X-Git-Url: https://git.syn-net.org/?p=debian%2Fuanytun.git;a=blobdiff_plain;f=doc%2Fuanytun.8.txt;h=ed978d47c5d6e2d4b99a4ab2c21a4b9aae9366c7;hp=311c54aabbb34c6d6d1da7615ede5e701d7ea0ec;hb=71f6f666a3d69c6e1e7a77e238362c5bbe288e66;hpb=b81b2c1954fe3e3317e6fa260c5ffdc9eeee966c

diff --git a/doc/uanytun.8.txt b/doc/uanytun.8.txt
index 311c54a..ed978d4 100644
--- a/doc/uanytun.8.txt
+++ b/doc/uanytun.8.txt
@@ -3,40 +3,46 @@ uanytun(8)
 
 NAME
 ----
+
 uanytun - micro anycast tunneling daemon
 
+
 SYNOPSIS
 --------
 
-*uanytun*
-[ *-h|--help* ]
-[ *-D|--nodaemonize* ]
-[ *-u|--username* <username> ]
-[ *-g|--groupname* <groupname> ]
-[ *-C|--chroot* <path> ]
-[ *-P|--write-pid* <filename> ]
-[ *-L|--log* <target>:<level>[,<param1>[,<param2>[..]]] ]
-[ *-i|--interface* <ip-address> ]
-[ *-p|--port* <port> ]
-[ *-r|--remote-host* <hostname|ip> ]
-[ *-o|--remote-port* <port> ]
-[ *-4|--ipv4-only* ]
-[ *-6|--ipv6-only* ]
-[ *-d|--dev* <name> ]
-[ *-t|--type* <tun|tap> ]
-[ *-n|--ifconfig* <local>/<prefix> ]
-[ *-x|--post-up-script* <script> ]
-[ *-m|--mux* <mux-id> ]
-[ *-s|--sender-id* <sender id> ]
-[ *-w|--window-size* <window size> ]
-[ *-k|--kd-prf* <kd-prf type> ]
-[ *-e|--role <role>* ]
-[ *-E|--passphrase* <pass phrase> ]
-[ *-K|--key* <master key> ]
-[ *-A|--salt* <master salt> ]
-[ *-c|--cipher* <cipher type> ]
-[ *-a|--auth-algo* <algo type> ]
-[ *-b|--auth-tag-length* <length> ]
+....
+uanytun
+  [ -h|--help ]
+  [ -D|--nodaemonize ]
+  [ -u|--username <username> ]
+  [ -g|--groupname <groupname> ]
+  [ -C|--chroot <path> ]
+  [ -P|--write-pid <filename> ]
+  [ -L|--log <target>:<level>[,<param1>[,<param2>[..]]] ]
+  [ -U|--debug ]
+  [ -i|--interface <ip-address> ]
+  [ -p|--port <port> ]
+  [ -r|--remote-host <hostname|ip> ]
+  [ -o|--remote-port <port> ]
+  [ -4|--ipv4-only ]
+  [ -6|--ipv6-only ]
+  [ -d|--dev <name> ]
+  [ -t|--type <tun|tap> ]
+  [ -n|--ifconfig <local>/<prefix> ]
+  [ -x|--post-up-script <script> ]
+  [ -m|--mux <mux-id> ]
+  [ -s|--sender-id <sender id> ]
+  [ -w|--window-size <window size> ]
+  [ -k|--kd-prf <kd-prf type> ]
+  [ -e|--role <role> ]
+  [ -E|--passphrase <pass phrase> ]
+  [ -K|--key <master key> ]
+  [ -A|--salt <master salt> ]
+  [ -c|--cipher <cipher type> ]
+  [ -a|--auth-algo <algo type> ]
+  [ -b|--auth-tag-length <length> ]
+....
+
 
 DESCRIPTION
 -----------
@@ -45,11 +51,12 @@ DESCRIPTION
 (SATP). It provides a complete VPN solution similar to OpenVPN or
 IPsec in tunnel mode. The main difference is that anycast enables the
 setup of tunnels between an arbitrary combination of anycast, unicast
-and multicast hosts. Unlike Anytun which is a full featured implementation 
-uAnytun has no support for multiple connections or synchronisation. It is a 
-small single threaded implementation intended to act as a client on small 
+and multicast hosts. Unlike Anytun which is a full featured implementation
+uAnytun has no support for multiple connections or synchronisation. It is a
+small single threaded implementation intended to act as a client on small
 platforms.
 
