From 774a362e87feab25f1be16fbca08269ddc7121a4 Mon Sep 17 00:00:00 2001 From: Rene Mayrhofer Date: Thu, 12 Apr 2007 20:41:31 +0000 Subject: Major new upstream release, just ran svn-upgrade for now (and wrote some debian/changelong entries). --- programs/spi/.cvsignore | 1 - programs/spi/Makefile | 69 -- programs/spi/spi.5 | 213 ------ programs/spi/spi.8 | 525 --------------- programs/spi/spi.c | 1689 ----------------------------------------------- 5 files changed, 2497 deletions(-) delete mode 100644 programs/spi/.cvsignore delete mode 100644 programs/spi/Makefile delete mode 100644 programs/spi/spi.5 delete mode 100644 programs/spi/spi.8 delete mode 100644 programs/spi/spi.c (limited to 'programs/spi') diff --git a/programs/spi/.cvsignore b/programs/spi/.cvsignore deleted file mode 100644 index c928c4b77..000000000 --- a/programs/spi/.cvsignore +++ /dev/null @@ -1 +0,0 @@ -spi diff --git a/programs/spi/Makefile b/programs/spi/Makefile deleted file mode 100644 index 10a1eaa9c..000000000 --- a/programs/spi/Makefile +++ /dev/null @@ -1,69 +0,0 @@ -# Makefile for the KLIPS interface utilities -# Copyright (C) 1998, 1999 Henry Spencer. -# Copyright (C) 1999, 2000, 2001 Richard Guy Briggs -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at your -# option) any later version. See . -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -# for more details. -# -# RCSID $Id: Makefile,v 1.2 2004/03/22 21:53:21 as Exp $ - -FREESWANSRCDIR=../.. -include ${FREESWANSRCDIR}/Makefile.inc - -PROGRAM=spi -EXTRA5PROC=${PROGRAM}.5 - -LIBS=${FREESWANLIB} - -OBJS=constants.o alg_info.o kernel_alg.o - -include ../Makefile.program - -constants.o : ../pluto/constants.c ../pluto/constants.h - $(CC) $(CFLAGS) -c -o $@ $< - -alg_info.o : ../pluto/alg_info.c ../pluto/alg_info.h - $(CC) $(CFLAGS) -DNO_PLUTO -c -o $@ $< - -kernel_alg.o : ../pluto/kernel_alg.c ../pluto/kernel_alg.h - $(CC) $(CFLAGS) -DNO_PLUTO -c -o $@ $< - -# -# $Log: Makefile,v $ -# Revision 1.2 2004/03/22 21:53:21 as -# merged alg-0.8.1 branch with HEAD -# -# Revision 1.1.4.1 2004/03/16 09:48:22 as -# alg-0.8.1rc12 patch merged -# -# Revision 1.1 2004/03/15 20:35:31 as -# added files from freeswan-2.04-x509-1.5.3 -# -# Revision 1.4 2002/06/03 20:25:31 mcr -# man page for files actually existant in /proc/net changed back to -# ipsec_foo via new EXTRA5PROC process. -# -# Revision 1.3 2002/06/02 21:51:41 mcr -# changed TOPDIR->FREESWANSRCDIR in all Makefiles. -# (note that linux/net/ipsec/Makefile uses TOPDIR because this is the -# kernel sense.) -# -# Revision 1.2 2002/04/26 01:21:26 mcr -# while tracking down a missing (not installed) /etc/ipsec.conf, -# MCR has decided that it is not okay for each program subdir to have -# some subset (determined with -f) of possible files. -# Each subdir that defines $PROGRAM, MUST have a PROGRAM.8 file as well as a PROGRAM file. -# Optional PROGRAM.5 files have been added to the makefiles. -# -# Revision 1.1 2002/04/24 07:55:32 mcr -# #include patches and Makefiles for post-reorg compilation. -# -# -# diff --git a/programs/spi/spi.5 b/programs/spi/spi.5 deleted file mode 100644 index a8faebee4..000000000 --- a/programs/spi/spi.5 +++ /dev/null @@ -1,213 +0,0 @@ -.TH IPSEC_SPI 5 "26 Jun 2000" -.\" -.