pyrox.dev
1# See: https://wiki.strongswan.org/projects/strongswan/wiki/Swanctlconf
2#
3# When strongSwan is upgraded please update the parameters in this file. You can
4# see which parameters should be deleted, changed or added by diffing
5# swanctl.opt:
6#
7# git clone https://github.com/strongswan/strongswan.git
8# cd strongswan
9# git diff 5.7.2..5.8.0 src/swanctl/swanctl.opt
10
11lib:
12with (import ./param-constructors.nix lib);
13
14let
15 certParams = {
16 file = mkOptionalStrParam ''
17 Absolute path to the certificate to load. Passed as-is to the daemon, so
18 it must be readable by it.
19
20 Configure either this or {option}`handle`, but not both, in one section.
21 '';
22
23 handle = mkOptionalHexParam ''
24 Hex-encoded CKA_ID or handle of the certificate on a token or TPM,
25 respectively.
26
27 Configure either this or {option}`file`, but not both, in one section.
28 '';
29
30 slot = mkOptionalIntParam ''
31 Optional slot number of the token that stores the certificate.
32 '';
33
34 module = mkOptionalStrParam ''
35 Optional PKCS#11 module name.
36 '';
37 };
38in
39{
40 authorities =
41 mkAttrsOfParams
42 (
43 {
44
45 cacert = mkOptionalStrParam ''
46 The certificates may use a relative path from the swanctl
47 `x509ca` directory or an absolute path.
48
49 Configure one of {option}`cacert`,
50 {option}`file`, or
51 {option}`handle` per section.
52 '';
53
54 cert_uri_base = mkOptionalStrParam ''
55 Defines the base URI for the Hash and URL feature supported by
56 IKEv2. Instead of exchanging complete certificates, IKEv2 allows one to
57 send an URI that resolves to the DER encoded certificate. The certificate
58 URIs are built by appending the SHA1 hash of the DER encoded certificates
59 to this base URI.
60 '';
61
62 crl_uris = mkCommaSepListParam [ ] ''
63 List of CRL distribution points (ldap, http, or file URI).
64 '';
65
66 ocsp_uris = mkCommaSepListParam [ ] ''
67 List of OCSP URIs.
68 '';
69
70 }
71 // certParams
72 )
73 ''
74 Section defining complementary attributes of certification authorities, each
75 in its own subsection with an arbitrary yet unique name
76 '';
77
78 connections =
79 mkAttrsOfParams
80 {
81
82 version = mkIntParam 0 ''
83 IKE major version to use for connection.
84
85 - 1 uses IKEv1 aka ISAKMP,
86 - 2 uses IKEv2.
87 - A connection using the default of 0 accepts both IKEv1 and IKEv2 as
88 responder, and initiates the connection actively with IKEv2.
89 '';
90
91 local_addrs = mkCommaSepListParam [ ] ''
92 Local address(es) to use for IKE communication. Takes
93 single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.
94
95 As initiator, the first non-range/non-subnet is used to initiate the
96 connection from. As responder, the local destination address must match at
97 least to one of the specified addresses, subnets or ranges.
98
99 If FQDNs are assigned they are resolved every time a configuration lookup
100 is done. If DNS resolution times out, the lookup is delayed for that time.
101 '';
102
103 remote_addrs = mkCommaSepListParam [ ] ''
104 Remote address(es) to use for IKE communication. Takes
105 single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.
106
107 As initiator, the first non-range/non-subnet is used to initiate the
108 connection to. As responder, the initiator source address must match at
109 least to one of the specified addresses, subnets or ranges.
110
111 If FQDNs are assigned they are resolved every time a configuration lookup
112 is done. If DNS resolution times out, the lookup is delayed for that time.
113 To initiate a connection, at least one specific address or DNS name must
114 be specified.
115 '';
116
117 local_port = mkIntParam 500 ''
118 Local UDP port for IKE communication. By default the port of the socket
119 backend is used, which is usually `500`. If port
120 `500` is used, automatic IKE port floating to port
121 `4500` is used to work around NAT issues.
122
123 Using a non-default local IKE port requires support from the socket
124 backend in use (socket-dynamic).
125 '';
126
127 remote_port = mkIntParam 500 ''
128 Remote UDP port for IKE communication. If the default of port
129 `500` is used, automatic IKE port floating to port
130 `4500` is used to work around NAT issues.
131 '';
132
133 proposals = mkCommaSepListParam [ "default" ] ''
134 A proposal is a set of algorithms. For non-AEAD IKE proposals, this includes
135 an encryption algorithm, an integrity algorithm, a pseudo-random function
136 and a key exchange method. For AEAD proposals, instead of encryption and
137 integrity algorithms, a combined mode algorithm is used.
138
139 With peers that support multiple IKEv2 key exchanges (RFC 9370), up to seven
140 additional key exchanges may be negotiated. They can be configured by
141 prefixing the algorithm keyword with **keX_** (where X is a number between
142 1 and 7).
143
144 For IKEv2, multiple algorithms of the same kind can be specified in a single
145 proposal, from which one gets selected. For IKEv1, only one algorithm per
146 kind is allowed per proposal, more algorithms get implicitly stripped. Use
147 multiple proposals to offer different algorithm combinations with IKEv1.
148
149 Algorithm keywords get separated using dashes. The special value _default_
150 forms a default proposal of supported algorithms considered safe, and is
151 usually a good choice for interoperability.
152 '';
153
154 vips = mkCommaSepListParam [ ] ''
155 List of virtual IPs to request in IKEv2 configuration payloads or IKEv1
156 Mode Config. The wildcard addresses `0.0.0.0` and
157 `::` request an arbitrary address, specific addresses may
158 be defined. The responder may return a different address, though, or none
159 at all.
160 '';
161
162 aggressive = mkYesNoParam no ''
163 Enables Aggressive Mode instead of Main Mode with Identity
164 Protection. Aggressive Mode is considered less secure, because the ID and
165 HASH payloads are exchanged unprotected. This allows a passive attacker to
166 snoop peer identities, and even worse, start dictionary attacks on the
167 Preshared Key.
168 '';
169
170 pull = mkYesNoParam yes ''
171 If the default of yes is used, Mode Config works in pull mode, where the
172 initiator actively requests a virtual IP. With no, push mode is used,
173 where the responder pushes down a virtual IP to the initiating peer.
174
175 Push mode is currently supported for IKEv1, but not in IKEv2. It is used
176 by a few implementations only, pull mode is recommended.
177 '';
178
179 dscp = mkStrParam "000000" ''
180 Differentiated Services Field Codepoint to set on outgoing IKE packets for
181 this connection. The value is a six digit binary encoded string specifying
182 the Codepoint to set, as defined in RFC 2474.
183 '';
184
185 encap = mkYesNoParam no ''
186 To enforce UDP encapsulation of ESP packets, the IKE daemon can fake the
187 NAT detection payloads. This makes the peer believe that NAT takes place
188 on the path, forcing it to encapsulate ESP packets in UDP.
189
190 Usually this is not required, but it can help to work around connectivity
191 issues with too restrictive intermediary firewalls.
