man/man8/ip-xfrm.8

   1 .TH IP\-XFRM 8 "20 Dec 2011" "iproute2" "Linux"
   2 .SH "NAME"
   3 ip-xfrm \- transform configuration
   4 .SH "SYNOPSIS"
   5 .sp
   6 .ad l
   7 .in +8
   8 .ti -8
   9 .B ip
  10 .RI "[ " OPTIONS " ]"
  11 .B xfrm
  12 .RI " { " COMMAND " | "
  13 .BR help " }"
  14 .sp
  15
  16 .ti -8
  17 .B "ip xfrm"
  18 .IR XFRM-OBJECT " { " COMMAND " | "
  19 .BR help " }"
  20 .sp
  21
  22 .ti -8
  23 .IR XFRM-OBJECT " :="
  24 .BR state " | " policy " | " monitor
  25 .sp
  26
  27 .ti -8
  28 .BR "ip xfrm state" " { " add " | " update " } "
  29 .IR ID " [ " ALGO-LIST " ]"
  30 .RB "[ " mode
  31 .IR MODE " ]"
  32 .RB "[ " mark
  33 .I MARK
  34 .RB "[ " mask
  35 .IR MASK " ] ]"
  36 .RB "[ " reqid
  37 .IR REQID " ]"
  38 .RB "[ " seq
  39 .IR SEQ " ]"
  40 .RB "[ " replay-window
  41 .IR SIZE " ]"
  42 .RB "[ " replay-seq
  43 .IR SEQ " ]"
  44 .RB "[ " replay-oseq
  45 .IR SEQ " ]"
  46 .RB "[ " replay-seq-hi
  47 .IR SEQ " ]"
  48 .RB "[ " replay-oseq-hi
  49 .IR SEQ " ]"
  50 .RB "[ " flag
  51 .IR FLAG-LIST " ]"
  52 .RB "[ " sel
  53 .IR SELECTOR " ] [ " LIMIT-LIST " ]"
  54 .RB "[ " encap
  55 .IR ENCAP " ]"
  56 .RB "[ " coa
  57 .IR ADDR "[/" PLEN "] ]"
  58 .RB "[ " ctx
  59 .IR CTX " ]"
  60 .RB "[ " extra-flag
  61 .IR EXTRA-FLAG-LIST " ]"
  62 .RB "[ " output-mark
  63 .IR OUTPUT-MARK " ]"
  64
  65 .ti -8
  66 .B "ip xfrm state allocspi"
  67 .I ID
  68 .RB "[ " mode
  69 .IR MODE " ]"
  70 .RB "[ " mark
  71 .I MARK
  72 .RB "[ " mask
  73 .IR MASK " ] ]"
  74 .RB "[ " reqid
  75 .IR REQID " ]"
  76 .RB "[ " seq
  77 .IR SEQ " ]"
  78 .RB "[ " min
  79 .I SPI
  80 .B max
  81 .IR SPI " ]"
  82
  83 .ti -8
  84 .BR "ip xfrm state" " { " delete " | " get " } "
  85 .I ID
  86 .RB "[ " mark
  87 .I MARK
  88 .RB "[ " mask
  89 .IR MASK " ] ]"
  90
  91 .ti -8
  92 .BR "ip xfrm state" " { " deleteall " | " list " } ["
  93 .IR ID " ]"
  94 .RB "[ " mode
  95 .IR MODE " ]"
  96 .RB "[ " reqid
  97 .IR REQID " ]"
  98 .RB "[ " flag
  99 .IR FLAG-LIST " ]"
 100
 101 .ti -8
 102 .BR "ip xfrm state flush" " [ " proto
 103 .IR XFRM-PROTO " ]"
 104
 105 .ti -8
 106 .BR "ip xfrm state count"
 107
 108 .ti -8
 109 .IR ID " :="
 110 .RB "[ " src
 111 .IR ADDR " ]"
 112 .RB "[ " dst
 113 .IR ADDR " ]"
 114 .RB "[ " proto
 115 .IR XFRM-PROTO " ]"
 116 .RB "[ " spi
 117 .IR SPI " ]"
 118
 119 .ti -8
 120 .IR XFRM-PROTO " :="
 121 .BR esp " | " ah " | " comp " | " route2 " | " hao
 122
 123 .ti -8
 124 .IR ALGO-LIST " := [ " ALGO-LIST " ] " ALGO
 125
 126 .ti -8
 127 .IR ALGO " :="
 128 .RB "{ " enc " | " auth " } "
 129 .IR ALGO-NAME " " ALGO-KEYMAT " |"
 130 .br
 131 .B auth-trunc
 132 .IR ALGO-NAME " " ALGO-KEYMAT " " ALGO-TRUNC-LEN " |"
 133 .br
 134 .B aead
 135 .IR ALGO-NAME " " ALGO-KEYMAT " " ALGO-ICV-LEN " |"