\" RCSID $Id: spi.5,v 1.1 2004/03/15 20:35:31 as Exp $ -.\" -.SH NAME -ipsec_spi \- list IPSEC Security Associations -.SH SYNOPSIS -.B ipsec -.B spi -.PP -.B cat -.B /proc/net/ipsec_spi -.PP -.SH DESCRIPTION -.I /proc/net/ipsec_spi -is a read-only file that lists the current IPSEC Security Associations. -A Security Association (SA) is a transform through which packet contents -are to be processed before being forwarded. A transform can be an -IPv4-in-IPv4 or IPv6-in-IPv6 encapsulation, an IPSEC Authentication Header (authentication -with no encryption), or an IPSEC Encapsulation Security Payload -(encryption, possibly including authentication). -.PP -When a packet is passed from a higher networking layer through an IPSEC -virtual interface, a search in the extended routing table (see -.IR ipsec_eroute (5)) -yields -a IP protocol number -, -a Security Parameters Index (SPI) -and -an effective destination address -. -When an IPSEC packet arrives from the network, -its ostensible destination, an SPI and an IP protocol -specified by its outermost IPSEC header are used. -The destination/SPI/protocol combination is used to select a relevant SA. -(See -.IR ipsec_spigrp (5) -for discussion of how multiple transforms are combined.) -.PP -An -.I spi , -.I proto, -.I daddr -and -.IR address_family -arguments specify an SAID. -.I Proto -is an ASCII string, "ah", "esp", "comp" or "tun", specifying the IP protocol. -.I Spi -is a number, preceded by '.' indicating hexadecimal and IPv4 or by ':' indicating hexadecimal and IPv6, -where each hexadecimal digit represents 4 bits, -between -.B 0x100 -and -.BR 0xffffffff ; -values from -.B 0x0 -to -.B 0xff -are reserved. -.I Daddr -is a dotted-decimal IPv4 destination address or a coloned hex IPv6 destination address. -.PP -An -.I SAID -combines the three parameters above, such as: "tun.101@1.2.3.4" for IPv4 or "tun:101@3049:1::1" for IPv6 -.PP -A table entry consists of: -.IP + 3 -.BR SAID -.IP + -: -.IP + -direction (dir=) -.IP + -source address (src=) -.IP + -source and destination addresses and masks for inner header policy check -addresses (policy=), as dotted-quads or coloned hex, separated by '->', -for IPv4-in-IPv4 or IPv6-in-IPv6 SAs only -.IP + -initialisation vector length and value (iv_bits=, iv=) if non-zero -.IP + -out-of-order window size, number of out-of-order errors, sequence -number, recently received packet bitmask, maximum difference between -sequence numbers (ooowin=, ooo_errs=, seq=, bit=, max_seq_diff=) if SA -is AH or ESP and if individual items are non-zero -.IP + -extra flags (flags=) if any are set -.IP + -authenticator length in bits (alen=) if non-zero -.IP + -authentication key length in bits (aklen=) if non-zero -.IP + -authentication errors (auth_errs=) if non-zero -.IP + -encryption key length in bits (eklen=) if non-zero -.IP + -encryption size errors (encr_size_errs=) if non-zero -.IP + -encryption padding error warnings (encr_pad_errs=) if non-zero -.IP + -lifetimes legend, c=Current status, s=Soft limit when exceeded will -initiate rekeying, h=Hard limit will cause termination of SA (life(c,s,h)=) -.IP + 6 -number of connections to which the SA is allocated (c), that will cause a -rekey (s), that will cause an