h2><a name="prodman">Using manual keying in production</a></h2>
-
-<p>Generally, <a href="glossary.html#auto">automatic keying</a> is preferred
-over <a href="glossary.html#manual">manual keying</a> for production use
-because it is both easier to manage and more secure. Automatic keying frees
-the admin from much of the burden of managing keys securely, and can provide
-<a href="glossary.html#PFS">perfect forward secrecy</a>. This is discussed in
-more detail <a href="#man-auto">above</a>.</p>
-
-<p>However, it is possible to use manual keying in production if that is what
-you want to do. This might be necessary, for example, in order to
-interoperate with some device that either does not provide automatic keying
-or provides it in some version we cannot talk to.</p>
-
-<p>Note that with manual keying <strong>all security rests with the
-keys</strong>. If an adversary acquires your keys, you've had it. He or she
-can read everything ever sent with those keys, including old messages he or
-she may have archived.</p>
-
-<p>You need to <strong>be really paranoid about keys</strong> if you're going
-to rely on manual keying for anything important.</p>
-<ul>
-  <li>keep keys in files with 600 permissions, owned by root</li>
-  <li>be extremely careful about security of your gateway systems. Anyone who
-    breaks into a gateway and gains root privileges can get all your keys and
-    read everything ever encrypted with those keys, both old messages he has
-    archived and any new ones you may send.</li>
-  <li>change keys regularly. This can be a considerable bother, (and provides
-    an excellent reason to consider automatic keying instead), but it is
-    <em>absolutely essential</em> for security. Consider a manually keyed
-    system in which you leave the same key in place for months:
-    <ul>
-      <li>an attacker can have a very large sample of text sent with that key
-        to work with. This makes various cryptographic attacks much more
-        likely to succeed.</li>
-      <li>The chances of the key being compromised in some non-cryptographic
-        manner -- a spy finds it on a discarded notepad, someone breaks into
-        your server or your building and steals it, a staff member is bribed,
-        tricked, seduced or coerced into revealing it, etc. -- also increase
-        over time.</li>
-      <li>a successful attacker can read everything ever sent with that key.
-        This makes any successful attack extremely damaging.</li>
-    </ul>
-    It is clear that you must change keys often to have any useful security.
-    The only question is how often.</li>
-  <li>use <a href="glossary.html#PGP">PGP</a> or <a
-    href="glossary.html#SSH">SSH</a> for all key transfers</li>
-  <li>don't edit files with keys in them when someone can look over your
-    shoulder</li>
-  <li>worry about network security; could someone get keys by snooping
-    packets on the LAN between your X desktop and the gateway?</li>
-  <li>lock up your backup tapes for the gateway system</li>
-  <li>... and so on</li>
-</ul>
-
-<p>Linux FreeS/WAN provides some facilities to help with this. In particular,
-it is good policy to <strong>keep keys in separate files</strong> so you can
-edit configuration information in /etc/ipsec.conf without exposing keys to
-"shoulder surfers" or network snoops. We support this with the
-<var>also=</var> and <var>include</var> syntax in <a
-href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a>.</p>
-
-<p>See the last example in our <a href="examples">examples</a> file. In the
-/etc/ipsec.conf <var>conn samplesep</var> section, it has the line:</p>
-<pre>        also=samplesep-keys</pre>
-
-<p>which tells the "ipsec manual" script to insert the configuration
-description labelled "samplesep-keys" if it can find it. The /etc/ipsec.conf
-file must also have a line such as:</p>
-<pre>include ipsec.*.conf</pre>
-
-<p>which tells it to read other files. One of those other files then might
-contain the additional data:</p>
-<pre>conn samplesep-keys
-  spi=0x200
-  esp=3des-md5-96
-  espenckey=0x01234567_89abcdef_02468ace_13579bdf_12345678_9abcdef0
-  espauthkey=0x12345678_9abcdef0_2468ace0_13579bdf</pre>
-
-<p>The first line matches the label in the "also=" line, so the indented
-lines are inserted. The net effect is exactly as if the inserted lines had
-occurred in the original file in place of the "also=" line.</p>
-
-<p>Variables set here are:</p>
-<dl>
-  <dt>spi</dt>
-    <dd>A number needed by the manual keying code. Any 3-digit hex number
-      will do, but if you have more than one manual connection then
-      <strong>spi must be different</strong> for each connection.</dd>
-  <dt>esp</dt>
-    <dd>Options for <a href="glossary.html#ESP">ESP</a> (Encapsulated
-      Security Payload), the usual IPsec encryption mode. Settings here are
-      for <a href="glossary.html#encryption">encryption</a> using <a
-      href="glossary.html#3DES">triple DES</a> and <a
-      href="glossary.html#authentication">authentication</a> using <a
-      href="glossary.html#MD5">MD5</a>. Note that encryption without
-      authentication should not be used; it is insecure.</dd>
-  <dt>espenkey</dt>
-    <dd>Key for ESP encryption. Here, a 192-bit hex number for triple
-    DES.</dd>
-  <dt>espauthkey</dt>
-    <dd>Key for ESP authentication. Here, a 128-bit hex number for MD5.</dd>
-</dl>
-
-<p><strong>Note</strong> that the <strong>example keys we supply</strong> are
-intended <strong>only for testing</strong>. For real use, you should go to
-automatic keying. If that is not possible, create your own keys for manual
-mode and keep them secret</p>
-
-<p>Of course, any files containing keys <strong>must</strong> have 600
-permissions and be owned by root.</p>
-
-<p>If you connect in this way to multiple sites, we recommend that you keep
-keys for each site in a separate file and adopt some naming convention that
-lets you pick them all up with a single "include" line. This minimizes the
-risk of losing several keys to one error or attack and of accidentally giving
-another site admin keys which he or she has no business knowing.</p>
-
-<p>Also note that if you have multiple manually keyed connections on a single
-machine, then the <var>spi</var> parameter must be different for each one.
-Any 3-digit hex number is OK, provided they are different for each
-connection. We reserve the range 0x100 to 0xfff for manual connections. Pluto
-assigns SPIs from 0x1000 up for automatically keyed connections.</p>
-
-<p>If <a href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> contains keys
-for manual mode connections, then it too must have permissions
-<var>rw-------</var>. We recommend instead that, if you must manual keying in
-production, you keep the keys in separate files.</p>
-
-<p>Note also that <a href="manpage.d/ipsec.conf.5.html">ipsec.conf</a> is
-installed with permissions <var>rw-r--r--</var>. If you plan to use manually
-keyed connections for anything more than initial testing, you <b>must</b>:</p>
-<ul>
-  <li>either change permissions to <var>rw-------</var></li>
-  <li>or store keys separately in secure files and access them via include
-    statements in <a href="manpage.d/ipsec.conf.5.html">ipsec.conf</a>.</li>
-</ul>
-
-<p>We recommend the latter method for all but the simplest configurations.</p>
-
-<h3><a name="ranbits">Creating keys with ranbits</a></h3>
-
-<p>You can create new <a href="glossary.html#random">random</a> keys with the
-<a href="manpage.d/ipsec_ranbits.8.html">ranbits(8)</a> utility. For example,
-the commands:</p>
-<pre>      umask 177
-      ipsec ranbits 192  &gt; temp
-      ipsec ranbits 128 &gt;&gt; temp</pre>
-
-<p>create keys in the sizes needed for our default algorithms:</p>
-<ul>
-  <li>192-bit key for <a href="glossary.html#3DES">3DES</a> encryption <br>
-    (only 168 bits are used; parity bits are ignored)</li>
-  <li>128-bit key for keyed <a href="glossary.html#MD5">MD5</a>
-  authentication</li>
-</ul>
-
-<p>If you want to use <a href="glossary.html#SHA">SHA</a> instead of <a
-href="glossary.html#MD5">MD5</a>, that requires a 160-bit key</p>
-
-<p>Note that any <strong>temporary files</strong> used must be kept
-<strong>secure</strong> since they contain keys. That is the reason for the
-umask command above. The temporary file should be deleted as soon as you are
-done with it. You may also want to change the umask back to its default value
-after you are finished working on keys.</p>
-
-<p>The ranbits utility may pause for a few seconds if not enough entropy is
-available immediately. See ipsec_ranbits(8) and random(4) for details. You
-may wish to provide some activity to feed entropy into the system. For
-example, you might move the mouse around, type random characters, or do
-<var>du /usr &gt; /dev/null</var> in the background.</p>
-
-<h2><a name="boot">Setting up connections at boot time</a></h2>
-
-<p>You can tell the system to set up connections automatically at boot time
-by putting suitable stuff in /etc/ipsec.conf on both systems. The relevant
-section of the file is labelled by a line reading <var>config setup</var>.</p>
-
-<p>Details can be found in the <a
-href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> man page. We also
-provide a file of <a href="examples">example configurations</a>.</p>
-
-<p>The most likely options are something like:</p>
-<dl>
-  <dt>interfaces="ipsec0=eth0 ipsec1=ppp0"</dt>
-    <dd>Tells KLIPS which interfaces to use. Up to four interfaces numbered
-      ipsec[0-3] are supported. Each interface can support an arbitrary
-      number of tunnels.
-      <p>Note that for PPP, you give the ppp[0-9] device name here, not the
-      underlying device such as modem (or eth1 if you are using PPPoE).</p>
-    </dd>
-  <dt>interfaces=%defaultroute</dt>
-    <dd>Alternative setting, useful in simple cases. KLIPS will pick up both
-      its interface and the next hop information from the settings of the
-      Linux default route.</dd>
-  <dt>forwardcontrol=no</dt>
-    <dd>Normally "no". Set to "yes" if the IP forwarding option is disabled
-      in your network configuration. (This can be set as a kernel
-      configuration option or later. e.g. on Redhat, it's in
-      /etc/sysconfig/network and on SuSE you can adjust it with Yast.) Linux
-      FreeS/WAN will then enable forwarding when starting up and turn it off
-      when going down. This is used to ensure that no packets will be
-      forwarded before IPsec comes up and takes control.</dd>
-  <dt>syslog=daemon.error</dt>
-    <dd>Used in messages to the system logging daemon (syslogd) to specify
-      what type of software is sending the messages. If the settings are
-      "daemon.error" as in our example, then syslogd treats the messages as
-      error messages from a daemon.
-      <p>Note that <a href="glossary.html#Pluto">Pluto</a> does not currently
-      pay attention to this variable. The variable controls setup messages
-      only.</p>
-    </dd>
-  <dt>klipsdebug=</dt>
-    <dd>Debug settings for <a href="glossary.html#KLIPS">KLIPS</a>.</dd>
-  <dt>plutodebug=</dt>
-    <dd>Debug settings for <a href="glossary.html#Pluto">Pluto</a>.</dd>
-  <dt>... for both the above DEBUG settings</dt>
-    <dd>Normally, leave empty as shown above for no debugging output.<br>
-      Use "all" for maximum information.<br>
-      See ipsec_klipsdebug(8) and ipsec_pluto(8) man page for other options.
-      Beware that if you set /etc/ipsec.conf to enable debug output, your
-      system's log files may get large quickly.</dd>
-  <dt>dumpdir=/safe/directory</dt>
-    <dd>Normally, programs started by ipsec setup don't crash. If they do, by
-      default, no core dump will be produced because such dumps would contain
-      secrets. If you find you need to debug such crashes, you can set
-      dumpdir to the name of a directory in which to collect the core
-    file.</dd>
-  <dt>manualstart=</dt>
-    <dd>List of manually keyed connections to be automatically started at
-      boot time. Useful for testing, but not for long term use. Connections
-      which are automatically started should also be automatically
-    re-keyed.</dd>
-  <dt>pluto=yes</dt>
-    <dd>Whether to start <a href="glossary.html#Pluto">Pluto</a> when ipsec
-      startup is done.<br>
-      This parameter is optional and defaults to "yes" if not present.
-      <p>"yes" is strongly recommended for production use so that the keying
-      daemon (Pluto) will automatically re-key the connections regularly. The
-      ipsec-auto parameters ikelifetime, ipseclifetime and reykeywindow give
-      you control over frequency of rekeying.</p>
-    </dd>
-  <dt>plutoload="reno-van reno-adam reno-nyc"</dt>
-    <dd>List of tunnels (by name, e.g. fred-susan or reno-van in our
-      examples) to be loaded into Pluto's internal database at startup. In
-      this example, Pluto loads three tunnels into its database when it is
-      started.
-      <p>If plutoload is "%search", Pluto will load any connections whose
-      description includes "auto=add" or "auto=start".</p>
-    </dd>
-  <dt>plutostart="reno-van reno-adam reno-nyc"</dt>
-    <dd>List of tunnels to attempt to negotiate when Pluto is started.
-      <p>If plutostart is "%search", Pluto will start any connections whose
-      description includes "auto=start".</p>
-      <p>Note that, for a connection intended to be permanent, <strong>both
-      gateways should be set try to start</strong> the tunnel. This allows
-      quick recovery if either gateway is rebooted or has its IPsec
-      restarted. If only one gateway is set to start the tunnel and the other
-      gateway restarts, the tunnel may not be rebuilt.</p>
-    </dd>
-  <dt>plutowait=no</dt>
-    <dd>Controls whether Pluto waits for one tunnel to be established before
-      starting to negotiate the next. You might set this to "yes"
-      <ul>
-        <li>if your gateway is a very limited machine and you need to
-          conserve resources.</li>
-        <li>for debugging; the logs are clearer if only one connection is
-          brought up at a time</li>
-      </ul>
-      For a busy and resource-laden production gateway, you likely want "no"
-      so that connections are brought up in parallel and the whole process
-      takes less time.</dd>
-</dl>
-
-<p>The example assumes you are at the Reno office and will use IPsec to
-Vancouver, New York City and Amsterdam.</p>
-
-<h2><a name="multitunnel">Multiple tunnels between the same two
-gateways</a></h2>
-
-<p>Consider a pair of subnets, each with a security gateway, connected via
-the Internet:</p>
-<pre>         192.168.100.0/24           left subnet
-              |
-         192.168.100.1
-         North Gateway
-         101.101.101.101            left
-              |
-         101.101.101.1              left next hop
-         [Internet]
-         202.202.202.1              right next hop
-              |
-         202.202.202.202            right
-         South gateway
-         192.168.200.1
-              |
-         192.168.200.0/24           right subnet</pre>
-
-<p>A tunnel specification such as:</p>
-<pre>conn northnet-southnet
-      left=101.101.101.101
-      leftnexthop=101.101.101.1
-      leftsubnet=192.168.100.0/24
-      leftfirewall=yes
-      right=202.202.202.202
-      rightnexthop=202.202.202.1
-      rightsubnet=192.168.200.0/24
-      rightfirewall=yes</pre>
-will allow machines on the two subnets to talk to each other. You might test
-this by pinging from polarbear (192.168.100.7) to penguin (192.168.200.5).
-
-<p>However, <strong>this does not cover other traffic you might want to
-secure</strong>. To handle all the possibilities, you might also want these
-connection descriptions:</p>
-<pre>conn northgate-southnet
-      left=101.101.101.101
-      leftnexthop=101.101.101.1
-      right=202.202.202.202
-      rightnexthop=202.202.202.1
-      rightsubnet=192.168.200.0/24
-      rightfirewall=yes
-
-conn northnet-southgate
-      left=101.101.101.101
-      leftnexthop=101.101.101.1
-      leftsubnet=192.168.100.0/24
-      leftfirewall=yes
-      right=202.202.202.202
-      rightnexthop=202.202.202.1</pre>
-
-<p>Without these, neither gateway can do IPsec to the remote subnet. There is
-no IPsec tunnel or eroute set up for the traffic.</p>
-
-<p>In our example, with the non-routable 192.168.* addresses used, packets
-would simply be discarded. In a different configuration, with routable
-addresses for the remote subnet, <strong>they would be sent
-unencrypted</strong> since there would be no IPsec eroute and there would be
-a normal IP route.</p>
-
-<p>You might also want:</p>
-<pre>conn northgate-southgate
-      left=101.101.101.101
-      leftnexthop=101.101.101.1
-      right=202.202.202.202
-      rightnexthop=202.202.202.1</pre>
-
-<p>This is required if you want the two gateways to speak IPsec to each
-other.</p>
-
-<p>This requires a lot of duplication of details.  Judicious use of
-<var>also=</var> and <var>include</var> can reduce this problem.</p>
-
-<p>Note that, while FreeS/WAN supports all four tunnel types, not all
-implementations do. In particular, some versions of Windows 2000 and the
-freely downloadable version of PGP provide only "client" functionality. You
-cannot use them as gateways with a subnet behind them. To get that
-functionality, you must upgrade to Windows 2000 server or the commercially
-available PGP products.</p>
-
-<h3><a name="advroute">One tunnel plus advanced routing</a></h3>
-It is also possible to use the new routing features in 2.2 and later kernels
-to avoid most needs for multple tunnels. Here is one mailing list message on
-the topic:
-<pre>Subject: Re: linux-ipsec: IPSec packets not entering tunnel?
-   Date: Mon, 20 Nov 2000
-   From: Justin Guyett &lt;jfg@sonicity.com&gt;
-
-On Mon, 20 Nov 2000, Claudia Schmeing wrote:
-
-&gt; Right                                                         Left
-&gt;                      "home"                "office"
-&gt; 10.92.10.0/24 ---- 24.93.85.110 ========= 216.175.164.91 ---- 10.91.10.24/24
-&gt;
-&gt; I've created all four tunnels, and can ping to test each of them,
-&gt; *except* homegate-officenet.
-
-I keep wondering why people create all four tunnels.  Why not route
-traffic generated from home to 10.91.10.24/24 out ipsec0 with iproute2?
-And 99% of the time you don't need to access "office" directly, which
-means you can eliminate all but the subnet&lt;-&gt;subnet connection.</pre>
-and FreeS/WAN technical lead Henry Spencer's comment:
-<pre>&gt; I keep wondering why people create all four tunnels.  Why not route
-&gt; traffic generated from home to 10.91.10.24/24 out ipsec0 with iproute2?
-
-This is feasible, given some iproute2 attention to source addresses, but
-it isn't something we've documented yet... (partly because we're still
-making some attempt to support 2.0.xx kernels, which can't do this, but
-mostly because we haven't caught up with it yet).
-
-&gt; And 99% of the time you don't need to access "office" directly, which
-&gt; means you can eliminate all but the subnet&lt;-&gt;subnet connection.
-
-Correct in principle, but people will keep trying to ping to or from the
-gateways during testing, and sometimes they want to run services on the
-gateway machines too.</pre>
-
-
-<!-- Is this in the right spot in this document? -->
-<H2><A name="opp.gate">An Opportunistic Gateway</A></H2>
-                                                                                
-<H3>Start from full opportunism</H3>
-                                                                                
-<P>Full opportunism
-allows you to initiate and receive opportunistic connections on your
-machine. The remaining instructions in this section assume
-you have first set up full opportunism on your gateway using
-<A HREF="quickstart.html#opp.incoming">these instructions</A>.
-Both sets of instructions require mailing DNS records to your ISP. Collect
-DNS records for both the gateway (above) and the
-subnet nodes (below) before contacting your ISP.</P>
-                                                                                
-                                                                                
-<H3>Reverse DNS TXT records for each protected machine</H3>
-                                                                                
-<P>You need these so that your Opportunistic peers can:
-<UL>
-<LI>discover the gateway's address, knowing only the IP address
- that packets are bound for</LI>
-<LI>verify that the gateway is authorised to encrypt for that endpoint</LI>
-</UL>
-                                                                                
-<P>On the gateway, generate a TXT record with:
-<PRE>    ipsec showhostkey --txt 192.0.2.11</PRE>
-<P>Use your gateway address in place of 192.0.2.11.</P>
-                                                                                
-<P>You should see (keys are trimmed for clarity throughout our example):</P>
-<PRE>    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;</PRE>
-                                                                                
-<P><B>This MUST BE the same key as in your gateway's TXT record, or nothing
-will work.</B></P>
-                                                                                
-<P>In a text file, make one copy of this TXT record for each subnet
-  node:</P>
-<PRE>    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;
-                                                                                
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;
-                                                                                
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;</PRE>
-                                                                                
-<P>Above each entry, insert a line like this:</P>
-<PRE>    98.2.0.192.in-addr.arpa. IN PTR arthur.example.com.</PRE>
-                                                                                
-<P>It must include:</P>
-<UL>
-<LI>The subnet node's address in reverse map format. For example, 192.0.2.120
-becomes <VAR>120.2.0.192.in-addr.arpa.</VAR>.  Note the final period.</LI>
-<LI><VAR>IN PTR</VAR></LI>
-<LI>The node's name, ie. <VAR>arthur.example.com.</VAR>. Note
-the final period.</LI>
-</UL>
-                                                                                
-<P>The result will be a file of TXT records, like this:</P>
-<PRE>    98.2.0.192.in-addr.arpa. IN PTR arthur.example.com.
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;
-                                                                                
-    99.2.0.192.in-addr.arpa. IN PTR ford.example.com.
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;
-                                                                                
-    100.2.0.192.in-addr.arpa. IN PTR trillian.example.com.
-    ; RSA 2048 bits  gateway.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;</PRE>
-                                                                                
-                                                                                
-<H3>Publish your records</H3>
-                                                                                
-<P>Ask your ISP to publish all the reverse DNS records you have collected.
-There may be a delay of up to 48 hours as the records propagate.</P>
-                                                                                
-                                                                                
-<H3>...and test them</H3>
-                                                                                
-<P>Check a couple of records with commands like this one:</P>
-                                                                                
-<PRE>    ipsec verify --host ford.example.com
-    ipsec verify --host trillian.example.com</PRE>
-                                                                                
-<P>The <var>verify</var> command checks for TXT records for both the
-subnet host and its gateway. You should see output like:</P>
-<PRE>    ...
-    Looking for TXT in reverse map: 99.2.0.192.in-addr.arpa [OK]
-    ...
-    Looking for TXT in reverse map: 11.2.0.192.in-addr.arpa   [OK]
-    ...
-    Looking for TXT in reverse map: 100.2.0.192.in-addr.arpa [OK]
-    ...
-    Looking for TXT in reverse map: 11.2.0.192.in-addr.arpa   [OK]
-    ...</PRE>
-<H3>No Configuration Needed</H3>
-                                                                                
-<P>FreeS/WAN 2.x ships with a built-in, automatically
-enabled OE connection <VAR>conn packetdefault</VAR>
-which applies OE, if possible, to all outbound traffic routed
-through the FreeS/WAN box.
-                                                                                
-The
-<A HREF="manpage.d/ipsec.conf.5.html">ipsec.conf(5) manual</A>
-describes this connection in detail.
-While the effect is much the same as <VAR>private-or-clear</VAR>,
-the implementation is different: notably, it does not use policy
-groups.</P>
-                                                                                
-<P>You can create more complex OE configurations
-for traffic forwarded through a FreeS/WAN box, as explained in our
-<A HREF="policygroups.html#policygroups">policy groups document</A>,
-or disable OE using
-<A HREF="policygroups.html#disable_policygroups">these instructions</A>.</P>
-
-
-
-<h2><a name="extruded.config">Extruded Subnets</a></h2>
-
-<p>What we call <a href="glossary.html#extruded">extruded subnets</a> are a
-special case of <a href="glossary.html#VPN.gloss">VPNs</a>.</p>
-
-<p>If your buddy has some unused IP addresses, in his subnet far off at the
-other side of the Internet, he can loan them to you... provided that the
-connection between you and him is fast enough to carry all the traffic
-between your machines and the rest of the Internet.  In effect, he "extrudes"
-a part of his address space over the network to you, with your Internet
-traffic appearing to originate from behind his Internet gateway.</p>
-
-<p>As far as the Internet is concerned, your new extruded net is behind your
-buddy's gateway. You route all your packets for the Internet at large
-out his gateway, and receive return packets the same way. You route your
-local packets locally.</p>
-
-<p>Suppose your friend has a.b.c.0/24 and wants to give you a.b.c.240/28. The
-initial situation is:</p>
-<pre>    subnet           gateway          Internet
-  a.b.c.0/24    a.b.c.1    p.q.r.s</pre>
-where anything from the Internet destined for any machine in a.b.c.0/24 is
-routed via p.q.r.s and that gateway knows what to do from there.
-
-<p>Of course it is quite normal for various smaller subnets to exist behind
-your friend's gateway. For example, your friend's company might have
-a.b.c.16/28=development, a.b.c.32/28=marketing and so on. The Internet
-neither knows not cares about this; it just delivers packets to the p.q.r.s
-and lets the gateway do whatever needs to be done from there.</p>
-
-<p>What we want to do is take a subnet, perhaps a.b.c.240/28, out of your
-friend's physical location <em>while still having your friend's gateway route
-to it</em>. As far as the Internet is concerned, you remain behind that
-gateway.</p>
-<pre>    subnet           gateway          Internet       your gate  extruded
-
-  a.b.c.0/24   a.b.c.1     p.q.r.s              d.e.f.g         a.b.c.240/28                
-
-                           ========== tunnel ==========</pre>
-
-<p>The extruded addresses have to be a complete subnet.</p>
-
-<p>In our example, the friend's security gateway is also his Internet
-gateway, but this is not necessary. As long as all traffic from the Internet
-to his addresses passes through the Internet gate, the security gate could be
-a machine behind that. The IG would need to route all traffic for the
-extruded subnet to the SG, and the SG could handle the rest.</p>
-
-<p>First, configure your subnet using the extruded addresses.  Your security
-gateway's interface to your subnet needs to have an extruded address
-(possibly using a Linux <a href="glossary.html#virtual">virtual
-interface</a>, if it also has to have a different address). Your gateway
-needs to have a route to the extruded subnet, pointing to that interface. The
-other machines at your site need to have addresses in that subnet, and
-default routes pointing to your gateway.</p>
-
-<p>If any of your friend's machines need to talk to the extruded subnet,
-<em>they</em> need to have a route for the extruded subnet, pointing at his
-gateway.</p>
-
-<p>Then set up an IPsec subnet-to-subnet tunnel between your gateway and his,
-with your subnet specified as the extruded subnet, and his subnet specified
-as "0.0.0.0/0".</p>
-
-<p>The tunnel description should be:</p>
-<pre>conn extruded
-        left=p.q.r.s
-        leftsubnet=0.0.0.0/0
-        right=d.e.f.g
-        rightsubnet=a.b.c.0/28</pre>
-
-<p>If either side was doing firewalling for the extruded subnet before the
-IPsec connection is set up, you'll need to poke holes in your
-<A HREF="firewall.html#firewall">firewall</A> to allow packets through.
-</p>
-
-<p>And it all just works.  Your SG routes traffic for 0.0.0.0/0 -- that is,
-the whole Internet -- through the tunnel to his SG, which then sends it
-onward as if it came from his subnet.  When traffic for the extruded subnet
-arrives at his SG, it gets sent through the tunnel to your SG, which passes
-it to the right machine.</p>
-
-<p>Remember that when ipsec_manual or ipsec_auto takes a connection down, it
-<em>does not undo the route</em> it made for that connection. This lets you
-take a connection down and bring up a new one, or a modified version of the
-old one, without having to rebuild the route it uses and without any risk of
-packets which should use IPsec accidentally going out in the clear. Because
-the route always points into KLIPS, the packets will always go there. Because
-KLIPS temporarily has no idea what to do with them (no eroute for them), they
-will be discarded.</p>
-
-<p>If you <em>do</em> want to take the route down, this is what the "unroute"
-operation in manual and auto is for.  Just do an unroute after doing the
-down.</p>
-
-<p>Note that the route for a connection may have replaced an existing
-non-IPsec route. Nothing in Linux FreeS/WAN will put that pre-IPsec route
-back. If you need it back, you have to create it with the route command.</p>
-
-<h2><a name="roadvirt">Road Warrior with virtual IP address</a></h2>
-
-<p>Please note that <A HREF="http://www.freeswan.ca/download.php">Super
-FreeS/WAN</A> now features DHCP-over-IPsec, which is an alternate procedure 
-for Virtual IP address assignment.
-<p>
-
-<p>Here is a mailing list message about another way to configure for road
-warrior support:</p>
-<pre>Subject: Re: linux-ipsec: understanding the vpn
-   Date: Thu, 28 Oct 1999 10:43:22 -0400
-   From: Irving Reid &lt;irving@nevex.com&gt;
-
-&gt;  local-------linux------internet------mobile
-&gt;  LAN        box                         user
-&gt;  ...
-
-&gt;  now when the mobile user connects to the linux box
-&gt;  it is given a virtual IP address, i have configured it to
-&gt;  be in the 10.x.x.x range. mobile user and linux box 
-&gt;  have a tunnel between them with these IP addresses.
-
-&gt;   Uptil this all is fine.
-
-If it is possible to configure your mobile client software *not* to
-use a virtual IP address, that will make your life easier. It is easier
-to configure FreeS/WAN to use the actual address the mobile user gets
-from its ISP.
-
-Unfortunately, some Windows clients don't let you choose.
-
-&gt;  what i would like to know is that how does the mobile
-&gt;  user communicate with other computers on the local
-&gt;  LAN , of course with the vpn ?
-
-&gt;   what IP address should the local LAN 
-&gt;  computers have ? I guess their default gateway 
-&gt;  should be the linux box ? and does the linux box need
-&gt;  to be a 2 NIC card box or one is fine.
-
-As someone else stated, yes, the Linux box would usually be the default
-IP gateway for the local lan.
-
-However...
-
-If you mobile user has software that *must* use a virtual IP address,
-the whole picture changes. Nobody has put much effort into getting
-FreeS/WAN to play well in this environment, but here's a sketch of one
-approach:
-
-Local Lan 1.0.0.0/24
-    |
-    +- Linux FreeS/WAN 1.0.0.2
-    |
-    | 1.0.0.1
- Router
-    | 2.0.0.1
-    |
-Internet
-    |
-    | 3.0.0.1
-Mobile User
-      Virtual Address: 1.0.0.3
-
-Note that the Local Lan network (1.0.0.x) can be registered, routable
-addresses.
-
-Now, the Mobile User sets up an IPSec security association with the
-Linux box (1.0.0.2); it should ESP encapsulate all traffic to the
-network 1.0.0.x **EXCEPT** UDP port 500. 500/udp is required for the key
-negotiation, which needs to work outside of the IPSec tunnel.
-
-On the Linux side, there's a bunch of stuff you need to do by hand (for
-now). FreeS/WAN should correctly handle setting up the IPSec SA and
-routes, but I haven't tested it so this may not work...
-
-The FreeS/WAN conn should look like:
-
-conn mobile
-        right=1.0.0.2
-        rightsubnet=1.0.0.0/24
-        rightnexthop=1.0.0.1
-        left=0.0.0.0  # The infamous "road warrior"
-        leftsubnet=1.0.0.3/32
-
-Note that the left subnet contains *only* the remote host's virtual
-address.
-
-Hopefully the routing table on the FreeS/WAN box ends up looking like
-this:
-
-% netstat -rn
-Kernel IP routing table
-Destination     Gateway      Genmask         Flags   MSS Window  irtt Iface
-1.0.0.0         0.0.0.0      255.255.255.0   U      1500 0          0 eth0
-127.0.0.0       0.0.0.0      255.0.0.0       U      3584 0          0 lo
-0.0.0.0         1.0.0.1      0.0.0.0         UG     1500 0          0 eth0
-1.0.0.3         1.0.0.1      255.255.255.255 UG     1433 0          0 ipsec0
-
-So, if anybody sends a packet for 1.0.0.3 to the Linux box, it should
-get bundled up and sent through the tunnel. To get the packets for
-1.0.0.3 to the Linux box in the first place, you need to use "proxy
-ARP".
-
-How this works is: when a host or router on the local Ethernet segment
-wants to send a packet to 1.0.0.3, it sends out an Ethernet level
-broadcast "ARP request". If 1.0.0.3 was on the local LAN, it would
-reply, saying "send IP packets for 1.0.0.3 to my Ethernet address".
-
-Instead, you need to set up the Linux box so that _it_ answers ARP
-requests for 1.0.0.3, even though that isn't its IP address. That
-convinces everyone else on the lan to send 1.0.0.3 packets to the Linux
-box, where the usual FreeS/WAN processing and routing take over.
-
-% arp -i eth0 -s 1.0.0.3 -D eth0 pub
-
-This says, if you see an ARP request on interface eth0 asking for
-1.0.0.3, respond with the Ethernet address of interface eth0.
-
-Now, as I said at the very beginning, if it is *at all* possible to
-configure your client *not* to use the virtual IP address, you can avoid
-this whole mess.</pre>
-
-<h2><a name="dynamic">Dynamic Network Interfaces</a></h2>
-
-<p>Sometimes you have to cope with a situation where the network interface(s)
-aren't all there at boot. The common example is notebooks with PCMCIA.</p>
-
-<h3><a name="basicdyn">Basics</a></h3>
-
-<p>The key issue here is that the <var>config setup</var> section of the
-<var>/etc/ipsec.conf</var> configuration file lists the connection between
-ipsecN and hardware interfaces, in the <var>interfaces=</var> variable. At
-any time when <var>ipsec setup start</var> or <var>ipsec setup restart</var>
-is run this variable <strong>must</strong> correspond to the current real
-situation. More precisely, it <strong>must not</strong> mention any hardware
-interfaces which don't currently exist. The difficulty is that an <var>ipsec
-setup start</var> command is normally run at boot time so interfaces that are
-not up then are mis-handled.</p>
-
-<h3><a name="bootdyn">Boot Time</a></h3>
-
-<p>Normally, an <var>ipsec setup start</var> is run at boot time. However, if
-the hardware situation at boot time is uncertain, one of two things must be
-done.</p>
-<ul>
-  <li>One possibility is simply not to have IPsec brought up at boot time. To
-    do this:
-    <pre>        chkconfig --level 2345 ipsec off</pre>
-    That's for modern Red Hats or other Linuxes with chkconfig. Systems which
-    lack this will require fiddling with symlinks in /etc/rc.d/rc?.d or the
-    equivalent.</li>
-  <li>Another possibility is to bring IPsec up with no interfaces, which is
-    less aesthetically satisfying but simpler.  Just put
-    <pre>        interfaces=</pre>
-    in the configuration file.  KLIPS and Pluto will be started, but won't do
-    anything.</li>
-</ul>
-
-<h3><a name="changedyn">Change Time</a></h3>
-
-<p>When the hardware *is* in place, IPsec has to be made aware of it. Someday
-there may be a nice way to do this.</p>
-
-<p>Right now, the way to do it is to fix the <var>/etc/ipsec.conf</var> file
-appropriately, so <var>interfaces</var> reflects the new situation, and then
-restart the IPsec subsystem. This does break any existing IPsec
-connections.</p>
-
-<p>If IPsec wasn't brought up at boot time, do</p>
-<pre>        ipsec setup start</pre>
-while if it was, do
-<pre>        ipsec setup restart</pre>
-which won't be as quick.
-
-<p>If some of the hardware is to be taken out, before doing that, amend the
-configuration file so interfaces no longer includes it, and do</p>
-<pre>        ipsec setup restart</pre>
-
-<p>Again, this breaks any existing connections.</p>
-
-<h2><a name="unencrypted">Unencrypted tunnels</a></h2>
-
-<p>Sometimes you might want to create a tunnel without encryption. Often this
-is a bad idea, even if you have some data which need not be private. See this
-<a href="ipsec.html#traffic.resist">discussion</a>.</p>
-
-<p>The IPsec protocols provide two ways to do build such tunnels:</p>
-<dl>
-  <dt>using ESP with null encryption</dt>
-    <dd>not supported by FreeS/WAN</dd>
-  <dt>using <a href="glossary.html#AH">AH</a> without <a
-  href="glossary.html#ESP">ESP</a></dt>
-    <dd>supported for manually keyed connections</dd>
-    <dd>possible with explicit commands via <a
-      href="manpage.d/ipsec_whack.8.html">ipsec_whack(8)</a> (see this <a
-      href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00190.html">list
-      message</a>)</dd>
-    <dd>not supported in the <a
-      href="manpage.d/ipsec_auto.8.html">ipsec_auto(8)</a> scripts.</dd>
-</dl>
-One situation in which this comes up is when otherwise some data would be
-encrypted twice. Alice wants a secure tunnel from her machine to Bob's. Since
-she's behind one security gateway and he's behind another, part of the tunnel
-that they build passes through the tunnel that their site admins have built
-between the gateways. All of Alice and Bob's messages are encrypted twice.
-
-<p>There are several ways to handle this.</p>
-<ul>
-  <li>Just accept the overhead of double encryption. The site admins might
-    choose this if any of the following apply:
-    <ul>
-      <li>policy says encrypt everything (usually, it should)</li>
-      <li>they don't entirely trust Alice and Bob (usually, if they don't
-        have to, they shouldn't)</li>
-      <li>if they don't feel the saved cycles are worth the time they'd need
-        to build a non-encrypted tunnel for Alice and Bob's packets (often,
-        they aren't)</li>
-    </ul>
-  </li>
-  <li>Use a plain IP-in-IP tunnel. These are not well documented. A good
-    starting point is in the Linux kernel source tree, in
-    /usr/src/linux/drivers/net/README.tunnel.</li>
-  <li>Use a manually-keyed AH-only tunnel.</li>
-</ul>
-
-<p>Note that if Alice and Bob want end-to-end security, they must build a
-tunnel end-to-end between their machines or use some other end-to-end tool
-such as PGP or SSL that suits their data. The only question is whether the
-admins build some special unencrypted tunnel for those already-encrypted
-packets.</p>
-</body>
-</html>
diff --git a/doc/src/background.html b/doc/src/background.html
deleted file mode 100644
index e25b9da03..000000000
--- a/doc/src/background.html
+++ /dev/null
@@ -1,376 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>FreeS/WAN background</title>
-  <meta name="keywords" content="Linux, IPSEC, VPN, security, FreeSWAN">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: background.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1><a name="background">Linux FreeS/WAN background</a></h1>
-
-<p>This section discusses a number of issues which have three things in
-common:</p>
-<ul>
-  <li>They are not specifically FreeS/WAN problems</li>
-  <li>You may have to understand them to get FreeS/WAN working right</li>
-  <li>They are not simple questions</li>
-</ul>
-
-<p>Grouping them here lets us provide the explanations some users will need
-without unduly complicating the main text.</p>
-
-<p>The explanations here are intended to be adequate for FreeS/WAN purposes
-(please comment to the <a href="mail.html">users mailing list</a> if you
-don't find them so), but they are not trying to be complete or definitive. If
-you need more information, see the references provided in each section.</p>
-
-<h2><a name="dns.background">Some DNS background</a></h2>
-
-<p><a href="glossary.html#carpediem">Opportunistic encryption</a> requires
-that the gateway systems be able to fetch public keys, and other
-IPsec-related information, from each other's DNS (Domain Name Service)
-records.</p>
-
-<p><a href="glossary.html#DNS">DNS</a> is a distributed database that maps
-names to IP addresses and vice versa.</p>
-
-<p>Much good reference material is available for DNS, including:</p>
-<ul>
-  <li>the <a href="http://www.linuxdoc.org/HOWTO/DNS-HOWTO.html">DNS
-  HowTo</a></li>
-  <li>the standard <a href="biblio.html#DNS.book">DNS reference</a> book</li>
-  <li><a href="http://www.linuxdoc.org/LDP/nag2/index.html">Linux Network
-    Administrator's Guide</a></li>
-  <li><a
-    href="http://www.nominum.com/resources/whitepapers/bind-white-paper.html">BIND
-    overview</a></li>
-  <li><a
-    href="http://www.nominum.com/resources/documentation/Bv9ARM.pdf">BIND 9
-    Administrator's Reference</a></li>
-</ul>
-
-<p>We give only a brief overview here, intended to help you use DNS for
-FreeS/WAN purposes.</p>
-
-<h3><a name="forward.reverse">Forward and reverse maps</a></h3>
-
-<p>Although the implementation is distributed, it is often useful to speak of
-DNS as if it were just two enormous tables:</p>
-<ul>
-  <li>the forward map: look up a name, get an IP address</li>
-  <li>the reverse map: look up an IP address, get a name</li>
-</ul>
-
-<p>Both maps can optionally contain additional data. For opportunistic
-encryption, we insert the data need for IPsec authentication.</p>
-
-<p>A system named gateway.example.com with IP address 10.20.30.40 should have
-at least two DNS records, one in each map:</p>
-<dl>
-  <dt>gateway.example.com. IN A 10.20.30.40</dt>
-    <dd>used to look up the name and get an IP address</dd>
-  <dt>40.30.20.10.in-addr.arpa. IN PTR gateway.example.com.</dt>
-    <dd>used for reverse lookups, looking up an address to get the associated
-      name. Notice that the digits here are in reverse order; the actual
-      address is 10.20.30.40 but we use 40.30.20.10 here.</dd>
-</dl>
-
-<h3>Hierarchy and delegation</h3>
-
-<p>For both maps there is a hierarchy of DNS servers and a system of
-delegating authority so that, for example:</p>
-<ul>
-  <li>the DNS administrator for example.com can create entries of the form
-    <var>name</var>.example.com</li>
-  <li>the example.com admin cannot create an entry for counterexample.com;
-    only someone with authority for .com can do that</li>
-  <li>an admin might have authority for 20.10.in-addr.arpa.</li>
-  <li>in either map, authority can be delegated
-    <ul>
-      <li>the example.com admin could give you authority for
-        westcoast.example.com</li>
-      <li>the 20.10.in-addr.arpa admin could give you authority for
-        30.20.10.in-addr.arpa</li>
-    </ul>
-  </li>
-</ul>
-
-<p>DNS zones are the units of delegation. There is a hierarchy of zones.</p>
-
-<h3>Syntax of DNS records</h3>
-
-<p>Returning to the example records:</p>
-<pre>        gateway.example.com. IN A 10.20.30.40
-        40.30.20.10.in-addr.arpa. IN PTR gateway.example.com.</pre>
-
-<p>some syntactic details are:</p>
-<ul>
-  <li>the IN indicates that these records are for <strong>In</strong>ternet
-    addresses</li>
-  <li>The final periods in '.com.' and '.arpa.' are required. They indicate
-    the root of the domain name system.</li>
-</ul>
-
-<p>The capitalised strings after IN indicate the type of record. Possible
-types include:</p>
-<ul>
-  <li><strong>A</strong>ddress, for forward lookups</li>
-  <li><strong>P</strong>oin<strong>T</strong>e<strong>R</strong>, for reverse
-    lookups</li>
-  <li><strong>C</strong>anonical <strong>NAME</strong>, records to support
-    aliasing, multiple names for one address</li>
-  <li><strong>M</strong>ail e<strong>X</strong>change, used in mail
-  routing</li>
-  <li><strong>SIG</strong>nature, used in <a href="glossary.html#SDNS">secure
-    DNS</a></li>
-  <li><strong>KEY</strong>, used in <a href="glossary.html#SDNS">secure
-    DNS</a></li>
-  <li><strong>T</strong>e<strong>XT</strong>, a multi-purpose record type</li>
-</ul>
-
-<p>To set up for opportunistic encryption, you add some TXT records
-to your DNS data. Details are in our <a href="quickstart.html">quickstart</a>
-document.</p>
-
-<h3>Cacheing, TTL and propagation delay</h3>
-
-<p>DNS information is extensively cached. With no caching, a lookup by your
-system of "www.freeswan.org" might involve:</p>
-<ul>
-  <li>your system asks your nameserver for "www.freeswan.org"</li>
-  <li>local nameserver asks root server about ".org", gets reply</li>
-  <li>local nameserver asks .org nameserver about "freeswan.org", gets
-  reply</li>
-  <li>local nameserver asks freeswan.org nameserver about "www.freeswan.org",
-    gets reply</li>
-</ul>
-
-<p>However, this can be a bit inefficient. For example, if you are in the
-Phillipines, the closest a root server is in Japan. That might send you to a
-.org server in the US, and then to freeswan.org in Holland. If everyone did
-all those lookups every time they clicked on a web link, the net would grind
-to a halt.</p>
-
-<p>Nameservers therefore cache information they look up. When you click on
-another link at www.freeswan.org, your local nameserver has the IP address
-for that server in its cache, and no further lookups are required. </p>
-
-<p>Intermediate results are also cached. If you next go to
-lists.freeswan.org, your nameserver can just ask the freeswan.org nameserver
-for that address; it does not need to query the root or .org nameservers
-because it has a cached address for the freeswan.org zone server.</p>
-
-<p>Of course, like any cacheing mechanism, this can create problems of
-consistency. What if the administrator for freeswan.org changes the IP
-address, or the authentication key, for www.freeswan.org? If you use old
-information from the cache, you may get it wrong. On the other hand, you
-cannot afford to look up fresh information every time. Nor can you expect the
-freeswan.org server to notify you; that isn't in the protocols.</p>
-
-<p>The solution that is in the protocols is fairly simple. Cacheable records
-are marked with Time To Live (TTL) information. When the time expires, the
-caching server discards the record. The next time someone asks for it, the
-server fetches a fresh copy. Of course, a server may also discard records
-before their TTL expires if it is running out of cache space.</p>
-
-<p>This implies that there will be some delay before the new version of a
-changed record propagates around the net. Until the TTLs on all copies of the
-old record expire, some users will see it because that is what is in their
-cache. Other users may see the new record immediately because they don't have
-an old one cached.</p>
-
-<h2><a name="MTU.trouble">Problems with packet fragmentation</a></h2>
-
-<p>It seems, from mailing list reports, to be moderately common for problems
-to crop up in which small packets pass through the IPsec tunnels just fine
-but larger packets fail.</p>
-
-<p>These problems are caused by various devices along the way mis-handling
-either packet fragments or <a href="glossary.html#pathMTU">path MTU
-discovery</a>.</p>
-
-<p>IPsec makes packets larger by adding an ESP or AH header. This can tickle
-assorted bugs in fragment handling in routers and firewalls, or in path MTU
-discovery mechanisms, and cause a variety of symptoms which are both annoying
-and, often, quite hard to diagnose.</p>
-
-<p>An explanation from project technical lead Henry Spencer:</p>
-<pre>The problem is IP fragmentation; more precisely, the problem is that the
-second, third, etc. fragments of an IP packet are often difficult for
-filtering mechanisms to classify.
-
-Routers cannot rely on reassembling the packet, or remembering what was in
-earlier fragments, because the fragments may be out of order or may even
-follow different routes.  So any general, worst-case filtering decision
-pretty much has to be made on each fragment independently.  (If the router
-knows that it is the only route to the destination, so all fragments
-*must* pass through it, reassembly would be possible... but most routers
-don't want to bother with the complications of that.)
-
-All fragments carry roughly the original IP header, but any higher-level
-header is (for IP purposes) just the first part of the packet data... so
-only the first fragment carries that.  So, for example, on examining the
-second fragment of a TCP packet, you could tell that it's TCP, but not
-what port number it is destined for -- that information is in the TCP
-header, which appears in the first fragment only. 
-
-The result of this classification difficulty is that stupid routers and
-over-paranoid firewalls may just throw fragments away.  To get through
-them, you must reduce your MTU enough that fragmentation will not occur.
-(In some cases, they might be willing to attempt reassembly, but have very
-limited resources to devote to it, meaning that packets must be small and
-fragments few in number, leading to the same conclusion:  smaller MTU.)</pre>
-
-<p>In addition to the problem Henry describes, you may also have trouble with
-<a href="glossary.html#pathMTU">path MTU discovery</a>.</p>
-
-<p>By default, FreeS/WAN uses a large <a href="glossary.html#MTU">MTU</a> for
-the ipsec device. This avoids some problems, but may complicate others.
-Here's an explanation from Claudia:</p>
-<pre>Here are a couple of pieces of background information. Apologies if you
-have seen these already. An excerpt from one of my old posts:
-
-    An MTU of 16260 on ipsec0 is usual. The IPSec device defaults to this 
-    high MTU so that it does not fragment incoming packets before encryption 
-    and encapsulation. If after IPSec processing packets are larger than 1500,
-    [ie. the mtu of eth0] then eth0 will fragment them. 
-
-    Adding IPSec headers adds a certain number of bytes to each packet. 
-    The MTU of the IPSec interface refers to the maximum size of the packet
-    before the IPSec headers are added. In some cases, people find it helpful 
-    to set ipsec0's MTU to 1500-(IPSec header size), which IIRC is about 1430.
-
-    That way, the resulting encapsulated packets don't exceed 1500. On most 
-    networks, packets less than 1500 will not need to be fragmented.
-
-and... (from Henry Spencer)
-
-    The way it *ought* to work is that the MTU advertised by the ipsecN
-    interface should be that of the underlying hardware interface, less a
-    pinch for the extra headers needed. 
-
-    Unfortunately, in certain situations this breaks many applications.
-    There is a widespread implicit assumption that the smallest MTUs are 
-    at the ends of paths, not in the middle, and another that MTUs are 
-    never less than 1500.  A lot of code is unprepared to handle paths 
-    where there is an "interior minimum" in the MTU, especially when it's 
-    less than 1500. So we advertise a big MTU and just let the resulting 
-    big packets fragment.
-
-This usually works, but we do get bitten in cases where some intermediate
-point can't handle all that fragmentation.  We can't win on this one.</pre>
-
-<p>The MTU can be changed with an <var>overridemtu=</var> statement in the
-<var>config setup</var> section of <a
-href="manpage.d/ipsec.conf.5.html">ipsec.conf.5</a>.</p>
-
-<p>For a discussion of MTU issues and some possible solutions using Linux
-advanced routing facilities, see the <a
-href="http://www.linuxguruz.org/iptables/howto/2.4routing-15.html#ss15.6">Linux
-2.4 Advanced Routing HOWTO</a>.
-
-For a discussion of MTU and NAT (Network Address Translation), see
-<A HREF="http://harlech.math.ucla.edu/services/ipsec.html">James Carter's MTU
-notes</A>.</p>
-
-<h2><a name="nat.background">Network address translation (NAT)</a></h2>
-
-<p><strong>N</strong>etwork <strong>A</strong>ddress
-<strong>T</strong>ranslation is a service provided by some gateway machines.
-Calling it NAPT (adding the word  <strong>P</strong>ort) would be more
-precise, but we will follow the widespread usage.</p>
-
-<p>A gateway doing NAT rewrites the headers of packets it is forwarding,
-changing one or more of:</p>
-<ul>
-  <li>source address</li>
-  <li>source port</li>
-  <li>destination address</li>
-  <li>destination port</li>
-</ul>
-
-<p>On Linux 2.4, NAT services are provided by the <a
-href="http://netfilter.samba.org">netfilter(8)</a> firewall code. There are
-several <a
-href="http://netfilter.samba.org/documentation/index.html#HOWTO">Netfilter
-HowTos</a> including one on NAT.</p>
-
-<p>For older versions of Linux, this was referred to as "IP masquerade" and
-different tools were used. See this <a
-href="http://www.e-infomax.com/ipmasq/">resource page</a>.</p>
-
-<p>Putting an IPsec gateway behind a NAT gateway is not recommended. See our
-<a href="firewall.html#NAT">firewalls document</a>.</p>
-
-<h3>NAT to non-routable addresses</h3>
-
-<p>The most common application of NAT uses private <a
-href="glossary.html#non-routable">non-routable</a> addresses.</p>
-
-<p>Often a home or small office network will have:</p>
-<ul>
-  <li>one connection to the Internet</li>
-  <li>one assigned publicly visible IP address</li>
-  <li>several machines that all need access to the net</li>
-</ul>
-
-<p>Of course this poses a problem since several machines cannot use one
-address. The best solution might be to obtain more addresses, but often this
-is impractical or uneconomical.</p>
-
-<p>A common solution is to have:</p>
-<ul>
-  <li><a href="glossary.html#non-routable">non-routable</a> addresses on the
-    local network</li>
-  <li>the gateway machine doing NAT</li>
-  <li>all packets going outside the LAN rewritten to have the gateway as
-    their source address</li>
-</ul>
-
-<p>The client machines are set up with reserved <a
-href="#non-routable">non-routable</a> IP addresses defined in RFC 1918. The
-masquerading gateway, the machine with the actual link to the Internet,
-rewrites packet headers so that all packets going onto the Internet appear to
-come from one IP address, that of its Internet interface. It then gets all
-the replies, does some table lookups and more header rewriting, and delivers
-the replies to the appropriate client machines.</p>
-
-<p>As far as anyone else on the Internet is concerned, the systems behind the
-gateway are completely hidden. Only one machine with one IP address is
-visible.</p>
-
-<p>For IPsec on such a gateway, you can entirely ignore the NAT in:</p>
-<ul>
-  <li><a href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a></li>
-  <li>firewall rules affecting your Internet-side interface</li>
-</ul>
-
-<p>Those can be set up exactly as they would be if your gateway had no other
-systems behind it.</p>
-
-<p>You do, however, have to take account of the NAT in firewall rules which
-affect packet forwarding.</p>
-
-<h3>NAT to routable addresses</h3>
-
-<p>NAT to routable addresses is also possible, but is less common and may
-make for rather tricky routing problems. We will not discuss it here. See the
-<a href="http://netfilter.samba.org/documentation/index.html#HOWTO">Netfilter
-HowTos</a>.</p>
-</body>
-</html>
diff --git a/doc/src/biblio.html b/doc/src/biblio.html
deleted file mode 100644
index d84e4c2cb..000000000
--- a/doc/src/biblio.html
+++ /dev/null
@@ -1,354 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>FreeS/WAN bibliography</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, bibliography">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: biblio.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1><a name="biblio">Bibliography for the Linux FreeS/WAN project</a></h1>
-
-<p>For extensive bibliographic links, see the <a
-href="http://liinwww.ira.uka.de/bibliography/index.html">Collection of
-Computer Science Bibliographies</a></p>
-
-<p>See our <a href="web.html">web links</a> for material available online.</p>
-<hr>
-<a name="adams">Carlisle Adams and Steve Lloyd <cite>Understanding Public Key
-Infrastructure</cite><br>
-</a>Macmillan 1999 ISBN 1-57870-166-x
-
-<p>An overview, mainly concentrating on policy and strategic issues rather
-than the technical details. Both authors work for <a
-href="glossary.html#PKI">PKI</a> vendor <a
-href="http://www.entrust.com/">Entrust</a>.</p>
-<hr>
-<a name="DNS.book">Albitz, Liu &amp; Loukides <cite>DNS &amp; BIND</cite> 3rd
-edition<br>
-</a> O'Reilly 1998 ISBN 1-56592-512-2
-
-<p>The standard reference on the <a href="glossary.html#DNS">Domain Name
-Service</a> and <a href="glossary.html#BIND">Berkeley Internet Name
-Daemon</a>.</p>
-<hr>
-<a name="anderson">Ross Anderson</a>, <cite>Security Engineering - a Guide to
-Building Dependable Distributed Systems</cite><br>
-Wiley, 2001, ISBN 0471389226
-
-<p>Easily the best book for the security professional I have seen.
-<strong>Highly recommended</strong>. See the <a
-href="http://www.cl.cam.ac.uk/~rja14/book.html">book web page</a>.</p>
-
-<p>This is quite readable, but Schneier's <a href="#secrets">Secrets and
-Lies</a> might be an easier introduction.</p>
-<hr>
-<a name="puzzle">Bamford <cite>The Puzzle Palace, A report on NSA, Americas's
-most Secret Agency</cite><br>
-Houghton Mifflin 1982 ISBN 0-395-31286-8</a>
-<hr>
-Bamford <cite>Body of Secrets</cite>
-
-<p>The sequel.</p>
-<hr>
-<a name="bander">David Bander</a>, <cite>Linux Security Toolkit</cite><br>
-IDG Books, 2000, ISBN: 0764546902
-
-<p>This book has a short section on FreeS/WAN and includes Caldera Linux on
-CD.</p>
-<hr>
-<a name="CZR">Chapman, Zwicky &amp; Russell</a>, <cite>Building Internet
-Firewalls</cite><br>
-O'Reilly 1995 ISBN 1-56592-124-0
-<hr>
-<a name="firewall.book">Cheswick and Bellovin</a> <cite>Firewalls and
-Internet Security: Repelling the Wily Hacker</cite><br>
-Addison-Wesley 1994 ISBN 0201633574
-
-<p>A fine book on firewalls in particular and security in general from two of
-AT&amp;T's system adminstrators.</p>
-
-<p>Bellovin has also done a number of <a href="web.html#papers">papers</a> on
-IPsec and co-authored a <a href="intro.html#applied">paper</a> on a large
-FreeS/WAN application.</p>
-<hr>
-<a name="comer">Comer <cite>Internetworking with TCP/IP</cite><br>
-Prentice Hall</a>
-<ul>
-  <li>Vol. I: Principles, Protocols, &amp; Architecture, 3rd Ed. 1995
-    ISBN:0-13-216987-8</li>
-  <li>Vol. II: Design, Implementation, &amp; Internals, 2nd Ed. 1994
-    ISBN:0-13-125527-4</li>
-  <li>Vol. III: Client/Server Programming &amp; Applications
-    <ul>
-      <li>AT&amp;T TLI Version  1994 ISBN:0-13-474230-3</li>
-      <li>BSD Socket Version 1996 ISBN:0-13-260969-X</li>
-      <li>Windows Sockets Version 1997 ISBN:0-13-848714-6</li>
-    </ul>
-  </li>
-</ul>
-
-<p>If you need to deal with the details of the network protocols, read either
-this series or the <a href="#stevens">Stevens and Wright</a> series before
-you start reading the RFCs.</p>
-<hr>
-<a name="diffie">Diffie and Landau</a> <cite>Privacy on the Line: The
-Politics of Wiretapping and Encryption</cite><br>
-MIT press 1998 ISBN 0-262-04167-7 (hardcover) or 0-262-54100-9<br>
-
-<hr>
-<a name="d_and_hark">Doraswamy and Harkins <cite>IP Sec: The New Security
-Standard for the Internet, Intranets and Virtual Private Networks</cite><br>
-Prentice Hall 1999 ISBN: 0130118982</a>
-<hr>
-<a name="EFF"> Electronic Frontier Foundation <cite>Cracking DES: Secrets of
-Encryption Research, Wiretap Politics and Chip Design</cite><br>
-</a> O'Reilly 1998 ISBN 1-56592-520-3
-
-<p>To conclusively demonstrate that DES is inadequate for continued use, the
-<a href="glossary.html#EFF">EFF</a> built a machine for just over $200,000
-that breaks DES encryption in under five days on average, under nine in the
-worst case.</p>
-
-<p>The book provides details of their design and, perhaps even more
-important, discusses why they felt the project was necessary. Recommended for
-anyone interested in any of the three topics mentioned in the subtitle.</p>
-
-<p>See also the <a href="http://www.eff.org/descracker.html"> EFF page on
-this project </a> and our discussion of <a
-href="politics.html#desnotsecure">DES insecurity</a>.</p>
-<hr>
-Martin Freiss <cite>Protecting Networks with SATAN</cite><br>
-O'Reilly 1998 ISBN 1-56592-425-8<br>
-translated from a 1996 work in German
-
-<p>SATAN is a Security Administrator's Tool for Analysing Networks. This book
-is a tutorial in its use.</p>
-<hr>
-Gaidosch and Kunzinger<cite> A Guide to Virtual Private Networks</cite><br>
-Prentice Hall 1999 ISBN: 0130839647
-<hr>
-<a name="Garfinkel">Simson Garfinkel</a> <cite>Database Nation: the death of
-privacy in the 21st century</cite><br>
-O'Reilly 2000 ISBN 1-56592-653-6
-
-<p>A thoughtful and rather scary book.</p>
-<hr>
-<a name="PGP">Simson Garfinkel</a> <cite>PGP: Pretty Good Privacy</cite><br>
-O'Reilly 1995 ISBN 1-56592-098-8
-
-<p>An excellent introduction and user manual for the <a
-href="glossary.html#PGP">PGP</a> email-encryption package.  PGP is a good
-package with a complex and poorly-designed user interface. This book or one
-like it is a must for anyone who has to use it at length.</p>
-
-<p>The book covers using PGP in Unix, PC and Macintosh environments, plus
-considerable background material on both the technical and political issues
-around cryptography.</p>
-
-<p>The book is now seriously out of date. It does not cover recent
-developments such as commercial versions since PGP 5, the Open PGP standard
-or GNU PG..</p>
-<hr>
-<a name="practical">Garfinkel and Spafford</a> <cite>Practical Unix
-Security</cite><br>
-O'Reilly 1996 ISBN 1-56592-148-8
-
-<p>A standard reference.</p>
-
-<p>Spafford's web page has an excellent collection of<a
-href="http://www.cs.purdue.edu/coast/hotlist"> crypto and security
-links</a>.</p>
-<hr>
-<a name="Kahn">David Kahn</a> <cite>The Codebreakers: the Comprehensive
-History of Secret Communications from Ancient Times to the Internet</cite><br>
-second edition Scribner 1996 ISBN 0684831309
-
-<p>A history of codes and code-breaking from ancient Egypt to the 20th
-century. Well-written and exhaustively researched. <strong>Highly
-recommended</strong>, even though it does not have much on computer
-cryptography.</p>
-<hr>
-David Kahn <cite>Seizing the Enigma, The Race to Break the German U-Boat
-codes, 1939-1943</cite><br>
-Houghton Mifflin 1991 ISBN 0-395-42739-8
-<hr>
-<a name="kirch">Olaf Kirch</a> <cite>Linux Network Administrator's
-Guide</cite><br>
-O'Reilly 1995 ISBN 1-56592-087-2
-
-<p>Now becoming somewhat dated in places, but still a good introductory book
-and general reference.</p>
-<hr>
-<a name="LinVPN">Kolesnikov and Hatch</a>, <cite>Building Linux Virtual
-Private Networks (VPNs)</cite><br>
-New Riders 2002
-
-<p>This has had a number of favorable reviews, including <a
-href="http://www.slashdot.org/article.pl?sid=02/02/27/0115214&amp;mode=thread&amp;tid=172">this
-one</a> on Slashdot. The book has a <a
-href="http://www.buildinglinuxvpns.net/">web site</a>.</p>
-<hr>
-<a name="RFCs">Pete Loshin <cite>Big Book of IPsec RFCs</cite><br>
-Morgan Kaufmann 2000 ISBN: 0-12-455839-9</a>
-<hr>
-<a name="crypto">Steven Levy <cite>Crypto: How the Code Rebels Beat the
-Government -- Saving Privacy in the Digital Age</cite></a><br>
-Penguin 2001, ISBN 0-670--85950-8
-
-<p><strong>Highly recommended</strong>. A fine history of recent (about
-1970-2000) developments in the field, and the related political
-controversies. FreeS/WAN project founder and leader John Gilmore appears
-several times.</p>
-
-<p>The book does not cover IPsec or FreeS/WAN, but this project is very much
-another battle in the same war.  See our discussion of the <a
-href="politics.html">politics</a>.</p>
-<hr>
-<a name="GTR">Matyas, Anderson et al.</a> <cite>The Global Trust
-Register</cite><br>
-Northgate Consultants Ltd 1998 ISBN: 0953239705<br>
-hard cover edition MIT Press 1999 ISBN 0262511053
-
-<p>From<a href="http://www.cl.cam.ac.uk/Research/Security/Trust-Register">
-their web page:</a></p>
-
-<blockquote>
-  This book is a register of the fingerprints of the world's most important
-  public keys; it implements a top-level certification authority (CA) using
-  paper and ink rather than in an electronic system.</blockquote>
-<hr>
-<a name="handbook">Menezies, van Oorschot and Vanstone <cite>Handbook of
-Applied Cryptography</cite></a><br>
-CRC Press 1997<br>
-ISBN 0-8493-8523-7
-
-<p>An excellent reference. Read <a href="#schneier">Schneier</a> before
-tackling this.</p>
-<hr>
-Michael Padlipsky <cite>Elements of Networking Style</cite><br>
-Prentice-Hall 1985 ISBN 0-13-268111-0 or 0-13-268129-3
-
-<p>Probably <strong>the funniest technical book ever written</strong>, this
-is a vicious but well-reasoned attack on the OSI "seven layer model" and all
-that went with it. Several chapters of it are also available as RFCs 871 to
-875.</p>
-<hr>
-<a name="matrix">John S. Quarterman</a> <cite>The Matrix: Computer Networks
-and Conferencing Systems Worldwide</cite><br>
-Digital Press 1990  ISBN 155558-033-5<br>
-Prentice-Hall ISBN 0-13-565607-9
-
-<p>The best general treatment of computer-mediated communication we have
-seen. It naturally has much to say about the Internet, but also covers UUCP,
-Fidonet and so on.</p>
-<hr>
-<a name="ranch">David Ranch</a> <cite>Securing Linux Step by Step</cite><br>
-SANS Institute, 1999
-
-<p><a href="http://www.sans.org/">SANS</a> is a respected organisation, this
-guide is part of a well-known series, and Ranch has previously written the
-useful <a
-href=" http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html#trinityos">Trinity
-OS</a> guide to securing Linux, so my guess would be this is a pretty good
-book. I haven't read it yet, so I'm not certain. It can be ordered online
-from <a href="http://www.sans.org/">SANS</a>.</p>
-
-<p>Note (Mar 1, 2002): a new edition with different editors in the works.
-Expect it this year.</p>
-<hr>
-<a name="schneier">Bruce Schneier</a> <cite>Applied Cryptography, Second
-Edition</cite><br>
-John Wiley &amp; Sons, 1996<br>
-ISBN 0-471-12845-7 hardcover<br>
-ISBN 0-471-11709-9 paperback
-
-<p>A standard reference on computer cryptography. For more recent essays, see
-the <a href="http://www.counterpane.com/">author's company's web site</a>.</p>
-<hr>
-<a name="secrets">Bruce Schneier</a><cite> Secrets and Lies</cite><br>
-Wiley 2000, ISBN 0-471-25311-1
-
-<p>An interesting discussion of security and privacy issues, written with
-more of an "executive overview" approach rather than a narrow focus on the
-technical issues. <strong>Highly recommended</strong>.</p>
-
-<p>This is worth reading even if you already understand security issues, or
-think you do. To go deeper, follow it with Anderson's <a
-href="#anderson">Security Engineering</a>.</p>
-<hr>
-<a name="VPNbook">Scott, Wolfe and Irwin <cite>Virtual Private
-Networks</cite></a><br>
-2nd edition, O'Reilly 1999 ISBN: 1-56592-529-7
-
-<p>This is the only O'Reilly book, out of a dozen I own, that I'm
-disappointed with. It deals mainly with building VPNs with various
-proprietary tools -- <a href="glossary.html#PPTP">PPTP</a>, <a
-href="glossary.html#SSH">SSH</a>, Cisco PIX, ... -- and touches only lightly
-on IPsec-based approaches.</p>
-
-<p>That said, it appears to deal competently with what it does cover and it
-has readable explanations of many basic VPN and security concepts. It may be
-exactly what some readers require, even if I find the emphasis
-unfortunate.</p>
-<hr>
-<a name="LASG">Kurt Seifried <cite>Linux Administrator's Security
-Guide</cite></a>
-
-<p>Available online from <a
-href="http://www.securityportal.com/lasg/">Security Portal</a>. It has fairly
-extensive coverage of IPsec.</p>
-<hr>
-<a name="Smith">Richard E Smith <cite>Internet Cryptography</cite><br>
-</a>ISBN 0-201-92480-3, Addison Wesley, 1997
-
-<p>See the book's <a
-href="http://www.visi.com/crypto/inet-crypto/index.html">home page</a></p>
-<hr>
-<a name="neal">Neal Stephenson <cite>Cryptonomicon</cite></a><br>
-Hardcover ISBN -380-97346-4, Avon, 1999.
-
-<p>A novel in which cryptography and the net figure prominently.
-<strong>Highly recommended</strong>: I liked it enough I immediately went out
-and bought all the author's other books.</p>
-
-<p>There is also a paperback edition. Sequels are expected.</p>
-<hr>
-<a name="stevens">Stevens and Wright</a> <cite>TCP/IP Illustrated</cite><br>
-Addison-Wesley
-<ul>
-  <li>Vol. I: The Protocols 1994 ISBN:0-201-63346-9</li>
-  <li>Vol. II: The Implementation 1995 ISBN:0-201-63354-X</li>
-  <li>Vol. III: TCP for Transactions, HTTP, NNTP, and the UNIX Domain
-    Protocols 1996 ISBN: 0-201-63495-3</li>
-</ul>
-
-<p>If you need to deal with the details of the network protocols, read either
-this series or the <a href="#comer">Comer</a> series before you start reading
-the RFCs.</p>
-<hr>
-<a name="Rubini">Rubini</a> <cite>Linux Device Drivers</cite><br>
-O'Reilly &amp; Associates, Inc. 1998 ISBN 1-56592-292-1
-<hr>
-<a name="Zeigler">Robert Zeigler</a> <cite>Linux Firewalls</cite><br>
-Newriders Publishing, 2000 ISBN 0-7537-0900-9
-
-<p>A good book, with detailed coverage of ipchains(8) firewalls and of many
-related issues.</p>
-</body>
-</html>
diff --git a/doc/src/buildtools.html b/doc/src/buildtools.html
deleted file mode 100644
index c8cfa1fc8..000000000
--- a/doc/src/buildtools.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
-<HTML>
-  <HEAD>
-    <TITLE>Tools used to build FreeSWAN releases (08-Mar-2002)</TITLE>
-    <!-- Created by: Michael Richardson, 08-Mar-2002 -->
-
-
-  </HEAD>
-  <BODY>
-    <H1>Tools used to build FreeSWAN releases</H1>
-
-<H2>man2html</H2>
-
-<P>
-If you are not running RedHat, you will need man2html. This is part of the
-"man" RPM on RedHat, whose sources can be found at <A HREF="ftp://ftp.win.tue.nl/pub/linux-local/utils/man/">ftp://ftp.win.tue.nl/pub/linux-local/utils/man/</A>.
-</P>
-
-<P>
-Note that the Debian package <A HREF="http://packages.debian.org/man2html">man2html</A>
-and the one listed on Freshmeat at
-<A HREF="http://freshmeat.net/projects/man2html/">man2html</A> will
-not work.
-</P>
-
-  </BODY>
-</HTML>
\ No newline at end of file
diff --git a/doc/src/compat.html b/doc/src/compat.html
deleted file mode 100644
index a8e1455bf..000000000
--- a/doc/src/compat.html
+++ /dev/null
@@ -1,795 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>FreeS/WAN compatibility guide</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, compatibility">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: compat.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1><a name="compat">Linux FreeS/WAN Compatibility Guide</a></h1>
-
-<p>Much of this document is quoted directly from the Linux FreeS/WAN <a
-href="mail.html">mailing list</a>. Thanks very much to the community of
-testers, patchers and commenters there, especially the ones quoted below but
-also various contributors we haven't quoted.</p>
-
-<h2><a name="spec">Implemented parts of the IPsec Specification</a></h2>
-
-<p>In general, do not expect Linux FreeS/WAN to do everything yet. This is a
-work-in-progress and some parts of the IPsec specification are not yet
-implemented.</p>
-
-<h3><a name="in">In Linux FreeS/WAN</a></h3>
-
-<p>Things we do, as of version 1.96:</p>
-<ul>
-  <li>key management methods
-    <dl>
-      <dt>manually keyed</dt>
-        <dd>using keys stored in /etc/ipsec.conf</dd>
-      <dt>automatically keyed</dt>
-        <dd>Automatically negotiating session keys as required. All
-          connections are automatically re-keyed periodically. The <a
-          href="glossary.html#Pluto">Pluto</a> daemon implements this using
-          the <a href="glossary.html#IKE">IKE</a> protocol.</dd>
-    </dl>
-  </li>
-  <li>Methods of authenticating gateways for IKE
-    <dl>
-      <dt>shared secrets</dt>
-        <dd>stored in <a
-          href="manpage.d/ipsec.secrets.5.html">ipsec.secrets(5)</a></dd>
-      <dt><a href="glossary.html#RSA">RSA</a> signatures</dt>
-        <dd>For details, see <a
-          href="manpage.d/ipsec_pluto.8.html">pluto(8)</a>.</dd>
-      <dt>looking up RSA authentication keys from <a
-      href="glossary.html#DNS">DNS</a>.</dt>
-        <dd>Note that this technique cannot be fully secure until <a
-          href="glossary.html#SDNS">secure DNS</a> is widely deployed.</dd>
-    </dl>
-  </li>
-  <li>groups for <a href="glossary.html#DH">Diffie-Hellman</a> key negotiation
-    <dl>
-      <dt>group 2, modp 1024-bit</dt>
-      <dt>group 5, modp 1536-bit</dt>
-        <dd>We implement these two groups.
-          <p>In negotiating a keying connection (ISAKMP SA, Phase 1) we
-          propose both groups when we are the initiator, and accept either
-          when a peer proposes them. Once the keying connection is made, we
-          propose only the alternative agreed there for data connections
-          (IPsec SA's, Phase 2) negotiated over that keying connection.</p>
-        </dd>
-    </dl>
-  </li>
-  <li>encryption transforms
-    <dl>
-      <dt><a href="glossary.html#DES">DES</a></dt>
-        <dd>DES is in the source code since it is needed to implement 3DES,
-          but single DES is not made available to users because <a
-          href="politics.html#desnotsecure">DES is insecure</a>.</dd>
-      <dt><a href="glossary.html#3DES">Triple DES</a></dt>
-        <dd>implemented, and used as the default encryption in Linux
-          FreeS/WAN.</dd>
-    </dl>
-  </li>
-  <li>authentication transforms
-    <dl>
-      <dt><a href="glossary.html#HMAC">HMAC</a> using <a
-      href="glossary.html#MD5">MD5</a></dt>
-        <dd>implemented, may be used in IKE or by by AH or ESP
-        transforms.</dd>
-      <dt><a href="glossary.html#HMAC">HMAC</a> using <a
-      href="glossary.html#SHA">SHA</a></dt>
-        <dd>implemented, may be used in IKE or by AH or ESP transforms.</dd>
-    </dl>
-    <p>In negotiations, we propose both of these and accept either.</p>
-  </li>
-  <li>compression transforms
-    <dl>
-      <dt>IPComp</dt>
-        <dd>IPComp as described in RFC 2393 was added for FreeS/WAN 1.6. Note
-          that Pluto becomes confused if you ask it to do IPComp when the
-          kernel cannot.</dd>
-    </dl>
-  </li>
-</ul>
-
-<p>All combinations of implemented transforms are supported. Note that some
-form of packet-level <strong>authentication is required whenever encryption
-is used</strong>. Without it, the encryption will not be secure.</p>
-
-<h3><a name="dropped">Deliberately omitted</a></h3>
-We do not implement everything in the RFCs because some of those things are
-insecure. See our discussions of avoiding <a href="politics.html#weak">bogus
-security</a>.
-
-<p>Things we deliberately omit which are required in the RFCs are:</p>
-<ul>
-  <li>null encryption (to use ESP as an authentication-only service)</li>
-  <li>single DES</li>
-  <li>DH group 1, a 768-bit modp group</li>
-</ul>
-
-<p>Since these are the only encryption algorithms and DH group the RFCs
-require, it is possible in theory to have a standards-conforming
-implementation which will not interpoperate with FreeS/WAN. Such an
-implementation would be inherently insecure, so we do not consider this a
-problem.</p>
-
-<p>Anyway, most implementations sensibly include more secure options as well,
-so dropping null encryption, single DES and Group 1 does not greatly hinder
-interoperation in practice.</p>
-
-<p>We also do not implement some optional features allowed by the RFCs:</p>
-<ul>
-  <li>aggressive mode for negotiation of the keying channel or ISAKMP SA.
-    This mode is a little faster than main mode, but exposes more information
-    to an eavesdropper.</li>
-</ul>
-
-<p>In theory, this should cause no interoperation problems since all
-implementations are required to support the more secure main mode, whether or
-not they also allow aggressive mode.</p>
-
-<p>In practice, it does sometimes produce problems with implementations such
-as Windows 2000 where aggressive mode is the default. Typically, these are
-easily solved with a configuration change that overrides that default.</p>
-
-<h3><a name="not">Not (yet) in Linux FreeS/WAN</a></h3>
-
-<p>Things we don't yet do, as of version 1.96:</p>
-<ul>
-  <li>key management methods
-    <ul>
-      <li>authenticate key negotiations via local <a
-        href="glossary.html#PKI">PKI</a> server, but see links to user <a
-        href="web.html#patch">patches</a></li>
-      <li>authenticate key negotiations via <a
-        href="glossary.html#SDNS">secure DNS</a></li>
-      <li>unauthenticated key management, using <a
-        href="glossary.html#DH">Diffie-Hellman</a> key agreement protocol
-        without authentication. Arguably, this would be worth doing since it
-        is secure against all passive attacks. On the other hand, it is
-        vulnerable to an active <a
-        href="glossary.html#middle">man-in-the-middle attack</a>.</li>
-    </ul>
-  </li>
-  <li>encryption transforms
-    <p>Currently <a href="glossary.html#3DES">Triple DES</a> is the only
-    encryption method Pluto will negotiate.</p>
-    <p>No additional encryption transforms are implemented, though the RFCs
-    allow them and some other IPsec implementations support various of them.
-    We are not eager to add more. See this <a
-    href="faq.html#other.cipher">FAQ question</a>.</p>
-    <p><a href="glossary.html#AES">AES</a>, the successor to the DES
-    standard, is an excellent candidate for inclusion in FreeS/WAN, see links
-    to user <a href="web.html#patch">patches</a>.</p>
-  </li>
-  <li>authentication transforms
-    <p>No optional additional authentication transforms are currently
-    implemented. Likely <a href="glossary.html#SHA-256">SHA-256, SHA-384 and
-    SHA-512</a> will be added when AES is.</p>
-  </li>
-  <li>Policy checking on decrypted packets
-    <p>To fully comply with the RFCs, it is not enough just to accept only
-    packets which survive any firewall rules in place to limit what IPsec
-    packets get in, and then pass KLIPS authentication. That is what
-    FreeS/WAN currently does.</p>
-    <p>We should also apply additional tests, for example ensuring that all
-    packets emerging from a particular tunnel have source and destination
-    addresses that fall within the subnets defined for that tunnel, and that
-    packets with those addresses that did not emerge from the appropriate
-    tunnel are disallowed.</p>
-    <p>This will be done as part of a KLIPS rewrite. See these <a
-    href="intro.html#applied">links</a> and the <a href="mail.html">design
-    mailing list</a> for discussion.</p>
-  </li>
-</ul>
-
-<h2><a name="pfkey">Our PF-Key implementation</a></h2>
-
-<p>We use PF-key Version Two for communication between the KLIPS kernel code
-and the Pluto Daemon. PF-Key v2 is defined by <a
-href="http://www.normos.org/ietf/rfc/rfc2367.txt">RFC 2367</a>.</p>
-
-<p>The "PF" stands for Protocol Family. PF-Inet defines a kernel/userspace
-interface for the TCP/IP Internet protocols (TCP/IP), and other members of
-the PF series handle Netware, Appletalk, etc. PF-Key is just a PF for
-key-related matters.</p>
-
-<h3><a name="pfk.port">PF-Key portability</a></h3>
-
-<p>PF-Key came out of Berkeley Unix work and is used in the various BSD IPsec
-implementations, and in Solaris. This means there is some hope of porting our
-Pluto(8) to one of the BSD distributions, or of running their photurisd(8) on
-Linux if you prefer <a href="glossary.html#photuris">Photuris</a> key
-management over IKE.</p>
-
-<p>It is, however, more complex than that. The PK-Key RFC deliberately deals
-only with keying, not policy management. The three PF-Key implementations we
-have looked at -- ours, OpenBSD and KAME -- all have extensions to deal with
-security policy, and the extensions are different. There have been
-discussions aimed at sorting out the differences, perhaps for a version three
-PF-Key spec. All players are in favour of this, but everyone involved is busy
-and it is not clear whether or when these discussions might bear fruit.</p>
-
-<h2><a name="otherk">Kernels other than the latest 2.2.x and 2.4.y</a></h2>
-
-<p>We develop and test on Redhat Linux using the most recent kernel in the
-2.2 and 2.4 series. In general, we recommend you use the latest kernel in one
-of those series. Complications and caveats are discussed below.</p>
-
-<h3><a name="kernel.2.0">2.0.x kernels</a></h3>
-
-<p>Consider upgrading to the 2.2 kernel series. If you want to stay with the
-2.0 series, then we strongly recommend 2.0.39. Some useful security patches
-were added in 2.0.38.</p>
-
-<p>Various versions of the code have run at various times on most 2.0.xx
-kernels, but the current version is only lightly tested on 2.0.39, and not at
-all on older kernels.</p>
-
-<p>Some of our patches for older kernels are shipped in 2.0.37 and later, so
-they are no longer provided in FreeS/WAN. This means recent versions of
-FreeS/WAN will probably not compile on anything earlier than 2.0.37.</p>
-
-<h3><a name="kernel.production">2.2 and 2.4 kernels</a></h3>
-<dl>
-  <dt>FreeS/WAN 1.0</dt>
-    <dd>ran only on 2.0 kernels</dd>
-  <dt>FreeS/WAN 1.1 to 1.8</dt>
-    <dd>ran on 2.0 or 2.2 kernels<br>
-      ran on some development kernels, 2.3 or 2.4-test</dd>
-  <dt>FreeS/WAN 1.9 to 1.96</dt>
-    <dd>runs on 2.0, 2.2 or 2.4 kernels</dd>
-</dl>
-
-<p>In general, <strong>we suggest the latest 2.2 kernel or 2.4 for production
-use</strong>.</p>
-
-<p>Of course no release can be guaranteed to run on kernels more recent than
-it is, so quite often there will be no stable FreeS/WAN for the absolute
-latest kernel. See the <a href="faq.html#k.versions">FAQ</a> for
-discussion.</p>
-
-<h2><a name="otherdist">Intel Linux distributions other than Redhat</a></h2>
-
-<p>We develop and test on Redhat 6.1 for 2.2 kernels, and on Redhat 7.1 or
-7.2 for 2.4, so minor changes may be required for other distributions.</p>
-
-<h3><a name="rh7">Redhat 7.0</a></h3>
-
-<p>There are some problems with FreeS/WAN on Redhat 7.0. They are soluble,
-but we recommend you upgrade to a later Redhat instead..</p>
-
-<p>Redhat 7 ships with two compilers.</p>
-<ul>
-  <li>Their <var>gcc</var> is version 2.96. Various people, including the GNU
-    compiler developers and Linus, have said fairly emphatically that using
-    this was a mistake. 2.96 is a development version, not intended for
-    production use. In particular, it will not compile a Linux kernel.</li>
-  <li>Redhat therefore also ship a separate compiler, which they call
-    <var>kgcc</var>, for compiling kernels.</li>
-</ul>
-
-<p>Kernel Makefiles have <var>gcc</var> as a default, and must be adjusted to
-use <var>kgcc</var> before a kernel will compile on 7.0. This mailing list
-message gives details:</p>
-<pre>Subject: Re: AW: Installing IPsec on Redhat 7.0
-   Date: Thu, 1 Feb 2001 14:32:52 -0200 (BRST)
-  From: Mads Rasmussen &lt;mads@cit.com.br&gt;
- 
-&gt; From www.redhat.com/support/docs/gotchas/7.0/gotchas-7-6.html#ss6.1
-
-cd to /usr/src/linux and open the Makefile in your favorite editor. You
-will need to look for a line similar to this:
-
-CC = $(CROSS_COMPILE)gcc -D__KERNEL__ -I$(HPATH)
-
-This line specifies which C compiler to use to build the kernel. It should
-be changed to:
-
-CC = $(CROSS_COMPILE)kgcc -D__KERNEL__ -I$(HPATH)
-
-for Red Hat Linux 7. The kgcc compiler is egcs 2.91.66. From here you can
-proceed with the typical compiling steps.</pre>
-
-<p>Check the <a href="mail.html">mailing list</a> archive for more recent
-news.</p>
-
-<h3><a name="suse">SuSE Linux</a></h3>
-
-<p>SuSE 6.3 and later versions, at least in Europe, ship with FreeS/WAN
-included.</p>
-
-<P>FreeS/WAN packages distributed for SuSE 7.0-7.2 were somehow
-miscompiled.  You can find fixed packages on 
-<A HREF="http://www.suse.de/~garloff/linux/FreeSWAN">
-Kurt Garloff's page</A>.</P>
-
-<p>Here are some notes for an earlier SuSE version.</p>
-
-<h4>SuSE Linux 5.3</h4>
-<pre>Date: Mon, 30 Nov 1998
-From: Peter Onion &lt;ponion@srd.bt.co.uk&gt;
-
-... I got Saturdays snapshot working between my two SUSE5.3 machines at home.
-
-The mods to the install process are quite simple.  From memory and looking at
-the files on the SUSE53 machine here at work....
-
-And extra link in each of the /etc/init.d/rc?.d directories called K35ipsec
-which SUSE use to shut a service down.
-
-A few mods in /etc/init.d/ipsec  to cope with the different places that SUSE
-put config info, and remove the inculsion of /etc/rc.d/init.d/functions and .
-/etc/sysconfig/network as they don't exists and 1st one isn't needed anyway.
-
-insert ". /etc/rc.config" to pick up the SUSE config info and use 
-
-  if test -n "$NETCONFIG" -a "$NETCONFIG" != "YAST_ASK" ; then
-
-to replace 
-
-  [ ${NETWORKING} = "no" ] &amp;&amp; exit 0
-
-Create /etc/sysconfig  as SUSE doesn't have one.
-
-I think that was all (but I prob forgot something)....</pre>
-
-<p>You may also need to fiddle initialisation scripts to ensure that
-<var>/var/run/pluto.pid</var> is removed when rebooting. If this file is
-present, Pluto does not come up correctly.</p>
-
-<h3><a name="slack">Slackware</a></h3>
-<pre>Subject: Re: linux-IPsec: Slackware distribution
-  Date:  Thu, 15 Apr 1999 12:07:01 -0700
-  From:  Evan Brewer &lt;dmessiah@silcon.com&gt;
-
-&gt; Very shortly, I will be needing to install IPsec on at least gateways that
-&gt; are running Slackware. . . .
-
-The only trick to getting it up is that on the slackware dist there is no
-init.d directory in /etc/rc.d .. so create one.  Then, what I do is take the
-IPsec startup script which normally gets put into the init.d directory, and
-put it in /etc/rc.d and name ir rc.ipsec .. then I symlink it to the file
-in init.d.  The only file in the dist you need to really edit is the
-utils/Makefile, setup4:
-
-Everything else should be just fine.</pre>
-
-<p>A year or so later:</p>
-<pre>Subject: Re: HTML Docs- Need some cleanup?
-   Date: Mon, 8 Jan 2001
-   From: Jody McIntyre &lt;jodym@oeone.com&gt;
-
-I have successfully installed FreeS/WAN on several Slackware 7.1 machines.
-FreeS/WAN installed its rc.ipsec file in /etc/rc.d.  I had to manually call
-this script from rc.inet2.  This seems to be an easier method than Evan
-Brewer's.</pre>
-
-<h3><a name="deb">Debian</a></h3>
-
-<p>A recent (Nov 2001) mailing list points to a <a
-href="http://www.thing.dyndns.org/debian/vpn.htm">web page</a> on setting up
-several types of tunnel, including IPsec, on Debian.</p>
-
-<p>Some older information:</p>
-<pre>Subject: FreeS/WAN 1.0 on Debian 2.1
-   Date: Tue, 20 Apr 1999
-  From:  Tim Miller &lt;cerebus+counterpane@haybaler.sackheads.org&gt;
-
-        Compiled and installed without error on a Debian 2.1 system
-with kernel-source-2.0.36 after pointing RCDIR in utils/Makefile to
-/etc/init.d.
-
-        /var/lock/subsys/ doesn't exist on Debian boxen, needs to be
-created; not a fatal error.
-
-        Finally, IPsec scripts appear to be dependant on GNU awk
-(gawk); the default Debian awk (mawk-1.3.3-2) had fatal difficulties.
-With gawk installed and /etc/alternatives/awk linked to /usr/bin/gawk
-operation appears flawless.</pre>
-
-<p>The scripts in question have been modified since this was posted. Awk
-versions should no longer be a problem.</p>
-
-<h3><a name="caldera">Caldera</a></h3>
-<pre>Subject: Re: HTML Docs- Need some cleanup?
-   Date: Mon, 08 Jan 2001
-   From: Andy Bradford &lt;andyb@calderasystems.com&gt;
-
-On Sun, 07 Jan 2001 22:59:05 EST, Sandy Harris wrote:
-
-&gt;     Intel Linux distributions other than Redhat 5.x and 6.x 
-&gt;         Redhat 7.0 
-&gt;         SuSE Linux 
-&gt;             SuSE Linux 5.3 
-&gt;         Slackware 
-&gt;         Debian 
-
-Can you please include Caldera in this list?  I have tested it since 
-FreeS/Wan 1.1 and it works great with our systems---provided one 
-follows the FreeS/Wan documentation. :-)
-
-Thank you,
-Andy</pre>
-
-<h2><a name="CPUs">CPUs other than Intel</a></h2>
-
-<p>FreeS/WAN has been run sucessfully on a number of different CPU
-architectures. If you have tried it on one not listed here, please post to
-the <a href="mail.html">mailing list</a>.</p>
-
-<h3><a name=" strongarm">Corel Netwinder (StrongARM CPU)</a></h3>
-<pre>Subject: linux-ipsec: Netwinder diffs
-Date: Wed, 06 Jan 1999
-From: rhatfield@plaintree.com
-
-I had a mistake in my IPsec-auto, so I got things working this morning.
-
-Following are the diffs for my changes.  Probably not the best and cleanest way 
-of doing it, but it works. . . . </pre>
-
-<p>These diffs are in the 0.92 and later distributions, so these should work
-out-of-the-box on Netwinder.</p>
-
-<h3><a name="yellowdog">Yellow Dog Linux on Power PC</a></h3>
-<pre>Subject:  Compiling FreeS/WAN 1.1 on YellowDog Linux (PPC)
-   Date:  11 Dec 1999
-   From:  Darron Froese &lt;darron@fudgehead.com&gt;
-
-I'm summarizing here for the record - because it's taken me many hours to do
-this (multiple times) and because I want to see IPsec on more linuxes than
-just x86.
-
-Also, I can't remember if I actually did summarize it before... ;-) I'm
-working too many late hours.
-
-That said - here goes.
-
-1. Get your linux kernel and unpack into /usr/src/linux/ - I used 2.2.13.
-&lt;http://www.kernel.org/pub/linux/kernel/v2.2/linux-2.2.13.tar.bz2&gt;
-
-2. Get FreeS/WAN and unpack into /usr/src/freeswan-1.1
-&lt;ftp://ftp.xs4all.nl/pub/crypto/freeswan/freeswan-1.1.tar.gz&gt;
-
-3. Get the gmp src rpm from here:
-&lt;ftp://ftp.yellowdoglinux.com//pub/yellowdog/champion-1.1/SRPMS/SRPMS/gmp-2.0.2-9a.src.rpm&gt;
-
-4. Su to root and do this: rpm --rebuild gmp-2.0.2-9a.src.rpm
-
-You will see a lot of text fly by and when you start to see the rpm
-recompiling like this:
-
-Executing: %build
-+ umask 022
-+ cd /usr/src/redhat/BUILD
-+ cd gmp-2.0.2
-+ libtoolize --copy --force
-Remember to add `AM_PROG_LIBTOOL' to `configure.in'.
-You should add the contents of `/usr/share/aclocal/libtool.m4' to
-`aclocal.m4'.
-+ CFLAGS=-O2 -fsigned-char
-+ ./configure --prefix=/usr
-
-Hit Control-C to stop the rebuild. NOTE: We're doing this because for some
-reason the gmp source provided with FreeS/WAN 1.1 won't build properly on
-ydl.
-
-cd /usr/src/redhat/BUILD/
-cp -ar gmp-2.0.2 /usr/src/freeswan-1.1/
-cd /usr/src/freeswan-1.1/
-rm -rf gmp
-mv gmp-2.0.2 gmp
-
-5. Open the freeswan Makefile and change the line that says:
-KERNEL=$(b)zimage (or something like that) to
-KERNEL=vmlinux
-
-6. cd ../linux/
-
-7. make menuconfig
-Select an option or two and then exit - saving your changes.
-
-8. cd ../freeswan-1.1/ ; make menugo
-
-That will start the whole process going - once that's finished compiling,
-you have to install your new kernel and reboot.
-
-That should build FreeS/WAN on ydl (I tried it on 1.1).</pre>
-And a later message on the same topic:
-<pre>Subject: Re: FreeS/WAN, PGPnet and E-mail
-   Date: Sat, 22 Jan 2000
-   From: Darron Froese &lt;darron@fudgehead.com&gt;
-
-on 1/22/00 6:47 PM, Philip Trauring at philip@trauring.com wrote:
-
-&gt; I have a PowerMac G3 ...
-
-The PowerMac G3 can run YDL 1.1 just fine. It should also be able to run
-FreeS/WAN 1.2patch1 with a couple minor modifications:
-
-1. In the Makefile it specifies a bzimage for the kernel compile - you have
-to change that to vmlinux for the PPC.
-
-2. The gmp source that comes with FreeS/WAN (for whatever reason) fails to
-compile. I have gotten around this by getting the gmp src rpm from here:
-
-ftp://ftp.yellowdoglinux.com//pub/yellowdog/champion-1.1/SRPMS/SRPMS/gmp-2.0.2-9a.src.rpm
-
-If you rip the source out of there - and place it where the gmp source
-resides it will compile just fine.</pre>
-
-<p>FreeS/WAN no longer includes GMP source.</p>
-
-<h3><a name="mklinux">Mklinux</a></h3>
-
-<p>One user reports success on the Mach-based
-<strong>m</strong>icro<strong>k</strong>ernel Linux.</p>
-<pre>Subject: Smiles on sparc and ppc
-   Date: Fri, 10 Mar 2000
-   From: Jake Hill &lt;jah@alien.bt.co.uk&gt;
-
-You may or may not be interested to know that I have successfully built
-FreeS/WAN on a number of non intel alpha architectures; namely on ppc
-and sparc and also on osfmach3/ppc (MkLinux). I can report that it just
-works, mostly, with few changes.</pre>
-
-<h3><a name="alpha">Alpha 64-bit processors</a></h3>
-<pre>Subject: IT WORKS (again) between intel &amp; alpha :-)))))
-   Date: Fri, 29 Jan 1999
-   From: Peter Onion &lt;ponion@srd.bt.co.uk&gt;
-
-Well I'm happy to report that I've got an IPsec connection between by intel &amp; alpha machines again :-))
-
-If you look back on this list to 7th of December I wrote...
-
--On 07-Dec-98 Peter Onion wrote:
--&gt; 
--&gt; I've about had enuf of wandering around inside the kernel trying to find out
--&gt; just what is corrupting outgoing packets...
--
--Its 7:30 in the evening .....
--
--I FIXED IT  :-))))))))))))))))))))))))))))))))
--
--It was my own fault :-((((((((((((((((((
--
--If you ask me very nicly I'll tell you where I was a little too over keen to
--change unsigned long int __u32 :-)  OPSE ...
--
--So tomorrow it will full steam ahead to produce a set of diffs/patches against
--0.91 
--
--Peter Onion.</pre>
-
-<p>In general (there have been some glitches), FreeS/WAN has been running on
-Alphas since then.</p>
-
-<h3><a name="SPARC">Sun SPARC processors</a></h3>
-
-<p>Several users have reported success with FreeS/WAN on SPARC Linux. Here is
-one mailing list message:</p>
-<pre>Subject: Smiles on sparc and ppc
-   Date: Fri, 10 Mar 2000
-   From: Jake Hill &lt;jah@alien.bt.co.uk&gt;
-
-You may or may not be interested to know that I have successfully built
-FreeS/WAN on a number of non intel alpha architectures; namely on ppc
-and sparc and also on osfmach3/ppc (MkLinux). I can report that it just
-works, mostly, with few changes.
-
-I have a question, before I make up some patches. I need to hack
-gmp/mpn/powerpc32/*.s to build them. Is this ok? The changes are
-trivial, but could I also use a different version of gmp? Is it vanilla
-here?
-
-I guess my only real headache is from ipchains, which appears to stop
-running when IPsec has been started for a while. This is with 2.2.14 on
-sparc.</pre>
-
-<p>This message, from a different mailing list, may be relevant for anyone
-working with FreeS/WAN on Suns:</p>
-<pre>Subject: UltraSPARC DES assembler
-   Date: Thu, 13 Apr 2000
-   From: svolaf@inet.uni2.dk (Svend Olaf Mikkelsen)
-     To: coderpunks@toad.com
-
-An UltraSPARC assembler version of the LibDES/SSLeay/OpenSSL des_enc.c
-file is available at http://inet.uni2.dk/~svolaf/des.htm.
-
-This brings DES on UltraSPARC from slower than Pentium at the same
-clock speed to significantly faster.</pre>
-
-<h3><a name="mips">MIPS processors</a></h3>
-
-<p>We know FreeS/WAN runs on at least some MIPS processors because <a
-href="http://www.lasat.com">Lasat</a> manufacture an IPsec box based on an
-embedded MIPS running Linux with FreeS/WAN. We have no details.</p>
-
-<h3><a name="crusoe">Transmeta Crusoe</a></h3>
-
-<p>The Merilus <a
-href="http://www.merilus.com/products/fc/index.shtml">Firecard</a>, a Linux
-firewall on a PCI card, is based on a Crusoe processor and supports
-FreeS/WAN.</p>
-
-<h3><a name="coldfire">Motorola Coldfire</a></h3>
-<pre>Subject: Re: Crypto hardware support
-   Date: Mon, 03 Jul 2000
-   From: Dan DeVault &lt;devault@tampabay.rr.com&gt;
-
-.... I have been running
-uClinux with FreeS/WAN 1.4 on a system built by Moreton Bay  (
-http://www.moretonbay.com )  and it was using a Coldfire processor
-and was able to do the Triple DES encryption at just about
-1 mbit / sec rate.......  they put a Hi/Fn 7901 hardware encryption
-chip on their board and now their system does over 25 mbit of 3DES
-encryption........ pretty significant increase if you ask me.</pre>
-
-<h2><a name="multiprocessor">Multiprocessor machines</a></h2>
-
-<p>FreeS/WAN is designed to work on SMP (symmetric multi-processing) Linux
-machines and is regularly tested on dual processor x86 machines.</p>
-
-<p>We do not know of any testing on multi-processor machines with other CPU
-architectures or with more than two CPUs. Anyone who does test this, please
-report results to the <a href="mail.html">mailing list</a>.</p>
-
-<p>The current design does not make particularly efficient use of
-multiprocessor machines; some of the kernel work is single-threaded.</p>
-
-<h2><a name="hardware">Support for crypto hardware</a></h2>
-
-<p>Supporting hardware cryptography accelerators has not been a high priority
-for the development team because it raises a number of fairly complex
-issues:</p>
-<ul>
-  <li>Can you trust the hardware? If it is not Open Source, how do you audit
-    its security? Even if it is, how do you check that the design has no
-    concealed traps?</li>
-  <li>If an interface is added for such hardware, can that interface be
-    subverted or misused?</li>
-  <li>Is hardware acceleration actually a performance win? It clearly is in
-    many cases, but on a fast machine it might be better to use the CPU for
-    the encryption than to pay the overheads of moving data to and from a
-    crypto board.</li>
-  <li>the current KLIPS code does not provide a clean interface for hardware
-    accelerators</li>
-</ul>
-
-<p>That said, we have a <a href="#coldfire">report</a> of FreeS/WAN working
-with one crypto accelerator and some work is going on to modify KLIPS to
-create a clean generic interface to such products. See this <a
-href="http://www.jukie.net/~bart/linux-ipsec/">web page</a> for some of the
-design discussion.</p>
-
-<p>More recently, a patch to support some hardware accelerators has been
-posted:</p>
-<pre>Subject: [Design] [PATCH] H/W acceleration patch
-   Date: Tue, 18 Sep 2001
-   From: "Martin Gadbois" &lt;martin.gadbois@colubris.com&gt;
- 
-Finally!!
-Here's a web site with H/W acceleration patch for FreeS/WAN 1.91, including
-S/W and Hifn 7901 crypto support.
-
-http://sources.colubris.com/
-
-Martin Gadbois</pre>
-
-<p>Hardware accelerators could take performance well beyond what FreeS/WAN
-can do in software (discussed <a href="performance.html">here</a>). Here is
-some discussion off the IETF IPsec list, October 2001:</p>
-<pre> ... Currently shipping chips deliver, 600 mbps throughput on a single
- stream of 3DES IPsec traffic.  There are also chips that use multiple
- cores to do 2.4 gbps.  We (Cavium) and others have announced even faster
- chips. ... Mid 2002 versions will handle at line rate (OC48 and OC192)
- IPsec and SSL/TLS traffic not only 3DES CBC but also AES and arc4.</pre>
-
-<p>The patches to date support chips that have been in production for some
-time, not the state-of-the-art latest-and-greatest devices described in that
-post. However, they may still outperform software and they almost certainly
-reduce CPU overhead.</p>
-
-<h2><a name="ipv6">IP version 6 (IPng)</a></h2>
-
-<p>The Internet currently runs on version four of the IP protocols. IPv4 is
-what is in the standard Linux IP stack, and what FreeS/WAN was built for. In
-IPv4, IPsec is an optional feature.</p>
-
-<p>The next version of the IP protocol suite is version six, usually
-abbreviated either as "IPv6" or as "IPng" for "IP: the next generation". For
-IPv6, IPsec is a required feature. Any machine doing IPv6 is required to
-support IPsec, much as any machine doing (any version of) IP is required to
-support ICMP.</p>
-
-<p>There is a Linux implementation of IPv6 in Linux kernels 2.2 and above.
-For details, see the <a
-href="http://www.cs-ipv6.lancs.ac.uk/ipv6/systems/linux/faq/">FAQ</a>. It
-does not yet support IPsec. The <a
-href="http://www.linux-ipv6.org/">USAGI</a> project are also working on IPv6
-for Linux.</p>
-
-<p>FreeS/WAN was originally built for the current standard, IPv4, but we are
-interested in seeing it work with IPv6. Some progress has been made, and a
-patched version with IPv6 support is <a
-href="http://www.ipv6.iabg.de/downloadframe/index.html">available</a>. For
-more recent information, check the <a href="mail.html">mailing list</a>.</p>
-
-<h3><a name="v6.back">IPv6 background</a></h3>
-
-<p>IPv6 has been specified by an IETF <a
-href="http://www.ietf.org/html.charters/ipngwg-charter.html">working
-group</a>. The group's page lists over 30 RFCs to date, and many Internet
-Drafts as well. The overview is <a
-href="http://www.ietf.org/rfc/rfc2460.txt">RFC 2460</a>. Major features
-include:</p>
-<ul>
-  <li>expansion of the address space from 32 to 128 bits,</li>
-  <li>changes to improve support for
-    <ul>
-      <li>mobile IP</li>
-      <li>automatic network configuration</li>
-      <li>quality of service routing</li>
-      <li>...</li>
-    </ul>
-  </li>
-  <li>improved security via IPsec</li>
-</ul>
-
-<p>A number of projects are working on IPv6 implementation. A prominent Open
-Source effort is <a href="http://www.kame.net/">KAME</a>, a collaboration
-among several large Japanese companies to implement IPv6 for Berkeley Unix.
-Other major players are also working on IPv6. For example, see pages at:</p>
-<ul>
-  <li><a
-  href="http://playground.sun.com/pub/ipng/html/ipng-main.html">Sun</a></li>
-  <li><a
-  href="http://www.cisco.com/warp/public/732/ipv6/index.html">Cisco</a></li>
-  <li><a
-    href="http://www.microsoft.com/windows2000/techinfo/howitworks/communications/networkbasics/IPv6.asp">Microsoft</a></li>
-</ul>
-
-<p>The <a href="http://www.6bone.net/">6bone</a> (IPv6 backbone) testbed
-network has been up for some time. There is an active <a
-href="http://www.ipv6.org/">IPv6 user group</a>.</p>
-
-<p>One of the design goals for IPv6 was that it must be possible to convert
-from v4 to v6 via a gradual transition process. Imagine the mess if there
-were a "flag day" after which the entire Internet used v6, and all software
-designed for v4 stopped working. Almost every computer on the planet would
-need major software changes! There would be huge costs to replace older
-equipment. Implementers would be worked to death before "the day", systems
-administrators and technical support would be completely swamped after it.
-The bugs in every implementation would all bite simultaneously. Large chunks
-of the net would almost certainly be down for substantial time periods.
-...</p>
-
-<p>Fortunately, the design avoids any "flag day". It is therefore a little
-tricky to tell how quickly IPv6 will take over. The transition has certainly
-begun. For examples, see announcements from <a
-href="http://www.mailbase.ac.uk/lists/internet2/2000-03/0016.html">NTT</a>
-and <a href="http://www.vnunet.com/News/1102383">Nokia</a>. However, it is
-not yet clear how quickly the process will gain momentum, or when it will be
-completed. Likely large parts of the Internet will remain with IPv4 for years
-to come.</p>
-</body>
-</html>
diff --git a/doc/src/config.html b/doc/src/config.html
deleted file mode 100644
index b98e452db..000000000
--- a/doc/src/config.html
+++ /dev/null
@@ -1,394 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>FreeS/WAN configuration</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, installation, quickstart">
-  <!--
-
-  Written by Claudia Schmeing for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: config.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-<BODY>
-<H1><A NAME="config">How to configure FreeS/WAN</A></H1>
-
-<P>This page will teach you how to configure a simple network-to-network
-link or a Road Warrior connection between two Linux FreeS/WAN boxes.
-</P>
-
-<P>See also these related documents:</P>
-<UL>
-<LI>our <A HREF="quickstart.html#quickstart">quickstart</A> guide
-to <A HREF="glossary.html#carpediem">opportunistic encryption</A></LI>
-<LI>our guide to configuration with 
-<A HREF="policygroups.html#policygroups">policy groups</A></LI>
-<LI>our  
-<A HREF="adv_config.html#adv_config">advanced configuration</A>
-document</LI>
-</UL>
-<P>
-The network-to-network setup allows you to connect two office 
-networks into one Virtual Private Network, while the Road Warrior 
-connection secures a laptop's telecommute to work.
-Our examples also show the basic procedure on the Linux FreeS/WAN side where 
-another IPsec peer is in play.</P>
-
-<P>
-Shortcut to <A HREF="#config.netnet">net-to-net</A>.<BR>
-Shortcut to <A HREF="#config.rw">Road Warrior</A>.
-</P>
-
-<H2>Requirements</H2>
-
-<P>To configure the network-to-network connection you must have:</P>
-<UL>
-<LI>two Linux gateways with static IPs</LI>
-<LI>a network behind each gate. Networks must have non-overlapping IP ranges.</LI>
-<LI>Linux FreeS/WAN <A HREF="install.html#install">installed</A>
-  on both gateways</LI>
-<LI><A HREF="http://www.tcpdump.org"><VAR>tcpdump</VAR></A> on the local gate, 
-  to test the connection</LI>
-</UL>
-<P>For the Road Warrior you need:</P>
-<UL>
-<LI>one Linux box with a static IP</LI>
-<LI>a Linux laptop with a dynamic IP</LI>
-<LI>Linux FreeS/WAN installed on both</LI>
-<LI>for testing, <VAR>tcpdump</VAR> on your gateway or laptop</LI>
-</UL>
-
-<P>If both IPs are dynamic, your situation is a bit trickier. Your best bet
-is a variation on the <A HREF="#config.rw">Road Warrior</A>, as described
-in <A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00282.html">this mailing list message</A>.
-
-<H2><A name="config.netnet"></A>Net-to-Net connection</H2>
-
-
-<H3><A name="netnet.info.ex">Gather information</A></H3>
-
-<P>For each gateway, compile the following information:</P>
-<UL>
-<LI>gateway IP</LI>
-<LI>IP range of the subnet you will be protecting. This doesn't have to 
-  be your whole physical subnet.</LI>
-<LI>a name by which that gateway can identify itself for IPsec
-negotiations. Its form is a Fully Qualified Domain Name preceded by
-an @ sign, ie. @xy.example.com.
-<BR>It does not need to be within a domain that you own. It can be a made-up
-name.</LI>
-</UL>
-
-
-<H4>Get your leftrsasigkey</H4>
-<P>On your local Linux FreeS/WAN gateway, print your IPsec public key:</P>
-<PRE>    ipsec showhostkey --left</PRE>
-<P>The output should look like this (with the key shortened for easy
- reading):</P>
-<PRE>    # RSA 2048 bits   xy.example.com   Fri Apr 26 15:01:41 2002
-    leftrsasigkey=0sAQOnwiBPt...</PRE>
-
-<P>Don't have a key? Use
-<A HREF="manpage.d/ipsec_newhostkey.8.html"><VAR>ipsec newhostkey</VAR></A>
-to create one.
-
-<H4>...and your rightrsasigkey</H4>
-<P>Get a console on the remote side:</P>
-<PRE>    ssh2 ab.example.com</PRE>
-<P>In that window, type:</P>
-<PRE>    ipsec showhostkey --right</PRE>
-<P>You'll see something like:</P>
-<PRE>    # RSA 2192 bits   ab.example.com   Thu May 16 15:26:20 2002
-    rightrsasigkey=0sAQOqH55O...</PRE>
-
-<H3>Edit <VAR>/etc/ipsec.conf</VAR></H3>
-
-<P>Back on the local gate, copy our template to <VAR>/etc/ipsec.conf</VAR>. 
-(on Mandrake, <VAR>/etc/freeswan/ipsec.conf</VAR>).
-Substitute the information you've gathered for our example data.</P>
-<PRE>conn net-to-net
-    left=192.0.2.2                 # Local vitals
-    leftsubnet=192.0.2.128/29      # 
-    leftid=@xy.example.com         #   
-    leftrsasigkey=0s1LgR7/oUM...   #
-    leftnexthop=%defaultroute      # correct in many situations 
-    right=192.0.2.9                # Remote vitals
-    rightsubnet=10.0.0.0/24        #
-    rightid=@ab.example.com        # 
-    rightrsasigkey=0sAQOqH55O...   #
-    rightnexthop=%defaultroute     # correct in many situations
-    auto=add                       # authorizes but doesn't start this 
-                                   # connection at startup</PRE>
-
-<P>
-"Left" and "right" should represent the machines that have FreeS/WAN installed
-on them, and "leftsubnet" and "rightsubnet" machines that are being protected.
-/32 is assumed for left/right and left/rightsubnet parameters.
-</P>
-
-<P>Copy <VAR>conn net-to-net</VAR> to the remote-side /etc/ipsec.conf.
-If you've made no other modifications to either <VAR>ipsec.conf</VAR>, 
-simply:</P>
-<PRE>    scp2 ipsec.conf root@ab.example.com:/etc/ipsec.conf</PRE>
-
-<H3>Start your connection</H3>
-
-<P>Locally, type:</P>
-<PRE>    ipsec auto --up net-to-net</PRE>
-
-<P>You should see:</P>
-<PRE>    104 "net-net" #223: STATE_MAIN_I1: initiate
-    106 "net-net" #223: STATE_MAIN_I2: sent MI2, expecting MR2
-    108 "net-net" #223: STATE_MAIN_I3: sent MI3, expecting MR3
-    004 "net-net" #223: STATE_MAIN_I4: ISAKMP SA established
-    112 "net-net" #224: STATE_QUICK_I1: initiate
-    004 "net-net" #224: STATE_QUICK_I2: sent QI2, IPsec SA established</PRE>
-
-<P>The important thing is <VAR>IPsec SA established</VAR>. If you're 
-unsuccessful, see our 
-<A HREF="trouble.html#trouble">troubleshooting tips</A>.</P>
-
-
-<H3>Do not MASQ or NAT packets to be tunneled</H3>
-
-<P>If you are using <A HREF="glossary.html#masq">IP masquerade</A> or 
-<A HREF="glossary.html#NAT.gloss">Network Address Translation (NAT)</A> 
-on either gateway, 
-you must now exempt the packets you wish to tunnel from this treatment.
-For example, if you have a rule like:</P>
-
-<PRE>iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -j MASQUERADE
-</PRE>
-
-<P>change it to something like:</P>
-<PRE>iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -d \! 192.0.2.128/29 -j MASQUERADE</PRE>
-
-<P>This may be necessary on both gateways.</P>
-
-
-<H3>Test your connection</H3>
-
-<P>Sit at one of your local subnet nodes (not the gateway), and ping a subnet 
-node on the other (again, not the gateway).</P>
-
-<PRE>    ping fileserver.toledo.example.com</PRE>
-
-<P>While still pinging, go to the local gateway and snoop your outgoing 
-interface, for example:</P>
-<PRE>    tcpdump -i ppp0</PRE>
-<P>You want to see ESP (Encapsulating Security Payload) packets moving
-<B>back and forth</B> between the two gateways at the same frequency as 
-your pings:</P>
-<PRE>    19:16:32.046220 192.0.2.2 > 192.0.2.9: ESP(spi=0x3be6c4dc,seq=0x3)
-    19:16:32.085630 192.0.2.9 > 192.0.2.2: ESP(spi=0x5fdd1cf8,seq=0x6)</PRE>
-
-<P>If you see this, congratulations are in order! You have a tunnel which 
-will protect any IP data from one subnet
-to the other, as it passes between the two gates.
-If not, go and <A HREF="trouble.html#trouble">troubleshoot</A>.</P>
-
-<P>Note: your new tunnel protects only net-net traffic, not 
-gateway-gateway, or gateway-subnet. If you need this (for example, if
-machines on one net need to securely contact a fileserver on the 
-IPsec gateway), you'll need to create
-<A HREF="adv_config.html#adv_config">extra connections</A>.</P>
-
-
-<H3>Finishing touches</H3>
-
-<P>Now that your connection works, name it something sensible, like:</P>
-<PRE>conn winstonnet-toledonet</PRE>
-<P>To have the tunnel come up on-boot, replace</P>
-<PRE>    auto=add</PRE>
-<P>with:</P>
-<PRE>    auto=start</PRE>
-<P>Copy these changes to the other side, for example:</P>
-<PRE>    scp2 ipsec.conf root@ab.example.com:/etc/ipsec.conf</PRE>
-<P>Enjoy!</P>
-
-
-
-<H2><A name="config.rw"></A>Road Warrior Configuration</H2>
-
-<H3><A name="rw.info.ex">Gather information</A></H3>
-
-<P>You'll need to know:</P>
-<UL>
-<LI>the gateway's static IP</LI>
-<LI>the IP range of the subnet behind that gateway</LI>
-<LI>a name by which each side can identify itself for IPsec
-negotiations. Its form is a Fully Qualified Domain Name preceded by
-an @ sign, ie. @road.example.com.
-<BR>It does not need to be within a domain that you own. It can be a made-up
-name.</LI>
-</UL>
-
-<H4>Get your leftrsasigkey...</H4>
-<P>On your laptop, print your IPsec public key:</P>
-<PRE>    ipsec showhostkey --left</PRE>
-<P>The output should look like this (with the key shortened for easy
- reading):</P>
-<PRE>    # RSA 2192 bits   road.example.com   Sun Jun  9 02:45:02 2002
-    leftrsasigkey=0sAQPIPN9uI...</PRE>
-
-<P>Don't have a key? See 
-<A HREF="old_config.html#genrsakey">these instructions</A>.
-
-
-<H4>...and your rightrsasigkey</H4>
-<P>Get a console on the gateway:</P>
-<PRE>    ssh2 xy.example.com</PRE>
-<P>View the gateway's public key with:</P>
-<PRE>    ipsec showhostkey --right</PRE>
-<P>This will yield something like</P>
-<PRE>    # RSA 2048 bits   xy.example.com   Fri Apr 26 15:01:41 2002
-    rightrsasigkey=0sAQOnwiBPt...</PRE>
- 
-
-<H3>Customize <VAR>/etc/ipsec.conf</VAR></H3>
-
-<P>On your laptop, copy this template to <VAR>/etc/ipsec.conf</VAR>. 
-(on Mandrake, <VAR>/etc/freeswan/ipsec.conf</VAR>).
-Substitute the information you've gathered for our example data.</P>
-<PRE>conn road
-    left=%defaultroute             # Picks up our dynamic IP 
-    leftnexthop=%defaultroute      # 
-    leftid=@road.example.com       # Local information
-    leftrsasigkey=0sAQPIPN9uI...   #
-    right=192.0.2.10               # Remote information
-    rightsubnet=10.0.0.0/24        #
-    rightid=@xy.example.com        # 
-    rightrsasigkey=0sAQOnwiBPt...  #
-    auto=add                       # authorizes but doesn't start this
-                                   # connection at startup</PRE>
-
-<P>The template for the gateway is different. Notice how it
-reverses <VAR>left</VAR> and <VAR>right</VAR>, in keeping with our
-convention that <STRONG>L</STRONG>eft is <STRONG>L</STRONG>ocal, 
-<STRONG>R</STRONG>ight <STRONG>R</STRONG>emote. Be sure to switch your
-rsasigkeys in keeping with this.</P>
-
-<PRE>    ssh2 xy.example.com
-    vi /etc/ipsec.conf</PRE>
-
-<P>and add:</P>
-
-<PRE>conn road
-    left=192.0.2.2                 # Gateway's information
-    leftid=@xy.example.com         #
-    leftsubnet=192.0.2.128/29      #
-    leftrsasigkey=0sAQOnwiBPt...   #
-    rightnexthop=%defaultroute     # correct in many situations
-    right=%any                     # Wildcard: we don't know the laptop's IP
-    rightid=@road.example.com      #
-    rightrsasigkey=0sAQPIPN9uI...  #
-    auto=add                       # authorizes but doesn't start this
-                                   # connection at startup</PRE>
-
-
-
-<H3>Start your connection</H3>
-
-<P>You must start the connection from the Road Warrior side. On your laptop,
-type:</P>
-<PRE>    ipsec auto --start net-to-net</PRE>
-
-<P>You should see:</P>
-<PRE>104 "net-net" #223: STATE_MAIN_I1: initiate
-106 "road" #301: STATE_MAIN_I2: sent MI2, expecting MR2
-108 "road" #301: STATE_MAIN_I3: sent MI3, expecting MR3
-004 "road" #301: STATE_MAIN_I4: ISAKMP SA established
-112 "road" #302: STATE_QUICK_I1: initiate
-004 "road" #302: STATE_QUICK_I2: sent QI2, IPsec SA established</PRE>
-
-<P>Look for <VAR>IPsec SA established</VAR>. If you're 
-unsuccessful, see our 
-<A HREF="trouble.html#trouble">troubleshooting tips</A>.</P>
-
-
-
-<H3>Do not MASQ or NAT packets to be tunneled</H3>
-
-<P>If you are using <A HREF="glossary.html#masq">IP masquerade</A> or
-<A HREF="glossary.html#NAT.gloss">Network Address Translation (NAT)</A>
-on either gateway,
-you must now exempt the packets you wish to tunnel from this treatment.
-For example, if you have a rule like:</P>
-
-<PRE>iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -j MASQUERADE
-</PRE>
-
-<P>change it to something like:</P>
-<PRE>iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -d \! 192.0.2.128/29 -j MASQUERADE</PRE>
-
-
-<H3>Test your connection</H3>
-
-<P>From your laptop, ping a subnet node behind the remote gateway. Do not
-choose the gateway itself for this test.</P>
-
-<PRE>    ping ns.winston.example.com</PRE>
-
-<P>Snoop the packets exiting the laptop, with a command like:</P>
-<PRE>    tcpdump -i wlan0</PRE>
-<P>You have success if you see (Encapsulating Security Payload) packets 
-travelling <B>in both directions</B>:</P>
-
-<PRE>    19:16:32.046220 192.0.2.2 > 192.0.2.9: ESP(spi=0x3be6c4dc,seq=0x3)
-    19:16:32.085630 192.0.2.9 > 192.0.2.2: ESP(spi=0x5fdd1cf8,seq=0x6)</PRE>
-
-
-<P>If you do, great! Traffic between your Road Warrior and the net
-behind your gateway is protected.
-If not, see our 
-<A HREF="trouble.html#trouble">troubleshooting hints</A>.</P>
-
-<P>Your new tunnel protects only traffic addressed to the net, not to 
-the IPsec gateway itself. If you need the latter, you'll want to make an 
-<A HREF="adv_config.html#adv_config">extra tunnel.</A>.</P>
-
-<H3>Finishing touches</H3>
-
-<P>On both ends, name your connection wisely, like:</P>
-<PRE>conn mike-to-office</PRE>
-<P><B>On the laptop only,</B> replace</P>
-<PRE>    auto=add</PRE>
-<P>with:</P>
-<PRE>    auto=start</PRE>
-<P>so that you'll be connected on-boot.</P>
-<P>Happy telecommuting!</P>
-
-<H3>Multiple Road Warriors</H3>
-
-<P>If you're using RSA keys, as we did in this example, you can add
-as many Road Warriors as you like.  The left/rightid
-parameter lets Linux FreeS/WAN distinguish between multiple Road Warrior 
-peers, each with its own public key.</P>
-
-<P>The situation is different for shared secrets (PSK). During a 
-PSK negotiation, ID information is not available at the time Pluto 
-is trying to determine which secret to use, so, effectively, you can 
-only define one Roadwarrior connection. All your PSK road warriors
-must therefore share one secret.</P>
-
-
-<H2>What next?</H2>
-
-<P>Using the principles illustrated here, you can try variations such as:
-<UL>
-<LI>a telecommuter with a static IP</LI>
-<LI>a road warrior with a subnet behind it</LI>
-</UL>
-<P>Or, look at some of our <A HREF="adv_config.html#adv_config">more complex configuration examples.</A>.</P>
-</BODY>
-</HTML>
diff --git a/doc/src/crosscompile.html b/doc/src/crosscompile.html
deleted file mode 100644
index c488957c8..000000000
--- a/doc/src/crosscompile.html
+++ /dev/null
@@ -1,105 +0,0 @@
-<HTML>

-<HEAD>

-	<TITLE>Cross Compiling FreeS/WAN</TITLE>

-      <meta name="keywords" content="Linux, IPSEC, VPN, Security, FreeSWAN, cross, compile">

-<!--

-     Written by Ken Bantoft <ken@freeswan.ca> for the Linux FreeS/WAN project

-     Freely distributable under the GNU General Public License

-

-     More information at www.freeswan.org

-     Feedback to users@lists.freeswan.org

-

-CVS information:

-RCS ID:          $Id: crosscompile.html,v 1.1 2004/03/15 20:35:24 as Exp $

-Last changed:    $Date: 2004/03/15 20:35:24 $

-Revision number: $Revision: 1.1 $

-

-CVS revision numbers do not correspond to FreeS/WAN release numbers.

--->

- 

-</HEAD>

-<BODY>

-

-<H1><A NAME="guide"></A>Linux FreeS/WAN Cross Compiling Guide</H1>

-

-<H2><A NAME="overview"></A>Overview</H2>

-

-<P>

-This document provides general instructions on how to cross compile 

-FreeS/WAN, 

-that is - compile it for another architecture (eg: StrongARM)</P>

-<OL>

-	<LI><A HREF="#setup">Setting up your environment</A>.</LI>

-	<LI><A HREF="#building">Building</A>.</LI>

-	<LI><A HREF="#common">Common Problems</A>.</LI>

-</OL>

-<H2><A NAME="setup"></A>Setting up your Environment</H2>

-<H3>Enviroment Variables</H3>

-<P>There are a number of environment variables you can set to help facilitate

-cross compiling FreeS/WAN.  All examples will are using the bash shell. 

-</P>

-<P>The following is an example of the how to set the environment variables if

-you were cross compiling using the Embedix ARM toolchain, to build for an embedded

-device like the Sharp Zaurus.  Set these while you are in the FreeS/WAN directory.

-It is often simpler to put the entire list into a script (eg: cross-setup.sh), and 

-then "source cross-setup.sh" or similar.

-<pre>

-export ARCH=arm

-export CC=/opt/Embedix/tools/bin/arm-linux-gcc

-export LD=/opt/Embedix/tools/bin/arm-linux-ld

-export RANLIB=/opt/Embedix/tools/bin/arm-linux-ranlib 

-export AR=/opt/Embedix/tools/bin/arm-linux-ar 

-export AS=/opt/Embedix/tools/bin/arm-linux-as 

-export STRIP=/opt/Embedix/tools/bin/arm-linux-strip 

-export KERNELSRC=/zaurus/kernel-2.4.6

-export LD_LIBRARY_PATH=/opt/Embedix/tools/lib/gcc-lib/arm-linux/2.95.2/

-export PATH=$PATH:/opt/Embedix/tools/bin

-export DESTDIR=/zaurus/binaries

-</pre>

-In the example above, we setup all of the usual gcc + bin-utils programs, 

-as well as setting the LD_LIBRARY_PATH to our cross-compiled system libraries, 

-and DESTDIR to our output directory.

-</P>

-

-<H3>Kernel Source</H3>

-<P>Place a copy of the kernel source, setup for your target device somewhere on

-your filesystem and set KERNELSRC= to this directory.  You will need to prepare 

-your kernel source treefirst, by running "make menuconfig && make dep && make 

-modules".  Once this is done, you can move on to building FreeS/WAN</P>

-

-<H2><A NAME="building"></A>Building</H2>

-<H3>The Make Process</H3>

-<P>There are two parts to building FreeS/WAN - the userland programs and utilities, 

-and the ipsec.o kernel module.  Each can be built seperatly, making debugging the

-build process simpler.

-</P>

-<P>Step 1 is to run "make programs".  This will build the required libs 

-(libfreeswan.a) as well as all of the userland tools (pluto, whack, etc...).  

-Provided your environment variables are set correctly, you should see the output

-using your specified gcc (arm-linux-gcc for our example), ld, as, ar and 

-ranlib.</P>

-<P>If this completes successfully, you can run "make install" to install a copy of

-all of the binaries, man pages and other documentation to DESTDIR.</P>

-<P>Step 2 is to build the ipsec.o module.  This is done with "make oldmod", which

-should change into the KERNELSRC directory and then compile and link the required

-files to generate an ipsec.o file.  If this is successful, you will end up with an

-ipsec.o file in your FreeS/WAN directory, under linux/net/ipsec/.</P>

-<P>Remember to install this to /lib/modules/$kernelversion/kernel/net/ipsec/ on 

-your target machine.</P>

-

-

-

-<H2><A NAME="common"></A>Common Problems Building</H2>

-<P>Here is a list of common problems/errors you may run into when cross compiling

-FreeS/WAN.</P>

-<UL>

-<LI>gmp.h, libgmp not found, error with -lgmp.  All of these refer to the GNU Math 

-Precision Library.  You will need to have already built this for your target 

-system.  Place libgmp.so in LD_LIBRARY_PATH, and ensure the headers are in your

-include path as well.

