1IP-XFRM(8)                           Linux                          IP-XFRM(8)
2
3
4

NAME

6       ip-xfrm - transform configuration
7

SYNOPSIS

9       ip [ OPTIONS ] xfrm  { COMMAND | help }
10
11
12       ip xfrm XFRM-OBJECT { COMMAND | help }
13
14
15       XFRM-OBJECT := state | policy | monitor
16
17
18       ip xfrm state { add | update } ID [ ALGO-LIST ] [ mode MODE ] [ mark
19               MARK [ mask MASK ] ] [ reqid REQID ] [ seq SEQ ] [ replay-win‐
20               dow SIZE ] [ replay-seq SEQ ] [ replay-oseq SEQ ] [ replay-seq-
21               hi SEQ ] [ replay-oseq-hi SEQ ] [ flag FLAG-LIST ] [ sel SELEC‐
22               TOR ] [ LIMIT-LIST ] [ encap ENCAP ] [ coa ADDR[/PLEN] ] [ ctx
23               CTX ] [ extra-flag EXTRA-FLAG-LIST ]
24
25       ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ] [
26               reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]
27
28       ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]
29
30       ip xfrm state { deleteall | list } [ ID ] [ mode MODE ] [ reqid REQID ]
31               [ flag FLAG-LIST ]
32
33       ip xfrm state flush [ proto XFRM-PROTO ]
34
35       ip xfrm state count
36
37       ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]
38
39       XFRM-PROTO := esp | ah | comp | route2 | hao
40
41       ALGO-LIST := [ ALGO-LIST ] ALGO
42
43       ALGO := { enc | auth } ALGO-NAME ALGO-KEYMAT |
44               auth-trunc ALGO-NAME ALGO-KEYMAT ALGO-TRUNC-LEN |
45               aead ALGO-NAME ALGO-KEYMAT ALGO-ICV-LEN |
46               comp ALGO-NAME
47
48       MODE := transport | tunnel | beet | ro | in_trigger
49
50       FLAG-LIST := [ FLAG-LIST ] FLAG
51
52       FLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec |
53               align4 | esn
54
55       SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ]
56               [ UPSPEC ]
57
58       UPSPEC := proto { PROTO |
59               { tcp | udp | sctp | dccp } [ sport PORT ] [ dport PORT ] |
60               { icmp | ipv6-icmp | mobility-header } [ type NUMBER ] [ code
61               NUMBER ] |
62               gre [ key { DOTTED-QUAD | NUMBER } ] }
63
64       LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT
65
66       LIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SEC‐
67               ONDS |
68               { byte-soft | byte-hard } SIZE |
69               { packet-soft | packet-hard } COUNT
70
71       ENCAP := { espinudp | espinudp-nonike } SPORT DPORT OADDR
72
73       EXTRA-FLAG-LIST := [ EXTRA-FLAG-LIST ] EXTRA-FLAG
74
75       EXTRA-FLAG := dont-encap-dscp
76
77       ip xfrm policy { add | update } SELECTOR dir DIR [ ctx CTX ] [ mark
78               MARK [ mask MASK ] ] [ index INDEX ] [ ptype PTYPE ] [ action
79               ACTION ] [ priority PRIORITY ] [ flag FLAG-LIST ] [ LIMIT-LIST
80               ] [ TMPL-LIST ]
81
82       ip xfrm policy { delete | get } { SELECTOR | index INDEX } dir DIR [
83               ctx CTX ] [ mark MARK [ mask MASK ] ] [ ptype PTYPE ]
84
85       ip xfrm policy { deleteall | list } [ SELECTOR ] [ dir DIR ] [ index
86               INDEX ] [ ptype PTYPE ] [ action ACTION ] [ priority PRIORITY ]
87               [ flag FLAG-LIST]
88
89       ip xfrm policy flush [ ptype PTYPE ]
90
91       ip xfrm policy count
92
93       ip xfrm policy set [ hthresh4 LBITS RBITS ] [ hthresh6 LBITS RBITS ]
94
95       SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [
96               UPSPEC ]
97
98       UPSPEC := proto { PROTO |
99               { tcp | udp | sctp | dccp } [ sport PORT ] [ dport PORT ] |
100               { icmp | ipv6-icmp | mobility-header } [ type NUMBER ] [ code
101               NUMBER ] |
102               gre [ key { DOTTED-QUAD | NUMBER } ] }
103
104       DIR := in | out | fwd
105
106       PTYPE := main | sub
107
108       ACTION := allow | block
109
110       FLAG-LIST := [ FLAG-LIST ] FLAG
111
112       FLAG := localok | icmp
113
114       LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT
115
116       LIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SEC‐
117               ONDS |
118               { byte-soft | byte-hard } SIZE |
119               { packet-soft | packet-hard } COUNT
120
121       TMPL-LIST := [ TMPL-LIST ] tmpl TMPL
122
123       TMPL := ID [ mode MODE ] [ reqid REQID ] [ level LEVEL ]
124
125       ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]
126
127       XFRM-PROTO := esp | ah | comp | route2 | hao
128
129       MODE := transport | tunnel | beet | ro | in_trigger
130
131       LEVEL := required | use
132
133       ip xfrm monitor [ all-nsid ] [ all
134                | LISTofXFRM-OBJECTS ]
135
136       LISTofXFRM-OBJECTS := [ LISTofXFRM-OBJECTS ] XFRM-OBJECT
137
138       XFRM-OBJECT := acquire | expire | SA | policy | aevent | report
139
140
141

