Imported Upstream version 5.0.1

5 files changed, 250 insertions, 308 deletions

diff --git a/src/ipsec/Makefile.am b/src/ipsec/Makefile.am
index bbf009721..8be28eff8 100644
--- a/src/ipsec/Makefile.am
+++ b/src/ipsec/Makefile.am
@@ -1,22 +1,35 @@
-sbin_SCRIPTS = ipsec
-CLEANFILES = ipsec ipsec.8
-dist_man8_MANS = ipsec.8
-EXTRA_DIST = ipsec.in ipsec.8.in Android.mk
+sbin_SCRIPTS = _ipsec
+CLEANFILES = _ipsec _ipsec.8
+dist_man8_MANS = _ipsec.8
+EXTRA_DIST = _ipsec.in _ipsec.8.in Android.mk
 
-ipsec.8 : ipsec.8.in
+_ipsec.8 : _ipsec.8.in
 	sed \
 	-e "s:@IPSEC_VERSION@:$(PACKAGE_VERSION):" \
+	-e "s:@IPSEC_SCRIPT@:$(ipsec_script):g" \
+	-e "s:@IPSEC_SCRIPT_UPPER@:$(ipsec_script_upper):g" \
 	$(srcdir)/$@.in > $@
 
-ipsec : ipsec.in
+_ipsec : _ipsec.in
 	sed \
 	-e "s:@IPSEC_SHELL@:/bin/sh:" \
 	-e "s:@IPSEC_VERSION@:$(PACKAGE_VERSION):" \
 	-e "s:@IPSEC_NAME@:$(PACKAGE_NAME):" \
 	-e "s:@IPSEC_DISTRO@::" \
 	-e "s:@IPSEC_DIR@:$(ipsecdir):" \
+	-e "s:@IPSEC_SCRIPT@:$(ipsec_script):" \
 	-e "s:@IPSEC_SBINDIR@:$(sbindir):" \
 	-e "s:@IPSEC_CONFDIR@:$(sysconfdir):" \
 	-e "s:@IPSEC_PIDDIR@:$(piddir):" \
 	$(srcdir)/$@.in > $@
 	chmod +x $@
+
+install-exec-hook:
+	mv $(DESTDIR)$(sbindir)/_ipsec $(DESTDIR)$(sbindir)/$(ipsec_script)
+
+install-data-hook:
+	mv $(DESTDIR)$(man8dir)/_ipsec.8 $(DESTDIR)$(man8dir)/$(ipsec_script).8
+
+uninstall-hook:
+	rm -f $(DESTDIR)$(sbindir)/$(ipsec_script)
+	rm -f $(DESTDIR)$(man8dir)/$(ipsec_script).8
diff --git a/src/ipsec/Makefile.in b/src/ipsec/Makefile.in
index b0474159d..dbb163f42 100644
--- a/src/ipsec/Makefile.in
+++ b/src/ipsec/Makefile.in
@@ -50,6 +50,7 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
 mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
 CONFIG_CLEAN_VPATH_FILES =
 am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
@@ -89,6 +90,7 @@ AUTOCONF = @AUTOCONF@
 AUTOHEADER = @AUTOHEADER@
 AUTOMAKE = @AUTOMAKE@
 AWK = @AWK@
+BFDLIB = @BFDLIB@
 BTLIB = @BTLIB@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
@@ -183,11 +185,14 @@ build_os = @build_os@
 build_vendor = @build_vendor@
 builddir = @builddir@
 c_plugins = @c_plugins@
+charon_natt_port = @charon_natt_port@
+charon_plugins = @charon_plugins@
+charon_udp_port = @charon_udp_port@
 clearsilver_LIBS = @clearsilver_LIBS@
 datadir = @datadir@
 datarootdir = @datarootdir@
 dbusservicedir = @dbusservicedir@
-default_pkcs11 = @default_pkcs11@
+dev_headers = @dev_headers@
 docdir = @docdir@
 dvidir = @dvidir@
 exec_prefix = @exec_prefix@
@@ -204,11 +209,12 @@ imcvdir = @imcvdir@
 includedir = @includedir@
 infodir = @infodir@
 install_sh = @install_sh@
+ipsec_script = @ipsec_script@
+ipsec_script_upper = @ipsec_script_upper@
 ipsecdir = @ipsecdir@
 ipsecgroup = @ipsecgroup@
 ipseclibdir = @ipseclibdir@
 ipsecuser = @ipsecuser@
-libcharon_plugins = @libcharon_plugins@
 libdir = @libdir@
 libexecdir = @libexecdir@
 linux_headers = @linux_headers@
@@ -224,6 +230,7 @@ mkdir_p = @mkdir_p@
 nm_CFLAGS = @nm_CFLAGS@
 nm_LIBS = @nm_LIBS@
 nm_ca_dir = @nm_ca_dir@
+nm_plugins = @nm_plugins@
 oldincludedir = @oldincludedir@
 openac_plugins = @openac_plugins@
 p_plugins = @p_plugins@
@@ -233,7 +240,6 @@ pdfdir = @pdfdir@
 piddir = @piddir@
 pki_plugins = @pki_plugins@
 plugindir = @plugindir@
-pluto_plugins = @pluto_plugins@
 pool_plugins = @pool_plugins@
 prefix = @prefix@
 program_transform_name = @program_transform_name@
@@ -261,10 +267,10 @@ top_srcdir = @top_srcdir@
 urandom_device = @urandom_device@
 xml_CFLAGS = @xml_CFLAGS@
 xml_LIBS = @xml_LIBS@
-sbin_SCRIPTS = ipsec
-CLEANFILES = ipsec ipsec.8
-dist_man8_MANS = ipsec.8
-EXTRA_DIST = ipsec.in ipsec.8.in Android.mk
+sbin_SCRIPTS = _ipsec
+CLEANFILES = _ipsec _ipsec.8
+dist_man8_MANS = _ipsec.8
+EXTRA_DIST = _ipsec.in _ipsec.8.in Android.mk
 all: all-am
 