+
 OPTIONS
 -------
 
@@ -57,260 +64,189 @@ OPTIONS
 no difference between client and server. The following options can be
 passed to the daemon:
 
--D|--nodaemonize
-~~~~~~~~~~~~~~~~
-
-This option instructs *uAnytun* to run in foreground
-instead of becoming a daemon which is the default.
-
--u|--username <username>
-~~~~~~~~~~~~~~~~~~~~~~~~
-
-run as this user. If no group is specified (*-g*) the default group of 
-the user is used. The default is to not drop privileges.
-
--g|--groupname <groupname>
-~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-run as this group. If no username is specified (*-u*) this gets ignored.
-The default is to not drop privileges.
-
--C|--chroot <path>
-~~~~~~~~~~~~~~~~~~
-
-Instruct *uAnytun* to run in a chroot jail. The default is 
-to not run in chroot.
-
--P|--write-pid <filename>
-~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Instruct *uAnytun* to write it's pid to this file. The default is 
-to not create a pid file.
-
--L|--log <target>:<level>[,<param1>[,<param2>[..]]]
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-add log target to logging system. This can be invoked several times
-in order to log to different targets at the same time. Every target 
-hast its own log level which is a number between 0 and 5. Where 0 means
-disabling log and 5 means debug messages are enabled.
-
-The following targets are supported:
-
-* *syslog* - log to syslog daemon, parameters <level>[,<logname>[,<facility>]]
-* *file* - log to file, parameters <level>[,<path>]
-* *stdout* - log to standard output, parameters <level>
-* *stderr* - log to standard error, parameters <level> 
-
-The file target can be used more the once with different levels.
-If no target is provided at the command line a single target with the 
-following config is added:
-
-*syslog:3,uanytun,daemon*
-
-
--i|--interface <ip address>
-~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-This IP address is used as the sender address for outgoing
-packets. The default is to not use a special inteface and just
-bind on all interfaces.
-
--p|--port <port>
-~~~~~~~~~~~~~~~~
-
-local port to bind to
-
-The local UDP port that is used to send and receive the
-payload data. The two tunnel endpoints can use different
-ports. default: 4444
-
--r|--remote-host <hostname|ip>
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-remote host
-
-This option can be used to specify the remote tunnel
-endpoint. In case of anycast tunnel endpoints, the
-anycast IP address has to be used. If you do not specify
-an address, it is automatically determined after receiving
-the first data packet.
-
--o|--remote-port <port>
-~~~~~~~~~~~~~~~~~~~~~~~
-
-remote port
-
-The UDP port used for payload data by the remote host
-(specified with -p on the remote host). If you do not specify
-a port, it is automatically determined after receiving
-the first data packet.
-
--4|--ipv4-only
-~~~~~~~~~~~~~~
-
-Resolv to IPv4 addresses only. The default is to resolv both
-IPv4 and IPv6 addresses.
-
--6|--ipv6-only
-~~~~~~~~~~~~~~
-
-Resolv to IPv6 addresses only. The default is to resolv both
-IPv4 and IPv6 addresses.
-
--d|--dev <name>
-~~~~~~~~~~~~~~~
-
-device name
-
-By default, tapN is used for Ethernet tunnel interfaces,
-and tunN for IP tunnels, respectively. This option can
-be used to manually override these defaults.
-
--t|--type <tun|tap>
-~~~~~~~~~~~~~~~~~~~
-
-device type
-
-Type of the tunnels to create. Use tap for Ethernet
-tunnels, tun for IP tunnels.
-
--n|--ifconfig <local>/<prefix>
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-*<local>* the local IP address for the tun/tap device
+*-D, --nodaemonize*::
+   This option instructs *uAnytun* to run in foreground
+   instead of becoming a daemon which is the default.
+
+*-u, --username '<username>'*::
+   run as this user. If no group is specified (*-g*) the default group of
+   the user is used. The default is to not drop privileges.
+
+*-g, --groupname '<groupname>'*::
+   run as this group. If no username is specified (*-u*) this gets ignored.
+   The default is to not drop privileges.
+
+*-C, --chroot '<path>'*::
+   Instruct *uAnytun* to run in a chroot jail. The default is
+   to not run in chroot.
+
+*-P, --write-pid <filename>*::
+   Instruct *uAnytun* to write it's pid to this file. The default is
+   to not create a pid file.
+
+*-L, --log '<target>:<level>[,<param1>[,<param2>[..]]]'*::
+   add log target to logging system. This can be invoked several times
+   in order to log to different targets at the same time. Every target
+   has its own log level which is a number between 0 and 5. Where 0 means
+   disabling log and 5 means debug messages are enabled. +
+   The file target can be used more than once with different levels.
+   If no target is provided at the command line a single target with the
+   config 'syslog:3,uanytun,daemon' is added. +
+   The following targets are supported:
+
+   'syslog';; log to syslog daemon, parameters <level>[,<logname>[,<facility>]]
+   'file';; log to file, parameters <level>[,<path>]
+   'stdout';; log to standard output, parameters <level>
+   'stderr';; log to standard error, parameters <level>
+
+*-U, --debug*::
+   This option instructs *uAnytun* to run in debug mode. It implicits *-D*
+   (don't daemonize) and adds a log target with the configuration
+   'stdout:5' (logging with maximum level). In future releases there might
+   be additional output when this option is supplied.
+
+*-i, --interface '<ip address>'*::
+   This IP address is used as the sender address for outgoing
+   packets. The default is to not use a special inteface and just
+   bind on all interfaces.
+
