M5484LITEKITE Freescale Semiconductor, M5484LITEKITE Datasheet - Page 12
![KIT DEV FOR MCF548X FAMILY](/photos/9/23/92382/m5484litekite_sml.jpg)
M5484LITEKITE
Manufacturer Part Number
M5484LITEKITE
Description
KIT DEV FOR MCF548X FAMILY
Manufacturer
Freescale Semiconductor
Series
ColdFire®r
Type
MPUr
Specifications of M5484LITEKITE
Contents
Module and Misc Hardware
Processor To Be Evaluated
MCF548x
Data Bus Width
32 bit
Interface Type
RS-232, Ethernet
For Use With/related Products
MCF548x
For Use With
460-1028 - CABLE DISP FREESCALE M5475,85EVB
Lead Free Status / RoHS Status
Lead free / RoHS Compliant
Setting Up Device Drivers and Modules
9.5
To include the IPSEC driver in compilation, the following options should be enabled:
To include ipsecadm you should enable:
The IPsec tunnel implementation is divided into two parts: one kernel module called ipsec_tunnel.o, and
a tool to administrate security associations and tunnels called ipsecadm.
The ipsecadm tool has a built-in brief help which is displayed if you execute it without parameters, or with
unknown or invalid parameters. The tool has three main modes: the first is for adding and removing
security associations (SAs), the second is for adding, modifying and removing tunnels, and the third mode
is for displaying statistics. Before we start, we need an example scenario. Let's say that we are going to
create a tunnel between the two hosts A and B. The public IP number of host A is 1.2.3.4 and its private
IP address is 10.0.1.0/24.
IPsec uses Security Associations (SAs), which are another name for a security agreement between two
hosts. The SA is uniquely described by two IP addresses and a 32-bit number called a SPI. The SPI allows
more than one SA between a pair of hosts. When the SA was agreed upon, the two parties agreed upon the
type of the SA which can basically be encryption and/or authorization, but also the algorithms, key sizes,
and keys to be used.
Before we can create an SA, we need a key. The best way to create a key is to use ipsecadm. To create a
192-bit key (which corresponds to 24 bytes) and put it in the file /etc/ipsec/ipsec.key run the following:
Before the previous command execution on the nfs file system, we need to make it available for writing:
For the romfs we have to place the generated key to ‘<project_dir>/merge/etc/ipsec/’. Now we can use
ipsecadm to create the SA above. The name of the cipher is specified using its CryptoAPI name, which
can be a little strange. The name for triple DES is des3_ede. You can see which ciphers you have installed
by looking in the file /proc/crypto.
To create a tunnel you need two SAs, one in each direction. Since it is common to use the same security
settings for both directions, you can create a pair of SAs at one time by using --duplex. Note that it is safer
to supply the key as a file (using --cipher-keyfile) than to specify it on the command line (using
--cipher-key), because it is easy for a local user to locate the key using w or ps.
12
•
•
kernel->Network Device Support->
— IPSEC tunnel device
Administration-> Administration_Network->tcp_wrappers->ipsecadm
mkdir /etc/ipsec
chmod 500 /etc/ipsec
ipsecadm key create 3des --file=/etc/ipsec/example.key
mount –o remount,rw /dev/root /
ipsecadm sa add --spi=0x1000 --dst=192.168.1.16 --src=192.168.1.15 \
IPSEC Module
--cipher=des3_ede --cipher-keyfile=/etc/ipsec/example.key \
--duplex
MCF547x/8x Linux BSP Quick Start, Rev. 0.2
Freescale Semiconductor