 .SUFFIXES:
@@ -476,13 +482,15 @@ info: info-am
 info-am:
 
 install-data-am: install-man
-
+	@$(NORMAL_INSTALL)
+	$(MAKE) $(AM_MAKEFLAGS) install-data-hook
 install-dvi: install-dvi-am
 
 install-dvi-am:
 
 install-exec-am: install-sbinSCRIPTS
-
+	@$(NORMAL_INSTALL)
+	$(MAKE) $(AM_MAKEFLAGS) install-exec-hook
 install-html: install-html-am
 
 install-html-am:
@@ -520,43 +528,59 @@ ps: ps-am
 ps-am:
 
 uninstall-am: uninstall-man uninstall-sbinSCRIPTS
-
+	@$(NORMAL_INSTALL)
+	$(MAKE) $(AM_MAKEFLAGS) uninstall-hook
 uninstall-man: uninstall-man8
 
-.MAKE: install-am install-strip
+.MAKE: install-am install-data-am install-exec-am install-strip \
+	uninstall-am
 
 .PHONY: all all-am check check-am clean clean-generic clean-libtool \
 	distclean distclean-generic distclean-libtool distdir dvi \
 	dvi-am html html-am info info-am install install-am \
-	install-data install-data-am install-dvi install-dvi-am \
-	install-exec install-exec-am install-html install-html-am \
-	install-info install-info-am install-man install-man8 \
-	install-pdf install-pdf-am install-ps install-ps-am \
-	install-sbinSCRIPTS install-strip installcheck installcheck-am \
-	installdirs maintainer-clean maintainer-clean-generic \
-	mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \
-	ps ps-am uninstall uninstall-am uninstall-man uninstall-man8 \
+	install-data install-data-am install-data-hook install-dvi \
+	install-dvi-am install-exec install-exec-am install-exec-hook \
+	install-html install-html-am install-info install-info-am \
+	install-man install-man8 install-pdf install-pdf-am install-ps \
+	install-ps-am install-sbinSCRIPTS install-strip installcheck \
+	installcheck-am installdirs maintainer-clean \
+	maintainer-clean-generic mostlyclean mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am uninstall uninstall-am \
+	uninstall-hook uninstall-man uninstall-man8 \
 	uninstall-sbinSCRIPTS
 
 
-ipsec.8 : ipsec.8.in
+_ipsec.8 : _ipsec.8.in
 	sed \
 	-e "s:@IPSEC_VERSION@:$(PACKAGE_VERSION):" \
+	-e "s:@IPSEC_SCRIPT@:$(ipsec_script):g" \
+	-e "s:@IPSEC_SCRIPT_UPPER@:$(ipsec_script_upper):g" \
 	$(srcdir)/$@.in > $@
 
-ipsec : ipsec.in
+_ipsec : _ipsec.in
 	sed \
 	-e "s:@IPSEC_SHELL@:/bin/sh:" \
 	-e "s:@IPSEC_VERSION@:$(PACKAGE_VERSION):" \
 	-e "s:@IPSEC_NAME@:$(PACKAGE_NAME):" \
 	-e "s:@IPSEC_DISTRO@::" \
 	-e "s:@IPSEC_DIR@:$(ipsecdir):" \
+	-e "s:@IPSEC_SCRIPT@:$(ipsec_script):" \
 	-e "s:@IPSEC_SBINDIR@:$(sbindir):" \
 	-e "s:@IPSEC_CONFDIR@:$(sysconfdir):" \
 	-e "s:@IPSEC_PIDDIR@:$(piddir):" \
 	$(srcdir)/$@.in > $@
 	chmod +x $@
 
