|
 |
049c96 |
From b213961bb74c8de4d713504a7b4c9b20900f8f99 Mon Sep 17 00:00:00 2001
|
|
|
049c96 |
From: Phil Sutter <psutter@redhat.com>
|
|
|
049c96 |
Date: Tue, 23 Feb 2016 18:24:36 +0100
|
|
|
049c96 |
Subject: [PATCH] xfrm: revise man page and document ip xfrm policy set
|
|
|
049c96 |
|
|
|
049c96 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1212026
|
|
|
049c96 |
Upstream Status: commit 811aca044859a
|
|
|
049c96 |
Conflicts: Context changed due to already applied commit b6ec53e3008aa
|
|
|
049c96 |
("xfrmmonitor: allows to monitor in several netns")
|
|
|
049c96 |
|
|
|
049c96 |
commit 811aca044859aed2802f4449023fcb4d30275625
|
|
|
049c96 |
Author: Christophe Gouault <christophe.gouault@6wind.com>
|
|
|
049c96 |
Date: Thu Apr 9 17:39:33 2015 +0200
|
|
|
049c96 |
|
|
|
049c96 |
xfrm: revise man page and document ip xfrm policy set
|
|
|
049c96 |
|
|
|
049c96 |
- document ip xfrm policy set
|
|
|
049c96 |
- update ip xfrm monitor documentation
|
|
|
049c96 |
- in DESCRIPTION section, reorganize grouping of commands
|
|
|
049c96 |
|
|
|
049c96 |
Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com>
|
|
|
049c96 |
---
|
|
|
049c96 |
man/man8/ip-xfrm.8 | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++++--
|
|
|
049c96 |
1 file changed, 59 insertions(+), 2 deletions(-)
|
|
|
049c96 |
|
|
|
049c96 |
diff --git a/man/man8/ip-xfrm.8 b/man/man8/ip-xfrm.8
|
|
|
049c96 |
index 3752c7e..aea4fda 100644
|
|
|
049c96 |
--- a/man/man8/ip-xfrm.8
|
|
|
049c96 |
+++ b/man/man8/ip-xfrm.8
|
|
|
049c96 |
@@ -252,6 +252,13 @@ ip-xfrm \- transform configuration
|
|
|
049c96 |
.B "ip xfrm policy count"
|
|
|
049c96 |
|
|
|
049c96 |
.ti -8
|
|
|
049c96 |
+.B "ip xfrm policy set"
|
|
|
049c96 |
+.RB "[ " hthresh4
|
|
|
049c96 |
+.IR LBITS " " RBITS " ]"
|
|
|
049c96 |
+.RB "[ " hthresh6
|
|
|
049c96 |
+.IR LBITS " " RBITS " ]"
|
|
|
049c96 |
+
|
|
|
049c96 |
+.ti -8
|
|
|
049c96 |
.IR SELECTOR " :="
|
|
|
049c96 |
.RB "[ " src
|
|
|
049c96 |
.IR ADDR "[/" PLEN "] ]"
|
|
|
049c96 |
@@ -359,6 +366,13 @@ ip-xfrm \- transform configuration
|
|
|
049c96 |
|
|
|
|
049c96 |
.IR LISTofXFRM-OBJECTS " ]"
|
|
|
049c96 |
|
|
|
049c96 |
+.ti -8
|
|
|
049c96 |
+.IR LISTofXFRM-OBJECTS " := [ " LISTofXFRM-OBJECTS " ] " XFRM-OBJECT
|
|
|
049c96 |
+
|
|
|
049c96 |
+.ti -8
|
|
|
049c96 |
+.IR XFRM-OBJECT " := "
|
|
|
049c96 |
+.BR acquire " | " expire " | " SA " | " policy " | " aevent " | " report
|
|
|
049c96 |
+
|
|
|
049c96 |
.in -8
|
|
|
049c96 |
.ad b
|
|
|
049c96 |
|
|
|
049c96 |
@@ -384,7 +398,6 @@ ip xfrm state deleteall delete all existing state in xfrm
|
|
|
049c96 |
ip xfrm state list print out the list of existing state in xfrm
|
|
|
049c96 |
ip xfrm state flush flush all state in xfrm
|
|
|
049c96 |
ip xfrm state count count all existing state in xfrm
|
|
|
049c96 |
-ip xfrm monitor state monitoring for xfrm objects
|
|
|
049c96 |
.TE
|
|
|
049c96 |
|
|
|
049c96 |
.TP
|
|
|
049c96 |
@@ -506,7 +519,9 @@ encapsulates packets with protocol
|
|
|
049c96 |
.BR espinudp " or " espinudp-nonike ","
|
|
|
049c96 |
.RI "using source port " SPORT ", destination port " DPORT
|
|
|
049c96 |
.RI ", and original address " OADDR "."