-</UL>

-

-<P><BR><BR>

-</P>

-</BODY>

-</HTML>

diff --git a/doc/src/draft-richardson-ipsec-opportunistic.html b/doc/src/draft-richardson-ipsec-opportunistic.html
deleted file mode 100644
index 87a13365a..000000000
--- a/doc/src/draft-richardson-ipsec-opportunistic.html
+++ /dev/null
@@ -1,2456 +0,0 @@
-<html><head><title>Opportunistic Encryption using The Internet Key Exchange (IKE)</title>
-<STYLE type='text/css'>
-    .title { color: #990000; font-size: 22px; line-height: 22px; font-weight: bold; text-align: right;
-             font-family: helvetica, arial, sans-serif }
-    .filename { color: #666666; font-size: 18px; line-height: 28px; font-weight: bold; text-align: right;
-                  font-family: helvetica, arial, sans-serif }
-    p.copyright { color: #000000; font-size: 10px;
-                  font-family: verdana, charcoal, helvetica, arial, sans-serif }
-    p { margin-left: 2em; margin-right: 2em; }
-    li { margin-left: 3em;  }
-    ol { margin-left: 2em; margin-right: 2em; }
-    ul.text { margin-left: 2em; margin-right: 2em; }
-    pre { margin-left: 3em; color: #333333 }
-    ul.toc { color: #000000; line-height: 16px;
-             font-family: verdana, charcoal, helvetica, arial, sans-serif }
-    H3 { color: #333333; font-size: 16px; line-height: 16px; font-family: helvetica, arial, sans-serif }
-    H4 { color: #000000; font-size: 14px; font-family: helvetica, arial, sans-serif }
-    TD.header { color: #ffffff; font-size: 10px; font-family: arial, helvetica, san-serif; valign: top }
-    TD.author-text { color: #000000; font-size: 10px;
-                     font-family: verdana, charcoal, helvetica, arial, sans-serif }
-    TD.author { color: #000000; font-weight: bold; margin-left: 4em; font-size: 10px; font-family: verdana, charcoal, helvetica, arial, sans-serif }
-     A:link { color: #990000; font-weight: bold;
-              font-family: MS Sans Serif, verdana, charcoal, helvetica, arial, sans-serif }
-     A:visited { color: #333333; font-weight: bold;
-                 font-family: MS Sans Serif, verdana, charcoal, helvetica, arial, sans-serif }
-     A:name { color: #333333; font-weight: bold;
-              font-family: MS Sans Serif, verdana, charcoal, helvetica, arial, sans-serif }
-    .link2 { color:#ffffff; font-weight: bold; text-decoration: none;
-             font-family: monaco, charcoal, geneva, MS Sans Serif, helvetica, monotype, verdana, sans-serif;
-             font-size: 9px }
-    .RFC { color:#666666; font-weight: bold; text-decoration: none;
-           font-family: monaco, charcoal, geneva, MS Sans Serif, helvetica, monotype, verdana, sans-serif;
-           font-size: 9px }
-    .hotText { color:#ffffff; font-weight: normal; text-decoration: none;
-               font-family: charcoal, monaco, geneva, MS Sans Serif, helvetica, monotype, verdana, sans-serif;
-               font-size: 9px }
-</style>
-</head>
-<body bgcolor="#ffffff" text="#000000" alink="#000000" vlink="#666666" link="#990000">
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<table width="66%" border="0" cellpadding="0" cellspacing="0"><tr><td><table width="100%" border="0" cellpadding="2" cellspacing="1">
-<tr valign="top"><td width="33%" bgcolor="#666666" class="header">Independent submission</td><td width="33%" bgcolor="#666666" class="header">M. Richardson</td></tr>
-<tr valign="top"><td width="33%" bgcolor="#666666" class="header">Internet-Draft</td><td width="33%" bgcolor="#666666" class="header">SSW</td></tr>
-<tr valign="top"><td width="33%" bgcolor="#666666" class="header">Expires: November 19, 2003</td><td width="33%" bgcolor="#666666" class="header">D. Redelmeier</td></tr>
-<tr valign="top"><td width="33%" bgcolor="#666666" class="header">&nbsp;</td><td width="33%" bgcolor="#666666" class="header">Mimosa</td></tr>
-<tr valign="top"><td width="33%" bgcolor="#666666" class="header">&nbsp;</td><td width="33%" bgcolor="#666666" class="header">May 21, 2003</td></tr>
-</table></td></tr></table>
-<div align="right"><font face="monaco, MS Sans Serif" color="#990000" size="+3"><b><br><span class="title">Opportunistic Encryption using The Internet Key Exchange (IKE)</span></b></font></div>
-<div align="right"><font face="monaco, MS Sans Serif" color="#666666" size="+2"><b><span class="filename">draft-richardson-ipsec-opportunistic-11.txt</span></b></font></div>
-<font face="verdana, helvetica, arial, sans-serif" size="2">
-
-<h3>Status of this Memo</h3>
-<p>
-This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026.</p>
-<p>
-Internet-Drafts are working documents of the Internet Engineering
-Task Force (IETF), its areas, and its working groups.
-Note that other groups may also distribute working documents as
-Internet-Drafts.</p>
-<p>
-Internet-Drafts are draft documents valid for a maximum of six months
-and may be updated, replaced, or obsoleted by other documents at any time.
-It is inappropriate to use Internet-Drafts as reference material or to cite
-them other than as "work in progress."</p>
-<p>
-The list of current Internet-Drafts can be accessed at
-<a href='http://www.ietf.org/ietf/1id-abstracts.txt'>http://www.ietf.org/ietf/1id-abstracts.txt</a>.</p>
-<p>
-The list of Internet-Draft Shadow Directories can be accessed at
-<a href='http://www.ietf.org/shadow.html'>http://www.ietf.org/shadow.html</a>.</p>
-<p>
-This Internet-Draft will expire on November 19, 2003.</p>
-
-<h3>Copyright Notice</h3>
-<p>
-Copyright (C) The Internet Society (2003). All Rights Reserved.</p>
-
-<h3>Abstract</h3>
-
-<p>
-This document describes opportunistic encryption (OE) using the Internet Key
-Exchange (IKE) and IPsec.  
-Each system administrator adds new
-resource records to his or her Domain Name System (DNS) to support
-opportunistic encryption. The objective is to allow encryption for secure communication without
-any pre-arrangement specific to the pair of systems involved.
-  
-</p>
-<p>
-DNS is used to distribute the public keys of each
-system involved. This is resistant to passive attacks. The use of DNS
-Security (DNSSEC) secures this system against active attackers as well. 
-  
-</p>
-<p>
-As a result, the administrative overhead is reduced
-from the square of the number of systems to a linear dependence, and it becomes  
-possible to make secure communication the default even
-when the partner is not known in advance.
-  
-</p>
-<p>
-This document is offered up as an Informational RFC.
-  
-</p><a name="toc"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<h3>Table of Contents</h3>
-<ul compact class="toc">
-<b><a href="#anchor1">1.</a>&nbsp;
-Introduction<br></b>
-<b><a href="#anchor6">2.</a>&nbsp;
-Overview<br></b>
-<b><a href="#anchor13">3.</a>&nbsp;
-Specification<br></b>
-<b><a href="#anchor31">4.</a>&nbsp;
-Impacts on IKE<br></b>
-<b><a href="#anchor38">5.</a>&nbsp;
-DNS issues<br></b>
-<b><a href="#anchor42">6.</a>&nbsp;
-Network address translation interaction<br></b>
-<b><a href="#anchor46">7.</a>&nbsp;
-Host implementations<br></b>
-<b><a href="#anchor47">8.</a>&nbsp;
-Multi-homing<br></b>
-<b><a href="#anchor48">9.</a>&nbsp;
-Failure modes<br></b>
-<b><a href="#anchor52">10.</a>&nbsp;
-Unresolved issues<br></b>
-<b><a href="#anchor54">11.</a>&nbsp;
-Examples<br></b>
-<b><a href="#securityconsiderations">12.</a>&nbsp;
-Security considerations<br></b>
-<b><a href="#anchor79">13.</a>&nbsp;
-IANA Considerations<br></b>
-<b><a href="#anchor80">14.</a>&nbsp;
-Acknowledgments<br></b>
-<b><a href="#rfc.references1">&#167;</a>&nbsp;
-Normative references<br></b>
-<b><a href="#rfc.authors">&#167;</a>&nbsp;
-Authors' Addresses<br></b>
-<b><a href="#rfc.copyright">&#167;</a>&nbsp;
-Full Copyright Statement<br></b>
-</ul>
-<br clear="all">
-
-<a name="anchor1"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.1"></a><h3>1.&nbsp;Introduction</h3>
-
-<a name="rfc.section.1.1"></a><h4><a name="anchor2">1.1</a>&nbsp;Motivation</h4>
-
-<p>
-The objective of opportunistic encryption is to allow encryption without
-any pre-arrangement specific to the pair of systems involved. Each
-system administrator adds
-public key information to DNS records to support opportunistic
-encryption and then enables this feature in the nodes' IPsec stack. 
-Once this is done, any two such nodes can communicate securely.
-
-</p>
-<p>
-This document describes opportunistic encryption as designed and
-mostly implemented by the Linux FreeS/WAN project.
-For project information, see http://www.freeswan.org.
-
-</p>
-<p>
-The Internet Architecture Board (IAB) and Internet Engineering
-Steering Group (IESG) have taken a strong stand that the Internet
-should use powerful encryption to provide security and
-privacy <a href="#RFC1984">[4]</a>.
-The Linux FreeS/WAN project attempts to provide a practical means to implement this policy. 
-  
-</p>
-<p>
-The project uses the IPsec, ISAKMP/IKE, DNS and DNSSEC
-protocols because they are
-standardized, widely available and can often be deployed very easily
-without changing hardware or software or retraining users. 
-  
-</p>
-<p>
-The extensions to support opportunistic encryption are simple.  No
-changes to any on-the-wire formats are needed.  The only changes are to 
-the policy decision making system.  This means that opportunistic
-encryption can be implemented with very minimal changes to an existing 
-IPsec implementation.
-  
-</p>
-<p>
-Opportunistic encryption creates a "fax effect". The proliferation
-of the fax machine was possible because it did not require that everyone
-buy one overnight. Instead, as each person installed one, the value
-of having one increased - as there were more people that could receive faxes.
-Once opportunistic encryption is installed it
-automatically recognizes 
-other boxes using opportunistic encryption, without any further configuration
-by the network 
-administrator. So, as opportunistic encryption software is installed on more
-boxes, its value 
-as a tool increases.
-
-</p>
-<p>
-This document describes the infrastructure to permit deployment of
-Opportunistic Encryption.
-
-</p>
-<p>
-The term S/WAN is a trademark of RSA Data Systems, and is used with permission
-by this project.
-  
-</p>
-<a name="rfc.section.1.2"></a><h4><a name="anchor3">1.2</a>&nbsp;Types of network traffic</h4>
-
-<p>
-    To aid in understanding the relationship between security processing and IPsec
-    we divide network traffic into four categories:
-    
-<blockquote class="text"><dl>
-<dt>* Deny:</dt>
-<dd> networks to which traffic is always forbidden.
-</dd>
-<dt>* Permit:</dt>
-<dd> networks to which traffic in the clear is permitted.
-</dd>
-<dt>* Opportunistic tunnel:</dt>
-<dd> networks to which traffic is encrypted if possible, but otherwise is in the clear  
-	    or fails depending on the default policy in place.	
-      
-</dd>
-<dt>* Configured tunnel:</dt>
-<dd> networks to which traffic must be encrypted, and traffic in the clear is never permitted.
-</dd>
-</dl></blockquote><p>
-</p>
-<p>
-Traditional firewall devices handle the first two categories. No authentication is required.
-The permit policy is currently the default on the Internet. 
-
-</p>
-<p>
-This document describes the third category - opportunistic tunnel, which is
-proposed as the new default for the Internet.
-
-</p>
-<p>
-  Category four, encrypt traffic or drop it, requires authentication of the
-  end points. As the number of end points is typically bounded and is typically
-  under a single authority, arranging for distribution of
-  authentication material, while difficult, does not require any new
-  technology. The mechanism described here provides an additional way to
-  distribute the authentication materials, that of a public key method that does not
-  require deployment of an X.509 based infrastructure.  
-
-</p>
-<p>
-Current Virtual Private Networks can often be replaced by an "OE paranoid"
-policy as described herein. 
-
-</p>
-<a name="rfc.section.1.3"></a><h4><a name="anchor4">1.3</a>&nbsp;Peer authentication in opportunistic encryption</h4>
-
-<p>
-  Opportunistic encryption creates tunnels between nodes that
-  are essentially strangers. This is done without any prior bilateral
-  arrangement. 
-  There is, therefore, the difficult question of how one knows to whom one is
-  talking.
-  
-</p>
-<p>
-  One possible answer is that since no useful
-  authentication can be done, none should be tried. This mode of operation is
-  named "anonymous encryption".  An active man-in-the-middle attack can be
-  used to thwart the privacy of this type of communication. 
-  Without peer authentication, there is no way to prevent this kind of attack.
-  
-</p>
-<p>
-Although a useful mode, anonymous encryption is not the goal of this
-project. Simpler methods are available that can achieve anonymous
-encryption only, but authentication of the peer is a desireable goal.
-The latter is achieved through key distribution in DNS, leveraging upon
-the authentication of the DNS in DNSSEC.
-
-</p>
-<p>
-  Peers are, therefore, authenticated with DNSSEC when available. Local policy 
-determines how much trust to extend when DNSSEC is not available.
-  
-</p>
-<p>
-  However, an essential premise of building private connections with
-  strangers is that datagrams received through opportunistic tunnels
-  are no more special than datagrams that arrive in the clear.
-  Unlike in a VPN, these datagrams should not be given any special
-  exceptions when it comes to auditing, further authentication or
-  firewalling.
-  
-</p>
-<p>
-  When initiating outbound opportunistic encryption, local 
-  configuration determines what happens if tunnel setup fails. It may be that
-  the packet goes out in the clear, or it may be dropped.
-  
-</p>
-<a name="rfc.section.1.4"></a><h4><a name="anchor5">1.4</a>&nbsp;Use of RFC2119 terms</h4>
-
-<p>
-   The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,
-   SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this
-   document, are to be interpreted as described in <a href="#RFC2119">[5]</a>
-</p>
-<a name="anchor6"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.2"></a><h3>2.&nbsp;Overview</h3>
-
-<a name="rfc.section.2.1"></a><h4><a name="anchor7">2.1</a>&nbsp;Reference diagram</h4>
-<br><hr size="1" shade="0">
-<a name="networkdiagram"></a>
-
-<p>The following network diagram is used in the rest of
-		this document as the canonical diagram:
-</p></font><pre>
-                          [Q]  [R]          
-                           .    .              AS2                 
-  [A]----+----[SG-A].......+....+.......[SG-B]-------[B]
-         |                 ......
-     AS1 |                 ..PI..
-         |                 ......
-  [D]----+----[SG-D].......+....+.......[C] AS3
-             
-
-           </pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-
-<p>
-</p><table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Reference Network Diagram&nbsp;</b></font><br></td></tr></table><hr size="1" shade="0">
-
-<p>
-    In this diagram, there are four end-nodes: A, B, C and D. 
-    There are three gateways, SG-A, SG-B, SG-D. A, D, SG-A and SG-D are part
-    of the same administrative authority, AS1. SG-A and SG-D are on two different exit
-    paths from organization 1. SG-B/B is an independent organization, AS2.
-    Nodes Q and R are nodes on the Internet. PI is the Public
-    Internet ("The Wild").
-    
-</p>
-<a name="rfc.section.2.2"></a><h4><a name="anchor8">2.2</a>&nbsp;Terminology</h4>
-
-<p>
-  The following terminology is used in this document:
-  
-</p>
-<blockquote class="text"><dl>
-<dt>Security gateway:</dt>
-<dd> a system that performs IPsec tunnel
-    mode encapsulation/decapsulation. [SG-x] in the diagram.
-</dd>
-<dt>Alice:</dt>
-<dd> node [A] in the diagram. When an IP address is needed, this is 192.1.0.65.
-</dd>
-<dt>Bob:</dt>
-<dd> node [B] in the diagram. When an IP address is needed, this is 192.2.0.66.
-</dd>
-<dt>Carol:</dt>
-<dd> node [C] in the diagram. When an IP address is needed, this is 192.1.1.67.
-</dd>
-<dt>Dave:</dt>
-<dd> node [D] in the diagram. When an IP address is needed, this is 192.3.0.68.
-</dd>
-<dt>SG-A:</dt>
-<dd> Alice's security gateway. Internally it is 192.1.0.1, externally it is 192.1.1.4.
-</dd>
-<dt>SG-B:</dt>
-<dd> Bob's security gateway. Internally it is 192.2.0.1, externally it is 192.1.1.5.
-</dd>
-<dt>SG-D:</dt>
-<dd> Dave's security gateway. Also Alice's backup security gateway. Internally it is 192.3.0.1, externally it is 192.1.1.6.
-</dd>
-<dt>-</dt>
-<dd> A single dash represents clear-text datagrams.
-</dd>
-<dt>=</dt>
-<dd> An equals sign represents phase 2 (IPsec) cipher-text
-        datagrams.
-</dd>
-<dt>~</dt>
-<dd> A single tilde represents clear-text phase 1 datagrams.
-</dd>
-<dt>#</dt>
-<dd> A hash sign represents phase 1 (IKE) cipher-text
-        datagrams.
-</dd>
-<dt>.</dt>
-<dd> A period represents an untrusted network of unknown
-        type.
-</dd>
-<dt>Configured tunnel:</dt>
-<dd> a tunnel that
-		  is directly and deliberately hand configured on participating gateways.
-		  Configured tunnels are typically given a higher level of
-		  trust than opportunistic tunnels.
-</dd>
-<dt>Road warrior tunnel:</dt>
-<dd> a configured tunnel connecting one
-		  node with a fixed IP address and one node with a variable IP address.
-		  A road warrior (RW) connection must be initiated by the
-		  variable node, since the fixed node cannot know the
-		  current address for the road warrior. 
-</dd>
-<dt>Anonymous encryption:</dt>
-<dd>
-	the process of encrypting a session without any knowledge of who the
-	other parties are. No authentication of identities is done.
-</dd>
-<dt>Opportunistic encryption:</dt>
-<dd>
-	the process of encrypting a session with authenticated knowledge of
-	who the other parties are.
-</dd>
-<dt>Lifetime:</dt>
-<dd>
-        the period in seconds (bytes or datagrams) for which a security
-	association will remain alive before needing to be re-keyed.
-</dd>
-<dt>Lifespan:</dt>
-<dd>
-        the effective time for which a security association remains useful. A
-	security association with a lifespan shorter than its lifetime would
-	be removed when no longer needed. A security association with a
-	lifespan longer than its lifetime would need to be re-keyed one or
-	more times.
-</dd>
-<dt>Phase 1 SA:</dt>
-<dd> an ISAKMP/IKE security association sometimes
-      referred to as a keying channel.
-</dd>
-<dt>Phase 2 SA:</dt>
-<dd> an IPsec security association.
-</dd>
-<dt>Tunnel:</dt>
-<dd> another term for a set of phase 2 SA (one in each direction).
-</dd>
-<dt>NAT:</dt>
-<dd> Network Address Translation
-    (see <a href="#RFC2663">[20]</a>).
-</dd>
-<dt>NAPT:</dt>
-<dd> Network Address and Port Translation
-    (see <a href="#RFC2663">[20]</a>).
-</dd>
-<dt>AS:</dt>
-<dd> an autonomous system (AS) is a group of systems (a network) that
-		are under the administrative control of a single organization.
-</dd>
-<dt>Default-free zone:</dt>
-<dd> 
-    a set of routers that maintain a complete set of routes to
-    all currently reachable destinations. Having such a list, these routers
-    never make use of a default route. A datagram with a destination address
-    not matching any route will be dropped by such a router.
-    
-</dd>
-</dl></blockquote><p>
-<a name="rfc.section.2.3"></a><h4><a name="anchor9">2.3</a>&nbsp;Model of operation</h4>
-
-<p>
-The opportunistic encryption security gateway (OE gateway) is a regular
-gateway node as described in <a href="#RFC0791">[2]</a> section 2.4 and  
-<a href="#RFC1009">[3]</a> with the additional capabilities described here and
-in <a href="#RFC2401">[7]</a>.  
-The algorithm described here provides a way to determine, for each datagram,
-whether or not to encrypt and tunnel the datagram. Two important things
-that must be determined are whether or not to encrypt and tunnel and, if
-so, the destination address or name of the tunnel end point which should be used. 
-
-</p>
-<a name="rfc.section.2.3.1"></a><h4><a name="anchor10">2.3.1</a>&nbsp;Tunnel authorization</h4>
-
-<p>
-The OE gateway determines whether or not to create a tunnel based on 
-the destination address of each packet. Upon receiving a packet with a destination
-address not recently seen, the OE gateway performs a lookup in DNS for an
-authorization resource record (see <a href="#TXT">Use of TXT delegation record</a>). The record is located using
-the IP address to perform a search in the in-addr.arpa (IPv4) or ip6.arpa
-(IPv6) maps. If an authorization record is found, the OE gateway 
-interprets this as a request for a tunnel to be formed.
-
-</p>
-<a name="rfc.section.2.3.2"></a><h4><a name="anchor11">2.3.2</a>&nbsp;Tunnel end-point discovery</h4>
-
-<p>
-The authorization resource record also provides the address or name of the tunnel
-end point which should be used.
-
-</p>
-<p>
-The record may also provide the public RSA key of the tunnel end point
-itself. This is provided for efficiency only. If the public RSA key is not 
-present, the OE gateway performs a second lookup to find a KEY 
-resource record for the end point address or name.
-
-</p>
-<p>
-Origin and integrity protection of the resource records is provided by 
-DNSSEC (<a href="#RFC2535">[16]</a>). <a href="#nodnssec">Restriction on unauthenticated TXT delegation records</a>
-documents an optional restriction on the tunnel end point if DNSSEC signatures
-are not available for the relevant records. 
-
-</p>
-<a name="rfc.section.2.3.3"></a><h4><a name="anchor12">2.3.3</a>&nbsp;Caching of authorization results</h4>
-
-<p>
-The OE gateway maintains a cache, in the forwarding plane, of
-source/destination pairs for which opportunistic encryption has been
-attempted. This cache maintains a record of whether or not OE was
-successful so that subsequent datagrams can be forwarded properly
-without additional delay. 
-
-</p>
-<p>
-Successful negotiation of OE instantiates a new security association. 
-Failure to negotiate OE results in creation of a 
-forwarding policy entry either to drop or transmit in the clear future
-datagrams. This negative cache is necessary to avoid the possibly lengthy process of repeatedly looking 
-up the same information.
-
-</p>
-<p>
-The cache is timed out periodically, as described in <a href="#teardown">Renewal and teardown</a>.
-This removes entries that are no longer
-being used and permits the discovery of changes in authorization policy.
-
-</p>
-<a name="anchor13"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.3"></a><h3>3.&nbsp;Specification</h3>
-
-<p>
-The OE gateway is modeled to have a forwarding plane and a control
-plane. A control channel, such as PF_KEY, connects the two planes. 
-(See <a href="#RFC2367">[6]</a>.)
-The forwarding plane performs per datagram operations. The control plane
-contains a keying 
-daemon, such as ISAKMP/IKE, and performs all authorization, peer authentication and
-key derivation functions.  
-
-</p>
-<a name="rfc.section.3.1"></a><h4><a name="anchor14">3.1</a>&nbsp;Datagram state machine</h4>
-
-<p>
-Let the OE gateway maintain a collection of objects -- a superset of the
-security policy database (SPD) specified in <a href="#RFC2401">[7]</a>. For
-each combination of source and destination address, an SPD
-object exists in one of five following states.
-Prior to forwarding each datagram, the
-responder uses the source and destination addresses to pick an entry from the SPD.
-The SPD then determines if and how the packet is forwarded.
-
-</p>
-<a name="rfc.section.3.1.1"></a><h4><a name="anchor15">3.1.1</a>&nbsp;Non-existent policy</h4>
-
-<p>
-If the responder does not find an entry, then this policy applies.
-The responder creates an entry with an initial state of "hold policy" and requests 
-keying material from the keying daemon. The responder does not forward the datagram,
-rather it attaches the datagram to the SPD entry as the  "first" datagram and retains it
-for eventual transmission in a new state. 
-
-
-</p>
-<a name="rfc.section.3.1.2"></a><h4><a name="anchor16">3.1.2</a>&nbsp;Hold policy</h4>
-
-<p>
-The responder requests keying material. If the interface to the keying
-system is lossy (PF_KEY, for instance, can be), the implementation 
-SHOULD include a mechanism to retransmit the
-keying request at a rate limited to less than 1 request per second.
-The responder does not forward the datagram. It attaches the 
-datagram to the SPD entry as the "last" datagram where it is retained 
-for eventual transmission. If there is
-a datagram already so stored, then that already stored datagram is discarded.
-
-</p>
-<p>
-Because the "first" datagram is probably a TCP SYN packet, the 
-responder retains the "first" datagram in an attempt to avoid waiting for a
-TCP retransmit. The responder retains the "last"
-datagram in deference to streaming protocols that find it useful to know
-how much data has been lost. These are recommendations to 
-decrease latency. There are no operational requirements for this.
-
-</p>
-<a name="rfc.section.3.1.3"></a><h4><a name="anchor17">3.1.3</a>&nbsp;Pass-through policy</h4>
-
-<p>
-The responder forwards the datagram using the normal forwarding table. 
-The responder enters this state only by command from the keying daemon, 
-and upon entering this state, also forwards the "first" and "last" datagrams.
-
-</p>
-<a name="rfc.section.3.1.4"></a><h4><a name="anchor18">3.1.4</a>&nbsp;Deny policy</h4>
-
-<p>
-The responder discards the datagram. The responder enters this state only by
-command  
-from the keying daemon, and upon entering this state, discards the "first"
-and "last" datagrams.  
-Local administration decides if further datagrams cause ICMP messages
-to be generated (i.e. ICMP Destination Unreachable, Communication
-Administratively Prohibited. type=3, code=13). 
-
-</p>
-<a name="rfc.section.3.1.5"></a><h4><a name="anchor19">3.1.5</a>&nbsp;Encrypt policy</h4>
-
-<p>
-The responder encrypts the datagram using the indicated security association database
-(SAD) entry.  The responder enters this state only by command from the keying daemon, and upon entering
-this state, releases and forwards the "first" and "last" datagrams using the
-new encrypt policy.  
-
-</p>
-<p>
-If the associated SAD entry expires because of byte, packet or time limits, then
-the entry returns to the Hold policy, and an expire message is sent to the keying daemon.
-
-</p>
-<p>
-All states may be created directly by the keying daemon while acting as a
-responder. 
-
-</p>
-<a name="rfc.section.3.2"></a><h4><a name="initclasses">3.2</a>&nbsp;Keying state machine - initiator</h4>
-
-<p>
-Let the keying daemon maintain a collection of objects. Let them be
-called "connections" or "conn"s. There are two categories of
-connection objects: classes and instances. A class represents an
-abstract policy - what could be. An instance represents an actual connection -  
-what is implemented at the time.
-
-</p>
-<p>
-Let there be two further subtypes of connections: keying channels (Phase
-1 SAs) and data channels (Phase 2 SAs). Each data channel object may have 
-a corresponding SPD and SAD entry maintained by the datagram state machine.
-
-</p>
-<p>
-For the purposes of opportunistic encryption, there MUST, at least, be
-connection classes known as "deny", "always-clear-text", "OE-permissive", and 
-"OE-paranoid".  
-The latter two connection classes define a set of source and/or destination
-addresses for which opportunistic encryption will be attempted. The administrator MAY set policy
-options in a number of additional places.  An implementation MAY create additional connection classes to further refine
-these policies.
-
-</p>
-<p>
-The simplest system may need only the "OE-permissive" connection, and would
-list its own (single) IP address as the source address of this policy and
-the wild-card address 0.0.0.0/0 as the destination IPv4 address. That is, the
-simplest policy is to try opportunistic encryption with all destinations. 
-
-</p>
-<p>
-The distinction between permissive and paranoid OE use will become clear 
-in the state transition differences. In general a permissive OE will, on
-failure, install a pass-through policy, while a paranoid OE will, on failure, 
-install a drop policy.
-
-</p>
-<p>
-In this description of the keying machine's state transitions, the states
-associated with the keying system itself are omitted because they are best documented in the keying system 
-(<a href="#RFC2407">[8]</a>, 
-<a href="#RFC2408">[9]</a> and <a href="#RFC2409">[10]</a> for ISAKMP/IKE),
-and the details are keying system specific. Opportunistic encryption is not
-dependent upon any specific keying protocol, but this document does provide
-requirements for those using ISAKMP/IKE to assure that implementations inter-operate.
-
-</p>
-<p>
-The state transitions that may be involved in communicating with the
-forwarding plane are omitted. PF_KEY and similar protocols have their own
-set of states required for message sends and completion notifications.
-
-</p>
-<p>
-Finally, the retransmits and recursive lookups that are normal for DNS are 
-not included in this description of the state machine.
-
-</p>
-<a name="rfc.section.3.2.1"></a><h4><a name="anchor20">3.2.1</a>&nbsp;Nonexistent connection</h4>
-
-<p>
-There is no connection instance for a given source/destination address pair.
-Upon receipt of a request for keying material for this
-source/destination pair, the initiator searches through the connection classes to
-determine the most appropriate policy. Upon determining an appropriate
-connection class, an instance object is created of that type. 
-Both of the OE types result in a potential OE connection.
-
-</p>
-<p>Failure to find an appropriate connection class results in an
-administrator defined default. 
-
-</p>
-<p>
-In each case, when the initiator finds an appropriate class for the new flow, 
-an instance connection is made of the class which matched.
-
-</p>
-<a name="rfc.section.3.2.2"></a><h4><a name="anchor21">3.2.2</a>&nbsp;Clear-text connection</h4>
-
-<p>
-The non-existent connection makes a transition to this state when an
-always-clear-text class is instantiated, or when an OE-permissive 
-connection fails. During the transition, the initiator creates a pass-through
-policy object in the forwarding plane for the appropriate flow.
-
-</p>
-<p>
-Timing out is the only way to leave this state
-(see <a href="#expiring">Expiring connection</a>).
-
-</p>
-<a name="rfc.section.3.2.3"></a><h4><a name="anchor22">3.2.3</a>&nbsp;Deny connection</h4>
-
-<p>
-The empty connection makes a transition to this state when a
-deny class is instantiated, or when an OE-paranoid connection fails. 
-During the transition, the initiator creates a deny policy object in the forwarding plane 
-for the appropriate flow.  
-
-</p>
-<p>
-Timing out is the only way to leave this state 
-(see <a href="#expiring">Expiring connection</a>).
-
-</p>
-<a name="rfc.section.3.2.4"></a><h4><a name="anchor23">3.2.4</a>&nbsp;Potential OE connection</h4>
-
-<p>
-The empty connection makes a transition to this state when one of either OE class is instantiated.
-During the transition to this state, the initiator creates a hold policy object in the 
-forwarding plane for the appropriate flow.  
-
-</p>
-<p>
-In addition, when making a transition into this state, DNS lookup is done in
-the reverse-map for a TXT delegation resource record (see <a href="#TXT">Use of TXT delegation record</a>).
-The lookup key is the destination address of the flow.
-
-</p>
-<p>
-There are three ways to exit this state: 
-
-<ol class="text">
-<li>DNS lookup finds a TXT delegation resource record.
-</li>
-<li>DNS lookup does not find a TXT delegation resource record.
-</li>
-<li>DNS lookup times out.
-</li>
-</ol><p>
-</p>
-<p>
-Based upon the results of the DNS lookup, the potential OE connection makes a
-transition to the pending OE connection state.  The conditions for a
-successful DNS look are:
-
-<ol class="text">
-<li>DNS finds an appropriate resource record
-</li>
-<li>It is properly formatted according to <a href="#TXT">Use of TXT delegation record</a>
-</li>
-<li> if DNSSEC is enabled, then the signature has been vouched for.
-</li>
-</ol><p>
-
-Note that if the initiator does not find the public key 
-present in the TXT delegation record, then the public key must 
-be looked up as a sub-state. Only successful completion of all the 
-DNS lookups is considered a success.
-
-</p>
-<p>
-If DNS lookup does not find a resource record or DNS times out, then the 
-initiator considers the receiver not OE capable. If this is an OE-paranoid instance, 
-then the potential OE connection makes a transition to the deny connection state.
-If this is an OE-permissive instance, then the potential OE connection makes a transition to the
-clear-text connection state.
-
-</p>
-<p>
-If the initiator finds a resource record but it is not properly formatted, or
-if DNSSEC is 
-enabled and reports a failure to authenticate, then the potential OE
-connection should make a 
-transition to the deny connection state. This action SHOULD be logged. If the
-administrator wishes to override this transition between states, then an
-always-clear class can be installed for this flow. An implementation MAY make
-this situation a new class.
-
-</p>
-<a name="rfc.section.3.2.4.1"></a><h4><a name="nodnssec">3.2.4.1</a>&nbsp;Restriction on unauthenticated TXT delegation records</h4>
-
-<p>
-An implementation SHOULD also provide an additional administrative control
-on delegation records and DNSSEC. This control would apply to delegation
-records (the TXT records in the reverse-map) that are not protected by
-DNSSEC.
-Records of this type are only permitted to delegate to their own address as
-a gateway. When this option is enabled, an active attack on DNS will be
-unable to redirect packets to other than the original destination.
-
-</p>
-<a name="rfc.section.3.2.5"></a><h4><a name="anchor24">3.2.5</a>&nbsp;Pending OE connection</h4>
-
-<p>
-The potential OE connection makes a transition to this state when 
-the initiator determines that all the information required from the DNS lookup is present.
-Upon entering this state, the initiator attempts to initiate keying to the gateway
-provided.  
-
-</p>
-<p>
-Exit from this state occurs either with a successfully created IPsec SA, or
-with a failure of some kind.  Successful SA creation results in a transition
-to the key connection state.
-
-</p>
-<p>
-Three failures have caused significant problems. They are clearly not the
-only possible failures from keying.
-
-</p>
-<p>
-Note that if there are multiple gateways available in the TXT delegation
-records, then a failure can only be declared after all have been
-tried. Further, creation of a phase 1 SA does not constitute success. A set
-of phase 2 SAs (a tunnel) is considered success.
-
-</p>
-<p>
-The first failure occurs when an ICMP port unreachable is consistently received
-without any other communication, or when there is silence from the remote
-end. This usually means that either the gateway is not alive, or the
-keying daemon is not functional. For an OE-permissive connection, the initiator makes a transition
-to the clear-text connection but with a low lifespan. For an OE-pessimistic connection,
-the initiator makes a transition to the deny connection again with a low lifespan. The lifespan in both 
-cases is kept low because the remote gateway may
-be in the process of rebooting or be otherwise temporarily unavailable. 
-
-</p>
-<p>
-The length of time to wait for the remote keying daemon to wake up is
-a matter of some debate. If there is a routing failure, 5 minutes is usually long enough for the network to
-re-converge. Many systems can reboot in that amount of
-time as well. However, 5 minutes is far too long for most users to wait to
-hear that they can not connect using OE. Implementations SHOULD make this a
-tunable parameter.
-
-</p>
-<p>
-The second failure occurs after a phase 1 SA has been created, but there is 
-either no response to the phase 2 proposal, or the initiator receives a 
-negative notify (the notify must be 
-authenticated). The remote gateway is not prepared to do OE at this time. 
-As before, the initiator makes a transition to the clear-text or the deny 
-connection based upon connection class, but this
-time with a normal lifespan. 
-
-</p>
-<p>
-The third failure occurs when there is signature failure while authenticating
-the remote gateway. This can occur when there has been a 
-key roll-over, but DNS has not caught up. In this case again, the initiator makes a 
-transition to the clear-text or the deny connection based
-upon the connection class. However, the lifespan depends upon the remaining
-time to live in the DNS. (Note that DNSSEC signed resource records have a different
-expiry time than non-signed records.) 
-
-</p>
-<a name="rfc.section.3.2.6"></a><h4><a name="keyed">3.2.6</a>&nbsp;Keyed connection</h4>
-
-<p>
-The pending OE connection makes a transition to this state when 
-session keying material (the phase 2 SAs) is derived. The initiator creates an encrypt
-policy in the forwarding plane for this flow.
-
-</p>
-<p>
-There are three ways to exit this state. The first is by receipt of an
-authenticated delete message (via the keying channel) from the peer. This is
-normal teardown and results in a transition to the expired connection state.
-
-</p>
-<p>
-The second exit is by expiry of the forwarding plane keying material. This
-starts a re-key operation with a transition back to pending OE
-connection. In general, the soft expiry occurs with sufficient time left
-to continue to use the keys. A re-key can fail, which may
-result in the connection failing to clear-text or deny as
-appropriate. In the event of a failure, the forwarding plane
-policy does not change until the phase 2 SA (IPsec SA) reaches its
-hard expiry.
-
-</p>
-<p>
-The third exit is in response to a negotiation from a remote
-gateway. If the forwarding plane signals the control plane that it has received an
-unknown SPI from the remote gateway, or an ICMP is received from the remote gateway
-indicating an unknown SPI, the initiator should consider that 
-the remote gateway has rebooted or restarted. Since these 
-indications are easily forged, the implementation must 
-exercise care.  The initiator should make a cautious 
-(rate-limited) attempt to re-key the connection. 
-
-</p>
-<a name="rfc.section.3.2.7"></a><h4><a name="expiring">3.2.7</a>&nbsp;Expiring connection</h4>
-
-<p>
-The initiator will periodically place each of the deny, clear-text, and keyed
-connections into this  
-sub-state. See <a href="#teardown">Renewal and teardown</a> for more details of how often this
-occurs. 
-The initiator queries the forwarding plane for last use time of the
-appropriate 
-policy. If the last use time is relatively recent, then the connection
-returns to the 
-previous deny, clear-text or keyed connection state. If not, then the
-connection enters 
-the expired connection state. 
-
-</p>
-<p>
-The DNS query and answer that lead to the expiring connection state are also
-examined. The DNS query may become stale. (A negative, i.e. no such record, answer
-is valid for the period of time given by the MINIMUM field in an attached SOA 
-record. See <a href="#RFC1034">[12]</a> section 4.3.4.)
-If the DNS query is stale, then a new query is made. If the results change, then the connection 
-makes a transition to a new state as described in potential OE connection state.
-
-</p>
-<p> 
-Note that when considering how stale a connection is, both outgoing SPD and
-incoming SAD must be queried as some flows may be unidirectional for some time.
-
-</p>
-<p>
-Also note that the policy at the forwarding plane is not updated unless there
-is a conclusion that there should be a change.
-
-</p>
-<a name="rfc.section.3.2.8"></a><h4><a name="anchor25">3.2.8</a>&nbsp;Expired connection</h4>
-
-<p>
-Entry to this state occurs when no datagrams have been forwarded recently via the
-appropriate SPD and SAD objects. The objects in the forwarding plane are
-removed (logging any final byte and packet counts if appropriate) and the
-connection instance in the keying plane is deleted. 
-
-</p>
-<p>
-The initiator sends an ISAKMP/IKE delete to clean up the phase 2 SAs as described in
-<a href="#teardown">Renewal and teardown</a>. 
-
-</p>
-<p>
-Whether or not to delete the phase 1 SAs
-at this time is left as a local implementation issue. Implementations
-that do delete the phase 1 SAs MUST send authenticated delete messages to
-indicate that they are doing so.  There is an advantage to keeping
-the phase 1 SAs until they expire - they may prove useful again in the 
-near future.
-
-</p>
-<a name="rfc.section.3.3"></a><h4><a name="anchor26">3.3</a>&nbsp;Keying state machine - responder</h4>
-
-<p>
-The responder has a set of objects identical to those of the initiator.
-
-</p>
-<p>
-The responder receives an invitation to create a keying channel from an initiator. 
-
-</p>
-<a name="rfc.section.3.3.1"></a><h4><a name="anchor27">3.3.1</a>&nbsp;Unauthenticated OE peer</h4>
-
-<p>
-Upon entering this state, the responder starts a DNS lookup for a KEY record for the
-initiator. 
-The responder looks in the reverse-map for a KEY record for the initiator if the
-initiator has offered an ID_IPV4_ADDR, and in the forward map if the
-initiator has offered an ID_FQDN type. (See <a href="#RFC2407">[8]</a> section 
-4.6.2.1.)
-
-</p>
-<p>
-The responder exits this state upon successful receipt of a KEY from DNS, and use of the key 
-to verify the signature of the initiator.
-
-</p>
-<p>
-Successful authentication of the peer results in a transition to the
-authenticated OE Peer state.
-
-</p>
-<p>
-Note that the unauthenticated OE peer state generally occurs in the middle of the key negotiation
-protocol. It is really a form of pseudo-state.
-
-</p>
-<a name="rfc.section.3.3.2"></a><h4><a name="anchor28">3.3.2</a>&nbsp;Authenticated OE Peer</h4>
-
-<p>
-The peer will eventually propose one or more phase 2 SAs. The responder uses the source and
-destination address in the proposal to 
-finish instantiating the connection state
-using the connection class table.
-The responder MUST search for an identical connection object at this point. 
-
-</p>
-<p> 
-If an identical connection is found, then the responder deletes the old instance, 
-and the new object makes a transition to the pending OE connection state. This means
-that new ISAKMP connections with a given peer will always use the latest
-instance, which is the correct one if the peer has rebooted in the interim.
-
-</p>
-<p> 
-If an identical connection is not found, then the responder makes the transition according to the 
-rules given for the initiator.
-
-</p>
-<p> 
-Note that if the initiator is in OE-paranoid mode and the responder is in 
-either always-clear-text or deny, then no communication is possible according
-to policy. An implementation is permitted to create new types of policies 
-such as "accept OE but do not initiate it". This is a local matter.
- 
-</p>
-<a name="rfc.section.3.4"></a><h4><a name="teardown">3.4</a>&nbsp;Renewal and teardown</h4>
-
-<a name="rfc.section.3.4.1"></a><h4><a name="anchor29">3.4.1</a>&nbsp;Aging</h4>
-
-<p>
-A potentially unlimited number of tunnels may exist. In practice, only a few
-tunnels are used during a period of time. Unused tunnels MUST, therefore, be
-torn down. Detecting when tunnels are no longer in use is the subject of this section.
-
-</p>
-<p>
-There are two methods for removing tunnels: explicit deletion or expiry. 
-
-</p>
-<p>
-Explicit deletion requires an IKE delete message. As the deletes
-MUST be authenticated, both ends of the tunnel must maintain the 
-key channel (phase 1 ISAKMP SA). An implementation which refuses to either maintain or
-recreate the keying channel SA will be unable to use this method.
-
-</p>
-<p>
-The tunnel expiry method, simply allows the IKE daemon to
-expire normally without attempting to re-key it.
-
-</p>
-<p>
-Regardless of which method is used to remove tunnels, the implementation requires 
-a method to determine if the tunnel is still in use.  The specifics are a
-local matter, but  the FreeS/WAN project uses the following criteria. These
-criteria are currently implemented in the key management daemon, but could
-also be implemented at the SPD layer using an idle timer.
-
-</p>
-<p>
-Set a short initial (soft) lifespan of 1 minute since many net flows last
-only a few seconds.
-
-</p>
-<p>
-At the end of the lifespan, check to see if the tunnel was used by
-traffic in either direction during the last 30 seconds. If so, assign a
-longer tentative lifespan of 20 minutes after which, look again. If the
-tunnel is not in use, then close the tunnel.
-
-</p>
-<p>
-The expiring state in the key management
-system (see <a href="#expiring">Expiring connection</a>) implements these timeouts.
-The timer above may be in the forwarding plane, 
-but then it must be re-settable. 
-
-</p>
-<p>
-The tentative lifespan is independent of re-keying; it is just the time when
-the tunnel's future is next considered. 
-(The term lifespan is used here rather than lifetime for this reason.) 
-Unlike re-keying, this tunnel use check is not costly and should happen
-reasonably frequently.
-
-</p>
-<p>
-A multi-step back-off algorithm is not considered worth the effort here.
-
-</p>
-<p>
-If the security gateway and the client host are the
-same and not a Bump-in-the-Stack or Bump-in-the-Wire implementation, tunnel
-teardown decisions MAY pay attention to TCP connection status as reported
-by the local TCP layer.  A still-open TCP connection is almost a guarantee that more traffic is
-expected. Closing of the only TCP connection through a tunnel is a
-strong hint that no more traffic is expected.
-
-</p>
-<a name="rfc.section.3.4.2"></a><h4><a name="anchor30">3.4.2</a>&nbsp;Teardown and cleanup</h4>
-
-<p>
-Teardown should always be coordinated between the two ends of the tunnel by 
-interpreting and sending delete notifications. There is a
-detailed sub-state in the expired connection state of the key manager that
-relates to retransmits of the delete notifications, but this is considered to 
-be a keying system detail.
-
-</p>
-<p>
-On receiving a delete for the outbound SAs of a tunnel (or some subset of
-them), tear down the inbound ones also and notify the remote end with a
-delete. If the local system receives a delete for a tunnel which is no longer in
-existence, then two delete messages have crossed paths. Ignore the delete.
-The operation has already been completed. Do not generate any messages in this
-situation. 
-
-</p>
-<p>
-Tunnels are to be considered as bidirectional entities, even though the
-low-level protocols don't treat them this way. 
-
-</p>
-<p>
-When the deletion is initiated locally, rather than as a
-response to a received delete, send a delete for (all) the
-inbound SAs of a tunnel.  If the local system does not receive a responding delete 
-for the outbound SAs, try re-sending the original
-delete. Three tries spaced 10 seconds apart seems a reasonable
-level of effort. A failure of the other end to respond after 3 attempts, 
-indicates that the possibility of further communication is unlikely. Remove the outgoing SAs.
-(The remote system may be a mobile node that is no longer present or powered on.)
-
-</p>
-<p>
-After re-keying, transmission should switch to using the new
-outgoing SAs (ISAKMP or IPsec) immediately, and the old leftover
-outgoing SAs should be cleared out promptly (delete should be sent
-for the outgoing SAs) rather than waiting for them to expire. This
-reduces clutter and minimizes confusion for the operator doing diagnostics.
-
-</p>
-<a name="anchor31"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.4"></a><h3>4.&nbsp;Impacts on IKE</h3>
-
-<a name="rfc.section.4.1"></a><h4><a name="anchor32">4.1</a>&nbsp;ISAKMP/IKE protocol</h4>
-
-<p>
-    The IKE wire protocol needs no modifications. The major changes are
-    implementation issues relating to how the proposals are interpreted, and from
-    whom they may come.
-    
-</p>
-<p>
-    As opportunistic encryption is designed to be useful between peers without
-    prior operator configuration, an IKE daemon must be prepared to negotiate
-    phase 1 SAs with any node. This may require a large amount of resources to 
-    maintain cookie state, as well as large amounts of entropy for nonces,
-    cookies and so on. 
-    
-</p>
-<p>
-    The major changes to support opportunistic encryption are at the IKE daemon
-    level. These changes relate to handling of key acquisition requests, lookup
-    of public keys and TXT records, and interactions with firewalls and other
-    security facilities that may be co-resident on the same gateway.
-    
-</p>
-<a name="rfc.section.4.2"></a><h4><a name="anchor33">4.2</a>&nbsp;Gateway discovery process</h4>
-
-<p>
-  In a typical configured tunnel, the address of SG-B is provided
-  via configuration. Furthermore, the mapping of an SPD entry to a gateway is
-  typically a 1:1 mapping. When the 0.0.0.0/0 SPD entry technique is used, then
-  the mapping to a gateway is determined by the reverse DNS records.
-  
-</p>
-<p>
-  The need to do a DNS lookup and wait for a reply will typically introduce a
-  new state and a new event source (DNS replies) to IKE. Although a
-synchronous DNS request can be implemented for proof of concept, experience
-is that it can cause very high latencies when a queue of queries must
-all timeout in series. 
-  
-</p>
-<p> 
-  Use of an asynchronous DNS lookup will also permit overlap of DNS lookups with
-  some of the protocol steps.
-  
-</p>
-<a name="rfc.section.4.3"></a><h4><a name="anchor34">4.3</a>&nbsp;Self identification</h4>
-
-<p>
-     SG-A will have to establish its identity. Use an
-     IPv4 ID in phase 1. 
-  
-</p>
-<p> There are many situations where the administrator of SG-A may not be
-      able to control the reverse DNS records for SG-A's public IP address.
-      Typical situations include dialup connections and most residential-type broadband Internet access 
-      (ADSL, cable-modem) connections. In these situations, a fully qualified domain
-      name that is under the control of SG-A's administrator may be used
-      when acting as an initiator only.
-      The FQDN ID should be used in phase 1. See <a href="#fqdn">Use of FQDN IDs</a>
-      for more details and restrictions.
-  
-</p>
-<a name="rfc.section.4.4"></a><h4><a name="anchor35">4.4</a>&nbsp;Public key retrieval process</h4>
-
-<p>
-     Upon receipt of a phase 1 SA proposal with either an IPv4 (IPv6) ID or
-     an FQDN ID, an IKE daemon needs to examine local caches and
-     configuration files to determine if this is part of a configured tunnel.
-     If no configured tunnels are found, then the implementation should attempt to retrieve
-     a KEY record from the reverse DNS in the case of an IPv4/IPv6 ID, or 
-     from the forward DNS in the case of FQDN ID.
-  
-</p>
-<p> 
-     It is reasonable that if other non-local sources of policy are used
-     (COPS, LDAP), they be consulted concurrently but some
-     clear ordering of policy be provided. Note that due to variances in
-     latency, implementations must wait for positive or negative replies from all sources
-     of policy before making any decisions.
-  
-</p>
-<a name="rfc.section.4.5"></a><h4><a name="anchor36">4.5</a>&nbsp;Interactions with DNSSEC</h4>
-
-<p>
-     The implementation described (1.98) neither uses DNSSEC directly to
-     explicitly verify the authenticity of zone information, nor uses the NXT
-     records to provide authentication of the absence of a TXT or KEY
-     record. Rather, this implementation uses a trusted path to a DNSSEC
-     capable caching resolver. 
-  
-</p>
-<p> 
-     To distinguish between an authenticated and an unauthenticated DNS
-     resource record, a stub resolver capable of returning DNSSEC
-     information MUST be used.
-  
-</p>
-<a name="rfc.section.4.6"></a><h4><a name="anchor37">4.6</a>&nbsp;Required proposal types</h4>
-
-<a name="rfc.section.4.6.1"></a><h4><a name="phase1id">4.6.1</a>&nbsp;Phase 1 parameters</h4>
-
-<p>
-        Main mode MUST be used.
-      
-</p>
-<p>
-	The initiator MUST offer at least one proposal using some combination
-	of: 3DES, HMAC-MD5 or HMAC-SHA1, DH group 2 or 5. Group 5 SHOULD be
-	proposed first.
-	<a href="#RFC3526">[11]</a>
-</p>
-<p>
-	The initiator MAY offer additional proposals, but the cipher MUST not
-	be weaker than 3DES. The initiator SHOULD limit the number of proposals
-	such that the IKE datagrams do not need to be fragmented.
-      
-</p>
-<p>
-	The responder MUST accept one of the proposals. If any configuration
-	of the responder is required then the responder is not acting in an
-	opportunistic way. 
-      
-</p>
-<p>
-        SG-A SHOULD use an ID_IPV4_ADDR (ID_IPV6_ADDR for IPv6) of the external
-        interface of SG-A for phase 1. (There is an exception, see <a href="#fqdn">Use of FQDN IDs</a>.) The authentication method MUST be RSA public key signatures. 
-        The RSA key for SG-A SHOULD be placed into a DNS KEY record in
-	the reverse space of SG-A (i.e. using in-addr.arpa).
-      
-</p>
-<a name="rfc.section.4.6.2"></a><h4><a name="phase2id">4.6.2</a>&nbsp;Phase 2 parameters</h4>
-
-<p>
-        SG-A MUST propose a tunnel between Alice and Bob, using 3DES-CBC
-        mode, MD5 or SHA1 authentication. Perfect Forward Secrecy MUST be specified.
-      
-</p>
-<p>
-        Tunnel mode MUST be used.
-      
-</p>
-<p>
-        Identities MUST be ID_IPV4_ADDR_SUBNET with the mask being /32.
-      
-</p>
-<p>
-        Authorization for SG-A to act on Alice's behalf is determined by
-        looking for a TXT record in the reverse-map at Alice's address.
-      
-</p>
-<p>
-        Compression SHOULD NOT be mandatory. It may be offered as an option.
-      
-</p>
-<a name="anchor38"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.5"></a><h3>5.&nbsp;DNS issues</h3>
-
-<a name="rfc.section.5.1"></a><h4><a name="KEY">5.1</a>&nbsp;Use of KEY record</h4>
-
-<p>
-    In order to establish their own identities, SG-A and SG-B SHOULD publish
-    their public keys in their reverse DNS via 
-    DNSSEC's KEY record.
-    See section 3 of <a href="#RFC2535">RFC 2535</a>[16].
-  
-</p>
-<p>
-<p>For example:
-</p></font><pre>
-KEY 0x4200 4 1 AQNJjkKlIk9...nYyUkKK8
-</pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-
-<blockquote class="text"><dl>
-<dt>0x4200:</dt>
-<dd> The flag bits, indicating that this key is prohibited
-    for confidentiality use (it authenticates the peer only, a separate
-    Diffie-Hellman exchange is used for
-    confidentiality), and that this key is associated with the non-zone entity
-    whose name is the RR owner name. No other flags are set.
-</dd>
-<dt>4:</dt>
-<dd>This indicates that this key is for use by IPsec.
-</dd>
-<dt>1:</dt>
-<dd>An RSA key is present.
-</dd>
-<dt>AQNJjkKlIk9...nYyUkKK8:</dt>
-<dd>The public key of the host as described in <a href="#RFC3110">[17]</a>.
-</dd>
-</dl></blockquote><p>
-</p>
-<p>Use of several KEY records allows for key rollover. The SIG Payload in
-  IKE phase 1 SHOULD be accepted if the public key given by any KEY RR
-  validates it.
-  
-</p>
-<a name="rfc.section.5.2"></a><h4><a name="TXT">5.2</a>&nbsp;Use of TXT delegation record</h4>
-
-<p>
-Alice publishes a TXT record to provide authorization for SG-A to act on
-Alice's behalf. 
-
-Bob publishes a TXT record to provide authorization for SG-B to act on Bob's
-behalf.  
-
-These records are located in the reverse DNS (in-addr.arpa) for their
-respective IP addresses.  The reverse DNS SHOULD be secured by DNSSEC, when
-it is deployed. DNSSEC is required to defend against active attacks.
-    
-</p>
-<p>
-      If Alice's address is P.Q.R.S, then she can authorize another node to
-      act on her behalf by publishing records at:
-           </p>
-</font><pre>
-S.R.Q.P.in-addr.arpa
-          </pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-<p>
-
-</p>
-<p>
-    The contents of the resource record are expected to be a string that
-    uses the following syntax, as suggested in <a href="#RFC1464">[15]</a>.
-    (Note that the reply to query may include other TXT resource
-    records used by other applications.)
-
-    <br><hr size="1" shade="0">
-<a name="txtformat"></a>
-</p>
-</font><pre>
-X-IPsec-Server(P)=A.B.C.D KEY
-          </pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-<p>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Format of reverse delegation record&nbsp;</b></font><br></td></tr></table><hr size="1" shade="0">
-
-</p>
-<blockquote class="text"><dl>
-<dt>P:</dt>
-<dd> Specifies a precedence for this record.  This is
-      similar to MX record preferences.  Lower numbers have stronger
-      preference. 
-      
-</dd>
-<dt>A.B.C.D:</dt>
-<dd> Specifies the IP address of the Security Gateway
-      for this client machine.
-      
-</dd>
-<dt>KEY:</dt>
-<dd> Is the encoded RSA Public key of the Security
-      Gateway. The key is provided here to avoid a second DNS lookup. If this
-      field is absent, then a KEY resource record should be looked up in the
-      reverse-map of A.B.C.D. The key is transmitted in base64 format.
-      
-</dd>
-</dl></blockquote><p>
-<p>
-  	The pieces of the record are separated by any whitespace
-	(space, tab, newline, carriage return). An ASCII space SHOULD
-	be used.
-    
-</p>
-<p>
-	In the case where Alice is located at a public address behind a 
-	security gateway that has no fixed address (or no control over its
-	reverse-map), then Alice may delegate to a public key by domain name.
-
-    <br><hr size="1" shade="0">
-<a name="txtfqdnformat"></a>
-</p>
-</font><pre>
-X-IPsec-Server(P)=@FQDN KEY
-          </pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-<p>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Format of reverse delegation record (FQDN version)&nbsp;</b></font><br></td></tr></table><hr size="1" shade="0">
-
-</p>
-<blockquote class="text"><dl>
-<dt>P:</dt>
-<dd> Is as above.
-      
-</dd>
-<dt>FQDN:</dt>
-<dd> Specifies the FQDN that the Security Gateway
-      will identify itself with. 
-      
-</dd>
-<dt>KEY:</dt>
-<dd> Is the encoded RSA Public key of the Security
-      Gateway. 
-</dd>
-</dl></blockquote><p>
-<p>
-	If there is more than one such TXT record with strongest (lowest
-	numbered) precedence, one Security Gateway is picked arbitrarily from
-	those specified in the strongest-preference records. 
-    
-</p>
-<a name="rfc.section.5.2.1"></a><h4><a name="anchor39">5.2.1</a>&nbsp;Long TXT records</h4>
-
-<p>
-  When packed into transport format, TXT records which are longer than 255
-  characters are divided into smaller &lt;character-strings&gt;.
-  (See <a href="#RFC1035">[13]</a> section 3.3 and 3.3.14.) These MUST
-  be reassembled into a single string for processing.
-  Whitespace characters in the base64 encoding are to be ignored.
-  
-</p>
-<a name="rfc.section.5.2.2"></a><h4><a name="anchor40">5.2.2</a>&nbsp;Choice of TXT record</h4>
-
-<p>
-	It has been suggested to use the KEY, OPT, CERT, or KX records
-	instead of a TXT record. None is satisfactory.
-  
-</p>
-<p> The KEY RR has a protocol field which could be used to indicate a new protocol, 
-and an algorithm field which could be used to
-        indicate different contents in the key data. However, the KEY record
-	is clearly not intended for storing what are really authorizations,
-	it is just for identities. Other uses have been discouraged.
-  
-</p>
-<p> OPT resource records, as defined in <a href="#RFC2671">[14]</a> are not 
-  intended to be used for storage of information. They are not to be loaded, 
-	cached or forwarded.  They are, therefore, inappropriate for use here.
-  
-</p>
-<p>
-    CERT records <a href="#RFC2538">[18]</a> can encode almost any set of
-    information. A custom type code could be used permitting any suitable
-    encoding to be stored, not just X.509.  According to
-    the RFC, the certificate RRs are to be signed internally which may add undesirable 
-and unnecessary bulk. Larger DNS records may require TCP instead of UDP transfers.
-  
-</p>
-<p>
-    At the time of protocol design, the CERT RR was not widely deployed and
-    could not be counted upon. Use of CERT records will be investigated,
-    and may be proposed in a future revision of this document.
-  
-</p>
-<p>
-    KX records are ideally suited for use instead of TXT records, but had not been deployed at
-    the time of implementation.
-
-</p>
-<a name="rfc.section.5.3"></a><h4><a name="fqdn">5.3</a>&nbsp;Use of FQDN IDs</h4>
-
-<p>
-      Unfortunately, not every administrator has control over the contents
-      of the reverse-map.  Where the initiator (SG-A) has no suitable reverse-map, the
-      authorization record present in the reverse-map of Alice may refer to a
-      FQDN instead of an IP address.
-    
-</p>
-<p>
-      In this case, the client's TXT record gives the fully qualified domain
-      name (FQDN) in place of its security gateway's IP address. 
-      The initiator should use the ID_FQDN ID-payload in phase 1.
-      A forward lookup for a KEY record on the FQDN must yield the
-      initiator's public key. 
-    
-</p>
-<p>
-      This method can also be used when the external address of SG-A is
-      dynamic. 
-    
-</p>
-<p>
-      If SG-A is acting on behalf of Alice, then Alice must still delegate
-      authority for SG-A to do so in her reverse-map. When Alice and SG-A
-      are one and the same (i.e. Alice is acting as an end-node) then there
-      is no need for this when initiating only. 
-</p>
-<p>However, Alice must still delegate to  herself if she wishes others to
-       initiate OE to her.  See <a href="#txtfqdnformat">Format of reverse delegation record (FQDN version)</a>.
-    
-</p>
-<a name="rfc.section.5.4"></a><h4><a name="anchor41">5.4</a>&nbsp;Key roll-over</h4>
-
-<p>
-Good cryptographic hygiene says that one should replace public/private key pairs
-periodically. Some administrators may wish to do this as often as daily. Typical DNS
-propagation delays are determined by the SOA Resource Record MINIMUM
-parameter, which controls how long DNS replies may be cached. For reasonable
-operation of DNS servers, administrators usually want this value to be at least several 
-hours, sometimes as a long as a day. This presents a problem - a new key MUST
-not be used prior to it propagating through DNS.
-
-</p>
-<p>
-This problem is dealt with by having the Security Gateway generate a new
-public/private key pair at least MINIMUM seconds in advance of using it. It
-then adds this key to the DNS (both as a second KEY record and in additional TXT
-delegation records) at key generation time. Note: only one key is allowed in
-each TXT record.
-
-</p>
-<p>
-When authenticating, all gateways MUST have available all public keys 
-that are found in DNS for this entity. This permits the authenticating end
-to check both the key for "today" and the key for "tomorrow". Note that it is 
-the end which is creating the signature (possesses the private key) that
-determines which key is to be used.
-
-</p>
-<a name="anchor42"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.6"></a><h3>6.&nbsp;Network address translation interaction</h3>
-
-<p>
-     There are no fundamentally new issues for implementing opportunistic encryption
-     in the presence of network address translation. Rather there are 
-     only the regular IPsec issues with NAT traversal.
-  
-</p>
-<p>
-     There are several situations to consider for NAT.
-  
-</p>
-<a name="rfc.section.6.1"></a><h4><a name="anchor43">6.1</a>&nbsp;Co-located NAT/NAPT</h4>
-
-<p>
-       If SG-A is also performing network address translation on
-       behalf of Alice, then the packet should be translated prior to
-       being subjected to opportunistic encryption. This is in contrast to
-       typically configured tunnels which often exist to bridge islands of 
-       private network address space. SG-A will use the translated source
-       address for phase 2, and so SG-B will look up that address to
-       confirm SG-A's authorization. 
-    
-</p>
-<p> In the case of NAT (1:1), the address space into which the
-        translation is done MUST be globally unique, and control over the
-	reverse-map is assumed.
-        Placing of TXT records is possible.
-    
-</p>
-<p> In the case of NAPT (m:1), the address will be SG-A. The ability to get
-        KEY and TXT records in place will again depend upon whether or not
-	there is administrative control over the reverse-map. This is
-	identical to situations involving a single host acting on behalf of
-	itself. 
-
-	FQDN style can be used to get around a lack of a reverse-map for
-	initiators only.
-    
-</p>
-<a name="rfc.section.6.2"></a><h4><a name="anchor44">6.2</a>&nbsp;SG-A behind NAT/NAPT</h4>
-
-<p>
-       If there is a NAT or NAPT between SG-A and SG-B, then normal IPsec
-       NAT traversal rules apply. In addition to the transport problem
-       which may be solved by other mechanisms, there
-       is the issue of what phase 1 and phase 2 IDs to use. While FQDN could
-       be used during phase 1 for SG-A, there is no appropriate ID for phase 2
-	that permits SG-B to determine that SG-A is in fact authorized to speak for Alice. 
-    
-</p>
-<a name="rfc.section.6.3"></a><h4><a name="anchor45">6.3</a>&nbsp;Bob is behind a NAT/NAPT</h4>
-
-<p>
-       If Bob is behind a NAT (perhaps SG-B), then there is, in fact, no way for
-       Alice to address a packet to Bob. Not only is opportunistic encryption
-       impossible, but it is also impossible for Alice to initiate any
-       communication to Bob. It may be possible for Bob to initiate in such
-       a situation. This creates an asymmetry, but this is common for 
-       NAPT.
-    
-</p>
-<a name="anchor46"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.7"></a><h3>7.&nbsp;Host implementations</h3>
-
-<p>
-  When Alice and SG-A are components of the same system, they are
-  considered to be a host implementation. The packet sequence scenario remains unchanged.
-
-</p>
-<p>
-  Components marked Alice are the upper layers (TCP, UDP, the
-  application), and SG-A is the IP layer.
-
-</p>
-<p>
-  Note that tunnel mode is still required. 
-
-</p>
-<p>
-  As Alice and SG-A are acting on behalf of themselves, no TXT based delegation
-  record is necessary for Alice to initiate. She can rely on FQDN in a
-  forward map. This is particularly attractive to mobile nodes such as 
-  notebook computers at conferences.
-  To respond, Alice/SG-A will still need an entry in Alice's reverse-map.
-
-</p>
-<a name="anchor47"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.8"></a><h3>8.&nbsp;Multi-homing</h3>
-
-<p> 
-If there are multiple paths between Alice and Bob (as illustrated in
-the diagram with SG-D), then additional DNS records are required to establish
-authorization. 
-
-</p>
-<p>
-In <a href="#networkdiagram">Reference Network Diagram</a>, Alice has two ways to
-exit her network: SG-A and SG-D. Previously SG-D has been ignored. Postulate
-that there are routers between Alice and her set of security gateways
-(denoted by the + signs and the marking of an autonomous system number for
-Alice's network). Datagrams may, therefore, travel to either SG-A or SG-D en
-route to Bob.
-
-</p>
-<p>
-As long as all network connections are in good order, it does not matter how
-datagrams exit Alice's network. When they reach either security gateway, the
-security gateway will find the TXT delegation record in Bob's reverse-map,
-and establish an SA with SG-B. 
-
-</p>
-<p>
-SG-B has no problem establishing that either of SG-A or SG-D may speak for
-Alice, because Alice has published two equally weighted TXT delegation records:
-    <br><hr size="1" shade="0">
-<a name="txtmultiexample"></a>
-</p>
-</font><pre>
-X-IPsec-Server(10)=192.1.1.5 AQMM...3s1Q==
-X-IPsec-Server(10)=192.1.1.6 AAJN...j8r9==
-          </pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-<p>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Multiple gateway delegation example for Alice&nbsp;</b></font><br></td></tr></table><hr size="1" shade="0">
-
-</p>
-<p>
-Alice's routers can now do any kind of load sharing needed. Both SG-A and SG-D send datagrams addressed to Bob through
-their tunnel to SG-B. 
-
-</p>
-<p>
-Alice's use of non-equal weight delegation records to show preference of one gateway over another, has relevance only when SG-B 
-is initiating to Alice. 
-
-</p>
-<p>
-If the precedences are the same, then SG-B has a more difficult time. It
-must decide which of the two tunnels to use. SG-B has no information about
-which link is less loaded, nor which security gateway has more cryptographic
-resources available. SG-B, in fact, has no knowledge of whether both gateways
-are even reachable.  
-
-</p>
-<p>
-The Public Internet's default-free zone may well know a good route to Alice,
-but the datagrams that SG-B creates must be addressed to either SG-A or SG-D;
-they can not be addressed to Alice directly.
-
-</p>
-<p>
-SG-B may make a number of choices:
-
-<ol class="text">
-<li>It can ignore the problem and round robin among the tunnels. This
-      causes losses during times when one or the other security gateway is
-      unreachable. If this worries Alice, she can change the weights in her
-      TXT delegation records.
-</li>
-<li>It can send to the gateway from which it most recently received datagrams. 
-      This assumes that routing and reachability are symmetrical.
-</li>
-<li>It can listen to BGP information from the Internet to decide which
-      system is currently up. This is clearly much more complicated, but if SG-B is already participating
-      in the BGP peering system to announce Bob, the results data may already
-      be available to it. 
-</li>
-<li>It can refuse to negotiate the second tunnel. (It is unclear whether or
-not this is even an option.)
-</li>
-<li>It can silently replace the outgoing portion of the first tunnel with the
-second one while still retaining the incoming portions of both. SG-B can,
-thus, accept datagrams from either SG-A or SG-D, but
-send only to the gateway that most recently re-keyed with it.
-</li>
-</ol><p>
-</p>
-<p>
-Local policy determines which choice SG-B makes. Note that even if SG-B has perfect
-knowledge about the reachability of SG-A and SG-D, Alice may not be reachable
-from either of these security gateways because of internal reachability
-issues. 
-
-</p>
-<p>
-FreeS/WAN implements option 5.  Implementing a different option is
-being considered. The multi-homing aspects of OE are not well developed and may
-be the subject of a future document.
-
-</p>
-<a name="anchor48"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.9"></a><h3>9.&nbsp;Failure modes</h3>
-
-<a name="rfc.section.9.1"></a><h4><a name="anchor49">9.1</a>&nbsp;DNS failures</h4>
-
-<p>
-  If a DNS server fails to respond, local policy decides
-  whether or not to permit communication in the clear as embodied in
-  the connection classes in <a href="#initclasses">Keying state machine - initiator</a>.
-  It is easy to mount a denial of service attack on the DNS server
-  responsible for a particular network's reverse-map.
-  Such an attack may cause all communication with that network to go in
-  the clear if the policy is permissive, or fail completely 
-  if the policy is paranoid. Please note that this is an active attack.
-  
-</p>
-<p>
-  There are still many networks
-  that do not have properly configured reverse-maps. Further, if the policy is not to communicate,
-  the above denial of service attack isolates the target network. Therefore, the decision of whether 
-or not to permit communication in the clear MUST be a matter of local policy.
-  
-</p>
-<a name="rfc.section.9.2"></a><h4><a name="anchor50">9.2</a>&nbsp;DNS configured, IKE failures</h4>
-
-<p>
-  DNS records claim that opportunistic encryption should
-  occur, but the target gateway either does not respond on port 500, or
-  refuses the proposal. This may be because of a crash or reboot, a
-  faulty configuration, or a firewall filtering port 500.  
-  
-</p>
-<p>
-  The receipt of ICMP port, host or network unreachable
-  messages indicates a potential problem, but MUST NOT cause communication
-  to fail 
-  immediately. ICMP messages are easily forged by attackers. If such a
-  forgery caused immediate failure, then an active attacker could easily
-  prevent any 
-  encryption from ever occurring, possibly preventing all communication.
-  
-</p>
-<p>
-  In these situations a clear log should be produced
-  and local policy should dictate if communication is then
-  permitted in the clear.
-  
-</p>
-<a name="rfc.section.9.3"></a><h4><a name="anchor51">9.3</a>&nbsp;System reboots</h4>
-
-<p>
-Tunnels sometimes go down because the remote end crashes,
-disconnects, or has a network link break.  In general there is no
-notification of this.  Even in the event of a crash and successful reboot, 
-other SGs don't hear about it unless the rebooted SG has specific 
-reason to talk to them immediately.  Over-quick response to temporary 
-network outages is undesirable.  Note that a tunnel can be torn
-down and then re-established without any effect visible to the user
-except a pause in traffic. On the other hand, if one end reboots,
-the other end can't get datagrams to it at all (except via
-IKE) until the situation is noticed.  So a bias toward quick
-response is appropriate even at the cost of occasional
-false alarms.
-
-</p>
-<p>
-A mechanism for recovery after reboot is a topic of current research and is not specified in this
-document.
-
-</p>
-<p>
-A deliberate shutdown should include an attempt, using deletes, to notify all other SGs
-currently connected by phase 1 SAs that communication is
-about to fail.  Again, a remote SG will assume this is a teardown.  Attempts by the
-remote SGs to negotiate new tunnels as replacements should be ignored. When possible, 
-SGs should attempt to preserve information about currently-connected SGs in non-volatile storage, so
-that after a crash, an Initial-Contact can be sent to previous partners to
-indicate loss of all previously established connections.
-
-</p>
-<a name="anchor52"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.10"></a><h3>10.&nbsp;Unresolved issues</h3>
-
-<a name="rfc.section.10.1"></a><h4><a name="anchor53">10.1</a>&nbsp;Control of reverse DNS</h4>
-
-<p>
-  The method of obtaining information by reverse DNS lookup causes
-  problems for people who cannot control their reverse DNS
-  bindings. This is an unresolved problem in this version, and is out
-  of scope.
-  
-</p>
-<a name="anchor54"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.11"></a><h3>11.&nbsp;Examples</h3>
-
-<a name="rfc.section.11.1"></a><h4><a name="anchor55">11.1</a>&nbsp;Clear-text usage (permit policy)</h4>
-
-<p>
-Two example scenarios follow. In the first example GW-A
-(Gateway A) and GW-B (Gateway B) have always-clear-text policies, and in the second example they have an OE
-policy.
-
-</p><br><hr size="1" shade="0">
-<a name="regulartiming"></a>
-</font><pre>
-  Alice         SG-A       DNS       SG-B           Bob
-   (1)
-    ------(2)-------------->
-    &lt;-----(3)---------------
-   (4)----(5)----->
-                   ----------(6)------>
-                                       ------(7)----->
-                                      &lt;------(8)------
-                   &lt;----------(9)------
-    &lt;----(10)-----
-   (11)----------->
-                   ----------(12)----->
-                                       -------------->
-                                      &lt;---------------
-                   &lt;-------------------
-    &lt;-------------
-          </pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Timing of regular transaction&nbsp;</b></font><br></td></tr></table><hr size="1" shade="0">
-
-<p>
-Alice wants to communicate with Bob. Perhaps she wants to retrieve a
-web page from Bob's web server. In the absence of opportunistic
-encryptors, the following events occur: 
-
-<blockquote class="text"><dl>
-<dt>(1)</dt>
-<dd>Human or application 'clicks' with a name.
-</dd>
-<dt>(2)</dt>
-<dd>Application looks up name in DNS to get IP address.
-</dd>
-<dt>(3)</dt>
-<dd>Resolver returns A record to application.
-</dd>
-<dt>(4)</dt>
-<dd>Application starts a TCP session or UDP session and OS sends datagram.
-</dd>
-<dt>(5)</dt>
-<dd>Datagram is seen at first gateway from Alice (SG-A). (SG-A
-makes a transition through Empty connection to always-clear connection and
-instantiates a pass-through policy at the forwarding plane.)
-</dd>
-<dt>(6)</dt>
-<dd>Datagram is seen at last gateway before Bob (SG-B).
-</dd>
-<dt>(7)</dt>
-<dd>First datagram from Alice is seen by Bob.
-</dd>
-<dt>(8)</dt>
-<dd>First return datagram is sent by Bob.
-</dd>
-<dt>(9)</dt>
-<dd>Datagram is seen at Bob's gateway. (SG-B makes a transition through
-Empty connection to always-clear connection and instantiates a pass-through
-policy at the forwarding plane.)
-</dd>
-<dt>(10)</dt>
-<dd>Datagram is seen at Alice's gateway.
-</dd>
-<dt>(11)</dt>
-<dd>OS hands datagram to application. Alice sends another datagram.
-</dd>
-<dt>(12)</dt>
-<dd>A second datagram traverses the Internet.
-</dd>
-</dl></blockquote><p>
-</p>
-<a name="rfc.section.11.2"></a><h4><a name="anchor56">11.2</a>&nbsp;Opportunistic encryption</h4>
-
-<p>
-In the presence of properly configured opportunistic encryptors, the
-event list is extended.
-
-<br><hr size="1" shade="0">
-<a name="opportunistictiming"></a>
-</p>
-</font><pre>
-  Alice          SG-A      DNS       SG-B           Bob
-   (1)
-    ------(2)-------------->
-    &lt;-----(3)---------------
-   (4)----(5)----->+
-                  ----(5B)->
-                  &lt;---(5C)--
-                  ~~~~~~~~~~~~~(5D)~~~>
-                  &lt;~~~~~~~~~~~~(5E1)~~~
-                  ~~~~~~~~~~~~~(5E2)~~>
-                  &lt;~~~~~~~~~~~~(5E3)~~~
-                  #############(5E4)##>
-                  &lt;############(5E5)###
-                           &lt;----(5F1)--
-                           -----(5F2)->
-                  #############(5G1)##>
-                           &lt;----(5H1)--
-                           -----(5H2)->
-                  &lt;############(5G2)###
-                  #############(5G3)##>
-                   ============(6)====>
-		                       ------(7)----->
-                                      &lt;------(8)------
-                  &lt;==========(9)======
-    &lt;-----(10)----
-   (11)----------->
-                   ==========(12)=====>
-                                       -------------->
-                                      &lt;---------------
-                   &lt;===================
-    &lt;-------------
-          </pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-<p>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Timing of opportunistic encryption transaction&nbsp;</b></font><br></td></tr></table><hr size="1" shade="0">
-
-<blockquote class="text"><dl>
-<dt>(1)</dt>
-<dd>Human or application clicks with a name.
-</dd>
-<dt>(2)</dt>
-<dd>Application initiates DNS mapping.
-</dd>
-<dt>(3)</dt>
-<dd>Resolver returns A record to application.
-</dd>
-<dt>(4)</dt>
-<dd>Application starts a TCP session or UDP.
-</dd>
-<dt>(5)</dt>
-<dd>SG-A (host or SG) sees datagram to target, and buffers it.
-</dd>
-<dt>(5B)</dt>
-<dd>SG-A asks DNS for TXT record.
-</dd>
-<dt>(5C)</dt>
-<dd>DNS returns TXT record(s).
-</dd>
-<dt>(5D)</dt>
-<dd>Initial IKE Main Mode Packet goes out.
-</dd>
-<dt>(5E)</dt>
-<dd>IKE ISAKMP phase 1 succeeds.
-</dd>
-<dt>(5F)</dt>
-<dd>SG-B asks DNS for TXT record to prove SG-A is an agent for Alice.
-</dd>
-<dt>(5G)</dt>
-<dd>IKE phase 2 negotiation.
-</dd>
-<dt>(5H)</dt>
-<dd>DNS lookup by responder (SG-B).
-</dd>
-<dt>(6)</dt>
-<dd>Buffered datagram is sent by SG-A.
-</dd>
-<dt>(7)</dt>
-<dd>Datagram is received by SG-B, decrypted, and sent to Bob.
-</dd>
-<dt>(8)</dt>
-<dd>Bob replies, and datagram is seen by SG-B.
-</dd>
-<dt>(9)</dt>
-<dd>SG-B already has tunnel up with SG-A, and uses it.
-</dd>
-<dt>(10)</dt>
-<dd>SG-A decrypts datagram and gives it to Alice.
-</dd>
-<dt>(11)</dt>
-<dd>Alice receives datagram. Sends new packet to Bob.
-</dd>
-<dt>(12)</dt>
-<dd>SG-A gets second datagram, sees that tunnel is up, and uses it.
-</dd>
-</dl></blockquote><p>
-</p>
-<p>
-  For the purposes of this section, we will describe only the changes that
-  occur between <a href="#regulartiming">Timing of regular transaction</a> and
-  <a href="#opportunistictiming">Timing of opportunistic encryption transaction</a>. This corresponds to time points 5, 6, 7, 9 and 10 on the list above. 
-  
-</p>
-<a name="rfc.section.11.2.1"></a><h4><a name="anchor57">11.2.1</a>&nbsp;(5) IPsec datagram interception</h4>
-
-<p>
-    At point (5), SG-A intercepts the datagram because this source/destination pair lacks a policy 
-(the non-existent policy state). SG-A creates a hold policy, and buffers the datagram. SG-A requests keys from the keying daemon. 
-    
-</p>
-<a name="rfc.section.11.2.2"></a><h4><a name="anchor58">11.2.2</a>&nbsp;(5B) DNS lookup for TXT record</h4>
-
-<p>
-    SG-A's IKE daemon, having looked up the source/destination pair in the connection
-    class list, creates a new Potential OE connection instance. SG-A starts DNS
-    queries.
-    
-</p>
-<a name="rfc.section.11.2.3"></a><h4><a name="anchor59">11.2.3</a>&nbsp;(5C) DNS returns TXT record(s)</h4>
-
-<p>
-  DNS returns properly formed TXT delegation records, and SG-A's IKE daemon
-  causes this instance to make a transition from Potential OE connection to Pending OE
-  connection.
-  
-</p>
-<p>
-      Using the example above, the returned record might contain:
-
-    <br><hr size="1" shade="0">
-<a name="txtexample"></a>
-</p>
-</font><pre>
-X-IPsec-Server(10)=192.1.1.5 AQMM...3s1Q==
-          </pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-<p>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Example of reverse delegation record for Bob&nbsp;</b></font><br></td></tr></table><hr size="1" shade="0">
-
-    with SG-B's IP address and public key listed.
-    
-</p>
-<a name="rfc.section.11.2.4"></a><h4><a name="anchor60">11.2.4</a>&nbsp;(5D) Initial IKE main mode packet goes out</h4>
-
-<p>Upon entering Pending OE connection, SG-A sends the initial ISAKMP
-  message with proposals. See <a href="#phase1id">Phase 1 parameters</a>.
-  
-</p>
-<a name="rfc.section.11.2.5"></a><h4><a name="anchor61">11.2.5</a>&nbsp;(5E1) Message 2 of phase 1 exchange</h4>
-
-<p>
-  SG-B receives the message. A new connection instance is created in the
-  unauthenticated OE peer state.
-  
-</p>
-<a name="rfc.section.11.2.6"></a><h4><a name="anchor62">11.2.6</a>&nbsp;(5E2) Message 3 of phase 1 exchange</h4>
-
-<p>
-  SG-A sends a Diffie-Hellman exponent. This is an internal state of the
-  keying daemon.
-  
-</p>
-<a name="rfc.section.11.2.7"></a><h4><a name="anchor63">11.2.7</a>&nbsp;(5E3) Message 4 of phase 1 exchange</h4>
-
-<p>
-  SG-B responds with a Diffie-Hellman exponent. This is an internal state of the
-  keying protocol.
-  
-</p>
-<a name="rfc.section.11.2.8"></a><h4><a name="anchor64">11.2.8</a>&nbsp;(5E4) Message 5 of phase 1 exchange</h4>
-
-<p>
-  SG-A uses the phase 1 SA to send its identity under encryption. 
-  The choice of identity is discussed in <a href="#phase1id">Phase 1 parameters</a>.
-  This is an internal state of the keying protocol.
-  
-</p>
-<a name="rfc.section.11.2.9"></a><h4><a name="anchor65">11.2.9</a>&nbsp;(5F1) Responder lookup of initiator key</h4>
-
-<p>
-  SG-B asks DNS for the public key of the initiator. 
-  DNS looks for a KEY record by IP address in the reverse-map.
-  That is, a KEY resource record is queried for 4.1.1.192.in-addr.arpa
-  (recall that SG-A's external address is 192.1.1.4).
-  SG-B uses the resulting public key to authenticate the initiator. See <a href="#KEY">Use of KEY record</a> for further details. 
-  
-</p>
-<a name="rfc.section.11.2.10"></a><h4><a name="anchor66">11.2.10</a>&nbsp;(5F2) DNS replies with public key of initiator</h4>
-
-<p>
-Upon successfully authenticating the peer, the connection instance makes a
-transition to authenticated OE peer on SG-B.
-
-</p>
-<p>
-The format of the TXT record returned is described in
-<a href="#TXT">Use of TXT delegation record</a>. 
-
-</p>
-<a name="rfc.section.11.2.11"></a><h4><a name="anchor67">11.2.11</a>&nbsp;(5E5) Responder replies with ID and authentication</h4>
-
-<p>
-    SG-B sends its ID along with authentication material. This is an internal
-    state for the keying protocol.
-  
-</p>
-<a name="rfc.section.11.2.12"></a><h4><a name="anchor68">11.2.12</a>&nbsp;(5G) IKE phase 2</h4>
-
-<a name="rfc.section.11.2.12.1"></a><h4><a name="anchor69">11.2.12.1</a>&nbsp;(5G1) Initiator proposes tunnel</h4>
-
-<p>
-    Having established mutually agreeable authentications (via KEY) and
-    authorizations (via TXT), SG-A proposes to create an IPsec tunnel for
-    datagrams transiting from Alice to Bob. This tunnel is established only for 
-    the Alice/Bob combination, not for any subnets that may be behind SG-A and SG-B.
-    
-</p>
-<a name="rfc.section.11.2.12.2"></a><h4><a name="anchor70">11.2.12.2</a>&nbsp;(5H1) Responder determines initiator's authority</h4>
-
-<p>
-    While the identity of SG-A has been established, its authority to
-    speak for Alice has not yet been confirmed. SG-B does a reverse
-    lookup on Alice's address for a TXT record. 
-    
-</p>
-<p>Upon receiving this specific proposal, SG-B's connection instance
-    makes a transition into the potential OE connection state. SG-B may already have an
-    instance, and the check is made as described above.
-</p>
-<a name="rfc.section.11.2.12.3"></a><h4><a name="anchor71">11.2.12.3</a>&nbsp;(5H2) DNS replies with TXT record(s)</h4>
-
-<p>
-      The returned key and IP address should match that of SG-A.
-    
-</p>
-<a name="rfc.section.11.2.12.4"></a><h4><a name="anchor72">11.2.12.4</a>&nbsp;(5G2) Responder agrees to proposal</h4>
-
-<p>
-    Should additional communication occur between, for instance, Dave and Bob using
-    SG-A and SG-B, a new tunnel (phase 2 SA) would be established. The phase 1 SA
-    may be reusable.
-    
-</p>
-<p>SG-A, having successfully keyed the tunnel, now makes a transition from
-    Pending OE connection to Keyed OE connection.
-    
-</p>
-<p>The responder MUST setup the inbound IPsec SAs before sending its reply.
-</p>
-<a name="rfc.section.11.2.12.5"></a><h4><a name="anchor73">11.2.12.5</a>&nbsp;(5G3) Final acknowledgment from initiator</h4>
-
-<p>
-    The initiator agrees with the responder's choice and sets up the tunnel.
-    The initiator sets up the inbound and outbound IPsec SAs.
-    
-</p>
-<p>
-    The proper authorization returned with keys prompts SG-B to make a transition
-    to the keyed OE connection state. 
-    
-</p>
-<p>Upon receipt of this message, the responder may now setup the outbound
-    IPsec SAs.
-</p>
-<a name="rfc.section.11.2.13"></a><h4><a name="anchor74">11.2.13</a>&nbsp;(6) IPsec succeeds, and sets up tunnel for communication between Alice and Bob</h4>
-
-<p>
-  SG-A sends the datagram saved at step (5) through the newly created
-  tunnel to SG-B, where it gets decrypted and forwarded. 
-  Bob receives it at (7) and replies at (8). 
-  
-</p>
-<a name="rfc.section.11.2.14"></a><h4><a name="anchor75">11.2.14</a>&nbsp;(9) SG-B already has tunnel up with G1 and uses it</h4>
-
-<p>
-  At (9), SG-B has already established an SPD entry mapping Bob->Alice via a
-  tunnel, so this tunnel is simply applied. The datagram is encrypted to SG-A,
-  decrypted by SG-A and passed to Alice at (10).
-  
-</p>
-<a name="securityconsiderations"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.12"></a><h3>12.&nbsp;Security considerations</h3>
-
-<a name="rfc.section.12.1"></a><h4><a name="anchor76">12.1</a>&nbsp;Configured vs opportunistic tunnels</h4>
-
-<p>
-    Configured tunnels are those which are setup using bilateral mechanisms: exchanging 
-public keys (raw RSA, DSA, PKIX), pre-shared secrets, or by referencing keys that
-are in known places (distinguished name from LDAP, DNS). These keys are then used to
-configure a specific tunnel. 
-
-</p>
-<p>
-A pre-configured tunnel may be on all the time, or may be keyed only when needed. 
-The end points of the tunnel are not necessarily static: many mobile
-applications (road warrior) are considered to be configured tunnels. 
-
-</p>
-<p>
-The primary characteristic is that configured tunnels are assigned specific
-security properties. They may be trusted in different ways relating to exceptions to 
-firewall rules, exceptions to NAT processing, and to bandwidth or other quality of service restrictions. 
-
-</p>
-<p>
-Opportunistic tunnels are not inherently trusted in any strong way. They are
-created without prior arrangement. As the two parties are strangers, there
-MUST be no confusion of datagrams that arrive from opportunistic peers and
-those that arrive from configured tunnels. A security gateway MUST take care
-that an opportunistic peer can not impersonate a configured peer.
-
-</p>
-<p>
-Ingress filtering MUST be used to make sure that only datagrams authorized by
-negotiation (and the concomitant authentication and authorization) are
-accepted from a tunnel. This is to prevent one peer from impersonating another. 
-
-</p>
-<p>
-An implementation suggestion is to treat opportunistic tunnel
-datagrams as if they arrive on a logical interface distinct from other
-configured tunnels. As the number of opportunistic tunnels that may be
-created automatically on a system is potentially very high, careful attention 
-to scaling should be taken into account.
-
-</p>
-<p>
-As with any IKE negotiation, opportunistic encryption cannot be secure
-without authentication. Opportunistic encryption relies on DNS for its
-authentication information and, therefore, cannot be fully secure without
-a secure DNS. Without secure DNS, opportunistic encryption can protect against passive
-eavesdropping but not against active man-in-the-middle attacks.
-
-</p>
-<a name="rfc.section.12.2"></a><h4><a name="anchor77">12.2</a>&nbsp;Firewalls versus Opportunistic Tunnels</h4>
-
-<p>
-  Typical usage of per datagram access control lists is to implement various
-kinds of security gateways. These are typically called "firewalls". 
-
-</p>
-<p>
-  Typical usage of a virtual private network (VPN) within a firewall is to
-bypass all or part of the access controls between two networks. Additional
-trust (as outlined in the previous section) is given to datagrams that arrive
-in the VPN.
-
-</p>
-<p> 
-  Datagrams that arrive via opportunistically configured tunnels MUST not be
-trusted. Any security policy that would apply to a datagram arriving in the
-clear SHOULD also be applied to datagrams arriving opportunistically.
-
-</p>
-<a name="rfc.section.12.3"></a><h4><a name="anchor78">12.3</a>&nbsp;Denial of service</h4>
-
-<p>
-  There are several different forms of denial of service that an implementor 
-  should concern themselves with. Most of these problems are shared with
-  security gateways that have large numbers of mobile peers (road warriors). 
-
-</p>
-<p>
-  The design of ISAKMP/IKE, and its use of cookies, defend against many kinds
-  of denial of service. Opportunism changes the assumption that if the phase 1 (ISAKMP) 
-  SA is authenticated, that it was worthwhile creating. Because the gateway will communicate with any machine, it is
-  possible to form phase 1 SAs with any machine on the Internet. 
-
-</p>
-<a name="anchor79"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.13"></a><h3>13.&nbsp;IANA Considerations</h3>
-
-<p>
-    There are no known numbers which IANA will need to manage.
-
-</p>
-<a name="anchor80"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.14"></a><h3>14.&nbsp;Acknowledgments</h3>
-
-<p>
-        Substantive portions of this document are based upon previous work by
-        Henry Spencer.
-
-</p>
-<p>
-	Thanks to Tero Kivinen, Sandy Harris, Wes Hardarker, Robert Moskowitz,
-	Jakob Schlyter, Bill Sommerfeld, John Gilmore and John Denker for their
-	comments and constructive criticism.
-
-</p>
-<p>
-	Sandra Hoffman and Bill Dickie did the detailed proof reading and editing.
-
-</p>
-<a name="rfc.references1"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<h3>Normative references</h3>
-<table width="99%" border="0">
-<tr><td class="author-text" valign="top"><b><a name="OEspec">[1]</a></b></td>
-<td class="author-text"><a href="mailto:hugh@mimosa.com">Redelmeier, D.</a> and <a href="mailto:henry@spsystems.net">H. Spencer</a>, "Opportunistic Encryption", paper http://www.freeswan.org/freeswan_trees/freeswan-1.91/doc/opportunism.spec, May 2001.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC0791">[2]</a></b></td>
-<td class="author-text">Defense Advanced Research Projects Agency (DARPA), Information Processing Techniques Office and University of Southern California (USC)/Information Sciences Institute, "<a href="ftp://ftp.isi.edu/in-notes/rfc791.txt">Internet Protocol</a>", STD 5, RFC 791, September 1981.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC1009">[3]</a></b></td>
-<td class="author-text"><a href="mailto:">Braden, R.</a> and <a href="mailto:">J. Postel</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc1009.txt">Requirements for Internet gateways</a>", RFC 1009, June 1987.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC1984">[4]</a></b></td>
-<td class="author-text">IAB, IESG, <a href="mailto:brian@dxcoms.cern.ch">Carpenter, B.</a> and <a href="mailto:fred@cisco.com">F. Baker</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc1984.txt">IAB and IESG Statement on Cryptographic Technology and the Internet</a>", RFC 1984, August 1996.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2119">[5]</a></b></td>
-<td class="author-text"><a href="mailto:-">Bradner, S.</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2119.txt">Key words for use in RFCs to Indicate Requirement Levels</a>", BCP 14, RFC 2119, March 1997.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2367">[6]</a></b></td>
-<td class="author-text"><a href="mailto:danmcd@eng.sun.com">McDonald, D.</a>, <a href="mailto:cmetz@inner.net">Metz, C.</a> and <a href="mailto:phan@itd.nrl.navy.mil">B. Phan</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2367.txt">PF_KEY Key Management API, Version 2</a>", RFC 2367, July 1998.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2401">[7]</a></b></td>
-<td class="author-text"><a href="mailto:kent@bbn.com">Kent, S.</a> and <a href="mailto:rja@corp.home.net">R. Atkinson</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2401.txt">Security Architecture for the Internet Protocol</a>", RFC 2401, November 1998.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2407">[8]</a></b></td>
-<td class="author-text"><a href="mailto:ddp@network-alchemy.com">Piper, D.</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2407.txt">The Internet IP Security Domain of Interpretation for ISAKMP</a>", RFC 2407, November 1998.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2408">[9]</a></b></td>
-<td class="author-text"><a href="mailto:wdm@tycho.ncsc.mil">Maughan, D.</a>, <a href="mailto:mss@tycho.ncsc.mil">Schneider, M.</a> and <a href="er@raba.com">M. Schertler</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2408.txt">Internet Security Association and Key Management Protocol (ISAKMP)</a>", RFC 2408, November 1998.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2409">[10]</a></b></td>
-<td class="author-text"><a href="mailto:dharkins@cisco.com">Harkins, D.</a> and <a href="mailto:carrel@ipsec.org">D. Carrel</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2409.txt">The Internet Key Exchange (IKE)</a>", RFC 2409, November 1998.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC3526">[11]</a></b></td>
-<td class="author-text"><a href="mailto:kivinen@ssh.fi">Kivinen, T.</a> and <a href="mailto:mrskojo@cc.helsinki.fi">M. Kojo</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc3526.txt">More MODP Diffie-Hellman groups for IKE</a>", RFC 3526, March 2003.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC1034">[12]</a></b></td>
-<td class="author-text">Mockapetris, P., "<a href="ftp://ftp.isi.edu/in-notes/rfc1034.txt">Domain names - concepts and facilities</a>", STD 13, RFC 1034, November 1987.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC1035">[13]</a></b></td>
-<td class="author-text"><a href="mailto:">Mockapetris, P.</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc1035.txt">Domain names - implementation and specification</a>", STD 13, RFC 1035, November 1987.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2671">[14]</a></b></td>
-<td class="author-text"><a href="mailto:vixie@isc.org">Vixie, P.</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2671.txt">Extension Mechanisms for DNS (EDNS0)</a>", RFC 2671, August 1999.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC1464">[15]</a></b></td>
-<td class="author-text"><a href="mailto:rosenbaum@lkg.dec.com">Rosenbaum, R.</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc1464.txt">Using the Domain Name System To Store Arbitrary String Attributes</a>", RFC 1464, May 1993.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2535">[16]</a></b></td>
-<td class="author-text"><a href="mailto:dee3@us.ibm.com">Eastlake, D.</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2535.txt">Domain Name System Security Extensions</a>", RFC 2535, March 1999.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC3110">[17]</a></b></td>
-<td class="author-text">Eastlake, D., "<a href="ftp://ftp.isi.edu/in-notes/rfc3110.txt">RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)</a>", RFC 3110, May 2001.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2538">[18]</a></b></td>
-<td class="author-text"><a href="mailto:dee3@us.ibm.com">Eastlake, D.</a> and <a href="mailto:ogud@tislabs.com">O. Gudmundsson</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2538.txt">Storing Certificates in the Domain Name System (DNS)</a>", RFC 2538, March 1999.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2748">[19]</a></b></td>
-<td class="author-text"><a href="mailto:David.Durham@intel.com">Durham, D.</a>, <a href="mailto:jboyle@Level3.net">Boyle, J.</a>, <a href="mailto:ronc@cisco.com">Cohen, R.</a>, <a href="mailto:herzog@iphighway.com">Herzog, S.</a>, <a href="mailto:rajan@research.att.com">Rajan, R.</a> and <a href="mailto:asastry@cisco.com">A. Sastry</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2748.txt">The COPS (Common Open Policy Service) Protocol</a>", RFC 2748, January 2000.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2663">[20]</a></b></td>
-<td class="author-text"><a href="mailto:srisuresh@lucent.com">Srisuresh, P.</a> and <a href="mailto:holdrege@lucent.com">M. Holdrege</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2663.txt">IP Network Address Translator (NAT) Terminology and Considerations</a>", RFC 2663, August 1999.</td></tr>
-</table>
-
-<a name="rfc.authors"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<h3>Authors' Addresses</h3>
-<table width="99%" border="0" cellpadding="0" cellspacing="0">
-<tr><td class="author-text">&nbsp;</td>
-<td class="author-text">Michael C. Richardson</td></tr>
-<tr><td class="author-text">&nbsp;</td>
-<td class="author-text">Sandelman Software Works</td></tr>
-<tr><td class="author-text">&nbsp;</td>
-<td class="author-text">470 Dawson Avenue</td></tr>
-<tr><td class="author-text">&nbsp;</td>
-<td class="author-text">Ottawa, ON  K1Z 5V7</td></tr>
-<tr><td class="author-text">&nbsp;</td>
-<td class="author-text">CA</td></tr>
-<tr><td class="author" align="right">EMail:&nbsp;</td>
-<td class="author-text"><a href="mailto:mcr@sandelman.ottawa.on.ca">mcr@sandelman.ottawa.on.ca</a></td></tr>
-<tr><td class="author" align="right">URI:&nbsp;</td>
-<td class="author-text"><a href="http://www.sandelman.ottawa.on.ca/">http://www.sandelman.ottawa.on.ca/</a></td></tr>
-<tr cellpadding="3"><td>&nbsp;</td><td>&nbsp;</td></tr>
-<tr><td class="author-text">&nbsp;</td>
-<td class="author-text">D. Hugh Redelmeier</td></tr>
-<tr><td class="author-text">&nbsp;</td>
-<td class="author-text">Mimosa</td></tr>
-<tr><td class="author-text">&nbsp;</td>
-<td class="author-text">Toronto, ON</td></tr>
-<tr><td class="author-text">&nbsp;</td>
-<td class="author-text">CA</td></tr>
-<tr><td class="author" align="right">EMail:&nbsp;</td>
-<td class="author-text"><a href="mailto:hugh@mimosa.com">hugh@mimosa.com</a></td></tr>
-</table>
-<a name="rfc.copyright"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<h3>Full Copyright Statement</h3>
-<p class='copyright'>
-Copyright (C) The Internet Society (2003). All Rights Reserved.</p>
-<p class='copyright'>
-This document and translations of it may be copied and furnished to
-others, and derivative works that comment on or otherwise explain it
-or assist in its implementation may be prepared, copied, published and
-distributed, in whole or in part, without restriction of any kind,
-provided that the above copyright notice and this paragraph are
-included on all such copies and derivative works. However, this
-document itself may not be modified in any way, such as by removing
-the copyright notice or references to the Internet Society or other
-Internet organizations, except as needed for the purpose of
-developing Internet standards in which case the procedures for
-copyrights defined in the Internet Standards process must be
-followed, or as required to translate it into languages other than
-English.</p>
-<p class='copyright'>
-The limited permissions granted above are perpetual and will not be
-revoked by the Internet Society or its successors or assigns.</p>
-<p class='copyright'>
-This document and the information contained herein is provided on an
-&quot;AS IS&quot; basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
-TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
-BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
-HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.</p>
-<h3>Acknowledgement</h3>
-<p class='copyright'>
-Funding for the RFC Editor function is currently provided by the
-Internet Society.</p>
-</font></body></html>
diff --git a/doc/src/draft-richardson-ipsec-opportunistic.xml b/doc/src/draft-richardson-ipsec-opportunistic.xml
deleted file mode 100644
index d587df693..000000000
--- a/doc/src/draft-richardson-ipsec-opportunistic.xml
+++ /dev/null
@@ -1,2519 +0,0 @@
-<?xml version="1.0"?>
-<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
-<?rfc toc="yes"?>
-<?rfc tocdepth='2' ?>
-
-<rfc ipr="full2026" docName="draft-richardson-ipsec-opportunistic-12.txt">
-
-<front>
-  <area>Security</area>
-  <workgroup>Independent submission</workgroup>
-  <title abbrev="opportunistic">
-     Opportunistic Encryption using The Internet Key Exchange (IKE)
-  </title>
-
-  <author initials="M." surname="Richardson" fullname="Michael C. Richardson">
-    <organization abbrev="SSW">Sandelman Software Works</organization>
-    <address>
-      <postal>   
-        <street>470 Dawson Avenue</street>
-        <city>Ottawa</city>
-        <region>ON</region>
-        <code>K1Z 5V7</code>
-        <country>CA</country>
-      </postal>
-      <email>mcr@sandelman.ottawa.on.ca</email>
-      <uri>http://www.sandelman.ottawa.on.ca/</uri>
-    </address>
-  </author>
-
-  <author initials="D.H." surname="Redelmeier"
-          fullname="D. Hugh Redelmeier">
-    <organization abbrev="Mimosa">Mimosa</organization>
-    <address>
-      <postal>   
-        <city>Toronto</city>
-        <region>ON</region>
-        <country>CA</country>
-      </postal>
-      <email>hugh@mimosa.com</email>
-    </address>
-  </author>
-
-  <date month="June" year="2003"></date>
-
-<abstract>
-  <t>
-This document describes opportunistic encryption (OE) using the Internet Key
-Exchange (IKE) and IPsec.  
-Each system administrator adds new
-resource records to his or her Domain Name System (DNS) to support
-opportunistic encryption. The objective is to allow encryption for secure communication without
-any pre-arrangement specific to the pair of systems involved.
-  </t>
-  <t>
-DNS is used to distribute the public keys of each
-system involved. This is resistant to passive attacks. The use of DNS
-Security (DNSSEC) secures this system against active attackers as well. 
-  </t>
-  <t>
-As a result, the administrative overhead is reduced
-from the square of the number of systems to a linear dependence, and it becomes  
-possible to make secure communication the default even
-when the partner is not known in advance.
-  </t>
-  <t>
-This document is offered up as an Informational RFC.
-  </t>
-</abstract>
-
-</front>
-
-<middle>
-
-<section title="Introduction">
-
-<section title="Motivation">
-
-<t>
-The objective of opportunistic encryption is to allow encryption without
-any pre-arrangement specific to the pair of systems involved. Each
-system administrator adds
-public key information to DNS records to support opportunistic
-encryption and then enables this feature in the nodes' IPsec stack. 
-Once this is done, any two such nodes can communicate securely.
-</t>
-
-<t>
-This document describes opportunistic encryption as designed and
-implemented by the Linux FreeS/WAN project in revisions up and including 2.00.
-Note that 2.01 and beyond implements RFC3445, in a backward compatible way.
-For project information, see http://www.freeswan.org.
-</t>
-
-  <t>
-The Internet Architecture Board (IAB) and Internet Engineering
-Steering Group (IESG) have taken a strong stand that the Internet
-should use powerful encryption to provide security and
-privacy <xref target="RFC1984" />.
-The Linux FreeS/WAN project attempts to provide a practical means to implement this policy. 
-  </t>
-
-  <t>
-The project uses the IPsec, ISAKMP/IKE, DNS and DNSSEC
-protocols because they are
-standardized, widely available and can often be deployed very easily
-without changing hardware or software or retraining users. 
-  </t>
-
-  <t>
-The extensions to support opportunistic encryption are simple.  No
-changes to any on-the-wire formats are needed.  The only changes are to 
-the policy decision making system.  This means that opportunistic
-encryption can be implemented with very minimal changes to an existing 
-IPsec implementation.
-  </t>
-
-  <t>
-Opportunistic encryption creates a "fax effect". The proliferation
-of the fax machine was possible because it did not require that everyone
-buy one overnight. Instead, as each person installed one, the value
-of having one increased - as there were more people that could receive faxes.
-Once opportunistic encryption is installed it
-automatically recognizes 
-other boxes using opportunistic encryption, without any further configuration
-by the network 
-administrator. So, as opportunistic encryption software is installed on more
-boxes, its value 
-as a tool increases.
-</t>
-
-  <t>
-This document describes the infrastructure to permit deployment of
-Opportunistic Encryption.
-</t>
- 
-  <t>
-The term S/WAN is a trademark of RSA Data Systems, and is used with permission
-by this project.
-  </t>
-
-</section>
-
-<section title="Types of network traffic">
-  <t>
-    To aid in understanding the relationship between security processing and IPsec
-    we divide network traffic into four categories:
-    <list style="hanging">
-      <t hangText="* Deny:"> networks to which traffic is always forbidden.</t>
-      <t hangText="* Permit:"> networks to which traffic in the clear is permitted.</t>
-      <t hangText="* Opportunistic tunnel:"> networks to which traffic is encrypted if possible, but otherwise is in the clear  
-	    or fails depending on the default policy in place.	
-      </t>
-      <t hangText="* Configured tunnel:"> networks to which traffic
-must be encrypted, and traffic in the clear is never permitted.
-A Virtual Private Network (VPN) is a form of configured tunnel.
-</t>
-    </list>      
-  </t>
-
-<t>
-Traditional firewall devices handle the first two categories.
-No authentication is required.  
-The permit policy is currently the default on the Internet. 
-</t>
-
-<t>
-This document describes the third category - opportunistic tunnel, which is
-proposed as the new default for the Internet.
-</t>
-
-<t>
-  Category four, encrypt traffic or drop it, requires authentication of the
-  end points. As the number of end points is typically bounded and is typically
-  under a single authority, arranging for distribution of
-  authentication material, while difficult, does not require any new
-  technology. The mechanism described here provides an additional way to
-  distribute the authentication materials, that of a public key method that does not
-  require deployment of an X.509 based infrastructure.  
-</t>
-<t>
-Current Virtual Private Networks can often be replaced by an "OE paranoid"
-policy as described herein. 
-</t>
-</section>	
-
-<section title="Peer authentication in opportunistic encryption">
-
-  <t>
-  Opportunistic encryption creates tunnels between nodes that
-  are essentially strangers. This is done without any prior bilateral
-  arrangement. 
-  There is, therefore, the difficult question of how one knows to whom one is
-  talking.
-  </t>
-
-  <t>
-  One possible answer is that since no useful
-  authentication can be done, none should be tried. This mode of operation is
-  named "anonymous encryption".  An active man-in-the-middle attack can be
-  used to thwart the privacy of this type of communication. 
-  Without peer authentication, there is no way to prevent this kind of attack.
-  </t>
-
-  <t>
-Although a useful mode, anonymous encryption is not the goal of this
-project. Simpler methods are available that can achieve anonymous
-encryption only, but authentication of the peer is a desireable goal.
-The latter is achieved through key distribution in DNS, leveraging upon
-the authentication of the DNS in DNSSEC.
-</t>
-
-  <t>
-  Peers are, therefore, authenticated with DNSSEC when available. Local policy 
-determines how much trust to extend when DNSSEC is not available.
-  </t>
-
-  <t>
-  However, an essential premise of building private connections with
-  strangers is that datagrams received through opportunistic tunnels
-  are no more special than datagrams that arrive in the clear.
-  Unlike in a VPN, these datagrams should not be given any special
-  exceptions when it comes to auditing, further authentication or
-  firewalling.
-  </t>
-  
-  <t>
-  When initiating outbound opportunistic encryption, local 
-  configuration determines what happens if tunnel setup fails. It may be that
-  the packet goes out in the clear, or it may be dropped.
-  </t>
-
-  </section>
-
-<section title="Use of RFC2119 terms">
-<t>
-   The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,
-   SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this
-   document, are to be interpreted as described in <xref target="RFC2119" />
-</t>
-</section>
-
-</section>
-
-<section title="Overview">
-
-  <section title="Reference diagram">
-
-    <figure anchor="networkdiagram" title="Reference Network Diagram">
-	   <preamble>The following network diagram is used in the rest of
-		this document as the canonical diagram:</preamble>
-           <artwork>
-                          [Q]  [R]          
-                           .    .              AS2                 
-  [A]----+----[SG-A].......+....+.......[SG-B]-------[B]
-         |                 ......
-     AS1 |                 ..PI..
-         |                 ......
-  [D]----+----[SG-D].......+....+.......[C] AS3
-             
-
-           </artwork>
-           <postamble></postamble>
-
-       </figure>
-
-    <t>
-    In this diagram, there are four end-nodes: A, B, C and D. 
-    There are three security gateways, SG-A, SG-B, SG-D. A, D, SG-A and
-    SG-D are part 
-    of the same administrative authority, AS1. SG-A and SG-D are on two
-    different exit
-    paths from organization 1. SG-B/B is an independent organization, AS2.
-    Nodes Q and R are nodes on the Internet. PI is the Public
-    Internet ("The Wild").
-    </t>
-
-  </section>
-
-  <section title="Terminology">
-
-  <t>
-  The following terminology is used in this document:
-  </t>
-
-  <list style="hanging">
-    <t hangText="Security gateway (or simply gateway):"> a system that performs IPsec tunnel
-    mode encapsulation/decapsulation. [SG-x] in the diagram.</t>
-    <t hangText="Alice:"> node [A] in the diagram. When an IP address is needed, this is 192.1.0.65.</t>
-    <t hangText="Bob:"> node [B] in the diagram. When an IP address is needed, this is 192.2.0.66.</t>
-    <t hangText="Carol:"> node [C] in the diagram. When an IP address is needed, this is 192.1.1.67.</t>
-    <t hangText="Dave:"> node [D] in the diagram. When an IP address is needed, this is 192.3.0.68.</t>
-    <t hangText="SG-A:"> Alice's security gateway. Internally it is 192.1.0.1, externally it is 192.1.1.4.</t>
-    <t hangText="SG-B:"> Bob's security gateway. Internally it is 192.2.0.1, externally it is 192.1.1.5.</t>
-    <t hangText="SG-D:"> Dave's security gateway. Also Alice's backup security gateway. Internally it is 192.3.0.1, externally it is 192.1.1.6.</t>
-    <t hangText="."> A period represents an untrusted network of unknown
-        type.</t> 
-    <t hangText="Configured tunnel:"> a tunnel that
-		  is directly and deliberately hand configured on participating gateways.
-		  Configured tunnels are typically given a higher level of
-		  trust than opportunistic tunnels.</t> 
-
-    <t hangText="Road warrior tunnel:"> a configured tunnel connecting one
-		  node with a fixed IP address and one node with a variable IP address.
-		  A road warrior (RW) connection must be initiated by the
-		  variable node, since the fixed node cannot know the
-		  current address for the road warrior. </t>
-
-    <t hangText="Anonymous encryption:">
-	the process of encrypting a session without any knowledge of who the
-	other parties are. No authentication of identities is done.</t>
-
-    <t hangText="Opportunistic encryption:">
-	the process of encrypting a session with authenticated knowledge of
-	who the other party is.</t>
-
-    <t hangText="Lifetime:">
-        the period in seconds (bytes or datagrams) for which a security
-	association will remain alive before needing to be re-keyed.</t>
-
-    <t hangText="Lifespan:">
-        the effective time for which a security association remains useful. A
-	security association with a lifespan shorter than its lifetime would
-	be removed when no longer needed. A security association with a
-	lifespan longer than its lifetime would need to be re-keyed one or
-	more times.</t>
-    
-    <t hangText="Phase 1 SA:"> an ISAKMP/IKE security association sometimes
-      referred to as a keying channel.</t>
-
-    <t hangText="Phase 2 SA:"> an IPsec security association.</t>
-
-    <t hangText="Tunnel:"> another term for a set of phase 2 SA (one in each direction).</t>
-
-    <t hangText="NAT:"> Network Address Translation
-    (see <xref target="RFC2663" />).</t>
-
-    <t hangText="NAPT:"> Network Address and Port Translation
-    (see <xref target="RFC2663" />).</t>
-
-    <t hangText="AS:"> an autonomous system </t>
-
-    <t hangText="FQDN:"> Fully-Qualified Domain Name </t>
-
-    <t hangText="Default-free zone:"> 
-    a set of routers that maintain a complete set of routes to
-    all currently reachable destinations. Having such a list, these routers
-    never make use of a default route. A datagram with a destination address
-    not matching any route will be dropped by such a router.
-    </t>
-
-  </list>
-  </section>
-
-<section title="Model of operation">
-
-<t>
-The opportunistic encryption security gateway (OE gateway) is a regular
-gateway node as described in <xref target="RFC0791" /> section 2.4 and  
-<xref target="RFC1009" /> with the additional capabilities described here and
-in <xref target="RFC2401" />.  
-The algorithm described here provides a way to determine, for each datagram,
-whether or not to encrypt and tunnel the datagram. Two important things
-that must be determined are whether or not to encrypt and tunnel and, if
-so, the destination address or name of the tunnel end point which should be used. 
-</t>
-
-<section title="Tunnel authorization">
-<t>
-The OE gateway determines whether or not to create a tunnel based on 
-the destination address of each packet. Upon receiving a packet with a destination
-address not recently seen, the OE gateway performs a lookup in DNS for an
-authorization resource record (see <xref target="TXT"/>). The record is located using
-the IP address to perform a search in the in-addr.arpa (IPv4) or ip6.arpa
-(IPv6) maps. If an authorization record is found, the OE gateway 
-interprets this as a request for a tunnel to be formed.
-</t>
-</section> 
-
-<section title="Tunnel end-point discovery">
-
-<t>
-The authorization resource record also provides the address or name of the tunnel
-end point which should be used.
-</t>
-<t>
-The record may also provide the public RSA key of the tunnel end point
-itself. This is provided for efficiency only. If the public RSA key is not 
-present, the OE gateway performs a second lookup to find a KEY 
-resource record for the end point address or name.
-</t>
-<t>
-Origin and integrity protection of the resource records is provided by 
-DNSSEC (<xref target="RFC2535"/>). <xref target="nodnssec"/>
-documents an optional restriction on the tunnel end point if DNSSEC signatures
-are not available for the relevant records. 
-</t>
-
-</section>
-
-<section title="Caching of authorization results">
-<t>
-The OE gateway maintains a cache, in the forwarding plane, of
-source/destination pairs for which opportunistic encryption has been
-attempted. This cache maintains a record of whether or not OE was
-successful so that subsequent datagrams can be forwarded properly
-without additional delay. 
-</t>
-
-<t>
-Successful negotiation of OE instantiates a new security association. 
-Failure to negotiate OE results in creation of a 
-forwarding policy entry either to drop or transmit in the clear future
-datagrams. This negative cache is necessary to avoid the possibly lengthy process of repeatedly looking 
-up the same information.
-</t>
-
-<t>
-The cache is timed out periodically, as described in <xref target="teardown" />.
-This removes entries that are no longer
-being used and permits the discovery of changes in authorization policy.
-</t>
-</section>
-
-</section> <!-- "Model of operation" -->
-
-</section> <!-- "Overview" -->
-
-<section title="Protocol Specification">
-
-<t>
-The OE gateway is modeled to have a forwarding plane and a control
-plane. A control channel, such as PF_KEY, connects the two planes. 
-(See <xref target="RFC2367" />.)
-The forwarding plane performs per datagram operations. The control plane
-contains a keying daemon, such as ISAKMP/IKE, and performs all
-authorization, peer authentication and key derivation functions.   
-</t>
-
-<section title="Forwarding plane state machine">
-
-<t>
-Let the OE gateway maintain a collection of objects -- a superset of the
-security policy database (SPD) specified in <xref target="RFC2401" />. For
-each combination of source and destination address, an SPD
-object exists in one of five following states.
-Prior to forwarding each datagram, the responder uses the source and
-destination addresses to pick an entry from the SPD. 
-The SPD then determines if and how the packet is forwarded.
-</t>
-
-<!-- from file forwardingstate.txt -->
-<artwork><![CDATA[
-      .--------------. 	 
-      | non-existant |
-      |    policy    |
-      `--------------'
-             |        
-             | PF_ACQUIRE
-             |           
-             |<---------.
-             V          | new packet
-      .--------------.  | (maybe resend PF_ACQUIRE)
-      |  hold policy |--'                          
-      |              |--.                          
-      `--------------'   \  pass                   
-         |        |       \ msg    .---------.     
-         |        |        \       V         | forward
-         |        |         .-------------.  | packet 
-  create |        |         | pass policy |--'       
-  IPsec  |        |         `-------------'          
-  SA     |        |                                  
-         |         \                                 
-         |          \                                
-         V           \ 	deny                         
-   .---------.        \ msg                          
-   | encrypt |         \                             
-   | policy  |          \         ,---------.        
-   `---------'           \        |         | discard
-                          \       V         | packet 
-                           .-------------.  |        
-                           | deny policy |--'        
-                           '-------------'          
-]]></artwork>
-
-
-<section title="Non-existent policy">
-<t>
-If the gateway does not find an entry, then this policy applies.
-The gateway creates an entry with an initial state of "hold policy" and requests 
-keying material from the keying daemon. The gateway does not forward the datagram,
-rather it SHOULD attach the datagram to the SPD entry as the  "first" datagram and retain it 
-for eventual transmission in a new state. 
-
-</t>
-</section>
-
-<section title="Hold policy">
-<t>
-The gateway requests keying material. If the interface to the keying
-system is lossy (PF_KEY, for instance, can be), the implementation 
-SHOULD include a mechanism to retransmit the
-keying request at a rate limited to less than 1 request per second.
-The gateway does not forward the datagram. The gateway SHOULD attach the 
-datagram to the SPD entry as the "last" datagram where it is retained 
-for eventual transmission.
-If there is a datagram already so stored, then that already stored datagram is discarded.
-</t>
-<t>
-The rational behind saving the the "first" and "last" datagrams are as follows:
-The "first" datagram is probably a TCP SYN packet. Once there is keying
-established, the gateway will release this datagram, avoiding the need to 
-for the end-point to retransmit the datagram. In the case where the connection
-was not a TCP connection, buyt was instead a streaming protocol or a DNS request,
-the "last" datagram that was retained is likely the most recent data. The difference
-between "first" and "last" may also help the end-points determine
-which data awas dropped while negotiation took place.  
-</t>
-</section>
-
-<section title="Pass-through policy">
-<t>
-The gateway forwards the datagram using the normal forwarding table. 
-The gateway enters this state only by command from the keying daemon, 
-and upon entering this state, also forwards the "first" and "last" datagrams.
-</t>
-</section>
-
-<section title="Deny policy">
-<t>
-The gateway discards the datagram. The gateway enters this state only by
-command  
-from the keying daemon, and upon entering this state, discards the "first"
-and "last" datagrams.
-An implementation MAY provide the administator with a control to determine
-if further datagrams cause ICMP messages
-to be generated (i.e. ICMP Destination Unreachable, Communication
-Administratively Prohibited. type=3, code=13). 
-</t>
-</section>
-
-<section title="Encrypt policy">
-<t>
-The gateway encrypts the datagram using the indicated security association database
-(SAD) entry.  The gateway enters this state only by command from the keying daemon, and upon entering
-this state, releases and forwards the "first" and "last" datagrams using the
-new encrypt policy.  
-</t>
-<t>
-If the associated SAD entry expires because of byte, packet or time limits, then
-the entry returns to the Hold policy, and an expire message is sent to the keying daemon.
-</t>
-</section>
-
-<t>
-All states may be created directly by the keying daemon while acting as a
-gateway. 
-</t>
-
-</section> <!-- "Datagram state machine" -->
-
-
-<section anchor="initclasses" title="Keying Daemon -- initiator">
-<t>
-Let the keying daemon maintain a collection of objects. Let them be
-called "connections" or "conn"s. There are two categories of
-connection objects: classes and instances. A class represents an
-abstract policy - what could be. An instance represents an actual connection -  
-what is implemented at the time.
-</t>
-
-<t>
-Let there be two further subtypes of connections: keying channels (Phase
-1 SAs) and data channels (Phase 2 SAs). Each data channel object may have 
-a corresponding SPD and SAD entry maintained by the datagram state machine.
-</t>
-
-<t>
-For the purposes of opportunistic encryption, there MUST, at least, be
-connection classes known as "deny", "always-clear-text", "OE-permissive", and 
-"OE-paranoid".  
-The latter two connection classes define a set of source and/or destination
-addresses for which opportunistic encryption will be attempted.
-The administrator MAY set policy options in a number of additional places.
-An implementation MAY create additional connection classes to further refine
-these policies.
-</t>
-
-<t>
-The simplest system may need only the "OE-permissive" connection, and would
-list its own (single) IP address as the source address of this policy and
-the wild-card address 0.0.0.0/0 as the destination IPv4 address. That is, the
-simplest policy is to try opportunistic encryption with all destinations. 
-</t>
-
-<t>
-The distinction between permissive and paranoid OE use will become clear 
-in the state transition differences. In general a permissive OE will, on
-failure, install a pass-through policy, while a paranoid OE will, on failure, 
-install a drop policy.
-</t>
-
-<t>
-In this description of the keying machine's state transitions, the states
-associated with the keying system itself are omitted because they are best documented in the keying system 
-(<xref target="RFC2407" />, 
-<xref target="RFC2408" /> and <xref target="RFC2409" /> for ISAKMP/IKE),
-and the details are keying system specific. Opportunistic encryption is not
-dependent upon any specific keying protocol, but this document does provide
-requirements for those using ISAKMP/IKE to assure that implementations inter-operate.
-</t>
-<t>
-The state transitions that may be involved in communicating with the
-forwarding plane are omitted. PF_KEY and similar protocols have their own
-set of states required for message sends and completion notifications.
-</t>
-<t>
-Finally, the retransmits and recursive lookups that are normal for DNS are 
-not included in this description of the state machine.
-</t>
-
-<!-- from file initiatorstate.txt -->
-<artwork><![CDATA[
-
-                       |
-	               | PF_ACQUIRE
-		       |     
-                       V
-                .---------------.       
-                |  non-existant |
-                |  connection   |
-                `---------------'
-                 |      |      |
-          send   ,      |      \
-expired   pass  /       |       \ send
-conn.     msg  /        |        \ deny
-  ^           /         |         \ msg
-  |          V          | do       \ 		 
-.---------------.       | DNS       \   .---------------.  
-|  clear-text   |	| lookup     `->|     deny      |---> expired
-|  connection   |	| for 	        |  connection   |     connection
-`---------------'	| destination   `---------------'
-   ^ ^                  |                   ^
-   | | no record        |                   |
-   | | OE-permissive    V                   | no record
-   | |            .---------------.         | OE-paranoid
-   | `------------|  potential OE |---------'
-   |              |  connection   |         ^
-   |              `---------------'         |
-   |                    |                   |
-   |                    | got TXT record    | DNSSEC failure
-   |                    | reply             |
-   |                    V                   | wrong 
-   |              .---------------.         | failure
-   |              |  authenticate |---------'
-   |              | & parse TXT RR|         ^
-   | repeated     `---------------'         |
-   | ICMP               |                   |
-   | failures           | initiate IKE to   |                         
-   | (short-timeout)    | responder         |                         
-   |                    V                   |                          
-   | phase-2      .---------------.         | failure                       
-   | failure      |   pending     |---------'                          
-   | (normal      |     OE        |         ^                          
-   |  timeout)    |               |invalid  | phase-2 failure (short-timeout)
-   |              |               |<--.SPI  | ICMP failures (normal timeout)
-   |              |               |   |     |                          
-   |              | +=======+     |---'     |                          
-   |              | |  IKE  |     |   ^     |                          
-   `--------------| | states|---------------'                          
-                  | +=======+     |   |                                
-                  `---------------'   |                                
-                        | IPsec SA    | invalid SPI                    
-                        | established |                                
-	                V             | rekey time                     
-                  .--------------.    |                                
-                  |   keyed      |<---|-------------------------------.
-                  |  connection  |----'                               |
-                  `--------------'                                    |
-                        | timer                                       |
-                        |                                             |
-                        V                                             |
-                  .--------------.     connection still active        |
-  clear-text----->|   expired    |------------------------------------'
-        deny----->|  connection  |
-                  `--------------'
-                        | dead connected - deleted
-                        V
-]]></artwork>
-
-
-<section title="Nonexistent connection">
-<t>
-There is no connection instance for a given source/destination address pair.
-Upon receipt of a request for keying material for this
-source/destination pair, the initiator searches through the connection classes to
-determine the most appropriate policy. Upon determining an appropriate
-connection class, an instance object is created of that type. 
-Both of the OE types result in a potential OE connection.
-</t>
-<t>Failure to find an appropriate connection class results in an
-administrator defined default. 
-</t>
-<t>
-In each case, when the initiator finds an appropriate class for the new flow, 
-an instance connection is made of the class which matched.
-</t>
-</section>
-
-<section title="Clear-text connection">
-<t>
-The non-existent connection makes a transition to this state when an
-always-clear-text class is instantiated, or when an OE-permissive 
-connection fails. During the transition, the initiator creates a pass-through
-policy object in the forwarding plane for the appropriate flow.
-</t>
-<t>
-Timing out is the only way to leave this state
-(see <xref target="expiring" />).
-</t>
-</section>
-
-<section title="Deny connection">
-<t>
-The empty connection makes a transition to this state when a
-deny class is instantiated, or when an OE-paranoid connection fails. 
-During the transition, the initiator creates a deny policy object in the forwarding plane 
-for the appropriate flow.  
-</t>
-<t>
-Timing out is the only way to leave this state 
-(see <xref target="expiring" />).
-</t>
-</section>
-
-<section title="Potential OE connection">
-<t>
-The empty connection makes a transition to this state when one of either OE class is instantiated.
-During the transition to this state, the initiator creates a hold policy object in the 
-forwarding plane for the appropriate flow.  
-</t>
-<t>
-In addition, when making a transition into this state, DNS lookup is done in
-the reverse-map for a TXT delegation resource record (see <xref target="TXT" />).
-The lookup key is the destination address of the flow.
-</t>
-<t>
-There are three ways to exit this state: 
-<list style="numbers">
-<t>DNS lookup finds a TXT delegation resource record.</t>
-<t>DNS lookup does not find a TXT delegation resource record.</t>
-<t>DNS lookup times out.</t>
-</list>
-</t>
-
-<t>
-Based upon the results of the DNS lookup, the potential OE connection makes a
-transition to the pending OE connection state.  The conditions for a
-successful DNS look are:
-<list style="numbers">
-<t>DNS finds an appropriate resource record</t>
-<t>It is properly formatted according to <xref target="TXT" /></t>
-<t> if DNSSEC is enabled, then the signature has been vouched for.</t>
-</list>
-
-Note that if the initiator does not find the public key 
-present in the TXT delegation record, then the public key must 
-be looked up as a sub-state. Only successful completion of all the 
-DNS lookups is considered a success.
-</t>
-<t>
-If DNS lookup does not find a resource record or DNS times out, then the 
-initiator considers the receiver not OE capable. If this is an OE-paranoid instance, 
-then the potential OE connection makes a transition to the deny connection state.
-If this is an OE-permissive instance, then the potential OE connection makes a transition to the
-clear-text connection state.
-</t>
-<t>
-If the initiator finds a resource record but it is not properly formatted, or
-if DNSSEC is 
-enabled and reports a failure to authenticate, then the potential OE
-connection makes a 
-transition to the deny connection state. This action SHOULD be logged. If the
-administrator wishes to override this transition between states, then an
-always-clear class can be installed for this flow. An implementation MAY make
-this situation a new class.
-</t>
-
-<section anchor="nodnssec" title="Restriction on unauthenticated TXT delegation records">
-<t>
-An implementation SHOULD also provide an additional administrative control
-on delegation records and DNSSEC. This control would apply to delegation
-records (the TXT records in the reverse-map) that are not protected by
-DNSSEC.
-Records of this type are only permitted to delegate to their own address as
-a gateway. When this option is enabled, an active attack on DNS will be
-unable to redirect packets to other than the original destination.
-<!-- This was asked for by Bill Sommerfeld -->
-</t>
-</section>
-</section>
-
-<section title="Pending OE connection">
-<t>
-The potential OE connection makes a transition to this state when 
-the initiator determines that all the information required from the DNS lookup is present.
-Upon entering this state, the initiator attempts to initiate keying to the gateway
-provided.  
-</t>
-<t>
-Exit from this state occurs either with a successfully created IPsec SA, or
-with a failure of some kind.  Successful SA creation results in a transition
-to the key connection state.
-</t>
-<t>
-Three failures have caused significant problems. They are clearly not the
-only possible failures from keying.
-</t>
-<t>
-Note that if there are multiple gateways available in the TXT delegation
-records, then a failure can only be declared after all have been
-tried. Further, creation of a phase 1 SA does not constitute success. A set
-of phase 2 SAs (a tunnel) is considered success.
-</t>
-<t>
-The first failure occurs when an ICMP port unreachable is consistently received
-without any other communication, or when there is silence from the remote
-end. This usually means that either the gateway is not alive, or the
-keying daemon is not functional. For an OE-permissive connection, the initiator makes a transition
-to the clear-text connection but with a low lifespan. For an OE-pessimistic connection,
-the initiator makes a transition to the deny connection again with a low lifespan. The
-lifespan in both 
-cases is kept low because the remote gateway may
-be in the process of rebooting or be otherwise temporarily unavailable. 
-</t>
-<t>
-The length of time to wait for the remote keying daemon to wake up is
-a matter of some debate. If there is a routing failure, 5 minutes is usually long
-enough for the network to
-re-converge. Many systems can reboot in that amount of
-time as well. However, 5 minutes is far too long for most users to wait to
-hear that they can not connect using OE. Implementations SHOULD make this a
-tunable parameter.
-</t>
-<t>
-The second failure occurs after a phase 1 SA has been created, but there is 
-either no response to the phase 2 proposal, or the initiator receives a 
-negative notify (the notify must be 
-authenticated). The remote gateway is not prepared to do OE at this time. 
-As before, the initiator makes a transition to the clear-text or the deny 
-connection based upon connection class, but this
-time with a normal lifespan. 
-</t>
-<t>
-The third failure occurs when there is signature failure while authenticating
-the remote gateway. This can occur when there has been a 
-key roll-over, but DNS has not caught up. In this case again, the initiator makes a 
-transition to the clear-text or the deny connection based
-upon the connection class. However, the lifespan depends upon the remaining
-time to live in the DNS. (Note that DNSSEC signed resource records have a different
-expiry time than non-signed records.) 
-<!-- dig @gateway would also work here -->
-</t>
-
-</section>
-
-<section anchor="keyed" title="Keyed connection">
-<t>
-The pending OE connection makes a transition to this state when 
-session keying material (the phase 2 SAs) is derived. The initiator creates an encrypt
-policy in the forwarding plane for this flow.
-</t>
-<t>
-There are three ways to exit this state. The first is by receipt of an
-authenticated delete message (via the keying channel) from the peer. This is
-normal teardown and results in a transition to the expired connection state.
-</t>
-<t>
-The second exit is by expiry of the forwarding plane keying material. This
-starts a re-key operation with a transition back to pending OE
-connection. In general, the soft expiry occurs with sufficient time left
-to continue to use the keys. A re-key can fail, which may
-result in the connection failing to clear-text or deny as
-appropriate. In the event of a failure, the forwarding plane
-policy does not change until the phase 2 SA (IPsec SA) reaches its
-hard expiry.
-</t>
-<t>
-The third exit is in response to a negotiation from a remote
-gateway. If the forwarding plane signals the control plane that it has received an
-unknown SPI from the remote gateway, or an ICMP is received from the remote gateway
-indicating an unknown SPI, the initiator should consider that 
-the remote gateway has rebooted or restarted. Since these 
-indications are easily forged, the implementation must 
-exercise care.  The initiator should make a cautious 
-(rate-limited) attempt to re-key the connection. 
-</t>
-</section>
-
-<section anchor="expiring" title="Expiring connection">
-<t>
-The initiator will periodically place each of the deny, clear-text, and keyed
-connections into this  
-sub-state. See <xref target="teardown" /> for more details of how often this
-occurs. 
-The initiator queries the forwarding plane for last use time of the
-appropriate 
-policy. If the last use time is relatively recent, then the connection
-returns to the 
-previous deny, clear-text or keyed connection state. If not, then the
-connection enters 
-the expired connection state. 
-</t>
-<t>
-The DNS query and answer that lead to the expiring connection state are also
-examined. The DNS query may become stale. (A negative, i.e. no such record, answer
-is valid for the period of time given by the MINIMUM field in an attached SOA 
-record. See <xref target="RFC1034" /> section 4.3.4.)
-If the DNS query is stale, then a new query is made. If the results change, then the connection 
-makes a transition to a new state as described in potential OE connection state.
-</t>
-<t> 
-Note that when considering how stale a connection is, both outgoing SPD and
-incoming SAD must be queried as some flows may be unidirectional for some time.
-</t>
-<t>
-Also note that the policy at the forwarding plane is not updated unless there
-is a conclusion that there should be a change.
-</t>
-
-</section>
-<section title="Expired connection">
-<t>
-Entry to this state occurs when no datagrams have been forwarded recently via the
-appropriate SPD and SAD objects. The objects in the forwarding plane are
-removed (logging any final byte and packet counts if appropriate) and the
-connection instance in the keying plane is deleted. 
-</t>
-<t>
-The initiator sends an ISAKMP/IKE delete to clean up the phase 2 SAs as described in
-<xref target="teardown" />. 
-</t>
-<t>
-Whether or not to delete the phase 1 SAs
-at this time is left as a local implementation issue. Implementations
-that do delete the phase 1 SAs MUST send authenticated delete messages to
-indicate that they are doing so.  There is an advantage to keeping
-the phase 1 SAs until they expire - they may prove useful again in the 
-near future.
-</t>
-</section>
-
-</section> <!-- "Keying state machine - initiator" -->
-
-<section title="Keying Daemon - responder">
-<t>
-The responder has a set of objects identical to those of the initiator.
-</t>
-<t>
-The responder receives an invitation to create a keying channel from an initiator. 
-</t>
-
-<!-- from file responderstate.txt -->
-<artwork><![CDATA[
-                |
-                | IKE main mode 
-                |  phase 1
-                V
-        .-----------------.  
-        | unauthenticated | 
-        |     OE peer     |
-        `-----------------'
-                |
-                | lookup KEY RR in in-addr.arpa 
-                |             (if ID_IPV4_ADDR)
-                | lookup KEY RR in forward
-                |             (if ID_FQDN)
-                V
-        .-----------------.  RR not found
-        |   received DNS  |---------------> log failure
-        |     reply       | 
-        `----+--------+---'
-     phase 2 |        \      misformatted 
-    proposal |         `------------------> log failure
-             V
-    .----------------.
-    |  authenticated |  identical initiator 
-    |     OE peer    |--------------------> initiator 
-    `----------------'  connection found    state machine
-         |
-         | look for TXT record for initiator
-	 |
-         V  
-   .---------------.
-   |  authorized   |---------------------> log failure
-   |    OE peer    |
-   `---------------'
-         |
-         |
-         V
-    potential OE
-    connection in
-    initiator state
-	machine
-
-
-$Id: draft-richardson-ipsec-opportunistic.xml,v 1.1 2004/03/15 20:35:24 as Exp $
-]]></artwork>
-
-
-<section title="Unauthenticated OE peer">
-<t>
-Upon entering this state, the responder starts a DNS lookup for a KEY record for the
-initiator. 
-The responder looks in the reverse-map for a KEY record for the initiator if the
-initiator has offered an ID_IPV4_ADDR, and in the forward map if the
-initiator has offered an ID_FQDN type. (See <xref target="RFC2407" /> section 
-4.6.2.1.)
-</t>
-<t>
-The responder exits this state upon successful receipt of a KEY from DNS, and use of the key 
-to verify the signature of the initiator.
-</t>
-
-<!--
-<t>
-The public key that is retrieved should be stored in stable storage for an
-administratively defined period of time, (typically several months if
-possible). If a key has previously been stored on disk, then the returned key
-should be compared to what has been received, and the key considered valid
-only if they match.  
-</t>
--->
-
-<t>
-Successful authentication of the peer results in a transition to the
-authenticated OE Peer state.
-</t>
-<t>
-Note that the unauthenticated OE peer state generally occurs in the middle of the key negotiation
-protocol. It is really a form of pseudo-state.
-</t>
-</section>
-
-<section title="Authenticated OE Peer">
-<t>
-The peer will eventually propose one or more phase 2 SAs. The responder uses the source and
-destination address in the proposal to 
-finish instantiating the connection state
-using the connection class table.
-The responder MUST search for an identical connection object at this point. 
-</t>
-<t> 
-If an identical connection is found, then the responder deletes the old instance, 
-and the new object makes a transition to the pending OE connection state. This means
-that new ISAKMP connections with a given peer will always use the latest
-instance, which is the correct one if the peer has rebooted in the interim.
-</t>
-<t> 
-If an identical connection is not found, then the responder makes the transition according to the 
-rules given for the initiator.
-</t>
-<t> 
-Note that if the initiator is in OE-paranoid mode and the responder is in 
-either always-clear-text or deny, then no communication is possible according
-to policy. An implementation is permitted to create new types of policies 
-such as "accept OE but do not initiate it". This is a local matter.
- </t>
-</section>
-
-</section> <!-- "Keying state machine - responder" -->
-
-<section anchor="teardown" title="Renewal and teardown">
-  <section title="Aging">
-<t>
-A potentially unlimited number of tunnels may exist. In practice, only a few
-tunnels are used during a period of time. Unused tunnels MUST, therefore, be
-torn down. Detecting when tunnels are no longer in use is the subject of this section.
-</t>
-
-<t>
-There are two methods for removing tunnels: explicit deletion or expiry. 
-</t>
-
-<t>
-Explicit deletion requires an IKE delete message. As the deletes
-MUST be authenticated, both ends of the tunnel must maintain the 
-key channel (phase 1 ISAKMP SA). An implementation which refuses to either maintain or
-recreate the keying channel SA will be unable to use this method.
-</t>
-
-<t>
-The tunnel expiry method simply allows the IKE daemon to
-expire normally without attempting to re-key it.
-</t>
-
-<t>
-Regardless of which method is used to remove tunnels, the implementation MUST
-a method to determine if the tunnel is still in use.  The specifics are a
-local matter, but  the FreeS/WAN project uses the following criteria. These
-criteria are currently implemented in the key management daemon, but could
-also be implemented at the SPD layer using an idle timer.
-</t>
-
-<t>
-Set a short initial (soft) lifespan of 1 minute since many net flows last
-only a few seconds.
-</t>
-
-<t>
-At the end of the lifespan, check to see if the tunnel was used by
-traffic in either direction during the last 30 seconds. If so, assign a
-longer tentative lifespan of 20 minutes after which, look again. If the
-tunnel is not in use, then close the tunnel.
-</t>
-
-<t>
-The expiring state in the key management
-system (see <xref target="expiring" />) implements these timeouts.
-The timer above may be in the forwarding plane, 
-but then it must be re-settable. 
-</t>
-
-<t>
-The tentative lifespan is independent of re-keying; it is just the time when
-the tunnel's future is next considered. 
-(The term lifespan is used here rather than lifetime for this reason.) 
-Unlike re-keying, this tunnel use check is not costly and should happen
-reasonably frequently.
-</t> 
-
-<t>
-A multi-step back-off algorithm is not considered worth the effort here.
-</t>
-
-<t>
-If the security gateway and the client host are the
-same and not a Bump-in-the-Stack or Bump-in-the-Wire implementation, tunnel
-teardown decisions MAY pay attention to TCP connection status as reported
-by the local TCP layer.  A still-open TCP connection is almost a guarantee that more traffic is
-expected. Closing of the only TCP connection through a tunnel is a
-strong hint that no more traffic is expected.
-</t>
-
-</section> <!-- "Aging" -->
-
-<section title="Teardown and cleanup">
-
-<t>
-Teardown should always be coordinated between the two ends of the tunnel by 
-interpreting and sending delete notifications. There is a
-detailed sub-state in the expired connection state of the key manager that
-relates to retransmits of the delete notifications, but this is considered to 
-be a keying system detail.
-</t>
-
-<t>
-On receiving a delete for the outbound SAs of a tunnel (or some subset of
-them), tear down the inbound ones also and notify the remote end with a
-delete. If the local system receives a delete for a tunnel which is no longer in
-existence, then two delete messages have crossed paths. Ignore the delete.
-The operation has already been completed. Do not generate any messages in this
-situation. 
-</t>
-<t>
-Tunnels are to be considered as bidirectional entities, even though the
-low-level protocols don't treat them this way. 
-</t>
-
-<t>
-When the deletion is initiated locally, rather than as a
-response to a received delete, send a delete for (all) the
-inbound SAs of a tunnel.  If the local system does not receive a responding delete 
-for the outbound SAs, try re-sending the original
-delete. Three tries spaced 10 seconds apart seems a reasonable
-level of effort. A failure of the other end to respond after 3 attempts, 
-indicates that the possibility of further communication is unlikely. Remove the outgoing SAs.
-(The remote system may be a mobile node that is no longer present or powered on.)
-</t>
-
-<t>
-After re-keying, transmission should switch to using the new
-outgoing SAs (ISAKMP or IPsec) immediately, and the old leftover
-outgoing SAs should be cleared out promptly (delete should be sent
-for the outgoing SAs) rather than waiting for them to expire. This
-reduces clutter and minimizes confusion for the operator doing diagnostics.
-</t>
-
-</section>
-
-</section>
-
-</section> <!-- "Specification" -->
-
-<section title="Impacts on IKE">
-
-  <section title="ISAKMP/IKE protocol">
-    <t>
-    The IKE wire protocol needs no modifications. The major changes are
-    implementation issues relating to how the proposals are interpreted, and from
-    whom they may come.
-    </t>
-    <t>
-    As opportunistic encryption is designed to be useful between peers without
-    prior operator configuration, an IKE daemon must be prepared to negotiate
-    phase 1 SAs with any node. This may require a large amount of resources to 
-    maintain cookie state, as well as large amounts of entropy for nonces,
-    cookies and so on. 
-    </t>
-    <t>
-    The major changes to support opportunistic encryption are at the IKE daemon
-    level. These changes relate to handling of key acquisition requests, lookup
-    of public keys and TXT records, and interactions with firewalls and other
-    security facilities that may be co-resident on the same gateway.
-    </t>
-  </section>
-
-  <section title="Gateway discovery process">
-  <t>
-  In a typical configured tunnel, the address of SG-B is provided
-  via configuration. Furthermore, the mapping of an SPD entry to a gateway is
-  typically a 1:1 mapping. When the 0.0.0.0/0 SPD entry technique is used, then
-  the mapping to a gateway is determined by the reverse DNS records.
-  </t>
-  <t>
-  The need to do a DNS lookup and wait for a reply will typically introduce a
-  new state and a new event source (DNS replies) to IKE. Although a
-synchronous DNS request can be implemented for proof of concept, experience
-is that it can cause very high latencies when a queue of queries must
-all timeout in series. 
-  </t>
-  <t> 
-  Use of an asynchronous DNS lookup will also permit overlap of DNS lookups with
-  some of the protocol steps.
-  </t>
-  </section>
-
-  <section title="Self identification">
-  <t>
-     SG-A will have to establish its identity. Use an
-     IPv4 ID in phase 1. 
-  </t>
-  <t> There are many situations where the administrator of SG-A may not be
-      able to control the reverse DNS records for SG-A's public IP address.
-      Typical situations include dialup connections and most residential-type broadband Internet access 
-      (ADSL, cable-modem) connections. In these situations, a fully qualified domain
-      name that is under the control of SG-A's administrator may be used
-      when acting as an initiator only.
-      The FQDN ID should be used in phase 1. See <xref target="fqdn" />
-      for more details and restrictions.
-  </t>
-  </section>
-
-  <section title="Public key retrieval process">
-  <t>
-     Upon receipt of a phase 1 SA proposal with either an IPv4 (IPv6) ID or
-     an FQDN ID, an IKE daemon needs to examine local caches and
-     configuration files to determine if this is part of a configured tunnel.
-     If no configured tunnels are found, then the implementation should attempt to retrieve
-     a KEY record from the reverse DNS in the case of an IPv4/IPv6 ID, or 
-     from the forward DNS in the case of FQDN ID.
-  </t>
-  <t> 
-     It is reasonable that if other non-local sources of policy are used
-     (COPS, LDAP), they be consulted concurrently but some
-     clear ordering of policy be provided. Note that due to variances in
-     latency, implementations must wait for positive or negative replies from all sources
-     of policy before making any decisions.
-  </t>
-  </section>
-  
-  <section title="Interactions with DNSSEC">
-  <t>
-     The implementation described (1.98) neither uses DNSSEC directly to
-     explicitly verify the authenticity of zone information, nor uses the NXT
-     records to provide authentication of the absence of a TXT or KEY
-     record. Rather, this implementation uses a trusted path to a DNSSEC
-     capable caching resolver. 
-  </t>
-  <t> 
-     To distinguish between an authenticated and an unauthenticated DNS
-     resource record, a stub resolver capable of returning DNSSEC
-     information MUST be used.
-  </t>
-     
-  </section>
-
-<!--
-  <section title="Interactions with COPS">
-  <t>
-     At this time there is no experience with implementations that interact
-     with COPS Policy Decision Points (PDP) <xref target="RFC2748" />. It is
-     suggested that it may be 
-     appropriate for many of 
-     the policy and discovery mechanisms outlined here to be done by a PDP.
-     In this context, the IKE daemon present in the Policy Enforcement Point
-     (PEP) may not need any modifications.
-  </t>
-  </section>
--->
-
-  <section title="Required proposal types">
-
-    <section anchor="phase1id" title="Phase 1 parameters">
-      <t>
-        Main mode MUST be used.
-      </t>
-      <t>
-	The initiator MUST offer at least one proposal using some combination
-	of: 3DES, HMAC-MD5 or HMAC-SHA1, DH group 2 or 5. Group 5 SHOULD be
-	proposed first.
-	<xref target="RFC3526" />
-      </t>
-      <t>
-	The initiator MAY offer additional proposals, but the cipher MUST not
-	be weaker than 3DES. The initiator SHOULD limit the number of proposals
-	such that the IKE datagrams do not need to be fragmented.
-      </t>
-      <t>
-	The responder MUST accept one of the proposals. If any configuration
-	of the responder is required then the responder is not acting in an
-	opportunistic way. 
-      </t>
-      <t>
-        The initiator SHOULD use an ID_IPV4_ADDR (ID_IPV6_ADDR for IPv6) of the external
-        interface of the initiator for phase 1. (There is an exception, see <xref
-        target="fqdn" />.) The authentication method MUST be RSA public key signatures. 
-        The RSA key for the initiator SHOULD be placed into a DNS KEY record in
-	the reverse space of the initiator (i.e. using in-addr.arpa or
-        ip6.arpa).
-      </t>
-    </section>
-
-    <section anchor="phase2id" title="Phase 2 parameters">
-      <t>
-        The initiator MUST propose a tunnel between the ultimate
-        sender ("Alice" or "A") and ultimate recipient ("Bob" or "B")
-        using 3DES-CBC
-        mode, MD5 or SHA1 authentication. Perfect Forward Secrecy MUST be specified.
-      </t>
-      <t>
-        Tunnel mode MUST be used.
-      </t>
-      <t>
-        Identities MUST be ID_IPV4_ADDR_SUBNET with the mask being /32.
-      </t>
-      <t>
-        Authorization for the initiator to act on Alice's behalf is determined by
-        looking for a TXT record in the reverse-map at Alice's IP address.
-      </t>
-      <t>
-        Compression SHOULD NOT be mandatory. It MAY be offered as an option.
-      </t>
-    </section>
-  </section>
-
-</section>
-
-<section title="DNS issues">
-  <section anchor="KEY" title="Use of KEY record">
-  <t>
-    In order to establish their own identities, security gateways SHOULD publish
-    their public keys in their reverse DNS via 
-    DNSSEC's KEY record.
-    See section 3 of <xref target="RFC2535">RFC 2535</xref>.
-  </t>	
-  <t>
-    <preamble>For example:</preamble>
-    <artwork><![CDATA[
-KEY 0x4200 4 1 AQNJjkKlIk9...nYyUkKK8
-]]></artwork>
-
-  <list style="hanging">
-  <t hangText="0x4200:"> The flag bits, indicating that this key is prohibited
-    for confidentiality use (it authenticates the peer only, a separate
-    Diffie-Hellman exchange is used for
-    confidentiality), and that this key is associated with the non-zone entity
-    whose name is the RR owner name. No other flags are set.</t>
-  <t hangText="4:">This indicates that this key is for use by IPsec.</t>
-  <t hangText="1:">An RSA key is present.</t>
-  <t hangText="AQNJjkKlIk9...nYyUkKK8:">The public key of the host as described in <xref target="RFC3110" />.</t> 
-  </list>
-  </t>
-  <t>Use of several KEY records allows for key rollover. The SIG Payload in
-  IKE phase 1 SHOULD be accepted if the public key given by any KEY RR
-  validates it.
-  </t>
-  </section>
-
-  <section anchor="TXT" title="Use of TXT delegation record">
-    <t>
-If, for example, machine Alice wishes SG-A to act on her behalf, then
-she publishes a TXT record to provide authorization for SG-A to act on
-Alice's behalf. Similarly for Bob and SG-B.
-</t>
-
-<t>
-These records are located in the reverse DNS (in-addr.arpa or ip6.arpa) for their
-respective IP addresses.  The reverse DNS SHOULD be secured by DNSSEC.
-DNSSEC is required to defend against active attacks.
-    </t>
-    <t>
-      If Alice's address is P.Q.R.S, then she can authorize another node to
-      act on her behalf by publishing records at:
-           <artwork><![CDATA[
-S.R.Q.P.in-addr.arpa
-          ]]></artwork>
-    </t>
-
-    <t>
-    The contents of the resource record are expected to be a string that
-    uses the following syntax, as suggested in <xref target="RFC1464">RFC1464</xref>.
-    (Note that the reply to query may include other TXT resource
-    records used by other applications.)
-
-    <figure anchor="txtformat" title="Format of reverse delegation record">
-           <artwork><![CDATA[
-X-IPsec-Server(P)=A.B.C.D KEY
-          ]]></artwork>
-    </figure>
-    </t>
-
-    where the record is formed by the following fields:
-
-    <list style="hanging"> 
-      <t hangText="P:"> Specifies a precedence for this record.  This is
-      similar to MX record preferences.  Lower numbers have stronger
-      preference. 
-      </t>  
-
-      <t hangText="A.B.C.D:"> Specifies the IP address of the Security Gateway
-      for this client machine.
-      </t>
-
-      <t hangText="KEY:"> Is the encoded RSA Public key of the Security
-      Gateway. The key is provided here to avoid a second DNS lookup. If this
-      field is absent, then a KEY resource record should be looked up in the
-      reverse-map of A.B.C.D. The key is transmitted in base64 format.
-      </t> 
-    </list>
-
-    <t>
-  	The fields of the record MUST be separated by whitespace. This
-        MAY be: space, tab, newline, or carriage return. A space is preferred.
-    </t>
-
-    <t>
-	In the case where Alice is located at a public address behind a 
-	security gateway that has no fixed address (or no control over its
-	reverse-map), then Alice may delegate to a public key by domain name.
-
-    <figure anchor="txtfqdnformat"
-            title="Format of reverse delegation record (FQDN version)">
-           <artwork><![CDATA[
-X-IPsec-Server(P)=@FQDN KEY
-          ]]></artwork>
-    </figure>
-    </t>
-
-    <list style="hanging"> 
-      <t hangText="P:"> Is as above.
-      </t>  
-
-      <t hangText="FQDN:"> Specifies the FQDN that the Security Gateway
-      will identify itself with. 
-      </t>
-
-      <t hangText="KEY:"> Is the encoded RSA Public key of the Security
-      Gateway. </t> 
-    </list>
-
-    <t>
-	If there is more than one such TXT record with strongest (lowest
-	numbered) precedence, one Security Gateway is picked arbitrarily from
-	those specified in the strongest-preference records. 
-    </t>
- 
-  <section title="Long TXT records">
-  <t>
-  When packed into transport format, TXT records which are longer than 255
-  characters are divided into smaller &lt;character-strings&gt;.
-  (See <xref target="RFC1035" /> section 3.3 and 3.3.14.) These MUST
-  be reassembled into a single string for processing.
-  Whitespace characters in the base64 encoding are to be ignored.
-  </t>
-  </section>
-
-  <section title="Choice of TXT record">
-  <t>
-	It has been suggested to use the KEY, OPT, CERT, or KX records
-	instead of a TXT record. None is satisfactory.
-  </t>
-  <t> The KEY RR has a protocol field which could be used to indicate a new protocol, 
-and an algorithm field which could be used to
-        indicate different contents in the key data. However, the KEY record
-	is clearly not intended for storing what are really authorizations,
-	it is just for identities. Other uses have been discouraged.
-  </t>
-  <t> OPT resource records, as defined in <xref target="RFC2671" /> are not 
-  intended to be used for storage of information. They are not to be loaded, 
-	cached or forwarded.  They are, therefore, inappropriate for use here.
-  </t>
-  <t>
-    CERT records <xref target="RFC2538" /> can encode almost any set of
-    information. A custom type code could be used permitting any suitable
-    encoding to be stored, not just X.509.  According to
-    the RFC, the certificate RRs are to be signed internally which may add undesirable 
-and unnecessary bulk. Larger DNS records may require TCP instead of UDP transfers.
-  </t>
-  <t>
-    At the time of protocol design, the CERT RR was not widely deployed and
-    could not be counted upon. Use of CERT records will be investigated,
-    and may be proposed in a future revision of this document.
-  </t>
-  <t>
-    KX records are ideally suited for use instead of TXT records, but had not been deployed at
-    the time of implementation.
-<!-- Jakob Schlyter <j@crt.se> confirmed -->
-  </t>	
-  </section>
-  </section>
-
-  <section anchor="fqdn" title="Use of FQDN IDs">
-    <t>
-      Unfortunately, not every administrator has control over the contents
-      of the reverse-map.  Where the initiator (SG-A) has no suitable reverse-map, the
-      authorization record present in the reverse-map of Alice may refer to a
-      FQDN instead of an IP address.
-    </t>
-    <t>
-      In this case, the client's TXT record gives the fully qualified domain
-      name (FQDN) in place of its security gateway's IP address. 
-      The initiator should use the ID_FQDN ID-payload in phase 1.
-      A forward lookup for a KEY record on the FQDN must yield the
-      initiator's public key. 
-    </t>
-    <t>
-      This method can also be used when the external address of SG-A is
-      dynamic. 
-    </t>
-    <t>
-      If SG-A is acting on behalf of Alice, then Alice must still delegate
-      authority for SG-A to do so in her reverse-map. When Alice and SG-A
-      are one and the same (i.e. Alice is acting as an end-node) then there
-      is no need for this when initiating only. </t>
-    <t>However, Alice must still delegate to  herself if she wishes others to
-       initiate OE to her.  See <xref target="txtfqdnformat" />.
-    </t>
-    <
-  </section> 
-
-<section title="Key roll-over">
-<t>
-Good cryptographic hygiene says that one should replace public/private key pairs
-periodically. Some administrators may wish to do this as often as daily. Typical DNS
-propagation delays are determined by the SOA Resource Record MINIMUM
-parameter, which controls how long DNS replies may be cached. For reasonable
-operation of DNS servers, administrators usually want this value to be at least several 
-hours, sometimes as a long as a day. This presents a problem - a new key MUST
-not be used prior to it propagating through DNS.
-</t>
-<t>
-This problem is dealt with by having the Security Gateway generate a new
-public/private key pair at least MINIMUM seconds in advance of using it. It
-then adds this key to the DNS (both as a second KEY record and in additional TXT
-delegation records) at key generation time. Note: only one key is allowed in
-each TXT record.
-</t>
-<t>
-When authenticating, all gateways MUST have available all public keys 
-that are found in DNS for this entity. This permits the authenticating end
-to check both the key for "today" and the key for "tomorrow". Note that it is 
-the end which is creating the signature (possesses the private key) that
-determines which key is to be used.
-</t>
-
-  </section>
-</section>
-
-
-<section title="Network address translation interaction">
-  <t>
-     There are no fundamentally new issues for implementing opportunistic encryption
-     in the presence of network address translation. Rather there are 
-     only the regular IPsec issues with NAT traversal.
-  </t>
-  <t>
-     There are several situations to consider for NAT.
-  </t>
-  <section title="Co-located NAT/NAPT">
-    <t>
-       If a security gateway is also performing network address translation on
-       behalf of an end-system, then the packet should be translated prior to
-       being subjected to opportunistic encryption. This is in contrast to
-       typically configured tunnels which often exist to bridge islands of 
-       private network address space. The security gateway will use the translated source
-       address for phase 2, and so the responding security gateway will look up that address to
-       confirm SG-A's authorization. 
-    </t>
-    <t> In the case of NAT (1:1), the address space into which the
-        translation is done MUST be globally unique, and control over the
-	reverse-map is assumed.
-        Placing of TXT records is possible.
-    </t>
-    <t> In the case of NAPT (m:1), the address will be the security
-        gateway itself. The ability to get
-        KEY and TXT records in place will again depend upon whether or not
-	there is administrative control over the reverse-map. This is
-	identical to situations involving a single host acting on behalf of
-	itself. 
-
-	FQDN style can be used to get around a lack of a reverse-map for
-	initiators only.
-    </t>
-  </section>
-
-  <section title="Security Gateway behind NAT/NAPT">
-    <t>
-       If there is a NAT or NAPT between the security gateways, then normal IPsec
-       NAT traversal problems occur. In addition to the transport problem
-       which may be solved by other mechanisms, there is the issue of
-       what phase 1 and phase 2 IDs to use. While FQDN could
-       be used during phase 1 for the security gateway, there is no appropriate ID for phase 2.
-       Due to the NAT, the end systems live in different IP address spaces.
-    </t>
-  </section>
-
-  <section title="End System is behind a NAT/NAPT">
-    <t>
-       If the end system is behind a NAT (perhaps SG-B), then there is, in fact, no way for
-       another end system to address a packet to this end system.
-       Not only is opportunistic encryption
-       impossible, but it is also impossible for any communication to
-       be initiate to the end system. It may be possible for this end
-       system to initiate in such communication. This creates an asymmetry, but this is common for 
-       NAPT.
-    </t>
-  </section>
-</section>
-
-<section title="Host implementations">
-<t>
-  When Alice and SG-A are components of the same system, they are
-  considered to be a host implementation. The packet sequence scenario remains unchanged.
-</t>
-<t>
-  Components marked Alice are the upper layers (TCP, UDP, the
-  application), and SG-A is the IP layer.
-</t>
-<t>
-  Note that tunnel mode is still required. 
-</t>
-<t>
-  As Alice and SG-A are acting on behalf of themselves, no TXT based delegation
-  record is necessary for Alice to initiate. She can rely on FQDN in a
-  forward map. This is particularly attractive to mobile nodes such as 
-  notebook computers at conferences.
-  To respond, Alice/SG-A will still need an entry in Alice's reverse-map.
-</t>
-</section>
-
-<section title="Multi-homing">
-<t> 
-If there are multiple paths between Alice and Bob (as illustrated in
-the diagram with SG-D), then additional DNS records are required to establish
-authorization. 
-</t>
-<t>
-In <xref target="networkdiagram" />, Alice has two ways to
-exit her network: SG-A and SG-D. Previously SG-D has been ignored. Postulate
-that there are routers between Alice and her set of security gateways
-(denoted by the + signs and the marking of an autonomous system number for
-Alice's network). Datagrams may, therefore, travel to either SG-A or SG-D en
-route to Bob.
-</t>
-<t>
-As long as all network connections are in good order, it does not matter how
-datagrams exit Alice's network. When they reach either security gateway, the
-security gateway will find the TXT delegation record in Bob's reverse-map,
-and establish an SA with SG-B. 
-</t>
-<t>
-SG-B has no problem establishing that either of SG-A or SG-D may speak for
-Alice, because Alice has published two equally weighted TXT delegation records:
-    <figure anchor="txtmultiexample"
-    title="Multiple gateway delegation example for Alice">
-           <artwork><![CDATA[
-X-IPsec-Server(10)=192.1.1.5 AQMM...3s1Q==
-X-IPsec-Server(10)=192.1.1.6 AAJN...j8r9==
-          ]]></artwork>
-    </figure>
-</t>
-<t>
-Alice's routers can now do any kind of load sharing needed. Both SG-A and SG-D send datagrams addressed to Bob through
-their tunnel to SG-B. 
-</t>
-<t>
-Alice's use of non-equal weight delegation records to show preference of one gateway over another, has relevance only when SG-B 
-is initiating to Alice. 
-</t>
-<t>
-If the precedences are the same, then SG-B has a more difficult time. It
-must decide which of the two tunnels to use. SG-B has no information about
-which link is less loaded, nor which security gateway has more cryptographic
-resources available. SG-B, in fact, has no knowledge of whether both gateways
-are even reachable.  
-</t>
-<t>
-The Public Internet's default-free zone may well know a good route to Alice,
-but the datagrams that SG-B creates must be addressed to either SG-A or SG-D;
-they can not be addressed to Alice directly.
-</t>
-<t>
-SG-B may make a number of choices:
-<list style="numbers">
-<t>It can ignore the problem and round robin among the tunnels. This
-      causes losses during times when one or the other security gateway is
-      unreachable. If this worries Alice, she can change the weights in her
-      TXT delegation records.</t>
-
-<t>It can send to the gateway from which it most recently received datagrams. 
-      This assumes that routing and reachability are symmetrical.</t>
-
-<t>It can listen to BGP information from the Internet to decide which
-      system is currently up. This is clearly much more complicated, but if SG-B is already participating
-      in the BGP peering system to announce Bob, the results data may already
-      be available to it. </t>
-
-<t>It can refuse to negotiate the second tunnel. (It is unclear whether or
-not this is even an option.)</t>
-
-<t>It can silently replace the outgoing portion of the first tunnel with the
-second one while still retaining the incoming portions of both. SG-B can,
-thus, accept datagrams from either SG-A or SG-D, but
-send only to the gateway that most recently re-keyed with it.</t> 
-</list>
-</t>
-
-<t>
-Local policy determines which choice SG-B makes. Note that even if SG-B has perfect
-knowledge about the reachability of SG-A and SG-D, Alice may not be reachable
-from either of these security gateways because of internal reachability
-issues. 
-</t>
-
-<t>
-FreeS/WAN implements option 5.  Implementing a different option is
-being considered. The multi-homing aspects of OE are not well developed and may
-be the subject of a future document.
-</t>
-	
-</section>
-
-<section title="Failure modes">
-  <section title="DNS failures">
-  <t>
-  If a DNS server fails to respond, local policy decides
-  whether or not to permit communication in the clear as embodied in
-  the connection classes in <xref target="initclasses" />.
-  It is easy to mount a denial of service attack on the DNS server
-  responsible for a particular network's reverse-map.
-  Such an attack may cause all communication with that network to go in
-  the clear if the policy is permissive, or fail completely 
-  if the policy is paranoid. Please note that this is an active attack.
-  </t>
-  <t>
-  There are still many networks
-  that do not have properly configured reverse-maps. Further, if the policy is not to communicate,
-  the above denial of service attack isolates the target network. Therefore, the decision of whether 
-or not to permit communication in the clear MUST be a matter of local policy.
-  </t>
-  </section>
-
-  <section title="DNS configured, IKE failures">
-  <t>
-  DNS records claim that opportunistic encryption should
-  occur, but the target gateway either does not respond on port 500, or
-  refuses the proposal. This may be because of a crash or reboot, a
-  faulty configuration, or a firewall filtering port 500.  
-  </t>
-  <t>
-  The receipt of ICMP port, host or network unreachable
-  messages indicates a potential problem, but MUST NOT cause communication
-  to fail 
-  immediately. ICMP messages are easily forged by attackers. If such a
-  forgery caused immediate failure, then an active attacker could easily
-  prevent any 
-  encryption from ever occurring, possibly preventing all communication.
-  </t>
-  <t>
-  In these situations a clear log should be produced
-  and local policy should dictate if communication is then
-  permitted in the clear.
-  </t>
-  </section>
-
-  <section title="System reboots">
-<t>
-Tunnels sometimes go down because the remote end crashes,
-disconnects, or has a network link break.  In general there is no
-notification of this.  Even in the event of a crash and successful reboot, 
-other SGs don't hear about it unless the rebooted SG has specific 
-reason to talk to them immediately.  Over-quick response to temporary 
-network outages is undesirable.  Note that a tunnel can be torn
-down and then re-established without any effect visible to the user
-except a pause in traffic. On the other hand, if one end reboots,
-the other end can't get datagrams to it at all (except via
-IKE) until the situation is noticed.  So a bias toward quick
-response is appropriate even at the cost of occasional
-false alarms.
-</t>
-
-<t>
-A mechanism for recovery after reboot is a topic of current research and is not specified in this
-document.
-</t>
-
-<t>
-A deliberate shutdown should include an attempt, using deletes, to notify all other SGs
-currently connected by phase 1 SAs that communication is
-about to fail.  Again, a remote SG will assume this is a teardown.  Attempts by the
-remote SGs to negotiate new tunnels as replacements should be ignored. When possible, 
-SGs should attempt to preserve information about currently-connected SGs in non-volatile storage, so
-that after a crash, an Initial-Contact can be sent to previous partners to
-indicate loss of all previously established connections.
-</t>
-
-  </section>
-</section>
-
-<!--
-<section title="Performance experiences">
-
-    Claudia> Is it useful to point out (or to clarify for our own discussion) any of the
-    Claudia> following:
-
-    Claudia> *  how much time this is likely to take on typical current hardware?
-    Claudia> *  what steps are likely to be time consuming
-    Claudia> *  how any added time could affect a typical transaction, such as hitting 
-    Claudia>    a web site
-    Claudia> *  any ways to minimize such time delays
-
-  <section title="Introduced latency">
-  </section>
-
-  <section title="Cryptographic performance">
-  </section>
-
-  <section title="Phase 1 SA performance">
-  </section>
-
-</section>
--->
-
-<section title="Unresolved issues">
-  <section title="Control of reverse DNS">
-  <t>
-  The method of obtaining information by reverse DNS lookup causes
-  problems for people who cannot control their reverse DNS
-  bindings. This is an unresolved problem in this version, and is out
-  of scope.
-  </t>
-  </section>
-</section>
-
-<section title="Examples">
-
-<section title="Clear-text usage (permit policy)">
-
-<t>
-Two example scenarios follow. In the first example GW-A
-(Gateway A) and GW-B (Gateway B) have always-clear-text policies, and in the second example they have an OE
-policy. The clear-text policy serves as a reference for what occurs in
-TCP/IP in the absence of Opportunistic Encryption.
-
-<t>
-Alice wants to communicate with Bob. Perhaps she wants to retrieve a
-web page from Bob's web server. In the absence of opportunistic
-encryptors, the following events occur: 
-</t>
-
-       <figure anchor="regulartiming" title="Timing of regular transaction">
-           <artwork><![CDATA[
-  Alice         SG-A       DNS       SG-B           Bob
-   Human or application
-   'clicks' with a name.
-   (1)
-
-    ------(2)-------------->
-    Application looks up
-    name in DNS to get
-    IP address.
-
-    <-----(3)---------------
-    Resolver returns "A" RR
-    to application with IP 
-    address.
-
-   (4)
-   Application starts a TCP session
-   or UDP session and OS sends
-   first datagram
-
-       ----(5)----->
-       Datagram is seen at first gateway
-       from Alice (SG-A). 
-
-                   ----------(6)------>
-                   Datagram traverses
-                   network.
-
-                                       ------(7)----->
-                                       Datagram arrives
-                                       at Bob, is provided
-                                       to TCP.
-
-                                      <------(8)------
-                                       A reply is sent.
-
-                   <----------(9)------
-                   Datagram traverses
-                   network.
-    <----(10)-----
-    Alice receives
-    answer.
-
-   (11)----------->
-    A second exchange
-    occurs.
-                   ----------(12)----->
-                                       -------------->
-                                      <---------------
-                   <-------------------
-    <-------------
-          ]]></artwork>
-</figure>
-
-</t>
-</section>
-
-<section title="Opportunistic encryption">
-
-<t>
-In the presence of properly configured opportunistic encryptors, the
-event list is extended. Only changes are annotated.
-</t>
-
-<t>The following symbols are used in the time-sequence diagram</t>
-
-<t>
-<list style="hanging">
-    <t hangText="-"> A single dash represents clear-text datagrams.</t>
-    <t hangText="="> An equals sign represents phase 2 (IPsec) cipher-text
-        datagrams.</t> 
-    <t hangText="~"> A single tilde represents clear-text phase 1 datagrams.</t>
-    <t hangText="#"> A hash sign represents phase 1 (IKE) cipher-text
-        datagrams.</t> 
-</list>
-</t>
-
-<t>
-<figure anchor="opportunistictiming" title="Timing of opportunistic encryption transaction">
-           <artwork><![CDATA[
-  Alice          SG-A      DNS       SG-B           Bob
-   (1)
-    ------(2)-------------->
-    <-----(3)---------------
-   (4)----(5)----->+
-      SG-A sees datagram 
-      to new target and
-      saves it as "first"
-
-                  ----(5B)->
-                  SG-A asks DNS 
-                  for TXT RR.
-
-                  <---(5C)--
-                  DNS returns TXT RR.
-
-                  ~~~~~~~~~~~~~(5D)~~~>
-                  initial IKE main mode 
-                  packet is sent.       
-
-                  <~~~~~~~~~~~~(5E1)~~~
-                  ~~~~~~~~~~~~~(5E2)~~>
-                  <~~~~~~~~~~~~(5E3)~~~
-                  IKE phase 1 - privacy.
-
-                  #############(5E4)##>
-                  SG-A sends ID to SG-B
-                           <----(5F1)--
-                            SG-B asks DNS
-                            for SG-A's public 
-                            KEY
-                           -----(5F2)->
-                            DNS provides KEY RR.
-                            SG-B authenticates SG-A
-
-                  <############(5E5)###
-                  IKE phase 1 - complete
-                           
-                  #############(5G1)##>
-                  IKE phase 2 - Alice<->Bob
-                  tunnel is proposed.
-
-                           <----(5H1)--
-                            SG-B asks DNS for
-                            Alice's TXT record.
-                           -----(5H2)->
-                            DNS replies with TXT
-                            record. SG-B checks
-                            SG-A's authorization.
-
-                  <############(5G2)###
-                   SG-B accepts proposal.
-
-                  #############(5G3)##>
-                   SG-A confirms.
-
-                   ============(6)====>
-                    SG-A sends "first"
-                    packet in new IPsec
-                    SA.
-                                       ------(7)----->
-                                        packet is decrypted
-                                        and forward to Bob.
-                                      <------(8)------
-                  <==========(9)======
-                    return packet also
-                    encrypted.
-    <-----(10)----
-
-   (11)----------->
-     a second packet
-     is sent by Alice
-                   ==========(12)=====>
-                    existing tunnel is used
-                                       -------------->
-                                      <---------------
-                   <===================
-    <-------------
-          ]]></artwork>
-</figure>
-
-</t>
-
-  <t>
-  For the purposes of this section, we will describe only the changes that
-  occur between <xref target="regulartiming" /> and
-  <xref target="opportunistictiming" />. This corresponds to time points 5, 6, 7, 9 and 10 on the list above. 
-  </t>
-
-<list style="symbols">
-  <t>
-    At point (5), SG-A intercepts the datagram because this source/destination pair lacks a policy 
-(the non-existent policy state). SG-A creates a hold policy, and buffers the datagram. SG-A requests keys from the keying daemon. 
-    </t>
-
-    <t>
-    SG-A's IKE daemon, having looked up the source/destination pair in the connection
-    class list, creates a new Potential OE connection instance. SG-A starts DNS
-    queries.
-    </t>
-  </section>
-
-  <section title="(5C) DNS returns TXT record(s)">
-
-  <t>
-  DNS returns properly formed TXT delegation records, and SG-A's IKE daemon
-  causes this instance to make a transition from Potential OE connection to Pending OE
-  connection.
-  </t>
-
-    <t>
-      Using the example above, the returned record might contain:
-
-    <figure anchor="txtexample"
-    title="Example of reverse delegation record for Bob">
-           <artwork><![CDATA[
-X-IPsec-Server(10)=192.1.1.5 AQMM...3s1Q==
-          ]]></artwork>
-    </figure>
-    with SG-B's IP address and public key listed.
-    </t>
-
-  </section>
-
-  <section title="(5D) Initial IKE main mode packet goes out">
-  <t>Upon entering Pending OE connection, SG-A sends the initial ISAKMP
-  message with proposals. See <xref target="phase1id" />.
-  </t>
-  </section>
-
-  <section title="(5E1) Message 2 of phase 1 exchange">
-  <t>
-  SG-B receives the message. A new connection instance is created in the
-  unauthenticated OE peer state.
-  </t>
-  </section>
-
-  <section title="(5E2) Message 3 of phase 1 exchange">
-  <t>
-  SG-A sends a Diffie-Hellman exponent. This is an internal state of the
