- import of strongswan-2.7.0
- applied patch for charon
This commit is contained in:
Martin Willi
@@ -0,0 +1 @@
|
||||
spi
|
||||
@@ -0,0 +1,69 @@
|
||||
# Makefile for the KLIPS interface utilities
|
||||
# Copyright (C) 1998, 1999 Henry Spencer.
|
||||
# Copyright (C) 1999, 2000, 2001 Richard Guy Briggs
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License as published by the
|
||||
# Free Software Foundation; either version 2 of the License, or (at your
|
||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
# for more details.
|
||||
#
|
||||
# RCSID $Id: Makefile,v 1.2 2004/03/22 21:53:21 as Exp $
|
||||
|
||||
FREESWANSRCDIR=../..
|
||||
include ${FREESWANSRCDIR}/Makefile.inc
|
||||
|
||||
PROGRAM=spi
|
||||
EXTRA5PROC=${PROGRAM}.5
|
||||
|
||||
LIBS=${FREESWANLIB}
|
||||
|
||||
OBJS=constants.o alg_info.o kernel_alg.o
|
||||
|
||||
include ../Makefile.program
|
||||
|
||||
constants.o : ../pluto/constants.c ../pluto/constants.h
|
||||
$(CC) $(CFLAGS) -c -o $@ $<
|
||||
|
||||
alg_info.o : ../pluto/alg_info.c ../pluto/alg_info.h
|
||||
$(CC) $(CFLAGS) -DNO_PLUTO -c -o $@ $<
|
||||
|
||||
kernel_alg.o : ../pluto/kernel_alg.c ../pluto/kernel_alg.h
|
||||
$(CC) $(CFLAGS) -DNO_PLUTO -c -o $@ $<
|
||||
|
||||
#
|
||||
# $Log: Makefile,v $
|
||||
# Revision 1.2 2004/03/22 21:53:21 as
|
||||
# merged alg-0.8.1 branch with HEAD
|
||||
#
|
||||
# Revision 1.1.4.1 2004/03/16 09:48:22 as
|
||||
# alg-0.8.1rc12 patch merged
|
||||
#
|
||||
# Revision 1.1 2004/03/15 20:35:31 as
|
||||
# added files from freeswan-2.04-x509-1.5.3
|
||||
#
|
||||
# Revision 1.4 2002/06/03 20:25:31 mcr
|
||||
# man page for files actually existant in /proc/net changed back to
|
||||
# ipsec_foo via new EXTRA5PROC process.
|
||||
#
|
||||
# Revision 1.3 2002/06/02 21:51:41 mcr
|
||||
# changed TOPDIR->FREESWANSRCDIR in all Makefiles.
|
||||
# (note that linux/net/ipsec/Makefile uses TOPDIR because this is the
|
||||
# kernel sense.)
|
||||
#
|
||||
# Revision 1.2 2002/04/26 01:21:26 mcr
|
||||
# while tracking down a missing (not installed) /etc/ipsec.conf,
|
||||
# MCR has decided that it is not okay for each program subdir to have
|
||||
# some subset (determined with -f) of possible files.
|
||||
# Each subdir that defines $PROGRAM, MUST have a PROGRAM.8 file as well as a PROGRAM file.
|
||||
# Optional PROGRAM.5 files have been added to the makefiles.
|
||||
#
|
||||
# Revision 1.1 2002/04/24 07:55:32 mcr
|
||||
# #include patches and Makefiles for post-reorg compilation.
|
||||
#
|
||||
#
|
||||
#
|
||||
@@ -0,0 +1,213 @@
|
||||
.TH IPSEC_SPI 5 "26 Jun 2000"
|
||||
.\"
|
||||
.\" RCSID $Id: spi.5,v 1.1 2004/03/15 20:35:31 as Exp $
|
||||
.\"
|
||||
.SH NAME
|
||||
ipsec_spi \- list IPSEC Security Associations
|
||||
.SH SYNOPSIS
|
||||
.B ipsec
|
||||
.B spi
|
||||
.PP
|
||||
.B cat
|
||||
.B /proc/net/ipsec_spi
|
||||
.PP
|
||||
.SH DESCRIPTION
|
||||
.I /proc/net/ipsec_spi
|
||||
is a read-only file that lists the current IPSEC Security Associations.
|
||||
A Security Association (SA) is a transform through which packet contents
|
||||
are to be processed before being forwarded. A transform can be an
|
||||
IPv4-in-IPv4 or IPv6-in-IPv6 encapsulation, an IPSEC Authentication Header (authentication
|
||||
with no encryption), or an IPSEC Encapsulation Security Payload
|
||||
(encryption, possibly including authentication).
