1.\" $NetBSD: setkey.8,v 1.21 2009/10/14 18:34:14 joerg Exp $ 2.\" 3.\" Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project. 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the project nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.Dd March 19, 2004 31.Dt SETKEY 8 32.Os 33.\" 34.Sh NAME 35.Nm setkey 36.Nd manually manipulate the IPsec SA/SP database 37.\" 38.Sh SYNOPSIS 39.Nm setkey 40.Op Fl knrv 41.Ar file ... 42.Nm setkey 43.Op Fl knrv 44.Fl c 45.Nm setkey 46.Op Fl krv 47.Fl f Ar filename 48.Nm setkey 49.Op Fl aklPrv 50.Fl D 51.Nm setkey 52.Op Fl Pvp 53.Fl F 54.Nm setkey 55.Op Fl H 56.Fl x 57.Nm setkey 58.Op Fl ?V 59.\" 60.Sh DESCRIPTION 61.Nm 62adds, updates, dumps, or flushes 63Security Association Database (SAD) entries 64as well as Security Policy Database (SPD) entries in the kernel. 65.Pp 66.Nm 67takes a series of operations from standard input 68.Po 69if invoked with 70.Fl c 71.Pc 72or the file named 73.Ar filename 74.Po 75if invoked with 76.Fl f Ar filename 77.Pc . 78.Bl -tag -width Ds 79.It (no flag) 80Dump the SAD entries or SPD entries contained in the specified 81.Ar file . 82.It Fl ? 83Print short help. 84.It Fl a 85.Nm 86usually does not display dead SAD entries with 87.Fl D . 88If 89.Fl a 90is also specified, the dead SAD entries will be displayed as well. 91A dead SAD entry is one that has expired but remains in the 92system because it is referenced by some SPD entries. 93.It Fl D 94Dump the SAD entries. 95If 96.Fl P 97is also specified, the SPD entries are dumped. 98If 99.Fl p 100is specified, the ports are displayed. 101.It Fl F 102Flush the SAD entries. 103If 104.Fl P 105is also specified, the SPD entries are flushed. 106.It Fl H 107Add hexadecimal dump in 108.Fl x 109mode. 110.It Fl h 111On 112.Nx , 113synonym for 114.Fl H . 115On other systems, synonym for 116.Fl ? . 117.It Fl k 118Use semantics used in kernel. 119Available only in Linux. 120See also 121.Fl r . 122.It Fl l 123Loop forever with short output on 124.Fl D . 125.It Fl n 126No action. 127The program will check validity of the input, but no changes to 128the SPD will be made. 129.It Fl r 130Use semantics described in IPsec RFCs. 131This mode is default. 132For details see section 133.Sx RFC vs Linux kernel semantics . 134Available only in Linux. 135See also 136.Fl k . 137.It Fl x 138Loop forever and dump all the messages transmitted to the 139.Dv PF_KEY 140socket. 141.Fl xx 142prints the unformatted timestamps. 143.It Fl V 144Print version string. 145.It Fl v 146Be verbose. 147The program will dump messages exchanged on the 148.Dv PF_KEY 149socket, including messages sent from other processes to the kernel. 150.El 151.Ss Configuration syntax 152With 153.Fl c 154or 155.Fl f 156on the command line, 157.Nm 158accepts the following configuration syntax. 159Lines starting with hash signs 160.Pq Sq # 161are treated as comment lines. 162.Bl -tag -width Ds 163.It Li add Oo Fl 46n Oc Ar src Ar dst Ar protocol Ar spi \ 164Oo Ar extensions Oc Ar algorithm ... Li ; 165Add an SAD entry. 166.Li add 167can fail for multiple reasons, including when the key length does 168not match the specified algorithm. 169.\" 170.It Li get Oo Fl 46n Oc Ar src Ar dst Ar protocol Ar spi Li ; 171Show an SAD entry. 172.\" 173.It Li delete Oo Fl 46n Oc Ar src Ar dst Ar protocol Ar spi Li ; 174Remove an SAD entry. 175.\" 176.It Li deleteall Oo Fl 46n Oc Ar src Ar dst Ar protocol Li ; 177Remove all SAD entries that match the specification. 178.