expiry (h) (alloc=), if any value is non-zero -.IP + -number of bytes processesd by this SA (c), that will cause a rekey (s), that -will cause an expiry (h) (bytes=), if any value is non-zero -.IP + -time since the SA was added (c), until rekey (s), until expiry (h), in seconds (add=) -.IP + -time since the SA was first used (c), until rekey (s), until expiry (h), in seconds (used=), -if any value is non-zero -.IP + -number of packets processesd by this SA (c), that will cause a rekey (s), that -will cause an expiry (h) (packets=), if any value is non-zero -.IP + 3 -time since the last packet was processed, in seconds (idle=), if SA has -been used -.IP -average compression ratio (ratio=) -.SH EXAMPLES -.B "tun.12a@192.168.43.1 IPIP: dir=out src=192.168.43.2" -.br -.B " life(c,s,h)=bytes(14073,0,0)add(269,0,0)" -.br -.B " use(149,0,0)packets(14,0,0)" -.br -.B " idle=23 -.LP -is an outbound IPv4-in-IPv4 (protocol 4) tunnel-mode SA set up between machines -192.168.43.2 and 192.168.43.1 with an SPI of 12a in hexadecimal that has -passed about 14 kilobytes of traffic in 14 packets since it was created, -269 seconds ago, first used 149 seconds ago and has been idle for 23 -seconds. -.LP -.B "esp:9a35fc02@3049:1::1 ESP_3DES_HMAC_MD5:" -.br -.B " dir=in src=9a35fc02@3049:1::2" -.br -.B " ooowin=32 seq=7149 bit=0xffffffff" -.br -.B " alen=128 aklen=128 eklen=192" -.br -.B " life(c,s,h)=bytes(1222304,0,0)add(4593,0,0)" -.br -.B " use(3858,0,0)packets(7149,0,0)" -.br -.B " idle=23" -.LP -is an inbound Encapsulating Security Payload (protocol 50) SA on machine -3049:1::1 with an SPI of 9a35fc02 that uses 3DES as the encryption -cipher, HMAC MD5 as the authentication algorithm, an out-of-order -window of 32 packets, a present sequence number of 7149, every one of -the last 32 sequence numbers was received, the authenticator length and -keys is 128 bits, the encryption key is 192 bits (actually 168 for 3DES -since 1 of 8 bits is a parity bit), has passed 1.2 Mbytes of data in -7149 packets, was added 4593 seconds ago, first used -3858 seconds ago and has been idle for 23 seconds. -.LP -.SH FILES -/proc/net/ipsec_spi, /usr/local/bin/ipsec -.SH "SEE ALSO" -ipsec(8), ipsec_manual(8), ipsec_tncfg(5), ipsec_eroute(5), -ipsec_spigrp(5), ipsec_klipsdebug(5), ipsec_spi(8), ipsec_version(5), -ipsec_pf_key(5) -.SH HISTORY -Written for the Linux FreeS/WAN project - -by Richard Guy Briggs. -.SH BUGS -The add and use times are awkward, displayed in seconds since machine -start. It would be better to display them in seconds before now for -human readability. -.\" -.\" $Log: spi.5,v $ -.\" Revision 1.1 2004/03/15 20:35:31 as -.\" added files from freeswan-2.04-x509-1.5.3 -.\" -.\" Revision 1.9 2002/04/24 07:35:39 mcr -.\" Moved from ./klips/utils/spi.5,v -.\" -.\" Revision 1.8 2001/08/01 23:22:44 rgb -.\" Fix inconsistancies between manpage and output. -.\" -.\" Revision 1.7 2000/11/30 16:47:28 rgb -.\" Added src= to /proc/net/ipsec_spi manpage. -.\" -.\" Revision 1.6 2000/09/17 18:56:48 rgb -.\" Added IPCOMP support. -.\" -.\" Revision 1.5 2000/09/13 15:54:32 rgb -.\" Added Gerhard's ipv6 updates. -.\" -.\" Revision 1.4 2000/07/05 17:24:03 rgb -.\" Updated for relative, rather than absolute values for addtime and -.