|
||||
.PP
|
||||
When a packet is passed from a higher networking layer through an IPSEC
|
||||
virtual interface, a search in the extended routing table (see
|
||||
.IR ipsec_eroute (5))
|
||||
yields
|
||||
a IP protocol number
|
||||
,
|
||||
a Security Parameters Index (SPI)
|
||||
and
|
||||
an effective destination address
|
||||
.
|
||||
When an IPSEC packet arrives from the network,
|
||||
its ostensible destination, an SPI and an IP protocol
|
||||
specified by its outermost IPSEC header are used.
|
||||
The destination/SPI/protocol combination is used to select a relevant SA.
|
||||
(See
|
||||
.IR ipsec_spigrp (5)
|
||||
for discussion of how multiple transforms are combined.)
|
||||
.PP
|
||||
An
|
||||
.I spi ,
|
||||
.I proto,
|
||||
.I daddr
|
||||
and
|
||||
.IR address_family
|
||||
arguments specify an SAID.
|
||||
.I Proto
|
||||
is an ASCII string, "ah", "esp", "comp" or "tun", specifying the IP protocol.
|
||||
.I Spi
|
||||
is a number, preceded by '.' indicating hexadecimal and IPv4 or by ':' indicating hexadecimal and IPv6,
|
||||
where each hexadecimal digit represents 4 bits,
|
||||
between
|
||||
.B 0x100
|
||||
and
|
||||
.BR 0xffffffff ;
|
||||
values from
|
||||
.B 0x0
|
||||
to
|
||||
.B 0xff
|
||||
are reserved.
|
||||
.I Daddr
|
||||
is a dotted-decimal IPv4 destination address or a coloned hex IPv6 destination address.
|
||||
.PP
|
||||
An
|
||||
.I SAID
|
||||
combines the three parameters above, such as: "[email protected]" for IPv4 or "tun:101@3049:1::1" for IPv6
|
||||
.PP
|
||||
A table entry consists of:
|
||||
.IP + 3
|
||||
.BR SAID
|
||||
.IP +
|
||||
<transform name (proto,encalg,authalg)>:
|
||||
.IP +
|
||||
direction (dir=)
|
||||
.IP +
|
||||
source address (src=)
|
||||
.IP +
|
||||
source and destination addresses and masks for inner header policy check
|
||||
addresses (policy=), as dotted-quads or coloned hex, separated by '->',
|
||||
for IPv4-in-IPv4 or IPv6-in-IPv6 SAs only
|
||||
.IP +
|
||||
initialisation vector length and value (iv_bits=, iv=) if non-zero
|
||||
.IP +
|
||||
out-of-order window size, number of out-of-order errors, sequence
|
||||
number, recently received packet bitmask, maximum difference between
|
||||
sequence numbers (ooowin=, ooo_errs=, seq=, bit=, max_seq_diff=) if SA
|
||||
is AH or ESP and if individual items are non-zero
|
||||
.IP +
|
||||
extra flags (flags=) if any are set
|
||||
.IP +
|
||||
authenticator length in bits (alen=) if non-zero
|
||||
.IP +
|
||||
authentication key length in bits (aklen=) if non-zero
|
||||
.IP +
|
||||
authentication errors (auth_errs=) if non-zero
|
||||
.IP +
|
||||
encryption key length in bits (eklen=) if non-zero
|
||||
.IP +
|
||||
encryption size errors (encr_size_errs=) if non-zero
|
||||
.IP +
|
||||
encryption padding error warnings (encr_pad_errs=) if non-zero
|
||||
.IP +
|
||||
lifetimes legend, c=Current status, s=Soft limit when exceeded will
|
||||
initiate rekeying, h=Hard limit will cause termination of SA (life(c,s,h)=)
|
||||
.IP + 6
|
||||
number of connections to which the SA is allocated (c), that will cause a
|
||||
rekey (s), that will cause an expiry (h) (alloc=), if any value is non-zero
|
||||
.IP +
|
||||
number of bytes processesd by this SA (c), that will cause a rekey (s), that
|
||||
will cause an expiry (h) (bytes=), if any value is non-zero
|
||||
.IP +
|
||||
time since the SA was added (c), until rekey (s), until expiry (h), in seconds (add=)
|
||||
.IP +
|
||||
time since the SA was first used (c), until rekey (s), until expiry (h), in seconds (used=),
|
||||
if any value is non-zero
|
||||
.IP +
|
||||
number of packets processesd by this SA (c), that will cause a rekey (s), that
|
||||
will cause an expiry (h) (packets=), if any value is non-zero
|
||||
.IP + 3
|
||||
time since the last packet was processed, in seconds (idle=), if SA has
|
||||
been used
|
||||
.IP
|
||||
average compression ratio (ratio=)
|
||||
.SH EXAMPLES
|
||||
.B "[email protected] IPIP: dir=out src=192.168.43.2"
|
||||
.br
|
||||
.B " life(c,s,h)=bytes(14073,0,0)add(269,0,0)"
|
||||
.br
|
||||
.B " use(149,0,0)packets(14,0,0)"
|
||||
.br
|
||||
.B " idle=23
|
||||
.LP
|
||||
is an outbound IPv4-in-IPv4 (protocol 4) tunnel-mode SA set up between machines
|
||||
192.168.43.2 and 192.168.43.1 with an SPI of 12a in hexadecimal that has
|
||||
passed about 14 kilobytes of traffic in 14 packets since it was created,
|
||||
269 seconds ago, first used 149 seconds ago and has been idle for 23
|
||||
seconds.