192 '';
193
194 mobike = mkYesNoParam yes ''
195 Enables MOBIKE on IKEv2 connections. MOBIKE is enabled by default on IKEv2
196 connections, and allows mobility of clients and multi-homing on servers by
197 migrating active IPsec tunnels.
198
199 Usually keeping MOBIKE enabled is unproblematic, as it is not used if the
200 peer does not indicate support for it. However, due to the design of
201 MOBIKE, IKEv2 always floats to port 4500 starting from the second
202 exchange. Some implementations don't like this behavior, hence it can be
203 disabled.
204 '';
205
206 dpd_delay = mkDurationParam "0s" ''
207 Interval to check the liveness of a peer actively using IKEv2
208 INFORMATIONAL exchanges or IKEv1 R_U_THERE messages. Active DPD checking
209 is only enforced if no IKE or ESP/AH packet has been received for the
210 configured DPD delay.
211 '';
212
213 dpd_timeout = mkDurationParam "0s" ''
214 Charon by default uses the normal retransmission mechanism and timeouts to
215 check the liveness of a peer, as all messages are used for liveness
216 checking. For compatibility reasons, with IKEv1 a custom interval may be
217 specified; this option has no effect on connections using IKEv2.
218 '';
219
220 fragmentation = mkEnumParam [ "yes" "accept" "force" "no" ] "yes" ''
221 Use IKE fragmentation (proprietary IKEv1 extension or RFC 7383 IKEv2
222 fragmentation). Acceptable values are `yes` (the default
223 since 5.5.1), `accept` (since versions:5.5.3),
224 `force` and `no`.
225
226 - If set to `yes`, and the peer
227 supports it, oversized IKE messages will be sent in fragments.
228 - If set to
229 `accept`, support for fragmentation is announced to the peer but the daemon
230 does not send its own messages in fragments.
231 - If set to `force` (only
232 supported for IKEv1) the initial IKE message will already be fragmented if
233 required.
234 - Finally, setting the option to `no` will disable announcing
235 support for this feature.
236
237 Note that fragmented IKE messages sent by a peer are always processed
238 irrespective of the value of this option (even when set to no).
239 '';
240
241 childless = mkEnumParam [ "allow" "prefer" "force" "never" ] "allow" ''
242 Use childless IKE_SA initiation (_allow_, _prefer_, _force_ or _never_).
243
244 Use childless IKE_SA initiation (RFC 6023) for IKEv2, with the first
245 CHILD_SA created with a separate CREATE_CHILD_SA exchange (e.g. to use an
246 independent key exchange for all CHILD_SAs). Acceptable values are _allow_
247 (the default), _prefer_, _force_ and _never_. If set to _allow_, responders
248 will accept childless IKE_SAs (as indicated via notify in the IKE_SA_INIT
249 response) while initiators continue to create regular IKE_SAs with the first
250 CHILD_SA created during IKE_AUTH, unless the IKE_SA is initiated explicitly
251 without any children (which will fail if the responder does not support or
252 has disabled this extension). The effect of _prefer_ is the same as _allow_
253 on responders, but as initiator a childless IKE_SA is initiated if the
254 responder supports it. If set to _force_, only childless initiation is
255 accepted in either role. Finally, setting the option to _never_ disables
256 support for childless IKE_SAs as responder.
257 '';
258
259 send_certreq = mkYesNoParam yes ''
260 Send certificate request payloads to offer trusted root CA certificates to
261 the peer. Certificate requests help the peer to choose an appropriate
262 certificate/private key for authentication and are enabled by default.
263 Disabling certificate requests can be useful if too many trusted root CA
264 certificates are installed, as each certificate request increases the size
265 of the initial IKE packets.
266 '';
267
268 send_cert = mkEnumParam [ "always" "never" "ifasked" ] "ifasked" ''
269 Send certificate payloads when using certificate authentication.
270
271 - With the default of `ifasked` the daemon sends
272 certificate payloads only if certificate requests have been received.
273 - `never` disables sending of certificate payloads
274 altogether,
275 - `always` causes certificate payloads to be sent
276 unconditionally whenever certificate authentication is used.
277 '';
278
279 ppk_id = mkOptionalStrParam ''
280 String identifying the Postquantum Preshared Key (PPK) to be used.
281 '';
282
283 ppk_required = mkYesNoParam no ''
284 Whether a Postquantum Preshared Key (PPK) is required for this connection.
285 '';
286
287 keyingtries = mkIntParam 1 ''
288 Number of retransmission sequences to perform during initial
289 connect. Instead of giving up initiation after the first retransmission
290 sequence with the default value of `1`, additional
291 sequences may be started according to the configured value. A value of
292 `0` initiates a new sequence until the connection
293 establishes or fails with a permanent error.
294 '';
295
296 unique = mkEnumParam [ "no" "never" "keep" "replace" ] "no" ''
297 Connection uniqueness policy to enforce. To avoid multiple connections
298 from the same user, a uniqueness policy can be enforced.
299
300 - The value `never` does never enforce such a policy, even
301 if a peer included INITIAL_CONTACT notification messages,
302 - whereas `no` replaces existing connections for the same
303 identity if a new one has the INITIAL_CONTACT notify.
304 - `keep` rejects new connection attempts if the same user
305 already has an active connection,
306 - `replace` deletes any existing connection if a new one
307 for the same user gets established.
308
309 To compare connections for uniqueness, the remote IKE identity is used. If
310 EAP or XAuth authentication is involved, the EAP-Identity or XAuth
311 username is used to enforce the uniqueness policy instead.
312
313 On initiators this setting specifies whether an INITIAL_CONTACT notify is
314 sent during IKE_AUTH if no existing connection is found with the remote
315 peer (determined by the identities of the first authentication
316 round). Unless set to `never` the client will send a notify.
317 '';
318
319 reauth_time = mkDurationParam "0s" ''
320 Time to schedule IKE reauthentication. IKE reauthentication recreates the
321 IKE/ISAKMP SA from scratch and re-evaluates the credentials. In asymmetric
322 configurations (with EAP or configuration payloads) it might not be
323 possible to actively reauthenticate as responder. The IKEv2
324 reauthentication lifetime negotiation can instruct the client to perform
325 reauthentication.
326
327 Reauthentication is disabled by default. Enabling it can usually result in
328 short connection interruptions, even when using make-before-break
329 reauthentication, which is now the default. However, they are significantly
330 shorter than when using the legacy break-before-make approach.
331 '';
332
333 rekey_time = mkDurationParam "4h" ''
334 IKE rekeying refreshes key material using a Diffie-Hellman exchange, but
335 does not re-check associated credentials. It is supported in IKEv2 only,
336 IKEv1 performs a reauthentication procedure instead.
337
338 With the default value IKE rekeying is scheduled every 4 hours, minus the
339 configured rand_time. If a reauth_time is configured, rekey_time defaults
340 to zero, disabling rekeying; explicitly set both to enforce rekeying and
341 reauthentication.
