matthias
/
iproute2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

xfrm: Update documentation 

The ip(8) man page and the "ip xfrm [ XFRM-OBJECT ] help" command output
are updated to include missing options, fix errors, and improve grammar.
There are no functional changes made.

The documentation for the ip command has many different meanings for the
same formatting symbols (which really needs to be fixed). This patch makes
consistent use of brackets [ ] to indicate optional parameters, pipes | to
mean "OR", braces { } to group things together, and dashes - instead of
underscores _ inside of parameter names. The parameters are listed in the
order in which they are parsed in the source code.

There are several parameters and options that are still not mentioned or
need to be described more thoroughly in the "COMMAND SYNTAX" section of
the ip(8) man page. I would appreciate help from the developers with this.

Signed-off-by: David Ward <david.ward@ll.mit.edu>
This commit is contained in:
David Ward 2011-06-11 16:13:30 +00:00 committed by Stephen Hemminger
parent 4f69c63a4b
commit cbec021913
5 changed files with 524 additions and 447 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ip/ipxfrm.c
View File

@ -59,8 +59,8 @@ static void usage(void) __attribute__((noreturn));
static void usage(void) static void usage(void)
{ {
fprintf(stderr, fprintf(stderr,
"Usage: ip xfrm XFRM_OBJECT { COMMAND | help }\n" "Usage: ip xfrm XFRM-OBJECT { COMMAND | help }\n"
"where XFRM_OBJECT := { state | policy | monitor }\n"); "where XFRM-OBJECT := state | policy | monitor\n");
exit(-1); exit(-1);
} }
@ -1040,7 +1040,7 @@ int xfrm_id_parse(xfrm_address_t *saddr, struct xfrm_id *id, __u16 *family,
ret = xfrm_xfrmproto_getbyname(*argv); ret = xfrm_xfrmproto_getbyname(*argv);
if (ret < 0) if (ret < 0)
invarg("\"XFRM_PROTO\" is invalid", *argv); invarg("\"XFRM-PROTO\" is invalid", *argv);
id->proto = (__u8)ret; id->proto = (__u8)ret;
@ -1072,7 +1072,7 @@ int xfrm_id_parse(xfrm_address_t *saddr, struct xfrm_id *id, __u16 *family,
invarg("the same address family is required between \"src\" and \"dst\"", *argv); invarg("the same address family is required between \"src\" and \"dst\"", *argv);
if (loose == 0 && id->proto == 0) if (loose == 0 && id->proto == 0)
missarg("XFRM_PROTO"); missarg("XFRM-PROTO");
if (argc == *argcp) if (argc == *argcp)
missarg("ID"); missarg("ID");

2
ip/xfrm_monitor.c
View File

@ -37,7 +37,7 @@ static void usage(void) __attribute__((noreturn));
static void usage(void) static void usage(void)
{ {
fprintf(stderr, "Usage: ip xfrm monitor [ all | LISTofOBJECTS ]\n"); fprintf(stderr, "Usage: ip xfrm monitor [ all | LISTofXFRM-OBJECTS ]\n");
exit(-1); exit(-1);
} }

72
ip/xfrm_policy.c
View File

@ -54,50 +54,50 @@ static void usage(void) __attribute__((noreturn));
static void usage(void) static void usage(void)
{ {
fprintf(stderr, "Usage: ip xfrm policy { add | update } dir DIR SELECTOR [ ctx SEC_CTX ][ index INDEX ] [ ptype PTYPE ]\n"); fprintf(stderr, "Usage: ip xfrm policy { add | update } SELECTOR dir DIR [ ctx CTX ]\n");
fprintf(stderr, " [ action ACTION ] [ priority PRIORITY ] [ flag FLAG-LIST ] [ LIMIT-LIST ] [ TMPL-LIST ] [mark MARK [mask MASK]]\n"); fprintf(stderr, " [ mark MARK [ mask MASK ] ] [ index INDEX ] [ ptype PTYPE ]\n");
fprintf(stderr, "Usage: ip xfrm policy { delete | get } dir DIR [ SELECTOR | index INDEX ] [ ctx SEC_CTX ][ ptype PTYPE ] [mark MARK [mask MASK]]\n"); fprintf(stderr, " [ action ACTION ] [ priority PRIORITY ] [ flag FLAG-LIST ]\n");
fprintf(stderr, "Usage: ip xfrm policy { deleteall | list } [ dir DIR ] [ SELECTOR ]\n"); fprintf(stderr, " [ LIMIT-LIST ] [ TMPL-LIST ]\n");
fprintf(stderr, " [ index INDEX ] [ action ACTION ] [ priority PRIORITY ] [ flag FLAG-LIST ]\n"); fprintf(stderr, "Usage: ip xfrm policy { delete | get } { SELECTOR | index INDEX } dir DIR\n");
fprintf(stderr, " [ ctx CTX ] [ mark MARK [ mask MASK ] ] [ ptype PTYPE ]\n");
fprintf(stderr, "Usage: ip xfrm policy { deleteall | list } [ SELECTOR ] [ dir DIR ]\n");
fprintf(stderr, " [ index INDEX ] [ ptype PTYPE ] [ action ACTION ] [ priority PRIORITY ]\n");
fprintf(stderr, " [ flag FLAG-LIST ]\n");
fprintf(stderr, "Usage: ip xfrm policy flush [ ptype PTYPE ]\n"); fprintf(stderr, "Usage: ip xfrm policy flush [ ptype PTYPE ]\n");
fprintf(stderr, "Usage: ip xfrm count\n"); fprintf(stderr, "Usage: ip xfrm count\n");
fprintf(stderr, "PTYPE := [ main | sub ](default=main)\n"); fprintf(stderr, "SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [ UPSPEC ]\n");
fprintf(stderr, "DIR := [ in | out | fwd ]\n"); fprintf(stderr, "UPSPEC := proto { { ");
fprintf(stderr, "%s | ", strxf_proto(IPPROTO_TCP));
