Suppose I have a host and VM connected using virtual network. I done:
host# ip -6 addr fc::1/120 dev eth0 host# ip link set eth0 up vm# ip -6 addr fc::2/120 dev eth0 vm# ip link set eth0 up
How to enable encryption using setkey(8) (using simplest pre-shared key, not necessarily super-secure)?
echo 'add fc::2 fc::1 esp 123457 -E des-cbc 0x3ffe05014819ffff ;' | setkey -c (based on example from the manpage) seems to be not enough...
(Don't just recommend to use open-/strongswan/racoon or whatever high-level solutions)
Update: found myself. Doing this on host (and the same with swapped
out and `in on the vm) sets up the encryption:
setkey -F && setkey -FP && setkey -c <<< ' spdadd fc::1 fc::2 any -P out ipsec esp/transport//require ; spdadd fc::2 fc::1 any -P in ipsec esp/transport//require ; add fc::2 fc::1 esp 123457 -E des-cbc 0x3ffe05014819ffff ; add fc::1 fc::2 esp 123457 -E des-cbc 0x3ffe05014819ffff ; '
Still looking for a good setkey tutorial which explains that is "SPD", what modes are there, how they are implemented, how IPSec works in general, etc.