-  keying daemon.
-  </t>
-  </section>
-
-  <section title="(5E3) Message 4 of phase 1 exchange">
-  <t>
-  SG-B responds with a Diffie-Hellman exponent. This is an internal state of the
-  keying protocol.
-  </t>
-  </section>
-
-  <section title="(5E4) Message 5 of phase 1 exchange">
-  <t>
-  SG-A uses the phase 1 SA to send its identity under encryption. 
-  The choice of identity is discussed in <xref target="phase1id" />.
-  This is an internal state of the keying protocol.
-  </t>
-  </section>
-
-  <section title="(5F1) Responder lookup of initiator key">
-  <t>
-  SG-B asks DNS for the public key of the initiator. 
-  DNS looks for a KEY record by IP address in the reverse-map.
-  That is, a KEY resource record is queried for 4.1.1.192.in-addr.arpa
-  (recall that SG-A's external address is 192.1.1.4).
-  SG-B uses the resulting public key to authenticate the initiator. See <xref
-  target="KEY" /> for further details. 
-  </t>
-  </section>
-
-<section title="(5F2) DNS replies with public key of initiator">
-<t>
-Upon successfully authenticating the peer, the connection instance makes a
-transition to authenticated OE peer on SG-B.
-</t>
-<t>
-The format of the TXT record returned is described in
-<xref target="TXT" />. 
-</t>
-</section>
-
-  <section title="(5E5) Responder replies with ID and authentication">
-  <t>
-    SG-B sends its ID along with authentication material. This is an internal
-    state for the keying protocol.
-  </t>
-  </section>
-
-  <section title="(5G) IKE phase 2">
-    <section title="(5G1) Initiator proposes tunnel">
-    <t>
-    Having established mutually agreeable authentications (via KEY) and
-    authorizations (via TXT), SG-A proposes to create an IPsec tunnel for
-    datagrams transiting from Alice to Bob. This tunnel is established only for 
-    the Alice/Bob combination, not for any subnets that may be behind SG-A and SG-B.
-    </t>
-    </section>
-
-    <section title="(5H1) Responder determines initiator's authority">
-    <t>
-    While the identity of SG-A has been established, its authority to
-    speak for Alice has not yet been confirmed. SG-B does a reverse
-    lookup on Alice's address for a TXT record. 
-    </t>
-    <t>Upon receiving this specific proposal, SG-B's connection instance
-    makes a transition into the potential OE connection state. SG-B may already have an
-    instance, and the check is made as described above.</t>
-    </section>
-  
-    <section title="(5H2) DNS replies with TXT record(s)">
-    <t>
-      The returned key and IP address should match that of SG-A.
-    </t>	
-    </section>
-    
-    <section title="(5G2) Responder agrees to proposal">
-    <t>
-    Should additional communication occur between, for instance, Dave and Bob using
-    SG-A and SG-B, a new tunnel (phase 2 SA) would be established. The phase 1 SA
-    may be reusable.
-    </t>
-    <t>SG-A, having successfully keyed the tunnel, now makes a transition from
-    Pending OE connection to Keyed OE connection.
-    </t>
-    <t>The responder MUST setup the inbound IPsec SAs before sending its reply.</t>
-    </section>
-
-    <section title="(5G3) Final acknowledgment from initiator">
-    <t>
-    The initiator agrees with the responder's choice and sets up the tunnel.
-    The initiator sets up the inbound and outbound IPsec SAs.
-    </t>
-    <t>
-    The proper authorization returned with keys prompts SG-B to make a transition
-    to the keyed OE connection state. 
-    </t>
-    <t>Upon receipt of this message, the responder may now setup the outbound
-    IPsec SAs.</t> 
-    </section>
-  </section>
-
-  <section title="(6) IPsec succeeds, and sets up tunnel for communication between Alice and Bob">
-  <t>
-  SG-A sends the datagram saved at step (5) through the newly created
-  tunnel to SG-B, where it gets decrypted and forwarded. 
-  Bob receives it at (7) and replies at (8). 
-  </t>
-  </section>
-
-  <section title="(9) SG-B already has tunnel up with G1 and uses it">
-  <t>
-  At (9), SG-B has already established an SPD entry mapping Bob->Alice via a
-  tunnel, so this tunnel is simply applied. The datagram is encrypted to SG-A,
-  decrypted by SG-A and passed to Alice at (10).
-  </t>
-
-  </section>
-</section> <!-- OE example -->
-
-</section> <!-- Examples -->
-
-<section anchor="securityconsiderations" title="Security considerations">
-
-  <section title="Configured vs opportunistic tunnels">
-<t>
-    Configured tunnels are those which are setup using bilateral mechanisms: exchanging 
-public keys (raw RSA, DSA, PKIX), pre-shared secrets, or by referencing keys that
-are in known places (distinguished name from LDAP, DNS). These keys are then used to
-configure a specific tunnel. 
-</t>
-<t>
-A pre-configured tunnel may be on all the time, or may be keyed only when needed. 
-The end points of the tunnel are not necessarily static: many mobile
-applications (road warrior) are considered to be configured tunnels. 
-</t>
-<t>
-The primary characteristic is that configured tunnels are assigned specific
-security properties. They may be trusted in different ways relating to exceptions to 
-firewall rules, exceptions to NAT processing, and to bandwidth or other quality of service restrictions. 
-</t>
-<t>
-Opportunistic tunnels are not inherently trusted in any strong way. They are
-created without prior arrangement. As the two parties are strangers, there
-MUST be no confusion of datagrams that arrive from opportunistic peers and
-those that arrive from configured tunnels. A security gateway MUST take care
-that an opportunistic peer can not impersonate a configured peer.
-</t>
-<t>
-Ingress filtering MUST be used to make sure that only datagrams authorized by
-negotiation (and the concomitant authentication and authorization) are
-accepted from a tunnel. This is to prevent one peer from impersonating another. 
-</t>
-<t>
-An implementation suggestion is to treat opportunistic tunnel
-datagrams as if they arrive on a logical interface distinct from other
-configured tunnels. As the number of opportunistic tunnels that may be
-created automatically on a system is potentially very high, careful attention 
-to scaling should be taken into account.
-</t>
-<t>
-As with any IKE negotiation, opportunistic encryption cannot be secure
-without authentication. Opportunistic encryption relies on DNS for its
-authentication information and, therefore, cannot be fully secure without
-a secure DNS. Without secure DNS, opportunistic encryption can protect against passive
-eavesdropping but not against active man-in-the-middle attacks.
-</t>
-  </section>
-
-  <section title="Firewalls versus Opportunistic Tunnels">
-<t>
-  Typical usage of per datagram access control lists is to implement various
-kinds of security gateways. These are typically called "firewalls". 
-</t>
-<t>
-  Typical usage of a virtual private network (VPN) within a firewall is to
-bypass all or part of the access controls between two networks. Additional
-trust (as outlined in the previous section) is given to datagrams that arrive
-in the VPN.
-</t>
-<t> 
-  Datagrams that arrive via opportunistically configured tunnels MUST not be
-trusted. Any security policy that would apply to a datagram arriving in the
-clear SHOULD also be applied to datagrams arriving opportunistically.
-</t>
-  </section>
-
-  <section title="Denial of service">
-<t>
-  There are several different forms of denial of service that an implementor 
-  should concern themselves with. Most of these problems are shared with
-  security gateways that have large numbers of mobile peers (road warriors). 
-</t>
-<t>
-  The design of ISAKMP/IKE, and its use of cookies, defend against many kinds
-  of denial of service. Opportunism changes the assumption that if the phase 1 (ISAKMP) 
-  SA is authenticated, that it was worthwhile creating. Because the gateway will communicate with any machine, it is
-  possible to form phase 1 SAs with any machine on the Internet. 
-</t>
-
-</section>
-</section>
-
-<section title="IANA Considerations">
-<t>
-    There are no known numbers which IANA will need to manage.
-</t>
-</section>
-
-<section title="Acknowledgments">
-<t>
-        Substantive portions of this document are based upon previous work by
-        Henry Spencer.
-</t>
-<t>
-	Thanks to Tero Kivinen, Sandy Harris, Wes Hardarker, Robert Moskowitz,
-	Jakob Schlyter, Bill Sommerfeld, John Gilmore and John Denker for their
-	comments and constructive criticism.
-</t>
-<t>
-	Sandra Hoffman and Bill Dickie did the detailed proof reading and editing.
-</t>
-</section>
-
-</middle>
-
-<back>
-<references title="Normative references">
-<?rfc include="reference.OEspec" ?>
-<!-- renumber according to reference order -->
-<?rfc include="reference.RFC.0791" ?>
-<?rfc include="reference.RFC.1009" ?>
-<?rfc include="reference.RFC.1984" ?>
-<?rfc include="reference.RFC.2119" ?>
-<!-- IPsec -->
-<?rfc include="reference.RFC.2367" ?>
-<?rfc include="reference.RFC.2401" ?>
-<?rfc include="reference.RFC.2407" ?>
-<?rfc include="reference.RFC.2408" ?>
-<?rfc include="reference.RFC.2409" ?>
-<!-- MODPGROUPS -->
-<?rfc include="reference.RFC.3526" ?>
-<!-- DNSSEC -->
-<?rfc include="reference.RFC.1034" ?>
-<?rfc include="reference.RFC.1035" ?>
-<?rfc include="reference.RFC.2671" ?>
-<?rfc include="reference.RFC.1464" ?>
-<?rfc include="reference.RFC.2535" ?>
-<?rfc include="reference.RFC.3110" ?>
-<?rfc include="reference.RFC.2538" ?>
-<!-- COPS -->
-<?rfc include="reference.RFC.2748" ?>
-<!-- NAT -->
-<?rfc include="reference.RFC.2663" ?>
-</references>
-<!-- <references title="Non-normative references"> -->
-<!-- ESPUDP -->
-<!-- <?rfc include="reference.ESPUDP" ?> -->
-<!-- </references> -->
-</back>
-</rfc>
-<!--
-  $Id: draft-richardson-ipsec-opportunistic.xml,v 1.1 2004/03/15 20:35:24 as Exp $
-
-  $Log: draft-richardson-ipsec-opportunistic.xml,v $
-  Revision 1.1  2004/03/15 20:35:24  as
-  added files from freeswan-2.04-x509-1.5.3
-
-  Revision 1.33  2003/06/30 03:19:59  mcr
-  	timing-diagram with inline explanation.
-
-  Revision 1.32  2003/06/30 01:57:44  mcr
-  	initial edits per-Bob Braden.
-
-  Revision 1.31  2003/05/26 19:31:23  mcr
-  	updates to drafts - IPSEC RR - SC versions, and RFC3526
-  	reference in OE draft.
-
-  Revision 1.30  2003/05/21 15:42:34  mcr
-  	updates due to publication of RFC 3526.
-
-  Revision 1.29  2003/01/17 16:22:55  mcr
-  	rev 11 of OE draft.
-
-  Revision 1.28  2002/07/25 19:27:31  mcr
-  	added DHR's minor edits.
-
-  Revision 1.27  2002/07/21 16:26:26  mcr
-  	slides from presentation at OLS
-  	draft-10 of OE draft.
-
-  Revision 1.26  2002/07/16 03:46:53  mcr
-  	second edits from Sandra.
-
-  Revision 1.25  2002/07/16 03:36:14  mcr
-  	removed HS from authors list
-  	updated reference inclusion to use <?rfc-include directive.
-  Revision 1.24  2002/07/11 02:08:21  mcr
-  	updated XML file from Sandra
-
-  Revision 1.23  2002/06/06 17:18:53  mcr
-  	spellcheck.
-
-  Revision 1.22  2002/06/06 17:14:19  mcr
-  	results of hand-editing session from May 28th.
-  	This is FINAL OE draft.
-
-  Revision 1.21  2002/06/06 02:25:44  mcr
-  	results of hand-editing session from May 28th.
-  	This is FINAL OE draft.
-
-  Revision 1.20  2002/05/24 03:28:37  mcr
-  	changes as requested by RFC editor.
-
-  Revision 1.19  2002/04/09 16:01:05  mcr
-  	comments from PHB.
-
-  Revision 1.18  2002/04/08 02:14:34  mcr
-  	RGBs changes to rev6.
-
-  Revision 1.17  2002/03/12 21:23:55  mcr
-  	adjusted definition of default-free zone.
-  	moved text on key rollover from format description to new
-  	section.
-
-  Revision 1.16  2002/02/22 01:23:21  mcr
-  	revisions from MCR (2002/2/18) and net.
-
-  Revision 1.15  2002/02/21 20:44:12  mcr
-  	extensive from DHR.
-
-  Revision 1.14  2002/02/10 16:20:39  mcr
-  	-05 draft. Many revisions to do "OE system in world of OE systems"
-  	view of the universe.
-
-  Revision 1.13  2001/12/20 04:35:22  mcr
-  	fixed reference to rfc1984.
-
-  Revision 1.12  2001/12/20 03:35:19  mcr
-  	comments from Henry, Tero, and Sandy.
-
-  Revision 1.11  2001/12/19 07:26:22  mcr
-  	added comment about KX records.
-
-  Revision 1.10  2001/11/09 04:28:10  mcr
-  	fixed some typos with XML, and one s/SG-B/SG-D/.
-
-  Revision 1.9  2001/11/09 04:07:13  mcr
-  	expanded section 10: multihoming, with an example.
-
-  Revision 1.8  2001/11/09 02:16:51  mcr
-  	added lifetime/lifespan definitions.
-  	moved example from 5B to 5C.
-  	added reference to phase 1 IDs to 5D.
-  	cleared up text in aging section.
-  	added text about delegation of DNSSEC activity to a DNS server.
-  	spelt out DH group names.
-  	added text about ignoring TXT records unless DNSSEC is deployed (somerfeld)
-  	added example of TXT delegation using FQDN.
-  	clarified some text in NAT interaction section.
-  	clarified absense of TXT record need for host implementation
-
-  Revision 1.7  2001/11/08 23:09:37  mcr
-  	changed revision of draft to 03.
-
-  Revision 1.6  2001/11/08 19:37:14  mcr
-  	fixed some formatting of Aging section.
-
-  Revision 1.5  2001/11/08 19:19:30  mcr
-  	fixed address for DHR, updated address for MCR,
-  	added reference to original HS/DHR OE specification paper.
-
-  Revision 1.4  2001/11/08 19:08:24  mcr
-  	section 10, "Renewal and Teardown" added moved between 4/5, and
-  	slightly rewritten.
-
-  Revision 1.3  2001/11/08 18:56:34  mcr
-  	sections 4.2, 5.6, 5.7.1 and 6.2 edited as per HS.
-  	section 10, "Renewal and Teardown" added.
-  	section 11, "Failure modes" completed.
-
-  Revision 1.2  2001/11/05 20:31:31  mcr
-  	added section from OE spec on aging and teardown.
-
-  Revision 1.1  2001/11/05 04:27:58  mcr
-  	OE draft added to documentation.
-
-  Revision 1.12  2001/10/10 01:12:31  mcr
-  	removed impact on DNS servers section.
-  	removed nested comments.
-  	adjusted data of issue
-
-  Revision 1.11  2001/09/17 02:55:50  mcr
-  	outline is now stable.
-
-  Revision 1.5  2001/08/19 02:53:32  mcr
-  	version 00d formatted.
-
-  Revision 1.10  2001/08/19 02:34:04  mcr
-  	version 00d formatted.
-
-  Revision 1.9  2001/08/19 02:21:54  mcr
-  	version 00d
-
-  Revision 1.8  2001/07/20 19:07:06  mcr
-    commented out section 1.1
-
-  Revision 1.7  2001/07/20 14:14:22  mcr
-  	HS and HD comments.
-
-  Revision 1.6  2001/07/19 00:56:50  mcr
-  	version 00b.
-
-  Revision 1.5  2001/07/12 23:57:07  mcr
-  	OE ID, 00.
-
-
-!>
diff --git a/doc/src/draft-richardson-ipsec-rr.html b/doc/src/draft-richardson-ipsec-rr.html
deleted file mode 100644
index 08473104f..000000000
--- a/doc/src/draft-richardson-ipsec-rr.html
+++ /dev/null
@@ -1,659 +0,0 @@
-<html><head><title>A method for storing IPsec keying material in DNS.</title>
-<STYLE type='text/css'>
-    .title { color: #990000; font-size: 22px; line-height: 22px; font-weight: bold; text-align: right;
-             font-family: helvetica, arial, sans-serif }
-    .filename { color: #666666; font-size: 18px; line-height: 28px; font-weight: bold; text-align: right;
-                  font-family: helvetica, arial, sans-serif }
-    p.copyright { color: #000000; font-size: 10px;
-                  font-family: verdana, charcoal, helvetica, arial, sans-serif }
-    p { margin-left: 2em; margin-right: 2em; }
-    li { margin-left: 3em;  }
-    ol { margin-left: 2em; margin-right: 2em; }
-    ul.text { margin-left: 2em; margin-right: 2em; }
-    pre { margin-left: 3em; color: #333333 }
-    ul.toc { color: #000000; line-height: 16px;
-             font-family: verdana, charcoal, helvetica, arial, sans-serif }
-    H3 { color: #333333; font-size: 16px; line-height: 16px; font-family: helvetica, arial, sans-serif }
-    H4 { color: #000000; font-size: 14px; font-family: helvetica, arial, sans-serif }
-    TD.header { color: #ffffff; font-size: 10px; font-family: arial, helvetica, san-serif; valign: top }
-    TD.author-text { color: #000000; font-size: 10px;
-                     font-family: verdana, charcoal, helvetica, arial, sans-serif }
-    TD.author { color: #000000; font-weight: bold; margin-left: 4em; font-size: 10px; font-family: verdana, charcoal, helvetica, arial, sans-serif }
-     A:link { color: #990000; font-weight: bold;
-              font-family: MS Sans Serif, verdana, charcoal, helvetica, arial, sans-serif }
-     A:visited { color: #333333; font-weight: bold;
-                 font-family: MS Sans Serif, verdana, charcoal, helvetica, arial, sans-serif }
-     A:name { color: #333333; font-weight: bold;
-              font-family: MS Sans Serif, verdana, charcoal, helvetica, arial, sans-serif }
-    .link2 { color:#ffffff; font-weight: bold; text-decoration: none;
-             font-family: monaco, charcoal, geneva, MS Sans Serif, helvetica, monotype, verdana, sans-serif;
-             font-size: 9px }
-    .RFC { color:#666666; font-weight: bold; text-decoration: none;
-           font-family: monaco, charcoal, geneva, MS Sans Serif, helvetica, monotype, verdana, sans-serif;
-           font-size: 9px }
-    .hotText { color:#ffffff; font-weight: normal; text-decoration: none;
-               font-family: charcoal, monaco, geneva, MS Sans Serif, helvetica, monotype, verdana, sans-serif;
-               font-size: 9px }
-</style>
-</head>
-<body bgcolor="#ffffff" text="#000000" alink="#000000" vlink="#666666" link="#990000">
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<table width="66%" border="0" cellpadding="0" cellspacing="0"><tr><td><table width="100%" border="0" cellpadding="2" cellspacing="1">
-<tr valign="top"><td width="33%" bgcolor="#666666" class="header">IPSECKEY WG</td><td width="33%" bgcolor="#666666" class="header">M. Richardson</td></tr>
-<tr valign="top"><td width="33%" bgcolor="#666666" class="header">Internet-Draft</td><td width="33%" bgcolor="#666666" class="header">SSW</td></tr>
-<tr valign="top"><td width="33%" bgcolor="#666666" class="header">Expires: March 4, 2004</td><td width="33%" bgcolor="#666666" class="header">September 4, 2003</td></tr>
-</table></td></tr></table>
-<div align="right"><font face="monaco, MS Sans Serif" color="#990000" size="+3"><b><br><span class="title">A method for storing IPsec keying material in DNS.</span></b></font></div>
-<div align="right"><font face="monaco, MS Sans Serif" color="#666666" size="+2"><b><span class="filename">draft-ietf-ipseckey-rr-07.txt</span></b></font></div>
-<font face="verdana, helvetica, arial, sans-serif" size="2">
-
-<h3>Status of this Memo</h3>
-<p>
-This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026.</p>
-<p>
-Internet-Drafts are working documents of the Internet Engineering
-Task Force (IETF), its areas, and its working groups.
-Note that other groups may also distribute working documents as
-Internet-Drafts.</p>
-<p>
-Internet-Drafts are draft documents valid for a maximum of six months
-and may be updated, replaced, or obsoleted by other documents at any time.
-It is inappropriate to use Internet-Drafts as reference material or to cite
-them other than as "work in progress."</p>
-<p>
-The list of current Internet-Drafts can be accessed at
-<a href='http://www.ietf.org/ietf/1id-abstracts.txt'>http://www.ietf.org/ietf/1id-abstracts.txt</a>.</p>
-<p>
-The list of Internet-Draft Shadow Directories can be accessed at
-<a href='http://www.ietf.org/shadow.html'>http://www.ietf.org/shadow.html</a>.</p>
-<p>
-This Internet-Draft will expire on March 4, 2004.</p>
-
-<h3>Copyright Notice</h3>
-<p>
-Copyright (C) The Internet Society (2003). All Rights Reserved.</p>
-
-<h3>Abstract</h3>
-
-<p>
-This document describes a new resource record for DNS. This record may be
-used to store public keys for use in IPsec systems. 
-
-</p>
-<p>
-This record replaces the functionality of the sub-type #1 of the KEY Resource
-Record, which has been obsoleted by RFC3445.
-
-</p><a name="toc"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<h3>Table of Contents</h3>
-<ul compact class="toc">
-<b><a href="#anchor1">1.</a>&nbsp;
-Introduction<br></b>
-<b><a href="#anchor2">1.1</a>&nbsp;
-Overview<br></b>
-<b><a href="#anchor3">1.2</a>&nbsp;
-Usage Criteria<br></b>
-<b><a href="#anchor4">2.</a>&nbsp;
-Storage formats<br></b>
-<b><a href="#anchor5">2.1</a>&nbsp;
-IPSECKEY RDATA format<br></b>
-<b><a href="#anchor6">2.2</a>&nbsp;
-RDATA format - precedence<br></b>
-<b><a href="#algotype">2.3</a>&nbsp;
-RDATA format - algorithm type<br></b>
-<b><a href="#gatewaytype">2.4</a>&nbsp;
-RDATA format - gateway type<br></b>
-<b><a href="#anchor7">2.5</a>&nbsp;
-RDATA format - gateway<br></b>
-<b><a href="#anchor8">2.6</a>&nbsp;
-RDATA format - public keys<br></b>
-<b><a href="#anchor9">3.</a>&nbsp;
-Presentation formats<br></b>
-<b><a href="#anchor10">3.1</a>&nbsp;
-Representation of IPSECKEY RRs<br></b>
-<b><a href="#anchor11">3.2</a>&nbsp;
-Examples<br></b>
-<b><a href="#anchor12">4.</a>&nbsp;
-Security Considerations<br></b>
-<b><a href="#anchor13">4.1</a>&nbsp;
-Active attacks against unsecured IPSECKEY resource records<br></b>
-<b><a href="#anchor14">5.</a>&nbsp;
-IANA Considerations<br></b>
-<b><a href="#anchor15">6.</a>&nbsp;
-Acknowledgments<br></b>
-<b><a href="#rfc.references1">&#167;</a>&nbsp;
-Normative references<br></b>
-<b><a href="#rfc.references2">&#167;</a>&nbsp;
-Non-normative references<br></b>
-<b><a href="#rfc.authors">&#167;</a>&nbsp;
-Author's Address<br></b>
-<b><a href="#rfc.copyright">&#167;</a>&nbsp;
-Full Copyright Statement<br></b>
-</ul>
-<br clear="all">
-
-<a name="anchor1"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.1"></a><h3>1.&nbsp;Introduction</h3>
-
-<p>
-   The type number for the IPSECKEY RR is TBD.
-
-</p>
-<a name="rfc.section.1.1"></a><h4><a name="anchor2">1.1</a>&nbsp;Overview</h4>
-
-<p>
-   The IPSECKEY resource record (RR) is used to publish a public key that is
-   to be associated with a Domain Name System (DNS) name for use with the
-   IPsec protocol suite.  This can be the  public key of a host,
-   network, or application (in the case of per-port keying).
-
-</p>
-<p>
-      The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
-      NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and
-      "OPTIONAL" in this document are to be interpreted as described in
-      RFC2119 <a href="#RFC2119">[8]</a>.
-
-</p>
-<a name="rfc.section.1.2"></a><h4><a name="anchor3">1.2</a>&nbsp;Usage Criteria</h4>
-
-<p>
-   An IPSECKEY resource record SHOULD be used in combination with DNSSEC
-unless some other means of authenticating the IPSECKEY resource record
-is available.
-
-</p>
-<p>  
-   It is expected that there will often be multiple IPSECKEY resource
-   records at the same name. This will be due to the presence
-   of multiple gateways and the need to rollover keys.
-
-
-</p>
-<p>
-   This resource record is class independent.
-
-</p>
-<a name="anchor4"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.2"></a><h3>2.&nbsp;Storage formats</h3>
-
-<a name="rfc.section.2.1"></a><h4><a name="anchor5">2.1</a>&nbsp;IPSECKEY RDATA format</h4>
-
-<p>
-   The RDATA for an IPSECKEY RR consists of a precedence value, a public key,
-   algorithm type, and an optional gateway address.
-
-</p></font><pre>
-    0                   1                   2                   3  
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |  precedence   | gateway type  |  algorithm  |     gateway     |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-------------+                 +
-   ~                            gateway                            ~
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                                                               /
-   /                          public key                           /
-   /                                                               /
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|
-</pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-
-<a name="rfc.section.2.2"></a><h4><a name="anchor6">2.2</a>&nbsp;RDATA format - precedence</h4>
-
-<p>
-This is an 8-bit precedence for this record. This is interpreted in
-the same way as the PREFERENCE field described in section
-3.3.9 of RFC1035 <a href="#RFC1035">[2]</a>. 
-
-</p>
-<p>
-Gateways listed in IPSECKEY records with  lower precedence are
-to be attempted first. Where there is a tie in precedence, the order
-should be non-deterministic.
-
-</p>
-<a name="rfc.section.2.3"></a><h4><a name="algotype">2.3</a>&nbsp;RDATA format - algorithm type</h4>
-
-<p>
-The algorithm type field identifies the public key's cryptographic
-algorithm and determines the format of the public key field.  
-
-</p>
-<p>
-A value of 0 indicates that no key is present.
-
-</p>
-<p>
-The following values are defined:
-  
-<blockquote class="text"><dl>
-<dt>1</dt>
-<dd>A DSA key is present, in the format defined in RFC2536 <a href="#RFC2536">[11]</a>
-</dd>
-<dt>2</dt>
-<dd>A RSA key is present, in the format defined in RFC3110 <a href="#RFC3110">[12]</a>
-</dd>
-</dl></blockquote><p>
-</p>
-<a name="rfc.section.2.4"></a><h4><a name="gatewaytype">2.4</a>&nbsp;RDATA format - gateway type</h4>
-
-<p>
-The gateway type field indicates the format of the information that
-is stored in the gateway field.
-
-</p>
-<p>
-The following values are defined:
-  
-<blockquote class="text"><dl>
-<dt>0</dt>
-<dd>No gateway is present
-</dd>
-<dt>1</dt>
-<dd>A 4-byte IPv4 address is present
-</dd>
-<dt>2</dt>
-<dd>A 16-byte IPv6 address is present
-</dd>
-<dt>3</dt>
-<dd>A wire-encoded domain name is present. The wire-encoded
-format is self-describing, so the length is implicit. The domain name
-MUST NOT be compressed.
-</dd>
-</dl></blockquote><p>
-</p>
-<a name="rfc.section.2.5"></a><h4><a name="anchor7">2.5</a>&nbsp;RDATA format - gateway</h4>
-
-<p>
-The gateway field indicates a gateway to which an IPsec tunnel may be
-created in order to reach the entity named by this resource record.
-
-</p>
-<p>
-There are three formats:
-
-</p>
-<p>
-A 32-bit IPv4 address is present in the gateway field. The data
-portion is an IPv4 address as described in section 3.4.1 of
-<a href="#RFC1035">RFC1035</a>[2].  This is a 32-bit number in network byte order.
-
-</p>
-<p>A 128-bit IPv6 address is present in the gateway field.
-The data portion is an IPv6 address as described in section 2.2 of
-<a href="#RFC1886">RFC1886</a>[7]. This is a 128-bit number in network byte order.
-
-</p>
-<p>
-The gateway field is a normal wire-encoded domain name, as described
-in section 3.3 of RFC1035 <a href="#RFC1035">[2]</a>. Compression MUST NOT be used. 
-
-</p>
-<a name="rfc.section.2.6"></a><h4><a name="anchor8">2.6</a>&nbsp;RDATA format - public keys</h4>
-
-<p>
-Both of the public key types defined in this document (RSA and DSA)
-inherit their public key formats from the corresponding KEY RR formats. 
-Specifically, the public key field contains the algorithm-specific
-portion of the KEY RR RDATA, which is all of the KEY RR DATA after the
-first four octets.  This is the same portion of the KEY RR that must be
-specified by documents that define a DNSSEC algorithm.  
-Those documents also specify a message digest to be used for generation
-of SIG RRs; that specification is not relevant for IPSECKEY RR.
-
-</p>
-<p>
-Future algorithms, if they are to be used by both DNSSEC (in the KEY
-RR) and IPSECKEY, are likely to use the same public key encodings in
-both records.  Unless otherwise specified, the IPSECKEY public key
-field will contain the algorithm-specific portion of the KEY RR RDATA
-for the corresponding algorithm.  The algorithm must still be
-designated for use by IPSECKEY, and an IPSECKEY algorithm type number
-(which might be different than the DNSSEC algorithm number) must be
-assigned to it.
-
-</p>
-<p>The DSA key format is defined in RFC2536 <a href="#RFC2536">[11]</a>
-</p>
-<p>The RSA key format is defined in RFC3110 <a href="#RFC3110">[12]</a>,
-with the following changes:
-</p>
-<p>
-The earlier definition of RSA/MD5 in RFC2065 limited the exponent and
-modulus to 2552 bits in length.  RFC3110 extended that limit to 4096
-bits for RSA/SHA1 keys.  The IPSECKEY RR imposes no length limit on
-RSA public keys, other than the 65535 octet limit imposed by the
-two-octet length encoding.  This length extension is applicable only
-to IPSECKEY and not to KEY RRs. 
-
-</p>
-<a name="anchor9"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.3"></a><h3>3.&nbsp;Presentation formats</h3>
-
-<a name="rfc.section.3.1"></a><h4><a name="anchor10">3.1</a>&nbsp;Representation of IPSECKEY RRs</h4>
-
-<p>
-   IPSECKEY RRs may appear in a zone data master file.
-   The precedence, gateway type and algorithm and gateway fields are REQUIRED.
-   The base64 encoded public key block is OPTIONAL; if not present,
-   then the public key field of the resource record MUST be construed
-   as being zero octets in length.
-
-</p>
-<p>
-   The algorithm field is an unsigned integer. No mnemonics are defined.
-
-</p>
-<p>
-   If no gateway is to be indicated, then the gateway type field MUST
-   be zero, and the gateway field MUST be "."
-
-</p>
-<p>
-   The Public Key field is represented as a Base64 encoding of the
-   Public Key.  Whitespace is allowed within the Base64 text.  For a
-   definition of Base64 encoding, see
-<a href="#RFC1521">RFC1521</a>[3] Section 5.2.
-
-</p>
-<p>
-   The general presentation for the record as as follows:
-</p>
-</font><pre>
-IN     IPSECKEY ( precedence gateway-type algorithm
-                  gateway base64-encoded-public-key )
-</pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-<p>
-
-</p>
-<a name="rfc.section.3.2"></a><h4><a name="anchor11">3.2</a>&nbsp;Examples</h4>
-
-<p> 
-An example of a node 192.0.2.38 that will accept IPsec tunnels on its
-own behalf.
-</p>
-</font><pre>
-38.2.0.192.in-addr.arpa. 7200 IN     IPSECKEY ( 10 1 2 
-                 192.0.2.38
-                 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-</pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-<p>
-
-</p>
-<p> 
-An example of a node, 192.0.2.38 that has published its key only.
-</p>
-</font><pre>
-38.2.0.192.in-addr.arpa. 7200 IN     IPSECKEY ( 10 0 2
-                 .
-                 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-</pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-<p>
-
-</p>
-<p> 
-An example of a node, 192.0.2.38 that has delegated authority to the node
-192.0.2.3.
-</p>
-</font><pre>
-38.2.0.192.in-addr.arpa. 7200 IN     IPSECKEY ( 10 1 2
-                 192.0.2.3
-                 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-</pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-<p>
-
-</p>
-<p> 
-An example of a node, 192.0.1.38 that has delegated authority to the node
-with the identity "mygateway.example.com".
-</p>
-</font><pre>
-38.1.0.192.in-addr.arpa. 7200 IN     IPSECKEY ( 10 3 2
-                 mygateway.example.com.
-                 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-</pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-<p>
-
-</p>
-<p> 
-An example of a node, 2001:0DB8:0200:1:210:f3ff:fe03:4d0 that has
-delegated authority to the node 2001:0DB8:c000:0200:2::1
-</p>
-</font><pre>
-$ORIGIN 1.0.0.0.0.0.2.8.B.D.0.1.0.0.2.ip6.int.
-0.d.4.0.3.0.e.f.f.f.3.f.0.1.2.0 7200 IN     IPSECKEY ( 10 2 2
-                 2001:0DB8:0:8002::2000:1
-                 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-</pre><font face="verdana, helvetica, arial, sans-serif" size="2">
-<p>
-
-</p>
-<a name="anchor12"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.4"></a><h3>4.&nbsp;Security Considerations</h3>
-
-<p>
-   This entire memo pertains to the provision of public keying material
-   for use by key management protocols such as ISAKMP/IKE (RFC2407)
-   <a href="#RFC2407">[9]</a>.
-
-</p>
-<p>
-The IPSECKEY resource record contains information that SHOULD be
-communicated to the end client in an integral fashion - i.e. free from
-modification. The form of this channel is up to the consumer of the
-data - there must be a trust relationship between the end consumer of this
-resource record and the server. This relationship may be end-to-end
-DNSSEC validation, a TSIG or SIG(0) channel to another secure source,
-a secure local channel on the host, or some combination of the above.
-
-</p>
-<p>
-The keying material provided by the IPSECKEY resource record is not
-sensitive to passive attacks. The keying material may be freely
-disclosed to any party without any impact on the security properties
-of the resulting IPsec session: IPsec and IKE provide for defense
-against both active and passive attacks.
-
-</p>
-<p>
-   Any user of this resource record MUST carefully document their trust
-   model, and why the trust model of DNSSEC is appropriate, if that is
-   the secure channel used.
-
-</p>
-<a name="rfc.section.4.1"></a><h4><a name="anchor13">4.1</a>&nbsp;Active attacks against unsecured IPSECKEY resource records</h4>
-
-<p>
-This section deals with active attacks against the DNS. These attacks
-require that DNS requests and responses be intercepted and changed.
-DNSSEC is designed to defend against attacks of this kind.
-
-</p>
-<p>
-The first kind of active attack is when the attacker replaces the
-keying material with either a key under its control or with garbage.
-
-</p>
-<p>
-If the attacker is not able to mount a subsequent 
-man-in-the-middle attack on the IKE negotiation after replacing the
-public key, then this will result in a denial of service, as the
-authenticator used by IKE would fail.  
-
-</p>
-<p>
-If the attacker is able to both to mount active attacks against DNS
-and is also in a position to perform a man-in-the-middle attack on IKE and
-IPsec negotiations, then the attacker will be in a position to compromise
-the resulting IPsec channel. Note that an attacker must be able to
-perform active DNS attacks on both sides of the IKE negotiation in
-order for this to succeed. 
-
-</p>
-<p>
-The second kind of active attack is one in which the attacker replaces
-the the gateway address to point to a node under the attacker's
-control. The attacker can then either replace the public key or remove
-it, thus providing an IPSECKEY record of its own to match the
-gateway address. 
-
-</p>
-<p>
-This later form creates a simple man-in-the-middle since the attacker
-can then create a second tunnel to the real destination. Note that, as before,
-this requires that the attacker also mount an active attack against
-the responder. 
-
-</p>
-<p>
-Note that the man-in-the-middle can not just forward cleartext
-packets to the original destination. While the destination may be
-willing to speak in the clear, replying to the original sender,
-the sender will have already created a policy expecting ciphertext.
-Thus, the attacker will need to intercept traffic from both sides. In some
-cases, the attacker may be able to accomplish the full intercept by use
-of Network Addresss/Port Translation (NAT/NAPT) technology.
-
-</p>
-<p>
-Note that the danger here only applies to cases where the gateway
-field of the IPSECKEY RR indicates a different entity than the owner
-name of the IPSECKEY RR.  In cases where the end-to-end integrity of
-the IPSECKEY RR is suspect, the end client MUST restrict its use
-of the IPSECKEY RR to cases where the RR owner name matches the
-content of the gateway field.
-
-</p>
-<a name="anchor14"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.5"></a><h3>5.&nbsp;IANA Considerations</h3>
-
-<p>
-This document updates the IANA Registry for DNS Resource Record Types
-by assigning type X to the IPSECKEY record.  
-
-</p>
-<p>
-This document creates an IANA registry for the algorithm type field.
-
-</p>
-<p>
-Values 0, 1 and 2 are defined in <a href="#algotype">RDATA format - algorithm type</a>. Algorithm numbers
-3 through 255 can be assigned by IETF Consensus (<a href="#RFC2434">see RFC2434</a>[6]).
-
-</p>
-<p>
-This document creates an IANA registry for the gateway type field.
-
-</p>
-<p>
-Values 0, 1, 2 and 3 are defined in <a href="#gatewaytype">RDATA format - gateway type</a>.
-Algorithm numbers 4 through 255 can be assigned by
-Standards Action (<a href="#RFC2434">see RFC2434</a>[6]).
-
-</p>
-<a name="anchor15"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<a name="rfc.section.6"></a><h3>6.&nbsp;Acknowledgments</h3>
-
-<p>
-My thanks to Paul Hoffman, Sam Weiler, Jean-Jacques Puig, Rob Austein,
-and Olafur Gurmundsson who reviewed this document carefully.
-Additional thanks to Olafur Gurmundsson for a reference implementation.
-
-</p>
-<a name="rfc.references1"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<h3>Normative references</h3>
-<table width="99%" border="0">
-<tr><td class="author-text" valign="top"><b><a name="RFC1034">[1]</a></b></td>
-<td class="author-text">Mockapetris, P., "<a href="ftp://ftp.isi.edu/in-notes/rfc1034.txt">Domain names - concepts and facilities</a>", STD 13, RFC 1034, November 1987.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC1035">[2]</a></b></td>
-<td class="author-text"><a href="mailto:">Mockapetris, P.</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc1035.txt">Domain names - implementation and specification</a>", STD 13, RFC 1035, November 1987.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC1521">[3]</a></b></td>
-<td class="author-text"><a href="mailto:nsb@bellcore.com">Borenstein, N.</a> and <a href="mailto:">N. Freed</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc1521.txt">MIME (Multipurpose Internet Mail Extensions) Part One: Mechanisms for Specifying and Describing the Format of Internet Message Bodies</a>", RFC 1521, September 1993.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2026">[4]</a></b></td>
-<td class="author-text"><a href="mailto:sob@harvard.edu">Bradner, S.</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2026.txt">The Internet Standards Process -- Revision 3</a>", BCP 9, RFC 2026, October 1996.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2065">[5]</a></b></td>
-<td class="author-text"><a href="mailto:dee@cybercash.com">Eastlake, D.</a> and <a href="mailto:charlie_kaufman@iris.com">C. Kaufman</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2065.txt">Domain Name System Security Extensions</a>", RFC 2065, January 1997.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2434">[6]</a></b></td>
-<td class="author-text"><a href="mailto:narten@raleigh.ibm.com">Narten, T.</a> and <a href="mailto:Harald@Alvestrand.no">H. Alvestrand</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2434.txt">Guidelines for Writing an IANA Considerations Section in RFCs</a>", BCP 26, RFC 2434, October 1998.</td></tr>
-</table>
-
-<a name="rfc.references2"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<h3>Non-normative references</h3>
-<table width="99%" border="0">
-<tr><td class="author-text" valign="top"><b><a name="RFC1886">[7]</a></b></td>
-<td class="author-text"><a href="mailto:set@thumper.bellcore.com">Thomson, S.</a> and <a href="mailto:Christian.Huitema@MIRSA.INRIA.FR">C. Huitema</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc1886.txt">DNS Extensions to support IP version 6</a>", RFC 1886, December 1995.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2119">[8]</a></b></td>
-<td class="author-text"><a href="mailto:-">Bradner, S.</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2119.txt">Key words for use in RFCs to Indicate Requirement Levels</a>", BCP 14, RFC 2119, March 1997.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2407">[9]</a></b></td>
-<td class="author-text"><a href="mailto:ddp@network-alchemy.com">Piper, D.</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2407.txt">The Internet IP Security Domain of Interpretation for ISAKMP</a>", RFC 2407, November 1998.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2535">[10]</a></b></td>
-<td class="author-text"><a href="mailto:dee3@us.ibm.com">Eastlake, D.</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2535.txt">Domain Name System Security Extensions</a>", RFC 2535, March 1999.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC2536">[11]</a></b></td>
-<td class="author-text"><a href="mailto:dee3@us.ibm.com">Eastlake, D.</a>, "<a href="ftp://ftp.isi.edu/in-notes/rfc2536.txt">DSA KEYs and SIGs in the Domain Name System (DNS)</a>", RFC 2536, March 1999.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC3110">[12]</a></b></td>
-<td class="author-text">Eastlake, D., "<a href="ftp://ftp.isi.edu/in-notes/rfc3110.txt">RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)</a>", RFC 3110, May 2001.</td></tr>
-<tr><td class="author-text" valign="top"><b><a name="RFC3445">[13]</a></b></td>
-<td class="author-text">Massey, D. and S. Rose, "<a href="ftp://ftp.isi.edu/in-notes/rfc3445.txt">Limiting the Scope of the KEY Resource Record (RR)</a>", RFC 3445, December 2002.</td></tr>
-</table>
-
-<a name="rfc.authors"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<h3>Author's Address</h3>
-<table width="99%" border="0" cellpadding="0" cellspacing="0">
-<tr><td class="author-text">&nbsp;</td>
-<td class="author-text">Michael C. Richardson</td></tr>
-<tr><td class="author-text">&nbsp;</td>
-<td class="author-text">Sandelman Software Works</td></tr>
-<tr><td class="author-text">&nbsp;</td>
-<td class="author-text">470 Dawson Avenue</td></tr>
-<tr><td class="author-text">&nbsp;</td>
-<td class="author-text">Ottawa, ON  K1Z 5V7</td></tr>
-<tr><td class="author-text">&nbsp;</td>
-<td class="author-text">CA</td></tr>
-<tr><td class="author" align="right">EMail:&nbsp;</td>
-<td class="author-text"><a href="mailto:mcr@sandelman.ottawa.on.ca">mcr@sandelman.ottawa.on.ca</a></td></tr>
-<tr><td class="author" align="right">URI:&nbsp;</td>
-<td class="author-text"><a href="http://www.sandelman.ottawa.on.ca/">http://www.sandelman.ottawa.on.ca/</a></td></tr>
-</table>
-<a name="rfc.copyright"><br><hr size="1" shade="0"></a>
-<table border="0" cellpadding="0" cellspacing="2" width="30" height="15" align="right"><tr><td bgcolor="#990000" align="center" width="30" height="15"><a href="#toc" CLASS="link2"><font face="monaco, MS Sans Serif" color="#ffffff" size="1"><b>&nbsp;TOC&nbsp;</b></font></a><br></td></tr></table>
-<h3>Full Copyright Statement</h3>
-<p class='copyright'>
-Copyright (C) The Internet Society (2003). All Rights Reserved.</p>
-<p class='copyright'>
-This document and translations of it may be copied and furnished to
-others, and derivative works that comment on or otherwise explain it
-or assist in its implementation may be prepared, copied, published and
-distributed, in whole or in part, without restriction of any kind,
-provided that the above copyright notice and this paragraph are
-included on all such copies and derivative works. However, this
-document itself may not be modified in any way, such as by removing
-the copyright notice or references to the Internet Society or other
-Internet organizations, except as needed for the purpose of
-developing Internet standards in which case the procedures for
-copyrights defined in the Internet Standards process must be
-followed, or as required to translate it into languages other than
-English.</p>
-<p class='copyright'>
-The limited permissions granted above are perpetual and will not be
-revoked by the Internet Society or its successors or assigns.</p>
-<p class='copyright'>
-This document and the information contained herein is provided on an
-&quot;AS IS&quot; basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
-TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
-BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
-HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.</p>
-<h3>Acknowledgement</h3>
-<p class='copyright'>
-Funding for the RFC Editor function is currently provided by the
-Internet Society.</p>
-</font></body></html>
diff --git a/doc/src/draft-richardson-ipsec-rr.xml b/doc/src/draft-richardson-ipsec-rr.xml
deleted file mode 100644
index e51b32615..000000000
--- a/doc/src/draft-richardson-ipsec-rr.xml
+++ /dev/null
@@ -1,560 +0,0 @@
-<?xml version="1.0"?>
-<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
-<?rfc toc="yes"?>
-
-<rfc ipr="full2026" docName="draft-ietf-ipseckey-rr-07.txt">
-
-<front>
-  <area>Security</area>
-  <workgroup>IPSECKEY WG</workgroup>
-  <title abbrev="ipsecrr">
-     A method for storing IPsec keying material in DNS.
-  </title>
-
-  <author initials="M." surname="Richardson" fullname="Michael C. Richardson">
-    <organization abbrev="SSW">Sandelman Software Works</organization>
-    <address>
-      <postal>   
-        <street>470 Dawson Avenue</street>
-        <city>Ottawa</city>
-        <region>ON</region>
-        <code>K1Z 5V7</code>
-        <country>CA</country>
-      </postal>
-      <email>mcr@sandelman.ottawa.on.ca</email>
-      <uri>http://www.sandelman.ottawa.on.ca/</uri>
-    </address>
-  </author>
-
-  <date month="September" year="2003" />
-
-<abstract>
-  <t>
-This document describes a new resource record for DNS. This record may be
-used to store public keys for use in IPsec systems. 
-</t>
-
-<t>
-This record replaces the functionality of the sub-type #1 of the KEY Resource
-Record, which has been obsoleted by RFC3445.
-</t>
-</abstract>
-
-</front>
-
-<middle>
-
-<section title="Introduction">
-<t>
-   The type number for the IPSECKEY RR is TBD.
-</t>
-
-<section title="Overview">
-<t>
-   The IPSECKEY resource record (RR) is used to publish a public key that is
-   to be associated with a Domain Name System (DNS) name for use with the
-   IPsec protocol suite.  This can be the  public key of a host,
-   network, or application (in the case of per-port keying).
-</t>
-
-<t>
-      The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
-      NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and
-      "OPTIONAL" in this document are to be interpreted as described in
-      RFC2119 <xref target="RFC2119" />.
-</t>
-</section>
-
-<section title="Usage Criteria">
-<t>
-   An IPSECKEY resource record SHOULD be used in combination with DNSSEC
-unless some other means of authenticating the IPSECKEY resource record
-is available.
-</t>
-
-<t>  
-   It is expected that there will often be multiple IPSECKEY resource
-   records at the same name. This will be due to the presence
-   of multiple gateways and the need to rollover keys.
-
-</t>
-
-<t>
-   This resource record is class independent.
-</t>
-</section>
-</section>
-
-<section title="Storage formats">
-
-<section title="IPSECKEY RDATA format">
-
-<t>
-   The RDATA for an IPSECKEY RR consists of a precedence value, a public key,
-   algorithm type, and an optional gateway address.
-</t>
-
-<artwork><![CDATA[
-    0                   1                   2                   3  
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |  precedence   | gateway type  |  algorithm  |     gateway     |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-------------+                 +
-   ~                            gateway                            ~
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                                                               /
-   /                          public key                           /
-   /                                                               /
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-|
-]]></artwork>
-</section>
-
-<section title="RDATA format - precedence">
-<t>
-This is an 8-bit precedence for this record. This is interpreted in
-the same way as the PREFERENCE field described in section
-3.3.9 of RFC1035 <xref target="RFC1035" />. 
-</t>
-<t>
-Gateways listed in IPSECKEY records with  lower precedence are
-to be attempted first. Where there is a tie in precedence, the order
-should be non-deterministic.
-</t>
-</section>
-
-<section anchor="algotype" title="RDATA format - algorithm type">
-<t>
-The algorithm type field identifies the public key's cryptographic
-algorithm and determines the format of the public key field.  
-</t>
-
-<t>
-A value of 0 indicates that no key is present.
-</t>
-
-<t>
-The following values are defined:
-  <list style="hanging">
-  <t hangText="1">A DSA key is present, in the format defined in RFC2536 <xref target="RFC2536" /></t>
-  <t hangText="2">A RSA key is present, in the format defined in RFC3110 <xref target="RFC3110" /></t>
-  </list>
-</t>
-
-</section>
-
-<section anchor="gatewaytype" title="RDATA format - gateway type">
-<t>
-The gateway type field indicates the format of the information that
-is stored in the gateway field.
-</t>
-
-<t>
-The following values are defined:
-  <list style="hanging">
-  <t hangText="0">No gateway is present</t>
-  <t hangText="1">A 4-byte IPv4 address is present</t>
-  <t hangText="2">A 16-byte IPv6 address is present</t>
-  <t hangText="3">A wire-encoded domain name is present. The wire-encoded
-format is self-describing, so the length is implicit. The domain name
-MUST NOT be compressed.</t>
-  </list>
-</t>
-
-</section>
-
-<section title="RDATA format - gateway">
-<t>
-The gateway field indicates a gateway to which an IPsec tunnel may be
-created in order to reach the entity named by this resource record.
-</t>
-<t>
-There are three formats:
-</t>
-
-<t>
-A 32-bit IPv4 address is present in the gateway field. The data
-portion is an IPv4 address as described in section 3.4.1 of
-<xref target="RFC1035">RFC1035</xref>.  This is a 32-bit number in network byte order.
-</t>
-
-<t>A 128-bit IPv6 address is present in the gateway field.
-The data portion is an IPv6 address as described in section 2.2 of
-<xref target="RFC1886">RFC1886</xref>. This is a 128-bit number in network byte order.
-</t>
-
-<t>
-The gateway field is a normal wire-encoded domain name, as described
-in section 3.3 of RFC1035 <xref target="RFC1035" />. Compression MUST NOT be used. 
-</t>
-
-</section>
-
-<section title="RDATA format - public keys">
-<t>
-Both of the public key types defined in this document (RSA and DSA)
-inherit their public key formats from the corresponding KEY RR formats. 
-Specifically, the public key field contains the algorithm-specific
-portion of the KEY RR RDATA, which is all of the KEY RR DATA after the
-first four octets.  This is the same portion of the KEY RR that must be
-specified by documents that define a DNSSEC algorithm.  
-Those documents also specify a message digest to be used for generation
-of SIG RRs; that specification is not relevant for IPSECKEY RR.
-</t>
-
-<t>
-Future algorithms, if they are to be used by both DNSSEC (in the KEY
-RR) and IPSECKEY, are likely to use the same public key encodings in
-both records.  Unless otherwise specified, the IPSECKEY public key
-field will contain the algorithm-specific portion of the KEY RR RDATA
-for the corresponding algorithm.  The algorithm must still be
-designated for use by IPSECKEY, and an IPSECKEY algorithm type number
-(which might be different than the DNSSEC algorithm number) must be
-assigned to it.
-</t>
-
-<t>The DSA key format is defined in RFC2536 <xref target="RFC2536" /></t>.
-
-<t>The RSA key format is defined in RFC3110 <xref target="RFC3110" />,
-with the following changes:</t>
-
-<t>
-The earlier definition of RSA/MD5 in RFC2065 limited the exponent and
-modulus to 2552 bits in length.  RFC3110 extended that limit to 4096
-bits for RSA/SHA1 keys.  The IPSECKEY RR imposes no length limit on
-RSA public keys, other than the 65535 octet limit imposed by the
-two-octet length encoding.  This length extension is applicable only
-to IPSECKEY and not to KEY RRs. 
-</t>
-
-</section>
-
-</section>
-
-
-
-<section title="Presentation formats">
-
-<section title="Representation of IPSECKEY RRs">
-<t>
-   IPSECKEY RRs may appear in a zone data master file.
-   The precedence, gateway type and algorithm and gateway fields are REQUIRED.
-   The base64 encoded public key block is OPTIONAL; if not present,
-   then the public key field of the resource record MUST be construed
-   as being zero octets in length.
-</t>
-<t>
-   The algorithm field is an unsigned integer. No mnemonics are defined.
-</t>
-<t>
-   If no gateway is to be indicated, then the gateway type field MUST
-   be zero, and the gateway field MUST be "."
-</t>
-
-<t>
-   The Public Key field is represented as a Base64 encoding of the
-   Public Key.  Whitespace is allowed within the Base64 text.  For a
-   definition of Base64 encoding, see
-<xref target="RFC1521">RFC1521</xref> Section 5.2.
-</t>
-
-   
-<t>
-   The general presentation for the record as as follows:
-<artwork><![CDATA[
-IN     IPSECKEY ( precedence gateway-type algorithm
-                  gateway base64-encoded-public-key )
-]]></artwork>
-</t>
-</section>
-
-
-<section title="Examples">
-<t> 
-An example of a node 192.0.2.38 that will accept IPsec tunnels on its
-own behalf.
-<artwork><![CDATA[
-38.2.0.192.in-addr.arpa. 7200 IN     IPSECKEY ( 10 1 2 
-                 192.0.2.38
-                 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-]]></artwork>
-</t>
-
-<t> 
-An example of a node, 192.0.2.38 that has published its key only.
-<artwork><![CDATA[
-38.2.0.192.in-addr.arpa. 7200 IN     IPSECKEY ( 10 0 2
-                 .
-                 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-]]></artwork>
-</t>
-
-<t> 
-An example of a node, 192.0.2.38 that has delegated authority to the node
-192.0.2.3.
-<artwork><![CDATA[
-38.2.0.192.in-addr.arpa. 7200 IN     IPSECKEY ( 10 1 2
-                 192.0.2.3
-                 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-]]></artwork>
-</t>
-
-<t> 
-An example of a node, 192.0.1.38 that has delegated authority to the node
-with the identity "mygateway.example.com".
-<artwork><![CDATA[
-38.1.0.192.in-addr.arpa. 7200 IN     IPSECKEY ( 10 3 2
-                 mygateway.example.com.
-                 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-]]></artwork>
-</t>
-
-<t> 
-An example of a node, 2001:0DB8:0200:1:210:f3ff:fe03:4d0 that has
-delegated authority to the node 2001:0DB8:c000:0200:2::1
-<artwork><![CDATA[
-$ORIGIN 1.0.0.0.0.0.2.8.B.D.0.1.0.0.2.ip6.int.
-0.d.4.0.3.0.e.f.f.f.3.f.0.1.2.0 7200 IN     IPSECKEY ( 10 2 2
-                 2001:0DB8:0:8002::2000:1
-                 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ== )
-]]></artwork>
-</t>
-
-</section>
-</section>
-
-<section title="Security Considerations">
-<t>
-   This entire memo pertains to the provision of public keying material
-   for use by key management protocols such as ISAKMP/IKE (RFC2407)
-   <xref target="RFC2407" />.
-</t>
-
-<t>
-The IPSECKEY resource record contains information that SHOULD be
-communicated to the end client in an integral fashion - i.e. free from
-modification. The form of this channel is up to the consumer of the
-data - there must be a trust relationship between the end consumer of this
-resource record and the server. This relationship may be end-to-end
-DNSSEC validation, a TSIG or SIG(0) channel to another secure source,
-a secure local channel on the host, or some combination of the above.
-</t>
-
-<t>
-The keying material provided by the IPSECKEY resource record is not
-sensitive to passive attacks. The keying material may be freely
-disclosed to any party without any impact on the security properties
-of the resulting IPsec session: IPsec and IKE provide for defense
-against both active and passive attacks.
-</t>
-
-<t>
-   Any user of this resource record MUST carefully document their trust
-   model, and why the trust model of DNSSEC is appropriate, if that is
-   the secure channel used.
-</t>
-
-<section title="Active attacks against unsecured IPSECKEY resource records">
-<t>
-This section deals with active attacks against the DNS. These attacks
-require that DNS requests and responses be intercepted and changed.
-DNSSEC is designed to defend against attacks of this kind.
-</t>
-
-<t>
-The first kind of active attack is when the attacker replaces the
-keying material with either a key under its control or with garbage.
-</t>
-
-<t>
-If the attacker is not able to mount a subsequent 
-man-in-the-middle attack on the IKE negotiation after replacing the
-public key, then this will result in a denial of service, as the
-authenticator used by IKE would fail.  
-</t>
-
-<t>
-If the attacker is able to both to mount active attacks against DNS
-and is also in a position to perform a man-in-the-middle attack on IKE and
-IPsec negotiations, then the attacker will be in a position to compromise
-the resulting IPsec channel. Note that an attacker must be able to
-perform active DNS attacks on both sides of the IKE negotiation in
-order for this to succeed. 
-</t>
-
-<t>
-The second kind of active attack is one in which the attacker replaces
-the the gateway address to point to a node under the attacker's
-control. The attacker can then either replace the public key or remove
-it, thus providing an IPSECKEY record of its own to match the
-gateway address. 
-</t>
-
-<t>
-This later form creates a simple man-in-the-middle since the attacker
-can then create a second tunnel to the real destination. Note that, as before,
-this requires that the attacker also mount an active attack against
-the responder. 
-</t>
-
-<t>
-Note that the man-in-the-middle can not just forward cleartext
-packets to the original destination. While the destination may be
-willing to speak in the clear, replying to the original sender,
-the sender will have already created a policy expecting ciphertext.
-Thus, the attacker will need to intercept traffic from both sides. In some
-cases, the attacker may be able to accomplish the full intercept by use
-of Network Addresss/Port Translation (NAT/NAPT) technology.
-</t>
-
-<t>
-Note that the danger here only applies to cases where the gateway
-field of the IPSECKEY RR indicates a different entity than the owner
-name of the IPSECKEY RR.  In cases where the end-to-end integrity of
-the IPSECKEY RR is suspect, the end client MUST restrict its use
-of the IPSECKEY RR to cases where the RR owner name matches the
-content of the gateway field.
-</t>
-</section>
-
-</section>
-
-<section title="IANA Considerations">
-<t>
-This document updates the IANA Registry for DNS Resource Record Types
-by assigning type X to the IPSECKEY record.  
-</t>
-
-<t>
-This document creates an IANA registry for the algorithm type field.
-</t>
-<t>
-Values 0, 1 and 2 are defined in <xref target="algotype" />. Algorithm numbers
-3 through 255 can be assigned by IETF Consensus (<xref target="RFC2434">see RFC2434</xref>).
-</t>
-
-<t>
-This document creates an IANA registry for the gateway type field.
-</t>
-<t>
-Values 0, 1, 2 and 3 are defined in <xref target="gatewaytype" />.
-Algorithm numbers 4 through 255 can be assigned by
-Standards Action (<xref target="RFC2434">see RFC2434</xref>).
-</t>
-
-
-
-</section>
-
-<section title="Acknowledgments">
-<t>
-My thanks to Paul Hoffman, Sam Weiler, Jean-Jacques Puig, Rob Austein,
-and Olafur Gurmundsson who reviewed this document carefully.
-Additional thanks to Olafur Gurmundsson for a reference implementation.
-</t>
-</section>
-
-</middle>
-
-<back>
-<references title="Normative references">
-<!-- DNSSEC -->
-<?rfc include="reference.RFC.1034" ?>
-<?rfc include="reference.RFC.1035" ?>
-<?rfc include="reference.RFC.1521" ?>
-<?rfc include="reference.RFC.2026" ?>
-<?rfc include="reference.RFC.2065" ?>
-<?rfc include="reference.RFC.2434" ?>
-</references>
-
-<references title="Non-normative references">
-<?rfc include="reference.RFC.1886" ?>
-<?rfc include="reference.RFC.2119" ?>
-<?rfc include="reference.RFC.2407" ?>
-<?rfc include="reference.RFC.2535" ?>
-<?rfc include="reference.RFC.2536" ?>
-<?rfc include="reference.RFC.3110" ?>
-<?rfc include="reference.RFC.3445" ?>
-</references>
-</back>
-</rfc>
-<!--
-  $Id: draft-richardson-ipsec-rr.xml,v 1.1 2004/03/15 20:35:24 as Exp $
-
-  $Log: draft-richardson-ipsec-rr.xml,v $
-  Revision 1.1  2004/03/15 20:35:24  as
-  added files from freeswan-2.04-x509-1.5.3
-
-  Revision 1.23  2003/09/04 23:26:09  mcr
-  	more nits.
-
-  Revision 1.22  2003/08/16 15:55:35  mcr
-  	fixed version to -06.
-
-  Revision 1.21  2003/08/16 15:52:32  mcr
-  	Sam's comments on IANA considerations.
-
-  Revision 1.20  2003/07/27 22:57:54  mcr
-  	updated document with new text about a seperate registry
-  	for the algorithm type.
-
-  Revision 1.19  2003/06/30 01:51:50  mcr
-  	minor typo fixes.
-
-  Revision 1.18  2003/06/16 17:45:00  mcr
-  	adjusted date on rev-04.
-
-  Revision 1.17  2003/06/16 17:41:30  mcr
-  	revision -04
-
-  Revision 1.16  2003/06/16 17:39:20  mcr
-  	adjusted typos, and adjusted IANA considerations.
-
-  Revision 1.15  2003/05/26 19:31:23  mcr
-  	updates to drafts - IPSEC RR - SC versions, and RFC3526
-  	reference in OE draft.
-
-  Revision 1.14  2003/05/23 13:57:40  mcr
-  	updated draft ##.
-
-  Revision 1.13  2003/05/23 13:54:45  mcr
-  	updated month on draft.
-
-  Revision 1.12  2003/05/21 15:42:49  mcr
-  	new SC section with comments from Rob Austein.
-
-  Revision 1.11  2003/05/20 20:52:22  mcr
-  	new security considerations section.
-
-  Revision 1.10  2003/05/20 19:07:47  mcr
-  	rewrote Security Considerations.
-
-  Revision 1.9  2003/05/20 18:17:09  mcr
-  	nits from Rob Austein.
-
-  Revision 1.8  2003/04/29 00:44:59  mcr
-  	updates according to WG consensus: restored three-way
-  	gateway field type.
-
-  Revision 1.7  2003/03/30 17:00:29  mcr
-  	updates according to community feedback.
-
-  Revision 1.6  2003/03/19 02:20:24  mcr
-  	updated draft based upon comments from working group
-
-  Revision 1.5  2003/02/23 22:39:22  mcr
-  	updates to IPSECKEY draft.
-
-  Revision 1.4  2003/02/21 04:39:04  mcr
-  	updated drafts, and added crosscompile.html
-
-  Revision 1.3  2003/01/17 16:26:34  mcr
-  	updated IPSEC KEY draft with restrictions.
-
-  Revision 1.2  2002/08/26 18:20:54  mcr
-  	updated documents
-
-  Revision 1.1  2002/08/10 20:05:33  mcr
-  	document proposing IPSECKEY Resource Record
-
-
-!>
diff --git a/doc/src/faq.html b/doc/src/faq.html
deleted file mode 100644
index f62fc1c88..000000000
--- a/doc/src/faq.html
+++ /dev/null
@@ -1,2770 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>FreeS/WAN FAQ</title>
-  <meta name="keywords" content="Linux, IPsec, VPN, security, FreeSWAN, FAQ">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: faq.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1>FreeS/WAN FAQ</h1>
-
-<p>This is a collection of questions and answers, mostly taken from the
-FreeS/WAN <a href="mail.html">mailing list</a>. See the project <a
-href="http://www.freeswan.org/">web site</a> for more information. All the
-FreeS/WAN documentation is online there.</p>
-
-<p>Contributions to the FAQ are welcome. Please send them to the project <a
-href="mail.html">mailing list</a>.</p>
-<hr>
-
-<h2><a name="questions">Index of FAQ questions</a></h2>
-<ul>
-  <li><a href="#whatzit">What is FreeS/WAN?</a></li>
-  <li><a href="#problems">How do I report a problem or seek help?</a></li>
-  <li><a href="#generic">Can I get ...</a>
-    <ul>
-      <li><a href="#lemme_out">... an off-the-shelf system that includes
-        FreeS/WAN?</a></li>
-      <li><a href="#contractor">... contractors or staff who know
-        FreeS/WAN?</a></li>
-      <li><a href="#commercial">... commercial support?</a></li>
-    </ul>
-  </li>
-  <li><a href="#release">Release questions</a>
-    <ul>
-      <li><a href="#rel.current">What is the current release?</a></li>
-      <li><a href="#relwhen">When is the next release?</a></li>
-      <li><a href="#rel.bugs">Are there known bugs in the current
-      release?</a></li>
-    </ul>
-  </li>
-  <li><a href="mod_cons">Modifications and contributions</a>
-    <ul>
-      <li><a href="#modify.faq">Can I modify FreeS/WAN to ...?</a></li>
-      <li><a href="#contrib.faq">Can I contribute to the project?</a></li>
-      <li><a href="#ddoc.faq">Is there detailed design documentation?</a></li>
-    </ul>
-  </li>
-  <li><a href="#interact">Will FreeS/WAN work in my environment?</a>
-    <ul>
-      <li><a href="#interop.faq">Can FreeS/WAN talk to ... ?</a></li>
-      <li><a href="#old_to_new">Can different FreeS/WAN versions talk to each
-        other?</a></li>
-      <li><a href="#faq.bandwidth">Is there a limit on throughput?</a></li>
-      <li><a href="#faq.number">Is there a limit on number of
-      connections?</a></li>
-      <li><a href="#faq.speed">Is a ... fast enough to handle FreeS/WAN with
-        my loads?</a></li>
-    </ul>
-  </li>
-  <li><a href="#work_on">Will FreeS/WAN work on ...</a>
-    <ul>
-      <li><a href="#versions">... my version of Linux?</a></li>
-      <li><a href="#nonIntel.faq">... non-Intel CPUs?</a></li>
-      <li><a href="#multi.faq">... multiprocessors?</a></li>
-      <li><a href="#k.old">... an older kernel?</a></li>
-      <li><a href="#k.versions">... the latest kernel version?</a></li>
-      <li><a href="#interface.faq">... unusual network hardware?</a></li>
-      <li><a href="#vlan">... a VLAN (802.1q) network?</a></li>
-    </ul>
-  </li>
-  <li><a href="#features.faq">Does FreeS/WAN support ...</a>
-    <ul>
-      <li><a href="#VPN.faq">... site-to-site VPN applications</a></li>
-      <li><a href="#warrior.faq">... remote users connecting to a LAN</a></li>
-      <li><a href="#road.shared.possible">... remote users using shared
-        secret authentication?</a></li>
-      <li><a href="#wireless.faq">... wireless networks</a></li>
-      <li><a href="#PKIcert">... X.509 or other PKI certificates?</a></li>
-      <li><a href="#Radius">... user authentication (Radius, SecureID,
-        Smart Card ...)?</a></li>
-      <li><a href="#NATtraversal">... NAT traversal</a></li>
-      <li><a href="#virtID">... assigning a "virtual identity" to a remote
-        system?</a></li>
-      <li><a href="#noDES.faq">... single DES encryption?</a></li>
-      <li><a href="#AES.faq">... AES encryption?</a></li>
-      <li><a href="#other.cipher">... other encryption algorithms?</a></li>
-    </ul>
-  </li>
-  <li><a href="#canI">Can I ...</a>
-    <ul>
-      <li><a href="#policy.preconfig">...use policy groups along with 
-         explicitly configured connections?</a></li>
-      <li><a href="#policy.off">...turn off policy groups?</a></li>
-<!--
-      <li><a href="#policy.otherinterface">...use policy groups
-      on an interface other than <VAR>%defaultroute</VAR>?</a></li>
--->
-      <li><a href="#reload">... reload connection info without
-      restarting?</a></li>
-      <li><a href="#masq.faq">... use several masqueraded subnets?</a></li>
-      <li><a href="#dup_route">... use subnets masqueraded to the same
-        addresses?</a></li>
-      <li><a href="#road.masq">... assign a road warrior an address on my net
-        (a virtual identity)?</a></li>
-      <li><a href="#road.many">... support many road warriors with one
-        gateway?</a></li>
-      <li><a href="#road.PSK">... have many road warriors using shared secret
-        authentication?</a></li>
-      <li><a href="#QoS">... use Quality of Service routing with
-        FreeS/WAN?</a></li>
-      <li><a href="#deadtunnel">... recognise dead tunnels and shut them
-        down?</a></li>
-      <li><a href="#demanddial">... build IPsec tunnels over a demand-dialed
-        link?</a></li>
-      <li><a href="#GRE">... build GRE, L2TP or PPTP tunnels over IPsec?</a></li>
-      <li><a href="#NetBIOS">... use Network Neighborhood (Samba, NetBIOS) over IPsec?</a></li>
-    </ul>
-  </li>
-  <li><a href="#setup.faq">Life's little mysteries</a>
-    <ul>
-      <li><a href="#cantping">I cannot ping ....</a></li>
-      <li><a href="#forever">It takes forever to ...</a></li>
-      <li><a href="#route">I send packets to the tunnel with route(8) but
-        they vanish</a></li>
-      <li><a href="#down_route">When a tunnel goes down, packets
-      vanish</a></li>
-      <li><a href="#firewall_ate">The firewall ate my packets!</a></li>
-      <li><a href="#dropconn">Dropped connections</a></li>
-      <li><a href="#defaultroutegone">Disappearing %defaultroute</a></li>
-      <li><a href="#tcpdump.faq">TCPdump on the gateway shows strange
-        things</a></li>
-      <li><a href="#no_trace">Traceroute does not show anything between the
-        gateways</a></li>
-    </ul>
-  </li>
-  <li><a href="#man4debug">Testing in stages (or .... works but ...
-    doesn't)</a>
-    <ul>
-      <li><a href="#nomanual">Manually keyed connections don't work</a></li>
-      <li><a href="#spi_error">One manual connection works, but second one
-        fails</a></li>
-      <li><a href="#man_no_auto">Manual connections work, but automatic
-        keying doesn't</a></li>
-      <li><a href="#nocomp">IPsec works, but connections using compression
-        fail</a></li>
-      <li><a href="#pmtu.broken">Small packets work, but large transfers
-        fail</a></li>
-      <li><a href="#subsub">Subnet-to-subnet works, but tests from the
-        gateways don't</a></li>
-    </ul>
-  </li>
-  <li><a href="#compile.faq">Compilation problems</a>
-    <ul>
-      <li><a href="#gmp.h_missing">gmp.h: No such file or directory</a></li>
-      <li><a href="#noVM">... virtual memory exhausted</a></li>
-    </ul>
-  </li>
-  <li><a href="#error">Interpreting error messages</a>
-    <ul>
-      <li><a href="#route-client">route-client (or host) exited with status
-        7</a></li>
-      <li><a href="#unreachable">SIOCADDRT:Network is unreachable</a></li>
-      <li><a href="#modprobe">ipsec_setup: modprobe: Can't locate
-        moduleipsec</a></li>
-      <li><a href="#noKLIPS">ipsec_setup: Fatal error, kernel appears to lack
-        KLIPS</a></li>
-      <li><a href="#noDNS">ipsec_setup: ... failure to fetch key for ... from
-        DNS</a></li>
-      <li><a href="#dup_address">ipsec_setup: ... interfaces ... and ...
-        share address ...</a></li>
-      <li><a href="#kflags">ipsec_setup: Cannot adjust kernel flags</a></li>
-      <li><a href="#message_num">Message numbers (MI3, QR1, et cetera) in
-        Pluto messages</a></li>
-      <li><a href="#conn_name">Connection names in Pluto error
-      messages</a></li>
-      <li><a href="#cantorient">Pluto: ... can't orient connection</a></li>
-      <li><a href="#no.interface">... we have no ipsecN interface for either
-        end of this connection</a></li>
-      <li><a href="#noconn">Pluto: ... no connection is known</a></li>
-      <li><a href="#nosuit">Pluto: ... no suitable connection ...</a></li>
-      <li><a href="#noconn.auth">Pluto: ... no connection has been
-        authorized</a></li>
-      <li><a href="#noDESsupport">Pluto: ... OAKLEY_DES_CBC is not
-        supported.</a></li>
-      <li><a href="#notransform">Pluto: ... no acceptable transform</a></li>
-      <li><a href="#rsasigkey">rsasigkey dumps core</a></li>
-      <li><a href="#sig4">!Pluto failure!: ... exited with ... signal
-      4</a></li>
-      <li><a href="#econnrefused">ECONNREFUSED error message</a></li>
-      <li><a href="#no_eroute">klips_debug: ... no eroute!</a></li>
-      <li><a href="#SAused">... trouble writing to /dev/ipsec ... SA already
-        in use</a></li>
-      <li><a href="#ignore">... ignoring ... payload</a></li>
-      <li><a href="#unknown_rightcert">unknown parameter name "rightcert"</a></li> 
-    </ul>
-  <li><a href="#spam">Why don't you restrict the mailing lists to reduce
-    spam?</a></li>
-</ul>
-<hr>
-
-<h2><a name="whatzit">What is FreeS/WAN?</a></h2>
-
-<p>FreeS/WAN is a Linux implementation of the <a
-href="glossary.html#IPSEC">IPsec</a> protocols, providing security services
-at the IP (Internet Protocol) level of the network.</p>
-
-<p>For more detail, see our <a href="intro.html">introduction</a> document or
-the FreeS/WAN project <a href="http://www.freeswan.org/">web site</a>.</p>
-
-<p>To start setting it up, go to our <a href="quickstart.html">quickstart
-guide</a>.</p>
-
-<p>Our <a href="web.html">web links</a> document has information on <a
-href="web.html#implement">IPsec for other systems</a>.</p>
-
-<h2><a name="problems">How do I report a problem or seek help?</a></h2>
-
-<DL>
-<DT>Read our <a href="trouble.html">troubleshooting</a> document.</DT>
-<DD><p>It may guide you to a solution. If not, see its 
-<a href="trouble.html#prob.report">problem reporting</a> section.</p>
-
-<p>Basically, what it says is <strong>give us the output from <var>ipsec
-barf</var> from both gateways</strong>. Without full information, we cannot
-diagnose a problem. However, <var>ipsec barf</var> produces a lot of output.
-If at all possible, <strong>please make barfs accessible via the web or
-FTP</strong> rather than sending enormous mail messages.</p>
-</DD>
-
-<DT><strong>Use the <a href="mail.html">users mailing list</a> for problem
-reports</strong>, rather than mailing developers directly.
-</DT>
-
-<DD>
-<ul>
-  <li>This gives you access to more expertise, including users who may have
-    encountered and solved the same problems.</li>
-  <li>It is more likely to get a quick response. Developers may get behind on
-    email, or even ignore it entirely for a while, but a list message (given
-    a reasonable Subject: line) is certain to be read by a fair number of
-    people within hours.</li>
-  <li>It may also be important because of <a
-    href="politics.html#exlaw">cryptography export laws</a>. A US citizen who
-    provides technical assistance to foreign cryptographic work might be
-    charged under the arms export regulations. Such a charge would be easier
-    to defend if the discussion took place on a public mailing list than if
-    it were done in private mail.</li>
-</ul>
-</DD>
-
-<DT>Try irc.freenode.net#freeswan.</DT>
-
-<DD>
-<p>FreeS/WAN developers, volunteers and users can often be found there. 
-Be patient and be 
-prepared to provide lots of information to support your question.</p>
-
-<p>If your question was really interesting, and you found an answer,
-please share that with the class by posting to the 
-<a href="mail.html">users mailing list</a>. That way others with the
-same problem can find your answer in the archives.</p>
-</DD>
-
-<DT>Premium support is also available.</DT>
-<DD>
-<p>See the next several questions.</p>
-</DD>
-</DL>
-
-<h2><a name="generic">Can I get ...</a></h2>
-
-<h3><a name="lemme_out">Can I get an off-the-shelf system that includes
-FreeS/WAN?</a></h3>
-
-<p>There are a number of Linux distributions or firewall products which
-include FreeS/WAN. See this <a href="intro.html#products">list</a>. Using one
-of these, chosen to match your requirements and budget, may save you
-considerable time and effort.</p>
-
-<p>If you don't know your requirements, start by reading Schneier's <a
-href="biblio.html#secrets">Secrets and Lies</a>. That gives the best overview
-of security issues I have seen. Then consider hiring a consultant (see next
-question) to help define your requirements.</p>
-
-<h3><a name="consultant">Can I hire consultants or staff who know
-FreeS/WAN?</a></h3>
-
-<p>If you want the help of a contractor, or to hire staff with FreeS/WAN
-expertise, you could:</p>
-<ul>
-  <li>check availability in your area through your local Linux User Group (<a
-    href="http://lugww.counter.li.org/">LUG Index</a>)</li>
-  <li>try asking on our <a href="mail.html">mailing list</a></li>
-</ul>
-
-<p>For companies offerring support, see the next question.</p>
-
-<h3><a name="commercial">Can I get commercial support?</a></h3>
-
-<p>Many of the distributions or firewall products which include FreeS/WAN
-(see this <a href="intro.html#products">list</a>) come with commercial
-support or have it available as an option.</p>
-
-<p>Various companies specialize in commercial support of open source
-software. Our project leader was a founder of the first such company, Cygnus
-Support. It has since been bought by <a
-href="http://www.redhat.com">Redhat</a>. Another such firm is <a
-href="http://www.linuxcare.com">Linuxcare</a>.</p>
-
-<h2><a name="release">Release questions</a></h2>
-
-<h3><a name="rel.current">What is the current release?</a></h3>
-
-<p>The current release is the highest-numbered tarball on our <a
-href="ftp://ftp.xs4all.nl/pub/crypto/freeswan">distribution site</a>. Almost
-always, any of <a href="intro.html#mirrors">the mirrors</a> will have the
-same file, though perhaps not for a day or so after a release.</p>
-
-<p>Unfortunately, the web site is not always updated as quickly as it should
-be.</p>
-
-<h3><a name="relwhen">When is the next release?</a></h3>
-
-<p>We try to do a release approximately every six to eight weeks.
-</p>
-
-<p>If pre-release tests fail and the fix appears complex, or more generally
-if the code does not appear stable when a release is scheduled, we will just
-skip that release.</p>
-
-<p>For serious bugs, we may bring out an extra bug-fix release. These get
-numbers in the normal release series.  For example, there was a bug found in
-FreeS/WAN 1.6, so we did another release less than two weeks later. The
-bug-fix release was called 1.7.</p>
-
-<h3><a name="rel.bugs">Are there known bugs in the current release?</a></h3>
-
-<p>Any problems we are aware of at the time of a release are documented in
-the <a href="../BUGS">BUGS</a> file for that release. You should also look at
-the <a href="../CHANGES">CHANGES</a> file.</p>
-
-<p>Bugs discovered after a release are discussed on the <a
-href="mail.html">mailing lists</a>. The easiest way to check for any problems
-in the current code would be to peruse the 
-<a href="http://lists.freeswan.org/pipermail/briefs">List In Brief</a>.</p>
-
-<h2><a name="mod_cons">Modifications and contributions</a></h2>
-
-<h3><a name="modify.faq">Can I modify FreeS/WAN to ...?</a></h3>
-
-<p>You are free to modify FreeS/WAN in any way. See the discussion of <a
-href="intro.html#licensing">licensing</a> in our introduction document.</p>
-
-<p>Before investing much energy in any such project, we suggest that you</p>
-<ul>
-  <li>check the list of <a href="web.html#patch">existing patches</a></li>
-  <li>post something about your project to the <a href="mail.html">design
-    mailing list</a></li>
-</ul>
-
-<p>This may prevent duplicated effort, or lead to interesting
-collaborations.</p>
-
-<h3><a name="contrib.faq">Can I contribute to the project?</a></h3>
-In general, we welcome contributions from the community. Various contributed
-patches, either to fix bugs or to add features, have been incorporated into
-our distribution. Other patches, not yet included in the distribution, are
-listed in our <a href="web.html#patch">web links</a> section.
-
-<p>Users have also contributed heavily to documentation, both by creating
-their own <a href="intro.html#howto">HowTos</a> and by posting things on the
-<a href="mail.html">mailing lists</a> which I have quoted in these HTML
-docs.</p>
-
-<p>There are, however, some caveats.</p>
-
-<p>FreeS/WAN is being implemented in Canada, by Canadians, largely to ensure
-that is it is entirely free of export restrictions. See this <a
-href="politics.html#status">discussion</a>. We <strong>cannot accept code
-contributions from US residents or citizens</strong>, not even one-line bugs
-fixes. The reasons for this were recently discussed extensively on the
-mailing list, in a thread starting <a
-href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/01/msg00111.html">here</a>.</p>
-
-<p>Not all contributions are of interest to us. The project has a set of
-fairly ambitious and quite specific goals, described in our <a
-href="intro.html#goals">introduction</a>. Contributions that lead toward
-these goals are likely to be welcomed enthusiastically. Other contributions
-may be seen as lower priority, or even as a distraction.</p>
-
-<p>Discussion of possible contributions takes place on the <a
-href="mail.html">design mailing list</a>.</p>
-
-<h3><a name="ddoc.faq">Is there detailed design documentation?</a></h3>
-There are:
-<ul>
-  <li><a href="rfc.html">RFCs</a> specifying the protocols we implement</li>
-  <li><a href="manpages.html">man pages</a> for our utilities, library
-    functions and file formats</li>
-  <li>comments in the source code</li>
-  <li><a href="index.html">HTML documentation</a> written primarily for
-  users</li>
-  <li>archived discussions from the <a href="mail.html">mailing lists</a></li>
-  <li>other papers mentioned in our <a
-    href="intro.html#applied">introduction</a></li>
-</ul>
-
-<p>The only formal design documents are a few papers in the last category
-above. All the other categories, however, have things to say about design as
-well.</p>
-
-<h2><a name="interact">Will FreeS/WAN work in my environment?</a></h2>
-
-<h3><a name="interop.faq">Can FreeS/WAN talk to ...?</a></h3>
-
-<p>The IPsec protocols are designed to support interoperation. In theory, any
-two IPsec implementations should be able to talk to each other. In practice,
-it is considerably more complex. We have a whole <a
-href="interop.html">interoperation document</a> devoted to this problem.</p>
-
-<p>An important part of that document is links to the many <a
-href="interop.html#otherpub">user-written HowTos</a> on interoperation
-between FreeS/WAN and various other implementations. Often the users know
-more than the developers about these issues (and almost always more than me
-:-), so these documents may be your best resource.</p>
-
-<h3><a name="old_to_new">Can different FreeS/WAN versions talk to each
-other?</a></h3>
-
-<p>Linux FreeS/WAN can interoperate with many IPsec implementations,
-including earlier versions of Linux FreeS/WAN itself.</p>
-
-<p>In a few cases, there are some complications. See our <a
-href="interop.html#oldswan">interoperation</a> document for details.</p>
-
-<h3><a name="faq.bandwidth">Is there a limit on throughput?</a></h3>
-
-<p>There is no hard limit, but see below.</p>
-
-<h3><a name="faq.number">Is there a limit on number of tunnels?</a></h3>
-
-<p>There is no hard limit, but see next question.</p>
-
-<h3><a name="faq.speed">Is a ... fast enough to handle FreeS/WAN with my
-loads?</a></h3>
-
-<p>A quick summary:</p>
-<dl>
-  <dt>Even a limited machine can be useful</dt>
-    <dd>A 486 can handle a T1, ADSL or cable link, though the machine may be
-      breathing hard.</dd>
-  <dt>A mid-range PC (say 800 MHz with good network cards) can do a lot of
-  IPsec</dt>
-    <dd>With up to roughly 50 tunnels and aggregate bandwidth of 20 Megabits
-      per second, it willl have cycles left over for other tasks.</dd>
-  <dt>There are limits</dt>
-    <dd>Even a high end CPU will not come close to handling a fully loaded
-      100 Mbit/second Ethernet link.
-      <p>Beyond about 50 tunnels it needs careful management.</p>
-    </dd>
-</dl>
-
-<p>See our <a href="performance.html">FreeS/WAN performance</a> document for
-details.</p>
-
-<h2><a name="work_on">Will FreeS/WAN work on ... ?</a></h2>
-
-<h3><a name="versions">Will FreeS/WAN run on my version of Linux?</a></h3>
-
-<p>We build and test on Redhat distributions, but FreeS/WAN runs just fine on
-several other distributions, sometimes with minor fiddles to adapt to the
-local environment. Details are in our <a
-href="compat.html#otherdist">compatibility</a> document. Also, some
-distributions or products come with <a href="intro.html#products">FreeS/WAN
-included</a>.</p>
-
-<h3><a name="nonIntel.faq">Will FreeS/WAN run on non-Intel CPUs?</a></h3>
-
-<p>FreeS/WAN is <strong>intended to run on all CPUs Linux supports</strong>.
-We know of it being used in production on x86, ARM, Alpha and MIPS. It has
-also had successful tests on PPC and SPARC, though we don't know of actual
-use there. Details are in our <a href="compat.html#CPUs">compatibility</a>
-document.</p>
-
-<h3><a name="multi.faq">Will FreeS/WAN run on multiprocessors?</a></h3>
-
-<p>FreeS/WAN is designed to work on any SMP architecture Linux supports, and
-has been tested successfully on at least dual processor Intel architecture
-machines. Details are in our <a
-href="compat.html#multiprocessor">compatibility</a> document.</p>
-
-<h3><a name="k.old">Will FreeS/WAN work on an older kernel?</a></h3>
-
-<p>It might, but we strongly recommend using a recent 2.2 or 2.4 series
-kernel. Sometimes the newer versions include security fixes which can be
-quite important on a gateway.</p>
-
-<p>Also, we use recent kernels for development and testing, so those are
-better tested and, if you do encounter a problem, more easily supported. If
-something breaks applying recent FreeS/WAN patches to an older kernel, then
-"update your kernel" is almost certain to be the first thing we suggest. It
-may be the only suggestion we have.</p>
-
-<p>The precise kernel versions supported by a particular FreeS/WAN release
-are given in the <a href="XX">README</a> file of that release.</p>
-
-<p>See the following question for more on kernels.</p>
-
-<h3><a name="k.versions">Will FreeS/WAN run on the latest kernel
-version?</a></h3>
-
-<p>Sometimes yes, but quite often, no.</p>
-
-<p>Kernel versions supported are given in the <a href="../README">README</a>
-file of each FreeS/WAN release. Typically, they are whatever production
-kernels were current at the time of our release (or shortly before; we might
-release for kernel <var>n</var> just as Linus releases <var>n+1</var>). Often
-FreeS/WAN will work on slightly later kernels as well, but of course this
-cannot be guaranteed.</p>
-
-<p>For example, FreeS/WAN 1.91 was released for kernels 2.2.19 or 2.4.5, the
-current kernels at the time. It also worked on 2.4.6, 2.4.7 and 2.4.8, but
-2.4.9 had changes that caused compilation errors if it was patched with
-FreeS/WAN 1.91.</p>
-
-<p>When such changes appear, we put a fix in the FreeS/WAN snapshots, and
-distribute it with our next release. However, this is not a high priority for
-us, and it may take anything from a few days to several weeks for such a
-problem to find its way to the top of our kernel programmer's To-Do list. In
-the meanwhile, you have two choices:</p>
-<ul>
-  <li>either stick with a slightly older kernel, even if it is not the latest
-    and greatest. This is recommended for production systems; new versions
-    may have new bugs.</li>
-  <li>or fix the problem yourself and send us a patch, via the <a
-    href="mail.html">Users mailing list</a>.</li>
-</ul>
-
-<p>We don't even try to keep up with kernel changes outside the main 2.2 and
-2.4 branches, such as the 2.4.x-ac patched versions from Alan Cox or the 2.5
-series of development kernels. We'd rather work on developing the FreeS/WAN
-code than on chasing these moving targets. We are, however, happy to get
-patches for problems discovered there.</p>
-
-<p>See also the <a href="install.html#choosek">Choosing a kernel</a> section
-of our installation document.</p>
-
-<h3><a name="interface.faq">Will FreeS/WAN work on unusual network
-hardware?</a></h3>
-
-<p>IPsec is designed to work over any network that IP works over, and
-FreeS/WAN is intended to work over any network interface hardware that Linux
-supports.</p>
-
-<p>If you have working IP on some unusual interface -- perhaps Arcnet, Token
-Ring, ATM or Gigabit Ethernet -- then IPsec should "just work".</p>
-
-<p>That said, practice is sometimes less tractable than theory. Our testing
-is done almost entirely on:</p>
-<ul>
-  <li>10 or 100 Mbit Ethernet</li>
-  <li>ADSL or cable connections, with and without PPPoE</li>
-  <li>IEEE 802.11 wireless LANs (see <a href="#wireless.faq">below</a>)</li>
-</ul>
-
-<p>If you have some other interface, especially an uncommon one, it is
-entirely possible you will get bitten either by a FreeS/WAN bug which our
-testing did not turn up, or by a bug in the driver that shows up only with
-our loads.</p>
-
-<p>If IP works on your interface and FreeS/WAN doesn't, seek help on the <a
-href="mail.html">mailing lists</a>.</p>
-
-<p>Another FAQ section describes <a href="#pmtu.broken">MTU problems</a>.
-These are a possibility for some interfaces.</p>
-
-<h3><a name="vlan">Will FreeS/WAN work on a VLAN (802.1q) network?</a></h3>
-
-<p>
-   Yes, FreeSwan works fine, though some network drivers have problems
-   with jumbo sized ethernet frames. If you used interfaces=%defaultroute
-   you do not need to change anything, but if you specified an interface
-   (eg eth0) then remember you must change that to reflect the VLAN
-   interface (eg eth0.2 for VLAN ID 2).
-</p>
-<p>
-   The "eepro100" module is known to be broken, use the e100 driver
-   for those cards instead (included in 2.4 as 'alternative driver' for
-   the Intel EtherExpressPro/100.
-</p>
-<p>
-   You do not need to change any MTU setting (those are workarounds
-   that are only needed for buggy drivers)
-</p>
-
-<p><em>This FAQ contributed by Paul Wouters.</em></p>
-
-<h2><a name="features.faq">Does FreeS/WAN support ...</a></h2>
-
-<p>For a discussion of which parts of the IPsec specifications FreeS/WAN does
-and does not implement, see our <a href="compat.html#spec">compatibility</a>
-document.</p>
-
-<p>For information on some often-requested features, see below.</p>
-
-<h3><a name="VPN.faq"></a>Does FreeS/WAN support site-to-site VPN
-(<A HREF="glossary.html#VPN">Virtual Private Network</A>)
-applications?</h3>
-
-<p>Absolutely. See this FreeS/WAN-FreeS/WAN 
-<A HREF="config.html">configuration example</A>. 
-If only one site is using FreeS/WAN, there may be a relevant HOWTO on our 
-<A HREF="interop.html">interop page</A>.
-</p>
-
-<h3><a name="warrior.faq">Does FreeS/WAN support remote users connecting to a
-LAN?</a></h3>
-
-<p>Yes. We call the remote users "Road Warriors". Check out our 
-FreeS/WAN-FreeS/WAN
-<A HREF="config.html#config.rw">Road Warrior Configuration Example</A>.</P>
-
-<p>If your Road Warrior is a Windows or Mac PC, you may need to 
-install an IPsec implementation on that machine. 
-Our <A HREF="interop.html">interop</A> page lists many available brands, 
-and features links to several HOWTOs.
-
-
-<h3><a name="road.shared.possible">Does FreeS/WAN support remote users using
-shared secret authentication?</a></h3>
-
-<p><strong>Yes, but</strong> there are severe restrictions, so <strong>we
-strongly recommend using </strong><a
-href="glossary.html#RSA"><strong>RSA</strong></a><strong> keys for
-</strong> <a
-href="glossary.html#authentication"><strong>authentication</strong></a>
-<strong>
-instead</strong>.</p>
-
-<p>See this <a href="#road.PSK">FAQ question</a>.</p>
-
-<h3><a name="wireless.faq">Does FreeS/WAN support wireless networks?</a></h3>
-
-<p>Yes, it is a common practice to use IPsec over wireless networks because
-their built-in encryption, <a href="glossary.html#WEP">WEP</a>, is
-insecure.</p>
-
-<p>There is some <a href="adv_config.html#wireless.config">discussion</a> in
-our advanced configuration document. See also the 
-<A HREF="http://www.wavesec.org">WaveSEC site</A>.</p>
-
-<h3><a name="PKIcert">Does FreeS/WAN support X.509 or other PKI
-certificates?</a></h3>
-
-<P>Vanilla FreeS/WAN does not support X.509, but Andreas Steffen 
-and others have provided a popular, well-supported X.509 patch.</P>
-
-<UL>
-<LI><A HREF="http://www.strongsec.com/freeswan">patch</A>
-</LI>
-<LI><A HREF="http://www.freeswan.ca">Super FreeS/WAN</A> incorporates
-this and other user-contributed patches.
-</LI>
-<LI>
-Kai Martius' <A HREF="http://www.strongsec.com/freeswan/install.htm">X.509 
-Installation and Configuration Guide</A>
-</LI>
-</UL>
-
-<P>
-Linux FreeS/WAN features
-<A HREF="quickstart.html">Opportunistic Encryption</A>, an alternative
-Public Key Infrastructure based on Secure DNS.
-</P>
-
-<h3><a name="Radius">Does FreeS/WAN support user authentication (Radius,
-SecureID, Smart Card...)?</a></h3>
-
-<P>Andreas Steffen's <A HREF="http://www.strongsec.com/freeswan">X.509 patch</A> (v. 1.42+) supports Smart Cards. The patch
-does not ship with vanilla FreeS/WAN, but will be incorporated into 
-<A HREF="http://www.freeswan.ca/">Super FreeS/WAN 
-2.01+</A>. The patch implements the PCKS#15 
-Cryptographic Token Information Format Standard, using the OpenSC smartcard 
-library functions.</P>
-
-<P>Older news:</P>
- 
-<P>A user-supported patch to FreeS/WAN 1.3, for smart card style 
-authentication, is available on
-<A HREF="http://alcatraz.webcriminals.com/~bastiaan/ipsec">Bastiaan's site</A>.
-It supports skeyid and ibutton.
-This patch is not part of Super FreeS/WAN.</p>
-
-<p>For a while progress on this front was impeded by a lack of standard.
-The IETF <a
-href="http://www.ietf.org/html.charters/ipsra-charter.html">working group</a>
-has now nearly completed its recommended solution to the problem; meanwhile 
-several vendors have implemented various things.</p>
-
-<!--
-<p>The <a href="web.html#patch">patches</a> section of our web links document
-has links to some user work on this.</p>
--->
-
-<p>Of course, there are various ways to avoid any requirement for user
-authentication in IPsec. Consider the situation where road warriors build
-IPsec tunnels to your office net and you are considering requiring user
-authentication during tunnel negotiation. Alternatives include:</p>
-<ul>
-  <li>If you can trust the road warrior machines, then set them up so that
-    only authorised users can create tunnels. If your road warriors use
-    laptops, consider the possibility of theft.</li>
-  <li>If the tunnel only provides access to particular servers and you can
-    trust those servers, then set the servers up to require user
-    authentication.</li>
-</ul>
-
-<p>If either of those is trustworthy, it is not clear that you need user
-authentication in IPsec.</p>
-
-
-<h3><a name="NATtraversal">Does FreeS/WAN support NAT traversal?</a></h3>
-
-<p>Vanilla FreeS/WAN does not, but thanks to Mathieu Lafon and
-Arkoon Network Security, there's a patch to support this.</P>
-
-<UL>
-<LI><A HREF="http://open-source.arkoon.net">patch and documentation</A>
-</LI>
-<LI><A HREF="http://www.freeswan.ca">Super FreeS/WAN</A> incorporates
-this and other user-contributed patches.
-</LI>
-</UL>
-
-<P>The NAT traversal patch has some issues with PSKs, so you may wish to 
-authenticate with RSA keys, or X.509 (requires a patch which is also 
-included in Super FreeS/WAN). Doing the latter also has
-advantages when dealing with large numbers of clients who may be behind NAT;
-instead of having to make an individual Roadwarrior connection for each
-virtual IP, you can use the "rightsubnetwithin" parameter to specify a range.
-See
-<A HREF="http://www.strongsec.com/freeswan/install.htm#section_4.4">these
-<VAR>rightsubnetwithin</VAR> instructions</A>.
-</P>
-
-
-<h3><a name="virtID">Does FreeS/WAN support assigning a "virtual identity" to
-a remote system?</a></h3>
-
-<p>Some IPsec implementations allow you to make the source address on packets
-sent by a Road Warrior machine be something other than the address of its
-interface to the Internet. This is sometimes described as assigning a virtual
-identity to that machine.</p>
-
-<p>FreeS/WAN does not directly support this, but it can be done. See this <a
-href="#road.masq">FAQ question</a>.</p>
-
-<h3><a name="noDES.faq">Does FreeS/WAN support single DES encryption?</a></h3>
-
-<p><strong>No</strong>, single DES is not used either at the <a
-href="glossary.html#IKE">IKE</a> level for negotiating connections or at the
-<a href="glossary.html#IPsec">IPsec</a> level for actually building them.</p>
-
-<p>Single DES is <a href="politics.html#desnotsecure">insecure</a>. As we see
-it, it is more important to deliver real security than to comply with a
-standard which has been subverted into allowing use of inadequate methods.
-See this <a href="politics.html#weak">discussion</a>.</p>
-
-<p>If you want to interoperate with an IPsec implementation which offers only
-DES, see our <a href="interop.html#noDES">interoperation</a> document.</p>
-
-<h3><a name="AES.faq">Does FreeS/WAN support AES encryption?</a></h3>
-
-<p><a href="glossary.html#AES">AES</a> is a new US government <a
-href="glossary.html#block">block cipher</a> standard to replace the obsolete
-<a href="glossary.html#DES">DES</a>.</p>
-
-<p>At time of writing (March 2002), the FreeS/WAN distribution does not yet
-support AES but user-written <a href="web.html#patch">patches</a> are
-available to add it. Our kernel programmer is working on integrating those
-patches into the distribution, and there is active discussion of this on the
-design mailimg list.</p>
-
-<h3><a name="other.cipher">Does FreeS/WAN support other encryption
-algorithms?</a></h3>
-
-<p>Currently <a href="glossary.html#3DES">triple DES</a> is the only cipher
-supported. AES will almost certainly be added (see previous question), and it
-is likely that in the process we will also add the other two AES finalists
-with open licensing, Twofish and Serpent.</p>
-
-<p>We are extremely reluctant to add other ciphers. This would make both use
-and maintenance of FreeS/WAN more complex without providing any clear
-benefit. Complexity is emphatically not desirable in a security product.</p>
-
-<p>Various users have written patches to add other ciphers. We provide <a
-href="web.html#patch">links</a> to these.</p>
-
-<h2><a name="canI">Can I ...</a></h2>
-
-
-<h3><a name="policy.preconfig">Can I use policy groups along with
-explicitly configured connections?</a></h3>
-
-<p>Yes, you can, so long as you pay attention to the selection rule, 
-which can be summarized "the most specific 
-connection wins". We describe the rule in our
-<A HREF="policygroups.html#policy.group.notes">policy groups</A> document,
-and provide a more technical explanation in 
-<A HREF="manpage.d/ipsec.conf.5.html">man ipsec.conf</A>.
-</p>
-
-<p>A good guideline: If you have a regular connection defined in 
-<VAR>ipsec.conf</VAR>, ensure that a subset of that connection
-is not listed in a less restrictive policy group. Otherwise, 
-FreeS/WAN will use the subset, with its more specific source/destination 
-pair.</p>
-
-<p>Here's an example. Suppose you are the system administrator at 192.0.2.2.
-You have this connection in ipsec.conf:
-<VAR>ipsec.conf</VAR>:
-
-<PRE>conn net-to-net
-    left=192.0.2.2           # you are here
-    right=192.0.2.8
-    rightsubnet=192.0.2.96/27
-    ....
-</PRE>
-
-<p>If you then place a host or net within <VAR>rightsubnet</VAR>, 
-(let's say 192.0.2.98) in <VAR>private-or-clear</VAR>, you may find 
-that 192.0.2.2 at times communicates in the
-clear with 192.0.2.98. That's consistent with the rule, but may be 
-contrary to your expectations.</p>
-
-<p>On the other hand, it's safe to put a larger subnet in a less
-restrictive policy group file. If <VAR>private-or-clear</VAR>
-contains 192.0.2.0/24, then the more specific <VAR>net-to-net</VAR>
-connection is used for any communication to 192.0.2.96/27. The
-more general policy applies only to communication with hosts or subnets in 
-192.0.2.0/24 without a more specific policy or connection.</p>
-
-
-<h3><a name="policy.off">Can I turn off policy groups?</a></h3>
-
-<p>Yes. Use <A HREF="policygroups.html#disable_policygroups">these
-instructions</A>.</p>
-
-<!--
-<h3><a name="policy.otherinterface">Can I use policy groups
- on an interface other than <VAR>%defaultroute</VAR>?</a></h3>
-
-<p>??<p>
--->
-
-<h3><a name="reload">Can I reload connection info without restarting?</a></h3>
-
-<p>Yes, you can do this. Here are the details, in a mailing list message from
-Pluto programmer Hugh Redelmeier:</p>
-<pre>| How can I reload config's without restarting all of pluto and klips?  I am using
-| FreeSWAN -&gt; PGPNet in a medium sized production environment, and would like to be
-| able to add new connections ( i am using include config/* ) without dropping current
-| SA's.
-| 
-| Can this be done?
-| 
-| If not, are there plans to add this kind of feature?
-
-        ipsec auto --add whatever
-This will look in the usual place (/etc/ipsec.conf) for a conn named
-whatever and add it.
-
-If you added new secrets, you need to do
-        ipsec auto --rereadsecrets
-before Pluto needs to know those secrets.
-
-| I have looked (perhaps not thoroughly enough tho) to see how to do this:
-
-There may be more bits to look for, depending on what you are trying
-to do.</pre>
-
-<p>Another useful command here is <var>ipsec auto --replace
-&lt;conn_name&gt;</var> which re-reads data for a named connection.</p>
-
-<h3><a name="masq.faq">Can I use several masqueraded subnets?</a></h3>
-
-<p>Yes. This is done all the time. See the discussion in our <a
-href="config.html#route_or_not">setup</a> document. The only restriction is
-that the subnets on the two ends must not overlap. See the next question.</p>
-
-<p>Here is a mailing list message on the topic. The user incorrectly thinks
-you need a 2.4 kernel for this -- actually various people have been doing it
-on 2.0 and 2.2 for quite some time -- but he has it right for 2.4.</p>
-<pre>Subject: Double NAT and freeswan working :)
-   Date: Sun, 11 Mar 2001
-   From: Paul Wouters &lt;paul@xtdnet.nl&gt;
-
-Just to share my pleasure, and make an entry for people who are searching
-the net on how to do this. Here's the very simple solution to have a double
-NAT'ed network working with freeswan. (Not sure if this is old news, but I'm
-not on the list (too much spam) and I didn't read this in any HOWTO/FAQ/doc
-on the freeswan site yet (Sandy, put it in! :)
-
-10.0.0.0/24 --- 10.0.0.1 a.b.c.d  ---- a.b.c.e {internet} ----+
-                                                              |
-10.0.1.0/24 --- 10.0.1.1 f.g.h.i  ---- f.g.h.j {internet} ----+
-
-the goal is to have the first network do a VPN to the second one, yet also
-have NAT in place for connections not destinated for the other side of the
-NAT. Here the two Linux security gateways have one real IP number (cable
-modem, dialup, whatever.
-
-The problem with NAT is you don't want packets from 10.*.*.* to 10.*.*.*
-to be NAT'ed. While with Linux 2.2, you can't, with Linux 2.4 you can.
-
-(This has been tested and works for 2.4.2 with Freeswan snapshot2001mar8b)
-
-relevant parts of /etc/ipsec.conf:
-
-        left=f.g.h.i
-        leftsubnet=10.0.1.0/24
-        leftnexthop=f.g.h.j
-        leftfirewall=yes
-        leftid=@firewall.netone.nl
-        leftrsasigkey=0x0........
-        right=a.b.c.d
-        rightsubnet=10.0.0.0/24
-        rightnexthop=a.b.c.e
-        rightfirewall=yes
-        rightid=@firewall.nettwo.nl
-        rightrsasigkey=0x0......
-        # To authorize this connection, but not actually start it, at startup,
-        # uncomment this.
-        auto=add
-
-and now the real trick. Setup the NAT correctly on both sites:
-
-iptables -t nat -F
-iptables -t nat -A POSTROUTING -o eth0 -d \! 10.0.0.0/8 -j MASQUERADE
-
-This tells the NAT code to only do NAT for packets with destination other then
-10.* networks. note the backslash to mask the exclamation mark to protect it
-against the shell.
-
-Happy painting :)
-
-Paul</pre>
-
-<h3><a name="dup_route">Can I use subnets masqueraded to the same
-addresses?</a></h3>
-
-<p><strong>No.</strong> The notion that IP addresses are unique is one of the
-fundamental principles of the IP protocol. Messing with it is exceedingly
-perilous.</p>
-
-<p>Fairly often a situation comes up where a company has several branches,
-all using the same <a href="glossary.html#non-routable">non-routable
-addresses</a>, perhaps 192.168.0.0/24. This works fine as long as those nets
-are kept distinct. The <a href="glossary.html#masq">IP masquerading</a> on
-their firewalls ensures that packets reaching the Internet carry the firewall
-address, not the private address.</p>
-
-<p>This can break down when IPsec enters the picture. FreeS/WAN builds a
-tunnel that pokes through both masquerades and delivers packets from
-<var>leftsubnet</var> to <var>rightsubnet</var> and vice versa. For this to
-work, the two subnets <em>must</em> be distinct.</p>
-
-<p>There are several solutions to this problem.</p>
-
-<p>Usually, you <strong>re-number the subnets</strong>. Perhaps the Vancouver
-office becomes 192.168.101.0/24, Calgary 192.168.102.0/24 and so on.
-FreeS/WAN can happily handle this. With, for example
-<var>leftsubnet=192.168.101.0/24</var> and
-<var>rightsubnet=192.168.102.0/24</var> in a connection description, any
-machine in Calgary can talk to any machine in Vancouver. If you want to be
-more restrictive and use something like
-<var>leftsubnet=192.168.101.128/25</var> and
-<var>rightsubnet=192.168.102.240/28</var> so only certain machines on each
-end have access to the tunnel, that's fine too.</p>
-
-<p>You could also <strong>split the subnet</strong> into smaller ones, for
-example using <var>192.168.1.0/25</var> in Vancouver and
-<var>rightsubnet=192.168.0.128/25</var> in Calgary.</p>
-
-<p>Alternately, you can just <strong>give up routing</strong> directly to
-machines on the subnets. Omit the <var>leftsubnet</var> and
-<var>rightsubnet</var> parameters from your connection descriptions. Your
-IPsec tunnels will then run between the public interfaces of the two
-firewalls. Packets will be masqueraded both before they are put into tunnels
-and after they emerge. Your Vancouver client machines will see only one
-Calgary machine, the firewall.</p>
-
-<h3><a name="road.masq">Can I assign a road warrior an address on my net (a
-virtual identity)?</a></h3>
-
-<p>Often it would be convenient to be able to give a Road Warrior an IP
-address which appears to be on the local network. Some IPsec implementations
-have support for this, sometimes calling the feature "virtual identity".</p>
-
-<p>Currently (Sept 2002) FreeS/WAN does not support this, and we have
-no definite plans to add it. The difficulty is that is not yet a standard
-mechanism for it. There is an Internet Draft for a method of doing it using
-<a href="#DHCP">DHCP</a> which looks promising. FreeS/WAN may support that in
-a future release.</p>
-
-<p>In the meanwhile, you can do it yourself using the Linux iproute2(8)
-facilities. Details are in <a
-href="http://www.av8n.com/vpn/iproute2.htm">this
-paper</a>.</p>
-
-<p>Another method has also been discussed on the mailing list.:</p>
-<ul>
-  <li>You can use a variant of the <a
-    href="adv_config.html#extruded.config">extruded subnet</a> procedure.</li>
-  <li>You have to avoid having the road warrior's assigned address within the
-    range you actually use at home base. See previous question.</li>
-  <li>On the other hand, you want the roadwarrior's address to be within the
-    range that <em>seems</em> to be on your network.</li>
-</ul>
-
-<p>For example, you might have:</p>
-<dl>
-  <dt>leftsubnet=a.b.c.0/25</dt>
-    <dd>head office network</dd>
-  <dt>rightsubnet=a.b.c.129/32</dt>
-    <dd>extruded to a road warrior. Note that this is not in a.b.c.0/25</dd>
-  <dt>a.b.c.0/24</dt>
-    <dd>whole network, including both the above</dd>
-</dl>
-
-<p>You then set up routing so that the office machines use the IPsec gateway
-as their route to a.b.c.128/25. The leftsubnet parameter tells the road
-warriors to use tunnels to reach a.b.c.0/25, so you should have two-way
-communication. Depending or your network and applications, there may be some
-additional work to do on DNS or Windows configuration</p>
-
-<h3><a name="road.many">Can I support many road warriors with one
-gateway?</a></h3>
-
-<p>Yes. This is easily done, using</p>
-<dl>
-  <dt>either RSA authentication</dt>
-    <dd>standard in the FreeS/WAN distribution</dd>
-  <dt>or X.509 certificates</dt>
-    <dd>requires <a href="#PKIcert">Super FreeS/WAN or a patch</a>.</dd>
-</dl>
-
-<p>In either case, each Road Warrior must have a different key or
-certificate.</p>
-
-<p>It is also possible using pre-shared key authentication,
-though we don't recommend this; see the
-<a href="#road.PSK">next question</a> for details.</p>
-
-<p>If you expect to have more than a few dozen Road Warriors connecting
-simultaneously, you may need a fairly powerful gateway machine. See our
-document on <a href="performance.html">FreeS/WAN performance</a>.</p>
-
-<h3><a name="road.PSK">Can I have many road warriors using shared secret
-authentication?</a></h3>
-
-<p><STRONG>Yes, but avoid it if possible</STRONG>.</p>
-
-<p>You can have multiple Road Warriors using shared secret authentication
-<strong>only if they all use the same secret</strong>. You must also 
-set:<p>
-
-<PRE>   uniqueids=no   </PRE>
-
-<p>in the connection definition.</p>
-
-
-<p>Why it's less secure:</p>
-<ul>
-  <li>If you have many users, it becomes almost certain the secret will
-  leak</li>
-  <li>The secret becomes quite valuable to an attacker</li>
-  <li>All users authenticate the same way, so the gateway cannot tell them
-    apart for logging or access control purposes</li>
-  <li>Changing the secret is difficult. You have to securely notify all
-  users.</li>
-  <li>If you find out the secret has been compromised, you can change it, but
-    then what? None of your users can connect without the new secret. How
-    will you notify them all, quickly and securely, without using the
-  VPN?</li>
-</ul>
-
-<p>This is a designed-in limitation of the <a
-href="glossary.html#IKE">IKE</a> key negotiation protocol, not a problem with
-our implementation.</p>
-
-<p><strong>We very strongly recommend that you avoid using shared secret
-authentication for multiple Road Warriors.</strong> Use RSA authentication
-instead.</p>
-
-<p>The longer story: When using shared secrets, the protocol requires 
-that the responding
-gateway be able to determine which secret to use at a time when all it knows
-about the initiator is an IP address. This works fine if you know the
-initiator's address in advance and can use it to look up the appropiriate
-secret. However, it fails for Road Warriors since the gateway cannot know
-their IP addresses in advance.</p>
-
-<p>With RSA signatures (or certificates) the protocol is slightly different.
-The initiator provides an identifier early in the exchange and the responder
-can use that identifier to look up the correct key or certificate. See <a
-href="#road.many">above</a>.</p>
-
-<h3><a name="QoS">Can I use Quality of Service routing with
-FreeS/WAN?</a></h3>
-
-<p>From project technical lead Henry Spencer:</p>
-<pre>&gt; Do QoS add to FreeS/WAN?
-&gt; For example integrating DiffServ and FreeS/WAN?
-
-With a current version of FreeS/WAN, you will have to add hidetos=no to
-the config-setup section of your configuration file.  By default, the TOS
-field of tunnel packets is zeroed; with hidetos=no, it is copied from the
-packet inside.  (This is a modest security hole, which is why it is no
-longer the default.)
-
-DiffServ does not interact well with tunneling in general.  Ways of
-improving this are being studied.</pre>
-
-<p>Copying the <a href="glossary.html#TOS">TOS</a> (type of service)
-information from the encapsulated packet to the outer header reveals the TOS
-information to an eavesdropper. This does not tell him much, but it might be
-of use in <a href="glossary.html#traffic">traffic analysis</a>. Since we do
-not have to give it to him, our default is not to.</p>
-
-<P>Even with the TOS hidden, you can still:</P>
-<UL>
-<LI>apply QOS rules to the tunneled (ESP) packets; for example, by
-giving ESP packets a certain priority.</LI>
-<LI>apply QOS rules to the packets as they enter or exit the tunnel
-via an IPsec virtual interface (eg. <VAR>ipsec0</VAR>).</LI>
-</UL>
-
-<p>See <a href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> for more on
-the <var>hidetos=</var> parameter.</p>
-
-
-<h3><a name="deadtunnel">Can I recognise dead tunnels and shut them
-down?</a></h3>
-
-<p>There is no general mechanism to do this is in the IPsec protocols.</p>
-
-<p>From time to time, there is discussion on the IETF Working Group <a
-href="mail.html#ietf">mailing list</a> of adding a "keep-alive" mechanism
-(which some say should be called "make-dead"), but it is a fairly complex
-problem and no consensus has been reached on whether or how it should be
-done.</p>
-
-<p>The protocol does have optional <a href="#ignore">delete-SA</a> messages
-which one side can send when it closes a connection in hopes this will cause
-the other side to do the same. FreeS/WAN does not currently support these. In
-any case, they would not solve the problem since:</p>
-<ul>
-  <li>a gateway that crashes or hangs would not send the messages</li>
-  <li>the sender is not required to send them</li>
-  <li>they are not authenticated, so any receiver that trusts them leaves
-    itself open to a <a href="glossary.html#DOS">denial of service</a>
-  attack</li>
-  <li>the receiver is not required to do anything about them</li>
-  <li>the receiver cannot acknowledge them; the protocol provides no
-    mechanism for that</li>
-  <li>since they are not acknowledged, the sender cannot rely on them</li>
-</ul>
-
-<p>However, connections do have limited lifetimes and you can control how
-many attempts your gateway makes to rekey before giving up. For example, you
-can set:</p>
-<pre>conn default
-        keyingtries=3
-        keylife=30m</pre>
-
-<p>With these settings old connections will be cleaned up. Within 30 minutes
-of the other end dying, rekeying will be attempted. If it succeeds, the new
-connection replaces the old one. If it fails, no new connection is created.
-Either way, the old connection is taken down when its lifetime expires.</p>
-
-<p>Here is a mailing list message on the topic from FreeS/WAN tech support
-person Claudia Schmeing:</p>
-<pre>You ask how to determine whether a tunnel is redundant:
-
-&gt; Can anybody explain the best way to determine this. Esp when a RW has
-&gt; disconnected? I thought 'ipsec auto --status' might be one way.
-
-If a tunnel goes down from one end, Linux FreeS/WAN on the
-other end has no way of knowing this until it attempts to rekey.
-Once it tries to rekey and fails, it will 'know' that the tunnel is 
-down.
-
-Because it doesn't have a way of knowing the state until this point, 
-it will also not be able to tell you the state via ipsec auto --status.
-
-&gt; However, comparing output from a working tunnel with that of one that
-&gt; was closed 
-&gt; did not show clearly show tunnel status.
-
-If your tunnel is down but not 'unrouted' (see man ipsec_auto), you
-should not be able to ping the opposite side of the tunnel. You can
-use this as an indicator of tunnel status.
-
-On a related note, you may be interested to know that as of 1.7, 
-redundant tunnels caused by RW disconnections are likely to be 
-less of a pain. From doc/CHANGES:
-
-    There is a new configuration parameter, uniqueids, to control a new Pluto
-    option:  when a new connection is negotiated with the same ID as an old
-    one, the old one is deleted immediately.  This should help eliminate
-    dangling Road Warrior connections when the same Road Warrior reconnects. 
-    It thus requires that IDs not be shared by hosts (a previously legal but
-    probably useless capability).  NOTE WELL:  the sample ipsec.conf now has
-    uniqueids=yes in its config-setup section.
-
-
-Cheers,
-
-Claudia</pre>
-
-<h3><a name="demanddial">Can I build IPsec tunnels over a demand-dialed
-link?</a></h3>
-
-<p>This is possible, but not easy. FreeS/WAN technical lead Henry Spencer
-wrote:</p>
-<pre>&gt; 5. If the ISDN link goes down in between and is reestablished, the SAs
-&gt; are still up but the eroute are deleted and the IPsec interface shows
-&gt; garbage (with ifconfig)
-&gt; 6. Only restarting IPsec will bring the VPN back online.
-
-This one is awkward to solve.  If the real interface that the IPsec
-interface is mounted on goes down, it takes most of the IPsec machinery
-down with it, and a restart is the only good way to recover. 
-
-The only really clean fix, right now, is to split the machines in two: 
-
-1. A minimal machine serves as the network router, and only it is aware
-that the link goes up and down. 
-
-2. The IPsec is done on a separate gateway machine, which thinks it has
-a permanent network connection, via the router.
-
-This is clumsy but it does work.  Trying to do both functions within a
-single machine is tricky.  There is a software package (diald) which will
-give the illusion of a permanent connection for demand-dialed modem
-connections; I don't know whether it's usable for ISDN, or whether it can
-be made to cooperate properly with FreeS/WAN. 
-
-Doing a restart each time the interface comes up *does* work, although it
-is a bit painful.  I did that with PPP when I was running on a modem link;
-it wasn't hard to arrange the PPP scripts to bring IPsec up and down at
-the right times.  (I'd meant to investigate diald but never found time.)
-
-In principle you don't need to do a complete restart on reconnect, but you
-do have to rebuild some things, and we have no nice clean way of doing
-only the necessary parts.</pre>
-
-<p>In the same thread, one user commented:</p>
-<pre>Subject: Re: linux-ipsec: IPsec and Dial Up Connections
-   Date: Wed, 22 Nov 2000
-   From: Andy Bradford &lt;andyb@calderasystems.com&gt;
-
-On Wed, 22 Nov 2000 19:47:11 +0100, Philip Reetz wrote:
-
-&gt; Are there any ideas what might be the cause of the problem and any way
-&gt; to work around it.
-&gt; Any help is highly appreciated.
-
-On my laptop, when using ppp there is a ip-up script in /etc/ppp that 
-will be executed each time that the ppp interface is brought up.  
-Likewise there is an ip-down script that is called when it is taken 
-down.  You might consider custimzing those to stop and start FreeS/WAN 
-with each connection.  I believe that ISDN uses the same files, though 
-I could be wrong---there should be something similar though.</pre>
-
-<h3><a name="GRE">Can I build GRE, L2TP or PPTP tunnels over IPsec?</a></h3>
-
-<p>Yes. Normally this is not necessary, but it is useful in a few special
-cases. For example, if you must route non-IP packets such as IPX, you
-will need to use a tunneling protocol that can route these packets. IPsec
-can be layered around it for extra security. Another example: you 
-can provide failover protection for high availability (HA) environments by
-combining IPsec with other tools. Ken Bantoft describes one such setup in 
-<A HREF="http://www.freeswan.ca/docs/HA">Using FreeS/WAN with Linux-HA, GRE, 
-OSPF and BGP for enterprise grade VPN solutions</A>.</P>
-
-<p>GRE over IPsec is covered as part of 
-<A HREF="http://www.freeswan.ca/docs/HA">that document</A>. 
-<a href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/07/msg00209.html">
-Here are links</a> to other GRE resources.
-
-Jacco de Leuw has created
-<A HREF="http://www.jacco2.dds.nl/networking/">this page on L2TP over IPsec</A> 
-with instructions for FreeS/WAN and several other brands of IPsec software.
-</P>
-
-<P>Please let us know of other useful links via the
-<A HREF="mail.html">mailing lists</A>.
-
-
-<h3><a name="NetBIOS">... use Network Neighborhood (Samba, NetBIOS) over IPsec?</a></h3>
-
-<p>Your local PC needs to know how to translate NetBIOS names to IP addresses.
-It may do this either via a local LMHOSTS file, or using a local or remote
-WINS server. The WINS server is preferable since it provides a centralized
-source of the information to the entire network. To use a WINS server over 
-the <A HREF="glossary.html#VPN">VPN</A>
-(or any IP-based network), you must enable "NetBIOS over TCP".</p>
-
-<p><A HREF="http://www.samba.org">Samba</A> can emulate a WINS server
-on Linux.</p>
-
-<p>
-See also several discussions in our 
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-September/thread.html">September 
-2002 Users archives</A></p>
-
-
-<h2><a name="setup.faq">Life's little mysteries</a></h2>
-
-<p>FreeS/WAN is a fairly complex product. (Neither the networks it runs on
-nor the protocols it uses are simple, so it could hardly be otherwise.) It
-therefore sometimes exhibits behaviour which can be somewhat confusing, or
-has problems which are not easy to diagnose. This section tries to explain
-those problems.</p>
-
-<p>Setup and configuration of FreeS/WAN are covered in other documentation
-sections:</p>
-<ul>
-  <li><a href="quickstart.html">basic setup and configuration</a></li>
-  <li><a href="adv_config.html">advanced configuration</a></li>
-  <li><a href="trouble.html">Troubleshooting</a></li>
-</ul>
-
-<p>However, we also list some of the commonest problems here.</p>
-
-<h3><a name="cantping">I cannot ping ....</a></h3>
-
-<p>This question is dealt with in the advanced configuration section under
-the heading <a href="adv_config.html#multitunnel">multiple tunnels</a>.</p>
-
-<p>The standard subnet-to-subnet tunnel protects traffic <strong>only between
-the subnets</strong>. To test it, you must use pings that go from one subnet
-to the other.</p>
-
-<p>For example, suppose you have:</p>
-<pre>      subnet a.b.c.0/24
-             |
-      eth1 = a.b.c.1
-         gate1
-      eth0 = 192.0.2.8
-             |
-
-       ~ internet ~
-
-             |
-      eth0 = 192.0.2.11
-         gate2
-      eth1 = x.y.z.1
-              |
-       subnet x.y.z.0/24</pre>
-
-<p>and the connection description:</p>
-<pre>conn abc-xyz
-     left=192.0.2.8
-     leftsubnet=a.b.c.0/24
-     right=192.0.2.11
-     rightsubnet=x.y.z.0/24</pre>
-
-<p>You can test this connection description only by sending a ping that will
-actually go through the tunnel. Assuming you have machines at addresses
-a.b.c.2 and x.y.z.2, pings you might consider trying are:</p>
-<dl>
-  <dt>ping from x.y.z.2 to a.b.c.2 or vice versa</dt>
-    <dd>Succeeds if tunnel is working. This is the <strong>only valid test of
-      the tunnel</strong>.</dd>
-  <dt>ping from gate2 to a.b.c.2 or vice versa</dt>
-    <dd><strong>Does not use tunnel</strong>. gate2 is not on protected
-      subnet.</dd>
-  <dt>ping from gate1 to x.y.z.2 or vice versa</dt>
-    <dd><strong>Does not use tunnel</strong>. gate1 is not on protected
-      subnet.</dd>
-  <dt>ping from gate1 to gate2 or vice versa</dt>
-    <dd><strong>Does not use tunnel</strong>. Neither gate is on a protected
-      subnet.</dd>
-</dl>
-
-<p>Only the first of these is a useful test of this tunnel. The others do not
-use the tunnel. Depending on other details of your setup and routing,
-they:</p>
-<ul>
-  <li>either fail, telling you nothing about the tunnel</li>
-  <li>or succeed, telling you nothing about the tunnel since these packets
-    use some other route</li>
-</ul>
-
-<p>In some cases, you may be able to get around this. For the example network
-above, you could use:</p>
-<pre>        ping -I a.b.c.1 x.y.z.1</pre>
-
-<p>Both the adresses given are within protected subnets, so this should go
-through the tunnel.</p>
-
-<p>If required, you can build additional tunnels so that all the machines
-involved can talk to all the others. See <a
-href="adv_config.html#multitunnel">multiple tunnels</a> in the advanced
-configuration document for details.</p>
-
-<h3><a name="forever">It takes forever to ...</a></h3>
-
-<p>Users fairly often report various problems involving long delays,
-sometimes on tunnel setup and sometimes on operations done through the
-tunnel, occasionally on simple things like ping or more often on more complex
-operations like doing NFS or Samba through the tunnel.</p>
-
-<p>Almost always, these turn out to involve failure of a DNS lookup. The
-timeouts waiting for DNS are typically set long so that you won't time out
-when a query involves multiple lookups or long paths. Genuine failures
-therefore produce long delays before they are detected.</p>
-
-<p>A mailing list message from project technical lead Henry Spencer:</p>
-<pre>&gt; ... when i run /etc/rc.d/init.d/ipsec start, i get:
-&gt; ipsec_setup: Starting FreeS/WAN IPsec 1.5...
-&gt; and it just sits there, doesn't give back my bash prompt.
-
-Almost certainly, the problem is that you're using DNS names in your
-ipsec.conf, but DNS lookups are not working for some reason.  You will
-get your prompt back... eventually.  But the DNS timeouts are long.
-Doing something about this is on our list, but it is not easy.</pre>
-
-<p>In the meanwhile, we recommend that connection descriptions in <a
-href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> use numeric IP addresses
-rather than names which will require a DNS lookup.</p>
-
-<p>Names that do not require a lookup are fine. For example:</p>
-<ul>
-  <li>a road warrior might use the identity
-    <var>rightid=@lancelot.example.org</var></li>
-  <li>the gateway might use <var>leftid=@camelot.example.org</var></li>
-</ul>
-
-<p>These are fine. The @ sign prevents any DNS lookup. However, do not
-attempt to give the gateway address as <var>left=camelot.example.org</var>.
-That requires a lookup.</p>
-
-<p>A post from one user after solving a problem with long delays:</p>
-<pre>Subject: Final Answer to Delay!!!
-   Date: Mon, 19 Feb 2001
-   From: "Felippe Solutions" &lt;felippe@solutionstecnologia.com.br&gt;
-
-Sorry people, but seems like the Delay problem had nothing to do with
-freeswan.
-
-The problem was DNS as some people sad from the beginning, but not the way
-they thought it was happening. Samba, ssh, telnet and other apps try to
-reverse lookup addresses when you use IP numbers (Stupid that ahh).
-
-I could ping very fast because I always ping with "-n" option, but I don't
-know the option on the other apps to stop reverse addressing so I don't use
-it.</pre>
-
-<p>This post is fairly typical. These problems are often tricky and
-frustrating to diagnose, and most turn out to be DNS-related.</p>
-
-<p>One suggestion for diagnosis: test with both names and addresses if
-possible. For example, try all of:</p>
-<ul>
-  <li>ping <var>address</var></li>
-  <li>ping -n <var>address</var></li>
-  <li>ping <var>name</var></li>
-</ul>
-
-<p>If these behave differently, the problem must be DNS-related since the
-three commands do exactly the same thing except for DNS lookups.</p>
-
-<h3><a name="route">I send packets to the tunnel with route(8) but they
-vanish</a></h3>
-
-<p>IPsec connections are designed to carry only packets travelling between
-pre-defined connection endpoints. As project technical lead Henry Spencer put
-it:</p>
-
-<blockquote>
-  IPsec tunnels are not just virtual wires; they are virtual wires with
-  built-in access controls.  Negotiation of an IPsec tunnel includes
-  negotiation of access rights for it, which don't include packets to/from
-  other IP addresses.  (The protocols themselves are quite inflexible about
-  this, so there are limits to what we can do about it.)</blockquote>
-
-<p>For fairly obvious security reasons, and to comply with the IPsec RFCs, <a
-href="glossary.html#KLIPS">KLIPS</a> drops any packets it receives that are
-not allowed on the tunnels currently defined. So if you send it packets with
-<var>route(8)</var>, and suitable tunnels are not defined, the packets
-vanish. Whether this is reported in the logs depends on the setting of
-<var>klipsdebug</var> in your <a
-href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> file.</p>
-
-<p>To rescue vanishing packets, you must ensure that suitable tunnels for
-them exist, by editing the connection descriptions in <a
-href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a>. For example, supposing
-you have a simple setup:</p>
-<pre>         leftsubnet -- leftgateway === internet === roadwarrior</pre>
-
-<p>If you want to give the roadwarrior access to some resource that is
-located behind the left gateway but is not in the currently defined left
-subnet, then the usual procedure is to define an additional tunnel for those
-packets by creating a new connection description.</p>
-
-<p>In some cases, it may be easier to alter an existing connection
-description, enlarging the definition of <var>leftsubnet</var>. For example,
-instead of two connection descriptions with 192.168.8.0/24 and 192.168.9.0/24
-as their <var>leftsubnet</var> parameters, you can use a single description
-with 192.168.8.0/23.</p>
-
-<p>If you have multiple endpoints on each side, you need to ensure that there
-is a route for each pair of endpoints. See this <a
-href="adv_config.html#multitunnel">example</a>.</p>
-
-<h3><a name="down_route">When a tunnel goes down, packets vanish</a></h3>
-
-<p>This is a special case of the vanishing packet problem described in the
-previous question. Whenever KLIPS sees packets for which it does not have a
-tunnel, it drops them.</p>
-
-<p>When a tunnel goes away, either because negotiations with the other
-gateway failed or because you gave an <var>ipsec auto --down</var> command,
-the route to its other end is left pointing into KLIPS, and KLIPS will drop
-packets it has no tunnel for.</p>
-
-<p>This is a documented design decision, not a bug. FreeS/WAN must not
-automatically adjust things to send packets via another route. The other
-route might be insecure.</p>
-
-<p>Of course, re-routing may be necessary in many cases. In those cases, you
-have to do it manually or via scripts. We provide the <var>ipsec auto
---unroute</var> command for these cases.</p>
-
-<p>From <a href="manpage.d/ipsec_auto.8.html">ipsec_auto(8)</a>:</p>
-
-<blockquote>
-  Normally,  pluto  establishes  a  route to the destination specified for a
-  connection as part of the --up  operation. However,  the  route and only
-  the route can be established with the --route operation.  Until and  unless
-  an  actual connection  is established, this discards any packets sent
-  there, which may be preferable to having them  sent elsewhere based  on  a
-  more  general  route (e.g., a default route).</blockquote>
-
-<blockquote>
-  Normally, pluto's route to a destination remains in  place when  a  --down
-  operation  is used to take the connection down (or if connection setup, or
-  later automatic rekeying, fails).   This permits establishing a new
-  connection (perhaps using a different specification; the route is altered
-  as necessary) without having a ``window'' in which packets might go
-  elsewhere based on a more general route.  Such  a route can be removed
-  using the --unroute operation (and is implicitly removed by
---delete).</blockquote>
-
-<p>See also this mailing list <a
-href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00523.html">message</a>.</p>
-
-<h3><a name="firewall_ate">The firewall ate my packets!</a></h3>
-
-<p>If firewalls filter out:</p>
-<ul>
-  <li>either the UDP port 500 packets used in IKE negotiations</li>
-  <li>or the ESP and AH (protocols 50 and 51) packets used to implement the
-    IPsec tunnel</li>
-</ul>
-
-<p>then IPsec cannot work. The first thing to check if packets seem to be
-vanishing is the firewall rules on the two gateway machines and any other
-machines along the path that you have access to.</p>
-
-<p>For details, see our document on <a href="firewall.html">firewalls</a>.</p>
-
-<p>Some advice from technical lead Henry Spencer on diagnosing such
-problems:</p>
-<pre>&gt; &gt; Packets vanishing between the hardware interface and the ipsecN interface
-&gt; &gt; is usually the result of firewalls not being configured to let them in...
-&gt; 
-&gt; Thanks for the suggestion. If only it were that simple! My ipchains startup
-&gt; script does take care of that, but just in case I manually inserted rules 
-&gt; accepting everything from london on dublin. No difference.
-
-The other thing to check is whether the "RX packets dropped" count on the
-ipsecN interface (run "ifconfig ipsecN", for N=1 or whatever, to see the
-counts) is rising.  If so, then there's some sort of configuration mismatch
-between the two ends, and IPsec itself is rejecting them.  If none of the
-ipsecN counts is rising, then the packets are never reaching the IPsec
-machinery, and the problem is almost certainly in firewalls etc.</pre>
-
-<h3><a name="dropconn">Dropped connections</a></h3>
-
-<p>Networks being what they are, IPsec connections can be broken for any
-number of reasons, ranging from hardware failures to various software
-problems such as the path MTU problems discussed <a
-href="#pmtu.broken">elsewhere in the FAQ</a>. Fortunately, various diagnostic
-tools exist that help you sort out many of the possible problems.</p>
-
-<p>There is one situation, however, where FreeS/WAN (using default settings)
-may destroy a connection for no readily apparent reason. This occurs when
-things are <strong>misconfigured</strong> so that <strong>two
-tunnels</strong> from the same gateway expect <strong>the same subnet on the
-far end</strong>.</p>
-
-<p>In this situation, the first tunnel comes up fine and works until the
-second is established. At that point, because of the way we track connections
-internally, the first tunnel ceases to exist as far as this gateway is
-concerned. Of course the far end does not know that, and a storm of error
-messages appears on both systems as it tries to use the tunnel.</p>
-
-<p>If the far end gives up, goes back to square one and negotiates a new
-tunnel, then that wipes out the second tunnel and ...</p>
-
-<p>The solution is simple. <strong>Do not build multiple conn descriptions
-with the same remote subnet</strong>.</p>
-
-<p>This is actually intended to be a feature, rather than a bug. Consider the
-situation where a single remote system goes down, then comes back up and
-reconnects to the gateway. It is useful to have the gateway tear down the old
-tunnel and recover resources when the reconnection is made. It recognises
-that situation by checking the remote subnet for each tunnel it builds and
-discarding duplicates. This works fine as long as you don't configure
-multiple tunnels with the same remote subnet.</p>
-
-<p>If this behaviour is inconvenient for you, you can disable it by setting
-<var>uniqueids=no</var> in <a
-href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a>.</p>
-
-
-<h3><a name="defaultroutegone">Disappearing %defaultroute</a></h3>
-
-<p>When an underlying connection (eg. ppp) goes down, FreeS/WAN will not 
-recover properly without a little help. Here are the symptoms that FreeS/WAN 
-user Michael Carmody noticed:
-<pre>
-&gt; After about 24 hours the freeswan connection takes over the default route.
-&gt; 
-&gt; i.e instead of deafult gateway pointing to the router via eth0, it becomes a 
-&gt; pointer to the router via ipsec0.
- 
-&gt; All internet access is then lost as all replies (and not just the link I 
-&gt; wanted) are routed out ipsec0 and the router doesn't respond to the ipsec 
-&gt; traffic.
-</pre>
-
-<p>If you're using a  
-FreeS/WAN 2.x/KLIPS system, simply re-attach the IPsec virtual 
-interface with <em>ipsec tnconfig</em> command such as:</p>
-<pre>    ipsec tnconfig --attach --virtual ipsec0 --physical ppp0</pre>
-<p>In your command, name the physical and virtual interfaces as they 
-appear paired on your system during regular uptime. For a system with several
-physical/virtual interface pairs on flaky links, you'll need more than
-one such command.
-If you're using FreeS/WAN 1.x, you must restart FreeS/WAN, which is more time 
-consuming.</p>
-
-<p>
-<A href="http://lists.freeswan.org/pipermail/design/2002-July/003070.html">Here</A> 
-is a script which can help to automate the process of FreeS/WAN restart at 
-need. 
-It could easily be adapted to use tnconfig instead.</p>
-
-<h3><a name="tcpdump.faq">TCPdump on the gateway shows strange things</a></h3>
-
-As another user pointed out, keeping the connect
-<p>Attempting to look at IPsec packets by running monitoring tools on the
-IPsec gateway machine can produce silly results. That machine is mangling the
-packets for IPsec, and possibly for firewall or NAT purposes as well. If the
-internals of the machine's IP stack are not what the monitoring tool expects,
-then the tool can misinterpret them and produce nonsense output.</p>
-
-<p>See our <a href="testing.html#tcpdump.test">testing</a> document for more
-detail.</p>
-
-<h3><a name="no_trace">Traceroute does not show anything between the
-gateways</a></h3>
-
-<p>As far as traceroute can see, the two gateways are one hop apart; the data
-packet goes directly from one to the other through the tunnel. Of course the
-outer packets that implement the tunnel pass through whatever lies between
-the gateways, but those packets are built and dismantled by the gateways.
-Traceroute does not see them and cannot report anything about their path.</p>
-
-<p>Here is a mailing list message with more detail.</p>
-<pre>Date: Mon, 14 May 2001
-To: linux-ipsec@freeswan.org
-From: "John S. Denker" &lt;jsd@research.att.com&lt;
-Subject: Re: traceroute: one virtual hop
-
-At 02:20 PM 5/14/01 -0400, Claudia Schmeing wrote:
-&gt;
-&gt;&gt; &gt; A bonus question: traceroute in subnet to subnet enviroment looks like:
-&gt;&gt; &gt; 
-&gt;&gt; &gt; traceroute to andris.dmz (172.20.24.10), 30 hops max, 38 byte packets
-&gt;&gt; &gt; 1  drama (172.20.1.1)  0.716 ms  0.942 ms  0.434 ms
-&gt;&gt; &gt; 2  * * *
-&gt;&gt; &gt; 3  andris.dmz (172.20.24.10)  73.576 ms  78.858 ms  79.434 ms
-&gt;&gt; &gt; 
-&gt;&gt; &gt; Why aren't there the other hosts which take part in the delivery during 
-&gt;    * * * ?
-&gt;
-&gt;If there is an ipsec tunnel between GateA and Gate B, this tunnel forms a 
-&gt;'virtual wire'.  When it is tunneled, the original packet becomes an inner 
-&gt;packet, and new ESP and/or AH headers are added to create an outer packet 
-&gt;around it. You can see an example of how this is done for AH at 
-&gt;doc/ipsec.html#AH . For ESP it is similar.
-&gt;
-&gt;Think about the packet's path from the inner packet's perspective.
-&gt;It leaves the subnet, goes into the tunnel, and re-emerges in the second
-&gt;subnet. This perspective is also the only one available to the
-&gt;'traceroute' command when the IPSec tunnel is up.
-
-Claudia got this exactly right.  Let me just expand on a couple of points:
-
-*) GateB is exactly one (virtual) hop away from GateA.  This is how it
-would be if there were a physically private wire from A to B.  The
-virtually private connection should work the same, and it does.
-
-*) While the information is in transit from GateA to GateB, the hop count
-of the outer header (the "envelope") is being decremented.  The hop count
-of the inner header (the "contents" of the envelope) is not decremented and
-should not be decremented.  The hop count of the outer header is not
-derived from and should not be derived from the hop count of the inner header.
-
-Indeed, even if the packets did time out in transit along the tunnel, there
-would be no way for traceroute to find out what happened.  Just as
-information cannot leak _out_ of the tunnel to the outside, information
-cannot leak _into_ the tunnel from outside, and this includes ICMP messages
-from routers along the path.
-
-There are some cases where one might wish for information about what is
-happening at the IP layer (below the tunnel layer) -- but the protocol
-makes no provision for this.  This raises all sorts of conceptual issues.
-AFAIK nobody has ever cared enough to really figure out what _should_
-happen, let alone implement it and standardize it.
-
-*) I consider the "* * *" to be a slight bug.  One might wish for it to be
-replaced by "GateB GateB GateB".  It has to do with treating host-to-subnet
-traffic different from subnet-to-subnet traffic (and other gory details).
-I fervently hope KLIPS2 will make this problem go away.
-
-*) If you want to ask questions about the link from GateA to GateB at the
-IP level (below the tunnel level), you have to ssh to GateA and launch a
-traceroute from there.</pre>
-
-<h2><a name="man4debug">Testing in stages</a></h2>
-
-<p>It is often useful in debugging to test things one at a time:</p>
-<ul>
-  <li>disable IPsec entirely, for example by turning it off with
-    chkconfig(8), and make sure routing works</li>
-  <li>Once that works, try a manually keyed connection. This does not require
-    key negotiation between Pluto and the key daemon on the other end.</li>
-  <li>Once that works, try automatically keyed connections</li>
-  <li>Once IPsec works, add packet compression</li>
-  <li>Once everything seems to work, try stress tests with large transfers,
-    many connections, frequent re-keying, ...</li>
-</ul>
-
-<p>FreeS/WAN releases are tested for all of these, so you can be reasonably
-certain they <em>can</em> do them all. Of course, that does not mean they
-<em>will</em> on the first try, especially if you have some unusual
-configuration.</p>
-
-<p>The rest of this section gives information on diagnosing the problem when
-each of the above steps fails.</p>
-
-<h3><a name="nomanual">Manually keyed connections don't work</a></h3>
-
-<p>Suspect one of:</p>
-<ul>
-  <li>mis-configuration of IPsec system in the /etc/ipsec.conf file<br>
-    common errors are incorrect interface or next hop information</li>
-  <li>mis-configuration of manual connection in the /etc/ipsec.conf file</li>
-  <li>routing problems causing IPsec packets to be lost</li>
-  <li>bugs in KLIPS</li>
-  <li>mismatch between the transforms we support and those another IPsec
-    implementation offers.</li>
-</ul>
-
-<h3><a name="spi_error">One manual connection works, but second one
-fails</a></h3>
-
-<p>This is a fairly common problem when attempting to configure multiple
-manually keyed connections from a single gateway.</p>
-
-<p>Each connection must be identified by a unique <a
-href="glossary.html#SPI">SPI</a> value. For automatic connections, these
-values are assigned automatically. For manual connections, you must set them
-with <var>spi=</var> statements in <a
-href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a>.</p>
-
-<p>Each manual connection must have a unique SPI value in the range 0x100 to
-0x999. Two or more with the same value will fail. For details, see our doc
-section <a href="adv_config.html#prodman">Using manual keying in
-production</a> and the man page <a
-href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a>.</p>
-
-<h3><a name="man_no_auto">Manual connections work, but automatic keying
-doesn't</a></h3>
-
-<p>The most common reason for this behaviour is a firewall dropping the UDP
-port 500 packets used in key negotiation.</p>
-
-<p>Other possibilities:</p>
-<ul>
-  <li>mis-configuration of auto connection in the /etc/ipsec.conf file.
-    <p>One common configuration error is forgetting that you need
-    <var>auto=add</var> to load the connection description on the receiving
-    end so it recognises the connection when the other end asks for it.</p>
-  </li>
-  <li>error in shared secret in /etc/ipsec.secrets</li>
-  <li>one gateway lacks a route to the other so Pluto's UDP packets are
-  lost</li>
-  <li>bugs in Pluto</li>
-  <li>incompatibilities between Pluto's <a href="glossary.html#IKE">IKE</a>
-    implementation and the IKE at the other end of the tunnel.
-    <p>Some possibile problems are discussed in out <a
-    href="interop.html#interop.problem">interoperation</a> document.</p>
-  </li>
-</ul>
-
-<h3><a name="nocomp">IPsec works, but connections using compression
-fail</a></h3>
-
-<p>When we first added compression, we saw some problems:</p>
-<ul>
-  <li>compatibility issues with other implementations. We followed the RFCs
-    and omitted some extra material that many compression libraries add by
-    default. Some other implementations left the extras in</li>
-  <li>bugs in assembler compression routines on non-Intel CPUs. The
-    workaround is to use C code instead of possibly problematic
-  assembler.</li>
-</ul>
-
-<p>We have not seen either problem in some time (at least six months as I
-write in March 2002), but if you have some unusual configuration then you may
-see them.</p>
-
-<h3><a name="pmtu.broken">Small packets work, but large transfers
-fail</a></h3>
-
-<p>If tests with ping(1) and a small packet size succeed, but tests or
-transfers with larger packet sizes fail, suspect problems with packet
-fragmentation and perhaps <a href="glossary.html#pathMTU">path MTU
-discovery</a>.</p>
-
-<p>Our <a href="trouble.html#bigpacket">troubleshooting document</a> covers
-these problems. Information on the underlying mechanism is in our <a
-href="background.html#MTU.trouble">background</a> document.</p>
-
-<h3><a name="subsub">Subnet-to-subnet works, but tests from the gateways
-don't</a></h3>
-
-<p>This is described under <a href="#cantping">I cannot ping...</a> above.</p>
-
-<h2><a name="compile.faq">Compilation problems</a></h2>
-
-<h3><a name="gmp.h_missing">gmp.h: No such file or directory</a></h3>
-
-<p>Pluto needs the GMP (<strong>G</strong>NU</p>
-
-<p><strong>M</strong>ulti-<strong>P</strong>recision) library for the large
-integer calculations it uses in <a href="glossary.html#public">public key</a>
-cryptography. This error message indicates a failure to find the library. You
-must install it before Pluto will compile.</p>
-
-<p>The GMP library is included in most Linux distributions. Typically, there
-are two RPMs, libgmp and libgmp-devel, You need to <em>install both</em>,
-either from your distribution CDs or from your vendor's web site.</p>
-
-<p>On Debian, a mailing list message reports that the command to give is
-<var>apt-get install gmp2</var>.</p>
-
-<p>For more information and the latest version, see the <a
-href="http://www.swox.com/gmp/">GMP home page</a>.</p>
-
-<h3><a name="noVM">... virtual memory exhausted</a></h3>
-
-<p>We have had several reports of this message appearing, all on SPARC Linux.
-Here is a mailing message on a solution:</p>
-<pre>&gt; ipsec_sha1.c: In function `SHA1Transform':
-&gt; ipsec_sha1.c:95: virtual memory exhausted
-
-I'm seeing exactly the same problem on an Ultra with 256MB ram and 500
-MB swap.  Except I am compiling version 1.5 and its Red Hat 6.2.
-
-I can get around this by using -O instead of -O2 for the optimization
-level.  So it is probably a bug in the optimizer on the sparc complier. 
-I'll try and chase this down on the sparc lists.</pre>
-
-<h2><a name="error">Interpreting error messages</a></h2>
-
-<h3><a name="route-client">route-client (or host) exited with status
-7</a></h3>
-
-<p>Here is a discussion of this error from FreeS/WAN "listress" (mailing list
-tech support person) Claudia Schmeing. The "FAQ on the network unreachable
-error" which she refers to is the next question below.</p>
-<pre>&gt; I reached the point where the two boxes (both on dial-up connections, but
-&gt; treated as static IPs by getting the IP and editing ipsec.conf after the
-&gt; connection is established) to the point where they exchange some info, but I
-&gt; get an error like "route-client command exited with status 7 \n internal
-&gt; error".
-&gt; Where can I find a description of this error?
-
-In general, if the FAQ doesn't cover it, you can search the mailing list 
-archives - I like to use
-http://www.sandelman.ottawa.on.ca/linux-ipsec/
-but you can see doc/mail.html for different archive formats.
-
-
-Your error comes from the _updown script, which performs some
-routing and firewall functions to help Linux FreeS/WAN. More info
-is available at doc/firewall.html and man ipsec.conf. Its routing
-is integral to the health of Linux FreeS/WAN; it also provides facility
-to insert custom firewall rules to be executed when you create or destroy
-a connection.
-
-Yours is, of course, a routing error. You can be fairly sure the routing 
-machinery is saying "network is unreachable". There's a FAQ on the 
-"network is unreachable" error, but more information is available now; read on.
-
-If your _updown script is recent (for example if it shipped with 
-Linux FreeS/WAN 1.91), you will see another debugging line in your logs 
-that looks something like this:
-
-&gt; output: /usr/local/lib/ipsec/_updown: `route add -net 128.174.253.83 
-&gt; netmask 255.255.255.255 dev ipsec0 gw 66.92.93.161' failed
-
-This is, of course, the system route command that exited with status 7, 
-(ie. failed). Man route for details. Seeing the command typed out yields 
-more information. If your _updown script is older, you may wish to update 
-it to show the command explicitly.
-
-Three parameters fed to the route command: net, netmask and gw [gateway] 
-are derived from things you've put in ipsec.conf.
-
-Net and netmask are derived from the peer's IP and mask. In more detail:
-
-You may see a routing error when routing to a client (ie. subnet), or 
-to a host (IPSec gateway or freestanding host; a box that does IPSec for
-itself). In _updown, the "route-client" section  is responsible to set up 
-the route for IPSec'd (usually, read 'tunneled') packets headed to a 
-peer subnet. Similarly, route-host routes IPSec'd packets to a peer host
-or IPSec gateway.
-
-When routing to a 'client', net and netmask are ipsec.conf's left- or 
-rightsubnet (whichever is not local). Similarly, when routing to a 
-'host' the net is left or right. Host netmask is always /32, indicating a 
-single machine.
-
-Gw is nexthop's value. Again, the value in question is left- or rightnexthop,
-whichever is local. Where left/right or left-/rightnexthop has the special 
-value %defaultroute (described in man ipsec.conf), gw will automagically get
-the value of the next hop on the default route.
-
-Q: "What's a nexthop and why do I need one?"
-
-A: 'nexthop' is a routing kluge; its value is the next hop away
-   from the machine that's doing IPSec, and toward your IPSec peer. 
-   You need it to get the processed packets out of the local system and 
-   onto the wire. While we often route other packets through the machine 
-   that's now doing IPSec, and are done with it, this does not suffice here. 
-   After packets are processed with IPSec, this machine needs to know where 
-   they go next. Of course using the 'IPSec gateway' as their routing gateway 
-   would cause an infinite loop! [To visualize this, see the packet flow 
-   diagram at doc/firewall.html.] To avoid this, we route packets through 
-   the next hop down their projected path.
-
-Now that you know the background, consider:
-1. Did you test routing between the gateways in the absence of Linux
-   FreeS/WAN, as recommended? You need to ensure the two machines that
-   will be running Linux FreeS/WAN can route to one another before trying to 
-   make a secure connection.
-2. Is there anything obviously wrong with the sense of your route command?
-
-Normally, this problem is caused by an incorrect local nexthop parameter.
-Check out the use of %defaultroute, described in man ipsec.conf. This is
-a simple way to set nexthop for most people. To figure nexthop out by hand,
-traceroute in-the-clear to your IPSec peer. Nexthop is the traceroute's 
-first hop after your IPSec gateway.</pre>
-
-<h3><a name="unreachable">SIOCADDRT:Network is unreachable</a></h3>
-
-<p>This message is not from FreeS/WAN, but from the Linux IP stack itself.
-That stack is seeing packets it has no route for, either because your routing
-was broken before FreeS/WAN started or because FreeS/WAN's changes broke
-it.</p>
-
-<p>Here is a message from Claudia suggesting ways to diagnose and fix such
-problems:</p>
-<pre>You write,
-&gt; I have correctly installed freeswan-1.8 on RH7.0 kernel 2.2.17, but when 
-&gt; I setup a VPN connection with the other machine(RH5.2 Kernel 2.0.36 
-&gt; freeswan-1.0, it works well.) it told me that 
-&gt; "SIOCADDRT:Network is unreachable"!  But the network connection is no 
-&gt; problem.
-
-Often this error is the result of a misconfiguration. 
-
-Be sure that you can route successfully in the absence of Linux
-FreeS/WAN. (You say this is no problem, so proceed to the next step.)
-
-Use a custom copy of the default updownscript. Do not change the route 
-commands, but add a diagnostic message revealing the exact text of the 
-route command. Is there a problem with the sense of the route command
-that you can see? If so, then re-examine those ipsec.conf settings
-that are being sent to the route command. 
-
-You may wish to use the ipsec auto --route and --unroute commands to 
-troubleshoot the problem. See man ipsec_auto for details.</pre>
-
-<p>Since the above message was written, we have modified the updown script to
-provide a better diagnostic for this problem. Check
-<var>/var/log/messages</var>.</p>
-
-<p>See also the FAQ question <a href="#route-client">route-client (or host)
-exited with status 7</a>.</p>
-
-<h3><a name="modprobe">ipsec_setup: modprobe: Can't locate module
-ipsec</a></h3>
-
-<h3><a name="noKLIPS">ipsec_setup: Fatal error, kernel appears to lack
-KLIPS</a></h3>
-
-<p>These messages indicate an installation failure. The kernel you are
-running does not contain the <a href="glossary.html#KLIPS">KLIPS (kernel
-IPsec)</a> code.</p>
-
-<p>Note that the "modprobe: Can't locate module ipsec" message appears even
-if you are not using modules. If there is no KLIPS in your kernel, FreeS/WAN
-tries to load it as a module. If that fails, you get this message.</p>
-
-<p>Commands you can quickly try are:</p>
-<dl>
-  <dt><var>uname -a</var></dt>
-    <dd>to get details, including compilation date and time, of the currently
-      running kernel</dd>
-  <dt><var>ls /</var></dt>
-  <dt><var>ls /boot</var></dt>
-    <dd>to ensure a new kernel is where it should be. If kernel compilation
-      puts it in <var>/</var> but <var>lilo</var> wants it in
-      <var>/boot</var>, then you should uncomment the
-      <var>INSTALL_PATH=/boot</var> line in the kernel
-    <var>Makefile</var>.</dd>
-  <dt><var>more /etc/lilo.conf</var></dt>
-    <dd>to see that <var>lilo</var> has correct information</dd>
-  <dt><var>lilo</var></dt>
-    <dd>to ensure that information in <var>/etc/lilo.conf</var> has been
-      transferred to the boot sector</dd>
-</dl>
-
-<p>If those don't find the problem, you have to go back and check through the
-<a href="install.html">install</a> procedure to see what was missed.</p>
-
-<p>Here is one of Claudia's messages on the topic:</p>
-<pre>&gt; I tried to install freeswan 1.8 on my mandrake 7.2 test box. ...
-
-&gt; It does show version and some output for whack.
-
-Yes, because the Pluto (daemon) part of ipsec is installed correctly, but
-as we see below the kernel portion is not.
-
-&gt; However, I get the following from /var/log/messages:
-&gt; 
-&gt; Mar 11 22:11:55 pavillion ipsec_setup: Starting FreeS/WAN IPsec 1.8...
-&gt; Mar 11 22:12:02 pavillion ipsec_setup: modprobe: Can't locate module ipsec
-&gt; Mar 11 22:12:02 pavillion ipsec_setup: Fatal error, kernel appears to lack
-&gt; KLIPS.
-
-This is your problem. You have not successfully installed a kernel with
-IPSec machinery in it. 
-
-Did you build Linux FreeS/WAN as a module? If so, you need to ensure that 
-your new module has been installed in the directory where your kernel 
-loader normally finds your modules. If not, you need to ensure
-that the new IPSec-enabled kernel is being loaded correctly.
-
-See also doc/install.html, and INSTALL in the distro.</pre>
-
-<h3><a name="noDNS">ipsec_setup: ... failure to fetch key for ... from
-DNS</a></h3>
-
-<p>Quoting Henry:</p>
-<pre>Note that by default, FreeS/WAN is now set up to
-     (a) authenticate with RSA keys, and
-     (b) fetch the public key of the far end from DNS.
-Explicit attention to  ipsec.conf will be needed if you want
-to do something different.</pre>
-
-<p>and Claudia, responding to the same user:</p>
-<pre>You write,
-
-&gt;       My current setup in ipsec.conf is leftrsasigkey=%dns I have 
-&gt; commented this and authby=rsasig out. I am able to get ipsec running, 
-&gt; but what I find is that the documentation only specifies for %dns are 
-&gt; there any other values that can be placed in this variable other than 
-&gt; %dns and the key? I am also assuming that this is where I would place 
-&gt; my public key for the left and right side as well is this correct?
-
-Valid values for authby= are rsasig and secret, which entail authentication
-by RSA signature or by shared secret, respectively. Because you have 
-commented authby=rsasig out, you are using the default value of authby=secret. 
-
-When using RSA signatures, there are two ways to get the public key for the
-IPSec peer: either copy it directly into *rsasigkey= in ipsec.conf, or
-fetch it from dns. The magic value %dns for *rsasigkey parameters says to 
-try to fetch the peer's key from dns.
-
-For any parameters, you may find their significance and special values in
-man ipsec.conf. If you are setting up keys or secrets, be sure also to
-reference man ipsec.secrets.</pre>
-
-<h3><a name="dup_address">ipsec_setup: ... interfaces ... and ... share
-address ...</a></h3>
-
-<p>This is a fatal error. FreeS/WAN cannot cope with two or more interfaces
-using the same IP address. You must re-configure to avoid this.</p>
-
-<p>A mailing list message on the topic from Pluto developer Hugh
-Redelmeier:</p>
-<pre>| I'm trying to get freeswan working between two machine where one has a ppp
-| interface.
-| I've already suceeded with  two machines with ethernet ports but  the ppp
-| interface is causing me problems.
-|  basically when I run ipsec start  i get
-| ipsec_setup: Starting FreeS/WAN IPsec 1.7...
-| ipsec_setup: 003 IP interfaces ppp1 and ppp0 share address 192.168.0.10!
-| ipsec_setup: 003 IP interfaces ppp1 and ppp2 share address 192.168.0.10!
-| ipsec_setup: 003 IP interfaces ppp0 and ppp2 share address 192.168.0.10!
-| ipsec_setup: 003 no public interfaces found
-|
-| followed by lots of cannot work out interface for connection messages
-|
-| now I can specify the interface in ipsec.conf to be ppp0 , but this does
-| not affect the above behaviour. A quick look in server.c indicates that the
-| interfaces value  is not used but some sort of raw detect happens.
-|
-| I guess I could prevent the formation of the extra ppp interfaces or
-| allocate them different ip but I'd  rather not. if at all possible. Any
-| suggestions please.
-
-Pluto won't touch an interface that shares an IP address with another.
-This will eventually change, but it probably won't happen soon.
-
-For now, you will have to give the ppp1 and ppp2 different addresses.</pre>
-
-<h3><a name="kflags">ipsec_setup: Cannot adjust kernel flags</a></h3>
-
-<p>A mailing list message form technical lead Henry Spencer:</p>
-<pre>&gt; When FreeS/WAN IPsec 1.7 is starting on my 2.0.38 Linux kernel the following
-&gt; error message is generated:
-&gt; ipsec_setup: Cannot adjust kernel flags, no /proc/sys/net/ipsec directory!
-&gt; What is supposed to create this directory and how can I fix this problem?
-
-I think that directory is a 2.2ism, although I'm not certain (I don't have
-a 2.0.xx system handy any more for testing).  Without it, some of the
-ipsec.conf config-setup flags won't work, but otherwise things should
-function. </pre>
-
-<p>You also need to enable the <var>/proc</var> filesystem in your kernel
-configuration for these operations to work.</p>
-
-<h3><a name="message_num">Message numbers (MI3, QR1, et cetera) in Pluto
-messages</a></h3>
-
-<p>Pluto messages often indicate  where Pluto is in the IKE protocols. The
-letters indicate <strong>M</strong>ain mode or <strong>Q</strong>uick mode
-and <strong>I</strong>nitiator or <strong>R</strong>esponder. The numerals
-are message sequence numbers. For more detail, see our <a
-href="ipsec.html#sequence">IPsec section</a>.</p>
-
-<h3><a name="conn_name">Connection names in Pluto error messages</a></h3>
-
-<p>From Pluto programmer Hugh Redelmeier:</p>
-<pre>| Jan 17 16:21:10 remus Pluto[13631]: "jumble" #1: responding to Main Mode from Road Warrior 130.205.82.46
-| Jan 17 16:21:11 remus Pluto[13631]: "jumble" #1: no suitable connection for peer @banshee.wittsend.com
-| 
-|     The connection "jumble" has nothing to do with the incoming
-| connection requests, which were meant for the connection "banshee".
-
-You are right.  The message tells you which Connection Pluto is
-currently using, which need not be the right one.  It need not be the
-right one now for the negotiation to eventually succeed!  This is
-described in ipsec_pluto(8) in the section "Road Warrior Support".
-
-There are two times when Pluto will consider switching Connections for
-a state object.  Both are in response to receiving ID payloads (one in
-Phase 1 / Main Mode and one in Phase 2 / Quick Mode).  The second is
-not unique to Road Warriors.  In fact, neither is the first any more
-(two connections for the same pair of hosts could differ in Phase 1 ID
-payload; probably nobody else has tried this).</pre>
-
-<h3><a name="cantorient">Pluto: ... can't orient connection</a></h3>
-
-<p>Older versions of FreeS/WAN used this message. The same error now gives
-the "we have no ipsecN ..." error described just below.</p>
-
-<h3><a name="no.interface">... we have no ipsecN interface for either end of
-this connection</a></h3>
-
-<p>Your tunnel has no IP address which matches the IP
-address of any of the available IPsec interfaces. Either you've 
-misconfigured the connection, or you need to define an appropriate 
-IPsec interface connection. <VAR>interfaces=%defaultroute</VAR> works
-in many cases.</p>
-
-<p>A longer story: Pluto needs to know whether it is running on 
-the machine which the
-connection description calls <var>left</var> or on <var>right</var>. It
-figures that out by:</p>
-<ul>
-  <li>looking at the interfaces given in <var>interfaces=</var> lines in the
-    <var>config setup</var> section</li>
-  <li>discovering the IP addresses for those interfaces</li>
-  <li>searching for a match between those addresses and the ones given in
-    <var>left=</var> or <var>right=</var> lines.</li>
-</ul>
-
-<p>Normally a match is found. Then Pluto knows where it is and can set up
-other things (for example, if it is <var>left</var>) using parameters such as
-<var>leftsubnet</var> and <var>leftnexthop</var>, and sending its outgoing
-packets to <var>right</var>.</p>
-
-<p>If no match is found, it emits the above error message.</p>
-
-<h3><a name="noconn">Pluto: ... no connection is known</a></h3>
-
-<p>This error message occurs when a remote system attempts to negotiate a
-connection and Pluto does not have a connection description that matches what
-the remote system has requested. The most common cause is a configuration
-error on one end or the other.</p>
-
-<p>Parameters involved in this match are <var>left</var>, <var>right</var>,
-<var>leftsubnet</var> and <var>rightsubnet</var>.</p>
-
-<p><strong>The match must be exact</strong>. For example, if your left subnet
-is a.b.c.0/24 then neither a single machine in that net nor a smaller subnet
-such as a.b.c.64/26 will be considered a match.</p>
-
-<p>The message can also occur when an appropriate description exists but
-Pluto has not loaded it. Use an <var>auto=add</var> statement in the
-connection description, or an <var>ipsec auto --add &lt;conn_name&gt;</var>
-command, to correct this.</p>
-
-<p>An explanation from the Pluto developer:</p>
-<pre>| Jul 12 15:00:22 sohar58 Pluto[574]: "corp_road" #2: cannot respond to IPsec
-| SA request because no connection is known for
-| 216.112.83.112/32===216.112.83.112...216.67.25.118
-
-This is the first message from the Pluto log showing a problem.  It
-means that PGPnet is trying to negotiate a set of SAs with this
-topology:
-
-216.112.83.112/32===216.112.83.112...216.67.25.118
-^^^^^^^^^^^^^^^^^   ^^^^^^^^^^^^^^   ^^^^^^^^^^^^^
-client on our side  our host         PGPnet host, no client
-
-None of the conns you showed look like this.
-
-Use
-        ipsec auto --status
-to see a snapshot of what connections are in pluto, what
-negotiations are going on, and what SAs are established.
-
-The leftsubnet= (client) in your conn is 216.112.83.64/26.  It must
-exactly match what pluto is looking for, and it does not.</pre>
-
-<h3><a name="nosuit">Pluto: ... no suitable connection ...</a></h3>
-
-<p>This is similar to the <a href="#noconn">no connection known</a> error,
-but occurs at a different point in Pluto processing.</p>
-
-<p>Here is one of Claudia's messages explaining the problem:</p>
-<pre>You write,
-
-&gt; What could be the reason of the following error? 
-&gt; "no suitable connection for peer '@xforce'"
-
-When a connection is initiated by the peer, Pluto must choose which entry in 
-the conf file best matches the incoming connection. A preliminary choice is 
-made on the basis of source and destination IPs, since that information is 
-available at that time. 
-
-A payload containing an ID arrives later in the negotiation. Based on this
-id and the *id= parameters, Pluto refines its conn selection. ...
-
-The message "no suitable connection" indicates that in this refining step,
-Pluto does not find a connection that matches that ID.
-
-Please see "Selecting a connection when responding" in man ipsec_pluto for
-more details.</pre>
-
-<p>See also <a href="#conn_name">Connection names in Pluto error
-messages</a>.</p>
-
-<h3><a name="noconn.auth">Pluto: ... no connection has been
-authorized</a></h3>
-
-<p>Here is one of Claudia's messages discussing this problem:</p>
-<pre>You write,
-
-&gt;  May 22 10:46:31 debian Pluto[25834]: packet from x.y.z.p:10014: 
-&gt;  initial Main Mode message from x.y.z.p:10014 
-                            but no connection has been authorized
-
-This error occurs early in the connection negotiation process,
-at the first step of IKE negotiation (Main Mode), which is itself the 
-first of two negotiation phases involved in creating an IPSec connection.
-
-Here, Linux FreeS/WAN receives a packet from a potential peer, which 
-requests that they begin discussing a connection.
-
-The "no connection has been authorized" means that there is no connection 
-description in Linux FreeS/WAN's internal database that can be used to 
-link your ipsec interface with that peer.
-
-"But of course I configured that connection!" 
-
-It may be that the appropriate connection description exists in ipsec.conf 
-but has not been added to the database with ipsec auto --add myconn or the 
-auto=add method. Or, the connection description may be misconfigured.
-
-The only parameters that are relevant in this decision are left= and right= .
-Local and remote ports are also taken into account -- we see that the port 
-is printed in the message above -- but there is no way to control these
-in ipsec.conf.
-
-
-Failure at "no connection has been authorized" is similar to the
-"no connection is known for..." error in the FAQ, and the "no suitable
-connection" error described in the snapshot's FAQ. In all three cases,
-Linux FreeS/WAN is trying to match parameters received in the
-negotiation with the connection description in the local config file.
-
-As it receives more information, its matches take more parameters into 
-account, and become more precise:  first the pair of potential peers,
-then the peer IDs, then the endpoints (including any subnets).
-
-The "no suitable connection for peer *" occurs toward the end of IKE 
-(Main Mode) negotiation, when the IDs are matched.
-
-"no connection is known for a/b===c...d" is seen at the beginning of IPSec 
-(Quick Mode, phase 2) negotiation, when the connections are matched using
-left, right, and any information about the subnets.</pre>
-
-<h3><a name="noDESsupport">Pluto: ... OAKLEY_DES_CBC is not
-supported.</a></h3>
-
-<p>This message occurs when the other system attempts to negotiate a
-connection using <a href="glossary.html#DES">single DES</a>, which we do not
-support because it is <a href="politics.html#desnotsecure">insecure</a>.</p>
-
-<p>Our interoperation document has suggestions for <a
-href="interop.html#noDES">how to deal with</a> systems that attempt to use
-single DES.</p>
-
-<h3><a name="notransform">Pluto: ... no acceptable transform</a></h3>
-
-<p>This message means that the other gateway has made a proposal for
-connection parameters, but nothing they proposed is acceptable to Pluto.
-Possible causes include:</p>
-<ul>
-  <li>misconfiguration on either end</li>
-  <li>policy incompatibilities, for example we require encrypted connections
-    but they are trying to create one with just authentication</li>
-  <li>interoperation problems, for example they offer only single DES and
-    FreeS/WAN does not support that. See <a
-    href="interop.html#interop.problem">discussion</a> in our interoperation
-    document.</li>
-</ul>
-
-<p>A more detailed explanation, from Pluto programmer Hugh Redelmeier:</p>
-<pre>Background:
-
-When one IKE system (for example, Pluto) is negotiating with another
-to create an SA, the Initiator proposes a bunch of choices and the
-Responder replies with one that it has selected.
-
-The structure of the choices is fairly complicated.  An SA payload
-contains a list of lists of "Proposals".  The outer list is a set of
-choices: the selection must be from one element of this list.
-
-Each of these elements is a list of Proposals.  A selection must be
-made from each of the elements of the inner list.  In other words,
-*all* of them apply (that is how, for example, both AH and ESP can
-apply at once).
-
-Within each of these Proposals is a list of Transforms.  For each
-Proposal selected, one Transform must be selected (in other words,
-each Proposal provides a choice of Transforms).
-
-Each Transform is made up of a list of Attributes describing, well,
-attributes.  Such as lifetime of the SA.  Such as algorithm to be
-used.  All the Attributes apply to a Transform.
-
-You will have noticed a pattern here: layers alternate between being
-disjunctions ("or") and conjunctions ("and").
-
-For Phase 1 / Main Mode (negotiating an ISAKMP SA), this structure is
-cut back.  There must be exactly one Proposal.  So this degenerates to
-a list of Transforms, one of which must be chosen.
-
-In your case, no proposal was considered acceptable to Pluto (the
-Responder).  So negotiation ceased.  Pluto logs the reason it rejects
-each Transform.  So look back in the log to see what is going wrong.</pre>
-
-<h3><a name="rsasigkey">rsasigkey dumps core</a></h3>
-A comment on this error from Henry:
-<pre>On Fri, 29 Jun 2001, Rodrigo Gruppelli wrote:
-&gt; ...Well, it seem that there's
-&gt; another problem with it. When I try to generate a pair of RSA keys,
-&gt; rsasigkey cores dump...
-
-*That* is a neon sign flashing "GMP LIBRARY IS BROKEN".  Rsasigkey calls
-GMP a lot, and our own library a little bit, and that's very nearly all it
-does.  Barring bugs in its code or our library -- which have happened, but
-not very often -- a problem in rsasigkey is a problem in GMP.</pre>
-
-<p>See the next question for how to deal with GMP errors.</p>
-
-<h3><a name="sig4">!Pluto failure!: ... exited with ... signal 4</a></h3>
-
-<p>Pluto has died. Signal 4 is SIGILL, illegal instruction.</p>
-
-<p>The most likely cause is that your <a href="glossary.html#GMP">GMP</a>
-(GNU multi-precision) library is compiled for a different processor than what
-you are running on. Pluto uses that library for its public key
-calculations.</p>
-
-<p>Try getting the GMP sources and recompile for your processor type. Most
-Linux distributions will include this source, or you can download it from the
-<a href="http://www.swox.com/gmp/">GMP home page</a>.</p>
-
-<h3><a name="econnrefused">ECONNREFUSED error message</a></h3>
-
-<p>From John Denker, on the mailing list:</p>
-<pre>1)  The log message
-  some IKE message we sent has been rejected with 
-  ECONNREFUSED (kernel supplied no details)
-is much more suitable than the previous version.  Thanks.
-
-2) Minor suggestion for further improvement: it might be worth mentioning
-that the command
-  tcpdump -i eth1 icmp[0] != 8 and icmp[0] != 0
-is useful for tracking down the details in question.  We shouldn't expect
-all IPsec users to figure that out on their own.  The log message might
-even provide a hint as to where to look in the docs.</pre>
-
-<p>Reply From Pluto developer Hugh Redelmeier</p>
-<pre>Good idea.
-
-I've added a bit pluto(8)'s BUGS section along these lines.
-I didn't have the heart to lengthen this message.</pre>
-
-<h3><a name="no_eroute">klips_debug: ... no eroute!</a></h3>
-
-<p>This message means <a href="glossary.html#KLIPS">KLIPS</a> has received a
-packet for which no IPsec tunnel has been defined.</p>
-
-<p>Here is a more detailed duscussion from the team's tech support person
-Claudia Schmeing, responding to a query on the mailing list:</p>
-<pre>&gt; Why ipsec reports no eroute! ???? IP Masq... is disabled.
-
-In general, more information is required so that people on the list may
-give you informed input. See doc/prob.report.</pre>
-
-<p>The document she refers to has since been replaced by a <a
-href="trouble.html#prob.report">section</a> of the troubleshooting
-document.</p>
-<pre>However, I can make some general comments on this type of error.
-
-This error usually looks something like this (clipped from an archived
-message):
-
-&gt; ttl:64 proto:1 chk:45459 saddr:192.168.1.2 daddr:192.168.100.1
-&gt; ... klips_debug:ipsec_findroute: 192.168.1.2-&gt;192.168.100.1
-&gt; ... klips_debug:rj_match: * See if we match exactly as a host destination
-&gt; ... klips_debug:rj_match: ** try to match a leaf, t=0xc1a260b0
-&gt; ... klips_debug:rj_match: *** start searching up the tree, t=0xc1a260b0
-&gt; ... klips_debug:rj_match: **** t=0xc1a260c8
-&gt; ... klips_debug:rj_match: **** t=0xc1fe5960
-&gt; ... klips_debug:rj_match: ***** not found.
-&gt; ... klips_debug:ipsec_tunnel_start_xmit: Original head/tailroom: 2, 28
-&gt; ... klips_debug:ipsec_tunnel_start_xmit: no eroute!: ts=47.3030, dropping.
-
-
-What does this mean?
-- --------------------
-
-"eroute" stands for "extended route", and is a special type of route 
-internal to Linux FreeS/WAN. For more information about this type of route, 
-see the section of man ipsec_auto on ipsec auto --route.
-
-"no eroute!" here means, roughly, that Linux FreeS/WAN cannot find an 
-appropriate tunnel that should have delivered this packet. Linux 
-FreeS/WAN therefore drops the packet, with the message "no eroute! ...
-dropping", on the assumption that this packet is not a legitimate 
-transmission through a properly constructed tunnel.
-
-
-How does this situation come about?
-- -----------------------------------
-
-Linux FreeS/WAN has a number of connection descriptions defined in 
-ipsec.conf. These must be successfully brought "up" to form actual tunnels.
-(see doc/setup.html's step 15, man ipsec.conf and man ipsec_auto 
-for details).
-
-Such connections are often specific to the endpoints' IPs. However, in 
-some cases they may be more general, for example in the case of 
-Road Warriors where left or right is the special value %any.
-
-When Linux FreeS/WAN receives a packet, it verifies that the packet has
-come through a legitimate channel, by checking that there is an
-appropriate tunnel through which this packet might legitimately have
-arrived. This is the process we see above.
-
-First, it checks for an eroute that exactly matches the packet. In the 
-example above, we see it checking for a route that begins at 192.168.1.2
-and ends at 192.168.100.1. This search favours the most specific match that
-would apply to the route between these IPs. So, if there is a connection 
-description exactly matching these IPs, the search will end there. If not, 
-the code will search for a more general description matching the IPs.
-If there is no match, either specific or general, the packet will be
-dropped, as we see, above.
-
-Unless you are working with Road Warriors, only the first, specific part 
-of the matching process is likely to be relevant to you.
-
-
-"But I defined the tunnel, and it came up, why do I have this error?"
-- ---------------------------------------------------------------------
-
-One of the most common causes of this error is failure to specify enough
-connection descriptions to cover all needed tunnels between any two 
-gateways and their respective subnets. As you have noticed, troubleshooting
-this error may be complicated by the use of IP Masq. However, this error is
-not limited to cases where IP Masq is used. 
-
-See doc/configuration.html#multitunnel for a detailed example of the 
-solution to this type of problem.</pre>
-
-<p>The documentation section she refers to is now <a
-href="adv_config.html#multitunnel">here</a>.</p>
-
-<h3><a name="SAused">... trouble writing to /dev/ipsec ... SA already in
-use</a></h3>
-
-<p>This error message occurs when two manual connections are set up with the
-same SPI value. </p>
-
-<p>See the FAQ for <a href="#spi_error">One manual connection works, but
-second one fails</a>.</p>
-
-<h3><a name="ignore">... ignoring ... payload</a></h3>
-
-<p>This message is harmless. The IKE protocol provides for a number of
-optional messages types:</p>
-<ul>
-  <li>delete SA</li>
-  <li>initial contact</li>
-  <li>vendor ID</li>
-  <li>...</li>
-</ul>
-
-<p>An implementation is never required to send these, but they are allowed
-to. The receiver is not required to do anything with them. FreeS/WAN ignores
-them, but notifies you via the logs.</p>
-
-<p>For the "ignoring delete SA Payload" message, see also our discussion of
-cleaning up <a href="#deadtunnel">dead tunnels</a>.</p>
-
-<h3><a name="unknown_rightcert">unknown parameter name "rightcert"</a></h3>
-
-<P>This message can appear when you've upgraded an X.509-enabled 
-Linux FreeS/WAN with a vanilla Linux FreeS/WAN. To use your X.509 configs
-you will need to overwrite the new install with 
-<A HREF="http://www.freeswan.ca">Super FreeS/WAN</A>, or add the
-<A HREF="http://www.strongsec.ca/freeswan">X.509 patch</A> by hand.
-</P>
-
-<h2><a name="spam">Why don't you restrict the mailing lists to reduce
-spam?</a></h2>
-
-<p>As a matter of policy, some of our <a href="mail.html">mailing lists</a>
-need to be open to non-subscribers. Project management feel strongly that
-maintaining this openness is more important than blocking spam.</p>
-<ul>
-  <li>Users should be able to get help or report bugs without
-  subscribing.</li>
-  <li>Even a user who is subscribed may not have access to his or her
-    subscribed account when he or she needs help, miles from home base in the
-    middle of setting up a client's gateway.</li>
-  <li>There is arguably a legal requirement for this policy. A US resident or
-    citizen could be charged under munitions export laws for providing
-    technical assistance to a foreign cryptographic project. Such a charge
-    would be more easily defended if the discussion takes place in public, on
-    an open list.</li>
-</ul>
-
-<p>This has been discussed several times at some length on the list. See the
-<a href="mail.html#archive">list archives</a>. Bringing the topic up again is
-unlikely to be useful. Please don't. Or at the very least, please don't
-without reading the archives and being certain that whatever you are about to
-suggest has not yet been discussed.</p>
-
-<p>Project technical lead Henry Spencer summarised one discussion:</p>
-
-<blockquote>
-  For the third and last time:  this list *will* *not* do address-based
-  filtering.  This is a policy decision, not an implementation problem. The
-  decision is final, and is not open to discussion.  This needs to be
-  communicated better to people, and steps are being taken to do
-that.</blockquote>
-
-<p>Adding this FAQ section is one of the steps he refers to.</p>
-
-<p>You have various options other than just putting up with the spam,
-filtering it yourself, or unsubscribing:</p>
-<ul>
-  <li>subscribe only to one or both of our lists with restricted posting
-    rules:
-    <ul>
-      <li><a
-        href="mailto:briefs@lists.freeswan.org?body=subscribe">briefs</a>,
-        weekly list summaries</li>
-      <li><a
-        href="mailto:announce@lists.freeswan.org?body=subscribe">announce</a>,
-        project-related announcements</li>
-    </ul>
-  </li>
-  <li>read the other lists via the <a
-  href="mail.html#archive">archives</a></li>
-</ul>
-
-<p>A number of tools are available to filter mail.</p>
-<ul>
-  <li>Many mail readers include some filtering capability.</li>
-  <li>Many Linux distributions include <a
-    href="http://www.procmail.org/">procmail(8)</a> for server-side
-  filtering.</li>
-  <li>The <a href="http://www.spambouncer.org/">Spam Bouncer</a> is a set of
-    procmail(8) filters designed to combat spam.</li>
-  <li>Roaring Penguin have a <a
-    href="http://www.roaringpenguin.com/mimedefang/">MIME defanger</a> that
-    removes potentially dangerous attachments.</li>
-</ul>
-
-<p>If you use your ISP's mail server rather than running your own, consider
-suggesting to the ISP that they tag suspected spam as <a
-href="http://www.msen.com/1997/spam.html#SUSPECTED">this ISP</a> does. They
-could just refuse mail from dubious sources, but that is tricky and runs some
-risk of losing valuable mail or senselessly annoying senders and their
-admins. However, they can safely tag and deliver dubious mail. The tags can
-greatly assist your filtering.</p>
-
-<p>For information on tracking down spammers, see these <a
-href="http://www.rahul.net/falk/#howtos">HowTos</a>, or the <a
-href="http://www.sputum.com/index2.html">Sputum</a> site. Sputum have a Linux
-anti-spam screensaver available for download.</p>
-
-<p>Here is a more detailed message from Henry:</p>
-<pre>On Mon, 15 Jan 2001, Jay Vaughan wrote:
-&gt; I know I'm flogging a dead horse here, but I'm curious as to the reasons for
-&gt; an aversion for a subscriber-only mailing list?
-
-Once again:  for legal reasons, it is important that discussions of these
-things be held in a public place -- the list -- and we do not want to
-force people to subscribe to the list just to ask one question, because
-that may be more than merely inconvenient for them.  There are also real
-difficulties with people who are temporarily forced to use alternate
-addresses; that is precisely the time when they may be most in need of
-help, yet a subscribers-only policy shuts them out.
-
-These issues do not apply to most mailing lists, but for a list that is
-(necessarily) the primary user support route for a crypto package, they
-are very important.  This is *not* an ordinary mailing list; it has to
-function under awkward constraints that make various simplistic solutions
-inapplicable or undesirable. 
-
-&gt; We're *ALL* sick of hearing about list management problems, not just you
-&gt; old-timers, so why don't you DO SOMETHING EFFECTIVE ABOUT IT...
-
-Because it's a lot harder than it looks, and many existing "solutions"
-have problems when examined closely.
-
-&gt; A suggestion for you, based on 10 years of experience with management of my
-&gt; own mailing lists would be to use mailman, which includes pretty much every
-&gt; feature under the sun that you guys need and want, plus some.  The URL for
-&gt; mailman...
-
-I assure you, we're aware of mailman.  Along with a whole bunch of others,
-including some you almost certainly have never heard of (I hadn't!).
-
-&gt; As for the argument that the list shouldn't be configured to enforce
-&gt; subscription - I contend that it *SHOULD* AT LEAST require manual address
-&gt; verification in order for posts to be redirected.
-
-You do realize, I hope, that interposing such a manual step might cause
-your government to decide that this is not truly a public forum, and thus
-you could go to jail if you don't get approval from them before mailing to
-it?  If you think this sounds irrational, your government is noted for
-making irrational decisions in this area; we can't assume that they will
-suddenly start being sensible.  See above about awkward constraints.  You
-may be willing to take the risk, but we can't, in good conscience, insist
-that all users with problems do so. 
-
-                                                          Henry Spencer
-                                                       henry@spsystems.net</pre>
-
-<p>and a message on the topic from project leader John Gilmore:</p>
-<pre>Subject: Re: The linux-ipsec list's topic
-   Date: Sat, 30 Dec 2000
-   From: John Gilmore &lt;gnu@toad.com&gt;
-
-I'll post this single message, once only, in this discussion, and then
-not burden the list with any further off-topic messages.  I encourage
-everyone on the list to restrain themself from posting ANY off-topic
-messages to the linux-ipsec list.
-
-The topic of the linux-ipsec mailing list is the FreeS/WAN software.
-
-I frequently see "discussions about spam on a list" overwhelm the
-volume of "actual spam" on a list. BOTH kinds of messages are
-off-topic messages.  Twenty anti-spam messages take just as long to
-detect and discard as twenty spam messages.
-
-The Linux-ipsec list encourages on-topic messages from people who have
-not joined the list itself.  We will not censor messages to the list
-based on where they originate, or what return address they contain.
-In other words, non-subscribers ARE allowed to post, and this will not
-change.  My own valid contributions have been rejected out-of-hand by
-too many other mailing lists for me to want to impose that censorship
-on anybody else's contributions.  And every day I see the damage that
-anti-spam zeal is causing in many other ways; that zeal is far more
-damaging to the culture of the Internet than the nuisance of spam.
-
-In general, it is the responsibility of recipients to filter,
-prioritize, or otherwise manage the handling of email that comes to
-them.  It is not the responsibility of the rest of the Internet