|
||||
.LP
|
||||
.B "esp:9a35fc02@3049:1::1 ESP_3DES_HMAC_MD5:"
|
||||
.br
|
||||
.B " dir=in src=9a35fc02@3049:1::2"
|
||||
.br
|
||||
.B " ooowin=32 seq=7149 bit=0xffffffff"
|
||||
.br
|
||||
.B " alen=128 aklen=128 eklen=192"
|
||||
.br
|
||||
.B " life(c,s,h)=bytes(1222304,0,0)add(4593,0,0)"
|
||||
.br
|
||||
.B " use(3858,0,0)packets(7149,0,0)"
|
||||
.br
|
||||
.B " idle=23"
|
||||
.LP
|
||||
is an inbound Encapsulating Security Payload (protocol 50) SA on machine
|
||||
3049:1::1 with an SPI of 9a35fc02 that uses 3DES as the encryption
|
||||
cipher, HMAC MD5 as the authentication algorithm, an out-of-order
|
||||
window of 32 packets, a present sequence number of 7149, every one of
|
||||
the last 32 sequence numbers was received, the authenticator length and
|
||||
keys is 128 bits, the encryption key is 192 bits (actually 168 for 3DES
|
||||
since 1 of 8 bits is a parity bit), has passed 1.2 Mbytes of data in
|
||||
7149 packets, was added 4593 seconds ago, first used
|
||||
3858 seconds ago and has been idle for 23 seconds.
|
||||
.LP
|
||||
.SH FILES
|
||||
/proc/net/ipsec_spi, /usr/local/bin/ipsec
|
||||
.SH "SEE ALSO"
|
||||
ipsec(8), ipsec_manual(8), ipsec_tncfg(5), ipsec_eroute(5),
|
||||
ipsec_spigrp(5), ipsec_klipsdebug(5), ipsec_spi(8), ipsec_version(5),
|
||||
ipsec_pf_key(5)
|
||||
.SH HISTORY
|
||||
Written for the Linux FreeS/WAN project
|
||||
<http://www.freeswan.org/>
|
||||
by Richard Guy Briggs.
|
||||
.SH BUGS
|
||||
The add and use times are awkward, displayed in seconds since machine
|
||||
start. It would be better to display them in seconds before now for
|
||||
human readability.
|
||||
.\"
|
||||
.\" $Log: spi.5,v $
|
||||
.\" Revision 1.1 2004/03/15 20:35:31 as
|
||||
.\" added files from freeswan-2.04-x509-1.5.3
|
||||
.\"
|
||||
.\" Revision 1.9 2002/04/24 07:35:39 mcr
|
||||
.\" Moved from ./klips/utils/spi.5,v
|
||||
.\"
|
||||
.\" Revision 1.8 2001/08/01 23:22:44 rgb
|
||||
.\" Fix inconsistancies between manpage and output.
|
||||
.\"
|
||||
.\" Revision 1.7 2000/11/30 16:47:28 rgb
|
||||
.\" Added src= to /proc/net/ipsec_spi manpage.
|
||||
.\"
|
||||
.\" Revision 1.6 2000/09/17 18:56:48 rgb
|
||||
.\" Added IPCOMP support.
