1.\" $OpenBSD: ipsecctl.8,v 1.13 2005/07/10 07:11:37 jmc Exp $ 2.\" 3.\" Copyright (c) 2004, 2005 Hans-Joerg Hoexer <hshoexer@openbsd.org> 4.\" 5.\" Permission to use, copy, modify, and distribute this software for any 6.\" purpose with or without fee is hereby granted, provided that the above 7.\" copyright notice and this permission notice appear in all copies. 8.\" 9.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16.\" 17.Dd April 5, 2005 18.Dt IPSECCTL 8 19.Os 20.Sh NAME 21.Nm ipsecctl 22.Nd control flows for IPsec 23.Sh SYNOPSIS 24.Nm ipsecctl 25.Op Fl dFnv 26.Op Fl f Ar file 27.Op Fl s Ar modifier 28.Sh DESCRIPTION 29The 30.Nm 31utility controls flows that determine which packets are to be processed by 32IPsec. 33It allows ruleset configuration and retrieval of status information from the 34kernel's SPD (Security Policy Database) and SADB (Security Association 35Database). 36.Pp 37Additionally, 38.Nm 39can be used to configure the SADB for use with TCP MD5 40signatures, as described in RFC 2385. 41See 42.Xr tcp 4 43for details. 44.Pp 45The ruleset grammar is described in 46.Xr ipsec.conf 5 . 47.Pp 48The options are as follows: 49.Bl -tag -width Ds 50.It Fl d 51When the 52.Fl d 53option is set, specified flows will be deleted from the SPD. 54Otherwise, 55.Nm 56will add flows. 57.It Fl F 58The 59.Fl F 60option flushes the SPD and the SADB. 61.It Fl f Ar file 62Load the rules contained in 63.Ar file . 64.It Fl n 65Do not actually load rules, just parse them. 66.It Fl s Ar modifier 67Show the kernel's databases, specified by 68.Ar modifier 69(may be abbreviated): 70.Pp 71.Bl -tag -width xxxxxxxxxxxxx -compact 72.It Fl s Cm flow 73Show the ruleset loaded into the SPD. 74.It Fl s Cm sa 75Show the active SADB entries. 76.It Fl s Cm all 77Show all of the above. 78.El 79.It Fl v 80Produce more verbose output. 81A second use of 82.Fl v 83will produce even more verbose output. 84.El 85.\" The following requests should be uncommented and used where appropriate. 86.\" This next request is for sections 2, 3, and 9 function return values only. 87.\" .Sh RETURN VALUES 88.\" This next request is for sections 1, 6, 7 & 8 only. 89.\" .Sh ENVIRONMENT 90.\" .Sh FILES 91.\" .Sh EXAMPLES 92.\" This next request is for sections 1, 4, 6, and 8 only. 93.\" .Sh DIAGNOSTICS 94.\" The next request is for sections 2, 3, and 9 error and signal handling only. 95.\" .Sh ERRORS 96.Sh SEE ALSO 97.Xr ipsec 4 , 98.Xr tcp 4 , 99.Xr ipsec.conf 5 100.\" .Sh STANDARDS 101.\" .Sh HISTORY 102.\" .Sh AUTHORS 103.\" .Sh CAVEATS 104.\" .Sh BUGS 105