\" 179.It Li flush Oo Ar protocol Oc Li ; 180Clear all SAD entries matched by the options. 181.Fl F 182on the command line achieves the same functionality. 183.\" 184.It Li dump Oo Ar protocol Oc Li ; 185Dumps all SAD entries matched by the options. 186.Fl D 187on the command line achieves the same functionality. 188.\" 189.It Li spdadd Oo Fl 46n Oc Ar src_range Ar dst_range Ar upperspec \ 190Ar label Ar policy Li ; 191Add an SPD entry. 192.\" 193.It Li spdadd tagged Ar tag Ar policy Li ; 194Add an SPD entry based on a PF tag. 195.Ar tag 196must be a string surrounded by double quotes. 197.\" 198.It Li spddelete Oo Fl 46n Oc Ar src_range Ar dst_range Ar upperspec \ 199Fl P Ar direction Li ; 200Delete an SPD entry. 201.\" 202.It Li spdflush Li ; 203Clear all SPD entries. 204.Fl FP 205on the command line achieves the same functionality. 206.\" 207.It Li spddump Li ; 208Dumps all SPD entries. 209.Fl DP 210on the command line achieves the same functionality. 211.El 212.\" 213.Pp 214Meta-arguments are as follows: 215.Pp 216.Bl -tag -compact -width Ds 217.It Ar src 218.It Ar dst 219Source/destination of the secure communication is specified as 220an IPv4/v6 address, and an optional port number between square 221brackets. 222.Nm 223can resolve a FQDN into numeric addresses. 224If the FQDN resolves into multiple addresses, 225.Nm 226will install multiple SAD/SPD entries into the kernel 227by trying all possible combinations. 228.Fl 4 , 229.Fl 6 , 230and 231.Fl n 232restrict the address resolution of FQDN in certain ways. 233.Fl 4 234and 235.Fl 6 236restrict results into IPv4/v6 addresses only, respectively. 237.Fl n 238avoids FQDN resolution and requires addresses to be numeric addresses. 239.\" 240.Pp 241.It Ar protocol 242.Ar protocol 243is one of following: 244.Bl -tag -width Fl -compact 245.It Li esp 246ESP based on rfc2406 247.It Li esp-old 248ESP based on rfc1827 249.It Li ah 250AH based on rfc2402 251.It Li ah-old 252AH based on rfc1826 253.It Li ipcomp 254IPComp 255.It Li tcp 256TCP-MD5 based on rfc2385 257.El 258.\" 259.Pp 260.It Ar spi 261Security Parameter Index 262.Pq SPI 263for the SAD and the SPD. 264.Ar spi 265must be a decimal number, or a hexadecimal number with a 266.Dq Li 0x 267prefix. 268SPI values between 0 and 255 are reserved for future use by IANA 269and cannot be used. 270TCP-MD5 associations must use 0x1000 and therefore only have per-host 271granularity at this time. 272.\" 273.Pp 274.It Ar extensions 275take some of the following: 276.Bl -tag -width Fl -compact 277.\" 278.It Fl m Ar mode 279Specify a security protocol mode for use. 280.Ar mode 281is one of following: 282.Li transport , tunnel , 283or 284.Li any . 285The default value is 286.Li any . 287.\" 288.It Fl r Ar size 289Specify window size of bytes for replay prevention. 290.Ar size 291must be decimal number in 32-bit word. 292If 293.Ar size 294is zero or not specified, replay checks don't take place. 295.\" 296.It Fl u Ar id 297Specify the identifier of the policy entry in the SPD. 298See 299.Ar policy . 300.\" 301.It Fl f Ar pad_option 302defines the content of the ESP padding. 303.Ar pad_option 304is one of following: 305.Bl -tag -width random-pad -compact 306.It Li zero-pad 307All the paddings are zero. 308.It Li random-pad 309A series of randomized values are used. 310.It Li seq-pad 311A series of sequential increasing numbers started from 1 are used. 312.El 313.\" 314.It Fl f Li nocyclic-seq 315Don't allow cyclic sequence numbers. 316.