342 '';
343
344 over_time = mkOptionalDurationParam ''
345 Hard IKE_SA lifetime if rekey/reauth does not complete, as time. To avoid
346 having an IKE/ISAKMP kept alive if IKE reauthentication or rekeying fails
347 perpetually, a maximum hard lifetime may be specified. If the IKE_SA fails
348 to rekey or reauthenticate within the specified time, the IKE_SA gets
349 closed.
350
351 In contrast to CHILD_SA rekeying, over_time is relative in time to the
352 rekey_time and reauth_time values, as it applies to both.
353
354 The default is 10% of the longer of {option}`rekey_time` and
355 {option}`reauth_time`.
356 '';
357
358 rand_time = mkOptionalDurationParam ''
359 Time range from which to choose a random value to subtract from
360 rekey/reauth times. To avoid having both peers initiating the rekey/reauth
361 procedure simultaneously, a random time gets subtracted from the
362 rekey/reauth times.
363
364 The default is equal to the configured {option}`over_time`.
365 '';
366
367 pools = mkCommaSepListParam [ ] ''
368 List of named IP pools to allocate virtual IP addresses
369 and other configuration attributes from. Each name references a pool by
370 name from either the pools section or an external pool.
371 '';
372
373 if_id_in = mkStrParam "0" ''
374 XFRM interface ID set on inbound policies/SA, can be overridden by child
375 config, see there for details.
376
377 The special value `%unique` allocates a unique interface ID per IKE_SA,
378 which is inherited by all its CHILD_SAs (unless overridden there), beyond
379 that the value `%unique-dir` assigns a different unique interface ID for
380 each direction (in/out).
381
382 '';
383
384 if_id_out = mkStrParam "0" ''
385 XFRM interface ID set on outbound policies/SA, can be overridden by child
386 config, see there for details.
387
388 The special value `%unique` allocates a unique interface ID per IKE_SA,
389 which is inherited by all its CHILD_SAs (unless overridden there), beyond
390 that the value `%unique-dir` assigns a different unique interface ID for
391 each direction (in/out).
392 '';
393
394 mediation = mkYesNoParam no ''
395 Whether this connection is a mediation connection, that is, whether this
396 connection is used to mediate other connections using the IKEv2 Mediation
397 Extension. Mediation connections create no CHILD_SA.
398 '';
399
400 mediated_by = mkOptionalStrParam ''
401 The name of the connection to mediate this connection through. If given,
402 the connection will be mediated through the named mediation
403 connection. The mediation connection must have mediation enabled.
404 '';
405
406 mediation_peer = mkOptionalStrParam ''
407 Identity under which the peer is registered at the mediation server, that
408 is, the IKE identity the other end of this connection uses as its local
409 identity on its connection to the mediation server. This is the identity
410 we request the mediation server to mediate us with. Only relevant on
411 connections that set mediated_by. If it is not given, the remote IKE
412 identity of the first authentication round of this connection will be
413 used.
414 '';
415
416 local =
417 mkPrefixedAttrsOfParams
418 {
419
420 round = mkIntParam 0 ''
421 Optional numeric identifier by which authentication rounds are
422 sorted. If not specified rounds are ordered by their position in the
423 config file/vici message.
424 '';
425
426 certs = mkCommaSepListParam [ ] ''
427 List of certificate candidates to use for
428 authentication. The certificates may use a relative path from the
429 swanctl `x509` directory or an absolute path.
430
431 The certificate used for authentication is selected based on the
432 received certificate request payloads. If no appropriate CA can be
433 located, the first certificate is used.
434 '';
435
436 cert = mkPostfixedAttrsOfParams certParams ''
437 Section for a certificate candidate to use for
438 authentication. Certificates in certs are transmitted as binary blobs,
439 these sections offer more flexibility.
440 '';
441
442 pubkeys = mkCommaSepListParam [ ] ''
443 List of raw public key candidates to use for
444 authentication. The public keys may use a relative path from the swanctl
445 `pubkey` directory or an absolute path.
446
447 Even though multiple local public keys could be defined in principle,
448 only the first public key in the list is used for authentication.
449 '';
450
451 auth = mkStrParam "pubkey" ''
452 Authentication to perform locally.
453
454 - The default `pubkey` uses public key authentication
455 using a private key associated to a usable certificate.
456 - `psk` uses pre-shared key authentication.
457 - The IKEv1 specific `xauth` is used for XAuth or Hybrid
458 authentication,
459 - while the IKEv2 specific `eap` keyword defines EAP
460 authentication.
461 - For `xauth`, a specific backend name may be appended,
462 separated by a dash. The appropriate `xauth` backend is
463 selected to perform the XAuth exchange. For traditional XAuth, the
464 `xauth` method is usually defined in the second
465 authentication round following an initial `pubkey` (or
466 `psk`) round. Using `xauth` in the
467 first round performs Hybrid Mode client authentication.
468 - For `eap`, a specific EAP method name may be appended, separated by a
469 dash. An EAP module implementing the appropriate method is selected to
470 perform the EAP conversation.
471 - Since 5.4.0, if both peers support RFC 7427 ("Signature Authentication
472 in IKEv2") specific hash algorithms to be used during IKEv2
473 authentication may be configured. To do so use `ike:`
474 followed by a trust chain signature scheme constraint (see description
475 of the {option}`remote` section's {option}`auth`
476 keyword). For example, with `ike:pubkey-sha384-sha256`
477 a public key signature scheme with either SHA-384 or SHA-256 would get
478 used for authentication, in that order and depending on the hash
479 algorithms supported by the peer. If no specific hash algorithms are
480 configured, the default is to prefer an algorithm that matches or
481 exceeds the strength of the signature key. If no constraints with
482 `ike:` prefix are configured any signature scheme
483 constraint (without `ike:` prefix) will also apply to
484 IKEv2 authentication, unless this is disabled in
485 `strongswan.conf`. To use RSASSA-PSS signatures use
486 `rsa/pss` instead of `pubkey` or
487 `rsa` as in e.g.
488 `ike:rsa/pss-sha256`. If `pubkey` or
489 `rsa` constraints are configured RSASSA-PSS signatures
490 will only be used if enabled in `strongswan.conf`(5).
491 '';
492
493 id = mkOptionalStrParam ''
494 IKE identity to use for authentication round. When using certificate
495 authentication, the IKE identity must be contained in the certificate,
496 either as subject or as subjectAltName.
497 '';
498
499 eap_id = mkOptionalStrParam ''
500 Client EAP-Identity to use in EAP-Identity exchange and the EAP method.
501 '';
502
503 aaa_id = mkOptionalStrParam ''
504 Server side EAP-Identity to expect in the EAP method. Some EAP methods,
505 such as EAP-TLS, use an identity for the server to perform mutual
506 authentication. This identity may differ from the IKE identity,
507 especially when EAP authentication is delegated from the IKE responder
508 to an AAA backend.
509
510 For EAP-(T)TLS, this defines the identity for which the server must
511 provide a certificate in the TLS exchange.
