Imported Upstream version 5.1.1

6 files changed, 339 insertions, 246 deletions

diff --git a/src/ipsec/Android.mk b/src/ipsec/Android.mk
index c25be3ebc..3936f7af9 100644
--- a/src/ipsec/Android.mk
+++ b/src/ipsec/Android.mk
@@ -19,6 +19,7 @@ $(GEN) : PRIVATE_CUSTOM_TOOL = sed \
 	-e "s:@IPSEC_DISTRO@::" \
 	-e "s:@IPSEC_DIR@:$(strongswan_DIR):" \
 	-e "s:@IPSEC_SCRIPT@:ipsec:" \
+	-e "s:@IPSEC_BINDIR@:$(strongswan_DIR):" \
 	-e "s:@IPSEC_SBINDIR@:$(strongswan_SBINDIR):" \
 	-e "s:@IPSEC_CONFDIR@:$(strongswan_CONFDIR):" \
 	-e "s:@IPSEC_PIDDIR@:$(strongswan_PIDDIR):" \
diff --git a/src/ipsec/Makefile.am b/src/ipsec/Makefile.am
index 73427c0fa..0ab9ab27c 100644
--- a/src/ipsec/Makefile.am
+++ b/src/ipsec/Makefile.am
@@ -9,6 +9,7 @@ _ipsec.8 : _ipsec.8.in
 	-e "s:@IPSEC_VERSION@:$(PACKAGE_VERSION):" \
 	-e "s:@IPSEC_SCRIPT@:$(ipsec_script):g" \
 	-e "s:@IPSEC_SCRIPT_UPPER@:$(ipsec_script_upper):g" \
+	-e "s:@IPSEC_DIR@:$(ipsecdir):" \
 	$(srcdir)/$@.in > $@
 
 _ipsec : _ipsec.in
@@ -20,6 +21,7 @@ _ipsec : _ipsec.in
 	-e "s:@IPSEC_DISTRO@::" \
 	-e "s:@IPSEC_DIR@:$(ipsecdir):" \
 	-e "s:@IPSEC_SCRIPT@:$(ipsec_script):" \
+	-e "s:@IPSEC_BINDIR@:$(bindir):" \
 	-e "s:@IPSEC_SBINDIR@:$(sbindir):" \
 	-e "s:@IPSEC_CONFDIR@:$(sysconfdir):" \
 	-e "s:@IPSEC_PIDDIR@:$(piddir):" \
diff --git a/src/ipsec/Makefile.in b/src/ipsec/Makefile.in
index 58072f20a..091519292 100644
--- a/src/ipsec/Makefile.in
+++ b/src/ipsec/Makefile.in
@@ -1,9 +1,8 @@
-# Makefile.in generated by automake 1.11.6 from Makefile.am.
+# Makefile.in generated by automake 1.13.3 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software
-# Foundation, Inc.
+# Copyright (C) 1994-2013 Free Software Foundation, Inc.
+
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
 # with or without modifications, as long as this notice is preserved.
@@ -16,23 +15,51 @@
 @SET_MAKE@
 
