pyrox.dev
1# See: https://wiki.strongswan.org/projects/strongswan/wiki/Swanctlconf
2#
3# When strongSwan is upgraded please update the parameters in this file. You can
4# see which parameters should be deleted, changed or added by diffing
5# swanctl.opt:
6#
7# git clone https://github.com/strongswan/strongswan.git
8# cd strongswan
9# git diff 5.7.2..5.8.0 src/swanctl/swanctl.opt
10
11lib: with (import ./param-constructors.nix lib);
12
13let
14 certParams = {
15 file = mkOptionalStrParam ''
16 Absolute path to the certificate to load. Passed as-is to the daemon, so
17 it must be readable by it.
18 </para><para>
19 Configure either this or <option>handle</option>, but not both, in one section.
20 '';
21
22 handle = mkOptionalHexParam ''
23 Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
24 respectively.
25 </para><para>
26 Configure either this or <option>file</option>, but not both, in one section.
27 '';
28
29 slot = mkOptionalIntParam ''
30 Optional slot number of the token that stores the certificate.
31 '';
32
33 module = mkOptionalStrParam ''
34 Optional PKCS#11 module name.
35 '';
36 };
37in {
38 authorities = mkAttrsOfParams ({
39
40 cacert = mkOptionalStrParam ''
41 The certificates may use a relative path from the swanctl
42 <literal>x509ca</literal> directory or an absolute path.
43 </para><para>
44 Configure one of <option>cacert</option>,
45 <option>file</option>, or
46 <option>handle</option> per section.
47 '';
48
49 cert_uri_base = mkOptionalStrParam ''
50 Defines the base URI for the Hash and URL feature supported by
51 IKEv2. Instead of exchanging complete certificates, IKEv2 allows one to
52 send an URI that resolves to the DER encoded certificate. The certificate
53 URIs are built by appending the SHA1 hash of the DER encoded certificates
54 to this base URI.
55 '';
56
57 crl_uris = mkCommaSepListParam [] ''
58 List of CRL distribution points (ldap, http, or file URI).
59 '';
60
61 ocsp_uris = mkCommaSepListParam [] ''
62 List of OCSP URIs.
63 '';
64
65 } // certParams) ''
66 Section defining complementary attributes of certification authorities, each
67 in its own subsection with an arbitrary yet unique name
68 '';
69
70 connections = mkAttrsOfParams {
71
72 version = mkIntParam 0 ''
73 IKE major version to use for connection.
74 <itemizedlist>
75 <listitem><para>1 uses IKEv1 aka ISAKMP,</para></listitem>
76 <listitem><para>2 uses IKEv2.</para></listitem>
77 <listitem><para>A connection using the default of 0 accepts both IKEv1 and IKEv2 as
78 responder, and initiates the connection actively with IKEv2.</para></listitem>
79 </itemizedlist>
80 '';
81
82 local_addrs = mkCommaSepListParam [] ''
83 Local address(es) to use for IKE communication. Takes
84 single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.
85 </para><para>
86 As initiator, the first non-range/non-subnet is used to initiate the
87 connection from. As responder, the local destination address must match at
88 least to one of the specified addresses, subnets or ranges.
89 </para><para>
90 If FQDNs are assigned they are resolved every time a configuration lookup
91 is done. If DNS resolution times out, the lookup is delayed for that time.
92 '';
93
94 remote_addrs = mkCommaSepListParam [] ''
95 Remote address(es) to use for IKE communication. Takes
96 single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.
97 </para><para>
98 As initiator, the first non-range/non-subnet is used to initiate the
99 connection to. As responder, the initiator source address must match at
100 least to one of the specified addresses, subnets or ranges.
101 </para><para>
102 If FQDNs are assigned they are resolved every time a configuration lookup
103 is done. If DNS resolution times out, the lookup is delayed for that time.
104 To initiate a connection, at least one specific address or DNS name must
105 be specified.
106 '';
107
108 local_port = mkIntParam 500 ''
109 Local UDP port for IKE communication. By default the port of the socket
110 backend is used, which is usually <literal>500</literal>. If port
111 <literal>500</literal> is used, automatic IKE port floating to port
112 <literal>4500</literal> is used to work around NAT issues.
113 </para><para>
114 Using a non-default local IKE port requires support from the socket
115 backend in use (socket-dynamic).
116 '';
117
118 remote_port = mkIntParam 500 ''
119 Remote UDP port for IKE communication. If the default of port
120 <literal>500</literal> is used, automatic IKE port floating to port
121 <literal>4500</literal> is used to work around NAT issues.
122 '';
123
124 proposals = mkCommaSepListParam ["default"] ''
125 A proposal is a set of algorithms. For non-AEAD algorithms, this includes
126 for IKE an encryption algorithm, an integrity algorithm, a pseudo random
127 function and a Diffie-Hellman group. For AEAD algorithms, instead of
128 encryption and integrity algorithms, a combined algorithm is used.
129 </para><para>
130 In IKEv2, multiple algorithms of the same kind can be specified in a
131 single proposal, from which one gets selected. In IKEv1, only one
132 algorithm per kind is allowed per proposal, more algorithms get implicitly
133 stripped. Use multiple proposals to offer different algorithms
134 combinations in IKEv1.
135 </para><para>
136 Algorithm keywords get separated using dashes. Multiple proposals may be
137 specified in a list. The special value <literal>default</literal> forms a
138 default proposal of supported algorithms considered safe, and is usually a
139 good choice for interoperability.
140 '';
141
142 vips = mkCommaSepListParam [] ''
143 List of virtual IPs to request in IKEv2 configuration payloads or IKEv1
144 Mode Config. The wildcard addresses <literal>0.0.0.0</literal> and
145 <literal>::</literal> request an arbitrary address, specific addresses may
146 be defined. The responder may return a different address, though, or none
147 at all.
148 '';
149
150 aggressive = mkYesNoParam no ''
151 Enables Aggressive Mode instead of Main Mode with Identity
152 Protection. Aggressive Mode is considered less secure, because the ID and
153 HASH payloads are exchanged unprotected. This allows a passive attacker to
154 snoop peer identities, and even worse, start dictionary attacks on the
155 Preshared Key.
156 '';
157
158 pull = mkYesNoParam yes ''
159 If the default of yes is used, Mode Config works in pull mode, where the
160 initiator actively requests a virtual IP. With no, push mode is used,
161 where the responder pushes down a virtual IP to the initiating peer.
162 </para><para>
163 Push mode is currently supported for IKEv1, but not in IKEv2. It is used
164 by a few implementations only, pull mode is recommended.
165 '';
166
167 dscp = mkStrParam "000000" ''
168 Differentiated Services Field Codepoint to set on outgoing IKE packets for
169 this connection. The value is a six digit binary encoded string specifying
170 the Codepoint to set, as defined in RFC 2474.
171 '';
172
173 encap = mkYesNoParam no ''
174 To enforce UDP encapsulation of ESP packets, the IKE daemon can fake the
175 NAT detection payloads. This makes the peer believe that NAT takes place
176 on the path, forcing it to encapsulate ESP packets in UDP.