DESCRIPTION

143       xfrm is an IP framework for transforming packets  (such  as  encrypting
144       their payloads). This framework is used to implement the IPsec protocol
145       suite (with the state object  operating  on  the  Security  Association
146       Database,  and the policy object operating on the Security Policy Data‐
147       base). It is also used for the IP Payload Compression Protocol and fea‐
148       tures of Mobile IPv6.
149
150
151       ip xfrm state add         add new state into xfrm
152       ip xfrm state update      update existing state in xfrm
153       ip xfrm state allocspi    allocate an SPI value
154       ip xfrm state delete      delete existing state in xfrm
155       ip xfrm state get         get existing state in xfrm
156       ip xfrm state deleteall   delete all existing state in xfrm
157       ip xfrm state list        print out the list of existing state in xfrm
158       ip xfrm state flush       flush all state in xfrm
159       ip xfrm state count       count all existing state in xfrm
160
161
162       ID     is specified by a source address, destination address, transform
163              protocol XFRM-PROTO, and/or Security Parameter Index SPI.   (For
164              IP  Payload  Compression, the Compression Parameter Index or CPI
165              is used for SPI.)
166
167
168       XFRM-PROTO
169              specifies a transform  protocol:  IPsec  Encapsulating  Security
170              Payload (esp), IPsec Authentication Header (ah), IP Payload Com‐
171              pression (comp), Mobile IPv6 Type 2 Routing Header (route2),  or
172              Mobile IPv6 Home Address Option (hao).
173
174
175       ALGO-LIST
176              contains  one  or more algorithms to use. Each algorithm ALGO is
177              specified by:
178
179              ·      the  algorithm  type:  encryption  (enc),  authentication
180                     (auth or auth-trunc), authenticated encryption with asso‐
181                     ciated data (aead), or compression (comp)
182
183              ·      the algorithm name ALGO-NAME (see below)
184
185              ·      (for all except comp) the  keying  material  ALGO-KEYMAT,
186                     which  may  include both a key and a salt or nonce value;
187                     refer to the corresponding RFC
188
189              ·      (for auth-trunc only) the truncation  length  ALGO-TRUNC-
190                     LEN in bits
191
192              ·      (for  aead  only)  the Integrity Check Value length ALGO-
193                     ICV-LEN in bits
194
195              Encryption  algorithms   include   ecb(cipher_null),   cbc(des),
196              cbc(des3_ede),      cbc(cast5),     cbc(blowfish),     cbc(aes),
197              cbc(serpent),       cbc(camellia),       cbc(twofish),       and
198              rfc3686(ctr(aes)).
199
200              Authentication   algorithms   include   digest_null,  hmac(md5),
201              hmac(sha1),    hmac(sha256),     hmac(sha384),     hmac(sha512),
202              hmac(rmd160), and xcbc(aes).
203
204              Authenticated  encryption with associated data (AEAD) algorithms
205              include      rfc4106(gcm(aes)),      rfc4309(ccm(aes)),      and
206              rfc4543(gcm(aes)).
207
208              Compression algorithms include deflate, lzs, and lzjh.
209
210
211       MODE   specifies  a mode of operation for the transform protocol. IPsec
212              and IP Payload Compression modes are transport, tunnel, and (for
213              IPsec  ESP  only)  Bound  End-to-End Tunnel (beet).  Mobile IPv6
214              modes are route optimization (ro) and inbound trigger  (in_trig‐
215              ger).
216
217
218       FLAG-LIST
219              contains one or more of the following optional flags: noecn, de‐
220              cap-dscp, nopmtudisc, wildrecv, icmp, af-unspec, align4, or esn.
221
222
223       SELECTOR
224              selects the traffic that will be controlled by the policy, based
225              on  the source address, the destination address, the network de‐
226              vice, and/or UPSPEC.
227
228
229       UPSPEC selects traffic by protocol. For the tcp,  udp,  sctp,  or  dccp
230              protocols,  the  source  and  destination port can optionally be
231              specified.  For the icmp, ipv6-icmp, or  mobility-header  proto‐
232              cols,  the  type  and  code numbers can optionally be specified.
233              For the gre protocol, the key can optionally be specified  as  a
234              dotted-quad  or number.  Other protocols can be selected by name
235              or number PROTO.
236
237
238       LIMIT-LIST
239              sets limits in seconds, bytes, or numbers of packets.
240