|
||||
.\"
|
||||
.\" Revision 1.5 2000/09/13 15:54:32 rgb
|
||||
.\" Added Gerhard's ipv6 updates.
|
||||
.\"
|
||||
.\" Revision 1.4 2000/07/05 17:24:03 rgb
|
||||
.\" Updated for relative, rather than absolute values for addtime and
|
||||
.\" usetime.
|
||||
.\"
|
||||
.\" Revision 1.3 2000/06/30 18:21:55 rgb
|
||||
.\" Update SEE ALSO sections to include ipsec_version(5) and ipsec_pf_key(5)
|
||||
.\" and correct FILES sections to no longer refer to /dev/ipsec which has
|
||||
.\" been removed since PF_KEY does not use it.
|
||||
.\"
|
||||
.\" Revision 1.2 2000/06/28 12:44:12 henry
|
||||
.\" format touchup
|
||||
.\"
|
||||
.\" Revision 1.1 2000/06/28 05:43:00 rgb
|
||||
.\" Added manpages for all 5 klips utils.
|
||||
.\"
|
||||
.\"
|
||||
@@ -0,0 +1,525 @@
|
||||
.TH IPSEC_SPI 8 "23 Oct 2001"
|
||||
.\"
|
||||
.\" RCSID $Id: spi.8,v 1.1 2004/03/15 20:35:31 as Exp $
|
||||
.\"
|
||||
.SH NAME
|
||||
ipsec spi \- manage IPSEC Security Associations
|
||||
.SH SYNOPSIS
|
||||
.br
|
||||
Note: In the following,
|
||||
.br
|
||||
.B <SA>
|
||||
means:
|
||||
.B \-\-af
|
||||
(inet | inet6)
|
||||
.B \-\-edst
|
||||
daddr
|
||||
.B \-\-spi
|
||||
spi
|
||||
.B \-\-proto
|
||||
proto OR
|
||||
.B \-\-said
|
||||
said,
|
||||
.br
|
||||
.B <life>
|
||||
means:
|
||||
.B \-\-life
|
||||
(soft | hard)\-(allocations | bytes | addtime | usetime | packets)=value[,...]
|
||||
.PP
|
||||
.B ipsec
|
||||
.B spi
|
||||
.PP
|
||||
.B ipsec
|
||||
.B spi
|
||||
.B <SA>
|
||||
.B \-\-src
|
||||
src
|
||||
.B \-\-ah
|
||||
.BR hmac-md5-96 | hmac-sha1-96
|
||||
[
|
||||
.B \-\-replay_window
|
||||
replayw ]
|
||||
[
|
||||
.B <life>
|
||||
]
|
||||
.B \-\-authkey
|
||||
akey
|
||||
.PP
|
||||
.B ipsec
|
||||
.B spi
|
||||
.B <SA>
|
||||
.B \-\-src
|
||||
src
|
||||
.B \-\-esp
|
||||
.BR 3des
|
||||
[
|
||||
.B \-\-replay_window
|
||||
replayw ]
|
||||
[
|
||||
.B <life>
|
||||
]
|
||||
.B \-\-enckey
|
||||
ekey
|
||||
.PP
|
||||
.B ipsec
|
||||
.B spi
|
||||
.B <SA>
|
||||
.B \-\-src
|
||||
src
|
||||
.B \-\-esp
|
||||
.BR 3des-md5-96 | 3des-sha1-96
|
||||
[
|
||||
.B \-\-replay_window
|
||||
replayw ]
|
||||
[
|
||||
.B <life>
|
||||
]
|
||||
.B \-\-enckey
|
||||
ekey
|
||||
.B \-\-authkey
|
||||
akey
|
||||
.PP
|
||||
.B ipsec
|
||||
.B spi
|
||||
.B <SA>
|
||||
.B \-\-src
|
||||
src
|
||||
.B \-\-comp
|
||||
.BR deflate
|
||||
.PP
|
||||
.B ipsec
|
||||
.B spi
|
||||
.B <SA>
|
||||
.B \-\-ip4
|
||||
.B \-\-src
|
||||
encap-src
|
||||
.B \-\-dst
|
||||
encap-dst
|
||||
.PP
|
||||
.B ipsec
|
||||
.B spi
|
||||
.B <SA>
|
||||
.B \-\-ip6
|
||||
.B \-\-src
|
||||
encap-src
|
||||
.B \-\-dst
|
||||
encap-dst
|
||||
.PP
|
||||
.B ipsec
|
||||
.B spi
|
||||
.B <SA>
|
||||
.B \-\-del
|
||||
.PP
|
||||
.B ipsec
|
||||
.B spi
|
||||
.B \-\-help
|
||||
.PP
|
||||
.B ipsec
|
||||
.B spi
|
||||
.B \-\-version
|
||||
.PP
|
||||
.B ipsec
|
||||
.B spi
|
||||
.B \-\-clear
|
||||
.PP
|
||||
.SH DESCRIPTION
|
||||
.I Spi
|
||||
creates and deletes IPSEC Security Associations.