177 </para><para>
178 Usually this is not required, but it can help to work around connectivity
179 issues with too restrictive intermediary firewalls.
180 '';
181
182 mobike = mkYesNoParam yes ''
183 Enables MOBIKE on IKEv2 connections. MOBIKE is enabled by default on IKEv2
184 connections, and allows mobility of clients and multi-homing on servers by
185 migrating active IPsec tunnels.
186 </para><para>
187 Usually keeping MOBIKE enabled is unproblematic, as it is not used if the
188 peer does not indicate support for it. However, due to the design of
189 MOBIKE, IKEv2 always floats to port 4500 starting from the second
190 exchange. Some implementations don't like this behavior, hence it can be
191 disabled.
192 '';
193
194 dpd_delay = mkDurationParam "0s" ''
195 Interval to check the liveness of a peer actively using IKEv2
196 INFORMATIONAL exchanges or IKEv1 R_U_THERE messages. Active DPD checking
197 is only enforced if no IKE or ESP/AH packet has been received for the
198 configured DPD delay.
199 '';
200
201 dpd_timeout = mkDurationParam "0s" ''
202 Charon by default uses the normal retransmission mechanism and timeouts to
203 check the liveness of a peer, as all messages are used for liveness
204 checking. For compatibility reasons, with IKEv1 a custom interval may be
205 specified; this option has no effect on connections using IKEv2.
206 '';
207
208 fragmentation = mkEnumParam ["yes" "accept" "force" "no"] "yes" ''
209 Use IKE fragmentation (proprietary IKEv1 extension or RFC 7383 IKEv2
210 fragmentation). Acceptable values are <literal>yes</literal> (the default
211 since 5.5.1), <literal>accept</literal> (since versions:5.5.3),
212 <literal>force</literal> and <literal>no</literal>.
213 <itemizedlist>
214 <listitem><para>If set to <literal>yes</literal>, and the peer
215 supports it, oversized IKE messages will be sent in fragments.</para></listitem>
216 <listitem><para>If set to
217 <literal>accept</literal>, support for fragmentation is announced to the peer but the daemon
218 does not send its own messages in fragments.</para></listitem>
219 <listitem><para>If set to <literal>force</literal> (only
220 supported for IKEv1) the initial IKE message will already be fragmented if
221 required.</para></listitem>
222 <listitem><para>Finally, setting the option to <literal>no</literal> will disable announcing
223 support for this feature.</para></listitem>
224 </itemizedlist>
225 </para><para>
226 Note that fragmented IKE messages sent by a peer are always processed
227 irrespective of the value of this option (even when set to no).
228 '';
229
230 childless = mkEnumParam [ "allow" "force" "never" ] "allow" ''
231 Use childless IKE_SA initiation (RFC 6023) for IKEv2. Acceptable values
232 are <literal>allow</literal> (the default), <literal>force</literal> and
233 <literal>never</literal>. If set to <literal>allow</literal>, responders
234 will accept childless IKE_SAs (as indicated via notify in the IKE_SA_INIT
235 response) while initiators continue to create regular IKE_SAs with the
236 first CHILD_SA created during IKE_AUTH, unless the IKE_SA is initiated
237 explicitly without any children (which will fail if the responder does not
238 support or has disabled this extension). If set to
239 <literal>force</literal>, only childless initiation is accepted and the
240 first CHILD_SA is created with a separate CREATE_CHILD_SA exchange
241 (e.g. to use an independent DH exchange for all CHILD_SAs). Finally,
242 setting the option to <literal>never</literal> disables support for
243 childless IKE_SAs as responder.
244 '';
245
246 send_certreq = mkYesNoParam yes ''
247 Send certificate request payloads to offer trusted root CA certificates to
248 the peer. Certificate requests help the peer to choose an appropriate
249 certificate/private key for authentication and are enabled by default.
250 Disabling certificate requests can be useful if too many trusted root CA
251 certificates are installed, as each certificate request increases the size
252 of the initial IKE packets.
253 '';
254
255 send_cert = mkEnumParam ["always" "never" "ifasked" ] "ifasked" ''
256 Send certificate payloads when using certificate authentication.
257 <itemizedlist>
258 <listitem><para>With the default of <literal>ifasked</literal> the daemon sends
259 certificate payloads only if certificate requests have been received.</para></listitem>
260 <listitem><para><literal>never</literal> disables sending of certificate payloads
261 altogether,</para></listitem>
262 <listitem><para><literal>always</literal> causes certificate payloads to be sent
263 unconditionally whenever certificate authentication is used.</para></listitem>
264 </itemizedlist>
265 '';
266
267 ppk_id = mkOptionalStrParam ''
268 String identifying the Postquantum Preshared Key (PPK) to be used.
269 '';
270
271 ppk_required = mkYesNoParam no ''
272 Whether a Postquantum Preshared Key (PPK) is required for this connection.
273 '';
274
275 keyingtries = mkIntParam 1 ''
276 Number of retransmission sequences to perform during initial
277 connect. Instead of giving up initiation after the first retransmission
278 sequence with the default value of <literal>1</literal>, additional
279 sequences may be started according to the configured value. A value of
280 <literal>0</literal> initiates a new sequence until the connection
281 establishes or fails with a permanent error.
282 '';
283
284 unique = mkEnumParam ["no" "never" "keep" "replace"] "no" ''
285 Connection uniqueness policy to enforce. To avoid multiple connections
286 from the same user, a uniqueness policy can be enforced.
287 </para><para>
288 <itemizedlist>
289 <listitem><para>
290 The value <literal>never</literal> does never enforce such a policy, even
291 if a peer included INITIAL_CONTACT notification messages,
292 </para></listitem>
293 <listitem><para>
294 whereas <literal>no</literal> replaces existing connections for the same
295 identity if a new one has the INITIAL_CONTACT notify.
296 </para></listitem>
297 <listitem><para>
298 <literal>keep</literal> rejects new connection attempts if the same user
299 already has an active connection,
300 </para></listitem>
301 <listitem><para>
302 <literal>replace</literal> deletes any existing connection if a new one
303 for the same user gets established.
304 </para></listitem>
305 </itemizedlist>
306 To compare connections for uniqueness, the remote IKE identity is used. If
307 EAP or XAuth authentication is involved, the EAP-Identity or XAuth
308 username is used to enforce the uniqueness policy instead.
309 </para><para>
310 On initiators this setting specifies whether an INITIAL_CONTACT notify is
311 sent during IKE_AUTH if no existing connection is found with the remote
312 peer (determined by the identities of the first authentication
313 round). Unless set to <literal>never</literal> the client will send a notify.
314 '';
315
316 reauth_time = mkDurationParam "0s" ''
317 Time to schedule IKE reauthentication. IKE reauthentication recreates the
318 IKE/ISAKMP SA from scratch and re-evaluates the credentials. In asymmetric
319 configurations (with EAP or configuration payloads) it might not be
320 possible to actively reauthenticate as responder. The IKEv2
321 reauthentication lifetime negotiation can instruct the client to perform
322 reauthentication.
323 </para><para>
324 Reauthentication is disabled by default. Enabling it usually may lead to
325 small connection interruptions, as strongSwan uses a break-before-make
326 policy with IKEv2 to avoid any conflicts with associated tunnel resources.
