doc/manpage.d/ipsec_spi.5.html

   1 Content-type: text/html
   2
   3 <HTML><HEAD><TITLE>Manpage of IPSEC_SPI</TITLE>
   4 </HEAD><BODY>
   5 <H1>IPSEC_SPI</H1>
   6 Section: File Formats (5)<BR>Updated: 26 Jun 2000<BR><A HREF="#index">Index</A>
   7 <A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
   8
   9
  10
  11
  12 <A NAME="lbAB">&nbsp;</A>
  13 <H2>NAME</H2>
  14
  15 ipsec_spi - list IPSEC Security Associations
  16 <A NAME="lbAC">&nbsp;</A>
  17 <H2>SYNOPSIS</H2>
  18
  19 <B>ipsec</B>
  20
  21 <B>spi</B>
  22
  23 <P>
  24
  25 <B>cat</B>
  26
  27 <B>/proc/net/ipsec_spi</B>
  28
  29 <P>
  30
  31 <A NAME="lbAD">&nbsp;</A>
  32 <H2>DESCRIPTION</H2>
  33
  34 <I>/proc/net/ipsec_spi</I>
  35
  36 is a read-only file that lists the current IPSEC Security Associations.
  37 A Security Association (SA) is a transform through which packet contents
  38 are to be processed before being forwarded.  A transform can be an
  39 IPv4-in-IPv4 or IPv6-in-IPv6 encapsulation, an IPSEC Authentication Header (authentication
  40 with no encryption), or an IPSEC Encapsulation Security Payload
  41 (encryption, possibly including authentication).
  42 <P>
  43
  44 When a packet is passed from a higher networking layer through an IPSEC
  45 virtual interface, a search in the extended routing table (see
  46 <I><A HREF="ipsec_eroute.5.html">ipsec_eroute</A></I>(5))
  47
  48 yields
  49 a IP protocol number
  50 ,
  51 a Security Parameters Index (SPI)
  52 and
  53 an effective destination address
  54 When an IPSEC packet arrives from the network,
  55 its ostensible destination, an SPI and an IP protocol
  56 specified by its outermost IPSEC header are used.
  57 The destination/SPI/protocol combination is used to select a relevant SA.
  58 (See
  59 <I><A HREF="ipsec_spigrp.5.html">ipsec_spigrp</A></I>(5)
  60
  61 for discussion of how multiple transforms are combined.)
  62 <P>
  63
  64 An
  65 <I>spi ,</I>
  66
  67 <I>proto, </I>
  68
  69 <I>daddr</I>
  70
  71 and
  72 <I>address_family</I>
  73
  74 arguments specify an SAID.
  75 <I>Proto</I>
  76
  77 is an ASCII string, &quot;ah&quot;, &quot;esp&quot;, &quot;comp&quot; or &quot;tun&quot;, specifying the IP protocol.
  78 <I>Spi</I>
  79
  80 is a number, preceded by '.' indicating hexadecimal and IPv4 or by ':' indicating hexadecimal and IPv6,
  81 where each hexadecimal digit represents 4 bits,
  82 between
  83 <B>0x100</B>
  84
  85 and
  86 <B>0xffffffff</B>;
  87
  88 values from
  89 <B>0x0</B>
  90
  91 to
  92 <B>0xff</B>
  93
  94 are reserved.
  95 <I>Daddr</I>
  96
  97 is a dotted-decimal IPv4 destination address or a coloned hex IPv6 destination address.