+install-exec-hook:
+	mv $(DESTDIR)$(sbindir)/_ipsec $(DESTDIR)$(sbindir)/$(ipsec_script)
+
+install-data-hook:
+	mv $(DESTDIR)$(man8dir)/_ipsec.8 $(DESTDIR)$(man8dir)/$(ipsec_script).8
+
+uninstall-hook:
+	rm -f $(DESTDIR)$(sbindir)/$(ipsec_script)
+	rm -f $(DESTDIR)$(man8dir)/$(ipsec_script).8
+
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:
diff --git a/src/ipsec/ipsec.8 b/src/ipsec/_ipsec.8
index 66e43b481..7802fc48f 100644
--- a/src/ipsec/ipsec.8
+++ b/src/ipsec/_ipsec.8
@@ -1,4 +1,4 @@
-.TH IPSEC 8 "2010-05-30" "4.5.3dr3" "strongSwan"
+.TH IPSEC 8 "2012-06-19" "5.0.1dr3" "strongSwan"
 .SH NAME
 ipsec \- invoke IPsec utilities
 .SH SYNOPSIS
@@ -31,240 +31,229 @@ and the IPsec version number.
 .PP
 .SS CONTROL COMMANDS
 .TP
-.B "ipsec start [ starter options ]"
+.B "start [ starter options ]"
 calls
-.BR "ipsec starter"
-which in turn parses \fIipsec.conf\fR and starts the IKEv1 \fIpluto\fR and
-IKEv2 \fIcharon\fR daemons.
+.BR "starter"
+which in turn parses \fIipsec.conf\fR and starts the IKEv1/IKEv2 daemon
+\fIcharon\fR.
 .PP
 .TP
-.B "ipsec update"
+.B "update"
 sends a \fIHUP\fR signal to
-.BR "ipsec starter"
+.BR "starter"
 which in turn determines any changes in \fIipsec.conf\fR
-and updates the configuration on the running IKEv1 \fIpluto\fR and IKEv2
-\fIcharon\fR daemons, correspondingly.
+and updates the configuration on the running IKE daemon \fIcharon\fR.
 .PP
 .TP
-.B "ipsec reload"
+.B "reload"
 sends a \fIUSR1\fR signal to
-.BR "ipsec starter"
-which in turn reloads the whole configuration on the running IKEv1 \fIpluto\fR
-and IKEv2 \fIcharon\fR daemons based on the actual \fIipsec.conf\fR.
+.BR "starter"
+which in turn reloads the whole configuration on the running IKE daemon
+\fIcharon\fR based on the actual \fIipsec.conf\fR.
 .PP
 .TP
-.B "ipsec restart"
+.B "restart"
 is equivalent to
-.B "ipsec stop"
+.B "stop"
 followed by
-.B "ipsec start"
+.B "start"
 after a guard of 2 seconds.
 .PP
 .TP
-.B "ipsec stop"
-terminates all IPsec connections and stops the IKEv1 \fIpluto\fR and IKEv2
-\fIcharon\fR daemons by sending a \fITERM\fR signal to
-.BR "ipsec starter".
+.B "stop"
+terminates all IPsec connections and stops the IKE daemon \fIcharon\fR
+by sending a \fITERM\fR signal to
+.BR "starter".
 .PP
 .TP
-.B "ipsec up \fIname\fP"
-tells the responsible IKE daemon to start up connection \fIname\fP.
+.B "up \fIname\fP"
+tells the IKE daemon to start up connection \fIname\fP.
 .PP
 .TP
-.B "ipsec down \fIname\fP"
-tells the responsible IKE daemon to terminate connection \fIname\fP.
+.B "down \fIname\fP"
+tells the IKE daemon to terminate connection \fIname\fP.
 .PP
 .TP
-.B "ipsec down \fIname{n}\fP"
-terminates IKEv2 CHILD SA instance \fIn\fP of connection \fIname\fP.
+.B "down \fIname{n}\fP"
+terminates IKEv1 Quick Mode and IKEv2 CHILD SA instance \fIn\fP of
+connection \fIname\fP.
 .PP
 .TP
-.B "ipsec down \fIname{*}\fP"
-terminates all IKEv2 CHILD SA instances of connection \fIname\fP.
+.B "down \fIname{*}\fP"
+terminates all IKEv1 Quick Mode and  IKEv2 CHILD SA instances of connection
+\fIname\fP.
 .PP
 .TP
-.B "ipsec down \fIname[n]\fP"
-terminates all IKEv2 IKE SA instance \fIn\fP of connection \fIname\fP.
+.B "down \fIname[n]\fP"
+terminates IKE SA instance \fIn\fP of connection \fIname\fP.
 .PP
 .TP
-.B "ipsec down \fIname[*]\fP"
-terminates all IKEv2 IKE SA instances of connection \fIname\fP.
+.B "down \fIname[*]\fP"
+terminates all IKE SA instances of connection \fIname\fP.
 .PP
 .TP
-.B "ipsec route \fIname\fP"
-tells the responsible IKE daemon to insert an IPsec policy in the kernel
+.B "route \fIname\fP"
+tells the IKE daemon to insert an IPsec policy in the kernel
 for connection \fIname\fP. The first payload packet matching the IPsec policy
 will automatically trigger an IKE connection setup.
 .PP
 .TP
-.B "ipsec unroute \fIname\fP"
+.B "unroute \fIname\fP"
 remove the IPsec policy in the kernel for connection \fIname\fP.
 .PP
 .TP
-.B "ipsec status [ \fIname\fP ]"
+.B "status [ \fIname\fP ]"
 returns concise status information either on connection
 \fIname\fP or if the argument is lacking, on all connections.
 .PP
 .TP
-.B "ipsec statusall [ \fIname\fP ]"
+.B "statusall [ \fIname\fP ]"
 returns detailed status information either on connection
 \fIname\fP or if the argument is lacking, on all connections.
 .PP
 .SS LIST COMMANDS
 .TP
-.B "ipsec listalgs"
-returns a list all supported IKE encryption and hash algorithms, the available
-Diffie-Hellman groups, as well as all supported ESP encryption and
-authentication algorithms registered via the Linux kernel's Crypto API.
-.br
-Supported by the IKEv1 \fIpluto\fP daemon only.
+.B "listalgs"
+returns a list supported cryptographic algorithms usable for IKE, and their
+corresponding plugin.
 .PP
 .TP
-.B "ipsec listpubkeys [ --utc ]"
+.B "listpubkeys [ --utc ]"
 returns a list of RSA public keys that were either loaded in raw key format
 or extracted from X.509 and|or OpenPGP certificates.
-.br
-Supported by the IKEv1 \fIpluto\fP daemon only.
 .PP
 .TP
-.B "ipsec listcerts [ --utc ]"
+.B "listcerts [ --utc ]"
