ipsec: Updated ipsec(8)

src/ipsec/Makefile.am

@@ -9,6 +9,7 @@ _ipsec.8 : _ipsec.8.in
 	-e "s:@IPSEC_VERSION@:$(PACKAGE_VERSION):" \
 	-e "s:@IPSEC_SCRIPT@:$(ipsec_script):g" \
 	-e "s:@IPSEC_SCRIPT_UPPER@:$(ipsec_script_upper):g" \
+	-e "s:@IPSEC_DIR@:$(ipsecdir):" \
 	$(srcdir)/$@.in > $@
 
 _ipsec : _ipsec.in

src/ipsec/_ipsec.8.in

@@ -1,11 +1,19 @@
-.TH @IPSEC_SCRIPT_UPPER@ 8 "2013-07-22" "@IPSEC_VERSION@" "strongSwan"
+.TH @IPSEC_SCRIPT_UPPER@ 8 "2013-10-29" "@IPSEC_VERSION@" "strongSwan"
+.
 .SH NAME
+.
 @IPSEC_SCRIPT@ \- invoke IPsec utilities
+.
 .SH SYNOPSIS
-.B @IPSEC_SCRIPT@
+.
-\fIcommand\fP [ \fIarguments\fP ] [ \fIoptions\fP ]
+.SY @IPSEC_SCRIPT@
-.PP
+.I command
+.RI [ arguments ]
+.RI [ options ]
+.YS
+.
 .SH DESCRIPTION
+.
 The
 .B @IPSEC_SCRIPT@
 utility invokes any of several utilities involved in controlling and monitoring
@@ -13,44 +21,40 @@ the IPsec encryption/authentication system, running the specified \fIcommand\fP
 with the specified \fIarguments\fP and \fIoptions\fP as if it had been invoked
 directly. This largely eliminates possible name collisions with other software,
 and also permits some centralized services.
-.PP
+.P
 All the commands described in this manual page are built-in and are used to
-control and monitor IPsec connections as well as the IKE daemons.
+control and monitor IPsec connections as well as the IKE daemon.
-.PP
+.P
 For other commands
 .I @IPSEC_SCRIPT@
 supplies the invoked
 .I command
 with a suitable PATH environment variable,
-and also provides IPSEC_DIR,
+and also provides the environment variables listed under
-IPSEC_CONFS, and IPSEC_VERSION environment variables,
+.IR ENVIRONMENT .
-containing respectively
+.
-the full pathname of the directory where the IPsec utilities are stored,
-the full pathname of the directory where the configuration files live,
-and the IPsec version number.
-.PP
 .SS CONTROL COMMANDS
+.
 .TP
-.B "start [ starter options ]"
+.BI "start [" "starter options" ]
 calls
-.BR "starter"
+.B "starter"
-which in turn parses \fIipsec.conf\fR and starts the IKEv1/IKEv2 daemon
+which in turn parses \fIipsec.conf\fR and starts the IKE daemon \fIcharon\fR.
-\fIcharon\fR.
+.
-.PP
 .TP
 .B "update"
 sends a \fIHUP\fR signal to
 .BR "starter"
 which in turn determines any changes in \fIipsec.conf\fR
 and updates the configuration on the running IKE daemon \fIcharon\fR.
-.PP
+.
 .TP
 .B "reload"
 sends a \fIUSR1\fR signal to
 .BR "starter"
-which in turn reloads the whole configuration on the running IKE daemon
+which in turn reloads the whole configuration of the running IKE daemon
 \fIcharon\fR based on the actual \fIipsec.conf\fR.
-.PP
+.
 .TP
 .B "restart"
 is equivalent to
@@ -58,224 +62,249 @@ is equivalent to
 followed by
 .B "start"
 after a guard of 2 seconds.
-.PP
+.
 .TP
 .B "stop"
 terminates all IPsec connections and stops the IKE daemon \fIcharon\fR
 by sending a \fITERM\fR signal to
 .BR "starter".
-.PP
+.
 .TP
-.B "up \fIname\fP"
+.BI "up " name
 tells the IKE daemon to start up connection \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname\fP"
+.BI "down " name
 tells the IKE daemon to terminate connection \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname{n}\fP"
+.BI "down " name{n}
 terminates IKEv1 Quick Mode and IKEv2 CHILD SA instance \fIn\fP of
 connection \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname{*}\fP"
+.BI "down " name{*}
 terminates all IKEv1 Quick Mode and  IKEv2 CHILD SA instances of connection
 \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname[n]\fP"
+.BI "down " name[n]