fprintf(stderr, "SELECTOR := src ADDR[/PLEN] dst ADDR[/PLEN] [ UPSPEC ] [ dev DEV ]\n"); fprintf(stderr, "%s | ", strxf_proto(IPPROTO_UDP));
fprintf(stderr, "%s | ", strxf_proto(IPPROTO_SCTP));
fprintf(stderr, "UPSPEC := proto PROTO [ [ sport PORT ] [ dport PORT ] |\n"); fprintf(stderr, "%s", strxf_proto(IPPROTO_DCCP));
fprintf(stderr, " [ type NUMBER ] [ code NUMBER ] |\n"); fprintf(stderr, " } [ sport PORT ] [ dport PORT ] |\n");
fprintf(stderr, " [ key { DOTTED_QUAD | NUMBER } ] ]\n"); fprintf(stderr, " { ");
fprintf(stderr, "%s | ", strxf_proto(IPPROTO_ICMP));
//fprintf(stderr, "DEV - device name(default=none)\n"); fprintf(stderr, "%s | ", strxf_proto(IPPROTO_ICMPV6));
fprintf(stderr, "%s", strxf_proto(IPPROTO_MH));
fprintf(stderr, "ACTION := [ allow | block ](default=allow)\n"); fprintf(stderr, " } [ type NUMBER ] [ code NUMBER ] |\n");
fprintf(stderr, " %s", strxf_proto(IPPROTO_GRE));
//fprintf(stderr, "PRIORITY - priority value(default=0)\n"); fprintf(stderr, " [ key { DOTTED-QUAD | NUMBER } ] | PROTO }\n");
fprintf(stderr, "DIR := in | out | fwd\n");
fprintf(stderr, "PTYPE := main | sub\n");
fprintf(stderr, "ACTION := allow | block\n");
fprintf(stderr, "FLAG-LIST := [ FLAG-LIST ] FLAG\n"); fprintf(stderr, "FLAG-LIST := [ FLAG-LIST ] FLAG\n");
fprintf(stderr, "FLAG := [ localok | icmp ]\n"); fprintf(stderr, "FLAG := localok | icmp\n");
fprintf(stderr, "LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT\n");
fprintf(stderr, "LIMIT-LIST := [ LIMIT-LIST ] | [ limit LIMIT ]\n"); fprintf(stderr, "LIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SECONDS |\n");
fprintf(stderr, "LIMIT := [ [time-soft|time-hard|time-use-soft|time-use-hard] SECONDS ] |\n"); fprintf(stderr, " { byte-soft | byte-hard } SIZE | { packet-soft | packet-hard } COUNT\n");
fprintf(stderr, " [ [byte-soft|byte-hard] SIZE ] | [ [packet-soft|packet-hard] NUMBER ]\n"); fprintf(stderr, "TMPL-LIST := [ TMPL-LIST ] tmpl TMPL\n");
fprintf(stderr, "TMPL-LIST := [ TMPL-LIST ] | [ tmpl TMPL ]\n");
fprintf(stderr, "TMPL := ID [ mode MODE ] [ reqid REQID ] [ level LEVEL ]\n"); fprintf(stderr, "TMPL := ID [ mode MODE ] [ reqid REQID ] [ level LEVEL ]\n");
fprintf(stderr, "ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM_PROTO ] [ spi SPI ]\n"); fprintf(stderr, "ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]\n");
fprintf(stderr, "XFRM-PROTO := ");
fprintf(stderr, "XFRM_PROTO := [ ");
fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ESP)); fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ESP));
fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_AH)); fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_AH));
fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_COMP)); fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_COMP));
fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ROUTING)); fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ROUTING));
fprintf(stderr, "%s ", strxf_xfrmproto(IPPROTO_DSTOPTS)); fprintf(stderr, "%s\n", strxf_xfrmproto(IPPROTO_DSTOPTS));
fprintf(stderr, "]\n"); fprintf(stderr, "MODE := transport | tunnel | ro | in_trigger | beet\n");
fprintf(stderr, "LEVEL := required | use\n");
fprintf(stderr, "MODE := [ transport | tunnel | beet ](default=transport)\n");
//fprintf(stderr, "REQID - number(default=0)\n");
fprintf(stderr, "LEVEL := [ required | use ](default=required)\n");
exit(-1); exit(-1);
} }

120
ip/xfrm_state.c
View File

@ -56,63 +56,57 @@ static void usage(void) __attribute__((noreturn));
static void usage(void) static void usage(void)
{ {
fprintf(stderr, "Usage: ip xfrm state { add | update } ID [ XFRM_OPT ] [ ctx SEC_CTX ] [ mode MODE ]\n"); fprintf(stderr, "Usage: ip xfrm state { add | update } ID [ ALGO-LIST ] [ mode MODE ]\n");
fprintf(stderr, " [ reqid REQID ] [ seq SEQ ] [ replay-window SIZE ] [ flag FLAG-LIST ]\n"); fprintf(stderr, " [ mark MARK [ mask MASK ] ] [ reqid REQID ] [ seq SEQ ]\n");
fprintf(stderr, " [ encap ENCAP ] [ sel SELECTOR ] [ replay-seq SEQ ]\n"); fprintf(stderr, " [ replay-window SIZE ] [ replay-seq SEQ ] [ replay-oseq SEQ ]\n");
fprintf(stderr, " [ replay-oseq SEQ ] [ LIMIT-LIST ]\n"); fprintf(stderr, " [ flag FLAG-LIST ] [ sel SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ]\n");
fprintf(stderr, "Usage: ip xfrm state allocspi ID [ mode MODE ] [ reqid REQID ] [ seq SEQ ]\n"); fprintf(stderr, " [ coa ADDR[/PLEN] ] [ ctx CTX ]\n");
fprintf(stderr, " [ min SPI max SPI ]\n"); fprintf(stderr, "Usage: ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ]\n");
fprintf(stderr, "Usage: ip xfrm state { delete | get } ID\n"); fprintf(stderr, " [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]\n");
fprintf(stderr, "Usage: ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]\n");