-community to refrain from sending messages to recipients that they
-might not want to see.  If your software infrastructure for managing
-your incoming email is insufficient, then improve it.  If you think
-the signal-to-noise ratio on linux-ipsec is too poor, then please
-unsubscribe.  But don't further increase the noise by posting to the
-linux-ipsec list about those topics.
-
-        John Gilmore
-        founder &amp; sponsor, FreeS/WAN project</pre>
-</body>
-</html>
diff --git a/doc/src/firewall.html b/doc/src/firewall.html
deleted file mode 100644
index 5051b458d..000000000
--- a/doc/src/firewall.html
+++ /dev/null
@@ -1,895 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>FreeS/WAN and firewalls</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, firewall, ipchains, iptables">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: firewall.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1><a name="firewall">FreeS/WAN and firewalls</a></h1>
-
-<p>FreeS/WAN, or other IPsec implementations, frequently run on gateway
-machines, the same machines running firewall or packet filtering code. This
-document discusses the relation between the two.</p>
-
-<p>The firewall code in 2.4 and later kernels is called Netfilter. The
-user-space utility to manage a firewall is iptables(8). See the <a
-href="http://netfilter.samba.org">netfilter/iptables web site</a> for
-details.</p>
-
-<h2><a name="filters">Filtering rules for IPsec packets</a></h2>
-
-<p>The basic constraint is that <strong>an IPsec gateway must have packet
-filters that allow IPsec packets</strong>, at least when talking to other
-IPsec gateways:</p>
-<ul>
-  <li>UDP port 500 for <a href="glossary.html#IKE">IKE</a> negotiations</li>
-  <li>protocol 50 if you use <a href="glossary.html#ESP">ESP</a> encryption
-    and/or authentication (the typical case)</li>
-  <li>protocol 51 if you use <a href="glossary.html#AH">AH</a> packet-level
-    authentication</li>
-</ul>
-
-<p>Your gateway and the other IPsec gateways it communicates with must be
-able to exchange these packets for IPsec to work. Firewall rules must allow
-UDP 500 and at least one of <a href="glossary.html#AH">AH</a> or 
-<a href="glossary.html#ESP">ESP</a> on
-the interface that communicates with the other gateway.</p>
-
-<p>For nearly all FreeS/WAN applications, you must allow UDP port 500 and the
-ESP protocol.</p>
-
-<p>There are two ways to set this up:</p>
-<dl>
-  <dt>easier but less flexible</dt>
-    <dd>Just set up your firewall scripts at boot time to allow IPsec packets
-      to and from your gateway. Let FreeS/WAN reject any bogus packets.</dd>
-  <dt>more work, giving you more precise control</dt>
-    <dd>Have the <a href="manpage.d/ipsec_pluto.8.html">ipsec_pluto(8)</a>
-      daemon call scripts to adjust firewall rules dynamically as required.
-      This is done by naming the scripts in the <a
-      href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> variables
-      <var>prepluto=</var>, <var>postpluto=</var>, <var>leftupdown=</var> and
-      <var>rightupdown=</var>.</dd>
-</dl>
-
-<p>Both methods are described in more detail below.</p>
-
-<h2><a name="examplefw">Firewall configuration at boot</a></h2>
-
-<p>It is possible to set up both firewalling and IPsec with appropriate
-scripts at boot and then not use <var>leftupdown=</var> and
-<var>rightupdown=</var>, or use them only for simple up and down
-operations.</p>
-
-<p>Basically, the technique is</p>
-<ul>
-  <li>allow IPsec packets (typically, IKE on UDP port 500 plus ESP, protocol
-    50)
-    <ul>
-      <li>incoming, if the destination address is your gateway (and
-        optionally, only from known senders)</li>
-      <li>outgoing, with the from address of your gateway (and optionally,
-        only to known receivers)</li>
-    </ul>
-  </li>
-  <li>let <a href="glossary.html#Pluto">Pluto</a> deal with IKE</li>
-  <li>let <a href="glossary.html#KLIPS">KLIPS</a> deal with ESP</li>
-</ul>
-
-<p>Since Pluto authenticates its partners during the negotiation, and KLIPS
-drops packets for which no tunnel has been negotiated, this may be all you
-need.</p>
-
-<h3><a name="simple.rules">A simple set of rules</a></h3>
-
-<p>In simple cases, you need only a few rules, as in this example:</p>
-<pre># allow IPsec
-#
-# IKE negotiations
-iptables -I INPUT  -p udp --sport 500 --dport 500 -j ACCEPT
-iptables -I OUTPUT -p udp --sport 500 --dport 500 -j ACCEPT
-# ESP encryption and authentication
-iptables -I INPUT  -p 50 -j ACCEPT
-iptables -I OUTPUT -p 50 -j ACCEPT
-</pre>
-
-<P>This should be all you need to allow IPsec through <var>lokkit</var>,
-which ships with Red Hat 9, on its medium security setting.
-Once you've tweaked to your satisfaction, save your active rule set with:</P>
-<PRE>service iptables save</PRE>
-
-<h3><a name="complex.rules">Other rules</a></h3>
-You can add additional rules, or modify existing ones, to work with IPsec and
-with your network and policies. We give a some examples in this section.
-
-<p>However, while it is certainly possible to create an elaborate set of
-rules yourself (please let us know via the <a href="mail.html">mailing
-list</a> if you do), it may be both easier and more secure to use a set which
-has already been published and tested.</p>
-
-<p>The published rule sets we know of are described in the <a
-href="#rules.pub">next section</a>.</p>
-
-<h4>Adding additional rules</h4>
-If necessary, you can add additional rules to:
-<dl>
-  <dt>reject IPsec packets that are not to or from known gateways</dt>
-    <dd>This possibility is discussed in more detail <a
-      href="#unknowngate">later</a></dd>
-  <dt>allow systems behind your gateway to build IPsec tunnels that pass
-  through the gateway</dt>
-    <dd>This possibility is discussed in more detail <a
-      href="#through">later</a></dd>
-  <dt>filter incoming packets emerging from KLIPS.</dt>
-    <dd>Firewall rules can recognise packets emerging from IPsec. They are
-      marked as arriving on an interface such as <var>ipsec0</var>, rather
-      than <var>eth0</var>, <var>ppp0</var> or whatever.</dd>
-</dl>
-
-<p>It is therefore reasonably straightforward to filter these packets in
-whatever way suits your situation.</p>
-
-<h4>Modifying existing rules</h4>
-
-<p>In some cases rules that work fine before you add IPsec may require
-modification to work with IPsec.</p>
-
-<p>This is especially likely for rules that deal with interfaces on the
-Internet side of your system. IPsec adds a new interface; often the rules
-must change to take account of that.</p>
-
-<p>For example, consider the rules given in <a
-href="http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-5.html">this
-section</a> of the Netfilter documentation:</p>
-<pre>Most people just have a single PPP connection to the Internet, and don't
-want anyone coming back into their network, or the firewall:
-
-    ## Insert connection-tracking modules (not needed if built into kernel).
-    # insmod ip_conntrack
-    # insmod ip_conntrack_ftp
-
-    ## Create chain which blocks new connections, except if coming from inside.
-    # iptables -N block
-    # iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
-    # iptables -A block -m state --state NEW -i ! ppp0 -j ACCEPT
-    # iptables -A block -j DROP
-
-    ## Jump to that chain from INPUT and FORWARD chains.
-    # iptables -A INPUT -j block
-    # iptables -A FORWARD -j block</pre>
-
-<p>On an IPsec gateway, those rules may need to be modified. The above allows
-new connections from <em>anywhere except ppp0</em>. That means new
-connections from ipsec0 are allowed.</p>
-
-<p>Do you want to allow anyone who can establish an IPsec connection to your
-gateway to initiate TCP connections to any service on your network? Almost
-certainly not if you are using opportunistic encryption. Quite possibly not
-even if you have only explicitly configured connections.</p>
-
-<p>To disallow incoming connections from ipsec0, change the middle section
-above to:</p>
-<pre>    ## Create chain which blocks new connections, except if coming from inside.
-    # iptables -N block
-    # iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
-    # iptables -A block -m state --state NEW -i ppp+ -j DROP
-    # iptables -A block -m state --state NEW -i ipsec+ -j DROP
-    # iptables -A block -m state --state NEW -i -j ACCEPT
-    # iptables -A block -j DROP</pre>
-
-<p>The original rules accepted NEW connections from anywhere except ppp0.
-This version drops NEW connections from any PPP interface (ppp+) and from any
-ipsec interface (ipsec+), then accepts the survivors.</p>
-
-<p>Of course, these are only examples. You will need to adapt them to your
-own situation.</p>
-
-<h3><a name="rules.pub">Published rule sets</a></h3>
-
-<p>Several sets of firewall rules that work with FreeS/WAN are available.</p>
-
-<h4><a name="Ranch.trinity">Scripts based on Ranch's work</a></h4>
-
-<p>One user, Rob Hutton, posted his boot time scripts to the mailing list,
-and we included them in previous versions of this documentation. They are
-still available from our <a
-href="http://www.freeswan.org/freeswan_trees/freeswan-1.5/doc/firewall.html#examplefw">web
-site</a>. However, they were for an earlier FreeS/WAN version so we no longer
-recommend them. Also, they had some bugs. See this <a
-href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/04/msg00316.html">message</a>.</p>
-
-<p>Those scripts were based on David Ranch's scripts for his "Trinity OS" for
-setting up a secure Linux. Check his <a
-href="http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html">home
-page</a> for the latest version and for information on his <a
-href="biblio.html#ranch">book</a> on securing Linux. If you are going to base
-your firewalling on Ranch's scripts, we recommend using his latest version,
-and sending him any IPsec modifications you make for incorporation into later
-versions.</p>
-
-<h4><a name="seawall">The Seattle firewall</a></h4>
-
-<p>We have had several mailing lists reports of good results using FreeS/WAN
-with Seawall (the Seattle Firewall). See that project's <a
-href="http://seawall.sourceforge.net/">home page</a> on Sourceforge.</p>
-
-<h4><a name="rcf">The RCF scripts</a></h4>
-
-<p>Another set of firewall scripts with IPsec support are the RCF or
-rc.firewall scripts. See their <a
-href="http://jsmoriss.mvlan.net/linux/rcf.html">home page</a>.</p>
-
-<h4><a name="asgard">Asgard scripts</a></h4>
-
-<p><a href="http://heimdall.asgardsrealm.net/linux/firewall/">Asgard's
-Realm</a> has set of firewall scripts with FreeS/WAN support, for 2.4 kernels
-and iptables.</p>
-
-<h4><a name="user.scripts">User scripts from the mailing list</a></h4>
-
-<p>One user gave considerable detail on his scripts, including supporting <a
-href="glossary.html#IPX">IPX</a> through the tunnel. His message was too long
-to conveniently be quoted here, so I've put it in a <a
-href="user_examples.html">separate file</a>.</p>
-
-<h2><a name="updown">Calling firewall scripts, named in ipsec.conf(5)</a></h2>
-
-<p>The <a href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> configuration
-file has three pairs of parameters used to specify an interface between
-FreeS/WAN and firewalling code.</p>
-
-<p>Note that using these is not required if you have a static firewall setup.
-In that case, you just set your firewall up at boot time (in a way that
-permits the IPsec connections you want) and do not change it thereafter. Omit
-all the FreeS/WAN firewall parameters and FreeS/WAN will not attempt to
-adjust firewall rules at all. See <a href="#examplefw">above</a> for some
-information on appropriate scripts.</p>
-
-<p>However, if you want your firewall rules to change when IPsec connections
-change, then you need to use these parameters.</p>
-
-<h3><a name="pre_post">Scripts called at IPsec start and stop</a></h3>
-
-<p>One pair of parmeters are set in the <var>config setup</var> section of
-the <a href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> file and affect
-all connections:</p>
-<dl>
-  <dt>prepluto=</dt>
-    <dd>script to be called before <a
-      href="manpage.d/ipsec_pluto.8.html">pluto(8)</a> IKE daemon is
-    started.</dd>
-  <dt>postpluto=</dt>
-    <dd>script to be called after <a
-      href="manpage.d/ipsec_pluto.8.html">pluto(8)</a> IKE daemon is
-    stopped.</dd>
-</dl>
-These parameters allow you to change firewall parameters whenever IPsec is
-started or stopped.
-
-<p>They can also be used in other ways. For example, you might have
-<var>prepluto</var> add a module to your kernel for the secure network
-interface or make a dialup connection, and then have <var>postpluto</var>
-remove the module or take the connection down.</p>
-
-<h3><a name="up_down">Scripts called at connection up and down</a></h3>
-
-<p>The other parameters are set in connection descriptions. They can be set
-in individual connection descriptions, and could even call different scripts
-for each connection for maximum flexibility. In most applications, however,
-it makes sense to use only one script and to call it from <var>conn
-%default</var> section so that it applies to all connections.</p>
-
-<p>You can:</p>
-<dl>
-  <dt><strong>either</strong></dt>
-    <dd>set <var>leftfirewall=yes</var> or <var>rightfirewall=yes</var> to
-      use our supplied default script</dd>
-  <dt><strong>or</strong></dt>
-    <dd>assign a name in a <var>leftupdown=</var> or <var>rightupdown=</var>
-      line to use your own script</dd>
-</dl>
-
-<p>Note that <strong>only one of these should be used</strong>. You cannot
-sensibly use both. Since <strong>our default script is obsolete</strong>
-(designed for firewalls using <var>ipfwadm(8)</var> on 2.0 kernels), most
-users who need this service will <strong>need to write a custom
-script</strong>.</p>
-
-<h4><a name="fw.default">The default script</a></h4>
-
-<p>We supply a default script named <var>_updown</var>.</p>
-<dl>
-  <dt>leftfirewall=</dt>
-    <dd></dd>
-  <dt>rightfirewall=</dt>
-    <dd>indicates that the gateway is doing firewalling and that <a
-      href="manpage.d/ipsec_pluto.8.html">pluto(8)</a> should poke holes in
-      the firewall as required.</dd>
-</dl>
-
-<p>Set these to <var>yes</var> and Pluto will call our default script
-<var>_updown</var> with appropriate arguments whenever it:</p>
-<ul>
-  <li>starts or stops IPsec services</li>
-  <li>brings a connection up or down</li>
-</ul>
-
-<p>The supplied default <var>_updown</var> script is appropriate for simple
-cases using the <var>ipfwadm(8)</var> firewalling package.</p>
-
-<h4><a name="userscript">User-written scripts</a></h4>
-
-<p>You can also write your own script and have Pluto call it. Just put the
-script's name in one of these <a
-href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> lines:</p>
-<dl>
-  <dt>leftupdown=</dt>
-    <dd></dd>
-  <dt>rightupdown=</dt>
-    <dd>specifies a script to call instead of our default script
-      <var>_updown</var>.</dd>
-</dl>
-
-<p>Your script should take the same arguments and use the same environment
-variables as <var>_updown</var>. See the "updown command" section of the <a
-href="manpage.d/ipsec_pluto.8.html">ipsec_pluto(8)</a> man page for
-details.</p>
-
-<p>Note that <strong>you should not modify our _updown script in
-place</strong>. If you did that, then upgraded FreeS/WAN, the upgrade would
-install a new default script, overwriting your changes.</p>
-
-<h3><a name="ipchains.script">Scripts for ipchains or iptables</a></h3>
-
-<p>Our <var>_updown</var> is for firewalls using <var>ipfwadm(8)</var>, the
-firewall code for the 2.0 series of Linux kernels. If you are using the more
-recent packages <var>ipchains(8)</var> (for 2.2 kernels) or
-<var>iptables(8)</var> (2.4 kernels), then you must do one of:</p>
-<ul>
-  <li>use static firewall rules which are set up at boot time as described <a
-    href="#examplefw">above</a> and do not need to be changed by Pluto</li>
-  <li>limit yourself to ipchains(8)'s ipfwadm(8) emulation mode in order to
-    use our script</li>
-  <li>write your own script and call it with <var>leftupdown</var> and
-    <var>rightupdown</var>.</li>
-</ul>
-
-<p>You can write a script to do whatever you need with firewalling. Specify
-its name in a <var>[left|right]updown=</var> parameter in <a
-href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> and Pluto will
-automatically call it for you.</p>
-
-<p>The arguments Pluto passes such a script are the same ones it passes to
-our default _updown script, so the best way to build yours is to copy ours
-and modify the copy.</p>
-
-<p>Note, however, that <strong>you should not modify our _updown script in
-place</strong>. If you did that, then upgraded FreeS/WAN, the upgrade would
-install a new default script, overwriting your changes.</p>
-
-<h2><a name="NAT">A complication: IPsec vs. NAT</a></h2>
-
-<p><a href="glossary.html#NAT.gloss">Network Address Translation</a>, also
-known as IP masquerading, is a method of allocating IP addresses dynamically,
-typically in circumstances where the total number of machines which need to
-access the Internet exceeds the supply of IP addresses.</p>
-
-<p>Any attempt to perform NAT operations on IPsec packets <em>between the
-IPsec gateways</em> creates a basic conflict:</p>
-<ul>
-  <li>IPsec wants to authenticate packets and ensure they are unaltered on a
-    gateway-to-gateway basis</li>
-  <li>NAT rewrites packet headers as they go by</li>
-  <li>IPsec authentication fails if packets are rewritten anywhere between
-    the IPsec gateways</li>
-</ul>
-
-<p>For <a href="glossary.html#AH">AH</a>, which authenticates parts of the
-packet header including source and destination IP addresses, this is fatal.
-If NAT changes those fields, AH authentication fails.</p>
-
-<p>For <a href="glossary.html#IKE">IKE</a> and <a
-href="glossary.html#ESP">ESP</a> it is not necessarily fatal, but is
-certainly an unwelcome complication.</p>
-
-<h3><a name="nat_ok">NAT on or behind the IPsec gateway works</a></h3>
-
-<p>This problem can be avoided by having the masquerading take place <em>on
-or behind</em> the IPsec gateway.</p>
-
-<p>This can be done physically with two machines, one physically behind the
-other. A picture, using SG to indicate IPsec <strong>S</strong>ecurity
-<strong>G</strong>ateways, is:</p>
-<pre>      clients --- NAT ----- SG ---------- SG
-                  two machines</pre>
-
-<p>In this configuration, the actual client addresses need not be given in
-the <var>leftsubnet=</var> parameter of the FreeS/WAN connection description.
-The security gateway just delivers packets to the NAT box; it needs only that
-machine's address. What that machine does with them does not affect
-FreeS/WAN.</p>
-
-<p>A more common setup has one machine performing both functions:</p>
-<pre>      clients ----- NAT/SG ---------------SG
-                  one machine</pre>
-
-<p>Here you have a choice of techniques depending on whether you want to make
-your client subnet visible to clients on the other end:</p>
-<ul>
-  <li>If you want the single gateway to behave like the two shown above, with
-    your clients hidden behind the NAT, then omit the <var>leftsubnet=</var>
-    parameter. It then defaults to the gateway address. Clients on the other
-    end then talk via the tunnel only to your gateway. The gateway takes
-    packets emerging from the tunnel, applies normal masquerading, and
-    forwards them to clients.</li>
-  <li>If you want to make your client machines visible, then give the client
-    subnet addresses as the <var>leftsubnet=</var> parameter in the
-    connection description and
-    <dl>
-      <dt>either</dt>
-        <dd>set <var>leftfirewall=yes</var> to use the default
-          <var>updown</var> script</dd>
-      <dt>or</dt>
-        <dd>use your own script by giving its name in a
-          <var>leftupdown=</var> parameter</dd>
-    </dl>
-    These scripts are described in their own <a href="#updown">section</a>.
-    <p>In this case, no masquerading is done. Packets to or from the client
-    subnet are encrypted or decrypted without any change to their client
-    subnet addresses, although of course the encapsulating packets use
-    gateway addresses in their headers. Clients behind the right security
-    gateway see a route via that gateway to the left subnet.</p>
-  </li>
-</ul>
-
-<h3><a name="nat_bad">NAT between gateways is problematic</a></h3>
-
-<p>We recommend not trying to build IPsec connections which pass through a
-NAT machine. This setup poses problems:</p>
-<pre>      clients --- SG --- NAT ---------- SG</pre>
-
-<p>If you must try it, some references are:</p>
-<ul>
-  <li>Jean_Francois Nadeau's document on doing <a
-    href="http://jixen.tripod.com/#NATed gateways">IPsec behind NAT</a></li>
-  <li><a href="web.html#VPN.masq">VPN masquerade patches</a> to make a Linux
-    NAT box handle IPsec packets correctly</li>
-</ul>
-
-<h3><a name="NAT.ref">Other references on NAT and IPsec</a></h3>
-
-<p>Other documents which may be relevant include:</p>
-<ul>
-  <li>an Internet Draft on <a
-    href="http://search.ietf.org/internet-drafts/draft-aboba-nat-ipsec-04.txt">IPsec
-    and NAT</a> which may eventually evolve into a standard solution for this
-    problem.</li>
-  <li>an informational <a
-    href="http://www.cis.ohio-state.edu/rfc/rfc2709.txt">RFC</a>,
-    <cite>Security Model with Tunnel-mode IPsec for NAT Domains</cite>.</li>
-  <li>an <a
-    href="http://www.cisco.com/warp/public/759/ipj_3-4/ipj_3-4_nat.html">article</a>
-    in Cisco's <cite>Internet Protocol Journal</cite></li>
-</ul>
-
-<h2><a name="complications">Other complications</a></h2>
-
-<p>Of course simply allowing UDP 500 and ESP packets is not the whole story.
-Various other issues arise in making IPsec and packet filters co-exist and
-even co-operate. Some of them are summarised below.</p>
-
-<h3><a name="through">IPsec <em>through</em></a> the gateway</h3>
-
-<p>Basic IPsec packet filtering rules deal only with packets addressed to or
-sent from your IPsec gateway.</p>
-
-<p>It is a separate policy decision whether to permit such packets to pass
-through the gateway so that client machines can build end-to-end IPsec
-tunnels of their own. This may not be practical if you are using <a
-href="#NAT">NAT (IP masquerade)</a> on your gateway, and may conflict with
-some corporate security policies.</p>
-
-<p>Where possible, allowing this is almost certainly a good idea. Using IPsec
-on an end-to-end basis is more secure than gateway-to-gateway.</p>
-
-<p>Doing it is quite simple. You just need firewall rules that allow UDP port
-500 and protocols 50 and 51 to pass through your gateway. If you wish, you
-can of course restrict this to certain hosts.</p>
-
-<h3><a name="ipsec_only">Preventing non-IPsec traffic</a></h3>
-You can also filter <em>everything but</em> UDP port 500 and ESP or AH to
-restrict traffic to IPsec only, either for anyone communicating with your
-host or just for specific partners.
-
-<p>One application of this is for the telecommuter who might have:</p>
-<pre>     Sunset==========West------------------East ================= firewall --- the Internet
-         home network      untrusted net        corporate network</pre>
-
-<p>The subnet on the right is 0.0.0.0/0, the whole Internet. The West gateway
-is set up so that it allows only IPsec packets to East in or out.</p>
-
-<p>This configuration is used in AT&amp;T Research's network. For details,
-see the <a href="intro.html#applied">papers</a> links in our introduction.</p>
-
-<p>Another application would be to set up firewall rules so that an internal
-machine, such as an employees-only web server, could not talk to the outside
-world except via specific IPsec tunnels.</p>
-
-<h3><a name="unknowngate">Filtering packets from unknown gateways</a></h3>
-
-<p>It is possible to use firewall rules to restrict UDP 500, ESP and AH
-packets so that these packets are accepted only from known gateways. This is
-not strictly necessary since FreeS/WAN will discard packets from unknown
-gateways. You might, however, want to do it for any of a number of reasons.
-For example:</p>
-<ul>
-  <li>Arguably, "belt and suspenders" is the sensible approach to security.
-    If you can block a potential attack in two ways, use both. The only
-    question is whether to look for a third way after implementing the first
-    two.</li>
-  <li>Some admins may prefer to use the firewall code this way because they
-    prefer firewall logging to FreeS/WAN's logging.</li>
-  <li>You may need it to implement your security policy. Consider an employee
-    working at home, and a policy that says traffic from the home system to
-    the Internet at large must go first via IPsec to the corporate LAN and
-    then out to the Internet via the corporate firewall. One way to do that
-    is to make <var>ipsec0</var> the default route on the home gateway and
-    provide exceptions only for UDP 500 and ESP to the corporate gateway.
-    Everything else is then routed via the tunnel to the corporate
-  gateway.</li>
-</ul>
-
-<p>It is not possible to use only static firewall rules for this filtering if
-you do not know the other gateways' IP addresses in advance, for example if
-you have "road warriors" who may connect from a different address each time
-or if want to do <a href="glossary.html#carpediem">opportunistic
-encryption</a> to arbitrary gateways. In these cases, you can accept UDP 500
-IKE packets from anywhere, then use the <a href="#updown">updown</a> script
-feature of <a href="manpage.d/ipsec_pluto.8.html">pluto(8)</a> to dynamically
-adjust firewalling for each negotiated tunnel.</p>
-
-<p>Firewall packet filtering does not much reduce the risk of a <a
-href="glossary.html#DOS">denial of service attack</a> on FreeS/WAN. The
-firewall can drop packets from unknown gateways, but KLIPS does that quite
-efficiently anyway, so you gain little. The firewall cannot drop otherwise
-legitmate packets that fail KLIPS authentication, so it cannot protect
-against an attack designed to exhaust resources by making FreeS/WAN perform
-many expensive authentication operations.</p>
-
-<p>In summary, firewall filtering of IPsec packets from unknown gateways is
-possible but not strictly necessary.</p>
-
-<h2><a name="otherfilter">Other packet filters</a></h2>
-
-<p>When the IPsec gateway is also acting as your firewall, other packet
-filtering rules will be in play. In general, those are outside the scope of
-this document. See our <a href="web.html#firewall.linux">Linux firewall
-links</a> for information. There are a few types of packet, however, which
-can affect the operation of FreeS/WAN or of diagnostic tools commonly used
-with it. These are discussed below.</p>
-
-<h3><a name="ICMP">ICMP filtering</a></h3>
-
-<p><a href="glossary.html#ICMP.gloss">ICMP</a> is the
-<strong>I</strong>nternet <strong>C</strong>ontrol <strong>M</strong>essage
-<strong>P</strong>rotocol. It is used for messages between IP implementations
-themselves, whereas IP used is used between the clients of those
-implementations. ICMP is, unsurprisingly, used for control messages. For
-example, it is used to notify a sender that a desination is not reachable, or
-to tell a router to reroute certain packets elsewhere.</p>
-
-<p>ICMP handling is tricky for firewalls.</p>
-<ul>
-  <li>You definitely want some ICMP messages to get through; things won't
-    work without them. For example, your clients need to know if some
-    destination they ask for is unreachable.</li>
-  <li>On the other hand, you do equally definitely do not want untrusted folk
-    sending arbitrary control messages to your machines. Imagine what someone
-    moderately clever and moderately malicious could do to you, given control
-    of your network's routing.</li>
-</ul>
-
-<p>ICMP does not use ports. Messages are distinguished by a "message type"
-field and, for some types, by an additional "code" field. The definitive list
-of types and codes is on the <a href="http://www.iana.org">IANA</a> site.</p>
-
-<p>One expert uses this definition for ICMP message types to be dropped at
-the firewall.</p>
-<pre># ICMP types which lack socially redeeming value.
-#  5     Redirect
-#  9     Router Advertisement
-# 10     Router Selection
-# 15     Information Request
-# 16     Information Reply
-# 17     Address Mask Request
-# 18     Address Mask Reply
-
-badicmp='5 9 10 15 16 17 18'</pre>
-
-<p>A more conservative approach would be to make a list of allowed types and
-drop everything else.</p>
-
-<p>Whichever way you do it, your ICMP filtering rules on a FreeS/WAN gateway
-should allow at least the following ICMP packet types:</p>
-<dl>
-  <dt>echo (type 8)</dt>
-    <dd></dd>
-  <dt>echo reply (type 0)</dt>
-    <dd>These are used by ping(1). We recommend allowing both types through
-      the tunnel and to or from your gateway's external interface, since
-      ping(1) is an essential testing tool.
-      <p>It is fairly common for firewalls to drop ICMP echo packets
-      addressed to machines behind the firewall. If that is your policy,
-      please create an exception for such packets arriving via an IPsec
-      tunnel, at least during intial testing of those tunnels.</p>
-    </dd>
-  <dt>destination unreachable (type 3)</dt>
-    <dd>This is used, with code 4 (Fragmentation Needed and Don't Fragment
-      was Set) in the code field, to control <a
-      href="glossary.html#pathMTU">path MTU discovery</a>. Since IPsec
-      processing adds headers, enlarges packets and may cause fragmentation,
-      an IPsec gateway should be able to send and receive these ICMP messages
-      <strong>on both inside and outside interfaces</strong>.</dd>
-</dl>
-
-<h3><a name="traceroute">UDP packets for traceroute</a></h3>
-
-<p>The traceroute(1) utility uses UDP port numbers from 33434 to
-approximately 33633. Generally, these should be allowed through for
-troubleshooting.</p>
-
-<p>Some firewalls drop these packets to prevent outsiders exploring the
-protected network with traceroute(1). If that is your policy, consider
-creating an exception for such packets arriving via an IPsec tunnel, at least
-during intial testing of those tunnels.</p>
-
-<h3><a name="l2tp">UDP for L2TP</a></h3>
-<p>
-Windows 2000 does, and products designed for compatibility with it may, build
-<a href="glossary.html#L2TP">L2TP</a> tunnels over IPsec connections.
-
-<p>For this to work, you must allow UDP protocol 1701 packets coming out of
-your tunnels to continue to their destination. You can, and probably should,
-block such packets to or from your external interfaces, but allow them from
-<var>ipsec0</var>.</p>
-
-<p>See also our Windows 2000 <a href="interop.html#win2k">interoperation
-discussion</a>.</p>
-
-<h2><a name="packets">How it all works: IPsec packet details</a></h2>
-
-<p>IPsec uses three main types of packet:</p>
-<dl>
-  <dt><a href="glossary.html#IKE">IKE</a> uses <strong>the UDP protocol and
-  port 500</strong>.</dt>
-    <dd>Unless you are using only (less secure, not recommended) manual
-      keying, you need IKE to negotiate connection parameters, acceptable
-      algorithms, key sizes and key setup. IKE handles everything required to
-      set up, rekey, repair or tear down IPsec connections.</dd>
-  <dt><a href="glossary.html#ESP">ESP</a> is <strong>protocol number
-  50</strong></dt>
-    <dd>This is required for encrypted connections.</dd>
-  <dt><a href="glossary.html#AH">AH</a> is <strong>protocol number
-  51</strong></dt>
-    <dd>This can be used where only authentication, not encryption, is
-      required.</dd>
-</dl>
-
-<p>All of those packets should have appropriate IPsec gateway addresses in
-both the to and from IP header fields. Firewall rules can check this if you
-wish, though it is not strictly necessary. This is discussed in more detail
-<a href="#unknowngate">later</a>.</p>
-
-<p>IPsec processing of incoming packets authenticates them then removes the
-ESP or AH header and decrypts if necessary. Successful processing exposes an
-inner packet which is then delivered back to the firewall machinery, marked
-as having arrived on an <var>ipsec[0-3]</var> interface. Firewall rules can
-use that interface label to distinguish these packets from unencrypted
-packets which are labelled with the physical interface they arrived on (or
-perhaps with a non-IPsec virtual interface such as <var>ppp0</var>).</p>
-
-<p>One of our users sent a mailing list message with a <a
-href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/12/msg00006.html">diagram</a>
-of the packet flow.</p>
-
-<h3><a name="noport">ESP and AH do not have ports</a></h3>
-
-<p>Some protocols, such as TCP and UDP, have the notion of ports. Others
-protocols, including ESP and AH, do not. Quite a few IPsec newcomers have
-become confused on this point. There are no ports <em>in</em> the ESP or AH
-protocols, and no ports used <em>for</em> them. For these protocols, <em>the
-idea of ports is completely irrelevant</em>.</p>
-
-<h3><a name="header">Header layout</a></h3>
-
-<p>The protocol numbers for ESP or AH are used in the 'next header' field of
-the IP header. On most non-IPsec packets, that field would have one of:</p>
-<ul>
-  <li>1 for ICMP</li>
-  <li>4 for IP-in-IP encapsulation</li>
-  <li>6 for TCP</li>
-  <li>17 for UDP</li>
-  <li>... or one of about 100 other possibilities listed by <a
-    href="http://www.iana.org">IANA</a></li>
-</ul>
-
-<p>Each header in the sequence tells what the next header will be. IPsec adds
-headers for ESP or AH near the beginning of the sequence. The original
-headers are kept and the 'next header' fields adjusted so that all headers
-can be correctly interpreted.</p>
-
-<p>For example, using <strong>[</strong> <strong>]</strong> to indicate data
-protected by ESP and unintelligible to an eavesdropper between the
-gateways:</p>
-<ul>
-  <li>a simple packet might have only IP and TCP headers with:
-    <ul>
-      <li>IP header says next header --&gt; TCP</li>
-      <li>TCP header port number --&gt; which process to send data to</li>
-      <li>data</li>
-    </ul>
-  </li>
-  <li>with ESP <a href="glossary.html#transport">transport mode</a>
-    encapsulation, that packet would have:
-    <ul>
-      <li>IP header says next header --&gt; ESP</li>
-      <li>ESP header <strong>[</strong> says next --&gt; TCP</li>
-      <li>TCP header port number --&gt; which process to send data to</li>
-      <li>data <strong>]</strong></li>
-    </ul>
-    Note that the IP header is outside ESP protection, visible to an
-    attacker, and that the final destination must be the gateway.</li>
-  <li>with ESP in <a href="glossary.html#tunnel">tunnel mode</a>, we might
-    have:
-    <ul>
-      <li>IP header says next header --&gt; ESP</li>
-      <li>ESP header <strong>[</strong> says next --&gt; IP</li>
-      <li>IP header says next header --&gt; TCP</li>
-      <li>TCP header port number --&gt; which process to send data to</li>
-      <li>data <strong>]</strong></li>
-    </ul>
-    Here the inner IP header is protected by ESP, unreadable by an attacker.
-    Also, the inner header can have a different IP address than the outer IP
-    header, so the decrypted packet can be routed from the IPsec gateway to a
-    final destination which may be another machine.</li>
-</ul>
-
-<p>Part of the ESP header itself is encrypted, which is why the
-<strong>[</strong> indicating protected data appears in the middle of some
-lines above. The next header field of the ESP header is protected. This makes
-<a href="glossary.html#traffic">traffic analysis</a> more difficult. The next
-header field would tell an eavesdropper whether your packet was UDP to the
-gateway, TCP to the gateway, or encapsulated IP. It is better not to give
-this information away. A clever attacker may deduce some of it from the
-pattern of packet sizes and timings, but we need not make it easy.</p>
-
-<p>IPsec allows various combinations of these to match local policies,
-including combinations that use both AH and ESP headers or that nest multiple
-copies of these headers.</p>
-
-<p>For example, suppose my employer has an IPsec VPN running between two
-offices so all packets travelling between the gateways for those offices are
-encrypted. If gateway policies allow it (The admins could block UDP 500 and
-protocols 50 and 51 to disallow it), I can build an IPsec tunnel from my
-desktop to a machine in some remote office. Those packets will have one ESP
-header throughout their life, for my end-to-end tunnel. For part of the
-route, however, they will also have another ESP layer for the corporate VPN's
-encapsulation. The whole header scheme for a packet on the Internet might
-be:</p>
-<ul>
-  <li>IP header (with gateway address) says next header --&gt; ESP</li>
-  <li>ESP header <strong>[</strong> says next --&gt; IP</li>
-  <li>IP header (with receiving machine address) says next header --&gt;
-  ESP</li>
-  <li>ESP header <strong>[</strong> says next --&gt; TCP</li>
-  <li>TCP header port number --&gt; which process to send data to</li>
-  <li>data <strong>]]</strong></li>
-</ul>
-
-<p>The first ESP (outermost) header is for the corporate VPN. The inner ESP
-header is for the secure machine-to-machine link.</p>
-
-<h3><a name="dhr">DHR on the updown script</a></h3>
-
-<p>Here are some mailing list comments from <a
-href="manpage.d/ipsec_pluto.8.html">pluto(8)</a> developer Hugh Redelmeier on
-an earlier draft of this document:</p>
-<pre>There are many important things left out
-
-- firewalling is important but must reflect (implement) policy.  Since
-  policy isn't the same for all our customers, and we're not experts,
-  we should concentrate on FW and MASQ interactions with FreeS/WAN.
-
-- we need a diagram to show packet flow WITHIN ONE MACHINE, assuming
-  IKE, IPsec, FW, and MASQ are all done on that machine.  The flow is
-  obvious if the components are run on different machines (trace the
-  cables).
-
-  IKE input:
-        + packet appears on public IF, as UDP port 500
-        + input firewalling rules are applied (may discard)
-        + Pluto sees the packet.
-
-  IKE output:
-        + Pluto generates the packet &amp; writes to public IF, UDP port 500
-        + output firewalling rules are applied (may discard)
-        + packet sent out public IF
-
-  IPsec input, with encapsulated packet, outer destination of this host:
-        + packet appears on public IF, protocol 50 or 51.  If this
-          packet is the result of decapsulation, it will appear
-          instead on the paired ipsec IF.
-        + input firewalling rules are applied (but packet is opaque)
-        + KLIPS decapsulates it, writes result to paired ipsec IF
-        + input firewalling rules are applied to resulting packet
-          as input on ipsec IF
-        + if the destination of the packet is this machine, the
-          packet is passed on to the appropriate protocol handler.
-          If the original packet was encapsulated more than once
-          and the new outer destination is this machine, that
-          handler will be KLIPS.
-        + otherwise:
-          * routing is done for the resulting packet.  This may well
-            direct it into KLIPS for encoding or encrypting.  What
-            happens then is described elsewhere.
-          * forwarding firewalling rules are applied
-          * output firewalling rules are applied
-          * the packet is sent where routing specified
-
- IPsec input, with encapsulated packet, outer destination of another host:
-        + packet appears on some IF, protocol 50 or 51
-        + input firewalling rules are applied (but packet is opaque)
-        + routing selects where to send the packet
-        + forwarding firewalling rules are applied (but packet is opaque)
-        + packet forwarded, still encapsulated
-
-  IPsec output, from this host or from a client:
-        + if from a client, input firewalling rules are applied as the
-          packet arrives on the private IF
-        + routing directs the packet to an ipsec IF (this is how the
-          system decides KLIPS processing is required)
-        + if from a client, forwarding firewalling rules are applied
-        + KLIPS eroute mechanism matches the source and destination
-          to registered eroutes, yielding a SPI group.  This dictates
-          processing, and where the resulting packet is to be sent
-          (the destinations SG and the nexthop).
-        + output firewalling is not applied to the resulting
-          encapsulated packet
-
-- Until quite recently, KLIPS would double encapsulate packets that
-  didn't strictly need to be.  Firewalling should be prepared for
-  those packets showing up as ESP and AH protocol input packets on
-  an ipsec IF.
-
-- MASQ processing seems to be done as if it were part of the
-  forwarding firewall processing (this should be verified).
-
-- If a firewall is being used, it is likely the case that it needs to
-  be adjusted whenever IPsec SAs are added or removed.  Pluto invokes
-  a script to do this (and to adjust routing) at suitable times.  The
-  default script is only suitable for ipfwadm-managed firewalls.  Under
-  LINUX 2.2.x kernels, ipchains can be managed by ipfwadm (emulation),
-  but ipchains more powerful if manipulated using the ipchains command.
-  In this case, a custom updown script must be used.
-
-  We think that the flexibility of ipchains precludes us supplying an
-  updown script that would be widely appropriate.</pre>
-</body>
-</html>
diff --git a/doc/src/forwardingstate.txt b/doc/src/forwardingstate.txt
deleted file mode 100644
index 8853ac84e..000000000
--- a/doc/src/forwardingstate.txt
+++ /dev/null
@@ -1,35 +0,0 @@
-
- 
-      .--------------. 	 
-      | non-existant |
-      |    policy    |
-      `--------------'
-             |        
-             | PF_ACQUIRE
-             |           
-             |<---------.
-             V          | new packet
-      .--------------.  | (maybe resend PF_ACQUIRE)
-      |  hold policy |--'                          
-      |              |--.                          
-      `--------------'   \  pass                   
-         |        |       \ msg    .---------.     
-         |        |        \       V         | forward
-         |        |         .-------------.  | packet 
-  create |        |         | pass policy |--'       
-  IPsec  |        |         `-------------'          
-  SA     |        |                                  
-         |         \                                 
-         |          \                                
-         V           \ 	deny                         
-   .---------.        \ msg                          
-   | encrypt |         \                             
-   | policy  |          \         ,---------.        
-   `---------'           \        |         | discard
-                          \       V         | packet 
-                           .-------------.  |        
-                           | deny policy |--'        
-                           '-------------'          
-                                                   
-    
-$Id: forwardingstate.txt,v 1.1 2004/03/15 20:35:24 as Exp $
diff --git a/doc/src/glossary.html b/doc/src/glossary.html
deleted file mode 100644
index 38d0db7bb..000000000
--- a/doc/src/glossary.html
+++ /dev/null
@@ -1,2257 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>FreeS/WAN glossary</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, glossary, cryptography">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: glossary.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1><a name="ourgloss">Glossary for the Linux FreeS/WAN project</a></h1>
-
-<p>Entries are in alphabetical order. Some entries are only one line or one
-paragraph long. Others run to several paragraphs. I have tried to put the
-essential information in the first paragraph so you can skip the other
-paragraphs if that seems appropriate.</p>
-<hr>
-
-<h2><a name="jump">Jump to a letter in the glossary</a></h2>
-
-<center>
-<big><b><a href="#0">numeric</a> <a href="#A">A</a> <a href="#B">B</a> <a
-href="#C">C</a> <a href="#D">D</a> <a href="#E">E</a> <a href="#F">F</a> <a
-href="#G">G</a> <a href="#H">H</a> <a href="#I">I</a> <a href="#J">J</a> <a
-href="#K">K</a> <a href="#L">L</a> <a href="#M">M</a> <a href="#N">N</a> <a
-href="#O">O</a> <a href="#P">P</a> <a href="#Q">Q</a> <a href="#R">R</a> <a
-href="#S">S</a> <a href="#T">T</a> <a href="#U">U</a> <a href="#V">V</a> <a
-href="#W">W</a> <a href="#X">X</a> <a href="#Y">Y</a> <a
-href="#Z">Z</a></b></big></center>
-<hr>
-
-<h2><a name="gloss">Other glossaries</a></h2>
-
-<p>Other glossaries which overlap this one include:</p>
-<ul>
-  <li>The VPN Consortium's glossary of <a
-    href="http://www.vpnc.org/terms.html">VPN terms</a>.</li>
-  <li>glossary portion of the <a
-    href="http://www.rsa.com/rsalabs/faq/B.html">Cryptography FAQ</a></li>
-  <li>an extensive crytographic glossary on <a
-    href="http://www.ciphersbyritter.com/GLOSSARY.HTM">Terry Ritter's</a>
-    page.</li>
-  <li>The <a href="#NSA">NSA</a>'s <a
-    href="http://www.sans.org/newlook/resources/glossary.htm">glossary of
-    computer security</a> on the <a href="http://www.sans.org">SANS
-    Institute</a> site.</li>
-  <li>a small glossary for Internet Security at <a
-    href="http://www5.zdnet.com/pcmag/pctech/content/special/glossaries/internetsecurity.html">
-    PC magazine</a></li>
-  <li>The <a
-    href="http://www.visi.com/crypto/inet-crypto/glossary.html">glossary</a>
-    from Richard Smith's book <a href="#Smith">Internet Cryptography</a></li>
-</ul>
-
-<p>Several Internet glossaries are available as RFCs:</p>
-<ul>
-  <li><a href="http://www.rfc-editor.org/rfc/rfc1208.txt">Glossary of
-    Networking Terms</a></li>
-  <li><a href="http://www.rfc-editor.org/rfc/rfc1983.txt">Internet User's
-    Glossary</a></li>
-  <li><a href="http://www.rfc-editor.org/rfc/rfc2828.txt">Internet Security
-    Glossary</a></li>
-</ul>
-
-<p>More general glossary or dictionary information:</p>
-<ul>
-  <li>Free Online Dictionary of Computing (FOLDOC)
-    <ul>
-      <li><a href="http://www.nightflight.com/foldoc">North America</a></li>
-      <li><a
-      href="http://wombat.doc.ic.ac.uk/foldoc/index.html">Europe</a></li>
-      <li><a href="http://www.nue.org/foldoc/index.html">Japan</a></li>
-    </ul>
-    <p>There are many more mirrors of this dictionary.</p>
-  </li>
-  <li>The Jargon File, the definitive resource for hacker slang and folklore
-    <ul>
-      <li><a href="http://www.netmeg.net/jargon">North America</a></li>
-      <li><a href="http://info.wins.uva.nl/~mes/jargon/">Holland</a></li>
-      <li><a href="http://www.tuxedo.org/~esr/jargon">home page</a></li>
-    </ul>
-    <p>There are also many mirrors of this. See the home page for a list.</p>
-  </li>
-  <li>A general <a
-    href="http://www.trinity.edu/~rjensen/245glosf.htm#Navigate"> technology
-    glossary</a></li>
-  <li>An <a href="http://www.yourdictionary.com/">online dictionary resource
-    page</a> with pointers to many dictionaries for many languages</li>
-  <li>A <a href="http://www.onelook.com/">search engine</a> that accesses
-    several hundred online dictionaries</li>
-  <li>O'Reilly <a href="http://www.ora.com/reference/dictionary/">Dictionary
-    of PC Hardware and Data Communications Terms</a></li>
-  <li><a href="http://www.FreeSoft.org/CIE/index.htm">Connected</a> Internet
-    encyclopedia</li>
-  <li><a href="http://www.whatis.com/">whatis.com</a></li>
-</ul>
-<hr>
-
-<h2><a name="definitions">Definitions</a></h2>
-<dl>
-  <dt><a name="0">0</a></dt>
-  <dt><a name="3DES">3DES (Triple DES)</a></dt>
-    <dd>Using three <a href="#DES">DES</a> encryptions on a single data
-      block, with at least two different keys, to get higher security than is
-      available from a single DES pass. The three-key version of 3DES is the
-      default encryption algorithm for <a href="#FreeSWAN">Linux
-      FreeS/WAN</a>.
-      <p><a href="#IPSEC">IPsec</a> always does 3DES with three different
-      keys, as required by RFC 2451. For an explanation of the two-key
-      variant, see <a href="#2key">two key triple DES</a>. Both use an <a
-      href="#EDE">EDE</a> encrypt-decrypt-encrpyt sequence of operations.</p>
-      <p>Single <a href="#DES">DES</a> is <a
-      href="politics.html#desnotsecure">insecure</a>.</p>
-      <p>Double DES is ineffective. Using two 56-bit keys, one might expect
-      an attacker to have to do 2<sup>112</sup> work to break it. In fact,
-      only 2<sup>57</sup> work is required with a <a
-      href="#meet">meet-in-the-middle attack</a>, though a large amount of
-      memory is also required. Triple DES is vulnerable to a similar attack,
-      but that just reduces the work factor from the 2<sup>168</sup> one
-      might expect to 2<sup>112</sup>. That provides adequate protection
-      against <a href="#brute">brute force</a> attacks, and no better attack
-      is known.</p>
-      <p>3DES can be somewhat slow compared to other ciphers. It requires
-      three DES encryptions per block. DES was designed for hardware
-      implementation and includes some operations which are difficult in
-      software. However, the speed we get is quite acceptable for many uses.
-      See our <a href="performance.html">performance</a> document for
-      details.</p>
-    </dd>
-  <dt><a name="A">A</a></dt>
-  <dt><a name="active">Active attack</a></dt>
-    <dd>An attack in which the attacker does not merely eavesdrop (see <a
-      href="#passive">passive attack</a>) but takes action to change, delete,
-      reroute, add, forge or divert data. Perhaps the best-known active
-      attack is <a href="#middle">man-in-the-middle</a>. In general, <a
-      href="#authentication">authentication</a> is a useful defense against
-      active attacks.</dd>
-  <dt><a name="AES">AES</a></dt>
-    <dd>The <b>A</b>dvanced <b>E</b>ncryption <b>S</b>tandard -- a new <a
-      href="#block">block cipher</a> standard to replace <a
-      href="politics.html#desnotsecure">DES</a> -- developed by <a
-      href="#NIST">NIST</a>, the US National Institute of Standards and
-      Technology. DES used 64-bit blocks and a 56-bit key. AES ciphers use a
-      128-bit block and 128, 192 or 256-bit keys. The larger block size helps
-      resist <a href="#birthday">birthday attacks</a> while the large key
-      size prevents <a href="#brute">brute force attacks</a>.
-      <p>Fifteen proposals meeting NIST's basic criteria were submitted in
-      1998 and subjected to intense discussion and analysis, "round one"
-      evaluation. In August 1999, NIST narrowed the field to five "round two"
-      candidates:</p>
-      <ul>
-        <li><a href="http://www.research.ibm.com/security/mars.html">Mars</a>
-          from IBM</li>
-        <li><a href="http://www.rsa.com/rsalabs/aes/">RC6</a> from RSA</li>
-        <li><a
-          href="http://www.esat.kuleuven.ac.be/~rijmen/rijndael/">Rijndael</a>
-          from two Belgian researchers</li>
-        <li><a
-          href="http://www.cl.cam.ac.uk/~rja14/serpent.html">Serpent</a>, a
-          British-Norwegian-Israeli collaboration</li>
-        <li><a href="http://www.counterpane.com/twofish.html">Twofish</a>
-          from the consulting firm <a
-          href="http://www.counterpane.com">Counterpane</a></li>
-      </ul>
-      <p>Three of the five finalists -- Rijndael, Serpent and Twofish -- have
-      completely open licenses.</p>
-      <p>In October 2000, NIST announced the winner -- Rijndael.</p>
-      <p>For more information, see:</p>
-      <ul>
-        <li>NIST's <a
-          href="http://csrc.nist.gov/encryption/aes/aes_home.htm">AES home
-          page</a></li>
-        <li>the Block Cipher Lounge <a
-          href="http://www.ii.uib.no/~larsr/aes.html">AES page</a></li>
-        <li>Brian Gladman's <a
-          href="http://fp.gladman.plus.com/cryptography_technology/index.htm">code
-          and benchmarks</a></li>
-        <li>Helger Lipmaa's <a
-          href="http://www.tcs.hut.fi/~helger/aes/">survey of
-          implementations</a></li>
-      </ul>
-      <p>AES will be added to a future release of <a href="#FreeSWAN">Linux
-      FreeS/WAN</a>.  Likely we will add all three of the finalists with good
-      licenses. User-written <a href="web.html#patch">AES patches</a> are
-      already available.</p>
-      <p>Adding AES may also require adding stronger hashes, <a
-      href="#SHA-256">SHA-256, SHA-384 and SHA-512</a>.</p>
-    </dd>
-  <dt><a name="AH">AH</a></dt>
-    <dd>The <a href="#IPSEC">IPsec</a> <b>A</b>uthentication <b>H</b>eader,
-      added after the IP header. For details, see our <a
-      href="ipsec.html#AH.ipsec">IPsec</a> document and/or RFC 2402.</dd>
-  <dt><a name="alicebob">Alice and Bob</a></dt>
-    <dd>A and B, the standard example users in writing on cryptography and
-      coding theory. Carol and Dave join them for protocols which require
-      more players.
-      <p>Bruce Schneier extends these with many others such as Eve the
-      Eavesdropper and Victor the Verifier. His extensions seem to be in the
-      process of becoming standard as well. See page 23 of <a
-      href="biblio.html#schneier">Applied Cryptography</a></p>
-      <p>Alice and Bob have an amusing <a
-      href="http://www.conceptlabs.co.uk/alicebob.html"> biography</a> on the
-      web.</p>
-    </dd>
-  <dt>ARPA</dt>
-    <dd>see <a href="#DARPA">DARPA</a></dd>
-  <dt><a name="ASIO">ASIO</a></dt>
-    <dd>Australian Security Intelligence Organisation.</dd>
-  <dt>Asymmetric cryptography</dt>
-    <dd>See <a href="#public">public key cryptography</a>.</dd>
-  <dt><a name="authentication">Authentication</a></dt>
-    <dd>Ensuring that a message originated from the expected sender and has
-      not been altered on route. <a href="#IPSEC">IPsec</a> uses
-      authentication in two places:
-      <ul>
-        <li>peer authentication, authenticating the players in <a
-          href="#IKE">IKE</a>'s <a href="#DH">Diffie-Hellman</a> key
-          exchanges to prevent <a href="#middle">man-in-the-middle
-          attacks</a>. This can be done in a number of ways. The methods
-          supported by FreeS/WAN are discussed in our <a
-          href="adv_config.html#choose">advanced configuration</a>
-        document.</li>
-        <li>packet authentication, authenticating packets on an established
-          <a href="#SA">SA</a>, either with a separate <a
-          href="#AH">authentication header</a> or with the optional
-          authentication in the <a href="#ESP">ESP</a> protocol. In either
-          case, packet authentication uses a <a href="#HMAC">hashed message
-          athentication code</a> technique.</li>
-      </ul>
-      <p>Outside IPsec, passwords are perhaps the most common authentication
-      mechanism. Their function is essentially to authenticate the person's
-      identity to the system. Passwords are generally only as secure as the
-      network they travel over. If you send a cleartext password over a
-      tapped phone line or over a network with a packet sniffer on it, the
-      security provided by that password becomes zero. Sending an encrypted
-      password is no better; the attacker merely records it and reuses it at
-      his convenience. This is called a <a href="#replay">replay</a>
-      attack.</p>
-      <p>A common solution to this problem is a <a
-      href="#challenge">challenge-response</a> system. This defeats simple
-      eavesdropping and replay attacks. Of course an attacker might still try
-      to break the cryptographic algorithm used, or the <a
-      href="#random">random number</a> generator.</p>
-    </dd>
-  <dt><a name="auto">Automatic keying</a></dt>
-    <dd>A mode in which keys are automatically generated at connection
-      establisment and new keys automaically created periodically thereafter.
-      Contrast with <a href="#manual">manual keying</a> in which a single
-      stored key is used.
-      <p>IPsec uses the <a href="#DH">Diffie-Hellman key exchange
-      protocol</a> to create keys. An <a
-      href="#authentication">authentication</a> mechansim is required for
-      this. FreeS/WAN normally uses <a href="#RSA">RSA</a> for this. Other
-      methods supported are discussed in our <a
-      href="adv_config.html#choose">advanced configuration</a> document.</p>
-      <p>Having an attacker break the authentication is emphatically not a
-      good idea. An attacker that breaks authentication, and manages to
-      subvert some other network entities (DNS, routers or gateways), can use
-      a <a href="#middle">man-in-the middle attack</a> to break the security
-      of your IPsec connections.</p>
-      <p>However, having an attacker break the authentication in automatic
-      keying is not quite as bad as losing the key in manual keying.</p>
-      <ul>
-        <li>An attacker who reads /etc/ipsec.conf and gets the keys for a
-          manually keyed connection can, without further effort, read all
-          messages encrypted with those keys, including any old messages he
-          may have archived.</li>
-        <li>Automatic keying has a property called <a href="#PFS">perfect
-          forward secrecy</a>. An attacker who breaks the authentication gets
-          none of the automatically generated keys and cannot immediately
-          read any messages. He has to mount a successful <a
-          href="#middle">man-in-the-middle attack</a> in real time before he
-          can read anything. He cannot read old archived messages at all and
-          will not be able to read any future messages not caught by
-          man-in-the-middle tricks.</li>
-      </ul>
-      <p>That said, the secrets used for authentication, stored in <a
-      href="manpage.d/ipsec.secrets.5.html">ipsec.secrets(5)</a>, should
-      still be protected as tightly as cryptographic keys.</p>
-    </dd>
-  <dt><a name="B">B</a></dt>
-  <dt><a href="http://www.nortelnetworks.com">Bay Networks</a></dt>
-    <dd>A vendor of routers, hubs and related products, now a subsidiary of
-      Nortel. Interoperation between their IPsec products and Linux FreeS/WAN
-      was problematic at last report; see our <a
-      href="interop.html#bay">interoperation</a> section.</dd>
-  <dt><a name="benchmarks">benchmarks</a></dt>
-    <dd>Our default block cipher, <a href="#3DES">triple DES</a>, is slower
-      than many alternate ciphers that might be used. Speeds achieved,
-      however, seem adequate for many purposes. For example, the assembler
-      code from the <a href="#LIBDES">LIBDES</a> library we use encrypts 1.6
-      megabytes per second on a Pentium 200, according to the test program
-      supplied with the library.
-      <p>For more detail, see our document on <a
-      href="performance.html">FreeS/WAN performance</a>.</p>
-    </dd>
-  <dt><a name="BIND">BIND</a></dt>
-    <dd><b>B</b>erkeley <b>I</b>nternet <b>N</b>ame <b>D</b>aemon, a widely
-      used implementation of <a href="#DNS">DNS</a> (Domain Name Service).
-      See our bibliography for a <a href="#DNS">useful reference</a>. See the
-      <a href="http://www.isc.org/bind.html">BIND home page</a> for more
-      information and the latest version.</dd>
-  <dt><a name="birthday">Birthday attack</a></dt>
-    <dd>A cryptographic attack based on the mathematics exemplified by the <a
-      href="#paradox">birthday paradox</a>. This math turns up whenever the
-      question of two cryptographic operations producing the same result
-      becomes an issue:
-      <ul>
-        <li><a href="#collision">collisions</a> in <a href="#digest">message
-          digest</a> functions.</li>
-        <li>identical output blocks from a <a href="#block">block
-        cipher</a></li>
-        <li>repetition of a challenge in a <a
-          href="#challenge">challenge-response</a> system</li>
-      </ul>
-      <p>Resisting such attacks is part of the motivation for:</p>
-      <ul>
-        <li>hash algorithms such as <a href="#SHA">SHA</a> and <a
-          href="#RIPEMD">RIPEMD-160</a> giving a 160-bit result rather than
-          the 128 bits of <a href="#MD4">MD4</a>, <a href="#MD5">MD5</a> and
-          <a href="#RIPEMD">RIPEMD-128</a>.</li>
-        <li><a href="#AES">AES</a> block ciphers using a 128-bit block
-          instead of the 64-bit block of most current ciphers</li>
-        <li><a href="#IPSEC">IPsec</a> using a 32-bit counter for packets
-          sent on an <a href="#auto">automatically keyed</a> <a
-          href="#SA">SA</a> and requiring that the connection always be
-          rekeyed before the counter overflows.</li>
-      </ul>
-    </dd>
-  <dt><a name="paradox">Birthday paradox</a></dt>
-    <dd>Not really a paradox, just a rather counter-intuitive mathematical
-      fact. In a group of 23 people, the chance of a least one pair having
-      the same birthday is over 50%.
-      <p>The second person has 1 chance in 365 (ignoring leap years) of
-      matching the first. If they don't match, the third person's chances of
-      matching one of them are 2/365. The 4th, 3/365, and so on. The total of
-      these chances grows more quickly than one might guess.</p>
-    </dd>
-  <dt><a name="block">Block cipher</a></dt>
-    <dd>A <a href="#symmetric">symmetric cipher</a> which operates on
-      fixed-size blocks of plaintext, giving a block of ciphertext for each.
-      Contrast with <a href="#stream"> stream cipher</a>. Block ciphers can
-      be used in various <a href="#mode">modes</a> when multiple block are to
-      be encrypted.
-      <p><a href="#DES">DES</a> is among the the best known and widely used
-      block ciphers, but is now obsolete. Its 56-bit key size makes it <a
-      href="#desnotsecure">highly insecure</a> today. <a href="#3DES">Triple
-      DES</a> is the default block cipher for <a href="#FreeSWAN">Linux
-      FreeS/WAN</a>.</p>
-      <p>The current generation of block ciphers -- such as <a
-      href="#Blowfish">Blowfish</a>, <a href="#CAST128">CAST-128</a> and <a
-      href="#IDEA">IDEA</a> -- all use 64-bit blocks and 128-bit keys. The
-      next generation, <a href="#AES">AES</a>, uses 128-bit blocks and
-      supports key sizes up to 256 bits.</p>
-      <p>The <a href="http://www.ii.uib.no/~larsr/bc.html"> Block Cipher
-      Lounge</a> web site has more information.</p>
-    </dd>
-  <dt><a name="Blowfish">Blowfish</a></dt>
-    <dd>A <a href="#block">block cipher</a> using 64-bit blocks and keys of
-      up to 448 bits, designed by <a href="#schneier">Bruce Schneier</a> and
-      used in several products.
-      <p>This is not required by the <a href="#IPSEC">IPsec</a> RFCs and not
-      currently used in <a href="#FreeSWAN">Linux FreeS/WAN</a>.</p>
-    </dd>
-  <dt><a name="brute">Brute force attack (exhaustive search)</a></dt>
-    <dd>Breaking a cipher by trying all possible keys. This is always
-      possible in theory (except against a <a href="#OTP">one-time pad</a>),
-      but it becomes practical only if the key size is inadequate. For an
-      important example, see our document on the <a
-      href="#desnotsecure">insecurity of DES</a> with its 56-bit key. For an
-      analysis of key sizes required to resist plausible brute force attacks,
-      see <a href="http://www.counterpane.com/keylength.html">this paper</a>.
-      <p>Longer keys protect against brute force attacks. Each extra bit in
-      the key doubles the number of possible keys and therefore doubles the
-      work a brute force attack must do. A large enough key defeats
-      <strong>any</strong> brute force attack.</p>
-      <p>For example, the EFF's <a href="#EFF">DES Cracker</a> searches a
-      56-bit key space in an average of a few days. Let us assume an attacker
-      that can find a 64-bit key (256 times harder) by brute force search in
-      a second (a few hundred thousand times faster). For a 96-bit key, that
-      attacker needs 2<sup>32</sup> seconds, about 135 years. Against a
-      128-bit key, he needs 2<sup>32</sup> times that, over 500,000,000,000
-      years. Your data is then obviously secure against brute force attacks.
-      Even if our estimate of the attacker's speed is off by a factor of a
-      million, it still takes him over 500,000 years to crack a message.</p>
-      <p>This is why</p>
-      <ul>
-        <li>single <a href="#DES">DES</a> is now considered <a
-          href="#desnotsecure">dangerously insecure</a></li>
-        <li>all of the current generation of <a href="#block">block
-          ciphers</a> use a 128-bit or longer key</li>
-        <li><a href="#AES">AES</a> ciphers support keysizes 128, 192 and 256
-          bits</li>
-        <li>any cipher we add to Linux FreeS/WAN will have <em>at least</em>
-          a 128-bit key</li>
-      </ul>
-      <p><strong>Cautions:</strong><br>
-      <em>Inadequate keylength always indicates a weak cipher</em> but it is
-      important to note that <em>adequate keylength does not necessarily
-      indicate a strong cipher</em>. There are many attacks other than brute
-      force, and adequate keylength <em>only</em> guarantees resistance to
-      brute force. Any cipher, whatever its key size, will be weak if design
-      or implementation flaws allow other attacks.</p>
-      <p>Also, <em>once you have adequate keylength</em> (somewhere around 90
-      or 100 bits), <em>adding more key bits make no practical
-      difference</em>, even against brute force. Consider our 128-bit example
-      above that takes 500,000,000,000 years to break by brute force. We
-      really don't care how many zeroes there are on the end of that, as long
-      as the number remains ridiculously large. That is, we don't care
-      exactly how large the key is as long as it is large enough.</p>
-      <p>There may be reasons of convenience in the design of the cipher to
-      support larger keys. For example <a href="#Blowfish">Blowfish</a>
-      allows up to 448 bits and <a href="#RC4">RC4</a> up to 2048, but beyond
-      100-odd bits it makes no difference to practical security.</p>
-    </dd>
-  <dt>Bureau of Export Administration</dt>
-    <dd>see <a href="#BXA">BXA</a></dd>
-  <dt><a name="BXA">BXA</a></dt>
-    <dd>The US Commerce Department's <b>B</b>ureau of E<b>x</b>port
-      <b>A</b>dministration which administers the <a href="#EAR">EAR</a>
-      Export Administration Regulations controling the export of, among other
-      things, cryptography.</dd>
-  <dt><a name="C">C</a></dt>
-  <dt><a name="CA">CA</a></dt>
-    <dd><b>C</b>ertification <b>A</b>uthority, an entity in a <a
-      href="#PKI">public key infrastructure</a> that can certify keys by
-      signing them. Usually CAs form a hierarchy. The top of this hierarchy
-      is called the <a href="#rootCA">root CA</a>.
-      <p>See <a href="#web">Web of Trust</a> for an alternate model.</p>
-    </dd>
-  <dt><a name="CAST128">CAST-128</a></dt>
-    <dd>A <a href="#block">block cipher</a> using 64-bit blocks and 128-bit
-      keys, described in RFC 2144 and used in products such as <a
-      href="#Entrust">Entrust</a> and recent versions of <a
-      href="#PGP">PGP</a>.
-      <p>This is not required by the <a href="#IPSEC">IPsec</a> RFCs and not
-      currently used in <a href="#FreeSWAN">Linux FreeS/WAN</a>.</p>
-    </dd>
-  <dt>CAST-256</dt>
-    <dd><a href="#Entrust">Entrust</a>'s candidate cipher for the <a
-      href="#AES">AES standard</a>, largely based on the <a
-      href="#CAST128">CAST-128</a> design.</dd>
-  <dt><a name="CBC">CBC mode</a></dt>
-    <dd><b>C</b>ipher <b>B</b>lock <b>C</b>haining <a href="#mode">mode</a>,
-      a method of using a <a href="#block">block cipher</a> in which for each
-      block except the first, the result of the previous encryption is XORed
-      into the new block before it is encrypted. CBC is the mode used in <a
-      href="#IPSEC">IPsec</a>.
-      <p>An <a href="#IV">initialisation vector</a> (IV) must be provided. It
-      is XORed into the first block before encryption. The IV need not be
-      secret but should be different for each message and unpredictable.</p>
-    </dd>
-  <dt><a name="CIDR">CIDR</a></dt>
-    <dd><b>C</b>lassless <b>I</b>nter-<b>D</b>omain <b>R</b>outing,
-      an addressing scheme used to describe networks not
-      restricted to the old Class A, B, and C sizes.
-      A CIDR block is written
-      <VAR>address</VAR>/<VAR>mask</VAR>, where <VAR>address</VAR> is 
-      a 32-bit Internet address. 
-      The first <VAR>mask</VAR> bits of <VAR>address</VAR>
-      are part of the gateway address, while the remaining bits designate
-      other host addresses.
-      For example, the CIDR block 192.0.2.96/27 describes a network with 
-      gateway 
-      192.0.2.96, hosts 192.0.2.96 through 192.0.2.126 and broadcast 
-      192.0.2.127.
-      <p>FreeS/WAN policy group files accept CIDR blocks of the format
-      <VAR>address</VAR>/[<VAR>mask</VAR>], where <VAR>address</VAR> may
-      take the form <VAR>name.domain.tld</VAR>. An absent <VAR>mask</VAR>
-      is assumed to be /32.
-      </p> 
-    </dd>
-
-  <dt>Certification Authority</dt>
-    <dd>see <a href="#CA">CA</a></dd>
-  <dt><a name="challenge">Challenge-response authentication</a></dt>
-    <dd>An <a href="#authentication">authentication</a> system in which one
-      player generates a <a href="#random">random number</a>, encrypts it and
-      sends the result as a challenge. The other player decrypts and sends
-      back the result. If the result is correct, that proves to the first
-      player that the second player knew the appropriate secret, required for
-      the decryption. Variations on this technique exist using <a
-      href="#public">public key</a> or <a href="#symmetric">symmetric</a>
-      cryptography. Some provide two-way authentication, assuring each player
-      of the other's identity.
-      <p>This is more secure than passwords against two simple attacks:</p>
-      <ul>
-        <li>If cleartext passwords are sent across the wire (e.g. for
-          telnet), an eavesdropper can grab them. The attacker may even be
-          able to break into other systems if the user has chosen the same
-          password for them.</li>
-        <li>If an encrypted password is sent, an attacker can record the
-          encrypted form and use it later. This is called a replay
-        attack.</li>
-      </ul>
-      <p>A challenge-response system never sends a password, either cleartext
-      or encrypted.  An attacker cannot record the response to one challenge
-      and use it as a response to a later challenge. The random number is
-      different each time.</p>
-      <p>Of course an attacker might still try to break the cryptographic
-      algorithm used, or the <a href="#random">random number</a>
-      generator.</p>
-    </dd>
-  <dt><a name="mode">Cipher Modes</a></dt>
-    <dd>Different ways of using a block cipher when encrypting multiple
-      blocks.
-      <p>Four standard modes were defined for <a href="#DES">DES</a> in <a
-      href="#FIPS">FIPS</a> 81. They can actually be applied with any block
-      cipher.</p>
-
-      <table>
-        <tbody>
-          <tr>
-            <td></td>
-            <td><a href="#ECB">ECB</a></td>
-            <td>Electronic CodeBook</td>
-            <td>encrypt each block independently</td>
-          </tr>
-          <tr>
-            <td></td>
-            <td><a href="#CBC">CBC</a></td>
-            <td>Cipher Block Chaining<br>
-            </td>
-            <td>XOR previous block ciphertext into new block plaintext before
-              encrypting new block</td>
-          </tr>
-          <tr>
-            <td></td>
-            <td>CFB</td>
-            <td>Cipher FeedBack</td>
-            <td></td>
-          </tr>
-          <tr>
-            <td></td>
-            <td>OFB</td>
-            <td>Output FeedBack</td>
-            <td></td>
-          </tr>
-        </tbody>
-      </table>
-      <p><a href="#IPSEC">IPsec</a> uses <a href="#CBC">CBC</a> mode since
-      this is only marginally slower than <a href="#ECB">ECB</a> and is more
-      secure. In ECB mode the same plaintext always encrypts to the same
-      ciphertext, unless the key is changed. In CBC mode, this does not
-      occur.</p>
-      <p>Various other modes are also possible, but none of them are used in
-      IPsec.</p>
-    </dd>
-  <dt><a name="ciphertext">Ciphertext</a></dt>
-    <dd>The encrypted output of a cipher, as opposed to the unencrypted <a
-      href="#plaintext">plaintext</a> input.</dd>
-  <dt><a href="http://www.cisco.com">Cisco</a></dt>
-    <dd>A vendor of routers, hubs and related products. Their IPsec products
-      interoperate with Linux FreeS/WAN; see our <a
-      href="interop.html#Cisco">interop</a> section.</dd>
-  <dt><a name="client">Client</a></dt>
-    <dd>This term has at least two distinct uses in discussing IPsec:
-      <ul>
-        <li>The <strong>clients of an IPsec gateway</strong> are the machines
-          it protects, typically on one or more subnets behind the gateway.
-          In this usage, all the machines on an office network are clients of
-          that office's IPsec gateway. Laptop or home machines connecting to
-          the office, however, are <em>not</em> clients of that gateway. They
-          are remote gateways, running the other end of an IPsec connection.
-          Each of them is also its own client.</li>
-        <li><strong>IPsec client software</strong> is used to describe
-          software which runs on various standalone machines to let them
-          connect to IPsec networks. In this usage, a laptop or home machine
-          connecting to the office is a client, and the office gateway is the
-          server.</li>
-      </ul>
-      <p>We generally use the term in the first sense. Vendors of Windows
-      IPsec solutions often use it in the second. See this <a
-      href="interop.html#client.server">discussion</a>.</p>
-    </dd>
-  <dt><a name="cc">Common Criteria</a></dt>
-    <dd>A set of international security classifications which are replacing
-      the old US <a href="#rainbow">Rainbow Book</a> standards and similar
-      standards in other countries.
-      <p>Web references include this <a href="http://csrc.nist.gov/cc">US
-      government site</a> and this <a
-      href="http://www.commoncriteria.org">global home page</a>.</p>
-    </dd>
-  <dt>Conventional cryptography</dt>
-    <dd>See <a href="#symmetric">symmetric cryptography</a></dd>
-  <dt><a name="collision">Collision resistance</a></dt>
-    <dd>The property of a <a href="#digest">message digest</a> algorithm
-      which makes it hard for an attacker to find or construct two inputs
-      which hash to the same output.</dd>
-  <dt>Copyleft</dt>
-    <dd>see GNU <a href="#GPL">General Public License</a></dd>
-  <dt><a name="CSE">CSE</a></dt>
-    <dd><a href="http://www.cse-cst.gc.ca/">Communications Security
-      Establishment</a>, the Canadian organisation for <a
-      href="#SIGINT">signals intelligence</a>.</dd>
-  <dt><a name="D">D</a></dt>
-  <dt><a name="DARPA">DARPA (sometimes just ARPA)</a></dt>
-    <dd>The US government's <b>D</b>efense <b>A</b>dvanced <b>R</b>esearch
-      <b>P</b>rojects <b>A</b>gency. Projects they have funded over the years
-      have included the Arpanet which evolved into the Internet, the TCP/IP
-      protocol suite (as a replacement for the original Arpanet suite), the
-      Berkeley 4.x BSD Unix projects, and <a href="#SDNS">Secure DNS</a>.
-      <p>For current information, see their <a
-      href="http://www.darpa.mil/ito">web site</a>.</p>
-    </dd>
-  <dt><a name="DOS">Denial of service (DoS) attack</a></dt>
-    <dd>An attack that aims at denying some service to legitimate users of a
-      system, rather than providing a service to the attacker.
-      <ul>
-        <li>One variant is a flooding attack, overwhelming the system with
-          too many packets, to much email, or whatever.</li>
-        <li>A closely related variant is a resource exhaustion attack. For
-          example, consider a "TCP SYN flood" attack. Setting up a TCP
-          connection involves a three-packet exchange:
-          <ul>
-            <li>Initiator: Connection please (SYN)</li>
-            <li>Responder: OK (ACK)</li>
-            <li>Initiator: OK here too</li>
-          </ul>
-          <p>If the attacker puts bogus source information in the first
-          packet, such that the second is never delivered, the responder may
-          wait a long time for the third to come back. If responder has
-          already allocated memory for the connection data structures, and if
-          many of these bogus packets arrive, the responder may run out of
-          memory.</p>
-        </li>
-        <li>Another variant is to feed the system undigestible data, hoping
-          to make it sick. For example, IP packets are limited in size to 64K
-          bytes and a fragment carries information on where it starts within
-          that 64K and how long it is. The "ping of death" delivers fragments
-          that say, for example, that they start at 60K and are 20K long.
-          Attempting to re-assemble these without checking for overflow can
-          be fatal.</li>
-      </ul>
-      <p>The two example attacks discussed were both quite effective when
-      first discovered, capable of crashing or disabling many operating
-      systems. They were also well-publicised, and today far fewer systems
-      are vulnerable to them.</p>
-    </dd>
-  <dt><a name="DES">DES</a></dt>
-    <dd>The <b>D</b>ata <b>E</b>ncryption <b>S</b>tandard, a <a
-      href="#block">block cipher</a> with 64-bit blocks and a 56-bit key.
-      Probably the most widely used <a href="#symmetric">symmetric cipher</a>
-      ever devised. DES has been a US government standard for their own use
-      (only for unclassified data), and for some regulated industries such as
-      banking, since the late 70's. It is now being replaced by <a
-      href="#AES">AES</a>.
-      <p><a href="politics.html#desnotsecure">DES is seriously insecure
-      against current attacks.</a></p>
-      <p><a href="#FreeSWAN">Linux FreeS/WAN</a> does not include DES, even
-      though the RFCs specify it. <b>We strongly recommend that single DES
-      not be used.</b></p>
-      <p>See also <a href="#3DES">3DES</a> and <a href="#DESX">DESX</a>,
-      stronger ciphers based on DES.</p>
-    </dd>
-  <dt><a name="DESX">DESX</a></dt>
-    <dd>An improved <a href="#DES">DES</a> suggested by Ron Rivest of RSA
-      Data Security. It XORs extra key material into the text before and
-      after applying the DES cipher.
-      <p>This is not required by the <a href="#IPSEC">IPsec</a> RFCs and not
-      currently used in <a href="#FreeSWAN">Linux FreeS/WAN</a>. DESX would
-      be the easiest additional transform to add; there would be very little
-      code to write. It would be much faster than 3DES and almost certainly
-      more secure than DES. However, since it is not in the RFCs other IPsec
-      implementations cannot be expected to have it.</p>
-    </dd>
-  <dt>DH</dt>
-    <dd>see <a href="#DH">Diffie-Hellman</a></dd>
-  <dt><a name="DHCP">DHCP</a></dt>
-    <dd><strong>D</strong>ynamic <strong>H</strong>ost
-      <strong>C</strong>onfiguration <strong>P</strong>rotocol, a method of
-      assigning <a href="#dynamic">dynamic IP addresses</a>, and providing
-      additional information such as addresses of DNS servers and of
-      gateways. See this <a href="http://www.dhcp.org">DHCP resource
-    page.</a></dd>
-  <dt><a name="DH">Diffie-Hellman (DH) key exchange protocol</a></dt>
-    <dd>A protocol that allows two parties without any initial shared secret
-      to create one in a manner immune to eavesdropping. Once they have done
-      this, they can communicate privately by using that shared secret as a
-      key for a block cipher or as the basis for key exchange.
-      <p>The protocol is secure against all <a href="#passive">passive
-      attacks</a>, but it is not at all resistant to active <a
-      href="#middle">man-in-the-middle attacks</a>. If a third party can
-      impersonate Bob to Alice and vice versa, then no useful secret can be
-      created. Authentication of the participants is a prerequisite for safe
-      Diffie-Hellman key exchange. IPsec can use any of several <a
-      href="#authentication">authentication</a> mechanisims. Those supported
-      by FreeS/WAN are discussed in our <a
-      href="config.html#choose">configuration</a> section.</p>
-      <p>The Diffie-Hellman key exchange is based on the <a
-      href="#dlog">discrete logarithm</a> problem and is secure unless
-      someone finds an efficient solution to that problem.</p>
-      <p>Given a prime <var>p</var> and generator <var>g</var> (explained
-      under <a href="#dlog">discrete log</a> below), Alice:</p>
-      <ul>
-        <li>generates a random number <var>a</var></li>
-        <li>calculates <var>A = g^a modulo p</var></li>
-        <li>sends <var>A</var> to Bob</li>
-      </ul>
-      <p>Meanwhile Bob:</p>
-      <ul>
-        <li>generates a random number <var>b</var></li>
-        <li>calculates <var>B = g^b modulo p</var></li>
-        <li>sends <var>B</var> to Alice</li>
-      </ul>
-      <p>Now Alice and Bob can both calculate the shared secret <var>s =
-      g^(ab)</var>. Alice knows <var>a</var> and <var>B</var>, so she
-      calculates <var>s = B^a</var>. Bob knows <var>A</var> and <var>b</var>
-      so he calculates <var>s = A^b</var>.</p>
-      <p>An eavesdropper will know <var>p</var> and <var>g</var> since these
-      are made public, and can intercept <var>A</var> and <var>B</var> but,
-      short of solving the <a href="#dlog">discrete log</a> problem, these do
-      not let him or her discover the secret <var>s</var>.</p>
-    </dd>
-  <dt><a name="signature">Digital signature</a></dt>
-    <dd>Sender:
-      <ul>
-        <li>calculates a <a href="#digest">message digest</a> of a
-        document</li>
-        <li>encrypts the digest with his or her private key, using some <a
-          href="#public">public key cryptosystem</a>.</li>
-        <li>attaches the encrypted digest to the document as a signature</li>
-      </ul>
-      <p>Receiver:</p>
-      <ul>
-        <li>calculates a digest of the document (not including the
-        signature)</li>
-        <li>decrypts the signature with the signer's public key</li>
-        <li>verifies that the two results are identical</li>
-      </ul>
-      <p>If the public-key system is secure and the verification succeeds,
-      then the receiver knows</p>
-      <ul>
-        <li>that the document was not altered between signing and
-        verification</li>
-        <li>that the signer had access to the private key</li>
-      </ul>
-      <p>Such an encrypted message digest can be treated as a signature since
-      it cannot be created without <em>both</em> the document <em>and</em>
-      the private key which only the sender should possess. The <a
-      href="web.html#legal">legal issues</a> are complex, but several
-      countries are moving in the direction of legal recognition for digital
-      signatures.</p>
-    </dd>
-  <dt><a name="dlog">discrete logarithm problem</a></dt>
-    <dd>The problem of finding logarithms in a finite field. Given a field
-      defintion (such definitions always include some operation analogous to
-      multiplication) and two numbers, a base and a target, find the power
-      which the base must be raised to in order to yield the target.
-      <p>The discrete log problem is the basis of several cryptographic
-      systems, including the <a href="#DH">Diffie-Hellman</a> key exchange
-      used in the <a href="#IKE">IKE</a> protocol. The useful property is
-      that exponentiation is relatively easy but the inverse operation,
-      finding the logarithm, is hard. The cryptosystems are designed so that
-      the user does only easy operations (exponentiation in the field) but an
-      attacker must solve the hard problem (discrete log) to crack the
-      system.</p>
-      <p>There are several variants of the problem for different types of
-      field. The IKE/Oakley key determination protocol uses two variants,
-      either over a field modulo a prime or over a field defined by an
-      elliptic curve. We give an example modulo a prime below. For the
-      elliptic curve version, consult an advanced text such as <a
-      href="biblio.html#handbook">Handbook of Applied Cryptography</a>.</p>
-      <p>Given a prime <var>p</var>, a generator <var>g</var> for the field
-      modulo that prime, and a number <var>x</var> in the field, the problem
-      is to find <var>y</var> such that <var>g^y = x</var>.</p>
-      <p>For example, let p = 13. The field is then the integers from 0 to
-      12. Any integer equals one of these modulo 13. That is, the remainder
-      when any integer is divided by 13 must be one of these.</p>
-      <p>2 is a generator for this field.  That is, the powers of two modulo
-      13 run through all the non-zero numbers in the field. Modulo 13 we
-      have:</p>
-      <pre>          y      x
-        2^0  ==  1
-        2^1  ==  2
-        2^2  ==  4
-        2^3  ==  8
-        2^4  ==  3 that is, the remainder from 16/13 is 3
-        2^5  ==  6          the remainder from 32/13 is 6
-        2^6  == 12 and so on
-        2^7  == 11
-        2^8  ==  9
-        2^9  ==  5
-        2^10 == 10
-        2^11 ==  7
-        2^12 ==  1</pre>
-      <p>Exponentiation in such a field is not difficult. Given, say,
-      <nobr><var>y = 11</var>,</nobr>calculating <nobr><var>x =
-      7</var></nobr>is straightforward. One method is just to calculate
-      <nobr><var>2^11 = 2048</var>,</nobr>then <nobr><var>2048 mod 13 ==
-      7</var>.</nobr>When the field is modulo a large prime (say a few 100
-      digits) you need a silghtly cleverer method and even that is moderately
-      expensive in computer time, but the calculation is still not
-      problematic in any basic way.</p>
-      <p>The discrete log problem is the reverse. In our example, given
-      <nobr><var>x = 7</var>,</nobr>find the logarithm <nobr><var>y =
-      11</var>.</nobr>When the field is modulo a large prime (or is based on
-      a suitable elliptic curve), this is indeed problematic. No solution
-      method that is not catastrophically expensive is known. Quite a few
-      mathematicians have tackled this problem. No efficient method has been
-      found and mathematicians do not expect that one will be. It seems
-      likely no efficient solution to either of the main variants the
-      discrete log problem exists.</p>
-      <p>Note, however, that no-one has proven such methods do not exist. If
-      a solution to either variant were found, the security of any crypto
-      system using that variant would be destroyed.  This is one reason <a
-      href="#IKE">IKE</a> supports two variants. If one is broken, we can
-      switch to the other.</p>
-    </dd>
-  <dt><a name="discretionary">discretionary access control</a></dt>
-    <dd>access control mechanisms controlled by the user, for example Unix
-      rwx file permissions. These contrast with <a
-      href="#mandatory">mandatory access controls</a>.</dd>
-  <dt><a name="DNS">DNS</a></dt>
-    <dd><b>D</b>omain <b>N</b>ame <b>S</b>ervice, a distributed database
-      through which names are associated with numeric addresses and other
-      information in the Internet Protocol Suite. See also the <a
-      href="background.html#dns.background">DNS background</a> section of our
-      documentation.</dd>
-  <dt>DOS attack</dt>
-    <dd>see <a href="#DOS">Denial Of Service</a> attack</dd>
-  <dt><a name="dynamic">dynamic IP address</a></dt>
-    <dd>an IP address which is automatically assigned, either by <a
-      href="#DHCP">DHCP</a> or by some protocol such as <a
-      href="#PPP">PPP</a> or <a href="#PPPoE">PPPoE</a> which the machine
-      uses to connect to the Internet. This is the opposite of a <a
-      href="#static">static IP address</a>, pre-set on the machine
-    itself.</dd>
-  <dt><a name="E">E</a></dt>
-  <dt><a name="EAR">EAR</a></dt>
-    <dd>The US government's <b>E</b>xport <b>A</b>dministration
-      <b>R</b>egulations, administered by the <a href="#BXA">Bureau of Export
-      Administration</a>. These have replaced the earlier <a
-      href="#ITAR">ITAR</a> regulations as the controls on export of
-      cryptography.</dd>
-  <dt><a name="ECB">ECB mode</a></dt>
-    <dd><b>E</b>lectronic <b>C</b>ode<b>B</b>ook mode, the simplest way to
-      use a block cipher. See <a href="#mode">Cipher Modes</a>.</dd>
-  <dt><a name="EDE">EDE</a></dt>
-    <dd>The sequence of operations normally used in either the three-key
-      variant of <a href="#3DES">triple DES</a> used in <a
-      href="#IPSEC">IPsec</a> or the <a href="#2key">two-key</a> variant used
-      in some other systems.
-      <p>The sequence is:</p>
-      <ul>
-        <li><b>E</b>ncrypt with key1</li>
-        <li><b>D</b>ecrypt with key2</li>
-        <li><b>E</b>ncrypt with key3</li>
-      </ul>
-      <p>For the two-key version, key1=key3.</p>
-      <p>The "advantage" of this EDE order of operations is that it makes it
-      simple to interoperate with older devices offering only single DES. Set
-      key1=key2=key3 and you have the worst of both worlds, the overhead of
-      triple DES with the "security" of single DES. Since both the <a
-      href="politics.html#desnotsecure">security of single DES</a> and the
-      overheads of triple DES are seriously inferior to many other ciphers,
-      this is a spectacularly dubious "advantage".</p>
-    </dd>
-  <dt><a name="Entrust">Entrust</a></dt>
-    <dd>A Canadian company offerring enterprise <a href="#PKI">PKI</a>
-      products using <a href="#CAST128">CAST-128</a> symmetric crypto, <a
-      href="#RSA">RSA</a> public key and <a href="#X509">X.509</a>
-      directories. <a href="http://www.entrust.com">Web site</a></dd>
-  <dt><a name="EFF">EFF</a></dt>
-    <dd><a href="http://www.eff.org">Electronic Frontier Foundation</a>, an
-      advocacy group for civil rights in cyberspace.</dd>
-  <dt><a name="encryption">Encryption</a></dt>
-    <dd>Techniques for converting a readable message (<a
-      href="#plaintext">plaintext</a>) into apparently random material (<a
-      href="#ciphertext">ciphertext</a>) which cannot be read if intercepted.
-      A key is required to read the message.
-      <p>Major variants include <a href="#symmetric">symmetric</a> encryption
-      in which sender and receiver use the same secret key and <a
-      href="#public">public key</a> methods in which the sender uses one of a
-      matched pair of keys and the receiver uses the other. Many current
-      systems, including <a href="#IPSEC">IPsec</a>, are <a
-      href="#hybrid">hybrids</a> combining the two techniques.</p>
-    </dd>
-  <dt><a name="ESP">ESP</a></dt>
-    <dd><b>E</b>ncapsulated <b>S</b>ecurity <b>P</b>ayload, the <a
-      href="#IPSEC">IPsec</a> protocol which provides <a
-      href="#encryption">encryption</a>. It can also provide <a
-      href="#authentication">authentication</a> service and may be used with
-      null encryption (which we do not recommend). For details see our <a
-      href="ipsec.html#ESP.ipsec">IPsec</a> document and/or RFC 2406.</dd>
-  <dt><a name="#extruded">Extruded subnet</a></dt>
-    <dd>A situation in which something IP sees as one network is actually in
-      two or more places.
-      <p>For example, the Internet may route all traffic for a particular
-      company to that firm's corporate gateway. It then becomes the company's
-      problem to get packets to various machines on their <a
-      href="#subnet">subnets</a> in various departments. They may decide to
-      treat a branch office like a subnet, giving it IP addresses "on" their
-      corporate net. This becomes an extruded subnet.</p>
-      <p>Packets bound for it are delivered to the corporate gateway, since
-      as far as the outside world is concerned, that subnet is part of the
-      corporate network. However, instead of going onto the corporate LAN (as
-      they would for, say, the accounting department) they are then
-      encapsulated and sent back onto the Internet for delivery to the branch
-      office.</p>
-      <p>For information on doing this with Linux FreeS/WAN, look in our <a
-      href="adv_config.html#extruded.config">advanced configuration</a>
-      section.</p>
-    </dd>
-  <dt>Exhaustive search</dt>
-    <dd>See <a href="#brute">brute force attack</a>.</dd>
-  <dt><a name="F">F</a></dt>
-  <dt><a name="FIPS">FIPS</a></dt>
-    <dd><b>F</b>ederal <b>I</b>nformation <b>P</b>rocessing <b>S</b>tandard,
-      the US government's standards for products it buys. These are issued by
-      <a href="#NIST">NIST</a>. Among other things, <a href="#DES">DES</a>
-      and <a href="#SHA">SHA</a> are defined in FIPS documents. NIST have a
-      <a href="http://www.itl.nist.gov/div897/pubs">FIPS home page</a>.</dd>
-  <dt><a name="FSF">Free Software Foundation (FSF)</a></dt>
-    <dd>An organisation to promote free software, free in the sense of these
-      quotes from their web pages</dd>
-    <dd>
-      <blockquote>
-        "Free software" is a matter of liberty, not price. To understand the
-        concept, you should think of "free speech", not "free beer."
-        <p>"Free software" refers to the users' freedom to run, copy,
-        distribute, study, change and improve the software.</p>
-      </blockquote>
-      <p>See also <a href="#GNU">GNU</a>, <a href="#GPL">GNU General Public
-      License</a>, and <a href="http://www.fsf.org">the FSF site</a>.</p>
-    </dd>
-  <dt>FreeS/WAN</dt>
-    <dd>see <a href="#FreeSWAN">Linux FreeS/WAN</a></dd>
-  <dt><a name="fullnet">Fullnet</A></dt>
-    <dd>The CIDR block containing all IPs of its IP version. 
-    The <A HREF="#IPv4">IPv4</A> fullnet is written 0.0.0.0/0. 
-    Also known as "all" and "default",
-    fullnet may be used in a routing table 
-    to specify a default route, 
-    and in a FreeS/WAN 
-    <A HREF="policygroups.html#policygroups">policy group</A> file to 
-    specify a default IPsec policy.</dd>
-  <dt>FSF</dt>
-    <dd>see <a href="#FSF">Free software Foundation</a></dd>
-  <dt><a name="G">G</a></dt>
-  <dt><a name="GCHQ">GCHQ</a></dt>
-    <dd><a href="http://www.gchq.gov.uk">Government Communications
-      Headquarters</a>, the British organisation for <a
-      href="#SIGINT">signals intelligence</a>.</dd>
-  <dt>generator of a prime field</dt>
-    <dd>see <a href="#dlog">discrete logarithm problem</a></dd>
-  <dt><a name="GILC">GILC</a></dt>
-    <dd><a href="http://www.gilc.org">Global Internet Liberty Campaign</a>,
-      an international organisation advocating, among other things, free
-      availability of cryptography. They have a <a
-      href="http://www.gilc.org/crypto/wassenaar">campaign</a> to remove
-      cryptographic software from the <a href="#Wassenaar.gloss">Wassenaar
-      Arrangement</a>.</dd>
-  <dt>Global Internet Liberty Campaign</dt>
-    <dd>see <a href="#GILC">GILC</a>.</dd>
-  <dt><a name="GTR">Global Trust Register</a></dt>
-    <dd>An attempt to create something like a <a href="#rootCA">root CA</a>
-      for <a href="#PGP">PGP</a> by publishing both <a
-      href="biblio.html#GTR">as a book</a> and <a
-      href="http://www.cl.cam.ac.uk/Research/Security/Trust-Register"> on the
-      web</a> the fingerprints of a set of verified keys for well-known users
-      and organisations.</dd>
-  <dt><a name="GMP">GMP</a></dt>
-    <dd>The <b>G</b>NU <b>M</b>ulti-<b>P</b>recision library code, used in <a
-      href="#FreeSWAN">Linux FreeS/WAN</a> by <a href="#Pluto">Pluto</a> for
-      <a href="#public">public key</a> calculations. See the <a
-      href="http://www.swox.com/gmp">GMP  home page</a>.</dd>
-  <dt><a name="GNU">GNU</a></dt>
-    <dd><b>G</b>NU's <b>N</b>ot <b>U</b>nix, the <a href="#FSF">Free Software
-      Foundation's</a> project aimed at creating a free system with at least
-      the capabilities of Unix. <a href="#Linux">Linux</a> uses GNU utilities
-      extensively.</dd>
-  <dt><a name="#GOST">GOST</a></dt>
-    <dd>a Soviet government standard <a href="#block">block cipher</a>. <a
-      href="biblio.html#schneier">Applied Cryptography</a> has details.</dd>
-  <dt>GPG</dt>
-    <dd>see <a href="#GPG">GNU Privacy Guard</a></dd>
-  <dt><a name="GPL">GNU General Public License</a>(GPL, copyleft)</dt>
-    <dd>The license developed by the <a href="#FSF">Free Software
-      Foundation</a> under which <a href="#Linux">Linux</a>, <a
-      href="#FreeSWAN">Linux FreeS/WAN</a> and many other pieces of software
-      are distributed. The license allows anyone to redistribute and modify
-      the code, but forbids anyone from distributing executables without
-      providing access to source code. For more details see the file <a
-      href="../COPYING">COPYING</a> included with GPLed source distributions,
-      including ours, or <a href="http://www.fsf.org/copyleft/gpl.html"> the
-      GNU site's GPL page</a>.</dd>
-  <dt><a name="GPG">GNU Privacy Guard</a></dt>
-    <dd>An open source implementation of Open <a href="#PGP">PGP</a> as
-      defined in RFC 2440. See their <a href="http://www.gnupg.org">web
-      site</a></dd>
-  <dt>GPL</dt>
-    <dd>see <a href="#GPL">GNU General Public License</a>.</dd>
-  <dt><a name="H">H</a></dt>
-  <dt><a name="hash">Hash</a></dt>
-    <dd>see <a href="#digest">message digest</a></dd>
-  <dt><a name="HMAC">Hashed Message Authentication Code (HMAC)</a></dt>
-    <dd>using keyed <a href="#digest">message digest</a> functions to
-      authenticate a message. This differs from other uses of these functions:
-      <ul>
-        <li>In normal usage, the hash function's internal variable are
-          initialised in some standard way. Anyone can reproduce the hash to
-          check that the message has not been altered.</li>
-        <li>For HMAC usage, you initialise the internal variables from the
-          key. Only someone with the key can reproduce the hash. A successful
-          check of the hash indicates not only that the message is unchanged
-          but also that the creator knew the key.</li>
-      </ul>
-      <p>The exact techniques used in <a href="#IPSEC">IPsec</a> are defined
-      in RFC 2104. They are referred to as HMAC-MD5-96 and HMAC-SHA-96
-      because they output only 96 bits of the hash. This makes some attacks
-      on the hash functions harder.</p>
-    </dd>
-  <dt>HMAC</dt>
-    <dd>see <a href="#HMAC">Hashed Message Authentication Code</a></dd>
-  <dt>HMAC-MD5-96</dt>
-    <dd>see <a href="#HMAC">Hashed Message Authentication Code</a></dd>
-  <dt>HMAC-SHA-96</dt>
-    <dd>see <a href="#HMAC">Hashed Message Authentication Code</a></dd>
-  <dt><a name="hybrid">Hybrid cryptosystem</a></dt>
-    <dd>A system using both <a href="#public">public key</a> and <a
-      href="#symmetric">symmetric cipher</a> techniques. This works well.
-      Public key methods provide key management and <a
-      href="#signature">digital signature</a> facilities which are not
-      readily available using symmetric ciphers. The symmetric cipher,
-      however, can do the bulk of the encryption work much more efficiently
-      than public key methods.</dd>
-  <dt><a name="I">I</a></dt>
-  <dt><a name="IAB">IAB</a></dt>
-    <dd><a href="http://www.iab.org/iab">Internet Architecture Board</a>.</dd>
-  <dt><a name="ICMP.gloss">ICMP</a></dt>
-    <dd><strong>I</strong>nternet <strong>C</strong>ontrol
-      <strong>M</strong>essage <strong>P</strong>rotocol. This is used for
-      various IP-connected devices to manage the network.</dd>
-  <dt><a name="IDEA">IDEA</a></dt>
-    <dd><b>I</b>nternational <b>D</b>ata <b>E</b>ncrypion <b>A</b>lgorithm,
-      developed in Europe as an alternative to exportable American ciphers
-      such as <a href="#DES">DES</a> which were <a href="#desnotsecure">too
-      weak for serious use</a>. IDEA is a <a href="#block">block cipher</a>
-      using 64-bit blocks and 128-bit keys, and is used in products such as
-      <a href="#PGP">PGP</a>.
-      <p>IDEA is not required by the <a href="#IPSEC">IPsec</a> RFCs and not
-      currently used in <a href="#FreeSWAN">Linux FreeS/WAN</a>.</p>
-      <p>IDEA is patented and, with strictly limited exceptions for personal
-      use, using it requires a license from <a
-      href="http://www.ascom.com">Ascom</a>.</p>
-    </dd>
-  <dt><a name="IEEE">IEEE</a></dt>
-    <dd><a href="http://www.ieee.org">Institute of Electrical and Electronic
-      Engineers</a>, a professional association which, among other things,
-      sets some technical standards</dd>
-  <dt><a name="IESG">IESG</a></dt>
-    <dd><a href="http://www.iesg.org">Internet Engineering Steering
-    Group</a>.</dd>
-  <dt><a name="IETF">IETF</a></dt>
-    <dd><a href="http://www.ietf.org">Internet Engineering Task Force</a>,
-      the umbrella organisation whose various working groups make most of the
-      technical decisions for the Internet. The IETF <a
-      href="http://www.ietf.org/html.charters/ipsec-charter.html"> IPsec
-      working group</a> wrote the <a href="#RFC">RFCs</a> we are
-    implementing.</dd>
-  <dt><a name="IKE">IKE</a></dt>
-    <dd><b>I</b>nternet <b>K</b>ey <b>E</b>xchange, based on the <a
-      href="#DH">Diffie-Hellman</a> key exchange protocol. For details, see
-      RFC 2409 and our <a href="ipsec.html">IPsec</a> document. IKE is
-      implemented in <a href="#FreeSWAN">Linux FreeS/WAN</a> by the <a
-      href="#Pluto">Pluto daemon</a>.</dd>
-  <dt>IKE v2</dt>
-    <dd>A proposed replacement for <a href="#IKE">IKE</a>. There are other
-      candidates, such as <a href="#JFK">JFK</a>, and at time of writing
-      (March 2002) the choice between them has not yet been made and does not
-      appear imminent.</dd>
-  <dt><a name="iOE">iOE</a></dt>
-    <dd>See <A HREF="#initiate-only">Initiate-only opportunistic 
-     encryption</A>.</dd>
-  <dt><a name="IP">IP</a></dt>
-    <dd><b>I</b>nternet <b>P</b>rotocol.</dd>
-  <dt><a name="masq">IP masquerade</a></dt>
-    <dd>A mostly obsolete term for a method of allowing multiple machines to
-      communicate over the Internet when only one IP address is available for
-      their use. The more current term is Network Address Translation or <a
-      href="#NAT.gloss">NAT</a>.</dd>
-  <dt><a name="IPng">IPng</a></dt>
-    <dd>"IP the Next Generation", see <a href="#ipv6.gloss">IPv6</a>.</dd>
-  <dt><a name="IPv4">IPv4</a></dt>
-    <dd>The current version of the <a href="#IP">Internet protocol
-    suite</a>.</dd>
-  <dt><a name="ipv6.gloss">IPv6 (IPng)</a></dt>
-    <dd>Version six of the <a href="#IP">Internet protocol suite</a>,
-      currently being developed. It will replace the current <a
-      href="#IPv4">version four</a>. IPv6 has <a href="#IPSEC">IPsec</a> as a
-      mandatory component.
-      <p>See this <a
-      href="http://playground.sun.com/pub/ipng/html/ipng-main.html">web
-      site</a> for more details, and our <a
-      href="compat.html#ipv6">compatibility</a> document for information on
-      FreeS/WAN and the Linux implementation of IPv6.</p>
-    </dd>
-  <dt><a name="IPSEC">IPsec</a> or IPSEC</dt>
-    <dd><b>I</b>nternet <b>P</b>rotocol <b>SEC</b>urity, security functions
-      (<a href="#authentication">authentication</a> and <a
-      href="#encryption">encryption</a>) implemented at the IP level of the
-      protocol stack. It is optional for <a href="#IPv4">IPv4</a> and
-      mandatory for <a href="#ipv6.gloss">IPv6</a>.
-      <p>This is the standard <a href="#FreeSWAN">Linux FreeS/WAN</a> is
-      implementing. For more details, see our <a href="ipsec.html">IPsec
-      Overview</a>. For the standards, see RFCs listed in our <a
-      href="rfc.html#RFC">RFCs document</a>.</p>
-    </dd>
-  <dt><a name="IPX">IPX</a></dt>
-    <dd>Novell's Netware protocol tunnelled over an IP link. Our <a
-      href="firewall.html#user.scripts">firewalls</a> document includes an
-      example of using this through an IPsec tunnel.</dd>
-  <dt><a name="ISAKMP">ISAKMP</a></dt>
-    <dd><b>I</b>nternet <b>S</b>ecurity <b>A</b>ssociation and <b>K</b>ey
-      <b>M</b>anagement <b>P</b>rotocol, defined in RFC 2408.</dd>
-  <dt><a name="ITAR">ITAR</a></dt>
-    <dd><b>I</b>nternational <b>T</b>raffic in <b>A</b>rms
-      <b>R</b>egulations, US regulations administered by the State Department
-      which until recently limited export of, among other things,
-      cryptographic technology and software. ITAR still exists, but the
-      limits on cryptography have now been transferred to the <a
-      href="#EAR">Export Administration Regulations</a> under the Commerce
-      Department's <a href="#BXA">Bureau of Export Administration</a>.</dd>
-  <dt>IV</dt>
-    <dd>see <a href="#IV">Initialisation vector</a></dd>
-  <dt><a name="IV">Initialisation Vector (IV)</a></dt>
-    <dd>Some cipher <a href="#mode">modes</a>, including the <a
-      href="#CBC">CBC</a> mode which IPsec uses, require some extra data at
-      the beginning. This data is called the initialisation vector. It need
-      not be secret, but should be different for each message. Its function
-      is to prevent messages which begin with the same text from encrypting
-      to the same ciphertext. That might give an analyst an opening, so it is
-      best prevented.</dd>
-  <dt><a name="initiate-only">Initiate-only opportunistic 
-  encryption (iOE)</a></dt>
-    <dd>A form of 
-     <A HREF="#carpediem">opportunistic encryption</A> (OE) in which 
-     a host proposes opportunistic connections, but lacks the reverse DNS
-     records necessary to support incoming opportunistic connection requests.
-     Common among hosts on cable or pppoe connections where the system 
-     administrator does not have write access to the DNS reverse map
-     for the host's external IP.
-      <p>Configuring for initiate-only opportunistic encryption 
-       is described in our
-      <a href="quickstart.html#opp.client">quickstart</a> document.</p>
-    </dd>
-  <dt><a name="J">J</a></dt>
-  <dt><a name="JFK">JFK</a></dt>
-    <dd><strong>J</strong>ust <strong>F</strong>ast <strong>K</strong>eying,
-      a proposed simpler replacement for <a href="#IKE">IKE.</a></dd>
-  <dt><a name="K">K</a></dt>
-  <dt><a name="kernel">Kernel</a></dt>
-    <dd>The basic part of an operating system (e.g. Linux) which controls the
-      hardware and provides services to all other programs.
-      <p>In the Linux release numbering system, an even second digit as in
-      2.<strong>2</strong>.x indicates a stable or production kernel while an
-      odd number as in 2.<strong>3</strong>.x indicates an experimental or
-      development kernel. Most users should run a recent kernel version from
-      the production series. The development kernels are primarily for people
-      doing kernel development. Others should consider using development
-      kernels only if they have an urgent need for some feature not yet
-      available in production kernels.</p>
-    </dd>
-  <dt>Keyed message digest</dt>
-    <dd>See <a href="#HMAC">HMAC</a>.</dd>
-  <dt>Key length</dt>
-    <dd>see <a href="#brute">brute force attack</a></dd>
-  <dt><a name="KLIPS">KLIPS</a></dt>
-    <dd><b>K</b>erne<b>l</b> <b>IP</b> <b>S</b>ecurity, the <a
-      href="#FreeSWAN">Linux FreeS/WAN</a> project's changes to the <a
-      href="#Linux">Linux</a> kernel to support the <a
-      href="#IPSEC">IPsec</a> protocols.</dd>
-  <dt><a name="L">L</a></dt>
-  <dt><a name="LDAP">LDAP</a></dt>
-    <dd><b>L</b>ightweight <b>D</b>irectory <b>A</b>ccess <b>P</b>rotocol,
-      defined in RFCs 1777 and 1778,  a method of accessing information
-      stored in directories. LDAP is used by several <a href="#PKI">PKI</a>
-      implementations, often with X.501 directories and <a
-      href="#X509">X.509</a> certificates. It may also be used by <a
-      href="#IPSEC">IPsec</a> to obtain key certifications from those PKIs.
-      This is not yet implemented in <a href="#FreeSWAN">Linux
-    FreeS/WAN</a>.</dd>
-  <dt><a name="LIBDES">LIBDES</a></dt>
-    <dd>A publicly available library of <a href="#DES">DES</a> code, written
-      by Eric Young, which <a href="#FreeSWAN">Linux FreeS/WAN</a> uses in
-      both <a href="#KLIPS">KLIPS</a> and <a href="#Pluto">Pluto</a>.</dd>
-  <dt><a name="Linux">Linux</a></dt>
-    <dd>A freely available Unix-like operating system based on a kernel
-      originally written for the Intel 386 architecture by (then) student
-      Linus Torvalds. Once his 32-bit kernel was available, the <a
-      href="#GNU">GNU</a> utilities made it a usable system and contributions
-      from many others led to explosive growth.
-      <p>Today Linux is a complete Unix replacement available for several CPU
-      architectures -- Intel, DEC/Compaq Alpha, Power PC, both 32-bit SPARC
-      and the 64-bit UltraSPARC, SrongARM, . . . -- with support for multiple
-      CPUs on some architectures.</p>
-      <p><a href="#FreeSWAN">Linux FreeS/WAN</a> is intended to run on all
-      CPUs supported by Linux and is known to work on several. See our <a
-      href="compat.html#CPUs">compatibility</a> section for a list.</p>
-    </dd>
-  <dt><a name="FreeSWAN">Linux FreeS/WAN</a></dt>
-    <dd>Our implementation of the <a href="#IPSEC">IPsec</a> protocols,
-      intended to be freely redistributable source code with <a href="#GPL">a
-      GNU GPL license</a> and no constraints under US or other <a
-      href="politics.html#exlaw">export laws</a>. Linux FreeS/WAN is intended
-      to interoperate with other <a href="#IPSEC">IPsec</a> implementations.
-      The name is partly taken, with permission, from the <a
-      href="#SWAN">S/WAN</a> multi-vendor IPsec compatability effort. Linux
-      FreeS/WAN has two major components, <a href="#KLIPS">KLIPS</a> (KerneL
-      IPsec Support) and the <a href="#Pluto">Pluto</a> daemon which manages
-      the whole thing.
-      <p>See our <a href="ipsec.html">IPsec section</a> for more detail. For
-      the code see our <a href="http://freeswan.org"> primary site</a> or one
-      of the mirror sites on <a href="intro.html#mirrors">this list</a>.</p>
-    </dd>
-  <dt><a name="LSM">Linux Security Modules (LSM)</a></dt>
-    <dd>a project to create an interface in the Linux kernel that supports
-      plug-in modules for various security policies.
-      <p>This allows multiple security projects to take different approaches
-      to security enhancement without tying the kernel down to one particular
-      approach. As I understand the history, several projects were pressing
-      Linus to incorporate their changes, the various sets of changes were
-      incompatible, and his answer was more-or-less "a plague on all your
-      houses; I'll give you an interface, but I won't incorporate
-      anything".</p>
-      <p>It seems to be working. There is a fairly active <a
-      href="http://mail.wirex.com/mailman/listinfo/linux-security-module">LSM
-      mailing list</a>, and several projects are already using the
-      interface.</p>
-    </dd>
-  <dt>LSM</dt>
-    <dd>see <a href="#LSM">Linux Security Modules</a></dd>
-  <dt><a name="M">M</a></dt>
-  <dt><a name="list">Mailing list</a></dt>
-    <dd>The <a href="#FreeSWAN">Linux FreeS/WAN</a> project has several
-      public email lists for bug reports and software development
-      discussions. See our document on <a href="mail.html">mailing
-    lists</a>.</dd>
-  <dt><a name="middle">Man-in-the-middle attack</a></dt>
-    <dd>An <a href="#active">active attack</a> in which the attacker
-      impersonates each of the legitimate players in a protocol to the other.
-      <p>For example, if <a href="#alicebob">Alice and Bob</a> are
-      negotiating a key via the <a href="#DH">Diffie-Hellman</a> key
-      agreement, and are not using <a
-      href="#authentication">authentication</a> to be certain they are
-      talking to each other, then an attacker able to insert himself in the
-      communication path can deceive both players.</p>
-      <p>Call the attacker Mallory. For Bob, he pretends to be Alice. For
-      Alice, he pretends to be Bob. Two keys are then negotiated,
-      Alice-to-Mallory and Bob-to-Mallory. Alice and Bob each think the key
-      they have is Alice-to-Bob.</p>
-      <p>A message from Alice to Bob then goes to Mallory who decrypts it,
-      reads it and/or saves a copy, re-encrypts using the Bob-to-Mallory key
-      and sends it along to Bob. Bob decrypts successfully and sends a reply
-      which Mallory decrypts, reads, re-encrypts and forwards to Alice.</p>
-      <p>To make this attack effective, Mallory must</p>
-      <ul>
-        <li>subvert some part of the network in some way that lets him carry
-          out the deception<br>
-          possible targets: DNS, router, Alice or Bob's machine, mail server,
-          ...</li>
-        <li>beat any authentication mechanism Alice and Bob use<br>
-          strong authentication defeats the attack entirely; this is why <a
-          href="#IKE">IKE</a> requires authentication</li>
-        <li>work in real time, delivering messages without introducing a
-          delay large enough to alert the victims<br>
-          not hard if Alice and Bob are using email; quite difficult in some
-          situations.</li>
-      </ul>
-      <p>If he manages it, however, it is devastating. He not only gets to
-      read all the messages; he can alter messages, inject his own, forge
-      anything he likes, . . . In fact, he controls the communication
-      completely.</p>
-    </dd>
-  <dt><a name="mandatory">mandatory access control</a></dt>
-    <dd>access control mechanisims which are not settable by the user (see <a
-      href="#discretionary">discretionary access control</a>), but are
-      enforced by the system.
-      <p>For example, a document labelled "secret, zebra" might be readable
-      only by someone with secret clearance working on Project Zebra.
-      Ideally, the system will prevent any transfer outside those boundaries.
-      For example, even if you can read it, you should not be able to e-mail
-      it (unless the recipient is appropriately cleared) or print it (unless
-      certain printers are authorised for that classification).</p>
-      <p>Mandatory access control is a required feature for some levels of <a
-      href="#rainbow">Rainbow Book</a> or <a href="#cc">Common Criteria</a>
-      classification, but has not been widely used outside the military and
-      government. There is a good discussion of the issues in Anderson's <a
-      href="biblio.html#anderson">Security Engineering</a>.</p>
-      <p>The <a href="#SElinux">Security Enhanced Linux</a> project is adding
-      mandatory access control to Linux.</p>
-    </dd>
-  <dt><a name="manual">Manual keying</a></dt>
-    <dd>An IPsec mode in which the keys are provided by the administrator. In
-      FreeS/WAN, they are stored in /etc/ipsec.conf. The alternative, <a
-      href="#auto">automatic keying</a>, is preferred in most cases. See this
-      <a href="adv_config.html#man-auto">discussion</a>.</dd>
-  <dt><a name="MD4">MD4</a></dt>
-    <dd><a href="#digest">Message Digest Algorithm</a> Four from Ron Rivest
-      of <a href="#RSAco">RSA</a>. MD4 was widely used a few years ago, but
-      is now considered obsolete. It has been replaced by its descendants <a
-      href="#MD5">MD5</a> and <a href="#SHA">SHA</a>.</dd>
-  <dt><a name="MD5">MD5</a></dt>
-    <dd><a href="#digest">Message Digest Algorithm</a> Five from Ron Rivest
-      of <a href="#RSAco">RSA</a>, an improved variant of his <a
-      href="#MD4">MD4</a>. Like MD4, it produces a 128-bit hash. For details
-      see RFC 1321.
-      <p>MD5 is one of two message digest algorithms available in IPsec. The
-      other is <a href="#SHA">SHA</a>. SHA produces a longer hash and is
-      therefore more resistant to <a href="#birthday">birthday attacks</a>,
-      but this is not a concern for IPsec. The <a href="#HMAC">HMAC</a>
-      method used in IPsec is secure even if the underlying hash is not
-      particularly strong against this attack.</p>
-      <p>Hans Dobbertin found a weakness in MD5, and people often ask whether
-      this means MD5 is unsafe for IPsec. It doesn't. The IPsec RFCs discuss
-      Dobbertin's attack and conclude that it does not affect MD5 as used for
-      HMAC in IPsec.</p>
-    </dd>
-  <dt><a name="meet">Meet-in-the-middle attack</a></dt>
-    <dd>A divide-and-conquer attack which breaks a cipher into two parts,
-      works against each separately, and compares results. Probably the best
-      known example is an attack on double DES. This applies in principle to
-      any pair of block ciphers, e.g. to an encryption system using, say,
-      CAST-128 and Blowfish, but we will describe it for double DES.
-      <p>Double DES encryption and decryption can be written:</p>
-      <pre>        C = E(k2,E(k1,P))
-        P = D(k1,D(k2,C))</pre>
-      <p>Where C is ciphertext, P is plaintext, E is encryption, D is
-      decryption, k1 is one key, and k2 is the other key. If we know a P, C
-      pair, we can try and find the keys with a brute force attack, trying
-      all possible k1, k2 pairs. Since each key is 56 bits, there are
-      2<sup>112</sup> such pairs and this attack is painfully inefficient.</p>
-      <p>The meet-in-the middle attack re-writes the equations to calculate a
-      middle value M:</p>
-      <pre>        M = E(k1,P)
-        M = D(k2,C)</pre>
-      <p>Now we can try some large number of D(k2,C) decryptions with various
-      values of k2 and store the results in a table. Then start doing E(k1,P)
-      encryptions, checking each result to see if it is in the table.</p>
-      <p>With enough table space, this breaks double DES with
-      <nobr>2<sup>56</sup> + 2<sup>56</sup> = 2<sup>57</sup></nobr>work.
-      Against triple DES, you need <nobr>2<sup>56</sup> + 2<sup>112</sup> ~=
-      2<sup>112</sup></nobr>.</p>
-      <p>The memory requirements for such attacks can be prohibitive, but
-      there is a whole body of research literature on methods of reducing
-      them.</p>
-    </dd>
-  <dt><a name="digest">Message Digest Algorithm</a></dt>
-    <dd>An algorithm which takes a message as input and produces a hash or
-      digest of it, a fixed-length set of bits which depend on the message
-      contents in some highly complex manner. Design criteria include making
-      it extremely difficult for anyone to counterfeit a digest or to change
-      a message without altering its digest. One essential property is <a
-      href="#collision">collision resistance</a>. The main applications are
-      in message <a href="#authentication">authentication</a> and <a
-      href="#signature">digital signature</a> schemes. Widely used algorithms
-      include <a href="#MD5">MD5</a> and <a href="#SHA">SHA</a>. In IPsec,
-      message digests are used for <a href="#HMAC">HMAC</a> authentication of
-      packets.</dd>
-  <dt><a name="MTU">MTU</a></dt>
-    <dd><strong>M</strong>aximum <strong>T</strong>ransmission
-      <strong>U</strong>nit, the largest size of packet that can be sent over
-      a link. This is determined by the underlying network, but must be taken
-      account of at the IP level.
-      <p>IP packets, which can be up to 64K bytes each, must be packaged into
-      lower-level packets of the appropriate size for the underlying
-      network(s) and re-assembled on the other end. When a packet must pass
-      over multiple networks, each with its own MTU, and many of the MTUs are
-      unknown to the sender, this becomes a fairly complex problem. See <a
-      href="#pathMTU">path MTU discovery</a> for details.</p>
-      <p>Often the MTU is a few hundred bytes on serial links and 1500 on
-      Ethernet. There are, however, serial link protocols which use a larger
-      MTU to avoid fragmentation at the ethernet/serial boundary, and newer
-      (especially gigabit) Ethernet networks sometimes support much larger
-      packets because these are more efficient in some applications.</p>
-    </dd>
-  <dt><a name="N">N</a></dt>
-  <dt><a name="NAI">NAI</a></dt>
-    <dd><a href="http://www.nai.com">Network Associates</a>, a conglomerate
-      formed from <a href="#PGPI">PGP Inc.</a>, TIS (Trusted Information
-      Systems, a firewall vendor) and McAfee anti-virus products. Among other
-      things, they offer an IPsec-based VPN product.</dd>
-  <dt><a name="NAT.gloss">NAT</a></dt>
-    <dd><b>N</b>etwork <b>A</b>ddress <b>T</b>ranslation, a process by which
-      firewall machines may change the addresses on packets as they go
-      through. For discussion, see our <a
-      href="background.html#nat.background">background</a> section.</dd>
-  <dt><a name="NIST">NIST</a></dt>
-    <dd>The US <a href="http://www.nist.gov"> National Institute of Standards
-      and Technology</a>, responsible for <a href="#FIPS">FIPS standards</a>
-      including <a href="#DES">DES</a> and its replacement, <a
-      href="#AES">AES</a>.</dd>
-  <dt><a name="nonce">Nonce</a></dt>
-    <dd>A <a href="#random">random</a> value used in an <a
-      href="#authentication">authentication</a> protocol.</dd>
-  <dt></dt>
-  <dt><a name="non-routable">Non-routable IP address</a></dt>
-    <dd>An IP address not normally allowed in the "to" or "from" IP address
-      field header of IP packets.
-      <p>Almost invariably, the phrase "non-routable address" means one of
-      the addresses reserved by RFC 1918 for private networks:</p>
-      <ul>
-        <li>10.anything</li>
-        <li>172.x.anything with 16 &lt;= x &lt;= 31</li>
-        <li>192.168.anything</li>
-      </ul>
-      <p>These addresses are commonly used on private networks, e.g. behind a
-      Linux machines doing <a href="#masq">IP masquerade</a>. Machines within
-      the private network can address each other with these addresses. All
-      packets going outside that network, however, have these addresses
-      replaced before they reach the Internet.</p>
-      <p>If any packets using these addresses do leak out, they do not go
-      far. Most routers automatically discard all such packets.</p>
-      <p>Various other addresses -- the 127.0.0.0/8 block reserved for local
-      use, 0.0.0.0, various broadcast and network addresses -- cannot be
-      routed over the Internet, but are not normally included in the meaning
-      when the phrase "non-routable address" is used.</p>
-    </dd>
-  <dt><a name="NSA">NSA</a></dt>
-    <dd>The US <a href="http://www.nsa.gov"> National Security Agency</a>,
-      the American organisation for <a href="#SIGINT">signals
-      intelligence</a>, the protection of US government messages and the
-      interception and analysis of other messages. For details, see Bamford's
-      <a href="biblio.html#puzzle">"The Puzzle Palace"</a>.
-      <p>Some <a
-      href="http://www.gwu.edu/~nsarchiv/NSAEBB/NSAEBB23/index.html">history
-      of NSA</a> documents were declassified in response to a FOIA (Freedom
-      of Information Act) request.</p>
-    </dd>
-  <dt><a name="O">O</a></dt>
-  <dt><a name="oakley">Oakley</a></dt>
-    <dd>A key determination protocol, defined in RFC 2412.</dd>
-  <dt>Oakley groups</dt>
-    <dd>The groups used as the basis of <a href="#DH">Diffie-Hellman</a> key
-      exchange in the Oakley protocol, and in <a href="#IKE">IKE</a>. Four
-      were defined in the original RFC, and a fifth has been <a
-      href="http://www.lounge.org/ike_doi_errata.html">added since</a>.
-      <p>Linux FreeS/WAN currently supports the three groups based on finite
-      fields modulo a prime (Groups 1, 2 and 5) and does not support the
-      elliptic curve groups (3 and 4). For a description of the difference of
-      the types, see <a href="#dlog">discrete logarithms</a>.</p>
-    </dd>
-  <dt><a name="OTP">One time pad</a></dt>
-    <dd>A cipher in which the key is:
-      <ul>
-        <li>as long as the total set of messages to be enciphered</li>
-        <li>absolutely <a href="#random">random</a></li>
-        <li>never re-used</li>
-      </ul>
-      <p>Given those three conditions, it can easily be proved that the
-      cipher is perfectly secure, in the sense that an attacker with
-      intercepted message in hand has no better chance of guessing the
-      message than an attacker who has not intercepted the message and only
-      knows the message length. No such proof exists for any other cipher.</p>
-      <p>There are, however, several problems with this "perfect" cipher.</p>
-      <p>First, it is <strong>wildly impractical</strong> for most
-      applications. Key management is at best difficult, often completely
-      impossible.</p>
-      <p>Second, it is <strong>extremely fragile</strong>. Small changes
-      which violate the conditions listed above do not just weaken the cipher
-      liitle. Quite often they destroy its security completely.</p>
-      <ul>
-        <li>Re-using the pad weakens the cipher to the point where it can be
-          broken with pencil and paper. With a computer, the attack is
-          trivially easy.</li>
-        <li>Using <em>anything</em> less than truly <a
-          href="#random">random</a> numbers <em>completely</em> invalidates
-          the security proof.</li>
-        <li>In particular, using computer-generated pseudo-random numbers may
-          give an extremely weak cipher. It might also produce a good stream
-          cipher, if the pseudo-random generator is both well-designed and
-          properely seeded.</li>
-      </ul>
-      <p>Marketing claims about the "unbreakable" security of various
-      products which somewhat resemble one-time pads are common. Such claims
-      are one of the surest signs of cryptographic <a href="#snake">snake
-      oil</a>; most systems marketed with such claims are worthless.</p>
-      <p>Finally, even if the system is implemented and used correctly, it is
-      <strong>highly vulnerable to a substitution attack</strong>. If an
-      attacker knows some plaintext and has an intercepted message, he can
-      discover the pad.</p>
-      <ul>
-        <li>This does not matter if the attacker is just a <a
-          href="#passive">passive</a> eavesdropper. It gives him no plaintext
-          he didn't already know and we don't care that he learns a pad which
-          we will never re-use.</li>
-        <li>However, an <a href="#active">active</a> attacker who knows the
-          plaintext can recover the pad, then use it to encode with whatever
-          he chooses. If he can get his version delivered instead of yours,
-          this may be a disaster. If you send "attack at dawn", the delivered
-          message can be anything the same length -- perhaps "retreat to
-          east" or "shoot generals".</li>
-        <li>An active attacker with only a reasonable guess at the plaintext
-          can try the same attack. If the guess is correct, this works and
-          the attacker's bogus message is delivered. If the guess is wrong, a
-          garbled message is delivered.</li>
-      </ul>
-      <p>In general then, despite its theoretical perfection, the
-      one-time-pad has very limited practical application.</p>
-      <p>See also the <a href="http://pubweb.nfr.net/~mjr/pubs/otpfaq/">one
-      time pad FAQ</a>.</p>
-    </dd>
-  <dt><a name="carpediem">Opportunistic encryption (OE)</a></dt>
-    <dd>A situation in which any two IPsec-aware machines can secure their
-      communications, without a pre-shared secret and without a common <a
-      href="#PKI">PKI</a> or previous exchange of public keys. This is one of
-      the goals of the Linux FreeS/WAN project, discussed in our <a
-      href="intro.html#goals">introduction</a> section.
-      <p>Setting up for opportunistic encryption is described in our <a
-      href="quickstart.html#quickstart">quickstart</a> document.</p>
-    </dd>
-  <dt><a name="responder">Opportunistic responder</a></dt>
-    <dd>A host which accepts, but does not initiate, requests for 
-     <A HREF="#carpediem">opportunistic encryption</A> (OE). 
-     An opportunistic responder has enabled OE in its
-     <A HREF="#passive.OE">passive</A> form (pOE) only.
-     A web server or file server may be usefully set up as an opportunistic 
-      responder. 
-      <p>Configuring passive OE is described in our
-      <a href="policygroups.html#policygroups">policy groups</a> document.</p>
-    </dd>
-  <dt><a name="orange">Orange book</a></dt>
-    <dd>the most basic and best known of the US government's <a
-      href="#rainbow">Rainbow Book</a> series of computer security
-    standards.</dd>
-  <dt><a name="P">P</a></dt>
-  <dt><a name="P1363">P1363 standard</a></dt>
-    <dd>An <a href="#IEEE">IEEE</a> standard for public key cryptography. <a
-      href="http://grouper.ieee.org/groups/1363">Web page</a>.</dd>
-  <dt><a name="pOE">pOE</a></dt>
-    <dd>See <a href="#passive.OE">Passive opportunistic encryption</a>.</dd>
-  <dt><a name="passive">Passive attack</a></dt>
-    <dd>An attack in which the attacker only eavesdrops and attempts to
-      analyse intercepted messages, as opposed to an <a href="#active">active
-      attack</a> in which he diverts messages or generates his own.</dd>
-  <dt><a name="passive.OE">Passive opportunistic encryption (pOE)</a></dt>
-    <dd>A form of
-     <A HREF="#carpediem">opportunistic encryption</A> (OE) in which the
-     host will accept opportunistic connection requests, but will not 
-     initiate such requests. A host which runs OE in its passive form only 
-     is known as an <A HREF="#responder">opportunistic responder</A>.
-      <p>Configuring passive OE is described in our
-      <a href="policygroups.html#policygroups">policy groups</a> document.</p>
-    </dd>
-  <dt><a name="pathMTU">Path MTU discovery</a></dt>
-    <dd>The process of discovering the largest packet size which all links on
-      a path can handle without fragmentation -- that is, without any router
-      having to break the packet up into smaller pieces to match the <a
-      href="#MTU">MTU</a> of its outgoing link.
-      <p>This is done as follows:</p>
-      <ul>
-        <li>originator sends the largest packets allowed by <a
-          href="#MTU">MTU</a> of the first link, setting the DF
-          (<strong>d</strong>on't <strong>f</strong>ragment) bit in the
-          packet header</li>
-        <li>any router which cannot send the packet on (outgoing MTU is too
-          small for it, and DF prevents fragmenting it to match) sends back
-          an <a href="#ICMP.gloss">ICMP</a> packet reporting the problem</li>
-        <li>originator looks at ICMP message and tries a smaller size</li>
-        <li>eventually, you settle on a size that can pass all routers</li>
-        <li>thereafter, originator just sends that size and no-one has to
-          fragment</li>
-      </ul>
-      <p>Since this requires co-operation of many systems, and since the next
-      packet may travel a different path, this is one of the trickier areas
-      of IP programming. Bugs that have shown up over the years have
-      included:</p>
-      <ul>
-        <li>malformed ICMP messages</li>
-        <li>hosts that ignore or mishandle these ICMP messages</li>
-        <li>firewalls blocking the ICMP messages so host does not see
-        them</li>
-      </ul>
-      <p>Since IPsec adds a header, it increases packet size and may require
-      fragmentation even where incoming and outgoing MTU are equal.</p>
-    </dd>
-  <dt><a name="PFS">Perfect forward secrecy (PFS)</a></dt>
-    <dd>A property of systems such as <a href="#DH">Diffie-Hellman</a> key
-      exchange which use a long-term key (such as the shared secret in IKE)
-      and generate short-term keys as required. If an attacker who acquires
-      the long-term key <em>provably</em> can
-      <ul>
-        <li><em>neither</em> read previous messages which he may have
-        archived</li>
-        <li><em>nor</em> read future messages without performing additional
-          successful attacks</li>
-      </ul>
-      <p>then the system has PFS. The attacker needs the short-term keys in
-      order to read the trafiic and merely having the long-term key does not
-      allow him to infer those. Of course, it may allow him to conduct
-      another attack (such as <a href="#middle">man-in-the-middle</a>) which
-      gives him some short-term keys, but he does not automatically get them
-      just by acquiring the long-term key.</p>
-      <p>See also
-<a href="http://sandelman.ottawa.on.ca/ipsec/1996/08/msg00123.html">Phil 
-Karn's definition</a>.
-    </dd>
-  <dt>PFS</dt>
-    <dd>see Perfect Forward Secrecy</dd>
-  <dt><a name="PGP">PGP</a></dt>
-    <dd><b>P</b>retty <b>G</b>ood <b>P</b>rivacy, a personal encryption
-      system for email based on public key technology, written by Phil
-      Zimmerman.
-      <p>The 2.xx versions of PGP used the <a href="#RSA">RSA</a> public key
-      algorithm and used <a href="#IDEA">IDEA</a> as the symmetric cipher.
-      These versions are described in RFC 1991 and in <a
-      href="#PGP">Garfinkel's book</a>. Since version 5, the products from <a
-      href="#PGPI">PGP Inc</a>. have used <a href="#DH">Diffie-Hellman</a>
-      public key methods and <a href="#CAST128">CAST-128</a> symmetric
-      encryption. These can verify signatures from the 2.xx versions, but
-      cannot exchange encryted messages with them.</p>
-      <p>An <a href="#IETF">IETF</a> working group has issued RFC 2440 for an
-      "Open PGP" standard, similar to the 5.x versions. PGP Inc. staff were
-      among the authors. A free <a href="#GPG">Gnu Privacy Guard</a> based on
-      that standard is now available.</p>
-      <p>For more information on PGP, including how to obtain it, see our
-      cryptography <a href="web.html#tools">links</a>.</p>
-    </dd>
-  <dt><a name="PGPI">PGP Inc.</a></dt>
-    <dd>A company founded by Zimmerman, the author of <a href="#PGP">PGP</a>,
-      now a division of <a href="#NAI">NAI</a>. See the <a
-      href="http://www.pgp.com">corporate website</a>. Zimmerman left in
-      2001, and early in 2002 NAI announced that they would no longer sell
-      PGP..
-      <p>Versions 6.5 and later of the PGP product include PGPnet, an IPsec
-      client for Macintosh or for Windows 95/98/NT. See our <a
-      href="interop.html#pgpnet">interoperation documen</a>t.</p>
-    </dd>
-  <dt><a name="photuris">Photuris</a></dt>
-    <dd>Another key negotiation protocol, an alternative to <a
-      href="#IKE">IKE</a>, described in RFCs 2522 and 2523.</dd>
-  <dt><a name="PPP">PPP</a></dt>
-    <dd><b>P</b>oint-to-<b>P</b>oint <b>P</b>rotocol, originally a method of
-      connecting over modems or serial lines, but see also PPPoE.</dd>
-  <dt><a name="PPPoE">PPPoE</a></dt>
-    <dd><b>PPP</b> <b>o</b>ver <b>E</b>thernet, a somewhat odd protocol that
-      makes Ethernet look like a point-to-point serial link. It is widely
-      used for cable or ADSL Internet services, apparently mainly because it
-      lets the providers use access control and address assignmment
-      mechanisms developed for dialup networks. <a
-      href="http://www.roaringpenguin.com">Roaring Penguin</a> provide a
-      widely used Linux implementation.</dd>
-  <dt><a name="PPTP">PPTP</a></dt>
-    <dd><b>P</b>oint-to-<b>P</b>oint <b>T</b>unneling <b>P</b>rotocol, used
-      in some Microsoft VPN implementations. Papers discussing weaknesses in
-      it are on <a
-      href="http://www.counterpane.com/publish.html">counterpane.com</a>. It
-      is now largely obsolete, replaced by L2TP.</dd>
-  <dt><a name="PKI">PKI</a></dt>
-    <dd><b>P</b>ublic <b>K</b>ey <b>I</b>nfrastructure, the things an
-      organisation or community needs to set up in order to make <a
-      href="#public">public key</a> cryptographic technology a standard part
-      of their operating procedures.
-      <p>There are several PKI products on the market. Typically they use a
-      hierarchy of <a href="#CA">Certification Authorities (CAs)</a>. Often
-      they use <a href="#LDAP">LDAP</a> access to <a href="#X509">X.509</a>
-      directories to implement this.</p>
-      <p>See <a href="#web">Web of Trust</a> for a different sort of
-      infrastructure.</p>
-    </dd>
-  <dt><a name="PKIX">PKIX</a></dt>
-    <dd><b>PKI</b> e<b>X</b>change, an <a href="#IETF">IETF</a> standard that
-      allows <a href="#PKI">PKI</a>s to talk to each other.
-      <p>This is required, for example, when users of a corporate PKI need to
-      communicate with people at client, supplier or government
-      organisations, any of which may have a different PKI in place. I should
-      be able to talk to you securely whenever:</p>
-      <ul>
-        <li>your organisation and mine each have a PKI in place</li>
-        <li>you and I are each set up to use those PKIs</li>
-        <li>the two PKIs speak PKIX</li>
-        <li>the configuration allows the conversation</li>
-      </ul>
-      <p>At time of writing (March 1999), this is not yet widely implemented
-      but is under quite active development by several groups.</p>
-    </dd>
-  <dt><a name="plaintext">Plaintext</a></dt>
-    <dd>The unencrypted input to a cipher, as opposed to the encrypted <a
-      href="#ciphertext">ciphertext</a> output.</dd>
-  <dt><a name="Pluto">Pluto</a></dt>
-    <dd>The <a href="#FreeSWAN">Linux FreeS/WAN</a> daemon which handles key
-      exchange via the <a href="#IKE">IKE</a> protocol, connection
-      negotiation, and other higher-level tasks. Pluto calls the <a
-      href="#KLIPS">KLIPS</a> kernel code as required. For details, see the
-      manual page ipsec_pluto(8).</dd>
-  <dt><a name="public">Public Key Cryptography</a></dt>
-    <dd>In public key cryptography, keys are created in matched pairs.
-      Encrypt with one half of a pair and only the matching other half can
-      decrypt it. This contrasts with <a href="#symmetric">symmetric or
-      secret key cryptography</a> in which a single key known to both parties
-      is used for both encryption and decryption.
-      <p>One half of each pair, called the public key, is made public. The
-      other half, called the private key, is kept secret. Messages can then
-      be sent by anyone who knows the public key to the holder of the private
-      key. Encrypt with the public key and you know that only someone with
-      the matching private key can decrypt.</p>
-      <p>Public key techniques can be used to create <a
-      href="#signature">digital signatures</a> and to deal with key
-      management issues, perhaps the hardest part of effective deployment of
-      <a href="#symmetric"> symmetric ciphers</a>. The resulting <a
-      href="#hybrid">hybrid cryptosystems</a> use public key methods to
-      manage keys for symmetric ciphers.</p>
-      <p>Many organisations are currently creating <a href="#PKI">PKIs,
-      public key infrastructures</a> to make these benefits widely
-      available.</p>
-    </dd>
-  <dt>Public Key Infrastructure</dt>
-    <dd>see <a href="#PKI">PKI</a></dd>
-  <dt><a name="Q">Q</a></dt>
-  <dt><a name="R">R</a></dt>
-  <dt><a name="rainbow">Rainbow books</a></dt>
-    <dd>A set of US government standards for evaluation of "trusted computer
-      systems", of which the best known was the <a href="#orange">Orange
-      Book</a>. One fairly often hears references to "C2 security" or a
-      product "evaluated at B1". The Rainbow books define the standards
-      referred to in those comments.
-      <p>See this <a href="http://www.fas.org/irp/nsa/rainbow.htm">reference
-      page</a>.</p>
-      <p>The Rainbow books are now mainly obsolete, replaced by the
-      international <a href="#cc">Common Criteria</a> standards.</p>
-    </dd>
-  <dt><a name="random">Random</a></dt>
-    <dd>A remarkably tricky term, far too much so for me to attempt a
-      definition here. Quite a few cryptosystems have been broken via attacks
-      on weak random number generators, even when the rest of the system was
-      sound.
-      <p>See <a
-      href="http://nis.nsf.net/internet/documents/rfc/rfc1750.txt">RFC
-      1750</a> for the theory.</p>
-      <p>See the manual pages for <a
-      href="manpage.d/ipsec_ranbits.8.html">ipsec_ranbits(8)</a> and
-      ipsec_prng(3) for more on FreeS/WAN's use of randomness. Both depend on
-      the random(4) device driver..</p>
-      <p>A couple of years ago, there was extensive mailing list discussion
-      (archived <a
-      href="http://www.openpgp.net/random/index.html">here</a>)of Linux
-      /dev/random and FreeS/WAN.  Since then, the design of the random(4)
-      driver has changed considerably. Linux 2.4 kernels have the new
-      driver..</p>
-    </dd>
-  <dt>Raptor</dt>
-    <dd>A firewall product for Windows NT offerring IPsec-based VPN services.
-      Linux FreeS/WAN interoperates with Raptor; see our <a
-      href="interop.html#Raptor">interop</a> document for details. Raptor
-      have recently merged with Axent.</dd>
-  <dt><a name="RC4">RC4</a></dt>
-    <dd><b>R</b>ivest <b>C</b>ipher four, designed by Ron Rivest of <a
-      href="#RSAco">RSA</a> and widely used. Believed highly secure with
-      adequate key length, but often implemented with inadequate key length
-      to comply with export restrictions.</dd>
-  <dt><a name="RC6">RC6</a></dt>
-    <dd><b>R</b>ivest <b>C</b>ipher six, <a href="#RSAco">RSA</a>'s <a
-      href="#AES">AES</a> candidate cipher.</dd>
-  <dt><a name="replay">Replay attack</a></dt>
-    <dd>An attack in which the attacker records data and later replays it in
-      an attempt to deceive the recipient.</dd>
-  <dt><a name="reverse">Reverse map</a></dt>
-    <dd>In <a href="#DNS">DNS</a>, a table where IP addresses can be used as
-      the key for lookups which return a system name and/or other
-    information.</dd>
-  <dt>RFC</dt>
-    <dd><b>R</b>equest <b>F</b>or <b>C</b>omments, an Internet document. Some
-      RFCs are just informative. Others are standards.
-      <p>Our list of <a href="#IPSEC">IPsec</a> and other security-related
-      RFCs is <a href="rfc.html#RFC">here</a>, along with information on
-      methods of obtaining them.</p>
-    </dd>
-  <dt><a name="rijndael">Rijndael</a></dt>
-    <dd>a <a href="#block">block cipher</a> designed by two Belgian
-      cryptographers, winner of the US government's <a href="#AES">AES</a>
-      contest to pick a replacement for <a href="#DES">DES</a>. See the <a
-      href="http://www.esat.kuleuven.ac.be/~rijmen/rijndael">Rijndael home
-      page</a>.</dd>
-  <dt><a name="RIPEMD">RIPEMD</a></dt>
-    <dd>A <a href="#digest">message digest</a> algorithm. The current version
-      is RIPEMD-160 which gives a 160-bit hash.</dd>
-  <dt><a name="rootCA">Root CA</a></dt>
-    <dd>The top level <a href="#CA">Certification Authority</a> in a hierachy
-      of such authorities.</dd>
-  <dt><a name="routable">Routable IP address</a></dt>
-    <dd>Most IP addresses can be used as "to" and "from" addresses in packet
-      headers. These are the routable addresses; we expect routing to be
-      possible for them. If we send a packet to one of them, we expect (in
-      most cases; there are various complications) that it will be delivered
-      if the address is in use and will cause an <a
-      href="#ICMP.gloss">ICMP</a> error packet to come back to us if not.
-      <p>There are also several classes of <a
-      href="#non-routable">non-routable</a> IP addresses.</p>
-    </dd>
-  <dt><a name="RSA">RSA algorithm</a></dt>
-    <dd><b>R</b>ivest <b>S</b>hamir <b>A</b>dleman <a href="#public">public
-      key</a> algorithm, named for its three inventors. It is widely used and
-      likely to become moreso since it became free of patent encumbrances in
-      September 2000.
-      <p>RSA can be used to provide either <a
-      href="#encryption">encryption</a> or <a href="#signature">digital
-      signatures</a>. In IPsec, it is used only for signatures. These provide
-      gateway-to-gateway <a href="#authentication">authentication</a> for <a
-      href="#IKE">IKE </a>negotiations.</p>
-      <p>For a full explanation of the algorithm, consult one of the standard
-      references such as <a href="biblio.html#schneier">Applied
-      Cryptography</a>. A simple explanation is:</p>
-      <p>The great 17th century French mathematician <a
-      href="http://www-groups.dcs.st-andrews.ac.uk/~history/Mathematicians/Fermat.html">Fermat</a>
-      proved that,</p>
-      <p>for any prime p and number x, 0 &lt;= x &lt; p:</p>
-      <pre>        x^p == x         modulo p
-        x^(p-1) == 1     modulo p, non-zero x
-      </pre>
-      <p>From this it follows that if we have a pair of primes p, q and two
-      numbers e, d such that:</p>
-      <pre>        ed == 1          modulo lcm( p-1, q-1)
-      </pre>
-      where lcm() is least common multiple, then<br>
-      for all x, 0 &lt;= x &lt; pq:
-      <pre>      x^ed == x           modulo pq
-      </pre>
-      <p>So we construct such as set of numbers p, q, e, d and publish the
-      product N=pq and e as the public key. Using c for <a
-      href="#ciphertext">ciphertext</a> and i for the input <a
-      href="#plaintext">plaintext</a>, encryption is then:</p>
-      <pre>        c = i^e           modulo N
-      </pre>
-      <p>An attacker cannot deduce i from the cyphertext c, short of either
-      factoring N or solving the <a href="#dlog">discrete logarithm</a>
-      problem for this field. If p, q are large primes (hundreds or thousands
-      of bits) no efficient solution to either problem is known.</p>
-      <p>The receiver, knowing the private key (N and d), can readily recover
-      the plaintext p since:</p>
-      <pre>        c^d == (i^e)^d    modulo N
-            == i^ed       modulo N
-            == i          modulo N
-      </pre>
-      <p>This gives an effective public key technique, with only a couple of
-      problems. It uses a good deal of computer time, since calculations with
-      large integers are not cheap, and there is no proof it is necessarily
-      secure since no-one has proven either factoring or discrete log cannot
-      be done efficiently. Quite a few good mathematicians have tried both
-      problems, and no-one has announced success, but there is no proof they
-      are insoluble.</p>
-    </dd>
-  <dt><a name="RSAco">RSA Data Security</a></dt>
-    <dd>A company founded by the inventors of the <a href="#RSA">RSA</a>
-      public key algorithm.</dd>
-  <dt><a name="S">S</a></dt>
-  <dt><a name="SA">SA</a></dt>
-    <dd><b>S</b>ecurity <b>A</b>ssociation, the channel negotiated by the
-      higher levels of an <a href="#IPSEC">IPsec</a> implementation (<a
-      href="#IKE">IKE</a>) and used by the lower (<a href="#ESP">ESP</a> and
-      <a href="#AH">AH</a>). SAs are unidirectional; you need a pair of them
-      for two-way communication.
-      <p>An SA is defined by three things -- the destination, the protocol
-      (<a href="#AH">AH</a> or<a href="#ESP">ESP</a>) and the <a
-      href="SPI">SPI</a>, security parameters index. It is used as an index
-      to look up other things such as session keys and intialisation
-      vectors.</p>
-      <p>For more detail, see our section on <a href="ipsec.html">IPsec</a>
-      and/or RFC 2401.</p>
-    </dd>
-  <dt><a name="SElinux">SE Linux</a></dt>
-    <dd><strong>S</strong>ecurity <strong>E</strong>nhanced Linux, an <a
-      href="#NSA">NSA</a>-funded project to add <a
-      href="#mandatory">mandatory access control</a> to Linux. See the <a
-      href="http://www.nsa.gov/selinux">project home page</a>.
-      <p>According to their web pages, this work will include extending
-      mandatory access controls to IPsec tunnels.</p>
-      <p>Recent versions of SE Linux code use the <a href="#LSM">Linux
-      Security Module</a> interface.</p>
-    </dd>
-  <dt><a name="SDNS">Secure DNS</a></dt>
-    <dd>A version of the <a href="#DNS">DNS or Domain Name Service</a>
-      enhanced with authentication services. This is being designed by the <a
-      href="#IETF">IETF</a> DNS security <a
-      href="http://www.ietf.org/ids.by.wg/dnssec.html">working group</a>.
-      Check the <a href="http://www.isc.org/bind.html">Internet Software
-      Consortium</a> for information on implementation progress and for the
-      latest version of <a href="#BIND">BIND</a>. Another site has <a
-      href="http://www.toad.com/~dnssec">more information</a>.
-      <p><a href="#IPSEC">IPsec</a> can use this plus <a
-      href="#DH">Diffie-Hellman key exchange</a> to bootstrap itself. This
-      allows <a href="#carpediem">opportunistic encryption</a>. Any pair of
-      machines which can authenticate each other via DNS can communicate
-      securely, without either a pre-existing shared secret or a shared <a
-      href="#PKI">PKI</a>.</p>
-    </dd>
-  <dt>Secret key cryptography</dt>
-    <dd>See <a href="#symmetric">symmetric cryptography</a></dd>
-  <dt>Security Association</dt>
-    <dd>see <a href="#SA">SA</a></dd>
-  <dt>Security Enhanced Linux</dt>
-    <dd>see <a href="#SElinux">SE Linux</a></dd>
-  <dt><a name="sequence">Sequence number</a></dt>
-    <dd>A number added to a packet or message which indicates its position in
-      a sequence of packets or messages. This provides some security against
-      <a href="#replay">replay attacks</a>.
-      <p>For <a href="#auto">automatic keying</a> mode, the <a
-      href="#IPSEC">IPsec</a> RFCs require that the sender generate sequence
-      numbers for each packet, but leave it optional whether the receiver
-      does anything with them.</p>
-    </dd>
-  <dt><a name="SHA">SHA</a></dt>
-  <dt>SHA-1</dt>
-    <dd><b>S</b>ecure <b>H</b>ash <b>A</b>lgorithm, a <a
-      href="#digest">message digest algorithm</a> developed by the <a
-      href="#NSA">NSA</a> for use in the Digital Signature standard, <a
-      href="#FIPS">FIPS</a> number 186 from <a href="#NIST">NIST</a>. SHA is
-      an improved variant of <a href="#MD4">MD4</a> producing a 160-bit hash.
-      <p>SHA is one of two message digest algorithms available in IPsec. The
-      other is <a href="#MD5">MD5</a>. Some people do not trust SHA because
-      it was developed by the <a href="#NSA">NSA</a>. There is, as far as we
-      know, no cryptographic evidence that SHA is untrustworthy, but this
-      does not prevent that view from being strongly held.</p>
-      <p>The NSA made one small change after the release of the original SHA.
-      They did not give reasons. Iit may be a defense against some attack
-      they found and do not wish to disclose.  Technically the modified
-      algorithm should be called SHA-1, but since it has replaced the
-      original algorithm in nearly all applications, it is generally just
-      referred to as SHA..</p>
-    </dd>
-  <dt><a name="SHA-256">SHA-256</a></dt>
-  <dt>SHA-384</dt>
-  <dt>SHA-512</dt>
-    <dd>Newer variants of SHA designed to match the strength of the 128, 192
-      and 256-bit keys of <a href="#AES">AES</a>. The work to break an
-      encryption algorithm's strength by <a href="#brute">brute force</a> is
-      2 
-      <math xmlns="http://www.w3.org/1998/Math/MathML">
-        <msup>
-          <mi>keylength</mi>
-        </msup>
-      </math>
-       operations but a <a href="birthday">birthday attack </a>on a hash
-      needs only 2 
-      <math xmlns="http://www.w3.org/1998/Math/MathML">
-        <msup>
-          <mrow>
-            <mi>hashlength</mi>
-            <mo>/</mo>
-            <mn>2</mn>
-          </mrow>
-        </msup>
-      </math>
-       , so as a general rule you need a hash twice the size of the key to
-      get similar strength. SHA-256, SHA-384 and SHA-512 are designed to
-      match the 128, 192 and 256-bit key sizes of AES, respectively.</dd>
-  <dt><a name="SIGINT">Signals intelligence (SIGINT)</a></dt>
-    <dd>Activities of government agencies from various nations aimed at
-      protecting their own communications and reading those of others.
-      Cryptography, cryptanalysis, wiretapping, interception and monitoring
-      of various sorts of signals. The players include the American <a
-      href="#NSA">NSA</a>, British <a href="#GCHQ">GCHQ</a> and Canadian <a
-      href="#CSE">CSE</a>.</dd>
-  <dt><a name="SKIP">SKIP</a></dt>
-    <dd><b>S</b>imple <b>K</b>ey management for <b>I</b>nternet
-      <b>P</b>rotocols, an alternative to <a href="#IKE">IKE</a> developed by
-      Sun and being marketed by their <a
-      href="http://skip.incog.com">Internet Commerce Group</a>.</dd>
-  <dt><a name="snake">Snake oil</a></dt>
-    <dd>Bogus cryptography. See the <a
-      href="http://www.interhack.net/people/cmcurtin/snake-oil-faq.html">
-      Snake Oil FAQ</a> or <a
-      href="http://www.counterpane.com/crypto-gram-9902.html#snakeoil">this
-      paper</a> by Schneier.</dd>
-  <dt><a name="SPI">SPI</a></dt>
-    <dd><b>S</b>ecurity <b>P</b>arameter <b>I</b>ndex, an index used within
-      <a href="#IPSEC">IPsec</a> to keep connections distinct. A <a
-      href="#SA">Security Association (SA)</a> is defined by destination,
-      protocol and SPI. Without the SPI, two connections to the same gateway
-      using the same protocol could not be distinguished.
-      <p>For more detail, see our <a href="ipsec.html">IPsec</a> section
-      and/or RFC 2401.</p>
-    </dd>
-  <dt><a name="SSH">SSH</a></dt>
-    <dd><b>S</b>ecure <b>SH</b>ell, an encrypting replacement for the
-      insecure Berkeley commands whose names begin with "r" for "remote":
-      rsh, rlogin, etc.
-      <p>For more information on SSH, including how to obtain it, see our
-      cryptography <a href="web.html#tools">links</a>.</p>
-    </dd>
-  <dt><a name="SSHco">SSH Communications Security</a></dt>
-    <dd>A company founded by the authors of <a href="#SSH">SSH</a>. Offices
-      are in <a href="http://www.ssh.fi">Finland</a> and <a
-      href="http://www.ipsec.com">California</a>. They have a toolkit for
-      developers of IPsec applications.</dd>
-  <dt><a name="SSL">SSL</a></dt>
-    <dd><a href="http://home.netscape.com/eng/ssl3">Secure Sockets Layer</a>,
-      a set of encryption and authentication services for web browsers,
-      developed by Netscape. Widely used in Internet commerce. Also known as
-      <a href="#TLS">TLS</a>.</dd>
-  <dt>SSLeay</dt>
-    <dd>A free implementation of <a href="#SSL">SSL</a> by Eric Young (eay)
-      and others. Developed in Australia; not subject to US export
-    controls.</dd>
-  <dt><a name="static">static IP address</a></dt>
-    <dd>an IP adddress which is pre-set on the machine itself, as opposed to
-      a <a href="#dynamic">dynamic address</a> which is assigned by a <a
-      href="#DHCP">DHCP</a> server or obtained as part of the process of
-      establishing a <a href="#PPP">PPP</a> or <a href="#PPPoE">PPPoE</a>
-      connection</dd>
-  <dt><a name="stream">Stream cipher</a></dt>
-    <dd>A <a href="#symmetric">symmetric cipher</a> which produces a stream
-      of output which can be combined (often using XOR or bytewise addition)
-      with the plaintext to produce ciphertext. Contrasts with <a
-      href="#block">block cipher</a>.
-      <p><a href="#IPSEC">IPsec</a> does not use stream ciphers. Their main
-      application is link-level encryption, for example of voice, video or
-      data streams on a wire or a radio signal.</p>
-    </dd>
-  <dt><a name="subnet">subnet</a></dt>
-    <dd>A group of IP addresses which are logically one network, typically
-      (but not always) assigned to a group of physically connected machines.
-      The range of addresses in a subnet is described using a subnet mask.
-      See next entry.</dd>
-  <dt>subnet mask</dt>
-    <dd>A method of indicating the addresses included in a subnet. Here are
-      two equivalent examples:
-      <ul>
-        <li>101.101.101.0/24</li>
-        <li>101.101.101.0 with mask 255.255.255.0</li>
-      </ul>
-      <p>The '24' is shorthand for a mask with the top 24 bits one and the
-      rest zero. This is exactly the same as 255.255.255.0 which has three
-      all-ones bytes and one all-zeros byte.</p>
-      <p>These indicate that, for this range of addresses, the top 24 bits
-      are to be treated as naming a network (often referred to as "the
-      101.101.101.0/24 subnet") while most combinations of the low 8 bits can
-      be used to designate machines on that network. Two addresses are
-      reserved; 101.101.101.0 refers to the subnet rather than a specific
-      machine while 101.101.101.255 is a broadcast address. 1 to 254 are
-      available for machines.</p>
-      <p>It is common to find subnets arranged in a hierarchy. For example, a
-      large company might have a /16 subnet and allocate /24 subnets within
-      that to departments. An ISP might have a large subnet and allocate /26
-      subnets (64 addresses, 62 usable) to business customers and /29 subnets
-      (8 addresses, 6 usable) to residential clients.</p>
-    </dd>
-  <dt><a name="SWAN">S/WAN</a></dt>
-    <dd>Secure Wide Area Network, a project involving <a href="#RSAco">RSA
-      Data Security</a> and a number of other companies. The goal was to
-      ensure that all their <a href="#IPSEC">IPsec</a> implementations would
-      interoperate so that their customers can communicate with each other
-      securely.</dd>
-  <dt><a name="symmetric">Symmetric cryptography</a></dt>
-    <dd>Symmetric cryptography, also referred to as conventional or secret
-      key cryptography, relies on a <em>shared secret key</em>, identical for
-      sender and receiver. Sender encrypts with that key, receiver decrypts
-      with it. The idea is that an eavesdropper without the key be unable to
-      read the messages. There are two main types of symmetric cipher, <a
-      href="#block">block ciphers</a> and <a href="#stream">stream
-      ciphers</a>.
-      <p>Symmetric cryptography contrasts with <a href="#public">public
-      key</a> or asymmetric systems where the two players use different
-      keys.</p>
-      <p>The great difficulty in symmetric cryptography is, of course, key
-      management. Sender and receiver <em>must</em> have identical keys and
-      those keys <em>must</em> be kept secret from everyone else. Not too
-      much of a problem if only two people are involved and they can
-      conveniently meet privately or employ a trusted courier. Quite a
-      problem, though, in other circumstances.</p>
-      <p>It gets much worse if there are many people. An application might be
-      written to use only one key for communication among 100 people, for
-      example, but there would be serious problems. Do you actually trust all
-      of them that much? Do they trust each other that much? Should they?
-      What is at risk if that key is compromised? How are you  going to
-      distribute that key to everyone without risking its secrecy? What do
-      you do when one of them leaves the company? Will you even know?</p>
-      <p>On the other hand, if you need unique keys for every possible
-      connection between a group of 100, then each user must have 99 keys.
-      You need either 99*100/2 = 4950 <em>secure</em> key exchanges between
-      users or a central authority that <em>securely</em> distributes 100 key
-      packets, each with a different set of 99 keys.</p>
-      <p>Either of these is possible, though tricky, for 100 users. Either
-      becomes an administrative nightmare for larger numbers. Moreover, keys
-      <em>must</em> be changed regularly, so the problem of key distribution
-      comes up again and again. If you use the same key for many messages
-      then an attacker has more text to work with in an attempt to crack that
-      key. Moreover, one successful crack will give him or her the text of
-      all those messages.</p>
-      <p>In short, the <em>hardest part of conventional cryptography is key
-      management</em>. Today the standard solution is to build a <a
-      href="#hybrid">hybrid system</a> using <a href="#public">public key</a>
-      techniques to manage keys.</p>
-    </dd>
-  <dt><a name="T">T</a></dt>
-  <dt><a name="TIS">TIS</a></dt>
-    <dd>Trusted Information Systems, a firewall vendor now part of <a
-      href="#NAI">NAI</a>. Their Gauntlet product offers IPsec VPN services.
-      TIS implemented the first version of <a href="#SDNS">Secure DNS</a> on
-      a <a href="#DARPA">DARPA</a> contract.</dd>
-  <dt><a name="TLS">TLS</a></dt>
-    <dd><b>T</b>ransport <b>L</b>ayer <b>S</b>ecurity, a newer name for <a
-      href="#SSL">SSL</a>.</dd>
-  <dt><a name="TOS">TOS field</a></dt>
-    <dd>The <strong>T</strong>ype <strong>O</strong>f
-      <strong>S</strong>ervice field in an IP header, used to control
-      qualkity of service routing.</dd>
-  <dt><a name="traffic">Traffic analysis</a></dt>
-    <dd>Deducing useful intelligence from patterns of message traffic,
-      without breaking codes or reading the messages. In one case during
-      World War II, the British guessed an attack was coming because all
-      German radio traffic stopped. The "radio silence" order, intended to
-      preserve security, actually gave the game away.
-      <p>In an industrial espionage situation, one might deduce something
-      interesting just by knowing that company A and company B were talking,
-      especially if one were able to tell which departments were involved, or
-      if one already knew that A was looking for acquisitions and B was
-      seeking funds for expansion.</p>
-      <p>In general, traffic analysis by itself is not very useful. However,
-      in the context of a larger intelligence effort where quite a bit is
-      already known, it can be very useful. When you are solving a complex
-      puzzle, every little bit helps.</p>
-      <p><a href="#IPSEC">IPsec</a> itself does not defend against traffic
-      analysis, but carefully thought out systems using IPsec can provide at
-      least partial protection. In particular, one might want to encrypt more
-      traffic than was strictly necessary, route things in odd ways, or even
-      encrypt dummy packets, to confuse the analyst. We discuss this <a
-      href="ipsec.html#traffic.resist">here</a>.</p>
-    </dd>
-  <dt><a name="transport">Transport mode</a></dt>
-    <dd>An IPsec application in which the IPsec gateway is the destination of
-      the protected packets, a machine acts as its own gateway. Contrast with
-      <a href="#tunnel">tunnel mode</a>.</dd>
-  <dt>Triple DES</dt>
-    <dd>see <a href="#3DES">3DES</a></dd>
-  <dt><a name="TTL">TTL</a></dt>
-    <dd><strong>T</strong>ime <strong>T</strong>o <strong>L</strong>ive, used
-      to control <a href="#DNS">DNS</a> caching. Servers discard cached
-      records whose TTL expires</dd>
-  <dt><a name="tunnel">Tunnel mode</a></dt>
-    <dd>An IPsec application in which an IPsec gateway provides protection
-      for packets to and from other systems. Contrast with <a
-      href="#transport">transport mode</a>.</dd>
-  <dt><a name="2key">Two-key Triple DES</a></dt>
-    <dd>A variant of <a href="#3DES">triple DES or 3DES</a> in which only two
-      keys are used. As in the three-key version, the order of operations is
-      <a href="#EDE">EDE</a> or encrypt-decrypt-encrypt, but in the two-key
-      variant the first and third keys are the same.
-      <p>3DES with three keys has 3*56 = 168 bits of key but has only 112-bit
-      strength against a <a href="#meet">meet-in-the-middle</a> attack, so it
-      is possible that the two key version is just as strong. Last I looked,
-      this was an open question in the research literature.</p>
-      <p>RFC 2451 defines triple DES for <a href="#IPSEC">IPsec</a> as the
-      three-key variant. The two-key variant should not be used and is not
-      implemented directly in <a href="#FreeSWAN">Linux FreeS/WAN</a>. It
-      cannot be used in automatically keyed mode without major fiddles in the
-      source code. For manually keyed connections, you could make Linux
-      FreeS/WAN talk to a two-key implementation by setting two keys the same
-      in /etc/ipsec.conf.</p>
-    </dd>
-  <dt><a name="U">U</a></dt>
-  <dt><a name="V">V</a></dt>
-  <dt><a name="virtual">Virtual Interface</a></dt>
-    <dd>A <a href="#Linux">Linux</a> feature which allows one physical
-      network interface to have two or more IP addresses. See the <cite>Linux
-      Network Administrator's Guide</cite> in <a
-      href="biblio.html#kirch">book form</a> or <a
-      href="http://metalab.unc.edu/LDP/LDP/nag/node1.html">on the web</a> for
-      details.</dd>
-  <dt>Virtual Private Network</dt>
-    <dd>see <a href="#VPN">VPN</a></dd>
-  <dt><a name="VPN">VPN</a></dt>
-    <dd><b>V</b>irtual <b>P</b>rivate <b>N</b>etwork, a network which can
-      safely be used as if it were private, even though some of its
-      communication uses insecure connections. All traffic on those
-      connections is encrypted.
-      <p><a href="#IPSEC">IPsec</a> is not the only technique available for
-      building VPNs, but it is the only method defined by <a
-      href="#RFC">RFCs</a> and supported by many vendors. VPNs are by no
-      means the only thing you can do with IPsec, but they may be the most
-      important application for many users.</p>
-    </dd>
-  <dt><a name="VPNC">VPNC</a></dt>
-    <dd><a href="http://www.vpnc.org">Virtual Private Network Consortium</a>,
-      an association of vendors of VPN products.</dd>
-  <dt><a name="W">W</a></dt>
-  <dt><a name="Wassenaar.gloss">Wassenaar Arrangement</a></dt>
-    <dd>An international agreement restricting export of munitions and other
-      tools of war. Unfortunately, cryptographic software is also restricted
-      under the current version of the agreement. <a
-      href="politics.html#Wassenaar">Discussion</a>.</dd>
-  <dt><a name="web">Web of Trust</a></dt>
-    <dd><a href="#PGP">PGP</a>'s method of certifying keys. Any user can sign
-      a key; you decide which signatures or combinations of signatures to
-      accept as certification. This contrasts with the hierarchy of <a
-      href="#CA">CAs (Certification Authorities)</a> used in many <a
-      href="#PKI">PKIs (Public Key Infrastructures)</a>.
-      <p>See <a href="#GTR">Global Trust Register</a> for an interesting
-      addition to the web of trust.</p>
-    </dd>
-  <dt><a name="WEP">WEP (Wired Equivalent Privacy)</a></dt>
-    <dd>The cryptographic part of the <a href="#IEEE">IEEE</a> standard for
-      wireless LANs. As the name suggests, this is designed to be only as
-      secure as a normal wired ethernet. Anyone with a network conection can
-      tap it. Its advocates would claim this is good design, refusing to
-      build in complex features beyond the actual requirements.
-      <p>Critics refer to WEP as "Wire<em>tap</em> Equivalent Privacy", and
-      consider it a horribly flawed design based on bogus "requirements". You
-      do not control radio waves as you might control your wires, so the
-      metaphor in the rationale is utterly inapplicable. A security policy
-      that chooses not to invest resources in protecting against certain
-      attacks which can only be conducted by people physically plugged into
-      your LAN may or may not be reasonable. The same policy is completely
-      unreasonable when someone can "plug in" from a laptop half a block
-      away..</p>
-      <p>There has been considerable analysis indicating that WEP is
-      seriously flawed. A FAQ on attacks against WEP is available. Part of it
-      reads:</p>
-
-      <blockquote>
-        ... attacks are practical to mount using only inexpensive
-        off-the-shelf equipment. We recommend that anyone using an 802.11
-        wireless network not rely on WEP for security, and employ other
-        security measures to protect their wireless network. Note that our
-        attacks apply to both 40-bit and the so-called 128-bit versions of
-        WEP equally well.</blockquote>
-      <p>WEP appears to be yet another instance of governments, and
-      unfortunately some vendors and standards bodies, deliberately promoting
-      hopelessly flawed "security" products, apparently mainly for the
-      benefit of eavesdropping agencies. See this <a
-      href="politics.html#weak">discussion</a>.</p>
-    </dd>
-  <dt><a name="X">X</a></dt>
-  <dt><a name="X509">X.509</a></dt>
-    <dd>A standard from the <a href="http://www.itu.int">ITU (International
-      Telecommunication Union)</a>, for hierarchical directories with
-      authentication services, used in many <a href="#PKI">PKI</a>
-      implementations.
-      <p>Use of X.509 services, via the <a href="#LDAP">LDAP protocol</a>,
-      for certification of keys is allowed but not required by the <a
-      href="#IPSEC">IPsec</a> RFCs. It is not yet implemented in <a
-      href="#FreeSWAN">Linux FreeS/WAN</a>.</p>
-    </dd>
-  <dt>Xedia</dt>
-    <dd>A vendor of router and Internet access products, now part of Lucent.
-      Their QVPN products interoperate with Linux FreeS/WAN; see our <a
-      href="interop.html#Xedia">interop document</a>.</dd>
-  <dt><a name="Y">Y</a></dt>
-  <dt><a name="Z">Z</a></dt>
-</dl>
-</body>
-</html>
diff --git a/doc/src/index.html b/doc/src/index.html
deleted file mode 100644
index e2530d711..000000000
--- a/doc/src/index.html
+++ /dev/null
@@ -1,55 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>FreeS/WAN index</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, encryption, cryptography, FreeS/WAN, FreeSWAN">
-  <!--
-
-  Written by Claudia Schmeing for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: index.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1>FreeS/WAN documentation</h1>
-
-<ul>
-  <li><a href="intro.html">Introduction</a></li>
-  <li><a href="upgrading.html">Upgrading to 2.x</a></li>
-</ul>
-
-<ul> 
-  <li><a href="quickstart.html">Quickstart guide to Opportunistic Encryption</a></li>
-  <li><a href="install.html">Installing</a></li>
-  <li><a href="config.html">Configuring</a></li>
-  <li><a href="policygroups.html">Policy Groups</a> 
-                   </li>
-  <li><a href="interop.html">Interoperating</a> 
-<FONT COLOR="#FF0000">New and improved!</FONT></li>
-  <li><a href="faq.html">FAQ</a></li>
-  <li><a href="trouble.html">Troubleshooting and problem reporting</a></li>
-</ul>
-
-<ul>
-  <li><a href="toc.html">Full table of contents, with much more</a></li>
-  <li><a href="HowTo.html">All our docs as one big file</a></li>
-</ul>  
-
-<p>For technical support and other questions, use our <a
-href="mail.html">mailing lists</a>.</p>
-
-<pre>        This index last changed:    $Date: 2004/03/15 20:35:24 $</pre>
-
-</body>
-</html>
diff --git a/doc/src/initiatorstate.txt b/doc/src/initiatorstate.txt
deleted file mode 100644
index 315f6da4c..000000000
--- a/doc/src/initiatorstate.txt
+++ /dev/null
@@ -1,66 +0,0 @@
-
-                       |
-	               | PF_ACQUIRE
-		       |     
-                       V
-                .---------------.       
-                |  non-existant |
-                |  connection   |
-                `---------------'
-                 |      |      |
-          send   ,      |      \
-expired   pass  /       |       \ send
-conn.     msg  /        |        \ deny
-  ^           /         |         \ msg
-  |          V          | do       \ 		 
-.---------------.       | DNS       \   .---------------.  
-|  clear-text   |	| lookup     `->|     deny      |---> expired
-|  connection   |	| for 	        |  connection   |     connection
-`---------------'	| destination   `---------------'
-   ^ ^                  |                   ^
-   | | no record        |                   |
-   | | OE-permissive    V                   | no record
-   | |            .---------------.         | OE-paranoid
-   | `------------|  potential OE |---------'
-   |              |  connection   |         ^
-   |              `---------------'         |
-   |                    |                   |
-   |                    | got TXT record    | DNSSEC failure
-   |                    | reply             |
-   |                    V                   | wrong 
-   |              .---------------.         | failure
-   |              |  authenticate |---------'
-   |              | & parse TXT RR|         ^
-   | repeated     `---------------'         |
-   | ICMP               |                   |
-   | failures           | initiate IKE to   |                         
-   | (short-timeout)    | responder         |                         
-   |                    V                   |                          
-   | phase-2      .---------------.         | failure                       
-   | failure      |   pending     |---------'                          
-   | (normal      |     OE        |         ^                          
-   |  timeout)    |               |invalid  | phase-2 failure (short-timeout)
-   |              |               |<--.SPI  | ICMP failures (normal timeout)
-   |              |               |   |     |                          
-   |              | +=======+     |---'     |                          
-   |              | |  IKE  |     |   ^     |                          
-   `--------------| | states|---------------'                          
-                  | +=======+     |   |                                
-                  `---------------'   |                                
-                        |             | invalid SPI                    
-                        |             |                                
-	                V             | rekey time                     
-                  .--------------.    |                                
-                  |   keyed      |<---|-------------------------------.
-                  |  connection  |----'                               |
-                  `--------------'                                    |
-                        |                                             |
-                        |                                             |
-                        V                                             |
-                  .--------------.     connection still active        |
-  clear-text----->|   expired    |------------------------------------'
-        deny----->|  connection  |
-                  `--------------'
-
-
-$Id: initiatorstate.txt,v 1.1 2004/03/15 20:35:24 as Exp $
diff --git a/doc/src/install.html b/doc/src/install.html
deleted file mode 100644
index 09d7c5a67..000000000
--- a/doc/src/install.html
+++ /dev/null
@@ -1,378 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>Installing FreeS/WAN</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, installation, quickstart">
-  <!--
-
-  Written by Claudia Schmeing for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: install.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-<BODY>
-<H1><A name="install">Installing FreeS/WAN</A></H1>
-
-<P>This document will teach you how to install Linux FreeS/WAN. 
-If your distribution comes with Linux FreeS/WAN, we offer
- tips to get you started.</P>
-
-<H2>Requirements</H2>
-
-<P>To install FreeS/WAN you must:</P>
-<UL>
-<LI>be running Linux with the 2.4 or 2.2 kernel series. See 
-this <A HREF="http://www.freeswan.ca/download.php#contact">kernel 
-compatibility table</A>.<BR>We also have experimental support for 
-2.6 kernels. Here are two basic approaches:
-<UL><LI>
-install FreeS/WAN, including its <A HREF="ipsec.html#parts">KLIPS</A>
-kernel code. This will remove the native IPsec stack and replace it
-with KLIPS.</LI>
-<LI>
-install the FreeS/WAN <A HREF="ipsec.html#parts">userland tools</A> 
-(keying daemon and supporting 
-scripts) for use with 
-<A HREF="http://lartc.org/howto/lartc.ipsec.html">2.6 kernel native IPsec</A>,
-</LI>
-</UL>
-See also these <A HREF="2.6.known-issues">known issues with 2.6</A>.
-<LI>have root access to your Linux box</LI>
-<LI>choose the version of FreeS/WAN you wish to install based on
-<A HREF="http://www.freeswan.org/mail.html">mailing list reports</A> <!-- or 
-our updates page (coming soon)--></LI>
-</UL>
-
-<H2>Choose your install method</H2>
-
-<P>There are three basic ways to get FreeS/WAN onto your system:</P>
-<UL>
-<LI>activating and testing a FreeS/WAN that <A HREF="#distroinstall">shipped 
-with your Linux distribution</A></LI>
-<LI><A HREF="#rpminstall">RPM install</A></LI>
-<LI><A HREF="#srcinstall">Install from source</A></LI>
-</UL>
-
-<A NAME="distroinstall"></A><H2>FreeS/WAN ships with some Linuxes</H2>
-
-<P>FreeS/WAN comes with <A HREF="intro.html#distwith">these distributions</A>.
-
-<P>If you're running one of these, include FreeS/WAN in the choices you 
-make during installation, or add it later using the distribution's tools.
-</P>
-
-<H3>FreeS/WAN may be altered...</H3>
-<P>Your distribution may have integrated extra features, such as Andreas
-Steffen's X.509 patch, into FreeS/WAN. It may also use custom
-startup script locations or directory names.</P>
-
-<H3>You might need to create an authentication keypair</H3>
-
-<P>If your FreeS/WAN came with your distribution, you may wish to
- generate a fresh RSA key pair. FreeS/WAN will use these keys
- for authentication.
-
-<P>
-To do this, become root, and type:
-</P>
-
-<PRE>    ipsec newhostkey --output /etc/ipsec.secrets --hostname xy.example.com
-    chmod 600 /etc/ipsec.secrets</PRE>
-
-<P>where you replace xy.example.com with your machine's fully-qualified 
-domain name. Generate some randomness, for example by wiggling your mouse, 
-to speed the process.
-</P>
-
-<P>The resulting ipsec.secrets looks like:</P>
-<PRE>: RSA   {
-        # RSA 2192 bits   xy.example.com   Sun Jun 8 13:42:19 2003
-        # for signatures only, UNSAFE FOR ENCRYPTION
-        #pubkey=0sAQOFppfeE3cC7wqJi...
-        Modulus: 0x85a697de137702ef0...
-        # everything after this point is secret
-        PrivateExponent: 0x16466ea5033e807...
-        Prime1: 0xdfb5003c8947b7cc88759065...
-        Prime2: 0x98f199b9149fde11ec956c814...
-        Exponent1: 0x9523557db0da7a885af90aee...
-        Exponent2: 0x65f6667b63153eb69db8f300dbb...
-        Coefficient: 0x90ad00415d3ca17bebff123413fc518...
-        }
-# do not change the indenting of that "}"</PRE>
-
-<P>In the actual file, the strings are much longer.</P>
-
-
-<H3>Start and test FreeS/WAN</H3>
-
-<P>You can now <A HREF="install.html#starttest">start FreeS/WAN and 
-test whether it's been successfully installed.</A>.</P>
-
-
-<A NAME="rpminstall"></A><H2>RPM install</H2>
-
-<P>These instructions are for a recent Red Hat with a stock Red Hat kernel.
-We know that Mandrake and SUSE also produce FreeS/WAN RPMs. If you're 
-running either, install using your distribution's tools.</P>
- 
-<H3>Download RPMs</H3>
-
-<P>Decide which functionality you need:</P>
-<UL>
-<LI>standard FreeS/WAN RPMs. Use these shortcuts:<BR>
-<UL>
-<LI>(for 2.6 kernels: userland only)<BR>
-ncftpget ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs/\*userland*</LI>
-
-<LI>(for 2.4 kernels)<BR>
-ncftpget ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs/`uname -r | tr -d 'a-wy-z'`/\*</LI>
-<LI>
-or view all the offerings at our
-<A href="ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs">FTP site</A>.
-</LI></UL>
-</LI>
-<LI>unofficial
-<A href="http://www.freeswan.ca/download.php">Super FreeS/WAN</A> 
-RPMs, which include Andreas Steffen's X.509 patch and more. 
-Super FreeS/WAN RPMs do not currently include 
-<A HREF="glossary.html#NAT.gloss">Network Address Translation</A>
-(NAT) traversal, but Super FreeS/WAN source does.</LI>
-</UL>
-
-<A NAME="2.6.rpm"></A>
-<P>For 2.6 kernels, get the latest FreeS/WAN userland RPM, for example:</P>
-<PRE>    freeswan-userland-2.04.9-0.i386.rpm</PRE>
-
-<P>Note: FreeS/WAN's support for 2.6 kernel IPsec is preliminary. Please see 
-<A HREf="2.6.known-issues">2.6.known-issues</A>, and the latest
-<A HREF="http://www.freeswan.org/mail.html">mailing list reports</A>.</P>                                                                                
-<P>Change to your new FreeS/WAN directory, and make and install the 
-
-<P>For 2.4 kernels, get both kernel and userland RPMs.
-Check your kernel version with</P>
-<PRE>    uname -r</PRE>
-
-<P>Get a kernel module which matches that version. For example:</P>
-<PRE>    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm</PRE>
-<P>Note: These modules 
-<B>will only work on the Red Hat kernel they were built for</B>,
-since they are very sensitive to small changes in the kernel.</P>
-
-
-<P>Get FreeS/WAN utilities to match. For example:</P>
-<PRE>    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm</PRE>
-
-
-<H3>For freeswan.org RPMs: check signatures</H3>
-
-<P>While you're at our ftp site, grab the RPM signing key</P>
-<PRE>    freeswan-rpmsign.asc</PRE>
-
-<P>If you're running RedHat 8.x or later, import this key into the RPM 
-database:</P>
-<PRE>    rpm --import freeswan-rpmsign.asc</PRE>
- 
-<P>For RedHat 7.x systems, you'll need to add it to your 
-<A HREF="glossary.html#PGP">PGP</A> keyring:</P>
-<PRE>    pgp -ka freeswan-rpmsign.asc</PRE>
-
-
-<P>Check the digital signatures on both RPMs using:</P>
-<PRE>    rpm --checksig freeswan*.rpm </PRE>
-
-<P>You should see that these signatures are good:</P>
-<PRE>    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm: pgp md5 OK
-    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm: pgp md5 OK</PRE>
-
-
-<H3>Install the RPMs</H3>
-
-<P>Become root:</P>
-<PRE>    su</PRE>
-
-<P>For a first time install, use:</P>
-<PRE>    rpm -ivh freeswan*.rpm</PRE>
-
-<P>To upgrade existing RPMs (and keep all .conf files in place), use:</P>
-<PRE>    rpm -Uvh freeswan*.rpm</PRE>
-
-<P>If you're upgrading from FreeS/WAN 1.x to 2.x RPMs, and encounter problems,
-see <A HREF="upgrading.html#upgrading.rpms">this note</A>.</P>
-
-
-<H3>Start and Test FreeS/WAN</H3>
-
-<P>Now, <A HREF="install.html#starttest">start FreeS/WAN and test your 
-install</A>.</P>
-
-
-<A NAME="srcinstall"></A><H2>Install from Source</H2>
-<!-- Most of this section, along with "Start and Test", can replace 
-INSTALL. -->
-
-<H3>Decide what functionality you need</H3>
-
-<P>Your choices are:</P>
-<UL>
-<LI><A HREF="ftp://ftp.xs4all.nl/pub/crypto/freeswan">standard 
-FreeS/WAN</A>,</LI>
-<LI>standard FreeS/WAN plus any of these
- <A HREF="web.html#patch">user-supported patches</A>, or</LI>
-<LI><A HREF="http://www.freeswan.ca/download">Super FreeS/WAN</A>,
-an unofficial FreeS/WAN pre-patched with many of the above. Provides 
-additional algorithms, X.509, SA deletion, dead peer detection, and 
-<A HREF="glossary.html#NAT.gloss">Network Address Translation</A>
-(NAT) traversal.</LI>
-</UL>
-
-<H3>Download FreeS/WAN</H3>
-
-<P>Download the source tarball you've chosen, along with any patches.</P>
-
-<H3>For freeswan.org source: check its signature</H3>
-
-<P>While you're at our ftp site, get our source signing key</P>
-<PRE>    freeswan-sigkey.asc</PRE>
-
-<P>Add it to your PGP keyring:</P>
-<PRE>    pgp -ka freeswan-sigkey.asc</PRE>
-
-
-<P>Check the signature using:</P>
-<PRE>    pgp freeswan-2.04.tar.gz.sig freeswan-2.04.tar.gz</PRE>
-<P>You should see something like:</P>
-<PRE>    Good signature from user "Linux FreeS/WAN Software Team (build@freeswan.org)".
-    Signature made 2002/06/26 21:04 GMT using 2047-bit key, key ID 46EAFCE1</PRE>
-<!-- Note to self: build@freeswan.org has angled brackets in the original.
-     Changed because it conflicts with HTML tags. -->
-
-<H3>Untar, unzip</H3>
-
-<P>As root, unpack your FreeS/WAN source into <VAR>/usr/src</VAR>.</P>
-<PRE>    su
-    mv freeswan-2.04.tar.gz /usr/src
-    cd /usr/src
-    tar -xzf freeswan-2.04.tar.gz
-</PRE>
-
-<H3>Patch if desired</H3>
-
-<P>Now's the time to add any patches. The contributor may have special 
-instructions, or you may simply use the patch command.</P>
-
-<H3>... and Make</H3>
-
-<P>Choose one of the methods below.</P>
-
-<H4>Userland-only Install for 2.6 kernels</H4>
-<A NAME="2.6.src"></A>
-
