# ip-xfrm

## NAME



           ip-xfrm - transform configuration
    


## SYNOPSIS



           **ip**[ _OPTIONS_ ] **xfrm**{ _COMMAND_ | **help**}
    
           **ip xfrm** _XFRM-OBJECT_ { _COMMAND_ | **help**}
    
           _XFRM-OBJECT_ := **state** | **policy** | **monitor**
    
           **ip xfrm state**{ **add** | **update**} _ID_ [ _ALGO-LIST_ ] [ **mode** _MODE_ ] [
                   **mark** _MARK_ [ **mask** _MASK_ ] ] [ **reqid** _REQID_ ] [ **dir** _SA-DIR_ ] [
                   **seq** _SEQ_ ] [ **replay-window** _SIZE_ ] [ **replay-seq** _SEQ_ ] [
                   **replay-oseq** _SEQ_ ] [ **replay-seq-hi** _SEQ_ ] [ **replay-oseq-hi**
                   _SEQ_ ] [ **flag** _FLAG-LIST_ ] [ **sel** _SELECTOR_ ] [ _LIMIT-LIST_ ] [
                   **encap** _ENCAP_ ] [ **coa** _ADDR_[/_PLEN_] ] [ **ctx** _CTX_ ] [ **extra-flag**
                   _EXTRA-FLAG-LIST_ ] [ **output-mark** _OUTPUT-MARK_ [ **mask** _MASK_ ]
                   ] [ **if_id** _IF-ID_ ] [ **offload**[ **crypto** |**packet**] dev _DEV_ dir
                   _DIR_ ] [ **tfcpad** _LENGTH_ ]
    
           **ip xfrm state allocspi** _ID_ [ **mode** _MODE_ ] [ **mark** _MARK_ [ **mask** _MASK_ ]
                   ] [ **reqid** _REQID_ ] [ **seq** _SEQ_ ] [ **min** _SPI_ **max** _SPI_ ]
    
           **ip xfrm state**{ **delete** | **get**} _ID_ [ **mark** _MARK_ [ **mask** _MASK_ ] ]
    
           **ip**[ **-4** | **-6**] **xfrm state deleteall**[ _ID_ ] [ **mode** _MODE_ ] [ **reqid**
                   _REQID_ ] [ **flag** _FLAG-LIST_ ]
    
           **ip**[ **-4** | **-6**] **xfrm state list**[ _ID_ ] [ **nokeys**] [ **mode** _MODE_ ] [
                   **reqid** _REQID_ ] [ **flag** _FLAG-LIST_ ]
    
           **ip xfrm state flush**[ **proto** _XFRM-PROTO_ ]
    
           **ip xfrm state count**
    
           _ID_ := [ **src** _ADDR_ ] [ **dst** _ADDR_ ] [ **proto** _XFRM-PROTO_ ] [ **spi** _SPI_ ]
    
           _XFRM-PROTO_ := **esp** | **ah** | **comp** | **route2** | **hao**
    
           _ALGO-LIST_ := [ _ALGO-LIST_ ] _ALGO_
    
           _ALGO_ := { **enc** | **auth**} _ALGO-NAME ALGO-KEYMAT_ |
                   **auth-trunc** _ALGO-NAME ALGO-KEYMAT ALGO-TRUNC-LEN_ |
                   **aead** _ALGO-NAME ALGO-KEYMAT ALGO-ICV-LEN_ |
                   **comp** _ALGO-NAME_
    
           _MODE_ := **transport** | **tunnel** | **beet** | **ro** | **in_trigger**
    
           _SA-DIR_ := **in** | **out**
    
           _FLAG-LIST_ := [ _FLAG-LIST_ ] _FLAG_
    
           _FLAG_ := **noecn** | **decap-dscp** | **nopmtudisc** | **wildrecv** | **icmp** | **af-**
                   **unspec** | **align4** | **esn**
    
           _SELECTOR_ := [ **src** _ADDR_[/_PLEN_] ] [ **dst** _ADDR_[/_PLEN_] ] [ **dev** _DEV_ ]
                   [ _UPSPEC_ ]
    
           _UPSPEC_ := **proto**{ _PROTO_ |
                   { **tcp** | **udp** | **sctp** | **dccp**} [ **sport** _PORT_ ] [ **dport** _PORT_ ]
                   |
                   { **icmp** | **ipv6-icmp** | **mobility-header**} [ **type** _NUMBER_ ] [
                   **code** _NUMBER_ ] |
                   **gre**[ **key**{ _DOTTED-QUAD_ | _NUMBER_ } ] }
    
