From: niklas <niklas@openbsd.org>
Date: Fri, 21 Feb 1997 23:17:19 +0000 (+0000)
Subject: Integration of IPSEC userland tools, no manpages yet, sorry.
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=937ca372737666226f4fb8070d244a877a294cad;p=openbsd

Integration of IPSEC userland tools, no manpages yet, sorry.
---

diff --git a/sbin/ipsec/Makefile b/sbin/ipsec/Makefile
new file mode 100644
index 00000000000..2e3bc3431f9
--- /dev/null
+++ b/sbin/ipsec/Makefile
@@ -0,0 +1,6 @@
+#	$OpenBSD: Makefile,v 1.1 1997/02/21 23:17:19 niklas Exp $
+
+SUBDIR=	delspi pfr rt rtdelete sah sahhmac sesp sesp3md5 sespmd5 sgrp shahmac \
+	si4
+
+.include <bsd.subdir.mk>
diff --git a/sbin/ipsec/Makefile.inc b/sbin/ipsec/Makefile.inc
new file mode 100644
index 00000000000..f208c3b74b0
--- /dev/null
+++ b/sbin/ipsec/Makefile.inc
@@ -0,0 +1,4 @@
+#	$OpenBSD: Makefile.inc,v 1.1 1997/02/21 23:17:22 niklas Exp $
+
+BINDIR=	/sbin
+NOMAN=
diff --git a/sbin/ipsec/delspi/Makefile b/sbin/ipsec/delspi/Makefile
new file mode 100644
index 00000000000..35b1928cd0e
--- /dev/null
+++ b/sbin/ipsec/delspi/Makefile
@@ -0,0 +1,5 @@
+#	$OpenBSD: Makefile,v 1.1 1997/02/21 23:17:23 niklas Exp $
+
+PROG=	delspi
+
+.include <bsd.prog.mk>
diff --git a/sbin/ipsec/delspi/delspi.c b/sbin/ipsec/delspi/delspi.c
new file mode 100644
index 00000000000..8a9d837466e
--- /dev/null
+++ b/sbin/ipsec/delspi/delspi.c
@@ -0,0 +1,94 @@
+/*
+ * The author of this code is John Ioannidis, ji@tla.org,
+ * 	(except when noted otherwise).
+ *
+ * This code was written for BSD/OS in Athens, Greece, in November 1995.
+ *
+ * Ported to NetBSD, with additional transforms, in December 1996,
+ * by Angelos D. Keromytis, kermit@forthnet.gr.
+ *
+ * Copyright (C) 1995, 1996, 1997 by John Ioannidis and Angelos D. Keromytis.
+ *	
+ * Permission to use, copy, and modify this software without fee
+ * is hereby granted, provided that this entire notice is included in
+ * all copies of any software which is or includes a copy or
+ * modification of this software.
+ *
+ * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTY. IN PARTICULAR, NEITHER AUTHOR MAKES ANY
+ * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
+ * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
+ * PURPOSE.
+ */
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/mbuf.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/route.h>
+#include <net/if_dl.h>
+#include <netinet/in.h>
+#include <netns/ns.h>
+#include <netiso/iso.h>
+#include <netccitt/x25.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+#include <paths.h>
+#include "net/encap.h"
+#include "netinet/ip_ipsp.h"
+
+#define IFT_ENC 0x37
+
+
+char buf[1024];
+
+main(argc, argv)
+int argc;
+char **argv;
+{
+	int sd, len, i, chain;
+
+	struct encap_msghdr *em;
+	struct sockaddr_encap *dst, *msk, *gw;
+	struct sockaddr_dl *dl;
+	u_char *opts;
+
+	if (argc != 5)
+	  fprintf(stderr, "usage: %s dst spi chaindelete alg\n", argv[0]), exit(1);
+	sd = socket(AF_ENCAP, SOCK_RAW, AF_UNSPEC);
+	if (sd < 0)
+	  perror("socket"), exit(1);
+	
+	chain = atoi(argv[3]);
+	em = (struct encap_msghdr *)&buf[0];
+	
+	if (chain)
+	  em->em_msglen = EMT_DELSPI_FLEN;
+	else
+	  em->em_msglen = EMT_DELSPICHAIN_FLEN;
+	em->em_version = 0;
+	if (chain)
+	  em->em_type = EMT_DELSPICHAIN;
+	else
+	  em->em_type = EMT_DELSPI;
+	em->em_spi = htonl(strtol(argv[2], NULL, 16));
+	em->em_if = 1;
+	em->em_dst.s_addr = inet_addr(argv[1]);
+	em->em_alg = atoi(argv[4]);  /* sanity checking in the kernel */
+
+	if (write(sd, buf, em->em_msglen) != em->em_msglen)
+	  perror("write");
+}
+
+
diff --git a/sbin/ipsec/pfr/Makefile b/sbin/ipsec/pfr/Makefile
new file mode 100644
index 00000000000..5acb79a73ca
--- /dev/null
+++ b/sbin/ipsec/pfr/Makefile
@@ -0,0 +1,5 @@
+#	$OpenBSD: Makefile,v 1.1 1997/02/21 23:17:26 niklas Exp $
+
+PROG=	pfr
+
+.include <bsd.prog.mk>
diff --git a/sbin/ipsec/pfr/pfr.c b/sbin/ipsec/pfr/pfr.c
new file mode 100644
index 00000000000..6be4a6a3435
--- /dev/null
+++ b/sbin/ipsec/pfr/pfr.c
@@ -0,0 +1,91 @@
+/*
+ * The author of this code is John Ioannidis, ji@tla.org,
+ * 	(except when noted otherwise).
+ *
+ * This code was written for BSD/OS in Athens, Greece, in November 1995.
+ *
+ * Ported to NetBSD, with additional transforms, in December 1996,
+ * by Angelos D. Keromytis, kermit@forthnet.gr.
+ *
+ * Copyright (C) 1995, 1996, 1997 by John Ioannidis and Angelos D. Keromytis.
+ *	
+ * Permission to use, copy, and modify this software without fee
+ * is hereby granted, provided that this entire notice is included in
+ * all copies of any software which is or includes a copy or
+ * modification of this software.
+ *
+ * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTY. IN PARTICULAR, NEITHER AUTHOR MAKES ANY
+ * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
+ * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
+ * PURPOSE.