-<P>Note: FreeS/WAN's support for 2.6 kernel IPsec is preliminary. Please see 
-<A HREf="2.6.known-issues">2.6.known-issues</A>, and the latest
-<A HREF="http://www.freeswan.org/mail.html">mailing list reports</A>.</P>                                                                                
-<P>Change to your new FreeS/WAN directory, and make and install the 
-FreeS/WAN userland tools.</P>
-<PRE>    cd /usr/src/freeswan-2.04
-    make programs
-    make install</PRE>
-                                                                                
-<P>Now, <A HREF="install.html#starttest">start FreeS/WAN and
-test your install</A>.</P>
-
-
-
-<H4>KLIPS install for 2.2, 2.4, or 2.6 kernels</H4>
-
-<A NAME="modinstall"></A>
-
-<P>To make a modular version of KLIPS, along with other FreeS/WAN programs 
-you'll need, use the command sequence below. This will
-change to your new FreeS/WAN directory, make the FreeS/WAN module (and other
-stuff), and install it all.</P>
-<PRE>    cd /usr/src/freeswan-2.04
-    make oldmod
-    make minstall</PRE>
- 
-<P><A HREF="install.html#starttest">Start FreeS/WAN and 
-test your install</A>.</P>
-
-
-
-<P>To link KLIPS statically into your kernel (using your old kernel settings), 
-and install other FreeS/WAN components, do:
-</P>
-<PRE>    cd /usr/src/freeswan-2.04
-    make oldmod
-    make minstall</PRE>
-
-
-<P>Reboot your system and <A HREF="install.html#testonly">test your 
-install</A>.</P>
-
-<P>For other ways to compile KLIPS, see our Makefile.</P>
-
-
-
-<A name="starttest"></A><H2>Start FreeS/WAN and test your install</H2>
-
-<P>Bring FreeS/WAN up with:</P>
-<PRE>    service ipsec start</PRE>
-
-<P>This is not necessary if you've rebooted.</P>
-
-<A name="testonly"></A><H2>Test your install</H2>
-
-<P>To check that you have a successful install, run:</P>
-<PRE>    ipsec verify</PRE>
-
-<P>You should see at least:</P>
-<PRE>
-    Checking your system to see if IPsec got installed and started correctly
-    Version check and ipsec on-path                             [OK]
-    Checking for KLIPS support in kernel                        [OK]
-    Checking for RSA private key (/etc/ipsec.secrets)           [OK]
-    Checking that pluto is running                              [OK]
-</PRE>
-
-<P>If any of these first four checks fails, see our 
-<A href="trouble.html#install.check">troubleshooting guide</A>.
-</P>
-
-
-<H2>Making FreeS/WAN play well with others</H2>
-
-<P>There are at least a couple of things on your system that might 
-interfere with FreeS/WAN, and now's a good time to check these:</P>
-<UL>
-  <LI>Firewalling. You need to allow UDP 500 through your firewall, plus 
- ESP (protocol 50) and AH (protocol 51). For more information, see our
-  updated firewalls document (coming soon).
- </LI>
-  <LI>Network address translation. 
-Do not NAT the packets you will be tunneling.</LI>
-</UL>
-
-
-<H2>Configure for your needs</H2>
-
-<P>You'll need to configure FreeS/WAN for your local site. Have a look at our 
-<A HREF="quickstart.html">opportunism quickstart guide</A> to see if that
-easy method is right for your needs. Or, see how to <A HREF="config.html">
-configure a network-to-network or Road Warrior style VPN</A>.
-</P>
-
-
-
-
-</BODY>
-</HTML>
diff --git a/doc/src/interop.html b/doc/src/interop.html
deleted file mode 100644
index dd4f8c577..000000000
--- a/doc/src/interop.html
+++ /dev/null
@@ -1,1802 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>FreeS/WAN interoperation Grid</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, interoperation">
-  <!--
-
-  Written by Claudia Schmeing for the Linux FreeS/WAN project
-  With notes from Sandy Harris.
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: interop.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<A NAME="interop"></A><H1>Interoperating with FreeS/WAN</H1>
-
-
-<P>The FreeS/WAN project needs you! We rely on the user community to keep
-up to date. Mail users@lists.freeswan.org with your
-interop success stories.</P>
-
-<P><STRONG>Please note</STRONG>: Most of our interop examples feature 
-Linux FreeS/WAN 1.x config files. You can convert them to 2.x files fairly 
-easily with the patch in our 
-<A HREF="upgrading.html#ipsec.conf_v2">Upgrading Guide</A>.
-</P>
-
-<H2>Interop at a Glance</H2>
-
-
-
-<TABLE BORDER="1">
-
-<TR>
-<TD>&nbsp;</TD>
-<TD colspan="5">FreeS/WAN VPN</TD>
-<TD>Road Warrior</TD>
-<TD>OE</TD>
-</TR>
-
-<TR>
-<TD>&nbsp;</TD>
-<TD>PSK</TD>
-<TD>RSA Secret</TD>
-<TD>X.509<BR><SMALL><A HREF="#interoprules">(requires patch)</A></SMALL></TD>
-<TD>NAT-Traversal<BR><SMALL><A HREF="#interoprules">(requires patch)</A></SMALL></TD>
-<TD>Manual<BR>Keying</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-</TR>
-
-
-<TR><TD colspan="8">More Compatible</TD></TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#freeswan">FreeS/WAN</A>
-<A NAME="freeswan.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#isakmpd">isakmpd (OpenBSD)</A>
-<A NAME="isakmpd.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No&nbsp;&nbsp;&nbsp;&nbsp;</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#kame">Kame (FreeBSD,
-<BR>NetBSD, MacOSX)
-<BR> <SMALL>aka racoon</SMALL></A>
-<A NAME="kame.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#mcafee">McAfee VPN<BR><SMALL>was PGPNet</SMALL></A>
-<A NAME="mcafee.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#microsoft">Microsoft <BR>Windows 2000/XP</A>
-<A NAME="microsoft.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-<TR>
-<TD><A HREF="#ssh">SSH Sentinel</A>
-<A NAME="ssh.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#cccc00">Maybe</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#safenet">Safenet SoftPK<BR>/SoftRemote</A>
-<A NAME="safenet.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-
-<TR><TD colspan="8">Other</TD></TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#6wind">6Wind</A>
-<A NAME="6wind.top">&nbsp;</A></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#alcatel">Alcatel Timestep</A>
-<A NAME="alcatel.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#apple">Apple Macintosh<br>System 10+</A>
-<A NAME="apple.top">&nbsp;</A></TD>
-<TD><FONT color="#cccc00">Maybe</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#cccc00">Maybe</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cccc00">Maybe</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#ashleylaurent">AshleyLaurent <BR>VPCom</A>
-<A NAME="ashleylaurent.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#borderware">Borderware</A>
-<A NAME="borderware.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-<!--
-http://www.cequrux.com/vpn-guides.php3
-"coming soon" guide to connect with FreeS/WAN.
--->
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#checkpoint">Check Point FW-1/VPN-1</A>
-<A NAME="checkpoint.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#cisco">Cisco with 3DES</A>
-<A NAME="cisco.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#cccc00">Maybe</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cccc00">Maybe</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#equinux">Equinux VPN Tracker <BR>
-(for Mac OS X)
-</A>
-<A NAME="equinux.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cccc00">Maybe</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#fsecure">F-Secure</A>
-<A NAME="fsecure.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cccc00">Maybe</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#gauntlet">Gauntlet GVPN</A>
-<A NAME="gauntlet.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#aix">IBM AIX</A>
-<A NAME="aix.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cccc00">Maybe</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#as400">IBM AS/400</A>
-<A NAME="as400">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#intel">Intel Shiva<BR>LANRover/Net Structure</A>
-<A NAME="intel.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#lancom">LanCom (formerly ELSA)</A>
-<A NAME="lancom.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#linksys">Linksys</A>
-<A NAME="linksys.top">&nbsp;</A></TD>
-<TD><FONT color="#cccc00">Maybe</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#lucent">Lucent</A>
-<A NAME="lucent.top">&nbsp;</A></TD>
-<TD><FONT color="#cccc00">Partial</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#netasq">Netasq</A>
-<A NAME="netasq.top">&nbsp;</A></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#netcelo">netcelo</A>
-<A NAME="netcelo.top">&nbsp;</A></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#netgear">Netgear fvs318</A>
-<A NAME="netgear.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#netscreen">Netscreen 100<BR>or 5xp</A>
-<A NAME="netscreen.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cccc00">Maybe</FONT></TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#nortel">Nortel Contivity</A>
-<A NAME="nortel.top">&nbsp;</A></TD>
-<TD><FONT color="#cccc00">Partial</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD><FONT color="#cccc00">Maybe</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#radguard">RadGuard</A>
-<A NAME="radguard.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#raptor">Raptor</A>
-<A NAME="raptor">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#redcreek">Redcreek Ravlin</A>
-<A NAME="redcreek.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT><FONT color="#cccc00">/Partial</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#sonicwall">SonicWall</A>
-<A NAME="sonicwall.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cccc00">Maybe</FONT></TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#sun">Sun Solaris</A>
-<A NAME="sun.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#symantec">Symantec</A>
-<A NAME="symantec.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#watchguard">Watchguard <BR>Firebox</A>
-<A NAME="watchguard.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#xedia">Xedia Access Point<BR>/QVPN</A>
-<A NAME="xedia.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-<TR>
-<TD><A HREF="#zyxel">Zyxel Zywall<BR>/Prestige</A>
-<A NAME="zyxel.top">&nbsp;</A></TD>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
-
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE
-
-
-<TR>
-<TD><A HREF="#sample">sample</A></TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-<TD><FONT color="#cc0000">No</FONT></TD>
-</TR>
-
--->
-
-<TR>
-<TD>&nbsp;</TD>
-<TD>PSK</TD>
-<TD>RSA Secret</TD>
-<TD>X.509<BR><SMALL><A HREF="#interoprules">(requires patch)</A></SMALL></TD>
-<TD>NAT-Traversal<BR><SMALL><A HREF="#interoprules">(requires patch)</A></SMALL></TD>
-<TD>Manual<BR>Keying</TD>
-<TD>&nbsp;</TD>
-<TD>&nbsp;</TD>
-</TR>
-
-<TR>
-<TD>&nbsp;</TD>
-<TD colspan="5">FreeS/WAN VPN</TD>
-<TD>Road Warrior</TD>
-<TD>OE</TD>
-</TR>
-
-
-
-<!-- PSK  RSA  X.509  NAT-T  Manual  RW  OE -->
-
-</TABLE>
-
-
-
-
-<H3>Key</H3>
-<TABLE BORDER="1">
-
-<TR>
-<TD><FONT color="#00cc00">Yes</FONT></TD>
-<TD>People report that this works for them.</TD>
-</TR>
-
-<TR>
-<TD>[Blank]</TD>
-<TD>We don't know.</TD>
-</TR>
-
-<TR>
-<TD><FONT color="#cc0000">No</FONT></TD>
-<TD>We have reason to believe
-it was, at some point, not possible to get this to work.</TD>
-</TR>
-
-<TR>
-<TD><FONT color="#cccc00">Partial</FONT></TD>
-<TD>Partial success. For example, a connection can be 
-created from one end only.</TD>
-</TR>
-
-<TR>
-<TD><FONT color="#00cc00">Yes</FONT><FONT color="#cccc00">/Partial</FONT></TD>
-<TD>Mixed reports.</TD>
-</TR>
-
-
-<TR>
-<TD><FONT color="#cccc00">Maybe</FONT></TD>
-<TD>We think the answer is "yes", but need confirmation.</TD>
-</TR>
-
-
-</TABLE>
-
-<A NAME="interoprules"></A><h2>Basic Interop Rules</h2>
-
-<P>Vanilla
-FreeS/WAN implements <A HREF="compat.html#compat">these parts</A> of the
-IPSec specifications. You can add more with 
-<A HREF="http://www.freeswan.ca">Super FreeS/WAN</A>, 
-but what we offer may be enough for many users.</P>
-<UL>
-<LI>
-To use X.509 certificates with FreeS/WAN, you will need 
-the <A HREF="http://www.strongsec.org/freeswan">X.509 patch</a> 
-or <A HREF="http://www.freeswan.ca">Super FreeS/WAN</A>,
-which includes that patch.</LI>
-<LI>
-To use 
-<A HREF="glossary.html#NAT.gloss">Network Address Translation</A> 
-(NAT) traversal
-with FreeS/WAN, you will need Arkoon Network Security's
-<A HREF="http://open-source.arkoon.net">NAT traversal patch</A>
-or <A HREF="http://www.freeswan.ca">Super FreeS/WAN</A>, which includes it.
-</LI>
-</UL>
-
-
-<P>We offer a set of proposals which is not user-adjustable, but covers
-all combinations that we can offer.
-FreeS/WAN always proposes triple DES encryption and
-Perfect Forward Secrecy (PFS).
-In addition, we propose Diffie Hellman groups 5 and 2 
-(in that order), and MD5 and SHA-1 hashes.
-We accept the same proposals, in the same order of preference. 
-</P>
-
-<P>Other interop notes:</P>
-<UL>
-<LI>
-A <A HREF="http://lists.freeswan.org/archives/users/2003-September/msg00462.html">SHA-1 
-bug in FreeS/WAN 2.00, 2.01 and 2.02</A> may affect some
-interop scenarios. It does not affect 1.x versions, and is fixed in 2.03 and
-later.
-</LI>
-<LI>
-Some other implementations will close a connection with FreeS/WAN
-after some time. This may be a problem with rekey lifetimes. Please see
-<A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00293.html">
-this tip</A> and 
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-December/005758.html">
-this workaround</A>.
-</LI>
-</UL>
-
-<H2>Longer Stories</H2>
-
-
-<H3>For <EM>More Compatible</EM> Implementations</H3>
-
-
-<H4><A NAME="freeswan">FreeS/WAN</A></H4>
-
-<P>
-See our documentation at <A HREF="http://www.freeswan.org">freeswan.org</A>
-and the Super FreeS/WAN docs at 
-<A HREF="http://www.freeswan.ca">freeswan.ca</A>.
-Some user-written HOWTOs for FreeS/WAN-FreeS/WAN connections
-are listed in <A HREF="intro.html#howto">our Introduction</A>.
-</P>
-
-<P>See also:</P>
-
-<UL>
-<LI>
-<A HREF="http://lugbe.ch/action/reports/ipsec_htbe.phtml">A German FreeS/WAN-FreeS/WAN page by Markus Wernig (X.509)</A>
-</LI>
-</UL>
-
-
-<P><A HREF="#freeswan.top">Back to chart</A></P>
-
-
-<H4><A NAME="isakmpd">isakmpd (OpenBSD)</A></H4>
-
-<P><A HREF="http://www.openbsd.org/faq/faq13.html">OpenBSD FAQ: Using IPsec</A><BR>
-<A HREF="http://www.rommel.stw.uni-erlangen.de/~hshoexer/ipsec-howto/HOWTO.html">Hans-Joerg Hoexer's interop Linux-OpenBSD (PSK)</A><BR>
-<A HREF="http://www.segfault.net/ipsec/">Skyper's configuration (PSK)</A>
-<BR>
-<A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
-French page with configs (X.509)</A>
-
-
-</P>
-
-<P><A HREF="#isakmpd.top">Back to chart</A></P>
-
-
-<H4><A NAME="kame">Kame</A></H4>
-
-<UL>
-<LI>For FreeBSD and NetBSD. Ships with Mac OS X; see also our
-<A HREF="#apple">Mac</A> section.</LI>
-<LI>Also known as <EM>racoon</EM>, its keying daemon.</LI>
-</UL>
-
-<P><A HREF="http://www.kame.net">Kame homepage, with FAQ</A><BR>
-<A HREF="http://www.netbsd.org/Documentation/network/ipsec">NetBSD's IPSec FAQ</A><BR>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/12/msg00560.html">Ghislaine's post explaining some interop peculiarities</A>
-</P>
-<P>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/09/msg00511.html">Itojun's Kame-FreeS/WAN interop tips (PSK)</A><BR>
-<A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2000">Ghislaine Labouret's French page with links to matching FreeS/WAN and Kame configs (RSA)</A><BR>
-<A HREF="http://lugbe.ch/lostfound/contrib/freebsd_router/">Markus Wernig's
-HOWTO (X.509, BSD gateway)</A><BR>
-<A HREF="http://web.morgul.net/~frodo/docs/kame+freeswan_interop.html">Frodo's Kame-FreeS/WAN interop (X.509)</A><BR>
-<A HREF="http://www.wavesec.org/kame.phtml">Kame as a WAVEsec client.</A>
-</P>
-
-<P><A HREF="#kame.top">Back to chart</A></P>
-
-
-<H4><A NAME="mcafee">PGPNet/McAfee</A></H4>
-
-<P>
-<UL>
-<LI>Now called McAfee VPN Client.</LI>
-<LI>PGPNet also came in a freeware version which did not support subnets</LI>
-<LI>To support dhcp-over-ipsec, you need the X.509 patch, which is included in
-<A HREF="http://www.freeswan.ca">Super FreeS/WAN</A>.
-</LI>
-</UL>
-<P>
-<A HREF="http://www.freeswan.ca/docs/WindowsInterop">Tim Carr's Windows Interop Guide (X.509)</A><BR>
-<A HREF="http://www.rommel.stw.uni-erlangen.de/~hshoexer/ipsec-howto/HOWTO.html#Interop2"
->Hans-Joerg Hoexer's Guide for Linux-PGPNet (PSK)</A><BR>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/04/msg00339.html">Kai Martius' instructions using RSA Key-Extractor Tool (RSA)</A><BR>
-&nbsp;&nbsp;&nbsp;&nbsp;<A HREF="http://www.zengl.net/freeswan/english.html">Christian Zeng's page (RSA)</A> based on Kai's work. English or German.<BR>
-<A HREF="http://tirnanog.ls.fi.upm.es/CriptoLab/Biblioteca/InfTech/InfTech_CriptoLab.htm">
-Oscar Delgado's PDF (X.509, no configs)</A><BR>
-<A HREF="http://www-ec.njit.edu/~rxt1077/Howto.txt">Ryan's HOWTO for FreeS/WAN-PGPNet (X.509)</A>. Through a Linksys Router with IPsec Passthru enabled.<BR>
-<A HREF="http://jixen.tripod.com/#RW-PGP-to-Fwan">Jean-Francois Nadeau's Practical Configuration (Road Warrior with PSK)</A><BR>
-<A HREF="http://www.evolvedatacom.nl/freeswan.html#toc">Wouter Prins' HOWTO (Road Warrior with X.509)</A><BR>
-</P>
-<P>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/01/msg00271.html">Rekeying problem with FreeS/WAN and older PGPNets</A><BR>
-</P>
-
-<P><A HREF="http://www.strongsec.com/freeswan/dhcprelay/index.htm">
-DHCP over IPSEC HOWTO for FreeS/WAN (requires X.509 and dhcprelay patches)
-</A>
-</P>
-
-<P><A HREF="#mcafee.top">Back to chart</A></P>
-
-
-<H4><A NAME="microsoft">Microsoft Windows 2000/XP</A></H4>
-
-<UL>
-<LI>IPsec comes with Win2k, and with XP Support Tools. May require
-<A HREF="http://www.microsoft.com/windows2000/downloads/recommended/encryption/default.asp"> High Encryption Pack</A>. WinXP users have also reported better
-results with Service Pack 1.</LI>
-<LI>The Road Warrior setup works either way round. Windows (XP or 2K) IPsec
-can connect as a Road Warrior to FreeS/WAN. 
-However, FreeS/WAN can also successfully connect as a Road 
-Warrior to Windows IPsec (see Nate Carlson's configs below).</LI>
-<LI>FreeS/WAN version 1.92 or later is required to avoid an interoperation
-problem with Windows native IPsec. Earlier FreeS/WAN versions 
-did not process the Commit Bit as Windows native IPsec expected.</LI>
-</UL>
-
-<P>
-<A HREF="http://www.freeswan.ca/docs/WindowsInterop">Tim Carr's Windows Interop Guide (X.509)</A><BR>
-
-<A HREF="http://ipsec.math.ucla.edu/services/ipsec.html">James Carter's
-instructions (X.509, NAT-T)</A><BR>
-
-<A HREF="http://jixen.tripod.com/#Win2000-Fwan">
-Jean-Francois Nadeau's Net-net Configuration (PSK)</A><BR>
-
-<A HREF="http://security.nta.no/freeswan-w2k.html">
-Telenor's Node-node Config (Transport-mode PSK)</A><BR>
-
-<A HREF="http://vpn.ebootis.de">Marcus Mueller's HOWTO using his VPN config tool (X.509).</A> Tool also works with PSK.<BR>
-
-<A HREF="http://www.natecarlson.com/include/showpage.php?cat=linux&page=ipsec-x509">
-Nate Carlson's HOWTO using same tool (Road Warrior with X.509)</A>. Unusually,
-FreeS/WAN is the Road Warrior here.<BR>
-
-<A HREF="http://tirnanog.ls.fi.upm.es/CriptoLab/Biblioteca/InfTech/InfTech_CriptoLab.htm">
-Oscar Delgado's PDF (X.509, no configs)</A><BR>
-
-<A HREF="http://lists.freeswan.org/pipermail/users/2003-July/022425.html">Tim Scannell's Windows XP Additional Checklist (X.509)</A><BR>
-</P>
-
-<!-- Note to self: Include L2TP references? -->
-
-<P>
-<A HREF="http://www.microsoft.com/windows2000/en/server/help/default.asp?url=/windows2000/en/server/help/sag_TCPIP_ovr_secfeatures.htm">
-Microsoft's page on Win2k TCP/IP security features</A><BR>
-
-<A HREF="http://support.microsoft.com/support/kb/articles/Q257/2/25.ASP">
-Microsoft's Win2k IPsec debugging tips</A><BR>
-
-<!-- Alt-URL http://support.microsoft.com/default.aspx?scid=kb;EN-US;q257225
-Perhaps newer? -->
-
-<A HREF="http://www.wired.com/news/technology/0,1282,36336,00.html">MS VPN may fall back to 1DES</A>
-</P>
-
-<P><A HREF="#microsoft.top">Back to chart</A></P>
-
-
-<H4><A NAME="ssh">SSH Sentinel</A></H4>
-
-<UL>
-<LI>Popular and well tested.</LI>
-<LI>Also rebranded in <A HREF="http://www.zyxel.com">Zyxel Zywall</A>.
-Our Zyxel interop notes are <A HREF="#zyxel">here</A>.</LI>
-<LI>
-SSH supports IPsec-over-UDP NAT traversal.
-</LI>
-<LI>There is this 
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/12/msg00370.html">
-potential problem</A> if you're not using the Legacy Proposal option.
-</UL>
-
-<P>
-<A HREF="http://www.ssh.com/support/sentinel/documents.cfm">SSH's Sentinel-FreeSWAN interop PDF (X.509)</A><BR>
-<A HREF="http://www.nadmm.com/show.php?story=articles/vpn.inc">Nadeem Hassan's 
-SUSE-to-Sentinel article (Road warrior with X.509)</A><BR>
-<A HREF="http://www.zerozone.it/documents/Linux/HowTo/VPN-IPsec-Freeswan-HOWTO.html">O-Zone's Italian HOWTO (Road Warrior, X.509, DHCP)</A><BR>
-</P>
-
-
-<P><A HREF="#ssh.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="safenet">Safenet SoftPK/SoftRemote</A></H4>
-
-<UL>
-<LI>People recommend SafeNet as a low cost Windows client.</LI>
-<LI>SoftRemote seems to be the newer name for SoftPK.</LI>
-</UL>
-
-<P>
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005061.html">
-Whit Blauvelt's SoftRemote tips</A><BR>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-October/015591.html">
-Tim Wilson's tips (X.509)</A>
-<A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00607.html">Workaround for a "gotcha"</A>
-</P>
-
-<P>
-<A HREF="http://jixen.tripod.com/#Rw-IRE-to-Fwan">Jean-Francois Nadeau's 
-Practical Configuration (Road Warrior with PSK)</A><BR>
-<A HREF="http://www.terradoncommunications.com/security/whitepapers/safe_net-to-free_swan.pdf">
-Terradon Communications' PDF (Road Warrior with PSK)</A><BR>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-October/?????.html">
-Seaan.net's PDF (Road Warrior to Subnet, with PSK)
-</A><BR>
-<A HREF="http://www.redbaronconsulting.com/freeswan/fswansafenet.pdf">
-Red Baron Consulting's PDF (Road Warrior with X.509)</A>
-</P>
-
-<P><A HREF="#safenet.top">Back to chart</A></P>
-
-
-
-
-
-
-
-
-<H3>For <EM>Other Implementations</EM></H3>
-
-
-
-<H4><A NAME="6wind">6Wind</A></H4>
-
-<P>
-
-<A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
-French page with configs (X.509)</A>
-
-</P>
-
-<P><A HREF="#6wind.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="alcatel">Alcatel Timestep</A></H4>
-
-<P>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-June/011878.html">
-Alain Sabban's settings (PSK or PSK road warrior; through static NAT)</A><BR>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/1999/06/msg00100.html">
-Derick Cassidy's configs (PSK)</A><BR>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/1999/08/msg00194.html">
-David Kerry's Timestep settings (PSK)</A>
-<BR>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-August/013711.html">
-Kevin Gerbracht's ipsec.conf (X.509)</A>
-</P>
-
-<P><A HREF="#alcatel.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="apple">Apple Macintosh System 10+</A></H4>
-
-<UL>
-<LI>Since the system is based on FreeBSD, this should
-interoperate <A HREF="#kame">just like FreeBSD</A>.
-</LI>
-
-<LI>
-To use Appletalk over IPsec tunnels,
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005116.html">run 
-it over TCP/IP</A>, or use 
-Open Door Networks' Shareway IP tool, 
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005426.html">described 
-here.</A>
-</LI>
-
-<LI>See also the <A HREF="#equinux">Equinux VPN Tracker</A> 
-for Mac OS X.</LI> 
-</UL>
-
-
-<P>
-<A HREF="http://ipsec.math.ucla.edu/services/ipsec.html">James Carter's
-instructions (X.509, NAT-T)</A>
-</P>
-
-
-<P><A HREF="#apple.top">Back to chart</A></P>
-
-
-
-
-
-
-<H4><A NAME="ashleylaurent">AshleyLaurent VPCom</A></H4>
-
-<P>
-<A HREF="http://www.ashleylaurent.com/newsletter/01-28-00.htm">
-Successful interop report, no details</A>
-</P>
-
-<P><A HREF="#ashleylaurent.top">Back to chart</A></P>
-
-
-<H4><A NAME="borderware">Borderware</A></H4>
-
-<UL>
-<LI>I suspect the Borderware client is a rebranded Safenet.
-If that's true, our <A HREF="#safenet">Safenet section</A> will help.</LI>
-</UL>
-
-<P>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-March/008288.html">
-Philip Reetz' configs (PSK)</A><BR>
-
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/09/msg00217.html">
-Borderware server does not support FreeS/WAN road warriors</A><BR>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-February/007733.html">
-Older Borderware may not support Diffie Hellman groups 2, 5</A><BR>
-</P>
-
-
-<P><A HREF="#borderware.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="checkpoint">Check Point VPN-1 or FW-1</A></H4>
-
-<UL>
-<LI>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00099.html">
-Caveat about IP-range inclusion on Check Point.</A>
-</LI>
-<LI>
-Some versions of Check Point may require an aggressive mode patch to 
-interoperate with FreeS/WAN.<BR>
-<A HREF="http://www.freeswan.ca/code/super-freeswan">Super FreeS/WAN</A> 
-now features this patch.
-<!--
-<A HREF="http://www.freeswan.ca/patches/aggressivemode">Steve Harvey's 
-aggressive mode patch for FreeS/WAN 1.5</A>
--->
-</LI>
-<LI>
-<LI>A Linux FreeS/WAN-Checkpoint connection may close after some time. Try
-<A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00293.html">this tip</A> toward a workaround.
-</LI>
-</UL>
-
-<P>
-<A HREF="http://www.fw-1.de/aerasec/ng/vpn-freeswan/CPNG+Linux-FreeSWAN.html">
-AERAsec's Firewall-1 NG site (PSK, X.509, Road Warrior with X.509, 
-other algorithms)</A><BR>
-&nbsp;&nbsp;&nbsp;&nbsp;
-<A HREF="http://www.fw-1.de/aerasec/ng/vpn-freeswan/CPNG+Linux-FreeSWAN.html#support-matrix">
-AERAsec's detailed Check Point-FreeS/WAN support matrix</A><BR>
-<A HREF="http://support.checkpoint.com/kb/docs/public/firewall1/4_1/pdf/fw-linuxvpn.pdf">Checkpoint.com PDF: Linux as a VPN Client to FW-1 (PSK)</A><BR>
-
-<A HREF="http://www.phoneboy.com">PhoneBoy's Check Point FAQ (on Check Point 
-only, not FreeS/WAN)</A><BR>
-
-</P>
-
-<P>
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-August/002351.html">Chris 
-Harwell's tips & FreeS/WAN configs (PSK)</A><BR>
-
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-April/009362.html">Daniel 
-Tombeil's configs (PSK)</A>
-
-</P>
-
-<P><A HREF="#checkpoint.top">Back to chart</A></P>
-
-
-<H4><A NAME="cisco">Cisco</A></H4>
-
-<UL>
-<LI>
-Cisco supports IPsec-over-UDP NAT traversal.
-</LI>
-<LI>Cisco VPN Client appears to use nonstandard IPsec and 
-does not work with FreeS/WAN. <A HREF="https://mj2.freeswan.org/archives/2003-August/maillist.html">This message</A> concerns Cisco VPN Client 4.01.
-<!-- fix link -->
-</LI>
-<LI>A Linux FreeS/WAN-Cisco connection may close after some time.
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-December/005758.html">
-Here</A>
-is a workaround, and 
-<A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00293.html">here</A>
- is another comment on the same subject.</LI>
-<LI><A HREF="http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120t/120t2/3desips.htm">Older Ciscos</A> 
-purchased outside the United States may not have 3DES, which FreeS/WAN requires.</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2001-June/000406.html">RSA keying may not be possible between Cisco and FreeS/WAN.</A>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2001-October/004357.html">In 
-ipsec.conf, VPN3000 DN (distinguished name) must be in binary (X.509 only)</A></LI>
-
-
-</UL>
-
-
-<P>
-<A HREF="http://rr.sans.org/encryption/cisco_router.php">SANS Institute HOWTO (PSK).</A> Detailed, with extensive references.<BR>
-<A HREF="http://www.worldbank.ro/IPSEC/cisco-linux.txt">Short HOWTO (PSK)</A><BR>
-<A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
-French page with configs for Cisco IOS, PIX and VPN 3000 (X.509)</A>
-<BR>
-
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-August/002966.html">Dave
-McFerren's sample configs (PSK)</A><BR>
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-September/003422.html">Wolfgang 
-Tremmel's sample configs (PSK road warrior)</A><BR>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00578.html">
-Old doc from Pete Davis, with William Watson's updated Tips (PSK)</A><BR>
-</P>
-
-<P><STRONG>Some PIX specific information:</STRONG><BR>
-
-<A HREF="http://www.wlug.org.nz/FreeSwanToCiscoPix">
-Waikato Linux Users' Group HOWTO. Nice detail (PSK)
-</A><BR>
-<A HREF="http://www.johnleach.co.uk/documents/freeswan-pix/freeswan-pix.html">
-John Leach's configs (PSK)
-</A><BR>
-<A HREF="http://www.diverdown.cc/vpn/freeswanpix.html">
-Greg Robinson's settings (PSK)
-</A><BR>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-February/007901.html">
-Scott's ipsec.conf for PIX (PSK, FreeS/WAN side only)</A><BR>
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-October/003949.html">Rick 
-Trimble's PIX and FreeS/WAN settings (PSK)</A><BR>
-</P>
-
-
-
-<P><A href="http://www.cisco.com/public/support/tac">
-Cisco VPN support page</A><BR>
-<A href="http://www.ieng.com/warp/public/707/index.shtml#ipsec">
-Cisco IPsec information page</A>
-</P>
-
-<P><A HREF="#cisco.top">Back to chart</A></P>
-
-
-
-
-<H4><A NAME="equinux">Equinux VPN tracker (for Mac OS X)</A></H4>
-                                                                                
-<UL>
-<LI>Graphical configurator for Mac OS X IPsec. May be an interface
-to the <A HREF="#apple">native Mac OS X IPsec</A>, which is essentially
-<A HREF="#kame">KAME</A>.</LI>
-<LI>To use Appletalk over IPsec tunnels,
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005116.html">run
-it over TCP/IP</A>, or use
-Open Door Networks' Shareway IP tool,
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005426.html">described
-here.</A> </LI>
-</UL>
-
-                                                                                
-<P>
-Equinux provides <A HREF="http://www.equinux.com/download/HowTo_FreeSWAN.pdf">this 
-excellent interop PDF</A> (PSK, RSA, X.509).
-</P>
-                                                                                
-<P><A HREF="#equinux.top">Back to chart</A></P>
-
-
-<H4><A NAME="fsecure">F-Secure</A></H4>
-
-<UL>
-<LI>
-<!-- <A HREF="http://lists.freeswan.org/pipermail/users/2002-February/007596.html"> -->
-F-Secure supports IPsec-over-UDP NAT traversal.
-</LI>
-</UL>
-
-<P><A HREF="http://www.pingworks.de/tech/vpn/vpn.txt">pingworks.de's
- "Connecting F-Secure's VPN+ to Linux FreeS/WAN" (PSK road warrior)</A><BR>
-&nbsp;&nbsp;&nbsp;&nbsp;<A HREF="http://www.pingworks.de/tech/vpn/vpn.pdf">Same thing as PDF</A><BR>
-<A HREF="http://www.exim.org/pipermail/linux-ipsec/Week-of-Mon-20010122/000061.html">Success report, no detail (PSK)</A><BR>
-<A HREF="http://www.exim.org/pipermail/linux-ipsec/Week-of-Mon-20010122/000041.html">Success report, no detail (Manual)</A>
-</P>
-
-<!-- Other NAT traversers:
-http://lists.freeswan.org/pipermail/users/2002-April/009136.html
-and ssh sentinel:
-http://lists.freeswan.org/pipermail/users/2001-September/003108.html
--->
-
-<P><A HREF="#fsecure.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="gauntlet">Gauntlet GVPN</A></H4>
-
-<P>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00535.html">Richard Reiner's ipsec.conf (PSK)</A>
-<BR>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-June/011434.html">
-Might work without that pesky firewall... (PSK)</A><BR>
-<!-- insert archive link -->
-In late July, 2003 Alexandar Antik reported success interoperating 
-with Gauntlet 6.0 for Solaris (X.509). Unfortunately the message is not 
-properly archived at this time.
-</P>
-
-<P><A HREF="#gauntlet.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="aix">IBM AIX</A></H4>
-
-<P><A HREF="http://www-1.ibm.com/servers/esdd/articles/security.html">
-IBM's "Built-In Network Security with AIX" (PSK, X.509)</A><BR>
-<A HREF="http://www-1.ibm.com/servers/aix/products/ibmsw/security/vpn/faqandtips/#ques20">
-IBM's tip: importing Linux FreeS/WAN settings into AIX's <VAR>ikedb</VAR> 
-(PSK)</A>
-</P>
-
-<P><A HREF="#aix.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="as400">IBM AS/400</A></H4>
-
-<UL>
-<LI>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-April/009106.html">Road
- Warriors may act flaky</A>.
-</LI>
-</UL>
-
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-September/014264.html">
-Richard Welty's tips and tricks</A><BR>
-</P>
-
-<P><A HREF="#as400.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="intel">Intel Shiva LANRover / Net Structure</A></H4>
-
-<UL>
-<LI>Intel Shiva LANRover is now known as Intel Net Structure.</LI>
-<LI>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/01/msg00298.html">
-Shiva seems to have two modes: IPsec or the proprietary
-"Shiva Tunnel".</A>
-Of course, FreeS/WAN will only create IPsec tunnels.
-</LI>
-
-<LI>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00293.html">
-AH may not work for Shiva-FreeS/WAN.</A>
-That's OK, since FreeS/WAN has phased out the use of AH.
-</LI>
-</UL>
-
-<P>
-<A HREF="http://snowcrash.tdyc.com/freeswan/">
-Snowcrash's configs (PSK)</A><BR>
-
-<A HREF="http://www.opus1.com/vpn/index.html">
-Old configs from an interop (PSK)</A><BR>
-
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-October/003831.html">
-The day Shiva tickled a Pluto bug (PSK)</A><BR>
-
-&nbsp;&nbsp;&nbsp;&nbsp;
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-October/004270.html">
-Follow up: success!</A>
-</P>
-
-<P><A HREF="#intel.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="lancom">LanCom (formerly ELSA)</A></H4>
-
-<UL>
-<LI>This router is popular in Germany.
-</UL>
-
-<P>
-Jakob Curdes successfully created a PSK connection with the LanCom 1612 in 
-August 2003.
-<!-- add ML link when it appears -->
-</P>
-
-<P><A HREF="#lancom.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="linksys">Linksys</A></H4>
-
-<UL>
-<LI>Linksys may be used as an IPsec tunnel endpoint, <STRONG>OR</STRONG>
-as a router in "IPsec passthrough" mode, so that the IPsec tunnel 
-passes through the Linksys.
-</LI>
-</UL>
-
-<H5>As tunnel endpoint</H5>
-<P>
-<A HREF="http://www.freeswan.ca/docs/BEFVP41/">
-Ken Bantoft's instructions (Road Warrior with PSK)</A><BR>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-February/007814.html">
-Nate Carlson's caveats</A>
-</P>
-
-<H5>In IPsec passthrough mode</H5>
-<P>
-<A HREF="http://www-ec.njit.edu/~rxt1077/Howto.txt">
-Sample HOWTO through a Linksys Router</A><BR>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2002/02/msg00114.html">
-Nadeem Hasan's configs</A><BR>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2002/02/msg00180.html">
-Brock Nanson's tips</A><BR>
-</P>
-
-<P><A HREF="#linksys.top">Back to chart</A></P>
-
-
-<H4><A NAME="lucent">Lucent</A></H4>
-
-<P>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010976.html">
-Partial success report; see also the next message in thread</A>
-</P>
-<!-- section done -->
-
-<P><A HREF="#lucent.top">Back to chart</A></P>
-
-
-<H4><A NAME="netasq">Netasq</A></H4>
-
-<P>
-<A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
-French page with configs (X.509)</A>
-
-</P>
-<!-- section done -->
-
-<P><A HREF="#netasq.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="netcelo">Netcelo</A></H4>
-
-<P>
-<A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
-French page with configs (X.509)</A>
-
-<!-- section done -->
-
-</P>
-
-<P><A HREF="#netcelo.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="netgear">Netgear fvs318</A></H4>
-
-<UL>
-<LI>With a recent Linux FreeS/WAN, you will require the latest 
-(12/2002) Netgear firmware, which supports Diffie-Hellman (DH) group 2.
-For security reasons, we phased out DH 1 after Linux FreeS/WAN 1.5.
-</LI>
-<LI>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-June/011833.html">
-This message</A> reports the incompatibility between Linux FreeS/WAN 1.6+
-and Netgear fvs318 without the firmware upgrade.
-</LI>
-<LI>We believe Linux FreeS/WAN 1.5 and earlier will interoperate with 
-any NetGear firmware.
-</LI>
-</UL>
-
-<P>
-<A HREF="http://lists.freeswan.org/pipermail/users/2003-February/017891.html">
-John Morris' setup (PSK)</A>
-</P>
-
-<P><A HREF="#netgear.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="netscreen">Netscreen 100 or 5xp</A></H4>
-
-<P>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-August/013409.html">
-Errol Neal's settings (PSK)</A><BR>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-October/015265.html">
-Corey Rogers' configs (PSK, no PFS)</A><BR>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-August/013051.html">
-Jordan Share's configs (PSK, 2 subnets, through static NAT)</A><BR>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/08/msg00404.html">
-Set src proxy_id to your protected subnet/mask</A><BR>
-
-<A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
-French page with ipsec.conf, Netscreen screen shots (X.509, may
-need to revert to PSK...)</A>
-
-</P>
-<P>
-<A HREF="http://archives.neohapsis.com/archives/sf/linux/2001-q2/0123.html">
-A report of a company using Netscreen with FreeS/WAN on a large scale
-(FreeS/WAN road warriors?)</A>
-</P>
-
-<P><A HREF="#netscreen.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="nortel">Nortel Contivity</A></H4>
-
-<UL>
-<LI>
-Nortel supports IPsec-over-UDP NAT traversal.
-</LI>
-
-<LI>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00417.html">
-Some older versions of Contivity and FreeS/WAN will not communicate.</A>
-</LI>
-
-<LI>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010924.html">
-FreeS/WAN cannot be used as a "client" to a Nortel Contivity server,
-but can be used as a branch-office tunnel.</A>
-</LI>
-
-<!--  Probably obsoleted by Ken's post
-<LI>
-(Matthias siebler from old interop)
-At one point you could not configure Nortel-FreeS/WAN tunnels as 
-"Client Tunnels" since FreeS/WAN does not support Aggressive Mode.
-Current status of this problem: unknown.
-<LI>
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/004612.html">
-How do we map group and user passwords onto the data that FreeS/WAN wants?
-</A>
-</LI>
--->
-
-<LI>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-October/015455.html">
-Contivity does not send Distinguished Names in the order FS wants them (X.509).
-</A>
-</LI>
-
-<LI>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/03/msg00137.html">
-Connections may time out after 30-40 minutes idle.</A>
-</LI>
-
-</UL>
-
-<P>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/03/msg00137.html">
-JJ Streicher-Bremer's mini HOWTO for old & new software. (PSK with two subnets)
-</A><BR>
-<A HREF="http://www.hsc.fr/ressources/ipsec/ipsec2001/#config">
-French page with configs (X.509)</A>. This succeeds using the above X.509 tip.
-</P>
-
-<!-- I could do more searching but this is a solid start. -->
-
-<P><A HREF="#nortel.top">Back to chart</A></P>
-
-
-<H4><A NAME="radguard">Radguard</A></H4>
-
-<P>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/05/msg00009.html">
-Marko Hausalo's configs (PSK).</A> Note: These do create a connection,
-as you can see by "IPsec SA established".<BR>
-
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-October/???.html">
-Claudia Schmeing's comments</A>
-</P>
-
-<P><A HREF="#radguard.top">Back to chart</A></P>
-
-
-<H4><A NAME="raptor">Raptor (NT or Solaris)</A></H4>
-
-<P>
-
-<UL>
-<LI>Now known as Symantec Enterprise Firewall.</LI>
-<LI>The Raptor does not normally come with X.509, but this may be available as
-an add-on.</LI>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010256.html">
-Raptor requires alphanumberic PSK values, whereas FreeS/WAN uses hex.</A>
-</LI>
-<LI>Raptor's tunnel endpoint may be a host, subnet or group of subnets
-(see 
-<A HREF="http://lists.freeswan.org/pipermail/design/2001-November/001295.html">
-this message</A>
-). FreeS/WAN cannot handle the group of subnets; you
-must create separate connections for each in order to interoperate.</LI>
-<LI>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010113.html">
-Some versions of Raptor accept only single DES.
-</A>
-According to this German message,
-<A HREF="http://radawana.cg.tuwien.ac.at/mail-archives/lll/200012/msg00065.html">
-the Raptor Mobile Client demo offers single DES only.</A>
-</LI>
-</UL>
-
-<P>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-January/006935.html">
-Peter Mazinger's settings (PSK)</A><BR>
-
-<A HREF="http://lists.freeswan.org/pipermail/users/2001-November/005522.html">
-Peter Gerland's configs (PSK)</A><BR>
-
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/07/msg00597.html">
-Charles Griebel's configs (PSK).</A><BR>
-
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-July/012275.html">
-Lumir Srch's tips (PSK)
-</A>
-</P>
-
-<P>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/05/msg00214.html">
-John Hardy's configs (Manual)</A><BR>
-
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/01/msg00236.html">
-Older Raptors want 3DES keys in 3 parts (Manual).</A><BR>
-
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/06/msg00480.html">
-Different keys for each direction? (Manual)</A><BR>
-
-</P>
-
-<P><A HREF="#raptor.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="redcreek">Redcreek Ravlin</A></H4>
-
-<UL>
-<LI>Known issue #1: The Ravlin expects a quick mode renegotiation right
-after every Main Mode negotiation.
-</LI>
-<LI>
-Known issue #2: The Ravlin tries to negotiate a zero
-connection lifetime, which it takes to mean "infinite". 
-<A HREF="http://www.bear-cave.org.uk/linux/ravlin/">Jim Hague's patch</A> 
-addresses both issues.
-</LI>
-<LI>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/03/msg00191.html">
-Interop works with Ravlin Firmware > 3.33. Includes tips (PSK).</A>
-</LI>
-</UL>
-
-<P><A HREF="#redcreek.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="sonicwall">SonicWall</A></H4>
-
-<UL>
-<LI><A HREF="http://lists.freeswan.org/pipermail/users/2001-June/000998.html">
-Sonicwall cannot be used for Road Warrior setups</A></LI>
-<LI>
-At one point, <A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/05/msg00217.html">
-only Sonicwall PRO supported triple DES</A>.</LI>
-<LI>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-March/008600.html">
-Older Sonicwalls (before Nov 2001) feature Diffie Hellman group 1
-only</A>.</LI>
-</UL>
-
-<P>
-<A HREF="http://www.xinit.cx/docs/freeswan.html">Paul Wouters' config (PSK)</A><BR>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00073.html">
-Dilan Arumainathan's configuration (PSK)</A><BR>
-<A HREF="http://www.gravitas.co.uk/vpndebug">Dariush's setup... only opens
-one way (PSK)</A><BR>
-<A HREF="http://lists.freeswan.org/pipermail/users/2003-July/022302.html">
-Andreas Steffen's tips (X.509)</A><BR>
-
-</P>
-
-<P><A HREF="#sonicwall.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="sun">Sun Solaris</A></H4>
-
-<UL>
-<LI>
-Solaris 8+ has a native (in kernel) IPsec implementation.
-</LI>
-<LI>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-May/010503.html">
-Solaris does not seem to support tunnel mode, but you can make
-IP-in-IP tunnels instead, like this.</A>
-</LI>
-</UL>
-<P>
-
-<A HREF="http://lists.freeswan.org/pipermail/users/2003-June/022216.html">Reports of some successful interops</A> from a fellow @sun.com.
-See also <A HREF="http://lists.freeswan.org/pipermail/users/2003-July/022247.html">these follow up posts</A>.<BR>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/03/msg00332.html">
-Aleks Shenkman's configs (Manual in transport mode)
-</A><BR>
-<!--sparc 64 stuff goes where?-->
-</P>
-
-<P><A HREF="#solaris.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="symantec">Symantec</A></H4>
-
-<UL>
-<LI>The Raptor, covered <A HREF="#raptor">above</A>, is now known as
-Symantec Enterprise Firewall.</LI>
-<LI>Symantec's "distinguished name" is a KEY_ID. See Andreas Steffen's post,
-below.</LI>
-</UL>
-
-<P><A HREF="http://lists.freeswan.org/pipermail/users/2002-April/009037.html">
-Andreas Steffen's configs for Symantec 200R (PSK)</A>
-</P>
-
-<P><A HREF="#symantec.top">Back to chart</A></P>
-
-
-
-
-<H4><A NAME="watchguard">Watchguard Firebox</A></H4>
-
-<UL>
-<LI>Automatic keying works with WatchGuard 5.0+ only.</LI>
-<LI>Seen to interoperate with WatchGuard 1000, II, III; firmware v. 5, 6..</LI>
-<LI>For manual keying, Watchguard's Policy Manager expects SPI numbers and
-encryption and authentication keys in decimal (not hex).</LI>
-</UL>
-
-<P>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-July/012595.html">
-WatchGuard's HOWTO (PSK)</A><BR>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-August/013342.html">
-Ronald C. Riviera's Settings (PSK)</A><BR>
-<A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00179.html">
-Walter Wickersham's Notes (PSK)</A><BR>
-
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-October/015587.html">
-Max Enders' Configs (Manual)</A>
-</P>
-
-<P>
-<A HREF="http://lists.freeswan.org/pipermail/users/2002-April/009404.html">
-Old known issue with auto keying</A><BR>
-
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/02/msg00124.html">
-Tips on key generation and format (Manual)</A><BR>
-</P>
-
-<P><A HREF="#watchguard.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="xedia">Xedia Access Point/QVPN</A></H4>
-
-<P>
-<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2001/12/msg00520.html">
-Hybrid IPsec/L2TP connection settings (X.509)
-</A><BR>
-<A HREF="http://www.sandelman.ottawa.on.ca/ipsec/1999/08/msg00140.html">
-  Xedia's LAN-LAN links don't use multiple tunnels
-</A><BR>
-&nbsp;&nbsp;&nbsp;&nbsp;
-<A HREF="http://www.sandelman.ottawa.on.ca/ipsec/1999/08/msg00140.html">
-  That explanation, continued
-</A>
-</P>
-
-<P><A HREF="#xedia.top">Back to chart</A></P>
-
-
-
-<H4><A NAME="zyxel">Zyxel</A></H4>
-
-<UL>
-<LI>The Zyxel Zywall is a rebranded SSH Sentinel box. See also our section
-on <A HREF="#ssh">SSH</A>.</LI>
-<LI>There seems to be a problem with keeping this connection alive. This is 
-caused at the Zyxel end. See this brief
-<A HREF="http://lists.freeswan.org/archives/users/2003-October/msg00141.html">
-discussion and solution.
-</A>
-</LI>
-</UL>                                                                                
-<P>
-<A HREF="http://www.zyxel.com/support/supportnote/zywall/app/zw_freeswan.htm">
-Zyxel's Zywall to FreeS/WAN instructions (PSK)</A><BR>
-<A HREF="http://www.zyxel.com/support/supportnote/p652/app/zw_freeswan.htm">
-Zyxel's Prestige to FreeS/WAN instructions (PSK)</A>. Note: not all Prestige 
-versions include VPN software.<BR>
-
-<A HREF="http://www.lancry.net/techdocs/freeswan-zyxel.txt">Fabrice Cahen's 
- HOWTO (PSK)</A><BR>
-&nbsp;&nbsp;&nbsp;&nbsp;
-</P>
-                                                                                
-<P><A HREF="#zyxel.top">Back to chart</A></P>
-
-
-
-<!-- SAMPLE ENTRY
-
-<H4><A NAME="timestep">Timestep</A></H4>
-
-<P>Text goes here.
-</P>
-
--->
-</BODY></HTML>
-
diff --git a/doc/src/intro.html b/doc/src/intro.html
deleted file mode 100644
index 09c352c00..000000000
--- a/doc/src/intro.html
+++ /dev/null
@@ -1,887 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>Introduction to FreeS/WAN</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, introduction">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: intro.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1><a name="intro">Introduction</a></h1>
-
-<p>This section gives an overview of:</p>
-<ul>
-  <li>what IP Security (IPsec) does</li>
-  <li>how IPsec works</li>
-  <li>why we are implementing it for Linux</li>
-  <li>how this implementation works</li>
-</ul>
-
-<p>This section is intended to cover only the essentials, <em>things you
-should know before trying to use FreeS/WAN.</em></p>
-
-<p>For more detailed background information, see the <a
-href="politics.html#politics">history and politics</a> and 
-<a href="ipsec.html#ipsec.detail">IPsec protocols</a> sections.</p>
-
-<h2><a name="ipsec.intro">IPsec, Security for the Internet Protocol</a></h2>
-
-<p>FreeS/WAN is a Linux implementation of the IPsec (IP security) protocols.
-IPsec provides <a href="glossary.html#encryption">encryption</a> and <a
-href="glossary.html#authentication">authentication</a> services at the IP
-(Internet Protocol) level of the network protocol stack.</p>
-
-<p>Working at this level, IPsec can protect any traffic carried over IP,
-unlike other encryption which generally protects only a particular
-higher-level protocol -- <a href="glossary.html#PGP">PGP</a> for mail, <a
-href="glossary.html#SSH">SSH</a> for remote login, <a
-href="glossary.html#SSL">SSL</a> for web work, and so on. This approach has
-both considerable advantages and some limitations. For discussion, see our <a
-href="ipsec.html#others">IPsec section</a></p>
-
-<p>IPsec can be used on any machine which does IP networking. Dedicated IPsec
-gateway machines can be installed wherever required to protect traffic. IPsec
-can also run on routers, on firewall machines, on various application
-servers, and on end-user desktop or laptop machines.</p>
-
-<p>Three protocols are used</p>
-<ul>
-  <li><a href="glossary.html#AH">AH</a> (Authentication Header) provides a
-    packet-level authentication service</li>
-  <li><a href="glossary.html#ESP">ESP</a> (Encapsulating Security Payload)
-    provides encryption plus authentication</li>
-  <li><a href="glossary.html#IKE">IKE</a> (Internet Key Exchange) negotiates
-    connection parameters, including keys, for the other two</li>
-</ul>
-
-<p>Our implementation has three main parts:</p>
-<ul>
-  <li><a href="glossary.html#KLIPS">KLIPS</a> (kernel IPsec) implements AH,
-    ESP, and packet handling within the kernel</li>
-  <li><a href="glossary.html#Pluto">Pluto</a> (an IKE daemon) implements IKE,
-    negotiating connections with other systems</li>
-  <li>various scripts provide an adminstrator's interface to the
-  machinery</li>
-</ul>
-
-<p>IPsec is optional for the current (version 4) Internet Protocol. FreeS/WAN
-adds IPsec to the Linux IPv4 network stack. Implementations of <a
-href="glossary.html#ipv6.gloss">IP version 6</a> are required to include
-IPsec. Work toward integrating FreeS/WAN into the Linux IPv6 stack has <a
-href="compat.html#ipv6">started</a>.</p>
-
-<p>For more information on IPsec, see our 
-<a href="ipsec.html#ipsec.detail">IPsec protocols</a> section, 
-our collection of <a href="web.html#ipsec.link">IPsec
-links</a> or the <a href="rfc.html#RFC">RFCs</a> which are the official
-definitions of these protocols.</p>
-
-<h3><a name="intro.interop">Interoperating with other IPsec
-implementations</a></h3>
-
-<p>IPsec is designed to let different implementations work together. We
-provide:</p>
-<ul>
-  <li>a <a href="web.html#implement">list</a> of some other
-  implementations</li>
-  <li>information on <a href="interop.html#interop">using FreeS/WAN 
-  with other implementations</a></li>
-</ul>
-
-<p>The VPN Consortium fosters cooperation among implementers and
-interoperability among implementations. Their <a
-href="http://www.vpnc.org/">web site</a> has much more information.</p>
-
-<h3><a name="advantages">Advantages of IPsec</a></h3>
-
-<p>IPsec has a number of security advantages. Here are some independently 
-written articles which discuss these:</p>
-
-<P>
-<A HREF="http://www.sans.org/rr/">SANS institute papers</A>. See the section
-on Encryption &amp;VPNs.
-<BR>
-<A HREF="http://www.cisco.com/en/US/netsol/ns110/ns170/ns171/ns128/networking_solutions_white_papers_list.html">Cisco's 
-white papers on "Networking Solutions"</A>.
-<BR>
-<A HREF="http://iscs.sourceforge.net/HowWhyBrief/HowWhyBrief.html">
-Advantages of ISCS (Linux Integrated Secure Communications System; 
-includes FreeS/WAN and other software)</A>.
-
-</P>
-
-
-<h3><a name="applications">Applications of IPsec</a></h3>
-
-<p>Because IPsec operates at the network layer, it is remarkably flexible and
-can be used to secure nearly any type of Internet traffic. Two applications,
-however, are extremely widespread:</p>
-<ul>
-  <li>a <a href="glossary.html#VPN">Virtual Private Network</a>, or VPN,
-    allows multiple sites to communicate securely over an insecure Internet
-    by encrypting all communication between the sites.</li>
-  <li>"Road Warriors" connect to the office from home, or perhaps from a
-    hotel somewhere</li>
-</ul>
-
-<p>There is enough opportunity in these applications that vendors are
-flocking to them. IPsec is being built into routers, into firewall products,
-and into major operating systems, primarily to support these applications.
-See our <a href="web.html#implement">list</a> of implementations for
-details.</p>
-
-<p>We support both of those applications, and various less common IPsec
-applications as well, but we also add one of our own:</p>
-<ul>
-  <li>opportunistic encryption, the ability to set up FreeS/WAN gateways so
-    that any two of them can encrypt to each other, and will do so whenever
-    packets pass between them.</li>
-</ul>
-
-<p>This is an extension we are adding to the protocols. FreeS/WAN is the
-first prototype implementation, though we hope other IPsec implementations
-will adopt the technique once we demonstrate it. See <a href="#goals">project
-goals</a> below for why we think this is important.</p>
-
-<p>A somewhat more detailed description of each of these applications is
-below. Our <a href="quickstart.html#quick_guide">quickstart</a> section will 
-show you how to build each of them.</p>
-
-<h4><a name="makeVPN">Using secure tunnels to create a VPN</a></h4>
-
-<p>A VPN, or <strong>V</strong>irtual <strong>P</strong>rivate
-<strong>N</strong>etwork lets two networks communicate securely when the only
-connection between them is over a third network which they do not trust.</p>
-
-<p>The method is to put a security gateway machine between each of the
-communicating networks and the untrusted network. The gateway machines
-encrypt packets entering the untrusted net and decrypt packets leaving it,
-creating a secure tunnel through it.</p>
-
-<p>If the cryptography is strong, the implementation is careful, and the
-administration of the gateways is competent, then one can reasonably trust
-the security of the tunnel. The two networks then behave like a single large
-private network, some of whose links are encrypted tunnels through untrusted
-nets.</p>
-
-<p>Actual VPNs are often more complex. One organisation may have fifty branch
-offices, plus some suppliers and clients, with whom it needs to communicate
-securely. Another might have 5,000 stores, or 50,000 point-of-sale devices.
-The untrusted network need not be the Internet. All the same issues arise on
-a corporate or institutional network whenever two departments want to
-communicate privately with each other.</p>
-
-<p>Administratively, the nice thing about many VPN setups is that large parts
-of them are static. You know the IP addresses of most of the machines
-involved. More important, you know they will not change on you. This
-simplifies some of the admin work. For cases where the addresses do change,
-see the next section.</p>
-
-<h4><a name="road.intro">Road Warriors</a></h4>
-
-<p>The prototypical "Road Warrior" is a traveller connecting to home base
-from a laptop machine. Administratively, most of the same problems arise for
-a telecommuter connecting from home to the office, especially if the
-telecommuter does not have a static IP address.</p>
-
-<p>For purposes of this document:</p>
-<ul>
-  <li>anyone with a dynamic IP address is a "Road Warrior".</li>
-  <li>any machine doing IPsec processing is a "gateway". Think of the
-    single-user road warrior machine as a gateway with a degenerate subnet
-    (one machine, itself) behind it.</li>
-</ul>
-
-<p>These require somewhat different setup than VPN gateways with static
-addresses and with client systems behind them, but are basically not
-problematic.</p>
-
-<p>There are some difficulties which appear for some road warrior
-connections:</p>
-<ul>
-  <li>Road Wariors who get their addresses via DHCP may have a problem.
-    FreeS/WAN can quite happily build and use a tunnel to such an address,
-    but when the DHCP lease expires, FreeS/WAN does not know that. The tunnel
-    fails, and the only recovery method is to tear it down and re-build
-  it.</li>
-  <li>If <a href="glossary.html#NAT.gloss">Network Address Translation</a>
-    (NAT) is applied between the two IPsec Gateways, this breaks IPsec. IPsec
-    authenticates packets on an end-to-end basis, to ensure they are not
-    altered en route. NAT rewrites packets as they go by. See our <a
-    href="firewall.html#NAT">firewalls</a> document for details.</li>
-</ul>
-
-<p>In most situations, however, FreeS/WAN supports road warrior connections
-just fine.</p>
-
-<h4><a name="opp.intro">Opportunistic encryption</a></h4>
-
-<p>One of the reasons we are working on FreeS/WAN is that it gives us the
-opportunity to add what we call opportuntistic encryption. This means that
-any two FreeS/WAN gateways will be able to encrypt their traffic, even if the
-two gateway administrators have had no prior contact and neither system has
-any preset information about the other.</p>
-
-<p>Both systems pick up the authentication information they need from the <a
-href="glossary.html#DNS">DNS</a> (domain name service), the service they
-already use to look up IP addresses. Of course the administrators must put
-that information in the DNS, and must set up their gateways with
-opportunistic encryption enabled. Once that is done, everything is automatic.
-The gateways look for opportunities to encrypt, and encrypt whatever they
-can. Whether they also accept unencrypted communication is a policy decision
-the administrator can make.</p>
-
-<p>This technique can give two large payoffs:</p>
-<ul>
-  <li>It reduces the administrative overhead for IPsec enormously. You
-    configure your gateway and thereafter everything is automatic. The need
-    to configure the system on a per-tunnel basis disappears. Of course,
-    FreeS/WAN allows specifically configured tunnels to co-exist with
-    opportunistic encryption, but we hope to make them unnecessary in most
-    cases.</li>
-  <li>It moves us toward a more secure Internet, allowing users to create an
-    environment where message privacy is the default. All messages can be
-    encrypted, provided the other end is willing to co-operate. See our <a
-    href="politics.html#politics">history and politics of cryptography</a> 
-    section for discussion of why we think this is needed.</li>
-</ul>
-
-<p>Opportunistic encryption is not (yet?) a standard part of the IPsec
-protocols, but an extension we are proposing and demonstrating. For details
-of our design, see <a href="#applied">links</a> below.</p>
-
-<p>Only one current product we know of implements a form of opportunistic
-encryption. <a href="web.html#ssmail">Secure sendmail</a> will automatically
-encrypt server-to-server mail transfers whenever possible.</p>
-
-<h3><a name="types">The need to authenticate gateways</a></h3>
-
-<p>A complication, which applies to any type of connection -- VPN, Road
-Warrior or opportunistic -- is that a secure connection cannot be created
-magically. <em>There must be some mechanism which enables the gateways to
-reliably identify each other.</em> Without this, they cannot sensibly trust
-each other and cannot create a genuinely secure link.</p>
-
-<p>Any link they do create without some form of <a
-href="glossary.html#authentication">authentication</a> will be vulnerable to
-a <a href="glossary.html#middle">man-in-the-middle attack</a>. If <a
-href="glossary.html#alicebob">Alice and Bob</a> are the people creating the
-connection, a villian who can re-route or intercept the packets can pose as
-Alice while talking to Bob and pose as Bob while talking to Alice. Alice and
-Bob then both talk to the man in the middle, thinking they are talking to
-each other, and the villain gets everything sent on the bogus "secure"
-connection.</p>
-
-<p>There are two ways to build links securely, both of which exclude the
-man-in-the middle:</p>
-<ul>
-  <li>with <strong>manual keying</strong>, Alice and Bob share a secret key
-    (which must be transmitted securely, perhaps in a note or via PGP or SSH)
-    to encrypt their messages. For FreeS/WAN, such keys are stored in the <a
-    href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> file. Of course, if
-    an enemy gets the key, all is lost.</li>
-  <li>with <strong>automatic keying</strong>, the two systems authenticate
-    each other and negotiate their own secret keys. The keys are
-    automatically changed periodically.</li>
-</ul>
-
-<p>Automatic keying is much more secure, since if an enemy gets one key only
-messages between the previous re-keying and the next are exposed. It is
-therefore the usual mode of operation for most IPsec deployment, and the mode
-we use in our setup examples. FreeS/WAN does support manual keying for
-special circumstanes. See this <a
-href="adv_config.html#prodman">section</a>.</p>
-
-<p>For automatic keying, the two systems must authenticate each other during
-the negotiations. There is a choice of methods for this:</p>
-<ul>
-  <li>a <strong>shared secret</strong> provides authentication. If Alice and
-    Bob are the only ones who know a secret and Alice recives a message which
-    could not have been created without that secret, then Alice can safely
-    believe the message came from Bob.</li>
-  <li>a <a href="glossary.html#public">public key</a> can also provide
-    authentication. If Alice receives a message signed with Bob's private key
-    (which of course only he should know) and she has a trustworthy copy of
-    his public key (so that she can verify the signature), then she can
-    safely believe the message came from Bob.</li>
-</ul>
-
-<p>Public key techniques are much preferable, for reasons discussed <a
-href="config.html#choose">later</a>, and will be used in all our setup
-examples. FreeS/WAN does also support auto-keying with shared secret
-authentication. See this <a
-href="adv_config.html#prodsecrets">section</a>.</p>
-
-<h2><a name="project">The FreeS/WAN project</a></h2>
-
-<p>For complete information on the project, see our web site, <a
-href="http://liberty.freeswan.org">freeswan.org</a>.</p>
-
-<p>In summary, we are implementing the <a
-href="glossary.html#IPsec">IPsec</a> protocols for Linux and extending them
-to do <a href="glossary.html#carpediem">opportunistic encryption</a>.</p>
-
-<h3><a name="goals">Project goals</a></h3>
-
-<p>Our overall goal in FreeS/WAN is to make the Internet more secure and more
-private.</p>
-
-<p>Our IPsec implementation supports VPNs and Road Warriors of course. Those
-are important applications. Many users will want FreeS/WAN to build corporate
-VPNs or to provide secure remote access.</p>
-
-<p>However, our goals in building it go beyond that. We are trying to help
-<strong>build security into the fabric of the Internet</strong> so that
-anyone who choses to communicate securely can do so, as easily as they can do
-anything else on the net.</p>
-
-<p>More detailed objectives are:</p>
-<ul>
-  <li>extend IPsec to do <a href="glossary.html#carpediem">opportunistic
-    encryption</a> so that
-    <ul>
-      <li>any two systems can secure their communications without a
-        pre-arranged connection</li>
-      <li><strong>secure connections can be the default</strong>, falling
-        back to unencrypted connections only if:
-        <ul>
-          <li><em>both</em> the partner is not set up to co-operate on
-            securing the connection</li>
-          <li><em>and</em> your policy allows insecure connections</li>
-        </ul>
-      </li>
-      <li>a significant fraction of all Internet traffic is encrypted</li>
-      <li>wholesale monitoring of the net (<a
-        href="politics.html#intro.poli">examples</a>) becomes difficult or
-        impossible</li>
-    </ul>
-  </li>
-  <li>help make IPsec widespread by providing an implementation with no
-    restrictions:
-    <ul>
-      <li>freely available in source code under the <a
-        href="glossary.html#GPL">GNU General Public License</a></li>
-      <li>running on a range of readily available hardware</li>
-      <li>not subject to US or other nations' <a
-        href="politics.html#exlaw">export restrictions</a>.<br>
-        Note that in order to avoid <em>even the appearance</em> of being
-        subject to those laws, the project cannot accept software
-        contributions -- <em>not even one-line bug fixes</em> -- from US
-        residents or citizens.</li>
-    </ul>
-  </li>
-  <li>provide a high-quality IPsec implementation for Linux
-    <ul>
-      <li>portable to all CPUs Linux supports: <a
-        href="compat.html#CPUs">(current list)</a></li>
-      <li>interoperable with other IPsec implementations: <a
-        href="interop.html#interop">(current list)</a></li>
-    </ul>
-  </li>
-</ul>
-
-<p>If we can get opportunistic encryption implemented and widely deployed,
-then it becomes impossible for even huge well-funded agencies to monitor the
-net.</p>
-
-<p>See also our section on <a href="politics.html#politics">history and 
-politics</a> of cryptography, which includes our project leader's <a
-href="politics.html#gilmore">rationale</a> for starting the project.</p>
-
-<h3><a name="staff">Project team</a></h3>
-
-<p>Two of the team are from the US and can therefore contribute no code:</p>
-<ul>
-  <li>John Gilmore: founder and policy-maker (<a
-    href="http://www.toad.com/gnu/">home page</a>)</li>
-  <li>Hugh Daniel: project manager, Most Demented Tester, and occasionally
-    Pointy-Haired Boss</li>
-</ul>
-
-<p>The rest of the team are Canadians, working in Canada. (<a
-href="politics.html#status">Why Canada?</a>)</p>
-<ul>
-  <li>Hugh Redelmeier: <a href="glossary.html#Pluto">Pluto daemon</a>
-    programmer</li>
-  <li>Richard Guy Briggs: <a href="glossary.html#KLIPS">KLIPS</a>
-  programmer</li>
-  <li>Michael Richardson: hacker without portfolio</li>
-  <li>Claudia Schmeing: documentation</li>
-  <li>Sam Sgro: technical support via the <a href="mail.html#lists">mailing
-    lists</a></li>
-</ul>
-
-<p>The project is funded by civil libertarians who consider our goals
-worthwhile. Most of the team are paid for this work.</p>
-
-<p>People outside this core team have made substantial contributions. See</p>
-<ul>
-  <li>our <a href="../CREDITS">CREDITS</a> file</li>
-  <li>the <a href="web.html#patch">patches and add-ons</a> section of our web
-    references file</li>
-  <li>lists below of user-written <a href="#howto">HowTos</a> and <a
-    href="#applied">other papers</a></li>
-</ul>
-
-<p>Additional contributions are welcome. See the <a
-href="faq.html#contrib.faq">FAQ</a> for details.</p>
-
-<h2><a name="products">Products containing FreeS/WAN</a></h2>
-
-<p>Unfortunately the <a href="politics.html#exlaw">export laws</a> of some
-countries restrict the distribution of strong cryptography. FreeS/WAN is
-therefore not in the standard Linux kernel and not in all CD or web
-distributions.</p>
-
-<p>FreeS/WAN is, however, quite widely used. Products we know of that use it
-are listed below. We would appreciate hearing, via the <a
-href="mail.html#lists">mailing lists</a>, of any we don't know of.</p>
-
-<h3><a name="distwith">Full Linux distributions</a></h3>
-
-<p>FreeS/WAN is included in various general-purpose Linux distributions,
-mostly from countries (shown in brackets) with more sensible laws:</p>
-<ul>
-  <li><a href="http://www.suse.com/">SuSE Linux</a> (Germany)</li>
-  <li><a href="http://www.conectiva.com">Conectiva</a> (Brazil)</li>
-  <li><a href="http://www.linux-mandrake.com/en/">Mandrake</a> (France)</li>
-  <li><a href="http://www.debian.org">Debian</a></li>
-  <li>the <a href="http://www.pld.org.pl/">Polish(ed) Linux Distribution</a>
-    (Poland)</li>
-  <li><a>Best Linux</a> (Finland)</li>
-</ul>
-
-<p>For distributions which do not include FreeS/WAN and are not Redhat (which
-we develop and test on), there is additional information in our <a
-href="compat.html#otherdist">compatibility</a> section.</p>
-
-<p>The server edition of <a href="http://www.corel.com">Corel</a> Linux
-(Canada) also had FreeS/WAN, but Corel have dropped that product line.</p>
-
-<h3><a name="kernel_dist">Linux kernel distributions</a></h3>
-
-<ul>
-<li><a href="http://sourceforge.net/projects/wolk/">Working Overloaded Linux Kernel (WOLK)</a></li>
-</ul>
-
-
-<h3><a name="office_dist">Office server distributions</a></h3>
-
-<p>FreeS/WAN is also included in several distributions aimed at the market
-for turnkey business servers:</p>
-<ul>
-  <li><a href="http://www.e-smith.com/">e-Smith</a> (Canada), which has
-    recently been acquired and become the Network Server Solutions group of
-    <a href="http://www.mitel.com/">Mitel Networks</a> (Canada)</li>
-  <li><a href="http://www.clarkconnect.org/">ClarkConnect</a> from Point Clark Networks (Canada)</li>
-  <li><a href="http://www.trustix.net/">Trustix Secure Linux</a> (Norway)</li>
-   
-</ul>
-
-<h3><a name="fw_dist">Firewall distributions</a></h3>
-
-<p>Several distributions intended for firewall and router applications
-include FreeS/WAN:</p>
-<ul>
-  <li>The <a href="http://www.linuxrouter.org/">Linux Router Project</a>
-    produces a Linux distribution that will boot from a single floppy. The <a
-    href="http://leaf.sourceforge.net">LEAF</a> firewall project provides
-    several different LRP-based firewall packages. At least one of them,
-    Charles Steinkuehler's Dachstein, includes FreeS/WAN with X.509
-  patches.</li>
-  <li>there are several distributions bootable directly from CD-ROM, usable
-    on a machine without hard disk.
-    <ul>
-      <li>Dachstein (see above) can be used this way</li>
-      <li><a href="http://www.gibraltar.at/">Gibraltar</a> is based on Debian
-        GNU/Linux.</li>
-      <li>at time of writing, <a href="www.xiloo.com">Xiloo</a> is available
-        only in Chinese. An English version is expected.</li>
-    </ul>
-  </li>
-  <li><a href="http://www.astaro.com/products/index.html">Astaro Security
-    Linux</a> includes FreeS/WAN. It has some web-based tools for managing
-    the firewall that include FreeS/WAN configuration management.</li>
-  <li><a href="http://www.linuxwall.de">Linuxwall</a></li>
-  <li><a href="http://www.smoothwall.org/">Smoothwall</a></li>
-  <li><a href="http://www.devil-linux.org/">Devil Linux</a></li>
-  <li>Coyote Linux has a <a
-    href="http://embedded.coyotelinux.com/wolverine/index.php">Wolverine</a>
-    firewall/VPN server</li>
-</ul>
-
-<p>There are also several sets of scripts available for managing a firewall
-which is also acting as a FreeS/WAN IPsec gateway. See this <a
-href="firewall.html#rules.pub">list</a>.</p>
-
-<h3><a name="turnkey">Firewall and VPN products</a></h3>
-
-<p>Several vendors use FreeS/WAN as the IPsec component of a turnkey firewall
-or VPN product.</p>
-
-<p>Software-only products:</p>
-<ul>
-  <li><a href="http://www.linuxmagic.com/vpn/index.html">Linux Magic</a>
-    offer a VPN/Firewall product using FreeS/WAN</li>
-  <li>The Software Group's <a
-    href="http://www.wanware.com/sentinet/">Sentinet</a> product uses
-    FreeS/WAN</li>
-  <li><a href="http://www.merilus.com">Merilus</a> use FreeS/WAN in their
-    Gateway Guardian firewall product</li>
-</ul>
-
-<p>Products that include the hardware:</p>
-<ul>
-  <li>The <a href="http://www.lasat.com">LASAT SafePipe[tm]</a> series. is an
-    IPsec box based on an embedded MIPS running Linux with FreeS/WAN and a
-    web-config front end. This company also host our freeswan.org web
-  site.</li>
-  <li>Merilus <a
-    href="http://www.merilus.com/products/fc/index.shtml">Firecard</a> is a
-    Linux firewall on a PCI card.</li>
-  <li><a href="http://www.kyzo.com/">Kyzo</a> have a "pizza box" product line
-    with various types of server, all running from flash. One of them is an
-    IPsec/PPTP VPN server</li>
-  <li><a href="http://www.pfn.com">PFN</a> use FreeS/WAN in some of their
-    products</li>
-</ul>
-
-<p><a href="www.rebel.com">Rebel.com</a>, makers of the Netwinder Linux
-machines (ARM or Crusoe based), had a product that used FreeS/WAN. The
-company is in receivership so the future of the Netwinder is at best unclear.
-<a href="web.html#patch">PKIX patches</a> for FreeS/WAN developed at Rebel
-are listed in our web links document.</p>
-
-
-<h2><a name="docs">Information sources</a></h2>
-
-<h3><a name="docformats">This HowTo, in multiple formats</a></h3>
-
-<p>FreeS/WAN documentation up to version 1.5 was available only in HTML. Now
-we ship two formats:</p>
-<ul>
-  <li>as HTML, one file for each doc section plus a global <a
-    href="toc.html">Table of Contents</a></li>
-  <li><a href="HowTo.html">one big HTML file</a> for easy searching</li>
-</ul>
-
-<p>and provide a Makefile to generate other formats if required:</p>
-<ul>
-  <li><a href="HowTo.pdf">PDF</a></li>
-  <li><a href="HowTo.ps">Postscript</a></li>
-  <li><a href="HowTo.txt">ASCII text</a></li>
-</ul>
-
-<p>The Makefile assumes the htmldoc tool is available. You can download it
-from <a href="http://www.easysw.com">Easy Software</a>.</p>
-
-<p>All formats should be available at the following websites:</p>
-<ul>
-  <li><a href="http://www.freeswan.org/doc.html">FreeS/WAN project</a></li>
-  <li><a href="http://www.linuxdoc.org">Linux Documentation Project</a></li>
-</ul>
-
-<p>The distribution tarball has only the two HTML formats.</p>
-
-<p><strong>Note:</strong> If you need the latest doc version, for example to
-see if anyone has managed to set up interoperation between FreeS/WAN and
-whatever, then you should download the current snapshot. What is on the web
-is documentation as of the last release. Snapshots have all changes I've
-checked in to date.</p>
-
-<h3><a name="rtfm">RTFM (please Read The Fine Manuals)</a></h3>
-
-<p>As with most things on any Unix-like system, most parts of Linux FreeS/WAN
-are documented in online manual pages. We provide a list of <a
-href="/mnt/floppy/manpages.html">FreeS/WAN man pages</a>, with links to HTML
-versions of them.</p>
-
-<p>The man pages describing configuration files are:</p>
-<ul>
-  <li><a href="/mnt/floppy/manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a></li>
-  <li><a
-    href="/mnt/floppy/manpage.d/ipsec.secrets.5.html">ipsec.secrets(5)</a></li>
-</ul>
-
-<p>Man pages for common commands include:</p>
-<ul>
-  <li><a href="/mnt/floppy/manpage.d/ipsec.8.html">ipsec(8)</a></li>
-  <li><a
-  href="/mnt/floppy/manpage.d/ipsec_pluto.8.html">ipsec_pluto(8)</a></li>
-  <li><a
-    href="/mnt/floppy/manpage.d/ipsec_newhostkey.8.html">ipsec_newhostkey(8)</a></li>
-  <li><a href="/mnt/floppy/manpage.d/ipsec_auto.8.html">ipsec_auto(8)</a></li>
-</ul>
-
-<p>You can read these either in HTML using the links above or with the
-<var>man(1)</var> command.</p>
-
-<p>In the event of disagreement between this HTML documentation and the man
-pages, the man pages are more likely correct since they are written by the
-implementers. Please report any such inconsistency on the <a
-href="mail.html#lists">mailing list</a>.</p>
-
-<h3><a name="text">Other documents in the distribution</a></h3>
-
-<p>Text files in the main distribution directory are README, INSTALL,
-CREDITS, CHANGES, BUGS and COPYING.</p>
-
-<p>The Libdes encryption library we use has its own documentation. You can
-find it in the library directory..</p>
-
-<h3><a name="assumptions">Background material</a></h3>
-
-<p>Throughout this documentation, I write as if the reader had at least a
-general familiarity with Linux, with Internet Protocol networking, and with
-the basic ideas of system and network security. Of course that will certainly
-not be true for all readers, and quite likely not even for a majority.</p>
-
-<p>However, I must limit amount of detail on these topics in the main text.
-For one thing, I don't understand all the details of those topics myself.
-Even if I did, trying to explain everything here would produce extremely long
-and almost completely unreadable documentation.</p>
-
-<p>If one or more of those areas is unknown territory for you, there are
-plenty of other resources you could look at:</p>
-<dl>
-  <dt>Linux</dt>
-    <dd>the <a href="http://www.linuxdoc.org">Linux Documentation Project</a>
-      or a local <a href="http://www.linux.org/groups/">Linux User Group</a>
-      and these <a href="web.html#linux.link">links</a></dd>
-  <dt>IP networks</dt>
-    <dd>Rusty Russell's <a
-      href="http://netfilter.samba.org/unreliable-guides/networking-concepts-HOWTO/index.html">Networking
-      Concepts HowTo</a> and these <a
-    href="web.html#IP.background">links</a></dd>
-  <dt>Security</dt>
-    <dd>Schneier's book <a href="biblio.html#secrets">Secrets and Lies</a>
-      and these <a href="web.html#crypto.link">links</a></dd>
-</dl>
-
-<p>Also, I do make an effort to provide some background material in these
-documents. All the basic ideas behind IPsec and FreeS/WAN are explained here.
-Explanations that do not fit in the main text, or that not everyone will
-need, are often in the <a href="glossary.html#ourgloss">glossary</a>, which is 
-the largest single file in this document set. There is also a <a
-href="background.html#background">background</a> file containing various 
-explanations too long to fit in glossary definitions. All files are heavily 
-sprinkled with links to each other and to the glossary. <strong>If some passage 
-makes no sense to you, try the links</strong>.</p>
-
-<p>For other reference material, see the <a
-href="biblio.html#biblio">bibliography</a> and our collection of <a
-href="web.html#weblinks">web links</a>.</p>
-
-<p>Of course, no doubt I get this (and other things) wrong sometimes.
-Feedback via the <a href="mail.html#lists">mailing lists</a> is welcome.</p>
-
-<h3><a name="archives">Archives of the project mailing list</a></h3>
-
-<p>Until quite recently, there was only one FreeS/WAN mailing list, and
-archives of it were:</p>
-<ul>
-  <li><a href="http://www.sandelman.ottawa.on.ca/linux-ipsec">Canada</a></li>
-  <li><a href="http://www.nexial.com">Holland</a></li>
-</ul>
-The two archives use completely different search engines. You might want to
-try both.
-
-<p>More recently we have expanded to five lists, each with its own
-archive.</p>
-
-<p><a href="mail.html#lists">More information</a> on mailing lists.</p>
-
-<h3><a name="howto">User-written HowTo information</a></h3>
-
-<p>Various user-written HowTo documents are available. The ones covering
-FreeS/WAN-to-FreeS/WAN connections are:</p>
-<ul>
-  <li>Jean-Francois Nadeau's <a href="http://jixen.tripod.com/">practical
-    configurations</a> document</li>
-  <li>Jens Zerbst's HowTo on <a href="http://dynipsec.tripod.com/">Using
-    FreeS/WAN with dynamic IP addresses</a>.</li>
-  <li>an entry in Kurt Seifried's <a
-    href="http://www.securityportal.com/lskb/kben00000013.html">Linux
-    Security Knowledge Base</a>.</li>
-  <li>a section of David Ranch's <a
-    href="http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html#trinityos">Trinity
-    OS Guide</a></li>
-  <li>a section in David Bander's book <a href="biblio.html#bander">Linux
-    Security Toolkit</a></li>
-</ul>
-
-<p>User-wriiten HowTo material may be <strong>especially helpful if you need
-to interoperate with another IPsec implementation</strong>. We have neither
-the equipment nor the manpower to test such configurations. Users seem to be
-doing an admirable job of filling the gaps.</p>
-<ul>
-  <li>list of user-written <a href="interop.html#otherpub">interoperation
-    HowTos</a> in our interop document</li>
-</ul>
-
-<p>Check what version of FreeS/WAN user-written documents cover. The software
-is under active development and the current version may be significantly
-different from what an older document describes.</p>
-
-<h3><a name="applied">Papers on FreeS/WAN</a></h3>
-
-<p>Two design documents show team thinking on new developments:</p>
-<ul>
-  <li><a href="opportunism.spec">Opportunistic Encryption</a> by technical
-    lead Henry Spencer and Pluto programmer Hugh Redelemeier</li>
-  <li>discussion of <a
-    href="http://www.sandelman.ottawa.on.ca/SSW/freeswan/klips2req/">KLIPS
-    redesign</a></li>
-</ul>
-
-<p>Both documents are works in progress and are frequently revised. For the
-latest version, see the <a href="mail.html#lists">design mailing list</a>. Comments
-should go to that list.</p>
-
-<p>There is now an <a
-href="http://www.ietf.org/internet-drafts/draft-richardson-ipsec-opportunistic-06.txt">Internet
-Draft on Opportunistic Encryption</a> by Michael Richardson, Hugh Redelmeier
-and Henry Spencer. This is a first step toward getting the protocol
-standardised so there can be multiple implementations of it. Discussion of it
-takes place on the <a
-href="http://www.ietf.org/html.charters/ipsec-charter.html">IETF IPsec
-Working Group</a> mailing list.</p>
-
-<p>A number of papers giving further background on FreeS/WAN, or exploring
-its future or its applications, are also available:</p>
-<ul>
-  <li>Both Henry and Richard gave talks on FreeS/WAN at the 2000 <a
-    href="http://www.linuxsymposium.org">Ottawa Linux Symposium</a>.
-    <ul>
-      <li>Richard's <a
-        href="http://www.conscoop.ottawa.on.ca/rgb/freeswan/ols2k/">slides</a></li>
-      <li>Henry's paper</li>
-      <li>MP3 audio of their talks is available from the <a
-        href="http://www.linuxsymposium.org/">conference page</a></li>
-    </ul>
-  </li>
-  <li><cite>Moat: A Virtual Private Network Appliances and Services
-    Platform</cite> is a paper about large-scale (a few 100 links) use of
-    FreeS/WAN in a production application at AT&amp;T Research. It is
-    available in Postscript or PDF from co-author Steve Bellovin's <a
-    href="http://www.research.att.com/~smb/papers/index.html">papers list
-    page</a>.</li>
-  <li>One of the Moat co-authors, John Denker, has also written
-    <ul>
-      <li>a <a
-        href="http://www.av8n.com/vpn/ipsec+routing.htm">proposal</a>
-        for how future versions of FreeS/WAN might interact with routing
-        protocols</li>
-      <li>a <a
-        href="http://www.av8n.com/vpn/wishlist.htm">wishlist</a>
-        of possible new features</li>
-    </ul>
-  </li>
-  <li>Bart Trojanowski's web page has a draft design for <a
-    href="http://www.jukie.net/~bart/linux-ipsec/">hardware acceleration</a>
-    of FreeS/WAN</li>
-</ul>
-
-<p>Several of these provoked interesting discussions on the mailing lists,
-worth searching for in the <a href="mail.html#archive">archives</a>.</p>
-
-<p>There are also several papers in languages other than English, see our <a
-href="web.html#otherlang">web links</a>.</p>
-
-<h3><a name="licensing">License and copyright information</a></h3>
-
-<p>All code and documentation written for this project is distributed under
-either the GNU General Public License (<a href="glossary.html#GPL">GPL</a>)
-or the GNU Library General Public License. For details see the COPYING file
-in the distribution.</p>
-
-<p>Not all code in the distribution is ours, however. See the CREDITS file
-for details. In particular, note that the <a
-href="glossary.html#LIBDES">Libdes</a> library and the version of <a
-href="glossary.html#MD5">MD5</a> that we use each have their own license.</p>
-
-<h2><a name="sites">Distribution sites</a></h2>
-
-<p>FreeS/WAN is available from a number of sites.</p>
-
-<h3>Primary site</h3>
-
-<p>Our primary site, is at xs4all (Thanks, folks!) in Holland:</p>
-<ul>
-  <li><a href="http://www.xs4all.nl/~freeswan">HTTP</a></li>
-  <li><a href="ftp://ftp.xs4all.nl/pub/crypto/freeswan">FTP</a></li>
-</ul>
-
-<h3><a name="mirrors">Mirrors</a></h3>
-
-<p>There are also mirror sites all over the world:</p>
-<ul>
-  <li><a href="http://www.flora.org/freeswan">Eastern Canada</a> (limited
-    resouces)</li>
-  <li><a href="ftp://ludwig.doculink.com/pub/freeswan/">Eastern Canada</a>
-    (has older versions too)</li>
-  <li><a href="ftp://ntsc.notBSD.org/pub/crypto/freeswan/">Eastern Canada</a>
-    (has older versions too)</li>
-  <li><a href="ftp://ftp.kame.net/pub/freeswan/">Japan</a></li>
-  <li><a href="ftp://ftp.futuredynamics.com/freecrypto/FreeSWAN/">Hong
-    Kong</a></li>
-  <li><a href="ftp://ipsec.dk/pub/freeswan/">Denmark</a></li>
-  <li><a href="ftp://ftp.net.lut.ac.uk/freeswan">the UK</a></li>
-  <li><a href="http://storm.alert.sk/comp/mirrors/freeswan/">Slovak
-    Republic</a></li>
-  <li><a
-    href="http://the.wiretapped.net/security/vpn-tunnelling/freeswan/">Australia</a></li>
-  <li><a href="http://freeswan.technolust.cx/">technolust</a></li>
-  <li><a href="http://freeswan.devguide.de/">Germany</a></li>
-  <li>Ivan Moore's <a href="http://snowcrash.tdyc.com/freeswan/">site</a></li>
-  <li>the <a href="http://www.cryptoarchive.net/">Crypto Archive</a> on the
-    <a href="http://www.securityportal.com/">Security Portal</a> site</li>
-  <li><a href="http://www.wiretapped.net/">Wiretapped.net</a> in
-  Australia</li>
-</ul>
-
-<p>Thanks to those folks as well.</p>
-
-<h3><a name="munitions">The "munitions" archive of Linux crypto
-software</a></h3>
-
-<p>There is also an archive of Linux crypto software called "munitions", with
-its own mirrors in a number of countries. It includes FreeS/WAN, though not
-always the latest version. Some of its sites are:</p>
-<ul>
-  <li><a href="http://munitions.vipul.net/">Germany</a></li>
-  <li><a href="http://munitions.iglu.cjb.net/">Italy</a></li>
-  <li><a href="http://munitions2.xs4all.nl/">Netherlands</a></li>
-</ul>
-
-<p>Any of those will have a list of other "munitions" mirrors. There is also
-a CD available.</p>
-
-<h2>Links to other sections</h2>
-
-<p>For more detailed background information, see:</p>
-<ul>
-  <li><a href="politics.html#politics">history and politics</a> of 
-   cryptography</li>
-  <li><a href="ipsec.html#ipsec.detail">IPsec protocols</a></li>
-</ul>
-
-<p>To begin working with FreeS/WAN, go to our <a
-href="quickstart.html#quick.guide">quickstart</a> guide.</p>
-</body>
-</html>
diff --git a/doc/src/ipsec.html b/doc/src/ipsec.html
deleted file mode 100644
index 4647eaf66..000000000
--- a/doc/src/ipsec.html
+++ /dev/null
@@ -1,1206 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>IPsec protocols</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, protocol, ESP, AH, IKE">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: ipsec.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1><a name="ipsec.detail">The IPsec protocols</a></h1>
-
-<p>This section provides information on the IPsec protocols which FreeS/WAN
-implements. For more detail, see the <a href="rfc.html">RFCs</a>.</p>
-
-<p>The basic idea of IPsec is to provide security functions, <a
-href="glossary.html#authentication">authentication</a> and <a
-href="glossary.html#encryption">encryption</a>, at the IP (Internet Protocol)
-level. This requires a higher-level protocol (IKE) to set things up for the
-IP-level services (ESP and AH).</p>
-
-<h2>Protocols and phases</h2>
-
-<p>Three protocols are used in an IPsec implementation:</p>
-<dl>
-  <dt>ESP, Encapsulating Security Payload</dt>
-    <dd>Encrypts and/or authenticates data</dd>
-  <dt>AH, Authentication Header</dt>
-    <dd>Provides a packet authentication service</dd>
-  <dt>IKE, Internet Key Exchange</dt>
-    <dd>Negotiates connection parameters, including keys, for the other
-    two</dd>
-</dl>
-
-<p>The term "IPsec" (also written as IPSEC) is slightly ambiguous. In some
-contexts, it includes all three of the above but in other contexts it refers
-only to AH and ESP.</p>
-
-<p>There is more detail below, but a quick summary of how the whole thing
-works is:</p>
-<dl>
-  <dt>Phase one IKE (main mode exchange)</dt>
-    <dd>sets up a keying channel (ISAKMP SA) between the two gateways</dd>
-  <dt>Phase two IKE (quick mode exchange)</dt>
-    <dd>sets up data channels (IPsec SAs)</dd>
-  <dt>IPsec proper</dt>
-    <dd>exchanges data using AH or ESP</dd>
-</dl>
-
-<p>Both phases of IKE are repeated periodically to automate re-keying.</p>
-
-<h2><a name="others">Applying IPsec</a></h2>
-
-<p>Authentication and encryption functions for network data can, of course,
-be provided at other levels. Many security protocols work at levels above
-IP.</p>
-<ul>
-  <li><a href="glossary.html#PGP">PGP</a> encrypts and authenticates mail
-    messages</li>
-  <li><a href="glossary.html#SSH">SSH</a> authenticates remote logins and
-    then encrypts the session</li>
-  <li><a href="glossary.html#SSL">SSL</a> or <a
-    href="glossary.html#TLS">TLS</a> provides security at the sockets layer,
-    e.g. for secure web browsing</li>
-</ul>
-
-<p>and so on. Other techniques work at levels below IP. For example, data on
-a communications circuit or an entire network can be encrypted by specialised
-hardware. This is common practice in high-security applications.</p>
-
-<h3><a name="advantages">Advantages of IPsec</a></h3>
-
-<p>There are, however, advantages to doing it at the IP level instead of, or
-as well as, at other levels.</p>
-
-<p>IPsec is the <strong>most general way to provide these services for the
-Internet</strong>.</p>
-<ul>
-  <li>Higher-level services protect a <em>single protocol</em>; for example
-    PGP protects mail.</li>
-  <li>Lower level services protect a <em>single medium</em>; for example a
-    pair of encryption boxes on the ends of a line make wiretaps on that line
-    useless unless the attacker is capable of breaking the encryption.</li>
-</ul>
-
-<p>IPsec, however, can protect <em>any protocol</em> running above IP and
-<em>any medium</em> which IP runs over. More to the point, it can protect a
-mixture of application protocols running over a complex combination of media.
-This is the normal situation for Internet communication; IPsec is the only
-general solution.</p>
-
-<p>IPsec can also provide some security services "in the background", with
-<strong>no visible impact on users</strong>. To use <a
-href="glossary.html#PGP">PGP</a> encryption and signatures on mail, for
-example, the user must at least:</p>
-<ul>
-  <li>remember his or her passphrase,</li>
-  <li>keep it secure</li>
-  <li>follow procedures to validate correspondents' keys</li>
-</ul>
-
-<p>These systems can be designed so that the burden on users is not onerous,
-but any system will place some requirements on users. No such system can hope
-to be secure if users are sloppy about meeting those requirements. The author
-has seen username and password stuck on terminals with post-it notes in an
-allegedly secure environment, for example.</p>
-
-<h3><a name="limitations">Limitations of IPsec</a></h3>
-
-<p>IPsec is designed to secure IP links between machines. It does that well,
-but it is important to remember that there are many things it does not do.
-Some of the important limitations are:</p>
-<dl>
-  <dt><a name="depends">IPsec cannot be secure if your system isn't</a></dt>
-    <dd>System security on IPsec gateway machines is an essential requirement
-      if IPsec is to function as designed. No system can be trusted if the
-      underlying machine has been subverted. See books on Unix security such
-      as <a href="biblio.html#practical">Garfinkel and Spafford</a> or our
-      web references for <a href="web.html#linsec">Linux security</a> or more
-      general <a href="web.html#compsec">computer security</a>.
-      <p>Of course, there is another side to this. IPsec can be a powerful
-      tool for improving system and network security. For example, requiring
-      packet authentication makes various spoofing attacks harder and IPsec
-      tunnels can be extremely useful for secure remote administration of
-      various things.</p>
-    </dd>
-  <dt><a name="not-end-to-end">IPsec is not end-to-end</a></dt>
-    <dd>IPsec cannot provide the same end-to-end security as systems working
-      at higher levels. IPsec encrypts an IP connection between two machines,
-      which is quite a different thing than encrypting messages between users
-      or between applications.
-      <p>For example, if you need mail encrypted from the sender's desktop to
-      the recipient's desktop and decryptable only by the recipient, use <a
-      href="glossary.html#PGP">PGP</a> or another such system. IPsec can
-      encrypt any or all of the links involved -- between the two mail
-      servers, or between either server and its clients. It could even be
-      used to secure a direct IP link from the sender's desktop machine to
-      the recipient's, cutting out any sort of network snoop. What it cannot
-      ensure is end-to-end user-to-user security. If only IPsec is used to
-      secure mail, then anyone with appropriate privileges on any machine
-      where that mail is stored (at either end or on any store-and-forward
-      servers in the path) can read it.</p>
-      <p>In another common setup, IPsec encrypts packets at a security
-      gateway machine as they leave the sender's site and decrypts them on
-      arrival at the gateway to the recipient's site. This does provide a
-      useful security service -- only encrypted data is passed over the
-      Internet -- but it does not even come close to providing an end-to-end
-      service. In particular, anyone with appropriate privileges on either
-      site's LAN can intercept the message in unencrypted form.</p>
-    </dd>
-  <dt><a name="notpanacea">IPsec cannot do everything</a></dt>
-    <dd>IPsec also cannot provide all the functions of systems working at
-      higher levels of the protocol stack. If you need a document
-      electronically signed by a particular person, then you need his or her
-      <a href="glossary.html#signature">digital signature</a> and a <a
-      href="glossary.html#public">public key cryptosystem</a> to verify it
-      with.
-      <p>Note, however, that IPsec authentication of the underlying
-      communication can make various attacks on higher-level protocols more
-      difficult. In particular, authentication prevents <a
-      href="glossary.html#middle">man-in-the-middle attacks</a>.</p>
-    </dd>
-  <dt><a name="no_user">IPsec authenticates machines, not users</a></dt>
-    <dd>IPsec uses strong authentication mechanisms to control which messages
-      go to which machines, but it does not have the concept of user ID,
-      which is vital to many other security mechansims and policies. This
-      means some care must be taken in fitting the various security
-      mechansims on a network together. For example, if you need to control
-      which users access your database server, you need some non-IPsec
-      mechansim for that. IPsec can control which machines connect to the
-      server, and can ensure that data transfer to those machines is done
-      securely, but that is all. Either the machines themselves must control
-      user access or there must be some form of user authentication to the
-      database, independent of IPsec.</dd>
-  <dt><a name="DoS">IPsec does not stop denial of service attacks</a></dt>
-    <dd><a href="glossary.html#DOS">Denial of service</a> attacks aim at
-      causing a system to crash, overload, or become confused so that
-      legitimate users cannot get whatever services the system is supposed to
-      provide. These are quite different from attacks in which the attacker
-      seeks either to use the service himself or to subvert the service into
-      delivering incorrect results.
-      <p>IPsec shifts the ground for DoS attacks; the attacks possible
-      against systems using IPsec are different than those that might be used
-      against other systems. It does not, however, eliminate the possibility
-      of such attacks.</p>
-    </dd>
-  <dt><a name="traffic">IPsec does not stop traffic analysis</a></dt>
-    <dd><a href="glossary.html#traffic">Traffic analysis</a> is the attempt
-      to derive intelligence from messages without regard for their contents.
-      In the case of IPsec, it would mean analysis based on things visible in
-      the unencrypted headers of encrypted packets -- source and destination
-      gateway addresses, packet size, et cetera. Given the resources to
-      acquire such data and some skill in analysing it (both of which any
-      national intelligence agency should have), this can be a very powerful
-      technique.
-      <p>IPsec is not designed to defend against this. Partial defenses are
-      certainly possible, and some are <a href="#traffic.resist">described
-      below</a>, but it is not clear that any complete defense can be
-      provided.</p>
-    </dd>
-</dl>
-
-<h3><a name="uses">IPsec is a general mechanism for securing IP</a></h3>
-
-<p>While IPsec does not provide all functions of a mail encryption package,
-it can encrypt your mail. In particular, it can ensure that all mail passing
-between a pair or a group of sites is encrypted. An attacker looking only at
-external traffic, without access to anything on or behind the IPsec gateway,
-cannot read your mail. He or she is stymied by IPsec just as he or she would
-be by <a href="glossary.html#PGP">PGP</a>.</p>
-
-<p>The advantage is that IPsec can provide the same protection for <strong>
-anything transmitted over IP</strong>. In a corporate network example, PGP
-lets the branch offices exchange secure mail with head office. SSL and SSH
-allow them to securely view web pages, connect as terminals to machines, and
-so on. IPsec can support all those applications, plus database queries, file
-sharing (NFS or Windows), other protocols encapsulated in IP (Netware,
-Appletalk, ...), phone-over-IP, video-over-IP, ... anything-over-IP. The only
-limitation is that IP Multicast is not yet supported, though there are
-Internet Draft documents for that.</p>
-
-<p>IPsec creates <strong>secure tunnels through untrusted networks</strong>.
-Sites connected by these tunnels form VPNs, <a
-href="glossary.html#VPN">Virtual Private Networks</a>.</p>
-
-<p>IPsec gateways can be installed wherever they are required.</p>
-<ul>
-  <li>One organisation might choose to install IPsec only on firewalls
-    between their LANs and the Internet. This would allow them to create a
-    VPN linking several offices. It would provide protection against anyone
-    outside their sites.</li>
-  <li>Another might install IPsec on departmental servers so everything on
-    the corporate backbone net was encrypted. This would protect messages on
-    that net from everyone except the sending and receiving department.</li>
-  <li>Another might be less concerned with information secrecy and more with
-    controlling access to certain resources. They might use IPsec packet
-    authentication as part of an access control mechanism, with or without
-    also using the IPsec encryption service.</li>
-  <li>It is even possible (assuming adequate processing power and an IPsec
-    implementation in each node) to make every machine its own IPsec gateway
-    so that everything on a LAN is encrypted. This protects information from
-    everyone outside the sending and receiving machine.</li>
-  <li>These techniques can be combined in various ways. One might, for
-    example, require authentication everywhere on a network while using
-    encryption only for a few links.</li>
-</ul>
-
-<p>Which of these, or of the many other possible variants, to use is up to
-you. <strong>IPsec provides mechanisms; you provide the policy</strong>.</p>
-
-<p><strong>No end user action is required</strong> for IPsec security to be
-used; they don't even have to know about it. The site administrators, of
-course, do have to know about it and to put some effort into making it work.
-Poor administration can compromise IPsec as badly as the post-it notes
-mentioned above. It seems reasonable, though, for organisations to hope their
-system administrators are generally both more security-conscious than end
-users and more able to follow computer security procedures. If not, at least
-there are fewer of them to educate or replace.</p>
-
-<p>IPsec can be, and often should be, used with along with security protocols
-at other levels. If two sites communicate with each other via the Internet,
-then IPsec is the obvious way to protect that communication. If two others
-have a direct link between them, either link encryption or IPsec would make
-sense. Choose one or use both. Whatever you use at and below the IP level,
-use other things as required above that level. Whatever you use above the IP
-level, consider what can be done with IPsec to make attacks on the higher
-levels harder. For example, <a href="glossary.html#middle">man-in-the-middle
-attacks</a> on various protocols become difficult if authentication at packet
-level is in use on the potential victims' communication channel.</p>
-
-<h3><a name="authonly">Using authentication without encryption</a></h3>
-
-<p>Where appropriate, IPsec can provide authentication without encryption.
-One might do this, for example:</p>
-<ul>
-  <li>where the data is public but one wants to be sure of getting the right
-    data, for example on some web sites</li>
-  <li>where encryption is judged unnecessary, for example on some company or
-    department LANs</li>
-  <li>where strong encryption is provided at link level, below IP</li>
-  <li>where strong encryption is provided in other protocols, above IP<br>
-    Note that IPsec authentication may make some attacks on those protocols
-    harder.</li>
-</ul>
-
-<p>Authentication has lower overheads than encryption.</p>
-
-<p>The protocols provide four ways to build such connections, using either an
-AH-only connection or ESP using null encryption, and in either manually or
-automatically keyed mode. FreeS/WAN supports only one of these, manually
-keyed AH-only connections, and <strong>we do not recommend using
-that</strong>. Our reasons are discussed under <a
-href="#traffic.resist">Resisting traffic analysis</a> a few sections further
-along.</p>
-
-<h3><a name="encnoauth">Encryption without authentication is
-dangerous</a></h3>
-
-<p>Originally, the IPsec encryption protocol <a
-href="glossary.html#ESP">ESP</a> didn't do integrity checking. It only did
-encryption. Steve Bellovin found many ways to attack ESP used without
-authentication. See his paper <a
-href="http://www.research.att.com/~smb/papers/badesp.ps">Problem areas for
-the IP Security Protocols</a>. To make a secure connection, you had to add an
-<a href="glossary.html#AH">AH</a> Authentication Header as well as ESP.
-Rather than incur the overhead of several layers (and rather than provide an
-ESP layer that didn't actually protect the traffic), the IPsec working group
-built integrity and replay checking directly into ESP.</p>
-
-<p>Today, typical usage is one of:</p>
-<ul>
-  <li>ESP for encryption and authentication</li>
-  <li>AH for authentication alone</li>
-</ul>
-
-<p>Other variants are allowed by the standard, but not much used:</p>
-<dl>
-  <dt>ESP encryption without authentication</dt>
-    <dd><strong>Bellovin has demonstrated fatal flaws in this. Do not
-      use.</strong></dd>
-  <dt>ESP encryption with AH authentication</dt>
-    <dd>This has higher overheads than using the authentication in ESP, and
-      no obvious benefit in most cases. The exception might be a network
-      where AH authentication was widely or universally used. If you're going
-      to do AH to conform with network policy, why authenticate again in the
-      ESP layer?</dd>
-  <dt>Authenticate twice, with AH and with ESP</dt>
-    <dd>Why? Of course, some folk consider "belt and suspenders" the sensible
-      approach to security. If you're among them, you might use both
-      protocols here. You might also use both to satisfy different parts of a
-      security policy. For example, an organisation might require AH
-      authentication everywhere but two users within the organisation might
-      use ESP as well.</dd>
-  <dt>ESP authentication without encryption</dt>
-    <dd>The standard allows this, calling it "null encryption". FreeS/WAN
-      does not support it. We recommend that you use AH instead if
-      authentication is all you require. AH authenticates parts of the IP
-      header, which ESP-null does not do.</dd>
-</dl>
-
-<p>Some of these variants cannot be used with FreeS/WAN because we do not
-support ESP-null and do not support automatic keying of AH-only
-connections.</p>
-
-<p>There are fairly frequent suggestions that AH be dropped entirely from the
-IPsec specifications since ESP and null encryption can handle that situation.
-It is not clear whether this will occur. My guess is that it is unlikely.</p>
-
-<h3><a name="multilayer">Multiple layers of IPsec processing are
-possible</a></h3>
-
-<p>The above describes combinations possible on a single IPsec connection. In
-a complex network you may have several layers of IPsec in play, with any of
-the above combinations at each layer.</p>
-
-<p>For example, a connection from a desktop machine to a database server
-might require AH authentication. Working with other host, network and
-database security measures, AH might be just the thing for access control.
-You might decide not to use ESP encryption on such packets, since it uses
-resources and might complicate network debugging. Within the site where the
-server is, then, only AH would be used on those packets.</p>
-
-<p>Users at another office, however, might have their whole connection (AH
-headers and all) passing over an IPsec tunnel connecting their office to the
-one with the database server. Such a tunnel should use ESP encryption and
-authentication. You need authentication in this layer because without
-authentication the encryption is vulnerable and the gateway cannot verify the
-AH authentication. The AH is between client and database server; the gateways
-aren't party to it.</p>
-
-<p>In this situation, some packets would get multiple layers of IPsec applied
-to them, AH on an end-to-end client-to-server basis and ESP from one office's
-security gateway to the other.</p>
-
-<h3><a name="traffic.resist">Resisting traffic analysis</a></h3>
-
-<p><a href="glossary.html#traffic">Traffic analysis</a> is the attempt to
-derive useful intelligence from encrypted traffic without breaking the
-encryption.</p>
-
-<p>Is your CEO exchanging email with a venture capital firm? With bankruptcy
-trustees? With an executive recruiting agency? With the holder of some
-important patents? If an eavesdropper learns about any of those, then he has
-interesting intelligence on your company, whether or not he can read the
-messages themselves.</p>
-
-<p>Even just knowing that there is network traffic between two sites may tell
-an analyst something useful, especially when combined with whatever other
-information he or she may have. For example, if you know Company A is having
-cashflow problems and Company B is looking for aquisitions, then knowing that
-packets are passing between the two is interesting. It is more interesting if
-you can tell it is email, and perhaps yet more if you know the sender and
-recipient.</p>
-
-<p>Except in the simplest cases, traffic analysis is hard to do well. It
-requires both considerable resources and considerable analytic skill.
-However, intelligence agencies of various nations have been doing it for
-centuries and many of them are likely quite good at it by now. Various
-commercial organisations, especially those working on "targeted marketing"
-may also be quite good at analysing certain types of traffic.</p>
-
-<p>In general, defending against traffic analysis is also difficult.
-Inventing a really good defense could get you a PhD and some interesting job
-offers.</p>
-
-<p>IPsec is not designed to stop traffic analysis and we know of no plausible
-method of extending it to do so. That said, there are ways to make traffic
-analysis harder. This section describes them.</p>
-
-<h4><a name="extra">Using "unnecessary" encryption</a></h4>
-
-<p>One might choose to use encryption even where it appears unnecessary in
-order to make analysis more difficult. Consider two offices which pass a
-small volume of business data between them using IPsec and also transfer
-large volumes of Usenet news. At first glance, it would seem silly to encrypt
-the newsfeed, except possibly for any newsgroups that are internal to the
-company. Why encrypt data that is all publicly available from many sites?</p>
-
-<p>However, if we encrypt a lot of news and send it down the same connection
-as our business data, we make <a href="glossary.html#traffic">traffic
-analysis</a> much harder. A snoop cannot now make inferences based on
-patterns in the volume, direction, sizes, sender, destination, or timing of
-our business messages. Those messages are hidden in a mass of news messages
-encapsulated in the same way.</p>
-
-<p>If we're going to do this we need to ensure that keys change often enough
-to remain secure even with high volumes and with the adversary able to get
-plaintext of much of the data. We also need to look at other attacks this
-might open up. For example, can the adversary use a chosen plaintext attack,
-deliberately posting news articles which, when we receive and encrypt them,
-will help break our encryption? Or can he block our business data
-transmission by flooding us with silly news articles? Or ...</p>
-
-<p>Also, note that this does not provide complete protection against traffic
-analysis. A clever adversary might still deduce useful intelligence from
-statistical analysis (perhaps comparing the input newsfeed to encrypted
-output, or comparing the streams we send to different branch offices), or by
-looking for small packets which might indicate establishment of TCP
-connections, or ...</p>
-
-<p>As a general rule, though, to improve resistance to traffic analysis, you
-should <strong>encrypt as much traffic as possible, not just as much as seems
-necessary.</strong></p>
-
-<h4><a name="multi-encrypt">Using multiple encryption</a></h4>
-
-<p>This also applies to using multiple layers of encryption. If you have an
-IPsec tunnel between two branch offices, it might appear silly to send <a
-href="glossary.html#PGP">PGP</a>-encrypted email through that tunnel.
-However, if you suspect someone is snooping your traffic, then it does make
-sense:</p>
-<ul>
-  <li>it protects the mail headers; they cannot even see who is mailing
-  who</li>
-  <li>it protects against user bungles or software malfunctions that
-    accidentally send messages in the clear</li>
-  <li>it makes any attack on the mail encryption much harder; they have to
-    break IPsec or break into your network before they can start on the mail
-    encryption</li>
-</ul>
-
-<p>Similar arguments apply for <a href="glossary.html#SSL">SSL</a>-encrypted
-web traffic or <a href="glossary.html#SSH">SSH</a>-encrypted remote login
-sessions, even for end-to-end IPsec tunnels between systems in the two
-offices.</p>
-
-<h4><a name="fewer">Using fewer tunnels</a></h4>
-
-<p>It may also help to use fewer tunnels. For example, if all you actually
-need encrypted is connections between:</p>
-<ul>
-  <li>mail servers at branch and head offices</li>
-  <li>a few branch office users and the head office database server</li>
-</ul>
-
-<p>You might build one tunnel per mail server and one per remote database
-user, restricting traffic to those applications. This gives the traffic
-analyst some information, however. He or she can distinguish the tunnels by
-looking at information in the ESP header and, given that distinction and the
-patterns of tunnel usage, might be able to figure out something useful.
-Perhaps not, but why take the risk?</p>
-
-<p>We suggest instead that you build one tunnel per branch office, encrypting
-everything passing from head office to branches. This has a number of
-advantages:</p>
-<ul>
-  <li>it is easier to build and administer</li>
-  <li>it resists traffic analysis somewhat better</li>
-  <li>it provides security for whatever you forgot. For example, if some user
-    at a remote office browses proprietary company data on some head office
-    web page (that the security people may not even know about!), then that
-    data is encrypted before it reaches the Internet.</li>
-</ul>
-
-<p>Of course you might also want to add additional tunnels. For example, if
-some of the database data is confidential and should not be exposed even
-within the company, then you need protection from the user's desktop to the
-database server. We suggest you do that in whatever way seems appropriate --
-IPsec, SSH or SSL might fit -- but, whatever you choose, pass it between
-locations via a gateway-to-gateway IPsec tunnel to provide some resistance to
-traffic analysis.</p>
-
-<h2><a name="primitives">Cryptographic components</a></h2>
-
-<p>IPsec combines a number of cryptographic techniques, all of them
-well-known and well-analyzed. The overall design approach was conservative;
-no new or poorly-understood components were included.</p>
-
-<p>This section gives a brief overview of each technique. It is intended only
-as an introduction. There is more information, and links to related topics,
-in our <a href="glossary.html">glossary</a>. See also our <a
-href="biblio.html">bibliography</a> and cryptography <a
-href="web.html#crypto.link">web links</a>.</p>
-
-<h3><a name="block.cipher">Block ciphers</a></h3>
-
-<p>The <a href="glossary.html#encryption">encryption</a> in the <a
-href="glossary.html#ESP">ESP</a> encapsulation protocol is done with a <a
-href="glossary.html#block">block cipher</a>.</p>
-
-<p>We do not implement <a href="glossary.html#DES">single DES</a>. It is <a
-href="politics.html#desnotsecure">insecure</a>. Our default, and currently
-only, block cipher is <a href="glossary.html#3DES">triple DES</a>.</p>
-
-<p>The <a href="glossary.html#rijndael">Rijndael</a> block cipher has won the
-<a href="glossary.html#AES">AES</a> competition to choose a relacement for
-DES. It will almost certainly be added to FreeS/WAN and to other IPsec
-implementations. <a href="web.html#patch">Patches</a> are already
-available.</p>
-
-<h3><a name="hash.ipsec">Hash functions</a></h3>
-
-<h4><a name="hmac.ipsec">The HMAC construct</a></h4>
-
-<p>IPsec packet authentication is done with the <a
-href="glossary.html#HMAC">HMAC</a> construct. This is not just a hash of the
-packet data, but a more complex operation which uses both a hashing algorithm
-and a key. It therefore does more than a simple hash would. A simple hash
-would only tell you that the packet data was not changed in transit, or that
-whoever changed it also regenerated the hash. An HMAC also tells you that the
-sender knew the HMAC key.</p>
-
-<p>For IPsec HMAC, the output of the hash algorithm is truncated to 96 bits.
-This saves some space in the packets. More important, it prevents an attacker
-from seeing all the hash output bits and perhaps creating some sort of attack
-based on that knowledge.</p>
-
-<h4>Choice of hash algorithm</h4>
-
-<p>The IPsec RFCs require two hash algorithms -- <a
-href="glossary.html#MD5">MD5</a> and <a href="glossary.html#SHA">SHA-1</a> --
-both of which FreeS/WAN implements.</p>
-
-<p>Various other algorithms -- such as RIPEMD and Tiger -- are listed in the
-RFCs as optional. None of these are in the FreeS/WAN distribution, or are
-likely to be added, although user <a href="web.html#patch">patches</a> exist
-for several of them.</p>
-
-<p>Additional hash algorithms -- <a href="glossary.html#SHA-256">SHA-256,
-SHA-384 and SHA-512</a> -- may be required to give hash strength matching the
-strength of <a href="glossary.html#AES">AES</a>. These are likely to be added
-to FreeS/WAN along with AES.</p>
-
-<h3><a name="DH.keying">Diffie-Hellman key agreement</a></h3>
-
-<p>The <a href="glossary.html#DH">Diffie-Hellman</a> key agreement protocol
-allows two parties (A and B or <a href="glossary.html#alicebob">Alice and
-Bob</a>) to agree on a key in such a way that an eavesdropper who intercepts
-the entire conversation cannot learn the key.</p>
-
-<p>The protocol is based on the <a href="glossary.html#dlog">discrete
-logarithm</a> problem and is therefore thought to be secure. Mathematicians
-have been working on that problem for years and seem no closer to a solution,
-though there is no proof that an efficient solution is impossible.</p>
-
-<h3><a name="RSA.auth">RSA authentication</a></h3>
-
-<p>The <a href="glossary.html#RSA">RSA</a> algorithm (named for its inventors
--- Rivest, Shamir and Adleman) is a very widely used <a
-href="glossary.html#">public key</a> cryptographic technique. It is used in
-IPsec as one method of authenticating gateways for Diffie-Hellman key
-negotiation.</p>
-
-<h2><a name="structure">Structure of IPsec</a></h2>
-
-<p>There are three protocols used in an IPsec implementation:</p>
-<dl>
-  <dt>ESP, Encapsulating Security Payload</dt>
-    <dd>Encrypts and/or authenticates data</dd>
-  <dt>AH, Authentication Header</dt>
-    <dd>Provides a packet authentication service</dd>
-  <dt>IKE, Internet Key Exchange</dt>
-    <dd>Negotiates connection parameters, including keys, for the other
-    two</dd>
-</dl>
-
-<p>The term "IPsec" is slightly ambiguous. In some contexts, it includes all
-three of the above but in other contexts it refers only to AH and ESP.</p>
-
-<h3><a name="IKE.ipsec">IKE (Internet Key Exchange)</a></h3>
-
-<p>The IKE protocol sets up IPsec (ESP or AH) connections after negotiating
-appropriate parameters (algorithms to be used, keys, connection lifetimes)
-for them. This is done by exchanging packets on UDP port 500 between the two
-gateways.</p>
-
-<p>IKE (RFC 2409) was the outcome of a long, complex process in which quite a
-number of protocols were proposed and debated. Oversimplifying mildly, IKE
-combines:</p>
-<dl>
-  <dt>ISAKMP (RFC 2408)</dt>
-    <dd>The <strong>I</strong>nternet <strong>S</strong>ecurity
-      <strong>A</strong>ssociation and <strong>K</strong>ey
-      <strong>M</strong>anagement <strong>P</strong>rotocol manages
-      negotiation of connections and defines <a
-      href="glossary.html#SA">SA</a>s (Security Associations) as a means of
-      describing connection properties.</dd>
-  <dt>IPsec DOI for ISAKMP (RFC 2407)</dt>
-    <dd>A <strong>D</strong>omain <strong>O</strong>f
-      <strong>I</strong>nterpretation fills in the details necessary to turn
-      the rather abstract ISAKMP protocol into a more tightly specified
-      protocol, so it becomes applicable in a particular domain.</dd>
-  <dt>Oakley key determination protocol (RFC 2412)</dt>
-    <dd>Oakley creates keys using the <a
-      href="glossary.html#DH">Diffie-Hellman</a> key agreement protocol.</dd>
-</dl>
-
-<p>For all the details, you would need to read the four <a
-href="rfc.html">RFCs</a> just mentioned (over 200 pages) and a number of
-others. We give a summary below, but it is far from complete.</p>
-
-<h4><a name="phases">Phases of IKE</a></h4>
-
-<p>IKE negotiations have two phases.</p>
-<dl>
-  <dt>Phase one</dt>
-    <dd>The two gateways negotiate and set up a two-way ISAKMP SA which they
-      can then use to handle phase two negotiations. One such SA between a
-      pair of gateways can handle negotiations for multiple tunnels.</dd>
-  <dt>Phase two</dt>
-    <dd>Using the ISAKMP SA, the gateways negotiate IPsec (ESP and/or AH) SAs
-      as required. IPsec SAs are unidirectional (a different key is used in
-      each direction) and are always negotiated in pairs to handle two-way
-      traffic. There may be more than one pair defined between two
-    gateways.</dd>
-</dl>
-
-<p>Both of these phases use the UDP protocol and port 500 for their
-negotiations.</p>
-
-<p>After both IKE phases are complete, you have IPsec SAs to carry your
-encrypted data. These use the ESP or AH protocols. These protocols do not
-have ports. Ports apply only to UDP or TCP.</p>
-
-<p>The IKE protocol is designed to be extremely flexible. Among the things
-that can be negotiated (separately for each SA) are:</p>
-<ul>
-  <li>SA lifetime before rekeying</li>
-  <li>encryption algorithm used. We currently support only <a
-    href="glossary.html#3DES">triple DES</a>. Single DES is <a
-    href="politics.html#desnotsecure">insecure</a>. The RFCs say you MUST do
-    DES, SHOULD do 3DES and MAY do various others. We do not do any of the
-    others.</li>
-  <li>authentication algorithms. We support <a
-    href="glossary.html#MD5">MD5</a> and <a href="glossary.html#SHA">SHA</a>.
-    These are the two the RFCs require.</li>
-  <li>choice of group for <a href="glossary.html#DH">Diffie-Hellman</a> key
-    agreement. We currently support Groups 2 and 5 (which are defined modulo
-    primes of various lengths) and do not support Group 1 (defined modulo a
-    shorter prime, and therefore cryptographically weak) or groups 3 and 4
-    (defined using elliptic curves). The RFCs require only Group 1.</li>
-</ul>
-
-<p>The protocol also allows implementations to add their own encryption
-algorithms, authentication algorithms or Diffie-Hellman groups. We do not
-support any such extensions, but there are some <a
-href="web.html#patch">patches</a> that do.</p>
-
-<p>There are a number of complications:</p>
-<ul>
-  <li>The gateways must be able to authenticate each other's identities
-    before they can create a secure connection. This host authentication is
-    part of phase one negotiations, and is a required prerequisite for packet
-    authentication used later. Host authentication can be done in a variety
-    of ways. Those supported by FreeS/WAN are discussed in our <a
-    href="adv_config.html#auto-auth">advanced configuration</a> document.</li>
-  <li>Phase one can be done in two ways.
-    <ul>
-      <li>Main Mode is required by the RFCs and supported in FreeS/WAN. It
-        uses a 6-packet exzchange.</li>
-      <li>Aggressive Mode is somewhat faster (only 3 packets) but reveals
-        more to an eavesdropper. This is optional in the RFCs, not currently
-        supported by FreeS/WAN, and not likely to be.</li>
-    </ul>
-  </li>
-  <li>A new group exchange may take place after phase one but before phase
-    two, defining an additional group for use in the <a
-    href="glossary.html#DH">Diffie-Hellman</a> key agreement part of phase
-    two. FreeS/WAN does not currently support this.</li>
-  <li>Phase two always uses Quick Mode, but there are two variants of that:
-    <ul>
-      <li>One variant provides <a href="glossary.html#PFS">Perfect Forward
-        Secrecy (PFS)</a>. An attacker that obtains your long-term host
-        authentication key does not immediately get any of your short-term
-        packet encryption of packet authentication keys. He must conduct
-        another successful attack each time you rekey to get the short-term
-        keys. Having some short-term keys does not help him learn others. In
-        particular, breaking your system today does not let him read messages
-        he archived yestarday, assuming you've changed short-term keys in the
-        meanwhile. We enable PFS as the default.</li>
-      <li>The other variant disables PFS and is therefore slightly faster. We
-        do not recommend this since it is less secure, but FreeS/WAN does
-        support it. You can enable it with a <var>pfs=no</var> statement in
-        <a href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a>.</li>
-      <li>The protocol provides no way to negotiate which variant will be
-        used. If one gateway is set for PFS and the other is not, the
-        negotiation fails. This has proved a fairly common source of
-        interoperation problems.</li>
-    </ul>
-  </li>
-  <li>Several types of notification message may be sent by either side during
-    either phase, or later. FreeS/WAN does not currently support these, but
-    they are a likely addition in future releases.</li>
-  <li>There is a commit flag which may optionally be set on some messages.
-    The <a href="http://www.lounge.org/ike_doi_errata.html">errata</a> page
-    for the RFCs includes two changes related to this, one to clarify the
-    description of its use and one to block a <a
-    href="glossary.html#DOS">denial of service</a> attack which uses it. We
-    currently do not implement this feature.</li>
-</ul>
-
-<p>These complications can of course lead to problems, particularly when two
-different implementations attempt to interoperate. For example, we have seen
-problems such as:</p>
-<ul>
-  <li>Some implementations (often products crippled by <a
-    href="politics.html#exlaw">export laws</a>) have the insecure DES
-    algorithm as their only supported encryption method. Other parts of our
-    documentation discuss the <a
-    href="politics.html#desnotsecure">reasons we do not implement single
-    DES</a>, and <a href="interop.html#noDES">how to cope with crippled
-    products</a>.</li>
-  <li>Windows 2000 IPsec tries to negotiate using Aggressive Mode, which we
-    don't support. Later on, it uses the commit bit, which we also don't
-    support.</li>
-  <li>Various implementations disable PFS by default, and therefore will not
-    talk to FreeS/WAN until you either turn on PFS on their end or turn it
-    off in FreeS/WAN with a <var>pfs=no</var> entry in the connection
-    description.</li>
-  <li>FreeS/WAN's interaction with PGPnet is complicated by their use of
-    notification messages we do not yet support.</li>
-</ul>
-
-<p>Despite this, we do interoperate successfully with many implementations,
-including both Windows 2000 and PGPnet. Details are in our <a
-href="interop.html">interoperability</a> document.</p>
-
-<h4><a name="sequence">Sequence of messages in IKE</a></h4>
-
-<p>Each phase (see <a href="#phases">previous section</a>)of IKE involves a
-series of messages. In Pluto error messages, these are abbreviated using:</p>
-<dl>
-  <dt>M</dt>
-    <dd><strong>M</strong>ain mode, settting up the keying channel (ISAKMP
-    SA)</dd>
-  <dt>Q</dt>
-    <dd><strong>Q</strong>uick mode, setting up the data channel (IPsec
-    SA)</dd>
-  <dt>I</dt>
-    <dd><strong>I</strong>nitiator, the machine that starts the
-    negotiation</dd>
-  <dt>R</dt>
-    <dd><strong>R</strong>esponder</dd>
-</dl>
-
-<p>For example, the six messages of a main mode negotiation, in sequence, are
-labelled:</p>
-<pre>       MI1 ----------&gt;
-           &lt;---------- MR1
-       MI2 ----------&gt; 
-           &lt;---------- MR2
-       MI3 ----------&gt;
-           &lt;---------- MR3</pre>
-
-<h4><a name="struct.exchange">Structure of IKE messages</a></h4>
-
-<p>Here is our Pluto developer explaining some of this on the mailing
-list:</p>
-<pre>When one IKE system (for example, Pluto) is negotiating with another
-to create an SA, the Initiator proposes a bunch of choices and the
-Responder replies with one that it has selected.
-
-The structure of the choices is fairly complicated.  An SA payload
-contains a list of lists of "Proposals".  The outer list is a set of
-choices: the selection must be from one element of this list.
-
-Each of these elements is a list of Proposals.  A selection must be
-made from each of the elements of the inner list.  In other words,
-*all* of them apply (that is how, for example, both AH and ESP can
-apply at once).
-
-Within each of these Proposals is a list of Transforms.  For each
-Proposal selected, one Transform must be selected (in other words,
-each Proposal provides a choice of Transforms).
-
-Each Transform is made up of a list of Attributes describing, well,
-attributes.  Such as lifetime of the SA.  Such as algorithm to be
-used.  All the Attributes apply to a Transform.
-
-You will have noticed a pattern here: layers alternate between being
-disjunctions ("or") and conjunctions ("and").
-
-For Phase 1 / Main Mode (negotiating an ISAKMP SA), this structure is
-cut back.  There must be exactly one Proposal.  So this degenerates to
-a list of Transforms, one of which must be chosen.</pre>
-
-<h3><a name="services">IPsec Services, AH and ESP</a></h3>
-
-<p>IPsec offers two services, <a
-href="glossary.html#authentication">authentication</a> and <a
-href="glossary.html#encryption">encryption</a>. These can be used separately
-but are often used together.</p>
-<dl>
-  <dt>Authentication</dt>
-    <dd>Packet-level authentication allows you to be confident that a packet
-      came from a particular machine and that its contents were not altered
-      en route to you. No attempt is made to conceal or protect the contents,
-      only to assure their integrity. Packet authentication can be provided
-      separately using an <a href="glossary.html#AH">Authentication
-      Header</a>, described just below, or it can be included as part of the
-      <a href="glossary.html#ESP">ESP</a> (Encapsulated Security Payload)
-      service, described in the following section. That service offers
-      encryption as well as authentication. In either case, the <a
-      href="glossary.html#HMAC">HMAC</a> construct is used as the
-      authentication mechanism.
-      <p>There is a separate authentication operation at the IKE level, in
-      which each gateway authenticates the other. This can be done in a
-      variety of ways.</p>
-    </dd>
-  <dt>Encryption</dt>
-    <dd>Encryption allows you to conceal the contents of a message from
-      eavesdroppers.
-      <p>In IPsec this is done using a <a href="glossary.html#block">block
-      cipher</a> (normally <a href="glossary.html#3DES">Triple DES</a> for
-      Linux). In the most used setup, keys are automatically negotiated, and
-      periodically re-negotiated, using the <a
-      href="glossary.html#IKE">IKE</a> (Internet Key Exchange) protocol. In
-      Linux FreeS/WAN this is handled by the Pluto Daemon.</p>
-      <p>The IPsec protocol offering encryption is <a
-      href="glossary.html#ESP">ESP</a>, Encapsulated Security Payload. It can
-      also include a packet authentication service.</p>
-    </dd>
-</dl>
-
-<p>Note that <strong>encryption should always be used with some packet
-authentication service</strong>. Unauthenticated encryption is vulnerable to
-<a href="glossary.html#middle">man-in-the-middle attacks</a>. Also note that
-encryption does not prevent <a href="glossary.html#traffic">traffic
-analysis</a>.</p>
-
-<h3><a name="AH.ipsec">The Authentication Header (AH)</a></h3>
-
-<p>Packet authentication can be provided separately from encryption by adding
-an authentication header (AH) after the IP header but before the other
-headers on the packet. This is the subject of this section. Details are in
-RFC 2402.</p>
-
-<p>Each of the several headers on a packet header contains a "next protocol"
-field telling the system what header to look for next. IP headers generally
-have either TCP or UDP in this field. When IPsec authentication is used, the
-packet IP header has AH in this field, saying that an Authentication Header
-comes next. The AH header then has the next header type -- usually TCP, UDP
-or encapsulated IP.</p>
-
-<p>IPsec packet authentication can be added in transport mode, as a
-modification of standard IP transport. This is shown in this diagram from the
-RFC:</p>
-<pre>                  BEFORE APPLYING AH
-            ----------------------------
-      IPv4  |orig IP hdr  |     |      |
-            |(any options)| TCP | Data |
-            ----------------------------
-
-                  AFTER APPLYING AH
-            ---------------------------------
-      IPv4  |orig IP hdr  |    |     |      |
-            |(any options)| AH | TCP | Data |
-            ---------------------------------
-            ||
-                 except for mutable fields</pre>
-
-<p>Athentication can also be used in tunnel mode, encapsulating the
-underlying IP packet beneath AH and an additional IP header.</p>
-<pre>                         ||
-IPv4  | new IP hdr* |    | orig IP hdr*  |    |      |
-      |(any options)| AH | (any options) |TCP | Data |
-      ------------------------------------------------
-      ||
-      |           in the new IP hdr                  |</pre>
-
-<p>This would normally be used in a gateway-to-gateway tunnel. The receiving
-gateway then strips the outer IP header and the AH header and forwards the
-inner IP packet.</p>
-
-<p>The mutable fields referred to are things like the time-to-live field in
-the IP header. These cannot be included in authentication calculations
-because they change as the packet travels.</p>
-
-<h4><a name="keyed">Keyed MD5 and Keyed SHA</a></h4>
-
-<p>The actual authentication data in the header is typically 96 bits and
-depends both on a secret shared between sender and receiver and on every byte
-of the data being authenticated. The technique used is <a
-href="glossary.html#HMAC">HMAC</a>, defined in RFC 2104.</p>
-
-<p>The algorithms involved are the <a href="glossary.html#MD5">MD5</a>
-Message Digest Algorithm or <a href="glossary.html#SHA">SHA</a>, the Secure
-Hash Algorithm. For details on their use in this application, see RFCs 2403
-and 2404 respectively.</p>
-
-<p>For descriptions of the algorithms themselves, see RFC 1321 for MD5 and <a
-href="glossary.html#FIPS">FIPS</a> (Federal Information Processing Standard)
-number 186 from <a href="glossary.html#NIST">NIST</a>, the US National
-Institute of Standards and Technology for SHA. <a
-href="biblio.html#schneier"><cite>Applied Cryptography</cite></a> covers both
-in some detail, MD5 starting on page 436 and SHA on 442.</p>
-
-<p>These algorithms are intended to make it nearly impossible for anyone to
-alter the authenticated data in transit. The sender calculates a digest or
-hash value from that data and includes the result in the authentication
-header. The recipient does the same calculation and compares results. For
-unchanged data, the results will be identical. The hash algorithms are
-designed to make it extremely difficult to change the data in any way and
-still get the correct hash.</p>
-
-<p>Since the shared secret key is also used in both calculations, an
-interceptor cannot simply alter the authenticated data and change the hash
-value to match. Without the key, he or she (or even the dreaded They) cannot
-produce a usable hash.</p>
-
-<h4><a name="sequence">Sequence numbers</a></h4>
-
-<p>The authentication header includes a sequence number field which the
-sender is required to increment for each packet. The receiver can ignore it
-or use it to check that packets are indeed arriving in the expected
-sequence.</p>
-
-<p>This provides partial protection against <a
-href="glossary.html#replay">replay attacks</a> in which an attacker resends
-intercepted packets in an effort to confuse or subvert the receiver. Complete
-protection is not possible since it is necessary to handle legitmate packets
-which are lost, duplicated, or delivered out of order, but use of sequence
-numbers makes the attack much more difficult.</p>
-
-<p>The RFCs require that sequence numbers never cycle, that a new key always
-be negotiated before the sequence number reaches 2^32-1. This protects both
-against replays attacks using packets from a previous cyclce and against <a
-href="glossary.html#birthday">birthday attacks</a> on the the packet
-authentication algorithm.</p>
-
-<p>In Linux FreeS/WAN, the sequence number is ignored for manually keyed
-connections and checked for automatically keyed ones. In manual mode, there
-is no way to negotiate a new key, or to recover from a sequence number
-problem, so we don't use sequence numbers.</p>
-
-<h3><a name="ESP.ipsec">Encapsulated Security Payload (ESP)</a></h3>
-
-<p>The ESP protocol is defined in RFC 2406. It provides one or both of
-encryption and packet authentication. It may be used with or without AH
-packet authentication.</p>
-
-<p>Note that <strong>some form of packet authentication should
-<em>always</em> be used whenever data is encrypted</strong>. Without
-authentication, the encryption is vulnerable to active attacks which may
-allow an enemy to break the encryption. ESP should <strong>always</strong>
-either include its own authentication or be used with AH authentication.</p>
-
-<p>The RFCs require support for only two mandatory encryption algorithms --
-<a href="glossary.html#DES">DES</a>, and null encryption -- and for two
-authentication methods -- keyed MD5 and keyed SHA. Implementers may choose to
-support additional algorithms in either category.</p>
-
-<p>The authentication algorithms are the same ones used in the IPsec <a
-href="#AH">authentication header</a>.</p>
-
-<p>We do not implement single DES since <a
-href="politics.html#desnotsecure">DES is insecure</a>. Instead we provide <a
-href="glossary.html#3DES">triple DES or 3DES</a>. This is currently the only
-encryption algorithm supported.</p>
-
-<p>We do not implement null encryption since it is obviously insecure.</p>
-
-<h2><a name="modes">IPsec modes</a></h2>
-
-<p>IPsec can connect in two modes. Transport mode is a host-to-host
-connection involving only two machines. In tunnel mode, the IPsec machines
-act as gateways and trafiic for any number of client machines may be
-carried.</p>
-
-<h3><a name="tunnel.ipsec">Tunnel mode</a></h3>
-
-<p>Security gateways are required to support tunnel mode connections. In this
-mode the gateways provide tunnels for use by client machines behind the
-gateways. The client machines need not do any IPsec processing; all they have
-to do is route things to gateways.</p>
-
-<h3><a name="transport.ipsec">Transport mode</a></h3>
-
-<p>Host machines (as opposed to security gateways) with IPsec implementations
-must also support transport mode. In this mode, the host does its own IPsec
-processing and routes some packets via IPsec.</p>
-
-<h2><a name="parts">FreeS/WAN parts</a></h2>
-
-<h3><a name="KLIPS.ipsec">KLIPS: Kernel IPsec Support</a></h3>
-
-<p>KLIPS is <strong>K</strong>erne<strong>L</strong> <strong>IP</strong>SEC
-<strong>S</strong>upport, the modifications necessary to support IPsec within
-the Linux kernel. KILPS does all the actual IPsec packet-handling,
-including</p>
-<ul>
-  <li>encryption</li>
-  <li>packet authentication calculations</li>
-  <li>creation of ESP and AH headers for outgoing packets</li>
-  <li>interpretation of those headers on incoming packets</li>
-</ul>
-
-<p>KLIPS also checks all non-IPsec packets to ensure they are not bypassing
-IPsec security policies.</p>
-
-<h3><a name="Pluto.ipsec">The Pluto daemon</a></h3>
-
-<p><a href="manpage.d/ipsec_pluto.8.html">Pluto(8)</a> is a daemon which
-implements the IKE protocol. It</p>
-<ul>
-  <li>handles all the Phase one ISAKMP SAs</li>
-  <li>performs host authentication and negotiates with other gateways</li>
-  <li>creates IPsec SAs and passes the data required to run them to KLIPS</li>
-  <li>adjust routing and firewall setup to meet IPsec requirements. See our
-    <a href="firewall.html">IPsec and firewalling</a> document for
-  details.</li>
-</ul>
-
-<p>Pluto is controlled mainly by the <a
-href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> configuration file.</p>
-
-<h3><a name="command">The ipsec(8) command</a></h3>
-
-<p>The <a href="manpage.d/ipsec.8.html">ipsec(8)</a> command is a front end
-shellscript that allows control over IPsec activity.</p>
-
-<h3><a name="ipsec.conf">Linux FreeS/WAN configuration file</a></h3>
-
-<p>The configuration file for Linux FreeS/WAN is</p>
-<pre>        /etc/ipsec.conf</pre>
-
-<p>For details see the <a
-href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> manual page .</p>
-
-<h2><a name="key">Key management</a></h2>
-
-<p>There are several ways IPsec can manage keys. Not all are implemented in
-Linux FreeS/WAN.</p>
-
-<h3><a name="current">Currently Implemented Methods</a></h3>
-
-<h4><a name="manual">Manual keying</a></h4>
-
-<p>IPsec allows keys to be manually set. In Linux FreeS/WAN, such keys are
-stored with the connection definitions in /etc/ipsec.conf.</p>
-
-<p><a href="glossary.html#manual">Manual keying</a> is useful for debugging
-since it allows you to test the <a href="glossary.html#KLIPS">KLIPS</a>
-kernel IPsec code without the <a href="glossary.html#Pluto">Pluto</a> daemon
-doing key negotiation.</p>
-
-<p>In general, however, automatic keying is preferred because it is more
-secure.</p>
-
-<h4><a name="auto">Automatic keying</a></h4>
-
-<p>In automatic keying, the <a href="glossary.html#Pluto">Pluto</a> daemon
-negotiates keys using the <a href="glossary.html#IKE">IKE</a> Internet Key
-Exchange protocol. Connections are automatically re-keyed periodically.</p>
-
-<p>This is considerably more secure than manual keying. In either case an
-attacker who acquires a key can read every message encrypted with that key,
-but automatic keys can be changed every few hours or even every few minutes
-without breaking the connection or requiring intervention by the system
-administrators. Manual keys can only be changed manually; you need to shut
-down the connection and have the two admins make changes. Moreover, they have
-to communicate the new keys securely, perhaps with <a
-href="glossary.html#PGP">PGP</a> or <a href="glossary.html#SSH">SSH</a>. This
-may be possible in some cases, but as a general solution it is expensive,
-bothersome and unreliable. Far better to let <a
-href="glossary.html#Pluto">Pluto</a> handle these chores; no doubt the
-administrators have enough to do.</p>
-
-<p>Also, automatic keying is inherently more secure against an attacker who
-manages to subvert your gateway system. If manual keying is in use and an
-adversary acquires root privilege on your gateway, he reads your keys from
-/etc/ipsec.conf and then reads all messages encrypted with those keys.</p>
-
-<p>If automatic keying is used, an adversary with the same privileges can
-read /etc/ipsec.secrets, but this does not contain any keys, only the secrets
-used to authenticate key exchanges. Having an adversary able to authenticate
-your key exchanges need not worry you overmuch. Just having the secrets does
-not give him any keys. You are still secure against <a
-href="glossary.html#passive">passive</a> attacks. This property of automatic
-keying is called <a href="glossary.html#PFS">perfect forward secrecy</a>,
-abbreviated PFS.</p>
-
-<p>Unfortunately, having the secrets does allow an <a
-href="glossary.html#active">active attack</a>, specifically a <a
-href="glossary.html#middle">man-in-the-middle</a> attack. Losing these
-secrets to an attacker may not be quite as disastrous as losing the actual
-keys, but it is <em>still a serious security breach</em>. These secrets
-should be guarded as carefully as keys.</p>
-
-<h3><a name="notyet">Methods not yet implemented</a></h3>
-
-<h4><a name="noauth">Unauthenticated key exchange</a></h4>
-
-<p>It would be possible to exchange keys without authenticating the players.
-This would support <a href="glossary.html#carpediem">opportunistic
-encryption</a> -- allowing any two systems to encrypt their communications
-without requiring a shared PKI or a previously negotiated secret -- and would
-be secure against <a href="glossary.html#passive">passive attacks</a>. It
-would, however, be highly vulnerable to active <a
-href="glossary.html#middle">man-in-the-middle</a> attacks. RFC 2408 therefore
-specifies that all <a href="glossary.html#ISAKMP">ISAKMP</a> key management
-interactions <em>must</em> be authenticated.</p>
-
-<p>There is room for debate here. Should we provide immediate security
-against <a href="glossary.html#passive">passive attacks</a> and encourage
-widespread use of encryption, at the expense of risking the more difficult <a
-href="glossary.html#active">active attacks</a>? Or should we wait until we
-can implement a solution that can both be widespread and offer security
-against active attacks?</p>
-
-<p>So far, we have chosen the second course, complying with the RFCs and
-waiting for secure DNS (see <a href="glossary.html#DNS">below</a>) so that we
-can do <a href="glossary.html#carpediem">opportunistic encryption</a>
-right.</p>
-
-<h4><a name="DNS">Key exchange using DNS</a></h4>
-
-<p>The IPsec RFCs allow key exchange based on authentication services
-provided by <a href="glossary.html#SDNS">Secure DNS</a>. Once Secure DNS
-service becomes widely available, we expect to make this the <em>primary key
-management method for Linux FreeS/WAN</em>. It is the best way we know of to
-support <a href="glossary.html#carpediem">opportunistic encryption</a>,
-allowing two systems without a common PKI or previous negotiation to secure
-their communication.</p>
-
-<p>We currently have code to acquire RSA keys from DNS but do not yet have
-code to validate Secure DNS signatures.</p>
-
-<h4><a name="PKI">Key exchange using a PKI</a></h4>
-
-<p>The IPsec RFCs allow key exchange based on authentication services
-provided by a <a href="glossary.html#PKI">PKI</a> or Public Key
-Infrastructure. With many vendors selling such products and many large
-organisations building these infrastructures, this will clearly be an
-important application of IPsec and one Linux FreeS/WAN will eventually
-support.</p>
-
-<p>On the other hand, this is not as high a priority for Linux FreeS/WAN as
-solutions based on <a href="glossary.html#SDNS">secure DNS</a>. We do not
-expect any PKI to become as universal as DNS.</p>
-
-<p>Some <a href="web.html#patch">patches</a> to handle authentication with
-X.509 certificates, which most PKIs use, are available.</p>
-
-<h4><a name="photuris">Photuris</a></h4>
-
-<p><a href="glossary.html#photuris">Photuris</a> is another key management
-protocol, an alternative to IKE and ISAKMP, described in RFCs 2522 and 2523
-which are labelled "experimental". Adding Photuris support to Linux FreeS/WAN
-might be a good project for a volunteer. The likely starting point would be
-the OpenBSD photurisd code.</p>
-
-<h4><a name="skip">SKIP</a></h4>
-
-<p><a href="glossary.html#SKIP">SKIP</a> is yet another key management
-protocol, developed by Sun. At one point it was fairly widely used, but it
-now seems moribund, displaced by IKE. Sun now (as of Solaris 8.0) ship an
-IPsec implementation using IKE. We have no plans to implement SKIP. If a user
-were to implement it, we would almost certainly not want to add the code to
-our distribution.</p>
-</body>
-</html>
diff --git a/doc/src/kernel.html b/doc/src/kernel.html
deleted file mode 100644
index a4beab417..000000000
--- a/doc/src/kernel.html
+++ /dev/null
@@ -1,392 +0,0 @@
-<html>
-<head>
-<title>Kernel configuration for FreeS/WAN</title>
-<meta name="keywords" content="Linux, IPsec, VPN, security, FreeSWAN, kernel">
-
-<!--
-
-Written by Sandy Harris for the Linux FreeS/WAN project
-Freely distributable under the GNU General Public License
-
-More information at www.freeswan.org
-Feedback to users@lists.freeswan.org
-
-CVS information:
-RCS ID:          $Id: kernel.html,v 1.1 2004/03/15 20:35:24 as Exp $
-Last changed:    $Date: 2004/03/15 20:35:24 $
-Revision number: $Revision: 1.1 $
-
-CVS revision numbers do not correspond to FreeS/WAN release numbers.
--->
-</head>
-
-<body>
-
-<h1><a name="kernelconfig">Kernel configuration for FreeS/WAN</a></h1>
-
-<p>
-This section lists many of the options available when configuring a Linux
-  kernel, and explains how they should be set on a FreeS/WAN IPsec
-  gateway.</p>
-
-  <h2><a name="notall">Not everyone needs to worry about kernel configuration</a></h2>
-
-  <p>Note that in many cases you do not need to mess with these.</p>
-
-<p>
-You may have a Linux distribution which comes with FreeS/WAN installed
-(see this <a href="intro.html#products">list</a>).
-  In that case, you need not do a FreeS/WAN installation or a kernel
-  configuration. Of course, you might still want to configure and rebuild your
-  kernel to improve performance or security. This can be done with standard
-  tools described in the <a href="http://www.linuxdoc.org/HOWTO/Kernel-HOWTO.html">Kernel HowTo</a>.</p>
-
-  <p>If you need to install FreeS/WAN, then you do need to configure a kernel.
-  However, you may choose to do that using the simplest procedure:</p>
-  <ul>
-    <li>Configure, build and test a kernel for your system before adding FreeS/WAN. See the <a
-      href="http://www.linuxdoc.org/HOWTO/Kernel-HOWTO.html">Kernel HowTo</a> for details. <strong>This step cannot be
-      skipped</strong>. FreeS/WAN needs the results of your configuration.</li>
-    <li>Then use FreeS/WAN's <var>make oldgo</var> command. This sets
-      everything FreeS/WAN needs and retains your values everywhere else.</li>
-  </ul>
-
-<p>
-This document is for those who choose to configure their FreeS/WAN kernel
-themselves.</p>
-
-<h2><a name="assume">Assumptions and notation</a></h2>
-
-<p>
-Help text for most kernel options is included with the kernel files, and
-is accessible from within the configuration utilities. We assume
-you will refer to that, and to the <a href="http://www.linuxdoc.org/HOWTO/Kernel-HOWTO.html">Kernel HowTo</a>, as
-necessary. This document covers only the FreeS/WAN-specific aspects of the
-problem.</p>
-
-<p>
-To avoid duplication, this document section does not cover settings for
-the additional IPsec-related kernel options which become available after you
-have patched your kernel with FreeS/WAN patches. There is help text for
-those available from within the configuration utility.</p>
-
-  <p>
-We assume a common configuration in which the FreeS/WAN IPsec gateway is
-also doing ipchains(8) firewalling for a local network, and possibly
-masquerading as well.</p>
-
-<p>
-Some suggestions below are labelled as appropriate for "a true paranoid".
-By this we mean they may cause inconvenience and it is not entirely clear
-  they are necessary, but they appear to be the safest choice. Not using them
-  might entail some risk. Of course one suggested mantra for security
-  administrators is: "I know I'm paranoid. I wonder if I'm paranoid
-  enough."</p>
-
-  <h3><a name="labels">Labels used</a></h3>
-
-<p>
-Six labels are used to indicate how options should be set. We mark the
-labels with [square brackets]. For two of these labels, you have no
-choice:</p>
-  <dl>
-    <dt>[required]</dt>
-      <dd>essential for FreeS/WAN operation.</dd>
-    <dt>[incompatible]</dt>
-      <dd>incompatible with FreeS/WAN.</dd>
-  </dl>
-
-  <p>those must be set correctly or FreeS/WAN will not work</p>
-
-  <p>FreeS/WAN should work with any settings of the others, though of course
-  not all combinations have been tested. We do label these in various ways,
-  but <em>these labels are only suggestions</em>.</p>
-  <dl>
-    <dt>[recommended]</dt>
-      <dd>useful on most FreeS/WAN gateways</dd>
-    <dt>[disable]</dt>
-      <dd>an unwelcome complication on a FreeS/WAN gateway.</dd>
-    <dt>[optional]</dt>
-      <dd>Your choice. We outline issues you might consider.</dd>
-    <dt>[anything]</dt>
-      <dd>This option has no direct effect on FreeS/WAN and related tools, so
-        you should be able to set it as you please.</dd>
-  </dl>
-
-<p>
-Of course complexity is an enemy in any effort to build secure systems.
-<strong>For maximum security, any feature that can reasonably be turned off
-should be</strong>. "If in doubt, leave it out."</p>
-  
-  <h2><a name="kernelopt">Kernel options for FreeS/WAN</a></h2>
-
-<p>
-Indentation is based on the nesting shown by 'make menuconfig' with a
-2.2.16 kernel for the i386 architecture.</p>
-<dl>
-    <dt><a name="maturity">Code maturity and level options</a></dt>
-      <dd>
-      <dl>
-          <dt><a name="devel">Prompt for development ...
-          code/drivers</a></dt>
-            <dd>[optional] If this is <var>no</var>, experimental drivers are
-              not shown in later menus.
-              <p>For most FreeS/WAN work, <var>no</var> is the preferred
-              setting. Using new or untested components is too risky for a
-              security gateway.</p>
-              <p>However, for some hardware (such as the author's network
-              cards) the only drivers available are marked
-              <var>new/experimental</var>. In such cases, you must enable this
-              option or your cards will not appear under &quot;network device
-              support&quot;. A true paranoid would leave this option off and
-              replace the cards.</p>
-            </dd>
-        <dt>Processor type and features</dt>
-            <dd>[anything]</dd>
-          <dt>Loadable module support</dt>
-      <dd>
-      <dl>
-          <dt>Enable loadable module support</dt>
-            <dd>[optional] A true paranoid would disable this. An attacker who
-              has root access to your machine can fairly easily install a
-              bogus module that does awful things, provided modules are
-              enabled. A common tool for attackers is a &quot;rootkit&quot;, a set
-              of tools the attacker uses once he or she has become root on your system.
-              The kit introduces assorted additional compromises so that the attacker
-              will continue to &quot;own&quot; your system despite most things you might
-              do to recovery the situation. For Linux, there is a tool called
-              <a href="http://www.sans.org/newlook/resources/IDFAQ/knark.htm">knark</a>
-              which is basically a rootkit packaged as a kernel module.
-              <p>With modules disabled, an attacker cannot install a bogus module.
-              The only way
-              he can achieve the same effects is to install a new kernel and
-              reboot. This is considerably more likely to be noticed.
-              <p>Many FreeS/WAN gateways run with modules enabled. This
-              simplifies some administrative tasks and some ipchains features
-              are available only as modules. Once an enemy has root on your
-              machine your security is nil, so arguably defenses which come
-              into play only in that situation are pointless.</p>
-              <p>
-             
-            </dd>
-          <dt>Set version information ....</dt>
-            <dd>[optional] This provides a check to prevent loading modules
-              compiled for a different kernel.</dd>
-          <dt>Kernel module loader</dt>
-            <dd>[disable] It gives little benefit on a typical FreeS/WAN gate
-              and entails some risk.</dd>
-        </dl>
-      </dd>
-    <dt>General setup</dt>
-      <dd>We list here only the options that matter for FreeS/WAN.
-        <dl>
-          <dt>Networking support</dt>
-            <dd>[required]</dd>
-          <dt>Sysctl interface</dt>
-            <dd>[optional] If this option is turned on and the
-              <var>/proc</var> filesystem installed, then you can control
-              various system behaviours by writing to files under
-              <var>/proc/sys</var>. For example:
-              <pre>        echo 1 &gt; /proc/sys/net/ipv4/ipforward</pre>
-              turns IP forwarding on.
-              <p>Disabling this option breaks many firewall scripts. A true
-              paranoid would disable it anyway since it might conceivably be
-              of use to an attacker.</p>
-            </dd>
-        </dl>
-      </dd>
-    <dt>Plug and Play support</dt>
-      <dd>[anything]</dd>
-    <dt>Block devices</dt>
-      <dd>[anything]</dd>
-    <dt>Networking options</dt>
-      <dd>
-      <dl>
-          <dt>Packet socket</dt>
-            <dd>[optional] This kernel feature supports tools such as
-              tcpdump(8) which communicate directly with network hardware,
-              bypassing kernel protocols. This is very much a two-edged sword:
-              <ul>
-                <li>such tools can be very useful to the firewall admin,
-                  especially during initial testing</li>
-                <li>should an evildoer breach your firewall, such tools could
-                  give him or her a great deal of information about the rest
-                  of your network</li>
-              </ul>
-              We recommend disabling this option on production gateways.</dd>
-          <dt><a name="netlink">Kernel/User netlink socket</a></dt>
-            <dd>[optional] Required if you want to use <a href="#adv">advanced
-              router</a> features.</dd>
-          <dt>Routing messages</dt>
-            <dd>[optional]</dd>
-          <dt>Netlink device emulation</dt>
-            <dd>[optional]</dd>
-          <dt>Network firewalls</dt>
-            <dd>[recommended] You need this if the IPsec gateway also
-              functions as a firewall.
-              <p>Even if the IPsec gateway is not your primary firewall, we
-              suggest setting this so that you can protect the gateway with at
-              least basic local packet filters.</p>
-            </dd>
-          <dt>Socket filtering</dt>
-            <dd>[disable] This enables an older filtering interface. We suggest
-                using ipchains(8) instead. To do that, set the &quot;Network
-                firewalls&quot; option just above, and not this one.</dd>
-          <dt>Unix domain sockets</dt>
-            <dd>[required] These sockets are used for communication between the
-              <a href="manpage.d/ipsec.8.html">ipsec(8)</a>
-              commands and the <a href="manpage.d/ipsec_pluto.8.html">ipsec_pluto(8)</a>
-              daemon.</dd>
-          <dt>TCP/IP networking</dt>
-            <dd>[required]
-              <dl>
-                <dt>IP: multicasting</dt>
-                  <dd>[anything]</dd>
-                <dt><a name="adv">IP: advanced router</a></dt>
-                  <dd>[optional] This gives you policy routing, which some
-                    people have used to good advantage in their scripts for
-                    FreeS/WAN gateway management. It is not used in our
-                    distributed scripts, so not required unless you want it
-                    for custom scripts. It requires the <a
-                    href="#netlink">netlink</a> interface between kernel code
-                    and the iproute2(8) command.</dd>
-                <dt>IP: kernel level autoconfiguration</dt>
-                  <dd>[disable] It gives little benefit on a typical FreeS/WAN
-                    gate and entails some risk.</dd>
-                <dt>IP: firewall packet netlink device</dt>
-                  <dd>[disable]</dd>
-                <dt>IP: transparent proxy support</dt>
-                  <dd>[optional] This is required in some firewall configurations,
-                    but should be disabled unless you have a definite need for it.
-                    </dd>
-                <dt>IP: masquerading</dt>
-                  <dd>[optional] Required if you want to use
-                    <a href="glossary.html#non-routable">non-routable</a> private
-                     IP addresses for your local network.</dd>
-                <dt>IP: Optimize as router not host</dt>
-                  <dd>[recommended]</dd>
-                <dt>IP: tunneling</dt>
-                  <dd>[required]</dd>
-                <dt>IP: GRE tunnels over IP</dt>
-                  <dd>[anything]</dd>
-                <dt>IP: aliasing support</dt>
-                  <dd>[anything]</dd>
-                <dt>IP: ARP daemon support (EXPERIMENTAL)</dt>
-                  <dd>Not required on most systems, but might prove useful on
-                    heavily-loaded gateways.</dd>
-                <dt>IP: TCP syncookie support</dt>
-                  <dd>[recommended] It provides a defense against a <a
-                    href="glossary.html#DOS">denial of
-                    service attack</a> which uses bogus TCP connection
-                    requests to waste resources on the victim machine.</dd>
-                <dt>IP: Reverse ARP</dt>
-                  <dd></dd>
-                <dt>IP: large window support</dt>
-                  <dd>[recommended] unless you have less than 16 meg RAM</dd>
-              </dl>
-            </dd>
-          <dt>IPv6</dt>
-            <dd>[optional] FreeS/WAN does not currently support IPv6, though work on
-              integrating FreeS/WAN with the Linux IPv6 stack has begun.
-              <a href="compat.html#ipv6">Details</a>.
-              <p>
-              It should be possible to use IPv4 FreeS/WAN on a machine which also
-              does IPv6. This combination is not yet well tested. We would be quite
-              interested in hearing results from anyone expermenting with it, via the
-              <a href="mail.html">mailing list</a>.
-              <p>
-              We do not recommend using IPv6 on production FreeS/WAN gateways until
-              more testing has been done.
-              </dd>
-          <dt>Novell IPX</dt>
-            <dd>[disable]</dd>
-          <dt>Appletalk</dt>
-            <dd>[disable] Quite a few Linux installations use IP but also have
-              some other protocol, such as Appletalk or IPX, for communication
-              with local desktop machines. In theory it should be possible to
-              configure IPsec for the IP side of things without interfering
-              with the second protocol.
-              <p>We do not recommend this. Keep the software on your gateway
-              as simple as possible. If you need a Linux-based Appletalk or
-              IPX server, use a separate machine.</p>
-            </dd>
-        </dl>
-      </dd>
-    <dt>Telephony support</dt>
-      <dd>[anything]</dd>
-    <dt>SCSI support</dt>
-      <dd>[anything]</dd>
-    <dt>I2O device support</dt>
-      <dd>[anything]</dd>
-    <dt>Network device support</dt>
-      <dd>[anything] should work, but there are some points to note.
-        <p>The development team test almost entirely on 10 or 100 megabit
-        Ethernet and modems. In principle, any device that can do IP should be
-        just fine for IPsec, but in the real world any device that has not
-        been well-tested is somewhat risky. By all means try it, but don't bet
-        your project on it until you have solid test results.</p>
-        <p>If you disabled experimental drivers in the <a
-        href="#maturity">Code maturity</a> section above, then those drivers
-        will not be shown here. Check that option before going off to hunt for
-        missing drivers.</p>
-        <p>If you want Linux to automatically find more than one ethernet
-        interface at boot time, you need to:</p>
-        <ul>
-          <li>compile the appropriate driver(s) into your kernel. Modules will
-            not work for this</li>
-          <li>add a line such as
-<pre>
-   append="ether=0,0,eth0 ether=0,0,eth1"
-</pre>
-            to your /etc/lilo.conf file. In some cases you may need to specify
-            parameters such as IRQ or base address. The example uses &quot;0,0&quot;
-            for these, which tells the system to search. If the search does not
-            succeed on your hardware, then you should retry with explicit parameters.
-            See the lilo.conf(5) man page for details.</li>
-          <li>run lilo(8)</li>
-        </ul>
-        Having Linux find the cards this way is not necessary, but is usually more
-        convenient than loading modules in your boot scripts.</dd>
-    <dt>Amateur radio support</dt>
-      <dd>[anything]</dd>
-    <dt>IrDA (infrared) support</dt>
-      <dd>[anything]</dd>
-    <dt>ISDN subsystem</dt>
-      <dd>[anything]</dd>
-    <dt>Old CDROM drivers</dt>
-      <dd>[anything]</dd>
-    <dt>Character devices</dt>
-      <dd>The only required character device is:
-        <dl>
-          <dt>random(4)</dt>
-            <dd>[required] This is a source of <a href="glossary.html#random">random</a>
-              numbers which are required for many cryptographic protocols,
-              including several used in IPsec.
-              <p>If you are comfortable with C source code, it is likely a
-              good idea to go in and adjust the <var>#define</var> lines in
-              <var>/usr/src/linux/drivers/char/random.c</var> to ensure that
-              all sources of randomness are enabled. Relying solely on
-              keyboard and mouse randomness is dubious procedure for a gateway
-              machine. You could also increase the randomness pool size from
-              the default 512 bytes (128 32-bit words).</p>
-            </dd>
-        </dl>
-     <dt>Filesystems</dt>
-       <dd>[anything] should work, but we suggest limiting a gateway
-         machine to the standard Linux ext2 filesystem in most
-         cases.</dd>
-     <dt>Network filesystems</dt>
-       <dd>[disable] These systems are an unnecessary risk on an IPsec
-         gateway.</dd>
-     <dt>Console drivers</dt>
-            <dd>[anything]</dd>
-     <dt>Sound</dt>
-       <dd>[anything] should work, but we suggest enabling sound only if
-              you plan to use audible alarms for firewall problems.</dd>
-     <dt>Kernel hacking</dt>
-       <dd>[disable] This might be enabled on test machines, but should
-         not be on production gateways.</dd>
-   </dl>
-  </dl>
-</body>
-</html>
diff --git a/doc/src/mail.html b/doc/src/mail.html
deleted file mode 100644
index e26f025a0..000000000
--- a/doc/src/mail.html
+++ /dev/null
@@ -1,250 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>FreeS/WAN mailing lists</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, mailing, list">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: mail.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1><a name="lists">Mailing lists and newsgroups</a></h1>
-
-<h2><a name="list.fs">Mailing lists about FreeS/WAN</a></h2>
-
-<h3><a name="projlist">The project mailing lists</a></h3>
-
-<p>The Linux FreeS/WAN project has several email lists for user support, bug
-reports and software development discussions.</p>
-
-<p>We had a single list on clinet.fi for several years (Thanks, folks!), then
-one list on freeswan.org, but now we've split into several lists:</p>
-<dl>
-  <dt><a
-  href="mailto:users-request@lists.freeswan.org?body=subscribe">users</a></dt>
-    <dd><ul>
-        <li>The general list for discussing use of the software</li>
-        <li>The place for seeking <strong>help with problems</strong> (but
-          please check the <a href="faq.html">FAQ</a> first).</li>
-        <li>Anyone can post.</li>
-      </ul>
-    </dd>
-  <dt><a
-  href="mailto:bugs-request@lists.freeswan.org?body=subscribe">bugs</a></dt>
-    <dd><ul>
-        <li>For <strong>bug reports</strong>.</li>
-        <li>If you are not certain what is going on -- could be a bug, a
-          configuration error, a network problem, ... -- please post to the
-          users list instead.</li>
-        <li>Anyone can post.</li>
-      </ul>
-    </dd>
-  <dt><a
-  href="mailto:design-request@lists.freeswan.org?body=subscribe">design</a></dt>
-    <dd><ul>
-        <li><strong>Design discussions</strong>, for people working on
-          FreeS/WAN development or others with an interest in design and
-          security issues.</li>
-        <li>It would be a good idea to read the existing design papers (see
-          this <a href="intro.html#applied">list</a>) before posting.</li>
-        <li>Anyone can post.</li>
-      </ul>
-    </dd>
-  <dt><a
-  href="mailto:announce-request@lists.freeswan.org?body=subscribe">announce</a></dt>
-    <dd><ul>
-        <li>A <strong>low-traffic</strong> list.</li>
-        <li><strong>Announcements</strong> about FreeS/WAN and related
-          software.</li>
-        <li>All posts here are also sent to the users list. You need not
-          subscribe to both.</li>
-        <li>Only the FreeS/WAN team can post.</li>
-        <li>If you have something you feel should go on this list, send it to
-          <var>announce-admin@lists.freeswan.org</var>. Unless it is obvious,
-          please include a short note explaining why we should post it.</li>
-      </ul>
-    </dd>
-  <dt><a
-  href="mailto:briefs-request@lists.freeswan.org?body=subscribe">briefs</a></dt>
-    <dd><ul>
-        <li>A <strong>low-traffic</strong> list.</li>
-        <li><strong>Weekly summaries</strong> of activity on the users
-        list.</li>
-        <li>All posts here are also sent to the users list. You need not
-          subscribe to both.</li>
-        <li>Only the FreeS/WAN team can post.</li>
-      </ul>
-    </dd>
-</dl>
-
-<p>To subscribe to any of these, you can:</p>
-<ul>
-  <li>just follow the links above</li>
-  <li>use our <a href="http://www.freeswan.org/mail.html">web
-  interface</a></li>
-  <li>send mail to <var>listname</var>-request@lists.freeswan.org with a
-    one-line message body "subscribe"</li>
-</ul>
-
-<p>Archives of these lists are available via the <a
-href="http://www.freeswan.org/mail.html">web interface</a>.</p>
-
-<h4><a name="which.list">Which list should I use?</a></h4>
-
-<p>For most questions, please check the <a href="faq.html">FAQ</a> first, and
-if that does not have an answer, ask on the users list. "My configuration
-doesn't work." does not belong on the bugs list, and "Can FreeS/WAN do
-such-and-such" or "How do I configure it to..." do not belong in design
-discussions.</p>
-
-<p>Cross-posting the same message to two or more of these lists is
-discouraged. Quite a few people read more than one list and getting multiple
-copies is annoying.</p>
-
-<h4><a name="policy.list">List policies</a></h4>
-
-<p><strong>US citizens or residents are asked not to post code to the lists,
-not even one-line bug fixes</strong>. The project cannot accept code which
-might entangle it in US <a href="politics.html#exlaw">export
-restrictions</a>.</p>
-
-<p>Non-subscribers can post to some of these lists. This is necessary;
-someone working on a gateway install who encounters a problem may not have
-access to a subscribed account.</p>
-
-<p>Some spam turns up on these lists from time to time. For discussion of why
-we do not attempt to filter it, see the <a href="faq.html#spam">FAQ</a>.
-Please do not clutter the lists with complaints about this.</p>
-
-<h3><a name="archive">Archives of the lists</a></h3>
-
-<p>Searchable archives of the old single list have existed for some time. At
-time of writing, it is not yet clear how they will change for the new
-multi-list structure.</p>
-<ul>
-  <li><a href="http://www.sandelman.ottawa.on.ca/linux-ipsec">Canada</a></li>
-  <li><a href="http://www.nexial.com">Holland</a></li>
-</ul>
-
-<p>Note that these use different search engines. Try both.</p>
-
-<p>Archives of the new lists are available via the <a
-href="http://www.freeswan.org/mail.html">web interface</a>.</p>
-
-<h2><a name="indexes">Indexes of mailing lists</a></h2>
-
-<p><a href="http://paml.net/">PAML</a> is the standard reference for
-<strong>P</strong>ublicly <strong>A</strong>ccessible
-<strong>M</strong>ailing <strong>L</strong>ists. When we last checked, it had
-over 7500 lists on an amazing variety of topics. It also has FAQ information
-and a search engine.</p>
-
-<p>There is an index of <a
-href="http://oslab.snu.ac.kr/~djshin/linux/mail-list/index.shtml">Linux
-mailing lists</a> available.</p>
-
-<p>A list of <a
-href="http://xforce.iss.net/maillists/otherlists.php">computer security
-mailing lists</a>, with descriptions.</p>
-
-<h2><a name="otherlists">Lists for related software and topics</a></h2>
-
-<p>Most links in this section point to subscription addresses for the various
-lists. Send the one-line message "subscribe <var>list_name</var>" to
-subscribe to any of them.</p>
-
-<h3>Products that include FreeS/WAN</h3>
-
-<p>Our introduction document gives a <a href="intro.html#products">list of
-products that include FreeS/WAN</a>. If you have, or are considering, one of
-those, check the supplier's web site for information on mailing lists for
-their users.</p>
-
-<h3><a name="linux.lists">Linux mailing lists</a></h3>
-<ul>
-  <li><a
-    href="mailto:majordomo@vger.kernel.org">linux-admin@vger.kernel.org</a>,
-    for Linux system administrators</li>
-  <li><a
-    href="mailto:netfilter-request@lists.samba.org">netfilter@lists.samba.org</a>,
-    about Netfilter, which replaces IPchains in kernels 2.3.15 and later</li>
-  <li><a
-    href="mailto:security-audit-request@ferret.lmh.ox.ac.uk">security-audit@ferret.lmh.ox.ac.uk</a>,
-    for people working on security audits of various Linux programs</li>
-  <li><a
-    href="mailto:securedistros-request@humbolt.geo.uu.nl">securedistros@humbolt.geo.uu.nl</a>,
-    for discussion of issues common to all the half dozen projects working on
-    secure Linux distributions.</li>
-</ul>
-
-<p>Each of the scure distribution projects also has its own web site and
-mailing list. Some of the sites are:</p>
-<ul>
-  <li><a href="http://bastille-linux.org/">Bastille Linux</a> scripts to
-    harden Redhat, e.g. by changing permissions and modifying inialisation
-    scripts</li>
-  <li><a href="http://immunix.org/">Immunix</a> take a different approach,
-    using a modified compiler to build kernel and utilities with better
-    resistance to various types of overflow and exploit</li>
-  <li>the <a href="glossary.html#NSA">NSA</a> have contractors working on a
-    <a href="glossary.html#SElinux">Security Enhanced Linux</a>, primarily
-    adding stronger access control mechanisms. You can download the current
-    version (which interestingly is under GPL and not export resrtricted) or
-    subscribe to the mailing list from the <a
-    href="http://www.nsa.gov/selinux">project web page</a>.</li>
-</ul>
-
-<h3><a name="ietf">Lists for IETF working groups</a></h3>
-
-<p>Each <a href="glossary.html#IETF">IETF</a> working group has an associated
-mailing list where much of the work takes place.</p>
-<ul>
-  <li><a
-    href="mailto:majordomo@lists.tislabs.com">ipsec@lists.tislabs.com</a>,
-    the IPsec <a
-    href="http://www.ietf.org/html.charters/ipsec-charter.html">working
-    group</a>. This is where the protocols are discussed, new drafts
-    announced, and so on. By now, the IPsec working group is winding down
-    since the work is essentially complete. A <a
-    href="http://www.sandelman.ottawa.on.ca/ipsec/">list archive</a> is
-    available.</li>
-  <li><a href="mailto:ipsec-policy-request@vpnc.org">IPsec policy</a> list,
-    and its <a href="http://www.vpnc.org/ipsec-policy/">archive</a></li>
-  <li><a href="mailto:ietf-ipsra-request@vpnc.org">IP secure remote
-    access</a> list, and its <a
-    href="http://www.vpnc.org/ietf-ipsra/mail-archive/">archive</a></li>
-</ul>
-
-<h3><a name="other">Other mailing lists</a></h3>
-<ul>
-  <li><a
-    href="mailto:ipc-announce-request@privacy.org">ipc-announce@privacy.org</a>
-    a low-traffic list with announcements of developments in privacy,
-    encryption and online civil rights</li>
-  <li>a VPN mailing list's <a
-    href="http://kubarb.phsx.ukans.edu/~tbird/vpn.html">home page</a></li>
-</ul>
-
-<h2><a name="newsgroups">Usenet newsgroups</a></h2>
-<ul>
-  <li>sci.crypt</li>
-  <li>sci.crypt.research</li>
-  <li>comp.dcom.vpn</li>
-  <li>talk.politics.crypto</li>
-</ul>
-</body>
-</html>
diff --git a/doc/src/makecheck.html b/doc/src/makecheck.html
deleted file mode 100644
index 7fa3a3bcb..000000000
--- a/doc/src/makecheck.html
+++ /dev/null
@@ -1,684 +0,0 @@
-<html>
-<head>
-<title>FreeS/WAN "make check" guide</title>
-<!-- Changed by: Michael Richardson, 02-Apr-2003 -->
-<meta name="keywords" content="Linux, IPsec, VPN, security, FreeSWAN, testing, User-Mode-Linux, UML">
-
-<!--
-
-Written by Michael Richardson for the Linux FreeS/WAN project
-Freely distributable under the GNU General Public License
-
-More information at www.freeswan.org
-Feedback to users@lists.freeswan.org
-
-$Id: makecheck.html,v 1.1 2004/03/15 20:35:24 as Exp $
-
-$Log: makecheck.html,v $
-Revision 1.1  2004/03/15 20:35:24  as
-added files from freeswan-2.04-x509-1.5.3
-
-Revision 1.25  2003/04/02 20:28:33  mcr
-	document for NETJIGVERBOSE environment variable.
-
-Revision 1.24  2003/04/02 02:17:52  mcr
-	added documentation on "PACKETRATE"
-
-Revision 1.23  2003/02/27 09:28:24  mcr
-	added documentation for *_RUN2_SCRIPT.
-
-Revision 1.22  2003/02/20 20:00:44  mcr
-	added documentation for ${host}HOST.
-
-Revision 1.21  2003/02/20 19:56:11  mcr
-	documented new umlXhost test case.
-
-Revision 1.20  2002/12/06 02:11:42  mcr
-	added new test type, module_compile.
-
-Revision 1.19  2002/12/04 03:47:06  mcr
-	added documentation of various *TESTDEBUG options in
-	the testing environment.
-
-Revision 1.18  2002/10/31 19:01:31  mcr
-	documentation for RUN_*_SCRIPT.
-
-Revision 1.17  2002/09/11 19:43:36  mcr
-	added documentation on format of TESTLIST.
-
-Revision 1.16  2002/09/11 19:26:48  mcr
-	renamed umlpluto -> umlplutotest.
-
-Revision 1.15  2002/07/29 22:27:12  mcr
-	added kernel_patch_test test type.
-
-Revision 1.14  2002/06/19 18:24:44  mcr
-	renamed SCRIPT to INIT_SCRIPT.
-
-Revision 1.13  2002/06/19 10:06:07  mcr
-	added nightly.html to the documentation tree.
-
-Revision 1.12  2002/06/19 09:19:26  mcr
-	wrote documentation for umlpluto parts of makecheck,
-	and adjusted scripts for consistency.
-
-Revision 1.11  2002/06/19 07:26:31  mcr
-	added FINAL_SCRIPT to be run after sending packets through.
-	renamed "SCRIPT" to "INIT_SCRIPT" (left compat variable)
-
-Revision 1.10  2002/06/17 05:40:57  mcr
-	Added test cases for the "make rpm" machinery.
-
-Revision 1.9  2002/06/08 17:12:49  mcr
-	added new libtest test type for use in testing libfreeswan
-
-Revision 1.8  2002/05/27 00:19:38  mcr
-	removed reference to single_netjig.png because mkhtml does not
-	grok it.
-
-Revision 1.7  2002/05/07 01:31:52  mcr
-	documented the new "mkinsttest" target type.
-
-Revision 1.6  2002/05/05 23:10:50  mcr
-	added documentation of $TEST_TYPE variable.
-
-Revision 1.5  2002/04/19 22:48:41  mcr
-	added documentation on NETJIGDEBUG and CONSOLEDIFFDEBUG.
-
-Revision 1.4  2002/04/01 23:59:46  mcr
-	added documentation on REF_{PUB,PRIV}_FILTER.
-
-Revision 1.3  2002/04/01 23:38:46  mcr
-	redo of updates to makecheck
-
-Revision 1.2  2002/03/12 21:12:07  mcr
-	initial stab at documentation on klips testing infrastructure.
-
-
--->
-</head>
-
-<body>
-
-<h1><a name="makecheck">How to configure to use "make check"</a></h1>
-
-<H2>What is "make check"</H2>
-<p>
-"make check" is a target in the top level makefile. It takes care of
-running a number of unit and system tests to confirm that FreeSWAN has 
-been compiled correctly, and that no new bugs have been introduced.
-</p>
-<p>
-As FreeSWAN contains both kernel and userspace components, doing testing
-of FreeSWAN requires that the kernel be simulated. This is typically difficult
-to do as a kernel requires that it be run on bare hardware. A technology
-has emerged that makes this simpler. This is
-<A HREF="http://user-mode-linux.sourceforge.net">User Mode Linux</A>. 
-</p>
-
-<p>
-User-Mode Linux is a way to build a Linux kernel such that it can run as a process
-under another Linux (or in the future other) kernel. Presently, this can only be
-done for 2.4 guest kernels. The host kernel can be 2.2 or 2.4. 
-</p>
-
-<p>
-"make check" expects to be able to build User-Mode Linux kernels with FreeSWAN included. 
-To do this it needs to have some files downloaded and extracted prior
-to running "make check". This is described in the
-<A HREF="umltesting.html">UML testing</A> document.  
-</p>
-
-<p>
-After having run the example in the UML testing document and
-successfully brought up the four machine combination, you are ready to 
-use "make check"
-</p>
-
-<h2>Running "make check"</h2>
-<p>
-"make check" works by walking the FreeSWAN source tree invoking the
-"check" target at each node. At present there are tests defined only
-for the <CODE>klips</CODE> directory. These tests will use the UML
-infrastructure to test out pieces of the <CODE>klips</CODE> code.
-</p>
-<p>
-The results of the tests can be recorded. If the environment variable
-<CODE>$REGRESSRESULTS</CODE> is non-null, then the results of each
-test will be recorded. This can be used as part of a nightly
-regression testing system, see
-<A HREF="nightly.html">Nightly testing</A> for more details.
-</p>
-<p>
-"make check" otherwise prints a minimal amount of output for each
-test, and indicates pass/fail status of each test as they are run.
-Failed tests do not cause failure of the target in the form of exit
-codes. 
-</p>
-
-<H1>How to write a "make check" test</H1>
-
-<h2>Structure of a test</h2>
-
-<p>
-Each test consists of a set of directories under <CODE>testing/</CODE>.
-There are directories for <CODE>klips</CODE>, <CODE>pluto</CODE>, <CODE>packaging</CODE>
-and <CODE>libraries</CODE>.
-Each directory has a list of tests to run is stored in a file called <CODE>TESTLIST</CODE> in that directory. e.g. <CODE>testing/klips/TESTLIST</CODE>.
-</P>
-
-<H2 NAME="TESTLIST">The TESTLIST</H2>
-<P>
-This isn't actually a shell script. It just looks like one. Some tools other than
-/bin/sh process it. Lines that start with # are comments. </P>
-
-<PRE>
-# test-kind     directory-containing-test       expectation     [PR#]
-</PRE>
-
-<P>The first word provides the test type, detailed below. </P>
-<P> The second word is the name of the test to run. This the directory
-in which the test case is to be found..</P>
-<P>The third word may be one of: 
-<DL>
-<DT> blank/good</DT>
-<DD>the test is believed to function, report failure</DD>
-<DT> bad</DT>
-<DD> the test is known to fail, report unexpected success</DD>
-<DT> suspended</DT>
-<DD> the test should not be run</DD>
-</DL>
-
-<P>
-The fourth word may be a number, which is a PR# if the test is
-failing.
-</P>
-
-<H2>Test kinds</H2>
-The test types are:
-
-<DL>
-<DT>skiptest</DT>
-<DD>means run no test.</DD>
-<DT>ctltest</DT>
-<DD>means run a single system without input/output.</DD>
-<DT>klipstest</DT>
-<DD>means run a single system with input/output networks</DD>
-<DT><A HREF="#umlplutotest">umlplutotest</A></DT>
-<DD>means run a pair of systems</DD>
-<DT><A HREF="#umlXhost">umlXhost</A></DT>
-<DD>run an arbitrary number of systems</DT>
-<DT>suntest (TBD)</DT>
-<DD>means run a quad of east/west/sunrise/sunset</DD>
-<DT>roadtest (TBD)</DT>
-<DD>means run a trio of east-sunrise + warrior</DD>
-<DT>extrudedtest (TBD)</DT>
-<DD>means run a quad of east-sunrise + warriorsouth + park</DD>
-<DT>mkinsttest</TD>
-<DD>a test of the "make install" machinery.</DD>
-<DT>kernel_test_patch</TD>
-<DD>a test of the "make kernelpatch" machinery.</DD>
-</DL>
-
-Tests marked (TBD) have yet to be fully defined.
-</p>
-
-<p>
-Each test directory has a file in it called <CODE>testparams.sh</CODE>.
-This file sets a number of environment variables to define the
-parameters of the test.
-</p>
-
-<H2>Common parameters</H2>
-<DL>
-<DT>TESTNAME</DT>
-<DD>the name of the test (repeated for checking purposes)</DD>
-
-<DT>TEST_TYPE</DT>
-<DD>the type of the test (repeat of type type above)</DD>
-
-<DT>TESTHOST</DT>
-<DD>the name of the UML machine to run for the test, typically "east"
-  or "west"</DD>
-
-<DT>TEST_PURPOSE</DT>
-<DD>The purpose of the test is one of: 
-
-<DL>
-<DT>goal</DT>
-<DD>The goal purpose is where a test is defined for code that is not yet
-finished. The test indicates when the goals have in fact been reached.</DD>
-<DT>regress</DT>
-<DD>This is a test to determine that a previously existing bug has been repaired. This 
-test will initially be created to reproduce the bug in isolation, and then the bug will 
-be fixed.</DD> 
-<DT>exploit</DT>
-<DD>This is a set of packets/programs that causes a vulnerability to be
-exposed. It is a specific variation of the regress option.</DD>
-</DL>
-</DD>
-
-<DT>TEST_GOAL_ITEM<DT>
-<DD>in the case of a goal test, this is a reference to the requirements document</DD>
-
-<DT>TEST_PROB_REPORT</DT>
-<DD>in the case of regression test, this the problem report number from GNATS</DD>
-
-<DT>TEST_EXPLOIT_URL</DT>
-<DD>in the case of an exploit, this is a URL referencing the paper explaining 
-the origin of the test and the origin of exploit software</DD>
-
-<DT>REF_CONSOLE_OUTPUT</DT>
-<DD>a file in the test directory that contains the sanitized console
-  output against which to compare the output of the actual test.</DD>
-<DT>REF_CONSOLE_FIXUPS</DT>
-<DD>a list of scripts (found in <CODE>klips/test/fixups</CODE>) to
-  apply to sanitize the console output of the machine under test.
-  These are typically perl, awk or sed scripts that remove things in
-  the kernel output that change each time the test is run and/or
-  compiled.
-</DD>
-<DT>INIT_SCRIPT</DT>
-<DD><p>a file of commands that is fed into the virtual machine's console
-  in single user mode prior to starting the tests. This file will
-  usually set up any eroute's and SADB entries that are required for
-  the test. </p>
-<p>Lines beginning with # are skipped. Blank lines are
-  skipped. Otherwise, a shell prompted is waited for each time
-  (consisting of <CODE>\n#</CODE>) and then the command is sent.
