1*aa9f7a4dSmpi.\" $OpenBSD: ipsecctl.8,v 1.29 2017/11/20 10:51:24 mpi Exp $ 2f484f2cfShshoexer.\" 3245d2e34Shshoexer.\" Copyright (c) 2004, 2005 Hans-Joerg Hoexer <hshoexer@openbsd.org> 4245d2e34Shshoexer.\" 5245d2e34Shshoexer.\" Permission to use, copy, modify, and distribute this software for any 6245d2e34Shshoexer.\" purpose with or without fee is hereby granted, provided that the above 7245d2e34Shshoexer.\" copyright notice and this permission notice appear in all copies. 8245d2e34Shshoexer.\" 9245d2e34Shshoexer.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10245d2e34Shshoexer.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11245d2e34Shshoexer.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12245d2e34Shshoexer.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13245d2e34Shshoexer.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14245d2e34Shshoexer.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15245d2e34Shshoexer.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16245d2e34Shshoexer.\" 17*aa9f7a4dSmpi.Dd $Mdocdate: November 20 2017 $ 18abe267ccShshoexer.Dt IPSECCTL 8 19f484f2cfShshoexer.Os 20f484f2cfShshoexer.Sh NAME 21abe267ccShshoexer.Nm ipsecctl 22eb529c9fSjmc.Nd control flows for IPsec 23f484f2cfShshoexer.Sh SYNOPSIS 24abe267ccShshoexer.Nm ipsecctl 25*aa9f7a4dSmpi.Op Fl cdFkmnv 263d7fea66Sjmc.Op Fl D Ar macro Ns = Ns Ar value 27abe267ccShshoexer.Op Fl f Ar file 283d7fea66Sjmc.Op Fl i Ar fifo 293dd59ad2Shshoexer.Op Fl s Ar modifier 30f484f2cfShshoexer.Sh DESCRIPTION 31f484f2cfShshoexerThe 32f484f2cfShshoexer.Nm 33eb529c9fSjmcutility controls flows that determine which packets are to be processed by 34abe267ccShshoexerIPsec. 3568ef0603ShshoexerIt allows ruleset configuration, and retrieval of status information from the 363044111dShokernel's SPD (Security Policy Database) and SAD (Security Association 37abd1b4caShshoexerDatabase). 3868ef0603ShshoexerIt also can control 3968ef0603Shshoexer.Xr isakmpd 8 4068ef0603Shshoexerand establish tunnels using automatic keying with 4168ef0603Shshoexer.Xr isakmpd 8 . 42abe267ccShshoexerThe ruleset grammar is described in 43abe267ccShshoexer.Xr ipsec.conf 5 . 44abe267ccShshoexer.Pp 45abe267ccShshoexerThe options are as follows: 46abe267ccShshoexer.Bl -tag -width Ds 47*aa9f7a4dSmpi.It Fl c 48*aa9f7a4dSmpiUse in combination with the 49*aa9f7a4dSmpi.Fl s 50*aa9f7a4dSmpioption to collapse flow output. 513d351c90Sreyk.It Fl D Ar macro Ns = Ns Ar value 523d351c90SreykDefine 533d351c90Sreyk.Ar macro 543d351c90Sreykto be set to 553d351c90Sreyk.Ar value 563d351c90Sreykon the command line. 573d351c90SreykOverrides the definition of 583d351c90Sreyk.Ar macro 593d351c90Sreykin the ruleset. 60abd1b4caShshoexer.It Fl d 61abd1b4caShshoexerWhen the 62abd1b4caShshoexer.Fl d 63abd1b4caShshoexeroption is set, specified flows will be deleted from the SPD. 64abd1b4caShshoexerOtherwise, 65abd1b4caShshoexer.Nm 66abd1b4caShshoexerwill add flows. 67abe267ccShshoexer.It Fl F 68abe267ccShshoexerThe 69abe267ccShshoexer.Fl F 703044111dShooption flushes the SPD and the SAD. 71eb529c9fSjmc.It Fl f Ar file 72eb529c9fSjmcLoad the rules contained in 73eb529c9fSjmc.Ar file . 74f8738d8bShenning.It Fl i Ar fifo 750d0003e3ShenningIf given, the 76f8738d8bShenning.Fl i 770d0003e3Shenningoption specifies an alternate FIFO instead of 780d0003e3Shenning.Pa /var/run/isakmpd.fifo , 790d0003e3Shenningused to talk to 80f8738d8bShenning.Xr isakmpd 8 . 813cb2a986Smarkus.It Fl k 823cb2a986SmarkusShow secret keying material when printing the active SAD entries. 838a87fca6Smsf.It Fl m 84d80f2536SjmcContinuously display all 85d80f2536Sjmc.Dv PF_KEY 86d80f2536Sjmcmessages exchanged with the kernel. 87abe267ccShshoexer.It Fl n 88abe267ccShshoexerDo not actually load rules, just parse them. 893dd59ad2Shshoexer.It Fl s Ar modifier 9003fbbeb8SjmcShow the kernel's databases, specified by 913dd59ad2Shshoexer.Ar modifier 923dd59ad2Shshoexer(may be abbreviated): 933dd59ad2Shshoexer.Pp 943dd59ad2Shshoexer.Bl -tag -width xxxxxxxxxxxxx -compact 953dd59ad2Shshoexer.It Fl s Cm flow 96eb529c9fSjmcShow the ruleset loaded into the SPD. 973dd59ad2Shshoexer.It Fl s Cm sa 983044111dShoShow the active SAD entries. 993dd59ad2Shshoexer.It Fl s Cm all 1003dd59ad2ShshoexerShow all of the above. 1013dd59ad2Shshoexer.El 102abe267ccShshoexer.It Fl v 103abe267ccShshoexerProduce more verbose output. 104abe267ccShshoexerA second use of 105abe267ccShshoexer.Fl v 106abe267ccShshoexerwill produce even more verbose output. 107eb529c9fSjmc.El 108c3324a93Skjell.Sh SEE ALSO 1098530c7abShshoexer.Xr ipsec 4 , 1108530c7abShshoexer.Xr tcp 4 , 11168ef0603Shshoexer.Xr ipsec.conf 5 , 11268ef0603Shshoexer.Xr isakmpd 8 113f484f2cfShshoexer.\" .Sh STANDARDS 114f484f2cfShshoexer.\" .Sh HISTORY 115f484f2cfShshoexer.\" .Sh AUTHORS 116f484f2cfShshoexer.\" .Sh CAVEATS 117f484f2cfShshoexer.\" .Sh BUGS 118bb6d8afcShshoexer.Sh HISTORY 119bb6d8afcShshoexerThe 120bb6d8afcShshoexer.Nm ipsecctl 121bb6d8afcShshoexerprogram first appeared in 122bb6d8afcShshoexer.Ox 3.8 . 123