           _LIMIT-LIST_ := [ _LIMIT-LIST_ ] **limit** _LIMIT_
    
           _LIMIT_ := { **time-soft** | **time-hard** | **time-use-soft** | **time-use-hard**}
                   _SECONDS_ |
                   { **byte-soft** | **byte-hard**} _SIZE_ |
                   { **packet-soft** | **packet-hard**} _COUNT_
    
           _ENCAP_ := { **espinudp** | **espinudp-nonike** | **espintcp**} _SPORT DPORT_
                   _OADDR_
    
           _EXTRA-FLAG-LIST_ := [ _EXTRA-FLAG-LIST_ ] _EXTRA-FLAG_
    
           _EXTRA-FLAG_ := **dont-encap-dscp** | **oseq-may-wrap**
    
           **ip xfrm policy**{ **add** | **update**} _SELECTOR_ **dir** _DIR_ [ **ctx** _CTX_ ] [
                   **mark** _MARK_ [ **mask** _MASK_ ] ] [ **index** _INDEX_ ] [ **ptype** _PTYPE_ ]
                   [ **action** _ACTION_ ] [ **priority** _PRIORITY_ ] [ **flag** _FLAG-LIST_ ]
                   [ **if_id** _IF-ID_ ] [ **offload** packet dev _DEV_ ] [ _LIMIT-LIST_ ]
                   [ _TMPL-LIST_ ]
    
           **ip xfrm policy**{ **delete** | **get**} { _SELECTOR_ | **index** _INDEX_ } **dir** _DIR_
                   [ **ctx** _CTX_ ] [ **mark** _MARK_ [ **mask** _MASK_ ] ] [ **ptype** _PTYPE_ ] [
                   **if_id** _IF-ID_ ]
    
           **ip**[ **-4** | **-6**] **xfrm policy**{ **deleteall** | **list**} [ **nosock**] [
                   _SELECTOR_ ] [ **dir** _DIR_ ] [ **index** _INDEX_ ] [ **ptype** _PTYPE_ ] [
                   **action** _ACTION_ ] [ **priority** _PRIORITY_ ] [ **flag** _FLAG-LIST_]
    
           **ip xfrm policy flush**[ **ptype** _PTYPE_ ]
    
           **ip xfrm policy count**
    
           **ip xfrm policy set**[ **hthresh4** _LBITS RBITS_ ] [ **hthresh6** _LBITS RBITS_
                   ]
    
           **ip xfrm policy setdefault** _DIR ACTION_ [ _DIR ACTION_ ] [ _DIR ACTION_ ]
    
           **ip xfrm policy getdefault**
    
           _SELECTOR_ := [ **src** _ADDR_[/_PLEN_] ] [ **dst** _ADDR_[/_PLEN_] ] [ **dev** _DEV_ ] [
                   _UPSPEC_ ]
    
           _UPSPEC_ := **proto**{ _PROTO_ |
                   { **tcp** | **udp** | **sctp** | **dccp**} [ **sport** _PORT_ ] [ **dport** _PORT_ ]
                   |
                   { **icmp** | **ipv6-icmp** | **mobility-header**} [ **type** _NUMBER_ ] [
                   **code** _NUMBER_ ] |
                   **gre**[ **key**{ _DOTTED-QUAD_ | _NUMBER_ } ] }
    
           _DIR_ := **in** | **out** | **fwd**
    
           _PTYPE_ := **main** | **sub**
    
           _ACTION_ := **allow** | **block**
    
           _FLAG-LIST_ := [ _FLAG-LIST_ ] _FLAG_
    
           _FLAG_ := **localok** | **icmp**
    
           _LIMIT-LIST_ := [ _LIMIT-LIST_ ] **limit** _LIMIT_
    
           _LIMIT_ := { **time-soft** | **time-hard** | **time-use-soft** | **time-use-hard**}
                   _SECONDS_ |
                   { **byte-soft** | **byte-hard**} _SIZE_ |
                   { **packet-soft** | **packet-hard**} _COUNT_
    
           _TMPL-LIST_ := [ _TMPL-LIST_ ] **tmpl** _TMPL_
    
           _TMPL_ := _ID_ [ **mode** _MODE_ ] [ **reqid** _REQID_ ] [ **level** _LEVEL_ ]
    
           _ID_ := [ **src** _ADDR_ ] [ **dst** _ADDR_ ] [ **proto** _XFRM-PROTO_ ] [ **spi** _SPI_ ]
    