\" usetime. -.\" -.\" Revision 1.3 2000/06/30 18:21:55 rgb -.\" Update SEE ALSO sections to include ipsec_version(5) and ipsec_pf_key(5) -.\" and correct FILES sections to no longer refer to /dev/ipsec which has -.\" been removed since PF_KEY does not use it. -.\" -.\" Revision 1.2 2000/06/28 12:44:12 henry -.\" format touchup -.\" -.\" Revision 1.1 2000/06/28 05:43:00 rgb -.\" Added manpages for all 5 klips utils. -.\" -.\" diff --git a/programs/spi/spi.8 b/programs/spi/spi.8 deleted file mode 100644 index fe6537c07..000000000 --- a/programs/spi/spi.8 +++ /dev/null @@ -1,525 +0,0 @@ -.TH IPSEC_SPI 8 "23 Oct 2001" -.\" -.\" RCSID $Id: spi.8,v 1.1 2004/03/15 20:35:31 as Exp $ -.\" -.SH NAME -ipsec spi \- manage IPSEC Security Associations -.SH SYNOPSIS -.br -Note: In the following, -.br -.B -means: -.B \-\-af -(inet | inet6) -.B \-\-edst -daddr -.B \-\-spi -spi -.B \-\-proto -proto OR -.B \-\-said -said, -.br -.B -means: -.B \-\-life -(soft | hard)\-(allocations | bytes | addtime | usetime | packets)=value[,...] -.PP -.B ipsec -.B spi -.PP -.B ipsec -.B spi -.B -.B \-\-src -src -.B \-\-ah -.BR hmac-md5-96 | hmac-sha1-96 -[ -.B \-\-replay_window -replayw ] -[ -.B -] -.B \-\-authkey -akey -.PP -.B ipsec -.B spi -.B -.B \-\-src -src -.B \-\-esp -.BR 3des -[ -.B \-\-replay_window -replayw ] -[ -.B -] -.B \-\-enckey -ekey -.PP -.B ipsec -.B spi -.B -.B \-\-src -src -.B \-\-esp -.BR 3des-md5-96 | 3des-sha1-96 -[ -.B \-\-replay_window -replayw ] -[ -.B -] -.B \-\-enckey -ekey -.B \-\-authkey -akey -.PP -.B ipsec -.B spi -.B -.B \-\-src -src -.B \-\-comp -.BR deflate -.PP -.B ipsec -.B spi -.B -.B \-\-ip4 -.B \-\-src -encap-src -.B \-\-dst -encap-dst -.PP -.B ipsec -.B spi -.B -.B \-\-ip6 -.B \-\-src -encap-src -.B \-\-dst -encap-dst -.PP -.B ipsec -.B spi -.B -.B \-\-del -.PP -.B ipsec -.B spi -.B \-\-help -.PP -.B ipsec -.B spi -.B \-\-version -.PP -.B ipsec -.B spi -.B \-\-clear -.PP -.SH DESCRIPTION -.I Spi -creates and deletes IPSEC Security Associations. -A Security Association (SA) is a transform through which packet -contents are to be processed before being forwarded. -A transform can be an IPv4-in-IPv4 or an IPv6-in-IPv6 encapsulation, -an IPSEC Authentication Header (authentication with no encryption), -or an IPSEC Encapsulation Security Payload (encryption, possibly -including authentication). -.PP -When a packet is passed from a higher networking layer -through an IPSEC virtual interface, -a search in the extended routing table (see -.IR ipsec_eroute (8)) -yields an effective destination address, a -Security Parameters Index (SPI) and a IP protocol number. -When an IPSEC packet arrives from the network, -its ostensible destination, an SPI and an IP protocol -specified by its outermost IPSEC header are used. -The destination/SPI/protocol combination is used to select a relevant SA. -(See -.IR ipsec_spigrp (8) -for discussion of how multiple transforms are combined.) -.PP -The -.IR af , -.IR daddr , -.I spi -and -.I proto -arguments specify the SA to be created or deleted. -.I af -is the address family (inet for IPv4, inet6 for IPv6). -.I Daddr -is a destination address -in dotted-decimal notation for IPv4 -or in a coloned hex notation for IPv6. -.I Spi -is a