fprintf(stderr, "Usage: ip xfrm state { deleteall | list } [ ID ] [ mode MODE ] [ reqid REQID ]\n"); fprintf(stderr, "Usage: ip xfrm state { deleteall | list } [ ID ] [ mode MODE ] [ reqid REQID ]\n");
fprintf(stderr, " [ flag FLAG-LIST ]\n"); fprintf(stderr, " [ flag FLAG-LIST ]\n");
fprintf(stderr, "Usage: ip xfrm state flush [ proto XFRM_PROTO ]\n"); fprintf(stderr, "Usage: ip xfrm state flush [ proto XFRM-PROTO ]\n");
fprintf(stderr, "Usage: ip xfrm state count \n"); fprintf(stderr, "Usage: ip xfrm state count\n");
fprintf(stderr, "ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]\n");
fprintf(stderr, "ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM_PROTO ] [ spi SPI ] [mark MARK [mask MASK]]\n"); fprintf(stderr, "XFRM-PROTO := ");
//fprintf(stderr, "XFRM_PROTO := [ esp | ah | comp ]\n");
fprintf(stderr, "XFRM_PROTO := [ ");
fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ESP)); fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ESP));
fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_AH)); fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_AH));
fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_COMP)); fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_COMP));
fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ROUTING)); fprintf(stderr, "%s | ", strxf_xfrmproto(IPPROTO_ROUTING));
fprintf(stderr, "%s ", strxf_xfrmproto(IPPROTO_DSTOPTS)); fprintf(stderr, "%s\n", strxf_xfrmproto(IPPROTO_DSTOPTS));
fprintf(stderr, "]\n"); fprintf(stderr, "ALGO-LIST := [ ALGO-LIST ] ALGO\n");
fprintf(stderr, "ALGO := { ");
//fprintf(stderr, "SPI - security parameter index(default=0)\n");
fprintf(stderr, "MODE := [ transport | tunnel | ro | beet ](default=transport)\n");
//fprintf(stderr, "REQID - number(default=0)\n");
fprintf(stderr, "FLAG-LIST := [ FLAG-LIST ] FLAG\n");
fprintf(stderr, "FLAG := [ noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4 ]\n");
fprintf(stderr, "ENCAP := ENCAP-TYPE SPORT DPORT OADDR\n");
fprintf(stderr, "ENCAP-TYPE := espinudp | espinudp-nonike\n");
fprintf(stderr, "ALGO-LIST := [ ALGO-LIST ] | [ ALGO ]\n");
fprintf(stderr, "ALGO := ALGO_TYPE ALGO_NAME ALGO_KEY "
"[ ALGO_ICV_LEN | ALGO_TRUNC_LEN ]\n");
fprintf(stderr, "ALGO_TYPE := [ ");
fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_AEAD));
fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_CRYPT)); fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_CRYPT));
fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_AUTH)); fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_AUTH));
fprintf(stderr, "%s | ", strxf_algotype(XFRMA_ALG_AUTH_TRUNC)); fprintf(stderr, "%s", strxf_algotype(XFRMA_ALG_COMP));
fprintf(stderr, "%s ", strxf_algotype(XFRMA_ALG_COMP)); fprintf(stderr, " } ALGO-NAME ALGO-KEY |\n");
fprintf(stderr, "]\n"); fprintf(stderr, " %s", strxf_algotype(XFRMA_ALG_AEAD));
fprintf(stderr, " ALGO-NAME ALGO-KEY ALGO-ICV-LEN |\n");
fprintf(stderr, " %s", strxf_algotype(XFRMA_ALG_AUTH_TRUNC));
fprintf(stderr, " ALGO-NAME ALGO-KEY ALGO-TRUNC-LEN\n");
fprintf(stderr, "MODE := transport | tunnel | ro | in_trigger | beet\n");
fprintf(stderr, "FLAG-LIST := [ FLAG-LIST ] FLAG\n");
fprintf(stderr, "FLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4\n");
fprintf(stderr, "SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [ UPSPEC ]\n");
fprintf(stderr, "UPSPEC := proto { { ");
fprintf(stderr, "%s | ", strxf_proto(IPPROTO_TCP));
fprintf(stderr, "%s | ", strxf_proto(IPPROTO_UDP));
fprintf(stderr, "%s | ", strxf_proto(IPPROTO_SCTP));
fprintf(stderr, "%s", strxf_proto(IPPROTO_DCCP));
fprintf(stderr, " } [ sport PORT ] [ dport PORT ] |\n");
fprintf(stderr, " { ");
fprintf(stderr, "%s | ", strxf_proto(IPPROTO_ICMP));
fprintf(stderr, "%s | ", strxf_proto(IPPROTO_ICMPV6));
fprintf(stderr, "%s", strxf_proto(IPPROTO_MH));
fprintf(stderr, " } [ type NUMBER ] [ code NUMBER ] |\n");
fprintf(stderr, " %s", strxf_proto(IPPROTO_GRE));
fprintf(stderr, " [ key { DOTTED-QUAD | NUMBER } ] | PROTO }\n");
fprintf(stderr, "LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT\n");
fprintf(stderr, "LIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SECONDS |\n");
fprintf(stderr, " { byte-soft | byte-hard } SIZE | { packet-soft | packet-hard } COUNT\n");
fprintf(stderr, "ENCAP := { espinudp | espinudp-nonike } SPORT DPORT OADDR\n");
//fprintf(stderr, "ALGO_NAME - algorithm name\n");
//fprintf(stderr, "ALGO_KEY - algorithm key\n");
fprintf(stderr, "SELECTOR := src ADDR[/PLEN] dst ADDR[/PLEN] [ UPSPEC ] [ dev DEV ]\n");
fprintf(stderr, "UPSPEC := proto PROTO [ [ sport PORT ] [ dport PORT ] |\n");
fprintf(stderr, " [ type NUMBER ] [ code NUMBER ] ]\n");
//fprintf(stderr, "DEV - device name(default=none)\n");
