1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
|
.\" $OpenBSD: startkey.1,v 1.7 2000/03/18 22:56:05 aaron Exp $
.\"
.\" Copyright 1997 Niels Provos <provos@physnet.uni-hamburg.de>
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in the
.\" documentation and/or other materials provided with the distribution.
.\" 3. All advertising materials mentioning features or use of this software
.\" must display the following acknowledgement:
.\" This product includes software developed by Niels Provos.
.\" 4. The name of the author may not be used to endorse or promote products
.\" derived from this software without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" Manual page, using -mandoc macros
.\"
.Dd July 18, 1997
.Dt STARTKEY 1
.Os
.Sh NAME
.Nm startkey
.Nd start keying with photurisd
.Sh SYNOPSIS
.Nm startkey
.Op Fl d Ar directory
.Ar options ...
.Sh DESCRIPTION
The
.Nm
utility attempts to contact the
.Xr photurisd 8
daemon and initialize a key exchange.
The flags are:
.Bl -tag -width Ds
.It Fl d Ar directory
The
.Fl d
option specifies the directory in which
.Xr photurisd
looks for its startup files.
The default is
.Pa /etc/photuris/ .
.El
.Pp
The options
.Ic dst ,
.Ic port ,
.Ic options ,
.Ic tsrc ,
.Ic tdst ,
.Ic exchange_lifetime ,
.Ic spi_lifetime
and
.Ic user
are understood by the daemon.
The meanings are as follows:
.Bl -tag -width options -offset indent
.It Ic dst
The destination IP address with which the exchange is to be established.
.It Ic port
The port number of the destination
.Xr photuris
daemon.
.It Ic options
The options to be used in the exchange.
Possible values are
.Dq enc
and
.Dq auth .
.It Ic tsrc
If both
.Ic tsrc
and
.Ic tdst
(see below) are specified, a tunnel (IP over IP) is setup.
The
.Ic tsrc
option is a network address with netmask used for matching the source
IP address of a packet.
When both the source and the destination
addresses match their respective options the packet will be routed into the
tunnel.
.It Ic tdst
If both
.Ic tsrc
(see above) and
.Ic tdst
are specified, a tunnel (IP over IP) is setup.
The
.Ic tdst
option is a network address with netmask used for matching the destination
IP address of a packet.
When both the source and the destination
addresses match their respective options the packet will be routed into the
tunnel.
.It Ic exchange_lifetime
Determines the lifetime of the exchange.
After an exchange expires
no new SPIs are created, which means the transport or tunnel is torn down
as soon as the current SPI times out (see
.Ic spi_lifetime
below).
The default value is gotten from the
.Ic exchange_lifetime
parameter given in
.Pa photuris.conf .
If it is not given there the default is 1800 seconds.
.It Ic spi_lifetime
Determines the lifetime of each created SPI in the exchange.
.It Ic user
The user name for whom the keying shall be done.
Preconfigured secrets are taken from the users secret file.
.El
.Sh EXAMPLE
startkey dst=169.200.12.23 options=auth
.Sh FILES
.Bl -tag -width /etc/photuris/photuris.pipe -compact
.It Pa /etc/photuris/photuris.pipe
FIFO in which keying requests are written
.El
.Sh SEE ALSO
.Xr photurisd 8
|