\" 317.It Fl lh Ar time 318.It Fl ls Ar time 319Specify hard/soft life time duration of the SA measured in seconds. 320.\" 321.It Fl bh Ar bytes 322.It Fl bs Ar bytes 323Specify hard/soft life time duration of the SA measured in bytes transported. 324.\" 325.It Fl ctx Ar doi Ar algorithm Ar context-name 326Specify an access control label. The access control label is interpreted 327by the LSM (e.g., SELinux). Ultimately, it enables MAC on network 328communications. 329.Bl -tag -width Fl -compact 330.It Ar doi 331The domain of interpretation, which is used by the 332IKE daemon to identify the domain in which negotiation takes place. 333.It Ar algorithm 334Indicates the LSM for which the label is generated (e.g., SELinux). 335.It Ar context-name 336The string representation of the label that is interpreted by the LSM. 337.El 338.El 339.\" 340.Pp 341.It Ar algorithm 342.Bl -tag -width Fl -compact 343.It Fl E Ar ealgo Ar key 344Specify an encryption algorithm 345.Ar ealgo 346for ESP. 347.It Fl E Ar ealgo Ar key Fl A Ar aalgo Ar key 348Specify an encryption algorithm 349.Ar ealgo , 350as well as a payload authentication algorithm 351.Ar aalgo , 352for ESP. 353.It Fl A Ar aalgo Ar key 354Specify an authentication algorithm for AH. 355.It Fl C Ar calgo Op Fl R 356Specify a compression algorithm for IPComp. 357If 358.Fl R 359is specified, the 360.Ar spi 361field value will be used as the IPComp CPI 362.Pq compression parameter index 363on wire as-is. 364If 365.Fl R 366is not specified, 367the kernel will use well-known CPI on wire, and 368.Ar spi 369field will be used only as an index for kernel internal usage. 370.El 371.Pp 372.Ar key 373must be a double-quoted character string, or a series of hexadecimal 374digits preceded by 375.Dq Li 0x . 376.Pp 377Possible values for 378.Ar ealgo , 379.Ar aalgo , 380and 381.Ar calgo 382are specified in the 383.Sx Algorithms 384sections. 385.\" 386.Pp 387.It Ar src_range 388.It Ar dst_range 389These select the communications that should be secured by IPsec. 390They can be an IPv4/v6 address or an IPv4/v6 address range, and 391may be accompanied by a TCP/UDP port specification. 392This takes the following form: 393.Bd -literal -offset 394.Ar address 395.Ar address/prefixlen 396.Ar address[port] 397.Ar address/prefixlen[port] 398.Ed 399.Pp 400.Ar prefixlen 401and 402.Ar port 403must be decimal numbers. 404The square brackets around 405.Ar port 406are really necessary, 407they are not man page meta-characters. 408For FQDN resolution, the rules applicable to 409.Ar src 410and 411.Ar dst 412apply here as well. 413.\" 414.Pp 415.It Ar upperspec 416Upper-layer protocol to be used. 417You can use one of the words in 418.Pa /etc/protocols 419as 420.Ar upperspec , 421or 422.Li icmp6 , 423.Li ip4 , 424or 425.Li any . 426.Li any 427stands for 428.Dq any protocol . 429You can also use the protocol number. 430You can specify a type and/or a code of ICMPv6 when the 431upper-layer protocol is ICMPv6. 432The specification can be placed after 433.Li icmp6 . 434A type is separated from a code by single comma. 435A code must always be specified. 436When a zero is specified, the kernel deals with it as a wildcard. 437Note that the kernel can not distinguish a wildcard from an ICPMv6 438type of zero. 439For example, the following means that the policy doesn't require IPsec 440for any inbound Neighbor Solicitation. 441.Dl spdadd ::/0 ::/0 icmp6 135,0 -P in none ; 442.Pp 443.Em Note : 444.Ar upperspec 445does not work against forwarding case at this moment, 446as it requires extra reassembly at the forwarding node 447.Pq not implemented at this moment . 