| blob | dbfe99b92c77822f8283754389d3be3f47b9c96a |
1 .\" $NetBSD: setkey.8,v 1.20 2006/10/06 12:02:27 manu Exp $
2 .\"
3 .\" Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
4 .\" All rights reserved.
5 .\"
6 .\" Redistribution and use in source and binary forms, with or without
7 .\" modification, are permitted provided that the following conditions
8 .\" are met:
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\" 2. Redistributions in binary form must reproduce the above copyright
12 .\" notice, this list of conditions and the following disclaimer in the
13 .\" documentation and/or other materials provided with the distribution.
14 .\" 3. Neither the name of the project nor the names of its contributors
15 .\" may be used to endorse or promote products derived from this software
16 .\" without specific prior written permission.
17 .\"
18 .\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
19 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
22 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 .\" SUCH DAMAGE.
29 .\"
30 .Dd March 19, 2004
31 .Dt SETKEY 8
32 .Os
33 .\"
34 .Sh NAME
35 .Nm setkey
36 .Nd manually manipulate the IPsec SA/SP database
37 .\"
38 .Sh SYNOPSIS
39 .Nm setkey
40 .Op Fl knrv
41 .Ar file ...
42 .Nm setkey
43 .Op Fl knrv
44 .Fl c
45 .Nm setkey
46 .Op Fl krv
47 .Fl f Ar filename
48 .Nm setkey
49 .Op Fl aklPrv
50 .Fl D
51 .Nm setkey
52 .Op Fl Pvp
53 .Fl F
54 .Nm setkey
55 .Op Fl H
56 .Fl x
57 .Nm setkey
58 .Op Fl ?V
59 .\"
60 .Sh DESCRIPTION
61 .Nm
62 adds, updates, dumps, or flushes
63 Security Association Database (SAD) entries
64 as well as Security Policy Database (SPD) entries in the kernel.
65 .Pp
66 .Nm
67 takes a series of operations from standard input
68 .Po
69 if invoked with
70 .Fl c
71 .Pc
72 or the file named
73 .Ar filename
74 .Po
75 if invoked with
76 .Fl f Ar filename
77 .Pc .
78 .Bl -tag -width Ds
79 .It (no flag)
80 Dump the SAD entries or SPD entries contained in the specified
81 .Ar file .
82 .It Fl ?
83 Print short help.
84 .It Fl a
85 .Nm
86 usually does not display dead SAD entries with
87 .Fl D .
88 If
89 .Fl a
90 is also specified, the dead SAD entries will be displayed as well.
91 A dead SAD entry is one that has expired but remains in the
92 system because it is referenced by some SPD entries.
93 .It Fl D
94 Dump the SAD entries.
95 If
96 .Fl P
97 is also specified, the SPD entries are dumped.
98 If
99 .Fl p
100 is specified, the ports are displayed.
101 .It Fl F
102 Flush the SAD entries.
103 If
104 .Fl P
105 is also specified, the SPD entries are flushed.
106 .It Fl H
107 Add hexadecimal dump in
108 .Fl x
109 mode.
110 .It Fl h
111 On
112 .Nx ,
113 synonym for
114 .Fl H .
115 On other systems, synonym for
116 .Fl ? .
117 .It Fl k
118 Use semantics used in kernel.
119 Available only in Linux.
120 See also
121 .Fl r .
122 .It Fl l
123 Loop forever with short output on
124 .Fl D .
125 .It Fl n
126 No action.
127 The program will check validity of the input, but no changes to
128 the SPD will be made.
129 .It Fl r
130 Use semantics described in IPsec RFCs.
131 This mode is default.
132 For details see section
133 .Sx RFC vs Linux kernel semantics .
134 Available only in Linux.
135 See also
136 .Fl k .
137 .It Fl x
138 Loop forever and dump all the messages transmitted to the
139 .Dv PF_KEY
140 socket.
141 .Fl xx
142 prints the unformatted timestamps.
143 .It Fl V
144 Print version string.
145 .It Fl v
146 Be verbose.
147 The program will dump messages exchanged on the
148 .Dv PF_KEY
149 socket, including messages sent from other processes to the kernel.
150 .El
151 .Ss Configuration syntax
152 With
153 .Fl c
154 or
155 .Fl f
156 on the command line,
157 .Nm
158 accepts the following configuration syntax.
159 Lines starting with hash signs
160 .Pq Sq #
161 are treated as comment lines.