 VPATH = @srcdir@
-am__make_dryrun = \
-  { \
-    am__dry=no; \
+am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
     case $$MAKEFLAGS in \
       *\\[\ \	]*) \
-        echo 'am--echo: ; @echo "AM"  OK' | $(MAKE) -f - 2>/dev/null \
-          | grep '^AM OK$$' >/dev/null || am__dry=yes;; \
-      *) \
-        for am__flg in $$MAKEFLAGS; do \
-          case $$am__flg in \
-            *=*|--*) ;; \
-            *n*) am__dry=yes; break;; \
-          esac; \
-        done;; \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
     esac; \
-    test $$am__dry = yes; \
-  }
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
 pkgdatadir = $(datadir)/@PACKAGE@
 pkgincludedir = $(includedir)/@PACKAGE@
 pkglibdir = $(libdir)/@PACKAGE@
@@ -52,14 +79,15 @@ POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
 subdir = src/ipsec
-DIST_COMMON = $(dist_man8_MANS) $(srcdir)/Makefile.am \
-	$(srcdir)/Makefile.in
+DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am \
+	$(dist_man8_MANS)
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
 	$(top_srcdir)/m4/config/ltoptions.m4 \
 	$(top_srcdir)/m4/config/ltsugar.m4 \
 	$(top_srcdir)/m4/config/ltversion.m4 \
 	$(top_srcdir)/m4/config/lt~obsolete.m4 \
+	$(top_srcdir)/m4/macros/split-package-version.m4 \
 	$(top_srcdir)/m4/macros/with.m4 \
 	$(top_srcdir)/m4/macros/enable-disable.m4 \
 	$(top_srcdir)/m4/macros/add-plugin.m4 \
@@ -99,12 +127,18 @@ am__uninstall_files_from_dir = { \
   }
 am__installdirs = "$(DESTDIR)$(sbindir)" "$(DESTDIR)$(man8dir)"
 SCRIPTS = $(sbin_SCRIPTS)
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
 AM_V_GEN = $(am__v_GEN_@AM_V@)
 am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
-am__v_GEN_0 = @echo "  GEN   " $@;
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
 AM_V_at = $(am__v_at_@AM_V@)
 am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
 am__v_at_0 = @
+am__v_at_1 = 
 SOURCES =
 DIST_SOURCES =
 am__can_run_installinfo = \
@@ -115,6 +149,7 @@ am__can_run_installinfo = \
 man8dir = $(mandir)/man8
 NROFF = nroff
 MANS = $(dist_man8_MANS)
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 ALLOCA = @ALLOCA@
@@ -189,6 +224,10 @@ PACKAGE_STRING = @PACKAGE_STRING@
 PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
+PACKAGE_VERSION_BUILD = @PACKAGE_VERSION_BUILD@
+PACKAGE_VERSION_MAJOR = @PACKAGE_VERSION_MAJOR@
+PACKAGE_VERSION_MINOR = @PACKAGE_VERSION_MINOR@
+PACKAGE_VERSION_REVIEW = @PACKAGE_VERSION_REVIEW@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 PERL = @PERL@
 PKG_CONFIG = @PKG_CONFIG@
@@ -305,6 +344,7 @@ starter_plugins = @starter_plugins@
 strongswan_conf = @strongswan_conf@
 sysconfdir = @sysconfdir@
 systemdsystemunitdir = @systemdsystemunitdir@
+t_plugins = @t_plugins@
 target_alias = @target_alias@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
@@ -431,27 +471,14 @@ uninstall-man8:
 	} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
 	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
 	dir='$(DESTDIR)$(man8dir)'; $(am__uninstall_files_from_dir)
-tags: TAGS
-TAGS:
+tags TAGS:
 
-ctags: CTAGS
-CTAGS:
+ctags CTAGS:
+
+cscope cscopelist:
 
 
 distdir: $(DISTFILES)
-	@list='$(MANS)'; if test -n "$$list"; then \
-	  list=`for p in $$list; do \
-	    if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
-	    if test -f "$$d$$p"; then echo "$$d$$p"; else :; fi; done`; \
-	  if test -n "$$list" && \
-	    grep 'ab help2man is required to generate this page' $$list >/dev/null; then \
-	    echo "error: found man pages containing the \`missing help2man' replacement text:" >&2; \
-	    grep -l 'ab help2man is required to generate this page' $$list | sed 's/^/         /' >&2; \
-	    echo "       to fix them, install help2man, remove and regenerate the man pages;" >&2; \
-	    echo "       typically \`make maintainer-clean' will remove them" >&2; \
-	    exit 1; \
-	  else :; fi; \
-	else :; fi
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@@ -594,18 +621,18 @@ uninstall-man: uninstall-man8
 	uninstall-am
 
 .PHONY: all all-am check check-am clean clean-generic clean-libtool \
-	distclean distclean-generic distclean-libtool distdir dvi \
-	dvi-am html html-am info info-am install install-am \
-	install-data install-data-am install-data-hook install-dvi \
-	install-dvi-am install-exec install-exec-am install-exec-hook \
-	install-html install-html-am install-info install-info-am \
-	install-man install-man8 install-pdf install-pdf-am install-ps \
-	install-ps-am install-sbinSCRIPTS install-strip installcheck \
-	installcheck-am installdirs maintainer-clean \
-	maintainer-clean-generic mostlyclean mostlyclean-generic \
-	mostlyclean-libtool pdf pdf-am ps ps-am uninstall uninstall-am \
-	uninstall-hook uninstall-man uninstall-man8 \
-	uninstall-sbinSCRIPTS
+	cscopelist-am ctags-am distclean distclean-generic \
+	distclean-libtool distdir dvi dvi-am html html-am info info-am \
+	install install-am install-data install-data-am \
+	install-data-hook install-dvi install-dvi-am install-exec \
+	install-exec-am install-exec-hook install-html install-html-am \
+	install-info install-info-am install-man install-man8 \
+	install-pdf install-pdf-am install-ps install-ps-am \
+	install-sbinSCRIPTS install-strip installcheck installcheck-am \
+	installdirs maintainer-clean maintainer-clean-generic \
+	mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \
+	ps ps-am tags-am uninstall uninstall-am uninstall-hook \
+	uninstall-man uninstall-man8 uninstall-sbinSCRIPTS
 