241
242       ENCAP  encapsulates packets with protocol espinudp or  espinudp-nonike,
243              using  source  port SPORT, destination port DPORT , and original
244              address OADDR.
245
246
247
248       ip xfrm policy add         add a new policy
249       ip xfrm policy update      update an existing policy
250       ip xfrm policy delete      delete an existing policy
251       ip xfrm policy get         get an existing policy
252       ip xfrm policy deleteall   delete all existing xfrm policies
253       ip xfrm policy list        print out the list of xfrm policies
254       ip xfrm policy flush       flush policies
255
256
257       SELECTOR
258              selects the traffic that will be controlled by the policy, based
259              on  the source address, the destination address, the network de‐
260              vice, and/or UPSPEC.
261
262
263       UPSPEC selects traffic by protocol. For the tcp,  udp,  sctp,  or  dccp
264              protocols,  the  source  and  destination port can optionally be
265              specified.  For the icmp, ipv6-icmp, or  mobility-header  proto‐
266              cols,  the  type  and  code numbers can optionally be specified.
267              For the gre protocol, the key can optionally be specified  as  a
268              dotted-quad  or number.  Other protocols can be selected by name
269              or number PROTO.
270
271
272       DIR    selects the policy direction as in, out, or fwd.
273
274
275       CTX    sets the security context.
276
277
278       PTYPE  can be main (default) or sub.
279
280
281       ACTION can be allow (default) or block.
282
283
284       PRIORITY
285              is a number that defaults to zero.
286
287
288       FLAG-LIST
289              contains one or both of the following optional flags:  local  or
290              icmp.
291
292
293       LIMIT-LIST
294              sets limits in seconds, bytes, or numbers of packets.
295
296
297       TMPL-LIST
298              is  a template list specified using ID, MODE, REQID, and/or LEV‐
299              EL.
300
301
302       ID     is specified by a source address, destination address, transform
303              protocol  XFRM-PROTO, and/or Security Parameter Index SPI.  (For
304              IP Payload Compression, the Compression Parameter Index  or  CPI
305              is used for SPI.)
306
307
308       XFRM-PROTO
309              specifies  a  transform  protocol:  IPsec Encapsulating Security
310              Payload (esp), IPsec Authentication Header (ah), IP Payload Com‐
311              pression  (comp), Mobile IPv6 Type 2 Routing Header (route2), or
312              Mobile IPv6 Home Address Option (hao).
313
314
315       MODE   specifies a mode of operation for the transform protocol.  IPsec
316              and IP Payload Compression modes are transport, tunnel, and (for
317              IPsec ESP only) Bound End-to-End  Tunnel  (beet).   Mobile  IPv6
318              modes  are route optimization (ro) and inbound trigger (in_trig‐
319              ger).
320
321
322       LEVEL  can be required (default) or use.
323
324
325
326       ip xfrm policy count   count existing policies
327
328
329       Use one or more -s options to display more  details,  including  policy
330       hash table information.
331
332
333
334       ip xfrm policy set   configure the policy hash table
335
336
337       Security  policies  whose  address  prefix  lengths are greater than or
338       equal policy hash table thresholds are hashed. Others are stored in the
339       policy_inexact chained list.
340
341
342       LBITS  specifies  the  minimum  local address prefix length of policies
343              that are stored in the Security Policy Database hash table.
344
345
346       RBITS  specifies the minimum remote address prefix length  of  policies
347              that are stored in the Security Policy Database hash table.
348
349
350
351       ip xfrm monitor    state monitoring for xfrm objects
352
353
354       The xfrm objects to monitor can be optionally specified.
355
356
357       If  the  all-nsid  option  is  set,  the program listens to all network
358       namespaces that have a nsid assigned into the  network  namespace  were
359       the  program  is  running.   A  prefix is displayed to show the network
360       namespace where the message originates. Example:
361
362         [nsid 1]Flushed state proto 0
363
364
365

AUTHOR

367       Manpage revised by David Ward <david.ward@ll.mit.edu>
368       Manpage revised by Christophe Gouault <christophe.gouault@6wind.com>
369       Manpage revised by Nicolas Dichtel <nicolas.dichtel@6wind.com>
370
371
372
373iproute2                          20 Dec 2011                       IP-XFRM(8)
Impressum