pfkey(8)

NAME

pfkey - IPsec Security Policy/Security Association(SA) control utility

SYNTAX

pfkey -A/-D {sa|sp} -T {ah|esp} -S spi [options]...

pfkey -A/-D {sa|sp} -T comp -C cpi [options]...

pfkey -F {any|ah|esp}

pfkey -L

DESCRIPTION

pfkey is used to set up, delete, and display IPsec Security Policy and Security Association(SA).

When you set up IPsec tunnel mode, you also have to set up ip over ip tunnel device. In IPv6, we make use of HUT ipv6tunnel device, so you should set up ipv6 over ipv6 tunnel.
For example:

    # insmod ipv6_tunnel

    # ipv6tunnel add v6tun0 --tunnel-local-packets encaplimit 0 remote 3ffe:a:b:c:d::2 local 3fffe:a:b:c:d:1

    # ipv6tunnel show v6tun0

    # ip link set v6tun0 up

    # ip -6 address add fec80::1/64 dev v6yun0

OPTIONS

-A|--append {sa|sp}
    Append Policy or SA.

-D|--delete {sa|sp}
    Delete Policy or SA.

-F|--flush {any|ah|esp}
    Flush spedified type of Policy/SA.

-L|--list
    Display current Policy/SA status.

-T|--type {ah|esp|comp}
    Specify a type of manipulating header.

-S|--spi
    Specify spi (Security Prameter Index).

-C|--cpi
    Specify cpi (Compression Prameter Index).

-V|--version
    Display version.

-h|--help
    Display help.

-p|--protocol {any|protocol name|protocol number}
    Specify protocol(default is any).
    (You can specify protocol name from /etc/protocols.)

-s|--src|--source source address
    Specify source IP address.

-d|--dst|--destination destination address
    Specify destination IP address.

--sport|--source-port  source port
    Specify source port.

--dport|--destination-port destination port
    Specify destination port.

--auth {hmac-md5|hmac-sha1}
    Specify Authentication algorithm.

--authkey key
    Specify key for Authentication.

--esp {des-cbc|3des-cbc|aes-cbc|null}
    Specify Encryption algorithm.

--espkey key
    Specify key for Encription.

--policy {discard|bypass}
    Specify Policy (default: applay).

--hard {allocs/bytes/age/usetime}
    Specify hard lifetime.
    allocs is the number of different connections, endpoints, or flows that has been allocated. bytes: How many bytes have been processed. age: the number of seconds after the creation. usetime: the number of seconds after the first use.

--soft {allocs/bytes/age/usetime}
    Specify soft lifetime.
    allocs,bytges,age,usetime are same as hard lifetime.

--tunnel
    use IPsec tunnel mode.

--sad SA destination address
    Specify SA destination address(to set policy).

EXAMPLES

To append ESP Policy:

    # pfkey -A sp -T esp -S 0x1234 -s fec0::1 -d fec0::2

To append ESP SA:

    # pfkey -A sa -T esp -S 0x1234 -s fec0::1 -d fec0::2 --esp 3des-cbc --espkey 0x7a3d...

To append AH Policy:

    # pfkey -A sp -T ah -S 0x5678 -s fec0::1 -d fec0::2

To append AH SA:

    # pfkey -A sa -T ah -S 0x5678 -s fec0::1 -d fec0::2 --auth hmac-md5 --authkey 0x3fa8...

To append IPcomp Policy:

    # pfkey -A sp -T comp -C deflate -s fec0::1 -d fec0::2

To append IPcomp SA:

    # pfkey -A sp -T comp -C deflate -s fec0::1 -d fec0::2

Tunnel Mode:

    # pfkey -A sa -T esp -S 0x90ab -s fec0:100::1 -d fec0:200::1 --esp 3des-cbc --espkey 0xa3fe...

    # pfkey -A sp -T esp -S 0x90ab -s fec0:100::/64 -d fec0:200::/64 --tunnel --sad fec0:200::1

BUGS

USAGI IPsec uses CryptoAPI scheme for encryption/authentication. You need to compile and install CryptoAPI encryption/digest modules.

AUTHORS

USAGI Project (http://www.linux-ipv6.org/)

SEE ALSO

RFC2401

The GNU/Linux CryptoAPI site <http://www.kerneli.org/>