 
 _ipsec.8 : _ipsec.8.in
@@ -614,6 +641,7 @@ _ipsec.8 : _ipsec.8.in
 	-e "s:@IPSEC_VERSION@:$(PACKAGE_VERSION):" \
 	-e "s:@IPSEC_SCRIPT@:$(ipsec_script):g" \
 	-e "s:@IPSEC_SCRIPT_UPPER@:$(ipsec_script_upper):g" \
+	-e "s:@IPSEC_DIR@:$(ipsecdir):" \
 	$(srcdir)/$@.in > $@
 
 _ipsec : _ipsec.in
@@ -625,6 +653,7 @@ _ipsec : _ipsec.in
 	-e "s:@IPSEC_DISTRO@::" \
 	-e "s:@IPSEC_DIR@:$(ipsecdir):" \
 	-e "s:@IPSEC_SCRIPT@:$(ipsec_script):" \
+	-e "s:@IPSEC_BINDIR@:$(bindir):" \
 	-e "s:@IPSEC_SBINDIR@:$(sbindir):" \
 	-e "s:@IPSEC_CONFDIR@:$(sysconfdir):" \
 	-e "s:@IPSEC_PIDDIR@:$(piddir):" \
diff --git a/src/ipsec/_ipsec.8 b/src/ipsec/_ipsec.8
index 02aeaace3..9548f9b15 100644
--- a/src/ipsec/_ipsec.8
+++ b/src/ipsec/_ipsec.8
@@ -1,11 +1,19 @@
-.TH IPSEC 8 "2013-07-22" "5.1.0" "strongSwan"
+.TH IPSEC 8 "2013-10-29" "5.1.1" "strongSwan"
+.
 .SH NAME
+.
 ipsec \- invoke IPsec utilities
+.
 .SH SYNOPSIS
-.B ipsec
-\fIcommand\fP [ \fIarguments\fP ] [ \fIoptions\fP ]
-.PP
+.
+.SY ipsec
+.I command
+.RI [ arguments ]
+.RI [ options ]
+.YS
+.
 .SH DESCRIPTION
+.
 The
 .B ipsec
 utility invokes any of several utilities involved in controlling and monitoring
@@ -13,44 +21,40 @@ the IPsec encryption/authentication system, running the specified \fIcommand\fP
 with the specified \fIarguments\fP and \fIoptions\fP as if it had been invoked
 directly. This largely eliminates possible name collisions with other software,
 and also permits some centralized services.
-.PP
+.P
 All the commands described in this manual page are built-in and are used to
-control and monitor IPsec connections as well as the IKE daemons.
-.PP
+control and monitor IPsec connections as well as the IKE daemon.
+.P
 For other commands
 .I ipsec
 supplies the invoked
 .I command
 with a suitable PATH environment variable,
-and also provides IPSEC_DIR,
-IPSEC_CONFS, and IPSEC_VERSION environment variables,
-containing respectively
-the full pathname of the directory where the IPsec utilities are stored,
-the full pathname of the directory where the configuration files live,
-and the IPsec version number.
-.PP
+and also provides the environment variables listed under
+.IR ENVIRONMENT .
+.
 .SS CONTROL COMMANDS
+.
 .TP
-.B "start [ starter options ]"
+.BI "start [" "starter options" ]
 calls
-.BR "starter"
-which in turn parses \fIipsec.conf\fR and starts the IKEv1/IKEv2 daemon
-\fIcharon\fR.
-.PP
+.B "starter"
+which in turn parses \fIipsec.conf\fR and starts the IKE daemon \fIcharon\fR.
+.
 .TP
 .B "update"
 sends a \fIHUP\fR signal to
 .BR "starter"
 which in turn determines any changes in \fIipsec.conf\fR
 and updates the configuration on the running IKE daemon \fIcharon\fR.
-.PP
+.
 .TP
 .B "reload"
 sends a \fIUSR1\fR signal to
 .BR "starter"
-which in turn reloads the whole configuration on the running IKE daemon
+which in turn reloads the whole configuration of the running IKE daemon
 \fIcharon\fR based on the actual \fIipsec.conf\fR.
-.PP
+.
 .TP
 .B "restart"
 is equivalent to
@@ -58,224 +62,249 @@ is equivalent to
 followed by
 .B "start"
 after a guard of 2 seconds.
-.PP
+.
 .TP
 .B "stop"
 terminates all IPsec connections and stops the IKE daemon \fIcharon\fR
 by sending a \fITERM\fR signal to
 .BR "starter".
-.PP
+.
 .TP
-.B "up \fIname\fP"
+.BI "up " name
 tells the IKE daemon to start up connection \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname\fP"
+.BI "down " name
 tells the IKE daemon to terminate connection \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname{n}\fP"
+.BI "down " name{n}
 terminates IKEv1 Quick Mode and IKEv2 CHILD SA instance \fIn\fP of
 connection \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname{*}\fP"
+.BI "down " name{*}
 terminates all IKEv1 Quick Mode and  IKEv2 CHILD SA instances of connection
 \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname[n]\fP"
+.BI "down " name[n]
 terminates IKE SA instance \fIn\fP of connection \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname[*]\fP"
+.BI "down " name[*]
 terminates all IKE SA instances of connection \fIname\fP.
-.PP
+.
 .TP
-.B "route \fIname\fP"
+.BI "route " name
 tells the IKE daemon to insert an IPsec policy in the kernel
 for connection \fIname\fP. The first payload packet matching the IPsec policy
 will automatically trigger an IKE connection setup.
-.PP
+.
 .TP
-.B "unroute \fIname\fP"
+.BI "unroute " name
 remove the IPsec policy in the kernel for connection \fIname\fP.
-.PP
+.
 .TP
-.B "status [ \fIname\fP ]"
+.BI "status [" name ]
 returns concise status information either on connection
 \fIname\fP or if the argument is lacking, on all connections.
-.PP
+.
 .TP
-.B "statusall [ \fIname\fP ]"
+.BI "statusall [" name ]
 returns detailed status information either on connection
 \fIname\fP or if the argument is lacking, on all connections.
-.PP
+.
 .SS LIST COMMANDS
+.
 .TP
 .B "listalgs"
 returns a list supported cryptographic algorithms usable for IKE, and their
 corresponding plugin.
-.PP
+.
 .TP
-.B "listpubkeys [ --utc ]"
+.BI "listpubkeys [" --utc ]
 returns a list of RSA public keys that were either loaded in raw key format
 or extracted from X.509 and|or OpenPGP certificates.
-.PP
+.
 .TP