448There are many protocols in 449.Pa /etc/protocols , 450but all protocols except of TCP, UDP, and ICMP may not be suitable 451to use with IPsec. 452You have to consider carefully what to use. 453.\" 454.Pp 455.It Ar label 456.Ar label 457is the access control label for the policy. This label is interpreted 458by the LSM (e.g., SELinux). Ultimately, it enables MAC on network 459communications. When a policy contains an access control label, SAs 460negotiated with this policy will contain the label. It's format: 461.Bl -tag -width Fl -compact 462.\" 463.It Fl ctx Ar doi Ar algorithm Ar context-name 464.Bl -tag -width Fl -compact 465.It Ar doi 466The domain of interpretation, which is used by the 467IKE daemon to identify the domain in which negotiation takes place. 468.It Ar algorithm 469Indicates the LSM for which the label is generated (e.g., SELinux). 470.It Ar context-name 471The string representation of the label that is interpreted by the LSM. 472.El 473.El 474.\" 475.Pp 476.It Ar policy 477.Ar policy 478is in one of the following three formats: 479.Bl -item -compact 480.It 481.Fl P Ar direction [priority specification] Li discard 482.It 483.Fl P Ar direction [priority specification] Li none 484.It 485.Fl P Ar direction [priority specification] Li ipsec 486.Ar protocol/mode/src-dst/level Op ... 487.El 488.Pp 489You must specify the direction of its policy as 490.Ar direction . 491Either 492.Ar out , 493.Ar in , 494or 495.Ar fwd 496can be used. 497.Pp 498.Ar priority specification 499is used to control the placement of the policy within the SPD. 500Policy position is determined by 501a signed integer where higher priorities indicate the policy is placed 502closer to the beginning of the list and lower priorities indicate the 503policy is placed closer to the end of the list. 504Policies with equal priorities are added at the end of groups 505of such policies. 506.Pp 507Priority can only 508be specified when setkey has been compiled against kernel headers that 509support policy priorities (Linux \*[Gt]= 2.6.6). 510If the kernel does not support priorities, a warning message will 511be printed the first time a priority specification is used. 512Policy priority takes one of the following formats: 513.Bl -tag -width "discard" 514.It Ar {priority,prio} offset 515.Ar offset 516is an integer in the range from \-2147483647 to 214783648. 517.It Ar {priority,prio} base {+,\-} offset 518.Ar base 519is either 520.Li low (\-1073741824) , 521.Li def (0) , 522or 523.Li high (1073741824) 524.Pp 525.Ar offset 526is an unsigned integer. 527It can be up to 1073741824 for 528positive offsets, and up to 1073741823 for negative offsets. 529.El 530.Pp 531.Li discard 532means the packet matching indexes will be discarded. 533.Li none 534means that IPsec operation will not take place onto the packet. 535.Li ipsec 536means that IPsec operation will take place onto the packet. 537.Pp 538The 539.Ar protocol/mode/src-dst/level 540part specifies the rule how to process the packet. 541Either 542.Li ah , 543.Li esp , 544or 545.Li ipcomp 546must be used as 547.Ar protocol . 548.Ar mode 549is either 550.Li transport 551or 552.Li tunnel . 553If 554.Ar mode 555is 556.Li tunnel , 557you must specify the end-point addresses of the SA as 558.Ar src 559and 560.Ar dst 561with 562.Sq - 563between these addresses, which is used to specify the SA to use. 564If 565.Ar mode 566is 567.Li transport , 568both 569.Ar src 570and 571.Ar dst 572can be omitted. 