-  Note that the prompt is waited for before the command and not after, 
-  so completion of the last command in the script is not
-  required. This is often used to invoke a program to monitor the
-  system, e.g. <CODE>ipsec pf_key</CODE>.
-</P>
-<DT>RUN_SCRIPT</DT>
-<DD><P>a file of commands that is fed into the virtual machine's console
-      in single user mode, before the packets are sent. On single machine
-      tests, this script doesn't provide any more power than INIT_SCRIPT,
-      but is implemented for consistency's sake.</P>
-<DT>FINAL_SCRIPT</DT>
-<DD><p>a file of commands that is fed into the virtual machine's console
-  in single user mode after the final packet is sent. Similar to INIT_SCRIPT,
-  above. If not specified, then the single command "halt" is sent.
-  If specified, then the script should end with a halt command to
-  nicely shutdown the UML.
-</P>
-<DT>CONSOLEDIFFDEBUG</DT>
-<DD>If set to "true" then the series of console fixups (see REF_CONSOLE_FIXUPS) will be output after it is constructed. (It should be set to "false", or unset otherwise)</DD>
-<DT>NETJIGDEBUG</DT>
-<DD>If set to "true" then the series of console fixups (see REF_CONSOLE_FIXUPS) will be output after it is constructed. (It should be set to "false", or unset otherwise)</DD>
-<DT>NETJIGTESTDEBUG</DT>
-<DD> If set to "netjig", then the results of talking to the <CODE>uml_netjig</CODE>
-will be printed to stderr during the test. In addition, the jig will
-be invoked with --debug, which causes it to log its process ID, and
-wait 60 seconds before continuing. This can be used if you are trying
-to debug the <CODE>uml_netjig</CODE> program itself.</DT>
-<DT>HOSTTESTDEBUG</DT>
-<DD> If set to "hosttest", then the results of taling to the consoles of the UMLs will
-be printed to stderr during the test.</DT>
-<DT>NETJIGWAITUSER</DT>
-<DD> If set to "waituser", then the scripts will wait forever for user
-  input before they shut the tests down. Use this is if you are
-  debugging through the kernel.</DD>
-
-<DT>PACKETRATE</DT>
-<DD> A number, in miliseconds (default is 500ms) at which packets will
-  be replayed by the netjig.</DD>
-</DL>
-
-
-<H2>KLIPStest paramaters</H2>
-<P>
-The klipstest function starts a program
-(<CODE>testing/utils/uml_netjig/uml_netjig</CODE>) to
-setup a bunch of I/O sockets (that simulate network interfaces). It
-then exports the references to these sockets to the environment and
-invokes (using system()) a given script. It waits for the script to
-finish.
-</P>
-
-<!-- <IMG SRC="single_netjig.png" ALT="block diagram of uml_netjig"> -->
-
-<P>
-The script invoked (<CODE>testing/utils/host-test.tcl</CODE>) is a TCL
-<A HREF="http://expect.nist.gov/">expect</A> script that arranges to start the UML 
-and configure it appropriately for the test. The configuration is done 
-with the script given above for <VAR>INIT_SCRIPT</VAR>. The TCL script then forks,
-leaves the UML in the background and exits. uml_netjig continues. It then
-starts listening to the simulated network answering ARPs and inserting
-packets as appropriate.
-</P>
-
-<P>
-The klipstest function invokes <CODE>uml_netjig</CODE> with arguments
-to capture output from network interface(s) and insert packets as
-appropriate:
-<DL>
-<DT>PUB_INPUT</DT>
-<DD>a <A HREF="http://www.tcpdump.org/">pcap</A> file to feed in on
-  the public (encrypted) interface. (typically, eth1)</DD>
-<DT>PRIV_INPUT</DT>
-<DD>a pcap file to feed in on the private (plain-text) interface
-  (typically, eth0).</DD>
-<DT>REF_PUB_OUTPUT</DT>
-<DD>a text file containing tcpdump output. Packets on the public
-  (eth1) interface are captured to a
-  <A HREF="http://www.tcpdump.org/">pcap</A> file by
-  <CODE>uml_netjig</CODE>. The klipstest function then uses tcpdump on 
-  the file to produce text output, which is compared to the file given.</DD>
-<DT>REF_PUB_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further processing. Defaults to "cat".</DD>
-<DT>REF_PRIV_OUTPUT</DT>
-<DD>a text file containing tcpdump output. Packets on the private
-  (eth0) interface are captured and compared after conversion by
-  tcpdump, as with <VAR>REFPUBOUTPUT</VAR>.</DD>
-<DT>REF_PRIV_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further processing. Defaults to "cat".</DD>
-<DT>EXITONEMPTY</DT>
-<DD>a flag for <CODE>uml_netjig</CODE>. It should contain
-  "--exitonempty" of uml_netjig should exit when all of the input
-  (<VAR>PUBINPUT</VAR>,<VAR>PRIVINPUT</VAR>) packets have been injected.</DD>
-<DT>ARPREPLY</DT>
-<DD>a flag for <CODE>uml_netjig</CODE>. It should contain "--arpreply" 
-  if <CODE>uml_netjig</CODE> should reply to ARP requests. One will
-  typically set this to avoid having to fudge the ARP cache manually.</DD>
-<DT>TCPDUMPFLAGS</DT>
-<DD>a set of flags for the tcpdump used when converting captured
-  output. Typical values will include "-n" to turn off DNS, and often
-  "-E" to set the decryption key (tcpdump 3.7.1 and higher only) for
-  ESP packets. The "-t" flag (turn off timestamps) is provided automatically</DD>
-
-<DT>NETJIG_EXTRA</DT>
-<DD>additional comments to be sent to the netjig. This may arrange to
-  record or create additional networks, or may toggle options.
-</DL>
-
-<H2>mkinsttest paramaters</H2>
-<P>
-The basic concept of the <CODE>mkinsttest</CODE> test type is that it 
-performs a "make install" to a temporary $DESTDIR. The resulting tree can then
-be examined to determine if it was done properly. The files can be uninstalled
-to determine if the file list was correct, or the contents of files can be
-examined more precisely.
-</P>
-
-<DL>
-<DT>INSTALL_FLAGS</DT>
-<DD>If set, then an install will be done. This provides the set of flags to 
-provide for the install. The target to be used (usually "install") must be 
-among the flags. </DD>  
-<DT>POSTINSTALL_SCRIPT</DT>
-<DD>If set, a script to run after initial "make install". Two arguments are provided: an absolute path to the root of the FreeSWAN src tree, and an absolute path to the temporary installation area.</DD>
-<DT>INSTALL2_FLAGS</DT>
-<DD>If set, a second install will be done using these flags. Similarly to
-INSTALL_FLAGS, the target must be among the flags. </DD>
-<DT>UNINSTALL_FLAGS</DT>
-<DD>If set, an uninstall will be done using these flags. Similarly to
-INSTALL_FLAGS, the target (usually "uninstall") must be among the flags.</DD> 
-<DT>REF_FIND_f_l_OUTPUT</DT>
-<DD>If set, a <CODE>find $ROOT ( -type f -or -type -l )</CODE> will be done to get a list of a real files and symlinks. The resulting file will be compared
-to the file listed by this option.</DD>
-<DT>REF_FILE_CONTENTS</DT>
-<DD>If set, it should point to a file containing records for the form:
-<PRE>
-  <VARIABLE>reffile</VARIABLE>   <VARIABLE>samplefile</VARIABLE>
-</PRE>
-one record per line. A diff between the provided reference file, and the
-sample file (located in the temporary installation root) will be done for
-each record.
-</DD>
-</DL>
-
-<H2>rpm_build_install_test paramaters</H2>
-<P>
-The <CODE>rpm_build_install_test</CODE> type is to verify that the proper
-packing list is produced by "make rpm", and that the mechanisms for
-building the kernel modules produce consistent results.
-</P>
-
-<DL>
-<DT>RPM_KERNEL_SOURCE</DT>
-<DD>Point to an extracted copy of the RedHat kernel source code. Variables
-from the environment may be used.</DD>  
-<DT>REF_RPM_CONTENTS</DT>
-<DD>This is a file containing one record per line. Each record consists
-of a RPM name (may contain wildcards) and a filename to compare the
-contents to. The RPM will be located and a file list will be produced with
-rpm2cpio.</DD>
-</DL>
-
-<H2>libtest paramaters</H2>
-<P>
-The libtest test is for testing library routines. The library file is
-expected to provided an <CODE>#ifdef</CODE> by the name of
-<VAR>library</VAR><CODE_MAIN</CODE>. 
-The libtest type invokes the C compiler to compile this file, links it against
-<CODE>libfreeswan.a</CODE> (to resolve any other dependancies) and runs the
-test with the <CODE>-r</CODE> argument to invoke a regression test.</P>
-<P>The library test case is expected to do a self-test, exiting with status code 0 if everything is okay, and with non-zero otherwise. A core dump (exit code greater than 128) is noted specifically.
-</P>
-<P>
-Unlike other tests, there are no subdirectories required, or other
-parameters to set.  
-</P>
-
-<H2 NAME="umlplutotest">umlplutotest paramaters</H2>
-<P>
-The umlplutotest function starts a pair of user mode line processes.
-This is a 2-host version of umlXhost. The "EAST" and "WEST" slots are defined.
-</P>
-
-<H2 NAME="umlXhost">umlXhost parameters</H2>
-<P>
-The umlXtest function starts an arbitrary number of user mode line processes.
-</P>
-
-<!-- <IMG SRC="single_netjig.png" ALT="block diagram of uml_netjig"> -->
-
-<P>
-The script invoked (<CODE>testing/utils/Xhost-test.tcl</CODE>) is a TCL
-<A HREF="http://expect.nist.gov/">expect</A> script that arranges to start each
-UML   
-and configure it appropriately for the test. It then starts listening
-(using uml_netjig) to the simulated network answering ARPs and
-inserting packets as appropriate.  
-</P>
-
-<P>
-umlXtest has a series of slots, each of which should be filled by a host.
-The list of slots is controlled by the variable, XHOST_LIST. This variable
-should be set to a space seperated list of slots. The former umlplutotest
-is now implemented as a variation of the umlXhost test,
-with XHOST_LIST="EAST WEST".
-</P>
-
-<P>
-For each host slot that is defined, a series of variables should be
-filled in, defining what configuration scripts to use for that host.
-</P>
-
-<P>
-The following are used to control the console input and output to the system.
-Where the string ${host} is present, the host slot should be filled in.
-I.e. for the two host system with XHOST_LIST="EAST WEST", then the
-variables: EAST_INIT_SCRIPT and WEST_INIT_SCRIPT will exist.
-<DL>
-<DT>${host}HOST</DT>
-<DD>The name of the UML host which will fill this slot</DD>
-<DT>${host}_INIT_SCRIPT</DT>
-<DD><p>a file of commands that is fed into the virtual machine's console
-  in single user mode prior to starting the tests. This file will
-  usually set up any eroute's and SADB entries that are required for
-  the test. Similar to INIT_SCRIPT, above.</p>
-<DT>${host}_RUN_SCRIPT</DT>
-<DD><P>a file of commands that is fed into the virtual machine's console
-      in single user mode, before the packets are sent. This set of 
-      commands is run after all of the virtual machines are initialized.
-      I.e. after EAST_INIT_SCRIPT <B>AND</B> WEST_INIT_SCRIPT. This script
-      can therefore do things that require that all machines are properly
-      configured.</P>
-<DT>${host}_RUN2_SCRIPT</DT>
-<DD><P>a file of commands that is fed into the virtual machine's console
-      in single user mode, after the packets are sent. This set of 
-      commands is run before any of the virtual machines have been shut
-      down. (I.e. before EAST_FINAL_SCRIPT <B>AND</B> WEST_FINAL_SCRIPT.)
-      This script can therefore catch post-activity status reports.</P>
-<DT>${host}_FINAL_SCRIPT</DT>
-<DD><p>a file of commands that is fed into the virtual machine's console
-  in single user mode after the final packet is sent. Similar to INIT_SCRIPT,
-  above. If not specified, then the single command "halt" is sent. Note that
-  when this script is run, the other virtual machines may already have been killed.
-  If specified, then the script should end with a halt command to nicely
-  shutdown the UML. 
-</P>
-<DT>REF_${host}_CONSOLE_OUTPUT</DT>
-<DD>Similar to REF_CONSOLE_OUTPUT, above.</DT>
-</DL>
-</P>
-
-<P>Some additional flags apply to all hosts:
-<DL>
-<DT>REF_CONSOLE_FIXUPS</DT>
-<DD>a list of scripts (found in <CODE>klips/test/fixups</CODE>) to
-  apply to sanitize the console output of the machine under test.
-  These are typically perl, awk or sed scripts that remove things in
-  the kernel output that change each time the test is run and/or
-  compiled.
-</DD>
-</DL>
-</P>
-
-<P> In addition to input to the console, the networks may have input
-fed to them:
-<DL>
-<DT>EAST_INPUT/WEST_INPUT</DT>
-<DD>a <A HREF="http://www.tcpdump.org/">pcap</A> file to feed in on
-  the private network side of each network. The "EAST" and "WEST" here 
-refer to the networks, not the hosts.</DD>
-<DT>REF_PUB_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further processing. Defaults to "cat".</DD>
-<DT>REF_EAST_FILTER/REF_WEST_FILTER</DT>
-<DD>a program that will filter the TCPDUMP output to do further processing. Defaults to "cat".</DD><
-<DT>TCPDUMPFLAGS</DT>
-<DD>a set of flags for the tcpdump used when converting captured
-  output. Typical values will include "-n" to turn off DNS, and often
-  "-E" to set the decryption key (tcpdump 3.7.1 and higher only) for
-  ESP packets. The "-t" flag (turn off timestamps) is provided automatically</DD>
-<DT>REF_EAST_OUTPUT/REF_WEST_OUTPUT</DT>
-<DD>a text file containing tcpdump output. Packets on the private
-  (eth0) interface are captured and compared after conversion by
-  tcpdump, as with <VAR>REF_PUB_OUTPUT</VAR>.</DD>
-</P>
-
-<P>
-There are two additional environment variables that may be set on the
-command line:
-<DL>
-<DT> NETJIGVERBOSE=verbose export NETJIGVERBOSE</DT>
-<DD> If set, then the test output will be "chatty", and let you know what
-  commands it is running, and as packets are sent. Without it set, the
-  output is limited to success/failure messages.</DD>
-<DT> NETJIGTESTDEBUG=netjig export NETJIGTESTDEBUG</DT>
-<DD> This will enable debugging of the communication with uml_netjig,
-  and turn on debugging in this utility.
-  This does not imply NETJIGVERBOSE.</DL>
-<DT> HOSTTESTDEBUG=hosttest export HOSTTESTDEBUG</DT>
-<DD> This will show all interactions with the user-mode-linux
-  consoles</DD>
-</DL>
-</P>
-
-<H2 NAME="kernelpatch">kernel_patch_test paramaters</H2>
-<P>
-The kernel_patch_test function takes some kernel source, copies it with
-lndir, and then applies the patch as produced by "make kernelpatch".
-</P>
-<P>
-The following are used to control the input and output to the system:
-<DL>
-<DT>KERNEL_NAME</DT>
-<DD>the kernel name, typically something like "linus" or "rh"</DD>
-<DT>KERNEL_VERSION</DT>
-<DD>the kernel version number, as in "2.2" or "2.4".</DD>
-<DT>KERNEL_${KERNEL_NAME}${KERNEL_VERSION}_SRC</DT>
-<DD>This variable should set in the environment, probably in
-  ~/freeswan-regress-env.sh. Examples of this variables would be
-  KERNEL_LINUS2_0_SRC or KERNEL_RH7_3_SRC. This variable should point
-  to an extracted copy of the kernel source in question.</DD>
-<DT>REF_PATCH_OUTPUT</DT>
-<DD>a copy of the patch output to compare against</DD>
-<DT>KERNEL_PATCH_LEAVE_SOURCE</DT>
-<DD>If set to a non-empty string, then the patched kernel source is not
-  removed at the end of the test. This will typically be set in the
-  environment while debugging.</DD>
-</DL>
-</P>
-
-<H2 NAME="modtest">module_compile paramaters</H2>
-<P>
-The module_compile test attempts to build the KLIPS module against a
-given set of kernel source. This is also done by the RPM tests, but
-in a very specific manner.
-</P>
-<P>
-There are two variations of this test - one where the kernel either
-doesn't need to be configured, or is already done, and tests were there
-is a local configuration file.
-</P>
-<P>
-Where the kernel doesn't need to be configured, the kernel source that
-is found is simply used. It may be a RedHat-style kernel, where one
-can cause it to configure itself via rhconfig.h-style definitions. Or,
-it may just be a kernel tree that has been configured. 
-</P>
-<P>
-If the variable KERNEL_CONFIG_FILE is set, then a new directory is
-created for the kernel source. It is populated with lndir(1). The referenced
-file is then copied in as .config, and "make oldconfig" is used to configure
-the kernel. This resulting kernel is then used as the reference source.
-</P>
-<p>
-In all cases, the kernel source is found the same was for the kernelpatch
-test, i.e. via KERNEL_VERSION/KERNEL_NAME and KERNEL_${KERNEL_NAME}${KERNEL_VERSION}_SRC.</P>
-<P>
-Once there is kernel source, the module is compiled using the top-level
-"make module" target. 
-</P>
-<P>
-The test is considered successful if an executable is found in OUTPUT/module/ipsec.o at the end of the test.
-</P>
-<DL>
-<DT>KERNEL_NAME</DT>
-<DD>the kernel name, typically something like "linus" or "rh"</DD>
-<DT>KERNEL_VERSION</DT>
-<DD>the kernel version number, as in "2.2" or "2.4".</DD>
-<DT>KERNEL_${KERNEL_NAME}${KERNEL_VERSION}_SRC</DT>
-<DD>This variable should set in the environment, probably in
-  ~/freeswan-regress-env.sh. Examples of this variables would be
-  KERNEL_LINUS2_0_SRC or KERNEL_RH7_3_SRC. This variable should point
-  to an extracted copy of the kernel source in question.</DD>
-<DT>KERNEL_CONFIG_FILE</DT>
-<DD>The configuration file for the kernel.</DD>
-<DT>KERNEL_PATCH_LEAVE_SOURCE</DT>
-<DD>If set to a non-empty string, then the configured kernel source is not
-  removed at the end of the test. This will typically be set in the
-  environment while debugging.</DD>
-<DT>MODULE_DEF_INCLUDE</DT>
-<DD>The include file that will be used to configure the KLIPS module, and
-  possibly the kernel source. </DD>
-</DL>
-
-<H1>Current pitfalls</H1>
-
-<DL>
-<DT> "tcpdump dissector" not available. </DT>
-<DD> This is a non-fatal warning. If uml_netjig is invoked with the -t 
-  option, then it will attempt to use tcpdump's dissector to decode
-  each packet that it processes. The dissector is presently not
-  available, so this option it normally turned off at compile time.
-  The dissector library will be released with tcpdump version
-  4.0.</DD>
-</DL>
-
-</body>
-</html>
\ No newline at end of file
diff --git a/doc/src/manpages.html b/doc/src/manpages.html
deleted file mode 100644
index 27a9aa7b3..000000000
--- a/doc/src/manpages.html
+++ /dev/null
@@ -1,155 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>FreeS/WAN man pages</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, manpage, manual, page">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: manpages.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1><a name="manpages">FreeS/WAN manual pages</a></h1>
-
-<p>The various components of Linux FreeS/WAN are of course documented in
-standard Unix manual pages, accessible via the man(1) command.</p>
-
-<p>Links here take you to an HTML version of the man pages.</p>
-
-<h2><a name="man.file">Files</a></h2>
-<dl>
-  <dt><a href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a></dt>
-    <dd>IPsec configuration and connections</dd>
-  <dt><a href="manpage.d/ipsec.secrets.5.html">ipsec.secrets(5)</a></dt>
-    <dd>secrets for IKE authentication, either pre-shared keys or RSA private
-      keys</dd>
-</dl>
-
-<p>These files are also discussed in the <a
-href="config.html">configuration</a> section.</p>
-
-<h2><a name="man.command">Commands</a></h2>
-
-<p>Many users will never give most of the FreeS/WAN commands directly.
-Configure the files listed above correctly and everything should be
-automatic.</p>
-
-<p>The exceptions are commands for mainpulating the <a
-href="glossary.html#RSA">RSA</a> keys used in Pluto authentication:</p>
-<dl>
-  <dt><a href="manpage.d/ipsec_rsasigkey.8.html">ipsec_rsasigkey(8)</a></dt>
-    <dd>generate keys</dd>
-  <dt><a href="manpage.d/ipsec_newhostkey.8.html">ipsec_newhostkey(8)</a></dt>
-    <dd>generate keys in a convenient format</dd>
-  <dt><a
-  href="manpage.d/ipsec_showhostkey.8.html">ipsec_showhostkey(8)</a></dt>
-    <dd>extract <a href="glossary.html#RSA">RSA</a> keys from <a
-      href="manpage.d/ipsec.secrets.5.html">ipsec.secrets(5)</a> (or
-      optionally, another file) and format them for insertion in <a
-      href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a> or in DNS
-    records</dd>
-</dl>
-
-<p>Note that:</p>
-<ul>
-  <li>These keys are for <strong>authentication only</strong>. They are
-    <strong>not secure for encryption</strong>.</li>
-  <li>The utility uses random(4) as a source of <a
-    href="glossary.html#random">random numbers</a>. This may block for some
-    time if there is not enough activity on the machine to provide the
-    required entropy. You may want to give it some bogus activity such as
-    random mouse movements or some command such as <nobr><tt>du /usr &gt; /dev/null
-    &amp;</tt></nobr>.</li>
-</ul>
-
-<p>The following commands are fairly likely to be used, if only for testing
-and status checks:</p>
-<dl>
-  <dt><a href="manpage.d/ipsec.8.html">ipsec(8)</a></dt>
-    <dd>invoke IPsec utilities</dd>
-  <dt><a href="manpage.d/ipsec_setup.8.html">ipsec_setup(8)</a></dt>
-    <dd>control IPsec subsystem</dd>
-  <dt><a href="manpage.d/ipsec_auto.8.html">ipsec_auto(8)</a></dt>
-    <dd>control automatically-keyed IPsec connections</dd>
-  <dt><a href="manpage.d/ipsec_manual.8.html">ipsec_manual(8)</a></dt>
-    <dd>take manually-keyed IPsec connections up and down</dd>
-  <dt><a href="manpage.d/ipsec_ranbits.8.html">ipsec_ranbits(8)</a></dt>
-    <dd>generate random bits in ASCII form</dd>
-  <dt><a href="manpage.d/ipsec_look.8.html">ipsec_look(8)</a></dt>
-    <dd>show minimal debugging information</dd>
-  <dt><a href="manpage.d/ipsec_barf.8.html">ipsec_barf(8)</a></dt>
-    <dd>spew out collected IPsec debugging information</dd>
-</dl>
-
-<p>The lower-level utilities listed below are normally invoked via scripts
-listed above, but they can also be used directly when required.</p>
-<dl>
-  <dt><a href="manpage.d/ipsec_eroute.8.html">ipsec_eroute(8)</a></dt>
-    <dd>manipulate IPsec extended routing tables</dd>
-  <dt><a href="manpage.d/ipsec_klipsdebug.8.html">ipsec_klipsdebug(8)</a></dt>
-    <dd>set Klips (kernel IPsec support) debug features and level</dd>
-  <dt><a href="manpage.d/ipsec_pluto.8.html">ipsec_pluto(8)</a></dt>
-    <dd>IPsec IKE keying daemon</dd>
-  <dt><a href="manpage.d/ipsec_spi.8.html">ipsec_spi(8)</a></dt>
-    <dd>manage IPsec Security Associations</dd>
-  <dt><a href="manpage.d/ipsec_spigrp.8.html">ipsec_spigrp(8)</a></dt>
-    <dd>group/ungroup IPsec Security Associations</dd>
-  <dt><a href="manpage.d/ipsec_tncfg.8.html">ipsec_tncfg(8)</a></dt>
-    <dd>associate IPsec virtual interface with real interface</dd>
-  <dt><a href="manpage.d/ipsec_whack.8.html">ipsec_whack(8)</a></dt>
-    <dd>control interface for IPsec keying daemon</dd>
-</dl>
-
-<h2><a name="man.lib">Library routines</a></h2>
-<dl>
-  <dt><a href="manpage.d/ipsec_atoaddr.3.html">ipsec_atoaddr(3)</a></dt>
-  <dt><a href="manpage.d/ipsec_addrtoa.3.html">ipsec_addrtoa(3)</a></dt>
-    <dd>convert Internet addresses to and from ASCII</dd>
-  <dt><a href="manpage.d/ipsec_atosubnet.3.html">ipsec_atosubnet(3)</a></dt>
-  <dt><a href="manpage.d/ipsec_subnettoa.3.html">ipsec_subnettoa(3)</a></dt>
-    <dd>convert subnet/mask ASCII form to and from addresses</dd>
-  <dt><a href="manpage.d/ipsec_atoasr.3.html">ipsec_atoasr(3)</a></dt>
-    <dd>convert ASCII to Internet address, subnet, or range</dd>
-  <dt><a href="manpage.d/ipsec_rangetoa.3.html">ipsec_rangetoa(3)</a></dt>
-    <dd>convert Internet address range to ASCII</dd>
-  <dt>ipsec_atodata(3)</dt>
-  <dt><a href="manpage.d/ipsec_datatoa.3.html">ipsec_datatoa(3)</a></dt>
-    <dd>convert binary data from and to ASCII formats</dd>
-  <dt><a href="manpage.d/ipsec_atosa.3.html">ipsec_atosa(3)</a></dt>
-  <dt><a href="manpage.d/ipsec_satoa.3.html">ipsec_satoa(3)</a></dt>
-    <dd>convert IPsec Security Association IDs to and from ASCII</dd>
-  <dt><a href="manpage.d/ipsec_atoul.3.html">ipsec_atoul(3)</a></dt>
-  <dt><a href="manpage.d/ipsec_ultoa.3.html">ipsec_ultoa(3)</a></dt>
-    <dd>convert unsigned-long numbers to and from ASCII</dd>
-  <dt><a href="manpage.d/ipsec_goodmask.3.html">ipsec_goodmask(3)</a></dt>
-    <dd>is this Internet subnet mask a valid one?</dd>
-  <dt><a href="manpage.d/ipsec_masktobits.3.html">ipsec_masktobits(3)</a></dt>
-    <dd>convert Internet subnet mask to bit count</dd>
-  <dt><a href="manpage.d/ipsec_bitstomask.3.html">ipsec_bitstomask(3)</a></dt>
-    <dd>convert bit count to Internet subnet mask</dd>
-  <dt><a
-  href="manpage.d/ipsec_optionsfrom.3.html">ipsec_optionsfrom(3)</a></dt>
-    <dd>read additional ``command-line'' options from file</dd>
-  <dt><a href="manpage.d/ipsec_subnetof.3.html">ipsec_subnetof(3)</a></dt>
-    <dd>given Internet address and subnet mask, return subnet number</dd>
-  <dt><a href="manpage.d/ipsec_hostof.3.html">ipsec_hostof(3)</a></dt>
-    <dd>given Internet address and subnet mask, return host part</dd>
-  <dt><a
-  href="manpage.d/ipsec_broadcastof.3.html">ipsec_broadcastof(3)</a></dt>
-    <dd>given Internet address and subnet mask, return broadcast address</dd>
-</dl>
-</body>
-</html>
diff --git a/doc/src/nightly.html b/doc/src/nightly.html
deleted file mode 100644
index d86037884..000000000
--- a/doc/src/nightly.html
+++ /dev/null
@@ -1,164 +0,0 @@
-<html>
-<head>
-<title>FreeS/WAN nightly testing guide</title>
-<!-- Changed by: Michael Richardson, 23-Jul-2002 -->
-<meta name="keywords" content="Linux, IPsec, VPN, security, FreeSWAN, testing, User-Mode-Linux, UML">
-
-<!--
-
-Written by Michael Richardson for the Linux FreeS/WAN project
-Freely distributable under the GNU General Public License
-
-More information at www.freeswan.org
-Feedback to users@lists.freeswan.org
-
-$Id: nightly.html,v 1.1 2004/03/15 20:35:24 as Exp $
-
-$Log: nightly.html,v $
-Revision 1.1  2004/03/15 20:35:24  as
-added files from freeswan-2.04-x509-1.5.3
-
-Revision 1.3  2002/07/23 18:42:16  mcr
-	added instructions on setup of nightly build.
-
-Revision 1.2  2002/06/19 10:06:07  mcr
-	added nightly.html to the documentation tree.
-
-Revision 1.1  2002/05/24 03:33:30  mcr
-	start at document on nightly regression testing.
-
-
--->
-</head>
-
-<body>
-
-<h1><a name="nightly">Nightly regression testing</a></h1>
-
-<p>
-The nightly regression testing system consists of several shell scripts
-and some perl scripts. The goal is to check out a fresh tree, run "make check" on it,
-record the results and summarize the results to the team and to the web site.
-</p>
-
-<P>
-Output can be found on <A HREF="http://bugs.freeswan.org:81/">adams</A>,
-although the tests are actually run on another project machine.</P>
-
-<H1><A name="nightlyhowto">How to setup the nightly build</A></h1>
-
-<P>
-The best way to do nightly testing is to setup a new account. We call the
-account "build" - you could call it something else, but there may
-still be some references to ~build in the scripts.
-</P>
-
-<H2> Files you need to know about </H2>
-<P>
-As few files as possible need to be extracted from the source tree -
-files are run from the source tree whenever possible. However, there
-are some bootstrap and configuration files that are necessary.
-</P>
-
-<P>
-There are 7 files in testing/utils that are involved:
-<DL>
-<DT> nightly-sample.sh </DT>
-<DD> This is the root of the build process. This file should be copied out
-of the CVS tree, to $HOME/bin/nightly.sh of the build account. This
-file should be invoked from cron. </DD>
-<DT> freeswan-regress-env-sample.sh </DT>
-<DD> This file should be copied to $HOME/freeswan-regress-env.sh. It
-  should be edited to localize the values. See below.</DD>
-<DT> regress-cleanup.pl </DT>
-<DD> This file needs to be copied to $HOME/bin/regress-cleanup.pl. It
-  is invoked by the nightly file before doing anything else. It
-  removes previous nights builds in order to free up disk space for
-  the build about to be done.</DD>
-<DT> teammail-sample.sh </DT>
-<DD> A script used to send results email to the "team". This sample
-  script could be copied to $HOME/bin/teammail.sh. This version will
-  PGP encrypt all the output to the team members. If this script is used,
-  then PGP will have to be properly setup to have the right keys.</DD>
-<DT> regress-nightly.sh </DT>
-<DD> This is the first stage of the nightly build. This stage will
-  call other scripts as appropriate, and will extract the source code
-  from CVS. This script should be copied to $HOME/bin/regress-nightly.sh</DD>
-<DT> regress-stage2.sh </DT>
-<DD> This is the second stage of the nightly build. It is called in
-  place. It essentially sets up the UML setup in umlsetup.sh, and
-  calls "make check".</DD>
-<DT> regress-summarize-results.pl
-<DD> This script will summarize the results from the tests to a
-  permanent directory set by $REGRESSRESULTS. It is invoked from the
-  stage2 nightly script.
-<DT> regress-chart.sh </DT>
-<DD> This script is called at the end of the build process, and will
-  summarize each night's results (as saved into $REGRESSRESULTS by
-  regress-summarize-results.pl) as a chart using gnuplot. Note that
-  this requires at least gnuplot 3.7.2.</DD>
-</DL>
-
-<H2>Configuring freeswan-regress-env.sh</H2>
-
-<P>For more info on KERNPOOL, UMLPATCH, BASICROOT and SHAREDIR, see
-  <A HREF="umltesting.html">User-Mode-Linux testing guide</A>.
-</P>
-
-<DL>
-<DT> KERNPOOL </DT>
-<DD> Extract copy of some kernel source to be used for UML builds</DD>
-<DT> UMLPATCH </DT>
-<DD> matching User-Mode-Linux patch.</DD>
-<DT> BASICROOT</DT>
-<DD> the root file system image (see
-  <A HREF="umltesting.html">User-Mode-Linux testing guide</A>).</DD>
-<DT> SHAREDIR=${BASICROOT}/usr/share</DT>
-<DD> The /usr/share to use.</DD>
-<DT> REGRESSTREE</DT>
-<DD> A directory in which to store the nightly regression
-  results. Directories will be created by date in this tree.</DD>
-
-<DT> TCPDUMP=tcpdump-3.7.1</DT>
-<DD> The path to the <A HREF="http://www.tcpdump.org/">tcpdump</A>
-  to use. This must have crypto compiled in, and must be at least 3.7.1</DT>
-
-<DT> KERNEL_RH7_2_SRC=/a3/kernel_sources/linux-2.4.9-13/</DT>
-<DD> An extracted copy of the RedHat 7.2. kernel source. If set, then
-  the packaging/rpm-rh72-install-01 test will be run, and an RPM will
-  be built as a test.</DD>
-  
-<DT> KERNEL_RH7_3_SRC=/a3/kernel_sources/rh/linux-2.4.18-5</DT>
-<DD> An extracted copy of the RedHat 7.3. kernel source. If set, then
-  the packaging/rpm-rh73-install-01 test will be run, and an RPM will
-  be built as a test.</DD>
-  
-<DT> NIGHTLY_WATCHERS="userid,userid,userid"</DT>
-<DD> The list of people who should receive nightly output. This is
-  used by teammail.sh</DD>
-
-<DT> FAILLINES=128</DT>
-<DD> How many lines of failed test output to include in the nightly
-  output</DD>
-
-<DT> PATH=$PATH:/sandel/bin export PATH</DT>
-<DD> You can also override the path if necessary here.</DD>
-
-<DT> CVSROOT=:pserver:anoncvs@ip212.xs4net.freeswan.org:/freeswan/MASTER</DT>
-<DD> The CVSROOT to use. This example may work for anonymous CVS, but
-  will be 12 hours behind the primary, and is still experimental</DD>
-
-<DT> SNAPSHOTSIGDIR=$HOME/snapshot-sig</DT>
-<DD> For the release tools, where to put the generated per-snapshot
-  signature keys</DD>
-
-<DT> LASTREL=1.97</DT>
-<DD> the name of the last release branch (to find the right
-  per-snapshot signature</DT>
-
-<DD>
-
-</DL>
-
-</body>
-</html>
\ No newline at end of file
diff --git a/doc/src/performance.html b/doc/src/performance.html
deleted file mode 100755
index 9d90acc62..000000000
--- a/doc/src/performance.html
+++ /dev/null
@@ -1,576 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>FreeS/WAN performance</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, performance, benchmark">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: performance.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1><a name="performance">Performance of FreeS/WAN</a></h1>
-The performance of FreeS/WAN is adequate for most applications.
-
-<p>In normal operation, the main concern is the overhead for encryption,
-decryption and authentication of the actual IPsec (<a
-href="glossary.html#ESP">ESP</a> and/or <a href="glossary.html#AH">AH</a>)
-data packets. Tunnel setup and rekeying occur so much less frequently than
-packet processing that, in general, their overheads are not worth worrying
-about.</p>
-
-<p>At startup, however, tunnel setup overheads may be significant. If you
-reboot a gateway and it needs to establish many tunnels, expect some delay.
-This and other issues for large gateways are discussed <a
-href="#biggate">below</a>.</p>
-
-<h2><a name="pub.bench">Published material</a></h2>
-
-<p>The University of Wales at Aberystwyth has done quite detailed speed tests
-and put <a href="http://tsc.llwybr.org.uk/public/reports/SWANTIME/">their
-results</a> on the web.</p>
-
-<p>Davide Cerri's <a href="http://www.linux.it/~davide/doc/">thesis (in
-Italian)</a> includes performance results for FreeS/WAN and for <a
-href="glossary.html#TLS">TLS</a>. He posted an <a
-href="http://lists.freeswan.org/pipermail/users/2001-December/006303.html">English
-summary</a> on the mailing list.</p>
-
-<p>Steve Bellovin used one of AT&amp;T Research's FreeS/WAN gateways as his
-data source for an analysis of the cache sizes required for key swapping in
-IPsec. Available as <a
-href="http://www.research.att.com/~smb/talks/key-agility.email.txt">text</a>
-or <a href="http://www.research.att.com/~smb/talks/key-agility.pdf">PDF
-slides</a> for a talk on the topic.</p>
-
-<p>See also the NAI work mentioned in the next section.</p>
-
-<h2><a name="perf.estimate">Estimating CPU overheads</a></h2>
-
-<p>We can come up with a formula that roughly relates CPU speed to the rate
-of IPsec processing possible. It is far from exact, but should be usable as a
-first approximation.</p>
-
-<p>An analysis of authentication overheads for high-speed networks, including
-some tests using FreeS/WAN, is on the <a
-href="http://www.pgp.com/research/nailabs/cryptographic/adaptive-cryptographic.asp">NAI
-Labs site</a>. In particular, see figure 3 in this <a
-href="http://download.nai.com/products/media/pgp/pdf/acsa_final_report.pdf">PDF
-document</a>. Their estimates of overheads, measured in Pentium II cycles per
-byte processed are:</p>
-
-<table border="1" align="center">
-  <tbody>
-    <tr>
-      <th></th>
-      <th>IPsec</th>
-      <th>authentication</th>
-      <th>encryption</th>
-      <th>cycles/byte</th>
-    </tr>
-    <tr>
-      <td>Linux IP stack alone</td>
-      <td>no</td>
-      <td>no</td>
-      <td>no</td>
-      <td align="right">5</td>
-    </tr>
-    <tr>
-      <td>IPsec without crypto</td>
-      <td>yes</td>
-      <td>no</td>
-      <td>no</td>
-      <td align="right">11</td>
-    </tr>
-    <tr>
-      <td>IPsec, authentication only</td>
-      <td>yes</td>
-      <td>SHA-1</td>
-      <td>no</td>
-      <td align="right">24</td>
-    </tr>
-    <tr>
-      <td>IPsec with encryption</td>
-      <td>yes</td>
-      <td>yes</td>
-      <td>yes</td>
-      <td align="right">not tested</td>
-    </tr>
-  </tbody>
-</table>
-
-<p>Overheads for IPsec with encryption were not tested in the NAI work, but
-Antoon Bosselaers' <a
-href="http://www.esat.kuleuven.ac.be/~bosselae/fast.html">web page</a> gives
-cost for his optimised Triple DES implementation as 928 Pentium cycles per
-block, or 116 per byte. Adding that to the 24 above, we get 140 cycles per
-byte for IPsec with encryption.</p>
-
-<p>At 140 cycles per byte, a 140 MHz machine can handle a megabyte -- 8
-megabits -- per second. Speeds for other machines will be proportional to
-this. To saturate a link  with capacity C megabits per second, you need a
-machine running at <var>C * 140/8 = C * 17.5</var> MHz.</p>
-
-<p>However, that estimate is not precise. It ignores the differences
-between:</p>
-<ul>
-  <li>NAI's test packets and real traffic</li>
-  <li>NAI's Pentium II cycles, Bosselaers' Pentium cycles, and your machine's
-    cycles</li>
-  <li>different 3DES implementations</li>
-  <li>SHA-1 and MD5</li>
-</ul>
-
-<p>and does not account for some overheads you will almost certainly have:</p>
-<ul>
-  <li>communication on the client-side interface</li>
-  <li>switching between multiple tunnels -- re-keying, cache reloading and so
-    on</li>
-</ul>
-
-<p>so we suggest using <var>C * 25</var> to get an estimate with a bit of a
-built-in safety factor.</p>
-
-<p>This covers only IP and IPsec processing. If you have other loads on your
-gateway -- for example if it is also working as a firewall -- then you will
-need to add your own safety factor atop that.</p>
-
-<p>This estimate matches empirical data reasonably well. For example,
-Metheringham's tests, described <a href="#klips.bench">below</a>, show a 733
-topping out between 32 and 36 Mbit/second, pushing data as fast as it can
-down a 100 Mbit link. Our formula suggests you need at least an 800 to handle
-a fully loaded 32 Mbit link. The two results are consistent.</p>
-
-<p>Some examples using this estimation method:</p>
-
-<table border="1" align="center">
-  <tbody>
-    <tr>
-      <th colspan="2">Interface</th>
-      <th colspan="3">Machine speed in MHz</th>
-    </tr>
-    <tr>
-      <th>Type</th>
-      <th>Mbit per<br>
-        second</th>
-      <th>Estimate<br>
-        Mbit*25</th>
-      <th>Minimum IPSEC gateway</th>
-      <th>Minimum with other load
-
-        <p>(e.g. firewall)</p>
-      </th>
-    </tr>
-    <tr>
-      <td>DSL</td>
-      <td align="right">1</td>
-      <td align="right">25 MHz</td>
-      <td rowspan="2">whatever you have</td>
-      <td rowspan="2">133, or better if you have it</td>
-    </tr>
-    <tr>
-      <td>cable modem</td>
-      <td align="right">3</td>
-      <td align="right">75 MHz</td>
-    </tr>
-    <tr>
-      <td><strong>any link, light load</strong></td>
-      <td align="right"><strong>5</strong></td>
-      <td align="right">125 MHz</td>
-      <td>133</td>
-      <td>200+, <strong>almost any surplus machine</strong></td>
-    </tr>
-    <tr>
-      <td>Ethernet</td>
-      <td align="right">10</td>
-      <td align="right">250 MHz</td>
-      <td>surplus 266 or 300</td>
-      <td>500+</td>
-    </tr>
-    <tr>
-      <td><strong>fast link, moderate load</strong></td>
-      <td align="right"><strong>20</strong></td>
-      <td align="right">500 MHz</td>
-      <td>500</td>
-      <td>800+, <strong>any current off-the-shelf PC</strong></td>
-    </tr>
-    <tr>
-      <td>T3 or E3</td>
-      <td align="right">45</td>
-      <td align="right">1125 MHz</td>
-      <td>1200</td>
-      <td>1500+</td>
-    </tr>
-    <tr>
-      <td>fast Ethernet</td>
-      <td align="right">100</td>
-      <td align="right">2500 MHz</td>
-      <td rowspan="2" colspan="2" align="center">// not feasible with 3DES in
-        software on current machines //</td>
-    </tr>
-    <tr>
-      <td>OC3</td>
-      <td align="right">155</td>
-      <td align="right">3875 MHz</td>
-    </tr>
-  </tbody>
-</table>
-
-<p>Such an estimate is far from exact, but should be usable as minimum
-requirement for planning. The key observations are:</p>
-<ul>
-  <li>older <strong>surplus machines</strong> are fine for IPsec gateways at
-    loads up to <strong>5 megabits per second</strong> or so</li>
-  <li>a <strong>mid-range new machine</strong> can handle IPsec at rates up
-    to <strong>20 megabits per second</strong> or more</li>
-</ul>
-  <h3><a name="perf.more">Higher performance alternatives</a></h3>
-
-  <p><a href="glossary.html#AES">AES</a> is a new US government block cipher
-  standard, designed to replace the obsolete <a
-  href="glossary.html#DES">DES</a>. If FreeS/WAN using <a
-  href="glossary.html#3DES">3DES</a> is not fast enough for your application,
-  the AES <a href="web.html#patch">patch</a> may help.</p>
-
-  <p>To date (March 2002) we have had only one <a
-  href="http://lists.freeswan.org/pipermail/users/2002-February/007771.html">mailing
-  list report</a> of measurements with the patch applied. It indicates that,
-  at least for the tested load on that user's network,  <strong>AES roughly
-  doubles IPsec throughput</strong>. If further testing confirms this, it may
-  prove possible to saturate an OC3 link in software on a high-end box.</p>
-
-  <p>Also, some work is being done toward support of <a
-  href="compat.html#hardware">hardware IPsec acceleration</a> which might
-  extend the range of requirements FreeS/WAN could meet.</p>
-
-  <h3>Other considerations</h3>
-
-  <p>CPU speed may be the main issue for IPsec performance, but of course it
-  isn't the only one.</p>
-
-  <p>You need good ethernet cards or other network interface hardware to get
-  the best performance. See this <a
-  href="http://www.ethermanage.com/ethernet/ethernet.html">ethernet
-  information</a> page and this <a href="http://www.scyld.com/diag">Linux
-  network driver</a> page.</p>
-
-  <p>The current FreeS/WAN kernel code is largely single-threaded. It is SMP
-  safe, and will run just fine on a multiprocessor machine (<a
-  href="compat.html#multiprocessor">discussion</a>), but the load within the
-  kernel is not shared effectively. This means that, for example to saturate
-  a T3 -- which needs about a 1200 MHz machine -- you cannot expect something
-  like a dual 800 to do the job. </p>
-
-  <p>On the other hand, SMP machines do tend to share loads well so --
-  provided one CPU is fast enough for the IPsec work -- a multiprocessor
-  machine may be ideal for a gateway with a mixed load.</p>
-
-  <h2><a name="biggate">Many tunnels from a single gateway</a></h2>
-
-  <p>FreeS/WAN allows a single gateway machine to build tunnels to many
-  others. There may, however, be some problems for large numbers as indicated
-  in this message from the mailing list:</p>
-
-<pre>Subject: Re: Maximum number of ipsec tunnels?
-   Date: Tue, 18 Apr 2000
-   From: "John S. Denker" &lt;jsd@research.att.com&gt;
-
-Christopher Ferris wrote:
-
-&gt;&gt; What are the maximum number ipsec tunnels FreeS/WAN can handle??
-
-Henry Spencer wrote:
-
-&gt;There is no particular limit.  Some of the setup procedures currently
-&gt;scale poorly to large numbers of connections, but there are (clumsy)
-&gt;workarounds for that now, and proper fixes are coming.
-
-1) "Large" numbers means anything over 50 or so.  I routinely run boxes
-with about 200 tunnels.  Once you get more than 50 or so, you need to worry
-about several scalability issues:
-
-a) You need to put a "-" sign in syslogd.conf, and rotate the logs daily
-not weekly.
-
-b) Processor load per tunnel is small unless the tunnel is not up, in which
-case a new half-key gets generated every 90 seconds, which can add up if
-you've got a lot of down tunnels.
-
-c) There's other bits of lore you need when running a large number of
-tunnels.  For instance, systematically keeping the .conf file free of
-conflicts requires tools that aren't shipped with the standard freeswan
-package.
-
-d) The pluto startup behavior is quadratic.  With 200 tunnels, this eats up
-several minutes at every restart.   I'm told fixes are coming soon.
-
-2) Other than item (1b), the CPU load depends mainly on the size of the
-pipe attached, not on the number of tunnels.
-</pre>
-
-<p>It is worth noting that item (1b) applies only to repeated attempts to
-re-key a data connection (IPsec SA, Phase 2) over an established keying
-connection (ISAKMP SA, Phase 1). There are two ways to reduce this overhead
-using settings in <a href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</a>:</p>
-<ul>
-  <li>set <var>keyingtries</var> to some small value to limit repetitions</li>
-  <li>set <var>keylife</var> to a short time so that a failing data
-    connection will be cleaned up when the keying connection is reset.</li>
-</ul>
-
-<p>The overheads for establishing keying connections (ISAKMP SAs, Phase 1)
-are lower because for these Pluto does not perform expensive operations
-before receiving a reply from the peer.</p>
-
-<p>A gateway that does a lot of rekeying -- many tunnels and/or low settings
-for tunnel lifetimes -- will also need a lot of <a
-href="glossary.html#random">random numbers</a> from the random(4) driver.</p>
-
-<h2><a name="low-end">Low-end systems</a></h2>
-
-<p><em>Even a 486 can handle a T1 line</em>, according to this mailing list
-message:</p>
-<pre>Subject: Re: linux-ipsec: IPSec Masquerade
-   Date: Fri, 15 Jan 1999 11:13:22 -0500
-   From: Michael Richardson 
-
-. . . A 486/66 has been clocked by Phil Karn to do
-10Mb/s encryption.. that uses all the CPU, so half that to get some CPU,
-and you have 5Mb/s. 1/3 that for 3DES and you get 1.6Mb/s....</pre>
-
-<p>and a piece of mail from project technical lead Henry Spencer:</p>
-<pre>Oh yes, and a new timing point for Sandy's docs...  A P60 -- yes, a 60MHz
-Pentium, talk about antiques -- running a host-to-host tunnel to another
-machine shows an FTP throughput (that is, end-to-end results with a real
-protocol) of slightly over 5Mbit/s either way.  (The other machine is much
-faster, the network is 100Mbps, and the ether cards are good ones... so
-the P60 is pretty definitely the bottleneck.)</pre>
-
-<p>From the above, and from general user experience as reported on the list,
-it seems clear that a cheap surplus machine -- a reasonable 486, a minimal
-Pentium box, a Sparc 5, ... -- can easily handle a home office or a small
-company connection using any of:</p>
-<ul>
-  <li>ADSL service</li>
-  <li>cable modem</li>
-  <li>T1</li>
-  <li>E1</li>
-</ul>
-
-<p>If available, we suggest using a Pentium 133 or better. This should ensure
-that, even under maximum load, IPsec will use less than half the CPU cycles.
-You then have enough left for other things you may want on your gateway --
-firewalling, web caching, DNS and such.</p>
-
-<h2><a name="klips.bench">Measuring KLIPS</a></h2>
-
-<p>Here is some additional data from the mailing list.</p>
-<pre>Subject: FreeSWAN (specically KLIPS) performance measurements
-   Date: Thu, 01 Feb 2001
-   From: Nigel Metheringham &lt;Nigel.Metheringham@intechnology.co.uk&gt;
-
-I've spent a happy morning attempting performance tests against KLIPS 
-(this is due to me not being able to work out the CPU usage of KLIPS so 
-resorting to the crude measurements of maximum throughput to give a 
-baseline to work out loading of a box).
-
-Measurements were done using a set of 4 boxes arranged in a line, each 
-connected to the next by 100Mbit duplex ethernet.  The inner 2 had an 
-ipsec tunnel between them (shared secret, but I was doing measurements 
-when the tunnel was up and running - keying should not be an issue 
-here).  The outer pair of boxes were traffic generators or traffic sink.
-
-The crypt boxes are Compaq DL380s - Uniprocessor PIII/733 with 256K 
-cache.  They have 128M main memory.  Nothing significant was running on 
-the boxes other than freeswan.  The kernel was a 2.2.19pre7 patched 
-with freeswan and ext3.
-
-Without an ipsec tunnel in the chain (ie the 2 inner boxes just being 
-100BaseT routers), throughput (measured with ttcp) was between 10644 
-and 11320 KB/sec
-
-With an ipsec tunnel in place, throughput was between 3268 and 3402 
-KB/sec
-
-These measurements are for data pushed across a TCP link, so the 
-traffic on the wire between the 2 ipsec boxes would have been higher 
-than this....
-
-vmstat (run during some other tests, so not affecting those figures) on 
-the encrypting box shows approx 50% system &amp; 50% idle CPU - which I 
-don't believe at all.  Interactive feel of the box was significantly 
-sluggish.
-
-I also tried running the kernel profiler (see man readprofile) during 
-test runs.
-
-A box doing primarily decrypt work showed basically nothing happening - 
-I assume interrupts were off.
-A box doing encrypt work showed the following:-
- Ticks Function                                   Load
- ~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~    ~~~~~~
-   956 total                                      0.0010
-   532 des_encrypt2                               0.1330
-   110 MD5Transform                               0.0443
-    97 kmalloc                                    0.1880
-    39 des_encrypt3                               0.1336
-    23 speedo_interrupt                           0.0298
-    14 skb_copy_expand                            0.0250
-    13 ipsec_tunnel_start_xmit                    0.0009
-    13 Decode                                     0.1625
-    11 handle_IRQ_event                           0.1019
-    11 .des_ncbc_encrypt_end                      0.0229
-    10 speedo_start_xmit                          0.0188
-     9 satoa                                      0.0225
-     8 kfree                                      0.0118
-     8 ip_fragment                                0.0121
-     7 ultoa                                      0.0365
-     5 speedo_rx                                  0.0071
-     5 .des_encrypt2_end                          5.0000
-     4 _stext                                     0.0140
-     4 ip_fw_check                                0.0035
-     2 rj_match                                   0.0034
-     2 ipfw_output_check                          0.0200
-     2 inet_addr_type                             0.0156
-     2 eth_copy_and_sum                           0.0139
-     2 dev_get                                    0.0294
-     2 addrtoa                                    0.0143
-     1 speedo_tx_buffer_gc                        0.0024
-     1 speedo_refill_rx_buf                       0.0022
-     1 restore_all                                0.0667
-     1 number                                     0.0020
-     1 net_bh                                     0.0021
-     1 neigh_connected_output                     0.0076
-     1 MD5Final                                   0.0083
-     1 kmem_cache_free                            0.0016
-     1 kmem_cache_alloc                           0.0022
-     1 __kfree_skb                                0.0060
-     1 ipsec_rcv                                  0.0001
-     1 ip_rcv                                     0.0014
-     1 ip_options_fragment                        0.0071
-     1 ip_local_deliver                           0.0023
-     1 ipfw_forward_check                         0.0139
-     1 ip_forward                                 0.0011
-     1 eth_header                                 0.0040
-     1 .des_encrypt3_end                          0.0833
-     1 des_decrypt3                               0.0034
-     1 csum_partial_copy_generic                  0.0045
-     1 call_out_firewall                          0.0125
-
-Hope this data is helpful to someone... however the lack of visibility 
-into the decrypt side makes things less clear</pre>
-
-<h2><a name="speed.compress">Speed with compression</a></h2>
-
-<p>Another user reported some results for connections with and without IP
-compression:</p>
-<pre>Subject: [Users] Speed with compression
-   Date: Fri, 29 Jun 2001
-   From: John McMonagle &lt;johnm@advocap.org&gt;
-
-Did a couple tests with compression using the new 1.91 freeswan.
-
-Running between 2 sites with cable modems.  Both  using approximately
-130 mhz pentium.
-
-Transferred files with ncftp.
-
-Compressed file was a 6mb compressed  installation file.
-Non compressed was 18mb /var/lib/rpm/packages.rpm
-
-                            Compressed vpn          regular vpn
-Compress file                42.59 kBs               42.08 kBs
-regular file                110.84 kBs               41.66 kBs
-
-Load  was about 0 either way.
-Ping times were very similar  a bit above 9 ms.
-
-Compression looks attractive to me.</pre>
-Later in the same thread, project technical lead Henry Spencer added:
-<pre>&gt; is there a reason not to switch compression on?  I have large gateway boxes
-&gt; connecting 3 connections, one of them with a measly DS1 link...
-
-Run some timing tests with and without, with data and loads representative
-of what you expect in production.  That's the definitive way to decide. 
-If compression is a net loss, then obviously, leave it turned off.  If it
-doesn't make much difference, leave it off for simplicity and hence
-robustness.  If there's a substantial gain, by all means turn it on. 
-
-If both ends support compression and can successfully negotiate a
-compressed connection (trivially true if both are FreeS/WAN 1.91), then
-the crucial question is CPU cycles. 
-
-Compression has some overhead, so one question is whether *your* data
-compresses well enough to save you more CPU cycles (by reducing the volume
-of data going through CPU-intensive encryption/decryption) than it costs
-you.  Last time I ran such tests on data that was reasonably compressible
-but not deliberately contrived to be so, this generally was not true --
-compression cost extra CPU cycles -- so compression was worthwhile only if
-the link, not the CPU, was the bottleneck.  However, that was before the
-slow-compression bug was fixed.  I haven't had a chance to re-run those
-tests yet, but it sounds like I'd probably see a different result. </pre>
-The bug he refers to was a problem with the compression libraries that had us
-using C code, rather than assembler, for compression. It was fixed before
-1.91.
-
-<h2><a name="methods">Methods of measuring</a></h2>
-
-<p>If you want to measure the loads FreeS/WAN puts on a system, note that
-tools such as top or measurements such as load average are more-or-less
-useless for this. They are not designed to measure something that does most
-of its work inside the kernel.</p>
-
-<p>Here is a message from FreeS/WAN kernel programmer Richard Guy Briggs on
-this:</p>
-<pre>&gt; I have a batch of boxes doing Freeswan stuff.
-&gt; I want to measure the CPU loading of the Freeswan tunnels, but am 
-&gt; having trouble seeing how I get some figures out...
-&gt; 
-&gt;  - Keying etc is in userspace so will show up on the per-process
-&gt;    and load average etc (ie pluto's load)
-
-Correct.
-
-&gt;  - KLIPS is in the kernel space, and does not show up in load average
-&gt;    I think also that the KLIPS per-packet processing stuff is running
-&gt;    as part of an interrupt handler so it does not show up in the
-&gt;    /proc/stat system_cpu or even idle_cpu figures
-
-It is not running in interrupt handler.  It is in the bottom half.
-This is somewhere between user context (careful, this is not
-userspace!) and hardware interrupt context.
-
-&gt; Is this correct, and is there any means of instrumenting how much the 
-&gt; cpu is being loaded - I don't like the idea of a system running out of 
-&gt; steam whilst still showing 100% idle CPU :-)
-
-vmstat seems to do a fairly good job, but use a running tally to get a
-good idea.  A one-off call to vmstat gives different numbers than a
-running stat.  To do this, put an interval on your vmstat command
-line.</pre>
-and another suggestion from the same thread:
-<pre>Subject: Re: Measuring the CPU usage of Freeswan
-   Date: Mon, 29 Jan 2001
-   From: Patrick Michael Kane &lt;modus@pr.es.to&gt;
- 
-The only truly accurate way to accurately track FreeSWAN CPU usage is to use
-a CPU soaker. You run it on an unloaded system as a benchmark, then start up
-FreeSWAN and take the difference to determine how much FreeSWAN is eating.
-I believe someone has done this in the past, so you may find something in
-the FreeSWAN archives.  If not, someone recently posted a URL to a CPU
-soaker benchmark tool on linux-kernel.</pre>
-</body>
-</html>
diff --git a/doc/src/policy-groups-table.html b/doc/src/policy-groups-table.html
deleted file mode 100644
index 8e84809cf..000000000
--- a/doc/src/policy-groups-table.html
+++ /dev/null
@@ -1,297 +0,0 @@
-<!DOCTYPE html PUBLIC "-//w3c//dtd html 4.0 transitional//en">
-<html>
-<head>
-            
-  <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
-            
-  <meta name="Author" content="Richard Guy Briggs">
-            
-  <meta name="GENERATOR" content="Mozilla/4.78 [en] (X11; U; Linux 2.4.18 i686) [Netscape]">
-  <title></title>
-</head>
-  <body>
-Policy Groups Table<br>
-<br>
-This table lists all the policy group combinations and expected packet flows.<br>
-<br>
-<br>
-   
-<table border="1" cols="14" width="100%" nosave="">
-   <tbody>
-      <tr>
-   <th bgcolor="#cccccc">policy</th>
-    <th bgcolor="#cccccc"><br>
-        </th>
-    <th bgcolor="#cccccc" colspan="2">none</th>
-      <th bgcolor="#cccccc" colspan="2">clear</th>
-      <th bgcolor="#cccccc" colspan="2">clear-or-private</th>
-      <th bgcolor="#cccccc" colspan="2">private-or-clear</th>
-      <th bgcolor="#cccccc" colspan="2">private</th>
-      <th bgcolor="#cccccc" colspan="2">block</th>
-     </tr>
-    <tr>
-   <th bgcolor="#cccccc"><br>
-        </th>
-    <th bgcolor="#cccccc">key?</th>
-    <th bgcolor="#cccccc">no</th>
-    <th bgcolor="#cccccc">yes</th>
-    <th bgcolor="#cccccc">no</th>
-    <th bgcolor="#cccccc">yes</th>
-    <th bgcolor="#cccccc">no</th>
-    <th bgcolor="#cccccc">yes</th>
-    <th bgcolor="#cccccc">no</th>
-    <th bgcolor="#cccccc">yes</th>
-    <th bgcolor="#cccccc">no</th>
-    <th bgcolor="#cccccc">yes</th>
-    <th bgcolor="#cccccc">no</th>
-    <th bgcolor="#cccccc">yes</th>
-   </tr>
-    <tr>
-   <th bgcolor="#cccccc" rowspan="2">none</th>
-    <th bgcolor="#cccccc">no</th>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c,f</td>
-    <td>c,f</td>
-    <td>c,f</td>
-    <td>c,f</td>
-   </tr>
-    <tr>
-    <th bgcolor="#cccccc">yes</th>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c,f?</td>
-    <td>c,f?</td>
-    <td>c,f</td>
-    <td>c,f</td>
-    <td>c,f</td>
-    <td>c,f</td>
-   </tr>
-    <tr>
-   <th bgcolor="#cccccc" rowspan="2">clear</th>
-    <th bgcolor="#cccccc">no</th>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c,c(f?)</td>
-    <td>c,f</td>
-    <td>c,f</td>
-    <td>c,f</td>
-    <td>c,f</td>
-   </tr>
-    <tr>
-    <th bgcolor="#cccccc">yes</th>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c,f?</td>
-    <td>c,f?</td>
-    <td>c,f</td>
-    <td>c,f</td>
-    <td>c,f</td>
-    <td>c,f</td>
-   </tr>
-    <tr>
-   <th bgcolor="#cccccc" rowspan="2">clear-or-private</th>
-    <th bgcolor="#cccccc">no</th>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c,f?</td>
-    <td>c,c(f?)</td>
-    <td>c,f</td>
-    <td>c,f</td>
-    <td>c,f</td>
-    <td>c,f</td>
-   </tr>
-    <tr>
-    <th bgcolor="#cccccc">yes</th>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c</td>
-    <td>c,f?</td>
-    <td>c,e</td>
-    <td>c,f</td>
-    <td>c,e</td>
-    <td>c,f</td>
-    <td>c,f</td>
-   </tr>
-    <tr>
-   <th bgcolor="#cccccc" rowspan="2">private-or-clear</th>
-    <th bgcolor="#cccccc">no</th>
-    <td>t,c</td>
-    <td>t,f?</td>
-    <td>t,c</td>
-    <td>t,f?</td>
-    <td>t,c</td>
-    <td>t,f?</td>
-    <td>t,f?</td>
-    <td>t,f?</td>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-   </tr>
-    <tr>
-    <th bgcolor="#cccccc">yes</th>
-    <td>t,c</td>
-    <td>t,f?</td>
-    <td>t,c</td>
-    <td>t,f?</td>
-    <td>t,c</td>
-    <td>t,e</td>
-    <td>t,c(f?)</td>
-    <td>t,e</td>
-    <td>t,f</td>
-    <td>t,e</td>
-    <td>t,f</td>
-    <td>t,f</td>
-   </tr>
-    <tr>
-   <th bgcolor="#cccccc" rowspan="2">private</th>
-    <th bgcolor="#cccccc">no</th>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-   </tr>
-    <tr>
-    <th bgcolor="#cccccc">yes</th>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,f</td>
-    <td>t,e</td>
-    <td>t,f</td>
-    <td>t,e</td>
-    <td>t,f</td>
-    <td>t,e</td>
-    <td>t,f</td>
-    <td>t,f</td>
-   </tr>
-    <tr>
-   <th bgcolor="#cccccc" rowspan="2">block</th>
-    <th bgcolor="#cccccc">no</th>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-   </tr>
-    <tr>
-    <th bgcolor="#cccccc">yes</th>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-    <td>f</td>
-   </tr>
-         
-  </tbody>  
-</table>
-    <br>
-  &nbsp;   
-<table border="1" cols="2" nosave="">
-   <tbody>
-      <tr nosave="">
-   <th nosave="">legend</th>
-    <th>packet fate</th>
-   </tr>
-    <tr>
-   <td>c</td>
-    <td>clear</td>
-   </tr>
-    <tr>
-   <td>f</td>
-    <td>fail</td>
-   </tr>
-    <tr>
-   <td>e</td>
-    <td>encrypt</td>
-   </tr>
-    <tr>
-   <td>t</td>
-    <td>trap</td>
-   </tr>
-    <tr>
-      <td valign="Top">c,f<br>
-      </td>
-      <td valign="Top">first packet clear, then fail<br>
-      </td>
-    </tr>
-    <tr>
-      <td valign="Top">c,e<br>
-      </td>
-      <td valign="Top">first packet clear, then encrypt<br>
-      </td>
-    </tr>
-    <tr>
-      <td valign="Top">t,f<br>
-      </td>
-      <td valign="Top">trap, then fail<br>
-      </td>
-    </tr>
-    <tr>
-      <td valign="Top">t,c<br>
-      </td>
-      <td valign="Top">trap, then clear<br>
-      </td>
-    </tr>
-    <tr>
-      <td valign="Top">t,e<br>
-      </td>
-      <td valign="Top">trap, then encrypt<br>
-      </td>
-    </tr>
-         
-  </tbody>  
-</table>
-      
-</body>
-</html>
diff --git a/doc/src/policygroups.html b/doc/src/policygroups.html
deleted file mode 100644
index 0425ade39..000000000
--- a/doc/src/policygroups.html
+++ /dev/null
@@ -1,489 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>Configuring FreeS/WAN with policy groups</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, encryption, cryptography, FreeS/WAN, FreeSWAN">
-  <!--
-
-  Written by Claudia Schmeing for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: policygroups.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1>How to Configure Linux FreeS/WAN with Policy Groups</h1>
-
-
-<A NAME="policygroups"></A>
-
-<H2>What are Policy Groups?</H2>
-
-
-<P><STRONG>Policy Groups</STRONG> are an elegant general mechanism 
-to configure FreeS/WAN. They are useful for
-many FreeS/WAN users.</P>
-
-<P>In previous FreeS/WAN versions, you needed to configure each IPsec 
-connection explicitly, on both local and remote hosts.
- This could become complex.</P>
-
-<P>By contrast, Policy Groups allow you to set local IPsec policy
-for lists of remote hosts and networks,
-simply by listing the hosts and networks which you wish to 
-have special treatment in one of several Policy Group files.
-FreeS/WAN then internally creates the connections 
-needed to implement each policy.</P>
-
-<P>In the next section we describe our five Base Policy Groups, which
-you can use to configure IPsec in many useful ways. Later, we will 
-show you how to create an IPsec VPN using one line of configuration for 
-each remote host or network.</P>
-
-
-<A NAME="builtin_policygroups"></A><H3>Built-In Security Options</H3>
-
-<P>FreeS/WAN offers these Base Policy Groups:</P>
-
-<DL>
-
-<DT>private</DT>
-
-<DD>
-FreeS/WAN only communicates privately with the listed 
-<A HREF="glossary.html#CIDR">CIDR</A> blocks.
-If needed, FreeS/WAN attempts to create a connection opportunistically.
-If this fails, FreeS/WAN blocks communication.
-Inbound blocking is assumed to be done by the firewall. FreeS/WAN offers 
-firewall hooks but no modern firewall rules to help with inbound blocking.
-
-</DD>
-
-<DT>private-or-clear</DT>
-<DD>
-
-FreeS/WAN prefers private communication with the listed CIDR blocks.
-If needed, FreeS/WAN attempts to create a connection opportunistically.
-If this fails, FreeS/WAN allows traffic in the clear.
-
-</DD>
-
-<DT>clear-or-private</DT>
-
-<DD>
-FreeS/WAN communicates cleartext with the listed CIDR blocks, but
-also accepts inbound OE connection requests from them.
-Also known as <A HREF="glossary.html#passive.OE">passive OE (pOE)</A>, 
-this policy may be used to create an 
-<A HREF="glossary.html#responder">opportunistic responder</A>.
-</DD>
-
-<DT>clear</DT>
-<DD>
-FreeS/WAN only communicates cleartext with the listed CIDR blocks.
-</DD>
-
-<DT>block</DT>
-<DD>FreeS/WAN blocks traffic to and from and the listed CIDR blocks.
-Inbound blocking is assumed to be done by the firewall. FreeS/WAN offers 
-firewall hooks but no modern firewall rules to help with inbound blocking.
-<!-- also called "blockdrop".-->
-
-</DD>
-
-</DL>
-
-<A NAME="policy.group.notes"></A><P>Notes:</P>
-
-<UL>
-<LI>Base Policy Groups apply to communication with this host only.</LI>
-<LI>The most specific rule (whether policy or pre-configured connection) 
-applies.
-This has several practical applications:
-<UL>
-<LI>If CIDR blocks overlap, FreeS/WAN chooses 
-the most specific applicable block.</LI>
-<LI>This decision also takes into account any pre-configured connections
-you may have.</LI>
-<LI>If the most specific connection is a pre-configured connection,
-the following procedure applies. If that connection is up, it will be
-used. If it is routed, it will be brought up. If it is added, 
-no action will be taken.</LI>
-</UL>
-<LI>Base Policy Groups are created using built-in connections.
-Details in 
-<A HREF="manpage.d/ipsec.conf.5.html">man ipsec.conf</A>.</LI>
-<LI>All Policy Groups are bidirectional. 
-<A HREF="src/policy-groups-table.html">This chart</A> shows some technical 
-details.
-FreeS/WAN does not support one-way encryption, since it can give users
-a false sense of security.</LI>
-</UL>
-
-
-<H2>Using Policy Groups</H2>
-
-<P>The Base Policy Groups which build IPsec connections rely on Opportunistic
-Encryption. To use the following examples, you 
-must first become OE-capable, as described 
-in our <A HREF="quickstart.html#quickstart">quickstart guide</A>.
-
-<A NAME="example1"></A><H3>Example 1: Using a Base Policy Group</H3>
-
-<P>Simply place CIDR blocks (<A HREF="#dnswarning">names</A>, 
-IPs or IP ranges) in /etc/ipsec.d/policies/<VAR>[groupname]</VAR>, 
-and reread the policy group files.</P> 
-
-<P>For example, the <VAR>private-or-clear</VAR> policy tells 
-FreeS/WAN to prefer encrypted communication to the listed CIDR blocks.
-Failing that, it allows talk in the clear.</P>
-
-<P>To make this your default policy, place
-<A HREF="glossary.html#fullnet">fullnet</A>
-in the <VAR>private-or-clear</VAR> policy group file:</P>
-
-<PRE>    [root@xy root]# cat /etc/ipsec.d/policies/private-or-clear
-    # This file defines the set of CIDRs (network/mask-length) to which
-    # communication should be private, if possible, but in the clear otherwise.
-    ....
-    0.0.0.0/0</PRE>
-
-<P>and reload your policies with</P>
-
-<PRE>    ipsec auto --rereadgroups</PRE>
-
-<P>Use <A HREF="quickstart.html#opp.test">this test</A> to verify 
-opportunistic connections.</P>
-
-
-
-<A NAME="example2"></A><H3>Example 2: Defining IPsec Security Policy 
-with Groups</H3>
-
-<P>Defining IPsec security policy with Base Policy Groups is like creating
-a shopping list: just put CIDR blocks in the appropriate group files. 
-For example:</P>
-
-
-<PRE>    [root@xy root]# cd /etc/ipsec.d/policies
-    [root@xy policies]# cat private
-        192.0.2.96/27              # The finance department
-        192.0.2.192/29             # HR
-	192.0.2.12                 # HR gateway
-        irc.private.example.com    # Private IRC server
-  
-    [root@xy policies]# cat private-or-clear
-        0.0.0.0/0                  # My default policy: try to encrypt.
-
-    [root@xy policies]# cat clear
-        192.0.2.18/32              # My POP3 server
-        192.0.2.19/32              # My Web proxy
-
-    [root@xy policies]# cat block
-        spamsource.example.com</PRE>
-
-<P>To make these settings take effect, type:</P>
-<PRE>    ipsec auto --rereadgroups</PRE>
-
-
-<P>Notes:</P>
-<UL>
-<LI>For opportunistic connection attempts to succeed, all participating
-FreeS/WAN hosts and gateways must be configured for OE.</LI>
-<LI>Examples 3 through 5 show how to implement a detailed <VAR>private</VAR>
-policy.</LI>
-<LI>
-<A NAME="dnswarning"></A>
-<FONT COLOR=RED>Warning:</FONT> Using DNS names in policy files and ipsec.conf 
-can be tricky. If the name does not resolve, the policy will not be 
-implemented for that name.
-It is therefore safer either to use IPs, or to put any critical names 
-in /etc/hosts.
-We plan to implement periodic DNS retry to help with this.
-<BR>
-Names are resolved at FreeS/WAN startup, or when the policies are reloaded.
-Unfortunately, name lookup can hold up the startup process. 
-If you have fast DNS servers, the problem may be less severe.
-</LI>
-</UL>
-
-
-<A HREF="example3"></A><H3>Example 3: Creating a Simple IPsec VPN with the 
-<VAR>private</VAR> Group</H3>
-
-
-<P>You can create an IPsec VPN between several hosts, with
-only one line of configuration per host, using the <VAR>private</VAR>
-policy group.</P>
-
-<P>First, use our <A HREF="quickstart.html">quickstart 
-guide</A> to set up each participating host
-with a FreeS/WAN install and OE.</P>
-
-<P>In one host's <VAR>/etc/ipsec.d/policies/private</VAR>, 
-list the peers to which you wish to protect traffic.
-For example:</P>
-
-<PRE>    [root@xy root]# cd /etc/ipsec.d/policies
-    [root@xy policies]# cat private
-        192.0.2.9              # several hosts at example.com
-        192.0.2.11             
-        192.0.2.12                 
-        irc.private.example.com 
-</PRE>
-
-<P>Copy the <VAR>private</VAR> file to each host. Remove the local host, and 
-add the initial host.</P>
-
-<PRE>    scp2 /etc/ipsec.d/policies/private root@192.0.2.12:/etc/ipsec.d/policies/private</PRE>
-
-<P>On each host, reread the policy groups with</P>
-
-<PRE>    ipsec auto --rereadgroups</PRE>
-
-
-<P>That's it! You're configured.</P>
-
-<P>Test by pinging between two hosts. After a second or two, 
-traffic should flow, and</P>
-
-<PRE>    ipsec eroute</PRE>
-
-<P>should yield something like</P>
-
-<PRE>    192.0.2.11/32   -> 192.0.2.8/32  => tun0x149f@192.0.2.8</PRE>
-
-<P>where your host IPs are substituted for 192.0.2.11 and 192.0.2.8.</P>
-
-<P>If traffic does not flow, there may be an error in your OE setup. 
-Revisit our <A HREF="quickstart.html">quickstart guide</A>.</P>
-
-
-<P>Our next two examples show you how to add subnets to this IPsec VPN.</P>
-
-
-<A NAME="example4"></A><H3>Example 4: New Policy Groups to Protect a
-Subnet</H3>
-
-<P>To protect traffic to a subnet behind your FreeS/WAN gateway, 
-you'll need additional DNS records, and new policy groups.
-To set up the DNS, see our <A HREF="quickstart.html#opp.gate">quickstart
-guide</A>. To create five new policy groups for your subnet, 
-copy these connections to <VAR>/etc/ipsec.conf</VAR>. 
-Substitute your subnet's IPs for 192.0.2.128/29.</P>
-
-<PRE>
-conn private-net
-    also=private  # inherits settings (eg. auto=start) from built in conn
-    leftsubnet=192.0.2.128/29  # your subnet's IPs here
-
-conn private-or-clear-net
-    also=private-or-clear
-    leftsubnet=192.0.2.128/29
-
-conn clear-or-private-net
-    also=clear-or-private
-    leftsubnet=192.0.2.128/29
-
-conn clear-net
-    also=clear
-    leftsubnet=192.0.2.128/29
-
-conn block-net
-    also=block
-    leftsubnet=192.0.2.128/29
-</PRE>
-
-<P>Copy the gateway's files to serve as the initial policy group files for the
-new groups:</P>
-
-<PRE>
-    cp -p /etc/ipsec.d/policies/private /etc/ipsec.d/policies/private-net
-    cp -p /etc/ipsec.d/policies/private-or-clear /etc/ipsec.d/policies/private-or-clear-net
-    cp -p /etc/ipsec.d/policies/clear-or-private /etc/ipsec.d/policies/clear-or-private-net
-    cp -p /etc/ipsec.d/policies/clear /etc/ipsec.d/policies/clear-net
-    cp -p /etc/ipsec.d/policies/block /etc/ipsec.d/policies/block
-</PRE>
-
-<P><STRONG>Tip: Since a missing policy group file is equivalent to a file with 
-no entries, you need only create files for the connections 
-you'll use.</STRONG></P>
-
-<P>To test one of your new groups, place the fullnet 0.0.0.0/0 in 
-<VAR>private-or-clear-net</VAR>. 
-Perform the subnet test in
-<A HREF="quickstart.html#opp.test">our quickstart guide</A>. You should
-see a connection, and</P>
-
-<PRE>    ipsec eroute</PRE>
-
-<P>should include an entry which mentions the subnet node's IP and the 
-OE test site IP, like this:</P>
-
-<PRE>    192.0.2.131/32   -> 192.139.46.77/32  => tun0x149f@192.0.2.11</PRE>
-
-
-<A HREF="example5"></A><H3>Example 5: Adding a Subnet to the VPN</H3>
-
-<P>Suppose you wish to secure traffic to a subnet 192.0.2.192/29
-behind a FreeS/WAN box 192.0.2.12.</P>
-
-<P>First, add DNS entries to configure 192.0.2.12 as an opportunistic 
-gateway for that subnet. Instructions are in
- our <A HREF="quickstart.html#opp.gate">quickstart guide</A>.
-Next, create a <VAR>private-net</VAR> group on 192.0.2.12 as described in 
-<A HREF="#example4">Example 4</A>.
-</P>
-
-<P>On each other host, add the subnet 192.0.2.192/29 to <VAR>private</VAR>,
-yielding for example</P>
-
-<PRE>    [root@xy root]# cd /etc/ipsec.d/policies
-    [root@xy policies]# cat private
-        192.0.2.9              # several hosts at example.com
-        192.0.2.11
-        192.0.2.12             # HR department gateway
-        192.0.2.192/29         # HR subnet
-        irc.private.example.com
-</PRE>
-
-
-<P>and reread policy groups with </P>
-
-<PRE>    ipsec auto --rereadgroups</PRE>
-
-<P>That's all the configuration you need.</P>
-
-<P>Test your VPN by pinging from a machine on 192.0.2.192/29 to any other host:
-</P>
-
-<PRE>    [root@192.0.2.194]# ping 192.0.2.11</PRE>
-
-
-<P>After a second or two, traffic should flow, and</P>
-
-<PRE>    ipsec eroute</PRE>
-
-<P>should yield something like</P>
-
-<PRE>    192.0.2.11/32   -> 192.0.2.194/32  => tun0x149f@192.0.2.12
-</PRE>
-
-<P>Key:</P>
-<TABLE>
-<TR><TD>1.</TD>
-    <TD>192.0.2.11/32</TD>
-    <TD>Local start point of the protected traffic.
-    </TD></TR>
-<TR><TD>2.</TD>
-    <TD>192.0.2.194/32</TD>
-    <TD>Remote end point of the protected traffic.
-    </TD></TR>
-<TR><TD>3.</TD>
-    <TD>192.0.2.12</TD>
-    <TD>Remote FreeS/WAN node (gateway or host).
-	May be the same as (2).
-   </TD></TR>
-<TR><TD>4.</TD>
-    <TD>[not shown]</TD>
-    <TD>Local FreeS/WAN node (gateway or host),
-	where you've produced the output.
-	May be the same as (1).
-   </TD></TR>
-</TABLE>
-
-<P>For additional assurance, you can verify with a packet sniffer 
-that the traffic is being encrypted.</P>
-
-
-<P>Note</P>
-<UL>
-<LI>Because strangers may also connect via OE, 
-this type of VPN may require a stricter firewalling policy than a 
-conventional VPN.</LI></UL>
-
-
-
-<H2>Appendix</H2>
-
-<A NAME="hiddenconn"></A><H3>Our Hidden Connections</H3>
-
-
-<P>Our Base Policy Groups are created using hidden connections.
-These are spelled out in 
-<A HREF="manpage.d/ipsec.conf.5.html">man ipsec.conf</A>
- and defined in <VAR>/usr/local/lib/ipsec/_confread</VAR>.
-</P>
-
-
-<A NAME="custom_policygroups"></A><H3>Custom Policy Groups</H3>
-
-<P>A policy group is built using a special connection description
-in <VAR>ipsec.conf</VAR>, which:</P>
-
-<UL>
-<LI>is <STRONG>generic</STRONG>. It uses 
-<VAR>right=[%group|%opportunisticgroup]</VAR> rather than specific IPs. 
-The connection is cloned for every name or IP range listed in its Policy Group
-file.</LI>
-<LI>often has a <STRONG>failure rule</STRONG>. This rule, written
-<VAR>failureshunt=[passthrough|drop|reject|none]</VAR>, tells FreeS/WAN 
-what to do with packets for these CIDRs if it fails to establish the connection.
-Default is <VAR>none</VAR>.
-</LI>
-</UL>
-
-<P>To create a new group:</P>
-<OL>
-<LI>Create its connection definition in <VAR>ipsec.conf</VAR>.</LI>
-<LI>Create a Policy Group file in <VAR>/etc/ipsec.d/policies</VAR> 
-with the same name as your connection.
-</LI>
-<LI>Put a CIDR block in that file.</LI>
-<LI>Reread groups with <VAR>ipsec auto --rereadgroups</VAR>.</LI>
-<LI>Test: <VAR>ping</VAR> to activate any OE connection, and view
-results with <VAR>ipsec eroute</VAR>.</LI>
-</OL>
-
-<A NAME="disable_oe"></A>
-<A NAME="disable_policygroups"></A><H3>Disabling Opportunistic Encryption</H3>
-
-<P>To disable OE (eg. policy groups and packetdefault), cut and paste the following lines 
-to <VAR>/etc/ipsec.conf</VAR>:</P>
-
-<PRE>conn block
-    auto=ignore
-
-conn private
-    auto=ignore
-
-conn private-or-clear
-    auto=ignore
-
-conn clear-or-private
-    auto=ignore
-
-conn clear
-    auto=ignore
-
-conn packetdefault
-    auto=ignore</PRE>
-
-<P>Restart FreeS/WAN so that the changes take effect:</P>
-
-<PRE>    ipsec setup restart</PRE>
-
-</body>
-</html>
-
-
diff --git a/doc/src/politics.html b/doc/src/politics.html
deleted file mode 100644
index 9e87d4f05..000000000
--- a/doc/src/politics.html
+++ /dev/null
@@ -1,1466 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>History and politics of cryptography</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, cryptography, history, politics">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: politics.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1><a name="politics">History and politics of cryptography</a></h1>
-
-<p>Cryptography has a long and interesting history, and has been the subject
-of considerable political controversy.</p>
-
-<h2><a name="intro.politics">Introduction</a></h2>
-
-<h3>History</h3>
-
-<p>The classic book on the history of cryptography is David Kahn's <a
-href="biblio.html#Kahn">The Codebreakers</a>. It traces codes and
-codebreaking from ancient Egypt to the 20th century.</p>
-
-<p>Diffie and Landau <a href="biblio.html#diffie">Privacy on the Line: The
-Politics of Wiretapping and Encryption</a> covers the history from the First
-World War to the 1990s, with an emphasis on the US.</p>
-
-<h4>World War II</h4>
-
-<p>During the Second World War, the British "Ultra" project achieved one of
-the greatest intelligence triumphs in the history of warfare, breaking many
-Axis codes. One major target was the Enigma cipher machine, a German device
-whose users were convinced it was unbreakable. The American "Magic" project
-had some similar triumphs against Japanese codes.</p>
-
-<p>There are many books on this period. See our bibliography for several. Two
-I particularly like are:</p>
-<ul>
-  <li>Andrew Hodges has done a superb <a
-    href="http://www.turing.org.uk/book/">biography</a> of Alan Turing, a key
-    player among the Ultra codebreakers. Turing was also an important
-    computer pioneer. The terms <a
-    href="http://www.abelard.org/turpap/turpap.htm">Turing test</a> and <a
-    href="http://plato.stanford.edu/entries/turing-machine/">Turing
-    machine</a> are named for him, as is the <a
-    href="http://www.acm.org">ACM</a>'s highest technical <a
-    href="http://www.acm.org/awards/taward.html">award</a>.</li>
-  <li>Neal Stephenson's <a href="biblio.html#neal">Cryptonomicon</a> is a
-    novel with cryptography central to the plot. Parts of it take place
-    during WW II, other parts today.</li>
-</ul>
-
-<p>Bletchley Park, where much of the Ultra work was done, now has a museum
-and a <a href="http://www.bletchleypark.org.uk/">web site</a>.</p>
-
-<p>The Ultra work introduced three major innovations.</p>
-<ul>
-  <li>The first break of Enigma was achieved by Polish Intelligence in 1931.
-    Until then most code-breakers had been linguists, but a different
-    approach was needed to break machine ciphers. Polish Intelligence
-    recruited bright young mathematicians to crack the "unbreakable" Enigma.
-    When war came in 1939, the Poles told their allies about this, putting
-    Britain on the road to Ultra. The British also adopted a mathematical
-    approach.</li>
-  <li>Machines were extensively used in the attacks. First the Polish "Bombe"
-    for attacking Enigma, then British versions of it, then machines such as
-    Collosus for attacking other codes. By the end of the war, some of these
-    machines were beginning to closely resemble digital computers. After the
-    war, a team at Manchester University, several old Ultra hands included,
-    built one of the world's first actual general-purpose digital
-  computers.</li>
-  <li>Ultra made codebreaking a large-scale enterprise, producing
-    intelligence on an industrial scale. This was not a "black chamber", not
-    a hidden room in some obscure government building with a small crew of
-    code-breakers. The whole operation -- from wholesale interception of
-    enemy communications by stations around the world, through large-scale
-    code-breaking and analysis of the decrypted material (with an enormous
-    set of files for cross-referencing), to delivery of intelligence to field
-    commanders -- was huge, and very carefully managed.</li>
-</ul>
-
-<p>So by the end of the war, Allied code-breakers were expert at large-scale
-mechanised code-breaking. The payoffs were enormous.</p>
-
-<h4><a name="postwar">Postwar and Cold War</a></h4>
-
-<p>The wartime innovations were enthusiastically adopted by post-war and Cold
-War signals intelligence agencies. Presumably many nations now have some
-agency capable of sophisticated attacks on communications security, and quite
-a few engage in such activity on a large scale.</p>
-
-<p>America's <a href="glossary.html#NSA">NSA</a>, for example, is said to be
-both the world's largest employer of mathematicians and the world's largest
-purchaser of computer equipment. Such claims may be somewhat exaggerated, but
-beyond doubt the NSA -- and similar agencies in other countries -- have some
-excellent mathematicians, lots of powerful computers, sophisticated software,
-and the organisation and funding to apply them on a large scale. Details of
-the NSA budget are secret, but there are some published <a
-href="http://www.fas.org/irp/nsa/nsabudget.html">estimates</a>.</p>
-
-<p>Changes in the world's communications systems since WW II have provided
-these agencies with new targets. Cracking the codes used on an enemy's
-military or diplomatic communications has been common practice for centuries.
-Extensive use of radio in war made large-scale attacks such as Ultra
-possible. Modern communications make it possible to go far beyond that.
-Consider listening in on cell phones, or intercepting electronic mail, or
-tapping into the huge volumes of data on new media such as fiber optics or
-satellite links. None of these targets existed in 1950. All of them can be
-attacked today, and almost certainly are being attacked.</p>
-
-<p>The Ultra story was not made public until the 1970s. Much of the recent
-history of codes and code-breaking has not been made public, and some of it
-may never be. Two important books are:</p>
-<ul>
-  <li>Bamford's <a href="biblio.html#puzzle">The Puzzle Palace</a>, a history
-    of the NSA</li>
-  <li>Hager's <a href="http://www.fas.org/irp/eprint/sp/index.html">Secret
-    Power</a>, about the <a
-    href="http://sg.yahoo.com/government/intelligence/echelon_network/">Echelon</a>
-    system -- the US, UK, Canada, Australia and New Zealand co-operating to
-    monitor much of the world's communications.</li>
-</ul>
-
-<p>Note that these books cover only part of what is actually going on, and
-then only the activities of nations open and democratic enough that (some of)
-what they are doing can be discovered. A full picture, including:</p>
-<ul>
-  <li>actions of the English-speaking democracies not covered in those
-  books</li>
-  <li>actions of other more-or-less sane governments</li>
-  <li>the activities of various more-or-less insane governments</li>
-  <li>possibilities for unauthorized action by government employees</li>
-  <li>possible actions by large non-government organisations: corporations,
-    criminals, or conspiracies</li>
-</ul>
-
-<p>might be really frightening.</p>
-
-<h4><a name="recent">Recent history -- the crypto wars</a></h4>
-
-<p>Until quite recently, cryptography was primarily a concern of governments,
-especially of the military, of spies, and of diplomats. Much of it was
-extremely secret.</p>
-
-<p>In recent years, that has changed a great deal. With computers and
-networking becoming ubiquitous, cryptography is now important to almost
-everyone. Among the developments since the 1970s:</p>
-<ul>
-  <li>The US gov't established the Data Encryption Standard, <a
-    href="glossary.html#DES">DES</a>, a <a href="glossary.html#block">block
-    cipher</a> for cryptographic protection of unclassfied documents.</li>
-  <li>DES also became widely used in industry, especially regulated
-    industries such as banking.</li>
-  <li>Other nations produced their own standards, such as <a
-    href="glossary.html#GOST">GOST</a> in the Soviet Union.</li>
-  <li><a href="glossary.html#public">Public key</a> cryptography was invented
-    by Diffie and Hellman.</li>
-  <li>Academic conferences such as <a
-    href="http://www-cse.ucsd.edu/users/mihir/crypto2k.html">Crypto</a> and
-    <a
-    href="http://www.esat.kuleuven.ac.be/cosic/eurocrypt2000/">Eurocrypt</a>
-    began.</li>
-  <li>Several companies began offerring cryptographic products: <a
-    href="glossary.html#RSAco">RSA</a>, <a href="glossary.html#PGPI">PGP</a>,
-    the many vendors with <a href="glossary.html#PKI">PKI</a> products,
-  ...</li>
-  <li>Cryptography appeared in other products: operating systems, word
-    processors, ...</li>
-  <li>Network protocols based on crypto were developed:  <a
-    href="glossary.html#SSH">SSH</a>, <a href="glossary.html#SSL">SSL</a>, <a
-    href="glossary.html#IPsec">IPsec</a>, ...</li>
-  <li>Crytography came into widespread use to secure bank cards, terminals,
-    ...</li>
-  <li>The US government replaced <a href="glossary.html#DES">DES</a> with the
-    much stronger Advanced Encryption Standard, <a
-    href="glossary.html#AES">AES</a></li>
-</ul>
-
-<p>This has led to a complex ongoing battle between various mainly government
-groups wanting to control the spread of crypto and various others, notably
-the computer industry and the <a
-href="http://online.offshore.com.ai/security/">cypherpunk</a> crypto
-advocates, wanting to encourage widespread use.</p>
-
-<p>Steven Levy has written a fine history of much of this, called <a
-href="biblio.html#crypto">Crypto: How the Code rebels Beat the Government --
-Saving Privacy in the Digital Age</a>.</p>
-
-<p>The FreeS/WAN project is to a large extent an outgrowth of cypherpunk
-ideas. Our reasons for doing the project can be seen in these quotes from the
-<a
-href="http://www.eff.org/pub/Privacy/Crypto_misc/cypherpunk.manifesto">Cypherpunk
-Manifesto</a>:</p>
-
-<blockquote>
-  Privacy is necessary for an open society in the electronic age. ...
-
-  <p>We cannot expect governments, corporations, or other large, faceless
-  organizations to grant us privacy out of their beneficence.  It is to their
-  advantage to speak of us, and  we should expect that they will speak.
-  ...</p>
-
-  <p>We must defend our own privacy if we expect to have any. ...</p>
-
-  <p>Cypherpunks write code.  We know that someone has to write software to
-  defend privacy, and since we can't get privacy unless we all do, we're
-  going to write it. We publish our code so that our fellow Cypherpunks may
-  practice and play with it. Our code is free for all to use, worldwide.  We
-  don't much care if you don't approve of the software we write.  We know
-  that software can't be destroyed and that a widely dispersed system can't
-  be shut down.</p>
-
-  <p>Cypherpunks deplore regulations on cryptography, for encryption is
-  fundamentally a private act. ...</p>
-
-  <p>For privacy to be widespread it must be part of a social contract.
-  People must come and together deploy these systems for the common good.
-  ...</p>
-</blockquote>
-
-<p>To quote project leader John Gilmore:</p>
-
-<blockquote>
-  We are literally in a race between our ability to build and deploy
-  technology, and their ability to build and deploy laws and treaties.
-  Neither side is likely to back down or wise up until it has definitively
-  lost the race.</blockquote>
-
-<p>If FreeS/WAN reaches its goal of making <a
-href="intro.html#opp.intro">opportunistic encryption</a> widespread so that
-secure communication can become the default for a large part of the net, we
-will have struck a major blow.</p>
-
-<h3><a name="intro.poli">Politics</a></h3>
-
-<p>The political problem is that nearly all governments want to monitor their
-enemies' communications, and some want to monitor their citizens. They may be
-very interested in protecting some of their own communications, and often
-some types of business communication, but not in having everyone able to
-communicate securely. They therefore attempt to restrict availability of
-strong cryptography as much as possible.</p>
-
-<p>Things various governments have tried or are trying include:</p>
-<ul>
-  <li>Echelon, a monitor-the-world project of the US, UK, NZ, Australian and
-    Canadian <a href="glossary.html#SIGINT">signals intelligence</a>
-    agencies. See this <a
-    href="http://sg.yahoo.com/government/intelligence/echelon_network/">collection</a>
-    of links and this <a
-    href="http://www.zdnet.com/zdnn/stories/news/0,4586,2640682,00.html">story</a>
-    on the French Parliament's reaction.</li>
-  <li>Others governments may well have their own Echelon-like projects. To
-    quote the Dutch Minister of Defense, as reported in a German <a
-    href="http://www.heise.de/tp/english/inhalt/te/4729/1.html">magazine</a>:
-
-    <blockquote>
-      The government believes not only the governments associated with
-      Echelon are able to intercept communication systems, but that it is an
-      activity of the investigative authorities and intelligence services of
-      many countries with governments of different political
-    signature.</blockquote>
-    Even if they have nothing on the scale of Echelon, most intelligence
-    agencies and police forces certainly have some interception
-  capability.</li>
-  <li><a href="glossary.html#NSA">NSA</a> tapping of submarine communication
-    cables, described in <a
-    href="http://www.zdnet.com/zdnn/stories/news/0,4586,2764372,00.html">this
-    article</a></li>
-  <li>A proposal for international co-operation on <a
-    href="http://www.heise.de/tp/english/special/enfo/4306/1.html">Internet
-    surveillance</a>.</li>
-  <li>Alleged <a href="http://cryptome.org/nsa-sabotage.htm">sabotage</a> of
-    security products by the <a href="glossary.html#NSA">NSA</a> (the US
-    signals intelligence agency).</li>
-  <li>The German armed forces and some government departments will stop using
-    American software for fear of NSA "back doors", according to this <a
-    href="http://www.theregister.co.uk/content/4/17679.html">news
-  story</a>.</li>
-  <li>The British Regulation of Investigatory Powers bill. See this <a
-    href="http://www.fipr.org/rip/index.html">web page.</a> and perhaps this
-    <a
-    href="http://ars.userfriendly.org/cartoons/?id=20000806&amp;mode=classic">cartoon</a>.</li>
-  <li>A Russian <a
-    href="http://www.eff.org/pub/Privacy/Foreign_and_local/Russia/russian_crypto_ban_english.edict">ban</a>
-    on cryptography</li>
-  <li>Chinese <a
-    href="http://www.eff.org/pub/Misc/Publications/Declan_McCullagh/www/global/china">controls</a>
-    on net use.</li>
-  <li>The FBI's carnivore system for covert searches of email. See this <a
-    href="http://www.zdnet.com/zdnn/stories/news/0,4586,2601502,00.html">news
-    coverage</a> and this <a
-    href="http://www.crypto.com/papers/carnivore-risks.html">risk
-    assessment</a>. The government had an external review of some aspects of
-    this system done. See this <a
-    href="http://www.crypto.com/papers/carnivore_report_comments.html">analysis</a>
-    of that review. Possible defenses against Carnivore include:
-    <ul>
-      <li><a href="glossary.html#PGP">PGP</a> for end-to-end mail
-      encryption</li>
-      <li><a href="http://www.home.aone.net.au/qualcomm/">secure sendmail</a>
-        for server-to-server encryption</li>
-      <li>IPsec encryption on the underlying IP network</li>
-    </ul>
-  </li>
-  <li>export laws restricting strong cryptography as a munition. See <a
-    href="#exlaw">discussion</a> below.</li>
-  <li>various attempts to convince people that fundamentally flawed
-    cryptography, such as encryption with a <a href="#escrow">back door</a>
-    for government access to data or with <a href="#shortkeys">inadequate key
-    lengths</a>, was adequate for their needs.</li>
-</ul>
-
-<p>Of course governments are by no means the only threat to privacy and
-security on the net. Other threats include:</p>
-<ul>
-  <li>industrial espionage, as for example in this <a
-    href="http://www.zdnet.com/zdnn/stories/news/0,4586,2626931,00.html">news
-    story</a></li>
-  <li>attacks by organised criminals, as in this <a
-    href="http://www.sans.org/newlook/alerts/NTE-bank.htm">large-scale
-    attack</a></li>
-  <li>collection of personal data by various companies.
-    <ul>
-      <li>for example, consider the various corporate winners of Privacy
-        International's <a
-        href="http://www.privacyinternational.org/bigbrother/">Big Brother
-        Awards</a>.</li>
-      <li><a href="http://www.zeroknowledge.com">Zero Knowledge</a> sell
-        tools to defend against this</li>
-    </ul>
-  </li>
-  <li>individuals may also be a threat in a variety of ways and for a variety
-    of reasons</li>
-  <li>in particular, an individual with access to government or industry data
-    collections could do considerable damage using that data in unauthorized
-    ways.</li>
-</ul>
-
-<p>One <a
-href="http://www.zdnet.com/zdnn/stories/news/0,4586,2640674,00.html">study</a>
-enumerates threats and possible responses for small and medium businesses.
-VPNs are a key part of the suggested strategy.</p>
-
-<p>We consider privacy a human right. See the UN's <a href="http://www.un.org/Overview/rights.html">Universal
-Declaration of Human Rights</a>, article twelve:</p>
-
-<blockquote>
-  No one shall be subjected to arbitrary interference with his privacy,
-  family, home or correspondence, nor to attacks upon his honor and
-  reputation. Everyone has the right to the protection of the law against
-  such interference or attacks.</blockquote>
-
-<p>Our objective is to help make privacy possible on the Internet using
-cryptography strong enough not even those well-funded government agencies are
-likely to break it. If we can do that, the chances of anyone else breaking it
-are negliible.</p>
-
-<h3>Links</h3>
-
-<p>Many groups are working in different ways to defend privacy on the net and
-elsewhere. Please consider contributing to one or more of these groups:</p>
-<ul>
-  <li>the EFF's <a href="http://www.eff.org/crypto/">Privacy Now!</a>
-  campaign</li>
-  <li>the <a href="http://www.gilc.org">Global Internet Liberty
-  Campaign</a></li>
-  <li><a href="http://www.cpsr.org/program/privacy/privacy.html">Computer
-    Professionals for Social Responsibility</a></li>
-</ul>
-
-<p>For more on these issues see:</p>
-<ul>
-  <li>Steven Levy (Newsweek's chief technology writer and author of the
-    classic "Hackers") new book <a href="biblio.html#crypto">Crypto: How the
-    Code Rebels Beat the Government--Saving Privacy in the Digital
-  Age</a></li>
-  <li>Simson Garfinkel (Boston Globe columnist and author of books on <a
-    href="biblio.html#PGP">PGP</a> and <a href="biblio.html#practical">Unix
-    Security</a>) book <a href="biblio.html#Garfinkel">Database Nation: the
-    death of privacy in the 21st century</a></li>
-</ul>
-
-<p>There are several collections of <a href="web.html#quotes">crypto
-quotes</a> on the net.</p>
-
-<p>See also the <a href="biblio.html">bibliography</a> and our list of <a
-href="web.html#policy">web references</a> on cryptography law and policy.</p>
-
-<h3>Outline of this section</h3>
-
-<p>The remainder of this section includes two pieces of writing by our
-project leader</p>
-<ul>
-  <li>his <a href="#gilmore">rationale</a> for starting this</li>
-  <li>another <a href="#policestate">discussion</a> of project goals</li>
-</ul>
-
-<p>and discussions of:</p>
-<ul>
-  <li><a href="#desnotsecure">why we do not use DES</a></li>
-  <li><a href="#exlaw">cryptography export laws</a></li>
-  <li>why <a href="#escrow">government access to keys</a> is not a good
-  idea</li>
-  <li>the myth that <a href="#shortkeys">short keys</a> are adequate for some
-    security requirements</li>
-</ul>
-
-<p>and a section on <a href="#press">press coverage of FreeS/WAN</a>.</p>
-
-<h2><a name="leader">From our project leader</a></h2>
-
-<p>FreeS/WAN project founder John Gilmore wrote a web page about why we are
-doing this. The version below is slightly edited, to fit this format and to
-update some links. For a version without these edits, see his <a
-href="http://www.toad.com/gnu/">home page</a>.</p>
-
-<center>
-<h3><a name="gilmore">Swan: Securing the Internet against Wiretapping</a></h3>
-</center>
-
-<p>My project for 1996 was to <b>secure 5% of the Internet traffic against
-passive wiretapping</b>. It didn't happen in 1996, so I'm still working on it
-in 1997, 1998, and 1999! If we get 5% in 1999 or 2000, we can secure 20% the
-next year, against both active and passive attacks; and 80% the following
-year.  Soon the whole Internet will be private and secure. The project is
-called S/WAN or S/Wan or Swan for Secure Wide Area Network; since it's free
-software, we call it FreeSwan to distinguish it from various commercial
-implementations. <a href="http://www.rsa.com/rsa/SWAN/">RSA</a> came up with
-the term "S/WAN". Our main web site is at <a
-href="http://www.freeswan.org/">http://www.freeswan.org/</a>. Want to
-help?</p>
-
-<p>The idea is to deploy PC-based boxes that will sit between your local area
-network and the Internet (near your firewall or router) which
-opportunistically encrypt your Internet packets.  Whenever you talk to a
-machine (like a Web site) that doesn't support encryption, your traffic goes
-out "in the clear" as usual.  Whenever you connect to a machine that does
-support this kind of encryption, this box automatically encrypts all your
-packets, and decrypts the ones that come in.  In effect, each packet gets put
-into an "envelope" on one side of the net, and removed from the envelope when
-it reaches its destination.  This works for all kinds of Internet traffic,
-including Web access, Telnet, FTP, email, IRC, Usenet, etc.</p>
-
-<p>The encryption boxes are standard PC's that use freely available Linux
-software that you can download over the Internet or install from a cheap
-CDROM.</p>
-
-<p>This wasn't just my idea; lots of people have been working on it for
-years. The encryption protocols for these boxes are called <a
-href="glossary.html#IPsec">IPSEC (IP Security)</a>. They have been developed
-by the <a
-href="http://www.ietf.cnri.reston.va.us/html.charters/ipsec-charter.html">IP
-Security Working Group</a> of the <a href="http://www.ietf.org/">Internet
-Engineering Task Force</a>, and will be a standard part of the next major
-version of the Internet protocols (<a
-href="http://playground.sun.com/pub/ipng/html/ipng-main.html">IPv6</a>). For
-today's (IP version 4) Internet, they are an option.</p>
-
-<p>The <a href="http://www.iab.org/iab">Internet Architecture Board</a> and
-<a href="http://www.ietf.org/">Internet Engineering Steering Group</a> have
-taken a <a href="iab-iesg.stmt">strong stand</a> that the Internet should use
-powerful encryption to provide security and privacy.  I think these protocols
-are the best chance to do that, because they can be deployed very easily,
-without changing your hardware or software or retraining your users. They
-offer the best security we know how to build, using the Triple-DES, RSA, and
-Diffie-Hellman algorithms.</p>
-
-<p>This "opportunistic encryption box" offers the "fax effect".  As each
-person installs one for their own use, it becomes more valuable for their
-neighbors to install one too, because there's one more person to use it with.
-The software automatically notices each newly installed box, and doesn't
-require a network administrator to reconfigure it.  Instead of "virtual
-private networks" we have a "REAL private network"; we add privacy to the
-real network instead of layering a manually-maintained virtual network on top
-of an insecure Internet.</p>
-
-<h4>Deployment of IPSEC</h4>
-
-<p>The US government would like to control the deployment of IP Security with
-its <a href="#exlaw">crypto export laws</a>. This isn't a problem for my
-effort, because the cryptographic work is happening outside the United
-States. A foreign philanthropist, and others, have donated the resources
-required to add these protocols to the Linux operating system. <a
-href="http://www.linux.org/">Linux</a> is a complete, freely available
-operating system for IBM PC's and several kinds of workstation, which is
-compatible with Unix.  It was written by Linus Torvalds, and is still
-maintained by a talented team of expert programmers working all over the
-world and coordinating over the Internet.  Linux is distributed under the <a
-href="glossary.html#GPL">GNU Public License</a>, which gives everyone the
-right to copy it, improve it, give it to their friends, sell it commercially,
-or do just about anything else with it, without paying anyone for the
-privilege.</p>
-
-<p>Organizations that want to secure their network will be able to put two
-Ethernet cards into an IBM PC, install Linux on it from a $30 CDROM or by
-downloading it over the net, and plug it in between their Ethernet and their
-Internet link or firewall. That's all they'll have to do to encrypt their
-Internet traffic everywhere outside their own local area network.</p>
-
-<p>Travelers will be able to run Linux on their laptops, to secure their
-connection back to their home network (and to everywhere else that they
-connect to, such as customer sites). Anyone who runs Linux on a standalone PC
-will also be able to secure their network connections, without changing their
-application software or how they operate their computer from day to day.</p>
-
-<p>There will also be numerous commercially available firewalls that use this
-technology. <a href="http://www.rsa.com/">RSA Data Security</a> is
-coordinating the <a href="http://www.rsa.com/rsa/SWAN">S/Wan (Secure Wide
-Area Network)</a> project among more than a dozen vendors who use these
-protocols. There's a <a
-href="http://www.rsa.com/rsa/SWAN/swan_test.htm">compatability chart</a> that
-shows which vendors have tested their boxes against which other vendors to
-guarantee interoperatility.</p>
-
-<p>Eventually it will also move into the operating systems and networking
-protocol stacks of major vendors.  This will probably take longer, because
-those vendors will have to figure out what they want to do about the export
-controls.</p>
-
-<h4>Current status</h4>
-
-<p>My initial goal of securing 5% of the net by Christmas '96 was not met. It
-was an ambitious goal, and inspired me and others to work hard, but was
-ultimately too ambitious.  The protocols were in an early stage of
-development, and needed a lot more protocol design before they could be
-implemented.  As of April 1999, we have released version 1.0 of the software
-(<a
-href="ftp://ftp.xs4all.nl/freeswan/freeswan-1.0.tar.gz">freeswan-1.0.tar.gz</a>),
-which is suitable for setting up Virtual Private Networks using shared
-secrets for authentication.  It does not yet do opportunistic encryption, or
-use DNSSEC for authentication; those features are coming in a future
-release.</p>
-<dl>
-  <dt>Protocols</dt>
-    <dd>The low-level encrypted packet formats are defined.  The system for
-      publishing keys and providing secure domain name service is defined.
-      The IP Security working group has settled on an NSA-sponsored protocol
-      for key agreement (called ISAKMP/Oakley), but it is still being worked
-      on, as the protocol and its documentation is too complex and
-      incomplete. There are prototype implementations of ISAKMP.  The
-      protocol is not yet defined to enable opportunistic encryption or the
-      use of DNSSEC keys.</dd>
-  <dt>Linux Implementation</dt>
-    <dd>The Linux implementation has reached its first major release and is
-      ready for production use in manually-configured networks, using Linux
-      kernel version 2.0.36.</dd>
-  <dt>Domain Name System Security</dt>
-    <dd>There is now a release of BIND 8.2 that includes most DNS Security
-      features.
-      <p>The first prototype implementation of Domain Name System Security
-      was funded by <a href="glossary.html#DARPA">DARPA</a> as part of their
-      <a href="http://www.darpa.mil/ito/research/is/index.html">Information
-      Survivability program</a>. <a href="http://www.tis.com">Trusted
-      Information Systems</a> wrote a modified version of <a
-      href="http://www.isc.org/bind.html">BIND</a>, the widely-used Berkeley
-      implementation of the Domain Name System.</p>
-      <p>TIS, ISC, and I merged the prototype into the standard version of
-      BIND. The first production version that supports KEY and SIG records is
-      <b>bind-4.9.5</b>. This or any later version of BIND will do for
-      publishing keys.  It is available from the <a
-      href="http://www.isc.org/bind.html">Internet Software Consortium</a>.
-      This version of BIND is not export-controlled since it does not contain
-      any cryptography.  Later releases starting with BIND 8.2 include
-      cryptography for authenticating DNS records, which is also exportable.
-      Better documentation is needed.</p>
-    </dd>
-</dl>
-
-<h4>Why?</h4>
-
-<p>Because I can.  I have made enough money from several successful startup
-companies, that for a while I don't have to work to support myself. I spend
-my energies and money creating the kind of world that I'd like to live in and
-that I'd like my (future) kids to live in. Keeping and improving on the civil
-rights we have in the United States, as we move more of our lives into
-cyberspace, is a particular goal of mine.</p>
-
-<h4>What You Can Do</h4>
-<dl>
-  <dt>Install the latest BIND at your site.</dt>
-    <dd>You won't be able to publish any keys for your domain, until you have
-      upgraded your copy of BIND.  The thing you really need from it is the
-      new version of <i>named</i>, the Name Daemon, which knows about the new
-      KEY and SIG record types.  So, download it from the <a
-      href="http://www.isc.org/bind.html">Internet Software Consortium </a>
-      and install it on your name server machine (or get your system
-      administrator, or Internet Service Provider, to install it).  Both your
-      primary DNS site and all of your secondary DNS sites will need the new
-      release before you will be able to publish your keys.  You can tell
-      which sites this is by running the Unix command "dig MYDOMAIN ns" and
-      seeing which sites are mentioned in your NS (name server) records.</dd>
-  <dt>Set up a Linux system and run a 2.0.x kernel on it</dt>
-    <dd>Get a machine running Linux (say the 5.2 release from <a
-      href="http://www.redhat.com">Red Hat</a>). Give the machine two
-      Ethernet cards.</dd>
-  <dt>Install the Linux IPSEC (Freeswan) software</dt>
-    <dd>If you're an experienced sysadmin or Linux hacker, install the
-      freeswan-1.0 release, or any later release or snapshot. These releases
-      do NOT provide automated "opportunistic" operation; they must be
-      manually configured for each site you wish to encrypt with.</dd>
-  <dt>Get on the linux-ipsec mailing list</dt>
-    <dd>The discussion forum for people working on the project, and testing
-      the code and documentation, is: linux-ipsec@clinet.fi. To join this
-      mailing list, send email to <a
-      href="mailto:linux-ipsec-REQUEST@clinet.fi">linux-ipsec-REQUEST@clinet.fi</a>
-      containing a line of text that says "subscribe linux-ipsec". (You can
-      later get off the mailing list the same way -- just send "unsubscribe
-      linux-ipsec").</dd>
-
-  <p></p>
-  <dt>Check back at this web page every once in a while</dt>
-    <dd>I update this page periodically, and there may be new information in
-      it that you haven't seen.  My intent is to send email to the mailing
-      list when I update the page in any significant way, so subscribing to
-      the list is an alternative.</dd>
-</dl>
-
-<p>Would you like to help?  I can use people who are willing to write
-documentation, install early releases for testing, write cryptographic code
-outside the United States, sell pre-packaged software or systems including
-this technology, and teach classes for network administrators who want to
-install this technology. To offer to help, send me email at gnu@toad.com.
-Tell me what country you live in and what your citizenship is (it matters due
-to the export control laws; personally I don't care).  Include a copy of your
-resume and the URL of your home page.  Describe what you'd like to do for the
-project, and what you're uniquely qualified for.  Mention what other
-volunteer projects you've been involved in (and how they worked out). Helping
-out will require that you be able to commit to doing particular things, meet
-your commitments, and be responsive by email.  Volunteer projects just don't
-work without those things.</p>
-
-<h4>Related projects</h4>
-<dl>
-  <dt>IPSEC for NetBSD</dt>
-    <dd>This prototype implementation of the IP Security protocols is for
-      another free operating system. <a
-      href="ftp://ftp.funet.fi/pub/unix/security/net/ip/BSDipsec.tar.gz">Download
-      BSDipsec.tar.gz</a>.</dd>
-  <dt>IPSEC for <a href="http://www.openbsd.org">OpenBSD</a></dt>
-    <dd>This prototype implementation of the IP Security protocols is for yet
-      another free operating system.  It is directly integrated into the OS
-      release, since the OS is maintained in Canada, which has freedom of
-      speech in software.</dd>
-</dl>
-
-<h3><a name="policestate">Stopping wholesale monitoring</a></h3>
-
-<p>From a message project leader John Gilmore posted to the mailing list:</p>
-<pre>John Denker wrote:
-
-&gt; Indeed there are several ways in which the documentation overstates the 
-&gt; scope of what this project does -- starting with the name 
-&gt; FreeS/WAN.  There's a big difference between having an encrypted IP tunnel 
-&gt; versus having a Secure Wide-Area Network.  This software does a fine job of 
-&gt; the former, which is necessary but not sufficient for the latter.
-
-The goal of the project is to make it very hard to tap your wide area
-communications.  The current system provides very good protection
-against passive attacks (wiretapping and those big antenna farms).
-Active attacks, which involve the intruder sending packets to your
-system (like packets that break into sendmail and give them a root
-shell :-) are much harder to guard against.  Active attacks that
-involve sending people (breaking into your house and replacing parts
-of your computer with ones that transmit what you're doing) are also
-much harder to guard against.  Though we are putting effort into
-protecting against active attacks, it's a much bigger job than merely
-providing strong encryption.  It involves general computer security,
-and general physical security, which are two very expensive problems
-for even a site to solve, let alone to build into a whole society.
-
-The societal benefit of building an infrastructure that protects
-well against passive attacks is that it makes it much harder to do
-undetected bulk monitoring of the population.  It's a defense against
-police-states, not against policemen.
-
-Policemen can put in the effort required to actively attack sites that
-they have strong suspicions about.  But police states won't be able to
-build systems that automatically monitor everyone's communications.
-Either they will be able to monitor only a small subset of the
-populace (by targeting those who screwed up their passive security),
-or their monitoring activities will be detectable by those monitored
-(active attacks leave packet traces or footprints), which can then be
-addressed through the press and through political means if they become
-too widespread.
-
-FreeS/WAN does not protect very well against traffic analysis, which
-is a kind of widespread police-state style monitoring that still
-reveals significant information (who's talking to who) without
-revealing the contents of what was said.  Defenses against traffic
-analysis are an open research problem.  Zero Knowledge Systems is
-actively deploying a system designed to thwart it, designed by Ian
-Goldberg.  The jury is out on whether it actually works; a lot more
-experience with it will be needed.</pre>
-
-<p>Notes on things mentioned in that message:</p>
-<ul>
-  <li>Denker is a co-author of a <a href="intro.html#applied">paper</a> on a
-    large FreeS/WAN application.</li>
-  <li>Information on Zero Knowledge is on their <a
-    href="http://www.zks.net/">web site</a>. Their Freedom product, designed
-    to provide untracable pseudonyms for use on the net, is no longer
-    marketed.</li>
-  <li>Another section of our documentation discusses ways to <a
-    href="ipsec.html#traffic.resist">resist traffic analysis</a>.</li>
-</ul>
-
-<h2><a name="weak">Government promotion of weak crypto</a></h2>
-
-<p>Various groups, especially governments and especially the US government,
-have a long history of advocating various forms of bogus security.</p>
-
-<p>We regard bogus security as extremely dangerous. If users are deceived
-into relying on bogus security, then they may be exposed to large risks. They
-would be better off having no security and knowing it. At least then they
-would be careful about what they said.</p>
-
-<p><strong>Avoiding bogus security is a key design criterion for everything
-we do in FreeS/WAN</strong>. The most conspicuous example is our refusal to
-support <a href="#desnotsecure">single DES</a>. Other IPsec "features" which
-we do not implement are discussed in our <a
-href="compat.html#dropped">compatibility</a> document.</p>
-
-<h3><a name="escrow">Escrowed encryption</a></h3>
-
-<p>Various governments have made persistent attempts to encourage or mandate
-"escrowed encrytion", also called "key recovery", or GAK for "government
-access to keys". The idea is that cryptographic keys be held by some third
-party and turned over to law enforcement or security agencies under some
-conditions.</p>
-<pre>  Mary had a little key - she kept it in escrow,
-  and every thing that Mary said,
-  the feds were sure to know.</pre>
-
-<p>A <a href="web.html#quotes">crypto quotes</a> page attributes this to <a
-href="http://www.scramdisk.clara.net/">Sam Simpson</a>.</p>
-
-<p>There is an excellent paper available on <a
-href="http://www.cdt.org/crypto/risks98/">Risks of Escrowed Encryption</a>,
-from a group of cryptographic luminaries which included our project
-leader.</p>
-
-<p>Like any unnecessary complication, GAK tends to weaken security of any
-design it infects. For example:</p>
-<ul>
-  <li>Matt Blaze found a fatal flaw in the US government's Clipper chip
-    shortly after design information became public. See his paper "Protocol
-    Failure in the Escrowed Encryption Standard" on his <a
-    href="http://www.crypto.com/papers/">papers</a> page.</li>
-  <li>a rather <a href="http://www.pgp.com/other/advisories/adk.asp">nasty
-    bug</a> was found in the "additional decryption keys" "feature" of some
-    releases of <a href="glossary.html#PGP">PGP</a></li>
-</ul>
-
-<p>FreeS/WAN does not support escrowed encryption, and never will.</p>
-
-<h3><a name="shortkeys">Limited key lengths</a></h3>
-
-<p>Various governments, and some vendors, have also made persistent attempts
-to convince people that:</p>
-<ul>
-  <li>weak systems are sufficient for some data</li>
-  <li>strong cryptography should be reserved for cases where the extra
-    overheads are justified</li>
-</ul>
-
-<p><strong>This is utter nonsense</strong>.</p>
-
-<p>Weak systems touted include:</p>
-<ul>
-  <li>the ludicrously weak (deliberately crippled) 40-bit ciphers that until
-    recently were all various <a href="#exlaw">export laws</a> allowed</li>
-  <li>56-bit single DES, discussed <a href="#desnotsecure">below</a></li>
-  <li>64-bit symmetric ciphers and 512-bit RSA, the maximums for unrestricted
-    export under various current laws</li>
-</ul>
-
-<p>The notion that choice of ciphers or keysize should be determined by a
-trade-off between security requirements and overheads is pure bafflegab.</p>
-<ul>
-  <li>For most <a href="glossary.html#symmetric">symmetric ciphers</a>, it is
-    simply a lie. Any block cipher has some natural maximum keysize inherent
-    in the design -- 128 bits for <a href="glossary.html#IDEA">IDEA</a> or <a
-    href="glossary.html#CAST128">CAST-128</a>, 256 for Serpent or Twofish,
-    448 for <a href="glossary.html#Blowfish">Blowfish</a> and 2048 for <a
-    href="glossary.html#RC4">RC4</a>. Using a key size smaller than that
-    limit gives <em>exactly zero </em>savings in overhead. The crippled
-    40-bit or 64-bit version of the cipher provides <em>no advantage
-    whatsoever</em>.</li>
-  <li><a href="glossary.html#AES">AES</a> uses 10 rounds with 128-bit keys,
-    12 rounds for 192-bit and 14 rounds for 256-bit, so there actually is a
-    small difference in overhead, but not enough to matter in most
-    applications.</li>
-  <li>For <a href="glossary.html#3DES">triple DES</a> there is a grain of
-    truth in the argument. 3DES is indeed three times slower than single DES.
-    However, the solution is not to use the insecure single DES, but to pick
-    a faster secure cipher. <a href="glossary.html#CAST128">CAST-128</a>, <a
-    href="glossary.html#Blowfish">Blowfish</a> and the <a
-    href="glossary.html#AES">AES candidate</a> ciphers are are all
-    considerably faster in software than DES (let alone 3DES!), and
-    apparently secure.</li>
-  <li>For <a href="glossary.html#public">public key</a> techniques, there are
-    extra overheads for larger keys, but they generally do not affect overall
-    performance significantly. Practical public key applications are usually
-    <a href="glossary.html#hybrid">hybrid</a> systems in which the bulk of
-    the work is done by a symmetric cipher. The effect of increasing the cost
-    of the public key operations is typically negligible because the public
-    key operations use only a tiny fraction of total resources.
-    <p>For example, suppose public key operations use use 1% of the time in a
-    hybrid system and you triple the cost of public key operations. The cost
-    of symmetric cipher operations is unchanged at 99% of the original total
-    cost, so the overall effect is a jump from 99 + 1 = 100 to 99 + 3 = 102,
-    a 2% rise in system cost.</p>
-  </li>
-</ul>
-
-<p>In short, <strong>there has never been any technical reason to use
-inadequate ciphers</strong>. The only reason there has ever been for anyone
-to use such ciphers is that government agencies want weak ciphers used so
-that they can crack them. The alleged savings are simply propaganda.</p>
-<pre>   Mary had a little key (It's all she could export),
-   and all the email that she sent was opened at the Fort.</pre>
-
-<p>A <a href="web.html#quotes">crypto quotes</a> page attributes this to <a
-href="http://theory.lcs.mit.edu:80/~rivest/">Ron Rivest</a>. NSA headquarters
-is at Fort Meade, Maryland.</p>
-
-<p>Our policy in FreeS/WAN is to use only cryptographic components with
-adequate keylength and no known weaknesses.</p>
-<ul>
-  <li>We do not implement single DES because it is clearly <a
-    href="#desnotsecure">insecure</a>, so implemeting it would violate our
-    policy of avoiding bogus security. Our default cipher is <a
-    href="glossary.html#3DES">3DES</a></li>
-  <li>Similarly, we do not implement the 768-bit Group 1 for <a
-    href="glossary.html#DH">Diffie-Hellman</a> key negotiation. We provide
-    only the 1024-bit Group 2 and 1536-bit Group 5.</li>
-</ul>
-
-<p>Detailed discussion of which IPsec features we implement or omit is in out
-<a href="compat.html">compatibility document</a>.</p>
-
-<p>These decisions imply that we cannot fully conform to the IPsec RFCs,
-since those have DES as the only required cipher and Group 1 as the only
-required DH group. (In our view, the standards were subverted into offerring
-bogus security.) Fortunately, we can still interoperate with most other IPsec
-implementations since nearly all implementers provide at least 3DES and Group
-2 as well.</p>
-
-<p>We hope that eventually the RFCs will catch up with our (and others')
-current practice and reject dubious components. Some of our team and a number
-of others are working on this in <a href="glossary.html#IETF">IETF</a>
-working groups.</p>
-
-<h4>Some real trade-offs</h4>
-
-<p>Of course, making systems secure does involve costs, and trade-offs can be
-made between cost and security. However, the real trade-offs have nothing to
-do with using weaker ciphers.</p>
-
-<p>There can be substantial hardware and software costs. There are often
-substantial training costs, both to train administrators and to increase user
-awareness of security issues and procedures. There are almost always
-substantial staff or contracting costs.</p>
-
-<p>Security takes staff time for planning, implementation, testing and
-auditing. Some of the issues are subtle; you need good (hence often
-expensive) people for this. You also need people to monitor your systems and
-respond to problems. The best safe ever built is insecure if an attacker can
-work on it for days without anyone noticing. Any computer is insecure if the
-administrator is "too busy" to check the logs.</p>
-
-<p>Moreover, someone in your organisation (or on contract to it) needs to
-spend considerable time keeping up with new developments. EvilDoers
-<em>will</em> know about new attacks shortly after they are found. You need
-to know about them before your systems are attacked. If your vendor provides
-a patch, you need to apply it. If the vendor does nothing, you need to
-complain or start looking for another vendor.</p>
-
-<p>For a fairly awful example, see this <a
-href="http://www.sans.org/newlook/alerts/NTE-bank.htm">report</a>. In that
-case over a million credit card numbers were taken from e-commerce sites,
-using security flaws in Windows NT servers. Microsoft had long since released
-patches for most or all of the flaws, but the site administrators had not
-applied them.</p>
-
-<p>At an absolute minimum, you must do something about such issues
-<em>before</em> an exploitation tool is posted to the net for downloading by
-dozens of "script kiddies". Such a tool might appear at any time from the
-announcement of the security hole to several months later. Once it appears,
-anyone with a browser and an attitude can break any system whose
-administrators have done nothing about the flaw.</p>
-
-<p>Compared to those costs, cipher overheads are an insignificant factor in
-the cost of security.</p>
-
-<p>The only thing using a weak cipher can do for you is to cause all your
-other investment to be wasted.</p>
-
-<h2><a name="exlaw">Cryptography Export Laws</a></h2>
-
-<p>Many nations restrict the export of cryptography and some restrict its use
-by their citizens or others within their borders.</p>
-
-<h3><a name="USlaw">US Law</a></h3>
-
-<p>US laws, as currently interpreted by the US government, forbid export of
-most cryptographic software from the US in machine-readable form without
-government permission. In general, the restrictions apply even if the
-software is widely-disseminated or public-domain and even if it came from
-outside the US originally. Cryptography is legally a munition and export is
-tightly controlled under the <a href="glossary.html#EAR">EAR</a> Export
-Administration Regulations.</p>
-
-<p>If you are a US citizen, your brain is considered US territory no matter
-where it is physically located at the moment. The US believes that its laws
-apply to its citizens everywhere, not just within the US. Providing technical
-assistance or advice to foreign "munitions" projects is illegal. The US
-government has very little sense of humor about this issue and does not
-consider good intentions to be sufficient excuse. Beware.</p>
-
-<p>The <a href="http://www.bxa.doc.gov/Encryption/">official website</a> for
-these regulations is run by the Commerce Department's Bureau of Export
-Administration (BXA).</p>
-
-<p>The <a href="http://www.eff.org/bernstein/">Bernstein case</a> challenges
-the export restrictions on Constitutional grounds. Code is speech so
-restrictions on export of code violate the First Amendment's free speech
-provisions. This argument has succeeded in two levels of court so far. It is
-quite likely to go on to the Supreme Court.</p>
-
-<p>The regulations were changed substantially in January 2000, apparently as
-a government attempt to get off the hook in the Bernstein case. It is now
-legal to export public domain source code for encryption, provided you notify
-the <a href="glossary.html#BXA">BXA</a>.</p>
-
-<p>There are, however, still restrictions in force.
- Moreover, the regulations can still be changed again whenever the government
-chooses to do so. Short of a Supreme Court ruling (in the Berstein case or
-another) that overturns the regulations completely, the problem of export
-regulation is not likely to go away in the forseeable future.</p>
-
-<h4><a name="UScontrib">US contributions to FreeS/WAN</a></h4>
-
-<p>The FreeS/WAN project <strong>cannot accept software contributions, <em>
-not even small bug fixes</em>, from US citizens or residents</strong>. We
-want it to be absolutely clear that our distribution is not subject to US
-export law. Any contribution from an American might open that question to a
-debate we'd prefer to avoid. It might also put the contributor at serious
-legal risk.</p>
-
-<p>Of course Americans can still make valuable contributions (many already
-have) by reporting bugs, or otherwise contributing to discussions, on the
-project <a href="mail.html">mailing list</a>. Since the list is public, this
-is clearly constitutionally protected free speech.</p>
-
-<p>Note, however, that the export laws restrict Americans from providing
-technical assistance to foreign "munitions" projects. The government might
-claim that private discussions or correspondence with FreeS/WAN developers
-were covered by this. It is not clear what the courts would do with such a
-claim, so we strongly encourage Americans to use the list rather than risk
-the complications.</p>
-
-<h3><a name="wrong">What's wrong with restrictions on cryptography</a></h3>
-
-<p>Some quotes from prominent cryptography experts:</p>
-
-<blockquote>
-  The real aim of current policy is to ensure the continued effectiveness of
-  US information warfare assets against individuals, businesses and
-  governments in Europe and elsewhere.<br>
-  <a href="http://www.cl.cam.ac.uk/users/rja14"> Ross Anderson, Cambridge
-  University</a></blockquote>
-
-<blockquote>
-  If the government were honest about its motives, then the debate about
-  crypto export policy would have ended years ago.<br>
-  <a href="http://www.counterpane.com"> Bruce Schneier, Counterpane
-  Systems</a></blockquote>
-
-<blockquote>
-  The NSA regularly lies to people who ask it for advice on export control.
-  They have no reason not to; accomplishing their goal by any legal means is
-  fine by them. Lying by government employees is legal.<br>
-  John Gilmore.</blockquote>
-
-<p>The Internet Architecture Board (IAB) and the Internet Engineering
-Steering Group (IESG) made a <a href="iab-iesg.stmt">strong statement</a> in
-favour of worldwide access to strong cryptography. Essentially the same
-statement is in the appropriately numbered <a
-href="ftp://ftp.isi.edu/in-notes/rfc1984.txt">RFC 1984</a>. Two critical
-paragraphs are:</p>
-
-<blockquote>
-  ... various governments have actual or proposed policies on access to
-  cryptographic technology ...
-
-  <p>(a) ... export controls ...<br>
-  (b) ... short cryptographic keys ...<br>
-  (c) ... keys should be in the hands of the government or ...<br>
-  (d) prohibit the use of cryptology ...</p>
-
-  <p>We believe that such policies are against the interests of consumers and
-  the business community, are largely irrelevant to issues of military
-  security, and provide only a marginal or illusory benefit to law
-  enforcement agencies, ...</p>
-
-  <p>The IAB and IESG would like to encourage policies that allow ready
-  access to uniform strong cryptographic technology for all Internet users in
-  all countries.</p>
-</blockquote>
-
-<p>Our goal in the FreeS/WAN project is to build just such "strong
-cryptographic technology" and to distribute it "for all Internet users in all
-countries".</p>
-
-<p>More recently, the same two bodies (IESG and IAB) have issued <a
-href="ftp://ftp.isi.edu/in-notes/rfc2804.txt">RFC 2804</a> on why the IETF
-should not build wiretapping capabilities into protocols for the convenience
-of security or law enforcement agenicies. The abstract from that document
-is:</p>
-
-<blockquote>
-  The Internet Engineering Task Force (IETF) has been asked to take a
-  position on the inclusion into IETF standards-track documents of
-  functionality designed to facilitate wiretapping.
-
-  <p>This memo explains what the IETF thinks the question means, why its
-  answer is "no", and what that answer means.</p>
-</blockquote>
-A quote from the debate leading up to that RFC:
-
-<blockquote>
-  We should not be building surveillance technology into standards. Law
-  enforcement was not supposed to be easy. Where it is easy, it's called a
-  police state.<br>
-  Jeff Schiller of MIT, in a discussion of FBI demands for wiretap capability
-  on the net, as quoted by <a
-  href="http://www.wired.com/news/politics/0,1283,31895,00.html">Wired</a>.</blockquote>
-
-<p>The <a href="http://www.ietf.org/mailman/listinfo/raven">Raven</a> mailing
-list was set up for this IETF discussion.</p>
-
-<p>Our goal is to go beyond that RFC and prevent Internet wiretapping
-entirely.</p>
-
-<h3><a name="Wassenaar">The Wassenaar Arrangement</a></h3>
-
-<p>Restrictions on the export of cryptography are not just US policy, though
-some consider the US at least partly to blame for the policies of other
-nations in this area.</p>
-
-<p>A number of countries:</p>
-
-<p>Argentina, Australia, Austria, Belgium, Bulgaria, Canada, Czech Republic,
-Denmark, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan,
-Luxembourg, Netherlands, New Zealand, Norway, Poland, Portugal, Republic of
-Korea, Romania, Russian Federation, Slovak Republic, Spain, Sweden,
-Switzerland, Turkey, Ukraine, United Kingdom and United States</p>
-
-<p>have signed the Wassenaar Arrangement which restricts export of munitions
-and other tools of war. Cryptographic sofware is covered there.</p>
-
-<p>Wassenaar details are available from the <a
-href="http://www.wassenaar.org/"> Wassenaar Secretariat</a>, and elsewhere in
-a more readable <a href="http://www.fitug.de/news/wa/index.html"> HTML
-version</a>.</p>
-
-<p>For a critique see the <a href="http://www.gilc.org/crypto/wassenaar">
-GILC site</a>:</p>
-
-<blockquote>
-  The Global Internet Liberty Campaign (GILC) has begun a campaign calling
-  for the removal of cryptography controls from the Wassenaar Arrangement.
-
-  <p>The aim of the Wassenaar Arrangement is to prevent the build up of
-  military capabilities that threaten regional and international security and
-  stability . . .</p>
-
-  <p>There is no sound basis within the Wassenaar Arrangement for the
-  continuation of any export controls on cryptographic products.</p>
-</blockquote>
-
-<p>We agree entirely.</p>
-
-<p>An interesting analysis of Wassenaar can be found on the <a
-href="http://www.cyber-rights.org/crypto/wassenaar.htm">cyber-rights.org</a>
-site.</p>
-
-<h3><a name="status">Export status of Linux FreeS/WAN</a></h3>
-
-<p>We believe our software is entirely exempt from these controls since the
-Wassenaar <a
-href="http://www.wassenaar.org/list/GTN%20and%20GSN%20-%2099.pdf">General
-Software Note</a> says:</p>
-
-<blockquote>
-  The Lists do not control "software" which is either:
-  <ol>
-    <li>Generally available to the public by . . . retail . . . or</li>
-    <li>"In the public domain".</li>
-  </ol>
-</blockquote>
-
-<p>There is a note restricting some of this, but it is a sub-heading under
-point 1, so it appears not to apply to public domain software.</p>
-
-<p>Their glossary defines "In the public domain" as:</p>
-
-<blockquote>
-  . . . "technology" or "software" which has been made available without
-  restrictions upon its further dissemination.
-
-  <p>N.B. Copyright restrictions do not remove "technology" or "software"
-  from being "in the public domain".</p>
-</blockquote>
-
-<p>We therefore believe that software freely distributed under the <a
-href="glossary.html#GPL">GNU Public License</a>, such as Linux FreeS/WAN, is
-exempt from Wassenaar restrictions.</p>
-
-<p>Most of the development work is being done in Canada. Our understanding is
-that the Canadian government accepts this interpretation.</p>
-<ul>
-  <li>A web statement of <a
-    href="http://www.dfait-maeci.gc.ca/~eicb/notices/ser113-e.htm"> Canadian
-    policy</a> is available from the Department of Foreign Affairs and
-    International Trade.</li>
-  <li>Another document from that department states that <a
-    href="http://www.dfait-maeci.gc.ca/~eicb/export/gr1_e.htm">public domain
-    software</a> is exempt from the export controls.</li>
-  <li>A researcher's <a
-    href="http://insight.mcmaster.ca/org/efc/pages/doc/crypto-export.html">analysis</a>
-    of Canadian policy is also available.</li>
-</ul>
-
-<p>Recent copies of the freely modifiable and distributable source code exist
-in many countries. Citizens all over the world participate in its use and
-evolution, and guard its ongoing distribution. Even if Canadian policy were
-to change, the software would continue to evolve in countries which do not
-restrict exports, and would continue to be imported from there into unfree
-countries. "The Net culture treats censorship as damage, and routes around
-it."</p>
-
-<h3><a name="help">Help spread IPsec around</a></h3>
-
-<p>You can help. If you don't know of a Linux FreeS/WAN archive in your own
-country, please download it now to your personal machine, and consider making
-it publicly accessible if that doesn't violate your own laws. If you have the
-resources, consider going one step further and setting up a mirror site for
-the whole <a href="intro.html#munitions">munitions</a> Linux crypto software
-archive.</p>
-
-<p>If you make Linux CD-ROMs, please consider including this code, in a way
-that violates no laws (in a free country, or in a domestic-only CD
-product).</p>
-
-<p>Please send a note about any new archive mirror sites or CD distributions
-to linux-ipsec@clinet.fi so we can update the documentation.</p>
-
-<p>Lists of current <a href="intro.html#sites">mirror sites</a> and of <a
-href="intro.html#distwith">distributions</a> which include FreeS/WAN are in
-our introduction section.</p>
-
-<h2><a name="desnotsecure">DES is Not Secure</a></h2>
-
-<p>DES, the <strong>D</strong>ata <strong>E</strong>ncryption
-<strong>S</strong>tandard, can no longer be considered secure. While no major
-flaws in its innards are known, it is fundamentally inadequate because its
-<strong>56-bit key is too short</strong>. It is vulnerable to <a
-href="glossary.html#brute">brute-force search</a> of the whole key space,
-either by large collections of general-purpose machines or even more quickly
-by specialized hardware. Of course this also applies to <strong>any other
-cipher with only a 56-bit key</strong>. The only reason anyone could have for
-using a 56 or 64-bit key is to comply with various <a
-href="exportlaw.html">export laws</a> intended to ensure the use of breakable
-ciphers.</p>
-
-<p>Non-government cryptologists have been saying DES's 56-bit key was too
-short for some time -- some of them were saying it in the 70's when DES
-became a standard -- but the US government has consistently ridiculed such
-suggestions.</p>
-
-<p>A group of well-known cryptographers looked at key lengths in a <a
-href="http://www.counterpane.com/keylength.html"> 1996 paper</a>. They
-suggested a <em>minimum</em> of 75 bits to consider an existing cipher secure
-and a <em>minimum of 90 bits for new ciphers</em>. More recent papers,
-covering both <a href="glossary.html#symmetric">symmetric</a> and <a
-href="glossary.html#public">public key</a> systems are at <a
-href="http://www.cryptosavvy.com/">cryptosavvy.com</a> and <a
-href="http://www.rsasecurity.com/rsalabs/bulletins/bulletin13.html">rsa.com</a>.
-For all algorithms, the minimum keylengths recommended in such papers are
-significantly longer than the maximums allowed by various export laws.</p>
-
-<p>In a <a
-href="http://www.privacy.nb.ca/cryptography/archives/cryptography/html/1998-09/0095.html">1998
-ruling</a>, a German court described DES as "out-of-date and not safe enough"
-and held a bank liable for using it.</p>
-
-<h3><a name="deshware">Dedicated hardware breaks DES in a few days</a></h3>
-
-<p>The question of DES security has now been settled once and for all. In
-early 1998, the <a href="http://www.eff.org/">Electronic Frontier
-Foundation</a> built a <a
-href="http://www.eff.org/descracker.html">DES-cracking machine</a>. It can
-find a DES key in an average of a few days' search. The details of all this,
-including complete code listings and complete plans for the machine, have
-been published in <a href="biblio.html#EFF"><cite>Cracking DES</cite></a>, by
-the Electronic Frontier Foundation.</p>
-
-<p>That machine cost just over $200,000 to design and build. "Moore's Law" is
-that machines get faster (or cheaper, for the same speed) by roughly a factor
-of two every 18 months. At that rate, their $200,000 in 1998 becomes $50,000
-in 2001.</p>
-
-<p>However, Moore's Law is not exact and the $50,000 estimate does not allow
-for the fact that a copy based on the published EFF design would cost far
-less than the original. We cannot say exactly what such a cracker would cost
-today, but it would likely be somewhere between $10,000 and $100,000.</p>
-
-<p>A large corporation could build one of these out of petty cash. The cost
-is low enough for a senior manager to hide it in a departmental budget and
-avoid having to announce or justify the project. Any government agency, from
-a major municipal police force up, could afford one. Or any other group with
-a respectable budget -- criminal organisations, political groups, labour
-unions, religious groups, ... Or any millionaire with an obsession or a
-grudge, or just strange taste in toys.</p>
-
-<p>One might wonder if a private security or detective agency would have one
-for rent. They wouldn't need many clients to pay off that investment.</p>
-
-<h3><a name="spooks">Spooks may break DES faster yet</a></h3>
-
-<p>As for the security and intelligence agencies of various nations, they may
-have had DES crackers for years, and theirs may be much faster. It is
-difficult to make most computer applications work well on parallel machines,
-or to design specialised hardware to accelerate them. Cipher-cracking is one
-of the very few exceptions. It is entirely straightforward to speed up
-cracking by just adding hardware. Within very broad limits, you can make it
-as fast as you like if you have the budget. The EFF's $200,000 machine breaks
-DES in a few days. An <a href="http://www.planepage.com/">aviation
-website</a> gives the cost of a B1 bomber as $200,000,000. Spending that
-much, an intelligence agency could break DES in an average time of <em>six
-and a half minutes</em>.</p>
-
-<p>That estimate assumes they use the EFF's 1998 technology and just spend
-more money. They may have an attack that is superior to brute force, they
-quite likely have better chip technology (Moore's law, a bigger budget, and
-whatever secret advances they may have made) and of course they may have
-spent the price of an aircraft carrier, not just one aircraft.</p>
-
-<p>In short, we have <em>no idea</em> how quickly these organisations can
-break DES. Unless they're spectacularly incompetent or horribly underfunded,
-they can certainly break it, but we cannot guess how quickly. Pick any time
-unit between days and milliseconds; none is entirely unbelievable. More to
-the point, none of them is  of any comfort if you don't want such
-organisations reading your communications.</p>
-
-<p>Note that this may be a concern even if nothing you do is a threat to
-anyone's national security. An intelligence agency might well consider it to
-be in their national interest for certain companies to do well. If you're
-competing against such companies in a world market and that agency can read
-your secrets, you have a serious problem.</p>
-
-<p>One might wonder about technology the former Soviet Union and its allies
-developed for cracking DES during the Cold War. They must have tried; the
-cipher was an American standard and widely used. Certainly those countries
-have some fine mathematicians, and those agencies had budget. How well did
-they succeed? Is their technology now for sale or rent?</p>
-
-<h3><a name="desnet">Networks break DES in a few weeks</a></h3>
-
-<p>Before the definitive EFF effort, DES had been cracked several times by
-people using many machines. See this <a
-href="http://www.distributed.net/pressroom/DESII-1-PR.html"> press
-release</a> for example.</p>
-
-<p>A major corporation, university, or government department could break DES
-by using spare cycles on their existing collection of computers, by
-dedicating a group of otherwise surplus machines to the problem, or by
-combining the two approaches. It might take them weeks or months, rather than
-the days required for the EFF machine, but they could do it.</p>
-
-<p>What about someone working alone, without the resources of a large
-organisation? For them, cracking DES will not be easy, but it may be
-possible. A few thousand dollars buys a lot of surplus workstations. A pile
-of such machines will certainly heat your garage nicely and might break DES
-in a few months or years. Or enroll at a university and use their machines.
-Or use an employer's machines. Or crack security somewhere and steal the
-resources to crack a DES key. Or write a virus that steals small amounts of
-resources on many machines. Or . . .</p>
-
-<p>None of these approaches are easy or break DES really quickly, but an
-attacker only needs to find one that is feasible and breaks DES quickly
-enough to be dangerous. How much would you care to bet that this will be
-impossible if the attacker is clever and determined? How valuable is your
-data? Are you authorised to risk it on a dubious bet?</p>
-
-<h3><a name="no_des">We disable DES</a></h3>
-
-<p>In short, it is now absolutely clear that <strong>DES is not
-secure</strong> against</p>
-<ul>
-  <li>any <strong>well-funded opponent</strong></li>
-  <li>any opponent (even a penniless one) with access (even stolen access) to
-    <strong>enough general purpose computers</strong></li>
-</ul>
-
-<p>That is why <strong>Linux FreeS/WAN disables all transforms which use
-plain DES</strong> for encryption.</p>
-
-<p>DES is in the source code, because we need DES to implement our default
-encryption transform, <a href="glossary.html#3DES">Triple DES</a>. <strong>We
-urge you not to use single DES</strong>. We do not provide any easy way to
-enable it in FreeS/WAN, and our policy is to provide no assistance to anyone
-wanting to do so.</p>
-
-<h3><a name="40joke">40-bits is laughably weak</a></h3>
-
-<p>The same is true, in spades, of ciphers -- DES or others -- crippled by
-40-bit keys, as many ciphers were required to be until recently under various
-<a href="#exlaw">export laws</a>. A brute force search of such a cipher's
-keyspace is 2<sup>16</sup> times faster than a similar search against DES.
-The EFF's machine can do a brute-force search of a 40-bit key space in
-<em>seconds</em>. One contest to crack a 40-bit cipher was won by a student
-<a href="http://catless.ncl.ac.uk/Risks/18.80.html#subj1"> using a few
-hundred idle machines at his university</a>. It took only three and half
-hours.</p>
-
-<p>We do not, and will not, implement any 40-bit cipher.</p>
-
-<h3><a name="altdes">Triple DES is almost certainly secure</a></h3>
-
-<p><a href="glossary.html#3DES">Triple DES</a>, usually abbreviated 3DES,
-applies DES three times, with three different keys. DES seems to be basically
-an excellent cipher design; it has withstood several decades of intensive
-analysis without any disastrous flaws being found. It's only major flaw is
-that the small keyspace allows brute force attacks to succeeed. Triple DES
-enlarges the key space to 168 bits, making brute-force search a ridiculous
-impossibility.</p>
-
-<p>3DES is currently the only block cipher implemented in FreeS/WAN. 3DES is,
-unfortunately, about 1/3 the speed of DES, but modern CPUs still do it at
-quite respectable speeds. Some <a href="glossary.html#benchmarks">speed
-measurements</a> for our code are available.</p>
-
-<h3><a name="aes.ipsec">AES in IPsec</a></h3>
-
-<p>The <a href="glossary.html#AES">AES</a> project has chosen a replacement
-for DES, a new standard cipher for use in non-classified US government work
-and in regulated industries such as banking. This cipher will almost
-certainly become widely used for many applications, including IPsec.</p>
-
-<p>The winner, announced in October 2000 after several years of analysis and
-discussion, was the <a
-href="http://www.esat.kuleuven.ac.be/~rijmen/rijndael/">Rijndael</a> cipher
-from two Belgian designers.</p>
-
-<p>It is almost certain that FreeS/WAN will add AES support. <a
-href="web.html#patch">AES patches</a> are already available.</p>
-
-<h2><a name="press">Press coverage of Linux FreeS/WAN:</a></h2>
-
-<h3>FreeS/WAN 1.0 press</h3>
-<ul>
-  <li><a
-    href="http://www.wired.com/news/news/technology/story/19136.html">Wired</a>
-    "Linux-Based Crypto Stops Snoops", James Glave April 15 1999</li>
-  <li><a
-    href="http://slashdot.org/articles/99/04/15/1851212.shtml">Slashdot</a></li>
-  <li><a href="http://dgl.com/itinfo/1999/it990415.html">DGL</a>, Damar Group
-    Limited; looking at FreeS/WAN from a perspective of business
-  computing</li>
-  <li><a href="http://linuxtoday.com/stories/5010.html">Linux Today</a></li>
-  <li><a href="http://www.tbtf.com/archive/1999-04-21.html#Tcep">TBTF</a>,
-    Tasty Bits from the Technology Front</li>
-  <li><a
-    href="http://www.salonmagazine.com/tech/log/1999/04/16/encryption/index.html">Salon
-    Magazine</a> "Free Encryption Takes a Big Step"</li>
-</ul>
-
-<h3><a name="release">Press release for version 1.0</a></h3>
-<pre>        Strong Internet Privacy Software Free for Linux Users Worldwide
-
-Toronto, ON, April 14, 1999 - 
-
-The Linux FreeS/WAN project today released free software to protect
-the privacy of Internet communications using strong encryption codes.
-FreeS/WAN automatically encrypts data as it crosses the Internet, to
-prevent unauthorized people from receiving or modifying it.  One
-ordinary PC per site runs this free software under Linux to become a
-secure gateway in a Virtual Private Network, without having to modify
-users' operating systems or application software.  The project built
-and released the software outside the United States, avoiding US
-government regulations which prohibit good privacy protection.
-FreeS/WAN version 1.0 is available immediately for downloading at
-http://www.xs4all.nl/~freeswan/.
-
-"Today's FreeS/WAN release allows network administrators to build
-excellent secure gateways out of old PCs at no cost, or using a cheap
-new PC," said John Gilmore, the entrepreneur who instigated the
-project in 1996.  "They can build operational experience with strong
-network encryption and protect their users' most important
-communications worldwide."
-
-"The software was written outside the United States, and we do not
-accept contributions from US citizens or residents, so that it can be
-freely published for use in every country," said Henry Spencer, who
-built the release in Toronto, Canada.  "Similar products based in the
-US require hard-to-get government export licenses before they can be
-provided to non-US users, and can never be simply published on a Web
-site.  Our product is freely available worldwide for immediate
-downloading, at no cost."
-
-FreeS/WAN provides privacy against both quiet eavesdropping (such as
-"packet sniffing") and active attempts to compromise communications
-(such as impersonating participating computers).  Secure "tunnels" carry
-information safely across the Internet between locations such as a
-company's main office, distant sales offices, and roaming laptops.  This
-protects the privacy and integrity of all information sent among those
-locations, including sensitive intra-company email, financial transactions
-such as mergers and acquisitions, business negotiations, personal medical
-records, privileged correspondence with lawyers, and information about
-crimes or civil rights violations.  The software will be particularly
-useful to frequent wiretapping targets such as private companies competing
-with government-owned companies, civil rights groups and lawyers,
-opposition political parties, and dissidents. 
-
-FreeS/WAN provides privacy for Internet packets using the proposed
-standard Internet Protocol Security (IPSEC) protocols.  FreeS/WAN
-negotiates strong keys using Diffie-Hellman key agreement with 1024-bit
-keys, and encrypts each packet with 168-bit Triple-DES (3DES).  A modern
-$500 PC can set up a tunnel in less than a second, and can encrypt
-6 megabits of packets per second, easily handling the whole available
-bandwidth at the vast majority of Internet sites.  In preliminary testing,
-FreeS/WAN interoperated with 3DES IPSEC products from OpenBSD, PGP, SSH,
-Cisco, Raptor, and Xedia.  Since FreeS/WAN is distributed as source code,
-its innards are open to review by outside experts and sophisticated users,
-reducing the chance of undetected bugs or hidden security compromises.
-
-The software has been in development for several years.  It has been
-funded by several philanthropists interested in increased privacy on
-the Internet, including John Gilmore, co-founder of the Electronic
-Frontier Foundation, a leading online civil rights group.
-
-Press contacts:
-Hugh Daniel,   +1 408 353 8124, hugh@toad.com
-Henry Spencer, +1 416 690 6561, henry@spsystems.net
-
-* FreeS/WAN derives its name from S/WAN, which is a trademark of RSA Data
-  Security, Inc; used by permission.</pre>
-</body>
-</html>
diff --git a/doc/src/quickstart-configs.html b/doc/src/quickstart-configs.html
deleted file mode 100644
index b2ad21bcc..000000000
--- a/doc/src/quickstart-configs.html
+++ /dev/null
@@ -1,144 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>Quick FreeS/WAN installation and configuration</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, installation, quickstart">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Revised by Claudia Schmeing for same
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  This is a new file derived from:
-  RCS ID:          $Id: quickstart-configs.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-<BODY>
-<H1><A name="quick_configs">FreeS/WAN quick start examples</A></H1>
-<P>These are sample 
-<A href="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A>
-configuration files for opportunistic encryption, with comments. Much of 
-this configuration will be unnecessary with the new defaults proposed
-for FreeS/WAN 2.x.</P>
-<P>Full instructions are in our
-<A href="quickstart.html#quickstart">quickstart guide</A>.
-
-<H2><A name="qc.opp.client">Configuration for Initiate-only Opportunistic Encryption</A></H2>
-<P>The ipsec.conf file for an initiate-only opportunistic setup is:</P>
-<PRE># general IPsec setup
-config setup
-        # Use the default interface
-        interfaces=%defaultroute
-        # Use auto= parameters in conn descriptions to control startup actions.
-        plutoload=%search
-        plutostart=%search
-        uniqueids=yes
-
-# defaults for subsequent connection descriptions
-conn %default
-        # How to authenticate gateways
-        authby=rsasig
-        # default is
-        # load connection description into Pluto's database
-        # so it can respond if another gatway initiates
-        # individual connection descriptions may override this
-        auto=add
-
-# description for opportunistic connections
-conn me-to-anyone
-        left=%defaultroute         # all connections should use default route
-        right=%opportunistic       # anyone we can authenticate
-        leftrsasigkey=%dnsondemand  # NEW: look up keys in DNS as-needed
-        rightrsasigkey=%dnsondemand # (not at connection load time)
-        rekey=no                   # let unused connections die
-        keylife=1h                 # short
-        auto=route                 # set up for opportunistic
-        leftid=@xy.example.com     # our identity for IPSec negotiations
-                                   # must match DNS and ipsec.secrets</PRE>
-
-<P>Normally, you need to do only two things:</P>
-<UL>
-  <LI>edit <VAR>leftid=</VAR></LI>
-  <LI>set <VAR>auto=route</VAR></LI>
-</UL>
-<P>
- However, some people may need to customize the <VAR>interfaces=</VAR> line
- in the "config setup" section. All other sections are identical for any
- standalone machine doing opportunistic encryption.</P>
-<P>The @ sign in the <VAR>leftid=</VAR> makes the ID go "over the wire"
- as a Fully Qualified Domain Name (FQDN).  Without it, an IP address would
- be used and this won't work.</P>
-<P>The conn is not used to supply either public key. Your private key
- is in <A href="manpage.d/ipsec.secrets.5.html">ipsec.secrets(5)</A>
- and, for opportunistic encryption, the public keys for remote gateways
- are all looked up in DNS.</P>
-<P>FreeS/WAN authenticates opportunistic encryption by <A href="#gen_rsa">RSA
- signature</A> only, so "public key" and "private key" refer to these keys.</P>
-<P>While the <VAR>left</VAR> and <VAR>right</VAR> designations
- here are arbitrary, we follow a convention of using <VAR>left</VAR> for
- local and <VAR>right</VAR> for remote.</P>
-
-<P><A href="quickstart.html#config.opp.client">Continue configuring
-initiate-only opportunism.</A>
-
-<H2><A name="qc.incoming.opp.conf">ipsec.conf for Incoming Opportunistic Encryption</A></H2>
-Use the ipsec.conf above, except that the section describing opportunistic
-connections is now:</P>
-<PRE>
-# description for opportunistic connections
-conn me-to-anyone
-        left=%defaultroute         # all connections should use default route
-        right=%opportunistic       # anyone we can authenticate
-        leftrsasigkey=%dnsondemand  # NEW: look up keys in DNS as-needed
-        rightrsasigkey=%dnsondemand # (not at connection load time)
-        rekey=no                   # let unused connections die
-        keylife=1h                 # short
-        auto=route                 # set up for opportunistic</PRE>
-
-<P>Note that <VAR>leftid=</VAR> has been removed. With no explicit setting,
-<VAR>leftid=</VAR> defaults to the IP of your public interface.</P>
-
-<P><A href="quickstart.html#incoming.opp.conf">Continue configuring
-full opportunism.</A>
-
-
-<H2><A name="qc.gate.opp.conf">ipsec.conf for Opportunistic Gateway</A></H2>
-Use the ipsec.conf above, plus these connections:
-
-<PRE>conn subnet-to-anyone            # must be above me-to-anyone
-       also=me-to-anyone
-       leftsubnet=42.42.42.0/24
-
-conn me-to-anyone                # just like for full opportunism
-        left=%defaultroute
-        right=%opportunistic
-        leftrsasigkey=%dnsondemand
-        rightrsasigkey=%dnsondemand
-        keylife=1h
-        rekey=no
-        auto=route               # be sure this is enabled
-                                 # Note there is NO leftid= </PRE>
-
-
-<P>Note that a subnet described in ipsec.conf(5) need not correspond to a
- physical network segment. This is discussed in more detail in our
-<A href="adv_config.html">advanced configuration</A> document.</P>
-
-<P>If required, a gateway can easily provide this service for more than one
- subnet. You just add a connection description for each.</P>
-
-<P><A href="quickstart.html#config.opp.gate">Continue configuring an
-opportunistic gateway.</A>
-
-
-</BODY>
-</HTML>
-
diff --git a/doc/src/quickstart-firewall.html b/doc/src/quickstart-firewall.html
deleted file mode 100644
index 53c27b5af..000000000
--- a/doc/src/quickstart-firewall.html
+++ /dev/null
@@ -1,187 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>Quick FreeS/WAN installation and configuration</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, installation, quickstart">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Revised by Claudia Schmeing for same
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  RCS ID:          $Id: quickstart-firewall.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-<BODY>
-<H1><A name="quick_firewall">FreeS/WAN quick start on firewalling</A></H1>
-<P>This firewalling information supplements our
-<A HREF="quickstart.html#quick_guide">quickstart guide.</A></P>
-<P>It includes tips for firewalling:</P>
-<UL>
-<LI><A HREF="#firewall.standalone">a standalone system with initiator-only 
-opportunism</A></LI>
-<LI><A HREF="#incoming.opp.firewall">incoming opportunistic connections</A></LI>
-<LI><A HREF="#opp.gate.firewall">an opportunistic gateway</A></LI>
-</UL>
-<P>and a list of helpful <A HREF="#resources">resources</A>.</P>
-<H2><A name="firewall.standalone">Firewalling a standalone system</A></H2>
-<P>Firewall rules on a standalone system doing IPsec can be very simple.</P>
-<P>The first step is to allow IPsec packets (IKE on UDP port 500 plus
- ESP, protocol 50) in and out of your gateway. A script to set up
- iptables(8) rules for this is:</P>
-<PRE># edit this line to match the interface you use as default route
-# ppp0 is correct for many modem, DSL or cable connections
-# but perhaps not for you
-world=ppp0
-#
-# allow IPsec
-#
-# IKE negotiations
-iptables -A INPUT  -p udp -i $world --sport 500 --dport 500 -j ACCEPT
-iptables -A OUTPUT -p udp -o $world --sport 500 --dport 500 -j ACCEPT
-# ESP encryption and authentication
-iptables -A INPUT  -p 50 -i $world -j ACCEPT
-iptables -A OUTPUT -p 50 -o $world -j ACCEPT</PRE>
-<P>Optionally, you could restrict this, allowing these packets only to
- and from a list of known gateways.</P>
-<P>A second firewalling step -- access controls built into the IPsec
- protocols -- is automatically applied:</P>
-<DL>
-<DT><A href="glossary.html#Pluto">Pluto</A> -- the FreeS/WAN keying
- daemon -- deals with the IKE packets.</DT>
-<DD>Pluto authenticates its partners during the IKE negotiation, and
- drops negotiation if authentication fails.</DD>
-<DT><A href="glossary.html#KLIPS">KLIPS</A> -- the FreeS/WAN kernel
- component -- handles the ESP packets.</DT>
-<DD>
-<DL>
-<DT>KLIPS drops outgoing packets</DT>
-<DD>if they are routed to IPsec, but no tunnel has been negotiated for
- them</DD>
-<DT>KLIPS drops incoming unencrypted packets</DT>
-<DD>if source and destination addresses match a tunnel; the packets
- should have been encrypted</DD>
-<DT>KLIPS drops incoming encrypted packets</DT>
-<DD>if source and destination address do not match the negotiated
- parameters of the tunnel that delivers them</DD>
-<DD>if packet-level authentication fails</DD>
-</DL>
-</DD>
-</DL>
-<P>These errors are logged. See our <A href="trouble.html">
- troubleshooting</A> document for details.</P>
-<P>As an optional third step, you may wish to filter packets emerging from 
- your opportunistic tunnels.
- These packets arrive on an interface such as <VAR>ipsec0</VAR>, rather than
- <VAR>eth0</VAR>, <VAR>ppp0</VAR> or whatever. For example, in an iptables(8)
- rule set, you would use:</P>
-<DL>
-<DT><VAR>-i ipsec+</VAR></DT>
-<DD>to specify packets arriving on any ipsec device</DD>
-<DT><VAR>-o ipsec+</VAR></DT>
-<DD>to specify packets leaving via any ipsec device</DD>
-</DL>
-<P>In this way, you can apply whatever additional filtering you like to these
-packets.</P>
-<P>The packets emerging on <VAR>ipsec0</VAR> are likely
- to be things that a client application on your machine requested: web 
- pages, e-mail, file transfers and so on. However, any time you initiate
- an opportunistic connection, you open a two-way connection to
- another machine (or network). It is conceivable that a Bad Guy there 
- could take advantage of your link.</P>
-<P>For more information, read the next section.</P>
-</P>
-<H2><A name="incoming.opp.firewall">Firewalling incoming opportunistic
- connections</A></H2>
-<P>The basic firewalling for IPsec does not change when you support
- incoming connections as well as connections you initiate. You must
- still allow IKE (UDP port 500) and ESP (protocol 50) packets to and
- from your machine, as in the rules given <A href="#firewall.standalone">
- above</A>.</P>
-<P>However, there is an additional security concern when you allow
- incoming opportunistic connections. Incoming opportunistic packets
- enter your machine via an IPSec tunnel. That is, they all appear as
- ESP (protocol 50) packets, concealing whatever port and protocol
- characteristics the packet within the tunnel has. Contained
- in the tunnel as they pass through <VAR>ppp0</VAR> or <VAR>eth0</VAR>,
- these packets can bypass your usual firewall rules on these interfaces.
-<P>Consequently, you will want to firewall your <VAR>ipsec</VAR> interfaces
- the way you would any publicly accessible interface.</P>
-<P>A simple way to do this is to create one iptables(8) table with
- all your filtering rules for incoming packets, and apply the entire table to
- all public interfaces, including <VAR>ipsec</VAR> interfaces.</P>
-
-<H2><A name="opp.gate.firewall">Firewalling for opportunistic gateways</A></H2>
-<P>On a gateway, the IPsec-related firewall rules applied for input and
- output on the Internet side are exactly as shown 
-<A HREF="#firewall.standalone">above</A>. A gateway
- exchanges exactly the same things -- UDP 500 packets and IPsec packets
- -- with other gateways that a standalone system does, so it can use
- exactly the same firewall rules as a standalone system would.</P>
-<P>However, on a gateway there are additional things to do:</P>
-<UL>
-<LI>you have other interfaces and need rules for them</LI>
-<LI>packets emerging from ipsec processing must be correctly forwarded</LI>
-</UL>
-<P>You need additional rules to handle these things. For example, adding
- some rules to the set shown above we get:</P>
-<PRE># edit this line to match the interface you use as default route
-# ppp0 is correct for many modem, DSL or cable connections
-# but perhaps not for you
-world=ppp0
-#
-# edit these lines to describe your internal subnet and interface
-localnet=42.42.42.0/24
-internal=eth1
-#
-# allow IPsec
-#
-# IKE negotiations
-iptables -A INPUT  -p udp -i $world --sport 500 --dport 500 -j ACCEPT
-iptables -A OUTPUT -p udp -o $world --sport 500 --dport 500 -j ACCEPT
-# ESP encryption and authentication
-iptables -A INPUT  -p 50 -i $world -j ACCEPT
-iptables -A OUTPUT -p 50 -o $world -j ACCEPT
-#
-# packet forwarding for an IPsec gateway
-# simplest possible rules
-$ forward everything, with no attempt to filter
-#
-# handle packets emerging from IPsec
-# ipsec+ means any of ipsec0, ipsec1, ...
-iptables -A FORWARD -d $localnet -i ipsec+ -j ACCEPT
-# simple rule for outbound packets
-# let local net send anything
-# IPsec will encrypt some of it
-iptables -A FORWARD -s $localnet -i $internal -j ACCEPT </PRE>
-<P>On a production gateway, you would no doubt need tighter rules than
- the above.</P>
-<H2><A NAME="resources">Firewall resources</A></H2>
-<P>For more information, see these handy resources:</P>
-<UL>
-<LI><A href="http://www.netfilter.org/documentation/">netfilter
- documentation</A></LI>
-<LI>books such as:
-<UL>
-<LI>Cheswick and Bellovin, <A href="biblio.html#firewall.book">Firewalls
- and Internet Security</A></LI>
-<LI>Zeigler, <A href="biblio.html#Zeigler">Linux Firewalls</A>,</LI>
-</UL>
-</LI>
-<LI><A href="firewall.html#firewall">our firewalls document</A></LI>
-<LI><A href="web.html#firewall.web">our firewall links</A></LI>
-</UL>
-<A HREF="quickstart.html#quick.firewall">Back to our quickstart guide.</A>
-</BODY>
-</HTML>
-
-
-
diff --git a/doc/src/quickstart.html b/doc/src/quickstart.html
deleted file mode 100644
index a74c11774..000000000
--- a/doc/src/quickstart.html
+++ /dev/null
@@ -1,458 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>Quick FreeS/WAN installation and configuration</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, installation, quickstart">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Revised by Claudia Schmeing for same
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: quickstart.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-<BODY>
-<H1><A name="quickstart">Quickstart Guide to Opportunistic Encryption</A></H1>
-<A name="quick_guide"></A>
-
-<H2><A name="opp.setup">Purpose</A></H2>
-
-<P>This page will get you started using Linux FreeS/WAN with opportunistic
- encryption (OE). OE enables you to set up IPsec tunnels
- without co-ordinating with another
- site administrator, and without hand configuring each tunnel.
- If enough sites support OE, a &quot;FAX effect&quot; occurs, and
- many of us can communicate without eavesdroppers.</P>
-
-<H3>OE "flag day"</H3>
-
-<P>As of FreeS/WAN 2.01, OE uses DNS TXT resource records (RRs)
-only (rather than TXT with KEY). 
-This change causes a 
-<a href="http://jargon.watson-net.com/jargon.asp?w=flag+day">"flag day"</a>.
-Users of FreeS/WAN 2.00 (or earlier) OE who are upgrading may require 
-additional resource records, as detailed in our 
-<a href="upgrading.html#upgrading.flagday">upgrading document</a>. 
-OE setup instructions here are for 2.02 or later.</P>
-
-
-<H2><A name="opp.dns">Requirements</A></H2>
-
-<P>To set up opportunistic encryption, you will need:</P>
-<UL>
-<LI>a Linux box. For OE to the public Internet, this box must NOT 
-be behind <A HREF="glossary.html#NAT.gloss">Network Address Translation</A>
-(NAT).</LI>
-<LI>to install Linux FreeS/WAN 2.02 or later</LI>
-<LI>either control over your reverse DNS (for full opportunism) or 
-the ability to write to some forward domain (for initiator-only). 
-<A HREF="http://www.fdns.net">This free DNS service</A> explicitly 
-supports forward TXT records for FreeS/WAN use.</LI>
-<LI>(for full opportunism) a static IP</LI>
-</UL>
-
-<P>Note: Currently, only Linux FreeS/WAN supports opportunistic 
-encryption.</P>
-
-<H2><A name="easy.install">RPM install</A></H2>
-
-<P>Our instructions are for a recent Red Hat with a 2.4-series stock or 
-Red Hat updated kernel. For other ways to install, see our 
-<A href="install.html#install">install document</A>.</P>
-
-
-<H3>Download RPMs</H3>
-
-<P>If we have prebuilt RPMs for your Red Hat system, 
-this command will get them:
-</P>
-
-<PRE>    ncftpget ftp://ftp.xs4all.nl/pub/crypto/freeswan/binaries/RedHat-RPMs/`uname -r | tr -d 'a-wy-z'`/\*</PRE>
-
-<P>If that fails, you will need to try <A HREF="install.html">another install 
-method</A>. 
-Our kernel modules 
-<B>will only work on the Red Hat kernel they were built for</B>,
-since they are very sensitive to small changes in the kernel.</P>
-
-<P>If it succeeds, you will have userland tools, a kernel module, and an 
-RPM signing key:</P>
-
-<PRE>    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm
-    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm
-    freeswan-rpmsign.asc</PRE>
-
-
-<H3>Check signatures</H3>
-
-<P>If you're running RedHat 8.x or later, import the RPM signing key into the 
-RPM database:</P>
-<PRE>    rpm --import freeswan-rpmsign.asc</PRE>
- 
-<P>For RedHat 7.x systems, you'll need to add it to your 
-<A HREF="glossary.html#PGP">PGP</A> keyring:</P>
-<PRE>    pgp -ka freeswan-rpmsign.asc</PRE>
-
-<P>Check the digital signatures on both RPMs using:</P>
-<PRE>    rpm --checksig freeswan*.rpm </PRE>
-
-<P>You should see that these signatures are good:</P>
-<PRE>    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm: pgp md5 OK
-    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm: pgp md5 OK</PRE>
-
-
-<H3>Install the RPMs</H3>
-
-<P>Become root:</P>
-<PRE>    su</PRE>
-
-<P>Install your RPMs with:<P>
-<PRE>    rpm -ivh freeswan*.rpm</PRE>
-
-<P>If you're upgrading from FreeS/WAN 1.x RPMs, and have problems with that
-command, see 
-<A HREF="upgrading.html#upgrading.rpms">this note</A>.</P>
-
-<P>Then, start FreeS/WAN:</P>
-<PRE>    service ipsec start</PRE>
-
-
-<H3><A name="testinstall">Test</A></H3>
-<P>To check that you have a successful install, run:</P>
-<PRE>    ipsec verify</PRE>
-
-<P>You should see as part of the <var>verify</var> output:</P>
-<PRE>
-    Checking your system to see if IPsec got installed and started correctly
-    Version check and ipsec on-path                             [OK]
-    Checking for KLIPS support in kernel                        [OK]
-    Checking for RSA private key (/etc/ipsec.secrets)           [OK]
-    Checking that pluto is running                              [OK]
-    ...</PRE>
-
-<P>If any of these first four checks fails, see our 
-<A href="trouble.html#install.check">troubleshooting guide</A>.
-</P>
-
-<H2><A name="opp.setups.list">Our Opportunistic Setups</A></H2>
-<H3>Full or partial opportunism?</H3>
-<P>Determine the best form of opportunism your system can support.</P>
-<UL>
-<LI>For <A HREF="#opp.incoming">full opportunism</A>, you'll need a static
-IP and and either control over your reverse DNS or an ISP
-that can add the required TXT record for you.</LI>
-<LI>If you have a dynamic IP, and/or write access to forward DNS only,
-you can do <A HREF="#opp.client">initiate-only opportunism</A></LI>
-<LI>To protect traffic bound for real IPs behind your gateway, use
-<A HREF="adv_config.html#opp.gate">this form of full opportunism</A>.</LI>
-</UL>
-
-<H2><A name="opp.client">Initiate-only setup</A></H2>
-
-<H3>Restrictions</H3>
-<P>When you set up initiate-only Opportunistic Encryption (iOE):</P>
-<UL>
-<LI>there will be <STRONG> no incoming connection requests</STRONG>; you
- can initiate all the IPsec connections you need.</LI>
-<LI><STRONG>only one machine is visible</STRONG> on your end of the
- connection.</LI>
-<LI>iOE also protects traffic on behalf of 
-<A HREF="glossary.html#NAT.gloss">NATted</A> hosts behind the iOE box.</LI>
-</UL>
-<P>You cannot network a group of initiator-only machines if none
-of these is capable of responding to OE. If one is capable of responding, 
-you may be able to create a hub topology using routing.</P>
-
-
-<H3><A name="forward.dns">Create and publish a forward DNS record</A></H3>
-
-<H4>Find a domain you can use</H4>
-
-<P>Find a DNS forward domain (e.g. example.com) where you can publish your key. 
-You'll need access to the DNS zone files for that domain.  
-This is common for a domain you own. Some free DNS providers, 
-such as <A HREF="http://www.fdns.net">this one</A>, also provide 
-this service.</P>
-
-<P>Dynamic IP users take note: the domain where you place your key
- need not be associated with the IP address for your system, 
- or even with your system's usual hostname.</P>
-
-<H4>Choose your ID</H4>
-
-<P>Choose a name within that domain which you will use to identify your 
- machine. It's convenient if this can be the same as your hostname:</P>
-<PRE>    [root@xy root]# hostname --fqdn
-    xy.example.com</PRE>
-<P>This name in FQDN (fully-qualified domain name)
-format will be your ID, for DNS key lookup and IPsec
-negotiation.</P>
-
-
-<H4>Create a forward TXT record</H4>
-
-<P>Generate a forward TXT record containing your system's public key
- with a command like:</P>
-<PRE>    ipsec showhostkey --txt @xy.example.com</PRE>
-<P>using your chosen ID in place of 
-xy.example.com.
-This command takes the contents of
-/etc/ipsec.secrets and reformats it into something usable by ISC's BIND.
- The result should look like this (with the key data trimmed down for
- clarity):</P>
-<PRE>
-    ; RSA 2192 bits   xy.example.com   Thu Jan  2 12:41:44 2003
-        IN      TXT     "X-IPsec-Server(10)=@xy.example.com" 
-    "AQOF8tZ2... ...+buFuFn/"
-</PRE>
-
-
-<H4>Publish the forward TXT record</H4>
-
-<P>Insert the record into DNS, or have a system adminstrator do it
-for you. It may take up to 48 hours for the record to propagate, but 
-it's usually much quicker.</P>
-
-<H3>Test that your key has been published</H3>
-
-<P>Check your DNS work</P>
-
-<PRE>    ipsec verify --host xy.example.com</PRE>
-
-<P>As part of the <var>verify</var> output, you ought to see something 
-like:</P>
-
-<PRE>    ...
-    Looking for TXT in forward map: xy.example.com          [OK]
-    ...</PRE>
-
-<P>For this type of opportunism, only the forward test is relevant;
-you can ignore the tests designed to find reverse records.</P>
-
-
-<H3>Configure, if necessary</H3>
-
-<P>
-If your ID is the same as your hostname,
-you're ready to go.
-FreeS/WAN will use its 
-<A HREF="policygroups.html">built-in connections</A> to create 
-your iOE functionality.
-</P>
-
-<P>If you have chosen a different ID, you must tell FreeS/WAN about it via
-<A HREF="manpage.d/ipsec.conf.5.html"><VAR>ipsec.conf</VAR></A>:
-
-<PRE>    config setup
-        myid=@myname.freedns.example.com</PRE>
-
-<P>and restart FreeS/WAN:
-</P>
-<PRE>    service ipsec restart</PRE>
-<P>The new ID will be applied to the built-in connections.</P>
-
-<P>Note: you can create more complex iOE configurations as explained in our
-<A HREF="policygroups.html#policygroups">policy groups document</A>, or
-disable OE using
-<A HREF="policygroups.html#disable_policygroups">these instructions</A>.</P>
-
-
-<H3>Test</H3>
-<P>That's it! <A HREF="#opp.test">Test your connections</A>.</P>
-
-<A name="opp.incoming"></A><H2>Full Opportunism</H2>
-
-<P>Full opportunism
-allows you to initiate and receive opportunistic connections on your
-machine.</P>
-
-<A name="incoming.opp.dns"></A><H3>Put a TXT record in a Forward Domain</H3>
-
-<P>To set up full opportunism, first
-<A HREF="#forward.dns">set up a forward TXT record</A> as for 
-<A HREF="#opp.client">initiator-only OE</A>, using
-an ID (for example, your hostname) that resolves to your IP. Do not
-configure <VAR>/etc/ipsec.conf</VAR>, but continue with the
-instructions for full opportunism, below.
-</P>
-
-<P>Note that this forward record is not currently necessary for full OE, 
-but will facilitate future features.</P>
-
-
-<A name="incoming.opp.dns"></A><H3>Put a TXT record in Reverse DNS</H3>
-
-<P>You must be able to publish your DNS RR directly in the reverse domain.
-FreeS/WAN will not follow a PTR which appears in the reverse, since 
-a second lookup at connection start time is too costly.</P>
-
-
-<H4>Create a Reverse DNS TXT record</H4>
-
-<P>This record serves to publicize your FreeS/WAN public key. In 
- addition, it lets others know that this machine can receive opportunistic 
-connections, and asserts that the machine is authorized to encrypt on 
-its own behalf.</P>
-
-<P>Use the command:</P>
-<PRE>    ipsec showhostkey --txt 192.0.2.11</PRE>
-<P>where you replace 192.0.2.11 with your public IP.</P>
-
-<P>The record (with key shortened) looks like:</P>
-<PRE>    ; RSA 2048 bits  xy.example.com   Sat Apr 15 13:53:22 2000
-    IN TXT  &quot;X-IPsec-Server(10)=192.0.2.11&quot; &quot; AQOF8tZ2...+buFuFn/&quot;</PRE>
-
-
-<H4>Publish your TXT record</H4>
-
-<P>Send these records to your ISP, to be published in your IP's reverse map.
-It may take up to 48 hours for these to propagate, but usually takes
-much less time.</P>
-
-
-<H3>Test your DNS record</H3>
-
-<P>Check your DNS work with</P>
-
-<PRE>    ipsec verify --host xy.example.com</PRE>
-
-<P>As part of the <var>verify</var> output, you ought to see something like:</P>
-
-<PRE>    ...
-    Looking for TXT in reverse map: 11.2.0.192.in-addr.arpa [OK]
-    ...</PRE>
-
-<P>which indicates that you've passed the reverse-map test.</P>
-
-<H3>No Configuration Needed</H3>
-
-<P>FreeS/WAN 2.x ships with full OE enabled, so you don't need to configure 
-anything.
-To enable OE out of the box, FreeS/WAN 2.x uses the policy group
-<VAR>private-or-clear</VAR>,
-which creates IPsec connections if possible (using OE if needed), 
-and allows traffic in the clear otherwise. You can create more complex 
-OE configurations as described in our
-<A HREF="policygroups.html#policygroups">policy groups document</A>, or 
-disable OE using 
-<A HREF="policygroups.html#disable_policygroups">these instructions</A>.</P>
-
-<P>If you've previously configured for initiator-only opportunism, remove 
- <VAR>myid=</VAR> from <VAR>config setup</VAR>, so that peer FreeS/WANs 
-will look up your key by IP. Restart FreeS/WAN so that your change will 
-take effect, with</P>
-
-<PRE>    service ipsec restart</PRE>
-
-
-<H3>Consider Firewalling</H3>
-
-<P>If you are running a default install of RedHat 8.x, take note: you will
-need to alter your iptables rule setup to allow IPSec traffic through your
-firewall. See <A HREF="firewall.html#simple.rules">our firewall document</A>
-for sample <VAR>iptables</VAR> rules.</P>
-
-
-<H3>Test</H3>
-
-<P>That's it. Now, <A HREF="#opp.test">test your connection</A>.
-
-
-
-
-<H3>Test</H3>
-
-<P>Instructions are in the next section.</P>
-
-
-<H2><A NAME="opp.test">Testing opportunistic connections</A></H2>
-
-<P>Be sure IPsec is running. You can see whether it is with:</P>
-<PRE>    ipsec setup status</PRE>
-<P>If need be, you can restart it with:</P>
-<PRE>    service ipsec restart</PRE>
-
-<P>Load a FreeS/WAN test website from the host on which you're running
-FreeS/WAN. Note: the feds may be watching these sites. Type one of:<P>
-<PRE>   links oetest.freeswan.org</PRE>
-<PRE>   links oetest.freeswan.nl</PRE>
-<!--<PRE>   links oetest.freeswan.ca</PRE>-->
-
-<P>A positive result looks like this:</P>
-
-<PRE>
-   You  seem  to  be  connecting  from:  192.0.2.11 which DNS says is:
-   gateway.example.com
-     _________________________________________________________________
-
-   Status E-route
-   OE    enabled    16    192.139.46.73/32    ->    192.0.2.11/32   =>
-   tun0x2097@192.0.2.11
-   OE    enabled    176    192.139.46.77/32    ->   192.0.2.11/32   =>
-   tun0x208a@192.0.2.11
-</PRE>
-
-<P>If you see this, congratulations! Your OE host or gateway will now encrypt 
-its own traffic whenever it can. For more OE tests, please see our
-<A HREF="testing.html#test.oe">testing document</A>. If you have difficulty, 
-see our <A HREF="#oe.trouble">OE troubleshooting tips</A>.
-</P>
-
-
-
-<H2>Now what?</H2>
-
-<P>Please see our <A HREF="policygroups.html">policy groups document</A>
-for more ways to set up Opportunistic Encryption.</P>
-
-<P>You may also wish to make some <A HREF="config.html">
-pre-configured connections</A>.
-</P>
-
-<H2>Notes</H2>
-
-<UL>
-<LI>We assume some facts about your system in order to make Opportunistic
-Encryption easier to configure. For example, we assume that you wish
-to have FreeS/WAN secure your default interface.</LI>
-<LI>You may change this, and other settings, by altering the
-<VAR>config setup</VAR> section in 
-<VAR>/etc/ipsec.conf</VAR>.
-</LI>
-<LI>Note that the built-in connections used to build policy groups do 
-not inherit from <VAR>conn default</VAR>.</LI>
-<!--
-<LI>If you do not define your local identity
-(eg. <VAR>leftid</VAR>), this will be the IP address of your default
-FreeS/WAN interface.  
--->
-<LI>
-If you fail to define your local identity and
-do not fill in your reverse DNS entry, you will not be able to use OE.</LI>
-</UL>
-
-<A NAME="oe.trouble"></A><H2>Troubleshooting OE</H2>
-
-<P>See the OE troubleshooting hints in our 
-<A HREF="trouble.html#oe.trouble">troubleshooting guide</A>.
-</P>
-
-<A NAME="oe.known-issues"></A><H2>Known Issues</H2>
-
-<P>Please see 
-<A HREF="opportunism.known-issues">this list</A> of known issues
-with Opportunistic Encryption.</P>
-
-
-</BODY>
-</HTML>
diff --git a/doc/src/reference.ESPUDP.xml b/doc/src/reference.ESPUDP.xml
deleted file mode 100644
index c9b96cef3..000000000
--- a/doc/src/reference.ESPUDP.xml
+++ /dev/null
@@ -1,34 +0,0 @@
-<?xml version='1.0'?>
-<!DOCTYPE reference SYSTEM 'rfc2629.dtd'>
-
-<reference anchor='ESPUDP'>
-
-<front>
-<title abbrev='UDPESP'>UDP Encapsulation of IPsec Packets</title>
-<author initials='A.' surname='Huttunen' fullname='Ari Huttunen'>
-<organization>F-Secure Corporation</organization>
-<address>
-<postal>
-<street>Tammasaarenkatu 7</street>
-<street>FIN-00181 HELSINKI</street>
-<country>Finland</country></postal>
-<email>Ari.Huttunen@F-Secure.com</email></address></author>
-
-<author initials='W.' surname='Dixon' fullname='William Dixon'>
-<organization>Microsoft</organization>
-<address>
-<postal>
-<street>One Microsoft Way</street>
-<street>Redmond</street>
-<street>WA 98052</street>
-<country>USA</country></postal>
-<email>wdixon@microsoft.com</email></address></author>
-
-<date month='June' year='2001'></date>
-<area>Security</area>
-<keyword>IP security protocol</keyword>
-<keyword>IPSEC</keyword>
-<keyword>security</keyword></front>
-
-<seriesInfo name='ID' value='internet-draft (draft-ietf-ipsec-udp-encaps-00) (informative)' />
-</reference>
diff --git a/doc/src/reference.KEYRESTRICT.xml b/doc/src/reference.KEYRESTRICT.xml
deleted file mode 100644
index 62aa1ef96..000000000
--- a/doc/src/reference.KEYRESTRICT.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<?xml version='1.0'?>
-<!DOCTYPE reference SYSTEM 'rfc2629.dtd'>
-
-<reference anchor='KEYRESTRICT'>
-
-<front>
-<title abbrev='KEYRESTRICT'>Limiting the Scope of the KEY Resource Record</title>
-<author initials='D.' surname='Massey' fullname='Dan Massey'>
-<organization>USC/ISI</organization>
-<address>
-<postal>
-<street>USC Informational Sciences Institute</street>
-<street>3811 North Fairfax Drive, Suite 200</street>
-<street>Arlington, VA 22203</street>
-<country>USA</country></postal>
-<email>masseyd@isi.edu</email></address></author>
-
-<author initials='S.' surname='Rose' fullname='Scott Rose'>
-<organization>National Institute for Standards and Technology</organization>
-<address>
-<postal>
-<street>Gaithersburg, MD</street>
-<country>USA</country></postal>
-<email>scott.rose@nist.gov</email></address></author>
-
-<date month='March' year='2002'></date>
-<area>Internet</area>
-</front>
-
-<seriesInfo name='ID' value='internet-draft (draft-ietf-dnsext-restrict-key-for-dnssec-02) (normative)' />
-</reference>
diff --git a/doc/src/reference.MODPGROUPS.xml b/doc/src/reference.MODPGROUPS.xml
deleted file mode 100644
index 5eaf83f89..000000000
--- a/doc/src/reference.MODPGROUPS.xml
+++ /dev/null
@@ -1,32 +0,0 @@
-<?xml version='1.0'?>
-<!DOCTYPE reference SYSTEM 'rfc2629.dtd'>
-
-<reference anchor='MODPGROUPS'>
-
-<front>
-<title abbrev='MODPGROUPS'>More MODP Diffie-Hellman groups for IKE</title>
-<author initials='T.' surname='Kivinen' fullname='Tero Kivinen'>
-<organization>SSH Communications Security</organization>
-<address>
-<postal>
-<street>Fredrikinkatu 42</street>
-<street>FIN-00100 HELSINKI</street>
-<country>Finland</country></postal>
-<email>kivinen@ssh.fi</email></address></author>
-
-<author initials='M.' surname='Kojo' fullname='Mika Kojo'>
-<organization>University of Helsinki</organization>
-<address>
-<postal>
-<street>HELSINKI</street>
-<country>Finland</country></postal>
-<email>mrskojo@cc.helsinki.fi</email></address></author>
-
-<date month='November' year='2001'></date>
-<area>Security</area>
-<keyword>IP security protocol</keyword>
-<keyword>IPSEC</keyword>
-<keyword>security</keyword></front>
-
-<seriesInfo name='ID' value='internet-draft (draft-ietf-ipsec-ike-modp-groups-03) (normative)' />
-</reference>
diff --git a/doc/src/reference.OEspec.xml b/doc/src/reference.OEspec.xml
deleted file mode 100644
index 29c6d6efd..000000000
--- a/doc/src/reference.OEspec.xml
+++ /dev/null
@@ -1,45 +0,0 @@
-<?xml version='1.0'?>
-<!DOCTYPE reference SYSTEM 'rfc2629.dtd'>
-
-<reference anchor='OEspec'>
-
-<front>
-<title abbrev='OEspec'>Opportunistic Encryption</title>
-
-  <author initials="D.H." surname="Redelmeier"
-          fullname="D. Hugh Redelmeier">
-    <organization abbrev="Mimosa">Mimosa</organization>
-    <address>
-      <postal>   
-      	<street>Somewhere</street>
-        <city>Toronto</city>
-        <region>ON</region>
-        <country>CA</country>
-      </postal>
-      <email>hugh@mimosa.com</email>
-    </address>
-  </author>
-
-  <author initials="H." surname="Spencer"
-          fullname="Henry Spencer">
-    <organization abbrev="SP Systems">SP Systems</organization>
-    <address>
-      <postal>
-      	<street>Box 280 Station A</street>
-	<city>Toronto</city>
-	<region>ON</region>
-	<code>M5W 1B2</code>
-	<country>Canada</country>
-      </postal>
-      <email>henry@spsystems.net</email>
-    </address>
-  </author>
-
-<date month='May' year='2001'></date>
-<keyword>IP security protocol</keyword>
-<keyword>IPSEC</keyword>
-<keyword>security</keyword></front>
-
-<seriesInfo name='paper' value='http://www.freeswan.org/freeswan_trees/freeswan-1.91/doc/opportunism.spec' />