number, preceded by '0x' for hexadecimal, -between -.B 0x100 -and -.BR 0xffffffff ; -values from -.B 0x0 -to -.B 0xff -are reserved. -.I Proto -is an ASCII string, "ah", "esp", "comp" or "tun", specifying the IP protocol. -The protocol must agree with the algorithm selected. -.PP -Alternatively, the -.I said -argument can also specify an SA to be created or deleted. -.I Said -combines the three parameters above, such as: "tun.101@1.2.3.4" or "tun:101@1:2::3:4", -where the address family is specified by "." for IPv4 and ":" for IPv6. The address -family indicators substitute the "0x" for hexadecimal. -.PP -The source address, -.IR src , -must also be provided for the inbound policy check to -function. The source address does not need to be included if inbound -policy checking has been disabled. -.PP -Keys vectors must be entered as hexadecimal or base64 numbers. -They should be cryptographically strong random numbers. -.PP -All hexadecimal numbers are entered as strings of hexadecimal digits -(0-9 and a-f), without spaces, preceded by '0x', where each hexadecimal -digit represents 4 bits. -All base64 numbers are entered as strings of base64 digits - (0-9, A-Z, a-z, '+' and '/'), without spaces, preceded by '0s', -where each hexadecimal digit represents 6 bits and '=' is used for padding. -.PP -The deletion of an SA which has been grouped will result in the entire chain -being deleted. -.PP -The form with no additional arguments lists the contents of -/proc/net/ipsec_spi. The format of /proc/net/ipsec_spi is discussed in -ipsec_spi(5). -.PP -The lifetime severity of -.B soft -sets a limit when the key management daemons are asked to rekey the SA. -The lifetime severity of -.B hard -sets a limit when the SA must expire. -The lifetime type -.B allocations -tells the system when to expire the SA because it is being shared by too many -eroutes (not currently used). The lifetime type of -.B bytes -tells the system to expire the SA after a certain number of bytes have been -processed with that SA. The lifetime type of -.B addtime -tells the system to expire the SA a certain number of seconds after the SA was -installed. The lifetime type of -.B usetime -tells the system to expire the SA a certain number of seconds after that SA has -processed its first packet. The lifetime type of -.B packets -tells the system to expire the SA after a certain number of packets have been -processed with that SA. -.SH OPTIONS -.TP 10 -.B \-\-af -specifies the address family (inet for IPv4, inet6 for IPv6) -.TP -.B \-\-edst -specifies the effective destination -.I daddr -of the Security Association -.TP -.B \-\-spi -specifies the Security Parameters Index -.I spi -of the Security Association -.TP -.B \-\-proto -specifies the IP protocol -.I proto -of the Security Association -.TP -.B \-\-said -specifies the Security Association in monolithic format -.TP -.B \-\-ah -add an SA for an IPSEC Authentication Header, -specified by the following transform identifier -(\c -.BR hmac-md5-96 -or -.BR hmac-sha1-96 ) -(RFC2402, obsoletes RFC1826) -.TP -.B hmac-md5-96 -transform following the HMAC and MD5 standards, -using a 128-bit -.I key -to produce a 96-bit authenticator (RFC2403) -.TP -.B hmac-sha1-96 -transform