fprintf(stderr, "LIMIT-LIST := [ LIMIT-LIST ] | [ limit LIMIT ]\n");
fprintf(stderr, "LIMIT := [ [time-soft|time-hard|time-use-soft|time-use-hard] SECONDS ] |\n");
fprintf(stderr, " [ [byte-soft|byte-hard] SIZE ] | [ [packet-soft|packet-hard] COUNT ]\n");
exit(-1); exit(-1);
} }
@ -124,7 +118,7 @@ static int xfrm_algo_parse(struct xfrm_algo *alg, enum xfrm_attr_type_t type,
#if 0 #if 0
/* XXX: verifying both name and key is required! */ /* XXX: verifying both name and key is required! */
fprintf(stderr, "warning: ALGONAME/ALGOKEY will send to kernel promiscuously!(verifying them isn't implemented yet)\n"); fprintf(stderr, "warning: ALGO-NAME/ALGO-KEY will send to kernel promiscuously! (verifying them isn't implemented yet)\n");
#endif #endif
strncpy(alg->alg_name, name, sizeof(alg->alg_name)); strncpy(alg->alg_name, name, sizeof(alg->alg_name));
@ -144,7 +138,7 @@ static int xfrm_algo_parse(struct xfrm_algo *alg, enum xfrm_attr_type_t type,
/* calculate length of the converted values(real key) */ /* calculate length of the converted values(real key) */
len = (plen + 1) / 2; len = (plen + 1) / 2;
if (len > max) if (len > max)
invarg("\"ALGOKEY\" makes buffer overflow\n", key); invarg("\"ALGO-KEY\" makes buffer overflow\n", key);
for (i = - (plen % 2), j = 0; j < len; i += 2, j++) { for (i = - (plen % 2), j = 0; j < len; i += 2, j++) {
char vbuf[3]; char vbuf[3];
@ -155,7 +149,7 @@ static int xfrm_algo_parse(struct xfrm_algo *alg, enum xfrm_attr_type_t type,
vbuf[2] = '\0'; vbuf[2] = '\0';
if (get_u8(&val, vbuf, 16)) if (get_u8(&val, vbuf, 16))
invarg("\"ALGOKEY\" is invalid", key); invarg("\"ALGO-KEY\" is invalid", key);
buf[j] = val; buf[j] = val;
} }
@ -163,7 +157,7 @@ static int xfrm_algo_parse(struct xfrm_algo *alg, enum xfrm_attr_type_t type,
len = slen; len = slen;
if (len > 0) { if (len > 0) {
if (len > max) if (len > max)
invarg("\"ALGOKEY\" makes buffer overflow\n", key); invarg("\"ALGO-KEY\" makes buffer overflow\n", key);
strncpy(buf, key, len); strncpy(buf, key, len);
} }
@ -384,37 +378,37 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv)
switch (type) { switch (type) {
case XFRMA_ALG_AEAD: case XFRMA_ALG_AEAD:
if (aeadop) if (aeadop)
duparg("ALGOTYPE", *argv); duparg("ALGO-TYPE", *argv);
aeadop = *argv; aeadop = *argv;
break; break;
case XFRMA_ALG_CRYPT: case XFRMA_ALG_CRYPT:
if (ealgop) if (ealgop)
duparg("ALGOTYPE", *argv); duparg("ALGO-TYPE", *argv);
ealgop = *argv; ealgop = *argv;
break; break;
case XFRMA_ALG_AUTH: case XFRMA_ALG_AUTH:
case XFRMA_ALG_AUTH_TRUNC: case XFRMA_ALG_AUTH_TRUNC:
if (aalgop) if (aalgop)
duparg("ALGOTYPE", *argv); duparg("ALGO-TYPE", *argv);
aalgop = *argv; aalgop = *argv;
break; break;
case XFRMA_ALG_COMP: case XFRMA_ALG_COMP:
if (calgop) if (calgop)
duparg("ALGOTYPE", *argv); duparg("ALGO-TYPE", *argv);
calgop = *argv; calgop = *argv;
break; break;
default: default:
/* not reached */ /* not reached */
invarg("\"ALGOTYPE\" is invalid\n", *argv); invarg("\"ALGO-TYPE\" is invalid\n", *argv);
} }
if (!NEXT_ARG_OK()) if (!NEXT_ARG_OK())
missarg("ALGONAME"); missarg("ALGO-NAME");
NEXT_ARG(); NEXT_ARG();
name = *argv; name = *argv;
if (!NEXT_ARG_OK()) if (!NEXT_ARG_OK())
missarg("ALGOKEY"); missarg("ALGO-KEY");
NEXT_ARG(); NEXT_ARG();
key = *argv; key = *argv;
@ -424,7 +418,7 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv)
switch (type) { switch (type) {
case XFRMA_ALG_AEAD: case XFRMA_ALG_AEAD:
if (!NEXT_ARG_OK()) if (!NEXT_ARG_OK())
missarg("ALGOICVLEN"); missarg("ALGO-ICV-LEN");
NEXT_ARG(); NEXT_ARG();
if (get_u32(&icvlen, *argv, 0)) if (get_u32(&icvlen, *argv, 0))
invarg("\"aead\" ICV length is invalid", invarg("\"aead\" ICV length is invalid",
@ -436,7 +430,7 @@ static int xfrm_state_modify(int cmd, unsigned flags, int argc, char **argv)
break; break;
case XFRMA_ALG_AUTH_TRUNC: case XFRMA_ALG_AUTH_TRUNC:
if (!NEXT_ARG_OK()) if (!NEXT_ARG_OK())
missarg("ALGOTRUNCLEN"); missarg("ALGO-TRUNC-LEN");
NEXT_ARG(); NEXT_ARG();
if (get_u32(&trunclen, *argv, 0)) if (get_u32(&trunclen, *argv, 0))
invarg("\"auth\" trunc length is invalid", invarg("\"auth\" trunc length is invalid",
@ -649,7 +643,7 @@ static int xfrm_state_allocspi(int argc, char **argv)
exit(1); exit(1);
} }
if (req.xspi.min > req.xspi.max) { if (req.xspi.min > req.xspi.max) {
fprintf(stderr, "\"min\" valie is larger than \"max\" one\n"); fprintf(stderr, "\"min\" value is larger than \"max\" value\n");
exit(1); exit(1);
} }
} else { } else {
@ -1164,7 +1158,7 @@ static int xfrm_state_flush(int argc, char **argv)
ret = xfrm_xfrmproto_getbyname(*argv); ret = xfrm_xfrmproto_getbyname(*argv);
if (ret < 0) if (ret < 0)
invarg("\"XFRM_PROTO\" is invalid", *argv); invarg("\"XFRM-PROTO\" is invalid", *argv);