-</reference>
-
diff --git a/doc/src/reference.RFC.3526.xml b/doc/src/reference.RFC.3526.xml
deleted file mode 100644
index 54fed705a..000000000
--- a/doc/src/reference.RFC.3526.xml
+++ /dev/null
@@ -1,32 +0,0 @@
-<?xml version='1.0'?>
-<!DOCTYPE reference SYSTEM 'rfc2629.dtd'>
-
-<reference anchor='RFC3526'>
-
-<front>
-<title abbrev='MODPGROUPS'>More MODP Diffie-Hellman groups for IKE</title>
-<author initials='T.' surname='Kivinen' fullname='Tero Kivinen'>
-<organization>SSH Communications Security</organization>
-<address>
-<postal>
-<street>Fredrikinkatu 42</street>
-<street>FIN-00100 HELSINKI</street>
-<country>Finland</country></postal>
-<email>kivinen@ssh.fi</email></address></author>
-
-<author initials='M.' surname='Kojo' fullname='Mika Kojo'>
-<organization>University of Helsinki</organization>
-<address>
-<postal>
-<street>HELSINKI</street>
-<country>Finland</country></postal>
-<email>mrskojo@cc.helsinki.fi</email></address></author>
-
-<date month='March' year='2003'></date>
-<area>Security</area>
-<keyword>IP security protocol</keyword>
-<keyword>IPSEC</keyword>
-<keyword>security</keyword></front>
-
-<seriesInfo name='RFC' value='3526' />
-</reference>
diff --git a/doc/src/responderstate.txt b/doc/src/responderstate.txt
deleted file mode 100644
index f64b82983..000000000
--- a/doc/src/responderstate.txt
+++ /dev/null
@@ -1,43 +0,0 @@
-                |
-                | IKE main mode 
-                |  phase 1
-                V
-        .-----------------.  
-        | unauthenticated | 
-        |     OE peer     |
-        `-----------------'
-                |
-                | lookup KEY RR in in-addr.arpa 
-                |             (if ID_IPV4_ADDR)
-                | lookup KEY RR in forward
-                |             (if ID_FQDN)
-                V
-        .-----------------.  RR not found
-        |   received DNS  |---------------> log failure
-        |     reply       | 
-        `----+--------+---'
-     phase 2 |        \      misformatted 
-    proposal |         `------------------> log failure
-             V
-    .----------------.
-    |  authenticated |  identical initiator 
-    |     OE peer    |--------------------> initiator 
-    `----------------'  connection found    state machine
-         |
-         | look for TXT record for initiator
-	 |
-         V  
-   .---------------.
-   |  authorized   |---------------------> log failure
-   |    OE peer    |
-   `---------------'
-         |
-         |
-         V
-    potential OE
-    connection in
-    initiator state
-	machine
-
-
-$Id: responderstate.txt,v 1.1 2004/03/15 20:35:24 as Exp $
diff --git a/doc/src/rfc.html b/doc/src/rfc.html
deleted file mode 100644
index 762c66c6e..000000000
--- a/doc/src/rfc.html
+++ /dev/null
@@ -1,158 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>IPsec RFCs</title>
-  <meta name="keywords"
-  content="IPsec, VPN, security, FreeSWAN, RFC, standard">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: rfc.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1><a name="RFC">IPsec RFCs and related documents</a></h1>
-
-<h2><a name="RFCfile">The RFCs.tar.gz Distribution File</a></h2>
-
-<p>The Linux FreeS/WAN distribution is available from <a
-href="http://www.xs4all.nl/~freeswan"> our primary distribution site</a> and
-various mirror sites. To give people more control over their downloads, the
-RFCs that define IP security are bundled separately in the file
-RFCs.tar.gz.</p>
-
-<p>The file you are reading is included in the main distribution and is
-available on the web site. It describes the RFCs included in the <a
-href="#RFCs.tar.gz">RFCs.tar.gz</a> bundle and gives some pointers to <a
-href="#sources">other ways to get them</a>.</p>
-
-<h2><a name="sources">Other sources for RFCs &amp; Internet drafts</a></h2>
-
-<h3><a name="RFCdown">RFCs</a></h3>
-
-<p>RFCs are downloadble at many places around the net such as:</p>
-<ul>
-  <li><a href="http://www.rfc-editor.org">http://www.rfc-editor.org</a></li>
-  <li><a href="http://nis.nsf.net/internet/documents/rfc">NSF.net</a></li>
-  <li><a href="http://sunsite.doc.ic.ac.uk/computing/internet/rfc">Sunsite in
-    the UK</a></li>
-</ul>
-
-<p>browsable in HTML form at others such as:</p>
-<ul>
-  <li><a
-  href="http://www.landfield.com/rfcs/index.html">landfield.com</a></li>
-  <li><a href="http://www.library.ucg.ie/Connected/RFC">Connected Internet
-    Encyclopedia</a></li>
-</ul>
-
-<p>and some of them are available in translation:</p>
-<ul>
-  <li><a href="http://www.eisti.fr/eistiweb/docs/normes/">French</a></li>
-</ul>
-
-<p>There is also a published <a href="biblio.html#RFCs">Big Book of IPSEC
-RFCs</a>.</p>
-
-<h3><a name="drafts">Internet Drafts</a></h3>
-
-<p>Internet Drafts, working documents which sometimes evolve into RFCs, are
-also available.</p>
-<ul>
-  <li><a href="http://www.ietf.org/ID.html">Overall reference page</a></li>
-  <li><a href="http://www.ietf.org/ids.by.wg/ipsec.html">IPsec</a> working
-    group</li>
-  <li><a href="http://www.ietf.org/ids.by.wg/ipsra.html">IPSRA (IPsec Remote
-    Access)</a> working group</li>
-  <li><a href="http://www.ietf.org/ids.by.wg/ipsp.html">IPsec Policy</a>
-    working group</li>
-  <li><a href="http://www.ietf.org/ids.by.wg/kink.html">KINK (Kerberized
-    Internet Negotiation of Keys)</a>  working group</li>
-</ul>
-
-<p>Note: some of these may be obsolete, replaced by later drafts or by
-RFCs.</p>
-
-<h3><a name="FIPS1">FIPS standards</a></h3>
-
-<p>Some things used by <a href="glossary.html#IPSEC">IPsec</a>, such as <a
-href="glossary.html#DES">DES</a> and <a href="glossary.html#SHA">SHA</a>, are
-defined by US government standards called <a
-href="glossary.html#FIPS">FIPS</a>. The issuing organisation, <a
-href="glossary.html#NIST">NIST</a>, have a <a
-href="http://www.itl.nist.gov/div897/pubs">FIPS home page</a>.</p>
-
-<h2><a name="RFCs.tar.gz">What's in the RFCs.tar.gz bundle?</a></h2>
-
-<p>All filenames are of the form rfc*.txt, with the * replaced with the RFC
-number.</p>
-<pre>RFC#        Title</pre>
-
-<h3><a name="rfc.ov">Overview RFCs</a></h3>
-<pre>2401        Security Architecture for the Internet Protocol
-2411        IP Security Document Roadmap</pre>
-
-<h3><a name="basic.prot">Basic protocols</a></h3>
-<pre>2402        IP Authentication Header
-2406        IP Encapsulating Security Payload (ESP)</pre>
-
-<h3><a name="key.ike">Key management</a></h3>
-<pre>2367        PF_KEY Key Management API, Version 2
-2407        The Internet IP Security Domain of Interpretation for ISAKMP
-2408        Internet Security Association and Key Management Protocol (ISAKMP)
-2409        The Internet Key Exchange (IKE)
-2412        The OAKLEY Key Determination Protocol
-2528        Internet X.509 Public Key Infrastructure</pre>
-
-<h3><a name="rfc.detail">Details of various things used</a></h3>
-<pre>2085        HMAC-MD5 IP Authentication with Replay Prevention
-2104        HMAC: Keyed-Hashing for Message Authentication
-2202        Test Cases for HMAC-MD5 and HMAC-SHA-1
-2207        RSVP Extensions for IPSEC Data Flows
-2403        The Use of HMAC-MD5-96 within ESP and AH
-2404        The Use of HMAC-SHA-1-96 within ESP and AH
-2405        The ESP DES-CBC Cipher Algorithm With Explicit IV
-2410        The NULL Encryption Algorithm and Its Use With IPsec
-2451        The ESP CBC-Mode Cipher Algorithms
-2521        ICMP Security Failures Messages</pre>
-
-<h3><a name="rfc.ref">Older RFCs which may be referenced</a></h3>
-<pre>1321        The MD5 Message-Digest Algorithm
-1828        IP Authentication using Keyed MD5
-1829        The ESP DES-CBC Transform
-1851        The ESP Triple DES Transform
-1852        IP Authentication using Keyed SHA</pre>
-
-<h3><a name="rfc.dns">RFCs for secure DNS service, which IPsec may
-use</a></h3>
-<pre>2137        Secure Domain Name System Dynamic Update
-2230        Key Exchange Delegation Record for the DNS
-2535        Domain Name System Security Extensions
-2536        DSA KEYs and SIGs in the Domain Name System (DNS)
-2537        RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)
-2538        Storing Certificates in the Domain Name System (DNS)
-2539        Storage of Diffie-Hellman Keys in the Domain Name System (DNS)</pre>
-
-<h3><a name="rfc.exp">RFCs labelled "experimental"</a></h3>
-<pre>2521        ICMP Security Failures Messages
-2522        Photuris: Session-Key Management Protocol
-2523        Photuris: Extended Schemes and Attributes</pre>
-
-<h3><a name="rfc.rel">Related RFCs</a></h3>
-<pre>1750        Randomness Recommendations for Security
-1918        Address Allocation for Private Internets
-1984        IAB and IESG Statement on Cryptographic Technology and the Internet
-2144        The CAST-128 Encryption Algorithm</pre>
-</body>
-</html>
diff --git a/doc/src/roadmap.html b/doc/src/roadmap.html
deleted file mode 100644
index c9d85047c..000000000
--- a/doc/src/roadmap.html
+++ /dev/null
@@ -1,203 +0,0 @@
-<html>
-<head>
-<title>FreeS/WAN roadmap</title>
-<meta name="keywords" content="Linux, IPsec, VPN, security, FreeSWAN">
-
-<!--
-
-Written by Sandy Harris for the Linux FreeS/WAN project
-Freely distributable under the GNU General Public License
-
-More information at www.freeswan.org
-Feedback to users@lists.freeswan.org
-
-CVS information:
-RCS ID:          $Id: roadmap.html,v 1.1 2004/03/15 20:35:24 as Exp $
-Last changed:    $Date: 2004/03/15 20:35:24 $
-Revision number: $Revision: 1.1 $
-
-CVS revision numbers do not correspond to FreeS/WAN release numbers.
--->
-</head>
-
-<body>
-<h1><a name="roadmap">Distribution Roadmap: What's Where in Linux FreeS/WAN</a></h1>
-
-<p>
-This file is a guide to the locations of files within the FreeS/WAN
-distribution. Everything described here should be on your system once you
-download, gunzip, and untar the distribution.</p>
-
-<p>This distribution contains two major subsystems
-</p>
-<dl>
-  <dt><a href="#klips.roadmap">KLIPS</a></dt>
-    <dd>the kernel code</dd>
-  <dt><a href="#pluto.roadmap">Pluto</a></dt>
-    <dd>the user-level key-management daemon</dd>
-</dl>
-
-<p>plus assorted odds and ends.
-</p>
-<h2><a name="top">Top directory</a></h2>
-
-<p>The top directory has essential information in text files:</p>
-
-<dl>
-  <dt>README</dt>
-    <dd>introduction to the software</dd>
-  <dt>INSTALL</dt>
-    <dd>short experts-only installation procedures. More detalied procedures are in
-      <a href="install.html">installation</a> and
-	<a href="config.html">configuration</a> HTML documents.</dd>
-  <dt>BUGS</dt>
-    <dd>major known bugs in the current release.</dd>
-  <dt>CHANGES</dt>
-    <dd>changes from previous releases</dd>
-  <dt>CREDITS</dt>
-    <dd>acknowledgement of contributors</dd>
-  <dt>COPYING</dt>
-    <dd>licensing and distribution information</dd>
-</dl>
-
-<h2><a name="doc">Documentation</a></h2>
-
-<p>
-The doc directory contains the bulk of the documentation, most of it in
-HTML format. See the <a href="index.html">index file</a> for details.
-</p>
-
-<h2><a name="klips.roadmap">KLIPS: kernel IP security</a></h2>
-</a>
-<p>
-<a href="glossary.html#KLIPS">KLIPS</a> is <strong>K</strong>erne<strong>L</strong>
-<strong>IP</strong> <strong>S</strong>ecurity. It lives in the klips
-directory, of course.
-</p>
-<dl>
-  <dt>klips/doc</dt>
-    <dd>documentation</dd>
-  <dt>klips/patches</dt>
-    <dd>patches for existing kernel files</dd>
-  <dt>klips/test</dt>
-    <dd>test stuff</dd>
-  <dt>klips/utils</dt>
-    <dd>low-level user utilities</dd>
-  <dt>klips/net/ipsec</dt>
-    <dd>actual klips kernel files</dd>
-  <dt>klips/src</dt>
-    <dd>symbolic link to klips/net/ipsec
-      <p>The "make insert" step of installation installs the patches and makes
-      a symbolic link from the kernel tree to klips/net/ipsec. The odd name of
-      klips/net/ipsec is dictated by some annoying limitations of the scripts
-      which build the Linux kernel.  The symbolic-link business is a bit
-      messy, but all the alternatives are worse.</p>
-      <p></p>
-    </dd>
-  <dt>klips/utils</dt>
-    <dd>Utility programs:
-      <p></p>
-      <dl>
-        <dt>eroute</dt>
-          <dd>manipulate IPsec extended routing tables</dd>
-        <dt>klipsdebug</dt>
-          <dd>set Klips (kernel IPsec support) debug features and level</dd>
-        <dt>spi</dt>
-          <dd>manage IPsec Security Associations</dd>
-        <dt>spigrp</dt>
-          <dd>group/ungroup IPsec Security Associations</dd>
-        <dt>tncfg</dt>
-          <dd>associate IPsec virtual interface with real interface</dd>
-      </dl>
-      <p>These are all normally invoked by ipsec(8) with commands such as</p>
-      <pre>        ipsec tncfg <var>arguments</var></pre>
-      There are section 8 man pages for all of these; the names have "ipsec_"
-      as a prefix, so your man command should be something like:
-      <pre>        man 8 ipsec_tncfg</pre>
-    </dd>
-</dl>
-
-<h2><a name="pluto.roadmap">Pluto key and connection management daemon</a></h2>
-
-<p>
-<a href="glossary.html#Pluto">Pluto</a> is our key management and negotiation daemon. It
-lives in the pluto directory, along with its low-level user utility,
-whack.
-</p>
-<p>
-There are no subdirectories. Documentation is a man page,
-<a href="manpage.d/ipsec_pluto.8.html">pluto.8</a>. This covers whack as well.
-</p>
-
-<h2><a name="utils">Utils</a></h2>
-
-<p>
-The utils directory contains a growing collection of higher-level user
-utilities, the commands that administer and control the software.  Most of the
-things that you will actually have to run yourself are in there.
-</p>
-<dl>
-  <dt>ipsec</dt>
-    <dd>invoke IPsec utilities
-      <p>ipsec(8) is normally the only program installed in a standard
-      directory, /usr/local/sbin. It is used to invoke the others, both those
-      listed below and the ones in klips/utils mentioned above.</p>
-      <p></p>
-    </dd>
-  <dt>auto</dt>
-    <dd>control automatically-keyed IPsec connections</dd>
-  <dt>manual</dt>
-    <dd>take manually-keyed IPsec connections up and down</dd>
-  <dt>barf</dt>
-    <dd>generate copious debugging output</dd>
-  <dt>look</dt>
-    <dd>generate moderate amounts of debugging output</dd>
-</dl>
-<p>
-There are .8 manual pages for these. look is covered in barf.8. The man pages
-have an "ipsec_" prefix so your man command should be something like:
-<pre>
-        man 8 ipsec_auto
-</pre>
-<p>
-Examples are in various files with names utils/*.eg</p>
-
-<h2><a name="lib">Libraries</a></h2>
-
-<h3><a name="fswanlib">FreeS/WAN Library</a></h3>
-
-<p>
-The lib directory is the FreeS/WAN library, also steadily growing, used by
-both user-level and kernel code.<br />
-It includes section 3 <a href="manpages.html">man pages</a> for the library routines.
-</p>
-<h3><a name="otherlib">Imported Libraries</a></h3>
-
-<h4>LibDES</h4>
-
-The libdes library, originally from SSLeay, is used by both Klips and Pluto
-for <a href="glossary.html#3DES">Triple DES</a> encryption. Single DES is not
-used because <a href="politics.html#desnotsecure">it is
-insecure</a>.
-<p>
-Note that this library has its own license, different from the
-<a href="glossary.html#GPL">GPL</a> used for other code in FreeS/WAN.
- </p>
-<p>
-The library includes its own documentation.
-
-
-<h4>GMP</h4>
-
-The GMP (GNU multi-precision) library is used for multi-precision arithmetic
-in Pluto's key-exchange code and public key code.
-<p>
-Older versions (up to 1.7) of FreeS/WAN included a copy of this library in
-the FreeS/WAN distribution.
-<p>
-Since 1.8, we have begun to rely on the system copy of GMP.
-</p>
-
-</body>
-</html>
-
diff --git a/doc/src/testing.html b/doc/src/testing.html
deleted file mode 100644
index 8ffcca604..000000000
--- a/doc/src/testing.html
+++ /dev/null
@@ -1,395 +0,0 @@
-<html>
-<head>
-<title>Testing FreeS/WAN</title>
-
-<meta name="keywords" content="Linux, IPsec, VPN, security, FreeSWAN, testing">
-
-<!--
-
-Written by Sandy Harris for the Linux FreeS/WAN project
-Freely distributable under the GNU General Public License
-
-More information at www.freeswan.org
-Feedback to users@lists.freeswan.org
-
-CVS information:
-RCS ID:          $Id: testing.html,v 1.1 2004/03/15 20:35:24 as Exp $
-Last changed:    $Date: 2004/03/15 20:35:24 $
-Revision number: $Revision: 1.1 $
-
-CVS revision numbers do not correspond to FreeS/WAN release numbers.
--->
-</head>
-
-<body>
-<h1><a name="test.freeswan">Testing FreeS/WAN</a></h1>
-This document discusses testing FreeS/WAN.
-
-<p>Not all types of testing are described here. Other parts of the
-documentation describe some tests:</p>
-<dl>
-  <dt><a href="install.html#testinstall">installation</a> document</dt>
-    <dd>testing for a successful install</dd>
-  <dt><a href="config.html#testsetup">configuration</a> document</dt>
-    <dd>basic tests for a working configuration</dd>
-  <dt><a href="web.html#interop.web">web links</a> document</dt>
-    <dd>General information on tests for interoperability between various
-      IPsec implementations. This includes links to several test sites.</dd>
-  <dt><a href="interop.html">interoperation</a> document.</dt>
-    <dd>More specific information on FreeS/WAN interoperation with other
-      implementations.</dd>
-  <dt><a href="performance.html">performance</a> document</dt>
-    <dd>performance measurements</dd>
-</dl>
-
-<p>The test setups and procedures described here can also be used in other
-testing, but this document focuses on testing the IPsec functionality of
-FreeS/WAN.</p>
-
-<H2><A NAME="test.oe">Testing opportunistic connections</A></H2>
-
-<P>This section teaches you how to test your opportunistically encrypted (OE)
-connections. To set up OE, please see the easy instructions in our
-<A HREF="quickstart.html">quickstart guide</A>.</P>
-
-<H3>Basic OE Test</H3>
-
-
-<P>This test is for basic OE functionality. 
-<!-- You may use it on an 
-<A HREF="quickstart.html#oppo.client">initiate-only OE</A> box or a 
-<A HREF="quickstart.html#opp.incoming">full OE</A> box. -->
-For additional tests, keep reading.</P>
-
-<P>Be sure IPsec is running. You can see whether it is with:</P>
-<PRE>    ipsec setup status</PRE>
-<P>If need be, you can restart it with:</P>
-<PRE>    service ipsec restart</PRE>
-                                                                                
-<P>Load a FreeS/WAN test website from the host on which you're running
-FreeS/WAN. Note: the feds may be watching these sites. Type one of:<P>
-<PRE>   links oetest.freeswan.org</PRE>
-<PRE>   links oetest.freeswan.nl</PRE>
-<!--<PRE>   links oetest.freeswan.ca</PRE>-->
-                                                                                
-<P>A positive result looks like this:</P>
-                                                                                
-<PRE>
-   You  seem  to  be  connecting  from:  192.0.2.11 which DNS says is:
-   gateway.example.com
-     _________________________________________________________________
-                                                                                
-   Status E-route
-   OE    enabled    16    192.139.46.73/32    ->    192.0.2.11/32   =>
-   tun0x2097@192.0.2.11
-   OE    enabled    176    192.139.46.77/32    ->   192.0.2.11/32   =>
-   tun0x208a@192.0.2.11
-</PRE>
-                                                                                
-<P>If you see this, congratulations! Your OE box will now encrypt
-its own traffic whenever it can. If you have difficulty,
-see our <A HREF="#oe.trouble">OE troubleshooting tips</A>.
-</P>
-
-<H3>OE Gateway Test</H3>                                                                                
-<P>If you've set up FreeS/WAN to protect a subnet behind your gateway,
-you'll need to run another simple test, which can be done from a machine
-running any OS. That's right, your Windows box can be protected by
-opportunistic encryption without any FreeS/WAN install or configuration
-on that box. From <STRONG>each protected subnet node</STRONG>,
-load the FreeS/WAN website with:</P>
-                                                                                
-<PRE>   links oetest.freeswan.org</PRE>
-<PRE>   links oetest.freeswan.nl</PRE>
-                                                                                
-<P>A positive result looks like this:</P>
-<PRE>
-   You  seem  to  be  connecting  from:  192.0.2.98 which DNS says is:
-   box98.example.com
-     _________________________________________________________________
-                                                                                
-   Status E-route
-   OE    enabled    16    192.139.46.73/32    ->    192.0.2.98/32   =>
-   tun0x134ed@192.0.2.11
-   OE    enabled    176    192.139.46.77/32    ->   192.0.2.11/32   =>
-   tun0x134d2@192.0.2.11
-</PRE>
-                                                                                
-<P>If you see this, congratulations! Your OE gateway will now encrypt
-traffic for this subnet node whenever it can. If you have difficulty, see our
-<A HREF="#oe.trouble">OE troubleshooting tips</A>.
-</P>
-                                                                                
-                                                                                
-<H3>Additional OE tests</H3>
-                                                                                
-<P>When testing OE, you will often find it useful to execute this command
-on the FreeS/WAN host:</P>
-<PRE>   ipsec eroute</PRE>
-                                                                                
-<P>If you have established a connection (either for or for a subnet node)
-you will see a result like:</P>
-                                                                                
-<PRE>    192.0.2.11/32   -> 192.139.46.73/32  => tun0x149f@192.139.46.38
-</PRE>
-                                                                                
-<P>Key:</P>
-<TABLE>
-<TR><TD>1.</TD>
-    <TD>192.0.2.11/32</TD>
-    <TD>Local start point of the protected traffic.
-    </TD></TR>
-<TR><TD>2.</TD>
-    <TD>192.0.2.194/32</TD>
-    <TD>Remote end point of the protected traffic.
-    </TD></TR>
-<TR><TD>3.</TD>
-    <TD>192.0.48.38</TD>
-    <TD>Remote FreeS/WAN node (gateway or host).
-        May be the same as (2).
-   </TD></TR>
-<TR><TD>4.</TD>
-    <TD>[not shown]</TD>
-    <TD>Local FreeS/WAN node (gateway or host), where you've produced the output.
-        May be the same as (1).
-   </TD></TR>
-</TABLE>
-                                                                                
-                                                                                
-<P>For extra assurance, you may wish to use a packet sniffer such as
-<A HREF="http://www.tcpdump.org">tcpdump</A> to verify that packets
-are being encrypted. You should see output that indicates
-<STRONG>ESP</STRONG> encrypted data,
- for example:</P>
-                                                                                
-<PRE>    02:17:47.353750 PPPoE  [ses 0x1e12] IP 154: xy.example.com > oetest.freeswan.org: ESP(spi=0x87150d16,seq=0x55)</PRE>
-                                                                                
-
-
-<h2><a name="test.uml">Testing with User Mode Linux</a></h2>
-
-<p><a href="http://user-mode-linux.sourceforge.net/">User Mode Linux</a>
-allows you to run Linux as a user process on another Linux machine.</p>
-
-<p>As of 1.92, the distribution has a new directory named  testing. It
-contains a collection of test scripts and sample configurations. Using these,
-you can bring up several copies of Linux in user mode and have them build
-tunnels to each other. This lets you do some testing of  a FreeS/WAN
-configuration on a single machine.</p>
-
-<p>You need a moderately well-endowed machine for this to work well. Each UML
-wants about 16 megs of memory by default, which is plenty for FreeS/WAN
-usage. Typical regression testing only occasionally uses as many as 4 UMLs.
-If one is doing nothing else with the machine (in particular, not running X
-on it), then 128 megs and a 500MHz CPU are fine.</p>
-
-Documentation on these
-scripts is <a href="umltesting.html">here</a>. There is also documentation 
-on automated testing <A href="makecheck.html">here</a>.
- 
-<h2><a name="testnet">Configuration for a testbed network</a></h2>
-
-<p>A common test setup is to put a machine with dual Ethernet cards in
-between two gateways under test. You need at least five machines; two
-gateways, two clients and a testing machine in the middle.</p>
-
-<p>The central machine both routes packets and provides a place to run
-diagnostic software for checking IPsec packets. See next section for
-discussion of <a href="#tcpdump.faq">using tcpdump(8)</a> for this.</p>
-
-<p>This makes things more complicated than if you just connected the two
-gateway machines directly to each other, but it also makes your test setup
-much more like the environment you actually use IPsec in. Those environments
-nearly always involve routing, and quite a few apparent IPsec failures turn
-out to be problems with routing or with firewalls dropping packets. This
-approach lets you deal with those problems on your test setup.</p>
-
-<p>What you end up with looks like:</p>
-
-<h3><a name="testbed">Testbed network</a></h3>
-<pre>      subnet a.b.c.0/24
-             |
-      eth1 = a.b.c.1
-         gate1
-      eth0 = 192.168.p.1
-             |
-             |
-      eth0 = 192.168.p.2
-         route/monitor box
-      eth1 = 192.168.q.2
-             |
-             |
-      eth0 = 192.168.q.1
-         gate2
-      eth1 = x.y.z.1
-              |
-       subnet x.y.z.0/24</pre>
-<pre>Where p and q are any convenient values that do not interfere with other
-routes you may have. The ipsec.conf(5) file then has, among other things:</pre>
-<pre>conn abc-xyz
-      left=192.168.p.1
-      leftnexthop=192.168.p.2
-      right=192.168.q.1
-      rightnexthop=192.168.q.2</pre>
-
-<p>Once that works, you can remove the "route/monitor box", and connect the
-two gateways to the Internet. The only parameters in ipsec.conf(5) that need
-to change are the four shown above. You replace them with values appropriate
-for your Internet connection, and change the eth0 IP addresses and the
-default routes on both gateways.</p>
-
-<p>Note that nothing on either subnet needs to change. This lets you test
-most of your IPsec setup before connecting to the insecure Internet.</p>
-
-<h3><a name="tcpdump.test">Using packet sniffers in testing</a></h3>
-
-<p>A number of tools are available for looking at packets. We will discuss
-using <a href="http://www.tcpdump.org/">tcpdump(8)</a>, a common Linux tool
-included in most distributions. Alternatives offerring more-or-less the same
-functionality include:</p>
-<dl>
-  <dt><a href="http://www.ethereal.com">Ethereal</a></dt>
-    <dd>Several people on our mailing list report a preference for this over
-      tcpdump.</dd>
-  <dt><a href="http://netgroup-serv.polito.it/windump/">windump</a></dt>
-    <dd>a Windows version of tcpdump(8), possibly handy if you have Windows
-      boxes in your network</dd>
-  <dt><a
-  href="http://reptile.rug.ac.be/~coder/sniffit/sniffit.html">Sniffit</a></dt>
-    <dd>A linux sniffer that we don't know much about. If you use it, please
-      comment on our mailing list.</dd>
-</dl>
-
-<p>See also this <a
-href="http://www.tlsecurity.net/unix/ids/sniffer/">index</a> of packet
-sniffers.</p>
-
-<p>tcpdump(8) may misbehave if run on the gateways themselves. It is designed
-to look into a normal IP stack and may become confused if you ask it to
-display data from a stack which has IPsec in play.</p>
-
-<p>At one point, the problem was quite severe. Recent versions of tcpdump,
-however, understand IPsec well enough to be usable on a gateway. You can get
-the latest version from <a href="http://www.tcpdump.org/">tcpdump.org</a>.</p>
-
-<p>Even with a recent tcpdump, some care is required. Here is part of a post
-from Henry on the topic:</p>
-<pre>&gt; a) data from sunset to sunrise or the other way is not being
-&gt; encrypted (I am using tcpdump (ver. 3.4) -x/ping -p to check
-&gt; packages) 
-
-What *interface* is tcpdump being applied to?  Use the -i option to
-control this.  It matters!  If tcpdump is looking at the ipsecN
-interfaces, e.g. ipsec0, then it is seeing the packets before they are
-encrypted or after they are decrypted, so of course they don't look
-encrypted.  You want to have tcpdump looking at the actual hardware
-interfaces, e.g. eth0. 
-
-Actually, the only way to be *sure* what you are sending on the wire is to
-have a separate machine eavesdropping on the traffic.  Nothing you can do
-on the machines actually running IPsec is 100% guaranteed reliable in this
-area (although tcpdump is a lot better now than it used to be).</pre>
-
-<p>The most certain way to examine IPsec packets is to look at them on the
-wire. For security, you need to be certain, so we recommend doing that. To do
-so, you need a <strong>separate sniffer machine located between the two
-gateways</strong>. This machine can be routing IPsec packets, but it must not
-be an IPsec gateway. Network configuration for such testing is discussed <a
-href="#testnet">above</a>.</p>
-
-<p>Here's another mailing list message with advice on using tcpdump(8):</p>
-<pre>Subject: RE: [Users] Encrypted???
-   Date: Thu, 29 Nov 2001
-   From: "Joe Patterson" &lt;jpatterson@asgardgroup.com&gt;
-
-tcpdump -nl -i $EXT-IF proto 50
-
--nl tells it not to buffer output or resolve names (if you don't do that it
-may confuse you by not outputing anything for a while), -i $EXT-IF (replace
-with your external interface) tells it what interface to listen on, and
-proto 50 is ESP.  Use "proto 51" if for some odd reason you're using AH, and
-"udp port 500" if you want to see the isakmp key exchange/tunnel setup
-packets.
-
-You can also run `tcpdump -nl -i ipsec0` to see what traffic is on that
-virtual interface.  Anything you see there *should* be either encrypted or
-dropped (unless you've turned on some strange options in your ipsec.conf
-file)
-
-Another very handy thing is ethereal (http://www.ethereal.com/) which runs
-on just about anything, has a nice gui interface (or a nice text-based
-interface), and does a great job of protocol  breakdown.  For ESP and AH
-it'll basically just tell you that there's a packet of that protocol, and
-what the spi is, but for isakmp it'll actually show you a lot of the tunnel
-setup information (until it gets to the point in the protocol where isakmp
-is encrypted....)</pre>
-
-<h2><a name="verify.crypt">Verifying encryption</a></h2>
-
-<p>The question of how to verify that messages are actually encrypted has
-been extensively discussed on the mailing list. See this <a
-href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/07/msg00262.html">thread</a>.</p>
-
-<p>If you just want to verify that packets are encrypted, look at them with a
-packet sniffer (see <a href="#tcpdump.test">previous section</a>) located
-between the gateways. The packets should, except for some of the header
-information, be utterly unintelligible. <strong>The output of good encryption
-looks <em>exactly</em> like random noise</strong>. </p>
-
-<p>A packet sniffer can only tell you that the data you looked at was
-encrypted. If you have stronger requirements -- for example if your security
-policy requires verification that plaintext is not leaked during startup or
-under various anomolous conditions -- then you will need to devise much more
-thorough tests. If you do that, please post any results or methodological
-details which your security policy allows you to make public.</p>
-
-<p>You can put recognizable data into ping packets with something like:</p>
-<pre>        ping -p feedfacedeadbeef 11.0.1.1</pre>
-
-<p>"feedfacedeadbeef" is a legal hexadecimal pattern that is easy to pick out
-of hex dumps.</p>
-
-<p>For other protocols, you may need to check if you have encrypted data or
-ASCII text. Encrypted data has approximately equal frequencies for all 256
-possible characters. ASCII text has most characters in the printable range
-0x20-0x7f, a few control characters less than 0x20, and none at all in the
-range 0x80-0xff. 0x20, space, is a good character to look for. In normal
-English text space occurs about once in seven characters, versus about once
-in 256 for random or encrypted data.</p>
-
-<p>One thing to watch for: the output of good compression, like that of good
-encryption, looks just like random noise. You cannot tell just by looking at
-a data stream whether it has been compressed, encrypted, or both. You need a
-little care not to mistake compressed data for encrypted data in your
-testing.</p>
-
-<p>Note also that weak encryption also produces random-looking output. You
-cannot tell whether the encryption is strong by looking at the output. To be
-sure of that, you would need to have both the algorithms and the
-implementation examined by experts. </p>
-
-<p>For IPsec, you can get partial assurance from interoperability tests. See
-our <a href="interop.html">interop</a> document. When twenty products all
-claim to implement <a href="glossary.html#3DES">3DES</a>, and they all talk
-to each other, you can be fairly sure they have it right. Of course, you
-might wonder whether all the implementers are consipring to trick you or,
-more plausibly, whether some implementations might have "back doors" so they
-can get also it wrong when required.. If you're seriously worried about
-things like that, you need to get the code you use audited (good luck if it
-is not Open Source), or perhaps to talk to a psychiatrist about treatments
-for paranoia. </p>
-
-<h2><a name="mail.test">Mailing list pointers</a></h2>
-
-<p>Additional information on testing can be found in these <a
-href="mail.html">mailing list</a> messages:</p>
-<ul>
-  <li>a user's detailed <a
-    href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00571.html">setup
-    diary</a> for his testbed network</li>
-  <li>a FreeS/WAN team member's <a
-    href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00425.html">notes</a>
-    from testing at an IPsec interop "bakeoff"</li>
-</ul>
-</body>
-</html>
diff --git a/doc/src/testingtools.html b/doc/src/testingtools.html
deleted file mode 100644
index 491b1956c..000000000
--- a/doc/src/testingtools.html
+++ /dev/null
@@ -1,188 +0,0 @@
-<html>
-<head>
-<title>FreeS/WAN survey of testing tools</title>
-<!-- Changed by: Michael Richardson, 02-Jan-2002 -->
-<meta name="keywords" content="Linux, IPsec, VPN, security, FreeSWAN, testing, nettools">
-
-<!--
-
-Written by Michael Richardson for the Linux FreeS/WAN project
-Freely distributable under the GNU General Public License
-
-More information at www.freeswan.org
-Feedback to users@lists.freeswan.org
-
-$Id: testingtools.html,v 1.1 2004/03/15 20:35:24 as Exp $
-
-$Log: testingtools.html,v $
-Revision 1.1  2004/03/15 20:35:24  as
-added files from freeswan-2.04-x509-1.5.3
-
-Revision 1.1  2002/03/12 20:57:25  mcr
-	review of tools used for testing FreeSWAN systems.
-
-
--->
-</head>
-
-<body>
-
-<h1>Survey of testing tools</h1>
-
-<h2><A HREF="http://freshmeat.net/projects/apsend">http://freshmeat.net/projects/apsend</A></h2>
-
-<P>
-About: <A HREF="">APSEND</A> is a TCP/IP packet sender to test firewalls and other
-network applications. It also includes a syn flood option, the land
-DoS attack, a DoS attack against tcpdump running on a UNIX-based
-system, a UDP-flood attack, and a ping flood option. It currently
-supports the following protocols: IP, TCP, UDP, ICMP, Ethernet frames
-and you can also build any other type of protocol using the generic
-option. The scripting language of apsend is already written, but not
-yet public.   
-</P>
-
-<P>
-STATUS: The public web site seems to have died
-</P>
-
-<h2><A HREF="http://freshmeat.net/projects/hping2">http://freshmeat.net/projects/hping2</A></h2>
-
-<P>
-About: <A HREF="http://www.hping.org/">hping2</A> is a network tool
-able to send custom ICMP/UDP/TCP packets and to display target replies
-like ping does with ICMP replies. It handles fragmentation and
-arbitrary packet body and size, and can be used to transfer files
-under supported protocols. Using hping2, you can: test firewall rules,
-perform [spoofed] port scanning, test net performance using different
-protocols, packet size, TOS (type of service), and fragmentation, do
-path MTU discovery, tranfer files (even between really Fascist
-firewall rules), perform traceroute-like actions under different
-protocols, fingerprint remote OSs, audit a TCP/IP stack, etc. hping2
-is a good tool for learning TCP/IP.  
-</P>
-
-<P>
-This utility has rather complicated usage and no man page at present. 
-The documentation is supposed to be in HPING2-HOWTO, but that file
-seems to be absent. 
-</P>
-
-<h2><A HREF="http://freshmeat.net/projects/icmpush">http://freshmeat.net/projects/icmpush</A></h2>
-
-<P>
-About: ICMPush is a tool that send ICMP packets fully customized from command
-line. This release supports the ICMP error types Unreach, Parameter
-Problem, Redirect and Source Quench and the ICMP information types
-Timestamp, Address Mask Request, Information Request, Router
-Solicitation, Router Advertisement and Echo Request. Also supports
-ip-spoofing, broadcasting and other useful features. It's really a
-powerful program for testing and debugging TCP/IP stacks and networks.
-</P>
-
-<P>
-</P>
-
-<h2><A HREF="http://freshmeat.net/projects/isic">http://freshmeat.net/projects/isic</A></h2>
-
-<P>
-ISIC sends randomly generated packets to a target computer. Its
-primary uses are to stress-test an IP stack, to find leaks in a
-firewall, and to test the implementation of IDSes and firewalls. The
-user can specify how often the packets will be frags, have IP options,
-TCP options, an urgent pointer, etc. Programs for TCP, UDP, ICMP,
-IP w/ random protocols, and random ethernet frames are included.  
-</P>
-
-<h2><A HREF="http://freshmeat.net/projects/sendpacket">http://freshmeat.net/projects/sendpacket</A></h2>
-
-<P>
-Send Packet is a small but powerful program to test how your network
-responds to specific packet content. Via a config file and/or command
-line parameters, you can forge (modify the headers of) your own
-TCP/UDP/ICMP/IP packets and send them through your network. Also,
-following the Easy Sniffer modular philosophy, you can specify wich
-modules you'd like to build.  
-</P>
-
-<h2><A HREF="http://freshmeat.net/projects/aicmpsend/">http://freshmeat.net/projects/aicmpsend/</A></h2>
-
-<P>
-AICMPSEND is an ICMP sender with many features including ICMP
-flooding and spoofing. All ICMP flags and codes are implemented. You
-can use this program for various DoS attacks, for ICMP flooding and
-to test firewalls.  
-</P>
-
-<h2><A HREF="http://freshmeat.net/projects/sendip/">http://freshmeat.net/projects/sendip/</A></h2>
-
-<P>
-SendIP is a command-line tool to send arbitrary IP packets. It has a
-large number of options to specify the content of every header of a
-RIP, TCP, UDP, ICMP, or raw IPv4/IPv6 packet. It also allows any data
-to be added to the packet. Checksums can be calculated automatically,
-but if you wish to send out wrong checksums, that is supported too.  
-</P>
-
-<h2><A HREF="http://laurent.riesterer.free.fr/gasp/index.html">http://laurent.riesterer.free.fr/gasp/index.html</A></h2>
-
-<P>
-GASP stands for 'Generator and Analyzer System for Protocols'. It
-allows you to decode and encode any protocols you specify.  
-</P>
-
-<P>
-The main use is probably to test networks applications : you can
-construct packets by hand and test the behavior of your program when
-facing some strange packets. But you can image a lot of other
-application : e.g. manipulating graphical file or executable
-headers. Just describe the specification of the structured data.  
-</P>
-
-<P>
-GASP is divided in two parts : a compiler which take the specification
-of the protocols and generate the code to handle it, this code is a
-new Tcl command as GASP in build upon Tcl/Tk and extends the scripting
-facilities provided by Tcl. 
-</P>
-
-<h2><A HREF="http://pdump.lucidx.com/">http://pdump.lucidx.com/</A></h2>
-<h2><A HREF="http://freshmeat.net/projects/aps/">http://freshmeat.net/projects/aps/</A></h2>
-<h2><A HREF="http://freshmeat.net/projects/netsed/">http://freshmeat.net/projects/netsed/</A></h2>
-<h2><A HREF="http://www.via.ecp.fr/~bbp/netsh/">http://www.via.ecp.fr/~bbp/netsh/</A></h2>
-<h2><A HREF="http://www.elxsi.de/">http://www.elxsi.de/</A></h2>
-<h2><A HREF="http://www.laurentconstantin.com/us/lcrzo/">http://www.laurentconstantin.com/us/lcrzo/</A></h2>
-<h2><A HREF="http://www.joedog.org/libping/index.html">http://www.joedog.org/libping/index.html</A></h2>
-<h2><A HREF="http://feynman.mme.wilkes.edu/projects/xNetTools/">http://feynman.mme.wilkes.edu/projects/xNetTools/</A></h2>
-<h2><A HREF="http://freshmeat.net/projects/pktsrc/">http://freshmeat.net/projects/pktsrc/</A></h2>
-<h2><A HREF="http://freshmeat.net/projects/lcrzoex/">http://freshmeat.net/projects/lcrzoex/</A></h2>
-<h2><A HREF="http://freshmeat.net/projects/rain/">http://freshmeat.net/projects/rain/</A></h2>
-<P>
-rain is a powerful packet builder for testing the stability of
-hardware and software. Its features include support for all IP
-protocols and the ability to fully customize the packets it sends.  
-</P>
-
-<P>(Note, this is not the same as /usr/games/rain)</P>
-
-<h2><A HREF="http://freshmeat.net/projects/libnet">http://freshmeat.net/projects/libnet</A></h2>
-<h2><A HREF="http://freshmeat.net/projects/pftp">http://freshmeat.net/projects/pftp</A></h2>
-<h2><A HREF="http://freshmeat.net/projects/pung">http://freshmeat.net/projects/pung</A></h2>
-
-<P>
-pung is a simple server tester. It tries to connect via TCP/IP to a
-server but does not transfer any data. It is meant to be used in
-scripts that check a list of servers, helping to detect certain common
-problems.  
-</P>
-
-<h2><A HREF="http://freshmeat.net/projects/thesunpacketshell">http://freshmeat.net/projects/thesunpacketshell</A></h2>
-<h2><A HREF="http://freshmeat.net/projects/webperformancetrainer">http://freshmeat.net/projects/webperformancetrainer</A></h2>
-<h2><A HREF="http://sourceforge.net/projects/va-ctcs">http://sourceforge.net/projects/va-ctcs</A></h2>
-<h2><A HREF="http://synscan.nss.nu/programs.php">http://synscan.nss.nu/programs.php</A></h2>
-<h2><A HREF="http://sourceforge.net/projects/va-ctcs">http://sourceforge.net/projects/va-ctcs</A></h2>
-<h2><A HREF="http://freshmeat.net/projects/ettercap/">http://freshmeat.net/projects/ettercap/</A></h2>
-<h2><A HREF="http://www.dtek.chalmers.se/~d3august/xt/index.html">http://www.dtek.chalmers.se/~d3august/xt/index.html</A></h2>
-<h2><A HREF="http://www.opersys.com/LTT/">http://www.opersys.com/LTT/</A></h2>
-<h2><A HREF="http://packetstorm.securify.com/DoS/indexdate.shtml">http://packetstorm.securify.com/DoS/indexdate.shtml</A></h2>
-<H2> <A HREF="http://comnet.technion.ac.il/~cn1w02/">TCP/IP noise simulator</A></H2>
diff --git a/doc/src/trouble.html b/doc/src/trouble.html
deleted file mode 100644
index 604264c01..000000000
--- a/doc/src/trouble.html
+++ /dev/null
@@ -1,840 +0,0 @@
-<HTML>
-<HEAD>
-	<TITLE>FreeS/WAN troubleshooting</TITLE>
-      <meta name="keywords" content="Linux, IPSEC, VPN, security, FreeSWAN, troubleshooting, debugging">
-<!--
-     Written by Claudia Schmeing for the Linux FreeS/WAN project
-     Freely distributable under the GNU General Public License
-
-     More information at www.freeswan.org
-     Feedback to users@lists.freeswan.org
-
-CVS information:
-RCS ID:          $Id: trouble.html,v 1.1 2004/03/15 20:35:24 as Exp $
-Last changed:    $Date: 2004/03/15 20:35:24 $
-Revision number: $Revision: 1.1 $
-
-CVS revision numbers do not correspond to FreeS/WAN release numbers.
--->
- 
-</HEAD>
-<BODY>
-
-<H1><A NAME="trouble"></A>Linux FreeS/WAN Troubleshooting Guide</H1>
-
-<H2><A NAME="overview"></A>Overview</H2>
-
-<P>
-This document covers several general places where you might have a problem:</P>
-<OL>
-	<LI><A HREF="#install">During install</A>.</LI>
-	<LI><A HREF="#negotiation">During the negotiation process</A>.</LI>
-	<LI><A HREF="#use">Using an established connection</A>.</LI>
-</OL>
-<P>This document also contains <A HREF="#notes">notes</A> which
-expand on points made in these sections, and tips for 
-<A HREF="#prob.report">problem
-reporting</A>. If the other end of your connection is not FreeS/WAN,
-you'll also want to read our 
-<A HREF="interop.html#interop.problem">interoperation</A> document.</P>
-<H2><A NAME="install"></A>1. During Install</H2>
-<H3>1.1 RPM install gotchas</H3>
-<P>With the RPM method:</P>
-<UL>
-<LI>Be sure you have installed both the userland tools and the kernel
-  components. One will not work without the other. For example, when using 
-  FreeS/WAN-produced RPMs for our 2.04 release, you need both:
-<PRE>    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm
-    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm
-</PRE>
-</LI>
-</UL>
-<H3>1.2 Problems installing from source</H3>
-<P>When installing from source, you may find these problems:</P>
-<UL>
-	<LI>Missing library. See <A HREF="faq.html#gmp.h_missing">this</A>
-	FAQ.</LI>
-	<LI>Missing utilities required for compile. See this 
-        <A HREF="install.html#tool.lib">checklist</A>.</LI>
-	<LI>Kernel version incompatibility. See <A HREF="faq.html#k.versions">this</A>
-	FAQ.</LI>
-	<LI>Another compile problem. Find information in the out.* files,
-	ie. out.kpatch, out.kbuild, created at compile time in the top-level
-	Linux FreeS/WAN directory. Error messages generated by KLIPS during
-	the boot sequence are accessible with the <VAR>dmesg</VAR> command. 
-	<BR>
-	Check the list archives and the List in Brief to see if this is a
-	known issue. If it is not, report it to the bugs list as described
-	in our <A HREF="#prob.report">problem reporting</A> section. In some
-	cases, you may be asked to provide debugging information using gdb;
-	details <A HREF="#gdb">below</A>.</LI>
-	<LI>If your kernel compiles but you fail to install your new
-	FreeS/WAN-enabled kernel, review the sections on <A HREF="install.html#newk">installing
-	the patched kernel</A>, and <A HREF="install.html#testinstall">testing</A>
-	to see if install succeeded.</LI>
-</UL>
-<H3><A NAME="install.check"></A>1.3 Install checks</H3>
-<P><VAR>ipsec verify</VAR> checks a number 
-of FreeS/WAN essentials. Here are some hints on what do to when your
-system doesn't check out:</P>
-<P>
-<TABLE border=1>
-<TR>
-<TD><STRONG>Problem</STRONG></TD>
-<TD><STRONG>Status</STRONG></TD>
-<TD><STRONG>Action</STRONG></TD>
-</TR>
-<TR>
-<TD><VAR>ipsec</VAR> not on-path</TD>
-<TD>&nbsp;</TD>
-<TD><P>Add <VAR>/usr/local/sbin</VAR> to your PATH.</P></TD>
-</TR>
-<TR>
-<TD>Missing KLIPS support</TD>
-<TD><FONT COLOR="#FF0000">critical</FONT></TD>
-<TD>See <A HREF="faq.html#noKLIPS">this FAQ.</A></TD>
-</TR>
-<TR>
-<TD>No RSA private key</TD>
-<TD>&nbsp;</TD>
-<TD>
-<P>Follow <A HREF="install.html#genrsakey">these 
-instructions</A> to create an RSA key pair for your host. RSA keys are:</P>
-<UL>
-<LI>required for opportunistic encryption, and</LI>
-<LI>our preferred method to authenticate pre-configured connections.</LI>
-</UL>
-</TD>
-</TR>
-<TR>
-<TD><VAR>pluto</VAR> not running</TD>
-<TD><FONT COLOR="#FF0000">critical</FONT></TD>
-<TD><PRE>service ipsec start</PRE></TD>
-</TR>
-<TR>
-<TD>No port 500 hole</TD>
-<TD><FONT COLOR="#FF0000">critical</FONT></TD>
-<TD>Open port 500 for IKE negotiation.</TD>
-</TR>
-<TR>
-<TD>Port 500 check N/A</TD>
-<TD>&nbsp;</TD>
-<TD>Check that port 500 is open for IKE negotiation.</TD>
-</TR>
-<TR>
-<TD>Failed DNS checks</TD>
-<TD>&nbsp;</TD>
-<TD>Opportunistic encryption requires information from DNS.
-To set this up, see <A HREF="quickstart.html#opp.setup">our instructions</A>.
-</TD>
-</TR>
-<TR>
-<TD>No public IP address</TD>
-<TD>&nbsp;</TD>
-<TD>Check that the interface which you want to protect with IPSec is up and 
-running.</TD>
-</TR>
-</TABLE>
-
-
-<H3><A NAME="oe.trouble"></A>1.3 Troubleshooting OE</H3>
-<P>OE should work with no local configuration, if you have posted
-DNS TXT records according to the instructions in our 
-<A HREF="quickstart.html">quickstart guide</A>.
-If you encounter trouble, try these hints. 
-We welcome additional hints via the
-<A HREF="mail.html">users' mailing list</A>.</P>
-                                                                                
-<TABLE border=1>
-<TR>
-<TD><STRONG>Symptom</STRONG></TD>
-<TD><STRONG>Problem</STRONG></TD>
-<TD><STRONG>Action</STRONG></TD>
-</TR>
-<TR>
-<TD>
-You're running FreeS/WAN 2.01 (or later),
-and initiating a connection to FreeS/WAN
-2.00 (or earlier).
-In your logs, you see a message like:
-<pre>no RSA public key known for '192.0.2.13';
-DNS search for KEY failed (no KEY record
-for 13.2.0.192.in-addr.arpa.)</pre>
-The older FreeS/WAN logs no error.
-</TD>
-<TD>
-<A NAME="oe.trouble.flagday"></A>
-A protocol level incompatibility between 2.01 (or later) and
-2.00 (or earlier) causes this error. It occurs when a FreeS/WAN 2.01
-(or later) box for which no KEY record is posted attempts to initiate an OE
-connection to older FreeS/WAN versions (2.00 and earlier).
-Note that older versions can initiate to newer versions without this error.
-</TD>
-<TD>If you control the peer host, upgrade its FreeS/WAN to 2.01 (or later), and
-post new style TXT records for it. If not, but if you know its sysadmin,
-perhaps a quick note is in order. If neither option is possible, you can
-ease the transition by posting an old style KEY record (created with a
-command like "ipsec&nbsp;showhostkey&nbsp;--key") to the reverse map for
-the FreeS/WAN 2.01 (or later) box.</TD>
-</TR>
-<TR>
-<TD>OE host is very slow to contact other hosts.</TD>
-<TD>Slow DNS service while running OE.</TD>
-<TD>It's a good idea to run a caching DNS server on your OE host,
-as outlined in <A HREF="http://lists.freeswan.org/pipermail/design/2003-January/004205.html">this
-mailing list message</A>. If your DNS servers are elsewhere,
-put their IPs
-in the <VAR>clear</VAR> policy group, and
-re-read groups with <PRE>ipsec auto --rereadgroups</PRE>
-</TD>
-</TR>
-<TR>
-<TD>
-<PRE>Can't Opportunistically initiate for
-192.0.2.2 to 192.0.2.3: no TXT record
-for 13.2.0.192.in-addr.arpa.</PRE>
-</TD>
-<TD>Peer is not set up for OE.</TD>
-<TD><P>None. Plenty of hosts on the Internet
-do not run OE. If, however, you have set OE up on that peer, this may
-indicate that you need to wait up to 48 hours
-for its DNS records to propagate.</P></TD>
-</TR>
-<TR>
-<TD><VAR>ipsec verify</VAR> does not find DNS records:
-<PRE>...
-Looking for TXT in forward map:
-                xy.example.com...[FAILED]
-Looking for TXT in reverse map...[FAILED]
-...</PRE>
-                                                                                
-You also experience authentication failure:<BR>
-<PRE>Possible authentication failure:
-no acceptable response to our
-first encrypted message</PRE>
-</TD>
-                                                                                
-<TD>DNS records are not posted or have not propagated.</TD>
-<TD>Did you post the DNS records necessary for OE? If not,
-do so using the instructions in our
-<A HREF="quickstart.html#quickstart">quickstart guide</A>.
-If so, wait up to 48 hours for the DNS records to propagate.</TD>
-</TR>
-<TR>
-<TD><VAR>ipsec verify</VAR> does not find DNS records, and you experience
-authentication failure.</TD>
-<TD>For iOE, your ID
-does not match location of
-forward DNS record.</TD>
-<TD>In <VAR>config setup</VAR>, change
-<VAR>myid=</VAR> to match the forward DNS where you posted the record.
-Restart FreeS/WAN.
- For reference, see our
-<A HREF="quickstart.html#opp.client">iOE instructions</A>.</TD>
-</TR>
-<TR>
-<TD><VAR>ipsec verify</VAR> finds DNS records, yet there is
-still authentication failure. ( ? )</TD>
-<TD>DNS records are malformed.</TD>
-<TD>Re-create the records and send new copies to your DNS administrator.</TD>
-</TR>
-<TR>
-<TD><VAR>ipsec verify</VAR> finds DNS records, yet there is
-still authentication failure. ( ? )</TD>
-<TD>DNS records show different keys for a gateway vs. its subnet hosts.</TD>
-<TD>All TXT records for boxes protected by an OE gateway must contain the
-gateway's public key. Re-create and re-post any incorrect records using
-<A HREF="quickstart.html#opp.incoming">these instructions</A>.</TD>
-</TR>
-<TR>
-<TD>OE gateway loses connectivity to its subnet. The gateway's
-routing table shows routes to the subnet through IPsec interfaces.</TD>
-<TD>The subnet is part of the <VAR>private</VAR> or <VAR>block</VAR>
-policy group on the gateway.</TD>
-<TD>Remove the subnet from the group, and reread
-groups with <PRE>ipsec auto --rereadgroups</PRE></TD>
-</TR>
-<TR>
-<TD>OE does not work to hosts on the local LAN.</TD>
-<TD>This is a known issue.</TD>
-<TD>See <A HREF="opportunism.known-issues">this list</A> of known issues
-with OE.
-</TD>
-</TR>
-                                                                                
-<TR>
-<TD>FreeS/WAN does not seem to be executing your default policy. In your
-logs, you see a message like:
-<PRE>/etc/ipsec.d/policies/iprivate-or-clear"
-line 14: subnet "0.0.0.0/0",
-source 192.0.2.13/32,
-already "private-or-clear"</PRE>
-</TD>
-<TD><A HREF="glossary.html#fullnet">Fullnet</A> in a policy group file defines
-your default policy. Fullnet should normally be present in only one policy
-group file. The fine print: you can have two default policies defined so long
-as they protect different local endpoints (e.g. the FreeS/WAN gateway and a
-subnet).</TD>
-<TD>
-Find all policies which contain fullnet with:<br>
-<PRE>grep -F 0.0.0.0/0 /etc/ipsec.d/policies/*</PRE>
-then remove the unwanted occurrence(s).
-</TD>
-</TR>
-                                                                                
-</TABLE>
-
-
-<H2><A NAME="negotiation"></A>2. During Negotiation</H2>
-<P>When you fail to bring up a tunnel, you'll need to find out:</P>
-<UL>
-<LI><A HREF="#state">what your connection state is,</A> and often</LI>
-<LI><A HREF="#find.pluto.error">an error message</A>.</LI>
-</UL>
-<P>before you can 
-<A HREF="#interpret.pluto.error">diagnose your problem</A>.</P>
-<H3><A NAME="state"></A>2.1 Determine Connection State</H3>
-<H4>Finding current state</H4>
-<P>You can see connection states (STATE_MAIN_I1 and so on) when you
-bring up a connection on the command line. If you have missed this,
-or brought up your connection automatically, use:
-</P>
-<PRE>ipsec auto --status</PRE>
-<P>The most relevant state is the last one reached.</P>
-<H4><VAR>What's this supposed to look like?</VAR></H4>
-<P>Negotiations should proceed though various states, in the processes of:</P>
-<OL>
-<LI>IKE negotiations (aka Phase 1, Main Mode, STATE_MAIN_*)</LI>
-<LI>IPSEC negotiations (aka Phase 2, Quick Mode, STATE_QUICK_*)</LI>
-</OL>
-<P>These are done and a connection is established when you see messages like:</P>
-<PRE>    000 #21: &quot;myconn&quot; STATE_MAIN_I4 (ISAKMP SA established)...
-    000 #2: &quot;myconn&quot; STATE_QUICK_I2 (sent QI2, IPsec SA established)...</PRE><P>
-Look for the key phrases are &quot;ISAKMP SA established&quot; and &quot;IPSec
-SA established&quot;, with the relevant connection name. Often, this happens 
-at STATE_MAIN_I4 and STATE_QUICK_I2, respectively.</P>
-<P><VAR>ipsec auto --status</VAR> will tell you what states <STRONG>have
-been achieved</STRONG>, rather than the current state. Since
-determining the current state is rather more difficult to do, current
-state information is not available from Linux FreeS/WAN. If you are
-actively bringing a connection up, the status report's last states
-for that connection likely reflect its current state. Beware, though,
-of the case where a connection was correctly brought up but is now
-downed: Linux FreeS/WAN will not notice this until it attempts to
-rekey. Meanwhile, the last known state indicates that the connection
-has been established.</P>
-<P>If your connection is stuck at STATE_MAIN_I1, skip straight to 
-<A HREF="#ikepath">here</A>.
-
-<H3><A NAME="find.pluto.error"></A>2.2 Finding error text</H3>
-<P>Solving most errors will require you to find verbose error text,
-either on the command line or in the logs.</P>
-<H4>Verbose start for more information</H4>
-<P>
-Note that you can get more detail from <VAR>ipsec auto</VAR> using
-the --verbose flag:</P>
-<PRE STYLE="margin-bottom: 0.2in">    ipsec auto --verbose --up west-east</PRE><P>
-More complete information can be gleaned from the <A HREF="#logusage">log
-files</A>.</P>
-
-<H4>Debug levels count</H4>
-<P>The amount of description you'll get here depends on ipsec.conf debug
-settings, <VAR>klipsdebug</VAR>= and <VAR>plutodebug</VAR>=. 
-When troubleshooting, set at least one of these to <VAR>all</VAR>, and 
-when done, reset it to <VAR>none</VAR> so your logs don't fill up.
-Note that you must have enabled the <VAR>klipsdebug</VAR> 
-<A HREF="install.html#allbut">compile-time option</A> for the 
-<VAR>klipsdebug</VAR> configuration switch to work.</P>
-<P>For negotiation problems <VAR>plutodebug</VAR> is most relevant.
-<VAR>klipsdebug</VAR> applies mainly to attempts to use an
-already-established connection. See also <A HREF="ipsec.html#parts">this</A>
-description of the division of duties within Linux FreeS/WAN.</P>
-<P>After raising your debug levels, restart Linux FreeS/WAN to ensure
-that ipsec.conf is reread, then recreate the error to generate
-verbose logs. 
-</P>
-<H4><VAR>ipsec barf</VAR> for lots of debugging information</H4>
-<P>
-<A HREF="manpage.d/ipsec_barf.8.html"><VAR>ipsec barf (8)</VAR></A>
-collects a bunch of useful debugging information, including these logs
-Use the command</P>
-<PRE>
-    ipsec barf &gt; barf.west
-</PRE>
-<P>to generate one.</P>
-<H4>Find the error</H4>
-<P>Search out the failure point in your logs.
- Are there a handful of lines which succinctly describe how
-things are going wrong or contrary to your expectation? Sometimes the
-failure point is not immediately obvious: Linux FreeS/WAN's errors
-are usually not marked &quot;Error&quot;. Have a look in the 
-<A HREF="faq.html">FAQ</A>
-for what some common failures look like.</P>
-<P>Tip: problems snowball.
-Focus your efforts on the first problem, which is likely to be the
-cause of later errors.</P>
-<H4>Play both sides</H4>
-<P>Also find error text on the peer IPSec box.
-This gives you two perspectives on the same failure.</P>
-<P>At times you will require information which only one side has.
-The peer can merely indicate the presence of an error, and its 
-approximate point in the negotiations. If one side keeps retrying, 
-it may be because there is a show stopper on the other side. 
-Have a look at the other side and figure out what it doesn't like.</P>
-<P>If the other end is not Linux FreeS/WAN, the principle is the
-same: replicate the error with its most verbose logging on, and
-capture the output to a file.</P>
-<H3><A NAME="interpret.pluto.error"></A>2.3 Interpreting a Negotiation Error</H3>
-<H4><A NAME="ikepath"></A>Connection stuck at STATE_MAIN_I1</H4>
-<P>This error commonly happens because IKE (port 500) packets, needed 
-to negotiate an IPSec connection, cannot travel freely between your IPSec 
-gateways. See <A HREF="firewall.html#packets">our firewall document</A> 
-for details.</P>
-<H4>Other errors</H4>
-<P>Other errors require a bit more digging. Use the following resources:</P>
-<UL>
-	<LI><A HREF="faq.html">the FAQ</A> . Since this document is
-	constantly updated, the snapshot's FAQ may have a new entry relevant
-	to your problem.</LI>
-	<LI>our <A HREF="background.html">background document</A> .
-	Special considerations which, while not central to Linux FreeS/WAN,
-	are often tripped over. Includes problems with 
-      <a href="background.html#MTU.trouble">packet fragmentation</a>,
-      and considerations for
-	testing opportunism.</LI>
-	<LI>the <A HREF="mail.html#lists">list archives</A>. Each of the
-	searchable archives works differently, so it's worth checking each.
-	Use a search term which is generic, but identifies your error, for
-	example &quot;No connection is known for&quot;.
-	<BR>
-        Often, you will find that your question has been answered in the
-	past. Finding an archived answer is quicker than asking the list.
-	You may, however, find similar questions without answers. If you do,
-	send their URLs to the list with your trouble report. The additional
-	examples may help the list tech support person find your answer.</LI>
-	<LI>Look into the code where the error is being generated. The
-	pluto code is nicely documented with comments and meaningful
-	variable names.</LI>
-</UL>
-<P>If you have failed to solve your problem with the help of these
-resources, send a detailed problem report to the users list,
-following these <A HREF="#prob.report">guidelines</A>.</P>
-<H2><A NAME="use"></A>3. Using a Connection</H2>
-<H3>3.1 Orienting yourself</H3>
-<H4><VAR>How do I know if it works?</VAR></H4>
-<P>Test your connection by sending packets through it. The simplest way
-to do this is with ping, but the ping needs to <STRONG>test the correct 
-tunnel.</STRONG> See <A HREF="#testgates">this example scenario</A> if
-you don't understand this.<P>
-<P>If your ping returns, test any other connections you've brought
-u all check out, great. You may wish to <A HREF="#bigpacket">test
-with large packets</A> for MTU problems.</P>
-<H4><VAR>ipsec barf</VAR> is useful again</H4>
-<P>If your ping fails to return, generate an ipsec barf debugging
-report on each IPSec gateway. On a non-Linux FreeS/WAN
-implementation, gather equivalent information. Use this, and the tips
-in the next sections, to troubleshoot. Are you sure that both
-endpoints are capable of hearing and responding to ping?</P>
-<H3>3.2 Those pesky configuration errors</H3>
-<P>IPSec may be dropping your ping packets since they do not belong in the
-tunnels you have constructed:</P>
-<UL>
-<LI>Your ping may not test the tunnel you intend to test. For details, see our  
-<A HREF="faq.html#cantping">&quot;I can't ping&quot;</A> FAQ.
-</LI>
-<LI>
-Alternately, you may have a configuration error.
-For example, you may have configured one of the four possible tunnels between 
-two gateways, but not the one required to secure the important
-traffic you're now testing. In this case, add and start the tunnel,
-and try again.
-</LI>
-</UL>
-<P>In either case, you will often see a message like:</P>
-<PRE>klipsdebug... no eroute</PRE>
-<P>which we discuss in <A HREF="faq.html#no_eroute">this
-FAQ</A>.</P>
-<P>Note:</P>
-<UL>
-<LI><A HREF="glossary.html#NAT.gloss">Network Address Translation (NAT)</A> 
-and <A HREF="glossary.html#masq">IP masquerade</A> may have an effect on 
-which tunnels you need to configure.</LI>
-<LI>When testing a tunnel that protects a multi-node subnet, try several 
-subnet nodes as ping targets, in case one node is routing incorrectly.</LI>
-</UL>
-<H3><A NAME="route.firewall"></A>3.3 Check Routing and Firewalling</H3>
-<P>If you've confirmed your configuration assumptions, the problem is
-almost certainly with routing or firewalling. Isolate the problem
-using interface statistics, firewall statistics, or a packet sniffer.</P>
-<H4>Background:</H4>
-<UL>
-	<LI>Linux FreeS/WAN supplies all the special routing it needs;
-	you need only route packets out through your IPSec gateway. Verify
-	that on the <VAR>subnetted</VAR> machines you are using for your 
-        ping-test, your routing is as expected. I have seen a tunnel 
-        &quot;fail&quot; because the subnet machine sending packets 
-        out an alternate gateway (not our IPSec gateway) on their return path.
-	<LI>Linux FreeS/WAN requires particular <A HREF="firewall.html"> 
-        firewalling considerations</A>.
-	Check the firewall rules on your IPSec gateways and ensure that they
-	allow IPSec traffic through. Be sure that no other machine - for
-	example a router between the gateways - is blocking your IPSec
-	packets.
-</UL>
-<H4><A NAME="ifconfig"></A>View Interface and Firewall
-Statistics</H4>
-<P>Interface reports and firewall statistics can help you track down
-lost packets at a glance. Check any firewall statistics you may be keeping 
-on your IPSec gateways, for dropped packets.</P>
-
-<P><STRONG>Tip</STRONG>: You can take a snapshot of the packets processed 
-by your firewall with:</P>
-
-<PRE>    iptables -L -n -v</PRE>
-
-<P>You can get creative with "diff" to find out what happens to a
-particular packet during transmission.</P>
-
-<P>Both <VAR>cat /proc/net/dev</VAR> and <VAR>ifconfig</VAR> display
-interface statistics, and both are included in <VAR>ipsec barf</VAR>. Use
-either to check if any interface has dropped packets. If you find
-that one has, test whether this is related to your ping. While you
-ping continuously, print that interface's statistics several times.
-Does its drop count increase in proportion to the ping? If so, check
-why the packets are dropped there.</P>
-
-<P>To do this, look at the firewall rules that apply to that interface. If the
-interface is an IPSec interface, more information may be available in
-the log. Grep for the word &quot;drop&quot; in a log which was
-created with <VAR>klipsdebug=all</VAR> as the error happened.</P>
-<P>See also this <A HREF="#ifconfig1">discussion</A> on interpreting 
-<VAR>ifconfig</VAR> statistics.</P>
-<H3><A NAME="sniff"></A>3.4 When in doubt, sniff it out</H3>
-<P>If you have checked configuration assumptions, routing, and
-firewall rules, and your interface statistics yield no clue, it
-remains for you to investigate the mystery of the lost packet by the
-most thorough method: with a packet sniffer (providing, of course, 
-that this is legal where you are working).
-<P>In order to detect packets on the ipsec virtual interfaces,
-you will need an up-to-date sniffer (tcpdump, ethereal, ksnuffle) on
-your IPSec gateway machines. You may also find it useful to sniff the ping
-endpoints.</P>
-<H4>Anticipate your packets' path</H4>
-<P>Ping, and examine each interface along the projected path, checking for your 
-ping's arrival. If it doesn't get to the the next stop, you have narrowed 
-down where to look for it. In this way, you can isolate a problem area, 
-and narrow your troubleshooting focus.</P>
-<P>Within a machine running Linux FreeS/WAN, this 
-<A HREF="firewall.html#packets">packet flow diagram</A> will help you 
-anticipate a packet's path.
-<P>Note that:</P>
-<UL>
-<LI>
-from the perspective of the tunneled packet, the entire tunnel is one hop. 
-That's explained in <A HREF="faq.html#no_trace">this</A> FAQ.
-</LI>
-<LI>
- an encapsulated IPSec packet will look different, when
-sniffed, from the plaintext packet which generated it. You
-can see plaintext packets entering an IPSec interface and the
-resulting cyphertext packets as they emerge from the corresponding
-physical interface. 
-</LI>
-</UL>
-<P>Once you isolate where the packet is lost, take a closer look at
-firewall rules, routing and configuration assumptions as they affect
-that specific area. If the packet is lost on an IPSec gateway, comb
-through <VAR>klipsdebug</VAR> output for anomalies. 
-</P>
-<P>If the packet goes through both gateways successfully and reaches
-the ping target, but does not return, suspect routing. Check that the
-ping target routes packets back to the IPSec gateway.</P>
-<H3><A NAME="find.use.error"></A>3.5 Check your logs</H3>
-<P>Here, too, log information can be useful. Start with the 
-<A HREF="#find.pluto.error">guidelines above</A>.</P>
-<P>For connection use problems, set <VAR>klipsdebug=all</VAR>. Note
-that you must have enabled the <VAR>klipsdebug</VAR> 
-<A HREF="install.html#allbut">compile-time option</A> to do this. 
-Restart Linux FreeS/WAN so that it rereads <VAR>ipsec.conf</VAR>, 
-then recreate the error condition. When searching through 
-<VAR>klipsdebug</VAR> data, look especially for the keywords
-&quot;drop&quot; (as in dropped packets) and &quot;error&quot;.</P>
-<P>Often the problem with connection use is not software error, but
-rather that the software is behaving contrary to expectation. 
-</P>
-<H4><A NAME="interpret.use.error"></A>Interpreting log text</H4>
-<P>To interpret the Linux FreeS/WAN log text you've found, use the
-same resources as indicated for troubleshooting 
-connection negotiation: 
-<A HREF="faq.html">the FAQ</A> , our
-<A HREF="background.html">background document</A>, and the 
-<A HREF="mail.html#lists">list archives</A>.
-Looking in the KLIPS code is only for the very brave.</P>
-<P>If you are still stuck, send a <A HREF="#prob.report">detailed
-problem report</A> to the users' list.</P>
-<H3><A NAME="bigpacket"></A>3.6 More testing for the truly thorough</H3>
-<H4>Large Packets</H4>
-<P>If each of your connections passed the ping test, you may wish to
-test by pinging with large packets (2000 bytes or larger). If it does
-not return, suspect MTU issues, and see this <A HREF="background.html#MTU.trouble">discussion</A>.</P>
-<H4>Stress Tests</H4>
-<P>In most users' view, a simple ping test, and perhaps a
-large-packet ping test suffice to indicate a working IPSec
-connection.</P>
-<P>Some people might like to do additional stress tests prior to
-production use. They may be interested in this <A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/12/msg00224.html">testing
-protocol</A> we use at interoperation conferences, aka &quot;bakeoffs&quot;.
-We also have a <VAR>testing</VAR> directory that ships with the
-release.</P>
-<H2><A NAME="prob.report"></A>4. Problem Reporting</H2>
-<H3>4.1 How to ask for help</H3>
-<P>Ask for troubleshooting help on the users' mailing list,
-<A HREF="mailto:users@lists.freeswan.org">users@lists.freeswan.org</A>.
-While sometimes an initial query with a quick description of your
-intent and error will twig someone's memory of a similar problem,
-it's often necessary to send a second mail with a complete problem
-report. 
-</P>
-
-
-<P>When reporting problems to the mailing list(s), please include: 
-</P>
-<UL>
-	<LI>a brief description of the problem</LI>
-	<LI>if it's a compile problem, the actual output from make,
-	showing the problem. Try to edit it down to only the relevant part,
-	but when in doubt, be as complete as you can. If it's a kernel
-	compile problem, any relevant out.* files</LI>
-	<LI>if it's a run-time problem, pointers to where we can find the
-	complete output from &quot;ipsec barf&quot; from BOTH ENDS (not just
-	one of them). Remember that it's common outside the US and Canada to
-	pay for download volume, so if you can't post barfs on the web and
-	send the URL to the mailing list, at least compress them with tar or
-	gzip.<BR>
-	If you can, try to simplify the case that is causing the problem.
-	In particular, if you clear your logs, start FreeS/WAN with no other
-	connections running, cause the problem to happen, and then do <VAR>ipsec
-	barf</VAR> on both ends immediately, that gives the smallest and
-	least cluttered output.</LI>
-	<LI>any other error messages, complaints, etc. that you saw.
-	Please send the complete text of the messages, not just a summary.</LI>
-	<LI>what your network setup is. Include subnets, gateway
-	addresses, etc. A schematic diagram is a
-	good format for this information.</LI>
-	<LI>exactly what you were trying to do with Linux FreeS/WAN, and
-	exactly what went wrong</LI>
-	<LI>a fix, if you have one. But remember, you are sending mail to
-	people all over the world; US residents and US citizens in
-	particular, please read doc/exportlaws.html before sending code --
-	even small bug fixes -- to the list or to us.</LI>
-	<LI>When in doubt about whether to include some seemingly-trivial
-	item of information, include it. It is rare for problem reports to
-	have too much information, and common for them to have too little.</LI>
-</UL>
-
-<P>Here are some good general guidelines on bug reporting:
-<a href="http://tuxedo.org/~esr/faqs/smart-questions.html">How To Ask Questions
-The Smart Way</a> and <a
-href="http://www.chiark.greenend.org.uk/~sgtatham/bugs.html">How to Report
-Bugs Effectively</a>.</p>
-
-
-<H3>4.2 Where to ask</H3>
-<P>To report a problem, send mail about it to the users' list. If you
-are certain that you have found a bug, report it to the bugs list. If
-you encounter a problem while doing your own coding on the Linux
-FreeS/WAN codebase and think it is of interest to the design team,
-notify the design list. When in doubt, default to the users' list.
-More information about the mailing lists is found <A HREF="mail.html#lists">here</A>.</P>
-<P>For a number of reasons -- including export-control regulations
-affecting almost any <STRONG>private</STRONG> discussion of
-encryption software -- we prefer that problem reports and discussions
-go to the lists, not directly to the team. Beware that the list goes
-worldwide; US citizens, read this important information about your
-<A HREF="politics.html#exlaw">export laws</A>. If you're using this
-software, you really should be on the lists. To get onto them, visit
-<A HREF="http://lists.freeswan.org/">lists.freeswan.org</A>.</P>
-<P>If you do send private mail to our coders or want a private reply
-from them, please make sure that the return address on your mail
-(From or Reply-To header) is a valid one. They have more important
-things to do than to unravel addresses that have been mangled in an
-attempt to confuse spammers. 
-</P>
-<H2><A NAME="notes"></A>5. Additional Notes on Troubleshooting</H2>
-<P>The following sections supplement the Guide: <A HREF="#system.info">information
-available on your system</A>; <A HREF="#testgates">testing between
-security gateways</A>; <A HREF="#ifconfig1">ifconfig reports for
-KLIPS debugging</A>; <A HREF="#gdb">using GDB on Pluto</A>.</P>
-<H3><A NAME="system.info"></A>5.1 Information available on your
-system</H3>
-<H4><A NAME="logusage"></A>Logs used</H4>
-<P>Linux FreeS/WAN logs to:</P>
-<UL>
-	<LI>/var/log/secure (or, on Debian, /var/log/auth.log)</LI>
-	<LI>/var/log/messages</LI>
-</UL>
-<P>Check both places to get full information. If you find nothing,
-check your <VAR>syslogd.conf(5)</VAR> to see where your
-/etc/syslog.conf or equivalent is directing <VAR>authpriv</VAR>
-messages.</P>
-<H4><A NAME="pages"></A>man pages provided</H4>
-<DL>
-	<DT><A HREF="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A> 
-	</DT><DD>
-	Manual page for IPSEC configuration file. 
-	</DD><DT>
-	<A HREF="manpage.d/ipsec.8.html">ipsec(8)</A> 
-	</DT><DD STYLE="margin-bottom: 0.2in">
-	Primary man page for ipsec utilities. 
-	</DD></DL>
-<P>
-Other man pages are on <A HREF="manpages.html">this list</A> and in</P>
-<UL>
-	<LI>/usr/local/man/man3</LI>
-	<LI>/usr/local/man/man5</LI>
-	<LI>/usr/local/man/man8/ipsec_*</LI>
-</UL>
-<H4><A NAME="statusinfo"></A>Status information</H4>
-<DL>
-	<DT>ipsec auto --status 
-	</DT><DD>
-	Command to get status report from running system. Displays Pluto's
-	state. Includes the list of connections which are currently &quot;added&quot;
-	to Pluto's internal database; lists state objects reflecting ISAKMP
-	and IPsec SAs being negotiated or installed. 
-	</DD><DT>
-	ipsec look 
-	</DT><DD>
-	Brief status info. 
-	</DD><DT>
-	ipsec barf 
-	</DT><DD STYLE="margin-bottom: 0.2in">
-	Copious debugging info. 
-	</DD></DL>
-<H3>
-<A NAME="testgates"></A>5.2 Testing between security gateways</H3>
-<P>Sometimes you need to test a subnet-subnet tunnel. This is a
-tunnel between two security gateways, which protects traffic on
-behalf of the subnets behind these gateways. On this network:</P>
-<PRE>     Sunset==========West------------------East=========Sunrise
-                     IPSec gateway         IPSec gateway
-           local net       untrusted net       local net</PRE><P>
-you might name this tunnel sunset-sunrise. You can test this tunnel
-by having a machine behind one gateway ping a machine behind the
-other gateway, but this is not always convenient or even possible.</P>
-<P>Simply pinging one gateway from the other is not useful. Such a
-ping does not normally go through the tunnel. <STRONG>The tunnel
-handles traffic between the two protected subnets, not between the
-gateways</STRONG> . Depending on the routing in place, a ping might</P>
-<UL>
-	<LI>either succeed by finding an
-	unencrypted route</LI>
-	<LI>or fail by finding no route. Packets without an IPSEC eroute
-	are discarded.</LI>
-</UL>
-<P><STRONG>Neither event tells you anything about the tunnel</STRONG>.
-You can explicitly create an eroute to force such packets through the
-tunnel, or you can create additional tunnels as described in our
-<A HREF="config.html#multitunnel">configuration document</A>, but
-those may be unnecessary complications in your situation.</P>
-<P>The trick is to explicitly test between <STRONG>both gateways'
-private-side IP addresses</STRONG>. Since the private-side interfaces
-are on the protected subnets, the resulting packets do go via the
-tunnel. Use either ping -I or traceroute -i, both of which allow you
-to specify a source interface. (Note: unsupported on older Linuxes).
-The same principles apply for a road warrior (or other) case where
-only one end of your tunnel is a subnet.</P>
-<H3><A NAME="ifconfig1"></A>5.3 ifconfig reports for KLIPS debugging</H3>
-<P>When diagnosing problems using ifconfig statistics, you may wonder
-what type of activity increments a particular counter for an ipsecN
-device. Here's an index, posted by KLIPS developer Richard Guy
-Briggs:</P>
-<PRE>Here is a catalogue of the types of errors that can occur for which
-statistics are kept when transmitting and receiving packets via klips.
-I notice that they are not necessarily logged in the right counter.
-. . .
-
-Sources of ifconfig statistics for ipsec devices
-
-rx-errors:
-- packet handed to ipsec_rcv that is not an ipsec packet.
-- ipsec packet with payload length not modulo 4.
-- ipsec packet with bad authenticator length.
-- incoming packet with no SA.
-- replayed packet.
-- incoming authentication failed.
-- got esp packet with length not modulo 8.
-
-tx_dropped:
-- cannot process ip_options.
-- packet ttl expired.
-- packet with no eroute.
-- eroute with no SA.
-- cannot allocate sk_buff.
-- cannot allocate kernel memory.
-- sk_buff internal error.
-
-
-The standard counters are:
-
-struct enet_statistics
-{
-        int        rx_packets;                /* total packets received */
-        int        tx_packets;                /* total packets transmitted */
-        int        rx_errors;                /* bad packets received */
-        int        tx_errors;                /* packet transmit problems */
-        int        rx_dropped;                /* no space in linux buffers */
-        int        tx_dropped;                /* no space available in linux */
-        int        multicast;                /* multicast packets received */
-        int        collisions;
-
-        /* detailed rx_errors: */
-        int        rx_length_errors;
-        int        rx_over_errors;                /* receiver ring buff overflow */
-        int        rx_crc_errors;                /* recved pkt with crc error */
-        int        rx_frame_errors;        /* recv'd frame alignment error */
-        int        rx_fifo_errors;                /* recv'r fifo overrun */
-        int        rx_missed_errors;        /* receiver missed packet */
-
-        /* detailed tx_errors */
-        int        tx_aborted_errors;
-        int        tx_carrier_errors;
-        int        tx_fifo_errors;
-        int        tx_heartbeat_errors;
-        int        tx_window_errors;
-};
-
-of which I think only the first 6 are useful.</PRE><H3>
-<A NAME="gdb"></A>5.4 Using GDB on Pluto</H3>
-<P>You may need to use the GNU debugger, gdb(1), on Pluto. This
-should be necessary only in unusual cases, for example if you
-encounter a problem which the Pluto developer cannot readily
-reproduce or if you are modifying Pluto. 
-</P>
-<P>Here are the Pluto developer's suggestions for doing this: 
-</P>
-<PRE>Can you get a core dump and use gdb to find out what Pluto was doing
-when it died?
-
-To get a core dump, you will have to set dumpdir to point to a
-suitable directory (see <A HREF="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A>).
-
-To get gdb to tell you interesting stuff:
-        $ script
-        $ cd dump-directory-you-chose
-        $ gdb /usr/local/lib/ipsec/pluto core
-        (gdb) where
-        (gdb) quit
-        $ exit
-
-The resulting output will have been captured by the script command in
-a file called &quot;typescript&quot;.  Send it to the list.
-
-Do not delete the core file.  I may need to ask you to print out some
-more relevant stuff.</PRE><P>
-Note that the <VAR>dumpdir</VAR> parameter takes effect only when the
-IPsec subsystem is restarted -- reboot or ipsec setup restart.</P>
-<P><BR><BR>
-</P>
-</BODY>
-</HTML>
diff --git a/doc/src/uml-rhroot-list.txt b/doc/src/uml-rhroot-list.txt
deleted file mode 100644
index 198997032..000000000
--- a/doc/src/uml-rhroot-list.txt
+++ /dev/null
@@ -1,91 +0,0 @@
-filesystem-2.1.6-2
-glibc-common-2.2.4-13
-slang-1.4.4-4
-newt-0.50.33-1
-mktemp-1.5-11
-syslinux-1.52-2
-which-2.12-3
-zlib-devel-1.1.3-24
-ntsysv-1.2.24-1
-db1-devel-1.85-7
-e2fsprogs-1.23-2
-iputils-20001110-6
-mingetty-0.9.4-18
-pwdb-0.61.1-3
-bash-2.05-8
-bzip2-1.0.1-4
-libstdc++-2.96-98
-logrotate-3.5.9-1
-rootfiles-7.2-1
-bash-doc-2.05-8
-iproute-2.2.4-14
-ncurses-5.2-12
-diffutils-2.7.2-2
-findutils-4.1.7-1
-gzip-1.3-15
-readline-4.2-2
-tmpwatch-2.8-2
-cpio-2.4.2-23
-gawk-3.1.0-3
-less-358-21
-procps-X11-2.0.7-11
-sed-3.02-10
-vim-minimal-5.8-7
-fileutils-4.1-4
-sysklogd-1.4.1-4
-mount-2.11g-5
-rpm-4.0.3-1.03
-glib-devel-1.2.10-5
-bzip2-libs-1.0.1-4
-tar-1.13.19-6
-cracklib-dicts-2.7-12
-passwd-0.64.1-7
-pam-devel-0.75-14
-SysVinit-2.78-19
-krb5-libs-1.2.2-13
-pam_krb5-1.46-1
-krbafs-utils-1.0.9-2
-setup-2.5.7-1
-basesystem-7.0-2
-glibc-2.2.4-13
-popt-1.6.3-1.03
-setuptool-1.8-2
-shadow-utils-20000902-4
-zlib-1.1.3-24
-chkconfig-1.2.24-1
-db1-1.85-7
-db3-3.2.9-4
-file-3.35-2
-losetup-2.11g-5
-net-tools-1.60-3
-netconfig-0.8.11-7
-libtermcap-2.0.8-28
-libtermcap-devel-2.0.8-28
-bzip2-devel-1.0.1-4
-libstdc++-devel-2.96-98
-modutils-2.4.6-4
-crontabs-1.10-1
-MAKEDEV-3.2-5
-grep-2.4.2-7
-psmisc-20.1-2
-readline-devel-4.2-2
-e2fsprogs-devel-1.23-2
-ed-0.2-21
-vim-common-5.8-7
-procps-2.0.7-11
-redhat-release-7.2-1
-time-1.7-14
-cracklib-2.7-12
-console-tools-19990829-36
-textutils-2.0.14-2
-dev-3.2-5
-glib-1.2.10-5
-termcap-11.0.1-10
-info-4.0b-3
-words-2-17
-pam-0.75-14
-util-linux-2.11f-9
-sh-utils-2.0.11-5
-initscripts-6.40-1
-krbafs-1.0.9-2
-krbafs-devel-1.0.9-2
diff --git a/doc/src/uml-rhroot.html b/doc/src/uml-rhroot.html
deleted file mode 100644
index ca05a2073..000000000
--- a/doc/src/uml-rhroot.html
+++ /dev/null
@@ -1,116 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
-<HTML>
-  <HEAD>
-    <TITLE>Building a RedHat root image</TITLE>
-    <!-- Created by: Michael Richardson, 22-Nov-2001 -->
-    <!-- Changed by: Michael Richardson, 22-Nov-2001 -->
-
-
-  </HEAD>
-  <BODY>
-    <H1>Building a RedHat root image</H1>
-
-<P>
-The image required to use User-Mode-Linux is just a normal set of executables.
-These can be extracted from a RedHat distribution using the following proceedure.
-</P>
-
-<P>
-There is a script in testing/utils called <CODE>uml-rhroot.sh</CODE>. It takes
-two arguments:
-<UL>
-<LI> a directory in which to put resulting directory tree. 
-<LI> a directory tree containing the RedHat distribution RPMs. This may be
-  in one of three forms:
-<UL>
-<LI> a directory containing the directories "disc1" and "disc2". These 
-  could be ISO images that are mounted loopback via, for instance:
-<PRE>
-<CODE>
-mkdir -p /distros/redhat/7.2/disc1 /distros/redhat/7.2/disc1
-mount -t iso9660 -o loop,ro /distros/redhat/7.2/enigma-i386-disc1.iso /distros/redhat/7.2/disc1
-mount -t iso9660 -o loop,ro /distros/redhat/7.2/enigma-i386-disc2.iso /distros/redhat/7.2/disc2 
-</CODE>
-</PRE>
-or even two real CDroms mounted somewhere. In the example above, use "/distros/redhat/7.2" as the distribution directory.
-</LI>
-<LI> a directory containing a "merged" disc1 and disc2 as suggested by RedHat in <A HREF="http://www.redhat.com/docs/manuals/linux/RHL-7.2-Manual/install-guide/s1-install-network.html#S2-INSTALL-SETUPSERVER">http://www.redhat.com/docs/manuals/linux/RHL-7.2-Manual/install-guide/s1-install-network.html under "Setting up the Server"</A>.
-<LI> a directory containing all the required RPMs. (See <A HREF="uml-rhroot-list7.2.txt">list of RPMs</A>)</LI>
-</UL>
-</UL>
-</P>
-
-<P>The unpacked distribution will take approximately 133Mb. You will
-  want to locate this on the same partition as your intended root
-  trees for your User-Mode-Linux's as this will permit hard links to
-  be used, saving disk space.  
-</P>
-
-<P>
-  Because the RPM command used uses the chroot(2) system call and
-  needs to change ownership of the files that it creates, it must be
-  run as root. Afterward, you should chown the entire directory to the
-  userid that you will be using for testing (i.e. probably
-  yours). It should eventually suffices to make sure that you can read
-  every file.
-</P>
-
-<P>
-You should be able to chroot to this directory and run programs. If
-you can not at least run ls, then there is a problem.
-</P>
-<P>
-Expect a couple of errors about install-info.
-</P>
-
-<P>
-An example:
-<PRE>
-<CODE>
-Script started on Thu Nov 22 15:51:15 2001
-cassidy:/c2/user-mode-linux# df
-Filesystem           1k-blocks      Used Available Use% Mounted on
-/dev/hda1              3844408   1673528   1975584  46% /
-/dev/hda3             12495048   1823404  10036884  16% /home
-/dev/hdc1             10325748    805056   8996172   9% /c1
-/dev/hdc2             10325780   4815160   4986100  50% /c2
-/dev/hdc3             10325780   2972480   6828780  31% /c3
-/dev/hdc4              7495084   3059640   4054704  44% /c4
-/distros/redhat/7.2/enigma-i386-disc1.iso
-                        662072    662072         0 100% /distros/redhat/7.2/disc1
-/distros/redhat/7.2/enigma-i386-disc2.iso
-                        653740    653740         0 100% /distros/redhat/7.2/disc2
-cassidy:/c2/user-mode-linux# /c2/freeswan/sandbox-main/testing/utils/uml-rhroot.sh 
-Usage: /c2/freeswan/sandbox-main/testing/utils/uml-rhroot.sh rootdir cdimagedir
-cassidy:/c2/user-mode-linux# /c2/freeswan/sandbox-main/testing/utils/uml-rhroot.sh /c2/user-mode-linux/rpm-root/root /distros/redhat/7.2
-Assuming RH disc1 at /distros/redhat/7.2/disc1/RedHat/RPMS
-        and disc2 at /distros/redhat/7.2/disc2/RedHat/RPMS
-/var/tmp/rpm-tmp.99149: /sbin/install-info: No such file or directory
-error: execution of %post scriptlet from textutils-2.0.14-2 failed, exit status 127
-cat: /proc/mounts: No such file or directory
-warning: /var/lib/rpm/Basenames created as /var/lib/rpm/Basenames.rpmnew
-warning: /var/lib/rpm/Conflictname created as /var/lib/rpm/Conflictname.rpmnew
-warning: /var/lib/rpm/Group created as /var/lib/rpm/Group.rpmnew
-warning: /var/lib/rpm/Name created as /var/lib/rpm/Name.rpmnew
-warning: /var/lib/rpm/Packages created as /var/lib/rpm/Packages.rpmnew
-warning: /var/lib/rpm/Providename created as /var/lib/rpm/Providename.rpmnew
-warning: /var/lib/rpm/Requirename created as /var/lib/rpm/Requirename.rpmnew
-warning: /var/lib/rpm/Triggername created as /var/lib/rpm/Triggername.rpmnew
-You should now chown it to yourself.
-cassidy:/c2/user-mode-linux# chown -R mcr rpm-root/root
-cassidy:/c2/user-mode-linux# ls rpm-root/root
-bin   dev  home    lib	opt   root  tmp  var
-boot  etc  initrd  mnt	proc  sbin  usr
-cassidy:/c2/user-mode-linux# chroot rpm-root/root
-cassidy:/# ls
-bin   dev  home    lib  opt   root  tmp  var
-boot  etc  initrd  mnt  proc  sbin  usr
-cassidy:/# exit
-cassidy:/c2/user-mode-linux# exit
-Script done on Thu Nov 22 15:54:33 2001
-</CODE>
-</PRE>
-
-
-  </BODY>
-</HTML>
\ No newline at end of file
diff --git a/doc/src/uml-stack-trace.html b/doc/src/uml-stack-trace.html
deleted file mode 100644
index 1b08ed7d1..000000000
--- a/doc/src/uml-stack-trace.html
+++ /dev/null
@@ -1,129 +0,0 @@
-<PRE>
-To: Michael Richardson <mcr@sandelman.ottawa.on.ca>
-Cc: user-mode-linux-devel@lists.sourceforge.net
-From: Jeff Dike <jdike@karaya.com>
-Subject: [uml-devel] Re: stack trace
-Date: Mon, 16 Sep 2002 22:36:06 -0500
-
-mcr@sandelman.ottawa.on.ca said:
-> Can you post (on list or web site) a "script" output of you trying to
-> get the right stack out of a stuck uml (tracing myself)...? 
-
-Yup.  Here we go...
-
-Here, I attach to the tracing thread and get the stack of the current thread,
-which happens to be the idle thread.
-
-um 1013: gdb linux 14936
-GNU gdb 5.0rh-5 Red Hat Linux 7.1
-Copyright 2001 Free Software Foundation, Inc.
-GDB is free software, covered by the GNU General Public License, and you are
-welcome to change it and/or distribute copies of it under certain conditions.
-Type "show copying" to see the conditions.
-There is absolutely no warranty for GDB.  Type "show warranty" for details.
-This GDB was configured as "i386-redhat-linux"...
-/home/jdike/linux/2.4/um/14936: No such file or directory.
-Attaching to program: /home/jdike/linux/2.4/um/linux, process 14936
-0xa014efe9 in __wait4 ()
-
-# This is how you get the current task in the tracing thread - get_current()
-# only works in a kernel thread.
-(gdb) p (struct task_struct *)cpu_tasks[0].task
-$2 = (struct task_struct *) 0xa01c0000
-
-# Get the host pid of that task.
-(gdb) p $2.thread.extern_pid
-$3 = 14939
-
-# Get the current ip and sp.
-(gdb) shell cat /proc/14939/stat
-14939 (linux) T 14936 14936 883 34816 14936 64 5 3 806 7 62 12 0 0 9 0 0 2 
-588043 142770176 5008 4294967295 2684358656 2686348640 3221223520 2686205764
-                                                               sp ^^^^^^^^^^ 
-   2685727185 73728 201392128 167776768 268444672 3222308129 0 0 17 0
-ip ^^^^^^^^^^
-
-# the sp and ip are items 4 and 5 after the 4294967295 (on 2.2 hosts, that's
-2^31 - 1 rather than 2^32 - 1).
-
-(gdb) p/x 2686205764
-$4 = 0xa01c3f44
-(gdb) p/x 2685727185
-$5 = 0xa014f1d1
-
-# Where's the ip?
-(gdb) i sym 0xa014f1d1
-nanosleep + 17 in section .text
-
-# look at the stack around the sp
-(gdb) x/32x 0xa01c3f30
-0xa01c3f30 :     0x00000000      0x00000000      0xa01c3f60      0xa00020a8
-0xa01c3f40 :     0x00000004      0xa012e891      0xa01c3f58      0xa01c3f58
-0xa01c3f50 :     0xa01c3f70      0xa0023667      0x00000009      0x3b023380
-0xa01c3f60 :     0xa01c3fa0      0xa012a21d      0x0000000a      0xa01c0000
-0xa01c3f70 :     0xa01c3fa0      0xa012a213      0x00000003      0x00000024
-0xa01c3f80 :     0xa01c3fa0      0xa0011bc4      0xa012b25c      0x00000000
-0xa01c3f90 :     0xa01c3fb0      0x00000000      0xa01c3ffc      0x0000000d
-0xa01c3fa0 :     0xa01c3fb0      0xa000c50e      0xa01812e0      0xa01c3ffc
-
-# The trick here is to locate a frame near the current sp.  You're looking
-# for a consecutive pair of longwords (fp, ip) having the properties that:
-#	fp is on the current kernel stack and points further up it
-#	ip is a text address (if you can't recognize a UML text address by
-# sight, print out &_stext and &_etext)
-#
-# Starting at 0xa01c3f44, the first pair of works satisfying these requirements
-# is at 0xa01c3f50.
-# So, print that pair out as hex.
-(gdb) p/x *((int (*)[2])0xa01c3f50)
-$9 = {0xa01c3f70, 0xa0023667}
-
-# Now, we start climbing the stack.
-(gdb) p/x *((int (*)[2])$[0])
-$10 = {0xa01c3fa0, 0xa012a213}
-(gdb) 
-$11 = {0xa01c3fb0, 0xa000c50e}
-(gdb) 
-$12 = {0xa01c3fc0, 0xa000356d}
-(gdb) 
-$13 = {0xa01c3fd0, 0xa013082f}
-(gdb) 
-$14 = {0xa01c3ff0, 0xa012fbdd}
-# Stop when you see a NULL frame pointer or gdb bitches at you.
-(gdb) 
-$15 = {0x0, 0xa01513aa}
-
-# Now we get the symbolic version of the stack with 'i sym' of the second item
-# in each pair. 
-(gdb) i sym 0xa0023667
-check_pgt_cache + 23 in section .text
-(gdb) i sym 0xa012a213
-cpu_idle + 123 in section .text
-(gdb) i sym 0xa000c50e
-rest_init + 46 in section .text
-(gdb) i sym 0xa000356d
-start_kernel + 361 in section .text.init
-(gdb) i sym 0xa013082f
-start_kernel_proc + 63 in section .text
-(gdb) i sym 0xa012fbdd
-signal_tramp + 209 in section .text
-(gdb) i sym 0xa01513aa
-thread_start + 4 in section .text
-
-# You can also get line number information with 'i line'.
-(gdb) i line *0xa012a213
-Line 488 of "process_kern.c" starts at address 0xa012a213 <cpu_idle+123>
-   and ends at 0xa012a21d <cpu_idle+133>.
-(gdb) 
-
-
--------------------------------------------------------
-Sponsored by: AMD - Your access to the experts on Hammer Technology! 
-Open Source & Linux Developers, register now for the AMD Developer 
-Symposium. Code: EX8664 http://www.developwithamd.com/developerlab
-_______________________________________________
-User-mode-linux-devel mailing list
-User-mode-linux-devel@lists.sourceforge.net
-https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel
-
-</PRE>
\ No newline at end of file
diff --git a/doc/src/umltesting.html b/doc/src/umltesting.html
deleted file mode 100644
index df62a9ae2..000000000
--- a/doc/src/umltesting.html
+++ /dev/null
@@ -1,478 +0,0 @@
-<html>
-<head>
-<title>FreeS/WAN User-Mode-Linux testing guide</title>
-<!-- Changed by: Michael Richardson, 05-Mar-2003 -->
-<meta name="keywords" content="Linux, IPsec, VPN, security, FreeSWAN, testing, User-Mode-Linux, UML">
-
-<!--
-
-Written by Michael Richardson for the Linux FreeS/WAN project
-Freely distributable under the GNU General Public License
-
-More information at www.freeswan.org
-Feedback to users@lists.freeswan.org
-
-$Id: umltesting.html,v 1.1 2004/03/15 20:35:24 as Exp $
-
-$Log: umltesting.html,v $
-Revision 1.1  2004/03/15 20:35:24  as
-added files from freeswan-2.04-x509-1.5.3
-
-Revision 1.23  2003/09/18 15:12:11  dhr
-
-fix link to kernel.org mirrors page
-
-Revision 1.22  2003/03/07 03:49:25  dhr
-
-fix recommended version of uml-patch
-
-Revision 1.21  2003/03/06 08:37:03  dhr
-
-capture more of MCR's knowledge about BIND
-
-Revision 1.20  2003/03/06 02:15:44  mcr
-	added note about need for bind9.
-
-Revision 1.19  2003/03/05 23:20:39  mcr
-	updates from -47 to -53.
-
-Revision 1.18  2003/02/27 08:25:48  dhr
-
-update to reflect newer umlfreeroot
-
-Revision 1.17  2003/02/27 08:16:45  dhr
-
-make clear what is the latest version of the UML patch that we've used
-
-Revision 1.16  2003/02/21 01:35:31  mcr
-	updated latest umlfreeroot to 15.1.
-
-Revision 1.15  2003/01/21 03:26:34  mcr
-	updated documentation on UML state.
-
-Revision 1.14  2002/11/11 16:43:35  mcr
-	adjusted formatting of uml_netjig notes.
-
-Revision 1.13  2002/11/08 10:13:05  mcr
-	updated documentation for 2.4.19
-
-Revision 1.12  2002/11/03 23:44:23  mcr
-	fixed some formatting in umltesting.html
-	added some notes about NETJIGWAITUSER re: having tests
-	prompt before they exit. Helps with debugging.
-
-Revision 1.11  2002/10/31 19:01:31  mcr
-	documentation for RUN_*_SCRIPT.
-
-Revision 1.10  2002/09/15 23:57:59  dhr
-
-update suggested umlfreeroot
-
-Revision 1.9  2002/09/15 19:28:05  mcr
-	added some comments about problems with UMLs.
-
-Revision 1.8  2002/09/11 20:00:25  mcr
-	updated umlroot rev to 8.0.
-
-Revision 1.7  2002/09/09 21:37:43  mcr
-	updated document to reference currently working kernel+UML.
-
-Revision 1.6  2002/08/02 22:43:35  mcr
-	added section on debugging with UMLs.
-
-Revision 1.5  2002/05/30 18:47:57  dhr
-
-Update from experience:
-- fixed HTML bugs
-- restructure slightly
-- added another intro paragraph
-- mentioned lack of Super User requirements
-- added tcpdump build and install procedure
-- added uml utils build procedure
-- added invitation to try "make check"
-- fixed minor typos and mistakes
-
-Revision 1.4  2002/03/12 21:10:37  mcr
-	removed instruction on downloading umlminishare, as this is
-	now simply included in umlrootXXX. reformated some other text.
-
-Revision 1.3  2002/01/29 02:21:21  mcr
-	updated instructions for 2.4.17, and for newest UMLroot.
-
-Revision 1.2  2001/11/27 05:24:09  mcr
-	added reference to uml-rhroot, but commented out.
-	This proceedure is not yet ready for prime time.
-
-Revision 1.1  2001/11/05 04:35:57  mcr
-	adapted text from design list posting into HTML for Sandy.
-
-
--->
-</head>
-
-<body>
-
-<h1><a name="umltesting">User-Mode-Linux Testing guide</a></h1>
-
-<p>
-User mode linux is a way to compile a linux kernel such that it can run as a
-process in another linux system (potentially as a *BSD or Windows process
-later). See <A HREF="http://user-mode-linux.sourceforge.net/">http://user-mode-linux.sourceforge.net/</A>
-</P>
-
-<p>
-UML is a good platform for testing and experimenting with FreeS/WAN.
-It allows several network nodes to be simulated on a single machine.
-Creating, configuring, installing, monitoring, and controling these
-nodes is generally easier and easier to script with UML than real
-hardware.
-</p>
-
-<p>
-You'll need about 500Mb of disk space for a full sunrise-east-west-sunset
-setup. You can possibly get this down by 130Mb if you remove the
-sunrise/sunset kernel build. If you just want to run, then you can even
-remove the east/west kernel build.
-</p>
-<p>
-Nothing need be done as super user.  In a couple of steps, we note
-where super user is required to install commands in system-wide
-directories, but ~/bin could be used instead.  UML seems to use a
-system-wide /tmp/uml directory so different users may interfere with
-one another. Later UMLs use ~/.uml instead, so multiple users running UML 
-tests should not be a problem, but note that a single user running
-the UML tests will only be able run one set. Further, UMLs sometimes
-get stuck and hang around. These "zombies" (most will actually be in
-the "T" state in the process table) will interfere with subsequent tests.
-</P>
-<H2>Preliminary Notes on BIND</H2>
-
-<P>
-As of 2003/3/1, the Light-Weight Resolver is used by pluto. This requires
-that BIND9 be running. It also requires that BIND9 development libraries
-be present in the build environment. The DNSSEC code is only truly functional
-in BIND9 snapshots. The library code could be 9.2.2, we believe. We are
-using BIND9 20021115 snapshot code from
-<A HREF="ftp://ftp.isc.org/isc/bind9/snapshots">ftp://ftp.isc.org/isc/bind9/snapshots</A>.
-</P>
-<P>
-FreeS/WAN may well require a newer BIND than is on your system.
-Many distributions have moved to BIND9.2.2 recently due to a security advisory.
-BIND is five components.
-</P>
-<OL>
-<LI>
-named
-</LI>
-<LI>
-dnssec-*
-</LI>
-<LI>
-client side resolver libraries
-</LI>
-<LI>
-client side utility libraries
-I thought there were lib and named parts to dnsssec...
-</LI>
-<LI>
-dynamic DNS update utilities
-</LI>
-</OL>
-<P>
-The only piece that we need for *building* is #4. That's the only part that has to be on the build host.
-What is the difference between resolver and util libs?
-If you want to edit testing/baseconfigs/all/etc/bind, you'll need a snapshot version.
-The resolver library contains the resolver.
-FreeS/WAN has its own copy of that in lib/liblwres.
-</P>
-<H2>Steps to Install UML for FreeS/WAN</H2>
-<OL>
-<LI> Get the following files:
-<OL type="a">
-<LI> from <A HREF="http://www.sandelman.ottawa.on.ca/freeswan/uml/">http://www.sandelman.ottawa.on.ca/freeswan/uml/</A>
-umlfreeroot-15.1.tar.gz (or highest numbered one). This is a
-  debian potato root file system. You can use this even on a Redhat
-  host, as it has the newer GLIBC2.2 libraries as well. 
-
-
-<!-- If you are using
-  Redhat 7.2 or newer as your development machine, you can create the
-  image from your installation media. See <A HREF="uml-rhroot.html">Building a RedHat root"></A>.
-  A future document will explain how to build this from .DEB files as well.
--->
-
-<!--
-<LI> umlfreesharemini.tar.gz    (or umlfreeshareall.tar.gz). 
-  If you are a Debian potato user, you don't need it you can use your
-  native /usr/share.
-</UL>
--->
-
-<LI> From <A HREF="ftp://ftp.xs4all.nl/pub/crypto/freeswan/">ftp://ftp.xs4all.nl/pub/crypto/freeswan/</A>
-a snapshot or release (1.92 or better)
-
-<LI> From a
-  <A HREF="http://www.kernel.org/mirrors/">http://www.kernel.org mirror</A>,
-  the virgin 2.4.19 kernel. Please realize that we have defaults in our
-  tree for kernel configuration. We try to track the latest UML
-  kernels. If you   use a newer kernel, you may have faults in the
-  kernel build process. You can see what the latest that is being regularly tested by visiting <A HREF="http://bugs.freeswan.org:81/regress/HEAD/lastgood/freeswan-regress-env.sh">freeswan-regress-env.sh</A>.
-
-<LI>
-<!-- Note: this step is refered to as "step 1d" below. -->
-Get
-  <A HREF="http://ftp.nl.linux.org/uml/">http://ftp.nl.linux.org/uml/</A>
-  uml-patch-2.4.19-47.bz2 or the one associated with your kernel.
-  As of 2003/03/05, uml-patch-2.4.19-47.bz2 works for us.
-<STRONG>More recent versions of the patch have not been tested by us.</STRONG>
-<LI> You'll probably want to visit 
-<A
-  HREF="http://user-mode-linux.sourceforge.net">http://user-mode-linux.sourceforge.net</A> 
-and get the UML utilities. These are not needed for the build or interactive use (but recommended). They are necessary for the regression testing procedures used by "make check". 
-We currently use uml_utilities_20020212.tar.bz2.
-<LI>
-You need tcpdump version 3.7.1 or better.
-This is newer than the version included in most LINUX distributions.
-You can check the version of an installed tcpdump with the --version flag.
-If you need a newer tcpdump
-fetch both tcpdump and libpcap source tar files from 
-<A HREF="http://www.tcpdump.org/">http://www.tcpdump.org/</A> or a mirror.
-</OL>
-
-<LI> Pick a suitable place, and extract the following files:
-<OL type="a"> 
-<LI>
-<!-- Note: this step is refered to as "step 2a" later. -->
-2.4.19 kernel. For instance:
-<PRE>
-<CODE>
-           cd /c2/kernel
-           tar xzvf ../download/pub/linux/kernel/v2.4/linux-2.4.19.tar.gz
-</CODE>
-</PRE>
-
-<LI> extract the umlfreeroot file 
-<!-- (unless you <A HREF="uml-rhroot.html">built your own from RPMs</A>) -->
-<PRE>
-<CODE>
-           mkdir -p /c2/user-mode-linux/basic-root
-           cd /c2/user-mode-linux/basic-root
-           tar xzvf ../download/umlfreeroot-15.1.tar.gz
-</CODE>
-</PRE>
-
-<LI> FreeSWAN itself (or checkout "all" from CVS)
-<PRE>
-<CODE>
-           mkdir -p /c2/freeswan/sandbox
-           cd /c2/freeswan/sandbox
-           tar xzvf ../download/snapshot.tar.gz
-</CODE>
-</PRE>
-</OL>
-
-<LI> If you need to build a newer tcpdump:
-<UL>
-<LI>
-Make sure you have OpenSSL installed -- it is needed for cryptographic routines.
-<LI>
-Unpack libpcap and tcpdump source in parallel directories (the tcpdump
-build procedures look for libpcap next door).
-<LI>
-Change directory into the libpcap source directory and then build the library:
-<PRE>
-<CODE>
-	./configure
-	make
-</CODE>
-</PRE>
-<LI>
-Change into the tcpdump source directory, build tcpdump, and install it.
-<PRE>
-<CODE>
-	./configure
-	make
-	# Need to be superuser to install in system directories.
-	# Installing in ~/bin would be an alternative.
-	su -c "make install"
-</CODE>
-</PRE>
-</UL>
-<LI> If you need the uml utilities, unpack them somewhere then build and install
-them:
-<PRE>
-<CODE>
-	cd tools
-	make all
-	# Need to be superuser to install in system directories.
-	# Installing in ~/bin would be an alternative.
-	su -c "make install BIN_DIR=/usr/local/bin"
-</CODE>
-</PRE>
-<LI> set up the configuration file
-<UL>
-<LI>
-<CODE>
-cd /c2/freeswan/sandbox/freeswan-1.97/testing/utils
-</CODE>
-<LI> copy umlsetup-sample.sh to ../../umlsetup.sh:
-<CODE>
-  cp umlsetup-sample.sh ../../umlsetup.sh
-</CODE>
-
-<LI> open up ../../umlsetup.sh in your favorite editor.
-<LI> change POOLSPACE= to point to the place with at least 500Mb of
-disk. Best if it is on the same partition as the "umlfreeroot" extraction,
-as it will attempt to use hard links if possible to save  disk space.
-
-<LI> Set TESTINGROOT if you intend to run the script outside of the
-     sandbox/snapshot/release directory. Otherwise, it will configure itself.
-
-<LI> KERNPOOL should point to the directory with your 2.4.19 kernel
-   tree. This tree should be unconfigured! This is the directory
-   you used in step 2a.
-
-<LI> UMLPATCH should point at the bz2 file you downloaded at 1d.
-   If using a kernel that already includes the patch, set this to /dev/null.
- 
-<LI> FREESWANDIR should point at the directory where you unpacked
-               the snapshot/release. Include the "freeswan-snap2001sep16b"
-               or whatever in it. If you are running from CVS, then
-               you point at the directory where top, klips, etc. are.
-               The script will fix up the directory so that it can be
-               used.
-
-<LI> BASICROOT should be set to the directory used in 2b, or to the directory
-  that you created with RPMs.
-
-<LI> SHAREDIR should be set to the directory used in 2c, to /usr/share
-             for Debian potato users, or to $BASICROOT/usr/share.
-</UL>
-
-<LI> <PRE><CODE>
-cd $TESTINGROOT/utils
-sh make-uml.sh
-</CODE></PRE>
-    It will grind for awhile. If there are errors it will bail.
-    If so, run it under "script" and send the output to bugs@lists.freeswan.org.  
-
-<LI> You will have a bunch of stuff under $POOLSPACE.
-    Open four xterms:
-
-<PRE><CODE>
-    for i in sunrise sunset east west
-    do
-        xterm -name $i -title $i -e $POOLSPACE/$i/start.sh &
-    done
-</CODE></PRE>
-
-<LI> Login as root. Password is "root"
-    (Note, these virtual machines are networked together, but are not
-    configured to talk to the rest of the world.)
-
-<LI> verify that pluto started on east/west, run "ipsec look"
-
-<LI> login to sunrise. run "ping sunset"
-
-<LI> login to west. run "tcpdump -p -i eth1 -n"
-    (tcpdump must be version 3.7.1 or newer)
-
-<LI> Closing a console xterm will shut down that UML.
-
-<LI> You can "make check", if you want to.
-It is run from /c2/freeswan/sandbox/freeswan-1.97.</LI>
-
-</OL>
-
-<H1>Debugging the kernel with GDB</H1>
-
-<P>
-With User-Mode-Linux, you can debug the kernel using GDB.
-See <HREF="http://user-mode-linux.sourceforge.net/debugging.html">http://user-mode-linux.sourceforge.net/debugging.html</A>.
-</P>
-
-<P>
-Typically, one will want to address a test case for a failing situation.
-Running GDB from Emacs, or from other front ends is possible. First start GDB.
-</P>
-<P>
-Tell it to open the UMLPOOL/swan/linux program.
-</P>
-<P>
-Note the PID of GDB:
-<PRE>
-marajade-[projects/freeswan/mgmt/planning] mcr 1029 %ps ax | grep gdb
- 1659 pts/9    SN     0:00 /usr/bin/gdb -fullname -cd /mara4/freeswan/kernpatch/UMLPOOL/swan/ linux
-</PRE>
-</P>
-
-<P>
-Set the following in the environment:
-<PRE>
-UML_east_OPT="debug gdb-pid=1659"
-</PRE>
-</P>
-
-<P>
-Then start the user-mode-linux in the test scheme you wish:
-<PRE>
-marajade-[kernpatch/testing/klips/east-icmp-02] mcr 1220 %../../utils/runme.sh
-</PRE>
-
-The user-mode-linux will stop on boot, giving you a chance to attach to the process:
-
-<PRE>
-(gdb) file linux
-Reading symbols from linux...done.
-(gdb) attach 1
-Attaching to program: /mara4/freeswan/kernpatch/UMLPOOL/swan/linux, process 1
-0xa0118bc1 in kill () at hostfs_kern.c:770
-</PRE>
-
-<P>
-At this point, break points should be created as appropriate.
-</P>
-
-<H2>Other notes about debugging</H2>
-
-<P>
-If you are running a standard test, after all the packets are sent, the UML will
-be shutdown. This can cause problems, because the UML may get terminated while you
-are debugging.
-</P>
-<P>
-The environment variable <CODE>NETJIGWAITUSER</CODE> can be set to "waituser".
-If so, then the testing system will prompt before exiting the test.
-</P>
-
-<H1>User-Mode-Linux mysteries</H1>
-
-<UL>
-<LI> running more than one UML of the same name (e.g. "west") can cause
-  problems.
-<LI> running more than one UML from the same root file system is not
-  a good idea.
-<LI> all this means that running "make check" twice on the same machine
-  is probably not a good idea.
-<LI> occationally, UMLs will get stuck. This can happen like:
-<BLOCK>
-15134 ?        T      0:00 /spare/hugh/uml/uml2.4.18-sept5/umlbuild/east/linux (east) [/bin/sh]           
-15138 ?        T      0:00 /spare/hugh/uml/uml2.4.18-sept5/umlbuild/east/linux (east) [halt]              
- </BLOCK>
-
-these will need to be killed. Note that they are in "T"racing mode.
-<LI> UMLs can also hang, and will report "Tracing myself and I can't get out".
-This is a bug in UML. There are ways to find out what is going on and
-report this to the UML people, but we don't know the magic right now.
-</UL>
-
-<H1>Getting more info from uml_netjig</H1>
-
-<P>
-uml_netjig can be compiled with a built-in tcpdump. This uses not-yet-released
-code from <A HREF="http://www.tcpdump.org/">www.tcpdump.org</A>.
-Please see the instructions in <CODE>testing/utils/uml_netjig/Makefile</CODE>.
-</P>
-
-</body>
-</html>
diff --git a/doc/src/upgrading.html b/doc/src/upgrading.html
deleted file mode 100644
index 0d6401b96..000000000
--- a/doc/src/upgrading.html
+++ /dev/null
@@ -1,260 +0,0 @@
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>Introduction to FreeS/WAN</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, encryption, cryptography, FreeS/WAN, FreeSWAN">
-  <!--
-
-  Written by Claudia Schmeing for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: upgrading.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<A NAME="upgrading"></A><h1>Upgrading to FreeS/WAN 2.x</h1>
-
-
-<H2>New! Built in Opportunistic connections</H2>
-
-<P>Out of the box, FreeS/WAN 2.x will attempt to encrypt all your IP traffic.
-It will try to establish IPsec connections for:</P>
-<UL><LI>
-IP traffic from the Linux box on which you have installed FreeS/WAN, and</LI>
-<LI>
-outbound IP traffic routed through that Linux box (eg. from a protected subnet).</LI>
-</UL>
-<P>FreeS/WAN 2.x uses <STRONG>hidden, automatically enabled 
- <VAR>ipsec.conf</VAR> connections</STRONG> to do this.</P>
-
-<P>This behaviour is part of our campaign to get Opportunistic 
-Encryption (OE) widespread in the Linux world, so that any two Linux boxes can
-encrypt to one another without prearrangement.
-There's one catch, however: you must <A HREF="quickstart.html#quickstart">set 
-up a few DNS records</A> 
-to distribute RSA public keys and (if applicable) IPsec gateway
-information.</P>
-
-<P>If you start FreeS/WAN before you have set up these DNS 
-records, your connectivity will be slow, and 
-messages relating to the built in connections will clutter your logs.
-If you are unable to set up DNS for OE, you will wish to 
-<A HREF="policygroups.html#disable_policygroups">disable the 
-hidden connections</A>.</P>
-
-<A NAME="upgrading.flagday"></A>
-
-<H3>Upgrading Opportunistic Encryption
-to 2.01 (or later)</H3>
-
-<P>As of FreeS/WAN 2.01, Opportunistic Encryption (OE)
-uses DNS TXT resource records (RRs) only (rather than TXT with KEY). 
-This change causes a "flag day". 
-Users of FreeS/WAN 2.00 (or earlier) OE who are upgrading may
-need to post additional resource records.
-</P>
-
-<P>If you are running 
-<A HREF="glossary.html#initiate-only">initiate-only OE</A>, 
-you <em>must</em> put up a TXT record in any forward domain as per our 
-<A HREF="quickstart.html#opp.client">quickstart instructions</A>. This
-replaces your old forward KEY.
-</P>
-
-<P>
-If you are running full OE, you require no updates. You already have 
-the needed TXT record in the reverse domain. 
-However, to facilitate future features, you
-may also wish to publish that TXT record in a forward domain as 
-instructed <A HREF="quickstart.html#opp.incoming">here</A>.
-</P>
-
-<P>If you are running OE on a gateway (and encrypting on behalf of subnetted
-boxes) you require no updates. 
-You already have the required TXT record in your gateway's reverse map,
-and the TXT records for any subnetted boxes require no updating.
-However, to facilitate future features, you may wish to publish your gateway's
- TXT record in a forward domain as shown 
-<A HREF="quickstart.html#opp.incoming">here</A>.
-
-
-<P>
-During the transition, you may wish to leave any old KEY records up for
-some time. They will provide limited backward compatibility. 
-<!--
-For more
-detail on that compatibility, see <A HREF="oe.known-issues">Known Issues with
-OE</A>.
--->
-</P>
-
-<H2>New! Policy Groups</H2>
-
-<P>We want to make it easy for you to declare security policy as it
-applies to IPsec connections.</P>
-
-<P>Policy Groups make it simple to say:
-</P>
-
-<UL>
-<LI>These are the folks I want to talk to in the clear.</LI>
-<LI>These spammers' domains -- I don't want to talk to them at all.</LI>
-<LI>To talk to the finance department, I must use IPsec.</LI>
-<LI>For any other communication, try to encrypt, but it's okay if we can't.</LI></UL>
-
-<P>FreeS/WAN then implements these policies, creating OE connections
-if and when needed.
-You can use Policy Groups along with connections you explicitly 
-define in ipsec.conf.</P>
-
-<P>For more information, see our
-<A HREF="policygroups.html">Policy Group HOWTO</A>.</P>
-
-
-<H2>New! Packetdefault Connection</H2>
-
-<P>Free/SWAN 2.x ships with the <STRONG>automatically enabled, hidden
-connection</STRONG> <VAR>packetdefault</VAR>. This configures
-a FreeS/WAN box as an OE gateway for any hosts located
-behind it. As mentioned above, you must configure some 
-<A HREF="quickstart.html">DNS records</A> for 
-OE to work.</P>
-<P>As the name implies, this connection functions as a default. If you
-have more specific connections, such as policy groups which configure 
-your FreeS/WAN box as an OE gateway for a local subnet, these 
-will apply before <VAR>packetdefault</VAR>. You can view 
-<VAR>packetdefault</VAR>'s specifics in 
-<A HREF="manpage.d/ipsec.conf.5.html">man ipsec.conf</A>.
-</P>
-
-
-<H2>FreeS/WAN now disables Reverse Path Filtering</H2>
-
-<P>FreeS/WAN often doesn't work with reverse path filtering. At
-start time, FreeS/WAN now turns rp_filter off, and logs a warning.</P>
-
-<P>FreeS/WAN does not turn it back on again. 
-You can do this yourself with a command like:</P>
-
-<PRE>   echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter</PRE>
-
-<P>For eth0, substitute the interface which FreeS/WAN was affecting.</P>
-
-
-<A NAME="ipsec.conf_v2"></A><H2>Revised <VAR>ipsec.conf</VAR></H2>
-
-<H3>No promise of compatibility</H3>
-
-<P>The FreeS/WAN team promised config-file compatibility throughout
-the 1.x series. That means a 1.5 config file can be directly imported into
-a fresh 1.99 install with no problems.</P>
-
-<P>With FreeS/WAN 2.x, we've given ourselves permission to make the config
-file easier to use. The cost: some FreeS/WAN 1.x configurations will not
-work properly. Many of the new features are, however, backward compatible.</P>
-
-
-<H3>Most <VAR>ipsec.conf</VAR> files will work fine</H3>
-
-<P>... so long as you paste this line, <STRONG>with no preceding 
-whitespace</STRONG>,
- at the top of your config file:
-</P>
-
-<PRE>    version 2</PRE>
-
-<H3>Backward compatibility patch</H3>
-
-<P>If the new defaults bite you, use 
-<A HREF="ipsec.conf.2_to_1">
-this <VAR>ipsec.conf</VAR> fragment</A> to simulate the old default values.</P>
-
-
-<H3>Details</H3>
-
-<P>
-We've obsoleted various directives which almost no one was using:
-</P>
-<PRE>    dump
-    plutobackgroundload
-    no_eroute_pass
-    lifetime
-    rekeystart
-    rekeytries</PRE>
-
-<P>For most of these, there is some other way to elicit the desired behaviour.
-See <A HREF="http://lists.freeswan.org/pipermail/design/2002-August/003243.html">
-this post</A>.
-
-<P>
-We've made some settings, which almost everyone was using, defaults.
-For example:
-</P>
-
-<PRE>    interfaces=%defaultroute
-    plutoload=%search
-    plutostart=%search
-    uniqueids=yes</PRE>
-
-<P>We've also changed some default values to help with OE and Policy Groups:</P>
-
-<PRE>    authby=rsasig   ## not secret!!!
-    leftrsasigkey=%dnsondemand ## looks up missing keys in DNS when needed.
-    rightrsasigkey=%dnsondemand</PRE>
-
-<P>
-Of course, you can still override any defaults by explictly declaring something
-else in your connection.
-</P>
-
-<P>  
-<A HREF="http://lists.freeswan.org/pipermail/design/2002-August/003243.html">A post with a list of many ipsec.conf changes.</A><BR>
-<A HREF="manpage.d/ipsec.conf.5.html">Current ipsec.conf manual.</A>
-</P>
-
-
-<A NAME="upgrading.rpms"></A><H3>Upgrading from 1.x RPMs to 2.x RPMs</H3>
-
-<P>Note: When upgrading from 1-series to 2-series RPMs, 
-<VAR>rpm -U</VAR> will not work.</P>
-
-<P>You must instead erase the 1.x RPMs, then install the 2.x set:</P>
-<PRE>    rpm -e freeswan</PRE>
-<PRE>    rpm -e freeswan-module</PRE>
-
-<P>On erasing, your old <VAR>ipsec.conf</VAR> should be moved to 
-<VAR>ipsec.conf.rpmsave</VAR>.
-Keep this. You will probably want to copy your existing connections to the 
-end of your new 2.x file.</P>
-
-<P>Install the RPMs suitable for your kernel version, such as:</P>
-<PRE>    rpm -ivh freeswan-module-2.04_2.4.20_20.9-0.i386.rpm</PRE>
-<PRE>    rpm -ivh freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm</PRE>
-
-
-
-<P>Or, to splice the files:</P>
-
-<PRE>    cat /etc/ipsec.conf /etc/ipsec.conf.rpmsave > /etc/ipsec.conf.tmp
-    mv /etc/ipsec.conf.tmp /etc/ipsec.conf</PRE>
-
-<P>Then, remove the redundant <VAR>conn %default</VAR> and 
-<VAR>config setup</VAR>
-sections. Unless you have done any special configuring here, you'll likely
-want to remove the 1.x versions. Remove <VAR>conn OEself</VAR>, if
-present.</P>
-
-
-
-</body>
-</html>
diff --git a/doc/src/user_examples.html b/doc/src/user_examples.html
deleted file mode 100755
index 5e3784858..000000000
--- a/doc/src/user_examples.html
+++ /dev/null
@@ -1,322 +0,0 @@
-<html>
-<head>
-<title>FreeS/WAN examples</title>
-<meta name="keywords" content="Linux, IPsec, VPN, security, FreeSWAN, examples">
-
-<!--
-
-Written by Sandy Harris for the Linux FreeS/WAN project
-Freely distributable under the GNU General Public License
-
-More information at www.freeswan.org
-Feedback to users@lists.freeswan.org
-
-CVS information:
-RCS ID:          $Id: user_examples.html,v 1.1 2004/03/15 20:35:24 as Exp $
-Last changed:    $Date: 2004/03/15 20:35:24 $
-Revision number: $Revision: 1.1 $
-
-CVS revision numbers do not correspond to FreeS/WAN release numbers.
--->
-</head>
-
-<body>
-
-<h1><a name="user.examples">FreeS/WAN script examples</a></h1>
-
-This file is intended to hold a collection of user-written example
-scripts or configuration files for use with FreeS/WAN.
-<p>
-So far it has only one entry.
-
-<h2><a name="poltorak">Poltorak's Firewall script</a></h2>
-
-<pre>
-From: Poltorak Serguei &lt;poltorak@dataforce.net&gt;
-Subject: [Users] Using FreeS/WAN
-Date: Tue, 16 Oct 2001
-
-Hello.
-
-I'm using FreeS/WAN IPsec for half a year. I learned a lot of things about
-it and I think it would be interesting for someone to see the result of my
-experiments and usage of FreeS/WAN. If you find a mistake in this
-file, please e-mail me. And excuse me for my english... I'm learning.. :)
-
-I'll talk about vary simple configuration:
-
-addresses prefix = 192.168
-
-    lan1          sgw1     .0.0/24 (Internet)       sgw2            lan2
-  .1.0/24---[ .1.1 ; .0.1 ]===================[ .0.10 ; . 2.10 ]---.2.0/24
-
-
-We need to let lan1 see lan2 across Internet like it is behind sgw1. The
-same for lan2. And we need to do IPX bridge for Novel Clients and NDS
-synchronization.
-
-my config:
-------------------- ipsec.conf -------------------
-conn lan1-lan2
-        type=tunnel
-        compress=yes
-        #-------------------
-        left=192.168.0.1
-        leftsubnet=192.168.1.0/24
-        #-------------------
-        right=192.168.0.10
-        rightsubnet=192.168.2.0/24
-        #-------------------
-        auth=esp
-        authby=secret
---------------- end of ipsec.conf ----------------
-
-ping .2.x from .1.y   (y != 1)
-It works?? Fine. Let's continue...
-
-Why y != 1 ?? Because kernel of sgw1 have 2 IP addresses and it will choose
-the first IP (which is used to go to Internet) .0.1 and the packet won't go
-through IPsec tunnel :(  But if do ping on .1.1 kernel will respond from
-that address (.1.1) and the packet will be tunneled. The same problem occurred then
-.2.x sends a packet to .1.2 which is down at the moment. What happens? .1.1
-sends ARP requesting .1.2... after 3 tries it send to .2.x an destunreach,
-but from his "natural" IP or .0.1 . So the error message won't be delivered!
-It's a big problem...
-
-Resolution... One can manipulate with ipsec0 or ipsec0:0 to solve the
-problem (if ipsec0 has .1.1 kernel will send packets correctly), but there
-are powerful and elegant iproute2 :) We simply need to change source address
-of packet that goes to other secure lan. This is done with
-
-ip route replace 192.168.2.0/24 via 192.168.0.10 dev ipsec0 src 192.168.1.1
-
-Cool!! Now it works!!
-
-The second step. We want install firewall on sgw1 and sgw2. Encryption of 
-traffic without security isn't a good idea. I don't use {left|right}firewall, 
-because I'm running firewall from init scripts.
-
-We want IPsec data between lan1-lan2, some ICMP errors (destination
-unreachable, TTL exceeded, parameter problem and source quench), replying on 
-pings from both lans and Internet, ipxtunnel data for IPX and of course SSH
-between sgw1 and sgw2 and from/to one specified host.
-
-I'm using ipchains. With iptables there are some changes.
-
----------------- rc.firewall ---------------------
-#!/bin/sh
-#
-# Firewall for IPsec lan1-lan2
-#
-
-IPC=/sbin/ipchains
-ANY=0.0.0.0/0
-
-# left
-SGW1_EXT=192.168.0.1
-SGW1_INT=192.168.1.1
-LAN1=192.168.1.0/24
-
-# right
-SGW2_EXT=192.168.0.10
-SGW2_INT=192.168.2.10
-LAN2=192.168.2.0/24
-
-# SSH from and to this host
-SSH_PEER_HOST=_SOME_HOST_
-
-# this is for left. exchange these values for right.
-MY_EXT=$SGW1_EXT
-MY_INT=$SGW1_INT
-PEER_EXT=$SGW2_EXT
-PEER_INT=$SGW2_INT
-INT_IF=eth1
-EXT_IF=eth0
-IPSEC_IF=ipsec0
-MY_LAN=$LAN1
-PEER_LAN=$LAN2
-
-$IPC -F
-$IPC -P input DENY
-$IPC -P forward DENY
-$IPC -P output DENY
-
-# Loopback traffic
-$IPC -A input -i lo -j ACCEPT
-$IPC -A output -i lo -j ACCEPT
-
-# for IPsec SGW1-SGW2
-## IKE
-$IPC -A input -p udp -s $PEER_EXT 500 -d $MY_EXT 500 -i $EXT_IF -j ACCEPT
-$IPC -A output -p udp -s $MY_EXT 500 -d $PEER_EXT 500 -i $EXT_IF -j ACCEPT
-## ESP
-$IPC -A input -p 50 -s $PEER_EXT -d $MY_EXT -i $EXT_IF -j ACCEPT
-### we don't need this line ### $IPC -A output -p 50 -s $MY_EXT -d $PEER_EXT -i $EXT_IF -j ACCEPT
-## forward LAN1-LAN2
-$IPC -A forward -s $MY_LAN -d $PEER_LAN -i $IPSEC_IF -j ACCEPT
-$IPC -A forward -s $PEER_LAN -d $MY_LAN -i $INT_IF -j ACCEPT
-$IPC -A output -s $PEER_LAN -d $MY_LAN -i $INT_IF -j ACCEPT
-$IPC -A input -s $PEER_LAN -d $MY_LAN -i $IPSEC_IF -j ACCEPT
-$IPC -A input -s $MY_LAN -d $PEER_LAN -i $INT_IF -j ACCEPT
-$IPC -A output -s $MY_LAN -d $PEER_LAN -i $IPSEC_IF -j ACCEPT
-
-# ICMP
-#
-## Dest unreachable
-### from/to Internet
-$IPC -A input -p icmp --icmp-type destination-unreachable -s $ANY -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type destination-unreachable -s $MY_EXT -d $ANY -i $EXT_IF -j ACCEPT
-### from/to Lan
-$IPC -A input -p icmp --icmp-type destination-unreachable -s $ANY -d $MY_INT -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type destination-unreachable -s $MY_INT -d $ANY -i $INT_IF -j ACCEPT
-### from/to Peer Lan
-$IPC -A input -p icmp --icmp-type destination-unreachable -s $ANY -d $MY_INT -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type destination-unreachable -s $MY_INT -d $ANY -i $IPSEC_IF -j ACCEPT
-#
-## Source quench
-### from/to Internet
-$IPC -A input -p icmp --icmp-type source-quench -s $ANY -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type source-quench -s $MY_EXT -d $ANY -i $EXT_IF -j ACCEPT
-### from/to Lan
-$IPC -A input -p icmp --icmp-type source-quench -s $ANY -d $MY_INT -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type source-quench -s $MY_INT -d $ANY -i $INT_IF -j ACCEPT
-### from/to Peer Lan
-$IPC -A input -p icmp --icmp-type source-quench -s $ANY -d $MY_INT -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type source-quench -s $MY_INT -d $ANY -i $IPSEC_IF -j ACCEPT
-#
-## Parameter problem
-### from/to Internet
-$IPC -A input -p icmp --icmp-type parameter-problem -s $ANY -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type parameter-problem -s $MY_EXT -d $ANY -i $EXT_IF -j ACCEPT
-### from/to Lan
-$IPC -A input -p icmp --icmp-type parameter-problem -s $ANY -d $MY_INT -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type parameter-problem -s $MY_INT -d $ANY -i $INT_IF -j ACCEPT
-### from/to Peer Lan
-$IPC -A input -p icmp --icmp-type parameter-problem -s $ANY -d $MY_INT -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type parameter-problem -s $MY_INT -d $ANY -i $IPSEC_IF -j ACCEPT
-#
-## Time To Live exceeded
-### from/to Internet
-$IPC -A input -p icmp --icmp-type time-exceeded -s $ANY -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type time-exceeded -s $MY_EXT -d $ANY -i $EXT_IF -j ACCEPT
-### to Lan
-$IPC -A input -p icmp --icmp-type time-exceeded -s $ANY -d $MY_INT -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type time-exceeded -s $MY_INT -d $ANY -i $INT_IF -j ACCEPT
-### to Peer Lan
-$IPC -A input -p icmp --icmp-type time-exceeded -s $ANY -d $MY_INT -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type time-exceeded -s $MY_INT -d $ANY -i $IPSEC_IF -j ACCEPT
-
-# ICMP PINGs
-## from Internet
-$IPC -A input -p icmp -s $ANY -d $MY_EXT --icmp-type echo-request  -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp -s $MY_EXT -d $ANY --icmp-type echo-reply  -i $EXT_IF -j ACCEPT
-## from LAN
-$IPC -A input -p icmp -s $ANY -d $MY_INT --icmp-type echo-request -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp -s $MY_INT -d $ANY --icmp-type echo-reply  -i $INT_IF -j ACCEPT
-## from Peer LAN
-$IPC -A input -p icmp -s $ANY -d $MY_INT --icmp-type echo-request -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp -s $MY_INT -d $ANY --icmp-type echo-reply  -i $IPSEC_IF -j ACCEPT
-
-# SSH
-## from SSH_PEER_HOST
-$IPC -A input -p tcp -s $SSH_PEER_HOST -d $MY_EXT 22 -i $EXT_IF -j ACCEPT
-$IPC -A output -p tcp \! -y -s $MY_EXT 22 -d $SSH_PEER_HOST -i $EXT_IF -j ACCEPT
-## to SSH_PEER_HOST
-$IPC -A input -p tcp \! -y -s $SSH_PEER_HOST 22 -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p tcp -s $MY_EXT -d $SSH_PEER_HOST 22 -i $EXT_IF -j ACCEPT
-## from PEER
-$IPC -A input -p tcp -s $PEER_EXT -d $MY_EXT 22 -i $EXT_IF -j ACCEPT
-$IPC -A output -p tcp \! -y -s $MY_EXT 22 -d $PEER_EXT -i $EXT_IF -j ACCEPT
-## to PEER
-$IPC -A input -p tcp \! -y -s $PEER_EXT 22 -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p tcp -s $MY_EXT -d $PEER_EXT 22 -i $EXT_IF -j ACCEPT
-
-# ipxtunnel
-$IPC -A input -p udp -s $PEER_INT 2005 -d $MY_INT 2005 -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p udp -s $MY_INT 2005 -d $PEER_INT 2005 -i $IPSEC_IF -j ACCEPT
-
----------------- end of rc.firewall ----------------------
-
-To understand this we need to look on this scheme:
-
-           ++-----------------------&lt;----------------------------+
-           || ipsec0                                             |
-           \/                                                    |
- eth0  +--------+    /---------/ yes  /---------/ yes +-----------------------+
-------&gt;| INPUT  |--&gt;/ ?local? /-----&gt;/ ?IPsec? /-----&gt;| decrypt & decapsulate |
- eth1  +--------+  /---------/      /---------/       +-----------------------+
-                       || no            || no
-                       \/               \/
-                  +----------+      +---------+        +-------+
-                  | routing  |      |  local  |        | local |
-                  | decision |      | deliver |        | send  |
-                  +----------+      +---------+        +-------+
-                       ||                                 ||
-                       \/                                 \/
-                   +---------+                       +----------+
-                   | forward |                       | routing  |
-                   +---------+                       | decision |
-                       ||                            +----------+
-                       ||                                  ||
-                       ++----------------&lt;-----------------++
-                       ||
-                       \/
-                   +--------+ eth0
-                   | OUTPUT | eth1
-                   +--------+ ipsec0
-                       ||
-                       \/
-                   /---------/ yes +-----------------------+
-                  / ?IPsec? /-----&gt;| encrypt & encapsulate |
-                 /---------/       +-----------------------+
-                      || no                    ||
-                      ||                       ||
-                      ||                       \/   eth0, eth1
-                      ++-----------------------++--------------&gt;
-
-This explain how a packet traverse TCP/IP stack in IPsec capable kernel.
-
-FIX ME, please, if there are any errors
-
-Test the new firewall now.
-
-
-Now about IPX. I tried 3 programs for tunneling IPX: tipxd, SIB and ipxtunnel
-
-tipxd didn't send packets.. :(
-SIB and ipxtunnel worked fine :)
-With ipxtunnel there was a little problem. In sources there are an error.
-
---------------------- in main.c ------------------------
-&lt;       bytes += p.len;
----
-&gt;       bytes += len;
---------------------------------------------------------
-
-After this FIX everything goes right...
-
-------------------- /etc/ipxtunnel.conf ----------------
-port    2005
-remote  192.168.101.97    2005
-interface eth1
---------------- end of /etc/ipxtunnel.conf -------------
-
-I use IPX tunnel between .1.1 and .2.10 so we don't need to encrypt nor
-authenticate encapsulated IPX packets, it is done with IPsec.
-
-If you don't wont to use iproute2 to change source IP you need to use SIB
-(it is able to bind local address) or establish tunnel between .0.1 and
-.0.10 (external IPs, you need to do encryption in the program, but it isn't
-strong).
-
-For now I'm using ipxtunnel.
-
-I think that's all for the moment. If there are any error, please e-mail me: 
-poltorak@df.ru . It would be cool if someone puts the scheme of TCP/IP in
-kernel and firewall example on FreeS/WAN's manual pages.
-
-PoltoS
-</pre>
-
-</body>
-</html>
\ No newline at end of file
diff --git a/doc/src/web.html b/doc/src/web.html
deleted file mode 100644
index 19df6ffa6..000000000
--- a/doc/src/web.html
+++ /dev/null
@@ -1,905 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
-    "http://www.w3.org/TR/html4/loose.dtd">
-<html>
-<head>
-  <meta http-equiv="Content-Type" content="text/html">
-  <title>FreeS/WAN web links</title>
-  <meta name="keywords"
-  content="Linux, IPsec, VPN, security, FreeSWAN, links, web">
-  <!--
-
-  Written by Sandy Harris for the Linux FreeS/WAN project
-  Freely distributable under the GNU General Public License
-
-  More information at www.freeswan.org
-  Feedback to users@lists.freeswan.org
-
-  CVS information:
-  RCS ID:          $Id: web.html,v 1.1 2004/03/15 20:35:24 as Exp $
-  Last changed:    $Date: 2004/03/15 20:35:24 $
-  Revision number: $Revision: 1.1 $
-
-  CVS revision numbers do not correspond to FreeS/WAN release numbers.
-  -->
-</head>
-
-<body>
-<h1><a name="weblink">Web links</a></h1>
-
-<h2><a name="freeswan">The Linux FreeS/WAN Project</a></h2>
-
-<p>The main project web site is <a
-href="http://www.freeswan.org/">www.freeswan.org</a>.</p>
-
-<p>Links to other project-related <a href="intro.html#sites">sites</a> are
-provided in our introduction section.</p>
-
-<h3><a name="patch">Add-ons and patches for FreeS/WAN</a></h3>
-
-<p>Some user-contributed patches have been integrated into the FreeS/WAN
-distribution. For a variety of reasons, those listed below have not.</p>
-
-<p>Note that not all patches are a good idea.</p>
-<ul>
-  <li>There are a number of "features" of IPsec which we do not implement
-    because they reduce security. See this <a
-    href="compat.html#dropped">discussion</a>. We do not recommend using
-    patches that implement these. One example is aggressive mode.</li>
-  <li>We do not recommend adding "features" of any sort unless they are
-    clearly necessary, or at least have clear benefits. For example,
-    FreeS/WAN would not become more secure if it offerred a choice of 14
-    ciphers. If even one was flawed, it would certainly become less secure
-    for anyone using that cipher. Even with 14 wonderful ciphers, it would be
-    harder to maintain and administer, hence more vulnerable to various human
-    errors.</li>
-</ul>
-
-<p>This is not to say that patches are necessarily  bad, only that using them
-requires some deliberation. For example, there might be perfectly good
-reasons to add a specific cipher in your application: perhaps GOST to comply
-with government standards in Eastern Europe, or AES for performance
-benefits.</p>
-
-<h4>Current patches</h4>
-
-<p>Patches believed current::</p>
-<ul>
-  <li>patches for <a href="http://www.strongsec.com/freeswan/">X.509
-    certificate support</a>, also available from a <a
-    href="http://www.twi.ch/~sna/strongsec/freeswan/">mirror site</a></li>
-  <li>patches to add <a href="http://www.irrigacion.gov.ar/juanjo/ipsec">AES
-    and other ciphers</a>. There is preliminary data indicating AES gives a
-    substantial <a href="performance.html#perf.more">performance
-  gain</a>.</li>
-</ul>
-
-<p>There is also one add-on that takes the form of a modified FreeS/WAN
-distribution, rather than just patches to the standard distribution:</p>
-<ul>
-  <li><a href="http://www.ipv6.iabg.de/downloadframe/index.html">IPv6
-    support</a></li>
-</ul>
-
-<p>Before using any of the above,, check the <a href="mail.html">mailing
-lists</a> for news of newer versions and to see whether they have been
-incorporated into more recent versions of FreeS/WAN.</p>
-
-<h4>Older patches</h4>
-<ul>
-  <li><a href="http://sources.colubris.com/en/projects/FreeSWAN/">hardware
-    acceleration</a></li>
-  <li>a <a href="http://tzukanov.narod.ru/">series</a> of patches that
-    <ul>
-      <li>provide GOST, a Russian gov't. standard cipher, in MMX
-      assembler</li>
-      <li>add GOST to OpenSSL</li>
-      <li>add GOST to the International kernel patch</li>
-      <li>let FreeS/WAN use International kernel patch ciphers</li>
-    </ul>
-  </li>
-  <li>Neil Dunbar's patches for <a
-    href="ftp://hplose.hpl.hp.com/pub/nd/pluto-openssl.tar.gz">certificate
-    support</a>, using code from <a href="http://www.openssl.org">Open
-    SSL</a>.</li>
-  <li>Luc Lanthier's <a
-    href="ftp://ftp.netwinder.org/users/f/firesoul/">patches</a> for <a
-    href="glossary.html#PKIX">PKIX</a> support.</li>
-  <li><a href="ftp://ftp.heise.de/pub/ct/listings/9916-180.tgz">patches</a>
-    to add <a href="glossary.html#blowfish">Blowfish</a>, <a
-    href="glossary.html#IDEA">IDEA</a> and <a
-    href="glossary.html#CAST128">CAST-128</a> to FreeS/WAN</li>
-  <li>patches for FreeS/WAN 1.3, Pluto support for <a
-    href="http://alcatraz.webcriminals.com/~bastiaan/ipsec/">external
-    authentication</a>, for example with a smartcard or SKEYID.</li>
-  <li><a href="http://www.zengl.net/freeswan/download/">patches and
-    utilities</a> for using FreeS/WAN with PGPnet</li>
-  <li><a
-    href="http://www.freelith.com/lithworks/crypto/freeswan_patch.htm">Blowfish
-    encryption and Tiger hash</a></li>
-  <li><a
-    href="http://www.cendio.se/~bellman/aggressive-pluto.snap.tar.gz">patches</a>
-    for aggressive mode support</li>
-</ul>
-
-<p>These patches are for older versions of FreeS/WAN and will likely not work
-with the current version.  Older versions of FreeS/WAN may be available on
-some of the <a href="intro.html#sites">distribution sites</a>, but we
-recommend using the current release.</p>
-
-<h4><a name="VPN.masq">VPN masquerade patches</a></h4>
-
-<p>Finally, there are some patches to other code that may be useful with
-FreeS/WAN:</p>
-<ul>
-  <li>a <a
-    href="ftp://ftp.rubyriver.com/pub/jhardin/masquerade/ip_masq_vpn.html">patch</a>
-    to make IPsec, PPTP and SSH VPNs work through a Linux firewall with <a
-    href="glossary.html#masq">IP masquerade</a>.</li>
-  <li><a href="http://www.linuxdoc.org/HOWTO/VPN-Masquerade-HOWTO.html">Linux
-    VPN Masquerade HOWTO</a></li>
-</ul>
-
-<p>Note that this is not required if the same machine does IPsec and
-masquerading, only if you want a to locate your IPsec gateway on a
-masqueraded network. See our <a href="firewall.html#NAT">firewalls</a>
-document for discussion of why this is problematic.</p>
-
-<p>At last report, this patch could not co-exist with FreeS/WAN on the same
-machine.</p>
-
-<h3><a name="dist">Distributions including FreeS/WAN</a></h3>
-
-<p>The introductory section of our document set lists several <a
-href="intro.html#distwith">Linux distributions</a> which include
-FreeS/WAN.</p>
-
-<h3><a name="used">Things FreeS/WAN uses or could use</a></h3>
-<ul>
-  <li><a href="http://openpgp.net/random">/dev/random</a> support page,
-    discussion of and code for the Linux <a
-    href="glossary.html#random">random number driver</a>. Out-of-date when we
-    last checked (January 2000), but still useful.</li>
-  <li>other programs related to random numbers:
-    <ul>
-      <li><a href="http://www.mindrot.org/audio-entropyd.html">audio entropy
-        daemon</a> to gather noise from a sound card and feed it into
-        /dev/random</li>
-      <li>an <a href="http://www.lothar.com/tech/crypto/">entropy-gathering
-        daemon</a></li>
-      <li>a driver for the random number generator in recent <a
-        href="http://sourceforge.net/projects/gkernel/">Intel chipsets</a>.
-        This driver is included as standard in 2.4 kernels.</li>
-    </ul>
-  </li>
-  <li>a Linux <a href="http://www.marko.net/l2tp/">L2TP Daemon</a> which
-    might be useful for communicating with Windows 2000 which builds L2TP
-    tunnels over its IPsec connections</li>
-  <li>to use opportunistic encryption, you need a recent version of <a
-    href="glossary.html#BIND">BIND</a>. You can get one from the <a
-    href="http://www.isc.org">Internet Software Consortium</a> who maintain
-    BIND.</li>
-</ul>
-
-<h3><a name="alternatives">Other approaches to VPNs for Linux</a></h3>
-<ul>
-  <li>other Linux <a href="#linuxipsec">IPsec implementations</a></li>
-  <li><a href="http://www.tik.ee.ethz.ch/~skip/">ENskip</a>, a free
-    implementation of Sun's <a href="glossary.html#SKIP">SKIP</a>
-  protocol</li>
-  <li><a href="http://sunsite.auc.dk/vpnd/">vpnd</a>, a non-IPsec VPN daemon
-    for Linux which creates tunnels using <a
-    href="glossary.html#Blowfish">Blowfish</a> encryption</li>
-  <li><a href="http://www.winton.org.uk/zebedee/">Zebedee</a>, a simple GPLd
-    tunnel-building program with Linux and Win32 versions. The name is from
-    <strong>Z</strong>lib compression, <strong>B</strong>lowfish encryption
-    and <strong>D</strong>iffie-Hellman key exchange.</li>
-  <li>There are at least two  PPTP implementations for Linux
-    <ul>
-      <li>Moreton Bay's <a
-        href="http://www.moretonbay.com/vpn/pptp.html">PoPToP</a></li>
-      <li><a
-        href="http://cag.lcs.mit.edu/~cananian/Projects/PPTP/">PPTP-Linux</a></li>
-    </ul>
-  </li>
-  <li><a href="http://sites.inka.de/sites/bigred/devel/cipe.html">CIPE</a>
-    (crypto IP encapsulation) project, using their own lightweight protocol
-    to encrypt between routers</li>
-  <li><a href="http://tinc.nl.linux.org/">tinc</a>, a VPN Daemon</li>
-</ul>
-
-<p>There is a list of <a
-href="http://www.securityportal.com/lskb/10000000/kben10000005.html">Linux
-VPN</a> software in the <a
-href="http://www.securityportal.com/lskb/kben00000001.html">Linux Security
-Knowledge Base</a>.</p>
-
-<h2><a name="ipsec.link">The IPsec Protocols</a></h2>
-
-<h3><a name="general">General IPsec or VPN information</a></h3>
-<ul>
-  <li>The <a href="http://www.vpnc.org">VPN Consortium</a> is a group for
-    vendors of IPsec products. Among other things, they have a good
-    collection of <a href="http://www.vpnc.org/white-papers.html">IPsec white
-    papers</a>.</li>
-  <li>A VPN mailing list with a <a
-    href="http://kubarb.phsx.ukans.edu/~tbird/vpn.html">home page</a>, a FAQ,
-    some product comparisons, and many links.</li>
-  <li><a href="http://www.opus1.com/vpn/index.html">VPN pointer page</a></li>
-  <li>a <a href="http://www.epm.ornl.gov/~dunigan/vpn.html">collection</a> of
-    VPN links, and some explanation</li>
-</ul>
-
-<h3><a name="overview">IPsec overview documents or slide sets</a></h3>
-<ul>
-  <li>the FreeS/WAN <a href="ipsec.html">document section</a> on these
-    protocols</li>
-</ul>
-
-<h3><a name="otherlang">IPsec information in languages other than
-English</a></h3>
-<ul>
-  <li><a
-    href="http://www.imib.med.tu-dresden.de/imib/Internet/Literatur/ipsec-docu.html">German</a></li>
-  <li><a href="http://www.kame.net/index-j.html">Japanese</a></li>
-  <li>Feczak Szabolcs' thesis in <a
-    href="http://feczo.koli.kando.hu/vpn/">Hungarian</a></li>
-  <li>Davide Cerri's thesis and some presentation slides <a
-    href="http://www.linux.it/~davide/doc/">Italian</a></li>
-</ul>
-
-<h3><a name="RFCs1">RFCs and other reference documents</a></h3>
-<ul>
-  <li><a href="rfc.html">Our document</a> listing the RFCs relevant to Linux
-    FreeS/WAN and giving various ways of obtaining both RFCs and Internet
-    Drafts.</li>
-  <li><a href="http://www.vpnc.org/vpn-standards.html">VPN Standards</a> page
-    maintained by <a href="glossary.html#VPNC">VPNC</a>. This covers both
-    RFCs and Drafts, and classifies them in a fairly helpful way.</li>
-  <li><a href="http://www.rfc-editor.org">RFC archive</a></li>
-  <li><a href="http://www.ietf.org/ids.by.wg/ipsec.html">Internet Drafts</a>
-    related to IPsec</li>
-  <li>US government <a href="http://www.itl.nist.gov/div897/pubs"> site</a>
-    with their <a href="glossary.html#FIPS">FIPS</a> standards</li>
-  <li>Archives of the ipsec@tis.com mailing list where discussion of drafts
-    takes place.
-    <ul>
-      <li><a href="http://www.sandelman.ottawa.on.ca/ipsec">Eastern
-      Canada</a></li>
-      <li><a href="http://www.vpnc.org/ietf-ipsec">California</a>.</li>
-    </ul>
-  </li>
-</ul>
-
-<h3><a name="analysis">Analysis and critiques of IPsec protocols</a></h3>
-<ul>
-  <li>Counterpane's <a
-    href="http://www.counterpane.com/ipsec.pdf">evaluation</a> of the
-    protocols</li>
-  <li>Simpson's <a
-    href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/1999/06/msg00319.html">IKE
-    Considered Dangerous</a> paper. Note that this is a link to an archive of
-    our mailing list. There are several replies in addition to the paper
-    itself.</li>
-  <li>Fate Labs <a href="http://www.fatelabs.com/loki-vpn.pdf">Virual Private
-    Problems: the Broken Dream</a></li>
-  <li>Catherine Meadows' paper <cite>Analysis of the Internet Key Exchange
-    Protocol Using the NRL Protocol Analyzer</cite>, in <a
-    href="http://chacs.nrl.navy.mil/publications/CHACS/1999/1999meadows-IEEE99.pdf">PDF</a>
-    or <a
-    href="http://chacs.nrl.navy.mil/publications/CHACS/1999/1999meadows-IEEE99.ps">Postscript</a>.</li>
-  <li>Perlman and Kaufmnan
-    <ul>
-      <li><a
-        href="http://snoopy.seas.smu.edu/ee8392_summer01/week7/perlman2.pdf">Key
-        Exchange in IPsec</a></li>
-      <li>a newer <a
-        href="http://sec.femto.org/wetice-2001/papers/radia-paper.pdf">PDF
-        paper</a>, <cite>Analysis of the IPsec Key Exchange
-      Standard</cite>.</li>
-    </ul>
-  </li>
-  <li>Bellovin's <a
-    href="http://www.research.att.com/~smb/papers/index.html">papers</a> page
-    including his:
-    <ul>
-      <li><cite>Security Problems in the TCP/IP Protocol Suite</cite>
-      (1989)</li>
-      <li><cite>Problem Areas for the IP Security Protocols</cite> (1996)</li>
-      <li><cite>Probable Plaintext Cryptanalysis of the IP Security
-        Protocols</cite> (1997)</li>
-    </ul>
-  </li>
-  <li>An <a href="http://www.lounge.org/ike_doi_errata.html">errata list</a>
-    for the IPsec RFCs.</li>
-</ul>
-
-<h3><a name="IP.background">Background information on IP</a></h3>
-<ul>
-  <li>An <a href="http://ipprimer.windsorcs.com/">IP tutorial</a> that seems
-    to be written mainly for Netware or Microsoft LAN admins entering a new
-    world</li>
-  <li><a href="http://www.iana.org">IANA</a>, Internet Assigned Numbers
-    Authority</li>
-  <li><a href="http://public.pacbell.net/dedicated/cidr.html">CIDR</a>,
-    Classless Inter-Domain Routing</li>
-  <li>Also see our <a href="biblio.html">bibliography</a></li>
-</ul>
-
-<h2><a name="implement">IPsec Implementations</a></h2>
-
-<h3><a name="linuxprod">Linux products</a></h3>
-
-<p>Vendors using FreeS/WAN in turnkey firewall or VPN products are listed in
-our <a href="intro.html#turnkey">introduction</a>.</p>
-
-<p>Other vendors have Linux IPsec products which, as far as we know, do not
-use FreeS/WAN</p>
-<ul>
-  <li><a href="http://www.redcreek.com/products/shareware.html">Redcreek</a>
-    provide an open source Linux driver for their PCI hardware VPN card. This
-    card has a 100 Mbit Ethernet port, an Intel 960 CPU plus more specialised
-    crypto chips, and claimed encryption performance of 45 Mbit/sec. The PC
-    sees it as an Ethernet board.</li>
-  <li><a href="http://linuxtoday.com/stories/8428.html?nn">Paktronix</a>
-    offer a Linux-based VPN with hardware encryption</li>
-  <li><a href="http://www.watchguard.com/">Watchguard</a> use Linux in their
-    Firebox product.</li>
-  <li><a href="http://www.entrust.com">Entrust</a> offer a developers'
-    toolkit for using their <a href="glossary.html#PKI">PKI</a> for IPsec
-    authentication</li>
-  <li>According to a report on our mailing list, <a
-    href="http://www.axent.com">Axent</a> have a Linux version of their
-    product.</li>
-</ul>
-
-<h3><a name="router">IPsec in router products</a></h3>
-
-<p>All the major router vendors support IPsec, at least in some models.</p>
-<ul>
-  <li><a href="http://www.cisco.com/warp/public/707/16.html">Cisco</a> IPsec
-    information</li>
-  <li>Ascend, now part of <a href="http://www.lucent.com/">Lucent</a>, have
-    some IPsec-based products</li>
-  <li><a href="http://www.nortelnetworks.com/">Bay Networks</a>, now part of
-    Nortel, use IPsec in their Contivity switch product line</li>
-  <li><a href="http://www.3com.com/products/enterprise.html">3Com</a> have a
-    number of VPN products, some using IPsec</li>
-</ul>
-
-<h3><a name="fw.web">IPsec in firewall products</a></h3>
-
-<p>Many firewall vendors offer IPsec, either as a standard part of their
-product, or an optional extra. A few we know about are:</p>
-<ul>
-  <li><a href="http://www.borderware.com/">Borderware</a></li>
-  <li><a href="http://www.ashleylaurent.com/vpn/ipsec_vpn.htm">Ashley
-    Laurent</a></li>
-  <li><a href="http://www.watchguard.com">Watchguard</a></li>
-  <li><a href="http://www.fx.dk/firewall/ipsec.html">Injoy</a> for OS/2</li>
-</ul>
-
-<p>Vendors using FreeS/WAN in turnkey firewall products are listed in our <a
-href="intro.html#turnkey">introduction</a>.</p>
-
-<h3><a name="ipsecos">Operating systems with IPsec support</a></h3>
-
-<p>All the major open source operating systems support IPsec. See below for
-details on <a href="#BSD">BSD-derived</a> Unix variants.</p>
-
-<p>Among commercial OS vendors, IPsec players include:</p>
-<ul>
-  <li><a
-    href="http://msdn.microsoft.com/isapi/msdnlib.idc?theURL=/library/backgrnd/html/msdn_ip_security.htm">Microsoft</a>
-    have put IPsec in their Windows 2000 and XP products</li>
-  <li><a
-    href="http://www.s390.ibm.com/stories/1999/os390v2r8_pr.html">IBM</a>
-    announce a release of OS390 with IPsec support via a crypto
-  co-processor</li>
-  <li><a
-    href="http://www.sun.com/solaris/ds/ds-security/ds-security.pdf">Sun</a>
-    include IPsec in Solaris 8</li>
-  <li><a
-    href="http://www.hp.com/security/products/extranet-security.html">Hewlett
-    Packard</a> offer IPsec for their Unix machines</li>
-  <li>Certicom have IPsec available for the <a
-    href="http://www.certicom.com/products/movian/movianvpn_tech.html">Palm</a>.</li>
-  <li>There were reports before the release that Apple's Mac OS X would have
-    IPsec support built in, but it did not seem to be there when we last
-    checked. If you find, it please let us know via the <a
-    href="mail.html">mailing list</a>.</li>
-</ul>
-
-<h3>IPsec on network cards</h3>
-
-<p>Network cards with built-in IPsec acceleration are available from at least
-Intel, 3Com and Redcreek.</p>
-
-<h3><a name="opensource">Open source IPsec implementations</a></h3>
-
-<h4><a name="linuxipsec">Other Linux IPsec implementations</a></h4>
-
-<p>We like to think of FreeS/WAN as <em>the</em> Linux IPsec implementation,
-but it is not the only one. Others we know of are:</p>
-<ul>
-  <li><a href="http://www.enst.fr/~beyssac/pipsec/">pipsecd</a>, a
-    lightweight implementation of IPsec for Linux. Does not require kernel
-    recompilation.</li>
-  <li>Petr Novak's <a href="ftp://ftp.eunet.cz/icz/ipnsec/">ipnsec</a>, based
-    on the OpenBSD IPsec code and using <a
-    href="glossary.html#photuris">Photuris</a> for key management</li>
-  <li>A now defunct project at <a
-    href="http://www.cs.arizona.edu/security/hpcc-blue/linux.html">U of
-    Arizona</a> (export controlled)</li>
-  <li><a href="http://snad.ncsl.nist.gov/cerberus">NIST Cerebus</a> (export
-    controlled)</li>
-</ul>
-
-<h4><a name="BSD">IPsec for BSD Unix</a></h4>
-<ul>
-  <li><a href="http://www.kame.net/project-overview.html">KAME</a>, several
-    large Japanese companies co-operating on IPv6 and IPsec</li>
-  <li><a href="http://web.mit.edu/network/isakmp">US Naval Research Lab</a>
-    implementation of IPv6 and of IPsec for IPv4 (export controlled)</li>
-  <li><a href="http://www.openbsd.org">OpenBSD</a> includes IPsec as a
-    standard part of the distribution</li>
-  <li><a href="http://www.r4k.net/ipsec">IPsec for FreeBSD</a></li>
-  <li>a <a href="http://www.netbsd.org/Documentation/network/ipsec/">FAQ</a>
-    on NetBSD's IPsec implementation</li>
-</ul>
-
-<h4><a name="misc">IPsec for other systems</a></h4>
-<ul>
-  <li><a href="http://www.tcm.hut.fi/Tutkimus/IPSEC/">Helsinki U of
-    Technolgy</a> have implemented IPsec for Solaris, Java and Macintosh</li>
-</ul>
-
-<h3><a name="interop.web">Interoperability</a></h3>
-
-<p>The IPsec protocols are designed so that different implementations should
-be able to work together. As they say "the devil is in the details". IPsec
-has a lot of details, but considerable success has been achieved.</p>
-
-<h4><a name="result">Interoperability results</a></h4>
-
-<p>Linux FreeS/WAN has been tested for interoperability with many other IPsec
-implementations. Results to date are in our <a
-href="interop.html">interoperability</a> section.</p>
-
-<p>Various other sites have information on interoperability between various
-IPsec implementations:</p>
-<ul>
-  <li><a href="http://www.opus1.com/vpn/atl99display.html">interop
-    results</a> from a bakeoff in Atlanta, September 1999.</li>
-  <li>a French company, HSC's, <a
-    href="http://www.hsc.fr/ressources/presentations/ipsec99/index.html.en">interoperability</a>
-    test data covers FreeS/WAN, Open BSD, KAME, Linux pipsecd, Checkpoint,
-    Red Creek Ravlin, and Cisco IOS</li>
-  <li><a href="http://www.icsa.net/">ICSA</a> offer certification programs
-    for various security-related products. See their list of <a
-    href="http://www.icsa.net/html/communities/ipsec/certification/certified_products/index.shtml">
-    certified IPsec</a> products. Linux FreeS/WAN is not currently on that
-    list, but several products with which we interoperate are.</li>
-  <li>VPNC have a page on why they are not yet doing <a
-    href="http://www.vpnc.org/interop.html">interoperability</a> testing and
-    a page on the <a href="http://www.vpnc.org/conformance.html">spec
-    conformance</a> testing that they are doing</li>
-  <li>a <a href="http://www.commweb.com/article/COM20000912S0009">review</a>
-    comparing a dozen commercial IPsec implemetations. Unfortunately, the
-    reviewers did not look at Open Source implementations such as FreeS/WAN
-    or OpenBSD.</li>
-  <li><a
-    href="http://www.tanu.org/~sakane/doc/public/report-ike-interop0007.html">results</a>
-    from interoperability tests at a conference. FreeS/WAN was not tested
-    there.</li>
-  <li>test results from the <a
-    href="http://www.hsc.fr/ressources/veille/ipsec/ipsec2000/">IPSEC
-    2000</a> conference</li>
-</ul>
-
-<h4><a name="test1">Interoperability test sites</a></h4>
-<ul>
-  <li><a href="http://www.tahi.org/">TAHI</a>, a Japanese IPv6 testing
-    project with free IPsec validation software</li>
-  <li><a href="http://ipsec-wit.antd.nist.gov">National Institute of
-    Standards and Technology</a></li>
-  <li><a href="http://isakmp-test.ssh.fi/">SSH Communications
-  Security</a></li>
-</ul>
-
-<h2><a name="linux.link">Linux links</a></h2>
-
-<h3><a name="linux.basic">Basic and tutorial Linux information</a></h3>
-<ul>
-  <li>Linux <a
-    href="http://linuxcentral.com/linux/LDP/LDP/gs/gs.html">Getting
-    Started</a> HOWTO document</li>
-  <li>A getting started guide from the <a
-    href="http://darkwing.uoregon.edu/~cchome/linuxgettingstarted.html">U of
-    Oregon</a></li>
-  <li>A large <a href="http://www.herring.org/techie.html">link
-    collection</a> which includes a lot of introductory and tutorial material
-    on Unix, Linux, the net, . . .</li>
-</ul>
-
-<h3><a name="general">General Linux sites</a></h3>
-<ul>
-  <li><a href="http://www.freshmeat.net">Freshmeat</a> Linux news</li>
-  <li><a href="http://slashdot.org">Slashdot</a> "News for Nerds"</li>
-  <li><a href="http://www.linux.org">Linux Online</a></li>
-  <li><a href="http://www.linuxhq.com">Linux HQ</a></li>
-  <li><a href="http://www.tux.org">tux.org</a></li>
-</ul>
-
-<h3><a name="docs.ldp">Documentation</a></h3>
-
-<p>Nearly any Linux documentation you are likely to want can be found at the
-<a href="http://metalab.unc.edu/LDP">Linux Documentation Project</a> or
-LDP.</p>
-<ul>
-  <li><a href="http://metalab.unc.edu/LDP/HOWTO/META-FAQ.html">Meta-FAQ</a>
-    guide to Linux information sources</li>
-  <li>The LDP's HowTo documents are a standard Linux reference. See this <a
-    href="http://www.linuxdoc.org/docs.html#howto">list</a>. Documents there
-    most relevant to a FreeS/WAN gateway are:
-    <ul>
-      <li><a href="http://metalab.unc.edu/LDP/HOWTO/Kernel-HOWTO.html">Kernel
-        HOWTO</a></li>
-      <li><a
-        href="http://metalab.unc.edu/LDP/HOWTO/Networking-Overview-HOWTO.html">Networking
-        Overview HOWTO</a></li>
-      <li><a
-        href="http://metalab.unc.edu/LDP/HOWTO/Security-HOWTO.html">Security
-        HOWTO</a></li>
-    </ul>
-  </li>
-  <li>The LDP do a series of Guides, book-sized publications with more detail
-    (and often more "why do it this way?") than the HowTos. See this <a
-    href="http://www.linuxdoc.org/guides.html">list</a>. Documents there most
-    relevant to a FreeS/WAN gateway are:
-    <ul>
-      <li><a href="http://www.tml.hut.fi/~viu/linux/sag/">System
-        Administrator's Guide</a></li>
-      <li><a href="http://www.linuxdoc.org/LDP/nag2/index.html">Network
-        Adminstrator's Guide</a></li>
-      <li><a href="http://www.seifried.org/lasg/">Linux Administrator's
-        Security Guide</a></li>
-    </ul>
-  </li>
-</ul>
-
-<p>You may not need to go to the LDP to get this material. Most Linux
-distributions include the HowTos on their CDs and several include the Guides
-as well. Also, most of the Guides and some collections of HowTos are
-available in book form from various publishers.</p>
-
-<p>Much of the LDP material is also available in languages other than
-English. See this <a href="http://www.linuxdoc.org/links/nenglish.html">LDP
-page</a>.</p>
-
-<h3><a name="advroute.web">Advanced routing</a></h3>
-
-<p>The Linux IP stack has some new features in 2.4 kernels. Some HowTos have
-been written:</p>
-<ul>
-  <li>several HowTos for the <a
-    href="http://netfilter.samba.org/unreliable-guides/">netfilter</a>
-    firewall code in newer kernels</li>
-  <li><a
-    href="http://www.ds9a.nl/2.4Networking/HOWTO//cvs/2.4routing/output/2.4networking.html">2.4
-    networking</a> HowTo</li>
-  <li><a
-    href="http://www.ds9a.nl/2.4Networking/HOWTO//cvs/2.4routing/output/2.4routing.html">2.4
-    routing</a> HowTo</li>
-</ul>
-
-<h3><a name="linsec">Security for Linux</a></h3>
-
-<p>See also the <a href="#docs.ldp">LDP material</a> above.</p>
-<ul>
-  <li><a
-    href="http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html#trinityos">Trinity
-    OS guide to setting up Linux</a></li>
-  <li><a href="http://www.deter.com/unix">Unix security</a> page</li>
-  <li><a href="http://linux01.gwdg.de/~alatham/">PPDD</a> encrypting
-    filesystem</li>
-  <li><a href="http://EncryptionHOWTO.sourceforge.net/">Linux Encryption
-    HowTo</a> (outdated when last checked, had an Oct 2000 revision date in
-    March 2002)</li>
-</ul>
-
-<h3><a name="firewall.linux">Linux firewalls</a></h3>
-
-<p>Our <a href="firewall.html">FreeS/WAN and firewalls</a> document includes
-links to several sets of <a href="firewall.html#examplefw">scripts</a> known
-to work with FreeS/WAN.</p>
-
-<p>Other information sources:</p>
-<ul>
-  <li><a href="http://ipmasq.cjb.net/">IP Masquerade resource page</a></li>
-  <li><a href="http://netfilter.samba.org/unreliable-guides/">netfilter</a>
-    firewall code in 2.4 kernels</li>
-  <li>Our list of general <a href="#firewall.web">firewall references</a> on
-    the web</li>
-  <li><a href="http://users.dhp.com/~whisper/mason/">Mason</a>, a tool for
-    automatically configuring Linux firewalls</li>
-  <li>the web cache software <a href="http://www.squid-cache.org/">squid</a>
-    and <a href="http://www.squidguard.org/">squidguard</a> which turns Squid
-    into a filtering web proxy</li>
-</ul>
-
-<h3><a name="linux.misc">Miscellaneous Linux information</a></h3>
-<ul>
-  <li><a href="http://lwn.net/current/dists.php3">Linux distribution
-    vendors</a></li>
-  <li><a href="http://www.linux.org/groups/">Linux User Groups</a></li>
-</ul>
-
-<h2><a name="crypto.link">Crypto and security links</a></h2>
-
-<h3><a name="security">Crypto and security resources</a></h3>
-
-<h4><a name="std.links">The standard link collections</a></h4>
-
-<p>Two enormous collections of links, each the standard reference in its
-area:</p>
-<dl>
-  <dt>Gene Spafford's <a
-  href="http://www.cerias.purdue.edu/coast/hotlist/">COAST hotlist</a></dt>
-    <dd>Computer and network security.</dd>
-  <dt>Peter Gutmann's <a
-  href="http://www.cs.auckland.ac.nz/~pgut001/links.html">Encryption and
-  Security-related Resources</a></dt>
-    <dd>Cryptography.</dd>
-</dl>
-
-<h4><a name="FAQ">Frequently Asked Question (FAQ) documents</a></h4>
-<ul>
-  <li><a href="http://www.faqs.org/faqs/cryptography-faq/">Cryptography
-    FAQ</a></li>
-  <li><a href="http://www.interhack.net/pubs/fwfaq">Firewall FAQ</a></li>
-  <li><a href="http://www.whitefang.com/sup/secure-faq.html">Secure Unix
-    Programming FAQ</a></li>
-  <li>FAQs for specific programs are listed in the <a href="#tools">tools</a>
-    section below.</li>
-</ul>
-
-<h4><a name="cryptover">Tutorials</a></h4>
-<ul>
-  <li>Gary Kessler's <a
-    href="http://www.garykessler.net/library/crypto.html">Overview of
-    Cryptography</a></li>
-  <li>Terry Ritter's <a
-    href="http://www.ciphersbyritter.com/LEARNING.HTM">introduction</a></li>
-  <li>Peter Gutman's <a
-    href="http://www.cs.auckland.ac.nz/~pgut001/tutorial/index.html">cryptography</a>
-    tutorial (500 slides in PDF format)</li>
-  <li>Amir Herzberg of IBM's sildes for his course <a
-    href="http://www.hrl.il.ibm.com/mpay/course.html">Introduction to
-    Cryptography and Electronic Commerce</a></li>
-  <li>the <a href="http://www.gnupg.org/gph/en/manual/c173.html">concepts
-    section</a> of the <a href="glossary.html#GPG">GNU Privacy Guard</a>
-    documentation</li>
-  <li>Bruce Schneier's self-study <a
-    href="http://www.counterpane.com/self-study.html">cryptanalysis</a>
-  course</li>
-</ul>
-
-<p>See also the <a href="#interesting">interesting papers</a> section
-below.</p>
-
-<h4><a name="standards">Crypto and security standards</a></h4>
-<ul>
-  <li><a href="http://csrc.nist.gov/cc">Common Criteria</a>, new
-    international computer and network security standards to replace the
-    "Rainbow" series</li>
-  <li>AES <a href="http://csrc.nist.gov/encryption/aes/aes_home.htm">
-    Advanced Encryption Standard </a> which will replace DES</li>
-  <li><a href="http://grouper.ieee.org/groups/1363">IEEE P-1363 public key
-    standard</a></li>
-  <li>our collection of links for the <a href="#ipsec.link">IPsec</a>
-    standards</li>
-  <li>history of <a
-    href="http://www.visi.com/crypto/evalhist/index.html">formal
-    evaluation</a> of security policies and implementation</li>
-</ul>
-
-<h4><a name="quotes">Crypto quotes</a></h4>
-
-<p>There are several collections of cryptographic quotes on the net:</p>
-<ul>
-  <li><a href="http://www.eff.org/pub/EFF/quotes.eff">the EFF</a></li>
-  <li><a href="http://www.samsimpson.com/cquotes.php">Sam Simpson</a></li>
-  <li><a href="http://www.amk.ca/quotations/cryptography/page-1.html">AM
-    Kutchling</a></li>
-</ul>
-
-<h3><a name="policy">Cryptography law and policy</a></h3>
-
-<h4><a name="legal">Surveys of crypto law</a></h4>
-<ul>
-  <li>International survey of <a
-    href="http://cwis.kub.nl/~FRW/PEOPLE/koops/lawsurvy.htm"> crypto
-  law</a>.</li>
-  <li>International survey of <a
-    href="http://rechten.kub.nl/simone/ds-lawsu.htm"> digital signature
-    law</a></li>
-</ul>
-
-<h4><a name="oppose">Organisations opposing crypto restrictions</a></h4>
-<ul>
-  <li>The <a href="glossary.html#EFF">EFF</a>'s archives on <a
-    href="http://www.eff.org/pub/Privacy/">privacy</a> and <a
-    href="http://www.eff.org/pub/Privacy/ITAR_export/">export
-  control</a>.</li>
-  <li><a href="http://www.gilc.org">Global Internet Liberty Campaign</a></li>
-  <li><a href="http://www.cdt.org/crypto">Center for Democracy and
-    Technology</a></li>
-  <li><a href="http://www.privacyinternational.org/">Privacy
-    International</a>, who give out <a
-    href="http://www.bigbrotherawards.org/">Big Brother Awards</a> to snoopy
-    organisations</li>
-</ul>
-
-<h4><a name="other.policy">Other information on crypto policy</a></h4>
-<ul>
-  <li><a href="ftp://ftp.isi.edu/in-notes/rfc1984.txt">RFC 1984</a>, the <a
-    href="glossary.html#IAB">IAB</a> and <a
-    href="glossary.html#IESG">IESG</a> Statement on Cryptographic Technology
-    and the Internet.</li>
-  <li>John Young's collection of <a href="http://cryptome.org/">documents</a>
-    of interest to the cryptography, open government and privacy movements,
-    organized chronologically</li>
-  <li>AT&amp;T researcher Matt Blaze's Encryption, Privacy and Security <a
-    href="http://www.crypto.com">Resource Page</a></li>
-  <li>A good <a href="http://cryptome.org/crypto97-ne.htm">overview</a> of
-    the issues from Australia.</li>
-</ul>
-
-<p>See also our documentation section on the <a href="politics.html">history
-and politics</a> of cryptography.</p>
-
-<h3><a name="crypto.tech">Cryptography technical information</a></h3>
-
-<h4><a name="cryptolinks">Collections of crypto links</a></h4>
-<ul>
-  <li><a href="http://www.counterpane.com/hotlist.html">Counterpane</a></li>
-  <li><a href="http://www.cs.auckland.ac.nz/~pgut001/links.html">Peter
-    Gutman's links</a></li>
-  <li><a href="http://www.pca.dfn.de/eng/team/ske/pem-dok.html">PKI
-  links</a></li>
-  <li><a href="http://crypto.yashy.com/www/">Robert Guerra's links</a></li>
-</ul>
-
-<h4><a name="papers">Lists of online cryptography papers</a></h4>
-<ul>
-  <li><a href="http://www.counterpane.com/biblio">Counterpane</a></li>
-  <li><a
-    href="http://www.cryptography.com/resources/papers">cryptography.com</a></li>
-  <li><a href="http://www.cryptosoft.com/html/secpub.htm">Cryptosoft</a></li>
-</ul>
-
-<h4><a name="interesting">Particularly interesting papers</a></h4>
-
-<p>These papers emphasize important issues around the use of cryptography,
-and the design and management of secure systems.</p>
-<ul>
-  <li><a href="http://www.counterpane.com/keylength.html">Key length
-    requirements for security</a></li>
-  <li><a href="http://www.cl.cam.ac.uk/users/rja14/wcf.html">Why
-    Cryptosystems Fail</a></li>
-  <li><a href="http://www.cdt.org/crypto/risks98/">Risks of escrowed
-    encryption</a></li>
-  <li><a href="http://www.counterpane.com/pitfalls.html">Security pitfalls in
-    cryptography</a></li>
-  <li><a href="http://www.acm.org/classics/sep95">Reflections on Trusting
-    Trust</a>, Ken Thompson on Trojan horse design</li>
-  <li><a href="http://www.apache-ssl.org/disclosure.pdf">Security against
-    Compelled Disclosure</a>, how to maintain privacy in the face of legal or
-    other coersion</li>
-</ul>
-
-<h3><a name="compsec">Computer and network security</a></h3>
-
-<h4><a name="seclink">Security links</a></h4>
-<ul>
-  <li><a href="http://www.cs.purdue.edu/coast/hotlist">COAST Hotlist</a></li>
-  <li>DMOZ open directory project <a
-    href="http://dmoz.org/Computers/Security/">computer security</a>
-  links</li>
-  <li><a href="http://www-cse.ucsd.edu/users/bsy/sec.html">Bennet Yee</a></li>
-  <li>Mike Fuhr's <a
-    href="http://www.fuhr.org/~mfuhr/computers/security.html">link
-    collection</a></li>
-  <li><a href="http://www.networkintrusion.co.uk/">links</a> with an emphasis
-    on intrusion detection</li>
-</ul>
-
-<h4><a name="firewall.web">Firewall links</a></h4>
-<ul>
-  <li><a href="http://www.cs.purdue.edu/coast/firewalls">COAST
-  firewalls</a></li>
-  <li><a href="http://www.zeuros.co.uk">Firewalls Resource page</a></li>
-</ul>
-
-<h4><a name="vpn">VPN links</a></h4>
-<ul>
-  <li><a href="http://www.vpnc.org">VPN Consortium</a></li>
-  <li>First VPN's <a href="http://www.firstvpn.com/research/rhome.html">white
-    paper</a> collection</li>
-</ul>
-
-<h4><a name="tools">Security tools</a></h4>
-<ul>
-  <li>PGP -- mail encryption
-    <ul>
-      <li><a href="http://www.pgp.com/">PGP Inc.</a> (part of NAI) for
-        commercial versions</li>
-      <li><a href="http://web.mit.edu/network/pgp.html">MIT</a> distributes
-        the NAI product for non-commercial use</li>
-      <li><a href="http://www.pgpi.org/">international</a> distribution
-      site</li>
-      <li><a href="http://gnupg.org">GNU Privacy Guard (GPG)</a></li>
-      <li><a href="http://www.dk.pgp.net/pgpnet/pgp-faq/">PGP FAQ</a></li>
-    </ul>
-    A message in our mailing list archive has considerable detail on <a
-    href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/12/msg00029.html">available
-    versions</a> of PGP and on IPsec support in them.
-    <p><strong>Note:</strong> A fairly nasty bug exists in all commercial PGP
-    versions from 5.5 through 6.5.3. If you have one of those,
-    <strong>upgrade now</strong>.</p>
-  </li>
-  <li>SSH -- secure remote login
-    <ul>
-      <li><a href="http://www.ssh.fi">SSH Communications Security</a>, for
-        the original software. It is free for trial, academic and
-        non-commercial use.</li>
-      <li><a href="http://www.openssh.com/">Open SSH</a>, the Open BSD team's
-        free replacement</li>
-      <li><a href="http://www.freessh.org/">freessh.org</a>, links to free
-        implementations for many systems</li>
-      <li><a href="http://www.uni-karlsruhe.de/~ig25/ssh-faq">SSH FAQ</a></li>
-      <li><a
-        href="http://www.chiark.greenend.org.uk/~sgtatham/putty/">Putty</a>,
-        an SSH client for Windows</li>
-    </ul>
-  </li>
-  <li>Tripwire saves message digests of your system files. Re-calculate the
-    digests and compare to saved values to detect any file changes. There are
-    several versions available:
-    <ul>
-      <li><a href="http://www.tripwiresecurity.com/">commercial
-      version</a></li>
-      <li><a href="http://www.tripwire.org/">Open Source</a></li>
-    </ul>
-  </li>
-  <li><a href="http://www.snort.org">Snort</a> and <a
-    href="http://www.lids.org">LIDS</a> are intrusion detection system for
-    Linux</li>
-  <li><a href="http://www.fish.com/~zen/satan/satan.html">SATAN</a> System
-    Administrators Tool for Analysing Networks</li>
-  <li><a href="http://www.insecure.org/nmap/">NMAP</a> Network Mapper</li>
-  <li><a href="ftp://ftp.porcupine.org/pub/security/index.html">Wietse
-    Venema's page</a> with various tools</li>
-  <li><a href="http://ita.ee.lbl.gov/index.html">Internet Traffic
-    Archive</a>, various tools to analyze network traffic, mostly scripts to
-    organise and format tcpdump(8) output for specific purposes</li>
-  <li><a name="ssmail">ssmail -- sendmail patched to do</a> <a
-    href="glossary.html#carpediem">opportunistic encryption</a>
-    <ul>
-      <li><a href="http://www.home.aone.net.au/qualcomm/">web page</a> with
-        links to code and to a Usenix paper describing it, in PDF</li>
-    </ul>
-  </li>
-  <li><a href="http://www.openca.org/">Open CA</a> project to develop a
-    freely distributed <a href="glossary.html#CA">Certification Authority</a>
-    for building a open <a href="glossary.html#PKI">Public Key
-    Infrastructure</a>.</li>
-</ul>
-
-<h3><a name="people">Links to home pages</a></h3>
-
-<p>David Wagner at Berkeley provides a set of links to <a
-href="http://www.cs.berkeley.edu/~daw/people/crypto.html">home pages</a> of
-cryptographers, cypherpunks and computer security people.</p>
-</body>
-</html>
diff --git a/doc/testing.html b/doc/testing.html
deleted file mode 100644
index 77626ba5d..000000000
--- a/doc/testing.html
+++ /dev/null
@@ -1,332 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="performance.html">Previous</A>
-<A HREF="kernel.html">Next</A>
-<HR>
-<H1><A name="test.freeswan">Testing FreeS/WAN</A></H1>
- This document discusses testing FreeS/WAN.
-<P>Not all types of testing are described here. Other parts of the
- documentation describe some tests:</P>
-<DL>
-<DT><A href="install.html#testinstall">installation</A> document</DT>
-<DD>testing for a successful install</DD>
-<DT><A href="config.html#testsetup">configuration</A> document</DT>
-<DD>basic tests for a working configuration</DD>
-<DT><A href="web.html#interop.web">web links</A> document</DT>
-<DD>General information on tests for interoperability between various
- IPsec implementations. This includes links to several test sites.</DD>
-<DT><A href="interop.html">interoperation</A> document.</DT>
-<DD>More specific information on FreeS/WAN interoperation with other
- implementations.</DD>
-<DT><A href="performance.html">performance</A> document</DT>
-<DD>performance measurements</DD>
-</DL>
-<P>The test setups and procedures described here can also be used in
- other testing, but this document focuses on testing the IPsec
- functionality of FreeS/WAN.</P>
-<H2><A NAME="test.oe">Testing opportunistic connections</A></H2>
-<P>This section teaches you how to test your opportunistically encrypted
- (OE) connections. To set up OE, please see the easy instructions in our<A
-HREF="quickstart.html"> quickstart guide</A>.</P>
-<H3><A NAME="12_1_1">Basic OE Test</A></H3>
-<P>This test is for basic OE functionality.
-<!-- You may use it on an 
-<A HREF="quickstart.html#oppo.client">initiate-only OE</A> box or a 
-<A HREF="quickstart.html#opp.incoming">full OE</A> box. -->
- For additional tests, keep
- reading.</P>
-<P>Be sure IPsec is running. You can see whether it is with:</P>
-<PRE>    ipsec setup status</PRE>
-<P>If need be, you can restart it with:</P>
-<PRE>    service ipsec restart</PRE>
-<P>Load a FreeS/WAN test website from the host on which you're running
- FreeS/WAN. Note: the feds may be watching these sites. Type one of:</P>
-<P></P>
-<PRE>   links oetest.freeswan.org</PRE>
-<PRE>   links oetest.freeswan.nl</PRE>
-
-<!--<PRE>   links oetest.freeswan.ca</PRE>-->
-<P>A positive result looks like this:</P>
-<PRE>
-   You  seem  to  be  connecting  from:  192.0.2.11 which DNS says is:
-   gateway.example.com
-     _________________________________________________________________
-                                                                                
-   Status E-route
-   OE    enabled    16    192.139.46.73/32    -&gt;    192.0.2.11/32   =&gt;
-   tun0x2097@192.0.2.11
-   OE    enabled    176    192.139.46.77/32    -&gt;   192.0.2.11/32   =&gt;
-   tun0x208a@192.0.2.11
-</PRE>
-<P>If you see this, congratulations! Your OE box will now encrypt its
- own traffic whenever it can. If you have difficulty, see our<A HREF="quickstart.html#oe.trouble">
- OE troubleshooting tips</A>.</P>
-<H3><A NAME="12_1_2">OE Gateway Test</A></H3>
-<P>If you've set up FreeS/WAN to protect a subnet behind your gateway,
- you'll need to run another simple test, which can be done from a
- machine running any OS. That's right, your Windows box can be protected
- by opportunistic encryption without any FreeS/WAN install or
- configuration on that box. From<STRONG> each protected subnet node</STRONG>
-, load the FreeS/WAN website with:</P>
-<PRE>   links oetest.freeswan.org</PRE>
-<PRE>   links oetest.freeswan.nl</PRE>
-<P>A positive result looks like this:</P>
-<PRE>
-   You  seem  to  be  connecting  from:  192.0.2.98 which DNS says is:
-   box98.example.com
-     _________________________________________________________________
-                                                                                
-   Status E-route
-   OE    enabled    16    192.139.46.73/32    -&gt;    192.0.2.98/32   =&gt;
-   tun0x134ed@192.0.2.11
-   OE    enabled    176    192.139.46.77/32    -&gt;   192.0.2.11/32   =&gt;
-   tun0x134d2@192.0.2.11
-</PRE>
-<P>If you see this, congratulations! Your OE gateway will now encrypt
- traffic for this subnet node whenever it can. If you have difficulty,
- see our<A HREF="quickstart.html#oe.trouble"> OE troubleshooting tips</A>
-.</P>
-<H3><A NAME="12_1_3">Additional OE tests</A></H3>
-<P>When testing OE, you will often find it useful to execute this
- command on the FreeS/WAN host:</P>
-<PRE>   ipsec eroute</PRE>
-<P>If you have established a connection (either for or for a subnet
- node) you will see a result like:</P>
-<PRE>    192.0.2.11/32   -&gt; 192.139.46.73/32  =&gt; tun0x149f@192.139.46.38
-</PRE>
-<P>Key:</P>
-<TABLE>
-<TR><TD>1.</TD><TD>192.0.2.11/32</TD><TD>Local start point of the
- protected traffic.</TD></TR>
-<TR><TD>2.</TD><TD>192.0.2.194/32</TD><TD>Remote end point of the
- protected traffic.</TD></TR>
-<TR><TD>3.</TD><TD>192.0.48.38</TD><TD>Remote FreeS/WAN node (gateway or
- host). May be the same as (2).</TD></TR>
-<TR><TD>4.</TD><TD>[not shown]</TD><TD>Local FreeS/WAN node (gateway or
- host), where you've produced the output. May be the same as (1).</TD></TR>
-</TABLE>
-<P>For extra assurance, you may wish to use a packet sniffer such as<A HREF="http://www.tcpdump.org">
- tcpdump</A> to verify that packets are being encrypted. You should see
- output that indicates<STRONG> ESP</STRONG> encrypted data, for example:</P>
-<PRE>    02:17:47.353750 PPPoE  [ses 0x1e12] IP 154: xy.example.com &gt; oetest.freeswan.org: ESP(spi=0x87150d16,seq=0x55)</PRE>
-<H2><A name="test.uml">Testing with User Mode Linux</A></H2>
-<P><A href="http://user-mode-linux.sourceforge.net/">User Mode Linux</A>
- allows you to run Linux as a user process on another Linux machine.</P>
-<P>As of 1.92, the distribution has a new directory named testing. It
- contains a collection of test scripts and sample configurations. Using
- these, you can bring up several copies of Linux in user mode and have
- them build tunnels to each other. This lets you do some testing of a
- FreeS/WAN configuration on a single machine.</P>
-<P>You need a moderately well-endowed machine for this to work well.
- Each UML wants about 16 megs of memory by default, which is plenty for
- FreeS/WAN usage. Typical regression testing only occasionally uses as
- many as 4 UMLs. If one is doing nothing else with the machine (in
- particular, not running X on it), then 128 megs and a 500MHz CPU are
- fine.</P>
- Documentation on these scripts is<A href="umltesting.html"> here</A>.
- There is also documentation on automated testing<A href="makecheck.html">
- here</A>.
-<H2><A name="testnet">Configuration for a testbed network</A></H2>
-<P>A common test setup is to put a machine with dual Ethernet cards in
- between two gateways under test. You need at least five machines; two
- gateways, two clients and a testing machine in the middle.</P>
-<P>The central machine both routes packets and provides a place to run
- diagnostic software for checking IPsec packets. See next section for
- discussion of<A href="faq.html#tcpdump.faq"> using tcpdump(8)</A> for
- this.</P>
-<P>This makes things more complicated than if you just connected the two
- gateway machines directly to each other, but it also makes your test
- setup much more like the environment you actually use IPsec in. Those
- environments nearly always involve routing, and quite a few apparent
- IPsec failures turn out to be problems with routing or with firewalls
- dropping packets. This approach lets you deal with those problems on
- your test setup.</P>
-<P>What you end up with looks like:</P>
-<H3><A name="testbed">Testbed network</A></H3>
-<PRE>      subnet a.b.c.0/24
-             |
-      eth1 = a.b.c.1
-         gate1
-      eth0 = 192.168.p.1
-             |
-             |
-      eth0 = 192.168.p.2
-         route/monitor box
-      eth1 = 192.168.q.2
-             |
-             |
-      eth0 = 192.168.q.1
-         gate2
-      eth1 = x.y.z.1
-              |
-       subnet x.y.z.0/24</PRE>
-<PRE>Where p and q are any convenient values that do not interfere with other
-routes you may have. The ipsec.conf(5) file then has, among other things:</PRE>
-<PRE>conn abc-xyz
-      left=192.168.p.1
-      leftnexthop=192.168.p.2
-      right=192.168.q.1
-      rightnexthop=192.168.q.2</PRE>
-<P>Once that works, you can remove the &quot;route/monitor box&quot;, and connect
- the two gateways to the Internet. The only parameters in ipsec.conf(5)
- that need to change are the four shown above. You replace them with
- values appropriate for your Internet connection, and change the eth0 IP
- addresses and the default routes on both gateways.</P>
-<P>Note that nothing on either subnet needs to change. This lets you
- test most of your IPsec setup before connecting to the insecure
- Internet.</P>
-<H3><A name="tcpdump.test">Using packet sniffers in testing</A></H3>
-<P>A number of tools are available for looking at packets. We will
- discuss using<A href="http://www.tcpdump.org/"> tcpdump(8)</A>, a
- common Linux tool included in most distributions. Alternatives
- offerring more-or-less the same functionality include:</P>
-<DL>
-<DT><A href="http://www.ethereal.com">Ethereal</A></DT>
-<DD>Several people on our mailing list report a preference for this over
- tcpdump.</DD>
-<DT><A href="http://netgroup-serv.polito.it/windump/">windump</A></DT>
-<DD>a Windows version of tcpdump(8), possibly handy if you have Windows
- boxes in your network</DD>
-<DT><A href="http://reptile.rug.ac.be/~coder/sniffit/sniffit.html">
-Sniffit</A></DT>
-<DD>A linux sniffer that we don't know much about. If you use it, please
- comment on our mailing list.</DD>
-</DL>
-<P>See also this<A href="http://www.tlsecurity.net/unix/ids/sniffer/">
- index</A> of packet sniffers.</P>
-<P>tcpdump(8) may misbehave if run on the gateways themselves. It is
- designed to look into a normal IP stack and may become confused if you
- ask it to display data from a stack which has IPsec in play.</P>
-<P>At one point, the problem was quite severe. Recent versions of
- tcpdump, however, understand IPsec well enough to be usable on a
- gateway. You can get the latest version from<A href="http://www.tcpdump.org/">
- tcpdump.org</A>.</P>
-<P>Even with a recent tcpdump, some care is required. Here is part of a
- post from Henry on the topic:</P>
-<PRE>&gt; a) data from sunset to sunrise or the other way is not being
-&gt; encrypted (I am using tcpdump (ver. 3.4) -x/ping -p to check
-&gt; packages) 
-
-What *interface* is tcpdump being applied to?  Use the -i option to
-control this.  It matters!  If tcpdump is looking at the ipsecN
-interfaces, e.g. ipsec0, then it is seeing the packets before they are
-encrypted or after they are decrypted, so of course they don't look
-encrypted.  You want to have tcpdump looking at the actual hardware
-interfaces, e.g. eth0. 
-
-Actually, the only way to be *sure* what you are sending on the wire is to
-have a separate machine eavesdropping on the traffic.  Nothing you can do
-on the machines actually running IPsec is 100% guaranteed reliable in this
-area (although tcpdump is a lot better now than it used to be).</PRE>
-<P>The most certain way to examine IPsec packets is to look at them on
- the wire. For security, you need to be certain, so we recommend doing
- that. To do so, you need a<STRONG> separate sniffer machine located
- between the two gateways</STRONG>. This machine can be routing IPsec
- packets, but it must not be an IPsec gateway. Network configuration for
- such testing is discussed<A href="#testnet"> above</A>.</P>
-<P>Here's another mailing list message with advice on using tcpdump(8):</P>
-<PRE>Subject: RE: [Users] Encrypted???
-   Date: Thu, 29 Nov 2001
-   From: &quot;Joe Patterson&quot; &lt;jpatterson@asgardgroup.com&gt;
-
-tcpdump -nl -i $EXT-IF proto 50
-
--nl tells it not to buffer output or resolve names (if you don't do that it
-may confuse you by not outputing anything for a while), -i $EXT-IF (replace
-with your external interface) tells it what interface to listen on, and
-proto 50 is ESP.  Use &quot;proto 51&quot; if for some odd reason you're using AH, and
-&quot;udp port 500&quot; if you want to see the isakmp key exchange/tunnel setup
-packets.
-
-You can also run `tcpdump -nl -i ipsec0` to see what traffic is on that
-virtual interface.  Anything you see there *should* be either encrypted or
-dropped (unless you've turned on some strange options in your ipsec.conf
-file)
-
-Another very handy thing is ethereal (http://www.ethereal.com/) which runs
-on just about anything, has a nice gui interface (or a nice text-based
-interface), and does a great job of protocol  breakdown.  For ESP and AH
-it'll basically just tell you that there's a packet of that protocol, and
-what the spi is, but for isakmp it'll actually show you a lot of the tunnel
-setup information (until it gets to the point in the protocol where isakmp
-is encrypted....)</PRE>
-<H2><A name="verify.crypt">Verifying encryption</A></H2>
-<P>The question of how to verify that messages are actually encrypted
- has been extensively discussed on the mailing list. See this<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/07/msg00262.html">
- thread</A>.</P>
-<P>If you just want to verify that packets are encrypted, look at them
- with a packet sniffer (see<A href="#tcpdump.test"> previous section</A>
-) located between the gateways. The packets should, except for some of
- the header information, be utterly unintelligible.<STRONG> The output
- of good encryption looks<EM> exactly</EM> like random noise</STRONG>.</P>
-<P>A packet sniffer can only tell you that the data you looked at was
- encrypted. If you have stronger requirements -- for example if your
- security policy requires verification that plaintext is not leaked
- during startup or under various anomolous conditions -- then you will
- need to devise much more thorough tests. If you do that, please post
- any results or methodological details which your security policy allows
- you to make public.</P>
-<P>You can put recognizable data into ping packets with something like:</P>
-<PRE>        ping -p feedfacedeadbeef 11.0.1.1</PRE>
-<P>&quot;feedfacedeadbeef&quot; is a legal hexadecimal pattern that is easy to
- pick out of hex dumps.</P>
-<P>For other protocols, you may need to check if you have encrypted data
- or ASCII text. Encrypted data has approximately equal frequencies for
- all 256 possible characters. ASCII text has most characters in the
- printable range 0x20-0x7f, a few control characters less than 0x20, and