|
||||
A Security Association (SA) is a transform through which packet
|
||||
contents are to be processed before being forwarded.
|
||||
A transform can be an IPv4-in-IPv4 or an IPv6-in-IPv6 encapsulation,
|
||||
an IPSEC Authentication Header (authentication with no encryption),
|
||||
or an IPSEC Encapsulation Security Payload (encryption, possibly
|
||||
including authentication).
|
||||
.PP
|
||||
When a packet is passed from a higher networking layer
|
||||
through an IPSEC virtual interface,
|
||||
a search in the extended routing table (see
|
||||
.IR ipsec_eroute (8))
|
||||
yields an effective destination address, a
|
||||
Security Parameters Index (SPI) and a IP protocol number.
|
||||
When an IPSEC packet arrives from the network,
|
||||
its ostensible destination, an SPI and an IP protocol
|
||||
specified by its outermost IPSEC header are used.
|
||||
The destination/SPI/protocol combination is used to select a relevant SA.
|
||||
(See
|
||||
.IR ipsec_spigrp (8)
|
||||
for discussion of how multiple transforms are combined.)
|
||||
.PP
|
||||
The
|
||||
.IR af ,
|
||||
.IR daddr ,
|
||||
.I spi
|
||||
and
|
||||
.I proto
|
||||
arguments specify the SA to be created or deleted.
|
||||
.I af
|
||||
is the address family (inet for IPv4, inet6 for IPv6).
|
||||
.I Daddr
|
||||
is a destination address
|
||||
in dotted-decimal notation for IPv4
|
||||
or in a coloned hex notation for IPv6.
|
||||
.I Spi
|
||||
is a number, preceded by '0x' for hexadecimal,
|
||||
between
|
||||
.B 0x100
|
||||
and
|
||||
.BR 0xffffffff ;
|
||||
values from
|
||||
.B 0x0
|
||||
to
|
||||
.B 0xff
|
||||
are reserved.
|
||||
.I Proto
|
||||
is an ASCII string, "ah", "esp", "comp" or "tun", specifying the IP protocol.
|
||||
The protocol must agree with the algorithm selected.
|
||||
.PP
|
||||
Alternatively, the
|
||||
.I said
|
||||
argument can also specify an SA to be created or deleted.
|
||||
.I Said
|
||||
combines the three parameters above, such as: "[email protected]" or "tun:101@1:2::3:4",
|
||||
where the address family is specified by "." for IPv4 and ":" for IPv6. The address
|
||||
family indicators substitute the "0x" for hexadecimal.
|
||||
.PP
|
||||
The source address,
|
||||
.IR src ,
|
||||
must also be provided for the inbound policy check to
|
||||
function. The source address does not need to be included if inbound
|
||||
policy checking has been disabled.
|
||||
.PP
|
||||
Keys vectors must be entered as hexadecimal or base64 numbers.
|
||||
They should be cryptographically strong random numbers.
|
||||
.PP
|
||||
All hexadecimal numbers are entered as strings of hexadecimal digits
|
||||
(0-9 and a-f), without spaces, preceded by '0x', where each hexadecimal
|
||||
digit represents 4 bits.
|
||||
All base64 numbers are entered as strings of base64 digits
|
||||
(0-9, A-Z, a-z, '+' and '/'), without spaces, preceded by '0s',
|
||||
where each hexadecimal digit represents 6 bits and '=' is used for padding.
|
||||
.PP
|
||||
The deletion of an SA which has been grouped will result in the entire chain
|
||||
being deleted.
|
||||
.PP
|
||||
The form with no additional arguments lists the contents of
|
||||
/proc/net/ipsec_spi. The format of /proc/net/ipsec_spi is discussed in
|
||||
ipsec_spi(5).
|
||||
.PP
|
||||
The lifetime severity of
|
||||
.B soft
|
||||
sets a limit when the key management daemons are asked to rekey the SA.
|
||||
The lifetime severity of
|
||||
.B hard
|
||||
sets a limit when the SA must expire.