+ */
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/mbuf.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/route.h>
+#include <net/if_dl.h>
+#include <netinet/in.h>
+#include <netns/ns.h>
+#include <netiso/iso.h>
+#include <netccitt/x25.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+#include <paths.h>
+#include "net/encap.h"
+ 
+
+#define IFT_ENC 0x37
+
+
+char buf[1024];
+
+main(argc, argv)
+int argc;
+char **argv;
+{
+	int sd;
+
+	struct encap_msghdr *em;
+	
+	struct sockaddr_encap *dst, *msk, *gw;
+	struct sockaddr_dl *dl;
+	u_char *opts;
+
+	if (argc != 3)
+	  fprintf(stderr, "usage: %s if# ipaddr\n", argv[0]), exit(1);
+	
+	sd = socket(AF_ENCAP, SOCK_RAW, AF_UNSPEC);
+	if (sd < 0)
+	  perror("socket"), exit(1);
+	
+	em = (struct encap_msghdr *)&buf[0];
+	
+	em->em_msglen = EM_MINLEN;
+	em->em_version = 0;
+	em->em_type = EMT_IFADDR;
+	em->em_ifa.s_addr = inet_addr(argv[2]);
+	em->em_ifn = atoi(argv[1]);
+	
+	if (write(sd, buf, EMT_IFADDR_LEN) != EMT_IFADDR_LEN)
+	  perror("write");
+	
+	
+	
+
+}
+
+
diff --git a/sbin/ipsec/rt/Makefile b/sbin/ipsec/rt/Makefile
new file mode 100644
index 00000000000..6eb05e02113
--- /dev/null
+++ b/sbin/ipsec/rt/Makefile
@@ -0,0 +1,5 @@
+#	$OpenBSD: Makefile,v 1.1 1997/02/21 23:17:29 niklas Exp $
+
+PROG=	rt
+
+.include <bsd.prog.mk>
diff --git a/sbin/ipsec/rt/rt.c b/sbin/ipsec/rt/rt.c
new file mode 100644
index 00000000000..8dcf352a1f8
--- /dev/null
+++ b/sbin/ipsec/rt/rt.c
@@ -0,0 +1,182 @@
+/*
+ * The author of this code is John Ioannidis, ji@tla.org,
+ * 	(except when noted otherwise).
+ *
+ * This code was written for BSD/OS in Athens, Greece, in November 1995.
+ *
+ * Ported to NetBSD, with additional transforms, in December 1996,
+ * by Angelos D. Keromytis, kermit@forthnet.gr.
+ *
+ * Copyright (C) 1995, 1996, 1997 by John Ioannidis and Angelos D. Keromytis.
+ *	
+ * Permission to use, copy, and modify this software without fee
+ * is hereby granted, provided that this entire notice is included in
+ * all copies of any software which is or includes a copy or
+ * modification of this software.
+ *
+ * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTY. IN PARTICULAR, NEITHER AUTHOR MAKES ANY
+ * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
+ * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
+ * PURPOSE.
+ */
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/mbuf.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/route.h>
+#include <net/if_dl.h>
+#include <netinet/in.h>
+#include <netns/ns.h>
+#include <netiso/iso.h>
+#include <netccitt/x25.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+#include <paths.h>
+
+ 
+
+#define SENO_EOL        0x00            /* End of Options, or placeholder */
+#define SENO_NOP        0x01            /* No Operation. Skip */
+#define SENO_NAME       0x02            /* tunnel name, NUL-terminated */
+#define SENO_TDB        0x03            /* tunnel descriptor block address */
+#define SENO_IFN        0x04            /* Encap interface number */
+#define SENO_IFIP4A     0x05            /* Encap interface IPv4 address */
+#define SENO_IPSA       0x06            /* Encap interface generic sockaddr */
+
+
+#define IFT_ENC 0x37
+#define INET
+
+
+#include "net/encap.h"
+
+/*
+ * The numbers below are arbitrary. They have been chosen for their
+ * mnemonic value. If sen_len is larger than what would be expected from
+ * the length of the data that follow, then TLV-triplets follow the 
+ * addresses containing system-depended information.
+ */
+
+
+char buf[2048];
+
+main(argc, argv)
+int argc;
+char **argv;
+{
+	int sd;
+
+	struct rt_msghdr *rtm;
+	struct sockaddr_encap *dst, *msk, *gw;
+	struct sockaddr_dl *dl;
+	u_char *opts;
+
+	if (argc != 12)
+	  fprintf(stderr, "usage: %s isrc isrcmask idst idstmask osrc odst spi if proto sport dport\n", argv[0]), exit(1);
+	
+	sd = socket(PF_ROUTE, SOCK_RAW, AF_UNSPEC);
+	if (sd < 0)
+	  perror("socket"), exit(1);
+	
+	rtm = (struct rt_msghdr *)(&buf[0]);
+	dst = (struct sockaddr_encap *)(&buf[sizeof (*rtm)]);
+	gw = (struct sockaddr_encap *)(&buf[sizeof (*rtm) + SENT_IP4_LEN]);
+/*	opts = (u_char *)(&buf[sizeof (*rtm) + 2*SENT_IP4_LEN]); */
+	msk = (struct sockaddr_encap *)(&buf[sizeof (*rtm) + SENT_IP4_LEN + SENT_IPSP_LEN]);
+/*	dl = (struct sockaddr_dl *)(&buf[sizeof (*rtm) + 3*SENT_IP4_LEN + 12]); */
+	
+	rtm->rtm_version = RTM_VERSION;
+	rtm->rtm_type = RTM_ADD;
+	rtm->rtm_index = 0;
+	rtm->rtm_pid = getpid();
+	rtm->rtm_addrs = RTA_DST | RTA_GATEWAY | RTA_NETMASK /* | RTA_IFP */;
+	rtm->rtm_errno = 0;
+	rtm->rtm_flags = RTF_UP | RTF_GATEWAY | RTF_STATIC;
+	rtm->rtm_inits = 0;
+	
+	dst->sen_len = SENT_IP4_LEN;
+	dst->sen_family = AF_ENCAP;
+	dst->sen_type = SENT_IP4;
+	dst->sen_ip_src.s_addr = inet_addr(argv[1]);
+	dst->sen_ip_dst.s_addr = inet_addr(argv[3]);
+	dst->sen_proto = dst->sen_sport = dst->sen_dport = 0;
+
+	if (atoi(argv[9]) >= 0)
+	{
+		dst->sen_proto = atoi(argv[9]);
+		msk->sen_proto = 0xff;
+		if (atoi(argv[10]) >= 0)
+		{
+			dst->sen_sport = atoi(argv[10]);