 136 .br
 137 .B comp
 138 .IR ALGO-NAME
 139
 140 .ti -8
 141 .IR MODE " := "
 142 .BR transport " | " tunnel " | " beet " | " ro " | " in_trigger
 143
 144 .ti -8
 145 .IR FLAG-LIST " := [ " FLAG-LIST " ] " FLAG
 146
 147 .ti -8
 148 .IR FLAG " :="
 149 .BR noecn " | " decap-dscp " | " nopmtudisc " | " wildrecv " | " icmp " | "
 150 .BR af-unspec " | " align4 " | " esn
 151
 152 .ti -8
 153 .IR SELECTOR " :="
 154 .RB "[ " src
 155 .IR ADDR "[/" PLEN "] ]"
 156 .RB "[ " dst
 157 .IR ADDR "[/" PLEN "] ]"
 158 .RB "[ " dev
 159 .IR DEV " ]"
 160 .br
 161 .RI "[ " UPSPEC " ]"
 162
 163 .ti -8
 164 .IR UPSPEC " := "
 165 .BR proto " {"
 166 .IR PROTO " |"
 167 .br
 168 .RB "{ " tcp " | " udp " | " sctp " | " dccp " } [ " sport
 169 .IR PORT " ]"
 170 .RB "[ " dport
 171 .IR PORT " ] |"
 172 .br
 173 .RB "{ " icmp " | " ipv6-icmp " | " mobility-header " } [ " type
 174 .IR NUMBER " ]"
 175 .RB "[ " code
 176 .IR NUMBER " ] |"
 177 .br
 178 .BR gre " [ " key
 179 .RI "{ " DOTTED-QUAD " | " NUMBER " } ] }"
 180
 181 .ti -8
 182 .IR LIMIT-LIST " := [ " LIMIT-LIST " ]"
 183 .B limit
 184 .I LIMIT
 185
 186 .ti -8
 187 .IR LIMIT " :="
 188 .RB "{ " time-soft " | " time-hard " | " time-use-soft " | " time-use-hard " }"
 189 .IR "SECONDS" " |"
 190 .br
 191 .RB "{ " byte-soft " | " byte-hard " }"
 192 .IR SIZE " |"
 193 .br
 194 .RB "{ " packet-soft " | " packet-hard " }"
 195 .I COUNT
 196
 197 .ti -8
 198 .IR ENCAP " :="
 199 .RB "{ " espinudp " | " espinudp-nonike " }"
 200 .IR SPORT " " DPORT " " OADDR
 201
 202 .ti -8
 203 .IR EXTRA-FLAG-LIST " := [ " EXTRA-FLAG-LIST " ] " EXTRA-FLAG
 204
 205 .ti -8
 206 .IR EXTRA-FLAG " := "
 207 .B dont-encap-dscp
 208
 209 .ti -8
 210 .BR "ip xfrm policy" " { " add " | " update " }"
 211 .I SELECTOR
 212 .B dir
 213 .I DIR
 214 .RB "[ " ctx
 215 .IR CTX " ]"
 216 .RB "[ " mark
 217 .I MARK
 218 .RB "[ " mask
 219 .IR MASK " ] ]"
 220 .RB "[ " index
 221 .IR INDEX " ]"
 222 .RB "[ " ptype
 223 .IR PTYPE " ]"
 224 .RB "[ " action
 225 .IR ACTION " ]"
 226 .RB "[ " priority
 227 .IR PRIORITY " ]"
 228 .RB "[ " flag
 229 .IR FLAG-LIST " ]"
 230 .RI "[ " LIMIT-LIST " ] [ " TMPL-LIST " ]"
 231
 232 .ti -8
 233 .BR "ip xfrm policy" " { " delete " | " get " }"
 234 .RI "{ " SELECTOR " | "
 235 .B index
 236 .IR INDEX " }"
 237 .B dir
 238 .I DIR
 239 .RB "[ " ctx
 240 .IR CTX " ]"
 241 .RB "[ " mark
 242 .I MARK
 243 .RB "[ " mask
 244 .IR MASK " ] ]"
 245 .RB "[ " ptype
 246 .IR PTYPE " ]"
 247
 248 .ti -8
 249 .BR "ip xfrm policy" " { " deleteall " | " list " }"
 250 .RB "[ " nosock " ]"
 251 .RI "[ " SELECTOR " ]"
 252 .RB "[ " dir
 253 .IR DIR " ]"
 254 .RB "[ " index
 255 .IR INDEX " ]"
 256 .RB "[ " ptype
 257 .IR PTYPE " ]"
 258 .RB "[ " action
 259 .IR ACTION " ]"
 260 .RB "[ " priority
