调用IPsec实用程序

命令语法格式

ipsec command [arguments] [options]

命令描述

命令ipsec会调用控制和监视IPsec加密/身份验证系统所涉及的几个实用程序中的任何一个，使用指定的参数（arguments）和选项（options）运行指定的命令（command），就像它已被直接调用一样。 这在很大程度上消除了与其他软件可能的命名冲突，并且还允许一些集中式服务。

命令行命令

本手册页中描述的所有命令都是内置的，用于控制和监视IPsec连接以及IKE守护程序。

对于其他命令，ipsec为调用的命令提供合适的PATH环境变量，并提供「相关环境变量」部分中列出的环境变量。

CONTROL COMMANDS

start [starter options]
calls starter which in turn parses ipsec.conf and starts the IKE daemon charon.

update
sends a HUP signal to starter which in turn determines any changes in ipsec.conf and updates the configuration on the running IKE daemon charon.

reload
sends a USR1 signal to starter which in turn reloads the whole configuration of the running IKE daemon charon based on the actual ipsec.conf.

restart
is equivalent to stop followed by start after a guard of 2 seconds.

stop
terminates all IPsec connections and stops the IKE daemon charon by sending a TERM signal to starter.

up name
tells the IKE daemon to start up connection name.

down name
tells the IKE daemon to terminate connection name.

down name{n}
terminates IKEv1 Quick Mode and IKEv2 CHILD SA instance n of connection name.

down name{*}
terminates all IKEv1 Quick Mode and IKEv2 CHILD SA instances of connection name.

down name[n]
terminates IKE SA instance n of connection name.

down name[*]
terminates all IKE SA instances of connection name.

down-srcip <start> [<end>]
terminates all IKE SA instances with clients having virtual IPs in the range start-end.

route name
tells the IKE daemon to insert an IPsec policy in the kernel for connection name. The first payload packet matching the IPsec policy will automatically trigger an IKE connection setup.

unroute name
remove the IPsec policy in the kernel for connection name.

status [name]
returns concise status information either on connection name or if the argument is lacking, on all connections.

statusall [name]
returns detailed status information either on connection name or if the argument is lacking, on all connections.

LIST COMMANDS

leases [<poolname> [<address>]]
returns the status of all or the selected IP address pool (or even a single virtual IP address).

listalgs
returns a list supported cryptographic algorithms usable for IKE, and their corresponding plugin.

listpubkeys [–utc]
returns a list of RSA public keys that were either loaded in raw key format or extracted from X.509 and|or OpenPGP certificates.

listcerts [–utc]
returns a list of X.509 and|or OpenPGP certificates that were either loaded locally by the IKE daemon or received via the IKE protocol.

listcacerts [–utc]
returns a list of X.509 Certification Authority (CA) certificates that were loaded locally by the IKE daemon from the /etc/ipsec.d/cacerts/ directory or received via the IKE protocol.

listaacerts [–utc]
returns a list of X.509 Authorization Authority (AA) certificates that were loaded locally by the IKE daemon from the /etc/ipsec.d/aacerts/ directory.

listocspcerts [–utc]
returns a list of X.509 OCSP Signer certificates that were either loaded locally by the IKE daemon from the /etc/ipsec.d/ocspcerts/ directory or were sent by an OCSP server.

listacerts [–utc]
returns a list of X.509 Attribute certificates that were loaded locally by the IKE daemon from the /etc/ipsec.d/acerts/ directory.

listgroups [–utc]
returns a list of groups that are used to define user authorization profiles.

listcainfos [–utc]
returns certification authority information (CRL distribution points, OCSP URIs, LDAP servers) that were defined by ca sections in ipsec.conf.

listcrls [–utc]
returns a list of Certificate Revocation Lists (CRLs) that were either loaded by the IKE daemon from the /etc/ipsec.d/crls directory or fetched from an HTTP- or LDAP-based CRL distribution point.

listocsp [–utc]
returns revocation information fetched from OCSP servers.

listplugins
returns a list of all loaded plugin features.

listcounters [name]
returns a list of global or connection specific IKE counter values collected since daemon startup.

listall [–utc]
returns all information generated by the list commands above. Each list command can be called with the –utc option which displays all dates in UTC instead of local time.

REREAD COMMANDS

rereadsecrets
flushes and rereads all secrets defined in ipsec.secrets.

rereadcacerts
removes previously loaded CA certificates, reads all certificate files contained in the /etc/ipsec.d/cacerts directory and adds them to the list of Certification Authority (CA) certificates. This does not affect certificates explicitly defined in a ipsec.conf(5) ca section, which may be separately updated using the update command.

rereadaacerts
removes previously loaded AA certificates, reads all certificate files contained in the /etc/ipsec.d/aacerts directory and adds them to the list of Authorization Authority (AA) certificates.

rereadocspcerts
reads all certificate files contained in the /etc/ipsec.d/ocspcerts/ directory and adds them to the list of OCSP signer certificates.

rereadacerts
reads all certificate files contained in the /etc/ipsec.d/acerts/ directory and adds them to the list of attribute certificates.

rereadcrls
reads all Certificate Revocation Lists (CRLs) contained in the /etc/ipsec.d/crls/ directory and adds them to the list of CRLs.

rereadall
executes all reread commands listed above.

RESET COMMANDS

resetcounters [name]
resets global or connection specific counters.

PURGE COMMANDS

purgecerts
purges all cached certificates.

purgecrls
purges all cached CRLs.

purgeike
purges IKE SAs that don’t have a Quick Mode or CHILD SA.

purgeocsp
purges all cached OCSP information records.

INFO COMMANDS

–help
显示ipsec命令的帮助信息。

–version
如果strongSwan使用其运行的Linux内核的本机NETKEY IPsec堆栈，则以”Linux strongSwan U<strongSwan userland version>/K<Linux kernel version>“的形式返回版本。

–versioncode
如果strongSwan使用其运行的Linux内核的本机NETKEY IPsec堆栈，则以”U<strongSwan userland version>/K<Linux kernel version>“的形式返回版本号。

–copyright
返回版权信息。

–directory
返回configure选项定义的LIBEXECDIR目录。

–confdir
返回configure选项定义的SYSCONFDIR目录。

–piddir
返回configure选项定义的PIDDIR目录。

相关文件

/usr/libexec/ipsec
utilities directory

相关环境变量

When calling other commands the ipsec command supplies the following environment variables.

IPSEC_DIR directory containing ipsec programs and utilities
IPSEC_BINDIR directory containing pki command
IPSEC_SBINDIR directory containing ipsec command
IPSEC_CONFDIR directory containing configuration files
IPSEC_PIDDIR directory containing PID/socket files
IPSEC_SCRIPT name of the ipsec script
IPSEC_NAME name of ipsec distribution
IPSEC_VERSION version number of ipsec userland and kernel
IPSEC_STARTER_PID PID file for ipsec starter
IPSEC_CHARON_PID PID file for IKE keying daemon

相关手册

ipsec.conf(5), ipsec.secrets(5)

参考文献

• man 8 ipsec, Version 5.7.1-1

更新日志

• 11/02/2018 创建文章