req.xsf.proto = (__u8)ret; req.xsf.proto = (__u8)ret;
} else } else

769
man/man8/ip.8
View File

@ -421,318 +421,348 @@ throw " | " unreachable " | " prohibit " | " blackhole " | " nat " ]"
.ti -8 .ti -8
.BR "ip monitor" " [ " all " |" .BR "ip monitor" " [ " all " |"
.IR LISTofOBJECTS " ]" .IR LISTofOBJECTS " ]"
.sp
.ti -8 .ti -8
.BR "ip xfrm" .B "ip xfrm"
.IR XFRM_OBJECT " { " COMMAND " }" .IR XFRM-OBJECT " { " COMMAND " | "
.BR help " }"
.sp
.ti -8 .ti -8
.IR XFRM_OBJECT " := { " state " | " policy " | " monitor " } " .IR XFRM-OBJECT " :="
.BR state " | " policy " | " monitor
.sp
.ti -8 .ti -8
.BR "ip xfrm state " { " add " | " update " } " .BR "ip xfrm state " { " add " | " update " } "
.IR ID " [ " .IR ID " [ " ALGO-LIST " ]"
.IR XFRM_OPT " ] " .RB "[ " mode
.RB " [ " mode .IR MODE " ]"
.IR MODE " ] " .RB "[ " mark
.br .I MARK
.RB " [ " reqid .RB "[ " mask
.IR REQID " ] " .IR MASK " ] ]"
.RB " [ " seq .RB "[ " reqid
.IR SEQ " ] " .IR REQID " ]"
.RB " [ " replay-window .RB "[ " seq
.IR SIZE " ] " .IR SEQ " ]"
.br .RB "[ " replay-window
.RB " [ " flag .IR SIZE " ]"
.IR FLAG-LIST " ] " .RB "[ " replay-seq
.RB " [ " encap .IR SEQ " ]"
.IR ENCAP " ] " .RB "[ " replay-oseq
.RB " [ " sel .IR SEQ " ]"
.IR SELECTOR " ] " .RB "[ " flag
.br .IR FLAG-LIST " ]"
.RB " [ " .RB "[ " sel
.IR LIMIT-LIST " ] " .IR SELECTOR " ] [ " LIMIT-LIST " ]"
.RB "[ " encap
.IR ENCAP " ]"
.RB "[ " coa
.IR ADDR "[/" PLEN "] ]"
.RB "[ " ctx
.IR CTX " ]"
.ti -8 .ti -8
.BR "ip xfrm state allocspi " .B "ip xfrm state allocspi"
.IR ID .I ID
.RB " [ " mode .RB "[ " mode
.IR MODE " ] " .IR MODE " ]"
.RB " [ " reqid .RB "[ " mark
.IR REQID " ] " .I MARK
.RB " [ " seq .RB "[ " mask
.IR SEQ " ] " .IR MASK " ] ]"
.RB " [ " min .RB "[ " reqid
.IR SPI .IR REQID " ]"
.RB "[ " seq
.IR SEQ " ]"
.RB "[ " min
.I SPI
.B max .B max
.IR SPI " ] " .IR SPI " ]"
.ti -8 .ti -8
.BR "ip xfrm state" " { " delete " | " get " } " .BR "ip xfrm state" " { " delete " | " get " } "
.IR ID .I ID
.RB "[ " mark
.I MARK
.RB "[ " mask
.IR MASK " ] ]"
.ti -8 .ti -8
.BR "ip xfrm state" " { " deleteall " | " list " } [ " .BR "ip xfrm state" " { " deleteall " | " list " } ["
.IR ID " ] " .IR ID " ]"
.RB " [ " mode .RB "[ " mode
.IR MODE " ] " .IR MODE " ]"
.br .RB "[ " reqid
.RB " [ " reqid .IR REQID " ]"
.IR REQID " ] " .RB "[ " flag
.RB " [ " flag .IR FLAG-LIST " ]"
.IR FLAG_LIST " ] "
.ti -8 .ti -8
.BR "ip xfrm state flush" " [ " proto .BR "ip xfrm state flush" " [ " proto
.IR XFRM_PROTO " ] " .IR XFRM-PROTO " ]"
.ti -8 .ti -8
.BR "ip xfrm state count" .BR "ip xfrm state count"
.ti -8 .ti -8
.IR ID " := " .IR ID " :="
.RB " [ " src .RB "[ " src
.IR ADDR " ] " .IR ADDR " ]"
.RB " [ " dst .RB "[ " dst
.IR ADDR " ] " .IR ADDR " ]"
.RB " [ " proto .RB "[ " proto
.IR XFRM_PROTO " ] " .IR XFRM-PROTO " ]"
.RB " [ " spi .RB "[ " spi
.IR SPI " ] " .IR SPI " ]"
.ti -8 .ti -8
.IR XFRM_PROTO " := " .IR XFRM-PROTO " :="
.RB " [ " esp " | " ah " | " comp " | " route2 " | " hao " ] " .BR esp " | " ah " | " comp " | " route2 " | " hao
.ti -8
.IR ALGO-LIST " := [ " ALGO-LIST " ] " ALGO
.ti -8
.IR ALGO " :="
.RB "{ " enc " | " auth " | " comp " } "
.IR ALGO-NAME " " ALGO-KEY
.R "|"
.br
.B aead
.IR ALGO-NAME " " ALGO-KEY " " ALGO-ICV-LEN
.R "|"
.br
.B auth-trunc
.IR ALGO-NAME " " ALGO-KEY " " ALGO-TRUNC-LEN
.ti -8 .ti -8
.IR MODE " := " .IR MODE " := "
.RB " [ " transport " | " tunnel " | " ro " | " beet " ] " .BR transport " | " tunnel " | " ro " | " in_trigger " | " beet
.B (default=transport)
.ti -8 .ti -8
.IR FLAG-LIST " := " .IR FLAG-LIST " := [ " FLAG-LIST " ] " FLAG
.RI " [ " FLAG-LIST " ] " FLAG
.ti -8 .ti -8
.IR FLAG " := " .IR FLAG " :="
.RB " [ " noecn " | " decap-dscp " | " wildrecv " ] " .BR noecn " | " decap-dscp " | " nopmtudisc " | " wildrecv " | " icmp " | " af-unspec " | " align4
.ti -8 .ti -8
.IR ENCAP " := " ENCAP-TYPE " " SPORT " " DPORT " " OADDR .IR SELECTOR " :="
.RB "[ " src
.ti -8 .IR ADDR "[/" PLEN "] ]"
.IR ENCAP-TYPE " := " .RB "[ " dst
.B espinudp .IR ADDR "[/" PLEN "] ]"
.RB " | " .RB "[ " dev
.B espinudp-nonike .IR DEV " ]"
.br
.ti -8 .RI "[ " UPSPEC " ]"
.IR ALGO-LIST " := [ "
.IR ALGO-LIST " ] | [ "
.IR ALGO " ] "
.ti -8
.IR ALGO " := "
.IR ALGO_TYPE
.IR ALGO_NAME
.IR ALGO_KEY
.ti -8
.IR ALGO_TYPE " := "
.RB " [ " enc " | " auth " | " comp " ] "
.ti -8
.IR SELECTOR " := "
.B src
.IR ADDR "[/" PLEN "]"
.B dst
.IR ADDR "[/" PLEN "]"
.RI " [ " UPSPEC " ] "
.RB " [ " dev
.IR DEV " ] "
.ti -8 .ti -8
.IR UPSPEC " := " .IR UPSPEC " := "
.B proto .BR proto " {"
.IR PROTO " [[ " .IR PROTO " |"
.B sport
.IR PORT " ] "
.RB " [ " dport
.IR PORT " ] | "
.br .br
.RB " [ " type .RB "{ " tcp " | " udp " | " sctp " | " dccp " } [ " sport
.IR NUMBER " ] " .IR PORT " ]"
.RB " [ " code .RB "[ " dport