  98 <P>
  99
 100 An
 101 <I>SAID</I>
 102
 103 combines the three parameters above, such as: &quot;<A HREF="mailto:tun.101@1.2.3.4">tun.101@1.2.3.4</A>&quot; for IPv4 or &quot;tun:<A HREF="mailto:101@3049">101@3049</A>:1::1&quot; for IPv6
 104 <P>
 105
 106 A table entry consists of:
 107 <DL COMPACT>
 108 <DT>+<DD>
 109 <B>SAID</B>
 110
 111 <DT>+<DD>
 112 &lt;transform name (proto,encalg,authalg)&gt;:
 113 <DT>+<DD>
 114 direction (dir=)
 115 <DT>+<DD>
 116 source address (src=)
 117 <DT>+<DD>
 118 source and destination addresses and masks for inner header policy check
 119 addresses (policy=), as dotted-quads or coloned hex, separated by '-&gt;',
 120 for IPv4-in-IPv4 or IPv6-in-IPv6 SAs only
 121 <DT>+<DD>
 122 initialisation vector length and value (iv_bits=, iv=) if non-zero
 123 <DT>+<DD>
 124 out-of-order window size, number of out-of-order errors, sequence
 125 number, recently received packet bitmask, maximum difference between
 126 sequence numbers (ooowin=, ooo_errs=, seq=, bit=, max_seq_diff=) if SA
 127 is AH or ESP and if individual items are non-zero
 128 <DT>+<DD>
 129 extra flags (flags=) if any are set
 130 <DT>+<DD>
 131 authenticator length in bits (alen=) if non-zero
 132 <DT>+<DD>
 133 authentication key length in bits (aklen=) if non-zero
 134 <DT>+<DD>
 135 authentication errors (auth_errs=) if non-zero
 136 <DT>+<DD>
 137 encryption key length in bits (eklen=) if non-zero
 138 <DT>+<DD>
 139 encryption size errors (encr_size_errs=) if non-zero
 140 <DT>+<DD>
 141 encryption padding error warnings (encr_pad_errs=) if non-zero
 142 <DT>+<DD>
 143 lifetimes legend, c=Current status, s=Soft limit when exceeded will
 144 initiate rekeying, h=Hard limit will cause termination of SA (life(c,s,h)=)
 145 <DT>+<DD>
 146 number of connections to which the SA is allocated (c), that will cause a
 147 rekey (s), that will cause an expiry (h) (alloc=), if any value is non-zero
 148 <DT>+<DD>
 149 number of bytes processesd by this SA (c), that will cause a rekey (s), that
 150 will cause an expiry (h) (bytes=), if any value is non-zero
 151 <DT>+<DD>
 152 time since the SA was added (c), until rekey (s), until expiry (h), in seconds (add=)
 153 <DT>+<DD>
 154 time since the SA was first used (c), until rekey (s), until expiry (h), in seconds (used=),
 155 if any value is non-zero
 156 <DT>+<DD>
 157 number of packets processesd by this SA (c), that will cause a rekey (s), that
 158 will cause an expiry (h) (packets=), if any value is non-zero
 159 <DT>+<DD>
 160 time since the last packet was processed, in seconds (idle=), if SA has
 161 been used
 162 <DT><DD>
 163 average compression ratio (ratio=)
 164 </DL>
 165 <A NAME="lbAE">&nbsp;</A>
 166 <H2>EXAMPLES</H2>
 167
 168 <B><A HREF="mailto:tun.12a@192.168.43.1">tun.12a@192.168.43.1</A> IPIP: dir=out src=192.168.43.2</B>
 169
 170 <BR>
 171
 172 <B>      life(c,s,h)=bytes(14073,0,0)add(269,0,0)</B>
 173
 174 <BR>
 175
 176 <B>      use(149,0,0)packets(14,0,0)</B>
 177
 178 <BR>
 179
 180 <B>      idle=23</B>
 181
 182 <P>
 183
 184 is an outbound IPv4-in-IPv4 (protocol 4) tunnel-mode SA set up between machines
 185 192.168.43.2 and 192.168.43.1 with an SPI of 12a in hexadecimal that has
 186 passed about 14 kilobytes of traffic in 14 packets since it was created,
 187 269 seconds ago, first used 149 seconds ago and has been idle for 23
 188 seconds.