 261 .IR PRIORITY " ]"
 262 .RB "[ " flag
 263 .IR FLAG-LIST "]"
 264
 265 .ti -8
 266 .B "ip xfrm policy flush"
 267 .RB "[ " ptype
 268 .IR PTYPE " ]"
 269
 270 .ti -8
 271 .B "ip xfrm policy count"
 272
 273 .ti -8
 274 .B "ip xfrm policy set"
 275 .RB "[ " hthresh4
 276 .IR LBITS " " RBITS " ]"
 277 .RB "[ " hthresh6
 278 .IR LBITS " " RBITS " ]"
 279
 280 .ti -8
 281 .IR SELECTOR " :="
 282 .RB "[ " src
 283 .IR ADDR "[/" PLEN "] ]"
 284 .RB "[ " dst
 285 .IR ADDR "[/" PLEN "] ]"
 286 .RB "[ " dev
 287 .IR DEV " ]"
 288 .RI "[ " UPSPEC " ]"
 289
 290 .ti -8
 291 .IR UPSPEC " := "
 292 .BR proto " {"
 293 .IR PROTO " |"
 294 .br
 295 .RB "{ " tcp " | " udp " | " sctp " | " dccp " } [ " sport
 296 .IR PORT " ]"
 297 .RB "[ " dport
 298 .IR PORT " ] |"
 299 .br
 300 .RB "{ " icmp " | " ipv6-icmp " | " mobility-header " } [ " type
 301 .IR NUMBER " ]"
 302 .RB "[ " code
 303 .IR NUMBER " ] |"
 304 .br
 305 .BR gre " [ " key
 306 .RI "{ " DOTTED-QUAD " | " NUMBER " } ] }"
 307
 308 .ti -8
 309 .IR DIR " := "
 310 .BR in " | " out " | " fwd
 311
 312 .ti -8
 313 .IR PTYPE " := "
 314 .BR main " | " sub
 315
 316 .ti -8
 317 .IR ACTION " := "
 318 .BR allow " | " block
 319
 320 .ti -8
 321 .IR FLAG-LIST " := [ " FLAG-LIST " ] " FLAG
 322
 323 .ti -8
 324 .IR FLAG " :="
 325 .BR localok " | " icmp
 326
 327 .ti -8
 328 .IR LIMIT-LIST " := [ " LIMIT-LIST " ]"
 329 .B limit
 330 .I LIMIT
 331
 332 .ti -8
 333 .IR LIMIT " :="
 334 .RB "{ " time-soft " | " time-hard " | " time-use-soft " | " time-use-hard " }"
 335 .IR "SECONDS" " |"
 336 .br
 337 .RB "{ " byte-soft " | " byte-hard " }"
 338 .IR SIZE " |"
 339 .br
 340 .RB "{ " packet-soft " | " packet-hard " }"
 341 .I COUNT
 342
 343 .ti -8
 344 .IR TMPL-LIST " := [ " TMPL-LIST " ]"
 345 .B tmpl
 346 .I TMPL
 347
 348 .ti -8
 349 .IR TMPL " := " ID
 350 .RB "[ " mode
 351 .IR MODE " ]"
 352 .RB "[ " reqid
 353 .IR REQID " ]"
 354 .RB "[ " level
 355 .IR LEVEL " ]"
 356
 357 .ti -8
 358 .IR ID " :="
 359 .RB "[ " src
 360 .IR ADDR " ]"
 361 .RB "[ " dst
 362 .IR ADDR " ]"
 363 .RB "[ " proto
 364 .IR XFRM-PROTO " ]"
 365 .RB "[ " spi
 366 .IR SPI " ]"
 367
 368 .ti -8
 369 .IR XFRM-PROTO " :="
 370 .BR esp " | " ah " | " comp " | " route2 " | " hao
 371
 372 .ti -8
 373 .IR MODE " := "
 374 .BR transport " | " tunnel " | " beet " | " ro " | " in_trigger
 375
 376 .ti -8
 377 .IR LEVEL " :="
 378 .BR required " | " use
 379
 380 .ti -8
 381 .BR "ip xfrm monitor" " ["
 382 .BI all-nsid
 383 ] [
 384 .BI all
 385  |
 386 .IR LISTofXFRM-OBJECTS " ]"
 387
 388 .ti -8
 389 .IR LISTofXFRM-OBJECTS " := [ " LISTofXFRM-OBJECTS " ] " XFRM-OBJECT
 390
 391 .ti -8
 392 .IR XFRM-OBJECT " := "
 393 .BR acquire " | " expire " | " SA " | " policy " | " aevent " | " report
 394
 395 .in -8
 396 .ad b
 397