162 .Bl -tag -width Ds
163 .It Li add Oo Fl 46n Oc Ar src Ar dst Ar protocol Ar spi \
164 Oo Ar extensions Oc Ar algorithm ... Li ;
165 Add an SAD entry.
166 .Li add
167 can fail for multiple reasons, including when the key length does
168 not match the specified algorithm.
169 .\"
170 .It Li get Oo Fl 46n Oc Ar src Ar dst Ar protocol Ar spi Li ;
171 Show an SAD entry.
172 .\"
173 .It Li delete Oo Fl 46n Oc Ar src Ar dst Ar protocol Ar spi Li ;
174 Remove an SAD entry.
175 .\"
176 .It Li deleteall Oo Fl 46n Oc Ar src Ar dst Ar protocol Li ;
177 Remove all SAD entries that match the specification.
178 .\"
179 .It Li flush Oo Ar protocol Oc Li ;
180 Clear all SAD entries matched by the options.
181 .Fl F
182 on the command line achieves the same functionality.
183 .\"
184 .It Li dump Oo Ar protocol Oc Li ;
185 Dumps all SAD entries matched by the options.
186 .Fl D
187 on the command line achieves the same functionality.
188 .\"
189 .It Li spdadd Oo Fl 46n Oc Ar src_range Ar dst_range Ar upperspec \
190 Ar label Ar policy Li ;
191 Add an SPD entry.
192 .\"
193 .It Li spdadd tagged Ar tag Ar policy Li ;
194 Add an SPD entry based on a PF tag.
195 .Ar tag
196 must be a string surrounded by double quotes.
197 .\"
198 .It Li spddelete Oo Fl 46n Oc Ar src_range Ar dst_range Ar upperspec \
199 Fl P Ar direction Li ;
200 Delete an SPD entry.
201 .\"
202 .It Li spdflush Li ;
203 Clear all SPD entries.
204 .Fl FP
205 on the command line achieves the same functionality.
206 .\"
207 .It Li spddump Li ;
208 Dumps all SPD entries.
209 .Fl DP
210 on the command line achieves the same functionality.
211 .El
212 .\"
213 .Pp
214 Meta-arguments are as follows:
215 .Pp
216 .Bl -tag -compact -width Ds
217 .It Ar src
218 .It Ar dst
219 Source/destination of the secure communication is specified as
220 an IPv4/v6 address, and an optional port number between square
221 brackets.
222 .Nm
223 can resolve a FQDN into numeric addresses.
224 If the FQDN resolves into multiple addresses,
225 .Nm
226 will install multiple SAD/SPD entries into the kernel
227 by trying all possible combinations.
228 .Fl 4 ,
229 .Fl 6 ,
230 and
231 .Fl n
232 restrict the address resolution of FQDN in certain ways.
233 .Fl 4
234 and
235 .Fl 6
236 restrict results into IPv4/v6 addresses only, respectively.
237 .Fl n
238 avoids FQDN resolution and requires addresses to be numeric addresses.
239 .\"
240 .Pp
241 .It Ar protocol
242 .Ar protocol
243 is one of following:
244 .Bl -tag -width Fl -compact
245 .It Li esp
246 ESP based on rfc2406
247 .It Li esp-old
248 ESP based on rfc1827
249 .It Li ah
250 AH based on rfc2402
251 .It Li ah-old
252 AH based on rfc1826
253 .It Li ipcomp
254 IPComp
255 .It Li tcp
256 TCP-MD5 based on rfc2385
257 .El
258 .\"
259 .Pp
260 .It Ar spi
261 Security Parameter Index
262 .Pq SPI
263 for the SAD and the SPD.
264 .Ar spi
265 must be a decimal number, or a hexadecimal number with a
266 .Dq Li 0x
267 prefix.
268 SPI values between 0 and 255 are reserved for future use by IANA
269 and cannot be used.
270 TCP-MD5 associations must use 0x1000 and therefore only have per-host
271 granularity at this time.
272 .\"
273 .Pp
274 .It Ar extensions
275 take some of the following:
276 .Bl -tag -width Fl -compact
277 .\"
278 .It Fl m Ar mode
279 Specify a security protocol mode for use.
280 .Ar mode
281 is one of following:
282 .Li transport , tunnel ,
283 or
284 .Li any .
285 The default value is
286 .Li any .
287 .\"
288 .It Fl r Ar size
289 Specify window size of bytes for replay prevention.
290 .Ar size
291 must be decimal number in 32-bit word.