+			msk->sen_sport = 0xffff;
+		}
+		if (atoi(argv[11]) >= 0)
+		{
+			dst->sen_dport = atoi(argv[11]);
+			msk->sen_dport = 0xffff;
+		}
+	}
+
+	gw->sen_len = SENT_IPSP_LEN;
+	gw->sen_family = AF_ENCAP;
+	gw->sen_type = SENT_IPSP;
+	gw->sen_ipsp_src.s_addr = inet_addr(argv[5]);
+	gw->sen_ipsp_dst.s_addr = inet_addr(argv[6]);
+	gw->sen_ipsp_spi = htonl(strtol(argv[7], NULL, 16));
+	gw->sen_ipsp_ifn = atoi(argv[8]);
+
+/*
+	opts[0] = SENO_IFN;
+	opts[1] = 3;
+	opts[2] = 2;
+	opts[3] = SENO_NOP;
+	opts[4] = SENO_NOP;
+	opts[5] = SENO_NOP;
+	opts[6] = SENO_SPI;
+	opts[7] = 4;
+	opts[8] = 0x12;
+	opts[9] = 0x34;
+	opts[10] = 0x56;
+	opts[11] = 0x78;
+*/
+	msk->sen_len = SENT_IP4_LEN;
+	msk->sen_family = AF_ENCAP;
+	msk->sen_type = SENT_IP4;
+	msk->sen_ip_src.s_addr = inet_addr(argv[2]);
+	msk->sen_ip_dst.s_addr = inet_addr(argv[4]);
+
+/*
+	dl->sdl_len = 12;
+	dl->sdl_family = AF_DLI;
+	dl->sdl_index = 0;
+	dl->sdl_type = IFT_ENC;
+	dl->sdl_nlen = 4;
+	dl->sdl_alen = 0;
+	dl->sdl_slen = 0;
+	dl->sdl_data[0] = 'e';
+	dl->sdl_data[1] = 'n';
+	dl->sdl_data[2] = 'c';
+	dl->sdl_data[3] = '2';
+*/
+
+	rtm->rtm_msglen = sizeof (*rtm) + dst->sen_len + gw->sen_len + msk->sen_len /* + dl->sdl_len */ ;
+	
+	if (write(sd, (caddr_t)buf, rtm->rtm_msglen) < 0)
+	  perror("write");
+}
+
+	
+	
diff --git a/sbin/ipsec/rtdelete/Makefile b/sbin/ipsec/rtdelete/Makefile
new file mode 100644
index 00000000000..f588a3f859b
--- /dev/null
+++ b/sbin/ipsec/rtdelete/Makefile
@@ -0,0 +1,5 @@
+#	$OpenBSD: Makefile,v 1.1 1997/02/21 23:17:32 niklas Exp $
+
+PROG=	rtdelete
+
+.include <bsd.prog.mk>
diff --git a/sbin/ipsec/rtdelete/rtdelete.c b/sbin/ipsec/rtdelete/rtdelete.c
new file mode 100644
index 00000000000..16d7044ae6e
--- /dev/null
+++ b/sbin/ipsec/rtdelete/rtdelete.c
@@ -0,0 +1,182 @@
+/*
+ * The author of this code is John Ioannidis, ji@tla.org,
+ * 	(except when noted otherwise).
+ *
+ * This code was written for BSD/OS in Athens, Greece, in November 1995.
+ *
+ * Ported to NetBSD, with additional transforms, in December 1996,
+ * by Angelos D. Keromytis, kermit@forthnet.gr.
+ *
+ * Copyright (C) 1995, 1996, 1997 by John Ioannidis and Angelos D. Keromytis.
+ *	
+ * Permission to use, copy, and modify this software without fee
+ * is hereby granted, provided that this entire notice is included in
+ * all copies of any software which is or includes a copy or
+ * modification of this software.
+ *
+ * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTY. IN PARTICULAR, NEITHER AUTHOR MAKES ANY
+ * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
+ * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
+ * PURPOSE.
+ */
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/mbuf.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/route.h>
+#include <net/if_dl.h>
+#include <netinet/in.h>
+#include <netns/ns.h>
+#include <netiso/iso.h>
+#include <netccitt/x25.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+#include <paths.h>
+
+ 
+
+#define SENO_EOL        0x00            /* End of Options, or placeholder */
+#define SENO_NOP        0x01            /* No Operation. Skip */
+#define SENO_NAME       0x02            /* tunnel name, NUL-terminated */
+#define SENO_TDB        0x03            /* tunnel descriptor block address */
+#define SENO_IFN        0x04            /* Encap interface number */
+#define SENO_IFIP4A     0x05            /* Encap interface IPv4 address */
+#define SENO_IPSA       0x06            /* Encap interface generic sockaddr */
+
+
+#define IFT_ENC 0x37
+#define INET
+
+
+#include "net/encap.h"
+
+/*
+ * The numbers below are arbitrary. They have been chosen for their
+ * mnemonic value. If sen_len is larger than what would be expected from
+ * the length of the data that follow, then TLV-triplets follow the 
+ * addresses containing system-depended information.
+ */
+
+
+char buf[2048];
+
+main(argc, argv)
+int argc;
+char **argv;
+{
+	int sd;
+
+	struct rt_msghdr *rtm;
+	struct sockaddr_encap *dst, *msk, *gw;
+	struct sockaddr_dl *dl;
+	u_char *opts;
+
+	if (argc != 12)
+	  fprintf(stderr, "usage: %s isrc isrcmask idst idstmask osrc odst spi if proto sport dport\n", argv[0]), exit(1);
+	
+	sd = socket(PF_ROUTE, SOCK_RAW, AF_UNSPEC);
+	if (sd < 0)
+	  perror("socket"), exit(1);
+	
+	rtm = (struct rt_msghdr *)(&buf[0]);
+	dst = (struct sockaddr_encap *)(&buf[sizeof (*rtm)]);
+	gw = (struct sockaddr_encap *)(&buf[sizeof (*rtm) + SENT_IP4_LEN]);
+/*	opts = (u_char *)(&buf[sizeof (*rtm) + 2*SENT_IP4_LEN]); */
+	msk = (struct sockaddr_encap *)(&buf[sizeof (*rtm) + SENT_IP4_LEN + SENT_IPSP_LEN]);
+/*	dl = (struct sockaddr_dl *)(&buf[sizeof (*rtm) + 3*SENT_IP4_LEN + 12]); */
+	
+	rtm->rtm_version = RTM_VERSION;
+	rtm->rtm_type = RTM_DELETE;
+	rtm->rtm_index = 0;
+	rtm->rtm_pid = getpid();
+	rtm->rtm_addrs = RTA_DST | RTA_GATEWAY | RTA_NETMASK /* | RTA_IFP */;
+	rtm->rtm_errno = 0;
+	rtm->rtm_flags = RTF_UP | RTF_GATEWAY | RTF_STATIC;
+	rtm->rtm_inits = 0;
+	
+	dst->sen_len = SENT_IP4_LEN;
+	dst->sen_family = AF_ENCAP;