 398 .SH DESCRIPTION
 399
 400 xfrm is an IP framework for transforming packets (such as encrypting
 401 their payloads). This framework is used to implement the IPsec protocol
 402 suite (with the
 403 .B state
 404 object operating on the Security Association Database, and the
 405 .B policy
 406 object operating on the Security Policy Database). It is also used for
 407 the IP Payload Compression Protocol and features of Mobile IPv6.
 408
 409 .TS
 410 l l.
 411 ip xfrm state add       add new state into xfrm
 412 ip xfrm state update    update existing state in xfrm
 413 ip xfrm state allocspi  allocate an SPI value
 414 ip xfrm state delete    delete existing state in xfrm
 415 ip xfrm state get       get existing state in xfrm
 416 ip xfrm state deleteall delete all existing state in xfrm
 417 ip xfrm state list      print out the list of existing state in xfrm
 418 ip xfrm state flush     flush all state in xfrm
 419 ip xfrm state count     count all existing state in xfrm
 420 .TE
 421
 422 .TP
 423 .IR ID
 424 is specified by a source address, destination address,
 425 .RI "transform protocol " XFRM-PROTO ","
 426 and/or Security Parameter Index
 427 .IR SPI "."
 428 (For IP Payload Compression, the Compression Parameter Index or CPI is used for
 429 .IR SPI ".)"
 430
 431 .TP
 432 .I XFRM-PROTO
 433 specifies a transform protocol:
 434 .RB "IPsec Encapsulating Security Payload (" esp "),"
 435 .RB "IPsec Authentication Header (" ah "),"
 436 .RB "IP Payload Compression (" comp "),"
 437 .RB "Mobile IPv6 Type 2 Routing Header (" route2 "), or"
 438 .RB "Mobile IPv6 Home Address Option (" hao ")."
 439
 440 .TP
 441 .I ALGO-LIST
 442 contains one or more algorithms to use. Each algorithm
 443 .I ALGO
 444 is specified by:
 445 .RS
 446 .IP \[bu]
 447 the algorithm type:
 448 .RB "encryption (" enc "),"
 449 .RB "authentication (" auth " or " auth-trunc "),"
 450 .RB "authenticated encryption with associated data (" aead "), or"
 451 .RB "compression (" comp ")"
 452 .IP \[bu]
 453 the algorithm name
 454 .IR ALGO-NAME
 455 (see below)
 456 .IP \[bu]
 457 .RB "(for all except " comp ")"
 458 the keying material
 459 .IR ALGO-KEYMAT ","
 460 which may include both a key and a salt or nonce value; refer to the
 461 corresponding RFC
 462 .IP \[bu]
 463 .RB "(for " auth-trunc " only)"
 464 the truncation length
 465 .I ALGO-TRUNC-LEN
 466 in bits
 467 .IP \[bu]
 468 .RB "(for " aead " only)"
 469 the Integrity Check Value length
 470 .I ALGO-ICV-LEN
 471 in bits
 472 .RE
 473
 474 .nh
 475 .RS
 476 Encryption algorithms include
 477 .BR ecb(cipher_null) ", " cbc(des) ", " cbc(des3_ede) ", " cbc(cast5) ","
 478 .BR cbc(blowfish) ", " cbc(aes) ", " cbc(serpent) ", " cbc(camellia) ","
 479 .BR cbc(twofish) ", and " rfc3686(ctr(aes)) "."