 returns a list of X.509 and|or OpenPGP certificates that were either loaded
-locally by the IKE daemon or received via the IKEv2 protocol.
+locally by the IKE daemon or received via the IKE protocol.
 .PP
 .TP
-.B "ipsec listcacerts [ --utc ]"
+.B "listcacerts [ --utc ]"
 returns a list of X.509 Certification Authority (CA) certificates that were
 loaded locally by the IKE daemon from the \fI/etc/ipsec.d/cacerts/\fP
-directory or received in PKCS#7-wrapped certificate payloads via the IKE
-protocol.
+directory or received via the IKE protocol.
 .PP
 .TP
-.B "ipsec listaacerts [ --utc ]"
+.B "listaacerts [ --utc ]"
 returns a list of X.509 Authorization Authority (AA) certificates that were
 loaded locally by the IKE daemon from the \fI/etc/ipsec.d/aacerts/\fP
 directory.
 .PP
 .TP
-.B "ipsec listocspcerts [ --utc ]"
+.B "listocspcerts [ --utc ]"
 returns a list of X.509 OCSP Signer certificates that were either loaded
 locally by the IKE daemon from the \fI/etc/ipsec.d/ocspcerts/\fP
 directory or were sent by an OCSP server.
 .PP
 .TP
-.B "ipsec listacerts [ --utc ]"
+.B "listacerts [ --utc ]"
 returns a list of X.509 Attribute certificates that were loaded locally by
 the IKE daemon from the \fI/etc/ipsec.d/acerts/\fP directory.
 .PP
 .TP
-.B "ipsec listgroups [ --utc ]"
+.B "listgroups [ --utc ]"
 returns a list of groups that are used to define user authorization profiles.
-.br
-Supported by the IKEv1 \fIpluto\fP daemon only.
 .PP
 .TP
-.B "ipsec listcainfos [ --utc ]"
+.B "listcainfos [ --utc ]"
 returns certification authority information (CRL distribution points, OCSP URIs,
 LDAP servers) that were defined by
 .BR ca
 sections in \fIipsec.conf\fP.
 .PP
 .TP
-.B "ipsec listcrls [ --utc ]"
+.B "listcrls [ --utc ]"
 returns a list of Certificate Revocation Lists (CRLs) that were either loaded
 by the IKE daemon from the \fI/etc/ipsec.d/crls\fP directory or fetched from
 an HTTP- or LDAP-based CRL distribution point.
 .PP
 .TP
-.B "ipsec listocsp [ --utc ]"
+.B "listocsp [ --utc ]"
 returns revocation information fetched from OCSP servers.
 .PP
 .TP
-.B "ipsec listcards [ --utc ]"
-list all certificates found on attached smart cards.
-.br
-Supported by the IKEv1 \fIpluto\fP daemon only.
-.PP
-.TP
-.B "ipsec listall [ --utc ]"
-returns all information generated by the list commands above. Each list command 
+.B "listall [ --utc ]"
+returns all information generated by the list commands above. Each list command
 can be called with the
 \fB\-\-utc\fP
 option which displays all dates in UTC instead of local time.
 .PP
 .SS REREAD COMMANDS
 .TP
-.B "ipsec rereadsecrets"
+.B "rereadsecrets"
 flushes and rereads all secrets defined in \fIipsec.secrets\fP.
 .PP
 .TP
-.B "ipsec rereadcacerts"
+.B "rereadcacerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/cacerts\fP
 directory and adds them to the list of Certification Authority (CA)
 certificates.
 .PP
 .TP
-.B "ipsec rereadaacerts"
+.B "rereadaacerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/aacerts\fP
 directory and adds them to the list of Authorization Authority (AA)
 certificates.
 .PP
 .TP
-.B "ipsec rereadocspcerts" 
+.B "rereadocspcerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/ocspcerts/\fP
 directory and adds them to the list of OCSP signer certificates.
 .PP
 .TP
-.B "ipsec rereadacerts"
+.B "rereadacerts"
 reads all certificate files contained in the  \fI/etc/ipsec.d/acerts/\fP
 directory and adds them to the list of attribute certificates.
 .PP
 .TP
-.B "ipsec rereadcrls"
+.B "rereadcrls"
 reads  all Certificate  Revocation Lists (CRLs) contained in the
 \fI/etc/ipsec.d/crls/\fP directory and adds them to the list of CRLs.
 .PP
 .TP
-.B "ipsec rereadall"
+.B "rereadall"
 executes all reread commands listed above.
 .PP
 .SS PURGE COMMANDS
 .TP
-.B "ipsec purgeike"
-purges IKEv2 SAs that don't have a CHILD SA.
+.B "purgeike"
+purges IKE SAs that don't have a Quick Mode or CHILD SA.
 .PP
 .TP
-.B "ipsec purgeocsp"
+.B "purgeocsp"
 purges all cached OCSP information records.
 .PP
 .SS INFO COMMANDS
 .TP
-.B "ipsec \-\-help"
-returns the usage information for the ipsec command.
+.B "\-\-help"
+returns the usage information for the
+.B ipsec
+command.
 .PP
 .TP
-.B "ipsec \-\-version"
+.B "\-\-version"
 returns the version in the form of
 .B Linux strongSwan U<strongSwan userland version>/K<Linux kernel version>
 if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
 running on.
 .PP
 .TP
-.B "ipsec \-\-versioncode"
+.B "\-\-versioncode"
 returns the version number in the form of
 .B U<strongSwan userland version>/K<Linux kernel version>
 if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
 running on.
 .PP
 .TP
-.B "ipsec \-\-copyright"
+.B "\-\-copyright"
 returns the copyright information.
 .PP
 .TP
-.B "ipsec \-\-directory"
+.B "\-\-directory"
 returns the \fILIBEXECDIR\fP directory as defined by the configure options.
 .PP
 .TP
-.B "ipsec \-\-confdir"
+.B "\-\-confdir"
 returns the \fISYSCONFDIR\fP directory as defined by the configure options.
 .SH FILES
 /usr/local/lib/ipsec	usual utilities directory
@@ -278,15 +267,15 @@ command sets them if they are not already set.
 .nf
 .na
 