-.B "listcerts [ --utc ]"
+.BI "listcerts [" --utc ]
 returns a list of X.509 and|or OpenPGP certificates that were either loaded
 locally by the IKE daemon or received via the IKE protocol.
-.PP
+.
 .TP
-.B "listcacerts [ --utc ]"
+.BI "listcacerts [" --utc ]
 returns a list of X.509 Certification Authority (CA) certificates that were
 loaded locally by the IKE daemon from the \fI/etc/ipsec.d/cacerts/\fP
 directory or received via the IKE protocol.
-.PP
+.
 .TP
-.B "listaacerts [ --utc ]"
+.BI "listaacerts [" --utc ]
 returns a list of X.509 Authorization Authority (AA) certificates that were
 loaded locally by the IKE daemon from the \fI/etc/ipsec.d/aacerts/\fP
 directory.
-.PP
+.
 .TP
-.B "listocspcerts [ --utc ]"
+.BI "listocspcerts [" --utc ]
 returns a list of X.509 OCSP Signer certificates that were either loaded
 locally by the IKE daemon from the \fI/etc/ipsec.d/ocspcerts/\fP
 directory or were sent by an OCSP server.
-.PP
+.
 .TP
-.B "listacerts [ --utc ]"
+.BI "listacerts [" --utc ]
 returns a list of X.509 Attribute certificates that were loaded locally by
 the IKE daemon from the \fI/etc/ipsec.d/acerts/\fP directory.
-.PP
+.
 .TP
-.B "listgroups [ --utc ]"
+.BI "listgroups [" --utc ]
 returns a list of groups that are used to define user authorization profiles.
-.PP
+.
 .TP
-.B "listcainfos [ --utc ]"
+.BI "listcainfos [" --utc ]
 returns certification authority information (CRL distribution points, OCSP URIs,
 LDAP servers) that were defined by
 .BR ca
 sections in \fIipsec.conf\fP.
-.PP
+.
 .TP
-.B "listcrls [ --utc ]"
+.BI "listcrls [" --utc ]
 returns a list of Certificate Revocation Lists (CRLs) that were either loaded
 by the IKE daemon from the \fI/etc/ipsec.d/crls\fP directory or fetched from
 an HTTP- or LDAP-based CRL distribution point.
-.PP
+.
 .TP
-.B "listocsp [ --utc ]"
+.BI "listocsp [" --utc ]
 returns revocation information fetched from OCSP servers.
-.PP
+.
 .TP
-.B "listcounters"
-show IKE counter values collected since daemon startup.
-.PP
+.BI "listplugins"
+returns a list of all loaded plugin features.
+.
 .TP
-.B "listall [ --utc ]"
+.BI "listcounters [" name ]
+returns a list of global or connection specific IKE counter values
+collected since daemon startup.
+.
+.TP
+.BI "listall [" --utc ]
 returns all information generated by the list commands above. Each list command
 can be called with the
 \fB\-\-utc\fP
 option which displays all dates in UTC instead of local time.
-.PP
+.
 .SS REREAD COMMANDS
+.
 .TP
 .B "rereadsecrets"
 flushes and rereads all secrets defined in \fIipsec.secrets\fP.
-.PP
+.
 .TP
 .B "rereadcacerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/cacerts\fP
 directory and adds them to the list of Certification Authority (CA)
 certificates.
-.PP
+.
 .TP
 .B "rereadaacerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/aacerts\fP
 directory and adds them to the list of Authorization Authority (AA)
 certificates.
-.PP
+.
 .TP
 .B "rereadocspcerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/ocspcerts/\fP
 directory and adds them to the list of OCSP signer certificates.
-.PP
+.
 .TP
 .B "rereadacerts"
 reads all certificate files contained in the  \fI/etc/ipsec.d/acerts/\fP
 directory and adds them to the list of attribute certificates.
-.PP
+.
 .TP
 .B "rereadcrls"
 reads  all Certificate  Revocation Lists (CRLs) contained in the
 \fI/etc/ipsec.d/crls/\fP directory and adds them to the list of CRLs.
-.PP
+.
 .TP
 .B "rereadall"
 executes all reread commands listed above.
-.PP
+.
+.SS RESET COMMANDS
+.
+.TP
+.BI "resetcounters [" name ]
+resets global or connection specific counters.
+.
 .SS PURGE COMMANDS
+.
+.TP
+.B "purgecerts"
+purges all cached certificates.
+.
+.TP
+.B "purgecrl"
+purges all cached CRLs.
+.
 .TP
 .B "purgeike"
 purges IKE SAs that don't have a Quick Mode or CHILD SA.
-.PP
+.
 .TP
 .B "purgeocsp"
 purges all cached OCSP information records.
-.PP
+.
 .SS INFO COMMANDS
+.
 .TP
 .B "\-\-help"
 returns the usage information for the
 .B ipsec
 command.
-.PP
+.
 .TP
 .B "\-\-version"
 returns the version in the form of
 .B Linux strongSwan U<strongSwan userland version>/K<Linux kernel version>
 if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
 running on.
-.PP
+.
 .TP
 .B "\-\-versioncode"
 returns the version number in the form of
 .B U<strongSwan userland version>/K<Linux kernel version>
 if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
 running on.
-.PP
+.
 .TP
 .B "\-\-copyright"
 returns the copyright information.
-.PP
+.
 .TP
 .B "\-\-directory"
 returns the \fILIBEXECDIR\fP directory as defined by the configure options.
-.PP
+.
 .TP
 .B "\-\-confdir"
 returns the \fISYSCONFDIR\fP directory as defined by the configure options.
-.PP
+.
 .TP
 .B "\-\-piddir"
 returns the \fIPIDDIR\fP directory as defined by the configure options.
+.
 .SH FILES
-/usr/local/lib/ipsec	usual utilities directory
+.
+/usr/libexec/ipsec		utilities directory
+.
 .SH ENVIRONMENT
-.PP
-The following environment variables control where strongSwan finds its
-components.
-The
+.
+When calling other commands the
 .B ipsec
-command sets them if they are not already set.
+command supplies the following environment variables.
 .nf
 .na
 
