1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
|
.\" $NetBSD: racoonctl.8,v 1.13 2006/09/09 16:22:10 manu Exp $
.\"
.\" Id: racoonctl.8,v 1.6 2006/05/07 21:32:59 manubsd Exp
.\"
.\" Copyright (C) 2004 Emmanuel Dreyfus
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in the
.\" documentation and/or other materials provided with the distribution.
.\" 3. Neither the name of the project nor the names of its contributors
.\" may be used to endorse or promote products derived from this software
.\" without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.Dd November 16, 2004
.Dt RACOONCTL 8
.Os
.\"
.Sh NAME
.Nm racoonctl
.Nd racoon administrative control tool
.\"
.Sh SYNOPSIS
.Nm
reload-config
.Nm
show-schedule
.Nm
.Op Fl l Op Fl l
show-sa
.Op isakmp|esp|ah|ipsec
.Nm
flush-sa
.Op isakmp|esp|ah|ipsec
.Nm
delete-sa
.Ar saopts
.Nm
establish-sa
.Op Fl u Ar identity
.Ar saopts
.Nm
vpn-connect
.Op Fl u identity
.Ar vpn_gateway
.Nm
vpn-disconnect
.Ar vpn_gateway
.Nm
show-event
.Op Fl l
.Nm
logout-user
.Ar login
.\"
.Sh DESCRIPTION
.Nm
is used to control
.Xr racoon 8
operation, if ipsec-tools was configured with adminport support.
Communication between
.Nm
and
.Xr racoon 8
is done through a UNIX socket.
By changing the default mode and ownership
of the socket, you can allow non-root users to alter
.Xr racoon 8
behavior, so do that with caution.
.Pp
The following commands are available:
.Bl -tag -width Ds
.It reload-config
This should cause
.Xr racoon 8
to reload its configuration file.
.It show-schedule
Unknown command.
.It show-sa Op isakmp|esp|ah|ipsec
Dump the SA: All the SAs if no SA class is provided, or either ISAKMP SAs,
IPsec ESP SAs, IPsec AH SAs, or all IPsec SAs.
Use
.Fl l
to increase verbosity.
.It flush-sa Op isakmp|esp|ah|ipsec
is used to flush all SAs if no SA class is provided, or a class of SAs,
either ISAKMP SAs, IPsec ESP SAs, IPsec AH SAs, or all IPsec SAs.
.It Xo establish-sa
.Oo Fl u Ar username
.Oc Ar saopts
.Xc
Establish an SA, either an ISAKMP SA, IPsec ESP SA, or IPsec AH SA.
The optional
.Fl u Ar username
can be used when establishing an ISAKMP SA while hybrid auth is in use.
.Nm
will prompt you for the password associated with
.Ar username
and these credentials will be used in the Xauth exchange.
.Pp
.Ar saopts
has the following format:
.Bl -tag -width Bl
.It isakmp {inet|inet6} Ar src Ar dst
.It {esp|ah} {inet|inet6} Ar src/prefixlen/port Ar dst/prefixlen/port
{icmp|tcp|udp|any}
.El
.It Xo vpn-connect
.Oo Fl u Ar username
.Oc Ar vpn_gateway
.Xc
This is a particular case of the previous command.
It will establish an ISAKMP SA with
.Ar vpn_gateway .
.It delete-sa Ar saopts
Delete an SA, either an ISAKMP SA, IPsec ESP SA, or IPsec AH SA.
.It vpn-disconnect Ar vpn_gateway
This is a particular case of the previous command.
It will kill all SAs associated with
.Ar vpn_gateway .
.It show-event Op Fl l
Dump all events reported by
.Xr racoon 8 ,
then quit.
The
.Fl l
flag causes
.Nm
to not stop once all the events have been read, but rather to loop
awaiting and reporting new events.
.It logout-user Ar login
Delete all SA established on behalf of the Xauth user
.Ar login .
.El
.Pp
Command shortcuts are available:
.Bl -tag -width XXX -compact -offset indent
.It rc
reload-config
.It ss
show-sa
.It sc
show-schedule
.It fs
flush-sa
.It ds
delete-sa
.It es
establish-sa
.It vc
vpn-connect
.It vd
vpn-disconnect
.It se
show-event
.It lu
logout-user
.El
.\"
.Sh RETURN VALUES
The command should exit with 0 on success, and non-zero on errors.
.\"
.Sh FILES
.Bl -tag -width 30n -compact
.It Pa /var/racoon/racoon.sock No or
.It Pa /var/run/racoon.sock
.Xr racoon 8
control socket.
.El
.\"
.Sh SEE ALSO
.Xr ipsec 4 ,
.Xr racoon 8
.Sh HISTORY
Once was
.Ic kmpstat
in the KAME project.
It turned into
.Nm
but remained undocumented for a while.
.An Emmanuel Dreyfus Aq manu@NetBSD.org
wrote this man page.
|