327 '';
328
329 rekey_time = mkDurationParam "4h" ''
330 IKE rekeying refreshes key material using a Diffie-Hellman exchange, but
331 does not re-check associated credentials. It is supported in IKEv2 only,
332 IKEv1 performs a reauthentication procedure instead.
333 </para><para>
334 With the default value IKE rekeying is scheduled every 4 hours, minus the
335 configured rand_time. If a reauth_time is configured, rekey_time defaults
336 to zero, disabling rekeying; explicitly set both to enforce rekeying and
337 reauthentication.
338 '';
339
340 over_time = mkOptionalDurationParam ''
341 Hard IKE_SA lifetime if rekey/reauth does not complete, as time. To avoid
342 having an IKE/ISAKMP kept alive if IKE reauthentication or rekeying fails
343 perpetually, a maximum hard lifetime may be specified. If the IKE_SA fails
344 to rekey or reauthenticate within the specified time, the IKE_SA gets
345 closed.
346 </para><para>
347 In contrast to CHILD_SA rekeying, over_time is relative in time to the
348 rekey_time and reauth_time values, as it applies to both.
349 </para><para>
350 The default is 10% of the longer of <option>rekey_time</option> and
351 <option>reauth_time</option>.
352 '';
353
354 rand_time = mkOptionalDurationParam ''
355 Time range from which to choose a random value to subtract from
356 rekey/reauth times. To avoid having both peers initiating the rekey/reauth
357 procedure simultaneously, a random time gets subtracted from the
358 rekey/reauth times.
359 </para><para>
360 The default is equal to the configured <option>over_time</option>.
361 '';
362
363 pools = mkCommaSepListParam [] ''
364 List of named IP pools to allocate virtual IP addresses
365 and other configuration attributes from. Each name references a pool by
366 name from either the pools section or an external pool.
367 '';
368
369 if_id_in = mkStrParam "0" ''
370 XFRM interface ID set on inbound policies/SA, can be overridden by child
371 config, see there for details.
372 '';
373
374 if_id_out = mkStrParam "0" ''
375 XFRM interface ID set on outbound policies/SA, can be overridden by child
376 config, see there for details.
377 '';
378
379 mediation = mkYesNoParam no ''
380 Whether this connection is a mediation connection, that is, whether this
381 connection is used to mediate other connections using the IKEv2 Mediation
382 Extension. Mediation connections create no CHILD_SA.
383 '';
384
385 mediated_by = mkOptionalStrParam ''
386 The name of the connection to mediate this connection through. If given,
387 the connection will be mediated through the named mediation
388 connection. The mediation connection must have mediation enabled.
389 '';
390
391 mediation_peer = mkOptionalStrParam ''
392 Identity under which the peer is registered at the mediation server, that
393 is, the IKE identity the other end of this connection uses as its local
394 identity on its connection to the mediation server. This is the identity
395 we request the mediation server to mediate us with. Only relevant on
396 connections that set mediated_by. If it is not given, the remote IKE
397 identity of the first authentication round of this connection will be
398 used.
399 '';
400
401 local = mkPrefixedAttrsOfParams {
402
403 round = mkIntParam 0 ''
404 Optional numeric identifier by which authentication rounds are
405 sorted. If not specified rounds are ordered by their position in the
406 config file/vici message.
407 '';
408
409 certs = mkCommaSepListParam [] ''
410 List of certificate candidates to use for
411 authentication. The certificates may use a relative path from the
412 swanctl <literal>x509</literal> directory or an absolute path.
413 </para><para>
414 The certificate used for authentication is selected based on the
415 received certificate request payloads. If no appropriate CA can be
416 located, the first certificate is used.
417 '';
418
419 cert = mkPostfixedAttrsOfParams certParams ''
420 Section for a certificate candidate to use for
421 authentication. Certificates in certs are transmitted as binary blobs,
422 these sections offer more flexibility.
423 '';
424
425 pubkeys = mkCommaSepListParam [] ''
426 List of raw public key candidates to use for
427 authentication. The public keys may use a relative path from the swanctl
428 <literal>pubkey</literal> directory or an absolute path.
429 </para><para>
430 Even though multiple local public keys could be defined in principle,
431 only the first public key in the list is used for authentication.
432 '';
433
434 auth = mkStrParam "pubkey" ''
435 Authentication to perform locally.
436 <itemizedlist>
437 <listitem><para>
438 The default <literal>pubkey</literal> uses public key authentication
439 using a private key associated to a usable certificate.
440 </para></listitem>
441 <listitem><para>
442 <literal>psk</literal> uses pre-shared key authentication.
443 </para></listitem>
444 <listitem><para>
445 The IKEv1 specific <literal>xauth</literal> is used for XAuth or Hybrid
446 authentication,
447 </para></listitem>
448 <listitem><para>
449 while the IKEv2 specific <literal>eap</literal> keyword defines EAP
450 authentication.
451 </para></listitem>
452 <listitem><para>
453 For <literal>xauth</literal>, a specific backend name may be appended,
454 separated by a dash. The appropriate <literal>xauth</literal> backend is
455 selected to perform the XAuth exchange. For traditional XAuth, the
456 <literal>xauth</literal> method is usually defined in the second
457 authentication round following an initial <literal>pubkey</literal> (or
458 <literal>psk</literal>) round. Using <literal>xauth</literal> in the
459 first round performs Hybrid Mode client authentication.
460 </para></listitem>
461 <listitem><para>
462 For <literal>eap</literal>, a specific EAP method name may be appended, separated by a
463 dash. An EAP module implementing the appropriate method is selected to
464 perform the EAP conversation.
465 </para></listitem>
466 <listitem><para>
467 Since 5.4.0, if both peers support RFC 7427 ("Signature Authentication
468 in IKEv2") specific hash algorithms to be used during IKEv2
469 authentication may be configured. To do so use <literal>ike:</literal>
470 followed by a trust chain signature scheme constraint (see description
471 of the <option>remote</option> section's <option>auth</option>
472 keyword). For example, with <literal>ike:pubkey-sha384-sha256</literal>
473 a public key signature scheme with either SHA-384 or SHA-256 would get
474 used for authentication, in that order and depending on the hash
475 algorithms supported by the peer. If no specific hash algorithms are
476 configured, the default is to prefer an algorithm that matches or
477 exceeds the strength of the signature key. If no constraints with
478 <literal>ike:</literal> prefix are configured any signature scheme
479 constraint (without <literal>ike:</literal> prefix) will also apply to
480 IKEv2 authentication, unless this is disabled in
481 <literal>strongswan.conf</literal>. To use RSASSA-PSS signatures use
482 <literal>rsa/pss</literal> instead of <literal>pubkey</literal> or
483 <literal>rsa</literal> as in e.g.
484 <literal>ike:rsa/pss-sha256</literal>. If <literal>pubkey</literal> or
485 <literal>rsa</literal> constraints are configured RSASSA-PSS signatures
486 will only be used if enabled in <literal>strongswan.conf</literal>(5).
