Next: , Previous: , Up: ESPER  

ESPER usage

Listening on divert socket requires root-privileges. After daemon is started, you have to:

  1. Redirect necessary traffic to that divert port (12345 by default). For example to divert outbound TCP and UDP traffic from fc00::dc host to fc00::ac, and inbound ESP traffic from fc00::ac, you can use the following ipfw commands:
    ipfw add divert 12345 esp from fc00::ac to fc00::dc
    ipfw add divert 12345 { tcp or udp } from fc00::dc to fc00::ac
  2. Create necessary security associations (SA) and policies (SP), for example by sending the following CRLF-terminated commands to ESPER’s UNIX-socket (esper.sock by default):
    $ echo "
    flush ;
    spdflush ;
    add fc00::ac fc00::dc esp 0x12345678 -u 123 -E aes-gcm-16 0xd3537e657fde5599a2804fbb52d1aaed94b65d3e ;
    add fc00::dc fc00::ac esp 0x12345679 -u 234 -E aes-gcm-16 0x9a2dae68e475eacb39d41f23c3cbef890e9f6276 tfc:1320 ;
    add fc00::123 fc00::234 esp 0x12345680 -u 345 -E aes-gcm-16-esn 0xd3537e657fde5599a2804fbb52d1aaed94b65d3d tfc:1320 ;
    spdadd fc00::ac/128 fc00::dc/128 tcp -P in ipsec esp/transport//unique:123 ;
    spdadd fc00::ac/128 fc00::dc/128 udp -P in ipsec esp/transport//unique:123 ;
    spdadd fc00::dc/128 fc00::ac/128 tcp -P out ipsec esp/transport//unique:234 ;
    spdadd fc00::dc/128 fc00::ac/128 udp -P out ipsec esp/transport//unique:234 ;
    dump ;
    spddump ;
    " | while read cmd; do
        [ -z "$cmd" ] || printf "$cmd\r\n" | socat - UNIX-CONNECT:esper.sock

    and ESPER will output command execution result:

    SA ID:123 fc00::ac -> fc00::dc SPI:12345678 SEQ:0x00000000 AES-GCM-16-128
    SA ID:234 fc00::dc -> fc00::ac SPI:12345679 SEQ:0x00000000 AES-GCM-16-128
    SA ID:345 fc00::123 -> fc00::234 SPI:12345680 SEQ:0x0000000000000000 TFC:1320 AES-GCM-16-128
    SP fc00::ac/128[0] -> fc00::dc/128[0] PROTO:6 IN TRANSPORT SAID:123
    SP fc00::ac/128[0] -> fc00::dc/128[0] PROTO:17 IN TRANSPORT SAID:123
    SP fc00::dc/128[0] -> fc00::ac/128[0] PROTO:6 OUT TRANSPORT SAID:234
    SP fc00::dc/128[0] -> fc00::ac/128[0] PROTO:17 OUT TRANSPORT SAID:234