 480
 481 Authentication algorithms include
 482 .BR digest_null ", " hmac(md5) ", " hmac(sha1) ", " hmac(sha256) ","
 483 .BR hmac(sha384) ", " hmac(sha512) ", " hmac(rmd160) ", and " xcbc(aes) "."
 484
 485 Authenticated encryption with associated data (AEAD) algorithms include
 486 .BR rfc4106(gcm(aes)) ", " rfc4309(ccm(aes)) ", and " rfc4543(gcm(aes)) "."
 487
 488 Compression algorithms include
 489 .BR deflate ", " lzs ", and " lzjh "."
 490 .RE
 491 .hy
 492
 493 .TP
 494 .I MODE
 495 specifies a mode of operation for the transform protocol. IPsec and IP Payload
 496 Compression modes are
 497 .BR transport ", " tunnel ","
 498 and (for IPsec ESP only) Bound End-to-End Tunnel
 499 .RB "(" beet ")."
 500 Mobile IPv6 modes are route optimization
 501 .RB "(" ro ")"
 502 and inbound trigger
 503 .RB "(" in_trigger ")."
 504
 505 .TP
 506 .I FLAG-LIST
 507 contains one or more of the following optional flags:
 508 .BR noecn ", " decap-dscp ", " nopmtudisc ", " wildrecv ", " icmp ", "
 509 .BR af-unspec ", " align4 ", or " esn "."
 510
 511 .TP
 512 .IR SELECTOR
 513 selects the traffic that will be controlled by the policy, based on the source
 514 address, the destination address, the network device, and/or
 515 .IR UPSPEC "."
 516
 517 .TP
 518 .IR UPSPEC
 519 selects traffic by protocol. For the
 520 .BR tcp ", " udp ", " sctp ", or " dccp
 521 protocols, the source and destination port can optionally be specified.
 522 For the
 523 .BR icmp ", " ipv6-icmp ", or " mobility-header
 524 protocols, the type and code numbers can optionally be specified.
 525 For the
 526 .B gre
 527 protocol, the key can optionally be specified as a dotted-quad or number.
 528 Other protocols can be selected by name or number
 529 .IR PROTO "."
 530
 531 .TP
 532 .I LIMIT-LIST
 533 sets limits in seconds, bytes, or numbers of packets.
 534
 535 .TP
 536 .I ENCAP
 537 encapsulates packets with protocol
 538 .BR espinudp " or " espinudp-nonike ","
 539 .RI "using source port " SPORT ", destination port "  DPORT
 540 .RI ", and original address " OADDR "."
 541
 542 .TP
 543 .I MARK
 544 used to match xfrm policies and states
 545
 546 .TP
 547 .I OUTPUT-MARK
 548 used to set the output mark to influence the routing
 549 of the packets emitted by the state
 550
 551 .sp
 552 .PP
 553 .TS
 554 l l.
 555 ip xfrm policy add      add a new policy
 556 ip xfrm policy update   update an existing policy
 557 ip xfrm policy delete   delete an existing policy
 558 ip xfrm policy get      get an existing policy
 559 ip xfrm policy deleteall        delete all existing xfrm policies
 560 ip xfrm policy list     print out the list of xfrm policies
 561 ip xfrm policy flush    flush policies
 562 .TE
 563
 564 .TP
 565 .BR nosock
 566 filter (remove) all socket policies from the output.
 567
 568 .TP
 569 .IR SELECTOR
 570 selects the traffic that will be controlled by the policy, based on the source
 571 address, the destination address, the network device, and/or
 572 .IR UPSPEC "."
 573
 574 .TP
 575 .IR UPSPEC
 576 selects traffic by protocol. For the
 577 .BR tcp ", " udp ", " sctp ", or " dccp
 578 protocols, the source and destination port can optionally be specified.
 579 For the
 580 .BR icmp ", " ipv6-icmp ", or " mobility-header
 581 protocols, the type and code numbers can optionally be specified.