 IPSEC_DIR               directory containing ipsec programs and utilities
+IPSEC_BINDIR            directory containing \fBpki\fP command
 IPSEC_SBINDIR           directory containing \fBipsec\fP command
 IPSEC_CONFDIR           directory containing configuration files
 IPSEC_PIDDIR            directory containing PID/socket files
@@ -286,13 +315,12 @@ IPSEC_STARTER_PID       PID file for ipsec starter
 IPSEC_CHARON_PID        PID file for IKE keying daemon
 .ad
 .fi
+.
 .SH SEE ALSO
-.hy 0
-.na
-ipsec.conf(5), ipsec.secrets(5)
-.ad
-.hy
-.PP
+.
+.BR ipsec.conf (5),
+.BR ipsec.secrets (5)
+.
 .SH HISTORY
 Originally written for the FreeS/WAN project by Henry Spencer.
 Updated and extended for the strongSwan project <http://www.strongswan.org> by
diff --git a/src/ipsec/_ipsec.8.in b/src/ipsec/_ipsec.8.in
index 4cbc89686..250cf807a 100644
--- a/src/ipsec/_ipsec.8.in
+++ b/src/ipsec/_ipsec.8.in
@@ -1,11 +1,19 @@
-.TH @IPSEC_SCRIPT_UPPER@ 8 "2013-07-22" "@IPSEC_VERSION@" "strongSwan"
+.TH @IPSEC_SCRIPT_UPPER@ 8 "2013-10-29" "@IPSEC_VERSION@" "strongSwan"
+.
 .SH NAME
+.
 @IPSEC_SCRIPT@ \- invoke IPsec utilities
+.
 .SH SYNOPSIS
-.B @IPSEC_SCRIPT@
-\fIcommand\fP [ \fIarguments\fP ] [ \fIoptions\fP ]
-.PP
+.
+.SY @IPSEC_SCRIPT@
+.I command
+.RI [ arguments ]
+.RI [ options ]
+.YS
+.
 .SH DESCRIPTION
+.
 The
 .B @IPSEC_SCRIPT@
 utility invokes any of several utilities involved in controlling and monitoring
@@ -13,44 +21,40 @@ the IPsec encryption/authentication system, running the specified \fIcommand\fP
 with the specified \fIarguments\fP and \fIoptions\fP as if it had been invoked
 directly. This largely eliminates possible name collisions with other software,
 and also permits some centralized services.
-.PP
+.P
 All the commands described in this manual page are built-in and are used to
-control and monitor IPsec connections as well as the IKE daemons.
-.PP
+control and monitor IPsec connections as well as the IKE daemon.
+.P
 For other commands
 .I @IPSEC_SCRIPT@
 supplies the invoked
 .I command
 with a suitable PATH environment variable,
-and also provides IPSEC_DIR,
-IPSEC_CONFS, and IPSEC_VERSION environment variables,
-containing respectively
-the full pathname of the directory where the IPsec utilities are stored,
-the full pathname of the directory where the configuration files live,
-and the IPsec version number.
-.PP
+and also provides the environment variables listed under
+.IR ENVIRONMENT .
+.
 .SS CONTROL COMMANDS
+.
 .TP
-.B "start [ starter options ]"
+.BI "start [" "starter options" ]
 calls
-.BR "starter"
-which in turn parses \fIipsec.conf\fR and starts the IKEv1/IKEv2 daemon
-\fIcharon\fR.
-.PP
+.B "starter"
+which in turn parses \fIipsec.conf\fR and starts the IKE daemon \fIcharon\fR.
+.
 .TP
 .B "update"
 sends a \fIHUP\fR signal to
 .BR "starter"
 which in turn determines any changes in \fIipsec.conf\fR
 and updates the configuration on the running IKE daemon \fIcharon\fR.
-.PP
+.
 .TP
 .B "reload"
 sends a \fIUSR1\fR signal to
 .BR "starter"
-which in turn reloads the whole configuration on the running IKE daemon
+which in turn reloads the whole configuration of the running IKE daemon
 \fIcharon\fR based on the actual \fIipsec.conf\fR.
-.PP
+.
 .TP
 .B "restart"
 is equivalent to
@@ -58,224 +62,249 @@ is equivalent to
 followed by
 .B "start"
 after a guard of 2 seconds.
-.PP
+.
 .TP
 .B "stop"
 terminates all IPsec connections and stops the IKE daemon \fIcharon\fR
 by sending a \fITERM\fR signal to
 .BR "starter".
-.PP
+.
 .TP
-.B "up \fIname\fP"
+.BI "up " name
 tells the IKE daemon to start up connection \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname\fP"
+.BI "down " name
 tells the IKE daemon to terminate connection \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname{n}\fP"
+.BI "down " name{n}
 terminates IKEv1 Quick Mode and IKEv2 CHILD SA instance \fIn\fP of
 connection \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname{*}\fP"
+.BI "down " name{*}
 terminates all IKEv1 Quick Mode and  IKEv2 CHILD SA instances of connection
 \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname[n]\fP"
+.BI "down " name[n]
 terminates IKE SA instance \fIn\fP of connection \fIname\fP.
-.PP
+.
 .TP
-.B "down \fIname[*]\fP"
+.BI "down " name[*]
 terminates all IKE SA instances of connection \fIname\fP.
-.PP
+.
 .TP
-.B "route \fIname\fP"
+.BI "route " name
 tells the IKE daemon to insert an IPsec policy in the kernel
 for connection \fIname\fP. The first payload packet matching the IPsec policy
 will automatically trigger an IKE connection setup.
-.PP
+.
 .TP
-.B "unroute \fIname\fP"
+.BI "unroute " name
 remove the IPsec policy in the kernel for connection \fIname\fP.
-.PP
+.
 .TP
-.B "status [ \fIname\fP ]"
+.BI "status [" name ]
 returns concise status information either on connection
 \fIname\fP or if the argument is lacking, on all connections.
-.PP
+.
 .TP
-.B "statusall [ \fIname\fP ]"
+.BI "statusall [" name ]
 returns detailed status information either on connection
 \fIname\fP or if the argument is lacking, on all connections.
-.PP
+.
 .SS LIST COMMANDS
+.
 .TP
 .B "listalgs"
 returns a list supported cryptographic algorithms usable for IKE, and their
 corresponding plugin.
-.PP
+.
 .TP
-.B "listpubkeys [ --utc ]"
+.BI "listpubkeys [" --utc ]