following the HMAC and SHA1 standards, -using a 160-bit -.I key -to produce a 96-bit authenticator (RFC2404) -.TP -.B \-\-esp -add an SA for an IPSEC Encapsulation Security Payload, -specified by the following -transform identifier (\c -.BR 3des , -or -.BR 3des-md5-96 ) -(RFC2406, obsoletes RFC1827) -.TP -.B 3des -encryption transform following the Triple-DES standard in -Cipher-Block-Chaining mode using a 64-bit -.I iv -(internally generated) and a 192-bit 3DES -.I ekey -(RFC2451) -.TP -.B 3des-md5-96 -encryption transform following the Triple-DES standard in -Cipher-Block-Chaining mode with authentication provided by -HMAC and MD5 -(96-bit authenticator), -using a 64-bit -.IR iv -(internally generated), a 192-bit 3DES -.I ekey -and a 128-bit HMAC-MD5 -.I akey -(RFC2451, RFC2403) -.TP -.B 3des-sha1-96 -encryption transform following the Triple-DES standard in -Cipher-Block-Chaining mode with authentication provided by -HMAC and SHA1 -(96-bit authenticator), -using a 64-bit -.IR iv -(internally generated), a 192-bit 3DES -.I ekey -and a 160-bit HMAC-SHA1 -.I akey -(RFC2451, RFC2404) -.TP -.BR \-\-replay_window " replayw" -sets the replay window size; valid values are decimal, 1 to 64 -.TP -.BR \-\-life " life_param[,life_param]" -sets the lifetime expiry; the format of -.B life_param -consists of a comma-separated list of lifetime specifications without spaces; -a lifetime specification is comprised of a severity of -.BR soft " or " hard -followed by a '-', followed by a lifetime type of -.BR allocations ", " bytes ", " addtime ", " usetime " or " packets -followed by an '=' and finally by a value -.TP -.B \-\-comp -add an SA for IPSEC IP Compression, -specified by the following -transform identifier (\c -.BR deflate ) -(RFC2393) -.TP -.B deflate -compression transform following the patent-free Deflate compression algorithm -(RFC2394) -.TP -.B \-\-ip4 -add an SA for an IPv4-in-IPv4 -tunnel from -.I encap-src -to -.I encap-dst -.TP -.B \-\-ip6 -add an SA for an IPv6-in-IPv6 -tunnel from -.I encap-src -to -.I encap-dst -.TP -.B \-\-src -specify the source end of an IP-in-IP tunnel from -.I encap-src -to -.I encap-dst -and also specifies the source address of the Security Association to be -used in inbound policy checking and must be the same address -family as -.I af -and -.I edst -.TP -.B \-\-dst -specify the destination end of an IP-in-IP tunnel from -.I encap-src -to -.I encap-dst -.TP -.B \-\-del -delete the specified SA -.TP -.BR \-\-clear -clears the table of -.BR SA s -.TP -.BR \-\-help -display synopsis -.TP -.BR \-\-version -display version information -.SH EXAMPLES -To keep line lengths down and reduce clutter, -some of the long keys in these examples have been abbreviated -by replacing part of their text with -.RI `` ... ''. -Keys used when the programs are actually run must, -of course, be the full length required for the particular algorithm. -.LP -.B "ipsec spi \-\-af inet \-\-edst gw2 \-\-spi 0x125 \-\-proto esp \e" -.br -.B " \-\-src gw1 \e" -.br -.B " \-\-esp 3des\-md5\-96 \e" -.br -.BI "\ \ \ \-\-enckey\ 0x6630" "..." "97ce\ \e" -.br -.BI " \-\-authkey 0x9941" "..." "71df" -.LP -sets up an SA from -.BR gw1 -to -.BR gw2 -with an SPI of -.BR 0x125 -and protocol -.BR ESP -(50) using -.BR 3DES -encryption with integral -.BR MD5-96 -authentication transform, using an encryption key of -.BI 0x6630 ... 