- none at all in the range 0x80-0xff. 0x20, space, is a good character to
- look for. In normal English text space occurs about once in seven
- characters, versus about once in 256 for random or encrypted data.</P>
-<P>One thing to watch for: the output of good compression, like that of
- good encryption, looks just like random noise. You cannot tell just by
- looking at a data stream whether it has been compressed, encrypted, or
- both. You need a little care not to mistake compressed data for
- encrypted data in your testing.</P>
-<P>Note also that weak encryption also produces random-looking output.
- You cannot tell whether the encryption is strong by looking at the
- output. To be sure of that, you would need to have both the algorithms
- and the implementation examined by experts.</P>
-<P>For IPsec, you can get partial assurance from interoperability tests.
- See our<A href="interop.html"> interop</A> document. When twenty
- products all claim to implement<A href="glossary.html#3DES"> 3DES</A>,
- and they all talk to each other, you can be fairly sure they have it
- right. Of course, you might wonder whether all the implementers are
- consipring to trick you or, more plausibly, whether some
- implementations might have &quot;back doors&quot; so they can get also it wrong
- when required.. If you're seriously worried about things like that, you
- need to get the code you use audited (good luck if it is not Open
- Source), or perhaps to talk to a psychiatrist about treatments for
- paranoia.</P>
-<H2><A name="mail.test">Mailing list pointers</A></H2>
-<P>Additional information on testing can be found in these<A href="mail.html">
- mailing list</A> messages:</P>
-<UL>
-<LI>a user's detailed<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00571.html">
- setup diary</A> for his testbed network</LI>
-<LI>a FreeS/WAN team member's<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/11/msg00425.html">
- notes</A> from testing at an IPsec interop &quot;bakeoff&quot;</LI>
-</UL>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="performance.html">Previous</A>
-<A HREF="kernel.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/toc.html b/doc/toc.html
deleted file mode 100644
index 047833020..000000000
--- a/doc/toc.html
+++ /dev/null
@@ -1,1019 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<H1 ALIGN="CENTER"><A NAME="CONTENTS">Table of Contents</A></H1>
-<BR>
-<BR><B><A HREF="intro.html#intro">Introduction</A></B>
-<UL>
-<LI><A HREF="intro.html#ipsec.intro">IPsec, Security for the Internet
- Protocol</A></LI>
-<UL>
-<LI><A HREF="intro.html#intro.interop">Interoperating with other IPsec
- implementations</A></LI>
-<LI><A HREF="ipsec.html#advantages">Advantages of IPsec</A></LI>
-<LI><A HREF="intro.html#applications">Applications of IPsec</A></LI>
-<LI><A HREF="intro.html#types">The need to authenticate gateways</A></LI>
-</UL>
-<LI><A HREF="intro.html#project">The FreeS/WAN project</A></LI>
-<UL>
-<LI><A HREF="intro.html#goals">Project goals</A></LI>
-<LI><A HREF="intro.html#staff">Project team</A></LI>
-</UL>
-<LI><A HREF="intro.html#products">Products containing FreeS/WAN</A></LI>
-<UL>
-<LI><A HREF="intro.html#distwith">Full Linux distributions</A></LI>
-<LI><A HREF="intro.html#kernel_dist">Linux kernel distributions</A></LI>
-<LI><A HREF="intro.html#office_dist">Office server distributions</A></LI>
-<LI><A HREF="intro.html#fw_dist">Firewall distributions</A></LI>
-<LI><A HREF="intro.html#turnkey">Firewall and VPN products</A></LI>
-</UL>
-<LI><A HREF="intro.html#docs">Information sources</A></LI>
-<UL>
-<LI><A HREF="intro.html#docformats">This HowTo, in multiple formats</A></LI>
-<LI><A HREF="intro.html#rtfm">RTFM (please Read The Fine Manuals)</A></LI>
-<LI><A HREF="intro.html#text">Other documents in the distribution</A></LI>
-<LI><A HREF="intro.html#assumptions">Background material</A></LI>
-<LI><A HREF="intro.html#archives">Archives of the project mailing list</A>
-</LI>
-<LI><A HREF="intro.html#howto">User-written HowTo information</A></LI>
-<LI><A HREF="intro.html#applied">Papers on FreeS/WAN</A></LI>
-<LI><A HREF="intro.html#licensing">License and copyright information</A></LI>
-</UL>
-<LI><A HREF="intro.html#sites">Distribution sites</A></LI>
-<UL>
-<LI><A HREF="intro.html#1_5_1">Primary site</A></LI>
-<LI><A HREF="intro.html#mirrors">Mirrors</A></LI>
-<LI><A HREF="intro.html#munitions">The &quot;munitions&quot; archive of Linux
- crypto software</A></LI>
-</UL>
-<LI><A HREF="intro.html#1_6">Links to other sections</A></LI>
-</UL>
-<B><A HREF="upgrading.html#2">Upgrading to FreeS/WAN 2.x</A></B>
-<UL>
-<LI><A HREF="upgrading.html#2_1">New! Built in Opportunistic connections</A>
-</LI>
-<UL>
-<LI><A HREF="upgrading.html#2_1_1">Upgrading Opportunistic Encryption to
- 2.01 (or later)</A></LI>
-</UL>
-<LI><A HREF="upgrading.html#2_2">New! Policy Groups</A></LI>
-<LI><A HREF="upgrading.html#2_3">New! Packetdefault Connection</A></LI>
-<LI><A HREF="upgrading.html#2_4">FreeS/WAN now disables Reverse Path
- Filtering</A></LI>
-<LI><A HREF="upgrading.html#2_5">Revised ipsec.conf</A></LI>
-<UL>
-<LI><A HREF="upgrading.html#2_5_1">No promise of compatibility</A></LI>
-<LI><A HREF="upgrading.html#2_5_2">Most ipsec.conf files will work fine</A>
-</LI>
-<LI><A HREF="upgrading.html#2_5_3">Backward compatibility patch</A></LI>
-<LI><A HREF="upgrading.html#2_5_4">Details</A></LI>
-<LI><A HREF="upgrading.html#2_5_5">Upgrading from 1.x RPMs to 2.x RPMs</A>
-</LI>
-</UL>
-</UL>
-<B><A HREF="quickstart.html#quickstart">Quickstart Guide to
- Opportunistic Encryption</A></B>
-<UL>
-<LI><A HREF="quickstart.html#opp.setup">Purpose</A></LI>
-<UL>
-<LI><A HREF="quickstart.html#3_1_1">OE &quot;flag day&quot;</A></LI>
-</UL>
-<LI><A HREF="quickstart.html#opp.dns">Requirements</A></LI>
-<LI><A HREF="quickstart.html#easy.install">RPM install</A></LI>
-<UL>
-<LI><A HREF="quickstart.html#3_3_1">Download RPMs</A></LI>
-<LI><A HREF="quickstart.html#3_3_2">Check signatures</A></LI>
-<LI><A HREF="quickstart.html#3_3_3">Install the RPMs</A></LI>
-<LI><A HREF="quickstart.html#testinstall">Test</A></LI>
-</UL>
-<LI><A HREF="quickstart.html#opp.setups.list">Our Opportunistic Setups</A>
-</LI>
-<UL>
-<LI><A HREF="quickstart.html#3_4_1">Full or partial opportunism?</A></LI>
-</UL>
-<LI><A HREF="quickstart.html#opp.client">Initiate-only setup</A></LI>
-<UL>
-<LI><A HREF="quickstart.html#3_5_1">Restrictions</A></LI>
-<LI><A HREF="quickstart.html#forward.dns">Create and publish a forward
- DNS record</A></LI>
-<LI><A HREF="quickstart.html#3_5_3">Test that your key has been
- published</A></LI>
-<LI><A HREF="quickstart.html#3_5_4">Configure, if necessary</A></LI>
-<LI><A HREF="quickstart.html#3_5_5">Test</A></LI>
-</UL>
-<LI><A HREF="quickstart.html#3_6">Full Opportunism</A></LI>
-<UL>
-<LI><A HREF="quickstart.html#3_6_1">Put a TXT record in a Forward Domain</A>
-</LI>
-<LI><A HREF="quickstart.html#3_6_2">Put a TXT record in Reverse DNS</A></LI>
-<LI><A HREF="quickstart.html#3_6_3">Test your DNS record</A></LI>
-<LI><A HREF="quickstart.html#3_6_4">No Configuration Needed</A></LI>
-<LI><A HREF="quickstart.html#3_6_5">Consider Firewalling</A></LI>
-<LI><A HREF="quickstart.html#3_6_6">Test</A></LI>
-<LI><A HREF="quickstart.html#3_6_7">Test</A></LI>
-</UL>
-<LI><A HREF="quickstart.html#opp.test">Testing opportunistic connections</A>
-</LI>
-<LI><A HREF="quickstart.html#3_8">Now what?</A></LI>
-<LI><A HREF="quickstart.html#3_9">Notes</A></LI>
-<LI><A HREF="quickstart.html#3_10">Troubleshooting OE</A></LI>
-<LI><A HREF="quickstart.html#3_11">Known Issues</A></LI>
-</UL>
-<B><A HREF="policygroups.html#4">How to Configure Linux FreeS/WAN with
- Policy Groups</A></B>
-<UL>
-<LI><A HREF="policygroups.html#4_1">What are Policy Groups?</A></LI>
-<UL>
-<LI><A HREF="policygroups.html#4_1_1">Built-In Security Options</A></LI>
-</UL>
-<LI><A HREF="policygroups.html#4_2">Using Policy Groups</A></LI>
-<UL>
-<LI><A HREF="policygroups.html#4_2_1">Example 1: Using a Base Policy
- Group</A></LI>
-<LI><A HREF="policygroups.html#4_2_2">Example 2: Defining IPsec Security
- Policy with Groups</A></LI>
-<LI><A HREF="policygroups.html#4_2_3">Example 3: Creating a Simple IPsec
- VPN with the private Group</A></LI>
-<LI><A HREF="policygroups.html#4_2_4">Example 4: New Policy Groups to
- Protect a Subnet</A></LI>
-<LI><A HREF="policygroups.html#4_2_5">Example 5: Adding a Subnet to the
- VPN</A></LI>
-</UL>
-<LI><A HREF="policygroups.html#4_3">Appendix</A></LI>
-<UL>
-<LI><A HREF="policygroups.html#4_3_1">Our Hidden Connections</A></LI>
-<LI><A HREF="policygroups.html#4_3_2">Custom Policy Groups</A></LI>
-<LI><A HREF="policygroups.html#4_3_3">Disabling Opportunistic Encryption</A>
-</LI>
-</UL>
-</UL>
-<B><A HREF="faq.html#5">FreeS/WAN FAQ</A></B>
-<UL>
-<LI><A HREF="faq.html#questions">Index of FAQ questions</A></LI>
-<LI><A HREF="faq.html#whatzit">What is FreeS/WAN?</A></LI>
-<LI><A HREF="faq.html#problems">How do I report a problem or seek help?</A>
-</LI>
-<LI><A HREF="faq.html#generic">Can I get ...</A></LI>
-<UL>
-<LI><A HREF="faq.html#lemme_out">Can I get an off-the-shelf system that
- includes FreeS/WAN?</A></LI>
-<LI><A HREF="faq.html#consultant">Can I hire consultants or staff who
- know FreeS/WAN?</A></LI>
-<LI><A HREF="faq.html#commercial">Can I get commercial support?</A></LI>
-</UL>
-<LI><A HREF="faq.html#release">Release questions</A></LI>
-<UL>
-<LI><A HREF="faq.html#rel.current">What is the current release?</A></LI>
-<LI><A HREF="faq.html#relwhen">When is the next release?</A></LI>
-<LI><A HREF="faq.html#rel.bugs">Are there known bugs in the current
- release?</A></LI>
-</UL>
-<LI><A HREF="faq.html#mod_cons">Modifications and contributions</A></LI>
-<UL>
-<LI><A HREF="faq.html#modify.faq">Can I modify FreeS/WAN to ...?</A></LI>
-<LI><A HREF="faq.html#contrib.faq">Can I contribute to the project?</A></LI>
-<LI><A HREF="faq.html#ddoc.faq">Is there detailed design documentation?</A>
-</LI>
-</UL>
-<LI><A HREF="faq.html#interact">Will FreeS/WAN work in my environment?</A>
-</LI>
-<UL>
-<LI><A HREF="faq.html#interop.faq">Can FreeS/WAN talk to ...?</A></LI>
-<LI><A HREF="faq.html#old_to_new">Can different FreeS/WAN versions talk
- to each other?</A></LI>
-<LI><A HREF="faq.html#faq.bandwidth">Is there a limit on throughput?</A></LI>
-<LI><A HREF="faq.html#faq.number">Is there a limit on number of tunnels?</A>
-</LI>
-<LI><A HREF="faq.html#faq.speed">Is a ... fast enough to handle
- FreeS/WAN with my loads?</A></LI>
-</UL>
-<LI><A HREF="faq.html#work_on">Will FreeS/WAN work on ... ?</A></LI>
-<UL>
-<LI><A HREF="faq.html#versions">Will FreeS/WAN run on my version of
- Linux?</A></LI>
-<LI><A HREF="faq.html#nonIntel.faq">Will FreeS/WAN run on non-Intel
- CPUs?</A></LI>
-<LI><A HREF="faq.html#multi.faq">Will FreeS/WAN run on multiprocessors?</A>
-</LI>
-<LI><A HREF="faq.html#k.old">Will FreeS/WAN work on an older kernel?</A></LI>
-<LI><A HREF="faq.html#k.versions">Will FreeS/WAN run on the latest
- kernel version?</A></LI>
-<LI><A HREF="faq.html#interface.faq">Will FreeS/WAN work on unusual
- network hardware?</A></LI>
-<LI><A HREF="faq.html#vlan">Will FreeS/WAN work on a VLAN (802.1q)
- network?</A></LI>
-</UL>
-<LI><A HREF="faq.html#features.faq">Does FreeS/WAN support ...</A></LI>
-<UL>
-<LI><A HREF="faq.html#VPN.faq">Does FreeS/WAN support site-to-site VPN (
-Virtual Private Network) applications?</A></LI>
-<LI><A HREF="faq.html#warrior.faq">Does FreeS/WAN support remote users
- connecting to a LAN?</A></LI>
-<LI><A HREF="faq.html#road.shared.possible">Does FreeS/WAN support
- remote users using shared secret authentication?</A></LI>
-<LI><A HREF="faq.html#wireless.faq">Does FreeS/WAN support wireless
- networks?</A></LI>
-<LI><A HREF="faq.html#PKIcert">Does FreeS/WAN support X.509 or other PKI
- certificates?</A></LI>
-<LI><A HREF="faq.html#Radius">Does FreeS/WAN support user authentication
- (Radius, SecureID, Smart Card...)?</A></LI>
-<LI><A HREF="faq.html#NATtraversal">Does FreeS/WAN support NAT
- traversal?</A></LI>
-<LI><A HREF="faq.html#virtID">Does FreeS/WAN support assigning a
- &quot;virtual identity&quot; to a remote system?</A></LI>
-<LI><A HREF="faq.html#noDES.faq">Does FreeS/WAN support single DES
- encryption?</A></LI>
-<LI><A HREF="faq.html#AES.faq">Does FreeS/WAN support AES encryption?</A>
-</LI>
-<LI><A HREF="faq.html#other.cipher">Does FreeS/WAN support other
- encryption algorithms?</A></LI>
-</UL>
-<LI><A HREF="faq.html#canI">Can I ...</A></LI>
-<UL>
-<LI><A HREF="faq.html#policy.preconfig">Can I use policy groups along
- with explicitly configured connections?</A></LI>
-<LI><A HREF="faq.html#policy.off">Can I turn off policy groups?</A></LI>
-<LI><A HREF="faq.html#reload">Can I reload connection info without
- restarting?</A></LI>
-<LI><A HREF="faq.html#masq.faq">Can I use several masqueraded subnets?</A>
-</LI>
-<LI><A HREF="faq.html#dup_route">Can I use subnets masqueraded to the
- same addresses?</A></LI>
-<LI><A HREF="faq.html#road.masq">Can I assign a road warrior an address
- on my net (a virtual identity)?</A></LI>
-<LI><A HREF="faq.html#road.many">Can I support many road warriors with
- one gateway?</A></LI>
-<LI><A HREF="faq.html#road.PSK">Can I have many road warriors using
- shared secret authentication?</A></LI>
-<LI><A HREF="faq.html#QoS">Can I use Quality of Service routing with
- FreeS/WAN?</A></LI>
-<LI><A HREF="faq.html#deadtunnel">Can I recognise dead tunnels and shut
- them down?</A></LI>
-<LI><A HREF="faq.html#demanddial">Can I build IPsec tunnels over a
- demand-dialed link?</A></LI>
-<LI><A HREF="faq.html#GRE">Can I build GRE, L2TP or PPTP tunnels over
- IPsec?</A></LI>
-<LI><A HREF="faq.html#NetBIOS">... use Network Neighborhood (Samba,
- NetBIOS) over IPsec?</A></LI>
-</UL>
-<LI><A HREF="faq.html#setup.faq">Life's little mysteries</A></LI>
-<UL>
-<LI><A HREF="faq.html#cantping">I cannot ping ....</A></LI>
-<LI><A HREF="faq.html#forever">It takes forever to ...</A></LI>
-<LI><A HREF="faq.html#route">I send packets to the tunnel with route(8)
- but they vanish</A></LI>
-<LI><A HREF="faq.html#down_route">When a tunnel goes down, packets
- vanish</A></LI>
-<LI><A HREF="faq.html#firewall_ate">The firewall ate my packets!</A></LI>
-<LI><A HREF="faq.html#dropconn">Dropped connections</A></LI>
-<LI><A HREF="faq.html#defaultroutegone">Disappearing %defaultroute</A></LI>
-<LI><A HREF="faq.html#tcpdump.faq">TCPdump on the gateway shows strange
- things</A></LI>
-<LI><A HREF="faq.html#no_trace">Traceroute does not show anything
- between the gateways</A></LI>
-</UL>
-<LI><A HREF="faq.html#man4debug">Testing in stages</A></LI>
-<UL>
-<LI><A HREF="faq.html#nomanual">Manually keyed connections don't work</A>
-</LI>
-<LI><A HREF="faq.html#spi_error">One manual connection works, but second
- one fails</A></LI>
-<LI><A HREF="faq.html#man_no_auto">Manual connections work, but
- automatic keying doesn't</A></LI>
-<LI><A HREF="faq.html#nocomp">IPsec works, but connections using
- compression fail</A></LI>
-<LI><A HREF="faq.html#pmtu.broken">Small packets work, but large
- transfers fail</A></LI>
-<LI><A HREF="faq.html#subsub">Subnet-to-subnet works, but tests from the
- gateways don't</A></LI>
-</UL>
-<LI><A HREF="faq.html#compile.faq">Compilation problems</A></LI>
-<UL>
-<LI><A HREF="faq.html#gmp.h_missing">gmp.h: No such file or directory</A>
-</LI>
-<LI><A HREF="faq.html#noVM">... virtual memory exhausted</A></LI>
-</UL>
-<LI><A HREF="faq.html#error">Interpreting error messages</A></LI>
-<UL>
-<LI><A HREF="faq.html#route-client">route-client (or host) exited with
- status 7</A></LI>
-<LI><A HREF="faq.html#unreachable">SIOCADDRT:Network is unreachable</A></LI>
-<LI><A HREF="faq.html#modprobe">ipsec_setup: modprobe: Can't locate
- module ipsec</A></LI>
-<LI><A HREF="faq.html#noKLIPS">ipsec_setup: Fatal error, kernel appears
- to lack KLIPS</A></LI>
-<LI><A HREF="faq.html#noDNS">ipsec_setup: ... failure to fetch key for
- ... from DNS</A></LI>
-<LI><A HREF="faq.html#dup_address">ipsec_setup: ... interfaces ... and
- ... share address ...</A></LI>
-<LI><A HREF="faq.html#kflags">ipsec_setup: Cannot adjust kernel flags</A>
-</LI>
-<LI><A HREF="faq.html#message_num">Message numbers (MI3, QR1, et cetera)
- in Pluto messages</A></LI>
-<LI><A HREF="faq.html#conn_name">Connection names in Pluto error
- messages</A></LI>
-<LI><A HREF="faq.html#cantorient">Pluto: ... can't orient connection</A></LI>
-<LI><A HREF="faq.html#no.interface">... we have no ipsecN interface for
- either end of this connection</A></LI>
-<LI><A HREF="faq.html#noconn">Pluto: ... no connection is known</A></LI>
-<LI><A HREF="faq.html#nosuit">Pluto: ... no suitable connection ...</A></LI>
-<LI><A HREF="faq.html#noconn.auth">Pluto: ... no connection has been
- authorized</A></LI>
-<LI><A HREF="faq.html#noDESsupport">Pluto: ... OAKLEY_DES_CBC is not
- supported.</A></LI>
-<LI><A HREF="faq.html#notransform">Pluto: ... no acceptable transform</A>
-</LI>
-<LI><A HREF="faq.html#rsasigkey">rsasigkey dumps core</A></LI>
-<LI><A HREF="faq.html#sig4">!Pluto failure!: ... exited with ... signal
- 4</A></LI>
-<LI><A HREF="faq.html#econnrefused">ECONNREFUSED error message</A></LI>
-<LI><A HREF="faq.html#no_eroute">klips_debug: ... no eroute!</A></LI>
-<LI><A HREF="faq.html#SAused">... trouble writing to /dev/ipsec ... SA
- already in use</A></LI>
-<LI><A HREF="faq.html#ignore">... ignoring ... payload</A></LI>
-<LI><A HREF="faq.html#unknown_rightcert">unknown parameter name
- &quot;rightcert&quot;</A></LI>
-</UL>
-<LI><A HREF="faq.html#spam">Why don't you restrict the mailing lists to
- reduce spam?</A></LI>
-</UL>
-<B><A HREF="manpages.html#manpages">FreeS/WAN manual pages</A></B>
-<UL>
-<LI><A HREF="manpages.html#man.file">Files</A></LI>
-<LI><A HREF="manpages.html#man.command">Commands</A></LI>
-<LI><A HREF="manpages.html#man.lib">Library routines</A></LI>
-</UL>
-<B><A HREF="firewall.html#firewall">FreeS/WAN and firewalls</A></B>
-<UL>
-<LI><A HREF="firewall.html#filters">Filtering rules for IPsec packets</A>
-</LI>
-<LI><A HREF="firewall.html#examplefw">Firewall configuration at boot</A></LI>
-<UL>
-<LI><A HREF="firewall.html#simple.rules">A simple set of rules</A></LI>
-<LI><A HREF="firewall.html#complex.rules">Other rules</A></LI>
-<LI><A HREF="firewall.html#rules.pub">Published rule sets</A></LI>
-</UL>
-<LI><A HREF="firewall.html#updown">Calling firewall scripts, named in
- ipsec.conf(5)</A></LI>
-<UL>
-<LI><A HREF="firewall.html#pre_post">Scripts called at IPsec start and
- stop</A></LI>
-<LI><A HREF="firewall.html#up_down">Scripts called at connection up and
- down</A></LI>
-<LI><A HREF="firewall.html#ipchains.script">Scripts for ipchains or
- iptables</A></LI>
-</UL>
-<LI><A HREF="firewall.html#NAT">A complication: IPsec vs. NAT</A></LI>
-<UL>
-<LI><A HREF="firewall.html#nat_ok">NAT on or behind the IPsec gateway
- works</A></LI>
-<LI><A HREF="firewall.html#nat_bad">NAT between gateways is problematic</A>
-</LI>
-<LI><A HREF="firewall.html#NAT.ref">Other references on NAT and IPsec</A>
-</LI>
-</UL>
-<LI><A HREF="firewall.html#complications">Other complications</A></LI>
-<UL>
-<LI><A HREF="firewall.html#through">IPsec through the gateway</A></LI>
-<LI><A HREF="firewall.html#ipsec_only">Preventing non-IPsec traffic</A></LI>
-<LI><A HREF="firewall.html#unknowngate">Filtering packets from unknown
- gateways</A></LI>
-</UL>
-<LI><A HREF="firewall.html#otherfilter">Other packet filters</A></LI>
-<UL>
-<LI><A HREF="firewall.html#ICMP">ICMP filtering</A></LI>
-<LI><A HREF="firewall.html#traceroute">UDP packets for traceroute</A></LI>
-<LI><A HREF="firewall.html#l2tp">UDP for L2TP</A></LI>
-</UL>
-<LI><A HREF="firewall.html#packets">How it all works: IPsec packet
- details</A></LI>
-<UL>
-<LI><A HREF="firewall.html#noport">ESP and AH do not have ports</A></LI>
-<LI><A HREF="firewall.html#header">Header layout</A></LI>
-<LI><A HREF="firewall.html#dhr">DHR on the updown script</A></LI>
-</UL>
-</UL>
-<B><A HREF="trouble.html#trouble">Linux FreeS/WAN Troubleshooting Guide</A>
-</B>
-<UL>
-<LI><A HREF="trouble.html#overview">Overview</A></LI>
-<LI><A HREF="trouble.html#install">1. During Install</A></LI>
-<UL>
-<LI><A HREF="trouble.html#8_2_1">1.1 RPM install gotchas</A></LI>
-<LI><A HREF="trouble.html#8_2_2">1.2 Problems installing from source</A></LI>
-<LI><A HREF="trouble.html#install.check">1.3 Install checks</A></LI>
-<LI><A HREF="quickstart.html#oe.trouble">1.3 Troubleshooting OE</A></LI>
-</UL>
-<LI><A HREF="trouble.html#negotiation">2. During Negotiation</A></LI>
-<UL>
-<LI><A HREF="trouble.html#state">2.1 Determine Connection State</A></LI>
-<LI><A HREF="trouble.html#find.pluto.error">2.2 Finding error text</A></LI>
-<LI><A HREF="trouble.html#interpret.pluto.error">2.3 Interpreting a
- Negotiation Error</A></LI>
-</UL>
-<LI><A HREF="trouble.html#use">3. Using a Connection</A></LI>
-<UL>
-<LI><A HREF="trouble.html#8_4_1">3.1 Orienting yourself</A></LI>
-<LI><A HREF="trouble.html#8_4_2">3.2 Those pesky configuration errors</A>
-</LI>
-<LI><A HREF="trouble.html#route.firewall">3.3 Check Routing and
- Firewalling</A></LI>
-<LI><A HREF="trouble.html#sniff">3.4 When in doubt, sniff it out</A></LI>
-<LI><A HREF="trouble.html#find.use.error">3.5 Check your logs</A></LI>
-<LI><A HREF="trouble.html#bigpacket">3.6 More testing for the truly
- thorough</A></LI>
-</UL>
-<LI><A HREF="trouble.html#prob.report">4. Problem Reporting</A></LI>
-<UL>
-<LI><A HREF="trouble.html#8_5_1">4.1 How to ask for help</A></LI>
-<LI><A HREF="trouble.html#8_5_2">4.2 Where to ask</A></LI>
-</UL>
-<LI><A HREF="trouble.html#notes">5. Additional Notes on Troubleshooting</A>
-</LI>
-<UL>
-<LI><A HREF="trouble.html#system.info">5.1 Information available on your
- system</A></LI>
-<LI><A HREF="trouble.html#testgates"> 5.2 Testing between security
- gateways</A></LI>
-<LI><A HREF="trouble.html#ifconfig1">5.3 ifconfig reports for KLIPS
- debugging</A></LI>
-<LI><A HREF="trouble.html#gdb"> 5.4 Using GDB on Pluto</A></LI>
-</UL>
-</UL>
-<B><A HREF="compat.html#compat">Linux FreeS/WAN Compatibility Guide</A></B>
-<UL>
-<LI><A HREF="compat.html#spec">Implemented parts of the IPsec
- Specification</A></LI>
-<UL>
-<LI><A HREF="compat.html#in">In Linux FreeS/WAN</A></LI>
-<LI><A HREF="compat.html#dropped">Deliberately omitted</A></LI>
-<LI><A HREF="compat.html#not">Not (yet) in Linux FreeS/WAN</A></LI>
-</UL>
-<LI><A HREF="compat.html#pfkey">Our PF-Key implementation</A></LI>
-<UL>
-<LI><A HREF="compat.html#pfk.port">PF-Key portability</A></LI>
-</UL>
-<LI><A HREF="compat.html#otherk">Kernels other than the latest 2.2.x and
- 2.4.y</A></LI>
-<UL>
-<LI><A HREF="compat.html#kernel.2.0">2.0.x kernels</A></LI>
-<LI><A HREF="compat.html#kernel.production">2.2 and 2.4 kernels</A></LI>
-</UL>
-<LI><A HREF="compat.html#otherdist">Intel Linux distributions other than
- Redhat</A></LI>
-<UL>
-<LI><A HREF="compat.html#rh7">Redhat 7.0</A></LI>
-<LI><A HREF="compat.html#suse">SuSE Linux</A></LI>
-<LI><A HREF="compat.html#slack">Slackware</A></LI>
-<LI><A HREF="compat.html#deb">Debian</A></LI>
-<LI><A HREF="compat.html#caldera">Caldera</A></LI>
-</UL>
-<LI><A HREF="compat.html#CPUs">CPUs other than Intel</A></LI>
-<UL>
-<LI><A HREF="compat.html# strongarm">Corel Netwinder (StrongARM CPU)</A></LI>
-<LI><A HREF="compat.html#yellowdog">Yellow Dog Linux on Power PC</A></LI>
-<LI><A HREF="compat.html#mklinux">Mklinux</A></LI>
-<LI><A HREF="compat.html#alpha">Alpha 64-bit processors</A></LI>
-<LI><A HREF="compat.html#SPARC">Sun SPARC processors</A></LI>
-<LI><A HREF="compat.html#mips">MIPS processors</A></LI>
-<LI><A HREF="compat.html#crusoe">Transmeta Crusoe</A></LI>
-<LI><A HREF="compat.html#coldfire">Motorola Coldfire</A></LI>
-</UL>
-<LI><A HREF="compat.html#multiprocessor">Multiprocessor machines</A></LI>
-<LI><A HREF="compat.html#hardware">Support for crypto hardware</A></LI>
-<LI><A HREF="compat.html#ipv6">IP version 6 (IPng)</A></LI>
-<UL>
-<LI><A HREF="compat.html#v6.back">IPv6 background</A></LI>
-</UL>
-</UL>
-<B><A HREF="interop.html#10">Interoperating with FreeS/WAN</A></B>
-<UL>
-<LI><A HREF="interop.html#10_1">Interop at a Glance</A></LI>
-<UL>
-<LI><A HREF="interop.html#10_1_1">Key</A></LI>
-</UL>
-<LI><A HREF="interop.html#10_2">Basic Interop Rules</A></LI>
-<LI><A HREF="interop.html#10_3">Longer Stories</A></LI>
-<UL>
-<LI><A HREF="interop.html#10_3_1">For More Compatible Implementations</A>
-</LI>
-<LI><A HREF="interop.html#10_3_2">For Other Implementations</A></LI>
-</UL>
-</UL>
-<B><A HREF="performance.html#performance">Performance of FreeS/WAN</A></B>
-<UL>
-<LI><A HREF="performance.html#pub.bench">Published material</A></LI>
-<LI><A HREF="performance.html#perf.estimate">Estimating CPU overheads</A>
-</LI>
-<UL>
-<LI><A HREF="performance.html#perf.more">Higher performance alternatives</A>
-</LI>
-<LI><A HREF="performance.html#11_2_2">Other considerations</A></LI>
-</UL>
-<LI><A HREF="performance.html#biggate">Many tunnels from a single
- gateway</A></LI>
-<LI><A HREF="performance.html#low-end">Low-end systems</A></LI>
-<LI><A HREF="performance.html#klips.bench">Measuring KLIPS</A></LI>
-<LI><A HREF="performance.html#speed.compress">Speed with compression</A></LI>
-<LI><A HREF="performance.html#methods">Methods of measuring</A></LI>
-</UL>
-<B><A HREF="testing.html#test.freeswan">Testing FreeS/WAN</A></B>
-<UL>
-<LI><A HREF="testing.html#test.oe">Testing opportunistic connections</A></LI>
-<UL>
-<LI><A HREF="testing.html#12_1_1">Basic OE Test</A></LI>
-<LI><A HREF="testing.html#12_1_2">OE Gateway Test</A></LI>
-<LI><A HREF="testing.html#12_1_3">Additional OE tests</A></LI>
-</UL>
-<LI><A HREF="testing.html#test.uml">Testing with User Mode Linux</A></LI>
-<LI><A HREF="testing.html#testnet">Configuration for a testbed network</A>
-</LI>
-<UL>
-<LI><A HREF="testing.html#testbed">Testbed network</A></LI>
-<LI><A HREF="testing.html#tcpdump.test">Using packet sniffers in testing</A>
-</LI>
-</UL>
-<LI><A HREF="testing.html#verify.crypt">Verifying encryption</A></LI>
-<LI><A HREF="testing.html#mail.test">Mailing list pointers</A></LI>
-</UL>
-<B><A HREF="kernel.html#kernelconfig">Kernel configuration for FreeS/WAN</A>
-</B>
-<UL>
-<LI><A HREF="kernel.html#notall">Not everyone needs to worry about
- kernel configuration</A></LI>
-<LI><A HREF="kernel.html#assume">Assumptions and notation</A></LI>
-<UL>
-<LI><A HREF="kernel.html#labels">Labels used</A></LI>
-</UL>
-<LI><A HREF="kernel.html#kernelopt">Kernel options for FreeS/WAN</A></LI>
-</UL>
-<B><A HREF="adv_config.html#adv_config">Other configuration
- possibilities</A></B>
-<UL>
-<LI><A HREF="adv_config.html#thumb">Some rules of thumb about
- configuration</A></LI>
-<UL>
-<LI><A HREF="adv_config.html#cheap.tunnel">Tunnels are cheap</A></LI>
-<LI><A HREF="adv_config.html#subnet.size">Subnet sizes</A></LI>
-<LI><A HREF="adv_config.html#example.more">Other network layouts</A></LI>
-</UL>
-<LI><A HREF="adv_config.html#choose">Choosing connection types</A></LI>
-<UL>
-<LI><A HREF="adv_config.html#man-auto">Manual vs. automatic keying</A></LI>
-<LI><A HREF="adv_config.html#auto-auth">Authentication methods for
- auto-keying</A></LI>
-<LI><A HREF="adv_config.html#adv-pk">Advantages of public key methods</A>
-</LI>
-</UL>
-<LI><A HREF="adv_config.html#prodsecrets">Using shared secrets in
- production</A></LI>
-<UL>
-<LI><A HREF="biblio.html#secrets">Putting secrets in ipsec.secrets(5)</A>
-</LI>
-<LI><A HREF="adv_config.html#securing.secrets">File security</A></LI>
-<LI><A HREF="adv_config.html#notroadshared">Shared secrets for road
- warriors</A></LI>
-</UL>
-<LI><A HREF="adv_config.html#prodman">Using manual keying in production</A>
-</LI>
-<UL>
-<LI><A HREF="adv_config.html#ranbits">Creating keys with ranbits</A></LI>
-</UL>
-<LI><A HREF="adv_config.html#boot">Setting up connections at boot time</A>
-</LI>
-<LI><A HREF="adv_config.html#multitunnel">Multiple tunnels between the
- same two gateways</A></LI>
-<UL>
-<LI><A HREF="adv_config.html#advroute">One tunnel plus advanced routing</A>
-</LI>
-</UL>
-<LI><A HREF="adv_config.html#opp.gate">An Opportunistic Gateway</A></LI>
-<UL>
-<LI><A HREF="adv_config.html#14_7_1">Start from full opportunism</A></LI>
-<LI><A HREF="adv_config.html#14_7_2">Reverse DNS TXT records for each
- protected machine</A></LI>
-<LI><A HREF="adv_config.html#14_7_3">Publish your records</A></LI>
-<LI><A HREF="adv_config.html#14_7_4">...and test them</A></LI>
-<LI><A HREF="adv_config.html#14_7_5">No Configuration Needed</A></LI>
-</UL>
-<LI><A HREF="adv_config.html#extruded.config">Extruded Subnets</A></LI>
-<LI><A HREF="adv_config.html#roadvirt">Road Warrior with virtual IP
- address</A></LI>
-<LI><A HREF="glossary.html#dynamic">Dynamic Network Interfaces</A></LI>
-<UL>
-<LI><A HREF="adv_config.html#basicdyn">Basics</A></LI>
-<LI><A HREF="adv_config.html#bootdyn">Boot Time</A></LI>
-<LI><A HREF="adv_config.html#changedyn">Change Time</A></LI>
-</UL>
-<LI><A HREF="adv_config.html#unencrypted">Unencrypted tunnels</A></LI>
-</UL>
-<B><A HREF="trouble.html#install">Installing FreeS/WAN</A></B>
-<UL>
-<LI><A HREF="install.html#15_1">Requirements</A></LI>
-<LI><A HREF="install.html#15_2">Choose your install method</A></LI>
-<LI><A HREF="install.html#15_3">FreeS/WAN ships with some Linuxes</A></LI>
-<UL>
-<LI><A HREF="install.html#15_3_1">FreeS/WAN may be altered...</A></LI>
-<LI><A HREF="install.html#15_3_2">You might need to create an
- authentication keypair</A></LI>
-<LI><A HREF="install.html#15_3_3">Start and test FreeS/WAN</A></LI>
-</UL>
-<LI><A HREF="install.html#15_4">RPM install</A></LI>
-<UL>
-<LI><A HREF="install.html#15_4_1">Download RPMs</A></LI>
-<LI><A HREF="install.html#15_4_2">For freeswan.org RPMs: check
- signatures</A></LI>
-<LI><A HREF="install.html#15_4_3">Install the RPMs</A></LI>
-<LI><A HREF="install.html#15_4_4">Start and Test FreeS/WAN</A></LI>
-</UL>
-<LI><A HREF="install.html#15_5">Install from Source</A></LI>
-<UL>
-<LI><A HREF="install.html#15_5_1">Decide what functionality you need</A></LI>
-<LI><A HREF="install.html#15_5_2">Download FreeS/WAN</A></LI>
-<LI><A HREF="install.html#15_5_3">For freeswan.org source: check its
- signature</A></LI>
-<LI><A HREF="install.html#15_5_4">Untar, unzip</A></LI>
-<LI><A HREF="install.html#15_5_5">Patch if desired</A></LI>
-<LI><A HREF="install.html#15_5_6">... and Make</A></LI>
-</UL>
-<LI><A HREF="install.html#15_6">Start FreeS/WAN and test your install</A>
-</LI>
-<LI><A HREF="install.html#15_7">Test your install</A></LI>
-<LI><A HREF="install.html#15_8">Making FreeS/WAN play well with others</A>
-</LI>
-<LI><A HREF="install.html#15_9">Configure for your needs</A></LI>
-</UL>
-<B><A HREF="config.html#config">How to configure FreeS/WAN</A></B>
-<UL>
-<LI><A HREF="config.html#16_1">Requirements</A></LI>
-<LI><A HREF="config.html#config.netnet">Net-to-Net connection</A></LI>
-<UL>
-<LI><A HREF="config.html#netnet.info.ex">Gather information</A></LI>
-<LI><A HREF="config.html#16_2_2">Edit /etc/ipsec.conf</A></LI>
-<LI><A HREF="config.html#16_2_3">Start your connection</A></LI>
-<LI><A HREF="config.html#16_2_4">Do not MASQ or NAT packets to be
- tunneled</A></LI>
-<LI><A HREF="config.html#16_2_5">Test your connection</A></LI>
-<LI><A HREF="config.html#16_2_6">Finishing touches</A></LI>
-</UL>
-<LI><A HREF="config.html#config.rw">Road Warrior Configuration</A></LI>
-<UL>
-<LI><A HREF="config.html#rw.info.ex">Gather information</A></LI>
-<LI><A HREF="config.html#16_3_2">Customize /etc/ipsec.conf</A></LI>
-<LI><A HREF="config.html#16_3_3">Start your connection</A></LI>
-<LI><A HREF="config.html#16_3_4">Do not MASQ or NAT packets to be
- tunneled</A></LI>
-<LI><A HREF="config.html#16_3_5">Test your connection</A></LI>
-<LI><A HREF="config.html#16_3_6">Finishing touches</A></LI>
-<LI><A HREF="config.html#16_3_7">Multiple Road Warriors</A></LI>
-</UL>
-<LI><A HREF="config.html#16_4">What next?</A></LI>
-</UL>
-<B><A HREF="background.html#background">Linux FreeS/WAN background</A></B>
-<UL>
-<LI><A HREF="background.html#dns.background">Some DNS background</A></LI>
-<UL>
-<LI><A HREF="background.html#forward.reverse">Forward and reverse maps</A>
-</LI>
-<LI><A HREF="background.html#17_1_2">Hierarchy and delegation</A></LI>
-<LI><A HREF="background.html#17_1_3">Syntax of DNS records</A></LI>
-<LI><A HREF="background.html#17_1_4">Cacheing, TTL and propagation delay</A>
-</LI>
-</UL>
-<LI><A HREF="background.html#MTU.trouble">Problems with packet
- fragmentation</A></LI>
-<LI><A HREF="background.html#nat.background">Network address translation
- (NAT)</A></LI>
-<UL>
-<LI><A HREF="background.html#17_3_1">NAT to non-routable addresses</A></LI>
-<LI><A HREF="background.html#17_3_2">NAT to routable addresses</A></LI>
-</UL>
-</UL>
-<B><A HREF="user_examples.html#user.examples">FreeS/WAN script examples</A>
-</B>
-<UL>
-<LI><A HREF="user_examples.html#poltorak">Poltorak's Firewall script</A></LI>
-</UL>
-<B><A HREF="makecheck.html#makecheck">How to configure to use &quot;make
- check&quot;</A></B>
-<UL>
-<LI><A HREF="makecheck.html#19_1">What is &quot;make check&quot;</A></LI>
-<LI><A HREF="makecheck.html#19_2">Running &quot;make check&quot;</A></LI>
-</UL>
-<B><A HREF="makecheck.html#20">How to write a &quot;make check&quot; test</A></B>
-<UL>
-<LI><A HREF="makecheck.html#20_1">Structure of a test</A></LI>
-<LI><A HREF="makecheck.html#20_2">The TESTLIST</A></LI>
-<LI><A HREF="makecheck.html#20_3">Test kinds</A></LI>
-<LI><A HREF="makecheck.html#20_4">Common parameters</A></LI>
-<LI><A HREF="makecheck.html#20_5">KLIPStest paramaters</A></LI>
-<LI><A HREF="makecheck.html#20_6">mkinsttest paramaters</A></LI>
-<LI><A HREF="makecheck.html#20_7">rpm_build_install_test paramaters</A></LI>
-<LI><A HREF="makecheck.html#20_8">libtest paramaters</A></LI>
-<LI><A HREF="makecheck.html#20_9">umlplutotest paramaters</A></LI>
-<LI><A HREF="makecheck.html#20_10">umlXhost parameters</A></LI>
-<LI><A HREF="makecheck.html#20_11">kernel_patch_test paramaters</A></LI>
-<LI><A HREF="makecheck.html#20_12">module_compile paramaters</A></LI>
-</UL>
-<B><A HREF="makecheck.html#21">Current pitfalls</A></B>
-<BR>
-<BR><B><A HREF="umltesting.html#umltesting">User-Mode-Linux Testing
- guide</A></B>
-<UL>
-<LI><A HREF="umltesting.html#22_1">Preliminary Notes on BIND</A></LI>
-<LI><A HREF="umltesting.html#22_2">Steps to Install UML for FreeS/WAN</A>
-</LI>
-</UL>
-<B><A HREF="umltesting.html#23">Debugging the kernel with GDB</A></B>
-<UL>
-<LI><A HREF="umltesting.html#23_1">Other notes about debugging</A></LI>
-</UL>
-<B><A HREF="umltesting.html#24">User-Mode-Linux mysteries</A></B>
-<BR>
-<BR><B><A HREF="umltesting.html#25">Getting more info from uml_netjig</A>
-</B>
-<BR>
-<BR><B><A HREF="politics.html#politics">History and politics of
- cryptography</A></B>
-<UL>
-<LI><A HREF="politics.html#intro.politics">Introduction</A></LI>
-<UL>
-<LI><A HREF="politics.html#26_1_1">History</A></LI>
-<LI><A HREF="politics.html#intro.poli">Politics</A></LI>
-<LI><A HREF="politics.html#26_1_3">Links</A></LI>
-<LI><A HREF="politics.html#26_1_4">Outline of this section</A></LI>
-</UL>
-<LI><A HREF="politics.html#leader">From our project leader</A></LI>
-<UL>
-<LI><A HREF="politics.html#gilmore">Swan: Securing the Internet against
- Wiretapping</A></LI>
-<LI><A HREF="politics.html#policestate">Stopping wholesale monitoring</A>
-</LI>
-</UL>
-<LI><A HREF="politics.html#weak">Government promotion of weak crypto</A></LI>
-<UL>
-<LI><A HREF="politics.html#escrow">Escrowed encryption</A></LI>
-<LI><A HREF="politics.html#shortkeys">Limited key lengths</A></LI>
-</UL>
-<LI><A HREF="politics.html#exlaw">Cryptography Export Laws</A></LI>
-<UL>
-<LI><A HREF="politics.html#USlaw">US Law</A></LI>
-<LI><A HREF="politics.html#wrong">What's wrong with restrictions on
- cryptography</A></LI>
-<LI><A HREF="politics.html#Wassenaar">The Wassenaar Arrangement</A></LI>
-<LI><A HREF="politics.html#status">Export status of Linux FreeS/WAN</A></LI>
-<LI><A HREF="politics.html#help">Help spread IPsec around</A></LI>
-</UL>
-<LI><A HREF="politics.html#desnotsecure">DES is Not Secure</A></LI>
-<UL>
-<LI><A HREF="politics.html#deshware">Dedicated hardware breaks DES in a
- few days</A></LI>
-<LI><A HREF="politics.html#spooks">Spooks may break DES faster yet</A></LI>
-<LI><A HREF="politics.html#desnet">Networks break DES in a few weeks</A></LI>
-<LI><A HREF="politics.html#no_des">We disable DES</A></LI>
-<LI><A HREF="politics.html#40joke">40-bits is laughably weak</A></LI>
-<LI><A HREF="politics.html#altdes">Triple DES is almost certainly secure</A>
-</LI>
-<LI><A HREF="politics.html#aes.ipsec">AES in IPsec</A></LI>
-</UL>
-<LI><A HREF="politics.html#press">Press coverage of Linux FreeS/WAN:</A></LI>
-<UL>
-<LI><A HREF="politics.html#26_6_1">FreeS/WAN 1.0 press</A></LI>
-<LI><A HREF="faq.html#release">Press release for version 1.0</A></LI>
-</UL>
-</UL>
-<B><A HREF="ipsec.html#ipsec.detail">The IPsec protocols</A></B>
-<UL>
-<LI><A HREF="ipsec.html#27_1">Protocols and phases</A></LI>
-<LI><A HREF="ipsec.html#others">Applying IPsec</A></LI>
-<UL>
-<LI><A HREF="ipsec.html#advantages">Advantages of IPsec</A></LI>
-<LI><A HREF="ipsec.html#limitations">Limitations of IPsec</A></LI>
-<LI><A HREF="ipsec.html#uses">IPsec is a general mechanism for securing
- IP</A></LI>
-<LI><A HREF="ipsec.html#authonly">Using authentication without
- encryption</A></LI>
-<LI><A HREF="ipsec.html#encnoauth">Encryption without authentication is
- dangerous</A></LI>
-<LI><A HREF="ipsec.html#multilayer">Multiple layers of IPsec processing
- are possible</A></LI>
-<LI><A HREF="ipsec.html#traffic.resist">Resisting traffic analysis</A></LI>
-</UL>
-<LI><A HREF="ipsec.html#primitives">Cryptographic components</A></LI>
-<UL>
-<LI><A HREF="ipsec.html#block.cipher">Block ciphers</A></LI>
-<LI><A HREF="ipsec.html#hash.ipsec">Hash functions</A></LI>
-<LI><A HREF="ipsec.html#DH.keying">Diffie-Hellman key agreement</A></LI>
-<LI><A HREF="ipsec.html#RSA.auth">RSA authentication</A></LI>
-</UL>
-<LI><A HREF="ipsec.html#structure">Structure of IPsec</A></LI>
-<UL>
-<LI><A HREF="ipsec.html#IKE.ipsec">IKE (Internet Key Exchange)</A></LI>
-<LI><A HREF="ipsec.html#services">IPsec Services, AH and ESP</A></LI>
-<LI><A HREF="ipsec.html#AH.ipsec">The Authentication Header (AH)</A></LI>
-<LI><A HREF="ipsec.html#ESP.ipsec">Encapsulated Security Payload (ESP)</A>
-</LI>
-</UL>
-<LI><A HREF="ipsec.html#modes">IPsec modes</A></LI>
-<UL>
-<LI><A HREF="ipsec.html#tunnel.ipsec">Tunnel mode</A></LI>
-<LI><A HREF="ipsec.html#transport.ipsec">Transport mode</A></LI>
-</UL>
-<LI><A HREF="ipsec.html#parts">FreeS/WAN parts</A></LI>
-<UL>
-<LI><A HREF="ipsec.html#KLIPS.ipsec">KLIPS: Kernel IPsec Support</A></LI>
-<LI><A HREF="ipsec.html#Pluto.ipsec">The Pluto daemon</A></LI>
-<LI><A HREF="ipsec.html#command">The ipsec(8) command</A></LI>
-<LI><A HREF="ipsec.html#ipsec.conf">Linux FreeS/WAN configuration file</A>
-</LI>
-</UL>
-<LI><A HREF="ipsec.html#key">Key management</A></LI>
-<UL>
-<LI><A HREF="ipsec.html#current">Currently Implemented Methods</A></LI>
-<LI><A HREF="ipsec.html#notyet">Methods not yet implemented</A></LI>
-</UL>
-</UL>
-<B><A HREF="mail.html#lists">Mailing lists and newsgroups</A></B>
-<UL>
-<LI><A HREF="mail.html#list.fs">Mailing lists about FreeS/WAN</A></LI>
-<UL>
-<LI><A HREF="mail.html#projlist">The project mailing lists</A></LI>
-<LI><A HREF="mail.html#archive">Archives of the lists</A></LI>
-</UL>
-<LI><A HREF="mail.html#indexes">Indexes of mailing lists</A></LI>
-<LI><A HREF="mail.html#otherlists">Lists for related software and topics</A>
-</LI>
-<UL>
-<LI><A HREF="mail.html#28_3_1">Products that include FreeS/WAN</A></LI>
-<LI><A HREF="mail.html#linux.lists">Linux mailing lists</A></LI>
-<LI><A HREF="mail.html#ietf">Lists for IETF working groups</A></LI>
-<LI><A HREF="mail.html#other">Other mailing lists</A></LI>
-</UL>
-<LI><A HREF="mail.html#newsgroups">Usenet newsgroups</A></LI>
-</UL>
-<B><A HREF="web.html#weblink">Web links</A></B>
-<UL>
-<LI><A HREF="web.html#freeswan">The Linux FreeS/WAN Project</A></LI>
-<UL>
-<LI><A HREF="web.html#patch">Add-ons and patches for FreeS/WAN</A></LI>
-<LI><A HREF="web.html#dist">Distributions including FreeS/WAN</A></LI>
-<LI><A HREF="web.html#used">Things FreeS/WAN uses or could use</A></LI>
-<LI><A HREF="web.html#alternatives">Other approaches to VPNs for Linux</A>
-</LI>
-</UL>
-<LI><A HREF="web.html#ipsec.link">The IPsec Protocols</A></LI>
-<UL>
-<LI><A HREF="web.html#general">General IPsec or VPN information</A></LI>
-<LI><A HREF="trouble.html#overview">IPsec overview documents or slide
- sets</A></LI>
-<LI><A HREF="web.html#otherlang">IPsec information in languages other
- than English</A></LI>
-<LI><A HREF="web.html#RFCs1">RFCs and other reference documents</A></LI>
-<LI><A HREF="web.html#analysis">Analysis and critiques of IPsec
- protocols</A></LI>
-<LI><A HREF="web.html#IP.background">Background information on IP</A></LI>
-</UL>
-<LI><A HREF="web.html#implement">IPsec Implementations</A></LI>
-<UL>
-<LI><A HREF="web.html#linuxprod">Linux products</A></LI>
-<LI><A HREF="web.html#router">IPsec in router products</A></LI>
-<LI><A HREF="web.html#fw.web">IPsec in firewall products</A></LI>
-<LI><A HREF="web.html#ipsecos">Operating systems with IPsec support</A></LI>
-<LI><A HREF="web.html#29_3_5">IPsec on network cards</A></LI>
-<LI><A HREF="web.html#opensource">Open source IPsec implementations</A></LI>
-<LI><A HREF="web.html#interop.web">Interoperability</A></LI>
-</UL>
-<LI><A HREF="web.html#linux.link">Linux links</A></LI>
-<UL>
-<LI><A HREF="web.html#linux.basic">Basic and tutorial Linux information</A>
-</LI>
-<LI><A HREF="web.html#general">General Linux sites</A></LI>
-<LI><A HREF="web.html#docs.ldp">Documentation</A></LI>
-<LI><A HREF="web.html#advroute.web">Advanced routing</A></LI>
-<LI><A HREF="web.html#linsec">Security for Linux</A></LI>
-<LI><A HREF="web.html#firewall.linux">Linux firewalls</A></LI>
-<LI><A HREF="web.html#linux.misc">Miscellaneous Linux information</A></LI>
-</UL>
-<LI><A HREF="web.html#crypto.link">Crypto and security links</A></LI>
-<UL>
-<LI><A HREF="web.html#security">Crypto and security resources</A></LI>
-<LI><A HREF="web.html#policy">Cryptography law and policy</A></LI>
-<LI><A HREF="web.html#crypto.tech">Cryptography technical information</A>
-</LI>
-<LI><A HREF="web.html#compsec">Computer and network security</A></LI>
-<LI><A HREF="web.html#people">Links to home pages</A></LI>
-</UL>
-</UL>
-<B><A HREF="glossary.html#ourgloss">Glossary for the Linux FreeS/WAN
- project</A></B>
-<UL>
-<LI><A HREF="glossary.html#jump">Jump to a letter in the glossary</A></LI>
-<LI><A HREF="glossary.html#gloss">Other glossaries</A></LI>
-<LI><A HREF="glossary.html#definitions">Definitions</A></LI>
-</UL>
-<B><A HREF="biblio.html#biblio">Bibliography for the Linux FreeS/WAN
- project</A></B>
-<BR>
-<BR><B><A HREF="rfc.html#RFC">IPsec RFCs and related documents</A></B>
-<UL>
-<LI><A HREF="rfc.html#RFCfile">The RFCs.tar.gz Distribution File</A></LI>
-<LI><A HREF="rfc.html#sources">Other sources for RFCs &amp; Internet drafts</A>
-</LI>
-<UL>
-<LI><A HREF="rfc.html#RFCdown">RFCs</A></LI>
-<LI><A HREF="rfc.html#drafts">Internet Drafts</A></LI>
-<LI><A HREF="rfc.html#FIPS1">FIPS standards</A></LI>
-</UL>
-<LI><A HREF="rfc.html#RFCs.tar.gz">What's in the RFCs.tar.gz bundle?</A></LI>
-<UL>
-<LI><A HREF="rfc.html#rfc.ov">Overview RFCs</A></LI>
-<LI><A HREF="rfc.html#basic.prot">Basic protocols</A></LI>
-<LI><A HREF="rfc.html#key.ike">Key management</A></LI>
-<LI><A HREF="rfc.html#rfc.detail">Details of various things used</A></LI>
-<LI><A HREF="rfc.html#rfc.ref">Older RFCs which may be referenced</A></LI>
-<LI><A HREF="rfc.html#rfc.dns">RFCs for secure DNS service, which IPsec
- may use</A></LI>
-<LI><A HREF="rfc.html#rfc.exp">RFCs labelled &quot;experimental&quot;</A></LI>
-<LI><A HREF="rfc.html#rfc.rel">Related RFCs</A></LI>
-</UL>
-</UL>
-<B><A HREF="roadmap.html#roadmap">Distribution Roadmap: What's Where in
- Linux FreeS/WAN</A></B>
-<UL>
-<LI><A HREF="roadmap.html#top">Top directory</A></LI>
-<LI><A HREF="roadmap.html#doc">Documentation</A></LI>
-<LI><A HREF="roadmap.html#klips.roadmap">KLIPS: kernel IP security</A></LI>
-<LI><A HREF="roadmap.html#pluto.roadmap">Pluto key and connection
- management daemon</A></LI>
-<LI><A HREF="roadmap.html#utils">Utils</A></LI>
-<LI><A HREF="roadmap.html#lib">Libraries</A></LI>
-<UL>
-<LI><A HREF="roadmap.html#fswanlib">FreeS/WAN Library</A></LI>
-<LI><A HREF="roadmap.html#otherlib">Imported Libraries</A></LI>
-</UL>
-</UL>
-<B><A HREF="umltesting.html#umltesting">User-Mode-Linux Testing guide</A>
-</B>
-<UL>
-<LI><A HREF="umltesting.html#34_1">Preliminary Notes on BIND</A></LI>
-<LI><A HREF="umltesting.html#34_2">Steps to Install UML for FreeS/WAN</A>
-</LI>
-</UL>
-<B><A HREF="umltesting.html#35">Debugging the kernel with GDB</A></B>
-<UL>
-<LI><A HREF="umltesting.html#35_1">Other notes about debugging</A></LI>
-</UL>
-<B><A HREF="umltesting.html#36">User-Mode-Linux mysteries</A></B>
-<BR>
-<BR><B><A HREF="umltesting.html#37">Getting more info from uml_netjig</A>
-</B>
-<BR>
-<BR><B><A HREF="makecheck.html#makecheck">How to configure to use &quot;make
- check&quot;</A></B>
-<UL>
-<LI><A HREF="makecheck.html#38_1">What is &quot;make check&quot;</A></LI>
-<LI><A HREF="makecheck.html#38_2">Running &quot;make check&quot;</A></LI>
-</UL>
-<B><A HREF="makecheck.html#39">How to write a &quot;make check&quot; test</A></B>
-<UL>
-<LI><A HREF="makecheck.html#39_1">Structure of a test</A></LI>
-<LI><A HREF="makecheck.html#39_2">The TESTLIST</A></LI>
-<LI><A HREF="makecheck.html#39_3">Test kinds</A></LI>
-<LI><A HREF="makecheck.html#39_4">Common parameters</A></LI>
-<LI><A HREF="makecheck.html#39_5">KLIPStest paramaters</A></LI>
-<LI><A HREF="makecheck.html#39_6">mkinsttest paramaters</A></LI>
-<LI><A HREF="makecheck.html#39_7">rpm_build_install_test paramaters</A></LI>
-<LI><A HREF="makecheck.html#39_8">libtest paramaters</A></LI>
-<LI><A HREF="makecheck.html#39_9">umlplutotest paramaters</A></LI>
-<LI><A HREF="makecheck.html#39_10">umlXhost parameters</A></LI>
-<LI><A HREF="makecheck.html#39_11">kernel_patch_test paramaters</A></LI>
-<LI><A HREF="makecheck.html#39_12">module_compile paramaters</A></LI>
-</UL>
-<B><A HREF="makecheck.html#40">Current pitfalls</A></B>
-<BR>
-<BR><B><A HREF="nightly.html#nightly">Nightly regression testing</A></B>
-<BR>
-<BR><B><A HREF="nightly.html#nightlyhowto">How to setup the nightly
- build</A></B>
-<UL>
-<LI><A HREF="nightly.html#42_1"> Files you need to know about</A></LI>
-<LI><A HREF="nightly.html#42_2">Configuring freeswan-regress-env.sh</A></LI>
-</UL>
-</BODY>
-</HTML>
diff --git a/doc/trouble.html b/doc/trouble.html
deleted file mode 100644
index 2123f3805..000000000
--- a/doc/trouble.html
+++ /dev/null
@@ -1,706 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="firewall.html">Previous</A>
-<A HREF="compat.html">Next</A>
-<HR>
-<H1><A NAME="trouble"></A>Linux FreeS/WAN Troubleshooting Guide</H1>
-<H2><A NAME="overview"></A>Overview</H2>
-<P> This document covers several general places where you might have a
- problem:</P>
-<OL>
-<LI><A HREF="#install">During install</A>.</LI>
-<LI><A HREF="#negotiation">During the negotiation process</A>.</LI>
-<LI><A HREF="#use">Using an established connection</A>.</LI>
-</OL>
-<P>This document also contains<A HREF="#notes"> notes</A> which expand
- on points made in these sections, and tips for<A HREF="#prob.report">
- problem reporting</A>. If the other end of your connection is not
- FreeS/WAN, you'll also want to read our<A HREF="interop.html#interop.problem">
- interoperation</A> document.</P>
-<H2><A NAME="install"></A>1. During Install</H2>
-<H3><A NAME="8_2_1">1.1 RPM install gotchas</A></H3>
-<P>With the RPM method:</P>
-<UL>
-<LI>Be sure you have installed both the userland tools and the kernel
- components. One will not work without the other. For example, when
- using FreeS/WAN-produced RPMs for our 2.04 release, you need both:
-<PRE>    freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm
-    freeswan-module-2.04_2.4.20_20.9-0.i386.rpm
-</PRE>
-</LI>
-</UL>
-<H3><A NAME="8_2_2">1.2 Problems installing from source</A></H3>
-<P>When installing from source, you may find these problems:</P>
-<UL>
-<LI>Missing library. See<A HREF="faq.html#gmp.h_missing"> this</A> FAQ.</LI>
-<LI>Missing utilities required for compile. See this<A HREF="install.html#tool.lib">
- checklist</A>.</LI>
-<LI>Kernel version incompatibility. See<A HREF="faq.html#k.versions">
- this</A> FAQ.</LI>
-<LI>Another compile problem. Find information in the out.* files, ie.
- out.kpatch, out.kbuild, created at compile time in the top-level Linux
- FreeS/WAN directory. Error messages generated by KLIPS during the boot
- sequence are accessible with the<VAR> dmesg</VAR> command.
-<BR> Check the list archives and the List in Brief to see if this is a
- known issue. If it is not, report it to the bugs list as described in
- our<A HREF="#prob.report"> problem reporting</A> section. In some
- cases, you may be asked to provide debugging information using gdb;
- details<A HREF="#gdb"> below</A>.</LI>
-<LI>If your kernel compiles but you fail to install your new
- FreeS/WAN-enabled kernel, review the sections on<A HREF="install.html#newk">
- installing the patched kernel</A>, and<A HREF="install.html#testinstall">
- testing</A> to see if install succeeded.</LI>
-</UL>
-<H3><A NAME="install.check"></A>1.3 Install checks</H3>
-<P><VAR>ipsec verify</VAR> checks a number of FreeS/WAN essentials. Here
- are some hints on what do to when your system doesn't check out:</P>
-<P></P>
-<TABLE border="1">
-<TR><TD><STRONG>Problem</STRONG></TD><TD><STRONG>Status</STRONG></TD><TD>
-<STRONG>Action</STRONG></TD></TR>
-<TR><TD><VAR>ipsec</VAR> not on-path</TD><TD>&nbsp;</TD><TD>
-<P>Add<VAR> /usr/local/sbin</VAR> to your PATH.</P>
-</TD></TR>
-<TR><TD>Missing KLIPS support</TD><TD><FONT COLOR="#FF0000">critical</FONT>
-</TD><TD>See<A HREF="faq.html#noKLIPS"> this FAQ.</A></TD></TR>
-<TR><TD>No RSA private key</TD><TD>&nbsp;</TD><TD>
-<P>Follow<A HREF="install.html#genrsakey"> these instructions</A> to
- create an RSA key pair for your host. RSA keys are:</P>
-<UL>
-<LI>required for opportunistic encryption, and</LI>
-<LI>our preferred method to authenticate pre-configured connections.</LI>
-</UL>
-</TD></TR>
-<TR><TD><VAR>pluto</VAR> not running</TD><TD><FONT COLOR="#FF0000">
-critical</FONT></TD><TD>
-<PRE>service ipsec start</PRE>
-</TD></TR>
-<TR><TD>No port 500 hole</TD><TD><FONT COLOR="#FF0000">critical</FONT></TD><TD>
-Open port 500 for IKE negotiation.</TD></TR>
-<TR><TD>Port 500 check N/A</TD><TD>&nbsp;</TD><TD>Check that port 500 is open
- for IKE negotiation.</TD></TR>
-<TR><TD>Failed DNS checks</TD><TD>&nbsp;</TD><TD>Opportunistic encryption
- requires information from DNS. To set this up, see<A HREF="quickstart.html#opp.setup">
- our instructions</A>.</TD></TR>
-<TR><TD>No public IP address</TD><TD>&nbsp;</TD><TD>Check that the interface
- which you want to protect with IPSec is up and running.</TD></TR>
-</TABLE>
-<H3><A NAME="oe.trouble"></A>1.3 Troubleshooting OE</H3>
-<P>OE should work with no local configuration, if you have posted DNS
- TXT records according to the instructions in our<A HREF="quickstart.html">
- quickstart guide</A>. If you encounter trouble, try these hints. We
- welcome additional hints via the<A HREF="mail.html"> users' mailing
- list</A>.</P>
-<TABLE border="1">
-<TR><TD><STRONG>Symptom</STRONG></TD><TD><STRONG>Problem</STRONG></TD><TD>
-<STRONG>Action</STRONG></TD></TR>
-<TR><TD> You're running FreeS/WAN 2.01 (or later), and initiating a
- connection to FreeS/WAN 2.00 (or earlier). In your logs, you see a
- message like:
-<PRE>no RSA public key known for '192.0.2.13';
-DNS search for KEY failed (no KEY record
-for 13.2.0.192.in-addr.arpa.)</PRE>
- The older FreeS/WAN logs no error.</TD><TD><A NAME="oe.trouble.flagday">
-</A> A protocol level incompatibility between 2.01 (or later) and 2.00
- (or earlier) causes this error. It occurs when a FreeS/WAN 2.01 (or
- later) box for which no KEY record is posted attempts to initiate an OE
- connection to older FreeS/WAN versions (2.00 and earlier). Note that
- older versions can initiate to newer versions without this error.</TD><TD>
-If you control the peer host, upgrade its FreeS/WAN to 2.01 (or later),
- and post new style TXT records for it. If not, but if you know its
- sysadmin, perhaps a quick note is in order. If neither option is
- possible, you can ease the transition by posting an old style KEY
- record (created with a command like &quot;ipsec&nbsp;showhostkey&nbsp;--key&quot;) to the
- reverse map for the FreeS/WAN 2.01 (or later) box.</TD></TR>
-<TR><TD>OE host is very slow to contact other hosts.</TD><TD>Slow DNS
- service while running OE.</TD><TD>It's a good idea to run a caching DNS
- server on your OE host, as outlined in<A HREF="http://lists.freeswan.org/pipermail/design/2003-January/004205.html">
- this mailing list message</A>. If your DNS servers are elsewhere, put
- their IPs in the<VAR> clear</VAR> policy group, and re-read groups with
-<PRE>ipsec auto --rereadgroups</PRE>
-</TD></TR>
-<TR><TD>
-<PRE>Can't Opportunistically initiate for
-192.0.2.2 to 192.0.2.3: no TXT record
-for 13.2.0.192.in-addr.arpa.</PRE>
-</TD><TD>Peer is not set up for OE.</TD><TD>
-<P>None. Plenty of hosts on the Internet do not run OE. If, however, you
- have set OE up on that peer, this may indicate that you need to wait up
- to 48 hours for its DNS records to propagate.</P>
-</TD></TR>
-<TR><TD><VAR>ipsec verify</VAR> does not find DNS records:
-<PRE>...
-Looking for TXT in forward map:
-                xy.example.com...[FAILED]
-Looking for TXT in reverse map...[FAILED]
-...</PRE>
- You also experience authentication failure:
-<BR>
-<PRE>Possible authentication failure:
-no acceptable response to our
-first encrypted message</PRE>
-</TD><TD>DNS records are not posted or have not propagated.</TD><TD>Did
- you post the DNS records necessary for OE? If not, do so using the
- instructions in our<A HREF="quickstart.html#quickstart"> quickstart
- guide</A>. If so, wait up to 48 hours for the DNS records to propagate.</TD>
-</TR>
-<TR><TD><VAR>ipsec verify</VAR> does not find DNS records, and you
- experience authentication failure.</TD><TD>For iOE, your ID does not
- match location of forward DNS record.</TD><TD>In<VAR> config setup</VAR>
-, change<VAR> myid=</VAR> to match the forward DNS where you posted the
- record. Restart FreeS/WAN. For reference, see our<A HREF="quickstart.html#opp.client">
- iOE instructions</A>.</TD></TR>
-<TR><TD><VAR>ipsec verify</VAR> finds DNS records, yet there is still
- authentication failure. ( ? )</TD><TD>DNS records are malformed.</TD><TD>
-Re-create the records and send new copies to your DNS administrator.</TD>
-</TR>
-<TR><TD><VAR>ipsec verify</VAR> finds DNS records, yet there is still
- authentication failure. ( ? )</TD><TD>DNS records show different keys
- for a gateway vs. its subnet hosts.</TD><TD>All TXT records for boxes
- protected by an OE gateway must contain the gateway's public key.
- Re-create and re-post any incorrect records using<A HREF="quickstart.html#opp.incoming">
- these instructions</A>.</TD></TR>
-<TR><TD>OE gateway loses connectivity to its subnet. The gateway's
- routing table shows routes to the subnet through IPsec interfaces.</TD><TD>
-The subnet is part of the<VAR> private</VAR> or<VAR> block</VAR> policy
- group on the gateway.</TD><TD>Remove the subnet from the group, and
- reread groups with
-<PRE>ipsec auto --rereadgroups</PRE>
-</TD></TR>
-<TR><TD>OE does not work to hosts on the local LAN.</TD><TD>This is a
- known issue.</TD><TD>See<A HREF="opportunism.known-issues"> this list</A>
- of known issues with OE.</TD></TR>
-<TR><TD>FreeS/WAN does not seem to be executing your default policy. In
- your logs, you see a message like:
-<PRE>/etc/ipsec.d/policies/iprivate-or-clear&quot;
-line 14: subnet &quot;0.0.0.0/0&quot;,
-source 192.0.2.13/32,
-already &quot;private-or-clear&quot;</PRE>
-</TD><TD><A HREF="glossary.html#fullnet">Fullnet</A> in a policy group
- file defines your default policy. Fullnet should normally be present in
- only one policy group file. The fine print: you can have two default
- policies defined so long as they protect different local endpoints
- (e.g. the FreeS/WAN gateway and a subnet).</TD><TD> Find all policies
- which contain fullnet with:
-<BR>
-<PRE>grep -F 0.0.0.0/0 /etc/ipsec.d/policies/*</PRE>
- then remove the unwanted occurrence(s).</TD></TR>
-</TABLE>
-<H2><A NAME="negotiation"></A>2. During Negotiation</H2>
-<P>When you fail to bring up a tunnel, you'll need to find out:</P>
-<UL>
-<LI><A HREF="#state">what your connection state is,</A> and often</LI>
-<LI><A HREF="#find.pluto.error">an error message</A>.</LI>
-</UL>
-<P>before you can<A HREF="#interpret.pluto.error"> diagnose your problem</A>
-.</P>
-<H3><A NAME="state"></A>2.1 Determine Connection State</H3>
-<H4>Finding current state</H4>
-<P>You can see connection states (STATE_MAIN_I1 and so on) when you
- bring up a connection on the command line. If you have missed this, or
- brought up your connection automatically, use:</P>
-<PRE>ipsec auto --status</PRE>
-<P>The most relevant state is the last one reached.</P>
-<H4><VAR>What's this supposed to look like?</VAR></H4>
-<P>Negotiations should proceed though various states, in the processes
- of:</P>
-<OL>
-<LI>IKE negotiations (aka Phase 1, Main Mode, STATE_MAIN_*)</LI>
-<LI>IPSEC negotiations (aka Phase 2, Quick Mode, STATE_QUICK_*)</LI>
-</OL>
-<P>These are done and a connection is established when you see messages
- like:</P>
-<PRE>    000 #21: &quot;myconn&quot; STATE_MAIN_I4 (ISAKMP SA established)...
-    000 #2: &quot;myconn&quot; STATE_QUICK_I2 (sent QI2, IPsec SA established)...</PRE>
-<P> Look for the key phrases are &quot;ISAKMP SA established&quot; and &quot;IPSec SA
- established&quot;, with the relevant connection name. Often, this happens at
- STATE_MAIN_I4 and STATE_QUICK_I2, respectively.</P>
-<P><VAR>ipsec auto --status</VAR> will tell you what states<STRONG> have
- been achieved</STRONG>, rather than the current state. Since
- determining the current state is rather more difficult to do, current
- state information is not available from Linux FreeS/WAN. If you are
- actively bringing a connection up, the status report's last states for
- that connection likely reflect its current state. Beware, though, of
- the case where a connection was correctly brought up but is now downed:
- Linux FreeS/WAN will not notice this until it attempts to rekey.
- Meanwhile, the last known state indicates that the connection has been
- established.</P>
-<P>If your connection is stuck at STATE_MAIN_I1, skip straight to<A HREF="#ikepath">
- here</A>.</P>
-<H3><A NAME="find.pluto.error"></A>2.2 Finding error text</H3>
-<P>Solving most errors will require you to find verbose error text,
- either on the command line or in the logs.</P>
-<H4>Verbose start for more information</H4>
-<P> Note that you can get more detail from<VAR> ipsec auto</VAR> using
- the --verbose flag:</P>
-<PRE STYLE="margin-bottom: 0.2in">    ipsec auto --verbose --up west-east</PRE>
-<P> More complete information can be gleaned from the<A HREF="#logusage">
- log files</A>.</P>
-<H4>Debug levels count</H4>
-<P>The amount of description you'll get here depends on ipsec.conf debug
- settings,<VAR> klipsdebug</VAR>= and<VAR> plutodebug</VAR>=. When
- troubleshooting, set at least one of these to<VAR> all</VAR>, and when
- done, reset it to<VAR> none</VAR> so your logs don't fill up. Note that
- you must have enabled the<VAR> klipsdebug</VAR><A HREF="install.html#allbut">
- compile-time option</A> for the<VAR> klipsdebug</VAR> configuration
- switch to work.</P>
-<P>For negotiation problems<VAR> plutodebug</VAR> is most relevant.<VAR>
- klipsdebug</VAR> applies mainly to attempts to use an
- already-established connection. See also<A HREF="ipsec.html#parts">
- this</A> description of the division of duties within Linux FreeS/WAN.</P>
-<P>After raising your debug levels, restart Linux FreeS/WAN to ensure
- that ipsec.conf is reread, then recreate the error to generate verbose
- logs.</P>
-<H4><VAR>ipsec barf</VAR> for lots of debugging information</H4>
-<P><A HREF="manpage.d/ipsec_barf.8.html"><VAR> ipsec barf (8)</VAR></A>
- collects a bunch of useful debugging information, including these logs
- Use the command</P>
-<PRE>
-    ipsec barf &gt; barf.west
-</PRE>
-<P>to generate one.</P>
-<H4>Find the error</H4>
-<P>Search out the failure point in your logs. Are there a handful of
- lines which succinctly describe how things are going wrong or contrary
- to your expectation? Sometimes the failure point is not immediately
- obvious: Linux FreeS/WAN's errors are usually not marked &quot;Error&quot;. Have
- a look in the<A HREF="faq.html"> FAQ</A> for what some common failures
- look like.</P>
-<P>Tip: problems snowball. Focus your efforts on the first problem,
- which is likely to be the cause of later errors.</P>
-<H4>Play both sides</H4>
-<P>Also find error text on the peer IPSec box. This gives you two
- perspectives on the same failure.</P>
-<P>At times you will require information which only one side has. The
- peer can merely indicate the presence of an error, and its approximate
- point in the negotiations. If one side keeps retrying, it may be
- because there is a show stopper on the other side. Have a look at the
- other side and figure out what it doesn't like.</P>
-<P>If the other end is not Linux FreeS/WAN, the principle is the same:
- replicate the error with its most verbose logging on, and capture the
- output to a file.</P>
-<H3><A NAME="interpret.pluto.error"></A>2.3 Interpreting a Negotiation
- Error</H3>
-<H4><A NAME="ikepath"></A>Connection stuck at STATE_MAIN_I1</H4>
-<P>This error commonly happens because IKE (port 500) packets, needed to
- negotiate an IPSec connection, cannot travel freely between your IPSec
- gateways. See<A HREF="firewall.html#packets"> our firewall document</A>
- for details.</P>
-<H4>Other errors</H4>
-<P>Other errors require a bit more digging. Use the following resources:</P>
-<UL>
-<LI><A HREF="faq.html">the FAQ</A> . Since this document is constantly
- updated, the snapshot's FAQ may have a new entry relevant to your
- problem.</LI>
-<LI>our<A HREF="background.html"> background document</A> . Special
- considerations which, while not central to Linux FreeS/WAN, are often
- tripped over. Includes problems with<A href="background.html#MTU.trouble">
- packet fragmentation</A>, and considerations for testing opportunism.</LI>
-<LI>the<A HREF="mail.html#lists"> list archives</A>. Each of the
- searchable archives works differently, so it's worth checking each. Use
- a search term which is generic, but identifies your error, for example
- &quot;No connection is known for&quot;.
-<BR> Often, you will find that your question has been answered in the
- past. Finding an archived answer is quicker than asking the list. You
- may, however, find similar questions without answers. If you do, send
- their URLs to the list with your trouble report. The additional
- examples may help the list tech support person find your answer.</LI>
-<LI>Look into the code where the error is being generated. The pluto
- code is nicely documented with comments and meaningful variable names.</LI>
-</UL>
-<P>If you have failed to solve your problem with the help of these
- resources, send a detailed problem report to the users list, following
- these<A HREF="#prob.report"> guidelines</A>.</P>
-<H2><A NAME="use"></A>3. Using a Connection</H2>
-<H3><A NAME="8_4_1">3.1 Orienting yourself</A></H3>
-<H4><VAR>How do I know if it works?</VAR></H4>
-<P>Test your connection by sending packets through it. The simplest way
- to do this is with ping, but the ping needs to<STRONG> test the correct
- tunnel.</STRONG> See<A HREF="#testgates"> this example scenario</A> if
- you don't understand this.</P>
-<P></P>
-<P>If your ping returns, test any other connections you've brought u all
- check out, great. You may wish to<A HREF="#bigpacket"> test with large
- packets</A> for MTU problems.</P>
-<H4><VAR>ipsec barf</VAR> is useful again</H4>
-<P>If your ping fails to return, generate an ipsec barf debugging report
- on each IPSec gateway. On a non-Linux FreeS/WAN implementation, gather
- equivalent information. Use this, and the tips in the next sections, to
- troubleshoot. Are you sure that both endpoints are capable of hearing
- and responding to ping?</P>
-<H3><A NAME="8_4_2">3.2 Those pesky configuration errors</A></H3>
-<P>IPSec may be dropping your ping packets since they do not belong in
- the tunnels you have constructed:</P>
-<UL>
-<LI>Your ping may not test the tunnel you intend to test. For details,
- see our<A HREF="faq.html#cantping"> &quot;I can't ping&quot;</A> FAQ.</LI>
-<LI> Alternately, you may have a configuration error. For example, you
- may have configured one of the four possible tunnels between two
- gateways, but not the one required to secure the important traffic
- you're now testing. In this case, add and start the tunnel, and try
- again.</LI>
-</UL>
-<P>In either case, you will often see a message like:</P>
-<PRE>klipsdebug... no eroute</PRE>
-<P>which we discuss in<A HREF="faq.html#no_eroute"> this FAQ</A>.</P>
-<P>Note:</P>
-<UL>
-<LI><A HREF="glossary.html#NAT.gloss">Network Address Translation (NAT)</A>
- and<A HREF="glossary.html#masq"> IP masquerade</A> may have an effect
- on which tunnels you need to configure.</LI>
-<LI>When testing a tunnel that protects a multi-node subnet, try several
- subnet nodes as ping targets, in case one node is routing incorrectly.</LI>
-</UL>
-<H3><A NAME="route.firewall"></A>3.3 Check Routing and Firewalling</H3>
-<P>If you've confirmed your configuration assumptions, the problem is
- almost certainly with routing or firewalling. Isolate the problem using
- interface statistics, firewall statistics, or a packet sniffer.</P>
-<H4>Background:</H4>
-<UL>
-<LI>Linux FreeS/WAN supplies all the special routing it needs; you need
- only route packets out through your IPSec gateway. Verify that on the<VAR>
- subnetted</VAR> machines you are using for your ping-test, your routing
- is as expected. I have seen a tunnel &quot;fail&quot; because the subnet machine
- sending packets out an alternate gateway (not our IPSec gateway) on
- their return path.</LI>
-<LI>Linux FreeS/WAN requires particular<A HREF="firewall.html">
- firewalling considerations</A>. Check the firewall rules on your IPSec
- gateways and ensure that they allow IPSec traffic through. Be sure that
- no other machine - for example a router between the gateways - is
- blocking your IPSec packets.</LI>
-</UL>
-<H4><A NAME="ifconfig"></A>View Interface and Firewall Statistics</H4>
-<P>Interface reports and firewall statistics can help you track down
- lost packets at a glance. Check any firewall statistics you may be
- keeping on your IPSec gateways, for dropped packets.</P>
-<P><STRONG>Tip</STRONG>: You can take a snapshot of the packets
- processed by your firewall with:</P>
-<PRE>    iptables -L -n -v</PRE>
-<P>You can get creative with &quot;diff&quot; to find out what happens to a
- particular packet during transmission.</P>
-<P>Both<VAR> cat /proc/net/dev</VAR> and<VAR> ifconfig</VAR> display
- interface statistics, and both are included in<VAR> ipsec barf</VAR>.
- Use either to check if any interface has dropped packets. If you find
- that one has, test whether this is related to your ping. While you ping
- continuously, print that interface's statistics several times. Does its
- drop count increase in proportion to the ping? If so, check why the
- packets are dropped there.</P>
-<P>To do this, look at the firewall rules that apply to that interface.
- If the interface is an IPSec interface, more information may be
- available in the log. Grep for the word &quot;drop&quot; in a log which was
- created with<VAR> klipsdebug=all</VAR> as the error happened.</P>
-<P>See also this<A HREF="#ifconfig1"> discussion</A> on interpreting<VAR>
- ifconfig</VAR> statistics.</P>
-<H3><A NAME="sniff"></A>3.4 When in doubt, sniff it out</H3>
-<P>If you have checked configuration assumptions, routing, and firewall
- rules, and your interface statistics yield no clue, it remains for you
- to investigate the mystery of the lost packet by the most thorough
- method: with a packet sniffer (providing, of course, that this is legal
- where you are working).</P>
-<P>In order to detect packets on the ipsec virtual interfaces, you will
- need an up-to-date sniffer (tcpdump, ethereal, ksnuffle) on your IPSec
- gateway machines. You may also find it useful to sniff the ping
- endpoints.</P>
-<H4>Anticipate your packets' path</H4>
-<P>Ping, and examine each interface along the projected path, checking
- for your ping's arrival. If it doesn't get to the the next stop, you
- have narrowed down where to look for it. In this way, you can isolate a
- problem area, and narrow your troubleshooting focus.</P>
-<P>Within a machine running Linux FreeS/WAN, this<A HREF="firewall.html#packets">
- packet flow diagram</A> will help you anticipate a packet's path.</P>
-<P>Note that:</P>
-<UL>
-<LI> from the perspective of the tunneled packet, the entire tunnel is
- one hop. That's explained in<A HREF="faq.html#no_trace"> this</A> FAQ.</LI>
-<LI> an encapsulated IPSec packet will look different, when sniffed,
- from the plaintext packet which generated it. You can see plaintext
- packets entering an IPSec interface and the resulting cyphertext
- packets as they emerge from the corresponding physical interface.</LI>
-</UL>
-<P>Once you isolate where the packet is lost, take a closer look at
- firewall rules, routing and configuration assumptions as they affect
- that specific area. If the packet is lost on an IPSec gateway, comb
- through<VAR> klipsdebug</VAR> output for anomalies.</P>
-<P>If the packet goes through both gateways successfully and reaches the
- ping target, but does not return, suspect routing. Check that the ping
- target routes packets back to the IPSec gateway.</P>
-<H3><A NAME="find.use.error"></A>3.5 Check your logs</H3>
-<P>Here, too, log information can be useful. Start with the<A HREF="#find.pluto.error">
- guidelines above</A>.</P>
-<P>For connection use problems, set<VAR> klipsdebug=all</VAR>. Note that
- you must have enabled the<VAR> klipsdebug</VAR><A HREF="install.html#allbut">
- compile-time option</A> to do this. Restart Linux FreeS/WAN so that it
- rereads<VAR> ipsec.conf</VAR>, then recreate the error condition. When
- searching through<VAR> klipsdebug</VAR> data, look especially for the
- keywords &quot;drop&quot; (as in dropped packets) and &quot;error&quot;.</P>
-<P>Often the problem with connection use is not software error, but
- rather that the software is behaving contrary to expectation.</P>
-<H4><A NAME="interpret.use.error"></A>Interpreting log text</H4>
-<P>To interpret the Linux FreeS/WAN log text you've found, use the same
- resources as indicated for troubleshooting connection negotiation:<A HREF="faq.html">
- the FAQ</A> , our<A HREF="background.html"> background document</A>,
- and the<A HREF="mail.html#lists"> list archives</A>. Looking in the
- KLIPS code is only for the very brave.</P>
-<P>If you are still stuck, send a<A HREF="#prob.report"> detailed
- problem report</A> to the users' list.</P>
-<H3><A NAME="bigpacket"></A>3.6 More testing for the truly thorough</H3>
-<H4>Large Packets</H4>
-<P>If each of your connections passed the ping test, you may wish to
- test by pinging with large packets (2000 bytes or larger). If it does
- not return, suspect MTU issues, and see this<A HREF="background.html#MTU.trouble">
- discussion</A>.</P>
-<H4>Stress Tests</H4>
-<P>In most users' view, a simple ping test, and perhaps a large-packet
- ping test suffice to indicate a working IPSec connection.</P>
-<P>Some people might like to do additional stress tests prior to
- production use. They may be interested in this<A HREF="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/12/msg00224.html">
- testing protocol</A> we use at interoperation conferences, aka
- &quot;bakeoffs&quot;. We also have a<VAR> testing</VAR> directory that ships with
- the release.</P>
-<H2><A NAME="prob.report"></A>4. Problem Reporting</H2>
-<H3><A NAME="8_5_1">4.1 How to ask for help</A></H3>
-<P>Ask for troubleshooting help on the users' mailing list,<A HREF="mailto:users@lists.freeswan.org">
- users@lists.freeswan.org</A>. While sometimes an initial query with a
- quick description of your intent and error will twig someone's memory
- of a similar problem, it's often necessary to send a second mail with a
- complete problem report.</P>
-<P>When reporting problems to the mailing list(s), please include:</P>
-<UL>
-<LI>a brief description of the problem</LI>
-<LI>if it's a compile problem, the actual output from make, showing the
- problem. Try to edit it down to only the relevant part, but when in
- doubt, be as complete as you can. If it's a kernel compile problem, any
- relevant out.* files</LI>
-<LI>if it's a run-time problem, pointers to where we can find the
- complete output from &quot;ipsec barf&quot; from BOTH ENDS (not just one of
- them). Remember that it's common outside the US and Canada to pay for
- download volume, so if you can't post barfs on the web and send the URL
- to the mailing list, at least compress them with tar or gzip.
-<BR> If you can, try to simplify the case that is causing the problem.
- In particular, if you clear your logs, start FreeS/WAN with no other
- connections running, cause the problem to happen, and then do<VAR>
- ipsec barf</VAR> on both ends immediately, that gives the smallest and
- least cluttered output.</LI>
-<LI>any other error messages, complaints, etc. that you saw. Please send
- the complete text of the messages, not just a summary.</LI>
-<LI>what your network setup is. Include subnets, gateway addresses, etc.
- A schematic diagram is a good format for this information.</LI>
-<LI>exactly what you were trying to do with Linux FreeS/WAN, and exactly
- what went wrong</LI>
-<LI>a fix, if you have one. But remember, you are sending mail to people
- all over the world; US residents and US citizens in particular, please
- read doc/exportlaws.html before sending code -- even small bug fixes --
- to the list or to us.</LI>
-<LI>When in doubt about whether to include some seemingly-trivial item
- of information, include it. It is rare for problem reports to have too
- much information, and common for them to have too little.</LI>
-</UL>
-<P>Here are some good general guidelines on bug reporting:<A href="http://tuxedo.org/~esr/faqs/smart-questions.html">
- How To Ask Questions The Smart Way</A> and<A href="http://www.chiark.greenend.org.uk/~sgtatham/bugs.html">
- How to Report Bugs Effectively</A>.</P>
-<H3><A NAME="8_5_2">4.2 Where to ask</A></H3>
-<P>To report a problem, send mail about it to the users' list. If you
- are certain that you have found a bug, report it to the bugs list. If
- you encounter a problem while doing your own coding on the Linux
- FreeS/WAN codebase and think it is of interest to the design team,
- notify the design list. When in doubt, default to the users' list. More
- information about the mailing lists is found<A HREF="mail.html#lists">
- here</A>.</P>
-<P>For a number of reasons -- including export-control regulations
- affecting almost any<STRONG> private</STRONG> discussion of encryption
- software -- we prefer that problem reports and discussions go to the
- lists, not directly to the team. Beware that the list goes worldwide;
- US citizens, read this important information about your<A HREF="politics.html#exlaw">
- export laws</A>. If you're using this software, you really should be on
- the lists. To get onto them, visit<A HREF="http://lists.freeswan.org/">
- lists.freeswan.org</A>.</P>
-<P>If you do send private mail to our coders or want a private reply
- from them, please make sure that the return address on your mail (From
- or Reply-To header) is a valid one. They have more important things to
- do than to unravel addresses that have been mangled in an attempt to
- confuse spammers.</P>
-<H2><A NAME="notes"></A>5. Additional Notes on Troubleshooting</H2>
-<P>The following sections supplement the Guide:<A HREF="#system.info">
- information available on your system</A>;<A HREF="#testgates"> testing
- between security gateways</A>;<A HREF="#ifconfig1"> ifconfig reports
- for KLIPS debugging</A>;<A HREF="#gdb"> using GDB on Pluto</A>.</P>
-<H3><A NAME="system.info"></A>5.1 Information available on your system</H3>
-<H4><A NAME="logusage"></A>Logs used</H4>
-<P>Linux FreeS/WAN logs to:</P>
-<UL>
-<LI>/var/log/secure (or, on Debian, /var/log/auth.log)</LI>
-<LI>/var/log/messages</LI>
-</UL>
-<P>Check both places to get full information. If you find nothing, check
- your<VAR> syslogd.conf(5)</VAR> to see where your /etc/syslog.conf or
- equivalent is directing<VAR> authpriv</VAR> messages.</P>
-<H4><A NAME="pages"></A>man pages provided</H4>
-<DL>
-<DT><A HREF="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A></DT>
-<DD> Manual page for IPSEC configuration file.</DD>
-<DT><A HREF="manpage.d/ipsec.8.html"> ipsec(8)</A></DT>
-<DD STYLE="margin-bottom: 0.2in"> Primary man page for ipsec utilities.</DD>
-</DL>
-<P> Other man pages are on<A HREF="manpages.html"> this list</A> and in</P>
-<UL>
-<LI>/usr/local/man/man3</LI>
-<LI>/usr/local/man/man5</LI>
-<LI>/usr/local/man/man8/ipsec_*</LI>
-</UL>
-<H4><A NAME="statusinfo"></A>Status information</H4>
-<DL>
-<DT>ipsec auto --status</DT>
-<DD> Command to get status report from running system. Displays Pluto's
- state. Includes the list of connections which are currently &quot;added&quot; to
- Pluto's internal database; lists state objects reflecting ISAKMP and
- IPsec SAs being negotiated or installed.</DD>
-<DT> ipsec look</DT>
-<DD> Brief status info.</DD>
-<DT> ipsec barf</DT>
-<DD STYLE="margin-bottom: 0.2in"> Copious debugging info.</DD>
-</DL>
-<H3><A NAME="testgates"></A> 5.2 Testing between security gateways</H3>
-<P>Sometimes you need to test a subnet-subnet tunnel. This is a tunnel
- between two security gateways, which protects traffic on behalf of the
- subnets behind these gateways. On this network:</P>
-<PRE>     Sunset==========West------------------East=========Sunrise
-                     IPSec gateway         IPSec gateway
-           local net       untrusted net       local net</PRE>
-<P> you might name this tunnel sunset-sunrise. You can test this tunnel
- by having a machine behind one gateway ping a machine behind the other
- gateway, but this is not always convenient or even possible.</P>
-<P>Simply pinging one gateway from the other is not useful. Such a ping
- does not normally go through the tunnel.<STRONG> The tunnel handles
- traffic between the two protected subnets, not between the gateways</STRONG>
- . Depending on the routing in place, a ping might</P>
-<UL>
-<LI>either succeed by finding an unencrypted route</LI>
-<LI>or fail by finding no route. Packets without an IPSEC eroute are
- discarded.</LI>
-</UL>
-<P><STRONG>Neither event tells you anything about the tunnel</STRONG>.
- You can explicitly create an eroute to force such packets through the
- tunnel, or you can create additional tunnels as described in our<A HREF="config.html#multitunnel">
- configuration document</A>, but those may be unnecessary complications
- in your situation.</P>
-<P>The trick is to explicitly test between<STRONG> both gateways'
- private-side IP addresses</STRONG>. Since the private-side interfaces
- are on the protected subnets, the resulting packets do go via the
- tunnel. Use either ping -I or traceroute -i, both of which allow you to
- specify a source interface. (Note: unsupported on older Linuxes). The
- same principles apply for a road warrior (or other) case where only one
- end of your tunnel is a subnet.</P>
-<H3><A NAME="ifconfig1"></A>5.3 ifconfig reports for KLIPS debugging</H3>
-<P>When diagnosing problems using ifconfig statistics, you may wonder
- what type of activity increments a particular counter for an ipsecN
- device. Here's an index, posted by KLIPS developer Richard Guy Briggs:</P>
-<PRE>Here is a catalogue of the types of errors that can occur for which
-statistics are kept when transmitting and receiving packets via klips.
-I notice that they are not necessarily logged in the right counter.
-. . .
-
-Sources of ifconfig statistics for ipsec devices
-
-rx-errors:
-- packet handed to ipsec_rcv that is not an ipsec packet.
-- ipsec packet with payload length not modulo 4.
-- ipsec packet with bad authenticator length.
-- incoming packet with no SA.
-- replayed packet.
-- incoming authentication failed.
-- got esp packet with length not modulo 8.
-
-tx_dropped:
-- cannot process ip_options.
-- packet ttl expired.
-- packet with no eroute.
-- eroute with no SA.
-- cannot allocate sk_buff.
-- cannot allocate kernel memory.
-- sk_buff internal error.
-
-
-The standard counters are:
-
-struct enet_statistics
-{
-        int        rx_packets;                /* total packets received */
-        int        tx_packets;                /* total packets transmitted */
-        int        rx_errors;                /* bad packets received */
-        int        tx_errors;                /* packet transmit problems */
-        int        rx_dropped;                /* no space in linux buffers */
-        int        tx_dropped;                /* no space available in linux */
-        int        multicast;                /* multicast packets received */
-        int        collisions;
-
-        /* detailed rx_errors: */
-        int        rx_length_errors;
-        int        rx_over_errors;                /* receiver ring buff overflow */
-        int        rx_crc_errors;                /* recved pkt with crc error */
-        int        rx_frame_errors;        /* recv'd frame alignment error */
-        int        rx_fifo_errors;                /* recv'r fifo overrun */
-        int        rx_missed_errors;        /* receiver missed packet */
-
-        /* detailed tx_errors */
-        int        tx_aborted_errors;
-        int        tx_carrier_errors;
-        int        tx_fifo_errors;
-        int        tx_heartbeat_errors;
-        int        tx_window_errors;
-};
-
-of which I think only the first 6 are useful.</PRE>
-<H3><A NAME="gdb"></A> 5.4 Using GDB on Pluto</H3>
-<P>You may need to use the GNU debugger, gdb(1), on Pluto. This should
- be necessary only in unusual cases, for example if you encounter a
- problem which the Pluto developer cannot readily reproduce or if you
- are modifying Pluto.</P>
-<P>Here are the Pluto developer's suggestions for doing this:</P>
-<PRE>Can you get a core dump and use gdb to find out what Pluto was doing
-when it died?
-
-To get a core dump, you will have to set dumpdir to point to a
-suitable directory (see <A HREF="manpage.d/ipsec.conf.5.html">ipsec.conf(5)</A>).
-
-To get gdb to tell you interesting stuff:
-        $ script
-        $ cd dump-directory-you-chose
-        $ gdb /usr/local/lib/ipsec/pluto core
-        (gdb) where
-        (gdb) quit
-        $ exit
-
-The resulting output will have been captured by the script command in
-a file called &quot;typescript&quot;.  Send it to the list.
-
-Do not delete the core file.  I may need to ask you to print out some
-more relevant stuff.</PRE>
-<P> Note that the<VAR> dumpdir</VAR> parameter takes effect only when
- the IPsec subsystem is restarted -- reboot or ipsec setup restart.</P>
-<P>
-<BR>
-<BR></P>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="firewall.html">Previous</A>
-<A HREF="compat.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/umltesting.html b/doc/umltesting.html
deleted file mode 100644
index 35bcef96d..000000000
--- a/doc/umltesting.html
+++ /dev/null
@@ -1,313 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="roadmap.html">Previous</A>
-<A HREF="makecheck.html">Next</A>
-<HR>
-<H1><A name="umltesting">User-Mode-Linux Testing guide</A></H1>
-<P> User mode linux is a way to compile a linux kernel such that it can
- run as a process in another linux system (potentially as a *BSD or
- Windows process later). See<A HREF="http://user-mode-linux.sourceforge.net/">
- http://user-mode-linux.sourceforge.net/</A></P>
-<P> UML is a good platform for testing and experimenting with FreeS/WAN.
- It allows several network nodes to be simulated on a single machine.
- Creating, configuring, installing, monitoring, and controling these
- nodes is generally easier and easier to script with UML than real
- hardware.</P>
-<P> You'll need about 500Mb of disk space for a full
- sunrise-east-west-sunset setup. You can possibly get this down by 130Mb
- if you remove the sunrise/sunset kernel build. If you just want to run,
- then you can even remove the east/west kernel build.</P>
-<P> Nothing need be done as super user. In a couple of steps, we note
- where super user is required to install commands in system-wide
- directories, but ~/bin could be used instead. UML seems to use a
- system-wide /tmp/uml directory so different users may interfere with
- one another. Later UMLs use ~/.uml instead, so multiple users running
- UML tests should not be a problem, but note that a single user running
- the UML tests will only be able run one set. Further, UMLs sometimes
- get stuck and hang around. These &quot;zombies&quot; (most will actually be in
- the &quot;T&quot; state in the process table) will interfere with subsequent
- tests.</P>
-<H2><A NAME="34_1">Preliminary Notes on BIND</A></H2>
-<P> As of 2003/3/1, the Light-Weight Resolver is used by pluto. This
- requires that BIND9 be running. It also requires that BIND9 development
- libraries be present in the build environment. The DNSSEC code is only
- truly functional in BIND9 snapshots. The library code could be 9.2.2,
- we believe. We are using BIND9 20021115 snapshot code from<A HREF="ftp://ftp.isc.org/isc/bind9/snapshots">
- ftp://ftp.isc.org/isc/bind9/snapshots</A>.</P>
-<P> FreeS/WAN may well require a newer BIND than is on your system. Many
- distributions have moved to BIND9.2.2 recently due to a security
- advisory. BIND is five components.</P>
-<OL>
-<LI> named</LI>
-<LI> dnssec-*</LI>
-<LI> client side resolver libraries</LI>
-<LI> client side utility libraries I thought there were lib and named
- parts to dnsssec...</LI>
-<LI> dynamic DNS update utilities</LI>
-</OL>
-<P> The only piece that we need for *building* is #4. That's the only
- part that has to be on the build host. What is the difference between
- resolver and util libs? If you want to edit
- testing/baseconfigs/all/etc/bind, you'll need a snapshot version. The
- resolver library contains the resolver. FreeS/WAN has its own copy of
- that in lib/liblwres.</P>
-<H2><A NAME="34_2">Steps to Install UML for FreeS/WAN</A></H2>
-<OL>
-<LI> Get the following files:
-<OL type="a">
-<LI> from<A HREF="http://www.sandelman.ottawa.on.ca/freeswan/uml/">
- http://www.sandelman.ottawa.on.ca/freeswan/uml/</A>
- umlfreeroot-15.1.tar.gz (or highest numbered one). This is a debian
- potato root file system. You can use this even on a Redhat host, as it
- has the newer GLIBC2.2 libraries as well.
-<!-- If you are using
-  Redhat 7.2 or newer as your development machine, you can create the
-  image from your installation media. See <A HREF="uml-rhroot.html">Building a RedHat root"></A>.
-  A future document will explain how to build this from .DEB files as well.
--->
-
-<!--
-<LI> umlfreesharemini.tar.gz    (or umlfreeshareall.tar.gz). 
-  If you are a Debian potato user, you don't need it you can use your
-  native /usr/share.
-</UL>
--->
-</LI>
-<LI> From<A HREF="ftp://ftp.xs4all.nl/pub/crypto/freeswan/">
- ftp://ftp.xs4all.nl/pub/crypto/freeswan/</A> a snapshot or release
- (1.92 or better)</LI>
-<LI> From a<A HREF="http://www.kernel.org/mirrors/">
- http://www.kernel.org mirror</A>, the virgin 2.4.19 kernel. Please
- realize that we have defaults in our tree for kernel configuration. We
- try to track the latest UML kernels. If you use a newer kernel, you may
- have faults in the kernel build process. You can see what the latest
- that is being regularly tested by visiting<A HREF="http://bugs.freeswan.org:81/regress/HEAD/lastgood/freeswan-regress-env.sh">
- freeswan-regress-env.sh</A>.</LI>
-<LI>
-<!-- Note: this step is refered to as "step 1d" below. -->
- Get<A HREF="http://ftp.nl.linux.org/uml/">
- http://ftp.nl.linux.org/uml/</A> uml-patch-2.4.19-47.bz2 or the one
- associated with your kernel. As of 2003/03/05, uml-patch-2.4.19-47.bz2
- works for us.<STRONG> More recent versions of the patch have not been
- tested by us.</STRONG></LI>
-<LI> You'll probably want to visit<A HREF="http://user-mode-linux.sourceforge.net">
- http://user-mode-linux.sourceforge.net</A> and get the UML utilities.
- These are not needed for the build or interactive use (but
- recommended). They are necessary for the regression testing procedures
- used by &quot;make check&quot;. We currently use uml_utilities_20020212.tar.bz2.</LI>
-<LI> You need tcpdump version 3.7.1 or better. This is newer than the
- version included in most LINUX distributions. You can check the version
- of an installed tcpdump with the --version flag. If you need a newer
- tcpdump fetch both tcpdump and libpcap source tar files from<A HREF="http://www.tcpdump.org/">
- http://www.tcpdump.org/</A> or a mirror.</LI>
-</OL>
-</LI>
-<LI> Pick a suitable place, and extract the following files:
-<OL type="a">
-<LI>
-<!-- Note: this step is refered to as "step 2a" later. -->
- 2.4.19 kernel. For instance:
-<PRE>
- <CODE>           cd /c2/kernel
-           tar xzvf ../download/pub/linux/kernel/v2.4/linux-2.4.19.tar.gz
-</CODE>
-</PRE>
-</LI>
-<LI> extract the umlfreeroot file
-<!-- (unless you <A HREF="uml-rhroot.html">built your own from RPMs</A>) -->
-
-<PRE>
- <CODE>           mkdir -p /c2/user-mode-linux/basic-root
-           cd /c2/user-mode-linux/basic-root
-           tar xzvf ../download/umlfreeroot-15.1.tar.gz
-</CODE>
-</PRE>
-</LI>
-<LI> FreeSWAN itself (or checkout &quot;all&quot; from CVS)
-<PRE>
- <CODE>           mkdir -p /c2/freeswan/sandbox
-           cd /c2/freeswan/sandbox
-           tar xzvf ../download/snapshot.tar.gz
-</CODE>
-</PRE>
-</LI>
-</OL>
-</LI>
-<LI> If you need to build a newer tcpdump:
-<UL>
-<LI> Make sure you have OpenSSL installed -- it is needed for
- cryptographic routines.</LI>
-<LI> Unpack libpcap and tcpdump source in parallel directories (the
- tcpdump build procedures look for libpcap next door).</LI>
-<LI> Change directory into the libpcap source directory and then build
- the library:
-<PRE>
- <CODE>	./configure
-	make
-</CODE>
-</PRE>
-</LI>
-<LI> Change into the tcpdump source directory, build tcpdump, and
- install it.
-<PRE>
- <CODE>	./configure
-	make
-	# Need to be superuser to install in system directories.
-	# Installing in ~/bin would be an alternative.
-	su -c &quot;make install&quot;
-</CODE>
-</PRE>
-</LI>
-</UL>
-</LI>
-<LI> If you need the uml utilities, unpack them somewhere then build and
- install them:
-<PRE>
- <CODE>	cd tools
-	make all
-	# Need to be superuser to install in system directories.
-	# Installing in ~/bin would be an alternative.
-	su -c &quot;make install BIN_DIR=/usr/local/bin&quot;
-</CODE>
-</PRE>
-</LI>
-<LI> set up the configuration file
-<UL>
-<LI> <CODE>cd /c2/freeswan/sandbox/freeswan-1.97/testing/utils</CODE></LI>
-<LI> copy umlsetup-sample.sh to ../../umlsetup.sh: <CODE> cp
- umlsetup-sample.sh ../../umlsetup.sh</CODE></LI>
-<LI> open up ../../umlsetup.sh in your favorite editor.</LI>
-<LI> change POOLSPACE= to point to the place with at least 500Mb of
- disk. Best if it is on the same partition as the &quot;umlfreeroot&quot;
- extraction, as it will attempt to use hard links if possible to save
- disk space.</LI>
-<LI> Set TESTINGROOT if you intend to run the script outside of the
- sandbox/snapshot/release directory. Otherwise, it will configure
- itself.</LI>
-<LI> KERNPOOL should point to the directory with your 2.4.19 kernel
- tree. This tree should be unconfigured! This is the directory you used
- in step 2a.</LI>
-<LI> UMLPATCH should point at the bz2 file you downloaded at 1d. If
- using a kernel that already includes the patch, set this to /dev/null.</LI>
-<LI> FREESWANDIR should point at the directory where you unpacked the
- snapshot/release. Include the &quot;freeswan-snap2001sep16b&quot; or whatever in
- it. If you are running from CVS, then you point at the directory where
- top, klips, etc. are. The script will fix up the directory so that it
- can be used.</LI>
-<LI> BASICROOT should be set to the directory used in 2b, or to the
- directory that you created with RPMs.</LI>
-<LI> SHAREDIR should be set to the directory used in 2c, to /usr/share
- for Debian potato users, or to $BASICROOT/usr/share.</LI>
-</UL>
-</LI>
-<LI>
-<PRE> <CODE>cd $TESTINGROOT/utils
-sh make-uml.sh
-</CODE></PRE>
- It will grind for awhile. If there are errors it will bail. If so, run
- it under &quot;script&quot; and send the output to bugs@lists.freeswan.org.</LI>
-<LI> You will have a bunch of stuff under $POOLSPACE. Open four xterms:
-<PRE> <CODE>    for i in sunrise sunset east west
-    do
-        xterm -name $i -title $i -e $POOLSPACE/$i/start.sh     done
-</CODE></PRE>
-</LI>
-<LI> Login as root. Password is &quot;root&quot; (Note, these virtual machines are
- networked together, but are not configured to talk to the rest of the
- world.)</LI>
-<LI> verify that pluto started on east/west, run &quot;ipsec look&quot;</LI>
-<LI> login to sunrise. run &quot;ping sunset&quot;</LI>
-<LI> login to west. run &quot;tcpdump -p -i eth1 -n&quot; (tcpdump must be version
- 3.7.1 or newer)</LI>
-<LI> Closing a console xterm will shut down that UML.</LI>
-<LI> You can &quot;make check&quot;, if you want to. It is run from
- /c2/freeswan/sandbox/freeswan-1.97.</LI>
-</OL>
-<H1><A NAME="35">Debugging the kernel with GDB</A></H1>
-<P> With User-Mode-Linux, you can debug the kernel using GDB. See
-<!--HREF="http://user-mode-linux.sourceforge.net/debugging.html"-->
-
- http://user-mode-linux.sourceforge.net/debugging.html.</(null)></P>
-<P> Typically, one will want to address a test case for a failing
- situation. Running GDB from Emacs, or from other front ends is
- possible. First start GDB.</P>
-<P> Tell it to open the UMLPOOL/swan/linux program.</P>
-<P> Note the PID of GDB:</P>
-<PRE>
-marajade-[projects/freeswan/mgmt/planning] mcr 1029 %ps ax | grep gdb
- 1659 pts/9    SN     0:00 /usr/bin/gdb -fullname -cd /mara4/freeswan/kernpatch/UMLPOOL/swan/ linux
-</PRE>
-<P> Set the following in the environment:</P>
-<PRE>
-UML_east_OPT=&quot;debug gdb-pid=1659&quot;
-</PRE>
-<P> Then start the user-mode-linux in the test scheme you wish:</P>
-<PRE>
-marajade-[kernpatch/testing/klips/east-icmp-02] mcr 1220 %../../utils/runme.sh
-</PRE>
- The user-mode-linux will stop on boot, giving you a chance to attach to
- the process:
-<PRE>
-(gdb) file linux
-Reading symbols from linux...done.
-(gdb) attach 1
-Attaching to program: /mara4/freeswan/kernpatch/UMLPOOL/swan/linux, process 1
-0xa0118bc1 in kill () at hostfs_kern.c:770
-</PRE>
-<P> At this point, break points should be created as appropriate.</P>
-<H2><A NAME="35_1">Other notes about debugging</A></H2>
-<P> If you are running a standard test, after all the packets are sent,
- the UML will be shutdown. This can cause problems, because the UML may
- get terminated while you are debugging.</P>
-<P> The environment variable <CODE>NETJIGWAITUSER</CODE> can be set to
- &quot;waituser&quot;. If so, then the testing system will prompt before exiting
- the test.</P>
-<H1><A NAME="36">User-Mode-Linux mysteries</A></H1>
-<UL>
-<LI> running more than one UML of the same name (e.g. &quot;west&quot;) can cause
- problems.</LI>
-<LI> running more than one UML from the same root file system is not a
- good idea.</LI>
-<LI> all this means that running &quot;make check&quot; twice on the same machine
- is probably not a good idea.</LI>
-<LI> occationally, UMLs will get stuck. This can happen like:
-<!--BLOCK-->
- 15134 ? T
- 0:00 /spare/hugh/uml/uml2.4.18-sept5/umlbuild/east/linux (east)
- [/bin/sh] 15138 ? T 0:00
- /spare/hugh/uml/uml2.4.18-sept5/umlbuild/east/linux (east) [halt]</(null)>
- these will need to be killed. Note that they are in &quot;T&quot;racing mode.</LI>
-<LI> UMLs can also hang, and will report &quot;Tracing myself and I can't get
- out&quot;. This is a bug in UML. There are ways to find out what is going on
- and report this to the UML people, but we don't know the magic right
- now.</LI>
-</UL>
-<H1><A NAME="37">Getting more info from uml_netjig</A></H1>
-<P> uml_netjig can be compiled with a built-in tcpdump. This uses
- not-yet-released code from<A HREF="http://www.tcpdump.org/">
- www.tcpdump.org</A>. Please see the instructions in <CODE>
-testing/utils/uml_netjig/Makefile</CODE>.</P>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="roadmap.html">Previous</A>
-<A HREF="makecheck.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/upgrading.html b/doc/upgrading.html
deleted file mode 100644
index ce9fba3d2..000000000
--- a/doc/upgrading.html
+++ /dev/null
@@ -1,184 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="intro.html">Previous</A>
-<A HREF="quickstart.html">Next</A>
-<HR>
-<A NAME="upgrading"></A>
-<H1><A NAME="2">Upgrading to FreeS/WAN 2.x</A></H1>
-<H2><A NAME="2_1">New! Built in Opportunistic connections</A></H2>
-<P>Out of the box, FreeS/WAN 2.x will attempt to encrypt all your IP
- traffic. It will try to establish IPsec connections for:</P>
-<UL>
-<LI> IP traffic from the Linux box on which you have installed
- FreeS/WAN, and</LI>
-<LI> outbound IP traffic routed through that Linux box (eg. from a
- protected subnet).</LI>
-</UL>
-<P>FreeS/WAN 2.x uses<STRONG> hidden, automatically enabled<VAR>
- ipsec.conf</VAR> connections</STRONG> to do this.</P>
-<P>This behaviour is part of our campaign to get Opportunistic
- Encryption (OE) widespread in the Linux world, so that any two Linux
- boxes can encrypt to one another without prearrangement. There's one
- catch, however: you must<A HREF="quickstart.html#quickstart"> set up a
- few DNS records</A> to distribute RSA public keys and (if applicable)
- IPsec gateway information.</P>
-<P>If you start FreeS/WAN before you have set up these DNS records, your
- connectivity will be slow, and messages relating to the built in
- connections will clutter your logs. If you are unable to set up DNS for
- OE, you will wish to<A HREF="policygroups.html#disable_policygroups">
- disable the hidden connections</A>.</P>
-<A NAME="upgrading.flagday"></A>
-<H3><A NAME="2_1_1">Upgrading Opportunistic Encryption to 2.01 (or
- later)</A></H3>
-<P>As of FreeS/WAN 2.01, Opportunistic Encryption (OE) uses DNS TXT
- resource records (RRs) only (rather than TXT with KEY). This change
- causes a &quot;flag day&quot;. Users of FreeS/WAN 2.00 (or earlier) OE who are
- upgrading may need to post additional resource records.</P>
-<P>If you are running<A HREF="glossary.html#initiate-only">
- initiate-only OE</A>, you<EM> must</EM> put up a TXT record in any
- forward domain as per our<A HREF="quickstart.html#opp.client">
- quickstart instructions</A>. This replaces your old forward KEY.</P>
-<P> If you are running full OE, you require no updates. You already have
- the needed TXT record in the reverse domain. However, to facilitate
- future features, you may also wish to publish that TXT record in a
- forward domain as instructed<A HREF="quickstart.html#opp.incoming">
- here</A>.</P>
-<P>If you are running OE on a gateway (and encrypting on behalf of
- subnetted boxes) you require no updates. You already have the required
- TXT record in your gateway's reverse map, and the TXT records for any
- subnetted boxes require no updating. However, to facilitate future
- features, you may wish to publish your gateway's TXT record in a
- forward domain as shown<A HREF="quickstart.html#opp.incoming"> here</A>
-.</P>
-<P> During the transition, you may wish to leave any old KEY records up
- for some time. They will provide limited backward compatibility.
-<!--
-For more
-detail on that compatibility, see <A HREF="oe.known-issues">Known Issues with
-OE</A>.
--->
-</P>
-<H2><A NAME="2_2">New! Policy Groups</A></H2>
-<P>We want to make it easy for you to declare security policy as it
- applies to IPsec connections.</P>
-<P>Policy Groups make it simple to say:</P>
-<UL>
-<LI>These are the folks I want to talk to in the clear.</LI>
-<LI>These spammers' domains -- I don't want to talk to them at all.</LI>
-<LI>To talk to the finance department, I must use IPsec.</LI>
-<LI>For any other communication, try to encrypt, but it's okay if we
- can't.</LI>
-</UL>
-<P>FreeS/WAN then implements these policies, creating OE connections if
- and when needed. You can use Policy Groups along with connections you
- explicitly define in ipsec.conf.</P>
-<P>For more information, see our<A HREF="policygroups.html"> Policy
- Group HOWTO</A>.</P>
-<H2><A NAME="2_3">New! Packetdefault Connection</A></H2>
-<P>Free/SWAN 2.x ships with the<STRONG> automatically enabled, hidden
- connection</STRONG><VAR> packetdefault</VAR>. This configures a
- FreeS/WAN box as an OE gateway for any hosts located behind it. As
- mentioned above, you must configure some<A HREF="quickstart.html"> DNS
- records</A> for OE to work.</P>
-<P>As the name implies, this connection functions as a default. If you
- have more specific connections, such as policy groups which configure
- your FreeS/WAN box as an OE gateway for a local subnet, these will
- apply before<VAR> packetdefault</VAR>. You can view<VAR> packetdefault</VAR>
-'s specifics in<A HREF="manpage.d/ipsec.conf.5.html"> man ipsec.conf</A>
-.</P>
-<H2><A NAME="2_4">FreeS/WAN now disables Reverse Path Filtering</A></H2>
-<P>FreeS/WAN often doesn't work with reverse path filtering. At start
- time, FreeS/WAN now turns rp_filter off, and logs a warning.</P>
-<P>FreeS/WAN does not turn it back on again. You can do this yourself
- with a command like:</P>
-<PRE>   echo 1 &gt; /proc/sys/net/ipv4/conf/eth0/rp_filter</PRE>
-<P>For eth0, substitute the interface which FreeS/WAN was affecting.</P>
-<A NAME="ipsec.conf_v2"></A>
-<H2><A NAME="2_5">Revised<VAR> ipsec.conf</VAR></A></H2>
-<H3><A NAME="2_5_1">No promise of compatibility</A></H3>
-<P>The FreeS/WAN team promised config-file compatibility throughout the
- 1.x series. That means a 1.5 config file can be directly imported into
- a fresh 1.99 install with no problems.</P>
-<P>With FreeS/WAN 2.x, we've given ourselves permission to make the
- config file easier to use. The cost: some FreeS/WAN 1.x configurations
- will not work properly. Many of the new features are, however, backward
- compatible.</P>
-<H3><A NAME="2_5_2">Most<VAR> ipsec.conf</VAR> files will work fine</A></H3>
-<P>... so long as you paste this line,<STRONG> with no preceding
- whitespace</STRONG>, at the top of your config file:</P>
-<PRE>    version 2</PRE>
-<H3><A NAME="2_5_3">Backward compatibility patch</A></H3>
-<P>If the new defaults bite you, use<A HREF="ipsec.conf.2_to_1"> this<VAR>
- ipsec.conf</VAR> fragment</A> to simulate the old default values.</P>
-<H3><A NAME="2_5_4">Details</A></H3>
-<P> We've obsoleted various directives which almost no one was using:</P>
-<PRE>    dump
-    plutobackgroundload
-    no_eroute_pass
-    lifetime
-    rekeystart
-    rekeytries</PRE>
-<P>For most of these, there is some other way to elicit the desired
- behaviour. See<A HREF="http://lists.freeswan.org/pipermail/design/2002-August/003243.html">
- this post</A>.</P>
-<P> We've made some settings, which almost everyone was using, defaults.
- For example:</P>
-<PRE>    interfaces=%defaultroute
-    plutoload=%search
-    plutostart=%search
-    uniqueids=yes</PRE>
-<P>We've also changed some default values to help with OE and Policy
- Groups:</P>
-<PRE>    authby=rsasig   ## not secret!!!
-    leftrsasigkey=%dnsondemand ## looks up missing keys in DNS when needed.
-    rightrsasigkey=%dnsondemand</PRE>
-<P> Of course, you can still override any defaults by explictly
- declaring something else in your connection.</P>
-<P><A HREF="http://lists.freeswan.org/pipermail/design/2002-August/003243.html">
- A post with a list of many ipsec.conf changes.</A>
-<BR><A HREF="manpage.d/ipsec.conf.5.html"> Current ipsec.conf manual.</A>
-</P>
-<A NAME="upgrading.rpms"></A>
-<H3><A NAME="2_5_5">Upgrading from 1.x RPMs to 2.x RPMs</A></H3>
-<P>Note: When upgrading from 1-series to 2-series RPMs,<VAR> rpm -U</VAR>
- will not work.</P>
-<P>You must instead erase the 1.x RPMs, then install the 2.x set:</P>
-<PRE>    rpm -e freeswan</PRE>
-<PRE>    rpm -e freeswan-module</PRE>
-<P>On erasing, your old<VAR> ipsec.conf</VAR> should be moved to<VAR>
- ipsec.conf.rpmsave</VAR>. Keep this. You will probably want to copy
- your existing connections to the end of your new 2.x file.</P>
-<P>Install the RPMs suitable for your kernel version, such as:</P>
-<PRE>    rpm -ivh freeswan-module-2.04_2.4.20_20.9-0.i386.rpm</PRE>
-<PRE>    rpm -ivh freeswan-userland-2.04_2.4.20_20.9-0.i386.rpm</PRE>
-<P>Or, to splice the files:</P>
-<PRE>    cat /etc/ipsec.conf /etc/ipsec.conf.rpmsave &gt; /etc/ipsec.conf.tmp
-    mv /etc/ipsec.conf.tmp /etc/ipsec.conf</PRE>
-<P>Then, remove the redundant<VAR> conn %default</VAR> and<VAR> config
- setup</VAR> sections. Unless you have done any special configuring
- here, you'll likely want to remove the 1.x versions. Remove<VAR> conn
- OEself</VAR>, if present.</P>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="intro.html">Previous</A>
-<A HREF="quickstart.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/user_examples.html b/doc/user_examples.html
deleted file mode 100644
index d683c92e1..000000000
--- a/doc/user_examples.html
+++ /dev/null
@@ -1,320 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="background.html">Previous</A>
-<A HREF="makecheck.html">Next</A>
-<HR>
-<H1><A name="user.examples">FreeS/WAN script examples</A></H1>
- This file is intended to hold a collection of user-written example
- scripts or configuration files for use with FreeS/WAN.
-<P> So far it has only one entry.</P>
-<H2><A name="poltorak">Poltorak's Firewall script</A></H2>
-<PRE>
-From: Poltorak Serguei &lt;poltorak@dataforce.net&gt;
-Subject: [Users] Using FreeS/WAN
-Date: Tue, 16 Oct 2001
-
-Hello.
-
-I'm using FreeS/WAN IPsec for half a year. I learned a lot of things about
-it and I think it would be interesting for someone to see the result of my
-experiments and usage of FreeS/WAN. If you find a mistake in this
-file, please e-mail me. And excuse me for my english... I'm learning.. :)
-
-I'll talk about vary simple configuration:
-
-addresses prefix = 192.168
-
-    lan1          sgw1     .0.0/24 (Internet)       sgw2            lan2
-  .1.0/24---[ .1.1 ; .0.1 ]===================[ .0.10 ; . 2.10 ]---.2.0/24
-
-
-We need to let lan1 see lan2 across Internet like it is behind sgw1. The
-same for lan2. And we need to do IPX bridge for Novel Clients and NDS
-synchronization.
-
-my config:
-------------------- ipsec.conf -------------------
-conn lan1-lan2
-        type=tunnel
-        compress=yes
-        #-------------------
-        left=192.168.0.1
-        leftsubnet=192.168.1.0/24
-        #-------------------
-        right=192.168.0.10
-        rightsubnet=192.168.2.0/24
-        #-------------------
-        auth=esp
-        authby=secret
---------------- end of ipsec.conf ----------------
-
-ping .2.x from .1.y   (y != 1)
-It works?? Fine. Let's continue...
-
-Why y != 1 ?? Because kernel of sgw1 have 2 IP addresses and it will choose
-the first IP (which is used to go to Internet) .0.1 and the packet won't go
-through IPsec tunnel :(  But if do ping on .1.1 kernel will respond from
-that address (.1.1) and the packet will be tunneled. The same problem occurred then
-.2.x sends a packet to .1.2 which is down at the moment. What happens? .1.1
-sends ARP requesting .1.2... after 3 tries it send to .2.x an destunreach,
-but from his &quot;natural&quot; IP or .0.1 . So the error message won't be delivered!
-It's a big problem...
-
-Resolution... One can manipulate with ipsec0 or ipsec0:0 to solve the
-problem (if ipsec0 has .1.1 kernel will send packets correctly), but there
-are powerful and elegant iproute2 :) We simply need to change source address
-of packet that goes to other secure lan. This is done with
-
-ip route replace 192.168.2.0/24 via 192.168.0.10 dev ipsec0 src 192.168.1.1
-
-Cool!! Now it works!!
-
-The second step. We want install firewall on sgw1 and sgw2. Encryption of 
-traffic without security isn't a good idea. I don't use {left|right}firewall, 
-because I'm running firewall from init scripts.
-
-We want IPsec data between lan1-lan2, some ICMP errors (destination
-unreachable, TTL exceeded, parameter problem and source quench), replying on 
-pings from both lans and Internet, ipxtunnel data for IPX and of course SSH
-between sgw1 and sgw2 and from/to one specified host.
-
-I'm using ipchains. With iptables there are some changes.
-
----------------- rc.firewall ---------------------
-#!/bin/sh
-#
-# Firewall for IPsec lan1-lan2
-#
-
-IPC=/sbin/ipchains
-ANY=0.0.0.0/0
-
-# left
-SGW1_EXT=192.168.0.1
-SGW1_INT=192.168.1.1
-LAN1=192.168.1.0/24
-
-# right
-SGW2_EXT=192.168.0.10
-SGW2_INT=192.168.2.10
-LAN2=192.168.2.0/24
-
-# SSH from and to this host
-SSH_PEER_HOST=_SOME_HOST_
-
-# this is for left. exchange these values for right.
-MY_EXT=$SGW1_EXT
-MY_INT=$SGW1_INT
-PEER_EXT=$SGW2_EXT
-PEER_INT=$SGW2_INT
-INT_IF=eth1
-EXT_IF=eth0
-IPSEC_IF=ipsec0
-MY_LAN=$LAN1
-PEER_LAN=$LAN2
-
-$IPC -F
-$IPC -P input DENY
-$IPC -P forward DENY
-$IPC -P output DENY
-
-# Loopback traffic
-$IPC -A input -i lo -j ACCEPT
-$IPC -A output -i lo -j ACCEPT
-
-# for IPsec SGW1-SGW2
-## IKE
-$IPC -A input -p udp -s $PEER_EXT 500 -d $MY_EXT 500 -i $EXT_IF -j ACCEPT
-$IPC -A output -p udp -s $MY_EXT 500 -d $PEER_EXT 500 -i $EXT_IF -j ACCEPT
-## ESP
-$IPC -A input -p 50 -s $PEER_EXT -d $MY_EXT -i $EXT_IF -j ACCEPT
-### we don't need this line ### $IPC -A output -p 50 -s $MY_EXT -d $PEER_EXT -i $EXT_IF -j ACCEPT
-## forward LAN1-LAN2
-$IPC -A forward -s $MY_LAN -d $PEER_LAN -i $IPSEC_IF -j ACCEPT
-$IPC -A forward -s $PEER_LAN -d $MY_LAN -i $INT_IF -j ACCEPT
-$IPC -A output -s $PEER_LAN -d $MY_LAN -i $INT_IF -j ACCEPT
-$IPC -A input -s $PEER_LAN -d $MY_LAN -i $IPSEC_IF -j ACCEPT
-$IPC -A input -s $MY_LAN -d $PEER_LAN -i $INT_IF -j ACCEPT
-$IPC -A output -s $MY_LAN -d $PEER_LAN -i $IPSEC_IF -j ACCEPT
-
-# ICMP
-#
-## Dest unreachable
-### from/to Internet
-$IPC -A input -p icmp --icmp-type destination-unreachable -s $ANY -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type destination-unreachable -s $MY_EXT -d $ANY -i $EXT_IF -j ACCEPT
-### from/to Lan
-$IPC -A input -p icmp --icmp-type destination-unreachable -s $ANY -d $MY_INT -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type destination-unreachable -s $MY_INT -d $ANY -i $INT_IF -j ACCEPT
-### from/to Peer Lan
-$IPC -A input -p icmp --icmp-type destination-unreachable -s $ANY -d $MY_INT -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type destination-unreachable -s $MY_INT -d $ANY -i $IPSEC_IF -j ACCEPT
-#
-## Source quench
-### from/to Internet
-$IPC -A input -p icmp --icmp-type source-quench -s $ANY -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type source-quench -s $MY_EXT -d $ANY -i $EXT_IF -j ACCEPT
-### from/to Lan
-$IPC -A input -p icmp --icmp-type source-quench -s $ANY -d $MY_INT -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type source-quench -s $MY_INT -d $ANY -i $INT_IF -j ACCEPT
-### from/to Peer Lan
-$IPC -A input -p icmp --icmp-type source-quench -s $ANY -d $MY_INT -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type source-quench -s $MY_INT -d $ANY -i $IPSEC_IF -j ACCEPT
-#
-## Parameter problem
-### from/to Internet
-$IPC -A input -p icmp --icmp-type parameter-problem -s $ANY -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type parameter-problem -s $MY_EXT -d $ANY -i $EXT_IF -j ACCEPT
-### from/to Lan
-$IPC -A input -p icmp --icmp-type parameter-problem -s $ANY -d $MY_INT -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type parameter-problem -s $MY_INT -d $ANY -i $INT_IF -j ACCEPT
-### from/to Peer Lan
-$IPC -A input -p icmp --icmp-type parameter-problem -s $ANY -d $MY_INT -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type parameter-problem -s $MY_INT -d $ANY -i $IPSEC_IF -j ACCEPT
-#
-## Time To Live exceeded
-### from/to Internet
-$IPC -A input -p icmp --icmp-type time-exceeded -s $ANY -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type time-exceeded -s $MY_EXT -d $ANY -i $EXT_IF -j ACCEPT
-### to Lan
-$IPC -A input -p icmp --icmp-type time-exceeded -s $ANY -d $MY_INT -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type time-exceeded -s $MY_INT -d $ANY -i $INT_IF -j ACCEPT
-### to Peer Lan
-$IPC -A input -p icmp --icmp-type time-exceeded -s $ANY -d $MY_INT -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp --icmp-type time-exceeded -s $MY_INT -d $ANY -i $IPSEC_IF -j ACCEPT
-
-# ICMP PINGs
-## from Internet
-$IPC -A input -p icmp -s $ANY -d $MY_EXT --icmp-type echo-request  -i $EXT_IF -j ACCEPT
-$IPC -A output -p icmp -s $MY_EXT -d $ANY --icmp-type echo-reply  -i $EXT_IF -j ACCEPT
-## from LAN
-$IPC -A input -p icmp -s $ANY -d $MY_INT --icmp-type echo-request -i $INT_IF -j ACCEPT
-$IPC -A output -p icmp -s $MY_INT -d $ANY --icmp-type echo-reply  -i $INT_IF -j ACCEPT
-## from Peer LAN
-$IPC -A input -p icmp -s $ANY -d $MY_INT --icmp-type echo-request -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p icmp -s $MY_INT -d $ANY --icmp-type echo-reply  -i $IPSEC_IF -j ACCEPT
-
-# SSH
-## from SSH_PEER_HOST
-$IPC -A input -p tcp -s $SSH_PEER_HOST -d $MY_EXT 22 -i $EXT_IF -j ACCEPT
-$IPC -A output -p tcp \! -y -s $MY_EXT 22 -d $SSH_PEER_HOST -i $EXT_IF -j ACCEPT
-## to SSH_PEER_HOST
-$IPC -A input -p tcp \! -y -s $SSH_PEER_HOST 22 -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p tcp -s $MY_EXT -d $SSH_PEER_HOST 22 -i $EXT_IF -j ACCEPT
-## from PEER
-$IPC -A input -p tcp -s $PEER_EXT -d $MY_EXT 22 -i $EXT_IF -j ACCEPT
-$IPC -A output -p tcp \! -y -s $MY_EXT 22 -d $PEER_EXT -i $EXT_IF -j ACCEPT
-## to PEER
-$IPC -A input -p tcp \! -y -s $PEER_EXT 22 -d $MY_EXT -i $EXT_IF -j ACCEPT
-$IPC -A output -p tcp -s $MY_EXT -d $PEER_EXT 22 -i $EXT_IF -j ACCEPT
-
-# ipxtunnel
-$IPC -A input -p udp -s $PEER_INT 2005 -d $MY_INT 2005 -i $IPSEC_IF -j ACCEPT
-$IPC -A output -p udp -s $MY_INT 2005 -d $PEER_INT 2005 -i $IPSEC_IF -j ACCEPT
-
----------------- end of rc.firewall ----------------------
-
-To understand this we need to look on this scheme:
-
-           ++-----------------------&lt;----------------------------+
-           || ipsec0                                             |
-           \/                                                    |
- eth0  +--------+    /---------/ yes  /---------/ yes +-----------------------+
-------&gt;| INPUT  |--&gt;/ ?local? /-----&gt;/ ?IPsec? /-----&gt;| decrypt decapsulate |
- eth1  +--------+  /---------/      /---------/       +-----------------------+
-                       || no            || no
-                       \/               \/
-                  +----------+      +---------+        +-------+
-                  | routing  |      |  local  |        | local |
-                  | decision |      | deliver |        | send  |
-                  +----------+      +---------+        +-------+
-                       ||                                 ||
-                       \/                                 \/
-                   +---------+                       +----------+
-                   | forward |                       | routing  |
-                   +---------+                       | decision |
-                       ||                            +----------+
-                       ||                                  ||
-                       ++----------------&lt;-----------------++
-                       ||
-                       \/
-                   +--------+ eth0
-                   | OUTPUT | eth1
-                   +--------+ ipsec0
-                       ||
-                       \/
-                   /---------/ yes +-----------------------+
-                  / ?IPsec? /-----&gt;| encrypt encapsulate |
-                 /---------/       +-----------------------+
-                      || no                    ||
-                      ||                       ||
-                      ||                       \/   eth0, eth1
-                      ++-----------------------++--------------&gt;
-
-This explain how a packet traverse TCP/IP stack in IPsec capable kernel.
-
-FIX ME, please, if there are any errors
-
-Test the new firewall now.
-
-
-Now about IPX. I tried 3 programs for tunneling IPX: tipxd, SIB and ipxtunnel
-
-tipxd didn't send packets.. :(
-SIB and ipxtunnel worked fine :)
-With ipxtunnel there was a little problem. In sources there are an error.
-
---------------------- in main.c ------------------------
-&lt;       bytes += p.len;
----
-&gt;       bytes += len;
---------------------------------------------------------
-
-After this FIX everything goes right...
-
-------------------- /etc/ipxtunnel.conf ----------------
-port    2005
-remote  192.168.101.97    2005
-interface eth1
---------------- end of /etc/ipxtunnel.conf -------------
-
-I use IPX tunnel between .1.1 and .2.10 so we don't need to encrypt nor
-authenticate encapsulated IPX packets, it is done with IPsec.
-
-If you don't wont to use iproute2 to change source IP you need to use SIB
-(it is able to bind local address) or establish tunnel between .0.1 and
-.0.10 (external IPs, you need to do encryption in the program, but it isn't
-strong).
-
-For now I'm using ipxtunnel.
-
-I think that's all for the moment. If there are any error, please e-mail me: 
-poltorak@df.ru . It would be cool if someone puts the scheme of TCP/IP in
-kernel and firewall example on FreeS/WAN's manual pages.
-
-PoltoS
-</PRE>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="background.html">Previous</A>
-<A HREF="makecheck.html">Next</A>
-</BODY>
-</HTML>
diff --git a/doc/utils/cleanhtml.sed b/doc/utils/cleanhtml.sed
deleted file mode 100644
index 59d3866b8..000000000
--- a/doc/utils/cleanhtml.sed
+++ /dev/null
@@ -1 +0,0 @@
-/<STYLE>/,/<\/STYLE>/d
diff --git a/doc/utils/cleanhtml.sh b/doc/utils/cleanhtml.sh
deleted file mode 100755
index a3ea2afac..000000000
--- a/doc/utils/cleanhtml.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-# script to clean up HTML files
-# removes formatting added by htmldoc
-#
-# first argument is sedscript to use
-f=$1
-shift
-# remaining args are files to process
-for i
-do
-	sed -f $f $i > tmp
-	mv tmp $i
-done
diff --git a/doc/utils/contents.awk b/doc/utils/contents.awk
deleted file mode 100644
index 5cc07f246..000000000
--- a/doc/utils/contents.awk
+++ /dev/null
@@ -1,109 +0,0 @@
-# table-of-contents extractor
-# Copyright (C) 1999  Sandy Harris.
-# 
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
-# 
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-# for more details.
-#
-# RCSID $Id: contents.awk,v 1.1 2004/03/15 20:35:24 as Exp $
-BEGIN	{
-	# initialise indent counter
-	indent = 0
-	# define variables for section breaks
-	b0 = "==================================================="
-	b1 = "---------------------------------------------------"
-	b2 = "\t------------------------------------------"
-	# TURN OFF HTML formatting
-	print "<html>"
-	print "<body>"
-	print "<pre>"
-	# print a header
-	blurb() 
-	print "Section headings printed, indentation shows structure"
-}
-# start of new file
-FNR == 1 {
-	print b0
-	print "HTML file: " "<a href=\"" FILENAME "\">" FILENAME "</a>"
-	print b1
-}
-# print header lines
-# actual printing is done by tagged() function
-# which adds tag if last line was <a name=...>
-$0 ~/<h1>/	{
-	text = $0
-	tabs = ""
-	gsub(/.*<h1>/, "", text)
-	gsub(/<\/h1>/, "", text)
-	tagged( text )
-}
-$0 ~/<h2>/	{
-	text = $0
-	tabs = "\t"
-	gsub(/.*<h2>/, "", text)
-	gsub(/<\/h2>/, "", text)
-	tagged(text)
-}
-$0 ~/<h3>/	{
-	text = $0
-	tabs = "\t\t"
-	gsub(/.*<h3>/, "", text)
-	gsub(/<\/h3>/, "", text)
-	tagged(text)
-}
-$0 ~/<h4>/	{
-	text = $0
-	tabs = "\t\t\t"
-	gsub(/.*<h4>/, "", text)
-	gsub(/<\/h4>/, "", text)
-	tagged( text )
-}
-# if current line is not header
-# and we have stored tag from <a name=..> line
-# make link to that tag
-$0 !~ /<h[1-4]/ 	{
-	if( length(name) )
-		print "[ <a href=\"" FILENAME "#" name "\">" name "</a>" " ]"
-	name = ""
-}
-# for <a name=whatever> lines
-# save name in a variable
-# not printed until we see next line
-$0 ~ /<a name=.*>/	{
-	name = $0
-	# strip anything before or after name tag
-	gsub(/.*<a name=/, "", name)
-	gsub(/>.*/, "", name)
-	# strip quotes off name
-	gsub(/^"/, "", name)
-	gsub(/"$/, "", name)
-}
-END	{
-	print b0
-	blurb()
-	print "Docs & script by Sandy Harris"
-	print "</pre>"
-	print "</body>"
-	print "</html>"
-}
-
-function tagged(text)	{	# print header with tag if available
-	if( length(name) )	# > 0 if previous line was a name
-		print tabs "<a href=\"" FILENAME "#" name "\">" text "</a>"
-	else
-		print tabs text
-	name = ""
-}
-
-function blurb()	{
-	print "Linux FreeSWAN HTML documents"
-	print "Automatically generated Table of Contents"
-	print "Bug reports to the mailing list: linux-ipsec@clinet.fi"
-	print "<p>"
-}
diff --git a/doc/utils/four2perm.1 b/doc/utils/four2perm.1
deleted file mode 100644
index 1e5263b5b..000000000
--- a/doc/utils/four2perm.1
+++ /dev/null
@@ -1,20 +0,0 @@
-.TH FOUR2PERM 1 "August 1999"
-.\" RCSID $Id: four2perm.1,v 1.1 2004/03/15 20:35:24 as Exp $
-.SH NAME
-four2perm - generate permuted index from four-field lines
-.SH SYNOPSIS
-.B four2perm
-.SH DESCRIPTION
-.I four2perm
-expects input lines with four tab-separated fields, such as that
-created from HTML files by html2four(1). Given that, it does most
-of the work of generating a permuted index, gets things close
-enough that a simple pipeline through sort(1) and awk(1) can
-finish the job.
-.SH SEE ALSO
-.hy 0
-html2four(1)
-.SH HISTORY
-Written for the Linux FreeS/WAN project
-<http://www.xs4all.nl/~freeswan/>
-by Sandy Harris.
diff --git a/doc/utils/four2perm.c b/doc/utils/four2perm.c
deleted file mode 100644
index 5b575c1b5..000000000
--- a/doc/utils/four2perm.c
+++ /dev/null
@@ -1,140 +0,0 @@
-#include <ctype.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <assert.h>
-
-#define MAX_LINE  512
-
-void die( char * ) ;
-
-char buffer[MAX_LINE+1] ;
-char *prog_name ;
-
-void die( char *message )
-{
-	fflush(stdout) ;
-	fprintf(stderr, "%s: %s\n", prog_name, message) ;
-	exit(1) ;
-}
-
-int main(int argc, char* argv[])
-{
-	int errors ;
-	prog_name = *argv ;
-	if( argc != 1 )
-		die("pure filter, takes no arguments") ;
-	errors = 0 ;
-	while( fgets(buffer, MAX_LINE, stdin))
-		errors += do_line(buffer) ;
-	exit(errors ? 1 : 0 ) ;
-}
-
-int do_line(char *data)
-{
-	char *p, *q, *r, *end, *before, *after ;
-	// expecting two tab-separated fields
-	// point r to 2nd, null terminate 1st
-	for( r = data ; *r && *r != '\t' ; r++ )
-		;
-	if( *r != '\t' )
-		return(1) ;
-	end = r++ ;
-	*end = '\0' ;
-	for( q = r ; *q ; q++ )
-		if( *q == '\n' )
-			*q = '\0' ;
-	if( !strlen(r) )
-		return(1) ;
-	// within 1st, parse as space-separated
-	// p will point to current word, q past its end
-	// before & after point to rest of text
-	// spaces converted to nulls & back as req'd
-	before = "" ;
-	for( p = data ; p < end ; p = q + 1 )	{
-		if( p > data )	{
-			before = data ;
-			p[-1] = '\0' ;
-		}
-		// find end of word
-		for( q = p ; *q && *q != ' ' ; q++ )
-			;
-		if( q == end )
-			after = "" ;
-		else if( q < end )	{
-			after = q + 1 ;
-			*q = '\0' ;
-		}
-		else	assert(0) ;
-		print_line(before, p, after, r) ;
-		if( q < end )
-			*q = ' ' ;
-		if( p > data )
-			p[-1] = ' ' ;
-	}
-	return(0) ;
-}
-
-// print formatted line for permuted index
-// two tab-separated fields
-//    1st is sort key
-//    2nd is printable line
-// pipe it through something like
-//   sort -F | awk -F '\t' '{print $2}'
-// to get final output
-
-print_line( char *before, char *word, char *after, char *tag)
-{
-	int i , x, y, z ;
-/*
-	printf("%s\t%s\t%s\t%s\n", before, word, after, tag) ;
-*/
-	if( list_word(word) )
-		return ;
-	x = strlen(before) ;
-	y = strlen(word) ;
-	z = strlen(after) ;
-	// put in sortable field
-	// strip out with awk after sorting
-	printf("%s %s\t", word, after) ;
-	// shorten before string to fit field
-	for( ; x > 30 ; x-- )
-		before++ ;
-	printf("%30s", before) ;
-	// print keyword, html tagged
-	printf("  %s%s</a>  ", tag, word) ;
-	// padding, outside tag
-	for( ; y < 18 ; y++ )
-		putchar(' ') ;
-	if( z )
-		printf("%s", after) ;
-	printf("\n") ;
-}
-
-// avoid indexing on common English words
-
-char *list[] = {
-		"the", "of", "a", "an", "to", "and",  "or", "if", "for", "at",
-		"am", "is", "are", "was", "were", "have", "has", "had", "be", "been",
-		"on", "some", "with", "any", "into", "as", "by", "in", "out",
-		"that", "then", "this", "that", "than", "these", "those",
-		"he", "his", "him", "she", "her", "hers", "it", "its",
-		"&", "", "+", "-", "=", "--", "<", ">", "<=", ">=",
-		"!", "?", "#", "$", "%", "/", "\\", "\"", "\'",
-		NULL
-		} ;
-// interrogative words like "how" and "where" deliberately left out of
-// above list because users might want to search for "how to..." etc.
-
-// return 1 if word in list, else 0
-// case-insensitive comparison
-
-list_word( char *p )
-{
-	char **z ;
-	for( z = list ; *z != NULL ; z++ )
-		if( ! strcasecmp( p, *z ) )
-			return 1 ;
-	return 0 ;
-}
-
diff --git a/doc/utils/html2four.1 b/doc/utils/html2four.1
deleted file mode 100644
index 456ac5e98..000000000
--- a/doc/utils/html2four.1
+++ /dev/null
@@ -1,26 +0,0 @@
-.TH HTML2FOUR 1 "August 1999"
-.\" RCSID $Id: html2four.1,v 1.1 2004/03/15 20:35:24 as Exp $
-.SH NAME
-html2four - extract headers from HTML files into four-field lines
-.SH SYNOPSIS
-.B html2four
-[-digit] file*
-command [ argument ...]
-.SH DESCRIPTION
-.I html2four
-extracts information from HTML files and writes it out with four
-tab-separated fields: filename, last label (<a name=> tag) seen,
-header tag type (H[0-9]), and header text. This is an intermediate
-format convenient for generating a permuted index with four2perm(1)
-or a table of contents with a simple awkscript.
-
-The only option is a digit to limit the header levels extracted.
-For example, with -3 only h1, h2, h3 tags are taken. By default,
-it takes h[0-9], though HTML only defines levels 1 to 6.
-.SH SEE ALSO
-.hy 0
-four2perm(1)
-.SH HISTORY
-Written for the Linux FreeS/WAN project
-<http://www.xs4all.nl/~freeswan/>
-by Sandy Harris.
diff --git a/doc/utils/html2four.c b/doc/utils/html2four.c
deleted file mode 100644
index fc1100d01..000000000
--- a/doc/utils/html2four.c
+++ /dev/null
@@ -1,298 +0,0 @@
-/*
-	extract headers from HTML files
-	in format suitable for turning into permuted index
-*/
-
-#include <ctype.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-
-/*
-	maximum sizes for input line and for name in <a> tag
-*/
-#define MAX_LINE  512
-#define MAX_NAME   64
-
-/*
-	functions
-	all return 0 for OK, 1 for errors
-*/
-int do_file( char *, FILE * ) ;
-int parse_line( char * ) ;
-int print_line( char *, char *) ;
-int print_header_problem( char * ) ;
-int sanity() ;
-
-void die( char * ) ;
-
-char	*prog_name ;
-int	max_level ;
-char	*current_file ;
-
-int main(int argc, char* argv[])
-{
-	char *p ;
-	int temp, done, status ;
-	FILE *fp ;
-
-	prog_name = *argv ;
-	argc--,argv++ ;
-
-	max_level = 9 ;	
-	if(argc && *argv )	{
-		p = *argv ;
-		if( p[0] == '-' )	{
-			if( isdigit(p[1]) && p[2] == '\0' )	{
-				max_level = p[1] - 0 ;
-				argc-- ;
-				argv++ ;
-			}
-			else die("unknown option") ;
-	}	}
-
-	status = done = 0 ;
-	if( argc == 0)	{
-		if( (status = do_file("STDIN", stdin)) == 0 )
-			done++ ;
-	}
-	else	{
-/*
-		printf("ARGC = %d\n", argc ) ;
-*/
-		while( argc-- )	{
-			p = *argv++ ;
-/*
-			printf("ARGV P %s %s\n", *argv, p) ;
-*/
-			if( p == NULL )	{
-				fprintf(stderr, "%s: null filename pointer\n", prog_name) ;
-				status++ ;
-			} 
-			else if( (fp = fopen(p,"r")) == NULL )	{
-				fprintf(stderr, "%s: cannot open file %s\n", prog_name, p) ;
-				status++ ;
-			}
-			else	{
-				if( (temp = do_file(p, fp)) != 0 )
-					status++ ;
-				done++ ;
-				fclose(fp) ;
-			}
-			fflush(stderr) ;
-			fflush(stdout) ;
-		}
-	}
-/*
-	printf("%s: %d files processed, %d with errors\n", prog_name, done, status) ;
-*/
-	return( status ? 1 : 0 ) ;
-}
-
-void die( char *message )
-{
-	fflush(stdout) ;
-	fprintf(stderr, "%s: %s\n", prog_name, message) ;
-	exit(1) ;
-}
-
-int header_flags[10] ;
-int in_header ;
-
-char buffer[MAX_LINE+1] ;
-char label[MAX_NAME+1] ;
-
-int do_file( char *file, FILE *fp )
-{
-	int i, status, x, y ;
-	char *base, *p ;
-
-	status = 0 ;
-	in_header = 0 ;
-	label[0] = '\0' ;
-	for( i = 0 ; i < 10 ; i++ )
-		header_flags[i] = 0 ;
-	current_file = file ;
-
-	while( base = fgets(buffer, MAX_LINE, fp) )	{
-		// count < and > characters in line
-		for( x = y = 0, p = base ; *p ; p++ )
-			switch( *p )	{
-				case '<':
-					x++ ;
-					break ;
-				case '>':
-					y++ ;
-					break ;
-				default:
-					break ;
-			}
-		// skip line if no < or >
-		if( x == 0 && y == 0 )
-			continue ;
-		// report error for unequal count
-		else if( x != y )	{
-			if( strncmp( base, "<!--", 4) && strncmp(base, "-->", 3) )	{
-				fflush(stdout) ;
-				fprintf(stderr, "%s in file %s: unequal < > counts %d %d\n",
-					prog_name, file, x, y ) ;
-				fprintf(stderr, "%s: %s\n", prog_name, base) ;
-				fflush(stderr) ;
-				status = 1 ;
-			}
-			continue ;
-		}
-		// parse lines containing tags
-		else
-			if( parse_line(base) )
-				status = 1 ;
-		// check that header labelling is sane
-		for( i = x = y = 0 ; i < 10 ; i++ )	{
-			// count non-zero entries
-			if( x = header_flags[i] )
-				y++ ;
-			// should be in 0 or 1 headers at a time
-			if( x > 1 || x < 0 )
-				status = 1 ;
-		}
-		if( y > 1 )
-			status = 1 ;
-	}
-	return status ;
-}
-
-int parse_line( char *data )
-{
-	char *p, *q, *end ;
-	int x ;
-
-	// set end pointer
-	for( end = data ; *end ; end++ )
-		;
-	// trim off trailing returns or newlines
-	for( p = end - 1, q = end ; q > data ; p--,q-- )	{
-		switch( *p )	{
-			case '\012':
-			case '\015':
-				*p = '\0' ;
-				continue ;
-			default:
-				break ; // out of switch()
-		}
-		break ; // out of for()
-	}
-	end = q ;
-	p = data ;
-	while( p < end )	{
-		// find tag delimiters
-		if( *p == '<')	{
-			for( q = p + 1 ; *q ; q++ )
-				if( *q == '<' || *q == '>' )
-					break ;
-			// if we find another '<'
-			// restart tag search from it
-			if( *q == '<' )	{
-				p = q ;
-				continue ;
-			}
-			// "<>" is not interesting
-			if( q == p + 1 )	{
-				fflush(stdout) ;
-				fprintf(stderr, "%s: null tag\n", prog_name) ;
-				fprintf(stderr, "%s: line\n", prog_name, data) ;
-				fflush(stderr) ;
-				p = q + 1 ;
-				continue ;
-			}
-			// ignore delimiters once found
-			*q = '\0' ;
-			p++ ;
-			// p points to tag contents, null terminated
-			switch( *p )	{
-			// save contents of <a name= > tags
-			case 'a' :
-			case 'A' :
-				if(	 p[1] == ' ' &&
-					(p[2] == 'n' || p[2] == 'N') &&
-					(p[3] == 'a' || p[3] == 'A') &&
-					(p[4] == 'm' || p[4] == 'M') &&
-					(p[5] == 'e' || p[5] == 'E') &&
-					 p[6] == '=' )
-				strncpy(label, p + 7, MAX_NAME) ;
-				break ;
-			case 'b' :
-			case 'B' :
-				if(	in_header && strlen(p) == 2 &&
-					(p[1] == 'r' || p[1] == 'R') )
-					putchar(' ') ;
-				break ;
-			// header tags
-			case 'h' :
-			case 'H' :
-				if( strlen(p) == 2 && isdigit(p[1]) )	{
-					if( in_header )
-						fprintf(stderr, "%s: bad header nesting in %s\n",
-							prog_name, current_file) ; 
-					x = p[1] - '0' ;
-					in_header = 1 ;
-					header_flags[x]++ ;
-					printf("%s\t%s\tH%d\t", current_file, label, x) ;
-				}
-				break ;
-			// only care about end-of-header
-			case '/':
-				p++ ;
-				switch( *p )	{
-				case 'h' :
-				case 'H' :
-					if( strlen(p) == 2 && isdigit(p[1]) )	{
-						if( ! in_header )
-							fprintf(stderr, "%s: bad header nesting in %s\n",
-								prog_name, current_file) ; 
-						x = p[1] - '0' ;
-						in_header = 0 ;
-						header_flags[x]-- ;
-						printf("\n") ;
-					}
-					break ;
-				}
-				break ;
-			// uninteresting tag, look for next
-			default :
-				break ;
-			}
-		// tag done, point p beyond it
-		p = q + 1 ;
-		}
-		else if( in_header )	{
-			if( isprint(*p) && *p != '\n' )
-				putchar(*p) ;
-			else
-				putchar(' ');
-			p++ ;
-		}
-		else
-			p++ ;
-	}
-	return(0) ;
-}
-
-int print_line( char *tag, char *text)
-{
-	printf("%%s\ts\t%s\t%s\t\n", current_file, label, tag, text) ;
-	return 0 ;
-}
-
-int print_header_problem( char *file )
-{
-	int i ;
-	fflush(stdout) ;
-	fprintf(stderr, "%s: HEADER TAG PROBLEM in file %s\n", prog_name, file) ;
-	fprintf(stderr, "%s: counts", prog_name) ;
-	for ( i = 0 ; i < 10 ; i++ )
-		fprintf(stderr, "\t%d", i) ;
-	fprintf(stderr,"\n") ;
-	fflush(stderr) ;
-	return(0) ;
-}
-
diff --git a/doc/utils/html2txt.sed b/doc/utils/html2txt.sed
deleted file mode 100644
index fc4940991..000000000
--- a/doc/utils/html2txt.sed
+++ /dev/null
@@ -1,86 +0,0 @@
-# skip over header material
-# Copyright (C) 1999  Sandy Harris.
-# 
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
-# 
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-# for more details.
-#
-# RCSID $Id: html2txt.sed,v 1.1 2004/03/15 20:35:24 as Exp $
-/<head>/,/<\/head>/d
-/<HEAD>/,/<\/HEAD>/d
-/<^body$>/d
-s/<body>//
-# eliminate possible DOS crud
-s/\015//
-#get rid of HTML comments
-s/<!--.*-->//
-/<!--/,/-->/d
-# citations & emphasis -> visible
-s/<cite>/"/g
-s/<\/cite>/"/g
-s/<em>/*/g
-s/<\/em>/*/g
-s/<strong>/!->/g
-s/<\/strong>/<-!/g
-s/<b>//g
-s/<\/b>//g
-s/<blockquote>/Quote -->/
-s/<\/blockquote>/<-- End Quote/
-# mark headers
-s/<h1>/Header 1:  /
-s/<h2>/Header 2:  /
-s/<h3>/Header 3:  /
-s/<h4>/Header 4:  /
-s/<h5>/Header 5:  /
-s/<h6>/Header 6:  /
-# remove some cruft
-s/<\/h[1-6]>//
-/^<a name=[a-zA-Z0-9\.]*>$/d
-s/<a name=[a-zA-Z0-9\.]*>//
-# definition lists
-s/<dl>//
-s/<\/dl>//
-s/^<dt>$/-----------------------------------------/
-s/^<dt>/-----------------------------------------\
-/
-s/<dd>/\
-/
-# other types of lists
-s/<li>//
-s/<ol>//
-s/<ul>//
-s/<\/ol>//
-s/<\/ul>//
-# tables
-s/<table>//
-s/<\/table>//
-s/<tr>//
-s/<td>/	/g
-# line break and paragraph markers
-# different subst depending where they are in line
-s/^<br>//
-s/<br>$//
-s/<br>/\
-/
-s/^<p>$//
-s/<p>$/\
-/
-s/^<p>/\
-/
-s/<p>/\
-\
-/
-s/<\/p>//
-# remove more cruft
-s/<pre>//
-s/<\/pre>//
-s/<\/body>//
-s/<\/html//
-s/<\/BODY>//
-s/<\/HTML>//
diff --git a/doc/utils/killtoodeepcontents.pl b/doc/utils/killtoodeepcontents.pl
deleted file mode 100644
index a6fe551d6..000000000
--- a/doc/utils/killtoodeepcontents.pl
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/usr/bin/perl
-
-$toc=0;
-$memo=0;
-
-while(<>) {
-  if(0 && /^Status of this Memo/) {
-    $memo=1;
-    print;
-    next;
-  }
-    
-  if(/^Table of Contents/) {
-    print ".bp\n";
-    $toc=1;
-    print;
-    next;
-  }
-  
-  if(!$toc && !$memo) {
-    print;
-    next;
-  }
-
-  if($toc) {
-    if(/^[0-9]*\.[0-9]*\.[0-9]* / ||
-#       /^[0-9]*\.[0-9]* / ||
-       /^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* /) {
-      next;
-    }
-
-    if(/^14./) {
-      $toc=0;
-    }
-    if(/^\.bp/) {
-      next;
-    }
-    print;
-  }
-
-  if($memo) {
-    if(/^\.bp/) {
-      next;
-    }
-    
-    if(/^Copyright Notice/) {
-      print ".fi\n";
-      print "This memo provides information for the Internet community.  It does\n";
-      print "not specify an Internet standard of any kind.  Distribution of this\n";
-      print "memo is unlimited.\n";
-      print "\n.ti 0\n";
-
-      print;
-
-      $memo=0;
-      next;
-    }
-  }
-}
diff --git a/doc/utils/man2html.script b/doc/utils/man2html.script
deleted file mode 100755
index 515911c81..000000000
--- a/doc/utils/man2html.script
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/bin/sh
-
-# Assumes man2html command in path
-# That is a Perl script downloadable from
-# http://www.oac.uci.edu/indiv/ehood/man2html.html
-
-# also uses our man_xref utility
-
-case $# in
-2)	;;
-*)	echo "Usage: $0 mantree destdir" >&2 ; exit 2	;;
-esac
-
-mkdir -p $2
-rm -f $2/*
-
-# handle all sections just in case
-# only 3 5 8 expected 
-for i in `find $1 -name 'ipsec*.[1-9]'`
-do
-	b=`basename $i`
-	# then parse that into section number s
-	# and name n
-	case $b in
-		*.1)	s=1 ;;
-		*.2)	s=2 ;;
-		*.3)	s=3 ;;
-		*.4)	s=4 ;;
-		*.5)	s=5 ;;
-		*.6)	s=6 ;;
-		*.7)	s=7 ;;
-		*.8)	s=8 ;;
-		*.9)	s=9 ;;
-		*)	echo "$0 has lost its mind" ; exit 1 ;;
-	esac
-	n=`basename $b \.$s`
-	# the echos are a kluge
-	# without them, the first section head is not tagged
-	(echo ; echo ; man $s $n ) | man2html > $2/$b.html
-done
-# man2html doesn't convert man page cross-references such as
-# ipsec.conf(5) into HTML links
-# So post-process to do that.
-for i in $2/*.html
-do
-	../utils/man_xref $i > temp
-	mv temp $i
-done
diff --git a/doc/utils/man_xref.c b/doc/utils/man_xref.c
deleted file mode 100644
index fc3afb696..000000000
--- a/doc/utils/man_xref.c
+++ /dev/null
@@ -1,125 +0,0 @@
-#include <stdio.h>
-#include <ctype.h>
-#include <assert.h>
-
-/*
-	look through HTMLized man pages
-	convert references like man(1) into HTML links
-
-	somewhat quick & dirty code
-	various dubious assumptions made:
-
-	[a-zA-Z0-9\-_\.]* defines legal characters in name
-	pagename(x) corresponds to pagename.x.html
-	(Fine *if* it's been converted by my scripts)
-	x in the above must be a single digit
-	(or we ignore it, which does no damage)
-	Lazy parsing: malloc() enough RAM to read in whole file
-	Limited syntax: exactly one input file, results to stdout 
-
-	Sandy Harris
-*/
-
-int do_file( char *, char *) ;
-
-main(int argc, char **argv)
-{
-	FILE *in ;
-	char *progname;
-	long lsize ;
-	size_t size, nread;
-	char *buffer, *bufend ; 
-	progname = *argv ;
-	if( argc != 2 )	{
-		fprintf(stderr,"usage: %s input-file\n", progname);
-		exit(1) ;
-	}
-	if( (in = fopen(argv[1],"r")) == NULL )	{
-		fprintf(stderr,"%s Can't open input file\n", progname);
-		exit(2) ;
-	}
-	if( (lsize = fseek(in, 0L, SEEK_END)) < 0L )	{
-		fprintf(stderr,"%s fseek() fails\n", progname);
-		exit(3) ;
-	}
-	lsize = ftell(in) ;
-	rewind(in) ;
-	size = (size_t) lsize ;
-	if( lsize != (long) size )	{
-		fprintf(stderr,"%s file too large\n", progname);
-		exit(4) ;
-	}
-	if( (buffer = (char *) malloc(size)) == NULL)	{
-		fprintf(stderr,"%s malloc() failed\n", progname);
-		exit(5) ;
-	}
-	bufend = buffer + size ;
-	if( (nread = fread(buffer, size, 1, in)) != 1) { 
-		fprintf(stderr,"%s fread() failed\n", progname);
-		exit(6) ;
-	}
-	do_file(buffer,bufend);
-}
-
-do_file(char *start, char *end)
-{
-	/* p is where to start parsing, one past last output	*/
-	/* q is how far we've parsed				*/
-	char *p, *q ;
-	int value ;
-	for( p = q = start ; p < end ; q = (q<end) ? (q+1) : q  )	{
-		/* if p is beyond q, catch up	*/
-		if( q < p )
-			continue ;
-		/* move q ahead until we know if we've got manpage name */
-		if( isalnum(*q) )
-			continue ;
-		switch(*q)	{
-			/* can appear in manpage name	*/
-			case '.':
-			case '_':
-			case '-':
-			case '(':
-				continue ;
-				break ;
-			/* whatever's between p and q
-			   is not a manpage name
-			   so output it
-			*/
-			default:
-				/* leave p one past output	*/
-				for( ; p <= q ; p++ )
-					putchar(*p);
-				break ;
-			/* we may have a manpage name	*/
-			case ')':
-				value = do_name(p,q);
-				if(value)	{
-					p = q ;
-					p++ ;
-				}
-				/* unreached with current do_name() */
-				else
-					for( ; p <= q ; p++ )
-						putchar(*p);
-				break ;
-}	}	}
-
-do_name(char *p, char *q)
-{
-	*q = '\0' ;
-	/* if end of string matches RE ([0-9])
-	   with at least one legal character before it
-	   add HTML xref stuff
-	*/
-	if( (q-p > 3) && isdigit(q[-1]) && (q[-2]=='('))	{
-		q[-2] = '\0' ;
-		q-- ;  
-		printf("<a href=\"%s.%s.html\">", p, q);
-		printf("%s(%s)", p, q);
-		printf("</a>");
-	}
-	// otherwise just print string
-	else	printf("%s)", p);
-	return 1 ;
-}
diff --git a/doc/utils/mkhtmlman b/doc/utils/mkhtmlman
deleted file mode 100755
index 6d73bd1f2..000000000
--- a/doc/utils/mkhtmlman
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/bin/sh
-# gathers manpages up into dir, converts them to HTML, including interlinking
-# Assumes RedHat6.0 man2html available.
-
-PATH=/usr/local/bin:/bin:/usr/bin:/usr/contrib/bin:$PATH ; export PATH
-
-# note, this is always run from freeswan/doc.
-
-TOPDIR=..
-
-case $# in
-1)	exit 0	;;
-0)	echo "Usage: $0 destdir manpage ..." >&2 ; exit 1	;;
-esac
-
-dir=$1
-shift
-mkdir -p $dir
-rm -f $dir/*
-
-for f
-do
-	b=`basename $f`
-	case $b in
-	ipsec*)			;;	# ipsec.8, ipsec.conf.5, etc.
-	*)	b="ipsec_$b"	;;
-	esac
-	cp $f $dir/$b
-	$TOPDIR/packaging/utils/manlink $f | while read from to
-	do
-	    (cd $dir; ln -s ../$f $to)
-	done
-done
-
-# build the html (sed mess fixes overly-smart man2html's crud)
-refpat='"http://localhost/cgi-bin/man/man2html?\([1-8]\)+\([^"]*\)"'
-for f in $dir/*.[1-8]
-do
-	echo Processing $f
-	man2html <$f | sed 's;'"$refpat"';"\2.\1.html";g' >$f.html
-done
-
-# remove the source files (must wait until after all builds, due to symlinks)
-rm -f $dir/*.[1-8]
diff --git a/doc/utils/perm1.awk b/doc/utils/perm1.awk
deleted file mode 100644
index d9f8f5565..000000000
--- a/doc/utils/perm1.awk
+++ /dev/null
@@ -1 +0,0 @@
-{ print $4 "\t<a href=\"" $1 "#" $2 "\">" }
diff --git a/doc/utils/perm2.awk b/doc/utils/perm2.awk
deleted file mode 100644
index 3c55fef11..000000000
--- a/doc/utils/perm2.awk
+++ /dev/null
@@ -1,46 +0,0 @@
-BEGIN   {
-        print "<html>\n<body>"
-        print "<h2>Permuted Index of HTML headers in FreeS/WAN documents</h2>"
-        print "<h3>Jump to a letter</h3>"
-        print "<center><big><strong>"
-        print "<a href=\"#0\">numeric</a>"
-        print "<a href=\"#a\">A</a>"
-        print "<a href=\"#b\">B</a>"
-        print "<a href=\"#c\">C</a>"
-        print "<a href=\"#d\">D</a>"
-        print "<a href=\"#e\">E</a>"
-        print "<a href=\"#f\">F</a>"
-        print "<a href=\"#g\">G</a>"
-        print "<a href=\"#h\">H</a>"
-        print "<a href=\"#i\">I</a>"
-        print "<a href=\"#j\">J</a>"
-        print "<a href=\"#k\">K</a>"
-        print "<a href=\"#l\">L</a>"
-        print "<a href=\"#m\">M</a>"
-        print "<a href=\"#n\">N</a>"
-        print "<a href=\"#o\">O</a>"
-        print "<a href=\"#p\">P</a>"
-        print "<a href=\"#q\">Q</a>"
-        print "<a href=\"#r\">R</a>"
-        print "<a href=\"#s\">S</a>"
-        print "<a href=\"#t\">T</a>"
-        print "<a href=\"#u\">U</a>"
-        print "<a href=\"#v\">V</a>"
-        print "<a href=\"#w\">W</a>"
-        print "<a href=\"#x\">X</a>"
-        print "<a href=\"#y\">Y</a>"
-        print "<a href=\"#z\">Z</a>"
-        print "</strong></big></center>"
-        print "<hr>"
-        print "<pre>"
-        print "<a name=0>"
-        old =""
-        }
-{       x = tolower(substr($1,1,1))
-        if( (x ~ /[a-zA-Z]/) && (x != old) )
-                print "<a name=" x ">" $2
-        else
-                print $2
-        old = x
-        }
-END     { print "</pre>\n</html>" }
diff --git a/doc/utils/rfc_pg.c b/doc/utils/rfc_pg.c
deleted file mode 100644
index 448cc1a36..000000000
--- a/doc/utils/rfc_pg.c
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- *  $Header: /var/cvsroot/strongswan/doc/utils/rfc_pg.c,v 1.1 2004/03/15 20:35:24 as Exp $
- *
- * from 2-nroff.template file.
- *
- *  Remove N lines following any line that contains a form feed (^L).
- *  (Why can't this be done with awk or sed?)
- *
- *  OPTION:
- *	-n#	Number of lines to delete following each ^L (0 default).
- * $Log: rfc_pg.c,v $
- * Revision 1.1  2004/03/15 20:35:24  as
- * added files from freeswan-2.04-x509-1.5.3
- *
- * Revision 1.1  2002/07/23 18:42:43  mcr
- * 	required utility from IETF to help with formatting of drafts.
- *
- */
-#include <stdio.h>
-
-#define FORM_FEED	'\f'
-#define OPTION		"n:N:"		/* for getopt() */
-
-extern char *optarg;
-extern int optind;
-
-main(argc, argv)
-int	argc;
-char	*argv[];
-{
-  int	c,				/* next input char */
-	nlines = 0;			/* lines to delete after ^L */
-  void	print_and_delete();		/* print line starting with ^L,
-					   then delete N lines */
-
-/*********************** Process option (-nlines) ***********************/
-
-  while ((c = getopt(argc, argv, OPTION)) != EOF)
-    switch(c)
-    {
-      case 'n' :
-      case 'N' :  nlines = atoi(optarg);
-		  break;
-    }
-/************************* READ AND PROCESS CHARS **********************/
-
-  while ((c = getchar()) != EOF)
-    if (c == FORM_FEED)
-      print_and_delete(nlines);		/* remove N lines after this one */
-    else
-      putchar(c);			/* we write the form feed */
-  exit(0);
-}
-
-
-/*
- *  Print rest of line, then delete next N lines.
- */
-void print_and_delete(n)
-int  n;					/* nbr of lines to delete */
-{
-  int	c,				/* next input char */
-	cntr = 0;			/* count of deleted lines */
-
-  while ((c = getchar()) != '\n')	/* finish current line */
-    putchar(c);
-  putchar('\n');			/* write the last CR */
-  putchar(FORM_FEED);
-
-  for ( ; cntr < n; cntr++)
-    while ((c = getchar()) != '\n')
-      if (c == EOF)
-	exit(0);			/* exit on EOF */
-  putchar(c);				/* write that last CR */
-}
-
diff --git a/doc/utils/xref.sed b/doc/utils/xref.sed
deleted file mode 100644
index 8c3b442cc..000000000
--- a/doc/utils/xref.sed
+++ /dev/null
@@ -1,56 +0,0 @@
-# turn end-of xref tags into <*>
-# Copyright (C) 1999  Sandy Harris.
-# 
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
-# 
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-# for more details.
-#
-# RCSID $Id: xref.sed,v 1.1 2004/03/15 20:35:24 as Exp $
-s/<\/a>/<*>/g
-# delete all xrefs that point
-# within our document set
-s/<a href="..\/Internet-docs\/rfc....\.txt">//
-# in same doc
-s/<a href="#[a-zA-Z0-9\.]*">//
-# pointer into another doc
-s/<a href="DES.html#[a-zA-Z0-9\.]*">//
-s/<a href="RFCs.html#[a-zA-Z0-9\.]*">//
-s/<a href="WWWref.html#[a-zA-Z0-9\.]*">//
-s/<a href="bibliography.html#[a-zA-Z0-9\.]*">//
-s/<a href="compatibility.html#[a-zA-Z0-9\.]*">//
-s/<a href="configuration.html#[a-zA-Z0-9\.]*">//
-s/<a href="contents.html#[a-zA-Z0-9\.]*">//
-s/<a href="debugging.html#[a-zA-Z0-9\.]*">//
-s/<a href="exportlaws.html#[a-zA-Z0-9\.]*">//
-s/<a href="glossary.html#[a-zA-Z0-9\.]*">//
-s/<a href="index.html#[a-zA-Z0-9\.]*">//
-s/<a href="overview.html#[a-zA-Z0-9\.]*">//
-s/<a href="roadmap.html#[a-zA-Z0-9\.]*">//
-s/<a href="testbed.html#[a-zA-Z0-9\.]*">//
-s/<a href="setup.html#[a-zA-Z0-9\.]*">//
-# pointer to head of doc
-s/<a href="DES.html">//
-s/<a href="RFCs.html">//
-s/<a href="WWWref.html">//
-s/<a href="bibliography.html">//
-s/<a href="compatibility.html">//
-s/<a href="configuration.html">//
-s/<a href="contents.html">//
-s/<a href="debugging.html">//
-s/<a href="exportlaws.html">//
-s/<a href="glossary.html">//
-s/<a href="index.html">//
-s/<a href="overview.html">//
-s/<a href="roadmap.html">//
-s/<a href="testbed.html">//
-s/<a href="setup.html">//
-# xref to non-HTML files
-s/<a href="standards">//
-s/<a href="impl.notes">//
-s/<a href="prob.report">//
diff --git a/doc/web.html b/doc/web.html
deleted file mode 100644
index 0c084d289..000000000
--- a/doc/web.html
+++ /dev/null
@@ -1,749 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
-<HTML>
-<HEAD>
-<TITLE>Introduction to FreeS/WAN</TITLE>
-<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=iso-8859-1">
-<STYLE TYPE="text/css"><!--
-BODY { font-family: serif }
-H1 { font-family: sans-serif }
-H2 { font-family: sans-serif }
-H3 { font-family: sans-serif }
-H4 { font-family: sans-serif }
-H5 { font-family: sans-serif }
-H6 { font-family: sans-serif }
-SUB { font-size: smaller }
-SUP { font-size: smaller }
-PRE { font-family: monospace }
---></STYLE>
-</HEAD>
-<BODY>
-<A HREF="toc.html">Contents</A>
-<A HREF="mail.html">Previous</A>
-<A HREF="glossary.html">Next</A>
-<HR>
-<H1><A name="weblink">Web links</A></H1>
-<H2><A name="freeswan">The Linux FreeS/WAN Project</A></H2>
-<P>The main project web site is<A href="http://www.freeswan.org/">
- www.freeswan.org</A>.</P>
-<P>Links to other project-related<A href="intro.html#sites"> sites</A>
- are provided in our introduction section.</P>
-<H3><A name="patch">Add-ons and patches for FreeS/WAN</A></H3>
-<P>Some user-contributed patches have been integrated into the FreeS/WAN
- distribution. For a variety of reasons, those listed below have not.</P>
-<P>Note that not all patches are a good idea.</P>
-<UL>
-<LI>There are a number of &quot;features&quot; of IPsec which we do not implement
- because they reduce security. See this<A href="compat.html#dropped">
- discussion</A>. We do not recommend using patches that implement these.
- One example is aggressive mode.</LI>
-<LI>We do not recommend adding &quot;features&quot; of any sort unless they are
- clearly necessary, or at least have clear benefits. For example,
- FreeS/WAN would not become more secure if it offerred a choice of 14
- ciphers. If even one was flawed, it would certainly become less secure
- for anyone using that cipher. Even with 14 wonderful ciphers, it would
- be harder to maintain and administer, hence more vulnerable to various
- human errors.</LI>
-</UL>
-<P>This is not to say that patches are necessarily bad, only that using
- them requires some deliberation. For example, there might be perfectly
- good reasons to add a specific cipher in your application: perhaps GOST
- to comply with government standards in Eastern Europe, or AES for
- performance benefits.</P>
-<H4>Current patches</H4>
-<P>Patches believed current::</P>
-<UL>
-<LI>patches for<A href="http://www.strongsec.com/freeswan/"> X.509
- certificate support</A>, also available from a<A href="http://www.twi.ch/~sna/strongsec/freeswan/">
- mirror site</A></LI>
-<LI>patches to add<A href="http://www.irrigacion.gov.ar/juanjo/ipsec">
- AES and other ciphers</A>. There is preliminary data indicating AES
- gives a substantial<A href="performance.html#perf.more"> performance
- gain</A>.</LI>
-</UL>
-<P>There is also one add-on that takes the form of a modified FreeS/WAN
- distribution, rather than just patches to the standard distribution:</P>
-<UL>
-<LI><A href="http://www.ipv6.iabg.de/downloadframe/index.html">IPv6
- support</A></LI>
-</UL>
-<P>Before using any of the above,, check the<A href="mail.html"> mailing
- lists</A> for news of newer versions and to see whether they have been
- incorporated into more recent versions of FreeS/WAN.</P>
-<H4>Older patches</H4>
-<UL>
-<LI><A href="http://sources.colubris.com/en/projects/FreeSWAN/">hardware
- acceleration</A></LI>
-<LI>a<A href="http://tzukanov.narod.ru/"> series</A> of patches that
-<UL>
-<LI>provide GOST, a Russian gov't. standard cipher, in MMX assembler</LI>
-<LI>add GOST to OpenSSL</LI>
-<LI>add GOST to the International kernel patch</LI>
-<LI>let FreeS/WAN use International kernel patch ciphers</LI>
-</UL>
-</LI>
-<LI>Neil Dunbar's patches for<A href="ftp://hplose.hpl.hp.com/pub/nd/pluto-openssl.tar.gz">
- certificate support</A>, using code from<A href="http://www.openssl.org">
- Open SSL</A>.</LI>
-<LI>Luc Lanthier's<A href="ftp://ftp.netwinder.org/users/f/firesoul/">
- patches</A> for<A href="glossary.html#PKIX"> PKIX</A> support.</LI>
-<LI><A href="ftp://ftp.heise.de/pub/ct/listings/9916-180.tgz">patches</A>
- to add<A href="glossary.html#blowfish"> Blowfish</A>,<A href="glossary.html#IDEA">
- IDEA</A> and<A href="glossary.html#CAST128"> CAST-128</A> to FreeS/WAN</LI>
-<LI>patches for FreeS/WAN 1.3, Pluto support for<A href="http://alcatraz.webcriminals.com/~bastiaan/ipsec/">
- external authentication</A>, for example with a smartcard or SKEYID.</LI>
-<LI><A href="http://www.zengl.net/freeswan/download/">patches and
- utilities</A> for using FreeS/WAN with PGPnet</LI>
-<LI><A href="http://www.freelith.com/lithworks/crypto/freeswan_patch.htm">
-Blowfish encryption and Tiger hash</A></LI>
-<LI><A href="http://www.cendio.se/~bellman/aggressive-pluto.snap.tar.gz">
-patches</A> for aggressive mode support</LI>
-</UL>
-<P>These patches are for older versions of FreeS/WAN and will likely not
- work with the current version. Older versions of FreeS/WAN may be
- available on some of the<A href="intro.html#sites"> distribution sites</A>
-, but we recommend using the current release.</P>
-<H4><A name="VPN.masq">VPN masquerade patches</A></H4>
-<P>Finally, there are some patches to other code that may be useful with
- FreeS/WAN:</P>
-<UL>
-<LI>a<A href="ftp://ftp.rubyriver.com/pub/jhardin/masquerade/ip_masq_vpn.html">
- patch</A> to make IPsec, PPTP and SSH VPNs work through a Linux
- firewall with<A href="glossary.html#masq"> IP masquerade</A>.</LI>
-<LI><A href="http://www.linuxdoc.org/HOWTO/VPN-Masquerade-HOWTO.html">
-Linux VPN Masquerade HOWTO</A></LI>
-</UL>
-<P>Note that this is not required if the same machine does IPsec and
- masquerading, only if you want a to locate your IPsec gateway on a
- masqueraded network. See our<A href="firewall.html#NAT"> firewalls</A>
- document for discussion of why this is problematic.</P>
-<P>At last report, this patch could not co-exist with FreeS/WAN on the
- same machine.</P>
-<H3><A name="dist">Distributions including FreeS/WAN</A></H3>
-<P>The introductory section of our document set lists several<A href="intro.html#distwith">
- Linux distributions</A> which include FreeS/WAN.</P>
-<H3><A name="used">Things FreeS/WAN uses or could use</A></H3>
-<UL>
-<LI><A href="http://openpgp.net/random">/dev/random</A> support page,
- discussion of and code for the Linux<A href="glossary.html#random">
- random number driver</A>. Out-of-date when we last checked (January
- 2000), but still useful.</LI>
-<LI>other programs related to random numbers:
-<UL>
-<LI><A href="http://www.mindrot.org/audio-entropyd.html">audio entropy
- daemon</A> to gather noise from a sound card and feed it into
- /dev/random</LI>
-<LI>an<A href="http://www.lothar.com/tech/crypto/"> entropy-gathering
- daemon</A></LI>
-<LI>a driver for the random number generator in recent<A href="http://sourceforge.net/projects/gkernel/">
- Intel chipsets</A>. This driver is included as standard in 2.4 kernels.</LI>
-</UL>
-</LI>
-<LI>a Linux<A href="http://www.marko.net/l2tp/"> L2TP Daemon</A> which
- might be useful for communicating with Windows 2000 which builds L2TP
- tunnels over its IPsec connections</LI>
-<LI>to use opportunistic encryption, you need a recent version of<A href="glossary.html#BIND">
- BIND</A>. You can get one from the<A href="http://www.isc.org">
- Internet Software Consortium</A> who maintain BIND.</LI>
-</UL>
-<H3><A name="alternatives">Other approaches to VPNs for Linux</A></H3>
-<UL>
-<LI>other Linux<A href="#linuxipsec"> IPsec implementations</A></LI>
-<LI><A href="http://www.tik.ee.ethz.ch/~skip/">ENskip</A>, a free
- implementation of Sun's<A href="glossary.html#SKIP"> SKIP</A> protocol</LI>
-<LI><A href="http://sunsite.auc.dk/vpnd/">vpnd</A>, a non-IPsec VPN
- daemon for Linux which creates tunnels using<A href="glossary.html#Blowfish">
- Blowfish</A> encryption</LI>
-<LI><A href="http://www.winton.org.uk/zebedee/">Zebedee</A>, a simple
- GPLd tunnel-building program with Linux and Win32 versions. The name is
- from<STRONG> Z</STRONG>lib compression,<STRONG> B</STRONG>lowfish
- encryption and<STRONG> D</STRONG>iffie-Hellman key exchange.</LI>
-<LI>There are at least two PPTP implementations for Linux
-<UL>
-<LI>Moreton Bay's<A href="http://www.moretonbay.com/vpn/pptp.html">
- PoPToP</A></LI>
-<LI><A href="http://cag.lcs.mit.edu/~cananian/Projects/PPTP/">PPTP-Linux</A>
-</LI>
-</UL>
-</LI>
-<LI><A href="http://sites.inka.de/sites/bigred/devel/cipe.html">CIPE</A>
- (crypto IP encapsulation) project, using their own lightweight protocol
- to encrypt between routers</LI>
-<LI><A href="http://tinc.nl.linux.org/">tinc</A>, a VPN Daemon</LI>
-</UL>
-<P>There is a list of<A href="http://www.securityportal.com/lskb/10000000/kben10000005.html">
- Linux VPN</A> software in the<A href="http://www.securityportal.com/lskb/kben00000001.html">
- Linux Security Knowledge Base</A>.</P>
-<H2><A name="ipsec.link">The IPsec Protocols</A></H2>
-<H3><A name="general">General IPsec or VPN information</A></H3>
-<UL>
-<LI>The<A href="http://www.vpnc.org"> VPN Consortium</A> is a group for
- vendors of IPsec products. Among other things, they have a good
- collection of<A href="http://www.vpnc.org/white-papers.html"> IPsec
- white papers</A>.</LI>
-<LI>A VPN mailing list with a<A href="http://kubarb.phsx.ukans.edu/~tbird/vpn.html">
- home page</A>, a FAQ, some product comparisons, and many links.</LI>
-<LI><A href="http://www.opus1.com/vpn/index.html">VPN pointer page</A></LI>
-<LI>a<A href="http://www.epm.ornl.gov/~dunigan/vpn.html"> collection</A>
- of VPN links, and some explanation</LI>
-</UL>
-<H3><A name="overview">IPsec overview documents or slide sets</A></H3>
-<UL>
-<LI>the FreeS/WAN<A href="ipsec.html"> document section</A> on these
- protocols</LI>
-</UL>
-<H3><A name="otherlang">IPsec information in languages other than
- English</A></H3>
-<UL>
-<LI><A href="http://www.imib.med.tu-dresden.de/imib/Internet/Literatur/ipsec-docu.html">
-German</A></LI>
-<LI><A href="http://www.kame.net/index-j.html">Japanese</A></LI>
-<LI>Feczak Szabolcs' thesis in<A href="http://feczo.koli.kando.hu/vpn/">
- Hungarian</A></LI>
-<LI>Davide Cerri's thesis and some presentation slides<A href="http://www.linux.it/~davide/doc/">
- Italian</A></LI>
-</UL>
-<H3><A name="RFCs1">RFCs and other reference documents</A></H3>
-<UL>
-<LI><A href="rfc.html">Our document</A> listing the RFCs relevant to
- Linux FreeS/WAN and giving various ways of obtaining both RFCs and
- Internet Drafts.</LI>
-<LI><A href="http://www.vpnc.org/vpn-standards.html">VPN Standards</A>
- page maintained by<A href="glossary.html#VPNC"> VPNC</A>. This covers
- both RFCs and Drafts, and classifies them in a fairly helpful way.</LI>
-<LI><A href="http://www.rfc-editor.org">RFC archive</A></LI>
-<LI><A href="http://www.ietf.org/ids.by.wg/ipsec.html">Internet Drafts</A>
- related to IPsec</LI>
-<LI>US government<A href="http://www.itl.nist.gov/div897/pubs"> site</A>
- with their<A href="glossary.html#FIPS"> FIPS</A> standards</LI>
-<LI>Archives of the ipsec@tis.com mailing list where discussion of
- drafts takes place.
-<UL>
-<LI><A href="http://www.sandelman.ottawa.on.ca/ipsec">Eastern Canada</A></LI>
-<LI><A href="http://www.vpnc.org/ietf-ipsec">California</A>.</LI>
-</UL>
-</LI>
-</UL>
-<H3><A name="analysis">Analysis and critiques of IPsec protocols</A></H3>
-<UL>
-<LI>Counterpane's<A href="http://www.counterpane.com/ipsec.pdf">
- evaluation</A> of the protocols</LI>
-<LI>Simpson's<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/1999/06/msg00319.html">
- IKE Considered Dangerous</A> paper. Note that this is a link to an
- archive of our mailing list. There are several replies in addition to
- the paper itself.</LI>
-<LI>Fate Labs<A href="http://www.fatelabs.com/loki-vpn.pdf"> Virual
- Private Problems: the Broken Dream</A></LI>
-<LI>Catherine Meadows' paper<CITE> Analysis of the Internet Key Exchange
- Protocol Using the NRL Protocol Analyzer</CITE>, in<A href="http://chacs.nrl.navy.mil/publications/CHACS/1999/1999meadows-IEEE99.pdf">
- PDF</A> or<A href="http://chacs.nrl.navy.mil/publications/CHACS/1999/1999meadows-IEEE99.ps">
- Postscript</A>.</LI>
-<LI>Perlman and Kaufmnan
-<UL>
-<LI><A href="http://snoopy.seas.smu.edu/ee8392_summer01/week7/perlman2.pdf">
-Key Exchange in IPsec</A></LI>
-<LI>a newer<A href="http://sec.femto.org/wetice-2001/papers/radia-paper.pdf">
- PDF paper</A>,<CITE> Analysis of the IPsec Key Exchange Standard</CITE>
-.</LI>
-</UL>
-</LI>
-<LI>Bellovin's<A href="http://www.research.att.com/~smb/papers/index.html">
- papers</A> page including his:
-<UL>
-<LI><CITE>Security Problems in the TCP/IP Protocol Suite</CITE> (1989)</LI>
-<LI><CITE>Problem Areas for the IP Security Protocols</CITE> (1996)</LI>
-<LI><CITE>Probable Plaintext Cryptanalysis of the IP Security Protocols</CITE>
- (1997)</LI>
-</UL>
-</LI>
-<LI>An<A href="http://www.lounge.org/ike_doi_errata.html"> errata list</A>
- for the IPsec RFCs.</LI>
-</UL>
-<H3><A name="IP.background">Background information on IP</A></H3>
-<UL>
-<LI>An<A href="http://ipprimer.windsorcs.com/"> IP tutorial</A> that
- seems to be written mainly for Netware or Microsoft LAN admins entering
- a new world</LI>
-<LI><A href="http://www.iana.org">IANA</A>, Internet Assigned Numbers
- Authority</LI>
-<LI><A href="http://public.pacbell.net/dedicated/cidr.html">CIDR</A>,
- Classless Inter-Domain Routing</LI>
-<LI>Also see our<A href="biblio.html"> bibliography</A></LI>
-</UL>
-<H2><A name="implement">IPsec Implementations</A></H2>
-<H3><A name="linuxprod">Linux products</A></H3>
-<P>Vendors using FreeS/WAN in turnkey firewall or VPN products are
- listed in our<A href="intro.html#turnkey"> introduction</A>.</P>
-<P>Other vendors have Linux IPsec products which, as far as we know, do
- not use FreeS/WAN</P>
-<UL>
-<LI><A href="http://www.redcreek.com/products/shareware.html">Redcreek</A>
- provide an open source Linux driver for their PCI hardware VPN card.
- This card has a 100 Mbit Ethernet port, an Intel 960 CPU plus more
- specialised crypto chips, and claimed encryption performance of 45
- Mbit/sec. The PC sees it as an Ethernet board.</LI>
-<LI><A href="http://linuxtoday.com/stories/8428.html?nn">Paktronix</A>
- offer a Linux-based VPN with hardware encryption</LI>
-<LI><A href="http://www.watchguard.com/">Watchguard</A> use Linux in
- their Firebox product.</LI>
-<LI><A href="http://www.entrust.com">Entrust</A> offer a developers'
- toolkit for using their<A href="glossary.html#PKI"> PKI</A> for IPsec
- authentication</LI>
-<LI>According to a report on our mailing list,<A href="http://www.axent.com">
- Axent</A> have a Linux version of their product.</LI>
-</UL>
-<H3><A name="router">IPsec in router products</A></H3>
-<P>All the major router vendors support IPsec, at least in some models.</P>
-<UL>
-<LI><A href="http://www.cisco.com/warp/public/707/16.html">Cisco</A>
- IPsec information</LI>
-<LI>Ascend, now part of<A href="http://www.lucent.com/"> Lucent</A>,
- have some IPsec-based products</LI>
-<LI><A href="http://www.nortelnetworks.com/">Bay Networks</A>, now part
- of Nortel, use IPsec in their Contivity switch product line</LI>
-<LI><A href="http://www.3com.com/products/enterprise.html">3Com</A> have
- a number of VPN products, some using IPsec</LI>
-</UL>
-<H3><A name="fw.web">IPsec in firewall products</A></H3>
-<P>Many firewall vendors offer IPsec, either as a standard part of their
- product, or an optional extra. A few we know about are:</P>
-<UL>
-<LI><A href="http://www.borderware.com/">Borderware</A></LI>
-<LI><A href="http://www.ashleylaurent.com/vpn/ipsec_vpn.htm">Ashley
- Laurent</A></LI>
-<LI><A href="http://www.watchguard.com">Watchguard</A></LI>
-<LI><A href="http://www.fx.dk/firewall/ipsec.html">Injoy</A> for OS/2</LI>
-</UL>
-<P>Vendors using FreeS/WAN in turnkey firewall products are listed in
- our<A href="intro.html#turnkey"> introduction</A>.</P>
-<H3><A name="ipsecos">Operating systems with IPsec support</A></H3>
-<P>All the major open source operating systems support IPsec. See below
- for details on<A href="#BSD"> BSD-derived</A> Unix variants.</P>
-<P>Among commercial OS vendors, IPsec players include:</P>
-<UL>
-<LI><A href="http://msdn.microsoft.com/isapi/msdnlib.idc?theURL=/library/backgrnd/html/msdn_ip_security.htm">
-Microsoft</A> have put IPsec in their Windows 2000 and XP products</LI>
-<LI><A href="http://www.s390.ibm.com/stories/1999/os390v2r8_pr.html">IBM</A>
- announce a release of OS390 with IPsec support via a crypto
- co-processor</LI>
-<LI><A href="http://www.sun.com/solaris/ds/ds-security/ds-security.pdf">
-Sun</A> include IPsec in Solaris 8</LI>
-<LI><A href="http://www.hp.com/security/products/extranet-security.html">
-Hewlett Packard</A> offer IPsec for their Unix machines</LI>
-<LI>Certicom have IPsec available for the<A href="http://www.certicom.com/products/movian/movianvpn_tech.html">
- Palm</A>.</LI>
-<LI>There were reports before the release that Apple's Mac OS X would
- have IPsec support built in, but it did not seem to be there when we
- last checked. If you find, it please let us know via the<A href="mail.html">
- mailing list</A>.</LI>
-</UL>
-<H3><A NAME="29_3_5">IPsec on network cards</A></H3>
-<P>Network cards with built-in IPsec acceleration are available from at
- least Intel, 3Com and Redcreek.</P>
-<H3><A name="opensource">Open source IPsec implementations</A></H3>
-<H4><A name="linuxipsec">Other Linux IPsec implementations</A></H4>
-<P>We like to think of FreeS/WAN as<EM> the</EM> Linux IPsec
- implementation, but it is not the only one. Others we know of are:</P>
-<UL>
-<LI><A href="http://www.enst.fr/~beyssac/pipsec/">pipsecd</A>, a
- lightweight implementation of IPsec for Linux. Does not require kernel
- recompilation.</LI>
-<LI>Petr Novak's<A href="ftp://ftp.eunet.cz/icz/ipnsec/"> ipnsec</A>,
- based on the OpenBSD IPsec code and using<A href="glossary.html#photuris">
- Photuris</A> for key management</LI>
-<LI>A now defunct project at<A href="http://www.cs.arizona.edu/security/hpcc-blue/linux.html">
- U of Arizona</A> (export controlled)</LI>
-<LI><A href="http://snad.ncsl.nist.gov/cerberus">NIST Cerebus</A>
- (export controlled)</LI>
-</UL>
-<H4><A name="BSD">IPsec for BSD Unix</A></H4>
-<UL>
-<LI><A href="http://www.kame.net/project-overview.html">KAME</A>,
- several large Japanese companies co-operating on IPv6 and IPsec</LI>
-<LI><A href="http://web.mit.edu/network/isakmp">US Naval Research Lab</A>
- implementation of IPv6 and of IPsec for IPv4 (export controlled)</LI>
-<LI><A href="http://www.openbsd.org">OpenBSD</A> includes IPsec as a
- standard part of the distribution</LI>
-<LI><A href="http://www.r4k.net/ipsec">IPsec for FreeBSD</A></LI>
-<LI>a<A href="http://www.netbsd.org/Documentation/network/ipsec/"> FAQ</A>
- on NetBSD's IPsec implementation</LI>
-</UL>
-<H4><A name="misc">IPsec for other systems</A></H4>
-<UL>
-<LI><A href="http://www.tcm.hut.fi/Tutkimus/IPSEC/">Helsinki U of
- Technolgy</A> have implemented IPsec for Solaris, Java and Macintosh</LI>
-</UL>
-<H3><A name="interop.web">Interoperability</A></H3>
-<P>The IPsec protocols are designed so that different implementations
- should be able to work together. As they say &quot;the devil is in the
- details&quot;. IPsec has a lot of details, but considerable success has been
- achieved.</P>
-<H4><A name="result">Interoperability results</A></H4>
-<P>Linux FreeS/WAN has been tested for interoperability with many other
- IPsec implementations. Results to date are in our<A href="interop.html">
- interoperability</A> section.</P>
-<P>Various other sites have information on interoperability between
- various IPsec implementations:</P>
-<UL>
-<LI><A href="http://www.opus1.com/vpn/atl99display.html">interop results</A>
- from a bakeoff in Atlanta, September 1999.</LI>
-<LI>a French company, HSC's,<A href="http://www.hsc.fr/ressources/presentations/ipsec99/index.html.en">
- interoperability</A> test data covers FreeS/WAN, Open BSD, KAME, Linux
- pipsecd, Checkpoint, Red Creek Ravlin, and Cisco IOS</LI>
-<LI><A href="http://www.icsa.net/">ICSA</A> offer certification programs
- for various security-related products. See their list of<A href="http://www.icsa.net/html/communities/ipsec/certification/certified_products/index.shtml">
- certified IPsec</A> products. Linux FreeS/WAN is not currently on that
- list, but several products with which we interoperate are.</LI>
-<LI>VPNC have a page on why they are not yet doing<A href="http://www.vpnc.org/interop.html">
- interoperability</A> testing and a page on the<A href="http://www.vpnc.org/conformance.html">
- spec conformance</A> testing that they are doing</LI>
-<LI>a<A href="http://www.commweb.com/article/COM20000912S0009"> review</A>
- comparing a dozen commercial IPsec implemetations. Unfortunately, the
- reviewers did not look at Open Source implementations such as FreeS/WAN
- or OpenBSD.</LI>
-<LI><A href="http://www.tanu.org/~sakane/doc/public/report-ike-interop0007.html">
-results</A> from interoperability tests at a conference. FreeS/WAN was
- not tested there.</LI>
-<LI>test results from the<A href="http://www.hsc.fr/ressources/veille/ipsec/ipsec2000/">
- IPSEC 2000</A> conference</LI>
-</UL>
-<H4><A name="test1">Interoperability test sites</A></H4>
-<UL>
-<LI><A href="http://www.tahi.org/">TAHI</A>, a Japanese IPv6 testing
- project with free IPsec validation software</LI>
-<LI><A href="http://ipsec-wit.antd.nist.gov">National Institute of
- Standards and Technology</A></LI>
-<LI><A href="http://isakmp-test.ssh.fi/">SSH Communications Security</A></LI>
-</UL>
-<H2><A name="linux.link">Linux links</A></H2>
-<H3><A name="linux.basic">Basic and tutorial Linux information</A></H3>
-<UL>
-<LI>Linux<A href="http://linuxcentral.com/linux/LDP/LDP/gs/gs.html">
- Getting Started</A> HOWTO document</LI>
-<LI>A getting started guide from the<A href="http://darkwing.uoregon.edu/~cchome/linuxgettingstarted.html">
- U of Oregon</A></LI>
-<LI>A large<A href="http://www.herring.org/techie.html"> link collection</A>
- which includes a lot of introductory and tutorial material on Unix,
- Linux, the net, . . .</LI>
-</UL>
-<H3><A name="general">General Linux sites</A></H3>
-<UL>
-<LI><A href="http://www.freshmeat.net">Freshmeat</A> Linux news</LI>
-<LI><A href="http://slashdot.org">Slashdot</A> &quot;News for Nerds&quot;</LI>
-<LI><A href="http://www.linux.org">Linux Online</A></LI>
-<LI><A href="http://www.linuxhq.com">Linux HQ</A></LI>
-<LI><A href="http://www.tux.org">tux.org</A></LI>
-</UL>
-<H3><A name="docs.ldp">Documentation</A></H3>
-<P>Nearly any Linux documentation you are likely to want can be found at
- the<A href="http://metalab.unc.edu/LDP"> Linux Documentation Project</A>
- or LDP.</P>
-<UL>
-<LI><A href="http://metalab.unc.edu/LDP/HOWTO/META-FAQ.html">Meta-FAQ</A>
- guide to Linux information sources</LI>
-<LI>The LDP's HowTo documents are a standard Linux reference. See this<A href="http://www.linuxdoc.org/docs.html#howto">
- list</A>. Documents there most relevant to a FreeS/WAN gateway are:
-<UL>
-<LI><A href="http://metalab.unc.edu/LDP/HOWTO/Kernel-HOWTO.html">Kernel
- HOWTO</A></LI>
-<LI><A href="http://metalab.unc.edu/LDP/HOWTO/Networking-Overview-HOWTO.html">
-Networking Overview HOWTO</A></LI>
-<LI><A href="http://metalab.unc.edu/LDP/HOWTO/Security-HOWTO.html">
-Security HOWTO</A></LI>
-</UL>
-</LI>
-<LI>The LDP do a series of Guides, book-sized publications with more
- detail (and often more &quot;why do it this way?&quot;) than the HowTos. See this<A
-href="http://www.linuxdoc.org/guides.html"> list</A>. Documents there
- most relevant to a FreeS/WAN gateway are:
-<UL>
-<LI><A href="http://www.tml.hut.fi/~viu/linux/sag/">System
- Administrator's Guide</A></LI>
-<LI><A href="http://www.linuxdoc.org/LDP/nag2/index.html">Network
- Adminstrator's Guide</A></LI>
-<LI><A href="http://www.seifried.org/lasg/">Linux Administrator's
- Security Guide</A></LI>
-</UL>
-</LI>
-</UL>
-<P>You may not need to go to the LDP to get this material. Most Linux
- distributions include the HowTos on their CDs and several include the
- Guides as well. Also, most of the Guides and some collections of HowTos
- are available in book form from various publishers.</P>
-<P>Much of the LDP material is also available in languages other than
- English. See this<A href="http://www.linuxdoc.org/links/nenglish.html">
- LDP page</A>.</P>
-<H3><A name="advroute.web">Advanced routing</A></H3>
-<P>The Linux IP stack has some new features in 2.4 kernels. Some HowTos
- have been written:</P>
-<UL>
-<LI>several HowTos for the<A href="http://netfilter.samba.org/unreliable-guides/">
- netfilter</A> firewall code in newer kernels</LI>
-<LI><A href="http://www.ds9a.nl/2.4Networking/HOWTO//cvs/2.4routing/output/2.4networking.html">
-2.4 networking</A> HowTo</LI>
-<LI><A href="http://www.ds9a.nl/2.4Networking/HOWTO//cvs/2.4routing/output/2.4routing.html">
-2.4 routing</A> HowTo</LI>
-</UL>
-<H3><A name="linsec">Security for Linux</A></H3>
-<P>See also the<A href="#docs.ldp"> LDP material</A> above.</P>
-<UL>
-<LI><A href="http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html#trinityos">
-Trinity OS guide to setting up Linux</A></LI>
-<LI><A href="http://www.deter.com/unix">Unix security</A> page</LI>
-<LI><A href="http://linux01.gwdg.de/~alatham/">PPDD</A> encrypting
- filesystem</LI>
-<LI><A href="http://EncryptionHOWTO.sourceforge.net/">Linux Encryption
- HowTo</A> (outdated when last checked, had an Oct 2000 revision date in
- March 2002)</LI>
-</UL>
-<H3><A name="firewall.linux">Linux firewalls</A></H3>
-<P>Our<A href="firewall.html"> FreeS/WAN and firewalls</A> document
- includes links to several sets of<A href="firewall.html#examplefw">
- scripts</A> known to work with FreeS/WAN.</P>
-<P>Other information sources:</P>
-<UL>
-<LI><A href="http://ipmasq.cjb.net/">IP Masquerade resource page</A></LI>
-<LI><A href="http://netfilter.samba.org/unreliable-guides/">netfilter</A>
- firewall code in 2.4 kernels</LI>
-<LI>Our list of general<A href="#firewall.web"> firewall references</A>
- on the web</LI>
-<LI><A href="http://users.dhp.com/~whisper/mason/">Mason</A>, a tool for
- automatically configuring Linux firewalls</LI>
-<LI>the web cache software<A href="http://www.squid-cache.org/"> squid</A>
- and<A href="http://www.squidguard.org/"> squidguard</A> which turns
- Squid into a filtering web proxy</LI>
-</UL>
-<H3><A name="linux.misc">Miscellaneous Linux information</A></H3>
-<UL>
-<LI><A href="http://lwn.net/current/dists.php3">Linux distribution
- vendors</A></LI>
-<LI><A href="http://www.linux.org/groups/">Linux User Groups</A></LI>
-</UL>
-<H2><A name="crypto.link">Crypto and security links</A></H2>
-<H3><A name="security">Crypto and security resources</A></H3>
-<H4><A name="std.links">The standard link collections</A></H4>
-<P>Two enormous collections of links, each the standard reference in its
- area:</P>
-<DL>
-<DT>Gene Spafford's<A href="http://www.cerias.purdue.edu/coast/hotlist/">
- COAST hotlist</A></DT>
-<DD>Computer and network security.</DD>
-<DT>Peter Gutmann's<A href="http://www.cs.auckland.ac.nz/~pgut001/links.html">
- Encryption and Security-related Resources</A></DT>
-<DD>Cryptography.</DD>
-</DL>
-<H4><A name="FAQ">Frequently Asked Question (FAQ) documents</A></H4>
-<UL>
-<LI><A href="http://www.faqs.org/faqs/cryptography-faq/">Cryptography
- FAQ</A></LI>
-<LI><A href="http://www.interhack.net/pubs/fwfaq">Firewall FAQ</A></LI>
-<LI><A href="http://www.whitefang.com/sup/secure-faq.html">Secure Unix
- Programming FAQ</A></LI>
-<LI>FAQs for specific programs are listed in the<A href="#tools"> tools</A>
- section below.</LI>
-</UL>
-<H4><A name="cryptover">Tutorials</A></H4>
-<UL>
-<LI>Gary Kessler's<A href="http://www.garykessler.net/library/crypto.html">
- Overview of Cryptography</A></LI>
-<LI>Terry Ritter's<A href="http://www.ciphersbyritter.com/LEARNING.HTM">
- introduction</A></LI>
-<LI>Peter Gutman's<A href="http://www.cs.auckland.ac.nz/~pgut001/tutorial/index.html">
- cryptography</A> tutorial (500 slides in PDF format)</LI>
-<LI>Amir Herzberg of IBM's sildes for his course<A href="http://www.hrl.il.ibm.com/mpay/course.html">
- Introduction to Cryptography and Electronic Commerce</A></LI>
-<LI>the<A href="http://www.gnupg.org/gph/en/manual/c173.html"> concepts
- section</A> of the<A href="glossary.html#GPG"> GNU Privacy Guard</A>
- documentation</LI>
-<LI>Bruce Schneier's self-study<A href="http://www.counterpane.com/self-study.html">
- cryptanalysis</A> course</LI>
-</UL>
-<P>See also the<A href="#interesting"> interesting papers</A> section
- below.</P>
-<H4><A name="standards">Crypto and security standards</A></H4>
-<UL>
-<LI><A href="http://csrc.nist.gov/cc">Common Criteria</A>, new
- international computer and network security standards to replace the
- &quot;Rainbow&quot; series</LI>
-<LI>AES<A href="http://csrc.nist.gov/encryption/aes/aes_home.htm">
- Advanced Encryption Standard</A> which will replace DES</LI>
-<LI><A href="http://grouper.ieee.org/groups/1363">IEEE P-1363 public key
- standard</A></LI>
-<LI>our collection of links for the<A href="#ipsec.link"> IPsec</A>
- standards</LI>
-<LI>history of<A href="http://www.visi.com/crypto/evalhist/index.html">
- formal evaluation</A> of security policies and implementation</LI>
-</UL>
-<H4><A name="quotes">Crypto quotes</A></H4>
-<P>There are several collections of cryptographic quotes on the net:</P>
-<UL>
-<LI><A href="http://www.eff.org/pub/EFF/quotes.eff">the EFF</A></LI>
-<LI><A href="http://www.samsimpson.com/cquotes.php">Sam Simpson</A></LI>
-<LI><A href="http://www.amk.ca/quotations/cryptography/page-1.html">AM
- Kutchling</A></LI>
-</UL>
-<H3><A name="policy">Cryptography law and policy</A></H3>
-<H4><A name="legal">Surveys of crypto law</A></H4>
-<UL>
-<LI>International survey of<A href="http://cwis.kub.nl/~FRW/PEOPLE/koops/lawsurvy.htm">
- crypto law</A>.</LI>
-<LI>International survey of<A href="http://rechten.kub.nl/simone/ds-lawsu.htm">
- digital signature law</A></LI>
-</UL>
-<H4><A name="oppose">Organisations opposing crypto restrictions</A></H4>
-<UL>
-<LI>The<A href="glossary.html#EFF"> EFF</A>'s archives on<A href="http://www.eff.org/pub/Privacy/">
- privacy</A> and<A href="http://www.eff.org/pub/Privacy/ITAR_export/">
- export control</A>.</LI>
-<LI><A href="http://www.gilc.org">Global Internet Liberty Campaign</A></LI>
-<LI><A href="http://www.cdt.org/crypto">Center for Democracy and
- Technology</A></LI>
-<LI><A href="http://www.privacyinternational.org/">Privacy International</A>
-, who give out<A href="http://www.bigbrotherawards.org/"> Big Brother
- Awards</A> to snoopy organisations</LI>
-</UL>
-<H4><A name="other.policy">Other information on crypto policy</A></H4>
-<UL>
-<LI><A href="ftp://ftp.isi.edu/in-notes/rfc1984.txt">RFC 1984</A>, the<A href="glossary.html#IAB">
- IAB</A> and<A href="glossary.html#IESG"> IESG</A> Statement on
- Cryptographic Technology and the Internet.</LI>
-<LI>John Young's collection of<A href="http://cryptome.org/"> documents</A>
- of interest to the cryptography, open government and privacy movements,
- organized chronologically</LI>
-<LI>AT&amp;T researcher Matt Blaze's Encryption, Privacy and Security<A href="http://www.crypto.com">
- Resource Page</A></LI>
-<LI>A good<A href="http://cryptome.org/crypto97-ne.htm"> overview</A> of
- the issues from Australia.</LI>
-</UL>
-<P>See also our documentation section on the<A href="politics.html">
- history and politics</A> of cryptography.</P>
-<H3><A name="crypto.tech">Cryptography technical information</A></H3>
-<H4><A name="cryptolinks">Collections of crypto links</A></H4>
-<UL>
-<LI><A href="http://www.counterpane.com/hotlist.html">Counterpane</A></LI>
-<LI><A href="http://www.cs.auckland.ac.nz/~pgut001/links.html">Peter
- Gutman's links</A></LI>
-<LI><A href="http://www.pca.dfn.de/eng/team/ske/pem-dok.html">PKI links</A>
-</LI>
-<LI><A href="http://crypto.yashy.com/www/">Robert Guerra's links</A></LI>
-</UL>
-<H4><A name="papers">Lists of online cryptography papers</A></H4>
-<UL>
-<LI><A href="http://www.counterpane.com/biblio">Counterpane</A></LI>
-<LI><A href="http://www.cryptography.com/resources/papers">
-cryptography.com</A></LI>
-<LI><A href="http://www.cryptosoft.com/html/secpub.htm">Cryptosoft</A></LI>
-</UL>
-<H4><A name="interesting">Particularly interesting papers</A></H4>
-<P>These papers emphasize important issues around the use of
- cryptography, and the design and management of secure systems.</P>
-<UL>
-<LI><A href="http://www.counterpane.com/keylength.html">Key length
- requirements for security</A></LI>
-<LI><A href="http://www.cl.cam.ac.uk/users/rja14/wcf.html">Why
- Cryptosystems Fail</A></LI>
-<LI><A href="http://www.cdt.org/crypto/risks98/">Risks of escrowed
- encryption</A></LI>
-<LI><A href="http://www.counterpane.com/pitfalls.html">Security pitfalls
- in cryptography</A></LI>
-<LI><A href="http://www.acm.org/classics/sep95">Reflections on Trusting
- Trust</A>, Ken Thompson on Trojan horse design</LI>
-<LI><A href="http://www.apache-ssl.org/disclosure.pdf">Security against
- Compelled Disclosure</A>, how to maintain privacy in the face of legal
- or other coersion</LI>
-</UL>
-<H3><A name="compsec">Computer and network security</A></H3>
-<H4><A name="seclink">Security links</A></H4>
-<UL>
-<LI><A href="http://www.cs.purdue.edu/coast/hotlist">COAST Hotlist</A></LI>
-<LI>DMOZ open directory project<A href="http://dmoz.org/Computers/Security/">
- computer security</A> links</LI>
-<LI><A href="http://www-cse.ucsd.edu/users/bsy/sec.html">Bennet Yee</A></LI>
-<LI>Mike Fuhr's<A href="http://www.fuhr.org/~mfuhr/computers/security.html">
- link collection</A></LI>
-<LI><A href="http://www.networkintrusion.co.uk/">links</A> with an
- emphasis on intrusion detection</LI>
-</UL>
-<H4><A name="firewall.web">Firewall links</A></H4>
-<UL>
-<LI><A href="http://www.cs.purdue.edu/coast/firewalls">COAST firewalls</A>
-</LI>
-<LI><A href="http://www.zeuros.co.uk">Firewalls Resource page</A></LI>
-</UL>
-<H4><A name="vpn">VPN links</A></H4>
-<UL>
-<LI><A href="http://www.vpnc.org">VPN Consortium</A></LI>
-<LI>First VPN's<A href="http://www.firstvpn.com/research/rhome.html">
- white paper</A> collection</LI>
-</UL>
-<H4><A name="tools">Security tools</A></H4>
-<UL>
-<LI>PGP -- mail encryption
-<UL>
-<LI><A href="http://www.pgp.com/">PGP Inc.</A> (part of NAI) for
- commercial versions</LI>
-<LI><A href="http://web.mit.edu/network/pgp.html">MIT</A> distributes
- the NAI product for non-commercial use</LI>
-<LI><A href="http://www.pgpi.org/">international</A> distribution site</LI>
-<LI><A href="http://gnupg.org">GNU Privacy Guard (GPG)</A></LI>
-<LI><A href="http://www.dk.pgp.net/pgpnet/pgp-faq/">PGP FAQ</A></LI>
-</UL>
- A message in our mailing list archive has considerable detail on<A href="http://www.sandelman.ottawa.on.ca/linux-ipsec/html/2000/12/msg00029.html">
- available versions</A> of PGP and on IPsec support in them.
-<P><STRONG>Note:</STRONG> A fairly nasty bug exists in all commercial
- PGP versions from 5.5 through 6.5.3. If you have one of those,<STRONG>
- upgrade now</STRONG>.</P>
-</LI>
-<LI>SSH -- secure remote login
-<UL>
-<LI><A href="http://www.ssh.fi">SSH Communications Security</A>, for the
- original software. It is free for trial, academic and non-commercial
- use.</LI>
-<LI><A href="http://www.openssh.com/">Open SSH</A>, the Open BSD team's
- free replacement</LI>
-<LI><A href="http://www.freessh.org/">freessh.org</A>, links to free
- implementations for many systems</LI>
-<LI><A href="http://www.uni-karlsruhe.de/~ig25/ssh-faq">SSH FAQ</A></LI>
-<LI><A href="http://www.chiark.greenend.org.uk/~sgtatham/putty/">Putty</A>
-, an SSH client for Windows</LI>
-</UL>
-</LI>
-<LI>Tripwire saves message digests of your system files. Re-calculate
- the digests and compare to saved values to detect any file changes.
- There are several versions available:
-<UL>
-<LI><A href="http://www.tripwiresecurity.com/">commercial version</A></LI>
-<LI><A href="http://www.tripwire.org/">Open Source</A></LI>
-</UL>
-</LI>
-<LI><A href="http://www.snort.org">Snort</A> and<A href="http://www.lids.org">
- LIDS</A> are intrusion detection system for Linux</LI>
-<LI><A href="http://www.fish.com/~zen/satan/satan.html">SATAN</A> System
- Administrators Tool for Analysing Networks</LI>
-<LI><A href="http://www.insecure.org/nmap/">NMAP</A> Network Mapper</LI>
-<LI><A href="ftp://ftp.porcupine.org/pub/security/index.html">Wietse
- Venema's page</A> with various tools</LI>
-<LI><A href="http://ita.ee.lbl.gov/index.html">Internet Traffic Archive</A>
-, various tools to analyze network traffic, mostly scripts to organise
- and format tcpdump(8) output for specific purposes</LI>
-<LI><A name="ssmail">ssmail -- sendmail patched to do</A><A href="glossary.html#carpediem">
- opportunistic encryption</A>
-<UL>
-<LI><A href="http://www.home.aone.net.au/qualcomm/">web page</A> with
- links to code and to a Usenix paper describing it, in PDF</LI>
-</UL>
-</LI>
-<LI><A href="http://www.openca.org/">Open CA</A> project to develop a
- freely distributed<A href="glossary.html#CA"> Certification Authority</A>
- for building a open<A href="glossary.html#PKI"> Public Key
- Infrastructure</A>.</LI>
-</UL>
-<H3><A name="people">Links to home pages</A></H3>
-<P>David Wagner at Berkeley provides a set of links to<A href="http://www.cs.berkeley.edu/~daw/people/crypto.html">
- home pages</A> of cryptographers, cypherpunks and computer security
- people.</P>
-<HR>
-<A HREF="toc.html">Contents</A>
-<A HREF="mail.html">Previous</A>
-<A HREF="glossary.html">Next</A>
-</BODY>
-</HTML>