+	dst->sen_type = SENT_IP4;
+	dst->sen_ip_src.s_addr = inet_addr(argv[1]);
+	dst->sen_ip_dst.s_addr = inet_addr(argv[3]);
+	dst->sen_proto = dst->sen_sport = dst->sen_dport = 0;
+
+	if (atoi(argv[9]) >= 0)
+	{
+		dst->sen_proto = atoi(argv[9]);
+		msk->sen_proto = 0xff;
+		if (atoi(argv[10]) >= 0)
+		{
+			dst->sen_sport = atoi(argv[10]);
+			msk->sen_sport = 0xffff;
+		}
+		if (atoi(argv[11]) >= 0)
+		{
+			dst->sen_dport = atoi(argv[11]);
+			msk->sen_dport = 0xffff;
+		}
+	}
+
+	gw->sen_len = SENT_IPSP_LEN;
+	gw->sen_family = AF_ENCAP;
+	gw->sen_type = SENT_IPSP;
+	gw->sen_ipsp_src.s_addr = inet_addr(argv[5]);
+	gw->sen_ipsp_dst.s_addr = inet_addr(argv[6]);
+	gw->sen_ipsp_spi = htonl(strtol(argv[7], NULL, 16));
+	gw->sen_ipsp_ifn = atoi(argv[8]);
+
+/*
+	opts[0] = SENO_IFN;
+	opts[1] = 3;
+	opts[2] = 2;
+	opts[3] = SENO_NOP;
+	opts[4] = SENO_NOP;
+	opts[5] = SENO_NOP;
+	opts[6] = SENO_SPI;
+	opts[7] = 4;
+	opts[8] = 0x12;
+	opts[9] = 0x34;
+	opts[10] = 0x56;
+	opts[11] = 0x78;
+*/
+	msk->sen_len = SENT_IP4_LEN;
+	msk->sen_family = AF_ENCAP;
+	msk->sen_type = SENT_IP4;
+	msk->sen_ip_src.s_addr = inet_addr(argv[2]);
+	msk->sen_ip_dst.s_addr = inet_addr(argv[4]);
+
+/*
+	dl->sdl_len = 12;
+	dl->sdl_family = AF_DLI;
+	dl->sdl_index = 0;
+	dl->sdl_type = IFT_ENC;
+	dl->sdl_nlen = 4;
+	dl->sdl_alen = 0;
+	dl->sdl_slen = 0;
+	dl->sdl_data[0] = 'e';
+	dl->sdl_data[1] = 'n';
+	dl->sdl_data[2] = 'c';
+	dl->sdl_data[3] = '2';
+*/
+
+	rtm->rtm_msglen = sizeof (*rtm) + dst->sen_len + gw->sen_len + msk->sen_len /* + dl->sdl_len */ ;
+	
+	if (write(sd, (caddr_t)buf, rtm->rtm_msglen) < 0)
+	  perror("write");
+}
+
+	
+	
diff --git a/sbin/ipsec/sah/Makefile b/sbin/ipsec/sah/Makefile
new file mode 100644
index 00000000000..c2465967fb8
--- /dev/null
+++ b/sbin/ipsec/sah/Makefile
@@ -0,0 +1,5 @@
+#	$OpenBSD: Makefile,v 1.1 1997/02/21 23:17:35 niklas Exp $
+
+PROG=	sah
+
+.include <bsd.prog.mk>
diff --git a/sbin/ipsec/sah/sah.c b/sbin/ipsec/sah/sah.c
new file mode 100644
index 00000000000..e2938fdb906
--- /dev/null
+++ b/sbin/ipsec/sah/sah.c
@@ -0,0 +1,111 @@
+/*
+ * The author of this code is John Ioannidis, ji@tla.org,
+ * 	(except when noted otherwise).
+ *
+ * This code was written for BSD/OS in Athens, Greece, in November 1995.
+ *
+ * Ported to NetBSD, with additional transforms, in December 1996,
+ * by Angelos D. Keromytis, kermit@forthnet.gr.
+ *
+ * Copyright (C) 1995, 1996, 1997 by John Ioannidis and Angelos D. Keromytis.
+ *	
+ * Permission to use, copy, and modify this software without fee
+ * is hereby granted, provided that this entire notice is included in
+ * all copies of any software which is or includes a copy or
+ * modification of this software.
+ *
+ * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTY. IN PARTICULAR, NEITHER AUTHOR MAKES ANY
+ * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
+ * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
+ * PURPOSE.
+ */
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/mbuf.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/route.h>
+#include <net/if_dl.h>
+#include <netinet/in.h>
+#include <netns/ns.h>
+#include <netiso/iso.h>
+#include <netccitt/x25.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+#include <paths.h>
+#include "net/encap.h"
+#include "netinet/ip_ipsp.h"
+#include "netinet/ip_ah.h"
+ 
+
+#define IFT_ENC 0x37
+
+
+char buf[1024];
+
+int x2i(char *s)
+{
+	char ss[3];
+	ss[0] = s[0];
+	ss[1] = s[1];
+	ss[2] = 0;
+
+	return strtol(ss, NULL, 16);
+}
+	
+
+main(argc, argv)
+int argc;
+char **argv;
+{
+	int sd, len, klen, i;
+
+	struct encap_msghdr *em;
+	struct ahmd5_xdata *xd;
+	struct sockaddr_encap *dst, *msk, *gw;
+	struct sockaddr_dl *dl;
+	u_char *opts;
+
+	if (argc != 4)
+	  fprintf(stderr, "usage: %s dst spi key\n", argv[0]), exit(1);
+	sd = socket(AF_ENCAP, SOCK_RAW, AF_UNSPEC);
+	if (sd < 0)
+	  perror("socket"), exit(1);
+	
+	klen = strlen(argv[3])/2;
+
+	em = (struct encap_msghdr *)&buf[0];
+	
+	em->em_msglen = EMT_SETSPI_FLEN + 4 + klen;
+	em->em_version = 0;
+	em->em_type = EMT_SETSPI;
+	em->em_spi = htonl(strtol(argv[2], NULL, 16));
+	em->em_if = 1;
+	em->em_dst.s_addr = inet_addr(argv[1]);
+	em->em_alg = XF_AHMD5;
+	xd = (struct ahmd5_xdata *)(em->em_dat);
+
+	xd->amx_klen = klen;
+	xd->amx_alen = 16;
+	
+
+	for (i = 0; i < klen; i++ )
+	  xd->amx_key[i] = x2i(&(argv[3][2*i]));
+	
+	if (write(sd, buf, em->em_msglen) != em->em_msglen)
+	  perror("write");
+}
+
+
diff --git a/sbin/ipsec/sahhmac/Makefile b/sbin/ipsec/sahhmac/Makefile
new file mode 100644
index 00000000000..a2b0b37dd5c
--- /dev/null
+++ b/sbin/ipsec/sahhmac/Makefile
@@ -0,0 +1,5 @@
+#	$OpenBSD: Makefile,v 1.1 1997/02/21 23:17:37 niklas Exp $
+
+PROG=	sahhmac
+
+.include <bsd.prog.mk>
diff --git a/sbin/ipsec/sahhmac/sahhmac.c b/sbin/ipsec/sahhmac/sahhmac.c
new file mode 100644
index 00000000000..efcfc429b95
--- /dev/null
+++ b/sbin/ipsec/sahhmac/sahhmac.c
@@ -0,0 +1,110 @@
+/*
+ * The author of this code is John Ioannidis, ji@tla.org,
+ * 	(except when noted otherwise).