573.Ar level 574is to be one of the following: 575.Li default , use , require , 576or 577.Li unique . 578If the SA is not available in every level, the kernel will 579ask the key exchange daemon to establish a suitable SA. 580.Li default 581means the kernel consults the system wide default for the protocol 582you specified, e.g. the 583.Li esp_trans_deflev 584sysctl variable, when the kernel processes the packet. 585.Li use 586means that the kernel uses an SA if it's available, 587otherwise the kernel keeps normal operation. 588.Li require 589means SA is required whenever the kernel sends a packet matched 590with the policy. 591.Li unique 592is the same as 593.Li require ; 594in addition, it allows the policy to match the unique out-bound SA. 595You just specify the policy level 596.Li unique , 597.Xr racoon 8 598will configure the SA for the policy. 599If you configure the SA by manual keying for that policy, 600you can put a decimal number as the policy identifier after 601.Li unique 602separated by a colon 603.Sq \&: 604like: 605.Li unique:number 606in order to bind this policy to the SA. 607.Li number 608must be between 1 and 32767. 609It corresponds to 610.Ar extensions Fl u 611of the manual SA configuration. 612When you want to use SA bundle, you can define multiple rules. 613For example, if an IP header was followed by an AH header followed 614by an ESP header followed by an upper layer protocol header, the 615rule would be: 616.Dl esp/transport//require ah/transport//require ; 617The rule order is very important. 618.Pp 619When NAT-T is enabled in the kernel, policy matching for ESP over 620UDP packets may be done on endpoint addresses and port 621(this depends on the system. 622System that do not perform the port check cannot support 623multiple endpoints behind the same NAT). 624When using ESP over UDP, you can specify port numbers in the endpoint 625addresses to get the correct matching. 626Here is an example: 627.Bd -literal -offset 628spdadd 10.0.11.0/24[any] 10.0.11.33/32[any] any -P out ipsec 629 esp/tunnel/192.168.0.1[4500]-192.168.1.2[30000]/require ; 630 631.Ed 632These ports must be left unspecified (which defaults to 0) for 633anything other than ESP over UDP. 634They can be displayed in SPD dump using 635.Nm 636.Fl DPp . 637.Pp 638Note that 639.Dq Li discard 640and 641.Dq Li none 642are not in the syntax described in 643.Xr ipsec_set_policy 3 . 644There are a few differences in the syntax. 645See 646.Xr ipsec_set_policy 3 647for detail. 648.El 649.\" 650.Ss Algorithms 651The following list shows the supported algorithms. 652.Sy protocol 653and 654.Sy algorithm 655are almost orthogonal. 656These authentication algorithms can be used as 657.Ar aalgo 658in 659.Fl A Ar aalgo 660of the 661.Ar protocol 662parameter: 663.Pp 664.Bd -literal -offset indent 665algorithm keylen (bits) 666hmac-md5 128 ah: rfc2403 667 128 ah-old: rfc2085 668hmac-sha1 160 ah: rfc2404 669 160 ah-old: 128bit ICV (no document) 670keyed-md5 128 ah: 96bit ICV (no document) 671 128 ah-old: rfc1828 672keyed-sha1 160 ah: 96bit ICV (no document) 673 160 ah-old: 128bit ICV (no document) 674null 0 to 2048 for debugging 675hmac-sha256 256 ah: 96bit ICV 676 (draft-ietf-ipsec-ciph-sha-256-00) 677 256 ah-old: 128bit ICV (no document) 678hmac-sha384 384 ah: 96bit ICV (no document) 679 384 ah-old: 128bit ICV (no document) 680hmac-sha512 512 ah: 