|
|
|
049c96 |
+
|
|
|
049c96 |
.sp
|
|
|
049c96 |
+.PP
|
|
|
049c96 |
.TS
|
|
|
049c96 |
l l.
|
|
|
049c96 |
ip xfrm policy add add a new policy
|
|
|
049c96 |
@@ -516,7 +531,6 @@ ip xfrm policy get get an existing policy
|
|
|
049c96 |
ip xfrm policy deleteall delete all existing xfrm policies
|
|
|
049c96 |
ip xfrm policy list print out the list of xfrm policies
|
|
|
049c96 |
ip xfrm policy flush flush policies
|
|
|
049c96 |
-ip xfrm policy count count existing policies
|
|
|
049c96 |
.TE
|
|
|
049c96 |
|
|
|
049c96 |
.TP
|
|
|
049c96 |
@@ -611,6 +625,47 @@ and inbound trigger
|
|
|
049c96 |
can be
|
|
|
049c96 |
.BR required " (default) or " use "."
|
|
|
049c96 |
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.PP
|
|
|
049c96 |
+.TS
|
|
|
049c96 |
+l l.
|
|
|
049c96 |
+ip xfrm policy count count existing policies
|
|
|
049c96 |
+.TE
|
|
|
049c96 |
+
|
|
|
049c96 |
+.PP
|
|
|
049c96 |
+Use one or more -s options to display more details, including policy hash table
|
|
|
049c96 |
+information.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.PP
|
|
|
049c96 |
+.TS
|
|
|
049c96 |
+l l.
|
|
|
049c96 |
+ip xfrm policy set configure the policy hash table
|
|
|
049c96 |
+.TE
|
|
|
049c96 |
+
|
|
|
049c96 |
+.PP
|
|
|
049c96 |
+Security policies whose address prefix lengths are greater than or equal
|
|
|
049c96 |
+policy hash table thresholds are hashed. Others are stored in the
|
|
|
049c96 |
+policy_inexact chained list.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.TP
|
|
|
049c96 |
+.I LBITS
|
|
|
049c96 |
+specifies the minimum local address prefix length of policies that are
|
|
|
049c96 |
+stored in the Security Policy Database hash table.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.TP
|
|
|
049c96 |
+.I RBITS
|
|
|
049c96 |
+specifies the minimum remote address prefix length of policies that are
|
|
|
049c96 |
+stored in the Security Policy Database hash table.
|
|
|
049c96 |
+
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.PP
|
|
|
049c96 |
+.TS
|
|
|
049c96 |
+l l.
|
|
|
049c96 |
+ip xfrm monitor state monitoring for xfrm objects
|
|
|
049c96 |
+.TE
|
|
|
049c96 |
+
|
|
|
049c96 |
+.PP
|
|
|
049c96 |
The xfrm objects to monitor can be optionally specified.
|
|
|
049c96 |
|
|
|
049c96 |
.P
|
|
|
049c96 |
@@ -629,4 +684,6 @@ originates. Example:
|
|
|
049c96 |
.SH AUTHOR
|
|
|
049c96 |
Manpage revised by David Ward <david.ward@ll.mit.edu>
|
|
|
049c96 |
.br
|
|
|
049c96 |
+Manpage revised by Christophe Gouault <christophe.gouault@6wind.com>
|
|
|
049c96 |
+.br
|
|
|
049c96 |
Manpage revised by Nicolas Dichtel <nicolas.dichtel@6wind.com>
|
|
|
049c96 |
--
|
|
|
049c96 |
1.8.3.1
|
|
|
049c96 |
|