+ *
+ * This code was written for BSD/OS in Athens, Greece, in November 1995.
+ *
+ * Ported to NetBSD, with additional transforms, in December 1996,
+ * by Angelos D. Keromytis, kermit@forthnet.gr.
+ *
+ * Copyright (C) 1995, 1996, 1997 by John Ioannidis and Angelos D. Keromytis.
+ *	
+ * Permission to use, copy, and modify this software without fee
+ * is hereby granted, provided that this entire notice is included in
+ * all copies of any software which is or includes a copy or
+ * modification of this software.
+ *
+ * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTY. IN PARTICULAR, NEITHER AUTHOR MAKES ANY
+ * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
+ * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
+ * PURPOSE.
+ */
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/mbuf.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/route.h>
+#include <net/if_dl.h>
+#include <netinet/in.h>
+#include <netns/ns.h>
+#include <netiso/iso.h>
+#include <netccitt/x25.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+#include <paths.h>
+#include "net/encap.h"
+#include "netinet/ip_ipsp.h"
+#include "netinet/ip_ah.h"
+ 
+
+#define IFT_ENC 0x37
+
+
+char buf[1024];
+
+int x2i(char *s)
+{
+	char ss[3];
+	ss[0] = s[0];
+	ss[1] = s[1];
+	ss[2] = 0;
+
+	return strtol(ss, NULL, 16);
+}
+	
+
+main(argc, argv)
+int argc;
+char **argv;
+{
+	int sd, len, klen, i;
+
+	struct encap_msghdr *em;
+	struct ahhmacmd5_xencap *xd;
+	struct sockaddr_encap *dst, *msk, *gw;
+	struct sockaddr_dl *dl;
+	u_char *opts;
+
+	if (argc != 4)
+	  fprintf(stderr, "usage: %s dst spi key\n", argv[0]), exit(1);
+	sd = socket(AF_ENCAP, SOCK_RAW, AF_UNSPEC);
+	if (sd < 0)
+	  perror("socket"), exit(1);
+	
+	klen = strlen(argv[3])/2;
+
+	em = (struct encap_msghdr *)&buf[0];
+	
+	em->em_msglen = EMT_SETSPI_FLEN + 4 + AHHMACMD5_KMAX;
+	em->em_version = 0;
+	em->em_type = EMT_SETSPI;
+	em->em_spi = htonl(strtol(argv[2], NULL, 16));
+	em->em_if = 1;
+	em->em_dst.s_addr = inet_addr(argv[1]);
+	em->em_alg = XF_AHHMACMD5;
+	xd = (struct ahhmacmd5_xencap *)(em->em_dat);
+
+	xd->amx_alen = 16;
+	xd->amx_rpl = 1;
+	xd->amx_wnd = 32;
+
+	bzero(xd->amx_key, AHHMACMD5_KMAX);
+	for (i = 0; i < klen; i++ )
+	  xd->amx_key[i] = x2i(&(argv[3][2*i]));
+
+	if (write(sd, buf, em->em_msglen) != em->em_msglen)
+	  perror("write");
+}
diff --git a/sbin/ipsec/sesp/Makefile b/sbin/ipsec/sesp/Makefile
new file mode 100644
index 00000000000..733b389ec57
--- /dev/null
+++ b/sbin/ipsec/sesp/Makefile
@@ -0,0 +1,5 @@
+#	$OpenBSD: Makefile,v 1.1 1997/02/21 23:17:39 niklas Exp $
+
+PROG=	sesp
+
+.include <bsd.prog.mk>
diff --git a/sbin/ipsec/sesp/sesp.c b/sbin/ipsec/sesp/sesp.c
new file mode 100644
index 00000000000..ed0583b7738
--- /dev/null
+++ b/sbin/ipsec/sesp/sesp.c
@@ -0,0 +1,117 @@
+/*
+ * The author of this code is John Ioannidis, ji@tla.org,
+ * 	(except when noted otherwise).
+ *
+ * This code was written for BSD/OS in Athens, Greece, in November 1995.
+ *
+ * Ported to NetBSD, with additional transforms, in December 1996,
+ * by Angelos D. Keromytis, kermit@forthnet.gr.
+ *
+ * Copyright (C) 1995, 1996, 1997 by John Ioannidis and Angelos D. Keromytis.
+ *	
+ * Permission to use, copy, and modify this software without fee
+ * is hereby granted, provided that this entire notice is included in
+ * all copies of any software which is or includes a copy or
+ * modification of this software.
+ *
+ * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTY. IN PARTICULAR, NEITHER AUTHOR MAKES ANY
+ * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
+ * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
+ * PURPOSE.