512 '';
513
514 xauth_id = mkOptionalStrParam ''
515 Client XAuth username used in the XAuth exchange.
516 '';
517
518 }
519 ''
520 Section for a local authentication round. A local authentication round
521 defines the rules how authentication is performed for the local
522 peer. Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple
523 Authentication or IKEv1 XAuth.
524
525 Each round is defined in a section having `local` as
526 prefix, and an optional unique suffix. To define a single authentication
527 round, the suffix may be omitted.
528 '';
529
530 remote =
531 mkPrefixedAttrsOfParams
532 {
533
534 round = mkIntParam 0 ''
535 Optional numeric identifier by which authentication rounds are
536 sorted. If not specified rounds are ordered by their position in the
537 config file/vici message.
538 '';
539
540 id = mkStrParam "%any" ''
541 IKE identity to expect for authentication round. When using certificate
542 authentication, the IKE identity must be contained in the certificate,
543 either as subject or as subjectAltName.
544 '';
545
546 eap_id = mkOptionalStrParam ''
547 Identity to use as peer identity during EAP authentication. If set to
548 `%any` the EAP-Identity method will be used to ask the
549 client for an EAP identity.
550 '';
551
552 groups = mkCommaSepListParam [ ] ''
553 Authorization group memberships to require. The peer
554 must prove membership to at least one of the specified groups. Group
555 membership can be certified by different means, for example by
556 appropriate Attribute Certificates or by an AAA backend involved in the
557 authentication.
558 '';
559
560 cert_policy = mkCommaSepListParam [ ] ''
561 List of certificate policy OIDs the peer's certificate
562 must have. OIDs are specified using the numerical dotted representation.
563 '';
564
565 certs = mkCommaSepListParam [ ] ''
566 List of certificates to accept for authentication. The certificates may
567 use a relative path from the swanctl `x509` directory
568 or an absolute path.
569 '';
570
571 cert = mkPostfixedAttrsOfParams certParams ''
572 Section for a certificate candidate to use for
573 authentication. Certificates in certs are transmitted as binary blobs,
574 these sections offer more flexibility.
575 '';
576
577 ca_id = mkOptionalStrParam ''
578 Identity in CA certificate to accept for authentication. The specified
579 identity must be contained in one (intermediate) CA of the remote peer
580 trustchain, either as subject or as subjectAltName. This has the same
581 effect as specifying `cacerts` to force clients under
582 a CA to specific connections; it does not require the CA certificate
583 to be available locally, and can be received from the peer during the
584 IKE exchange.
585 '';
586
587 cacerts = mkCommaSepListParam [ ] ''
588 List of CA certificates to accept for
589 authentication. The certificates may use a relative path from the
590 swanctl `x509ca` directory or an absolute path.
591 '';
592
593 cacert = mkPostfixedAttrsOfParams certParams ''
594 Section for a CA certificate to accept for authentication. Certificates
595 in cacerts are transmitted as binary blobs, these sections offer more
596 flexibility.
597 '';
598
599 pubkeys = mkCommaSepListParam [ ] ''
600 List of raw public keys to accept for
601 authentication. The public keys may use a relative path from the swanctl
602 `pubkey` directory or an absolute path.
603 '';
604
605 revocation = mkEnumParam [ "strict" "ifuri" "relaxed" ] "relaxed" ''
606 Certificate revocation policy for CRL or OCSP revocation.
607
608 - A `strict` revocation policy fails if no revocation information is
609 available, i.e. the certificate is not known to be unrevoked.
610 - `ifuri` fails only if a CRL/OCSP URI is available, but certificate
611 revocation checking fails, i.e. there should be revocation information
612 available, but it could not be obtained.
613 - The default revocation policy `relaxed` fails only if a certificate is
614 revoked, i.e. it is explicitly known that it is bad.
615 '';
616
617 auth = mkStrParam "pubkey" ''
618 Authentication to expect from remote. See the {option}`local`
619 section's {option}`auth` keyword description about the details of
620 supported mechanisms.
621
622 Since 5.4.0, to require a trustchain public key strength for the remote
623 side, specify the key type followed by the minimum strength in bits (for
624 example `ecdsa-384` or
625 `rsa-2048-ecdsa-256`). To limit the acceptable set of
626 hashing algorithms for trustchain validation, append hash algorithms to
627 pubkey or a key strength definition (for example
628 `pubkey-sha256-sha512`,
629 `rsa-2048-sha256-sha384-sha512` or
630 `rsa-2048-sha256-ecdsa-256-sha256-sha384`).
631 Unless disabled in `strongswan.conf`, or explicit IKEv2
632 signature constraints are configured (refer to the description of the
633 {option}`local` section's {option}`auth` keyword for
634 details), such key types and hash algorithms are also applied as
635 constraints against IKEv2 signature authentication schemes used by the
636 remote side. To require RSASSA-PSS signatures use
637 `rsa/pss` instead of `pubkey` or
638 `rsa` as in e.g. `rsa/pss-sha256`. If
639 `pubkey` or `rsa` constraints are
640 configured RSASSA-PSS signatures will only be accepted if enabled in
641 `strongswan.conf`(5).
642
643 To specify trust chain constraints for EAP-(T)TLS, append a colon to the
644 EAP method, followed by the key type/size and hash algorithm as
645 discussed above (e.g. `eap-tls:ecdsa-384-sha384`).
646 '';
647
648 }
649 ''
650 Section for a remote authentication round. A remote authentication round
651 defines the constraints how the peers must authenticate to use this
652 connection. Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple
653 Authentication or IKEv1 XAuth.
654
655 Each round is defined in a section having `remote` as
656 prefix, and an optional unique suffix. To define a single authentication
657 round, the suffix may be omitted.
658 '';
659
660 children =
661 mkAttrsOfParams
662 {
663 ah_proposals = mkCommaSepListParam [ ] ''
664 AH proposals to offer for the CHILD_SA. A proposal is a set of algorithms.
665 For AH, this includes an integrity algorithm and an optional key exchange
666 method. If a KE method is specified, CHILD_SA/Quick Mode rekeying and
667 initial negotiation uses a separate key exchange using the negotiated method
668 (refer to _esp_proposals_ for details).
669
670 With peers that support multiple IKEv2 key exchanges (RFC 9370), up to seven
671 additional key exchanges may be negotiated. They can be configured by
672 prefixing the algorithm keyword with **keX_** (where X is a number between
673 1 and 7).
674
675 For IKEv2, multiple algorithms of the same kind can be specified in a single
676 proposal, from which one gets selected. For IKEv1, only one algorithm per
677 kind is allowed per proposal, more algorithms get implicitly stripped. Use
678 multiple proposals to offer different algorithm combinations with IKEv1.
679
680 Algorithm keywords get separated using dashes. The special value _default_
681 forms a default proposal of supported algorithms considered safe, and is
682 usually a good choice for interoperability. By default no AH proposals
683 are included, instead ESP is proposed.
684 '';
685
686 esp_proposals = mkCommaSepListParam [ "default" ] ''
687 ESP proposals to offer for the CHILD_SA. A proposal is a set of algorithms.
688 For non-AEAD ESP proposals, this includes an integrity algorithm, an
689 encryption algorithm, an optional key exchange method and an optional
690 Extended Sequence Number Mode indicator. For AEAD proposals, a combined
691 mode algorithm is used instead of the separate encryption/integrity
692 algorithms.
