NRL IPv6+IPsec Software Distribution

Introduction

The NRL IPv6/IPsec Software Distribution is a reference implementation of IPv6 and IP Security for the 4.4BSD-Lite networking software. It is freely distributable (subject to U.S. export controls) and usable for commercial and non-commercial purposes as long as the NRL and UC Berkeley license terms are adhered to.

We have tested this software on SPARC systems using the UC Berkeley 4.4 BSD UNIX operating system with 4.4-Lite updates. We have also tested this software on x86 systems running NetBSD 1.2, SPARC systems running NetBSD 1.2, and x86 systems using BSDI 2.1. We believe that our code should be easily portable to reasonable 4.4BSD derived systems (BSDI, NetBSD, OpenBSD, and Lites). We believe that it would be difficult, though not impossible, to port our code to other systems.

This implementation includes kernel networking software, a small IPv6 support library, and several applications (e.g. telnet, telnetd, ping, tftp, tftpd, socktest, netstat, ifconfig, ping, route, tcpdump) modified to support IPv6/IPsec. This implementation also includes the NRL Key Engine (aka PF_KEY) and applications to interface with it. There are manual pages for the modified and new software, but they might not yet be as detailed as one might like.

This "alpha-quality" release of the IPv6/IPsec software is intended to be used by kernel hackers and implementers who want to get early access and experience with IPv6 and IPsec. Use at your own risk. It is complete enough to use for experimenting but it is not entirely complete. In some areas this is because the specifications are not yet stable.

What's New

• Bug fixes
• Updated IPv6 BSD Socket API to draft 6.
• Added the IPv6 Advanced Socket API (draft 0).
• A NetBSD 64-bit alpha port contributed by Fred Templin (NASA). John Hawkinson provided useful bug reports/fixes to improve upon the port.
• Changed socket security API in anticipation of a new design that will be included in a future release. If you have comments or suggestions on things you would like to see in the new API, please send them to the ipv6-users mailing list.
• All applications with security support now use different command- line parameters to request security services than in previous releases. The '-S' flag is the standard flag for requesting security properties.
• A router advertisement daemon contributed by Lars Fenneberg.
• Added an IPv6 sendmail.
• Updated libpcap and tcpdump.
• Fixed bug causing IPSEC tunnels to eventually lead to a kernel panic or to not encrypt packets at all.
• Added limited support for address lifetime. More complete address deprecation and invalidation will be supported in the future release.
• An OpenBSD 2.0 port contributed by Andrea Rivetti and Andrea Spera (Politecnico di Torino, Italy)
• Fixed a good number of routing table and neighbor discovery bugs. The code should be much more stable especially in "non-standard" cases.

Legal

UNIX is a trademark of X/Open.

NRL is a trademark of the US Naval Research Laboratory.

All other trademarks are property of their respective owners.

For more information

Download the code! If you are in the U.S., get the code from MIT or cisco Systems. Users outside the U.S. are on their own -- parts of the code are export controlled.

As a last resort, you can send specific questions to < ipv6-info@itd.nrl.navy.mil >. Do not send junk e-mail or questions not specifically related to the NRL IPv6+IPsec code to this address.