 582 For the
 583 .B gre
 584 protocol, the key can optionally be specified as a dotted-quad or number.
 585 Other protocols can be selected by name or number
 586 .IR PROTO "."
 587
 588 .TP
 589 .I DIR
 590 selects the policy direction as
 591 .BR in ", " out ", or " fwd "."
 592
 593 .TP
 594 .I CTX
 595 sets the security context.
 596
 597 .TP
 598 .I PTYPE
 599 can be
 600 .BR main " (default) or " sub "."
 601
 602 .TP
 603 .I ACTION
 604 can be
 605 .BR allow " (default) or " block "."
 606
 607 .TP
 608 .I PRIORITY
 609 is a number that defaults to zero.
 610
 611 .TP
 612 .I FLAG-LIST
 613 contains one or both of the following optional flags:
 614 .BR local " or " icmp "."
 615
 616 .TP
 617 .I LIMIT-LIST
 618 sets limits in seconds, bytes, or numbers of packets.
 619
 620 .TP
 621 .I TMPL-LIST
 622 is a template list specified using
 623 .IR ID ", " MODE ", " REQID ", and/or " LEVEL ". "
 624
 625 .TP
 626 .IR ID
 627 is specified by a source address, destination address,
 628 .RI "transform protocol " XFRM-PROTO ","
 629 and/or Security Parameter Index
 630 .IR SPI "."
 631 (For IP Payload Compression, the Compression Parameter Index or CPI is used for
 632 .IR SPI ".)"
 633
 634 .TP
 635 .I XFRM-PROTO
 636 specifies a transform protocol:
 637 .RB "IPsec Encapsulating Security Payload (" esp "),"
 638 .RB "IPsec Authentication Header (" ah "),"
 639 .RB "IP Payload Compression (" comp "),"
 640 .RB "Mobile IPv6 Type 2 Routing Header (" route2 "), or"
 641 .RB "Mobile IPv6 Home Address Option (" hao ")."
 642
 643 .TP
 644 .I MODE
 645 specifies a mode of operation for the transform protocol. IPsec and IP Payload
 646 Compression modes are
 647 .BR transport ", " tunnel ","
 648 and (for IPsec ESP only) Bound End-to-End Tunnel
 649 .RB "(" beet ")."
 650 Mobile IPv6 modes are route optimization
 651 .RB "(" ro ")"
 652 and inbound trigger
 653 .RB "(" in_trigger ")."
 654
 655 .TP
 656 .I LEVEL
 657 can be
 658 .BR required " (default) or " use "."
 659
 660 .sp
 661 .PP
 662 .TS
 663 l l.
 664 ip xfrm policy count    count existing policies
 665 .TE
 666
 667 .PP
 668 Use one or more -s options to display more details, including policy hash table
 669 information.
 670
 671 .sp
 672 .PP
 673 .TS
 674 l l.
 675 ip xfrm policy set      configure the policy hash table
 676 .TE
 677
 678 .PP
 679 Security policies whose address prefix lengths are greater than or equal
 680 policy hash table thresholds are hashed. Others are stored in the
 681 policy_inexact chained list.
 682
 683 .TP
 684 .I LBITS
 685 specifies the minimum local address prefix length of policies that are
 686 stored in the Security Policy Database hash table.
 687
 688 .TP
 689 .I RBITS
 690 specifies the minimum remote address prefix length of policies that are
 691 stored in the Security Policy Database hash table.
 692
 693 .sp
 694 .PP
 695 .TS
 696 l l.
 697 ip xfrm monitor         state monitoring for xfrm objects
 698 .TE
 699
 700 .PP
 701 The xfrm objects to monitor can be optionally specified.
 702
 703 .P
 704 If the
 705 .BI all-nsid
 706 option is set, the program listens to all network namespaces that have a
 707 nsid assigned into the network namespace were the program is running.
 708 A prefix is displayed to show the network namespace where the message
 709 originates. Example:
 710 .sp
 711 .in +2
 712 [nsid 1]Flushed state proto 0
 713 .in -2
 714 .sp
 715
 716 .SH AUTHOR
 717 Manpage revised by David Ward <david.ward@ll.mit.edu>
 718 .br
 719 Manpage revised by Christophe Gouault <christophe.gouault@6wind.com>
 720 .br
 721 Manpage revised by Nicolas Dichtel <nicolas.dichtel@6wind.com>