pluto: Removed references to KLIPS from documentation, log messages and comments.

README

@@ -81,7 +81,7 @@ Contents
 strongSwan is an OpenSource IPsec solution for the Linux operating system
 and currently supports the following features:
 
-  * runs both on Linux 2.4 (KLIPS) and Linux 2.6 (native IPsec) kernels.
+  * runs on Linux 2.6 (native IPsec) kernels.
 
   * strong 3DES, AES, Serpent, Twofish, or Blowfish encryption.
 
@@ -2656,9 +2656,6 @@ with the line
 
 and can be used when the following prerequisites are fulfilled:
 
-  - Linux 2.4.x kernel, KLIPS IPsec stack, and arbitrary iptables version.
-    Filtering of tunneled traffic is based on ipsecN interfaces.
-
   - Linux 2.6.16 kernel or newer, native NETKEY IPsec stack, and
     iptables-1.3.5 or newer. Filtering of tunneled traffic is based on
     IPsec policy matching rules.

src/pluto/connections.c

@@ -1077,7 +1077,7 @@ void add_connection(const whack_message_t *wm)
 		if ((c->policy & POLICY_COMPRESS) && !can_do_IPcomp)
 		{
 			loglog(RC_COMMENT
-				, "ignoring --compress in \"%s\" because KLIPS is not configured to do IPCOMP"
+				, "ignoring --compress in \"%s\" because kernel does not support IPCOMP"
 				, c->name);
 		}
 

src/pluto/kernel_pfkey.c

@@ -262,7 +262,7 @@ finish_pfkey_msg(struct sadb_ext *extensions[SADB_EXT_MAX + 1],
 				success = FALSE;
 
 				/* if we were compiled with debugging, but we haven't already
-				 * dumped the KLIPS command, do so.
+				 * dumped the command, do so.
 				 */
 #ifdef DEBUG
 				if ((cur_debugging & DBG_KERNEL) == 0)