487 </para></listitem>
488 </itemizedlist>
489 '';
490
491 id = mkOptionalStrParam ''
492 IKE identity to use for authentication round. When using certificate
493 authentication, the IKE identity must be contained in the certificate,
494 either as subject or as subjectAltName.
495 '';
496
497 eap_id = mkOptionalStrParam ''
498 Client EAP-Identity to use in EAP-Identity exchange and the EAP method.
499 '';
500
501 aaa_id = mkOptionalStrParam ''
502 Server side EAP-Identity to expect in the EAP method. Some EAP methods,
503 such as EAP-TLS, use an identity for the server to perform mutual
504 authentication. This identity may differ from the IKE identity,
505 especially when EAP authentication is delegated from the IKE responder
506 to an AAA backend.
507 </para><para>
508 For EAP-(T)TLS, this defines the identity for which the server must
509 provide a certificate in the TLS exchange.
510 '';
511
512 xauth_id = mkOptionalStrParam ''
513 Client XAuth username used in the XAuth exchange.
514 '';
515
516 } ''
517 Section for a local authentication round. A local authentication round
518 defines the rules how authentication is performed for the local
519 peer. Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple
520 Authentication or IKEv1 XAuth.
521 </para><para>
522 Each round is defined in a section having <literal>local</literal> as
523 prefix, and an optional unique suffix. To define a single authentication
524 round, the suffix may be omitted.
525 '';
526
527 remote = mkPrefixedAttrsOfParams {
528
529 round = mkIntParam 0 ''
530 Optional numeric identifier by which authentication rounds are
531 sorted. If not specified rounds are ordered by their position in the
532 config file/vici message.
533 '';
534
535 id = mkStrParam "%any" ''
536 IKE identity to expect for authentication round. When using certificate
537 authentication, the IKE identity must be contained in the certificate,
538 either as subject or as subjectAltName.
539 '';
540
541 eap_id = mkOptionalStrParam ''
542 Identity to use as peer identity during EAP authentication. If set to
543 <literal>%any</literal> the EAP-Identity method will be used to ask the
544 client for an EAP identity.
545 '';
546
547 groups = mkCommaSepListParam [] ''
548 Authorization group memberships to require. The peer
549 must prove membership to at least one of the specified groups. Group
550 membership can be certified by different means, for example by
551 appropriate Attribute Certificates or by an AAA backend involved in the
552 authentication.
553 '';
554
555 cert_policy = mkCommaSepListParam [] ''
556 List of certificate policy OIDs the peer's certificate
557 must have. OIDs are specified using the numerical dotted representation.
558 '';
559
560 certs = mkCommaSepListParam [] ''
561 List of certificates to accept for authentication. The certificates may
562 use a relative path from the swanctl <literal>x509</literal> directory
563 or an absolute path.
564 '';
565
566 cert = mkPostfixedAttrsOfParams certParams ''
567 Section for a certificate candidate to use for
568 authentication. Certificates in certs are transmitted as binary blobs,
569 these sections offer more flexibility.
570 '';
571
572 cacerts = mkCommaSepListParam [] ''
573 List of CA certificates to accept for
574 authentication. The certificates may use a relative path from the
575 swanctl <literal>x509ca</literal> directory or an absolute path.
576 '';
577
578 cacert = mkPostfixedAttrsOfParams certParams ''
579 Section for a CA certificate to accept for authentication. Certificates
580 in cacerts are transmitted as binary blobs, these sections offer more
581 flexibility.
582 '';
583
584 pubkeys = mkCommaSepListParam [] ''
585 List of raw public keys to accept for
586 authentication. The public keys may use a relative path from the swanctl
587 <literal>pubkey</literal> directory or an absolute path.
588 '';
589
590 revocation = mkEnumParam ["strict" "ifuri" "relaxed"] "relaxed" ''
591 Certificate revocation policy for CRL or OCSP revocation.
592 <itemizedlist>
593 <listitem><para>
594 A <literal>strict</literal> revocation policy fails if no revocation information is
595 available, i.e. the certificate is not known to be unrevoked.
596 </para></listitem>
597 <listitem><para>
598 <literal>ifuri</literal> fails only if a CRL/OCSP URI is available, but certificate
599 revocation checking fails, i.e. there should be revocation information
600 available, but it could not be obtained.
601 </para></listitem>
602 <listitem><para>
603 The default revocation policy <literal>relaxed</literal> fails only if a certificate is
604 revoked, i.e. it is explicitly known that it is bad.
605 </para></listitem>
606 </itemizedlist>
607 '';
608
609 auth = mkStrParam "pubkey" ''
610 Authentication to expect from remote. See the <option>local</option>
611 section's <option>auth</option> keyword description about the details of
612 supported mechanisms.
613 </para><para>
614 Since 5.4.0, to require a trustchain public key strength for the remote
615 side, specify the key type followed by the minimum strength in bits (for
616 example <literal>ecdsa-384</literal> or
617 <literal>rsa-2048-ecdsa-256</literal>). To limit the acceptable set of
618 hashing algorithms for trustchain validation, append hash algorithms to
619 pubkey or a key strength definition (for example
620 <literal>pubkey-sha256-sha512</literal>,
621 <literal>rsa-2048-sha256-sha384-sha512</literal> or
622 <literal>rsa-2048-sha256-ecdsa-256-sha256-sha384</literal>).
623 Unless disabled in <literal>strongswan.conf</literal>, or explicit IKEv2
624 signature constraints are configured (refer to the description of the
625 <option>local</option> section's <option>auth</option> keyword for
626 details), such key types and hash algorithms are also applied as
627 constraints against IKEv2 signature authentication schemes used by the
628 remote side. To require RSASSA-PSS signatures use
629 <literal>rsa/pss</literal> instead of <literal>pubkey</literal> or
630 <literal>rsa</literal> as in e.g. <literal>rsa/pss-sha256</literal>. If
631 <literal>pubkey</literal> or <literal>rsa</literal> constraints are
632 configured RSASSA-PSS signatures will only be accepted if enabled in
633 <literal>strongswan.conf</literal>(5).
634 </para><para>
635 To specify trust chain constraints for EAP-(T)TLS, append a colon to the
636 EAP method, followed by the key type/size and hash algorithm as
637 discussed above (e.g. <literal>eap-tls:ecdsa-384-sha384</literal>).
638 '';
639
640 } ''
641 Section for a remote authentication round. A remote authentication round
642 defines the constraints how the peers must authenticate to use this
643 connection. Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple
644 Authentication or IKEv1 XAuth.
645 </para><para>
646 Each round is defined in a section having <literal>remote</literal> as
647 prefix, and an optional unique suffix. To define a single authentication
648 round, the suffix may be omitted.
649 '';
650
651 children = mkAttrsOfParams {
652 ah_proposals = mkCommaSepListParam [] ''
653 AH proposals to offer for the CHILD_SA. A proposal is a set of
654 algorithms. For AH, this includes an integrity algorithm and an optional
655 Diffie-Hellman group. If a DH group is specified, CHILD_SA/Quick Mode
656 rekeying and initial negotiation uses a separate Diffie-Hellman exchange
657 using the specified group (refer to esp_proposals for details).