 returns a list of RSA public keys that were either loaded in raw key format
 or extracted from X.509 and|or OpenPGP certificates.
-.PP
+.
 .TP
-.B "listcerts [ --utc ]"
+.BI "listcerts [" --utc ]
 returns a list of X.509 and|or OpenPGP certificates that were either loaded
 locally by the IKE daemon or received via the IKE protocol.
-.PP
+.
 .TP
-.B "listcacerts [ --utc ]"
+.BI "listcacerts [" --utc ]
 returns a list of X.509 Certification Authority (CA) certificates that were
 loaded locally by the IKE daemon from the \fI/etc/ipsec.d/cacerts/\fP
 directory or received via the IKE protocol.
-.PP
+.
 .TP
-.B "listaacerts [ --utc ]"
+.BI "listaacerts [" --utc ]
 returns a list of X.509 Authorization Authority (AA) certificates that were
 loaded locally by the IKE daemon from the \fI/etc/ipsec.d/aacerts/\fP
 directory.
-.PP
+.
 .TP
-.B "listocspcerts [ --utc ]"
+.BI "listocspcerts [" --utc ]
 returns a list of X.509 OCSP Signer certificates that were either loaded
 locally by the IKE daemon from the \fI/etc/ipsec.d/ocspcerts/\fP
 directory or were sent by an OCSP server.
-.PP
+.
 .TP
-.B "listacerts [ --utc ]"
+.BI "listacerts [" --utc ]
 returns a list of X.509 Attribute certificates that were loaded locally by
 the IKE daemon from the \fI/etc/ipsec.d/acerts/\fP directory.
-.PP
+.
 .TP
-.B "listgroups [ --utc ]"
+.BI "listgroups [" --utc ]
 returns a list of groups that are used to define user authorization profiles.
-.PP
+.
 .TP
-.B "listcainfos [ --utc ]"
+.BI "listcainfos [" --utc ]
 returns certification authority information (CRL distribution points, OCSP URIs,
 LDAP servers) that were defined by
 .BR ca
 sections in \fIipsec.conf\fP.
-.PP
+.
 .TP
-.B "listcrls [ --utc ]"
+.BI "listcrls [" --utc ]
 returns a list of Certificate Revocation Lists (CRLs) that were either loaded
 by the IKE daemon from the \fI/etc/ipsec.d/crls\fP directory or fetched from
 an HTTP- or LDAP-based CRL distribution point.
-.PP
+.
 .TP
-.B "listocsp [ --utc ]"
+.BI "listocsp [" --utc ]
 returns revocation information fetched from OCSP servers.
-.PP
+.
 .TP
-.B "listcounters"
-show IKE counter values collected since daemon startup.
-.PP
+.BI "listplugins"
+returns a list of all loaded plugin features.
+.
 .TP
-.B "listall [ --utc ]"
+.BI "listcounters [" name ]
+returns a list of global or connection specific IKE counter values
+collected since daemon startup.
+.
+.TP
+.BI "listall [" --utc ]
 returns all information generated by the list commands above. Each list command
 can be called with the
 \fB\-\-utc\fP
 option which displays all dates in UTC instead of local time.
-.PP
+.
 .SS REREAD COMMANDS
+.
 .TP
 .B "rereadsecrets"
 flushes and rereads all secrets defined in \fIipsec.secrets\fP.
-.PP
+.
 .TP
 .B "rereadcacerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/cacerts\fP
 directory and adds them to the list of Certification Authority (CA)
 certificates.
-.PP
+.
 .TP
 .B "rereadaacerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/aacerts\fP
 directory and adds them to the list of Authorization Authority (AA)
 certificates.
-.PP
+.
 .TP
 .B "rereadocspcerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/ocspcerts/\fP
 directory and adds them to the list of OCSP signer certificates.
-.PP
+.
 .TP
 .B "rereadacerts"
 reads all certificate files contained in the  \fI/etc/ipsec.d/acerts/\fP
 directory and adds them to the list of attribute certificates.
-.PP
+.
 .TP
 .B "rereadcrls"
 reads  all Certificate  Revocation Lists (CRLs) contained in the
 \fI/etc/ipsec.d/crls/\fP directory and adds them to the list of CRLs.
-.PP
+.
 .TP
 .B "rereadall"
 executes all reread commands listed above.
-.PP
+.
+.SS RESET COMMANDS
+.
+.TP
+.BI "resetcounters [" name ]
+resets global or connection specific counters.
+.
 .SS PURGE COMMANDS
+.
+.TP
+.B "purgecerts"
+purges all cached certificates.
+.
+.TP
+.B "purgecrl"
+purges all cached CRLs.
+.
 .TP
 .B "purgeike"
 purges IKE SAs that don't have a Quick Mode or CHILD SA.
-.PP
+.
 .TP
 .B "purgeocsp"
 purges all cached OCSP information records.
-.PP
+.
 .SS INFO COMMANDS
+.
 .TP
 .B "\-\-help"
 returns the usage information for the
 .B @IPSEC_SCRIPT@
 command.
-.PP
+.
 .TP
 .B "\-\-version"
 returns the version in the form of
 .B Linux strongSwan U<strongSwan userland version>/K<Linux kernel version>
 if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
 running on.
-.PP
+.
 .TP
 .B "\-\-versioncode"
 returns the version number in the form of
 .B U<strongSwan userland version>/K<Linux kernel version>
 if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
 running on.
-.PP
+.
 .TP
 .B "\-\-copyright"
 returns the copyright information.
-.PP
+.
 .TP
 .B "\-\-directory"
 returns the \fILIBEXECDIR\fP directory as defined by the configure options.
-.PP
+.
 .TP
 .B "\-\-confdir"
 returns the \fISYSCONFDIR\fP directory as defined by the configure options.
-.PP
+.
 .TP
 .B "\-\-piddir"
 returns the \fIPIDDIR\fP directory as defined by the configure options.
+.
 .SH FILES
-/usr/local/lib/ipsec	usual utilities directory
+.
+@IPSEC_DIR@		utilities directory
+.
 .SH ENVIRONMENT
-.PP
-The following environment variables control where strongSwan finds its
-components.
-The
+.
+When calling other commands the
 .B @IPSEC_SCRIPT@
-command sets them if they are not already set.
+command supplies the following environment variables.
 .nf
 .na
 