-IPSEC_DIR 		directory containing ipsec programs and utilities
-IPSEC_SBINDIR		directory containing \fBipsec\fP command
-IPSEC_CONFDIR 		directory containing configuration files
-IPSEC_PIDDIR		directory containing PID files
-IPSEC_NAME 		name of ipsec distribution
-IPSEC_VERSION 		version numer of ipsec userland and kernel
-IPSEC_STARTER_PID 	PID file for ipsec starter
-IPSEC_PLUTO_PID 	PID file for IKEv1 keying daemon
-IPSEC_CHARON_PID	PID file for IKEv2 keying daemon
+IPSEC_DIR               directory containing ipsec programs and utilities
+IPSEC_SBINDIR           directory containing \fBipsec\fP command
+IPSEC_CONFDIR           directory containing configuration files
+IPSEC_PIDDIR            directory containing PID files
+IPSEC_SCRIPT            name of the ipsec script
+IPSEC_NAME              name of ipsec distribution
+IPSEC_VERSION           version numer of ipsec userland and kernel
+IPSEC_STARTER_PID       PID file for ipsec starter
+IPSEC_CHARON_PID        PID file for IKE keying daemon
 .ad
 .fi
 .SH SEE ALSO
diff --git a/src/ipsec/ipsec.8.in b/src/ipsec/_ipsec.8.in
index 24a796392..41c6ff8d2 100644
--- a/src/ipsec/ipsec.8.in
+++ b/src/ipsec/_ipsec.8.in
@@ -1,13 +1,13 @@
-.TH IPSEC 8 "2010-05-30" "@IPSEC_VERSION@" "strongSwan"
+.TH @IPSEC_SCRIPT_UPPER@ 8 "2012-06-19" "@IPSEC_VERSION@" "strongSwan"
 .SH NAME
-ipsec \- invoke IPsec utilities
+@IPSEC_SCRIPT@ \- invoke IPsec utilities
 .SH SYNOPSIS
-.B ipsec
+.B @IPSEC_SCRIPT@
 \fIcommand\fP [ \fIarguments\fP ] [ \fIoptions\fP ]
 .PP
 .SH DESCRIPTION
 The
-.B ipsec
+.B @IPSEC_SCRIPT@
 utility invokes any of several utilities involved in controlling and monitoring
 the IPsec encryption/authentication system, running the specified \fIcommand\fP
 with the specified \fIarguments\fP and \fIoptions\fP as if it had been invoked
@@ -18,7 +18,7 @@ All the commands described in this manual page are built-in and are used to
 control and monitor IPsec connections as well as the IKE daemons.
 .PP
 For other commands
-.I ipsec
+.I @IPSEC_SCRIPT@
 supplies the invoked
 .I command
 with a suitable PATH environment variable,
@@ -31,240 +31,229 @@ and the IPsec version number.
 .PP
 .SS CONTROL COMMANDS
 .TP
-.B "ipsec start [ starter options ]"
+.B "start [ starter options ]"
 calls
-.BR "ipsec starter"
-which in turn parses \fIipsec.conf\fR and starts the IKEv1 \fIpluto\fR and
-IKEv2 \fIcharon\fR daemons.
+.BR "starter"
+which in turn parses \fIipsec.conf\fR and starts the IKEv1/IKEv2 daemon
+\fIcharon\fR.
 .PP
 .TP
-.B "ipsec update"
+.B "update"
 sends a \fIHUP\fR signal to
-.BR "ipsec starter"
+.BR "starter"
 which in turn determines any changes in \fIipsec.conf\fR
-and updates the configuration on the running IKEv1 \fIpluto\fR and IKEv2
-\fIcharon\fR daemons, correspondingly.
+and updates the configuration on the running IKE daemon \fIcharon\fR.
 .PP
 .TP
-.B "ipsec reload"
+.B "reload"
 sends a \fIUSR1\fR signal to
-.BR "ipsec starter"
-which in turn reloads the whole configuration on the running IKEv1 \fIpluto\fR
-and IKEv2 \fIcharon\fR daemons based on the actual \fIipsec.conf\fR.
+.BR "starter"
+which in turn reloads the whole configuration on the running IKE daemon
+\fIcharon\fR based on the actual \fIipsec.conf\fR.
 .PP
 .TP
-.B "ipsec restart"
+.B "restart"
 is equivalent to
-.B "ipsec stop"
+.B "stop"
 followed by
-.B "ipsec start"
+.B "start"
 after a guard of 2 seconds.
 .PP
 .TP
-.B "ipsec stop"
-terminates all IPsec connections and stops the IKEv1 \fIpluto\fR and IKEv2
-\fIcharon\fR daemons by sending a \fITERM\fR signal to
-.BR "ipsec starter".
+.B "stop"
+terminates all IPsec connections and stops the IKE daemon \fIcharon\fR
+by sending a \fITERM\fR signal to
+.BR "starter".
 .PP
 .TP
-.B "ipsec up \fIname\fP"
-tells the responsible IKE daemon to start up connection \fIname\fP.
+.B "up \fIname\fP"
+tells the IKE daemon to start up connection \fIname\fP.
 .PP
 .TP
-.B "ipsec down \fIname\fP"
-tells the responsible IKE daemon to terminate connection \fIname\fP.
+.B "down \fIname\fP"
+tells the IKE daemon to terminate connection \fIname\fP.
 .PP
 .TP
-.B "ipsec down \fIname{n}\fP"
-terminates IKEv2 CHILD SA instance \fIn\fP of connection \fIname\fP.
+.B "down \fIname{n}\fP"
+terminates IKEv1 Quick Mode and IKEv2 CHILD SA instance \fIn\fP of
+connection \fIname\fP.
 .PP
 .TP
-.B "ipsec down \fIname{*}\fP"
-terminates all IKEv2 CHILD SA instances of connection \fIname\fP.
+.B "down \fIname{*}\fP"
+terminates all IKEv1 Quick Mode and  IKEv2 CHILD SA instances of connection
+\fIname\fP.
 .PP
 .TP
-.B "ipsec down \fIname[n]\fP"
-terminates all IKEv2 IKE SA instance \fIn\fP of connection \fIname\fP.
+.B "down \fIname[n]\fP"
+terminates IKE SA instance \fIn\fP of connection \fIname\fP.
 .PP
 .TP
-.B "ipsec down \fIname[*]\fP"
-terminates all IKEv2 IKE SA instances of connection \fIname\fP.
+.B "down \fIname[*]\fP"
+terminates all IKE SA instances of connection \fIname\fP.
 .PP
 .TP
-.B "ipsec route \fIname\fP"
-tells the responsible IKE daemon to insert an IPsec policy in the kernel
+.B "route \fIname\fP"
+tells the IKE daemon to insert an IPsec policy in the kernel
 for connection \fIname\fP. The first payload packet matching the IPsec policy
 will automatically trigger an IKE connection setup.
 .PP
 .TP
-.B "ipsec unroute \fIname\fP"
+.B "unroute \fIname\fP"
 remove the IPsec policy in the kernel for connection \fIname\fP.
 .PP
 .TP
-.B "ipsec status [ \fIname\fP ]"
+.B "status [ \fIname\fP ]"
 returns concise status information either on connection
 \fIname\fP or if the argument is lacking, on all connections.
 .PP
 .TP
-.B "ipsec statusall [ \fIname\fP ]"
+.B "statusall [ \fIname\fP ]"
 returns detailed status information either on connection
 \fIname\fP or if the argument is lacking, on all connections.
 .PP
 .SS LIST COMMANDS
 .TP
-.B "ipsec listalgs"
-returns a list all supported IKE encryption and hash algorithms, the available
-Diffie-Hellman groups, as well as all supported ESP encryption and