658 </para><para>
659 In IKEv2, multiple algorithms of the same kind can be specified in a
660 single proposal, from which one gets selected. In IKEv1, only one
661 algorithm per kind is allowed per proposal, more algorithms get
662 implicitly stripped. Use multiple proposals to offer different algorithms
663 combinations in IKEv1.
664 </para><para>
665 Algorithm keywords get separated using dashes. Multiple proposals may be
666 specified in a list. The special value <literal>default</literal> forms
667 a default proposal of supported algorithms considered safe, and is
668 usually a good choice for interoperability. By default no AH proposals
669 are included, instead ESP is proposed.
670 '';
671
672 esp_proposals = mkCommaSepListParam ["default"] ''
673 ESP proposals to offer for the CHILD_SA. A proposal is a set of
674 algorithms. For ESP non-AEAD proposals, this includes an integrity
675 algorithm, an encryption algorithm, an optional Diffie-Hellman group and
676 an optional Extended Sequence Number Mode indicator. For AEAD proposals,
677 a combined mode algorithm is used instead of the separate
678 encryption/integrity algorithms.
679 </para><para>
680 If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial
681 negotiation use a separate Diffie-Hellman exchange using the specified
682 group. However, for IKEv2, the keys of the CHILD_SA created implicitly
683 with the IKE_SA will always be derived from the IKE_SA's key material. So
684 any DH group specified here will only apply when the CHILD_SA is later
685 rekeyed or is created with a separate CREATE_CHILD_SA exchange. A
686 proposal mismatch might, therefore, not immediately be noticed when the
687 SA is established, but may later cause rekeying to fail.
688 </para><para>
689 Extended Sequence Number support may be indicated with the
690 <literal>esn</literal> and <literal>noesn</literal> values, both may be
691 included to indicate support for both modes. If omitted,
692 <literal>noesn</literal> is assumed.
693 </para><para>
694 In IKEv2, multiple algorithms of the same kind can be specified in a
695 single proposal, from which one gets selected. In IKEv1, only one
696 algorithm per kind is allowed per proposal, more algorithms get
697 implicitly stripped. Use multiple proposals to offer different algorithms
698 combinations in IKEv1.
699 </para><para>
700 Algorithm keywords get separated using dashes. Multiple proposals may be
701 specified as a list. The special value <literal>default</literal> forms
702 a default proposal of supported algorithms considered safe, and is
703 usually a good choice for interoperability. If no algorithms are
704 specified for AH nor ESP, the default set of algorithms for ESP is
705 included.
706 '';
707
708 sha256_96 = mkYesNoParam no ''
709 HMAC-SHA-256 is used with 128-bit truncation with IPsec. For
710 compatibility with implementations that incorrectly use 96-bit truncation
711 this option may be enabled to configure the shorter truncation length in
712 the kernel. This is not negotiated, so this only works with peers that
713 use the incorrect truncation length (or have this option enabled).
714 '';
715
716 local_ts = mkCommaSepListParam ["dynamic"] ''
717 List of local traffic selectors to include in CHILD_SA. Each selector is
718 a CIDR subnet definition, followed by an optional proto/port
719 selector. The special value <literal>dynamic</literal> may be used
720 instead of a subnet definition, which gets replaced by the tunnel outer
721 address or the virtual IP, if negotiated. This is the default.
722 </para><para>
723 A protocol/port selector is surrounded by opening and closing square
724 brackets. Between these brackets, a numeric or getservent(3) protocol
725 name may be specified. After the optional protocol restriction, an
726 optional port restriction may be specified, separated by a slash. The
727 port restriction may be numeric, a getservent(3) service name, or the
728 special value <literal>opaque</literal> for RFC 4301 OPAQUE
729 selectors. Port ranges may be specified as well, none of the kernel
730 backends currently support port ranges, though.
731 </para><para>
732 When IKEv1 is used only the first selector is interpreted, except if the
733 Cisco Unity extension plugin is used. This is due to a limitation of the
734 IKEv1 protocol, which only allows a single pair of selectors per
735 CHILD_SA. So to tunnel traffic matched by several pairs of selectors when
736 using IKEv1 several children (CHILD_SAs) have to be defined that cover
737 the selectors. The IKE daemon uses traffic selector narrowing for IKEv1,
738 the same way it is standardized and implemented for IKEv2. However, this
739 may lead to problems with other implementations. To avoid that, configure
740 identical selectors in such scenarios.
741 '';
742
743 remote_ts = mkCommaSepListParam ["dynamic"] ''
744 List of remote selectors to include in CHILD_SA. See
745 <option>local_ts</option> for a description of the selector syntax.
746 '';
747
748 rekey_time = mkDurationParam "1h" ''
749 Time to schedule CHILD_SA rekeying. CHILD_SA rekeying refreshes key
750 material, optionally using a Diffie-Hellman exchange if a group is
751 specified in the proposal. To avoid rekey collisions initiated by both
752 ends simultaneously, a value in the range of <option>rand_time</option>
753 gets subtracted to form the effective soft lifetime.
754 </para><para>
755 By default CHILD_SA rekeying is scheduled every hour, minus
756 <option>rand_time</option>.
757 '';
758
759 life_time = mkOptionalDurationParam ''
760 Maximum lifetime before CHILD_SA gets closed. Usually this hard lifetime
761 is never reached, because the CHILD_SA gets rekeyed before. If that fails
762 for whatever reason, this limit closes the CHILD_SA. The default is 10%
763 more than the <option>rekey_time</option>.
764 '';
765
766 rand_time = mkOptionalDurationParam ''
767 Time range from which to choose a random value to subtract from
768 <option>rekey_time</option>. The default is the difference between
769 <option>life_time</option> and <option>rekey_time</option>.
770 '';
771
772 rekey_bytes = mkIntParam 0 ''
773 Number of bytes processed before initiating CHILD_SA rekeying. CHILD_SA
774 rekeying refreshes key material, optionally using a Diffie-Hellman
775 exchange if a group is specified in the proposal.
776 </para><para>
777 To avoid rekey collisions initiated by both ends simultaneously, a value
778 in the range of <option>rand_bytes</option> gets subtracted to form the
779 effective soft volume limit.
780 </para><para>
781 Volume based CHILD_SA rekeying is disabled by default.
782 '';
783
784 life_bytes = mkOptionalIntParam ''
785 Maximum bytes processed before CHILD_SA gets closed. Usually this hard
786 volume limit is never reached, because the CHILD_SA gets rekeyed
787 before. If that fails for whatever reason, this limit closes the
788 CHILD_SA. The default is 10% more than <option>rekey_bytes</option>.
789 '';
790
791 rand_bytes = mkOptionalIntParam ''
792 Byte range from which to choose a random value to subtract from
793 <option>rekey_bytes</option>. The default is the difference between
794 <option>life_bytes</option> and <option>rekey_bytes</option>.
795 '';
796
797 rekey_packets = mkIntParam 0 ''
798 Number of packets processed before initiating CHILD_SA rekeying. CHILD_SA
799 rekeying refreshes key material, optionally using a Diffie-Hellman
800 exchange if a group is specified in the proposal.