|
||||
The lifetime type
|
||||
.B allocations
|
||||
tells the system when to expire the SA because it is being shared by too many
|
||||
eroutes (not currently used). The lifetime type of
|
||||
.B bytes
|
||||
tells the system to expire the SA after a certain number of bytes have been
|
||||
processed with that SA. The lifetime type of
|
||||
.B addtime
|
||||
tells the system to expire the SA a certain number of seconds after the SA was
|
||||
installed. The lifetime type of
|
||||
.B usetime
|
||||
tells the system to expire the SA a certain number of seconds after that SA has
|
||||
processed its first packet. The lifetime type of
|
||||
.B packets
|
||||
tells the system to expire the SA after a certain number of packets have been
|
||||
processed with that SA.
|
||||
.SH OPTIONS
|
||||
.TP 10
|
||||
.B \-\-af
|
||||
specifies the address family (inet for IPv4, inet6 for IPv6)
|
||||
.TP
|
||||
.B \-\-edst
|
||||
specifies the effective destination
|
||||
.I daddr
|
||||
of the Security Association
|
||||
.TP
|
||||
.B \-\-spi
|
||||
specifies the Security Parameters Index
|
||||
.I spi
|
||||
of the Security Association
|
||||
.TP
|
||||
.B \-\-proto
|
||||
specifies the IP protocol
|
||||
.I proto
|
||||
of the Security Association
|
||||
.TP
|
||||
.B \-\-said
|
||||
specifies the Security Association in monolithic format
|
||||
.TP
|
||||
.B \-\-ah
|
||||
add an SA for an IPSEC Authentication Header,
|
||||
specified by the following transform identifier
|
||||
(\c
|
||||
.BR hmac-md5-96
|
||||
or
|
||||
.BR hmac-sha1-96 )
|
||||
(RFC2402, obsoletes RFC1826)
|
||||
.TP
|
||||
.B hmac-md5-96
|
||||
transform following the HMAC and MD5 standards,
|
||||
using a 128-bit
|
||||
.I key
|
||||
to produce a 96-bit authenticator (RFC2403)
|
||||
.TP
|
||||
.B hmac-sha1-96
|
||||
transform following the HMAC and SHA1 standards,
|
||||
using a 160-bit
|
||||
.I key
|
||||
to produce a 96-bit authenticator (RFC2404)
|
||||
.TP
|
||||
.B \-\-esp
|
||||
add an SA for an IPSEC Encapsulation Security Payload,
|
||||
specified by the following
|
||||
transform identifier (\c
|
||||
.BR 3des ,
|
||||
or
|
||||
.BR 3des-md5-96 )
|
||||
(RFC2406, obsoletes RFC1827)
|
||||
.TP
|
||||
.B 3des
|
||||
encryption transform following the Triple-DES standard in
|
||||
Cipher-Block-Chaining mode using a 64-bit
|
||||
.I iv
|
||||
(internally generated) and a 192-bit 3DES
|
||||
.I ekey
|
||||
(RFC2451)
|
||||
.TP
|
||||
.B 3des-md5-96
|
||||
encryption transform following the Triple-DES standard in
|
||||
Cipher-Block-Chaining mode with authentication provided by
|
||||
HMAC and MD5
|
||||
(96-bit authenticator),
|
||||
using a 64-bit
|
||||
.IR iv
|
||||
(internally generated), a 192-bit 3DES
|
||||
.I ekey
|
||||
and a 128-bit HMAC-MD5
|
||||
.I akey
|
||||
(RFC2451, RFC2403)
|
||||
.TP
|
||||
.B 3des-sha1-96
|
||||
encryption transform following the Triple-DES standard in
|
||||
Cipher-Block-Chaining mode with authentication provided by
|
||||
HMAC and SHA1
|
||||
(96-bit authenticator),
|
||||
using a 64-bit
|
||||
.IR iv
|
||||
(internally generated), a 192-bit 3DES
|
||||
.I ekey
|
||||
and a 160-bit HMAC-SHA1
|
||||
.I akey
|
||||
(RFC2451, RFC2404)
|
||||
.TP
|
||||
.BR \-\-replay_window " replayw"
|
||||
sets the replay window size; valid values are decimal, 1 to 64
|
||||
.TP
|
||||
.BR \-\-life " life_param[,life_param]"
|
||||
sets the lifetime expiry; the format of