-authentication algorithms registered via the Linux kernel's Crypto API.
-.br
-Supported by the IKEv1 \fIpluto\fP daemon only.
+.B "listalgs"
+returns a list supported cryptographic algorithms usable for IKE, and their
+corresponding plugin.
 .PP
 .TP
-.B "ipsec listpubkeys [ --utc ]"
+.B "listpubkeys [ --utc ]"
 returns a list of RSA public keys that were either loaded in raw key format
 or extracted from X.509 and|or OpenPGP certificates.
-.br
-Supported by the IKEv1 \fIpluto\fP daemon only.
 .PP
 .TP
-.B "ipsec listcerts [ --utc ]"
+.B "listcerts [ --utc ]"
 returns a list of X.509 and|or OpenPGP certificates that were either loaded
-locally by the IKE daemon or received via the IKEv2 protocol.
+locally by the IKE daemon or received via the IKE protocol.
 .PP
 .TP
-.B "ipsec listcacerts [ --utc ]"
+.B "listcacerts [ --utc ]"
 returns a list of X.509 Certification Authority (CA) certificates that were
 loaded locally by the IKE daemon from the \fI/etc/ipsec.d/cacerts/\fP
-directory or received in PKCS#7-wrapped certificate payloads via the IKE
-protocol.
+directory or received via the IKE protocol.
 .PP
 .TP
-.B "ipsec listaacerts [ --utc ]"
+.B "listaacerts [ --utc ]"
 returns a list of X.509 Authorization Authority (AA) certificates that were
 loaded locally by the IKE daemon from the \fI/etc/ipsec.d/aacerts/\fP
 directory.
 .PP
 .TP
-.B "ipsec listocspcerts [ --utc ]"
+.B "listocspcerts [ --utc ]"
 returns a list of X.509 OCSP Signer certificates that were either loaded
 locally by the IKE daemon from the \fI/etc/ipsec.d/ocspcerts/\fP
 directory or were sent by an OCSP server.
 .PP
 .TP
-.B "ipsec listacerts [ --utc ]"
+.B "listacerts [ --utc ]"
 returns a list of X.509 Attribute certificates that were loaded locally by
 the IKE daemon from the \fI/etc/ipsec.d/acerts/\fP directory.
 .PP
 .TP
-.B "ipsec listgroups [ --utc ]"
+.B "listgroups [ --utc ]"
 returns a list of groups that are used to define user authorization profiles.
-.br
-Supported by the IKEv1 \fIpluto\fP daemon only.
 .PP
 .TP
-.B "ipsec listcainfos [ --utc ]"
+.B "listcainfos [ --utc ]"
 returns certification authority information (CRL distribution points, OCSP URIs,
 LDAP servers) that were defined by
 .BR ca
 sections in \fIipsec.conf\fP.
 .PP
 .TP
-.B "ipsec listcrls [ --utc ]"
+.B "listcrls [ --utc ]"
 returns a list of Certificate Revocation Lists (CRLs) that were either loaded
 by the IKE daemon from the \fI/etc/ipsec.d/crls\fP directory or fetched from
 an HTTP- or LDAP-based CRL distribution point.
 .PP
 .TP
-.B "ipsec listocsp [ --utc ]"
+.B "listocsp [ --utc ]"
 returns revocation information fetched from OCSP servers.
 .PP
 .TP
-.B "ipsec listcards [ --utc ]"
-list all certificates found on attached smart cards.
-.br
-Supported by the IKEv1 \fIpluto\fP daemon only.
-.PP
-.TP
-.B "ipsec listall [ --utc ]"
-returns all information generated by the list commands above. Each list command 
+.B "listall [ --utc ]"
+returns all information generated by the list commands above. Each list command
 can be called with the
 \fB\-\-utc\fP
 option which displays all dates in UTC instead of local time.
 .PP
 .SS REREAD COMMANDS
 .TP
-.B "ipsec rereadsecrets"
+.B "rereadsecrets"
 flushes and rereads all secrets defined in \fIipsec.secrets\fP.
 .PP
 .TP
-.B "ipsec rereadcacerts"
+.B "rereadcacerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/cacerts\fP
 directory and adds them to the list of Certification Authority (CA)
 certificates.
 .PP
 .TP
-.B "ipsec rereadaacerts"
+.B "rereadaacerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/aacerts\fP
 directory and adds them to the list of Authorization Authority (AA)
 certificates.
 .PP
 .TP
-.B "ipsec rereadocspcerts" 
+.B "rereadocspcerts"
 reads all certificate files contained in the \fI/etc/ipsec.d/ocspcerts/\fP
 directory and adds them to the list of OCSP signer certificates.
 .PP
 .TP
-.B "ipsec rereadacerts"
+.B "rereadacerts"
 reads all certificate files contained in the  \fI/etc/ipsec.d/acerts/\fP
 directory and adds them to the list of attribute certificates.
 .PP
 .TP
-.B "ipsec rereadcrls"
+.B "rereadcrls"
 reads  all Certificate  Revocation Lists (CRLs) contained in the
 \fI/etc/ipsec.d/crls/\fP directory and adds them to the list of CRLs.
 .PP
 .TP
-.B "ipsec rereadall"
+.B "rereadall"
 executes all reread commands listed above.
 .PP
 .SS PURGE COMMANDS
 .TP
-.B "ipsec purgeike"
-purges IKEv2 SAs that don't have a CHILD SA.
+.B "purgeike"
+purges IKE SAs that don't have a Quick Mode or CHILD SA.
 .PP
 .TP
-.B "ipsec purgeocsp"
+.B "purgeocsp"
 purges all cached OCSP information records.
 .PP
 .SS INFO COMMANDS
 .TP
-.B "ipsec \-\-help"
-returns the usage information for the ipsec command.
+.B "\-\-help"
+returns the usage information for the
+.B @IPSEC_SCRIPT@
+command.
 .PP
 .TP
-.B "ipsec \-\-version"
+.B "\-\-version"
 returns the version in the form of
 .B Linux strongSwan U<strongSwan userland version>/K<Linux kernel version>
 if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
 running on.
 .PP
 .TP
-.B "ipsec \-\-versioncode"
+.B "\-\-versioncode"
 returns the version number in the form of
 .B U<strongSwan userland version>/K<Linux kernel version>
 if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is
 running on.
 .PP
 .TP
-.B "ipsec \-\-copyright"
+.B "\-\-copyright"
 returns the copyright information.
 .PP
 .TP
-.B "ipsec \-\-directory"
+.B "\-\-directory"
 returns the \fILIBEXECDIR\fP directory as defined by the configure options.
 .PP
 .TP
-.B "ipsec \-\-confdir"
+.B "\-\-confdir"
 returns the \fISYSCONFDIR\fP directory as defined by the configure options.
 .SH FILES
 /usr/local/lib/ipsec	usual utilities directory
@@ -273,20 +262,20 @@ returns the \fISYSCONFDIR\fP directory as defined by the configure options.
 The following environment variables control where strongSwan finds its
 components.
 The
-.B ipsec
+.B @IPSEC_SCRIPT@
 command sets them if they are not already set.
 .nf
 .na
 