           _XFRM-PROTO_ := **esp** | **ah** | **comp** | **route2** | **hao**
    
           _MODE_ := **transport** | **tunnel** | **beet** | **ro** | **in_trigger**
    
           _LEVEL_ := **required** | **use**
    
           **ip xfrm monitor**[ **all-nsid**] [ **nokeys**] [ **all**
                    | _LISTofXFRM-OBJECTS_ ]
    
           _LISTofXFRM-OBJECTS_ := [ _LISTofXFRM-OBJECTS_ ] _XFRM-OBJECT_
    
           _XFRM-OBJECT_ := **acquire** | **expire** | **SA** | **policy** | **aevent** | **report**
    


## DESCRIPTION



           xfrm  is  an  IP  framework  for  transforming  packets  (such  as
           encrypting their payloads). This framework is  used  to  implement
           the  IPsec  protocol suite (with the **state** object operating on the
           Security Association Database, and the **policy** object operating  on
           the  Security Policy Database). It is also used for the IP Payload
           Compression Protocol and features of Mobile IPv6.
    
           ip xfrm state add         add new state into xfrm
           ip xfrm state update      update existing state in xfrm
           ip xfrm state allocspi    allocate an SPI value
           ip xfrm state delete      delete existing state in xfrm
           ip xfrm state get         get existing state in xfrm
           ip xfrm state deleteall   delete all existing state in xfrm
           ip xfrm state list        print out the list of existing state in xfrm
           ip xfrm state flush       flush all state in xfrm
           ip xfrm state count       count all existing state in xfrm
    
           _ID_     is specified by a source address, destination address,
                  transform protocol _XFRM-PROTO_ , and/or Security Parameter
                  Index _SPI_.  (For IP Payload Compression, the Compression
                  Parameter Index or CPI is used for _SPI_.)
    
           _XFRM-PROTO_
                  specifies a transform protocol: IPsec Encapsulating
                  Security Payload (**esp**), IPsec Authentication Header (**ah**),
                  IP Payload Compression (**comp**), Mobile IPv6 Type 2 Routing
                  Header (**route2**), or Mobile IPv6 Home Address Option (**hao**).
    
           _ALGO-LIST_
                  contains one or more algorithms to use. Each algorithm _ALGO_
                  is specified by:
    
                  •      the algorithm type: encryption (**enc**), authentication
                         (**auth** or **auth-trunc**), authenticated encryption with
                         associated data (**aead**), or compression (**comp**)
    
                  •      the algorithm name _ALGO-NAME_ (see below)
    
                  •      (for all except **comp**) the keying material _ALGO-_
                         _KEYMAT_ , which may include both a key and a salt or
                         nonce value; refer to the corresponding RFC
    
                  •      (for **auth-trunc** only) the truncation length _ALGO-_
                         _TRUNC-LEN_ in bits
    
                  •      (for **aead** only) the Integrity Check Value length
                         _ALGO-ICV-LEN_ in bits
    
                  Encryption algorithms include **ecb(cipher_null)** , **cbc(des)** ,
                  **cbc(des3_ede)** , **cbc(cast5)** , **cbc(blowfish)** , **cbc(aes)** ,
                  **cbc(serpent)** , **cbc(camellia)** , **cbc(twofish)** , and
                  **rfc3686(ctr(aes))**.
    
                  Authentication algorithms include **digest_null** , **hmac(md5)** ,
                  **hmac(sha1)** , **hmac(sha256)** , **hmac(sha384)** , **hmac(sha512)** ,
                  **hmac(rmd160)** , and **xcbc(aes)**.
    
                  Authenticated encryption with associated data (AEAD)
                  algorithms include **rfc4106(gcm(aes))** , **rfc4309(ccm(aes))** ,
                  and **rfc4543(gcm(aes))**.
    
                  Compression algorithms include **deflate** , **lzs** , and **lzjh**.
    
           _MODE_   specifies a mode of operation for the transform protocol.
                  IPsec and IP Payload Compression modes are **transport** , **tun‐**
                  **nel** , and (for IPsec ESP only) Bound End-to-End Tunnel
                  (**beet**).  Mobile IPv6 modes are route optimization (**ro**) and
                  inbound trigger (**in_trigger**).
    
           _FLAG-LIST_
                  contains one or more of the following optional flags:
                  **noecn** , **decap-dscp** , **nopmtudisc** , **wildrecv** , **icmp** , **af-unspec** ,
                  **align4** , or **esn**.
    
           _SELECTOR_
                  selects the traffic that will be controlled by the policy,
                  based on the source address, the destination address, the
                  network device, and/or _UPSPEC_.
    
           _UPSPEC_ selects traffic by protocol. For the **tcp** , **udp** , **sctp** , or **dc‐**
                  **cp** protocols, the source and destination port can optional‐
                  ly be specified.  For the **icmp** , **ipv6-icmp** , or **mobility-**
                  **header** protocols, the type and code numbers can optionally
                  be specified.  For the **gre** protocol, the key can optionally
                  be specified as a dotted-quad or number.  Other protocols
                  can be selected by name or number _PROTO_.
    