96bit ICV (no document) 681 512 ah-old: 128bit ICV (no document) 682hmac-ripemd160 160 ah: 96bit ICV (RFC2857) 683 ah-old: 128bit ICV (no document) 684aes-xcbc-mac 128 ah: 96bit ICV (RFC3566) 685 128 ah-old: 128bit ICV (no document) 686tcp-md5 8 to 640 tcp: rfc2385 687.Ed 688.Pp 689These encryption algorithms can be used as 690.Ar ealgo 691in 692.Fl E Ar ealgo 693of the 694.Ar protocol 695parameter: 696.Pp 697.Bd -literal -offset indent 698algorithm keylen (bits) 699des-cbc 64 esp-old: rfc1829, esp: rfc2405 7003des-cbc 192 rfc2451 701null 0 to 2048 rfc2410 702blowfish-cbc 40 to 448 rfc2451 703cast128-cbc 40 to 128 rfc2451 704des-deriv 64 ipsec-ciph-des-derived-01 7053des-deriv 192 no document 706rijndael-cbc 128/192/256 rfc3602 707twofish-cbc 0 to 256 draft-ietf-ipsec-ciph-aes-cbc-01 708aes-ctr 160/224/288 draft-ietf-ipsec-ciph-aes-ctr-03 709camellia-cbc 128/192/256 rfc4312 710.Ed 711.Pp 712Note that the first 128 bits of a key for 713.Li aes-ctr 714will be used as AES key, and the remaining 32 bits will be used as nonce. 715.Pp 716These compression algorithms can be used as 717.Ar calgo 718in 719.Fl C Ar calgo 720of the 721.Ar protocol 722parameter: 723.Pp 724.Bd -literal -offset indent 725algorithm 726deflate rfc2394 727.Ed 728.\" 729.Ss RFC vs Linux kernel semantics 730The Linux kernel uses the 731.Ar fwd 732policy instead of the 733.Ar in 734policy for packets what are forwarded through that particular box. 735.Pp 736In 737.Ar kernel 738mode, 739.Nm 740manages and shows policies and SAs exactly as they are stored in the kernel. 741.Pp 742In 743.Ar RFC 744mode, 745.Nm 746.Bl -item 747.It 748creates 749.Ar fwd 750policies for every 751.Ar in 752policy inserted 753.It 754(not implemented yet) filters out all 755.Ar fwd 756policies 757.El 758.Sh RETURN VALUES 759The command exits with 0 on success, and non-zero on errors. 760.\" 761.Sh EXAMPLES 762.Bd -literal -offset 763add 3ffe:501:4819::1 3ffe:501:481d::1 esp 123457 764 -E des-cbc 0x3ffe05014819ffff ; 765 766add -6 myhost.example.com yourhost.example.com ah 123456 767 -A hmac-sha1 "AH SA configuration!" ; 768 769add 10.0.11.41 10.0.11.33 esp 0x10001 770 -E des-cbc 0x3ffe05014819ffff 771 -A hmac-md5 "authentication!!" ; 772 773get 3ffe:501:4819::1 3ffe:501:481d::1 ah 123456 ; 774 775flush ; 776 777dump esp ; 778 779spdadd 10.0.11.41/32[21] 10.0.11.33/32[any] any 780 -P out ipsec esp/tunnel/192.168.0.1-192.168.1.2/require ; 781 782add 10.1.10.34 10.1.10.36 tcp 0x1000 -A tcp-md5 "TCP-MD5 BGP secret" ; 783 784add 10.0.11.41 10.0.11.33 esp 0x10001 785 -ctx 1 1 "system_u:system_r:unconfined_t:SystemLow-SystemHigh" 786 -E des-cbc 0x3ffe05014819ffff; 787 788spdadd 10.0.11.41 10.0.11.33 any 789 -ctx 1 1 "system_u:system_r:unconfined_t:SystemLow-SystemHigh" 790 -P out ipsec esp/transport//require ; 791.Ed 792.\" 793.Sh SEE ALSO 794.Xr ipsec_set_policy 3 , 795.Xr racoon 8 , 796.Xr sysctl 8 797.Rs 798.%T "Changed manual key configuration for IPsec" 799.%O "http://www.kame.net/newsletter/19991007/" 800.%D "October 1999" 801.Re 802.\" 803.Sh HISTORY 804The 805.Nm 806command first appeared in the WIDE Hydrangea IPv6 protocol stack 807kit. 808The command was completely re-designed in June 1998. 809.\" 810.Sh BUGS 811.Nm 812should report and handle syntax errors better. 813.Pp 814For IPsec gateway configuration, 815.Ar src_range 816and 817.Ar dst_range 818with TCP/UDP port numbers does not work, as the gateway does not 819reassemble packets 820.Pq it cannot inspect upper-layer headers . 821