src/pluto/pluto.8

@@ -256,10 +256,7 @@ In other words,
 .BR pluto
 can eliminate much of the work of manual keying.
 The actual
-secure transmission of packets is the responsibility of other parts of
+secure transmission of packets is the responsibility of the Linux kernel.
-the system (see
-.BR KLIPS ,
-the companion implementation of IPsec).
 \fIipsec_auto\fP(8) provides a more convenient interface to
 \fBpluto\fP and \fBwhack\fP.
 .SS IKE's Job
@@ -314,8 +311,8 @@ are considered policy and are left in the system administrator's hands.
 .SS Pluto
 .LP
 \fBpluto\fP is an implementation of IKE.  It runs as a daemon on a network
-node.  Currently, this network node must be a LINUX system running the
+node.  Currently, this network node must be a Linux 2.6 system running the
-\fBKLIPS\fP implementation of IPsec.
+native \fBNETKEY\fP IPsec stack.
 .LP
 \fBpluto\fP only implements a subset of IKE.  This is enough for it to
 interoperate with other instances of \fBpluto\fP, and many other IKE
@@ -331,13 +328,13 @@ peers with whom it is negotiating.
 .LP
 \fBpluto\fP initiates negotiation of a Security Association when it is
 manually prodded: the program \fBwhack\fP is run to trigger this.
-It will also initiate a negotiation when \fBKLIPS\fP traps an outbound packet
+It will also initiate a negotiation when the Linux kernel traps an outbound
-for Opportunistic Encryption.
+packet for Opportunistic Encryption.
 .LP
 \fBpluto\fP implements ISAKMP SAs itself.  After it has negotiated the
-characteristics of an IPsec SA, it directs \fBKLIPS\fP to implement it.
+characteristics of an IPsec SA, it directs the Linux kernel to implement it.
 It also invokes a script to adjust any firewall and issue \fIroute\fP(8)
-commands to direct IP packets through \fBKLIPS\fP.
+commands.
 .LP
 When \fBpluto\fP shuts down, it closes all Security Associations.
 .SS Before Running Pluto
@@ -345,8 +342,8 @@ When \fBpluto\fP shuts down, it closes all Security Associations.
 \fBpluto\fP runs as a daemon with userid root.  Before running it, a few
 things must be set up.
 .LP
-\fBpluto\fP requires \fBKLIPS\fP, the FreeS/WAN implementation of IPsec.
+\fBpluto\fP requires a Linux 2.6 kernel with the modules for the native IPsec
-All of the components of \fBKLIPS\fP and \fBpluto\fP should be installed.
+stack enabled.
 .LP
 \fBpluto\fP supports multiple public networks (that is, networks
 that are considered insecure and thus need to have their traffic
@@ -355,11 +352,8 @@ public interfaces to use by looking at all interfaces that are
 configured (the \fB\-\-interface\fP option can be used to limit
 the interfaces considered).
 It does this only when \fBwhack\fP tells it to \-\-listen,
-so the interfaces must be configured by then.  Each interface with a name of the form
+so the interfaces must be configured by then.
-\fBipsec\fP[\fB0\fP-\fB9\fP] is taken as a \fBKLIPS\fP virtual public interface.
+\fIifconfig\fP(8) with the \fB\-a\fP flag will show
-Another network interface with the same IP address (there should be only
-one) is taken as the corresponding real public
-interface.  \fIifconfig\fP(8) with the \fB\-a\fP flag will show
 the name and status of each network interface.
 .LP
 \fBpluto\fP requires a database of preshared secrets and RSA private keys.
@@ -368,33 +362,6 @@ This is described in the
 \fBpluto\fP is told of RSA public keys via \fBwhack\fP commands.
 If the connection is Opportunistic, and no RSA public key is known,
 \fBpluto\fP will attempt to fetch RSA keys using the Domain Name System.
-.SS Setting up \fBKLIPS\fP for \fBpluto\fP
-.LP
-The most basic network topology that \fBpluto\fP supports has two security
-gateways negotiating on behalf of client subnets.  The diagram of RGB's
-testbed is a good example (see \fIklips/doc/rgb_setup.txt\fP).
-.LP
-The file \fIINSTALL\fP in the base directory of this distribution
-explains how to start setting up the whole system, including \fBKLIPS\fP.
-.LP
-Make sure that the security gateways have routes to each other.  This
-is usually covered by the default route, but may require issuing
-.IR route (8)
-commands.  The route must go through a particular IP
-interface (we will assume it is \fIeth0\fP, but it need not be).  The
-interface that connects the security gateway to its client must be a
-different one.
-.LP
-It is necessary to issue a
-.IR ipsec_tncfg (8)
-command on each gateway.  The required command is:
-
-\ \ \ ipsec tncfg \-\-attach\ \-\-virtual\ ipsec0 \-\-physical\ eth0