.IR NUMBER " ] | " .IR PORT " ] |"
.br .br
.RB " [ " key .RB "{ " icmp " | " ipv6-icmp " | " mobility-header " } [ " type
.IR KEY " ]] " .IR NUMBER " ]"
.RB "[ " code
.IR NUMBER " ] |"
.br
.BR gre " [ " key
.RI "{ " DOTTED-QUAD " | " NUMBER " } ] }"
.ti -8 .ti -8
.IR LIMIT-LIST " := [ " LIMIT-LIST " ] |" .IR LIMIT-LIST " := [ " LIMIT-LIST " ]"
.RB " [ "limit .B limit
.IR LIMIT " ] " .I LIMIT
.ti -8 .ti -8
.IR LIMIT " := " .IR LIMIT " :="
.RB " [ [" time-soft "|" time-hard "|" time-use-soft "|" time-use-hard "]" .RB "{ " time-soft " | " time-hard " | " time-use-soft " | " time-use-hard " }"
.IR SECONDS " ] | " .IR "SECONDS" " |"
.RB "[ ["byte-soft "|" byte-hard "]"
.IR SIZE " ] | "
.br .br
.RB " [ ["packet-soft "|" packet-hard "]" .RB "{ " byte-soft " | " byte-hard " }"
.IR COUNT " ] " .IR SIZE " |"
.br
.RB "{ " packet-soft " | " packet-hard " }"
.I COUNT
.ti -8 .ti -8
.BR "ip xfrm policy" " { " add " | " update " } " " dir " .IR ENCAP " :="
.IR DIR .RB "{ " espinudp " | " espinudp-nonike " }"
.IR SELECTOR " [ " .IR SPORT " " DPORT " " OADDR
.BR index
.IR INDEX " ] "
.br
.RB " [ " ptype
.IR PTYPE " ] "
.RB " [ " action
.IR ACTION " ] "
.RB " [ " priority
.IR PRIORITY " ] "
.br
.RI " [ " LIMIT-LIST " ] [ "
.IR TMPL-LIST " ] "
.ti -8 .ti -8
.BR "ip xfrm policy" " { " delete " | " get " } " " dir " .BR "ip xfrm policy" " { " add " | " update " }"
.IR DIR " [ " SELECTOR " | " .I SELECTOR
.BR index .B dir
.IR INDEX .I DIR
.RB " ] " .RB "[ " ctx
.br .IR CTX " ]"
.RB " [ " ptype .RB "[ " mark
.IR PTYPE " ] " .I MARK
.RB "[ " mask
.IR MASK " ] ]"
.RB "[ " index
.IR INDEX " ]"
.RB "[ " ptype
.IR PTYPE " ]"
.RB "[ " action
.IR ACTION " ]"
.RB "[ " priority
.IR PRIORITY " ]"
.RB "[ " flag
.IR FLAG-LIST " ]"
.RI "[ " LIMIT-LIST " ] [ " TMPL-LIST " ]"
.ti -8 .ti -8
.BR "ip xfrm policy" " { " deleteall " | " list " } " .BR "ip xfrm policy" " { " delete " | " get " }"
.RB " [ " dir .RI "{ " SELECTOR " | "
.IR DIR " ] [ " .B index
.IR SELECTOR " ] " .IR INDEX " }"
.br .B dir
.RB " [ " index .I DIR
.IR INDEX " ] " .RB "[ " ctx
.RB " [ " action .IR CTX " ]"
.IR ACTION " ] " .RB "[ " mark
.RB " [ " priority .I MARK
.IR PRIORITY " ] " .RB "[ " mask
.IR MASK " ] ]"
.RB "[ " ptype
.IR PTYPE " ]"
.ti -8
.BR "ip xfrm policy" " { " deleteall " | " list " }"
.RI "[ " SELECTOR " ]"
.RB "[ " dir
.IR DIR " ]"
.RB "[ " index
.IR INDEX " ]"
.RB "[ " ptype
.IR PTYPE " ]"
.RB "[ " action
.IR ACTION " ]"
.RB "[ " priority
.IR PRIORITY " ]"
.ti -8 .ti -8
.B "ip xfrm policy flush" .B "ip xfrm policy flush"
.RB " [ " ptype .RB "[ " ptype
.IR PTYPE " ] " .IR PTYPE " ]"
.ti -8 .ti -8
.B "ip xfrm count" .B "ip xfrm policy count"
.ti -8 .ti -8
.IR PTYPE " := " .IR SELECTOR " :="
.RB " [ " main " | " sub " ] " .RB "[ " src
.B (default=main) .IR ADDR "[/" PLEN "] ]"
.RB "[ " dst
.ti -8 .IR ADDR "[/" PLEN "] ]"
.IR DIR " := " .RB "[ " dev
.RB " [ " in " | " out " | " fwd " ] " .IR DEV " ]"
.RI "[ " UPSPEC " ]"
.ti -8
.IR SELECTOR " := "
.B src
.IR ADDR "[/" PLEN "]"
.B dst
.IR ADDR "[/" PLEN] " [ " UPSPEC
.RB " ] [ " dev
.IR DEV " ] "
.ti -8 .ti -8
.IR UPSPEC " := " .IR UPSPEC " := "
.B proto .BR proto " {"
.IR PROTO " [ " .IR PROTO " |"
.RB " [ " sport
.IR PORT " ] "
.RB " [ " dport
.IR PORT " ] | "
.br .br
.RB " [ " type .RB "{ " tcp " | " udp " | " sctp " | " dccp " } [ " sport
.IR NUMBER " ] " .IR PORT " ]"
.RB " [ " code .RB "[ " dport
.IR NUMBER " ] | " .IR PORT " ] |"
.br .br
.RB " [ " key .RB "{ " icmp " | " ipv6-icmp " | " mobility-header " } [ " type
.IR KEY " ] ] " .IR NUMBER " ]"
.RB "[ " code
.IR NUMBER " ] |"
.br
.BR gre " [ " key
.RI "{ " DOTTED-QUAD " | " NUMBER " } ] }"
.ti -8
.IR DIR " := "
.BR in " | " out " | " fwd
.ti -8
.IR PTYPE " := "
.BR main " | " sub
.ti -8 .ti -8
.IR ACTION " := " .IR ACTION " := "
.RB " [ " allow " | " block " ]" .BR allow " | " block
.B (default=allow)
.ti -8 .ti -8
.IR LIMIT-LIST " := " .IR FLAG-LIST " := [ " FLAG-LIST " ] " FLAG
.RB " [ "
.IR LIMIT-LIST " ] | "
.RB " [ " limit
.IR LIMIT " ] "
.ti -8 .ti -8
.IR LIMIT " := " .IR FLAG " :="
.RB " [ [" time-soft "|" time-hard "|" time-use-soft "|" time-use-hard "]" .BR localok " | " icmp
.IR SECONDS " ] | "
.RB " [ [" byte-soft "|" byte-hard "]"
.IR SIZE " ] | "
.br [ "
.RB "[" packet-soft "|" packet-hard "]"
.IR NUMBER " ] "
.ti -8 .ti -8
.IR TMPL-LIST " := " .IR LIMIT-LIST " := [ " LIMIT-LIST " ]"
.B " [ " .B limit
.IR TMPL-LIST " ] | " .I LIMIT
.RB " [ " tmpl
.IR TMPL " ] "
.ti -8 .ti -8
.IR TMPL " := " .IR LIMIT " :="
.IR ID " [ " .RB "{ " time-soft " | " time-hard " | " time-use-soft " | " time-use-hard " }"
.B mode .IR "SECONDS" " |"
.IR MODE " ] " .br
.RB " [ " reqid .RB "{ " byte-soft " | " byte-hard " }"
.IR REQID " ] " .IR SIZE " |"
.RB " [ " level .br