801 </para><para>
802 To avoid rekey collisions initiated by both ends simultaneously, a value
803 in the range of <option>rand_packets</option> gets subtracted to form
804 the effective soft packet count limit.
805 </para><para>
806 Packet count based CHILD_SA rekeying is disabled by default.
807 '';
808
809 life_packets = mkOptionalIntParam ''
810 Maximum number of packets processed before CHILD_SA gets closed. Usually
811 this hard packets limit is never reached, because the CHILD_SA gets
812 rekeyed before. If that fails for whatever reason, this limit closes the
813 CHILD_SA.
814 </para><para>
815 The default is 10% more than <option>rekey_bytes</option>.
816 '';
817
818 rand_packets = mkOptionalIntParam ''
819 Packet range from which to choose a random value to subtract from
820 <option>rekey_packets</option>. The default is the difference between
821 <option>life_packets</option> and <option>rekey_packets</option>.
822 '';
823
824 updown = mkOptionalStrParam ''
825 Updown script to invoke on CHILD_SA up and down events.
826 '';
827
828 hostaccess = mkYesNoParam no ''
829 Hostaccess variable to pass to <literal>updown</literal> script.
830 '';
831
832 mode = mkEnumParam [ "tunnel"
833 "transport"
834 "transport_proxy"
835 "beet"
836 "pass"
837 "drop"
838 ] "tunnel" ''
839 IPsec Mode to establish CHILD_SA with.
840 <itemizedlist>
841 <listitem><para>
842 <literal>tunnel</literal> negotiates the CHILD_SA in IPsec Tunnel Mode,
843 </para></listitem>
844 <listitem><para>
845 whereas <literal>transport</literal> uses IPsec Transport Mode.
846 </para></listitem>
847 <listitem><para>
848 <literal>transport_proxy</literal> signifying the special Mobile IPv6
849 Transport Proxy Mode.
850 </para></listitem>
851 <listitem><para>
852 <literal>beet</literal> is the Bound End to End Tunnel mixture mode,
853 working with fixed inner addresses without the need to include them in
854 each packet.
855 </para></listitem>
856 <listitem><para>
857 Both <literal>transport</literal> and <literal>beet</literal> modes are
858 subject to mode negotiation; <literal>tunnel</literal> mode is
859 negotiated if the preferred mode is not available.
860 </para></listitem>
861 <listitem><para>
862 <literal>pass</literal> and <literal>drop</literal> are used to install
863 shunt policies which explicitly bypass the defined traffic from IPsec
864 processing or drop it, respectively.
865 </para></listitem>
866 </itemizedlist>
867 '';
868
869 policies = mkYesNoParam yes ''
870 Whether to install IPsec policies or not. Disabling this can be useful in
871 some scenarios e.g. MIPv6, where policies are not managed by the IKE
872 daemon. Since 5.3.3.
873 '';
874
875 policies_fwd_out = mkYesNoParam no ''
876 Whether to install outbound FWD IPsec policies or not. Enabling this is
877 required in case there is a drop policy that would match and block
878 forwarded traffic for this CHILD_SA. Since 5.5.1.
879 '';
880
881 dpd_action = mkEnumParam ["clear" "trap" "restart"] "clear" ''
882 Action to perform for this CHILD_SA on DPD timeout. The default clear
883 closes the CHILD_SA and does not take further action. trap installs a
884 trap policy, which will catch matching traffic and tries to re-negotiate
885 the tunnel on-demand. restart immediately tries to re-negotiate the
886 CHILD_SA under a fresh IKE_SA.
887 '';
888
889 ipcomp = mkYesNoParam no ''
890 Enable IPComp compression before encryption. If enabled, IKE tries to
891 negotiate IPComp compression to compress ESP payload data prior to
892 encryption.
893 '';
894
895 inactivity = mkDurationParam "0s" ''
896 Timeout before closing CHILD_SA after inactivity. If no traffic has been
897 processed in either direction for the configured timeout, the CHILD_SA
898 gets closed due to inactivity. The default value of 0 disables inactivity
899 checks.
900 '';
901
902 reqid = mkIntParam 0 ''
903 Fixed reqid to use for this CHILD_SA. This might be helpful in some
904 scenarios, but works only if each CHILD_SA configuration is instantiated
905 not more than once. The default of 0 uses dynamic reqids, allocated
906 incrementally.
907 '';
908
909 priority = mkIntParam 0 ''
910 Optional fixed priority for IPsec policies. This could be useful to
911 install high-priority drop policies. The default of 0 uses dynamically
912 calculated priorities based on the size of the traffic selectors.
913 '';
914
915 interface = mkOptionalStrParam ''
916 Optional interface name to restrict outbound IPsec policies.
917 '';
918
919 mark_in = mkStrParam "0/0x00000000" ''
920 Netfilter mark and mask for input traffic. On Linux, Netfilter may
921 require marks on each packet to match an SA/policy having that option
922 set. This allows installing duplicate policies and enables Netfilter
923 rules to select specific SAs/policies for incoming traffic. Note that
924 inbound marks are only set on policies, by default, unless
925 <option>mark_in_sa</option> is enabled. The special value
926 <literal>%unique</literal> sets a unique mark on each CHILD_SA instance,
927 beyond that the value <literal>%unique-dir</literal> assigns a different
928 unique mark for each
929 </para><para>
930 An additional mask may be appended to the mark, separated by
931 <literal>/</literal>. The default mask if omitted is
932 <literal>0xffffffff</literal>.
933 '';
934
935 mark_in_sa = mkYesNoParam no ''
936 Whether to set <option>mark_in</option> on the inbound SA. By default,
937 the inbound mark is only set on the inbound policy. The tuple destination
938 address, protocol and SPI is unique and the mark is not required to find
939 the correct SA, allowing to mark traffic after decryption instead (where
940 more specific selectors may be used) to match different policies. Marking
941 packets before decryption is still possible, even if no mark is set on
942 the SA.
943 '';
944
945 mark_out = mkStrParam "0/0x00000000" ''
946 Netfilter mark and mask for output traffic. On Linux, Netfilter may
947 require marks on each packet to match a policy/SA having that option
948 set. This allows installing duplicate policies and enables Netfilter
949 rules to select specific policies/SAs for outgoing traffic. The special
950 value <literal>%unique</literal> sets a unique mark on each CHILD_SA
951 instance, beyond that the value <literal>%unique-dir</literal> assigns a
952 different unique mark for each CHILD_SA direction (in/out).
953 </para><para>
954 An additional mask may be appended to the mark, separated by
955 <literal>/</literal>. The default mask if omitted is
956 <literal>0xffffffff</literal>.
957 '';
958
959 set_mark_in = mkStrParam "0/0x00000000" ''
960 Netfilter mark applied to packets after the inbound IPsec SA processed
961 them. This way it's not necessary to mark packets via Netfilter before
962 decryption or right afterwards to match policies or process them
963 differently (e.g. via policy routing).
964
965 An additional mask may be appended to the mark, separated by
966 <literal>/</literal>. The default mask if omitted is 0xffffffff. The
967 special value <literal>%same</literal> uses the value (but not the mask)
968 from <option>mark_in</option> as mark value, which can be fixed,
969 <literal>%unique</literal> or <literal>%unique-dir</literal>.