+ */
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/mbuf.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/route.h>
+#include <net/if_dl.h>
+#include <netinet/in.h>
+#include <netns/ns.h>
+#include <netiso/iso.h>
+#include <netccitt/x25.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+#include <paths.h>
+#include "net/encap.h"
+#include "netinet/ip_ipsp.h"
+#include "netinet/ip_esp.h"
+ 
+
+#define IFT_ENC 0x37
+
+
+char buf[1024];
+
+int x2i(char *s)
+{
+	char ss[3];
+	ss[0] = s[0];
+	ss[1] = s[1];
+	ss[2] = 0;
+
+	return strtol(ss, NULL, 16);
+}
+	
+
+main(argc, argv)
+int argc;
+char **argv;
+{
+	int sd, len, i;
+
+	struct encap_msghdr *em;
+	struct espdes_xdata *xd;
+	struct sockaddr_encap *dst, *msk, *gw;
+	struct sockaddr_dl *dl;
+	u_char *opts;
+
+	if (argc != 5)
+	  fprintf(stderr, "usage: %s dst spi iv key\n", argv[0]), exit(1);
+	sd = socket(AF_ENCAP, SOCK_RAW, AF_UNSPEC);
+	if (sd < 0)
+	  perror("socket"), exit(1);
+	
+	em = (struct encap_msghdr *)&buf[0];
+	
+	em->em_msglen = EMT_SETSPI_FLEN + ESP_ULENGTH;
+	em->em_version = 0;
+	em->em_type = EMT_SETSPI;
+	em->em_spi = htonl(strtol(argv[2], NULL, 16));
+	em->em_if = 1;
+	em->em_dst.s_addr = inet_addr(argv[1]);
+	em->em_alg = XF_ESPDES;
+	xd = (struct espdes_xdata *)(em->em_dat);
+
+	xd->edx_ivlen = 4;
+
+#if 0
+#define max(_a,_b) (((_a)>(_b))?(_a):(_b))
+
+	memcpy(&(xd->edx_iv[0]), argv[3], max(strlen(argv[3]), 8));
+	memcpy(&(xd->edx_iv[8]), argv[4], max(strlen(argv[4]), 8));
+#endif
+
+	for (i = 0; i < 4; i++)
+	  xd->edx_iv[i] = x2i(&(argv[3][2*i]));
+
+	for (i = 0; i < 8; i++)
+	  xd->edx_iv[i+8] = x2i(&(argv[4][2*i]));
+
+	if (write(sd, buf, em->em_msglen) != em->em_msglen)
+	  perror("write");
+}
+
+
diff --git a/sbin/ipsec/sesp3md5/Makefile b/sbin/ipsec/sesp3md5/Makefile
new file mode 100644
index 00000000000..8c563648aaa
--- /dev/null
+++ b/sbin/ipsec/sesp3md5/Makefile
@@ -0,0 +1,5 @@
+#	$OpenBSD: Makefile,v 1.1 1997/02/21 23:17:42 niklas Exp $
+
+PROG=	sesp3md5
+
+.include <bsd.prog.mk>
diff --git a/sbin/ipsec/sesp3md5/sesp3md5.c b/sbin/ipsec/sesp3md5/sesp3md5.c
new file mode 100644
index 00000000000..c98c378c036
--- /dev/null
+++ b/sbin/ipsec/sesp3md5/sesp3md5.c
@@ -0,0 +1,117 @@
+/*
+ * The author of this code is John Ioannidis, ji@tla.org,
+ * 	(except when noted otherwise).
+ *
+ * This code was written for BSD/OS in Athens, Greece, in November 1995.
+ *
+ * Ported to NetBSD, with additional transforms, in December 1996,
+ * by Angelos D. Keromytis, kermit@forthnet.gr.
+ *
+ * Copyright (C) 1995, 1996, 1997 by John Ioannidis and Angelos D. Keromytis.
+ *	
+ * Permission to use, copy, and modify this software without fee
+ * is hereby granted, provided that this entire notice is included in
+ * all copies of any software which is or includes a copy or
+ * modification of this software.
+ *
+ * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTY. IN PARTICULAR, NEITHER AUTHOR MAKES ANY
+ * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
+ * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
+ * PURPOSE.
+ */
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/mbuf.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/route.h>
+#include <net/if_dl.h>
+#include <netinet/in.h>
+#include <netns/ns.h>
+#include <netiso/iso.h>
+#include <netccitt/x25.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+#include <paths.h>
+#include "net/encap.h"
+#include "netinet/ip_ipsp.h"
+#include "netinet/ip_esp.h"
+ 
+
+#define IFT_ENC 0x37
+
+
+char buf[1024];
+
+int x2i(char *s)
+{
+	char ss[3];
+	ss[0] = s[0];
+	ss[1] = s[1];
+	ss[2] = 0;
+
+	return strtol(ss, NULL, 16);
+}
+	
+
+main(argc, argv)
+int argc;
+char **argv;
+{
+	int sd, len, i;
+
+	struct encap_msghdr *em;
+	struct esp3desmd5_xencap *xd;
+	struct sockaddr_encap *dst, *msk, *gw;
+	struct sockaddr_dl *dl;
+	u_char *opts;
+
+	if (argc != 5)
+	  fprintf(stderr, "usage: %s dst spi iv key\n", argv[0]), exit(1);
+	sd = socket(AF_ENCAP, SOCK_RAW, AF_UNSPEC);
+	if (sd < 0)
+	  perror("socket"), exit(1);
+	
+	em = (struct encap_msghdr *)&buf[0];
+	
+	em->em_msglen = EMT_SETSPI_FLEN + ESP3DESMD5_ULENGTH;
+	em->em_version = 0;
+	em->em_type = EMT_SETSPI;
+	em->em_spi = htonl(strtol(argv[2], NULL, 16));
+	em->em_if = 1;
+	em->em_dst.s_addr = inet_addr(argv[1]);
+	em->em_alg = XF_ESP3DESMD5;
+	xd = (struct esp3desmd5_xencap *)(em->em_dat);
+
+	xd->edx_ivlen = 0;
+	xd->edx_initiator = 1;
+	xd->edx_wnd = 32;
+	xd->edx_keylen = 8;
+
+#if 0
+#define max(_a,_b) (((_a)>(_b))?(_a):(_b))
+
+	memcpy(&(xd->edx_iv[0]), argv[3], max(strlen(argv[3]), 8));
+	memcpy(&(xd->edx_iv[8]), argv[4], max(strlen(argv[4]), 8));
+#endif
+
+	for (i = 0; i < 8; i++)
+	  xd->edx_key[i] = x2i(&(argv[4][2*i]));
+
+	if (write(sd, buf, em->em_msglen) != em->em_msglen)
+	  perror("write");
+}
+
+
diff --git a/sbin/ipsec/sespmd5/Makefile b/sbin/ipsec/sespmd5/Makefile
new file mode 100644
index 00000000000..94aaab66200
--- /dev/null
+++ b/sbin/ipsec/sespmd5/Makefile
@@ -0,0 +1,5 @@
+#	$OpenBSD: Makefile,v 1.1 1997/02/21 23:17:44 niklas Exp $
+
+PROG=	sespmd5
+
+.include <bsd.prog.mk>
diff --git a/sbin/ipsec/sespmd5/sespmd5.c b/sbin/ipsec/sespmd5/sespmd5.c
new file mode 100644
index 00000000000..6badd4e0fc0
--- /dev/null
+++ b/sbin/ipsec/sespmd5/sespmd5.c
@@ -0,0 +1,117 @@
+/*
+ * The author of this code is John Ioannidis, ji@tla.org,
+ * 	(except when noted otherwise).
+ *
+ * This code was written for BSD/OS in Athens, Greece, in November 1995.
+ *
+ * Ported to NetBSD, with additional transforms, in December 1996,
+ * by Angelos D. Keromytis, kermit@forthnet.gr.
+ *
+ * Copyright (C) 1995, 1996, 1997 by John Ioannidis and Angelos D. Keromytis.
+ *	
+ * Permission to use, copy, and modify this software without fee
+ * is hereby granted, provided that this entire notice is included in
+ * all copies of any software which is or includes a copy or
+ * modification of this software.
+ *
+ * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTY. IN PARTICULAR, NEITHER AUTHOR MAKES ANY
+ * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
+ * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
+ * PURPOSE.