292 If
293 .Ar size
294 is zero or not specified, replay checks don't take place.
295 .\"
296 .It Fl u Ar id
297 Specify the identifier of the policy entry in the SPD.
298 See
299 .Ar policy .
300 .\"
301 .It Fl f Ar pad_option
302 defines the content of the ESP padding.
303 .Ar pad_option
304 is one of following:
305 .Bl -tag -width random-pad -compact
306 .It Li zero-pad
307 All the paddings are zero.
308 .It Li random-pad
309 A series of randomized values are used.
310 .It Li seq-pad
311 A series of sequential increasing numbers started from 1 are used.
312 .El
313 .\"
314 .It Fl f Li nocyclic-seq
315 Don't allow cyclic sequence numbers.
316 .\"
317 .It Fl lh Ar time
318 .It Fl ls Ar time
319 Specify hard/soft life time duration of the SA measured in seconds.
320 .\"
321 .It Fl bh Ar bytes
322 .It Fl bs Ar bytes
323 Specify hard/soft life time duration of the SA measured in bytes transported.
324 .\"
325 .It Fl ctx Ar doi Ar algorithm Ar context-name
326 Specify an access control label. The access control label is interpreted
327 by the LSM (e.g., SELinux). Ultimately, it enables MAC on network
328 communications.
329 .Bl -tag -width Fl -compact
330 .It Ar doi
331 The domain of interpretation, which is used by the
332 IKE daemon to identify the domain in which negotiation takes place.
333 .It Ar algorithm
334 Indicates the LSM for which the label is generated (e.g., SELinux).
335 .It Ar context-name
336 The string representation of the label that is interpreted by the LSM.
337 .El
338 .El
339 .\"
340 .Pp
341 .It Ar algorithm
342 .Bl -tag -width Fl -compact
343 .It Fl E Ar ealgo Ar key
344 Specify an encryption algorithm
345 .Ar ealgo
346 for ESP.
347 .It Fl E Ar ealgo Ar key Fl A Ar aalgo Ar key
348 Specify an encryption algorithm
349 .Ar ealgo ,
350 as well as a payload authentication algorithm
351 .Ar aalgo ,
352 for ESP.
353 .It Fl A Ar aalgo Ar key
354 Specify an authentication algorithm for AH.
355 .It Fl C Ar calgo Op Fl R
356 Specify a compression algorithm for IPComp.
357 If
358 .Fl R
359 is specified, the
360 .Ar spi
361 field value will be used as the IPComp CPI
362 .Pq compression parameter index
363 on wire as-is.
364 If
365 .Fl R
366 is not specified,
367 the kernel will use well-known CPI on wire, and
368 .Ar spi
369 field will be used only as an index for kernel internal usage.
370 .El
371 .Pp
372 .Ar key
373 must be a double-quoted character string, or a series of hexadecimal
374 digits preceded by
375 .Dq Li 0x .
376 .Pp
377 Possible values for
378 .Ar ealgo ,
379 .Ar aalgo ,
380 and
381 .Ar calgo
382 are specified in the
383 .Sx Algorithms
384 sections.
385 .\"
386 .Pp
387 .It Ar src_range
388 .It Ar dst_range
389 These select the communications that should be secured by IPsec.
390 They can be an IPv4/v6 address or an IPv4/v6 address range, and
391 may be accompanied by a TCP/UDP port specification.
392 This takes the following form:
393 .Bd -literal -offset
394 .Ar address
395 .Ar address/prefixlen
396 .Ar address[port]
397 .Ar address/prefixlen[port]
398 .Ed
399 .Pp
400 .Ar prefixlen
401 and
402 .Ar port
403 must be decimal numbers.
404 The square brackets around
405 .Ar port
406 are really necessary,
407 they are not man page meta-characters.
408 For FQDN resolution, the rules applicable to
409 .Ar src
410 and
411 .Ar dst
412 apply here as well.
413 .\"
414 .Pp
415 .It Ar upperspec
416 Upper-layer protocol to be used.
417 You can use one of the words in
418 .Pa /etc/protocols
419 as
420 .Ar upperspec ,
421 or
422 .Li icmp6 ,
423 .Li ip4 ,
424 or
425 .Li any .
426 .Li any
427 stands for
428 .Dq any protocol .
429 You can also use the protocol number.
430 You can specify a type and/or a code of ICMPv6 when the
431 upper-layer protocol is ICMPv6.
432 The specification can be placed after
433 .Li icmp6 .