970
971 Setting marks in XFRM input requires Linux 4.19 or higher.
972 '';
973
974 set_mark_out = mkStrParam "0/0x00000000" ''
975 Netfilter mark applied to packets after the outbound IPsec SA processed
976 them. This allows processing ESP packets differently than the original
977 traffic (e.g. via policy routing).
978
979 An additional mask may be appended to the mark, separated by
980 <literal>/</literal>. The default mask if omitted is 0xffffffff. The
981 special value <literal>%same</literal> uses the value (but not the mask)
982 from <option>mark_out</option> as mark value, which can be fixed,
983 <literal>%unique_</literal> or <literal>%unique-dir</literal>.
984
985 Setting marks in XFRM output is supported since Linux 4.14. Setting a
986 mask requires at least Linux 4.19.
987 '';
988
989 if_id_in = mkStrParam "0" ''
990 XFRM interface ID set on inbound policies/SA. This allows installing
991 duplicate policies/SAs and associates them with an interface with the
992 same ID. The special value <literal>%unique</literal> sets a unique
993 interface ID on each CHILD_SA instance, beyond that the value
994 <literal>%unique-dir</literal> assigns a different unique interface ID
995 for each CHILD_SA direction (in/out).
996 '';
997
998 if_id_out = mkStrParam "0" ''
999 XFRM interface ID set on outbound policies/SA. This allows installing
1000 duplicate policies/SAs and associates them with an interface with the
1001 same ID. The special value <literal>%unique</literal> sets a unique
1002 interface ID on each CHILD_SA instance, beyond that the value
1003 <literal>%unique-dir</literal> assigns a different unique interface ID
1004 for each CHILD_SA direction (in/out).
1005
1006 The daemon will not install routes for CHILD_SAs that have this option set.
1007 '';
1008
1009 tfc_padding = mkParamOfType (with lib.types; either int (enum ["mtu"])) 0 ''
1010 Pads ESP packets with additional data to have a consistent ESP packet
1011 size for improved Traffic Flow Confidentiality. The padding defines the
1012 minimum size of all ESP packets sent. The default value of
1013 <literal>0</literal> disables TFC padding, the special value
1014 <literal>mtu</literal> adds TFC padding to create a packet size equal to
1015 the Path Maximum Transfer Unit.
1016 '';
1017
1018 replay_window = mkIntParam 32 ''
1019 IPsec replay window to configure for this CHILD_SA. Larger values than
1020 the default of <literal>32</literal> are supported using the Netlink
1021 backend only, a value of <literal>0</literal> disables IPsec replay
1022 protection.
1023 '';
1024
1025 hw_offload = mkEnumParam ["yes" "no" "auto"] "no" ''
1026 Enable hardware offload for this CHILD_SA, if supported by the IPsec
1027 implementation. The value <literal>yes</literal> enforces offloading
1028 and the installation will fail if it's not supported by either kernel or
1029 device. The value <literal>auto</literal> enables offloading, if it's
1030 supported, but the installation does not fail otherwise.
1031 '';
1032
1033 copy_df = mkYesNoParam yes ''
1034 Whether to copy the DF bit to the outer IPv4 header in tunnel mode. This
1035 effectively disables Path MTU discovery (PMTUD). Controlling this
1036 behavior is not supported by all kernel interfaces.
1037 '';
1038
1039 copy_ecn = mkYesNoParam yes ''
1040 Whether to copy the ECN (Explicit Congestion Notification) header field
1041 to/from the outer IP header in tunnel mode. Controlling this behavior is
1042 not supported by all kernel interfaces.
1043 '';
1044
1045 copy_dscp = mkEnumParam [ "out" "in" "yes" "no" ] "out" ''
1046 Whether to copy the DSCP (Differentiated Services Field Codepoint)
1047 header field to/from the outer IP header in tunnel mode. The value
1048 <literal>out</literal> only copies the field from the inner to the outer
1049 header, the value <literal>in</literal> does the opposite and only
1050 copies the field from the outer to the inner header when decapsulating,
1051 the value <literal>yes</literal> copies the field in both directions,
1052 and the value <literal>no</literal> disables copying the field
1053 altogether. Setting this to <literal>yes</literal> or
1054 <literal>in</literal> could allow an attacker to adversely affect other
1055 traffic at the receiver, which is why the default is
1056 <literal>out</literal>. Controlling this behavior is not supported by
1057 all kernel interfaces.
1058 '';
1059
1060 start_action = mkEnumParam ["none" "trap" "start"] "none" ''
1061 Action to perform after loading the configuration.
1062 <itemizedlist>
1063 <listitem><para>
1064 The default of <literal>none</literal> loads the connection only, which
1065 then can be manually initiated or used as a responder configuration.
1066 </para></listitem>
1067 <listitem><para>
1068 The value <literal>trap</literal> installs a trap policy, which triggers
1069 the tunnel as soon as matching traffic has been detected.
1070 </para></listitem>
1071 <listitem><para>
1072 The value <literal>start</literal> initiates the connection actively.
1073 </para></listitem>
1074 </itemizedlist>
1075 When unloading or replacing a CHILD_SA configuration having a
1076 <option>start_action</option> different from <literal>none</literal>,
1077 the inverse action is performed. Configurations with
1078 <literal>start</literal> get closed, while such with
1079 <literal>trap</literal> get uninstalled.
1080 '';
1081
1082 close_action = mkEnumParam ["none" "trap" "start"] "none" ''
1083 Action to perform after a CHILD_SA gets closed by the peer.
1084 <itemizedlist>
1085 <listitem><para>
1086 The default of <literal>none</literal> does not take any action,
1087 </para></listitem>
1088 <listitem><para>
1089 <literal>trap</literal> installs a trap policy for the CHILD_SA.
1090 </para></listitem>
1091 <listitem><para>
1092 <literal>start</literal> tries to re-create the CHILD_SA.
1093 </para></listitem>
1094 </itemizedlist>
1095 </para><para>
1096 <option>close_action</option> does not provide any guarantee that the
1097 CHILD_SA is kept alive. It acts on explicit close messages only, but not
1098 on negotiation failures. Use trap policies to reliably re-create failed
1099 CHILD_SAs.
1100 '';
1101
1102 } ''
1103 CHILD_SA configuration sub-section. Each connection definition may have
1104 one or more sections in its <option>children</option> subsection. The
1105 section name defines the name of the CHILD_SA configuration, which must be
1106 unique within the connection (denoted <child> below).
1107 '';
1108 } ''
1109 Section defining IKE connection configurations, each in its own subsection
1110 with an arbitrary yet unique name
1111 '';
1112
1113 secrets = let
1114 mkEapXauthParams = mkPrefixedAttrsOfParams {
1115 secret = mkOptionalStrParam ''
1116 Value of the EAP/XAuth secret. It may either be an ASCII string, a hex
1117 encoded string if it has a 0x prefix or a Base64 encoded string if it
1118 has a 0s prefix in its value.