           _LIMIT-LIST_
                  sets limits in seconds, bytes, or numbers of packets.
    
           _ENCAP_  encapsulates packets with protocol **espinudp** , **espinudp-non‐**
                  **ike** , or **espintcp** , using source port _SPORT_ , destination port
                  _DPORT_ , and original address _OADDR_.
    
           _MARK_   used to match xfrm policies and states
    
           _OUTPUT-MARK_
                  used to set the output mark to influence the routing of the
                  packets emitted by the state
    
           _IF-ID_  xfrm interface identifier used to in both xfrm policies and
                  states
    
           _DEV_    Network interface name used to offload policies and states
    
           ip xfrm policy add         add a new policy
           ip xfrm policy update      update an existing policy
           ip xfrm policy delete      delete an existing policy
           ip xfrm policy get         get an existing policy
           ip xfrm policy deleteall   delete all existing xfrm policies
           ip xfrm policy list        print out the list of xfrm policies
           ip xfrm policy flush       flush policies
    
           **nosock** filter (remove) all socket policies from the output.
    
           _SELECTOR_
                  selects the traffic that will be controlled by the policy,
                  based on the source address, the destination address, the
                  network device, and/or _UPSPEC_.
    
           _UPSPEC_ selects traffic by protocol. For the **tcp** , **udp** , **sctp** , or **dc‐**
                  **cp** protocols, the source and destination port can optional‐
                  ly be specified.  For the **icmp** , **ipv6-icmp** , or **mobility-**
                  **header** protocols, the type and code numbers can optionally
                  be specified.  For the **gre** protocol, the key can optionally
                  be specified as a dotted-quad or number.  Other protocols
                  can be selected by name or number _PROTO_.
    
           _DIR_    selects the policy direction as **in** , **out** , or **fwd**.
    
           _CTX_    sets the security context.
    
           _PTYPE_  can be **main**(default) or **sub**.
    
           _ACTION_ can be **allow**(default) or **block**.
    
           _PRIORITY_
                  is a number that defaults to zero.
    
           _FLAG-LIST_
                  contains one or both of the following optional flags: **local**
                  or **icmp**.
    
           _LIMIT-LIST_
                  sets limits in seconds, bytes, or numbers of packets.
    
           _TMPL-LIST_
                  is a template list specified using _ID_ , _MODE_ , _REQID_ , and/or
                  _LEVEL_.
    
           _ID_     is specified by a source address, destination address,
                  transform protocol _XFRM-PROTO_ , and/or Security Parameter
                  Index _SPI_.  (For IP Payload Compression, the Compression
                  Parameter Index or CPI is used for _SPI_.)
    
           _XFRM-PROTO_
                  specifies a transform protocol: IPsec Encapsulating Securi‐
                  ty Payload (**esp**), IPsec Authentication Header (**ah**), IP Pay‐
                  load Compression (**comp**), Mobile IPv6 Type 2 Routing Header
                  (**route2**), or Mobile IPv6 Home Address Option (**hao**).
    
           _MODE_   specifies a mode of operation for the transform protocol.
                  IPsec and IP Payload Compression modes are **transport** , **tun‐**
                  **nel** , and (for IPsec ESP only) Bound End-to-End Tunnel
                  (**beet**).  Mobile IPv6 modes are route optimization (**ro**) and
                  inbound trigger (**in_trigger**).
    
           _LEVEL_  can be **required**(default) or **use**.
    
           ip xfrm policy count   count existing policies
    
           Use one or more -s options to display more details, including pol‐
           icy hash table information.
    
           ip xfrm policy set   configure the policy hash table
    
           Security policies whose address prefix lengths are greater than or
           equal policy hash table thresholds are hashed. Others are stored
           in the policy_inexact chained list.
    
           _LBITS_  specifies the minimum local address prefix length of poli‐
                  cies that are stored in the Security Policy Database hash
                  table.
    
           _RBITS_  specifies the minimum remote address prefix length of poli‐
                  cies that are stored in the Security Policy Database hash
                  table.
    
           ip xfrm monitor    state monitoring for xfrm objects
    
           The xfrm objects to monitor can be optionally specified.
    
           If the **all-nsid** option is set, the program listens to all network
           namespaces that have a nsid assigned into the network namespace
           were the program is running.  A prefix is displayed to show the
           network namespace where the message originates. Example:
    
             [nsid 1]Flushed state proto 0
    


* * *