434 A type is separated from a code by single comma.
435 A code must always be specified.
436 When a zero is specified, the kernel deals with it as a wildcard.
437 Note that the kernel can not distinguish a wildcard from an ICPMv6
438 type of zero.
439 For example, the following means that the policy doesn't require IPsec
440 for any inbound Neighbor Solicitation.
441 .Dl spdadd ::/0 ::/0 icmp6 135,0 -P in none ;
442 .Pp
443 .Em Note :
444 .Ar upperspec
445 does not work against forwarding case at this moment,
446 as it requires extra reassembly at the forwarding node
447 .Pq not implemented at this moment .
448 There are many protocols in
449 .Pa /etc/protocols ,
450 but all protocols except of TCP, UDP, and ICMP may not be suitable
451 to use with IPsec.
452 You have to consider carefully what to use.
453 .\"
454 .Pp
455 .It Ar label
456 .Ar label
457 is the access control label for the policy. This label is interpreted
458 by the LSM (e.g., SELinux). Ultimately, it enables MAC on network
459 communications. When a policy contains an access control label, SAs
460 negotiated with this policy will contain the label. It's format:
461 .Bl -tag -width Fl -compact
462 .\"
463 .It Fl ctx Ar doi Ar algorithm Ar context-name
464 .Bl -tag -width Fl -compact
465 .It Ar doi
466 The domain of interpretation, which is used by the
467 IKE daemon to identify the domain in which negotiation takes place.
468 .It Ar algorithm
469 Indicates the LSM for which the label is generated (e.g., SELinux).
470 .It Ar context-name
471 The string representation of the label that is interpreted by the LSM.
472 .El
473 .El
474 .\"
475 .Pp
476 .It Ar policy
477 .Ar policy
478 is in one of the following three formats:
479 .Bl -item -compact
480 .It
481 .Fl P Ar direction [priority specification] Li discard
482 .It
483 .Fl P Ar direction [priority specification] Li none
484 .It
485 .Fl P Ar direction [priority specification] Li ipsec
486 .Ar protocol/mode/src-dst/level Op ...
487 .El
488 .Pp
489 You must specify the direction of its policy as
490 .Ar direction .
491 Either
492 .Ar out ,
493 .Ar in ,
494 or
495 .Ar fwd
496 can be used.
497 .Pp
498 .Ar priority specification
499 is used to control the placement of the policy within the SPD.
500 Policy position is determined by
501 a signed integer where higher priorities indicate the policy is placed
502 closer to the beginning of the list and lower priorities indicate the
503 policy is placed closer to the end of the list.
504 Policies with equal priorities are added at the end of groups
505 of such policies.
506 .Pp
507 Priority can only
508 be specified when setkey has been compiled against kernel headers that
509 support policy priorities (Linux \*[Gt]= 2.6.6).
510 If the kernel does not support priorities, a warning message will
511 be printed the first time a priority specification is used.
512 Policy priority takes one of the following formats:
513 .Bl -tag -width "discard"
514 .It Ar {priority,prio} offset
515 .Ar offset
516 is an integer in the range from \-2147483647 to 214783648.
517 .It Ar {priority,prio} base {+,\-} offset
518 .Ar base
519 is either
520 .Li low (\-1073741824) ,
521 .Li def (0) ,
522 or
523 .Li high (1073741824)
524 .Pp
525 .Ar offset
526 is an unsigned integer.
527 It can be up to 1073741824 for
528 positive offsets, and up to 1073741823 for negative offsets.
529 .El
530 .Pp
531 .Li discard
532 means the packet matching indexes will be discarded.
533 .Li none
534 means that IPsec operation will not take place onto the packet.
535 .Li ipsec
536 means that IPsec operation will take place onto the packet.
537 .Pp
538 The
539 .Ar protocol/mode/src-dst/level
540 part specifies the rule how to process the packet.
541 Either
542 .Li ah ,
543 .Li esp ,
544 or
545 .Li ipcomp
546 must be used as
547 .Ar protocol .
548 .Ar mode
549 is either
550 .Li transport
551 or
552 .Li tunnel .
553 If
554 .Ar mode
555 is
556 .Li tunnel ,
557 you must specify the end-point addresses of the SA as
558 .Ar src
559 and
560 .Ar dst
561 with
562 .Sq -
563 between these addresses, which is used to specify the SA to use.
564 If
565 .Ar mode
566 is
567 .Li transport ,
568 both
569 .Ar src
570 and
571 .Ar dst
572 can be omitted.