-IPSEC_DIR 		directory containing ipsec programs and utilities
-IPSEC_SBINDIR		directory containing \fBipsec\fP command
-IPSEC_CONFDIR 		directory containing configuration files
-IPSEC_PIDDIR		directory containing PID files
-IPSEC_NAME 		name of ipsec distribution
-IPSEC_VERSION 		version numer of ipsec userland and kernel
-IPSEC_STARTER_PID 	PID file for ipsec starter
-IPSEC_PLUTO_PID 	PID file for IKEv1 keying daemon
-IPSEC_CHARON_PID	PID file for IKEv2 keying daemon
+IPSEC_DIR               directory containing ipsec programs and utilities
+IPSEC_SBINDIR           directory containing \fBipsec\fP command
+IPSEC_CONFDIR           directory containing configuration files
+IPSEC_PIDDIR            directory containing PID files
+IPSEC_SCRIPT            name of the ipsec script
+IPSEC_NAME              name of ipsec distribution
+IPSEC_VERSION           version numer of ipsec userland and kernel
+IPSEC_STARTER_PID       PID file for ipsec starter
+IPSEC_CHARON_PID        PID file for IKE keying daemon
 .ad
 .fi
 .SH SEE ALSO
diff --git a/src/ipsec/ipsec.in b/src/ipsec/_ipsec.in
index 479974a0e..2acf5a3f6 100755..100644
--- a/src/ipsec/ipsec.in
+++ b/src/ipsec/_ipsec.in
@@ -28,36 +28,34 @@ IPSEC_DIR="@IPSEC_DIR@"
 IPSEC_SBINDIR="@IPSEC_SBINDIR@"
 IPSEC_CONFDIR="@IPSEC_CONFDIR@"
 IPSEC_PIDDIR="@IPSEC_PIDDIR@"
+IPSEC_SCRIPT="@IPSEC_SCRIPT@"
 
