diff options
| author | Christian Weisgerber <naddy@cvs.openbsd.org> | 2006-08-29 17:52:41 +0000 |
|---|---|---|
| committer | Christian Weisgerber <naddy@cvs.openbsd.org> | 2006-08-29 17:52:41 +0000 |
| commit | 1eea2b74c8f4515abd7c948dc126551b6634f826 (patch) | |
| tree | a65ce43e8f8a48b03572db6f6b8a2291703e1a01 /sbin/ipsecctl | |
| parent | 6902abaac8b7ea7eda926ed3ade0bd10893a5648 (diff) | |
Add support for IKE AH rules to ipsecctl. Man page input by jmc@.
ok hshoexer@
Diffstat (limited to 'sbin/ipsecctl')
| -rw-r--r-- | sbin/ipsecctl/ike.c | 57 | ||||
| -rw-r--r-- | sbin/ipsecctl/ipsec.conf.5 | 20 |
2 files changed, 49 insertions, 28 deletions
diff --git a/sbin/ipsecctl/ike.c b/sbin/ipsecctl/ike.c index 8b08170b460..1257e139e1f 100644 --- a/sbin/ipsecctl/ike.c +++ b/sbin/ipsecctl/ike.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ike.c,v 1.46 2006/07/21 12:34:52 hshoexer Exp $ */ +/* $OpenBSD: ike.c,v 1.47 2006/08/29 17:52:40 naddy Exp $ */ /* * Copyright (c) 2005 Hans-Joerg Hoexer <hshoexer@openbsd.org> * @@ -189,6 +189,9 @@ ike_section_qm(struct ipsec_addr_wrap *src, struct ipsec_addr_wrap *dst, case IPSEC_ESP: fprintf(fd, "ESP"); break; + case IPSEC_AH: + fprintf(fd, "AH"); + break; default: warnx("illegal satype %d", satype); return (-1); @@ -207,32 +210,38 @@ ike_section_qm(struct ipsec_addr_wrap *src, struct ipsec_addr_wrap *dst, } if (qmxfs && qmxfs->encxf) { - switch (qmxfs->encxf->id) { - case ENCXF_3DES_CBC: - fprintf(fd, "3DES"); - break; - case ENCXF_DES_CBC: - fprintf(fd, "DES"); - break; - case ENCXF_AES: - fprintf(fd, "AES"); - break; - case ENCXF_AESCTR: - fprintf(fd, "AESCTR"); - break; - case ENCXF_BLOWFISH: - fprintf(fd, "BLF"); - break; - case ENCXF_CAST128: - fprintf(fd, "CAST"); - break; - default: + if (satype == IPSEC_ESP) { + switch (qmxfs->encxf->id) { + case ENCXF_3DES_CBC: + fprintf(fd, "3DES"); + break; + case ENCXF_DES_CBC: + fprintf(fd, "DES"); + break; + case ENCXF_AES: + fprintf(fd, "AES"); + break; + case ENCXF_AESCTR: + fprintf(fd, "AESCTR"); + break; + case ENCXF_BLOWFISH: + fprintf(fd, "BLF"); + break; + case ENCXF_CAST128: + fprintf(fd, "CAST"); + break; + default: + warnx("illegal transform %s", + qmxfs->encxf->name); + return (-1); + } + fprintf(fd, "-"); + } else { warnx("illegal transform %s", qmxfs->encxf->name); return (-1); } - } else - fprintf(fd, "AES"); - fprintf(fd, "-"); + } else if (satype == IPSEC_ESP) + fprintf(fd, "AES-"); if (qmxfs && qmxfs->authxf) { switch (qmxfs->authxf->id) { diff --git a/sbin/ipsecctl/ipsec.conf.5 b/sbin/ipsecctl/ipsec.conf.5 index 98ea572233d..3e5bc2aceee 100644 --- a/sbin/ipsecctl/ipsec.conf.5 +++ b/sbin/ipsecctl/ipsec.conf.5 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ipsec.conf.5,v 1.60 2006/07/22 16:47:49 jmc Exp $ +.\" $OpenBSD: ipsec.conf.5,v 1.61 2006/08/29 17:52:40 naddy Exp $ .\" .\" Copyright (c) 2004 Mathieu Sauve-Frankel All rights reserved. .\" @@ -378,13 +378,14 @@ and .Sh AUTOMATIC KEYING USING ISAKMP/IKE Rules can also specify IPsec flows and SAs to be established automatically by .Xr isakmpd 8 . -This is accomplished by the following rule: +This is accomplished by the following rules: .Bl -tag -width xxxx .It Ic ike esp Creates an IPsec tunnel using ESP. +.It Ic ike ah +Creates an IPsec tunnel using AH. .El .Pp -Note that AH is not yet supported. See .Xr isakmpd 8 for details on ISAKMP/IKE. @@ -403,7 +404,6 @@ as symbolic host names, interface names or interface group names. .It Xo .Ic ike .Aq Ar mode -.Ic esp .Xc When .Ar passive @@ -430,6 +430,18 @@ If omitted, .Ar active mode will be used. .It Xo +.Aq Ar encap +.Xc +The encapsulation protocol to be used. +Possible protocols are +.Ar esp +and +.Ar ah . +The default is +.Ar esp . +For details on ESP and AH see +.Xr ipsec 4 . +.It Xo .Aq Ar tmode .Xc The encapsulation mode to be used can be specified. |