 terminates IKE SA instance \fIn\fP of connection \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname[*]\fP"
+.BI "down " name[*]
 terminates all IKE SA instances of connection \fIname\fP.
-.PP
+.
 .TP
-.B "route \fIname\fP"
+.BI "route " name
 tells the IKE daemon to insert an IPsec policy in the kernel
 for connection \fIname\fP. The first payload packet matching the IPsec policy
 will automatically trigger an IKE connection setup.
-.PP
+.
 .TP
-.B "unroute \fIname\fP"
+.BI "unroute " name
 remove the IPsec policy in the kernel for connection \fIname\fP.
-.PP
+.
 .TP
-.B "status [ \fIname\fP ]"
+.BI "status [" name ]
 returns concise status information either on connection
 \fIname\fP or if the argument is lacking, on all connections.
-.PP
+.
 .TP
-.B "statusall [ \fIname\fP ]"
+.BI "statusall [" name ]
 returns detailed status information either on connection
 \fIname\fP or if the argument is lacking, on all connections.
-.PP
+.
 .SS LIST COMMANDS
+.
 .TP
 .B "listalgs"
 returns a list supported cryptographic algorithms usable for IKE, and their
 corresponding plugin.
-.PP
+.
 .TP
-.B "listpubkeys [ --utc ]"
+.BI "listpubkeys [" --utc ]
 returns a list of RSA public keys that were either loaded in raw key format
 or extracted from X.509 and|or OpenPGP certificates.
-.PP
+.
 .TP
-.B "listcerts [ --utc ]"
+.BI "listcerts [" --utc ]
 returns a list of X.509 and|or OpenPGP certificates that were either loaded
 locally by the IKE daemon or received via the IKE protocol.
-.PP
+.
 .TP
-.B "listcacerts [ --utc ]"
+.BI "listcacerts [" --utc ]
 returns a list of X.509 Certification Authority (CA) certificates that were
 loaded locally by the IKE daemon from the \fI/etc/ipsec.d/cacerts/\fP
 directory or received via the IKE protocol.
-.PP
+.
 .TP
-.B "listaacerts [ --utc ]"
+.BI "listaacerts [" --utc ]
 returns a list of X.509 Authorization Authority (AA) certificates that were
 loaded locally by the IKE daemon from the \fI/etc/ipsec.d/aacerts/\fP
 directory.
-.PP
+.
 .TP
-.B "listocspcerts [ --utc ]"
+.BI "listocspcerts [" --utc ]
 returns a list of X.509 OCSP Signer certificates that were either loaded
 locally by the IKE daemon from the \fI/etc/ipsec.d/ocspcerts/\fP
 directory or were sent by an OCSP server.
-.PP
+.
 .TP
-.B "listacerts [ --utc ]"
+.BI "listacerts [" --utc ]
 returns a list of X.509 Attribute certificates that were loaded locally by
 the IKE daemon from the \fI/etc/ipsec.d/acerts/\fP directory.
-.PP
+.
 .TP
-.B "listgroups [ --utc ]"
+.BI "listgroups [" --utc ]
 returns a list of groups that are used to define user authorization profiles.
-.PP
+.
 .TP
-.B "listcainfos [ --utc ]"
+.BI "listcainfos [" --utc ]
 returns certification authority information (CRL distribution points, OCSP URIs,
 LDAP servers) that were defined by
 .BR ca
 sections in \fIipsec.conf\fP.
-.PP
+.
 .TP
-.B "listcrls [ --utc ]"
+.BI "listcrls [" --utc ]
 returns a list of Certificate Revocation Lists (CRLs) that were either loaded
 by the IKE daemon from the \fI/etc/ipsec.d/crls\fP directory or fetched from
 an HTTP- or LDAP-based CRL distribution point.
-.PP
+.
 .TP
-.B "listocsp [ --utc ]"
+.BI "listocsp [" --utc ]
 returns revocation information fetched from OCSP servers.
-.PP
+.
 .TP
-.B "listcounters"
+.BI "listplugins"
-show IKE counter values collected since daemon startup.
+returns a list of all loaded plugin features.
-.PP
+.
 .TP
-.B "listall [ --utc ]"
+.BI "listcounters [" name ]
+returns a list of global or connection specific IKE counter values
+collected since daemon startup.
+.
+.TP
+.BI "listall [" --utc ]
 returns all information generated by the list commands above. Each list command