97ce -and an authentication key of -.BI 0x9941 ... 71df -(see note above about abbreviated keys). -.LP -.B "ipsec spi \-\-af inet6 \-\-edst 3049:9::9000:3100 \-\-spi 0x150 \-\-proto ah \e" -.br -.B " \-\-src 3049:9::9000:3101 \e" -.br -.B " \-\-ah hmac\-md5\-96 \e" -.br -.BI "\ \ \ \-\-authkey\ 0x1234" "..." "2eda\ \e" -.LP -sets up an SA from -.BR 3049:9::9000:3101 -to -.BR 3049:9::9000:3100 -with an SPI of -.BR 0x150 -and protocol -.BR AH -(50) using -.BR MD5-96 -authentication transform, using an authentication key of -.BI 0x1234 ... 2eda -(see note above about abbreviated keys). -.LP -.B "ipsec spi \-\-said tun.987@192.168.100.100 \-\-del " -.LP -deletes an SA to -.BR 192.168.100.100 -with an SPI of -.BR 0x987 -and protocol -.BR IPv4-in-IPv4 -(4). -.LP -.B "ipsec spi \-\-said tun:500@3049:9::1000:1 \-\-del " -.LP -deletes an SA to -.BR 3049:9::1000:1 -with an SPI of -.BR 0x500 -and protocol -.BR IPv6-in-IPv6 -(4). -.LP -.SH FILES -/proc/net/ipsec_spi, /usr/local/bin/ipsec -.SH "SEE ALSO" -ipsec(8), ipsec_manual(8), ipsec_tncfg(8), ipsec_eroute(8), -ipsec_spigrp(8), ipsec_klipsdebug(8), ipsec_spi(5) -.SH HISTORY -Written for the Linux FreeS/WAN project - -by Richard Guy Briggs. -.SH BUGS -The syntax is messy and the transform naming needs work. -.\" -.\" $Log: spi.8,v $ -.\" Revision 1.1 2004/03/15 20:35:31 as -.\" added files from freeswan-2.04-x509-1.5.3 -.\" -.\" Revision 1.32 2002/04/24 07:35:40 mcr -.\" Moved from ./klips/utils/spi.8,v -.\" -.\" Revision 1.31 2001/11/06 20:18:47 rgb -.\" Added lifetime parameters. -.\" -.\" Revision 1.30 2001/10/24 03:23:32 rgb -.\" Added lifetime option and parameters. -.\" -.\" Revision 1.29 2001/05/30 08:14:04 rgb -.\" Removed vestiges of esp-null transforms. -.\" -.\" Revision 1.28 2000/11/29 19:15:20 rgb -.\" Add --src requirement for inbound policy routing. -.\" -.\" Revision 1.27 2000/09/17 18:56:48 rgb -.\" Added IPCOMP support. -.\" -.\" Revision 1.26 2000/09/13 15:54:32 rgb -.\" Added Gerhard's ipv6 updates. -.\" -.\" Revision 1.25 2000/09/12 22:36:45 rgb -.\" Gerhard's IPv6 support. -.\" -.\" Revision 1.24 2000/06/30 18:21:55 rgb -.\" Update SEE ALSO sections to include ipsec_version(5) and ipsec_pf_key(5) -.\" and correct FILES sections to no longer refer to /dev/ipsec which has -.\" been removed since PF_KEY does not use it. -.\" -.\" Revision 1.23 2000/06/21 16:54:57 rgb -.\" Added 'no additional args' text for listing contents of -.\" /proc/net/ipsec_* files. -.\" -.\" Revision 1.22 1999/08/11 08:35:16 rgb -.\" Update, deleting references to obsolete and insecure algorithms. -.\" -.\" Revision 1.21 1999/07/19 18:53:55 henry -.\" improve font usage in key abbreviations -.\" -.\" Revision 1.20 1999/07/19 18:50:09 henry -.\" fix slightly-misformed comments -.\" abbreviate long keys to avoid long-line complaints -.\" -.\" Revision 1.19 1999/04/06 04:54:38 rgb -.\" Fix/Add RCSID Id: and Log: bits to make PHMDs happy. This includes -.\" patch shell fixes. -.