1119 '';
1120
1121 id = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''
1122 Identity the EAP/XAuth secret belongs to. Multiple unique identities may
1123 be specified, each having an <literal>id</literal> prefix, if a secret
1124 is shared between multiple users.
1125 '';
1126
1127 } ''
1128 EAP secret section for a specific secret. Each EAP secret is defined in a
1129 unique section having the <literal>eap</literal> prefix. EAP secrets are
1130 used for XAuth authentication as well.
1131 '';
1132
1133 in {
1134
1135 eap = mkEapXauthParams;
1136 xauth = mkEapXauthParams;
1137
1138 ntlm = mkPrefixedAttrsOfParams {
1139 secret = mkOptionalStrParam ''
1140 Value of the NTLM secret, which is the NT Hash of the actual secret,
1141 that is, MD4(UTF-16LE(secret)). The resulting 16-byte value may either
1142 be given as a hex encoded string with a 0x prefix or as a Base64 encoded
1143 string with a 0s prefix.
1144 '';
1145
1146 id = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''
1147 Identity the NTLM secret belongs to. Multiple unique identities may be
1148 specified, each having an id prefix, if a secret is shared between
1149 multiple users.
1150 '';
1151 } ''
1152 NTLM secret section for a specific secret. Each NTLM secret is defined in
1153 a unique section having the <literal>ntlm</literal> prefix. NTLM secrets
1154 may only be used for EAP-MSCHAPv2 authentication.
1155 '';
1156
1157 ike = mkPrefixedAttrsOfParams {
1158 secret = mkOptionalStrParam ''
1159 Value of the IKE preshared secret. It may either be an ASCII string, a
1160 hex encoded string if it has a 0x prefix or a Base64 encoded string if
1161 it has a 0s prefix in its value.
1162 '';
1163
1164 id = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''
1165 IKE identity the IKE preshared secret belongs to. Multiple unique
1166 identities may be specified, each having an <literal>id</literal>
1167 prefix, if a secret is shared between multiple peers.
1168 '';
1169 } ''
1170 IKE preshared secret section for a specific secret. Each IKE PSK is
1171 defined in a unique section having the <literal>ike</literal> prefix.
1172 '';
1173
1174 ppk = mkPrefixedAttrsOfParams {
1175 secret = mkOptionalStrParam ''
1176 Value of the PPK. It may either be an ASCII string, a hex encoded string
1177 if it has a <literal>0x</literal> prefix or a Base64 encoded string if
1178 it has a <literal>0s</literal> prefix in its value. Should have at least
1179 256 bits of entropy for 128-bit security.
1180 '';
1181
1182 id = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''
1183 PPK identity the PPK belongs to. Multiple unique identities may be
1184 specified, each having an <literal>id</literal> prefix, if a secret is
1185 shared between multiple peers.
1186 '';
1187 } ''
1188 Postquantum Preshared Key (PPK) section for a specific secret. Each PPK is
1189 defined in a unique section having the <literal>ppk</literal> prefix.
1190 '';
1191
1192 private = mkPrefixedAttrsOfParams {
1193 file = mkOptionalStrParam ''
1194 File name in the private folder for which this passphrase should be used.
1195 '';
1196
1197 secret = mkOptionalStrParam ''
1198 Value of decryption passphrase for private key.
1199 '';
1200 } ''
1201 Private key decryption passphrase for a key in the
1202 <literal>private</literal> folder.
1203 '';
1204
1205 rsa = mkPrefixedAttrsOfParams {
1206 file = mkOptionalStrParam ''
1207 File name in the <literal>rsa</literal> folder for which this passphrase
1208 should be used.
1209 '';
1210 secret = mkOptionalStrParam ''
1211 Value of decryption passphrase for RSA key.
1212 '';
1213 } ''
1214 Private key decryption passphrase for a key in the <literal>rsa</literal>
1215 folder.
1216 '';
1217
1218 ecdsa = mkPrefixedAttrsOfParams {
1219 file = mkOptionalStrParam ''
1220 File name in the <literal>ecdsa</literal> folder for which this
1221 passphrase should be used.
1222 '';
1223 secret = mkOptionalStrParam ''
1224 Value of decryption passphrase for ECDSA key.
1225 '';
1226 } ''
1227 Private key decryption passphrase for a key in the
1228 <literal>ecdsa</literal> folder.
1229 '';
1230
1231 pkcs8 = mkPrefixedAttrsOfParams {
1232 file = mkOptionalStrParam ''
1233 File name in the <literal>pkcs8</literal> folder for which this
1234 passphrase should be used.
1235 '';
1236 secret = mkOptionalStrParam ''
1237 Value of decryption passphrase for PKCS#8 key.
1238 '';
1239 } ''
1240 Private key decryption passphrase for a key in the
1241 <literal>pkcs8</literal> folder.
1242 '';
1243
1244 pkcs12 = mkPrefixedAttrsOfParams {
1245 file = mkOptionalStrParam ''
1246 File name in the <literal>pkcs12</literal> folder for which this
1247 passphrase should be used.
1248 '';
1249 secret = mkOptionalStrParam ''
1250 Value of decryption passphrase for PKCS#12 container.
1251 '';
1252 } ''
1253 PKCS#12 decryption passphrase for a container in the
1254 <literal>pkcs12</literal> folder.
1255 '';
1256
1257 token = mkPrefixedAttrsOfParams {
1258 handle = mkOptionalHexParam ''
1259 Hex-encoded CKA_ID or handle of the private key on the token or TPM,
1260 respectively.
1261 '';
1262
1263 slot = mkOptionalIntParam ''
1264 Optional slot number to access the token.
1265 '';
1266
1267 module = mkOptionalStrParam ''
1268 Optional PKCS#11 module name to access the token.
1269 '';
1270
1271 pin = mkOptionalStrParam ''
1272 Optional PIN required to access the key on the token. If none is
1273 provided the user is prompted during an interactive
1274 <literal>--load-creds</literal> call.
1275 '';
1276 } "Definition for a private key that's stored on a token/smartcard/TPM.";
1277
1278 };
1279
1280 pools = mkAttrsOfParams {
1281 addrs = mkOptionalStrParam ''
1282 Subnet or range defining addresses allocated in pool. Accepts a single
1283 CIDR subnet defining the pool to allocate addresses from or an address
1284 range (<from>-<to>). Pools must be unique and non-overlapping.
1285 '';
1286
1287 dns = mkCommaSepListParam [] "Address or CIDR subnets";
1288 nbns = mkCommaSepListParam [] "Address or CIDR subnets";
1289 dhcp = mkCommaSepListParam [] "Address or CIDR subnets";
1290 netmask = mkCommaSepListParam [] "Address or CIDR subnets";
1291 server = mkCommaSepListParam [] "Address or CIDR subnets";
1292 subnet = mkCommaSepListParam [] "Address or CIDR subnets";
1293 split_include = mkCommaSepListParam [] "Address or CIDR subnets";
1294 split_exclude = mkCommaSepListParam [] "Address or CIDR subnets";
1295 } ''
1296 Section defining named pools. Named pools may be referenced by connections
1297 with the pools option to assign virtual IPs and other configuration
1298 attributes. Each pool must have a unique name (denoted <name> below).
1299 '';
1300}