+*-p, --port '<port>'*::
+   The local UDP port that is used to send and receive the
+   payload data. The two tunnel endpoints can use different
+   ports. default: 4444
+
+*-r, --remote-host '<hostname|ip>'*::
+   This option can be used to specify the remote tunnel
+   endpoint. In case of anycast tunnel endpoints, the
+   anycast IP address has to be used. If you do not specify
+   an address, it is automatically determined after receiving
+   the first data packet.
+
+*-o, --remote-port '<port>'*::
+   The UDP port used for payload data by the remote host
+   (specified with -p on the remote host). If you do not specify
+   a port, it is automatically determined after receiving
+   the first data packet.
+
+*-4, --ipv4-only*::
+   Resolv to IPv4 addresses only. The default is to resolv both
+   IPv4 and IPv6 addresses.
+
+*-6, --ipv6-only*::
+   Resolv to IPv6 addresses only. The default is to resolv both
+   IPv4 and IPv6 addresses.
+
+*-d, --dev '<name>'*::
+   device name +
+   By default, tapN is used for Ethernet tunnel interfaces,
+   and tunN for IP tunnels, respectively. This option can
+   be used to manually override these defaults.
+
+*-t, --type '<tun|tap>'*::
+   device type +
+   Type of the tunnels to create. Use tap for Ethernet
+   tunnels, tun for IP tunnels.
+
+*-n, --ifconfig '<local>/<prefix>'*::
+   The local IP address and prefix length. The remote tunnel endpoint
+   has to use a different IP address in the same subnet.
+
+   '<local>';; the local IP address for the tun/tap device
+   '<prefix>';; the prefix length of the network
+
+*-x, --post-up-script '<script>'*::
+   This option instructs *uAnytun* to run this script after the interface
+   is created. By default no script will be executed.
+
+*-m, --mux '<mux-id>'*::
+   the multiplex id to use. default: 0
+
+*-s, --sender-id '<sender id>'*::
+   Each anycast tunnel endpoint needs a unique sender id
+   (1, 2, 3, ...). It is needed to distinguish the senders
+   in case of replay attacks. As *uAnytun* does not support
+   synchronisation it can't be used as an anycast endpoint therefore
+   this option is quite useless but implemented for compatibility
+   reasons. default: 0
+
+*-w, --window-size '<window size>'*::
+   seqence window size +
+   Sometimes, packets arrive out of order on the receiver
+   side. This option defines the size of a list of received
+   packets' sequence numbers. If, according to this list,
+   a received packet has been previously received or has
+   been transmitted in the past, and is therefore not in
+   the list anymore, this is interpreted as a replay attack
+   and the packet is dropped. A value of 0 deactivates this
+   list and, as a consequence, the replay protection employed
+   by filtering packets according to their secuence number.
+   By default the sequence window is disabled and therefore a
+   window size of 0 is used.
+
+*-k, --kd--prf '<kd-prf type>'*::
+   key derivation pseudo random function +
+   The pseudo random function which is used for calculating the
+   session keys and session salt. +
+   Possible values:
+
+   'null';; no random function, keys and salt are set to 0..00
+   'aes-ctr';; AES in counter mode with 128 Bits, default value
+   'aes-ctr-128';; AES in counter mode with 128 Bits
+   'aes-ctr-192';; AES in counter mode with 192 Bits
+   'aes-ctr-256';; AES in counter mode with 256 Bits
+
+*-e, --role '<role>'*::
+   SATP uses different session keys for inbound and outbound traffic. The
+   role parameter is used to determine which keys to use for outbound or
+   inbound packets. On both sides of a vpn connection different roles have
+   to be used. Possible values are 'left' and 'right'. You may also use
+   'alice' or 'server' as a replacement for 'left' and 'bob' or 'client' as
+   a replacement for 'right'. By default 'left' is used.
+
+*-E, --passphrase '<pass phrase>'*::
+   This passphrase is used to generate the master key and master salt.
+   For the master key the last n bits of the SHA256 digest of the
+   passphrase (where n is the length of the master key in bits) is used.
+   The master salt gets generated with the SHA1 digest.
+   You may force a specific key and or salt by using *--key* and *--salt*.
+
+*-K, --key '<master key>'*::
+   master key to use for key derivation +
+   Master key in hexadecimal notation, e.g.
+   01a2b3c4d5e6f708a9b0cadbecfd0fa1, with a mandatory length
+   of 32, 48 or 64 characters (128, 192 or 256 bits).
+
+*-A, --salt '<master salt>'*::
+   master salt to use for key derivation +
+   Master salt in hexadecimal notation, e.g.
+   01a2b3c4d5e6f708a9b0cadbecfd, with a mandatory length
+   of 28 characters (14 bytes).
+
+*-c, --cipher '<cipher type>'*::
+   payload encryption algorithm +
+   Encryption algorithm used for encrypting the payload +
+   Possible values:
+
+   'null';; no encryption
+   'aes-ctr';; AES in counter mode with 128 Bits, default value
+   'aes-ctr-128';; AES in counter mode with 128 Bits
+   'aes-ctr-192';; AES in counter mode with 192 Bits
+   'aes-ctr-256';; AES in counter mode with 256 Bits
+
+*-a, --auth-algo '<algo type>'*::
+   message authentication algorithm +
+   This option sets the message authentication algorithm. +
+   If HMAC-SHA1 is used, the packet length is increased. The additional bytes
+   contain the authentication data. see *--auth-tag-length* for more info. +
+   Possible values:
+
+   'null';; no message authentication
+   'sha1';; HMAC-SHA1, default value
+
+*-b, --auth-tag-length '<length>'*::
+   The number of bytes to use for the auth tag. This value defaults to 10 bytes
+   unless the 'null' auth algo is used in which case it defaults to 0.
 