\" diff --git a/programs/spi/spi.c b/programs/spi/spi.c deleted file mode 100644 index 369d556c7..000000000 --- a/programs/spi/spi.c +++ /dev/null @@ -1,1689 +0,0 @@ -/* - * All-in-one program to set Security Association parameters - * Copyright (C) 1996 John Ioannidis. - * Copyright (C) 1997, 1998, 1999, 2000, 2001, 2002 Richard Guy Briggs. - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -char spi_c_version[] = "RCSID $Id: spi.c,v 1.7 2004/10/14 20:03:26 as Exp $"; - -#include -#include -#include -/* #include */ -#include -/* #include */ /* new */ -#include -#include -#include -#include - -/* #include */ - -#include -#include -/* #include */ -#include - -#include -#include -#include -#include -#include -#include -#if 0 -#include /* CONFIG_IPSEC_PFKEYv2 */ -#endif - #include - #include - #include - #include - -#include "freeswan/radij.h" -#include "freeswan/ipsec_encap.h" -#include "freeswan/ipsec_xform.h" -#include "freeswan/ipsec_ipe4.h" -#include "freeswan/ipsec_ah.h" -#include "freeswan/ipsec_esp.h" -#include "freeswan/ipsec_sa.h" /* IPSEC_SAREF_NULL */ - -/* - * Manual conn support for ipsec_alg (modular algos). - * Rather ugly to include from pluto dir but avoids - * code duplication. - */ -#ifndef NO_KERNEL_ALG -#include "../pluto/alg_info.h" -#include "../pluto/constants.h" -struct connection; -#include "../pluto/kernel_alg.h" -#endif /* NO_KERNEL_ALG */ - -char *program_name; -int debug = 0; -int saref = 0; -char *command; -extern char *optarg; -extern int optind, opterr, optopt; -char scratch[2]; -char *iv = NULL, *enckey = NULL, *authkey = NULL; -size_t ivlen = 0, enckeylen = 0, authkeylen = 0; -ip_address edst, dst, src; -int address_family = 0; -unsigned char proto = 0; -int alg = 0; - -#ifndef NO_KERNEL_ALG -/* - * Manual connection support for modular algos (ipsec_alg) --Juanjo. - */ -#define XF_OTHER_ALG (XF_CLR-1) /* define magic XF_ symbol for alg_info's */ -#include -const char *alg_string = NULL; /* algorithm string */ -struct alg_info_esp *alg_info = NULL; /* algorithm info got from string */ -struct esp_info *esp_info = NULL; /* esp info from 1st (only) element */ -const char *alg_err; /* auxiliar for parsing errors */ -int proc_read_ok = 0; /* /proc/net/pf_key_support read ok */ -#endif /* NO_KERNEL_ALG */ - -int replay_window = 0; -char sa[SATOT_BUF]; - -extern unsigned int pfkey_lib_debug; /* used by libfreeswan/pfkey_v2_build */ -int pfkey_sock; -fd_set pfkey_socks; -uint32_t pfkey_seq = 0; -enum life_severity { - life_soft = 0, - life_hard = 1, - life_maxsever = 2 -}; -enum life_type { - life_alloc = 0, - life_bytes = 1, - life_addtime = 2, - life_usetime = 3, - life_packets = 4, - life_maxtype = 5 -}; - -#define streql(_a,_b) (!strcmp((_a),(_b))) - -static const char *usage_string = "\ -Usage:\n\ - in the following, is: --af --edst --spi --proto \n\ - OR: --said <.|:>@\n\ - is: --life -=[,...]\n\ -spi --clear\n\ -spi --help\n\ -spi --version\n\ -spi\n\ -spi --del \n\ -spi --ip4 --src --dst \n\ -spi --ip6 --src --dst \n\ -spi --ah [ ][ --replay_window ] --authkey \n\ - where is one of: hmac-md5-96 | hmac-sha1-96\n\ -spi --esp [ ][ --replay_window ] --enckey --authkey \n\ - where is one of: 3des-md5-96 | 3des-sha1-96\n\ -spi --esp [ ][ --replay_window ] --enckey \n\ - where is: 3des\n\ -spi --comp \n\ - where is: deflate\n\ -[ --debug ] is optional to any spi command.\n\ -[ --label