693
694 If a key exchange method is specified, CHILD_SA/Quick Mode rekeying and
695 initial negotiation use a separate key exchange using the specified method.
696 However, for IKEv2, the keys of the CHILD_SA created implicitly with the
697 IKE_SA will always be derived from the IKE_SA's key material. So any key
698 exchange method specified here will only apply when the CHILD_SA is later
699 rekeyed or is created with a separate CREATE_CHILD_SA exchange. A proposal
700 mismatch might, therefore, not immediately be noticed when the SA is
701 established, but may later cause rekeying to fail.
702
703 With peers that support multiple IKEv2 key exchanges (RFC 9370), up to seven
704 additional key exchanges may be negotiated. They can be configured by
705 prefixing the algorithm keyword with **keX_** (where X is a number between
706 1 and 7).
707
708 Extended Sequence Number support may be indicated with the _esn_ and _noesn_
709 values, both may be included to indicate support for both modes. If omitted,
710 _noesn_ is assumed.
711
712 For IKEv2, multiple algorithms of the same kind can be specified in a single
713 proposal, from which one gets selected. For IKEv1, only one algorithm per
714 kind is allowed per proposal, more algorithms get implicitly stripped. Use
715 multiple proposals to offer different algorithm combinations with IKEv1.
716
717 Algorithm keywords get separated using dashes. The special value _default_
718 forms a default proposal of supported algorithms considered safe, and is
719 usually a good choice for interoperability. If no algorithms are specified
720 for AH nor ESP, the _default_ set of algorithms for ESP is included.
721 '';
722
723 sha256_96 = mkYesNoParam no ''
724 HMAC-SHA-256 is used with 128-bit truncation with IPsec. For
725 compatibility with implementations that incorrectly use 96-bit truncation
726 this option may be enabled to configure the shorter truncation length in
727 the kernel. This is not negotiated, so this only works with peers that
728 use the incorrect truncation length (or have this option enabled).
729 '';
730
731 local_ts = mkCommaSepListParam [ "dynamic" ] ''
732 List of local traffic selectors to include in CHILD_SA.
733 Each selector is a CIDR subnet definition, followed by an optional
734 proto/port selector. The special value _dynamic_ may be used instead of a
735 subnet definition, which gets replaced by the tunnel outer address or the
736 virtual IP, if negotiated. This is the default.
737
738 A protocol/port selector is surrounded by opening and closing square
739 brackets. Between these brackets, a numeric or **getservent**(3) protocol
740 name may be specified. After the optional protocol restriction, an optional
741 port restriction may be specified, separated by a slash. The port
742 restriction may be numeric, a **getservent**(3) service name, or the special
743 value _opaque_ for RFC 4301 OPAQUE selectors. Port ranges may be specified
744 as well, none of the kernel backends currently support port ranges, though.
745 If the protocol is _icmp_ or _ipv6-icmp_, the port is interpreted as ICMP
746 message type if it is less than 256 or as type and code if it is greater or
747 equal to 256, with the type in the most significant 8 bits and the code in
748 the least significant 8 bits.
749
750 When IKEv1 is used only the first selector is interpreted, except if
751 the Cisco Unity extension plugin is used. This is due to a limitation of the
752 IKEv1 protocol, which only allows a single pair of selectors per CHILD_SA.
753 So to tunnel traffic matched by several pairs of selectors when using IKEv1
754 several children (CHILD_SAs) have to be defined that cover the selectors.
755
756 The IKE daemon uses traffic selector narrowing for IKEv1, the same way it is
757 standardized and implemented for IKEv2. However, this may lead to problems
758 with other implementations. To avoid that, configure identical selectors in
759 such scenarios.
760 '';
761
762 remote_ts = mkCommaSepListParam [ "dynamic" ] ''
763 List of remote selectors to include in CHILD_SA. See
764 {option}`local_ts` for a description of the selector syntax.
765 '';
766
767 rekey_time = mkOptionalDurationParam ''
768 Time to schedule CHILD_SA rekeying. CHILD_SA rekeying refreshes key
769 material, optionally using a Diffie-Hellman exchange if a group is
770 specified in the proposal.
771
772 To avoid rekey collisions initiated by both ends simultaneously, a value
773 in the range of {option}`rand_time` gets subtracted to form the effective soft
774 lifetime.
775
776 If {option}`life_time` is explicitly configured, {option}`rekey_time` defaults to 10%
777 less than that, otherwise, CHILD_SA rekeying is scheduled every hour, minus
778 {option}`rand_time`.
779 '';
780
781 life_time = mkOptionalDurationParam ''
782 Maximum lifetime before CHILD_SA gets closed. Usually this hard lifetime
783 is never reached, because the CHILD_SA gets rekeyed before. If that fails
784 for whatever reason, this limit closes the CHILD_SA. The default is 10%
785 more than the {option}`rekey_time`.
786 '';
787
788 rand_time = mkOptionalDurationParam ''
789 Time range from which to choose a random value to subtract from
790 {option}`rekey_time`. The default is the difference between
791 {option}`life_time` and {option}`rekey_time`.
792 '';
793
794 rekey_bytes = mkOptionalIntParam ''
795 Number of bytes processed before initiating CHILD_SA rekeying.
796
797 Number of bytes processed before initiating CHILD_SA rekeying. CHILD_SA
798 rekeying refreshes key material, optionally using a Diffie-Hellman exchange
799 if a group is specified in the proposal.
800
801 To avoid rekey collisions initiated by both ends simultaneously, a value
802 in the range of {option}`rand_bytes` gets subtracted to form the effective soft
803 volume limit.
804
805 Volume based CHILD_SA rekeying is disabled by default. If {option}`life_bytes`
806 is explicitly configured, {option}`rekey_bytes` defaults to 10% less than that.
807 '';
808
809 life_bytes = mkOptionalIntParam ''
810 Maximum bytes processed before CHILD_SA gets closed. Usually this hard
811 volume limit is never reached, because the CHILD_SA gets rekeyed
812 before. If that fails for whatever reason, this limit closes the
813 CHILD_SA. The default is 10% more than {option}`rekey_bytes`.
814 '';
815
816 rand_bytes = mkOptionalIntParam ''
817 Byte range from which to choose a random value to subtract from
818 {option}`rekey_bytes`. The default is the difference between
819 {option}`life_bytes` and {option}`rekey_bytes`.
820 '';
821
822 rekey_packets = mkOptionalIntParam ''
823 Number of packets processed before initiating CHILD_SA rekeying.
824
825 Number of packets processed before initiating CHILD_SA rekeying. CHILD_SA
826 rekeying refreshes key material, optionally using a Diffie-Hellman exchange
827 if a group is specified in the proposal.
828
829 To avoid rekey collisions initiated by both ends simultaneously, a value
830 in the range of {option}`rand_packets` gets subtracted to form the effective soft
831 packet count limit.
832
833 Packet count based CHILD_SA rekeying is disabled by default. If
834 {option}`life_packets` is explicitly configured, {option}`rekey_packets` defaults to
835 10% less than that.