|
||||
.B life_param
|
||||
consists of a comma-separated list of lifetime specifications without spaces;
|
||||
a lifetime specification is comprised of a severity of
|
||||
.BR soft " or " hard
|
||||
followed by a '-', followed by a lifetime type of
|
||||
.BR allocations ", " bytes ", " addtime ", " usetime " or " packets
|
||||
followed by an '=' and finally by a value
|
||||
.TP
|
||||
.B \-\-comp
|
||||
add an SA for IPSEC IP Compression,
|
||||
specified by the following
|
||||
transform identifier (\c
|
||||
.BR deflate )
|
||||
(RFC2393)
|
||||
.TP
|
||||
.B deflate
|
||||
compression transform following the patent-free Deflate compression algorithm
|
||||
(RFC2394)
|
||||
.TP
|
||||
.B \-\-ip4
|
||||
add an SA for an IPv4-in-IPv4
|
||||
tunnel from
|
||||
.I encap-src
|
||||
to
|
||||
.I encap-dst
|
||||
.TP
|
||||
.B \-\-ip6
|
||||
add an SA for an IPv6-in-IPv6
|
||||
tunnel from
|
||||
.I encap-src
|
||||
to
|
||||
.I encap-dst
|
||||
.TP
|
||||
.B \-\-src
|
||||
specify the source end of an IP-in-IP tunnel from
|
||||
.I encap-src
|
||||
to
|
||||
.I encap-dst
|
||||
and also specifies the source address of the Security Association to be
|
||||
used in inbound policy checking and must be the same address
|
||||
family as
|
||||
.I af
|
||||
and
|
||||
.I edst
|
||||
.TP
|
||||
.B \-\-dst
|
||||
specify the destination end of an IP-in-IP tunnel from
|
||||
.I encap-src
|
||||
to
|
||||
.I encap-dst
|
||||
.TP
|
||||
.B \-\-del
|
||||
delete the specified SA
|
||||
.TP
|
||||
.BR \-\-clear
|
||||
clears the table of
|
||||
.BR SA s
|
||||
.TP
|
||||
.BR \-\-help
|
||||
display synopsis
|
||||
.TP
|
||||
.BR \-\-version
|
||||
display version information
|
||||
.SH EXAMPLES
|
||||
To keep line lengths down and reduce clutter,
|
||||
some of the long keys in these examples have been abbreviated
|
||||
by replacing part of their text with
|
||||
.RI `` ... ''.
|
||||
Keys used when the programs are actually run must,
|
||||
of course, be the full length required for the particular algorithm.
|
||||
.LP
|
||||
.B "ipsec spi \-\-af inet \-\-edst gw2 \-\-spi 0x125 \-\-proto esp \e"
|
||||
.br
|
||||
.B " \-\-src gw1 \e"
|
||||
.br
|
||||
.B " \-\-esp 3des\-md5\-96 \e"
|
||||
.br
|
||||
.BI "\ \ \ \-\-enckey\ 0x6630" "..." "97ce\ \e"
|
||||
.br
|
||||
.BI " \-\-authkey 0x9941" "..." "71df"
|
||||
.LP
|
||||
sets up an SA from
|
||||
.BR gw1
|
||||
to
|
||||
.BR gw2
|
||||
with an SPI of
|
||||
.BR 0x125
|
||||
and protocol
|
||||
.BR ESP
|
||||
(50) using
|
||||
.BR 3DES
|
||||
encryption with integral
|
||||
.BR MD5-96
|
||||
authentication transform, using an encryption key of
|
||||
.BI 0x6630 ... 97ce
|
||||
and an authentication key of
|
||||
.BI 0x9941 ... 71df
|
||||
(see note above about abbreviated keys).
|
||||
.LP
|
||||
.B "ipsec spi \-\-af inet6 \-\-edst 3049:9::9000:3100 \-\-spi 0x150 \-\-proto ah \e"
|
||||
.br
|
||||
.B " \-\-src 3049:9::9000:3101 \e"
|
||||
.br
|
||||
.B " \-\-ah hmac\-md5\-96 \e"
|
||||
.br
|
||||
.BI "\ \ \ \-\-authkey\ 0x1234" "..." "2eda\ \e"
|
||||
.LP
|
||||
sets up an SA from
|
||||
.BR 3049:9::9000:3101
|
||||
to
|
||||
.BR 3049:9::9000:3100
|
||||
with an SPI of
|
||||
.BR 0x150
|
||||
and protocol
|
||||
.BR AH
|
||||
(50) using
|
||||
.BR MD5-96
|
||||
authentication transform, using an authentication key of
|
||||
.BI 0x1234 ... 2eda
|
||||
(see note above about abbreviated keys).