+ */
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/mbuf.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/route.h>
+#include <net/if_dl.h>
+#include <netinet/in.h>
+#include <netns/ns.h>
+#include <netiso/iso.h>
+#include <netccitt/x25.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+#include <paths.h>
+#include "net/encap.h"
+#include "netinet/ip_ipsp.h"
+#include "netinet/ip_esp.h"
+ 
+
+#define IFT_ENC 0x37
+
+
+char buf[1024];
+
+int x2i(char *s)
+{
+	char ss[3];
+	ss[0] = s[0];
+	ss[1] = s[1];
+	ss[2] = 0;
+
+	return strtol(ss, NULL, 16);
+}
+	
+
+main(argc, argv)
+int argc;
+char **argv;
+{
+	int sd, len, i;
+
+	struct encap_msghdr *em;
+	struct espdesmd5_xencap *xd;
+	struct sockaddr_encap *dst, *msk, *gw;
+	struct sockaddr_dl *dl;
+	u_char *opts;
+
+	if (argc != 5)
+	  fprintf(stderr, "usage: %s dst spi iv key\n", argv[0]), exit(1);
+	sd = socket(AF_ENCAP, SOCK_RAW, AF_UNSPEC);
+	if (sd < 0)
+	  perror("socket"), exit(1);
+	
+	em = (struct encap_msghdr *)&buf[0];
+	
+	em->em_msglen = EMT_SETSPI_FLEN + ESPDESMD5_ULENGTH;
+	em->em_version = 0;
+	em->em_type = EMT_SETSPI;
+	em->em_spi = htonl(strtol(argv[2], NULL, 16));
+	em->em_if = 1;
+	em->em_dst.s_addr = inet_addr(argv[1]);
+	em->em_alg = XF_ESPDESMD5;
+	xd = (struct espdesmd5_xencap *)(em->em_dat);
+
+	xd->edx_ivlen = 0;
+	xd->edx_initiator = 1;
+	xd->edx_wnd = 32;
+	xd->edx_keylen = 8;
+
+#if 0
+#define max(_a,_b) (((_a)>(_b))?(_a):(_b))
+
+	memcpy(&(xd->edx_iv[0]), argv[3], max(strlen(argv[3]), 8));
+	memcpy(&(xd->edx_iv[8]), argv[4], max(strlen(argv[4]), 8));
+#endif
+
+	for (i = 0; i < 8; i++)
+	  xd->edx_key[i] = x2i(&(argv[4][2*i]));
+
+	if (write(sd, buf, em->em_msglen) != em->em_msglen)
+	  perror("write");
+}
+
+
diff --git a/sbin/ipsec/sgrp/Makefile b/sbin/ipsec/sgrp/Makefile
new file mode 100644
index 00000000000..326ead5e3bf
--- /dev/null
+++ b/sbin/ipsec/sgrp/Makefile
@@ -0,0 +1,5 @@
+#	$OpenBSD: Makefile,v 1.1 1997/02/21 23:17:48 niklas Exp $
+
+PROG=	sgrp
+
+.include <bsd.prog.mk>
diff --git a/sbin/ipsec/sgrp/sgrp.c b/sbin/ipsec/sgrp/sgrp.c
new file mode 100644
index 00000000000..c8be606f5b4
--- /dev/null
+++ b/sbin/ipsec/sgrp/sgrp.c
@@ -0,0 +1,105 @@
+/*
+ * The author of this code is John Ioannidis, ji@tla.org,
+ * 	(except when noted otherwise).
+ *
+ * This code was written for BSD/OS in Athens, Greece, in November 1995.
+ *
+ * Ported to NetBSD, with additional transforms, in December 1996,
+ * by Angelos D. Keromytis, kermit@forthnet.gr.
+ *
+ * Copyright (C) 1995, 1996, 1997 by John Ioannidis and Angelos D. Keromytis.
+ *	
+ * Permission to use, copy, and modify this software without fee
+ * is hereby granted, provided that this entire notice is included in
+ * all copies of any software which is or includes a copy or
+ * modification of this software.
+ *
+ * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTY. IN PARTICULAR, NEITHER AUTHOR MAKES ANY
+ * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
+ * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
+ * PURPOSE.
+ */
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/mbuf.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/route.h>
+#include <net/if_dl.h>
+#include <netinet/in.h>
+#include <netns/ns.h>
+#include <netiso/iso.h>
+#include <netccitt/x25.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+#include <paths.h>
+#include "net/encap.h"
+#include "netinet/ip_ipsp.h"
+ 
+
+#define IFT_ENC 0x37
+
+
+char buf[1024];
+
+main(argc, argv)
+int argc;
+char **argv;
+{
+	int sd, len, nspis;
+
+	struct encap_msghdr *em;
+	struct espdes_xdata *xd;
+	struct sockaddr_encap *dst, *msk, *gw;
+	struct sockaddr_dl *dl;
+	u_char *opts;
+
+	if ((argc < 3) || (argc > 9) || ((argc % 2) != 1))
+	  fprintf(stderr, "usage: %s dst1 spi1 [ dst2 spi2 [ dst3 spi3 [ dst4 spi4 ] ] ] \n", argv[0]), exit(1);
+	nspis = argc / 2;
+	
+	sd = socket(AF_ENCAP, SOCK_RAW, AF_UNSPEC);
+	if (sd < 0)
+	  perror("socket"), exit(1);
+	
+	em = (struct encap_msghdr *)&buf[0];
+	
+	em->em_msglen = 4 + nspis * 12;
+	em->em_version = 0;
+	em->em_type = EMT_GRPSPIS;
+
+	switch (nspis)
+	{
+	      case 4:
+		em->em_rel[3].emr_spi = htonl(strtol(argv[8], NULL, 16));
+		em->em_rel[3].emr_dst.s_addr = inet_addr(argv[7]);
+	      case 3:
+		em->em_rel[2].emr_spi = htonl(strtol(argv[6], NULL, 16));
+		em->em_rel[2].emr_dst.s_addr = inet_addr(argv[5]);
+	      case 2:
+		em->em_rel[1].emr_spi = htonl(strtol(argv[4], NULL, 16));
+		em->em_rel[1].emr_dst.s_addr = inet_addr(argv[3]);
+	      case 1:
+		em->em_rel[0].emr_spi = htonl(strtol(argv[2], NULL, 16));
+		em->em_rel[0].emr_dst.s_addr = inet_addr(argv[1]);
+		break;
+	}
+	
+	
+	if (write(sd, buf, em->em_msglen) != em->em_msglen)
+	  perror("write");
+}
+
+
diff --git a/sbin/ipsec/shahmac/Makefile b/sbin/ipsec/shahmac/Makefile
new file mode 100644
index 00000000000..e6735e96558
--- /dev/null
+++ b/sbin/ipsec/shahmac/Makefile
@@ -0,0 +1,5 @@
+#	$OpenBSD: Makefile,v 1.1 1997/02/21 23:17:51 niklas Exp $
+
+PROG=	shahmac
+
+.include <bsd.prog.mk>
diff --git a/sbin/ipsec/shahmac/shahmac.c b/sbin/ipsec/shahmac/shahmac.c
new file mode 100644
index 00000000000..34905546d7e
--- /dev/null
+++ b/sbin/ipsec/shahmac/shahmac.c
@@ -0,0 +1,109 @@
+/*
+ * The author of this code is John Ioannidis, ji@tla.org,
+ * 	(except when noted otherwise).