 can be called with the
 \fB\-\-utc\fP
 option which displays all dates in UTC instead of local time.
-.PP
+.
 .SS REREAD COMMANDS
+.
 .TP
 .B "rereadsecrets"
 flushes and rereads all secrets defined in \fIipsec.secrets\fP.
-.PP
+.
 .TP
 .B "rereadcacerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/cacerts\fP
 directory and adds them to the list of Certification Authority (CA)
 certificates.
-.PP
+.
 .TP
 .B "rereadaacerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/aacerts\fP
 directory and adds them to the list of Authorization Authority (AA)
 certificates.
-.PP
+.
 .TP
 .B "rereadocspcerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/ocspcerts/\fP
 directory and adds them to the list of OCSP signer certificates.
-.PP
+.
 .TP
 .B "rereadacerts"
 reads all certificate files contained in the  \fI/etc/ipsec.d/acerts/\fP
 directory and adds them to the list of attribute certificates.
-.PP
+.
 .TP
 .B "rereadcrls"
 reads  all Certificate  Revocation Lists (CRLs) contained in the
 \fI/etc/ipsec.d/crls/\fP directory and adds them to the list of CRLs.
-.PP
+.
 .TP
 .B "rereadall"
 executes all reread commands listed above.
-.PP
+.
+.SS RESET COMMANDS
+.
+.TP
+.BI "resetcounters [" name ]
+resets global or connection specific counters.
+.
 .SS PURGE COMMANDS
+.
+.TP
+.B "purgecerts"
+purges all cached certificates.
+.
+.TP
+.B "purgecrl"
+purges all cached CRLs.
+.
 .TP
 .B "purgeike"
 purges IKE SAs that don't have a Quick Mode or CHILD SA.
-.PP
+.
 .TP
 .B "purgeocsp"
 purges all cached OCSP information records.
-.PP
+.
 .SS INFO COMMANDS
+.
 .TP
 .B "\-\-help"
 returns the usage information for the
 .B @IPSEC_SCRIPT@
 command.
-.PP
+.
 .TP
 .B "\-\-version"
 returns the version in the form of
 .B Linux strongSwan U<strongSwan userland version>/K<Linux kernel version>
 if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
 running on.
-.PP
+.
 .TP
 .B "\-\-versioncode"
 returns the version number in the form of
 .B U<strongSwan userland version>/K<Linux kernel version>
 if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
 running on.
-.PP
+.
 .TP
 .B "\-\-copyright"
 returns the copyright information.
-.PP
+.
 .TP
 .B "\-\-directory"
 returns the \fILIBEXECDIR\fP directory as defined by the configure options.
-.PP
+.
 .TP
 .B "\-\-confdir"
 returns the \fISYSCONFDIR\fP directory as defined by the configure options.
-.PP
+.
 .TP
 .B "\-\-piddir"
 returns the \fIPIDDIR\fP directory as defined by the configure options.
+.
 .SH FILES
-/usr/local/lib/ipsec	usual utilities directory
+.
+@IPSEC_DIR@		utilities directory
+.
 .SH ENVIRONMENT
-.PP
+.
-The following environment variables control where strongSwan finds its
+When calling other commands the
-components.
-The
 .B @IPSEC_SCRIPT@
-command sets them if they are not already set.
+command supplies the following environment variables.
 .nf
 .na
 
 IPSEC_DIR               directory containing ipsec programs and utilities
+IPSEC_BINDIR            directory containing \fBpki\fP command
 IPSEC_SBINDIR           directory containing \fBipsec\fP command
 IPSEC_CONFDIR           directory containing configuration files
 IPSEC_PIDDIR            directory containing PID/socket files
@@ -286,13 +315,12 @@ IPSEC_STARTER_PID       PID file for ipsec starter
 IPSEC_CHARON_PID        PID file for IKE keying daemon
 .ad
 .fi
+.
 .SH SEE ALSO
-.hy 0
+.
-.na
+.BR ipsec.conf (5),
-ipsec.conf(5), ipsec.secrets(5)
+.BR ipsec.secrets (5)
-.ad
+.
-.hy
-.PP
 .SH HISTORY
 Originally written for the FreeS/WAN project by Henry Spencer.
 Updated and extended for the strongSwan project <http://www.strongswan.org> by