573 .Ar level
574 is to be one of the following:
575 .Li default , use , require ,
576 or
577 .Li unique .
578 If the SA is not available in every level, the kernel will
579 ask the key exchange daemon to establish a suitable SA.
580 .Li default
581 means the kernel consults the system wide default for the protocol
582 you specified, e.g. the
583 .Li esp_trans_deflev
584 sysctl variable, when the kernel processes the packet.
585 .Li use
586 means that the kernel uses an SA if it's available,
587 otherwise the kernel keeps normal operation.
588 .Li require
589 means SA is required whenever the kernel sends a packet matched
590 with the policy.
591 .Li unique
592 is the same as
593 .Li require ;
594 in addition, it allows the policy to match the unique out-bound SA.
595 You just specify the policy level
596 .Li unique ,
597 .Xr racoon 8
598 will configure the SA for the policy.
599 If you configure the SA by manual keying for that policy,
600 you can put a decimal number as the policy identifier after
601 .Li unique
602 separated by a colon
603 .Sq \&:
604 like:
605 .Li unique:number
606 in order to bind this policy to the SA.
607 .Li number
608 must be between 1 and 32767.
609 It corresponds to
610 .Ar extensions Fl u
611 of the manual SA configuration.
612 When you want to use SA bundle, you can define multiple rules.
613 For example, if an IP header was followed by an AH header followed
614 by an ESP header followed by an upper layer protocol header, the
615 rule would be:
616 .Dl esp/transport//require ah/transport//require ;
617 The rule order is very important.
618 .Pp
619 When NAT-T is enabled in the kernel, policy matching for ESP over
620 UDP packets may be done on endpoint addresses and port
621 (this depends on the system.
622 System that do not perform the port check cannot support
623 multiple endpoints behind the same NAT).
624 When using ESP over UDP, you can specify port numbers in the endpoint
625 addresses to get the correct matching.
626 Here is an example:
627 .Bd -literal -offset
628 spdadd 10.0.11.0/24[any] 10.0.11.33/32[any] any -P out ipsec
629 esp/tunnel/192.168.0.1[4500]-192.168.1.2[30000]/require ;
631 .Ed
632 These ports must be left unspecified (which defaults to 0) for
633 anything other than ESP over UDP.
634 They can be displayed in SPD dump using
635 .Nm
636 .Fl DPp .
637 .Pp
638 Note that
639 .Dq Li discard
640 and
641 .Dq Li none
642 are not in the syntax described in
643 .Xr ipsec_set_policy 3 .
644 There are a few differences in the syntax.
645 See
646 .Xr ipsec_set_policy 3
647 for detail.
648 .El
649 .\"
650 .Ss Algorithms
651 The following list shows the supported algorithms.
652 .Sy protocol
653 and
654 .Sy algorithm
655 are almost orthogonal.
656 These authentication algorithms can be used as
657 .Ar aalgo
658 in
659 .Fl A Ar aalgo
660 of the
661 .Ar protocol
662 parameter:
663 .Pp
664 .Bd -literal -offset indent
665 algorithm keylen (bits)
666 hmac-md5 128 ah: rfc2403
667 128 ah-old: rfc2085
668 hmac-sha1 160 ah: rfc2404
669 160 ah-old: 128bit ICV (no document)
670 keyed-md5 128 ah: 96bit ICV (no document)
671 128 ah-old: rfc1828
672 keyed-sha1 160 ah: 96bit ICV (no document)
673 160 ah-old: 128bit ICV (no document)
674 null 0 to 2048 for debugging
675 hmac-sha256 256 ah: 96bit ICV
676 (draft-ietf-ipsec-ciph-sha-256-00)
677 256 ah-old: 128bit ICV (no document)
678 hmac-sha384 384 ah: 96bit ICV (no document)
679 384 ah-old: 128bit ICV (no document)
680 hmac-sha512 512 ah: 96bit ICV (no document)
681 512 ah-old: 128bit ICV (no document)
682 hmac-ripemd160 160 ah: 96bit ICV (RFC2857)
683 ah-old: 128bit ICV (no document)
684 aes-xcbc-mac 128 ah: 96bit ICV (RFC3566)
685 128 ah-old: 128bit ICV (no document)
686 tcp-md5 8 to 640 tcp: rfc2385
687 .Ed
688 .Pp
689 These encryption algorithms can be used as
690 .Ar ealgo
691 in
692 .Fl E Ar ealgo
693 of the
694 .Ar protocol
695 parameter:
696 .Pp
697 .Bd -literal -offset indent
698 algorithm keylen (bits)
699 des-cbc 64 esp-old: rfc1829, esp: rfc2405
700 3des-cbc 192 rfc2451
701 null 0 to 2048 rfc2410
702 blowfish-cbc 40 to 448 rfc2451
703 cast128-cbc 40 to 128 rfc2451
704 des-deriv 64 ipsec-ciph-des-derived-01
705 3des-deriv 192 no document
706 rijndael-cbc 128/192/256 rfc3602
707 twofish-cbc 0 to 256 draft-ietf-ipsec-ciph-aes-cbc-01
708 aes-ctr 160/224/288 draft-ietf-ipsec-ciph-aes-ctr-03
709 camellia-cbc 128/192/256 rfc4312
710 .Ed
711 .Pp
712 Note that the first 128 bits of a key for
713 .Li aes-ctr
714 will be used as AES key, and the remaining 32 bits will be used as nonce.