-
-A command to set up the ipsec0 virtual interface will also need to be
-run.  It will have the same parameters as the command used to set up
-the physical interface to which it has just been connected using
-.IR ipsec_tncfg (8).
 .SS ipsec.secrets file
 .LP
 A \fBpluto\fP daemon and another IKE daemon (for example, another instance
@@ -473,13 +440,6 @@ corresponding to a particular connection.
 Often there is one representing an ISAKMP SA and another representing
 an IPsec SA.
 .LP
-\fBKLIPS\fP hooks into the routing code in a LINUX kernel.
-Traffic to be processed by an IPsec SA must be directed through
-\fBKLIPS\fP by routing commands.  Furthermore, the processing to be
-done is specified by \fIipsec eroute(8)\fP commands.
-\fBpluto\fP takes the responsibility of managing both of these special
-kinds of routes.
-.LP
 Each connection may be routed, and must be while it has an IPsec SA.
 The connection specifies the characteristics of the route: the
 interface on this machine, the ``gateway'' (the nexthop),
@@ -519,9 +479,9 @@ SA for the same connection already has an eroute, all its outgoing traffic
 is taken over by the new eroute.  The incoming traffic will still be
 processed.  This characteristic is exploited during rekeying.
 .LP
-All of these routing characteristics are expected change when
+Some of these routing characteristics are specific to \fBKLIPS\fP, the FreeS/WAN
-\fBKLIPS\fP is modified to use the firewall hooks in the LINUX 2.4.x
+implementation of IPsec and are not relevant when running pluto on the native
-kernel.
+Linux 2.6 IPsec stack.
 .SS Using Whack
 .LP
 \fBwhack\fP is used to command a running \fBpluto\fP.
@@ -691,7 +651,7 @@ Note that this has nothing to do with IKE authentication.
 .TP
 \fB\-\-compress\fP
 All proposed IPsec SAs will include IPCOMP (compression).
-This will be ignored if KLIPS is not configured with IPCOMP support.
+This will be ignored if the kernel is not configured with IPCOMP support.
 .TP
 \fB\-\-tunnel\fP
 the IPsec SA should use tunneling.  Implicit if the SA is for clients.
@@ -1351,8 +1311,8 @@ show \fBpluto\fP's decision making
 \fB\-\-debug-lifecycle\fP
 [this option is temporary] log more detail of lifecycle of SAs
 .TP
-\fB\-\-debug-klips\fP
+\fB\-\-debug-kernel\fP
-show \fBpluto\fP's interaction with \fBKLIPS\fP
+show \fBpluto\fP's interaction with the kernel
 .TP
 \fB\-\-debug-dns\fP
 show \fBpluto\fP's interaction with \fBDNS\fP for KEY and TXT records
@@ -1418,11 +1378,6 @@ system (\fBpluto\fP didn't send a reply because it wasn't happy with
 the previous message).
 .SS Notes
 .LP
-If \fBpluto\fP is compiled without \-DKLIPS, it negotiates Security
-Associations but never ask the kernel to put them in place and never
-makes routing changes.  This allows \fBpluto\fP to be tested on systems
-without \fBKLIPS\fP, but makes it rather useless.
-.LP
 Each IPsec SA is assigned an SPI, a 32-bit number used to refer to the SA.
 The IKE protocol lets the destination of the SA choose the SPI.
 The range 0 to 0xFF is reserved for IANA.
@@ -1469,7 +1424,7 @@ component.  The selection is controlled by the \-\-encrypt and
 .IP \(bu
 Each of these may be combined with IPCOMP Deflate compression,
 but only if the potential connection specifies compression and only
-if KLIPS is configured with IPCOMP support.
+if the kernel is configured with IPCOMP support.
 .IP \(bu
 The IPSEC SAs may be tunnel or transport mode, where appropriate.
 The \-\-tunnel flag controls this when \fBpluto\fP is initiating.

src/pluto/spdb.c

@@ -2176,7 +2176,7 @@ parse_ipsec_sa_body(
 #endif
 			if (!can_do_IPcomp)
 			{
-				plog("compression proposed by %s, but KLIPS is not configured with IPCOMP"
+				plog("compression proposed by %s, but kernel does not support IPCOMP"
 					, ip_str(&c->spd.that.host_addr));
 				continue;
 			}

src/starter/README

@@ -18,8 +18,6 @@ Usage:
 FEATURES
 --------
 
-o Load and unload KLIPS (ipsec.o kernel module)
-
 o Load modules of the native Linux 2.6 IPsec stack
 
 o Launch and monitor pluto
@@ -50,8 +48,7 @@ o /var/run/dynip/xxxx can be used to use a virtual interface name in
 
 o %auto can be used to automaticaly name the connections
 
-o kill -TERM can be used to stop FS. pluto will be stopped and KLIPS unloaded
+o kill -TERM can be used to stop FS. pluto will be stopped.
-  (if it has been loaded).
 
 o Can be used to start strongSwan and load lots of connections in a few
   seconds.