-*<prefix>* the prefix length of the network
-
-The local IP address and prefix length. The remote tunnel endpoint
-has to use a different IP address in the same subnet.
-
--x|--post-up-script <script>
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-This option instructs *uAnytun* to run this script after the interface 
-is created. By default no script will be executed.
-
--m|--mux <mux-id>
-~~~~~~~~~~~~~~~~~
-
-the multiplex id to use. default: 0
-
--s|--sender-id  <sender id>
-~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Each anycast tunnel endpoint needs a unique sender id
-(1, 2, 3, ...). It is needed to distinguish the senders
-in case of replay attacks. As *uAnytun* does not support 
-synchronisation it can't be used as an anycast endpoint therefore 
-this option is quite useless but implemented for compability 
-reasons. default: 0
-
--w|--window-size <window size>
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-seqence window size
-
-Sometimes, packets arrive out of order on the receiver
-side. This option defines the size of a list of received
-packets' sequence numbers. If, according to this list,
-a received packet has been previously received or has
-been transmitted in the past, and is therefore not in
-the list anymore, this is interpreted as a replay attack
-and the packet is dropped. A value of 0 deactivates this
-list and, as a consequence, the replay protection employed
-by filtering packets according to their secuence number.
-By default the sequence window is disabled and therefore a
-window size of 0 is used.
-
--k|--kd--prf <kd-prf type>
-~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-key derivation pseudo random function.
-
-The pseudo random function which is used for calculating the 
-session keys and session salt.
-
-Possible values:
-
-* *null* - no random function, keys and salt are set to 0..00
-* *aes-ctr* - AES in counter mode with 128 Bits, default value
-* *aes-ctr-128* - AES in counter mode with 128 Bits
-* *aes-ctr-192* - AES in counter mode with 192 Bits
-* *aes-ctr-256* - AES in counter mode with 256 Bits
-
--e|--role <role>
-~~~~~~~~~~~~~~~~
-
-SATP uses different session keys for inbound and outbound traffic. The
-role parameter is used to determine which keys to use for outbound or
-inbound packets. On both sides of a vpn connection different roles have 
-to be used. Possible values are *left* and *right*. You may also use 
-*alice* or *server* as a replacement for *left* and *bob* or *client* as 
-a replacement for *right*. By default *left* is used.
-
--E|--passphrase <pass phrase>
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-This passphrase is used to generate the master key and master salt.
-For the master key the last n bits of the SHA256 digest of the 
-passphrase (where n is the length of the master key in bits) is used. 
-The master salt gets generated with the SHA1 digest. 
-You may force a specific key and or salt by using *--key* and *--salt*.
-
--K|--key <master key>
-~~~~~~~~~~~~~~~~~~~~~
-
-master key to use for key derivation
-
-Master key in hexadecimal notation, eg
-01a2b3c4d5e6f708a9b0cadbecfd0fa1, with a mandatory length
-of 32, 48 or 64 characters (128, 192 or 256 bits).
-
--A|--salt <master salt>
-~~~~~~~~~~~~~~~~~~~~~~~
-
-master salt to use for key derivation
-
-Master salt in hexadecimal notation, eg
-01a2b3c4d5e6f708a9b0cadbecfd, with a mandatory length
-of 28 characters (14 bytes).
-
--c|--cipher <cipher type>
-~~~~~~~~~~~~~~~~~~~~~~~~~
-
-payload encryption algorithm
-
-Encryption algorithm used for encrypting the payload
-
-Possible values:
-
-* *null* - no encryption
-* *aes-ctr* - AES in counter mode with 128 Bits, default value
-* *aes-ctr-128* - AES in counter mode with 128 Bits
-* *aes-ctr-192* - AES in counter mode with 192 Bits
-* *aes-ctr-256* - AES in counter mode with 256 Bits
-
--a|--auth-algo <algo type>
-~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-message authentication algorithm
-
-This option sets the message authentication algorithm.
-
-Possible values:
-
-* *null* - no message authentication
-* *sha1* - HMAC-SHA1, default value
-
-If HMAC-SHA1 is used, the packet length is increased. The additional bytes 
-contain the authentication data. see *-b|--auth-tag-length* for more info.
-
--b|--auth-tag-length <length>
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-The number of bytes to use for the auth tag. This value defaults to 10 bytes 
-unless the *null* auth algo is used in which case it defaults to 0. 
 