+ *
+ * This code was written for BSD/OS in Athens, Greece, in November 1995.
+ *
+ * Ported to NetBSD, with additional transforms, in December 1996,
+ * by Angelos D. Keromytis, kermit@forthnet.gr.
+ *
+ * Copyright (C) 1995, 1996, 1997 by John Ioannidis and Angelos D. Keromytis.
+ *	
+ * Permission to use, copy, and modify this software without fee
+ * is hereby granted, provided that this entire notice is included in
+ * all copies of any software which is or includes a copy or
+ * modification of this software.
+ *
+ * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTY. IN PARTICULAR, NEITHER AUTHOR MAKES ANY
+ * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
+ * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
+ * PURPOSE.
+ */
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/mbuf.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/route.h>
+#include <net/if_dl.h>
+#include <netinet/in.h>
+#include <netns/ns.h>
+#include <netiso/iso.h>
+#include <netccitt/x25.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+#include <paths.h>
+#include "net/encap.h"
+#include "netinet/ip_ipsp.h"
+#include "netinet/ip_ah.h"
+ 
+
+#define IFT_ENC 0x37
+
+
+char buf[1024];
+
+int x2i(char *s)
+{
+	char ss[3];
+	ss[0] = s[0];
+	ss[1] = s[1];
+	ss[2] = 0;
+
+	return strtol(ss, NULL, 16);
+}
+	
+
+main(argc, argv)
+int argc;
+char **argv;
+{
+	int sd, len, klen, i;
+
+	struct encap_msghdr *em;
+	struct ahhmacsha1_xencap *xd;
+	struct sockaddr_encap *dst, *msk, *gw;
+	struct sockaddr_dl *dl;
+	u_char *opts;
+
+	if (argc != 4)
+	  fprintf(stderr, "usage: %s dst spi key\n", argv[0]), exit(1);
+	sd = socket(AF_ENCAP, SOCK_RAW, AF_UNSPEC);
+	if (sd < 0)
+	  perror("socket"), exit(1);
+	
+	klen = strlen(argv[3])/2;
+
+	em = (struct encap_msghdr *)&buf[0];
+	
+	em->em_msglen = EMT_SETSPI_FLEN + 4 + AHHMACSHA1_KMAX;
+	em->em_version = 0;
+	em->em_type = EMT_SETSPI;
+	em->em_spi = htonl(strtol(argv[2], NULL, 16));
+	em->em_if = 1;
+	em->em_dst.s_addr = inet_addr(argv[1]);
+	em->em_alg = XF_AHHMACSHA1;
+	xd = (struct ahhmacsha1_xencap *)(em->em_dat);
+
+	xd->amx_alen = 20;
+	xd->amx_wnd = 32;
+
+	bzero(xd->amx_key, AHHMACSHA1_KMAX);
+	for (i = 0; i < klen; i++ )
+	  xd->amx_key[i] = x2i(&(argv[3][2*i]));
+
+	if (write(sd, buf, em->em_msglen) != em->em_msglen)
+	  perror("write");
+}
diff --git a/sbin/ipsec/si4/Makefile b/sbin/ipsec/si4/Makefile
new file mode 100644
index 00000000000..739b693d1aa
--- /dev/null
+++ b/sbin/ipsec/si4/Makefile
@@ -0,0 +1,5 @@
+#	$OpenBSD: Makefile,v 1.1 1997/02/21 23:17:54 niklas Exp $
+
+PROG=	si4
+
+.include <bsd.prog.mk>
diff --git a/sbin/ipsec/si4/si4.c b/sbin/ipsec/si4/si4.c
new file mode 100644
index 00000000000..4c7eca07cdb
--- /dev/null
+++ b/sbin/ipsec/si4/si4.c
@@ -0,0 +1,90 @@
+/*
+ * The author of this code is John Ioannidis, ji@tla.org,
+ * 	(except when noted otherwise).
+ *
+ * This code was written for BSD/OS in Athens, Greece, in November 1995.
+ *
+ * Ported to NetBSD, with additional transforms, in December 1996,
+ * by Angelos D. Keromytis, kermit@forthnet.gr.
+ *
+ * Copyright (C) 1995, 1996, 1997 by John Ioannidis and Angelos D. Keromytis.
+ *	
+ * Permission to use, copy, and modify this software without fee
+ * is hereby granted, provided that this entire notice is included in
+ * all copies of any software which is or includes a copy or
+ * modification of this software.
+ *
+ * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTY. IN PARTICULAR, NEITHER AUTHOR MAKES ANY
+ * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
+ * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
+ * PURPOSE.
+ */
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/mbuf.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/route.h>
+#include <net/if_dl.h>
+#include <netinet/in.h>
+#include <netns/ns.h>
+#include <netiso/iso.h>
+#include <netccitt/x25.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include <errno.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+#include <paths.h>
+#include "net/encap.h"
+#include "netinet/ip_ipsp.h"
+ 
+
+#define IFT_ENC 0x37
+
+
+char buf[1024];
+
+main(argc, argv)
+int argc;
+char **argv;
+{
+	int sd, len;
+
+	struct encap_msghdr *em;
+	
+	struct sockaddr_encap *dst, *msk, *gw;
+	struct sockaddr_dl *dl;
+	u_char *opts;
+
+	if (argc != 3)
+	  fprintf(stderr, "usage: %s dst spi\n", argv[0]), exit(1);
+	sd = socket(AF_ENCAP, SOCK_RAW, AF_UNSPEC);
+	if (sd < 0)
+	  perror("socket"), exit(1);
+	
+	em = (struct encap_msghdr *)&buf[0];
+	
+	em->em_msglen = EMT_SETSPI_FLEN;
+	em->em_version = 0;
+	em->em_type = EMT_SETSPI;
+	em->em_spi = htonl(strtol(argv[2], NULL, 16));
+	em->em_if = 1;
+	em->em_dst.s_addr = inet_addr(argv[1]);
+	em->em_alg = XF_IP4;
+	
+
+	if (write(sd, buf, EMT_SETSPI_FLEN) != EMT_SETSPI_FLEN)
+	  perror("write");
+}
+
+