 IPSEC_DIR               directory containing ipsec programs and utilities
+IPSEC_BINDIR            directory containing \fBpki\fP command
 IPSEC_SBINDIR           directory containing \fBipsec\fP command
 IPSEC_CONFDIR           directory containing configuration files
 IPSEC_PIDDIR            directory containing PID/socket files
@@ -286,13 +315,12 @@ IPSEC_STARTER_PID       PID file for ipsec starter
 IPSEC_CHARON_PID        PID file for IKE keying daemon
 .ad
 .fi
+.
 .SH SEE ALSO
-.hy 0
-.na
-ipsec.conf(5), ipsec.secrets(5)
-.ad
-.hy
-.PP
+.
+.BR ipsec.conf (5),
+.BR ipsec.secrets (5)
+.
 .SH HISTORY
 Originally written for the FreeS/WAN project by Henry Spencer.
 Updated and extended for the strongSwan project <http://www.strongswan.org> by
diff --git a/src/ipsec/_ipsec.in b/src/ipsec/_ipsec.in
index 03ddb744d..3c1f99825 100644
--- a/src/ipsec/_ipsec.in
+++ b/src/ipsec/_ipsec.in
@@ -15,7 +15,7 @@
 # for more details.
 
 # define a minimum PATH environment in case it is not set
-PATH="/sbin:/bin:/usr/sbin:/usr/bin:@IPSEC_SBINDIR@"
+PATH="/sbin:/bin:/usr/sbin:/usr/bin:@IPSEC_SBINDIR@:@IPSEC_BINDIR@"
 export PATH
 
