IP xfrm 命令说明1-sa

SA命令

       ip xfrm state { add | update } ID [ ALGO-LIST ] [ mode MODE ] [ mark MARK [ mask MASK ] ] [ reqid REQID ] [
               seq SEQ ] [ replay-window SIZE ] [ replay-seq SEQ ] [ replay-oseq SEQ ] [ flag FLAG-LIST ] [ sel
               SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ] [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST
               ]
       ip xfrm state allocspi ID [ mode MODE ] [ mark MARK [ mask MASK ] ] [ reqid REQID ] [ seq SEQ ] [ min SPI max SPI ]
       ip xfrm state { delete | get } ID [ mark MARK [ mask MASK ] ]
       ip xfrm state { deleteall | list } [ ID ] [ mode MODE ] [ reqid REQID ] [ flag FLAG-LIST ]
       ip xfrm state flush [ proto XFRM-PROTO ]
       ip xfrm state count

       ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]
       
       XFRM-PROTO := esp | ah | comp | route2 | hao
       
       ALGO-LIST := [ ALGO-LIST ] ALGO
       
       ALGO := { enc | auth } ALGO-NAME ALGO-KEYMAT |
               auth-trunc ALGO-NAME ALGO-KEYMAT ALGO-TRUNC-LEN |
               aead ALGO-NAME ALGO-KEYMAT ALGO-ICV-LEN |
               comp ALGO-NAME
               
       MODE := transport | tunnel | beet | ro | in_trigger
       
       FLAG-LIST := [ FLAG-LIST ] FLAG
       
       FLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4
       
       SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [ UPSPEC ]
       
       UPSPEC := proto { PROTO |
               { tcp | udp | sctp | dccp } [ sport PORT ] [ dport PORT ] |
               { icmp | ipv6-icmp | mobility-header } [ type NUMBER ] [ code NUMBER ] |
               gre [ key { DOTTED-QUAD | NUMBER } ] }
               
       LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT
       LIMIT-LIST
              sets limits in seconds, bytes, or numbers of packets.


       ENCAP  encapsulates  packets  with  protocol espinudp or espinudp-nonike, using source port SPORT, destination
              port DPORT , and original address OADDR.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

SA命令解析

       ip xfrm state { add | update } ID [ ALGO-LIST ] [ mode MODE ] [ mark MARK [ mask MASK ] ] [ reqid REQID ] [
               seq SEQ ] [ replay-window SIZE ] [ replay-seq SEQ ] [ replay-oseq SEQ ] [ flag FLAG-LIST ] [ sel
               SELECTOR ] [ LIMIT-LIST ] [ encap ENCAP ] [ coa ADDR[/PLEN] ] [ ctx CTX ] [ extra-flag EXTRA-FLAG-LIST
               ]
1
2
3
4

ID := [ src ADDR ] [ dst ADDR ] [ proto XFRM-PROTO ] [ spi SPI ]
1

ID 是键值， 用来区分不同SA。
ID内容为：
原地址、目的地址、协议（IPsec封装协议）和spi共同决定一个sa。

XFRM-PROTO := esp | ah | comp | route2 | hao
1

协议内容：目前一般使用esp

   ALGO := { enc | auth } ALGO-NAME ALGO-KEYMAT |
           auth-trunc ALGO-NAME ALGO-KEYMAT ALGO-TRUNC-LEN |
           aead ALGO-NAME ALGO-KEYMAT ALGO-ICV-LEN |
           comp ALGO-NAME
1
2
3
4

ALGO-LIST：算法列表。对数据加密、认证的算法。 ipsec能使用的算法跟内核算法模块支持的算法不同，是其子集。不同版本的内核支持的算法列表页不同，详见附录1： 内核支持的算法列表。

 MODE := transport | tunnel | beet | ro | in_trigger
1

封装模式，ESP封装协议支持隧道和传输模式，一般使用隧道模式（过NAT）

FLAG-LIST := [ FLAG-LIST ] FLAG
FLAG := noecn | decap-dscp | nopmtudisc | wildrecv | icmp | af-unspec | align4
1
2

暂留，目前未使用到

SELECTOR := [ src ADDR[/PLEN] ] [ dst ADDR[/PLEN] ] [ dev DEV ] [ UPSPEC ]
1

关联sp，选择进入隧道的数据流

   UPSPEC := proto { PROTO |
           { tcp | udp | sctp | dccp } [ sport PORT ] [ dport PORT ] |
           { icmp | ipv6-icmp | mobility-header } [ type NUMBER ] [ code NUMBER ] |
           gre [ key { DOTTED-QUAD | NUMBER } ] }
1
2
3
4

数据流的协议等特征。

   LIMIT-LIST := [ LIMIT-LIST ] limit LIMIT
   LIMIT-LIST
          sets limits in seconds, bytes, or numbers of packets.
1
2
3

sa的限制，可以通过时间、数据包、数据量来更新sa

   ENCAP  encapsulates  packets  with  protocol espinudp or espinudp-nonike, using source port SPORT, destination
          port DPORT , and original address OADDR.
1
2

带封装的ESP，比如espinudp 、espintcp。