Comparative between implementations
We have tried to interoperate with the others opensource IKEv2 implementations and we have generated a comparative table indicating with features are implemented or missed in each one. This is only a ilustrative figure, it is possible there are features in the others implementations that we had forgotten or simply not known or tested. Please, if you realize some wrong information, mail us and we change it as soon as possible.You can see the comparation table here.
libopenikev2 0.4 API (not fully finished)
You can use the libopenikev2 library in any application that needs perform some IKEv2 exchanges. The API documentation helps to understand how libopenikev2 works.
This documention version is not definitive and may contain some errors.
You can see the libopenikev2 API here.
libopenikev2_impl 0.4 API (not fully finished)
libopenikev2 needs some concrete implementations to its interfaces in order to perform its funcionability. libopenikev2_impl implements all of them. You can use that implementations directly or use them as example to implement your own concrete implementations.
This documention version is not definitive and may contain some errors.
You can see the libopenikev2_impl API here.
Third-party software
There are some parts of openikev2 code based on opensource third-party code. These parts are:- PFKEYv2: some code of this part are based on libipsec from KAME project and PFKEYv2 related code from IKEv2.
- XFRM: some code of this part are based on pluto from FreeS/WAN project and libnetlink from iproute2.
- DHCP: almost all the code of this part are based on the DHCP client of the udhcp project.
- EAP: the code for the EAP state machine has been taken from the wpa_supplicant client. The files have been kept without any modification (except a minimal one to avoid name collision with config.h file).
Needed software
Note that libopenikev2 is totally independent of any other library. However, libopenikev2_impl needs some additional libraries to perform its functionality. These libraries are:
- openssl
- libpthread
- http-fetcher
- libconfuse
Please, refer to each library home page to download them or install them from your distribution if they are available.
In addition, openikev2 needs both libopenikev2 and libopenikev2_impl.
How to configure & run openikev2 application
Installing needed libraries
- Install the libopenikev2 library
Untar the file libopenikev2-xxxx.tar.gz in the desired directory. Then do "./configure", "make" and "make install". - Install the needed libraries
Install them from your distribution (using apt, rpm, yum...) or follow the installation instructions of each one. - Install the libopenikev2_impl library
Untar the file libopenikev2_impl-xxxx.tar.gz in the desired directory. The do "./configure", "make" and "make install"
Compiling and installing openikev2 application
Untar the file openikev2-xxxx.tgz in the desired directory. Then do "./configure", "make" and "make install".
Configuring openikev2
openikev2 needs, at the moment, one configuration file. Its default location and name is "/etc/openikev2/openikev2.conf", but you can use another configuration file using the "-f" command line option.
An example of this configuration file is located into the "samples/openikev2.conf" directory and has the following syntax: openikev2.conf. (This is the last version configuration file. It doesn't work propertly with previous versions).
Now policies can be indicated in configuration file, and it is possible to add the the allow policies automaticaly.
Starting openikev2
Once you have the system configured, you can start the openikev2 program. openikev2 needs root privileges in order to crate the network socket, netlink socket, SAs, security policies, etc...
When using XFRM IPsec interface implementation (this is always true for 0.6 version), it is needed to load the "xfrm_user" kernel module before start openikev2 or have the following options enabled in your kernel:
CONFIG_XFRM_USER=y
The option "-F" allows see the log output on the screen, otherwise it will be written in the file "openike_log". The option "-f" allows specify the location and name of the configuration file. Use "-h" option to get a brief help.
When openikev2 is started in both peers, IPsec SAs will be stablished when needed.
Tested distributions
Take note that by default openikev2is installed into the /usr/local/sbin directory and you may want to include it in your path. Also remember to execute "ldconfig" at the end of the installation process in order to openikev2 could use installed libraries.