836 '';
837
838 life_packets = mkOptionalIntParam ''
839 Maximum number of packets processed before CHILD_SA gets closed. Usually
840 this hard packets limit is never reached, because the CHILD_SA gets
841 rekeyed before. If that fails for whatever reason, this limit closes the
842 CHILD_SA.
843
844 The default is 10% more than {option}`rekey_bytes`.
845 '';
846
847 rand_packets = mkOptionalIntParam ''
848 Packet range from which to choose a random value to subtract from
849 {option}`rekey_packets`. The default is the difference between
850 {option}`life_packets` and {option}`rekey_packets`.
851 '';
852
853 updown = mkOptionalStrParam ''
854 Updown script to invoke on CHILD_SA up and down events.
855 '';
856
857 hostaccess = mkYesNoParam no ''
858 Hostaccess variable to pass to `updown` script.
859 '';
860
861 mode =
862 mkEnumParam
863 [
864 "tunnel"
865 "transport"
866 "transport_proxy"
867 "beet"
868 "pass"
869 "drop"
870 ]
871 "tunnel"
872 ''
873 IPsec Mode to establish CHILD_SA with.
874
875 - `tunnel` negotiates the CHILD_SA in IPsec Tunnel Mode,
876 - whereas `transport` uses IPsec Transport Mode.
877 - `transport_proxy` signifying the special Mobile IPv6
878 Transport Proxy Mode.
879 - `beet` is the Bound End to End Tunnel mixture mode,
880 working with fixed inner addresses without the need to include them in
881 each packet.
882 - Both `transport` and `beet` modes are
883 subject to mode negotiation; `tunnel` mode is
884 negotiated if the preferred mode is not available.
885 - `pass` and `drop` are used to install
886 shunt policies which explicitly bypass the defined traffic from IPsec
887 processing or drop it, respectively.
888 '';
889
890 policies = mkYesNoParam yes ''
891 Whether to install IPsec policies or not. Disabling this can be useful in
892 some scenarios e.g. MIPv6, where policies are not managed by the IKE
893 daemon. Since 5.3.3.
894 '';
895
896 policies_fwd_out = mkYesNoParam no ''
897 Whether to install outbound FWD IPsec policies or not. Enabling this is
898 required in case there is a drop policy that would match and block
899 forwarded traffic for this CHILD_SA. Since 5.5.1.
900 '';
901
902 dpd_action = mkEnumParam [ "clear" "trap" "restart" ] "clear" ''
903 Action to perform for this CHILD_SA on DPD timeout. The default clear
904 closes the CHILD_SA and does not take further action. trap installs a
905 trap policy, which will catch matching traffic and tries to re-negotiate
906 the tunnel on-demand. restart immediately tries to re-negotiate the
907 CHILD_SA under a fresh IKE_SA.
908 '';
909
910 ipcomp = mkYesNoParam no ''
911 Enable IPComp compression before encryption. If enabled, IKE tries to
912 negotiate IPComp compression to compress ESP payload data prior to
913 encryption.
914 '';
915
916 inactivity = mkDurationParam "0s" ''
917 Timeout before closing CHILD_SA after inactivity. If no traffic has been
918 processed in either direction for the configured timeout, the CHILD_SA
919 gets closed due to inactivity. The default value of 0 disables inactivity
920 checks.
921 '';
922
923 reqid = mkIntParam 0 ''
924 Fixed reqid to use for this CHILD_SA. This might be helpful in some
925 scenarios, but works only if each CHILD_SA configuration is instantiated
926 not more than once. The default of 0 uses dynamic reqids, allocated
927 incrementally.
928 '';
929
930 priority = mkIntParam 0 ''
931 Optional fixed priority for IPsec policies. This could be useful to
932 install high-priority drop policies. The default of 0 uses dynamically
933 calculated priorities based on the size of the traffic selectors.
934 '';
935
936 interface = mkOptionalStrParam ''
937 Optional interface name to restrict outbound IPsec policies.
938 '';
939
940 mark_in = mkStrParam "0/0x00000000" ''
941 Netfilter mark and mask for input traffic. On Linux, Netfilter may
942 require marks on each packet to match an SA/policy having that option
943 set. This allows installing duplicate policies and enables Netfilter
944 rules to select specific SAs/policies for incoming traffic. Note that
945 inbound marks are only set on policies, by default, unless
946 {option}`mark_in_sa` is enabled. The special value
947 `%unique` sets a unique mark on each CHILD_SA instance,
948 beyond that the value `%unique-dir` assigns a different
949 unique mark for each
950
951 An additional mask may be appended to the mark, separated by
952 `/`. The default mask if omitted is
953 `0xffffffff`.
954 '';
955
956 mark_in_sa = mkYesNoParam no ''
957 Whether to set {option}`mark_in` on the inbound SA. By default,
958 the inbound mark is only set on the inbound policy. The tuple destination
959 address, protocol and SPI is unique and the mark is not required to find
960 the correct SA, allowing to mark traffic after decryption instead (where
961 more specific selectors may be used) to match different policies. Marking
962 packets before decryption is still possible, even if no mark is set on
963 the SA.
964 '';
965
966 mark_out = mkStrParam "0/0x00000000" ''
967 Netfilter mark and mask for output traffic. On Linux, Netfilter may
968 require marks on each packet to match a policy/SA having that option
969 set. This allows installing duplicate policies and enables Netfilter
970 rules to select specific policies/SAs for outgoing traffic. The special
971 value `%unique` sets a unique mark on each CHILD_SA
972 instance, beyond that the value `%unique-dir` assigns a
973 different unique mark for each CHILD_SA direction (in/out).
974
975 An additional mask may be appended to the mark, separated by
976 `/`. The default mask if omitted is
977 `0xffffffff`.
978 '';
979
980 set_mark_in = mkStrParam "0/0x00000000" ''
981 Netfilter mark applied to packets after the inbound IPsec SA processed
982 them. This way it's not necessary to mark packets via Netfilter before
983 decryption or right afterwards to match policies or process them
984 differently (e.g. via policy routing).
985
986 An additional mask may be appended to the mark, separated by
987 `/`. The default mask if omitted is 0xffffffff. The
988 special value `%same` uses the value (but not the mask)
989 from {option}`mark_in` as mark value, which can be fixed,
990 `%unique` or `%unique-dir`.
991
992 Setting marks in XFRM input requires Linux 4.19 or higher.
993 '';
994
995 set_mark_out = mkStrParam "0/0x00000000" ''
996 Netfilter mark applied to packets after the outbound IPsec SA processed
997 them. This allows processing ESP packets differently than the original
998 traffic (e.g. via policy routing).
999
1000 An additional mask may be appended to the mark, separated by
1001 `/`. The default mask if omitted is 0xffffffff. The
1002 special value `%same` uses the value (but not the mask)
1003 from {option}`mark_out` as mark value, which can be fixed,
1004 `%unique_` or `%unique-dir`.
1005
1006 Setting marks in XFRM output is supported since Linux 4.14. Setting a
1007 mask requires at least Linux 4.19.
