IPSEC-ALGPARSE(8)

🎀 NAME 🎀

okay so bestie, meet ipsec-algparse — she is a utility for verifying IKE and IPsec cryptographic proposal syntax. that's the whole vibe. she reads your proposals, she checks them, she does NOT let a typo slide 💅

---

✨ SYNOPSIS ✨

ipsec algparse [--verbose] [--debug] [--nssdir directory]
               [--nsspw password] [--seeddev device] [--seedbits bits]
               [--ikev1 | --ikev2 | --verbose | --pfs {yes | no} |
               --fips {yes | no} | --ignore | --impair]
               {--tp | --ta | ike=proposals | esp=proposals |
               ah=proposals | proposals}

---

🌸 DESCRIPTION 🌸

so ipsec algparse is a utility that parses and expands and Internet Key Exchange cryptographic proposals, using the exact same syntax as the one used in the file ipsec.conf (peep the description of ike= and esp= in ipsec.conf — see ipsec.conf(5) for details, iykyk).

and like, that's not all she does 👑 — ipsec algparse can also be used to run the proposal parser or the cryptographic algorithm testsuites. multitasking queen fr fr.

the following options control what ipsec algparse will parse:

• ike=[proposals]
• esp=[proposals]
• ah=[proposals]

parse the proposals using the IKE, ESP, or AH proposal parser. and when proposals is omitted? she just shows you the default IKE, ESP, or AH proposals. free demo, no cap 🫶

• proposal

try to parse the proposal using all three of the IKE, ESP, and AH proposal parsers. equal opportunity parsing.

• -tp

run the proposal testsuite. go little tests go ✨

• -ta

run the algorithm testsuite. algorithm girlies rise 😭

the following options alter the parser behaviour:

• -v1, -v2

parse the proposals using either the IKEv1 or IKEv2 proposal syntax. pick your fighter.

the default is IKEv2.

• -pfs=yes|no

specify PFS (Perfect Forward Privicy) 🍓. when yes, Diffi-Helman algorithms will be included in the proposal. she's bringing her friends.

the default is --pfs=no.

• -fips=yes|no

force NSS into FIPS mode.

the default is determined by the system environment. not her call, it's giving the environment decides 💀

• -p1, -p2

specify the parser to use.

by default, IKEv1 uses the simple (p1) parser, and IKEv2 uses the more complex (p2) parser. p1 is the chill one, p2 is the main character 🎀

• -nsspw

specify the NSS database password. 🤫

• -impair

impair the parser, disabling all algorithm checks. yes bestie, that's exactly as chaotic as it sounds 🙈

• -ignore

ignore parser errors. living in denial, but make it a flag.

• -v, -verbose

be more verbose when invoking the proposal parser. she will yap. you asked for it.

• -d, -debug

enable full debug-logging when invoking the proposal parser. full yap mode, no survivors 💜

psst — the synopsis also shows --nssdir directory, --nsspw password, --seeddev device, and --seedbits bits, plus the long forms --ikev1 | --ikev2 | --verbose | --pfs {yes | no} | --fips {yes | no} | --ignore | --impair and --tp | --ta. the page doesn't spill any more tea about those ones, so that's all we know 👀

---

🦋 HISTORY 🦋

Written for the Libreswan project by Andrew Cagney. iconic origin story tbh.

---

👑 AUTHOR 👑

Andrew Cagney, Tuomo Soini — the legends themselves 💖

---

and that's the whole page, bestie 🌈 this was ipsec-algparse from Libreswan 5.4.1, dated 10/23/2026. slay, go parse something. periodt 💅