.IR LEVEL " ] " .RB "{ " packet-soft " | " packet-hard " }"
.I COUNT
.ti -8 .ti -8
.IR ID " := " .IR TMPL-LIST " := [ " TMPL-LIST " ]"
.RB " [ " src .B tmpl
.IR ADDR " ] " .I TMPL
.RB " [ " dst
.IR ADDR " ] "
.RB " [ " proto
.IR XFRM_PROTO " ] "
.RB " [ " spi
.IR SPI " ] "
.ti -8 .ti -8
.IR XFRM_PROTO " := " .IR TMPL " := " ID
.RB " [ " esp " | " ah " | " comp " | " route2 " | " hao " ] " .RB "[ " mode
.IR MODE " ]"
.RB "[ " reqid
.IR REQID " ]"
.RB "[ " level
.IR LEVEL " ]"
.ti -8
.IR ID " :="
.RB "[ " src
.IR ADDR " ]"
.RB "[ " dst
.IR ADDR " ]"
.RB "[ " proto
.IR XFRM-PROTO " ]"
.RB "[ " spi
.IR SPI " ]"
.ti -8
.IR XFRM-PROTO " :="
.BR esp " | " ah " | " comp " | " route2 " | " hao
.ti -8 .ti -8
.IR MODE " := " .IR MODE " := "
.RB " [ " transport " | " tunnel " | " beet " ] " .BR transport " | " tunnel " | " ro " | " in_trigger " | " beet
.B (default=transport)
.ti -8 .ti -8
.IR LEVEL " := " .IR LEVEL " :="
.RB " [ " required " | " use " ] " .BR required " | " use
.B (default=required)
.ti -8 .ti -8
.BR "ip xfrm monitor" " [ " all " | " .BR "ip xfrm monitor" " [ " all " |"
.IR LISTofOBJECTS " ] " .IR LISTofXFRM-OBJECTS " ]"
.in -8 .in -8
.ad b .ad b
@ -849,10 +879,6 @@ host addresses.
.B tunnel .B tunnel
- tunnel over IP. - tunnel over IP.
.TP
.B xfrm
- framework for IPsec protocol.
.PP .PP
The names of all objects may be written in full or The names of all objects may be written in full or
abbreviated form, f.e. abbreviated form, f.e.
@ -2470,169 +2496,226 @@ at any time.
It prepends the history with the state snapshot dumped at the moment It prepends the history with the state snapshot dumped at the moment
of starting. of starting.
.SH ip xfrm - setting xfrm .SH ip xfrm - transform configuration
xfrm is an IP framework, which can transform format of the datagrams, xfrm is an IP framework for transforming packets (such as encrypting
.br their payloads). This framework is used to implement the IPsec protocol
i.e. encrypt the packets with some algorithm. xfrm policy and xfrm state suite (with the
are associated through templates .B state
.IR TMPL_LIST "." object operating on the Security Association Database, and the
This framework is used as a part of IPsec protocol. .B policy
object operating on the Security Policy Database). It is also used for
the IP Payload Compression Protocol and features of Mobile IPv6.
.SS ip xfrm state add - add new state into xfrm .SS ip xfrm state add - add new state into xfrm
.SS ip xfrm state update - update existing xfrm state .SS ip xfrm state update - update existing state in xfrm
.SS ip xfrm state allocspi - allocate SPI value .SS ip xfrm state allocspi - allocate an SPI value
.SS ip xfrm state delete - delete existing state in xfrm
.SS ip xfrm state get - get existing state in xfrm
.SS ip xfrm state deleteall - delete all existing state in xfrm
.SS ip xfrm state list - print out the list of existing state in xfrm
.SS ip xfrm state flush - flush all state in xfrm
.SS ip xfrm state count - count all existing state in xfrm
.TP .TP
.I MODE .IR ID
is set as default to is specified by a source address, destination address,
.BR transport "," .RI "transform protocol " XFRM-PROTO ","
but it could be set to and/or Security Parameter Index
.BR tunnel "," ro " or " beet "." .IR SPI "."
.TP .TP
.I FLAG-LIST .I XFRM-PROTO
contains one or more flags. specifies a transform protocol:
.RB "IPsec Encapsulating Security Payload (" esp "),"
.TP .RB "IPsec Authentication Header (" ah "),"
.I FLAG .RB "IP Payload Compression (" comp "),"
could be set to .RB "Mobile IPv6 Type 2 Routing Header (" route2 "), or"
.BR noecn ", " decap-dscp " or " wildrecv "." .RB "Mobile IPv6 Home Address Option (" hao ")."
.TP
.I ENCAP
encapsulation is set to encapsulation type
.IR ENCAP-TYPE ", source port " SPORT ", destination port " DPORT " and " OADDR "."
.TP
.I ENCAP-TYPE
could be set to
.BR espinudp " or " espinudp-nonike "."
.TP .TP
.I ALGO-LIST .I ALGO-LIST
contains one or more algorithms specifies one or more algorithms
.I ALGO .IR ALGO
which depend on the type of algorithm set by to use. Algorithm types include
.IR ALGO_TYPE "." .RB "encryption (" enc "),"
Valid algorithms are: .RB "authentication (" auth "),"
.BR enc ", " auth " or " comp "." .RB "authentication with a specified truncation length (" auth-trunc "),"
.RB "authenticated encryption with associated data (" aead "), and"
.RB "compression (" comp ")."
For each algorithm used, the algorithm type, the algorithm name
.IR ALGO-NAME ","
and the key
.I ALGO-KEY
must be specified. For
.BR aead ","
the Integrity Check Value length
.I ALGO-ICV-LEN
must additionally be specified.
For
.BR auth-trunc ","
the signature truncation length
.I ALGO-TRUNC-LEN
must additionally be specified.