 189 <P>
 190
 191 <B>esp:<A HREF="mailto:9a35fc02@3049">9a35fc02@3049</A>:1::1 ESP_3DES_HMAC_MD5:</B>
 192
 193 <BR>
 194
 195 <B>      dir=in src=<A HREF="mailto:9a35fc02@3049">9a35fc02@3049</A>:1::2</B>
 196
 197 <BR>
 198
 199 <B>      ooowin=32 seq=7149 bit=0xffffffff</B>
 200
 201 <BR>
 202
 203 <B>      alen=128 aklen=128 eklen=192</B>
 204
 205 <BR>
 206
 207 <B>      life(c,s,h)=bytes(1222304,0,0)add(4593,0,0)</B>
 208
 209 <BR>
 210
 211 <B>      use(3858,0,0)packets(7149,0,0)</B>
 212
 213 <BR>
 214
 215 <B>      idle=23</B>
 216
 217 <P>
 218
 219 is an inbound Encapsulating Security Payload (protocol 50) SA on machine
 220 3049:1::1 with an SPI of 9a35fc02 that uses 3DES as the encryption
 221 cipher, HMAC MD5 as the authentication algorithm, an out-of-order
 222 window of 32 packets, a present sequence number of 7149, every one of
 223 the last 32 sequence numbers was received, the authenticator length and
 224 keys is 128 bits, the encryption key is 192 bits (actually 168 for 3DES
 225 since 1 of 8 bits is a parity bit), has passed 1.2 Mbytes of data in
 226 7149 packets, was added 4593 seconds ago, first used
 227 3858 seconds ago and has been idle for 23 seconds.
 228 <P>
 229
 230 <A NAME="lbAF">&nbsp;</A>
 231 <H2>FILES</H2>
 232
 233 /proc/net/ipsec_spi, /usr/local/bin/ipsec
 234 <A NAME="lbAG">&nbsp;</A>
 235 <H2>SEE ALSO</H2>
 236
 237 <A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8), <A HREF="ipsec_tncfg.5.html">ipsec_tncfg</A>(5), <A HREF="ipsec_eroute.5.html">ipsec_eroute</A>(5),
 238 <A HREF="ipsec_spigrp.5.html">ipsec_spigrp</A>(5), <A HREF="ipsec_klipsdebug.5.html">ipsec_klipsdebug</A>(5), <A HREF="ipsec_spi.8.html">ipsec_spi</A>(8), <A HREF="ipsec_version.5.html">ipsec_version</A>(5),
 239 <A HREF="ipsec_pf_key.5.html">ipsec_pf_key</A>(5)
 240 <A NAME="lbAH">&nbsp;</A>
 241 <H2>HISTORY</H2>
 242
 243 Written for the Linux FreeS/WAN project
 244 &lt;<A HREF="http://www.freeswan.org/">http://www.freeswan.org/</A>&gt;
 245 by Richard Guy Briggs.
 246 <A NAME="lbAI">&nbsp;</A>
 247 <H2>BUGS</H2>
 248
 249 The add and use times are awkward, displayed in seconds since machine
 250 start.  It would be better to display them in seconds before now for
 251 human readability.
 252
 253
 254
 255
 256
 257
 258
 259
 260
 261
 262
 263
 264
 265
 266
 267
 268
 269
 270
 271
 272
 273
 274
 275
 276
 277
 278
 279
 280
 281
 282
 283
 284
 285 <P>
 286
 287 <HR>
 288 <A NAME="index">&nbsp;</A><H2>Index</H2>
 289 <DL>
 290 <DT><A HREF="#lbAB">NAME</A><DD>
 291 <DT><A HREF="#lbAC">SYNOPSIS</A><DD>
 292 <DT><A HREF="#lbAD">DESCRIPTION</A><DD>
 293 <DT><A HREF="#lbAE">EXAMPLES</A><DD>
 294 <DT><A HREF="#lbAF">FILES</A><DD>
 295 <DT><A HREF="#lbAG">SEE ALSO</A><DD>
 296 <DT><A HREF="#lbAH">HISTORY</A><DD>
 297 <DT><A HREF="#lbAI">BUGS</A><DD>
 298 </DL>
 299 <HR>
 300 This document was created by
 301 <A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
 302 using the manual pages.<BR>
 303 Time: 21:40:18 GMT, November 11, 2003
 304 </BODY>
 305 </HTML>