 EXAMPLES
 --------
@@ -321,18 +257,18 @@ P2P Setup between two unicast enpoints:
 Host A:
 ^^^^^^^
 
-uanytun -r hostb.example.com -t tun -n 192.168.123.1/30 -c aes-ctr-256 -k aes-ctr-256 \
+uanytun -r hostb.example.com -t tun -n 192.168.123.1/30 -c aes-ctr-256 -k aes-ctr-256
         -E have_a_very_safe_and_productive_day -e left
 
 Host B:
 ^^^^^^^
-uanytun -r hosta.example.com -t tun -n 192.168.123.2/30 -c aes-ctr-256 -k aes-ctr-256 \
+uanytun -r hosta.example.com -t tun -n 192.168.123.2/30 -c aes-ctr-256 -k aes-ctr-256
         -E have_a_very_safe_and_productive_day -e right
 
 
 One unicast and one anycast tunnel endpoint:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- 
+
 Unicast tunnel endpoint:
 ^^^^^^^^^^^^^^^^^^^^^^^^
 
@@ -341,19 +277,22 @@ uanytun -r anycast.anytun.org -d anytun0 -t tun -n 192.0.2.2/30 -a null -c null
 Anycast tunnel endpoints:
 ^^^^^^^^^^^^^^^^^^^^^^^^^
 As *uAnytun* can't work as an anycast endpoint it can't be used for this purpose. You
-have to use *anytun* for that job.
+have to use *Anytun* for that job.
 
 
 BUGS
 ----
+
 Most likely there are some bugs in *uAnytun*. If you find a bug, please let
 the developers know at uanytun@anytun.org. Of course, patches are preferred.
 
+
 AUTHORS
 -------
 
 Christian Pointner <equinox@anytun.org>
 
+
 RESOURCES
 ---------
 
@@ -363,8 +302,7 @@ Main web site: http://www.anytun.org/
 COPYING
 -------
 
-Copyright \(C) 2008-2009 Christian Pointner. This  program is  free 
-software; you can redistribute it and/or modify it under the terms 
-of the GNU General Public License version 3 as published by the 
-Free Software Foundation.
-
+Copyright \(C) 2008-2014 Christian Pointner. This  program is  free
+software: you can redistribute it and/or modify it under the terms
+of the GNU General Public License as published by the Free Software
+Foundation, either version 3 of the License, or any later version.