1008 '';
1009
1010 if_id_in = mkStrParam "0" ''
1011 XFRM interface ID set on inbound policies/SA. This allows installing
1012 duplicate policies/SAs and associates them with an interface with the
1013 same ID. The special value `%unique` sets a unique
1014 interface ID on each CHILD_SA instance, beyond that the value
1015 `%unique-dir` assigns a different unique interface ID
1016 for each CHILD_SA direction (in/out).
1017 '';
1018
1019 if_id_out = mkStrParam "0" ''
1020 XFRM interface ID set on outbound policies/SA. This allows installing
1021 duplicate policies/SAs and associates them with an interface with the
1022 same ID. The special value `%unique` sets a unique
1023 interface ID on each CHILD_SA instance, beyond that the value
1024 `%unique-dir` assigns a different unique interface ID
1025 for each CHILD_SA direction (in/out).
1026
1027 The daemon will not install routes for CHILD_SAs that have this option set.
1028 '';
1029
1030 tfc_padding = mkParamOfType (with lib.types; either int (enum [ "mtu" ])) 0 ''
1031 Pads ESP packets with additional data to have a consistent ESP packet
1032 size for improved Traffic Flow Confidentiality. The padding defines the
1033 minimum size of all ESP packets sent. The default value of
1034 `0` disables TFC padding, the special value
1035 `mtu` adds TFC padding to create a packet size equal to
1036 the Path Maximum Transfer Unit.
1037 '';
1038
1039 replay_window = mkIntParam 32 ''
1040 IPsec replay window to configure for this CHILD_SA. Larger values than
1041 the default of `32` are supported using the Netlink
1042 backend only, a value of `0` disables IPsec replay
1043 protection.
1044 '';
1045
1046 per_cpu_sas = mkEnumParam [ "yes" "no" "encap" ] "no" ''
1047 Enable per-CPU CHILD_SAs. Requires `trap` in `start_action`.
1048 The value `encap` enables a special type of UDP encapsulation
1049 (requires enabling `encap` for the connection if there is no NAT),
1050 where a random source port is used for each outbound per-CPU SA
1051 (the destination port for all of them remains 4500). This allows
1052 using the port for RSS if the SPI can’t be used. Note that this type
1053 of behavior is not standardized and not negotiated. So regardless
1054 of whether the option is enabled, inbound per-CPU SAs
1055 with UDP-encapsulation always have the source port set to 0
1056 as the peer’s random port is unknown if it has this option enabled.
1057 '';
1058
1059 hw_offload = mkEnumParam [ "yes" "no" "auto" "crypto" "packet" ] "no" ''
1060 Enable hardware offload for this CHILD_SA, if supported by the IPsec
1061 implementation. The values `crypto` or `packet` enforce crypto or full
1062 packet offloading and the installation will fail if the selected mode is not
1063 supported by either kernel or device. On Linux, `packet` also offloads
1064 policies, including trap policies. The value `auto` enables full packet
1065 or crypto offloading, if either is supported, but the installation does not
1066 fail otherwise.
1067 '';
1068
1069 copy_df = mkYesNoParam yes ''
1070 Whether to copy the DF bit to the outer IPv4 header in tunnel mode. This
1071 effectively disables Path MTU discovery (PMTUD). Controlling this
1072 behavior is not supported by all kernel interfaces.
1073 '';
1074
1075 copy_ecn = mkYesNoParam yes ''
1076 Whether to copy the ECN (Explicit Congestion Notification) header field
1077 to/from the outer IP header in tunnel mode. Controlling this behavior is
1078 not supported by all kernel interfaces.
1079 '';
1080
1081 copy_dscp = mkEnumParam [ "out" "in" "yes" "no" ] "out" ''
1082 Whether to copy the DSCP (Differentiated Services Field Codepoint)
1083 header field to/from the outer IP header in tunnel mode. The value
1084 `out` only copies the field from the inner to the outer
1085 header, the value `in` does the opposite and only
1086 copies the field from the outer to the inner header when decapsulating,
1087 the value `yes` copies the field in both directions,
1088 and the value `no` disables copying the field
1089 altogether. Setting this to `yes` or
1090 `in` could allow an attacker to adversely affect other
1091 traffic at the receiver, which is why the default is
1092 `out`. Controlling this behavior is not supported by
1093 all kernel interfaces.
1094 '';
1095
1096 start_action = mkEnumParam [ "none" "trap" "start" "trap|start" ] "none" ''
1097 Action to perform after loading the configuration.
1098
1099 - The default of `none` loads the connection only, which
1100 then can be manually initiated or used as a responder configuration.
1101 - The value `trap` installs a trap policy, which triggers
1102 the tunnel as soon as matching traffic has been detected.
1103 - The value `start` initiates the connection actively.
1104 - Since version 5.9.6 two modes above can be combined with `trap|start`,
1105 to immediately initiate a connection for which trap policies have been installed.
1106
1107 When unloading or replacing a CHILD_SA configuration having a
1108 {option}`start_action` different from `none`,
1109 the inverse action is performed. Configurations with
1110 `start` get closed, while such with
1111 `trap` get uninstalled.
1112 '';
1113
1114 close_action = mkEnumParam [ "none" "trap" "start" ] "none" ''
1115 Action to perform after a CHILD_SA gets closed by the peer.
1116
1117 - The default of `none` does not take any action,
1118 - `trap` installs a trap policy for the CHILD_SA.
1119 - `start` tries to re-create the CHILD_SA.
1120
1121 {option}`close_action` does not provide any guarantee that the
1122 CHILD_SA is kept alive. It acts on explicit close messages only, but not
1123 on negotiation failures. Use trap policies to reliably re-create failed
1124 CHILD_SAs.
1125 '';
1126
1127 }
1128 ''
1129 CHILD_SA configuration sub-section. Each connection definition may have
1130 one or more sections in its {option}`children` subsection. The
1131 section name defines the name of the CHILD_SA configuration, which must be
1132 unique within the connection (denoted \<child\> below).
1133 '';
1134 }
1135 ''
1136 Section defining IKE connection configurations, each in its own subsection
1137 with an arbitrary yet unique name
1138 '';
1139
1140 secrets =
1141 let
1142 mkEapXauthParams =
1143 mkPrefixedAttrsOfParams
1144 {
1145 secret = mkOptionalStrParam ''
1146 Value of the EAP/XAuth secret. It may either be an ASCII string, a hex
1147 encoded string if it has a 0x prefix or a Base64 encoded string if it
1148 has a 0s prefix in its value.
1149 '';
1150
1151 id = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''
1152 Identity the EAP/XAuth secret belongs to. Multiple unique identities may
1153 be specified, each having an `id` prefix, if a secret
1154 is shared between multiple users.
1155 '';
1156
1157 }
1158 ''
1159 EAP secret section for a specific secret. Each EAP secret is defined in a
1160 unique section having the `eap` prefix. EAP secrets are
1161 used for XAuth authentication as well.