.TP
.I MODE
specifies a mode of operation:
.RB "IPsec transport mode (" transport "), "
.RB "IPsec tunnel mode (" tunnel "), "
.RB "Mobile IPv6 route optimization mode (" ro "), "
.RB "Mobile IPv6 inbound trigger mode (" in_trigger "), or "
.RB "IPsec ESP Bound End-to-End Tunnel Mode (" beet ")."
.TP
.I FLAG-LIST
contains one or more of the following optional flags:
.BR noecn ", " decap-dscp ", " nopmtudisc ", " wildrecv ", " icmp ", "
.BR af-unspec ", or " align4 "."
.TP
.IR SELECTOR
selects the traffic that will be controlled by the policy, based on the source
address, the destination address, the network device, and/or
.IR UPSPEC "."
.TP
.IR UPSPEC
selects traffic by protocol. For the
.BR tcp ", " udp ", " sctp ", or " dccp
protocols, the source and destination port can optionally be specified.
For the
.BR icmp ", " ipv6-icmp ", or " mobility-header
protocols, the type and code numbers can optionally be specified.
For the
.B gre
protocol, the key can optionally be specified as a dotted-quad or number.
Other protocols can be selected by name or number
.IR PROTO "."
.TP
.I LIMIT-LIST
sets limits in seconds, bytes, or numbers of packets.
.TP
.I ENCAP
encapsulates packets with protocol
.BR espinudp " or " espinudp-nonike ","
.RI "using source port " SPORT ", destination port " DPORT
.RI ", and original address " OADDR "."
.SS ip xfrm policy add - add a new policy .SS ip xfrm policy add - add a new policy
.SS ip xfrm policy update - update an existing policy .SS ip xfrm policy update - update an existing policy
.SS ip xfrm policy delete - delete existing policy .SS ip xfrm policy delete - delete an existing policy
.SS ip xfrm policy get - get existing policy .SS ip xfrm policy get - get an existing policy
.SS ip xfrm policy deleteall - delete all existing xfrm policy .SS ip xfrm policy deleteall - delete all existing xfrm policies
.SS ip xfrm policy list - print out the list of xfrm policy .SS ip xfrm policy list - print out the list of xfrm policies
.SS ip xfrm policy flush - flush policies .SS ip xfrm policy flush - flush policies
It can be flush
.BR all
policies or only those specified with
.BR ptype "."
.TP .SS ip xfrm policy count - count existing policies
.BI dir " DIR "
directory could be one of these:
.BR "inp", " out " or " fwd".
.TP .TP
.IR SELECTOR .IR SELECTOR
selects for which addresses will be set up the policy. The selector selects the traffic that will be controlled by the policy, based on the source
is defined by source and destination address. address, the destination address, the network device, and/or
.IR UPSPEC "."
.TP .TP
.IR UPSPEC .IR UPSPEC
is defined by source port selects traffic by protocol. For the
.BR sport ", " .BR tcp ", " udp ", " sctp ", or " dccp
destination port protocols, the source and destination port can optionally be specified.
.BR dport ", " type For the
as number, .BR icmp ", " ipv6-icmp ", or " mobility-header
.B code protocols, the type and code numbers can optionally be specified.
also number and For the
.BR key .B gre
as dotted-quad or number. protocol, the key can optionally be specified as a dotted-quad or number.
Other protocols can be selected by name or number
.IR PROTO "."
.TP .TP
.BI dev " DEV " .I DIR
specify network device. selects the policy direction as
.BR in ", " out ", or " fwd "."
.TP .TP
.BI index " INDEX " .I CTX
the number of indexed policy. sets the security context.
.TP .TP
.BI ptype " PTYPE " .I PTYPE
type is set as default on can be
.BR "main" , .BR main " (default) or " sub "."
could be switch on
.BR "sub" .
.TP .TP
.BI action " ACTION " .I ACTION
is set as default on can be
.BR "allow". .BR allow " (default) or " block "."
It could be switch on
.BR "block".
.TP .TP
.BI priority " PRIORITY " .I PRIORITY
priority is a number. Default priority is set on zero. is a number that defaults to zero.
.TP .TP
.IR LIMIT-LIST .I FLAG-LIST
limits are set in seconds, bytes or numbers of packets. contains one or both of the following optional flags:
.BR local " or " icmp "."
.TP .TP
.IR TMPL-LIST .I LIMIT-LIST
template list is based on sets limits in seconds, bytes, or numbers of packets.
.IR ID ","
.BR mode ", " reqid " and " level ". " .TP
.I TMPL-LIST
is a template list specified using
.IR ID ", " MODE ", " REQID ", and/or " LEVEL ". "
.TP .TP
.IR ID .IR ID
is specified by source address, destination address, is specified by a source address, destination address,
.I proto .RI "transform protocol " XFRM-PROTO ","
and value of and/or Security Parameter Index
.IR spi "." .IR SPI "."
.TP .TP
.IR XFRM_PROTO .I XFRM-PROTO
values: specifies a transform protocol:
.BR esp ", " ah ", " comp ", " route2 " or " hao "." .RB "IPsec Encapsulating Security Payload (" esp "),"
.RB "IPsec Authentication Header (" ah "),"
.RB "IP Payload Compression (" comp "),"
.RB "Mobile IPv6 Type 2 Routing Header (" route2 "), or"
.RB "Mobile IPv6 Home Address Option (" hao ")."
.TP .TP
.IR MODE .I MODE
is set as default on specifies a mode of operation:
.BR transport "," .RB "IPsec transport mode (" transport "), "
but it could be set on .RB "IPsec tunnel mode (" tunnel "), "
.BR tunnel " or " beet "." .RB "Mobile IPv6 route optimization mode (" ro "), "
.RB "Mobile IPv6 inbound trigger mode (" in_trigger "), or "
.RB "IPsec ESP Bound End-to-End Tunnel Mode (" beet ")."
.TP .TP
.IR LEVEL .I LEVEL
is set as default on can be
.BR required .BR required " (default) or " use "."
and the other choice is
.BR use "."
.TP .SS ip xfrm monitor - state monitoring for xfrm objects
.IR UPSPEC The xfrm objects to monitor can be optionally specified.
is specified by
.BR sport " and " dport " (for UDP/TCP), "
.BR type " and " code " (for ICMP; as number) or "
.BR key " (for GRE; as dotted-quad or number)."
.
.SS ip xfrm monitor - is used for listing all objects or defined group of them.
The
.B xfrm monitor
can monitor the policies for all objects or defined group of them.
.SH HISTORY .SH HISTORY
.B ip .B ip