 IPSEC_STARTER_PID="${IPSEC_PIDDIR}/starter.pid"
-IPSEC_PLUTO_PID="${IPSEC_PIDDIR}/pluto.pid"
 IPSEC_CHARON_PID="${IPSEC_PIDDIR}/charon.pid"
 
-IPSEC_WHACK="${IPSEC_DIR}/whack"
 IPSEC_STROKE="${IPSEC_DIR}/stroke"
 IPSEC_STARTER="${IPSEC_DIR}/starter"
 
-export IPSEC_DIR IPSEC_SBINDIR IPSEC_CONFDIR IPSEC_PIDDIR IPSEC_VERSION IPSEC_NAME IPSEC_STARTER_PID IPSEC_PLUTO_PID IPSEC_CHARON_PID
+export IPSEC_DIR IPSEC_SBINDIR IPSEC_CONFDIR IPSEC_PIDDIR IPSEC_SCRIPT IPSEC_VERSION IPSEC_NAME IPSEC_STARTER_PID IPSEC_CHARON_PID
 
 IPSEC_DISTRO="Institute for Internet Technologies and Applications\nUniversity of Applied Sciences Rapperswil, Switzerland"
 
 case "$1" in
 '')
-	echo "Usage: ipsec command argument ..."
-	echo "Use --help for list of commands, or see ipsec(8) manual page"
-	echo "or the $IPSEC_NAME documentation for names of the common ones."
-	echo "Most have their own manual pages, e.g. ipsec_auto(8)."
+	echo "Usage: $IPSEC_SCRIPT command argument ..."
+	echo "Use --help for list of commands, or see $IPSEC_SCRIPT(8) manual "
+	echo "page or the $IPSEC_NAME documentation for names of the common "
+	echo "ones."
 	echo "See <http://www.strongswan.org> for more general info."
 	exit 0
 	;;
 --help)
-	echo "Usage: ipsec command argument ..."
+	echo "Usage: $IPSEC_SCRIPT command argument ..."
 	echo "where command is one of:"
 	echo "	start|restart  arguments..."
 	echo "	update|reload|stop"
 	echo "	up|down|route|unroute <connectionname>"
 	echo "	status|statusall [<connectionname>]"
-	echo "	ready"
 	echo "	listalgs|listpubkeys|listcerts [--utc]"
 	echo "	listcacerts|listaacerts|listocspcerts [--utc]"
 	echo "	listacerts|listgroups|listcainfos [--utc]"
@@ -67,14 +65,11 @@ case "$1" in
 	echo "	rereadcacerts|rereadaacerts|rereadocspcerts"
 	echo "	rereadacerts|rereadcrls|rereadall"
 	echo "	purgeocsp|purgecrls|purgecerts|purgeike"
-	echo "	scencrypt|scdecrypt <value> [--inbase <base>] [--outbase <base>] [--keyid <id>]"
 	echo "	openac"
-	echo "	pluto"
 	echo "	scepclient"
 	echo "	secrets"
 	echo "	starter"
 	echo "	version"
-	echo "	whack"
 	echo "	stroke"
 	echo
 	echo "Some of these functions have their own manual pages, e.g. ipsec_scepclient(8)."
@@ -100,15 +95,10 @@ down)
 	shift
 	if [ "$#" -ne 1 ]
 	then
-	    echo "Usage: ipsec down <connection name>"
+	    echo "Usage: $IPSEC_SCRIPT down <connection name>"
 	    exit 2
 	fi
 	rc=7
-	if [ -e $IPSEC_PLUTO_PID ]
-	then
-		$IPSEC_WHACK --name "$1" --terminate
-		rc="$?"
-	fi
 	if [ -e $IPSEC_CHARON_PID ]
 	then
 		$IPSEC_STROKE down "$1"
@@ -120,7 +110,7 @@ down-srcip)
 	shift
 	if [ "$#" -lt 1 ]
 	then
-	    echo "Usage: ipsec down-srcip <start> [<end>]"
+	    echo "Usage: $IPSEC_SCRIPT down-srcip <start> [<end>]"
 	    exit 2
 	fi
 	rc=7
@@ -134,11 +124,6 @@ down-srcip)
 listcards|rereadgroups)
 	op="$1"
 	shift
-	if [ -e $IPSEC_PLUTO_PID ]
-	then
-		$IPSEC_WHACK "$@" "--$op"
-		rc="$?"
-	fi
 	if [ -e $IPSEC_CHARON_PID ]
 	then
 		exit 3
@@ -150,15 +135,6 @@ leases)
 	op="$1"
 	rc=7
 	shift
-	if [ -e $IPSEC_PLUTO_PID ]
-	then
-		case "$#" in
-		0) $IPSEC_WHACK "--$op" ;;
-		1) $IPSEC_WHACK "--$op" --name "$1" ;;
-		*) $IPSEC_WHACK "--$op" --name "$1" --lease-addr "$2" ;;
-		esac
-		rc="$?"
-	fi
 	if [ -e $IPSEC_CHARON_PID ]
 	then
 		case "$#" in
@@ -180,11 +156,6 @@ rereadall|purgeocsp)
 	op="$1"
 	rc=7
 	shift
-	if [ -e $IPSEC_PLUTO_PID ]
-	then
-		$IPSEC_WHACK "$@" "--$op"
-		rc="$?"
-	fi
 	if [ -e $IPSEC_CHARON_PID ]
 	then
 		$IPSEC_STROKE "$op" "$@"
@@ -201,16 +172,6 @@ purgeike|purgecrls|purgecerts)
 	fi
 	exit "$rc"
 	;;
-ready)
-	shift
-	if [ -e $IPSEC_PLUTO_PID ]
-	then
-		$IPSEC_WHACK --listen
-		exit 0
-	else
-		exit 7
-	fi
-	;;
 reload)
 	rc=7
 	if [ -e $IPSEC_STARTER_PID ]
@@ -223,10 +184,10 @@ reload)
 	exit "$rc"
 	;;
 restart)
-	$IPSEC_SBINDIR/ipsec stop
+	$IPSEC_SBINDIR/$IPSEC_SCRIPT stop
 	sleep 2
 	shift
-	exec $IPSEC_SBINDIR/ipsec start "$@"
+	exec $IPSEC_SBINDIR/$IPSEC_SCRIPT start "$@"
 	;;
 route|unroute)
 	op="$1"
@@ -234,14 +195,9 @@ route|unroute)
 	shift
 	if [ "$#" -ne 1 ]
 	then
-		echo "Usage: ipsec $op <connection name>"
+		echo "Usage: $IPSEC_SCRIPT $op <connection name>"
 		exit 2
 	fi
-	if [ -e $IPSEC_PLUTO_PID ]
-	then
-		$IPSEC_WHACK --name "$1" "--$op"
-		rc="$?"
-	fi
 	if [ -e $IPSEC_CHARON_PID ]
 	then
 		$IPSEC_STROKE "$op" "$1"
@@ -249,24 +205,8 @@ route|unroute)
 	fi
 	exit "$rc"
 	;;
-scencrypt|scdecrypt)
-	op="$1"
-	shift
-	if [ -e $IPSEC_PLUTO_PID ]
-	then
-		$IPSEC_WHACK "--$op" "$@"
-		exit "$?"
-	else
-		exit 7
-	fi
-	;;
 secrets)
 	rc=7
-	if [ -e $IPSEC_PLUTO_PID ]
-	then
-		$IPSEC_WHACK --rereadsecrets
-		rc="$?"
-	fi
 	if [ -e $IPSEC_CHARON_PID ]
 	then
 		$IPSEC_STROKE rereadsecrets
@@ -293,19 +233,11 @@ status|statusall)
 	shift
 	if [ $# -eq 0 ]
 	then
-		if [ -e $IPSEC_PLUTO_PID ]
-		then
-			$IPSEC_WHACK "--$op"
-		fi
 		if [ -e $IPSEC_CHARON_PID ]
 		then
 			$IPSEC_STROKE "$op"
 		fi
 	else
-		if [ -e $IPSEC_PLUTO_PID ]
-		then
-			$IPSEC_WHACK --name "$1" "--$op"
-		fi
 		if [ -e $IPSEC_CHARON_PID ]
 		then
 			$IPSEC_STROKE "$op" "$1"
@@ -351,15 +283,10 @@ up)
 	shift
 	if [ "$#" -ne 1 ]
 	then
-	    echo "Usage: ipsec up <connection name>"
+	    echo "Usage: $IPSEC_SCRIPT up <connection name>"
 	    exit 2
 	fi
 	rc=7
-	if [ -e $IPSEC_PLUTO_PID ]
-	then
-		$IPSEC_WHACK --name "$1" --initiate
-		rc="$?"
-	fi
 	if [ -e $IPSEC_CHARON_PID ]
 	then
 		$IPSEC_STROKE up "$1"
@@ -381,7 +308,7 @@ update)
 version|--version)
 	printf "$OS_NAME $IPSEC_NAME $IPSEC_VERSION\n"
 	printf "$IPSEC_DISTRO\n"
-	printf "See 'ipsec --copyright' for copyright information.\n"
+	printf "See '$IPSEC_SCRIPT --copyright' for copyright information.\n"
 	exit 0
 	;;
 --*)
@@ -400,7 +327,7 @@ then
     path="$IPSEC_DIR/$cmd"
     if [ ! -x "$path" ]
     then
-	echo "$0: unknown IPsec command \`$cmd' (\`ipsec --help' for list)" >&2
+	echo "$0: unknown IPsec command \`$cmd' (\`$IPSEC_SCRIPT --help' for list)" >&2
 	exit 2
     fi
 fi