 # set daemon name
@@ -28,6 +28,7 @@ IPSEC_VERSION="U@IPSEC_VERSION@/K`uname -r`"
 
 # where the private directory and the config files are
 IPSEC_DIR="@IPSEC_DIR@"
+IPSEC_BINDIR="@IPSEC_BINDIR@"
 IPSEC_SBINDIR="@IPSEC_SBINDIR@"
 IPSEC_CONFDIR="@IPSEC_CONFDIR@"
 IPSEC_PIDDIR="@IPSEC_PIDDIR@"
@@ -39,7 +40,7 @@ IPSEC_CHARON_PID="${IPSEC_PIDDIR}/${DAEMON_NAME}.pid"
 IPSEC_STROKE="${IPSEC_DIR}/stroke"
 IPSEC_STARTER="${IPSEC_DIR}/starter"
 
-export IPSEC_DIR IPSEC_SBINDIR IPSEC_CONFDIR IPSEC_PIDDIR IPSEC_SCRIPT IPSEC_VERSION IPSEC_NAME IPSEC_STARTER_PID IPSEC_CHARON_PID
+export IPSEC_DIR IPSEC_BINDIR IPSEC_SBINDIR IPSEC_CONFDIR IPSEC_PIDDIR IPSEC_SCRIPT IPSEC_VERSION IPSEC_NAME IPSEC_STARTER_PID IPSEC_CHARON_PID
 
 IPSEC_DISTRO="Institute for Internet Technologies and Applications\nUniversity of Applied Sciences Rapperswil, Switzerland"
 
@@ -313,6 +314,10 @@ update)
 		exit 7
 	fi
 	;;
+pki)
+	shift
+	exec $IPSEC_BINDIR/pki "$@"
+	;;
 version|--version)
 	printf "$OS_NAME $IPSEC_NAME $IPSEC_VERSION\n"
 	printf "$IPSEC_DISTRO\n"