1162 '';
1163
1164 in
1165 {
1166
1167 eap = mkEapXauthParams;
1168 xauth = mkEapXauthParams;
1169
1170 ntlm =
1171 mkPrefixedAttrsOfParams
1172 {
1173 secret = mkOptionalStrParam ''
1174 Value of the NTLM secret, which is the NT Hash of the actual secret,
1175 that is, MD4(UTF-16LE(secret)). The resulting 16-byte value may either
1176 be given as a hex encoded string with a 0x prefix or as a Base64 encoded
1177 string with a 0s prefix.
1178 '';
1179
1180 id = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''
1181 Identity the NTLM secret belongs to. Multiple unique identities may be
1182 specified, each having an id prefix, if a secret is shared between
1183 multiple users.
1184 '';
1185 }
1186 ''
1187 NTLM secret section for a specific secret. Each NTLM secret is defined in
1188 a unique section having the `ntlm` prefix. NTLM secrets
1189 may only be used for EAP-MSCHAPv2 authentication.
1190 '';
1191
1192 ike =
1193 mkPrefixedAttrsOfParams
1194 {
1195 secret = mkOptionalStrParam ''
1196 Value of the IKE preshared secret. It may either be an ASCII string, a
1197 hex encoded string if it has a 0x prefix or a Base64 encoded string if
1198 it has a 0s prefix in its value.
1199 '';
1200
1201 id = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''
1202 IKE identity the IKE preshared secret belongs to. Multiple unique
1203 identities may be specified, each having an `id`
1204 prefix, if a secret is shared between multiple peers.
1205 '';
1206 }
1207 ''
1208 IKE preshared secret section for a specific secret. Each IKE PSK is
1209 defined in a unique section having the `ike` prefix.
1210 '';
1211
1212 ppk =
1213 mkPrefixedAttrsOfParams
1214 {
1215 secret = mkOptionalStrParam ''
1216 Value of the PPK. It may either be an ASCII string, a hex encoded string
1217 if it has a `0x` prefix or a Base64 encoded string if
1218 it has a `0s` prefix in its value. Should have at least
1219 256 bits of entropy for 128-bit security.
1220 '';
1221
1222 id = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''
1223 PPK identity the PPK belongs to. Multiple unique identities may be
1224 specified, each having an `id` prefix, if a secret is
1225 shared between multiple peers.
1226 '';
1227 }
1228 ''
1229 Postquantum Preshared Key (PPK) section for a specific secret. Each PPK is
1230 defined in a unique section having the `ppk` prefix.
1231 '';
1232
1233 private =
1234 mkPrefixedAttrsOfParams
1235 {
1236 file = mkOptionalStrParam ''
1237 File name in the private folder for which this passphrase should be used.
1238 '';
1239
1240 secret = mkOptionalStrParam ''
1241 Value of decryption passphrase for private key.
1242 '';
1243 }
1244 ''
1245 Private key decryption passphrase for a key in the
1246 `private` folder.
1247 '';
1248
1249 rsa =
1250 mkPrefixedAttrsOfParams
1251 {
1252 file = mkOptionalStrParam ''
1253 File name in the `rsa` folder for which this passphrase
1254 should be used.
1255 '';
1256 secret = mkOptionalStrParam ''
1257 Value of decryption passphrase for RSA key.
1258 '';
1259 }
1260 ''
1261 Private key decryption passphrase for a key in the `rsa`
1262 folder.
1263 '';
1264
1265 ecdsa =
1266 mkPrefixedAttrsOfParams
1267 {
1268 file = mkOptionalStrParam ''
1269 File name in the `ecdsa` folder for which this
1270 passphrase should be used.
1271 '';
1272 secret = mkOptionalStrParam ''
1273 Value of decryption passphrase for ECDSA key.
1274 '';
1275 }
1276 ''
1277 Private key decryption passphrase for a key in the
1278 `ecdsa` folder.
1279 '';
1280
1281 pkcs8 =
1282 mkPrefixedAttrsOfParams
1283 {
1284 file = mkOptionalStrParam ''
1285 File name in the `pkcs8` folder for which this
1286 passphrase should be used.
1287 '';
1288 secret = mkOptionalStrParam ''
1289 Value of decryption passphrase for PKCS#8 key.
1290 '';
1291 }
1292 ''
1293 Private key decryption passphrase for a key in the
1294 `pkcs8` folder.
1295 '';
1296
1297 pkcs12 =
1298 mkPrefixedAttrsOfParams
1299 {
1300 file = mkOptionalStrParam ''
1301 File name in the `pkcs12` folder for which this
1302 passphrase should be used.
1303 '';
1304 secret = mkOptionalStrParam ''
1305 Value of decryption passphrase for PKCS#12 container.
1306 '';
1307 }
1308 ''
1309 PKCS#12 decryption passphrase for a container in the
1310 `pkcs12` folder.
1311 '';
1312
1313 token = mkPrefixedAttrsOfParams {
1314 handle = mkOptionalHexParam ''
1315 Hex-encoded CKA_ID or handle of the private key on the token or TPM,
1316 respectively.
1317 '';
1318
1319 slot = mkOptionalIntParam ''
1320 Optional slot number to access the token.
1321 '';
1322
1323 module = mkOptionalStrParam ''
1324 Optional PKCS#11 module name to access the token.
1325 '';
1326
1327 pin = mkOptionalStrParam ''
1328 Optional PIN required to access the key on the token. If none is
1329 provided the user is prompted during an interactive
1330 `--load-creds` call.
1331 '';
1332 } "Definition for a private key that's stored on a token/smartcard/TPM.";
1333
1334 };
1335
1336 pools =
1337 mkAttrsOfParams
1338 {
1339 addrs = mkOptionalStrParam ''
1340 Addresses allocated in pool.
1341
1342 Subnet or range defining addresses allocated in pool. Accepts a single CIDR
1343 subnet defining the pool to allocate addresses from or an address range
1344 (<from>-<to>). If the address in CIDR notation is not the network ID of the
1345 subnet (e.g. 10.1.0.5/24 instead of 10.1.0.0/24), addresses below it won't
1346 be allocated to clients (they could e.g. be assigned manually to internal
1347 hosts like the VPN server itself). Pools must be unique and non-overlapping
1348 '';
1349
1350 dns = mkCommaSepListParam [ ] "Address or CIDR subnets";
1351 nbns = mkCommaSepListParam [ ] "Address or CIDR subnets";
1352 dhcp = mkCommaSepListParam [ ] "Address or CIDR subnets";
1353 netmask = mkCommaSepListParam [ ] "Address or CIDR subnets";
1354 server = mkCommaSepListParam [ ] "Address or CIDR subnets";
1355 subnet = mkCommaSepListParam [ ] "Address or CIDR subnets";
1356 split_include = mkCommaSepListParam [ ] "Address or CIDR subnets";
1357 split_exclude = mkCommaSepListParam [ ] "Address or CIDR subnets";
1358 }
1359 ''
1360 Section defining named pools. Named pools may be referenced by connections
1361 with the pools option to assign virtual IPs and other configuration
1362 attributes. Each pool must have a unique name (denoted \<name\> below).
1363 '';
1364}