|
||||
.LP
|
||||
.B "ipsec spi \-\-said [email protected] \-\-del "
|
||||
.LP
|
||||
deletes an SA to
|
||||
.BR 192.168.100.100
|
||||
with an SPI of
|
||||
.BR 0x987
|
||||
and protocol
|
||||
.BR IPv4-in-IPv4
|
||||
(4).
|
||||
.LP
|
||||
.B "ipsec spi \-\-said tun:500@3049:9::1000:1 \-\-del "
|
||||
.LP
|
||||
deletes an SA to
|
||||
.BR 3049:9::1000:1
|
||||
with an SPI of
|
||||
.BR 0x500
|
||||
and protocol
|
||||
.BR IPv6-in-IPv6
|
||||
(4).
|
||||
.LP
|
||||
.SH FILES
|
||||
/proc/net/ipsec_spi, /usr/local/bin/ipsec
|
||||
.SH "SEE ALSO"
|
||||
ipsec(8), ipsec_manual(8), ipsec_tncfg(8), ipsec_eroute(8),
|
||||
ipsec_spigrp(8), ipsec_klipsdebug(8), ipsec_spi(5)
|
||||
.SH HISTORY
|
||||
Written for the Linux FreeS/WAN project
|
||||
<http://www.freeswan.org/>
|
||||
by Richard Guy Briggs.
|
||||
.SH BUGS
|
||||
The syntax is messy and the transform naming needs work.
|
||||
.\"
|
||||
.\" $Log: spi.8,v $
|
||||
.\" Revision 1.1 2004/03/15 20:35:31 as
|
||||
.\" added files from freeswan-2.04-x509-1.5.3
|
||||
.\"
|
||||
.\" Revision 1.32 2002/04/24 07:35:40 mcr
|
||||
.\" Moved from ./klips/utils/spi.8,v
|
||||
.\"
|
||||
.\" Revision 1.31 2001/11/06 20:18:47 rgb
|
||||
.\" Added lifetime parameters.
|
||||
.\"
|
||||
.\" Revision 1.30 2001/10/24 03:23:32 rgb
|
||||
.\" Added lifetime option and parameters.
|
||||
.\"
|
||||
.\" Revision 1.29 2001/05/30 08:14:04 rgb
|
||||
.\" Removed vestiges of esp-null transforms.
|
||||
.\"
|
||||
.\" Revision 1.28 2000/11/29 19:15:20 rgb
|
||||
.\" Add --src requirement for inbound policy routing.
|
||||
.\"
|
||||
.\" Revision 1.27 2000/09/17 18:56:48 rgb
|
||||
.\" Added IPCOMP support.
|
||||
.\"
|
||||
.\" Revision 1.26 2000/09/13 15:54:32 rgb
|
||||
.\" Added Gerhard's ipv6 updates.
|
||||
.\"
|
||||
.\" Revision 1.25 2000/09/12 22:36:45 rgb
|
||||
.\" Gerhard's IPv6 support.
|
||||
.\"
|
||||
.\" Revision 1.24 2000/06/30 18:21:55 rgb
|
||||
.\" Update SEE ALSO sections to include ipsec_version(5) and ipsec_pf_key(5)
|
||||
.\" and correct FILES sections to no longer refer to /dev/ipsec which has
|
||||
.\" been removed since PF_KEY does not use it.
|
||||
.\"
|
||||
.\" Revision 1.23 2000/06/21 16:54:57 rgb
|
||||
.\" Added 'no additional args' text for listing contents of
|
||||
.\" /proc/net/ipsec_* files.
|
||||
.\"
|
||||
.\" Revision 1.22 1999/08/11 08:35:16 rgb
|
||||
.\" Update, deleting references to obsolete and insecure algorithms.
|
||||
.\"
|
||||
.\" Revision 1.21 1999/07/19 18:53:55 henry
|
||||
.\" improve font usage in key abbreviations
|
||||
.\"
|
||||
.\" Revision 1.20 1999/07/19 18:50:09 henry
|
||||
.\" fix slightly-misformed comments
|
||||
.\" abbreviate long keys to avoid long-line complaints
|
||||
.\"
|
||||
.\" Revision 1.19 1999/04/06 04:54:38 rgb
|
||||
.\" Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes
|
||||
.\" patch shell fixes.
|
||||
.\"
|
||||
+1689
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user