715 .Pp
716 These compression algorithms can be used as
717 .Ar calgo
718 in
719 .Fl C Ar calgo
720 of the
721 .Ar protocol
722 parameter:
723 .Pp
724 .Bd -literal -offset indent
725 algorithm
726 deflate rfc2394
727 .Ed
728 .\"
729 .Ss RFC vs Linux kernel semantics
730 The Linux kernel uses the
731 .Ar fwd
732 policy instead of the
733 .Ar in
734 policy for packets what are forwarded through that particular box.
735 .Pp
736 In
737 .Ar kernel
738 mode,
739 .Nm
740 manages and shows policies and SAs exactly as they are stored in the kernel.
741 .Pp
742 In
743 .Ar RFC
744 mode,
745 .Nm
746 .Bl -item
747 .It
748 creates
749 .Ar fwd
750 policies for every
751 .Ar in
752 policy inserted
753 .It
754 (not implemented yet) filters out all
755 .Ar fwd
756 policies
757 .El
758 .Sh RETURN VALUES
759 The command exits with 0 on success, and non-zero on errors.
760 .\"
761 .Sh EXAMPLES
762 .Bd -literal -offset
763 add 3ffe:501:4819::1 3ffe:501:481d::1 esp 123457
764 -E des-cbc 0x3ffe05014819ffff ;
766 add -6 myhost.example.com yourhost.example.com ah 123456
767 -A hmac-sha1 "AH SA configuration!" ;
769 add 10.0.11.41 10.0.11.33 esp 0x10001
770 -E des-cbc 0x3ffe05014819ffff
771 -A hmac-md5 "authentication!!" ;
773 get 3ffe:501:4819::1 3ffe:501:481d::1 ah 123456 ;
775 flush ;
777 dump esp ;
779 spdadd 10.0.11.41/32[21] 10.0.11.33/32[any] any
780 -P out ipsec esp/tunnel/192.168.0.1-192.168.1.2/require ;
782 add 10.1.10.34 10.1.10.36 tcp 0x1000 -A tcp-md5 "TCP-MD5 BGP secret" ;
784 add 10.0.11.41 10.0.11.33 esp 0x10001
785 -ctx 1 1 "system_u:system_r:unconfined_t:SystemLow-SystemHigh"
786 -E des-cbc 0x3ffe05014819ffff;
788 spdadd 10.0.11.41 10.0.11.33 any
789 -ctx 1 1 "system_u:system_r:unconfined_t:SystemLow-SystemHigh"
790 -P out ipsec esp/transport//require ;
791 .Ed
792 .\"
793 .Sh SEE ALSO
794 .Xr ipsec_set_policy 3 ,
795 .Xr racoon 8 ,
796 .Xr sysctl 8
797 .Rs
798 .%T "Changed manual key configuration for IPsec"
799 .%O "http://www.kame.net/newsletter/19991007/"
800 .%D "October 1999"
801 .Re
802 .\"
803 .Sh HISTORY
804 The
805 .Nm
806 command first appeared in the WIDE Hydrangea IPv6 protocol stack
807 kit.
808 The command was completely re-designed in June 1998.
809 .\"
810 .Sh BUGS
811 .Nm
812 should report and handle syntax errors better.
813 .Pp
814 For IPsec gateway configuration,
815 .Ar src_range
816 and
817 .Ar dst_range
818 with TCP/UDP port numbers does not work, as the gateway does not
819 reassemble packets
820 .Pq it cannot inspect upper-layer headers .